@machina.ai/cell-cli-core 1.41.1-rc2 → 1.45.1-rc1

package/dist/src/tools/ripGrep.test.js

@@ -4,9 +4,9 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { canUseRipgrep, RipGrepTool, ensureRgPath, getRipgrepPath, } from './ripGrep.js';
+import { RipGrepTool, resolveRipgrepPath, } from './ripGrep.js';
 import path from 'node:path';
-import { isSubpath } from '../utils/paths.js';
+import { isSubpath, resolveToRealPath } from '../utils/paths.js';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import { GEMINI_IGNORE_FILE_NAME } from '../config/constants.js';
@@ -16,6 +16,7 @@ import { PassThrough, Readable } from 'node:stream';
 import EventEmitter from 'node:events';
 import { createMockMessageBus } from '../test-utils/mock-message-bus.js';
 import { fileExists } from '../utils/fileUtils.js';
+import { resolveExecutable } from '../utils/shell-utils.js';
 vi.mock('../utils/fileUtils.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
@@ -23,40 +24,26 @@ vi.mock('../utils/fileUtils.js', async (importOriginal) => {
         fileExists: vi.fn(),
     };
 });
+vi.mock('../utils/shell-utils.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        resolveExecutable: vi.fn(),
+    };
+});
+vi.mock('../utils/paths.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        resolveToRealPath: vi.fn((p) => p),
+        normalizePath: vi.fn((p) => typeof p === 'string' ? p.replace(/\\/g, '/') : p),
+    };
+});
 // Mock child_process for ripgrep calls
 vi.mock('child_process', () => ({
     spawn: vi.fn(),
 }));
 const mockSpawn = vi.mocked(spawn);
-describe('canUseRipgrep', () => {
-    beforeEach(() => {
-        vi.mocked(fileExists).mockReset();
-    });
-    it('should return true if ripgrep already exists', async () => {
-        vi.mocked(fileExists).mockResolvedValue(true);
-        const result = await canUseRipgrep();
-        expect(result).toBe(true);
-    });
-    it('should return false if file does not exist', async () => {
-        vi.mocked(fileExists).mockResolvedValue(false);
-        const result = await canUseRipgrep();
-        expect(result).toBe(false);
-    });
-});
-describe('ensureRgPath', () => {
-    beforeEach(() => {
-        vi.mocked(fileExists).mockReset();
-    });
-    it('should return rg path if ripgrep already exists', async () => {
-        vi.mocked(fileExists).mockResolvedValue(true);
-        const rgPath = await ensureRgPath();
-        expect(rgPath).toBe(await getRipgrepPath());
-    });
-    it('should throw an error if ripgrep cannot be used', async () => {
-        vi.mocked(fileExists).mockResolvedValue(false);
-        await expect(ensureRgPath()).rejects.toThrow(/Cannot find bundled ripgrep binary/);
-    });
-});
 // Helper function to create mock spawn implementations
 function createMockSpawn(options = {}) {
     const { outputData, exitCode = 0, signal } = options;
@@ -90,56 +77,56 @@ function createMockSpawn(options = {}) {
         return mockProcess;
     };
 }
-describe('RipGrepTool', () => {
-    let tempRootDir;
-    let grepTool;
-    const abortSignal = new AbortController().signal;
-    let mockConfig = {
-        getTargetDir: () => tempRootDir,
-        getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
+// Helper function to create a mock Config
+function createMockConfig(rootDir, workspaceDirs = [rootDir]) {
+    const config = {
+        getTargetDir: () => rootDir,
+        getWorkspaceContext: () => createMockWorkspaceContext(rootDir, workspaceDirs),
         getDebugMode: () => false,
-        getFileFilteringRespectGitIgnore: () => true,
-        getFileFilteringRespectGeminiIgnore: () => true,
         getFileFilteringOptions: () => ({
             respectGitIgnore: true,
             respectGeminiIgnore: true,
+            customIgnoreFilePaths: [],
         }),
+        getFileFilteringRespectGitIgnore() {
+            return this.getFileFilteringOptions().respectGitIgnore;
+        },
+        getFileFilteringRespectGeminiIgnore() {
+            return this.getFileFilteringOptions().respectGeminiIgnore;
+        },
+        storage: {
+            getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+        },
+        isPathAllowed(absolutePath) {
+            const workspaceContext = this.getWorkspaceContext();
+            if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                return true;
+            }
+            const projectTempDir = this.storage.getProjectTempDir();
+            return isSubpath(path.resolve(projectTempDir), absolutePath);
+        },
+        validatePathAccess(absolutePath) {
+            if (this.isPathAllowed(absolutePath)) {
+                return null;
+            }
+            const workspaceDirs = this.getWorkspaceContext().getDirectories();
+            const projectTempDir = this.storage.getProjectTempDir();
+            return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+        },
+        getRipgrepPath: vi.fn().mockResolvedValue('/mock/rg'),
     };
+    return config;
+}
+describe('RipGrepTool', () => {
+    let tempRootDir;
+    let grepTool;
+    const abortSignal = new AbortController().signal;
+    let mockConfig;
     beforeEach(async () => {
         mockSpawn.mockReset();
         mockSpawn.mockImplementation(createMockSpawn());
         tempRootDir = await fs.mkdtemp(path.join(os.tmpdir(), 'grep-tool-root-'));
-        vi.mocked(fileExists).mockResolvedValue(true);
-        mockConfig = {
-            getTargetDir: () => tempRootDir,
-            getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
-            getDebugMode: () => false,
-            getFileFilteringRespectGitIgnore: () => true,
-            getFileFilteringRespectGeminiIgnore: () => true,
-            getFileFilteringOptions: () => ({
-                respectGitIgnore: true,
-                respectGeminiIgnore: true,
-            }),
-            storage: {
-                getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-            },
-            isPathAllowed(absolutePath) {
-                const workspaceContext = this.getWorkspaceContext();
-                if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                    return true;
-                }
-                const projectTempDir = this.storage.getProjectTempDir();
-                return isSubpath(path.resolve(projectTempDir), absolutePath);
-            },
-            validatePathAccess(absolutePath) {
-                if (this.isPathAllowed(absolutePath)) {
-                    return null;
-                }
-                const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                const projectTempDir = this.storage.getProjectTempDir();
-                return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-            },
-        };
+        mockConfig = createMockConfig(tempRootDir);
         grepTool = new RipGrepTool(mockConfig, createMockMessageBus());
         // Create some test files and directories
         await fs.writeFile(path.join(tempRootDir, 'fileA.txt'), 'hello world\nsecond line with world');
@@ -522,13 +509,13 @@ describe('RipGrepTool', () => {
             expect(() => grepTool.build(params)).toThrow(/params must have required property 'pattern'/);
         });
         it('should throw an error if ripgrep is not available', async () => {
-            vi.mocked(fileExists).mockResolvedValue(false);
+            vi.mocked(mockConfig.getRipgrepPath).mockResolvedValue(null);
             const params = { pattern: 'world' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute({ abortSignal });
             expect(result.llmContent).toContain('Cannot find bundled ripgrep binary');
             // restore the mock for subsequent tests
-            vi.mocked(fileExists).mockResolvedValue(true);
+            vi.mocked(mockConfig.getRipgrepPath).mockResolvedValue('/mock/rg');
         });
     });
     describe('multi-directory workspace', () => {
@@ -538,36 +525,7 @@ describe('RipGrepTool', () => {
             await fs.writeFile(path.join(secondDir, 'other.txt'), 'hello from second directory\nworld in second');
             await fs.writeFile(path.join(secondDir, 'another.js'), 'function world() { return "test"; }');
             // Create a mock config with multiple directories
-            const multiDirConfig = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, [secondDir]),
-                getDebugMode: () => false,
-                getFileFilteringRespectGitIgnore: () => true,
-                getFileFilteringRespectGeminiIgnore: () => true,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: true,
-                    respectGeminiIgnore: true,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const multiDirConfig = createMockConfig(tempRootDir, [secondDir]);
             // Setup specific mock for this test - multi-directory search for 'world'
             // Mock will be called twice - once for each directory
             mockSpawn.mockImplementation(createMockSpawn({
@@ -626,36 +584,7 @@ describe('RipGrepTool', () => {
             await fs.mkdir(path.join(secondDir, 'sub'));
             await fs.writeFile(path.join(secondDir, 'sub', 'test.txt'), 'hello from second sub directory');
             // Create a mock config with multiple directories
-            const multiDirConfig = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, [secondDir]),
-                getDebugMode: () => false,
-                getFileFilteringRespectGitIgnore: () => true,
-                getFileFilteringRespectGeminiIgnore: () => true,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: true,
-                    respectGeminiIgnore: true,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const multiDirConfig = createMockConfig(tempRootDir, [secondDir]);
             // Setup specific mock for this test - searching in 'sub' should only return matches from that directory
             mockSpawn.mockImplementation(createMockSpawn({
                 outputData: JSON.stringify({
@@ -1025,36 +954,12 @@ describe('RipGrepTool', () => {
             expect(result.llmContent).toContain('L1: secret log entry');
         });
         it('should disable gitignore rules when respectGitIgnore is false', async () => {
-            const configWithoutGitIgnore = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
-                getDebugMode: () => false,
-                getFileFilteringRespectGitIgnore: () => false,
-                getFileFilteringRespectGeminiIgnore: () => true,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: false,
-                    respectGeminiIgnore: true,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const configWithoutGitIgnore = createMockConfig(tempRootDir);
+            vi.spyOn(configWithoutGitIgnore, 'getFileFilteringOptions').mockReturnValue({
+                respectGitIgnore: false,
+                respectGeminiIgnore: true,
+                customIgnoreFilePaths: [],
+            });
             const gitIgnoreDisabledTool = new RipGrepTool(configWithoutGitIgnore, createMockMessageBus());
             mockSpawn.mockImplementation(createMockSpawn({
                 outputData: JSON.stringify({
@@ -1075,36 +980,12 @@ describe('RipGrepTool', () => {
         it('should add .geminiignore when enabled and patterns exist', async () => {
             const geminiIgnorePath = path.join(tempRootDir, GEMINI_IGNORE_FILE_NAME);
             await fs.writeFile(geminiIgnorePath, 'ignored.log');
-            const configWithGeminiIgnore = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
-                getDebugMode: () => false,
-                getFileFilteringRespectGitIgnore: () => true,
-                getFileFilteringRespectGeminiIgnore: () => true,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: true,
-                    respectGeminiIgnore: true,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const configWithGeminiIgnore = createMockConfig(tempRootDir);
+            vi.spyOn(configWithGeminiIgnore, 'getFileFilteringOptions').mockReturnValue({
+                respectGitIgnore: true,
+                respectGeminiIgnore: true,
+                customIgnoreFilePaths: [],
+            });
             const geminiIgnoreTool = new RipGrepTool(configWithGeminiIgnore, createMockMessageBus());
             mockSpawn.mockImplementation(createMockSpawn({
                 outputData: JSON.stringify({
@@ -1125,36 +1006,12 @@ describe('RipGrepTool', () => {
         it('should skip .geminiignore when disabled', async () => {
             const geminiIgnorePath = path.join(tempRootDir, GEMINI_IGNORE_FILE_NAME);
             await fs.writeFile(geminiIgnorePath, 'ignored.log');
-            const configWithoutGeminiIgnore = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
-                getDebugMode: () => false,
-                getFileFilteringRespectGitIgnore: () => true,
-                getFileFilteringRespectGeminiIgnore: () => false,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: true,
-                    respectGeminiIgnore: false,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const configWithoutGeminiIgnore = createMockConfig(tempRootDir);
+            vi.spyOn(configWithoutGeminiIgnore, 'getFileFilteringOptions').mockReturnValue({
+                respectGitIgnore: true,
+                respectGeminiIgnore: false,
+                customIgnoreFilePaths: [],
+            });
             const geminiIgnoreTool = new RipGrepTool(configWithoutGeminiIgnore, createMockMessageBus());
             mockSpawn.mockImplementation(createMockSpawn({
                 outputData: JSON.stringify({
@@ -1269,34 +1126,7 @@ describe('RipGrepTool', () => {
             expect(invocation.getDescription()).toContain(path.join('src', 'app'));
         });
         it('should use ./ when no path is specified (defaults to CWD)', () => {
-            const multiDirConfig = {
-                getTargetDir: () => tempRootDir,
-                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, ['/another/dir']),
-                getDebugMode: () => false,
-                getFileFilteringOptions: () => ({
-                    respectGitIgnore: true,
-                    respectGeminiIgnore: true,
-                }),
-                storage: {
-                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
-                },
-                isPathAllowed(absolutePath) {
-                    const workspaceContext = this.getWorkspaceContext();
-                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
-                        return true;
-                    }
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return isSubpath(path.resolve(projectTempDir), absolutePath);
-                },
-                validatePathAccess(absolutePath) {
-                    if (this.isPathAllowed(absolutePath)) {
-                        return null;
-                    }
-                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
-                    const projectTempDir = this.storage.getProjectTempDir();
-                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
-                },
-            };
+            const multiDirConfig = createMockConfig(tempRootDir, ['/another/dir']);
             const multiDirGrepTool = new RipGrepTool(multiDirConfig, createMockMessageBus());
             const params = { pattern: 'testPattern' };
             const invocation = multiDirGrepTool.build(params);
@@ -1474,10 +1304,7 @@ describe('RipGrepTool', () => {
         });
     });
 });
-describe('getRipgrepPath', () => {
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
+describe('resolveRipgrepPath', () => {
     describe('OS/Architecture Resolution', () => {
         it.each([
             { platform: 'darwin', arch: 'arm64', expectedBin: 'rg-darwin-arm64' },
@@ -1489,34 +1316,128 @@ describe('getRipgrepPath', () => {
             vi.spyOn(os, 'platform').mockReturnValue(platform);
             vi.spyOn(os, 'arch').mockReturnValue(arch);
             vi.mocked(fileExists).mockImplementation(async (checkPath) => checkPath.endsWith(expectedBin));
-            const resolvedPath = await getRipgrepPath();
+            const resolvedPath = await resolveRipgrepPath();
             expect(resolvedPath).not.toBeNull();
             expect(resolvedPath?.endsWith(expectedBin)).toBe(true);
         });
     });
     describe('Path Fallback Logic', () => {
-        beforeEach(() => {
-            vi.spyOn(os, 'platform').mockReturnValue('linux');
-            vi.spyOn(os, 'arch').mockReturnValue('x64');
+        afterEach(() => {
+            vi.unstubAllGlobals();
+            vi.unstubAllEnvs();
         });
-        it('should resolve the SEA (flattened) path first', async () => {
-            vi.mocked(fileExists).mockImplementation(async (checkPath) => checkPath.includes(path.normalize('tools/vendor/ripgrep')));
-            const resolvedPath = await getRipgrepPath();
-            expect(resolvedPath).not.toBeNull();
-            expect(resolvedPath).toContain(path.normalize('tools/vendor/ripgrep'));
-        });
-        it('should fall back to the Dev path if SEA path is missing', async () => {
-            vi.mocked(fileExists).mockImplementation(async (checkPath) => checkPath.includes(path.normalize('core/vendor/ripgrep')) &&
-                !checkPath.includes(path.join(path.sep, 'tools', path.sep)));
-            const resolvedPath = await getRipgrepPath();
-            expect(resolvedPath).not.toBeNull();
-            expect(resolvedPath).toContain(path.normalize('core/vendor/ripgrep'));
-            expect(resolvedPath).not.toContain(path.join(path.sep, 'tools', path.sep));
+        describe('on POSIX', () => {
+            beforeEach(() => {
+                vi.spyOn(os, 'platform').mockReturnValue('linux');
+                vi.spyOn(os, 'arch').mockReturnValue('x64');
+                vi.stubGlobal('process', Object.create(process, {
+                    platform: {
+                        get: () => 'linux',
+                    },
+                }));
+            });
+            it('should resolve the SEA (purely flattened) path first', async () => {
+                vi.mocked(fileExists).mockImplementation(async (checkPath) => {
+                    const expectedTarget = path.resolve(__dirname, `rg-linux-x64`);
+                    return checkPath.includes(expectedTarget);
+                });
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).not.toBeNull();
+                expect(resolvedPath).toContain('rg-linux-x64');
+            });
+            it('should resolve the SEA (vendor subdirectory) path if purely flattened is missing', async () => {
+                vi.mocked(fileExists).mockImplementation(async (checkPath) => checkPath.includes(path.normalize('vendor/ripgrep')));
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).not.toBeNull();
+                expect(resolvedPath).toContain(path.normalize('vendor/ripgrep'));
+            });
+            it('should resolve the Dev/Dist layout (actual output with src/) if SEA path is missing', async () => {
+                vi.mocked(fileExists).mockImplementation(async (checkPath) => {
+                    // Normalize the expected check against the absolute resolved path logic
+                    const expectedTarget = path.resolve(__dirname, '../../../vendor/ripgrep');
+                    return checkPath.includes(expectedTarget);
+                });
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).not.toBeNull();
+                expect(resolvedPath).toContain('vendor');
+            });
+            it('should resolve the Dev/Dist layout (assumed output without src/) if others are missing', async () => {
+                vi.mocked(fileExists).mockImplementation(async (checkPath) => {
+                    const expectedTarget = path.resolve(__dirname, '../../vendor/ripgrep');
+                    const skipTarget = path.resolve(__dirname, '../../../vendor/ripgrep');
+                    return (checkPath.includes(expectedTarget) &&
+                        !checkPath.includes(skipTarget));
+                });
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).not.toBeNull();
+                expect(resolvedPath).toContain('vendor');
+            });
+            it('should fall back to system PATH if both bundled paths are missing and system is trusted', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                vi.mocked(resolveExecutable).mockReturnValue('/usr/bin/rg');
+                vi.mocked(resolveToRealPath).mockReturnValue('/usr/bin/rg');
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBe('/usr/bin/rg');
+                expect(resolveExecutable).toHaveBeenCalledWith('rg');
+            });
+            it('should reject system PATH if it is in the current working directory', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                const unsafePath = path.join(process.cwd(), 'rg');
+                vi.mocked(resolveExecutable).mockReturnValue(unsafePath);
+                vi.mocked(resolveToRealPath).mockReturnValue(unsafePath);
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBeNull();
+            });
+            it('should allow system PATH if the real path is in a trusted directory (e.g. Homebrew Cellar)', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                const trustedLink = '/usr/local/bin/rg';
+                const trustedRealPath = '/opt/homebrew/Cellar/ripgrep/13.0.0/bin/rg';
+                vi.mocked(resolveExecutable).mockReturnValue(trustedLink);
+                vi.mocked(resolveToRealPath).mockReturnValue(trustedRealPath);
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBe(trustedRealPath);
+            });
+            it('should return null if binary is missing from both bundled paths and system PATH', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                vi.mocked(resolveExecutable).mockReturnValue(undefined);
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBeNull();
+            });
+            it('should handle errors gracefully and return null', async () => {
+                vi.mocked(fileExists).mockRejectedValue(new Error('File system error'));
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBeNull();
+            });
         });
-        it('should return null if binary is missing from both paths', async () => {
-            vi.mocked(fileExists).mockResolvedValue(false);
-            const resolvedPath = await getRipgrepPath();
-            expect(resolvedPath).toBeNull();
+        describe('on Windows', () => {
+            beforeEach(() => {
+                vi.spyOn(os, 'platform').mockReturnValue('win32');
+                vi.spyOn(os, 'arch').mockReturnValue('x64');
+                vi.stubGlobal('process', Object.create(process, {
+                    platform: {
+                        get: () => 'win32',
+                    },
+                }));
+                vi.stubEnv('SystemRoot', 'C:\\Windows');
+                vi.stubEnv('ProgramFiles', 'C:\\Program Files');
+                vi.stubEnv('ProgramFiles(x86)', 'C:\\Program Files (x86)');
+            });
+            it('should fall back to system PATH if system is trusted on Windows', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                vi.mocked(resolveExecutable).mockReturnValue('C:\\Windows\\System32\\rg.exe');
+                vi.mocked(resolveToRealPath).mockReturnValue('C:\\Windows\\System32\\rg.exe');
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBe('C:\\Windows\\System32\\rg.exe');
+                expect(resolveExecutable).toHaveBeenCalledWith('rg');
+            });
+            it('should reject system PATH if it is untrusted on Windows', async () => {
+                vi.mocked(fileExists).mockResolvedValue(false);
+                const unsafePath = 'D:\\Downloads\\rg.exe';
+                vi.mocked(resolveExecutable).mockReturnValue(unsafePath);
+                vi.mocked(resolveToRealPath).mockReturnValue(unsafePath);
+                const resolvedPath = await resolveRipgrepPath();
+                expect(resolvedPath).toBeNull();
+            });
         });
     });
 });