fix(search_code): surface cs failures + harden query/path handling

Address findings from an independent code review of the search_code tool:

- Critical: cs failures (non-zero exit, or SIGTERM from the spawn timeout)
  were swallowed and reported to the model as 'No matches found', discarding
  stderr. Now capture exit code + signal from 'close' and return a real
  Error: (timeout message for SIGTERM, exit-code + stderr otherwise). cs
  exits 0 on a genuine no-match, so that path still reports correctly.
- High: a query beginning with '-' (e.g. '-foo') was parsed by cs as a
  (usually invalid) flag. Insert a '--' separator before the query so it is
  always treated as the positional search term.
- Low: relative-path display fallback now matches the workdir only at a path
  boundary, so a sibling dir sharing the prefix (e.g. /app vs /app-secrets)
  isn't rendered as a '../app-secrets/...' path.

Adds tests for the non-zero-exit (stderr surfaced, not 'No matches') and
dash-leading-query cases. All tests (598), biome, and tsc pass.

1 files changed, 34 insertions, 0 deletions

diff --git a/packages/core/tests/tools/search-code.test.ts b/packages/core/tests/tools/search-code.test.ts
index b805d15..1632214 100644
--- a/packages/core/tests/tools/search-code.test.ts
+++ b/packages/core/tests/tools/search-code.test.ts
@@ -20,6 +20,13 @@ const ECHO_ENV_STUB = `#!/usr/bin/env bash
 printf '%s' "$CS_STUB_OUTPUT"
 `;
 
+// A stub that writes to stderr and exits non-zero, impersonating a cs failure
+// (bad flag, invalid regex, etc.).
+const FAIL_STUB = `#!/usr/bin/env bash
+echo "cs: simulated failure on stderr" >&2
+exit 3
+`;
+
 describe("search_code tool", () => {
 	let workDir: string;
 	const savedBin = process.env.DISPATCH_CS_BIN;
@@ -147,6 +154,22 @@ describe("search_code tool", () => {
 		}
 	});
 
+	it("reports an error (not 'No matches') when cs exits non-zero", async () => {
+		const stubDir = await mkdtempP(join(tmpdir(), "dispatch-cs-stub-"));
+		try {
+			process.env.DISPATCH_CS_BIN = writeStub(stubDir, FAIL_STUB);
+			const tool = createSearchCodeTool(workDir);
+			const out = await tool.execute({ query: "x" });
+			expect(out).toMatch(/^Error:/);
+			expect(out).toContain("exited with code 3");
+			// stderr from cs is surfaced to the caller.
+			expect(out).toContain("simulated failure on stderr");
+			expect(out).not.toContain("No matches found");
+		} finally {
+			await rmP(stubDir, { recursive: true, force: true });
+		}
+	});
+
 	// ── Live integration: only runs when a real `cs` binary is available. ──
 	const liveCsBin = findRealCs();
 	describe.runIf(liveCsBin)("live cs binary", () => {
@@ -165,6 +188,17 @@ describe("search_code tool", () => {
 			expect(out).not.toContain("Error:");
 		});
 
+		it("treats a dash-leading query as a search term, not a cs flag", async () => {
+			process.env.DISPATCH_CS_BIN = liveCsBin as string;
+			// A literal token beginning with '-' must not be parsed as a flag.
+			await writeFileP(join(workDir, "dash.ts"), "const dashToken = 1;\n");
+			const tool = createSearchCodeTool(workDir);
+			const out = await tool.execute({ query: "-dashToken" });
+			// Whether or not cs ranks a hit, it must NOT error out on flag parsing.
+			expect(out).not.toContain("unknown shorthand flag");
+			expect(out).not.toMatch(/^Error: cs exited/);
+		});
+
 		it("returns 'No matches found.' for a query with no hits", async () => {
 			process.env.DISPATCH_CS_BIN = liveCsBin as string;
 			await writeFileP(join(workDir, "alpha.ts"), "export const a = 1;\n");