fix: address codex review round 3

glob leaked VCS internals when the model rooted the search AT a VCS
directory (path: '.git' or 'sub/.git'): the prune glob !**/.git is
matched against root-prefixed candidate paths, which never end in the
directory name when the walk starts inside it. Pair each VCS exclude
with a contents glob (!**/<name>/**), verified empirically to exclude
relative, nested, and absolute VCS roots while leaving broad searches
untouched. Pinned by the command-construction test and a real-rg
integration case rooting at .git.

packages/fs/tool-fs-search/tests/integration.spec.ts

@@ -87,6 +87,12 @@ describe.skipIf(!hasRg)('search tools over the real bash executor + real rg', ()
       expect(text(await call('glob', { pattern: '*.nomatch' }))).toBe('No files found')
     })
 
+    it('excludes VCS internals even when the search root IS the VCS directory', async () => {
+      // The prune glob alone never matches root-prefixed paths when rg is
+      // rooted at .git; the paired contents glob keeps the exclusion airtight.
+      expect(text(await call('glob', { pattern: '*', path: '.git' }))).toBe('No files found')
+    })
+
     it('classifies an invalid glob as SEARCH_INVALID_PATTERN', async () => {
       const result = await call('glob', { pattern: '[' })
       expect(result.isError).toBe(true)

packages/fs/tool-fs-search/tests/tools.spec.ts

@@ -204,11 +204,13 @@ describe('config validation', () => {
 })
 
 describe('command construction (shell-safe)', () => {
-  it('glob: fixed rg --files template with quoted pattern and VCS excludes', () => {
+  it('glob: fixed rg --files template with quoted pattern and paired VCS excludes', () => {
     const command = buildGlobCommand({ pattern: '**/*.ts' })
     expect(command).toBe(
       "rg --files --glob='**/*.ts' --sort=modified --no-ignore --hidden "
-      + "--glob='!**/.git' --glob='!**/.svn' --glob='!**/.hg' --glob='!**/.bzr' --glob='!**/.jj' --glob='!**/.sl'",
+      + "--glob='!**/.git' --glob='!**/.git/**' --glob='!**/.svn' --glob='!**/.svn/**' "
+      + "--glob='!**/.hg' --glob='!**/.hg/**' --glob='!**/.bzr' --glob='!**/.bzr/**' "
+      + "--glob='!**/.jj' --glob='!**/.jj/**' --glob='!**/.sl' --glob='!**/.sl/**'",
     )
   })