feat(cli): workspaces

[jonathanlab]

wip

In general, when converting glob patterns to regular expressions, every regex metacharacter (including the backslash itself) must be escaped before you introduce your own special handling for * and **. Doing this manually with chained .replace calls is fragile; using a single replacement that escapes all regex-special characters is much safer.

The best minimal fix here is to first escape all regex metacharacters in the pattern, then translate the escaped glob wildcards to their regex equivalents. That means:

1. Take the raw pattern.
2. Escape all regex metacharacters ([\^$.*+?()|{}] and \).
3. Replace the escaped glob sequences for ** and * with placeholders / appropriate regex:
   • Convert the escaped ** to a placeholder (e.g. {{GLOBSTAR}}) and then to .*.
   • Convert the escaped * to [^/]*.
4. Build the final RegExp from this fully-escaped, transformed pattern.

Concretely in packages/core/src/commands/assign.ts, inside matchFiles, we should:

• Introduce a helper that escapes regex metacharacters, or inline the logic in the regexPattern computation.
• Change the current chain:

  const regexPattern = pattern
    .replace(/\./g, "\\.")
    .replace(/\*\*/g, "{{GLOBSTAR}}")
    .replace(/\*/g, "[^/]*")
    .replace(/{{GLOBSTAR}}/g, ".*");

  to:

  const escapedPattern = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
  const regexPattern = escapedPattern
    .replace(/\\\*\\\*/g, "{{GLOBSTAR}}")
    .replace(/\\\*/g, "[^/]*")
    .replace(/{{GLOBSTAR}}/g, ".*");

• Keep the rest of the function unchanged.

No new imports are needed; we rely only on the built-in RegExp and String.prototype.replace.