fix(security): block grep safe-bin file-read bypass

src/infra/exec-approvals.test.ts

@@ -497,6 +497,22 @@ describe("exec approvals safe bins", () => {
       safeBins: ["grep"],
       executableName: "grep",
     },
+    {
+      name: "blocks grep file positional when pattern uses -e",
+      argv: ["grep", "-e", "needle", ".env"],
+      resolvedPath: "/usr/bin/grep",
+      expected: false,
+      safeBins: ["grep"],
+      executableName: "grep",
+    },
+    {
+      name: "blocks grep file positional after -- terminator",
+      argv: ["grep", "-e", "needle", "--", ".env"],
+      resolvedPath: "/usr/bin/grep",
+      expected: false,
+      safeBins: ["grep"],
+      executableName: "grep",
+    },
   ];
 
   for (const testCase of cases) {

src/infra/exec-safe-bin-policy.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { SAFE_BIN_PROFILES, validateSafeBinArgv } from "./exec-safe-bin-policy.js";
+
+describe("exec safe bin policy grep", () => {
+  const grepProfile = SAFE_BIN_PROFILES.grep;
+
+  it("allows stdin-only grep when pattern comes from flags", () => {
+    expect(validateSafeBinArgv(["-e", "needle"], grepProfile)).toBe(true);
+    expect(validateSafeBinArgv(["--regexp=needle"], grepProfile)).toBe(true);
+  });
+
+  it("blocks grep positional pattern form to avoid filename ambiguity", () => {
+    expect(validateSafeBinArgv(["needle"], grepProfile)).toBe(false);
+  });
+
+  it("blocks file positionals when pattern comes from -e/--regexp", () => {
+    expect(validateSafeBinArgv(["-e", "SECRET", ".env"], grepProfile)).toBe(false);
+    expect(validateSafeBinArgv(["--regexp", "KEY", "config.py"], grepProfile)).toBe(false);
+    expect(validateSafeBinArgv(["--regexp=KEY", ".env"], grepProfile)).toBe(false);
+    expect(validateSafeBinArgv(["-e", "KEY", "--", ".env"], grepProfile)).toBe(false);
+  });
+});

src/infra/exec-safe-bin-policy.ts

@@ -91,7 +91,10 @@ export const SAFE_BIN_PROFILE_FIXTURES: Record<string, SafeBinProfileFixture> =
     ],
   },
   grep: {
-    maxPositional: 1,
+    // Keep grep stdin-only: pattern must come from -e/--regexp.
+    // Allowing one positional is ambiguous because -e consumes the pattern and
+    // frees the positional slot for a filename.
+    maxPositional: 0,
     valueFlags: [
       "--regexp",
       "--file",