fix(rg): support color and option terminator flags

[matchai]

Accepts ripgrep’s --color modes and the -- option terminator so sandbox clients can use the same color-safe invocation with real ripgrep and just-bash.

Also matches ripgrep’s heading behavior for one explicitly named file. Adds focused unit coverage and comparison fixtures recorded from real ripgrep.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
just-bash-website	Ready	Preview, v0	Sep 20, 2026 3:37pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
just-bash	Ignored	v0	Sep 20, 2026 3:37pm UTC

[auto-maintain]

🤖 auto-maintain review

Automated, advisory triage for @matchai's PR. Facts below are read from the GitHub API.

Check	Result
Author's merged PRs (this repo)	1
Account established	✅ (age 4850d · 1176 followers · 165 public repos)
Commits signed/verified	✅ 2/2
Changeset included	✅ (.changeset/rg-color-option.md)

Review panel: 🟡 medium highest severity

just-bash maintainer code review: 🟡 medium

The core invocation works, but option termination is incomplete and two accepted color modes have incorrect semantics.

• packages/just-bash/src/commands/rg/rg.ts:98 — The raw-argument checks for `--help` and `--type-list` run before terminator-aware parsing, so tokens after `--` still trigger special modes instead of becoming positional arguments.
• packages/just-bash/src/commands/rg/rg-parser.ts:163 — `--color` accepts `always` and `ansi` but discards the mode, producing plain text even though both modes explicitly force colored output in ripgrep. Implement forced coloring or reject these unsupported modes.

General code review: 🟡 medium

The new common invocation works, but option termination is incomplete and two accepted color modes silently violate their advertised semantics.

• packages/just-bash/src/commands/rg/rg.ts:98 — The option terminator is bypassed by the pre-parse checks: `rg -- --help file` returns help, and `rg -- --type-list file` lists types, instead of treating those tokens as the positional pattern. These special flags must only be recognized before the first `--`.
• packages/just-bash/src/commands/rg/rg-parser.ts:161 — All color modes are accepted but discarded, so `--color=always` and `--color=ansi` produce uncolored output despite those modes explicitly requiring ANSI output in ripgrep. Either implement their semantics or reject/document only the no-color compatibility modes.

Adversarial security: 🟡 medium

Option termination does not fully prevent positional arguments from being interpreted as control flags.

• packages/just-bash/src/commands/rg/rg.ts:98 — The new `--` terminator is bypassed by raw pre-parsing for `--help` and `--type-list`. For example, `rg -- --help file` returns help instead of searching, allowing an attacker-controlled pattern or path after the terminator to hijack the operation and produce successful unrelated output.

Adversarial security (second opinion): 🟢 low

Small, well-scoped rg compatibility change: adds `--color` as a validated no-op flag, implements the `--` option terminator, and suppresses the `--heading` filename line for a single explicitly named file. No new networking, process execution, filesystem, or dependency surface; the `--` handling is single-shot and correctly falls through to positional parsing, `--color` is stored nowhere (no injection path) and its accepted values/error text match ripgrep 14, and the heading change is corroborated by a comparison fixture whose id hash matches its recorded command/files. No actionable defects found.

Standard Bash and host portability: 🟢 low

No actionable Bash or host-portability issues found.

_{Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.}