instrument-bundler CLI silently skips instruments whose path contains glob metacharacters #1652

The instrument-bundler CLI (published as the instrument-bundler bin, and used by packages/instrument-library's build) puts filesystem paths straight into glob patterns without escaping them. If a path contains glob metacharacters ([, ], *, ?, {, }, extglob (…)), the glob is matched as a pattern and not as a literal path. The CLI then skips instruments without failing. An instrument directory such as [x]/index.ts is found by the first glob, but the per-directory glob returns nothing, so the CLI logs a misleading "Failed to find any input files in directory" warning and emits no bundle. If the target directory itself (or any parent, such as the checkout path) contains a metacharacter, the first glob matches nothing, so nothing is built and nothing is logged. The build exits successfully either way.

Where

packages/instrument-bundler/src/cli.ts:

62  const indexFiles = await glob(`${inputBase}/**/*/index.{js,jsx,ts,tsx}`);
...
68  const inputFiles = await glob(`${targetDir}/*`);
69
70  if (inputFiles.length === 0) {
71    logger.warn(`Failed to find any input files in directory: ${targetDir}`);

targetDir is always the dirname of an index file the first glob matched, so the branch at line 70 can only be reached through this bug.

Reproduce

1. Create src/[x]/index.ts containing a valid instrument, and run tsx packages/instrument-bundler/src/cli.ts --outdir dist src.
   Actual: warning "Failed to find any input files in directory: …/src/[x]", and no dist/[x].js. Expected: dist/[x].js is written.
2. Run the CLI against /tmp/glob[1]/src, which contains FOO/index.ts.
   Actual: no output and no warning. Expected: FOO.js is written.

A quick check with glob 13 confirmed both cases: glob('<base>/glob[1]/lib/**/*/index.{…}') and glob('<base>/lib/[x]/*') return [], while the same search with the directory passed as cwd finds the files.

Tests

packages/instrument-bundler/src/__tests__/cli.test.ts, test "should skip an instrument directory whose name contains glob metacharacters, a bug: the per-directory glob does not escape the path". When fixing, invert it: expect [x].js to be written and the warning not to be logged, then rename it. A second case with a metacharacter in the target directory would cover line 62.

Suggested fix

Pass the directory as glob's cwd option (with absolute: true) and keep only the relative part in the pattern, for both calls. Once the per-directory listing cannot come back empty, the inputFiles.length === 0 branch can go.

Found while raising unit test coverage in #1632.