@office-ai/aioncli-core 0.26.0 → 0.30.0

package/dist/src/tools/ripGrep.test.js

@@ -6,11 +6,15 @@
 import { describe, it, expect, beforeEach, afterEach, afterAll, vi, } from 'vitest';
 import { canUseRipgrep, RipGrepTool, ensureRgPath } from './ripGrep.js';
 import path from 'node:path';
+import { isSubpath } from '../utils/paths.js';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import { Storage } from '../config/storage.js';
+import { GEMINI_IGNORE_FILE_NAME } from '../config/constants.js';
 import { createMockWorkspaceContext } from '../test-utils/mockWorkspaceContext.js';
 import { spawn } from 'node:child_process';
+import { PassThrough, Readable } from 'node:stream';
+import EventEmitter from 'node:events';
 import { downloadRipGrep } from '@joshua.litt/get-ripgrep';
 import { createMockMessageBus } from '../test-utils/mock-message-bus.js';
 // Mock dependencies for canUseRipgrep
@@ -144,30 +148,32 @@ describe('ensureRgPath', () => {
 function createMockSpawn(options = {}) {
     const { outputData, exitCode = 0, signal } = options;
     return () => {
-        const mockProcess = {
-            stdout: {
-                on: vi.fn(),
-                removeListener: vi.fn(),
-            },
-            stderr: {
-                on: vi.fn(),
-                removeListener: vi.fn(),
+        // strict Readable implementation
+        let pushed = false;
+        const stdout = new Readable({
+            read() {
+                if (!pushed) {
+                    if (outputData) {
+                        this.push(outputData);
+                    }
+                    this.push(null); // EOF
+                    pushed = true;
+                }
             },
-            on: vi.fn(),
-            removeListener: vi.fn(),
-            kill: vi.fn(),
-        };
-        // Set up event listeners immediately
+        });
+        const stderr = new PassThrough();
+        const mockProcess = new EventEmitter();
+        mockProcess.stdout = stdout;
+        mockProcess.stderr = stderr;
+        mockProcess.kill = vi.fn();
+        // @ts-expect-error - mocking private/internal property
+        mockProcess.killed = false;
+        // @ts-expect-error - mocking private/internal property
+        mockProcess.exitCode = null;
+        // Emulating process exit
         setTimeout(() => {
-            const stdoutDataHandler = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-            const closeHandler = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-            if (stdoutDataHandler && outputData) {
-                stdoutDataHandler(Buffer.from(outputData));
-            }
-            if (closeHandler) {
-                closeHandler(exitCode, signal);
-            }
-        }, 0);
+            mockProcess.emit('close', exitCode, signal);
+        }, 10);
         return mockProcess;
     };
 }
@@ -178,11 +184,16 @@ describe('RipGrepTool', () => {
     let ripgrepBinaryPath;
     let grepTool;
     const abortSignal = new AbortController().signal;
-    const mockConfig = {
+    let mockConfig = {
         getTargetDir: () => tempRootDir,
         getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
         getDebugMode: () => false,
+        getFileFilteringRespectGitIgnore: () => true,
         getFileFilteringRespectGeminiIgnore: () => true,
+        getFileFilteringOptions: () => ({
+            respectGitIgnore: true,
+            respectGeminiIgnore: true,
+        }),
     };
     beforeEach(async () => {
         downloadRipGrepMock.mockReset();
@@ -196,6 +207,36 @@ describe('RipGrepTool', () => {
         await fs.writeFile(ripgrepBinaryPath, '');
         storageSpy.mockImplementation(() => binDir);
         tempRootDir = await fs.mkdtemp(path.join(os.tmpdir(), 'grep-tool-root-'));
+        mockConfig = {
+            getTargetDir: () => tempRootDir,
+            getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
+            getDebugMode: () => false,
+            getFileFilteringRespectGitIgnore: () => true,
+            getFileFilteringRespectGeminiIgnore: () => true,
+            getFileFilteringOptions: () => ({
+                respectGitIgnore: true,
+                respectGeminiIgnore: true,
+            }),
+            storage: {
+                getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+            },
+            isPathAllowed(absolutePath) {
+                const workspaceContext = this.getWorkspaceContext();
+                if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                    return true;
+                }
+                const projectTempDir = this.storage.getProjectTempDir();
+                return isSubpath(path.resolve(projectTempDir), absolutePath);
+            },
+            validatePathAccess(absolutePath) {
+                if (this.isPathAllowed(absolutePath)) {
+                    return null;
+                }
+                const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                const projectTempDir = this.storage.getProjectTempDir();
+                return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+            },
+        };
         grepTool = new RipGrepTool(mockConfig, createMockMessageBus());
         // Create some test files and directories
         await fs.writeFile(path.join(tempRootDir, 'fileA.txt'), 'hello world\nsecond line with world');
@@ -226,14 +267,13 @@ describe('RipGrepTool', () => {
                 params: { pattern: 'hello', dir_path: '.', include: '*.txt' },
                 expected: null,
             },
-            {
-                name: 'invalid regex pattern',
-                params: { pattern: '[[' },
-                expected: null,
-            },
         ])('should return null for valid params ($name)', ({ params, expected }) => {
             expect(grepTool.validateToolParams(params)).toBe(expected);
         });
+        it('should throw error for invalid regex pattern', () => {
+            const params = { pattern: '[[' };
+            expect(grepTool.validateToolParams(params)).toMatch(/Invalid regular expression pattern provided/);
+        });
         it('should return error if pattern is missing', () => {
             const params = { dir_path: '.' };
             expect(grepTool.validateToolParams(params)).toBe(`params must have required property 'pattern'`);
@@ -244,8 +284,9 @@ describe('RipGrepTool', () => {
                 dir_path: 'nonexistent',
             };
             // Check for the core error message, as the full path might vary
-            expect(grepTool.validateToolParams(params)).toContain('Path does not exist');
-            expect(grepTool.validateToolParams(params)).toContain('nonexistent');
+            const result = grepTool.validateToolParams(params);
+            expect(result).toMatch(/Path does not exist/);
+            expect(result).toMatch(/nonexistent/);
         });
         it('should allow path to be a file', async () => {
             const filePath = path.join(tempRootDir, 'fileA.txt');
@@ -299,6 +340,35 @@ describe('RipGrepTool', () => {
             expect(result.llmContent).toContain('L1: another world in sub dir');
             expect(result.returnDisplay).toBe('Found 3 matches');
         });
+        it('should ignore matches that escape the base path', async () => {
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: '..env' },
+                        line_number: 1,
+                        lines: { text: 'world in ..env\n' },
+                    },
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: '../secret.txt' },
+                            line_number: 1,
+                            lines: { text: 'leak\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
+            const params = { pattern: 'world' };
+            const invocation = grepTool.build(params);
+            const result = await invocation.execute(abortSignal);
+            expect(result.llmContent).toContain('File: ..env');
+            expect(result.llmContent).toContain('L1: world in ..env');
+            expect(result.llmContent).not.toContain('secret.txt');
+        });
         it('should find matches in a specific path', async () => {
             // Setup specific mock for this test - searching in 'sub' should only return matches from that directory
             mockSpawn.mockImplementationOnce(createMockSpawn({
@@ -344,40 +414,17 @@ describe('RipGrepTool', () => {
         it('should find matches with an include glob and path', async () => {
             await fs.writeFile(path.join(tempRootDir, 'sub', 'another.js'), 'const greeting = "hello";');
             // Setup specific mock for this test - searching for 'hello' in 'sub' with '*.js' filter
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'another.js' },
+                        line_number: 1,
+                        lines: { text: 'const greeting = "hello";\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        // Only return match from the .js file in sub directory
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'another.js' },
-                                line_number: 1,
-                                lines: { text: 'const greeting = "hello";\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+                exitCode: 0,
+            }));
             const params = {
                 pattern: 'hello',
                 dir_path: 'sub',
@@ -401,52 +448,132 @@ describe('RipGrepTool', () => {
             expect(result.llmContent).toContain('No matches found for pattern "nonexistentpattern" in path ".".');
             expect(result.returnDisplay).toBe('No matches found');
         });
-        it('should return an error from ripgrep for invalid regex pattern', async () => {
-            mockSpawn.mockImplementationOnce(createMockSpawn({
+        it('should throw error for invalid regex pattern during build', async () => {
+            const params = { pattern: '[[' };
+            expect(() => grepTool.build(params)).toThrow(/Invalid regular expression pattern provided/);
+        });
+        it('should ignore invalid regex error from ripgrep when it is not a user error', async () => {
+            mockSpawn.mockImplementation(createMockSpawn({
+                outputData: '',
                 exitCode: 2,
+                signal: undefined,
             }));
-            const params = { pattern: '[[' };
-            const invocation = grepTool.build(params);
+            const invocation = grepTool.build({
+                pattern: 'foo',
+                dir_path: tempRootDir,
+            });
             const result = await invocation.execute(abortSignal);
-            expect(result.llmContent).toContain('ripgrep exited with code 2');
-            expect(result.returnDisplay).toContain('Error: ripgrep exited with code 2');
+            expect(result.llmContent).toContain('Process exited with code 2');
+            expect(result.returnDisplay).toContain('Error: Process exited with code 2');
         });
-        it('should handle regex special characters correctly', async () => {
-            // Setup specific mock for this test - regex pattern 'foo.*bar' should match 'const foo = "bar";'
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        // Return match for the regex pattern
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'fileB.js' },
-                                line_number: 1,
-                                lines: { text: 'const foo = "bar";\n' },
-                            },
-                        }) + '\n'));
+        it('should handle massive output by terminating early without crashing (Regression)', async () => {
+            const massiveOutputLines = 30000;
+            // Custom mock for massive streaming
+            mockSpawn.mockImplementation(() => {
+                const stdout = new PassThrough();
+                const stderr = new PassThrough();
+                const mockProcess = new EventEmitter();
+                mockProcess.stdout = stdout;
+                mockProcess.stderr = stderr;
+                mockProcess.kill = vi.fn();
+                // @ts-expect-error - mocking private/internal property
+                mockProcess.killed = false;
+                // @ts-expect-error - mocking private/internal property
+                mockProcess.exitCode = null;
+                // Push data over time
+                let linesPushed = 0;
+                const pushInterval = setInterval(() => {
+                    if (linesPushed >= massiveOutputLines) {
+                        clearInterval(pushInterval);
+                        stdout.end();
+                        mockProcess.emit('close', 0);
+                        return;
+                    }
+                    // Push a batch
+                    try {
+                        for (let i = 0; i < 2000 && linesPushed < massiveOutputLines; i++) {
+                            const match = JSON.stringify({
+                                type: 'match',
+                                data: {
+                                    path: { text: `file_${linesPushed}.txt` },
+                                    line_number: 1,
+                                    lines: { text: `match ${linesPushed}\n` },
+                                },
+                            });
+                            stdout.write(match + '\n');
+                            linesPushed++;
+                        }
                     }
-                    if (onClose) {
-                        onClose(0);
+                    catch (_e) {
+                        clearInterval(pushInterval);
                     }
-                }, 0);
+                }, 1);
+                mockProcess.kill = vi.fn().mockImplementation(() => {
+                    clearInterval(pushInterval);
+                    stdout.end();
+                    // Emit close async to allow listeners to attach
+                    setTimeout(() => mockProcess.emit('close', 0, 'SIGTERM'), 0);
+                    return true;
+                });
                 return mockProcess;
             });
+            const invocation = grepTool.build({
+                pattern: 'test',
+                dir_path: tempRootDir,
+            });
+            const result = await invocation.execute(abortSignal);
+            expect(result.returnDisplay).toContain('(limited)');
+        }, 10000);
+        it('should filter out files based on FileDiscoveryService even if ripgrep returns them', async () => {
+            // Create .geminiignore to ignore 'ignored.txt'
+            await fs.writeFile(path.join(tempRootDir, GEMINI_IGNORE_FILE_NAME), 'ignored.txt');
+            // Re-initialize tool so FileDiscoveryService loads the new .geminiignore
+            const toolWithIgnore = new RipGrepTool(mockConfig, createMockMessageBus());
+            // Mock ripgrep returning both an ignored file and an allowed file
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'ignored.txt' },
+                        line_number: 1,
+                        lines: { text: 'should be ignored\n' },
+                    },
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'allowed.txt' },
+                            line_number: 1,
+                            lines: { text: 'should be kept\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
+            const params = { pattern: 'should' };
+            const invocation = toolWithIgnore.build(params);
+            const result = await invocation.execute(abortSignal);
+            // Verify ignored file is filtered out
+            expect(result.llmContent).toContain('allowed.txt');
+            expect(result.llmContent).toContain('should be kept');
+            expect(result.llmContent).not.toContain('ignored.txt');
+            expect(result.llmContent).not.toContain('should be ignored');
+            expect(result.returnDisplay).toContain('Found 1 match');
+        });
+        it('should handle regex special characters correctly', async () => {
+            // Setup specific mock for this test - regex pattern 'foo.*bar' should match 'const foo = "bar";'
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileB.js' },
+                        line_number: 1,
+                        lines: { text: 'const foo = "bar";\n' },
+                    },
+                }) + '\n',
+                exitCode: 0,
+            }));
             const params = { pattern: 'foo.*bar' }; // Matches 'const foo = "bar";'
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -456,50 +583,27 @@ describe('RipGrepTool', () => {
         });
         it('should be case-insensitive by default (JS fallback)', async () => {
             // Setup specific mock for this test - case insensitive search for 'HELLO'
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'hello world\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        // Return case-insensitive matches for 'HELLO'
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'fileA.txt' },
-                                line_number: 1,
-                                lines: { text: 'hello world\n' },
-                            },
-                        }) +
-                            '\n' +
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'fileB.js' },
-                                    line_number: 2,
-                                    lines: { text: 'function baz() { return "hello"; }\n' },
-                                },
-                            }) +
-                            '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileB.js' },
+                            line_number: 2,
+                            lines: { text: 'function baz() { return "hello"; }\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
             const params = { pattern: 'HELLO' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -535,92 +639,63 @@ describe('RipGrepTool', () => {
                 getTargetDir: () => tempRootDir,
                 getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, [secondDir]),
                 getDebugMode: () => false,
+                getFileFilteringRespectGitIgnore: () => true,
                 getFileFilteringRespectGeminiIgnore: () => true,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: true,
+                    respectGeminiIgnore: true,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
             };
             // Setup specific mock for this test - multi-directory search for 'world'
             // Mock will be called twice - once for each directory
-            let callCount = 0;
-            mockSpawn.mockImplementation(() => {
-                callCount++;
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'hello world\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const stdoutDataHandler = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const closeHandler = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    let outputData = '';
-                    if (callCount === 1) {
-                        // First directory (tempRootDir)
-                        outputData =
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'fileA.txt' },
-                                    line_number: 1,
-                                    lines: { text: 'hello world\n' },
-                                },
-                            }) +
-                                '\n' +
-                                JSON.stringify({
-                                    type: 'match',
-                                    data: {
-                                        path: { text: 'fileA.txt' },
-                                        line_number: 2,
-                                        lines: { text: 'second line with world\n' },
-                                    },
-                                }) +
-                                '\n' +
-                                JSON.stringify({
-                                    type: 'match',
-                                    data: {
-                                        path: { text: 'sub/fileC.txt' },
-                                        line_number: 1,
-                                        lines: { text: 'another world in sub dir\n' },
-                                    },
-                                }) +
-                                '\n';
-                    }
-                    else if (callCount === 2) {
-                        // Second directory (secondDir)
-                        outputData =
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'other.txt' },
-                                    line_number: 2,
-                                    lines: { text: 'world in second\n' },
-                                },
-                            }) +
-                                '\n' +
-                                JSON.stringify({
-                                    type: 'match',
-                                    data: {
-                                        path: { text: 'another.js' },
-                                        line_number: 1,
-                                        lines: { text: 'function world() { return "test"; }\n' },
-                                    },
-                                }) +
-                                '\n';
-                    }
-                    if (stdoutDataHandler && outputData) {
-                        stdoutDataHandler(Buffer.from(outputData));
-                    }
-                    if (closeHandler) {
-                        closeHandler(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 2,
+                            lines: { text: 'second line with world\n' },
+                        },
+                    }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'sub/fileC.txt' },
+                            line_number: 1,
+                            lines: { text: 'another world in sub dir\n' },
+                        },
+                    }) +
+                    '\n',
+            }));
             const multiDirGrepTool = new RipGrepTool(multiDirConfig, createMockMessageBus());
             const params = { pattern: 'world' };
             const invocation = multiDirGrepTool.build(params);
@@ -652,42 +727,43 @@ describe('RipGrepTool', () => {
                 getTargetDir: () => tempRootDir,
                 getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, [secondDir]),
                 getDebugMode: () => false,
+                getFileFilteringRespectGitIgnore: () => true,
                 getFileFilteringRespectGeminiIgnore: () => true,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: true,
+                    respectGeminiIgnore: true,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
             };
             // Setup specific mock for this test - searching in 'sub' should only return matches from that directory
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileC.txt' },
+                        line_number: 1,
+                        lines: { text: 'another world in sub dir\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'fileC.txt' },
-                                line_number: 1,
-                                lines: { text: 'another world in sub dir\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const multiDirGrepTool = new RipGrepTool(multiDirConfig, createMockMessageBus());
             // Search only in the 'sub' directory of the first workspace
             const params = { pattern: 'world', dir_path: 'sub' };
@@ -714,38 +790,17 @@ describe('RipGrepTool', () => {
         });
         it('should abort streaming search when signal is triggered', async () => {
             // Setup specific mock for this test - simulate process being killed due to abort
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                // Simulate process being aborted - use setTimeout to ensure handlers are registered first
-                setTimeout(() => {
-                    const closeHandler = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (closeHandler) {
-                        // Simulate process killed by signal (code is null, signal is SIGTERM)
-                        closeHandler(null, 'SIGTERM');
-                    }
-                }, 0);
-                return mockProcess;
-            });
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                exitCode: null,
+                signal: 'SIGTERM',
+            }));
             const controller = new AbortController();
             const params = { pattern: 'test' };
             const invocation = grepTool.build(params);
             // Abort immediately before starting the search
             controller.abort();
             const result = await invocation.execute(controller.signal);
-            expect(result.llmContent).toContain('Error during grep search operation: ripgrep exited with code null');
-            expect(result.returnDisplay).toContain('Error: ripgrep exited with code null');
+            expect(result.returnDisplay).toContain('No matches found');
         });
     });
     describe('error handling and edge cases', () => {
@@ -754,7 +809,7 @@ describe('RipGrepTool', () => {
                 pattern: 'test',
                 dir_path: '../outside',
             };
-            expect(() => grepTool.build(params)).toThrow(/Path validation failed/);
+            expect(() => grepTool.build(params)).toThrow(/Path not in workspace/);
         });
         it.each([
             {
@@ -783,39 +838,16 @@ describe('RipGrepTool', () => {
             const specialFileName = 'file with spaces & symbols!.txt';
             await fs.writeFile(path.join(tempRootDir, specialFileName), 'hello world with special chars');
             // Setup specific mock for this test - searching for 'world' should find the file with special characters
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: specialFileName },
+                        line_number: 1,
+                        lines: { text: 'hello world with special chars\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: specialFileName },
-                                line_number: 1,
-                                lines: { text: 'hello world with special chars\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const params = { pattern: 'world' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -827,39 +859,16 @@ describe('RipGrepTool', () => {
             await fs.mkdir(deepPath, { recursive: true });
             await fs.writeFile(path.join(deepPath, 'deep.txt'), 'content in deep directory');
             // Setup specific mock for this test - searching for 'deep' should find the deeply nested file
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'a/b/c/d/e/deep.txt' },
+                        line_number: 1,
+                        lines: { text: 'content in deep directory\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'a/b/c/d/e/deep.txt' },
-                                line_number: 1,
-                                lines: { text: 'content in deep directory\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const params = { pattern: 'deep' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -871,39 +880,16 @@ describe('RipGrepTool', () => {
         it('should handle complex regex patterns', async () => {
             await fs.writeFile(path.join(tempRootDir, 'code.js'), 'function getName() { return "test"; }\nconst getValue = () => "value";');
             // Setup specific mock for this test - regex pattern should match function declarations
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'code.js' },
+                        line_number: 1,
+                        lines: { text: 'function getName() { return "test"; }\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'code.js' },
-                                line_number: 1,
-                                lines: { text: 'function getName() { return "test"; }\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const params = { pattern: 'function\\s+\\w+\\s*\\(' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -913,58 +899,35 @@ describe('RipGrepTool', () => {
         it('should handle case sensitivity correctly in JS fallback', async () => {
             await fs.writeFile(path.join(tempRootDir, 'case.txt'), 'Hello World\nhello world\nHELLO WORLD');
             // Setup specific mock for this test - case insensitive search should match all variants
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'case.txt' },
+                        line_number: 1,
+                        lines: { text: 'Hello World\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'case.txt' },
-                                line_number: 1,
-                                lines: { text: 'Hello World\n' },
-                            },
-                        }) +
-                            '\n' +
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'case.txt' },
-                                    line_number: 2,
-                                    lines: { text: 'hello world\n' },
-                                },
-                            }) +
-                            '\n' +
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'case.txt' },
-                                    line_number: 3,
-                                    lines: { text: 'HELLO WORLD\n' },
-                                },
-                            }) +
-                            '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'case.txt' },
+                            line_number: 2,
+                            lines: { text: 'hello world\n' },
+                        },
+                    }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'case.txt' },
+                            line_number: 3,
+                            lines: { text: 'HELLO WORLD\n' },
+                        },
+                    }) +
+                    '\n',
+            }));
             const params = { pattern: 'hello' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -975,39 +938,16 @@ describe('RipGrepTool', () => {
         it('should handle escaped regex special characters', async () => {
             await fs.writeFile(path.join(tempRootDir, 'special.txt'), 'Price: $19.99\nRegex: [a-z]+ pattern\nEmail: test@example.com');
             // Setup specific mock for this test - escaped regex pattern should match price format
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'special.txt' },
+                        line_number: 1,
+                        lines: { text: 'Price: $19.99\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'special.txt' },
-                                line_number: 1,
-                                lines: { text: 'Price: $19.99\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const params = { pattern: '\\$\\d+\\.\\d+' };
             const invocation = grepTool.build(params);
             const result = await invocation.execute(abortSignal);
@@ -1022,49 +962,26 @@ describe('RipGrepTool', () => {
             await fs.writeFile(path.join(tempRootDir, 'test.js'), 'javascript content');
             await fs.writeFile(path.join(tempRootDir, 'test.txt'), 'text content');
             // Setup specific mock for this test - include pattern should filter to only ts/tsx files
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'test.ts' },
+                        line_number: 1,
+                        lines: { text: 'typescript content\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'test.ts' },
-                                line_number: 1,
-                                lines: { text: 'typescript content\n' },
-                            },
-                        }) +
-                            '\n' +
-                            JSON.stringify({
-                                type: 'match',
-                                data: {
-                                    path: { text: 'test.tsx' },
-                                    line_number: 1,
-                                    lines: { text: 'tsx content\n' },
-                                },
-                            }) +
-                            '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'test.tsx' },
+                            line_number: 1,
+                            lines: { text: 'tsx content\n' },
+                        },
+                    }) +
+                    '\n',
+            }));
             const params = {
                 pattern: 'content',
                 include: '*.{ts,tsx}',
@@ -1081,39 +998,16 @@ describe('RipGrepTool', () => {
             await fs.writeFile(path.join(tempRootDir, 'src', 'main.ts'), 'source code');
             await fs.writeFile(path.join(tempRootDir, 'other.ts'), 'other code');
             // Setup specific mock for this test - include pattern should filter to only src/** files
-            mockSpawn.mockImplementationOnce(() => {
-                const mockProcess = {
-                    stdout: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
-                    },
-                    stderr: {
-                        on: vi.fn(),
-                        removeListener: vi.fn(),
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'src/main.ts' },
+                        line_number: 1,
+                        lines: { text: 'source code\n' },
                     },
-                    on: vi.fn(),
-                    removeListener: vi.fn(),
-                    kill: vi.fn(),
-                };
-                setTimeout(() => {
-                    const onData = mockProcess.stdout.on.mock.calls.find((call) => call[0] === 'data')?.[1];
-                    const onClose = mockProcess.on.mock.calls.find((call) => call[0] === 'close')?.[1];
-                    if (onData) {
-                        onData(Buffer.from(JSON.stringify({
-                            type: 'match',
-                            data: {
-                                path: { text: 'src/main.ts' },
-                                line_number: 1,
-                                lines: { text: 'source code\n' },
-                            },
-                        }) + '\n'));
-                    }
-                    if (onClose) {
-                        onClose(0);
-                    }
-                }, 0);
-                return mockProcess;
-            });
+                }) + '\n',
+            }));
             const params = {
                 pattern: 'code',
                 include: 'src/**',
@@ -1163,27 +1057,32 @@ describe('RipGrepTool', () => {
             expect(result.llmContent).toContain('Found 1 match for pattern "HELLO"');
             expect(result.llmContent).toContain('L1: HELLO world');
         });
-        it.each([
-            {
-                name: 'fixed_strings parameter',
-                params: { pattern: 'hello.world', fixed_strings: true },
-                mockOutput: {
-                    path: { text: 'fileA.txt' },
-                    line_number: 1,
-                    lines: { text: 'hello.world\n' },
-                },
-                expectedArgs: ['--fixed-strings'],
-                expectedPattern: 'hello.world',
-            },
-        ])('should handle $name', async ({ params, mockOutput, expectedArgs, expectedPattern }) => {
+        it('should handle fixed_strings parameter', async () => {
             mockSpawn.mockImplementationOnce(createMockSpawn({
-                outputData: JSON.stringify({ type: 'match', data: mockOutput }) + '\n',
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'hello.world\n' },
+                    },
+                }) + '\n',
                 exitCode: 0,
             }));
-            const invocation = grepTool.build(params);
+            const invocation = grepTool.build({
+                pattern: 'hello.world',
+                fixed_strings: true,
+            });
             const result = await invocation.execute(abortSignal);
-            expect(mockSpawn).toHaveBeenLastCalledWith(expect.anything(), expect.arrayContaining(expectedArgs), expect.anything());
-            expect(result.llmContent).toContain(`Found 1 match for pattern "${expectedPattern}"`);
+            expect(mockSpawn).toHaveBeenLastCalledWith(expect.anything(), expect.arrayContaining(['--fixed-strings']), expect.anything());
+            expect(result.llmContent).toContain('Found 1 match for pattern "hello.world"');
+        });
+        it('should allow invalid regex patterns when fixed_strings is true', () => {
+            const params = {
+                pattern: '[[',
+                fixed_strings: true,
+            };
+            expect(grepTool.validateToolParams(params)).toBeNull();
         });
         it('should handle no_ignore parameter', async () => {
             mockSpawn.mockImplementationOnce(createMockSpawn({
@@ -1206,14 +1105,86 @@ describe('RipGrepTool', () => {
             expect(result.llmContent).toContain('File: ignored.log');
             expect(result.llmContent).toContain('L1: secret log entry');
         });
+        it('should disable gitignore rules when respectGitIgnore is false', async () => {
+            const configWithoutGitIgnore = {
+                getTargetDir: () => tempRootDir,
+                getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
+                getDebugMode: () => false,
+                getFileFilteringRespectGitIgnore: () => false,
+                getFileFilteringRespectGeminiIgnore: () => true,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: false,
+                    respectGeminiIgnore: true,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
+            };
+            const gitIgnoreDisabledTool = new RipGrepTool(configWithoutGitIgnore, createMockMessageBus());
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'ignored.log' },
+                        line_number: 1,
+                        lines: { text: 'secret log entry\n' },
+                    },
+                }) + '\n',
+                exitCode: 0,
+            }));
+            const params = { pattern: 'secret' };
+            const invocation = gitIgnoreDisabledTool.build(params);
+            await invocation.execute(abortSignal);
+            expect(mockSpawn).toHaveBeenLastCalledWith(expect.anything(), expect.arrayContaining(['--no-ignore-vcs', '--no-ignore-exclude']), expect.anything());
+        });
         it('should add .geminiignore when enabled and patterns exist', async () => {
-            const geminiIgnorePath = path.join(tempRootDir, '.geminiignore');
+            const geminiIgnorePath = path.join(tempRootDir, GEMINI_IGNORE_FILE_NAME);
             await fs.writeFile(geminiIgnorePath, 'ignored.log');
             const configWithGeminiIgnore = {
                 getTargetDir: () => tempRootDir,
                 getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
                 getDebugMode: () => false,
+                getFileFilteringRespectGitIgnore: () => true,
                 getFileFilteringRespectGeminiIgnore: () => true,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: true,
+                    respectGeminiIgnore: true,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
             };
             const geminiIgnoreTool = new RipGrepTool(configWithGeminiIgnore, createMockMessageBus());
             mockSpawn.mockImplementationOnce(createMockSpawn({
@@ -1233,13 +1204,37 @@ describe('RipGrepTool', () => {
             expect(mockSpawn).toHaveBeenLastCalledWith(expect.anything(), expect.arrayContaining(['--ignore-file', geminiIgnorePath]), expect.anything());
         });
         it('should skip .geminiignore when disabled', async () => {
-            const geminiIgnorePath = path.join(tempRootDir, '.geminiignore');
+            const geminiIgnorePath = path.join(tempRootDir, GEMINI_IGNORE_FILE_NAME);
             await fs.writeFile(geminiIgnorePath, 'ignored.log');
             const configWithoutGeminiIgnore = {
                 getTargetDir: () => tempRootDir,
                 getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir),
                 getDebugMode: () => false,
+                getFileFilteringRespectGitIgnore: () => true,
                 getFileFilteringRespectGeminiIgnore: () => false,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: true,
+                    respectGeminiIgnore: false,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
             };
             const geminiIgnoreTool = new RipGrepTool(configWithoutGeminiIgnore, createMockMessageBus());
             mockSpawn.mockImplementationOnce(createMockSpawn({
@@ -1261,18 +1256,41 @@ describe('RipGrepTool', () => {
         it('should handle context parameters', async () => {
             mockSpawn.mockImplementationOnce(createMockSpawn({
                 outputData: JSON.stringify({
-                    type: 'match',
+                    type: 'context',
                     data: {
                         path: { text: 'fileA.txt' },
-                        line_number: 2,
-                        lines: { text: 'second line with world\n' },
-                        lines_before: [{ text: 'hello world\n' }],
-                        lines_after: [
-                            { text: 'third line\n' },
-                            { text: 'fourth line\n' },
-                        ],
+                        line_number: 1,
+                        lines: { text: 'hello world\n' },
                     },
-                }) + '\n',
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 2,
+                            lines: { text: 'second line with world\n' },
+                        },
+                    }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'context',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 3,
+                            lines: { text: 'third line\n' },
+                        },
+                    }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'context',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 4,
+                            lines: { text: 'fourth line\n' },
+                        },
+                    }) +
+                    '\n',
                 exitCode: 0,
             }));
             const params = {
@@ -1293,9 +1311,10 @@ describe('RipGrepTool', () => {
             ]), expect.anything());
             expect(result.llmContent).toContain('Found 1 match for pattern "world"');
             expect(result.llmContent).toContain('File: fileA.txt');
+            expect(result.llmContent).toContain('L1- hello world');
             expect(result.llmContent).toContain('L2: second line with world');
-            // Note: Ripgrep JSON output for context lines doesn't include line numbers for context lines directly
-            // The current parsing only extracts the matched line, so we only assert on that.
+            expect(result.llmContent).toContain('L3- third line');
+            expect(result.llmContent).toContain('L4- fourth line');
         });
     });
     describe('getDescription', () => {
@@ -1335,6 +1354,29 @@ describe('RipGrepTool', () => {
                 getTargetDir: () => tempRootDir,
                 getWorkspaceContext: () => createMockWorkspaceContext(tempRootDir, ['/another/dir']),
                 getDebugMode: () => false,
+                getFileFilteringOptions: () => ({
+                    respectGitIgnore: true,
+                    respectGeminiIgnore: true,
+                }),
+                storage: {
+                    getProjectTempDir: vi.fn().mockReturnValue('/tmp/project'),
+                },
+                isPathAllowed(absolutePath) {
+                    const workspaceContext = this.getWorkspaceContext();
+                    if (workspaceContext.isPathWithinWorkspace(absolutePath)) {
+                        return true;
+                    }
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return isSubpath(path.resolve(projectTempDir), absolutePath);
+                },
+                validatePathAccess(absolutePath) {
+                    if (this.isPathAllowed(absolutePath)) {
+                        return null;
+                    }
+                    const workspaceDirs = this.getWorkspaceContext().getDirectories();
+                    const projectTempDir = this.storage.getProjectTempDir();
+                    return `Path not in workspace: Attempted path "${absolutePath}" resolves outside the allowed workspace directories: ${workspaceDirs.join(', ')} or the project temp directory: ${projectTempDir}`;
+                },
             };
             const multiDirGrepTool = new RipGrepTool(multiDirConfig, createMockMessageBus());
             const params = { pattern: 'testPattern' };
@@ -1354,6 +1396,142 @@ describe('RipGrepTool', () => {
             expect(invocation.getDescription()).toContain(path.join('src', 'app'));
         });
     });
+    describe('new parameters', () => {
+        it('should pass --max-count when max_matches_per_file is provided', async () => {
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'hello world\n' },
+                    },
+                }) + '\n',
+                exitCode: 0,
+            }));
+            const params = {
+                pattern: 'world',
+                max_matches_per_file: 1,
+            };
+            const invocation = grepTool.build(params);
+            await invocation.execute(abortSignal);
+            const spawnArgs = mockSpawn.mock.calls[0][1];
+            expect(spawnArgs).toContain('--max-count');
+            expect(spawnArgs).toContain('1');
+        });
+        it('should respect total_max_matches and truncate results', async () => {
+            // Return 3 matches, but set total_max_matches to 2
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'match 1\n' },
+                    },
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 2,
+                            lines: { text: 'match 2\n' },
+                        },
+                    }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileA.txt' },
+                            line_number: 3,
+                            lines: { text: 'match 3\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
+            const params = {
+                pattern: 'match',
+                total_max_matches: 2,
+            };
+            const invocation = grepTool.build(params);
+            const result = await invocation.execute(abortSignal);
+            expect(result.llmContent).toContain('Found 2 matches');
+            expect(result.llmContent).toContain('results limited to 2 matches for performance');
+            expect(result.llmContent).toContain('L1: match 1');
+            expect(result.llmContent).toContain('L2: match 2');
+            expect(result.llmContent).not.toContain('L3: match 3');
+            expect(result.returnDisplay).toBe('Found 2 matches (limited)');
+        });
+        it('should return only file paths when names_only is true', async () => {
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'hello world\n' },
+                    },
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileB.txt' },
+                            line_number: 5,
+                            lines: { text: 'hello again\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
+            const params = {
+                pattern: 'hello',
+                names_only: true,
+            };
+            const invocation = grepTool.build(params);
+            const result = await invocation.execute(abortSignal);
+            expect(result.llmContent).toContain('Found 2 files with matches');
+            expect(result.llmContent).toContain('fileA.txt');
+            expect(result.llmContent).toContain('fileB.txt');
+            expect(result.llmContent).not.toContain('L1:');
+            expect(result.llmContent).not.toContain('hello world');
+        });
+        it('should filter out matches based on exclude_pattern', async () => {
+            mockSpawn.mockImplementationOnce(createMockSpawn({
+                outputData: JSON.stringify({
+                    type: 'match',
+                    data: {
+                        path: { text: 'fileA.txt' },
+                        line_number: 1,
+                        lines: { text: 'Copyright 2025 Google LLC\n' },
+                    },
+                }) +
+                    '\n' +
+                    JSON.stringify({
+                        type: 'match',
+                        data: {
+                            path: { text: 'fileB.txt' },
+                            line_number: 1,
+                            lines: { text: 'Copyright 2026 Google LLC\n' },
+                        },
+                    }) +
+                    '\n',
+                exitCode: 0,
+            }));
+            const params = {
+                pattern: 'Copyright .* Google LLC',
+                exclude_pattern: '2026',
+            };
+            const invocation = grepTool.build(params);
+            const result = await invocation.execute(abortSignal);
+            expect(result.llmContent).toContain('Found 1 match');
+            expect(result.llmContent).toContain('fileA.txt');
+            expect(result.llmContent).not.toContain('fileB.txt');
+            expect(result.llmContent).toContain('Copyright 2025 Google LLC');
+        });
+    });
 });
 afterAll(() => {
     storageSpy.mockRestore();