[alex09x]

Problem

Explicit single-file code_grep searches went to remote ripgrep first. On a delayed remote exec, even an empty result waited for the remote command before the local fallback could run (#1531). Directory searches are a separate path and remain remote-first (#1321).

Change

• For a single existing file inside the checkout, canonicalize the workspace and requested path and reject paths outside the workspace before any local or remote search. This also refuses .. traversal and symlinks resolving outside the checkout.
• Try local ripgrep in spawn_blocking first for contained single files.
• Keep remote ripgrep and the in-process walker as fallbacks when local ripgrep is unavailable or cannot search the file. Do not repeat the same local ripgrep attempt after it has already returned no result.
• Leave directory and workspace searches on the existing remote-first path; Literal grep waits without progress before returning three matches #1321 is not closed by this PR.

Reproduce and verify

The public single-file code_grep regression searches for a missing token and an existing token while a mock remote gateway delays ExecRequest by 2 seconds. The searches return locally and confirm no remote exec was started. A second public test verifies that both ../ traversal and an absolute file outside the checkout are refused before searching.

Before the change, the empty search waited for the remote command and failed at 2.01 s. The original single-file test measured 0.06 s after the optimization.

Measurements

For the controlled empty-result fixture, latency changed from 2.01 s (remote-first mock baseline) to 0.06 s (local file search). This is a test fixture measurement, not a repository-wide benchmark.

Checks

Revision ff551d5930e970fde035100ae279ec936df23755, Linux build node:

• cargo fmt --all -- --check: exit 0.
• cargo clippy -p prod-code-mcp --all-targets: exit 0 with existing warnings (124 warnings in the test build and one unrelated test-helper warning); no strict-clean claim.
• cargo test -p prod-code-mcp --test tools code_grep_ -- --nocapture: 2 passed, 0 failed.
• prod-code impact --base origin/main --depth 1 --json: exit 0; selected the directly affected grep tests and reported incomplete callers at depth 1 plus a test-helper reference timeout.

Current head 923e1949f1653c57abcbe5802ae125facea1c27f integrates main after #1711. The merge adds only the #1711 signature changes and changelog entry relative to ff551d59; grep implementation and regression tests are unchanged.

Closes #1531
Refs #1321

[alex09x]

Independent read-only P0–P3 review of d67e804: APPROVE, no findings. Workspace containment, fallback behavior, and accurate #1531-only issue scope are verified in the PR checks.

[alex09x]

Independent read-only P0–P3 review of ff551d5: APPROVE, no findings. The canonical path guards, fallback behavior, accurate #1531-only closure, and latest base integration are verified in the PR checks.

[alex09x]

Independent read-only P0–P3 review of 923e194: APPROVE, no findings. The current-base review confirms only main/CHANGELOG updates since the tested grep revision; #1321 remains open.