fix: count duplicate brace alternatives toward work limit

Address Copilot review on #541 by charging every alternative before allocation and deduplication. Add exact-budget and public-API regressions and clarify the documented work-step bound.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: karthiknadig

crates/pet-fs/src/glob.rs

@@ -168,6 +168,12 @@ fn expand_braces_bounded(pattern: &str, limit: usize) -> Result<Vec<String>, Glo
             if let Some((open, close)) = group {
                 expanded = true;
                 for alternative in pattern[open + 1..close].split(',') {
+                    if steps == MAX_BRACE_EXPANSION_STEPS {
+                        return Err(GlobExpansionError::BraceWorkLimitExceeded {
+                            limit: MAX_BRACE_EXPANSION_STEPS,
+                        });
+                    }
+                    steps += 1;
                     let variant =
                         format!("{}{alternative}{}", &pattern[..open], &pattern[close + 1..]);
                     if unique.insert(variant.clone()) {
@@ -743,6 +749,27 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn duplicate_brace_alternatives_count_toward_work_limit() {
+        let within_limit = format!("{{{}}}", vec!["a"; MAX_BRACE_EXPANSION_STEPS - 2].join(","));
+        assert_eq!(expand_braces_bounded(&within_limit, 1).unwrap(), vec!["a"]);
+
+        let over_limit = format!("{{{}}}", vec!["a"; MAX_BRACE_EXPANSION_STEPS].join(","));
+        assert_eq!(
+            expand_braces_bounded(&over_limit, 1).unwrap_err(),
+            GlobExpansionError::BraceWorkLimitExceeded {
+                limit: MAX_BRACE_EXPANSION_STEPS
+            },
+        );
+        assert_eq!(
+            expand_glob_patterns_bounded(&[PathBuf::from(over_limit)], bounded_limits(1, 1))
+                .unwrap_err(),
+            GlobExpansionError::BraceWorkLimitExceeded {
+                limit: MAX_BRACE_EXPANSION_STEPS
+            },
+        );
+    }
+
     #[test]
     fn bounded_expansion_reports_malformed_and_limited_patterns() {
         assert!(matches!(

docs/JSONRPC.md

@@ -187,8 +187,9 @@ refreshes with the same normalized expanded paths, options, and configuration ge
 join one operation; different options or generations do not.
 
 Expansion allows at most 1,024 distinct brace-expanded patterns and 10,000
-filesystem candidates per request. Brace expansion also stops after 10,000 intermediate
-patterns per input pattern. Invalid patterns, traversal failures, or exceeded
+filesystem candidates per request. Brace expansion also stops after 10,000 work steps
+per input pattern, counting each pending pattern and each alternative before formatting
+or deduplication (including duplicate alternatives). Invalid patterns, traversal failures, or exceeded
 limits return a JSON-RPC error (`-4`) and no partial refresh inventory. Limits are
 checked between filesystem entries; they are not a timeout and cannot interrupt an
 operating-system filesystem call already in progress.