From d20ec4b4dfed2ce476fafef536d26a0a29f21c18 Mon Sep 17 00:00:00 2001
From: Yunare Maia <yunare@gmail.com>
Date: Mon, 24 Aug 2026 18:58:53 +0000
Subject: [PATCH 1/2] fix(runtime): separate dash-prefixed Grep patterns with
 -- in sandbox worker

The filesystem worker appended the pattern as a bare positional, so a
pattern starting with '-' was parsed by ripgrep as flags. A leading flag
exits 1, which maps to an empty match set - reporting strings that exist
as absent, with no diagnostic.

Adds the same '--' separator the host-local workspace executor already
pins (#2961), plus a regression test asserting the separator and a
successful dash-prefixed search.

Fixes #3733
---
 .../src/__tests__/filesystem-worker.test.ts   | 43 +++++++++++++++++++
 .../src/filesystem-worker/operations.ts       |  4 +-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/packages/runtime/src/__tests__/filesystem-worker.test.ts b/packages/runtime/src/__tests__/filesystem-worker.test.ts
index d056b7a76d..4991fee267 100644
--- a/packages/runtime/src/__tests__/filesystem-worker.test.ts
+++ b/packages/runtime/src/__tests__/filesystem-worker.test.ts
@@ -243,6 +243,49 @@ describe('filesystem worker operations', () => {
     });
   });
 
+  test('separates dash-prefixed patterns from flags with the -- argv separator', async () => {
+    const root = await temporaryDirectory('maka-worker-grep-dash-pattern-');
+    const target = join(root, 'style.css');
+    await writeFile(target, 'a { display: -webkit-box; }', 'utf8');
+    let grepArgs: readonly string[] | undefined;
+
+    const response = await executeFilesystemWorkerRequest(
+      await requestFor(
+        {
+          kind: 'grep',
+          cwd: root,
+          path: target,
+          // Without `--`, ripgrep parses a leading `-` as flags and exits 1,
+          // which this worker maps to "no matches" — reporting a present
+          // string as absent. Mirrors workspace-executor's pinned behavior.
+          pattern: '-webkit-box',
+          maxCountPerFile: 50,
+          limit: 200,
+          timeoutMs: 1_000,
+        },
+        { enforcementPath: target, access: 'read', scope: 'exact', targetType: 'file' },
+      ),
+      {
+        grepExecutable: '/usr/bin/rg',
+        runGrep: async (input) => {
+          grepArgs = input.args;
+          return { exitCode: 0, stdout: '1:a { display: -webkit-box; }\n', stderrTail: '' };
+        },
+      },
+    );
+
+    assert.ok(grepArgs, 'grep must be invoked');
+    const separator = grepArgs.indexOf('--');
+    assert.notEqual(separator, -1, 'argv must contain a -- separator before the pattern');
+    assert.equal(grepArgs[separator + 1], '-webkit-box');
+    assert.deepEqual(response, {
+      version: FILESYSTEM_WORKER_PROTOCOL_VERSION,
+      requestId: 'request-1',
+      ok: true,
+      result: { kind: 'grep', matches: ['1:a { display: -webkit-box; }'] },
+    });
+  });
+
   test('returns no Grep matches for exit code 1 and surfaces bounded stderr for failures', async () => {
     const root = await temporaryDirectory('maka-worker-grep-result-');
     const target = join(root, 'file.ts');
diff --git a/packages/runtime/src/filesystem-worker/operations.ts b/packages/runtime/src/filesystem-worker/operations.ts
index 1c9475c78f..d0c9adabf8 100644
--- a/packages/runtime/src/filesystem-worker/operations.ts
+++ b/packages/runtime/src/filesystem-worker/operations.ts
@@ -413,7 +413,9 @@ export async function executeFilesystemOperation(
         throw operationError('grep_unavailable', 'Grep is unavailable in this runtime.');
       const args = ['-n', '--no-heading', `--max-count=${operation.maxCountPerFile}`];
       if (operation.glob) args.push('--glob', operation.glob);
-      args.push(operation.pattern, path);
+      // `--` keeps ripgrep from parsing a dash-prefixed pattern as flags
+      // (a flag-like pattern exits 1, which maps to "no matches" below).
+      args.push('--', operation.pattern, path);
       const result = await (dependencies.runGrep ?? runRipgrep)({
         executable: dependencies.grepExecutable,
         args,

From 4d753800d5514df9fcbffad3e08573003961711c Mon Sep 17 00:00:00 2001
From: Yunare Maia <yunare@gmail.com>
Date: Mon, 24 Aug 2026 19:48:22 +0000
Subject: [PATCH 2/2] chore: re-trigger CI

Desktop e2e failure is the known flake tracked in #3727 (slash-command-menu
projection refresh); unrelated to this runtime-only diff.