agent tool: first-class search (capped rg), stop exec-ing grep #562

Summary

Add a first-class search (or grep) workspace tool. Today the model execs rg/grep, which dumps unbounded shell output into the turn and is the usual way it “finds” code.

This is a product / tool-surface issue, not agent-session (#548). It will help context later; ship it as a sandbox tool with a hard hit cap.

Why

Peer harnesses (Orrery et al.) keep search in the prefix: one small schema, bounded hits (path, line, text), no shell. Their in-process WalkDir is a bad impl (reads every file, glob is basename-only). We already have rg in the jail — call it argv-only with a max-results cap.

Goal

Success: the model stops exec rg for ordinary “where is X?”; exec stays for real commands.

Constraints

• Same jail / cwd / in-jail-abs path rules as read_file (resolvePathForTool).
• Read grant only. Secrets redacted. Binary / oversize files skipped.
• Do not WalkDir the workspace from the Next process.
• Do not copy Orrery’s filepath.Match(base) glob.
• Tool list is prefix-stable (skills: inject a catalog, not full bodies, every turn #557 is a different board) — adding one schema is the point; don’t add five search variants.

Non-goals

• Hashline
• Replacing exec
• Background jobs
• Agent-session fold / compaction

Related

• lib/agent/tools.ts — no search today (pwd / change_dir / list_dir / read_file / write_file / str_replace / exec)
• agent tool: exec summary in the result, verbose log on disk #565 exec summary (so leftover exec rg is still short)
• agent tool: windowed read_file — don’t dump huge files #563 windowed read_file (jump to a hit)
• agent memory: structured truncated tool_result on the wire (not Tool: crumbs) #549 is the fold; this is the tool

Suggested next

create-plan with Caps table (max hits, max bytes, timeout).