Greptile Summary

Fixes exec allowlist path matching crash when paths contain regex metacharacters (notably + in /usr/bin/g++). The fix extracts regex escaping logic into a dedicated escapeRegExpLiteral function that properly escapes all regex metacharacters (.*+?^${}()|[]\) while preserving glob wildcard semantics (*, **, ?).

Key improvements:

• Prevents regex compilation errors: "Nothing to repeat" errors from paths like /usr/bin/g++ are now prevented
• Cleaner implementation: extracted escaping logic into a reusable helper function
• Comprehensive test coverage: added tests for paths with ++ and wildcard-metacharacter combinations (/usr/bin/*++)

Technical details:

• The globToRegExp function now processes wildcards first (converting * to [^/]*, ** to .*, ? to .), then escapes all other characters through escapeRegExpLiteral
• All regex metacharacters are uniformly handled, making the fix robust for any future edge cases
• The removed test "requires a resolved path" is still functionally covered by other test files

Confidence Score: 5/5

• This PR is safe to merge with no concerns
• The fix is focused, correct, and well-tested. It addresses a specific crash bug without introducing side effects. The regex escaping logic is comprehensive (covers all metacharacters), the control flow is correct (wildcards are processed before escaping), and the test coverage validates both the core bug and edge cases. The implementation improves code clarity by extracting the escaping logic into a named function.
• No files require special attention

_{Last reviewed commit: 6861d7e}

Landed via temp rebase onto main.

• Gate: pnpm -s vitest run src/infra/exec-approvals.test.ts src/infra/exec-approvals-parity.test.ts src/infra/exec-approvals-safe-bins.test.ts
• Land commit: 559a1295fd687474e55f669b83cb2f719bc98c39
• Merge commit: 21d6d87

Thanks @stakeswky!