refactor(glob): back env matching with globset, split EnvGlob / PathGlobSet

`vite_glob` wraps `wax`, a filesystem path-glob engine, but most callers
use it to match environment-variable *names* — flat strings that are not
paths — by pushing `&str` through `is_match(impl AsRef<Path>)`. That is
semantically muddy, and `wax` exposes no option to disable its path
semantics (separators, rooting, `**`).

Split the crate into two purpose-built matchers:

- `EnvGlob` — a single env-name matcher backed by `globset` with
  `literal_separator(false)` and `case_insensitive(cfg!(windows))`, so
  `*`/`?`/`[...]`/`{a,b}` behave as pure flat-string wildcards with the
  platform's env case rules (sensitive on Unix, insensitive on Windows).
  `!` is an ordinary character — there is no negation.
- `PathGlobSet` — the former `GlobPatternSet`, renamed; still `wax`-backed
  with unchanged gitignore (first/last-match-wins) path semantics.

This mirrors how Turborepo splits env (regex) from path (wax) matching.
Env results are unchanged: globset matches the same `*`/`?`/`[...]`/`{}`
syntax wax did for separator-free names, including SENSITIVE_PATTERNS and
the Unix/Windows case split (covered by existing envs.rs tests).

Migrate the pre-existing callers: `envs.rs` compiles `Vec<EnvGlob>` and
matches with `.any(...)` (dropping the now-unnecessary `!`-filtering and
its warning), and `vite_workspace` switches to `PathGlobSet`. The new
runner-aware env-matching sites consume `EnvGlob` in the follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: wan9chi

Cargo.lock

@@ -80,6 +80,7 @@ fspy_shared = { path = "crates/fspy_shared" }
 fspy_shared_unix = { path = "crates/fspy_shared_unix" }
 futures = "0.3.31"
 futures-util = "0.3.31"
+globset = "0.4.18"
 jsonc-parser = { version = "0.32.0", features = ["serde"] }
 libc = "0.2.185"
 libtest-mimic = "0.8.2"

Cargo.toml

@@ -8,6 +8,7 @@ publish = false
 rust-version.workspace = true
 
 [dependencies]
+globset = { workspace = true }
 thiserror = { workspace = true }
 vite_path = { workspace = true }
 wax = { workspace = true }

crates/vite_glob/Cargo.toml

@@ -1,5 +1,7 @@
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
+    #[error(transparent)]
+    Globset(#[from] globset::Error),
     #[error(transparent)]
     WaxBuild(#[from] wax::BuildError),
     #[error(transparent)]

crates/vite_glob/src/error.rs

@@ -6,16 +6,53 @@ use std::path::Path;
 pub use error::Error;
 use wax::{Glob, Program};
 
+/// Matches a single environment-variable **name** as a flat string.
+///
+/// Backed by `globset` with path-separator handling disabled, so `*`, `?`,
+/// `[...]`, and `{a,b}` behave as plain-string wildcards rather than path globs
+/// (env names are never paths). Matching is case-sensitive on Unix and
+/// case-insensitive on Windows, mirroring how environment variables are looked
+/// up on each platform. `!` is an ordinary character — there is no negation.
+#[derive(Debug, Clone)]
+pub struct EnvGlob {
+    matcher: globset::GlobMatcher,
+}
+
+impl EnvGlob {
+    /// Compiles `pattern` into an env-name matcher.
+    ///
+    /// # Errors
+    /// Returns an error if `pattern` is not a valid glob.
+    pub fn new(pattern: &str) -> Result<Self, Error> {
+        let glob = globset::GlobBuilder::new(pattern)
+            // Env names contain no path separators, so disabling separator
+            // handling makes `*`/`?` match any character — a pure string match.
+            .literal_separator(false)
+            // Env lookups are case-insensitive on Windows, case-sensitive elsewhere.
+            .case_insensitive(cfg!(windows))
+            .build()?;
+        Ok(Self { matcher: glob.compile_matcher() })
+    }
+
+    /// Returns whether `name` matches the pattern.
+    #[must_use]
+    pub fn is_match(&self, name: &str) -> bool {
+        self.matcher.is_match(name)
+    }
+}
+
+/// Matches filesystem **paths** with gitignore semantics.
+///
 /// If there are no negated patterns, it will follow the first match wins semantics.
 /// Otherwise, it will follow the last match wins semantics.
 #[derive(Debug)]
-pub struct GlobPatternSet<'a> {
+pub struct PathGlobSet<'a> {
     /// (`glob_pattern`, `match_or_not`)
     patterns: Vec<(Glob<'a>, bool)>,
     has_negated: bool,
 }
 
-impl<'a> GlobPatternSet<'a> {
+impl<'a> PathGlobSet<'a> {
     /// # Errors
     /// Returns an error if any glob pattern is invalid.
     pub fn new<I, S>(match_patterns: I) -> Result<Self, Error>
@@ -74,7 +111,7 @@ mod tests {
             "!**/yarn.lock",
             "!**/pnpm-lock.yaml",
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore paths inside node_modules
         assert!(ignores.is_match("node_modules/react/index.js"));
@@ -104,7 +141,7 @@ mod tests {
     #[test]
     fn test_match_ignores_with_file_patterns() -> Result<(), Error> {
         let patterns = vec!["*.log", "**/*.tmp", "!important.log"];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore matching files
         assert!(ignores.is_match("debug.log"));
@@ -130,7 +167,7 @@ mod tests {
     #[test]
     fn test_match_ignores_directory_patterns() -> Result<(), Error> {
         let patterns = vec!["dist/**", "build/**", "!dist/public/**"];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore paths in dist and build
         assert!(ignores.is_match("dist/bundle.js"));
@@ -158,7 +195,7 @@ mod tests {
             "**/tests/**",
             "!**/integration/tests/**",
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore test files
         assert!(ignores.is_match("src/utils.test.js"));
@@ -180,7 +217,7 @@ mod tests {
     #[test]
     fn test_match_ignores_empty_patterns() -> Result<(), Error> {
         let patterns: Vec<&str> = vec![];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should not ignore anything with empty patterns
         assert!(!ignores.is_match("node_modules/package.json"));
@@ -193,7 +230,7 @@ mod tests {
     #[test]
     fn test_match_ignores_with_wildcards() -> Result<(), Error> {
         let patterns = vec!["*.{js,ts,jsx,tsx}", "!index.js", "!main.ts"];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore matching extensions
         assert!(ignores.is_match("utils.js"));
@@ -215,7 +252,7 @@ mod tests {
     #[test]
     fn test_match_ignores_dotfiles() -> Result<(), Error> {
         let patterns = vec![".*", "!.gitignore", "!.env.example"];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Should ignore dotfiles
         assert!(ignores.is_match(".env"));
@@ -242,7 +279,7 @@ mod tests {
             "!dist/public",
             "**/node_modules",
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
         // Patterns match at any level
         assert!(ignores.is_match("dist"));
         assert!(ignores.is_match("src/dist")); // Also matches nested
@@ -264,7 +301,7 @@ mod tests {
             "build/**",       // Match everything under build
             "!build/keep/**", // But not under build/keep
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
         // Directory patterns
         assert!(ignores.is_match("build/output.js"));
         assert!(ignores.is_match("build/assets/style.css"));
@@ -284,7 +321,7 @@ mod tests {
             "!**/temp/keep/**",
             "!debug.log",
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         // Test various patterns together
         assert!(ignores.is_match("error.log"));
@@ -314,31 +351,31 @@ mod tests {
 
         // Test with Vec<&str>
         let patterns_str = vec!["*.log", "!important.log"];
-        let ignores_str = GlobPatternSet::new(&patterns_str)?;
+        let ignores_str = PathGlobSet::new(&patterns_str)?;
         assert!(ignores_str.is_match("debug.log"));
         assert!(!ignores_str.is_match("important.log"));
 
         // Test with Vec<String>
         let patterns_string = vec![String::from("*.tmp"), String::from("!keep.tmp")];
-        let ignores_string = GlobPatternSet::new(&patterns_string)?;
+        let ignores_string = PathGlobSet::new(&patterns_string)?;
         assert!(ignores_string.is_match("temp.tmp"));
         assert!(!ignores_string.is_match("keep.tmp"));
 
         // Test with Vec<Str>
         let patterns_vite_str = vec![Str::from("*.rs"), Str::from("!main.rs")];
-        let ignores_vite_str = GlobPatternSet::new(&patterns_vite_str)?;
+        let ignores_vite_str = PathGlobSet::new(&patterns_vite_str)?;
         assert!(ignores_vite_str.is_match("lib.rs"));
         assert!(!ignores_vite_str.is_match("main.rs"));
 
         // Test with array
         let patterns_array = ["build/**", "!build/dist/**"];
-        let ignores_array = GlobPatternSet::new(&patterns_array)?;
+        let ignores_array = PathGlobSet::new(&patterns_array)?;
         assert!(ignores_array.is_match("build/src/main.js"));
         assert!(!ignores_array.is_match("build/dist/bundle.js"));
 
         // Test with iterator
         let patterns_iter = ["*.md", "!README.md"].iter();
-        let ignores_iter = GlobPatternSet::new(patterns_iter)?;
+        let ignores_iter = PathGlobSet::new(patterns_iter)?;
         assert!(ignores_iter.is_match("CHANGELOG.md"));
         assert!(!ignores_iter.is_match("README.md"));
 
@@ -353,7 +390,7 @@ mod tests {
             "!logs/important.log", // Second: don't ignore important.log
             "logs/important.log",  // Third: ignore important.log again (this wins)
         ];
-        let ignores = GlobPatternSet::new(&patterns)?;
+        let ignores = PathGlobSet::new(&patterns)?;
 
         assert!(ignores.is_match("logs/error.log"));
         assert!(ignores.is_match("logs/src/app.log"));
@@ -364,3 +401,80 @@ mod tests {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod env_tests {
+    use super::EnvGlob;
+
+    #[test]
+    fn matches_star_prefix_and_suffix() {
+        let g = EnvGlob::new("VITE_*").unwrap();
+        assert!(g.is_match("VITE_FOO"));
+        assert!(g.is_match("VITE_")); // `*` matches the empty string
+        assert!(!g.is_match("MYVITE_FOO"));
+
+        let g = EnvGlob::new("*_KEY").unwrap();
+        assert!(g.is_match("MY_KEY"));
+        assert!(!g.is_match("MY_KEYS"));
+
+        let g = EnvGlob::new("*_CREDENTIAL*").unwrap();
+        assert!(g.is_match("AWS_CREDENTIALS"));
+        assert!(g.is_match("X_CREDENTIAL_Y"));
+    }
+
+    #[test]
+    fn question_mark_matches_exactly_one_char() {
+        let g = EnvGlob::new("APP?_*").unwrap();
+        assert!(g.is_match("APP1_TOKEN"));
+        assert!(g.is_match("APP2_NAME"));
+        // `?` requires exactly one character, so `APP_X` (nothing before `_`) does not match.
+        assert!(!g.is_match("APP_X"));
+    }
+
+    #[test]
+    fn brace_alternation_is_supported() {
+        let g = EnvGlob::new("{VITE,NEXT}_*").unwrap();
+        assert!(g.is_match("VITE_FOO"));
+        assert!(g.is_match("NEXT_BAR"));
+        assert!(!g.is_match("NUXT_BAR"));
+    }
+
+    #[test]
+    fn dot_and_separators_are_literal_not_path_special() {
+        // Env names are flat strings: `*` spans `.` and `/` (no path semantics),
+        // and a literal `.` in the pattern matches a literal `.`.
+        assert!(EnvGlob::new("A*").unwrap().is_match("A.B"));
+        assert!(EnvGlob::new("A*").unwrap().is_match("A/B"));
+        assert!(EnvGlob::new("*.local").unwrap().is_match("APP.local"));
+        assert!(!EnvGlob::new("*.local").unwrap().is_match("APPXlocal"));
+    }
+
+    #[test]
+    fn bang_is_a_literal_character() {
+        // There is no negation: `!FOO` matches the literal name `!FOO`, not `FOO`.
+        let g = EnvGlob::new("!FOO").unwrap();
+        assert!(g.is_match("!FOO"));
+        assert!(!g.is_match("FOO"));
+    }
+
+    #[test]
+    fn non_match_default_is_false() {
+        assert!(!EnvGlob::new("VITE_*").unwrap().is_match("PATH"));
+    }
+
+    #[test]
+    #[cfg(not(windows))]
+    fn unix_matching_is_case_sensitive() {
+        let g = EnvGlob::new("VITE_*").unwrap();
+        assert!(g.is_match("VITE_FOO"));
+        assert!(!g.is_match("vite_foo"));
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn windows_matching_is_case_insensitive() {
+        let g = EnvGlob::new("VITE_*").unwrap();
+        assert!(g.is_match("VITE_FOO"));
+        assert!(g.is_match("vite_foo"));
+    }
+}