Add grep tool for code search by content pattern

Summary

Add a grep tool that searches file contents by regex pattern within the workspace. Essential for code navigation and analysis tasks.

Motivation

A coding agent needs to find where functions are defined, where variables are used, where errors are thrown. The exec tool can run grep commands, but a dedicated tool provides:

• Workspace boundary enforcement (can't search outside workspace)
• Structured output (file, line number, match) instead of raw stdout
• Output truncation to stay within token budgets
• No shell injection risk from pattern arguments

Proposed interface

{
  "name": "grep",
  "parameters": {
    "pattern": "string — regex pattern to search for",
    "path": "string — optional subdirectory or file to search (default: workspace root)",
    "glob": "string — optional file pattern filter, e.g. '*.go' (default: all files)",
    "context_lines": "integer — lines of context around each match (default: 0)",
    "max_results": "integer — maximum number of matches to return (default: 50)"
  }
}

Implementation notes

• Option A: Shell out to ripgrep (rg) if available, fall back to grep -rn
• Option B: Use Go's regexp + filepath.Walk for zero external dependencies
• Option A preferred for performance; ripgrep can be bundled in the coding Dockerfile flavor (#7)
• Enforce workspace boundary (same logic as read_file)
• Truncate output to configurable max (default 50KB, same as exec)
• Return results as structured text: file:line: matched_line
• Respect .gitignore patterns if in a git repo

Related

• Part of the coding agent capabilities gap analysis
• Pairs with edit_file (#26) and glob (#28) for code navigation + editing workflow
• #7 — Specialized Dockerfiles (coding flavor would bundle ripgrep)

Start by examining the existing read_file and exec tool implementations, especially their workspace-boundary and output-limit handling. Define the grep tool with the proposed parameters, structured matches, glob and context support, and .gitignore behavior; done means searches stay within the workspace and results are truncated at the configured limit.