fix(file): close the allowlist around PostgreSQL bracket expressions

`[:class:]` was rejected while `[=equivalence=]` and `[.collating.]` were
forwarded unchanged. All three are PostgreSQL bracket expressions with no
JavaScript counterpart, and the parser exists to admit only what both engines
spell the same way — so two of them passed an allowlist whose whole point is
to close, and were accepted by documentation that says POSIX classes are not
supported.

They are now rejected by the construct they open, each named in its own error.
An ordinary class holding a literal dot, `[.]` or `[a.b]`, is untouched: the
form only matches on a bracket nested inside a class.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/workspace-files/search/regex.test.ts

@@ -90,7 +90,9 @@ describe('analyzeFileSearchRegex', () => {
       ['(?<name>foo)', /Named group/],
       ['(?i)foo', /Inline flag/],
       ['(foo)\\1bar', /Backreference/],
-      ['[[:alpha:]]foo', /POSIX class/],
+      ['[[:alpha:]]foo', /POSIX character class/],
+      ['[[=a=]]foo', /POSIX equivalence class/],
+      ['[[.hyphen.]]foo', /POSIX collating element/],
       ['\\p{Lu}foo', /Unicode property/],
       ['\\yfoo\\y', /"\\y" is not supported — write "\\b" instead/],
       ['\\Afoo\\Z', /"\\A" is not supported — write "\^" instead/],
@@ -132,6 +134,8 @@ describe('analyzeFileSearchRegex', () => {
       'user_id=\\w+ token',
       'error a{3,}bcd',
       'error a{3,10}bcd',
+      'needle[.]txt',
+      'needle[a.b]txt',
     ])('accepts %s', (source) => {
       expect(() => analyzeFileSearchRegex(source)).not.toThrow()
     })

apps/sim/lib/workspace-files/search/regex.ts

@@ -62,6 +62,13 @@ const OPAQUE: LiteralGuarantee = {
   zeroWidth: false,
 }
 
+/** PostgreSQL bracket expressions, by the character that opens them after `[`. */
+const POSIX_BRACKETS: Record<string, string | undefined> = {
+  ':': 'character class',
+  '=': 'equivalence class',
+  '.': 'collating element',
+}
+
 /** Escapes whose meaning and spelling are identical in PostgreSQL ARE and JavaScript. */
 const SHARED_ESCAPE_LETTERS = new Set(['d', 'D', 'w', 'W', 's', 'S', 't', 'n', 'r', 'f', 'v'])
 
@@ -401,9 +408,17 @@ class FileSearchRegexParser {
         this.index += 1
         return OPAQUE
       }
-      if (character === '[' && this.source[this.index + 1] === ':') {
+      /**
+       * `[:class:]`, `[=equivalence=]` and `[.collating.]` are all PostgreSQL
+       * bracket expressions with no JavaScript counterpart — JavaScript reads
+       * them as an ordinary set of characters. Only the first was rejected, so
+       * the other two passed an allowlist whose whole point is to close.
+       */
+      const posixBracket =
+        character === '[' ? POSIX_BRACKETS[this.source[this.index + 1]] : undefined
+      if (posixBracket) {
         throw new FileSearchPatternError(
-          `POSIX class at position ${this.index + 1} is not supported — write the range directly, such as "[a-z]" or "\\w"`
+          `POSIX ${posixBracket} at position ${this.index + 1} is not supported — write the characters directly, such as "[a-z]" or "\\w"`
         )
       }
       if (character === '\\') {