@coo-quack/sensitive-canary 0.7.0 → 0.8.1

package/dist/user-prompt-submit-hook.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { blockOnUnhandledError, failClosed } from "./lib/fail-closed.js";
+import { allowTagLines, applyAllowTags, dedupeFindings, findingsToLines, randomBird, resolveTagPriority, typedTextOf, } from "./lib/inspector.js";
+import { beginScanBudget, enabledCategoriesFromEnv, scan, } from "./lib/rules.js";
+blockOnUnhandledError();
+// Depth at which a prompt stops being searched. The bound is here so a deeply
+// nested value cannot make the hook walk an arbitrary tree before every prompt.
+const MAX_PROMPT_DEPTH = 4;
+function collectStrings(value, depth = 0) {
+    if (typeof value === "string")
+        return [value];
+    if (depth >= MAX_PROMPT_DEPTH)
+        return [];
+    if (Array.isArray(value))
+        return value.flatMap((item) => collectStrings(item, depth + 1));
+    if (value !== null && typeof value === "object")
+        return Object.values(value).flatMap((item) => collectStrings(item, depth + 1));
+    return [];
+}
+const ENABLED_CATEGORIES = enabledCategoriesFromEnv();
+let raw = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => (raw += chunk));
+process.stdin.on("end", () => {
+    // Started here rather than at module load: the wait for stdin belongs to the
+    // runtime, and counting it against the scan let a slow handover spend the
+    // whole allowance before anything was read.
+    beginScanBudget();
+    let data;
+    try {
+        // Empty stdin is nothing to check. Bytes that do not parse are a check that
+        // could not read its input, which is not the same as safe: two characters
+        // missing from the end of a payload are enough to hide a key.
+        if (raw.trim().length === 0)
+            process.exit(0);
+        const parsed = JSON.parse(raw);
+        // `JSON.parse("null")` succeeds and returns null, which then threw on the
+        // first field read. A payload that is not an object carries no prompt.
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            process.exit(0);
+        data = parsed;
+    }
+    catch (error) {
+        // The check never started, so it vouches for nothing. Everything else that
+        // cannot finish stops the call; input that will not parse is the same case.
+        failClosed(error);
+    }
+    // Whatever the runtime sends. Not throwing on a prompt that is not a string
+    // was only half of it: coercing to "" made the hook exit 0 on the shapes it
+    // could not read, which is the same silence as never running. Every string
+    // inside the value is collected instead, to a bounded depth, so
+    // `{"prompt":{"text":"…"}}` and `{"prompt":["…"]}` are read like a prompt.
+    const prompt = collectStrings(data.prompt).join("\n");
+    const allFindings = scan(prompt, ENABLED_CATEGORIES);
+    if (allFindings.length === 0)
+        process.exit(0);
+    // From what the user typed, not from what they pasted: a fenced log or a
+    // README quoting `[allow-secret]` would otherwise lift the guard on the key in
+    // the same message. Both hooks read tags this way, so the same text gets the
+    // same answer whichever one sees it.
+    const { effectiveAllow, effectiveMask } = resolveTagPriority(typedTextOf(prompt));
+    const afterAllow = dedupeFindings(applyAllowTags(allFindings, effectiveAllow));
+    if (afterAllow.length === 0)
+        process.exit(0);
+    const maskableFindings = afterAllow.filter((f) => (f.category === "secret" && effectiveMask.has("secret")) ||
+        (f.category === "pii" && effectiveMask.has("pii")));
+    if (maskableFindings.length > 0) {
+        const usedTags = effectiveMask.has("all")
+            ? "[mask-all]"
+            : ["secret", "pii"]
+                .filter((d) => effectiveMask.has(d))
+                .map((d) => `[mask-${d}]`)
+                .join(", ");
+        const maskBlockLines = [
+            "",
+            `${randomBird()} sensitive-canary: prompt masking is not supported`,
+            "",
+            `  ${usedTags} cannot mask prompt content.`,
+            "  The following sensitive data was detected:",
+            "",
+            ...findingsToLines(dedupeFindings(maskableFindings)),
+            "",
+            "  Please choose one of the following:",
+            "",
+            "  1. Manually redact the values above and resubmit",
+            "  2. To send as-is, add an allow tag to your prompt:",
+            ...allowTagLines(maskableFindings, { indent: "       " }),
+            "",
+        ];
+        process.stderr.write(maskBlockLines.join("\n"));
+        process.exit(2);
+    }
+    const blockLines = [
+        "",
+        `${randomBird()} sensitive-canary: sensitive data detected — blocked`,
+        "",
+        ...findingsToLines(afterAllow),
+        "",
+        "To allow, add a tag to your prompt:",
+        ...allowTagLines(afterAllow),
+        "",
+    ];
+    process.stderr.write(blockLines.join("\n"));
+    process.exit(2);
+});

package/hooks/hooks.json

@@ -3,7 +3,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Read|Bash",
+        "matcher": "Read|NotebookRead|Bash|Grep|mcp__.*",
         "hooks": [
           {
             "type": "command",

package/package.json

@@ -1,15 +1,28 @@
 {
   "name": "@coo-quack/sensitive-canary",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Claude Code hooks that block secrets and PII before they reach the Anthropic API",
-  "homepage": "https://coo-quack.github.io/sensitive-canary/",
-  "type": "module",
+  "license": "MIT",
+  "author": "coo-quack",
+  "keywords": [
+    "security",
+    "secrets",
+    "pii",
+    "hooks"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/coo-quack/sensitive-canary.git"
   },
+  "homepage": "https://coo-quack.github.io/sensitive-canary/",
+  "bugs": {
+    "url": "https://github.com/coo-quack/sensitive-canary/issues"
+  },
+  "type": "module",
   "files": [
     "src/",
+    "!src/**/__tests__/**",
+    "dist/",
     ".claude-plugin/",
     "hooks/",
     "README.md",
@@ -20,23 +33,24 @@
     "node": ">=22.6.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.6",
+    "@biomejs/biome": "2.5.8",
     "@types/node": "25.9.5",
     "typescript": "7.0.2",
-    "vitepress": "2.0.0-alpha.18",
+    "vitepress": "2.0.0-alpha.19",
     "vitest": "4.1.10"
   },
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "lint": "biome lint src",
-    "format": "biome format --write src",
-    "format:check": "biome ci --linter-enabled=false src",
-    "fix": "biome check --write src",
-    "ci": "tsc --noEmit && biome check src && vitest run",
+    "lint": "biome lint --error-on-warnings src vitest.config.ts docs/.vitepress/config.ts docs/.vitepress/theme",
+    "format": "biome format --write src vitest.config.ts docs/.vitepress/config.ts docs/.vitepress/theme",
+    "format:check": "biome ci --linter-enabled=false src vitest.config.ts docs/.vitepress/config.ts docs/.vitepress/theme",
+    "fix": "biome check --write src vitest.config.ts docs/.vitepress/config.ts docs/.vitepress/theme",
+    "ci": "tsc --noEmit && biome check --error-on-warnings src vitest.config.ts docs/.vitepress/config.ts docs/.vitepress/theme && vitest run",
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
-    "docs:preview": "vitepress preview docs"
+    "docs:preview": "vitepress preview docs",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node -e \"require('node:fs').copyFileSync('src/lib/default-config.json','dist/lib/default-config.json')\""
   }
 }

package/src/lib/bash-commands.ts

@@ -0,0 +1,455 @@
+// What this hook knows about how each command treats its operands.
+//
+// The tables are the knowledge: which commands print a file they are handed,
+// which take a pattern first, which run another command. extractCommandRefs
+// turns a command line into the files it may print and the environment it may
+// expose, leaving the parsing to shell.ts.
+
+import path from "node:path";
+import {
+  ARGUMENT_ONLY_COMMANDS,
+  asksForRecursion,
+  type CommandRefs,
+  classifyCommand,
+  editsInPlace,
+  GIT_GLOBAL_FLAGS_WITH_OPERAND,
+  GREP_FAMILY,
+  gitLineRangeFile,
+  gitSubcommandPrintsFiles,
+  isWrapperTarget,
+  MAX_NESTING_DEPTH,
+  mergeRefs,
+  POSIX_SHELLS,
+  patternSupplyingFlag,
+  RECURSIVE_BY_DEFAULT,
+  WRAPPER_COMMANDS,
+  WRITE_TARGET_FLAGS,
+} from "./command-tables.ts";
+import {
+  extractQuotedLiterals,
+  extractSubstitutions,
+  isNonCommandToken,
+  type ShellToken,
+  stripHeredocBodies,
+  tokenizeCommand,
+} from "./shell.ts";
+
+// Index of the token naming the command whose operands matter.
+//
+// The lead command is the first token that is not a flag, redirection or
+// `VAR=value` assignment. Only a known wrapper (`sudo`, `env`, `timeout`, …)
+// is peeled, by searching the rest of the segment for the first token this
+// hook can classify (`env` and `printenv` included, so their detection behind
+// wrapper operands works); anything else is treated as the command itself. Searching
+// unconditionally mistook operands for commands: `echo cat secrets` resolved
+// to `cat`, and a file that was never read was scanned and blocked. Wrappers
+// are still not peeled by counting their flags: `sudo -u root cat f` would
+// mistake `root` for the command, and `timeout -s KILL 5 cat f` would
+// mistake `5`. Falling back to the lead leaves an unknown command classified
+// as itself.
+//
+// The search past a wrapper carries the same hazard one step further in, which
+// is why it stops at an ARGUMENT_ONLY_COMMANDS name: `sudo echo cat secrets`
+// otherwise resolved to the `cat` sitting in echo's arguments. Past any other
+// unclassifiable name the search continues, since that name may be a wrapper
+// flag's value rather than the command.
+function findCommandIndex(tokens: ShellToken[]): number {
+  let lead = -1;
+  // A redirection may come before the command — `< secrets cat` is `cat` reading
+  // `secrets`. The operator is skipped as a non-command token, but its target is
+  // an ordinary word, so `secrets` was taken for the command name and the real
+  // one went unclassified: nothing of its operands was collected, and a spelling
+  // away from `cat < secrets`, which blocks.
+  let skipRedirectTarget = false;
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (token === undefined) continue;
+    if (skipRedirectTarget) {
+      skipRedirectTarget = false;
+      continue;
+    }
+    if (token.redirect) {
+      skipRedirectTarget = true;
+      continue;
+    }
+    if (isNonCommandToken(token)) continue;
+    lead = i;
+    break;
+  }
+  if (lead === -1) return 0;
+
+  const leadName = path.basename(tokens[lead]?.value ?? "");
+  if (!WRAPPER_COMMANDS.has(leadName)) return lead;
+
+  for (let i = lead + 1; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (tok === undefined || isNonCommandToken(tok)) continue;
+    const name = path.basename(tok.value);
+    if (isWrapperTarget(name) || ARGUMENT_ONLY_COMMANDS.has(name)) return i;
+  }
+  return lead;
+}
+
+// `env` and `printenv` print the environment unless they are being used to run
+// another command. `sudo printenv` counts; `env FOO=1 cat f` does not. The
+// command is located with findCommandIndex, so wrapper flags and operands
+// (`sudo -u root printenv`, `timeout 5 env`) cannot hide it.
+function inspectEnvironmentCommand(tokens: ShellToken[]): {
+  dumps: boolean;
+  named: string[];
+} {
+  const nothing = { dumps: false, named: [] };
+
+  const start = findCommandIndex(tokens);
+  const cmdToken = tokens[start];
+  if (cmdToken === undefined) return nothing;
+
+  const name = path.basename(cmdToken.value);
+  if (name !== "env" && name !== "printenv") return nothing;
+
+  // `printenv` prints the whole environment unless it is given variables to
+  // print. A redirection target is not one of them: `printenv > out.txt` prints
+  // everything, and counting `out.txt` as a named variable left the environment
+  // unscanned.
+  if (name === "printenv") {
+    const rest = tokens.slice(start + 1);
+    const named: string[] = [];
+    for (let j = 0; j < rest.length; j++) {
+      const t = rest[j];
+      if (t === undefined) continue;
+      if (t.redirect) {
+        j++; // its target, or a heredoc delimiter
+        continue;
+      }
+      if (isNonCommandToken(t)) continue; // flags
+      named.push(t.value);
+    }
+    return named.length === 0
+      ? { dumps: true, named: [] }
+      : { dumps: false, named };
+  }
+
+  // `env` prints the environment unless a subcommand follows its own
+  // arguments: assignments (`FOO=1`), flags, and the values of flags that
+  // take one (`-u FOO`, `-C dir`) are all env's own. The `-S` split string
+  // is the subcommand itself (`env -S "cat f"` runs cat), so it rules a dump
+  // out. With no subcommand the whole environment is printed — `env FOO=1`
+  // and `env -u FOO` included. Exception: `-i` starts from an empty
+  // environment, so only the given assignments (already scanned as command
+  // text) print.
+  const rest = tokens.slice(start + 1);
+  let ignoreEnvironment = false;
+  let hasCommand = false;
+  for (let j = 0; j < rest.length; j++) {
+    const t = rest[j];
+    if (t === undefined) continue;
+    const value = t.value;
+    if (value === "-i" || value === "--ignore-environment") {
+      ignoreEnvironment = true;
+      continue;
+    }
+    if (t.redirect) {
+      j++; // redirection operator: its target is env's own argument here
+      continue;
+    }
+    if (
+      value === "-u" ||
+      value === "--unset" ||
+      value === "-C" ||
+      value === "--chdir"
+    ) {
+      j++; // flag value
+      continue;
+    }
+    if (value === "-S" || value === "--split-string") {
+      hasCommand = true; // the split string is the subcommand
+      break;
+    }
+    if (isNonCommandToken(t)) continue; // flags and FOO=1 assignments
+    hasCommand = true;
+    break;
+  }
+  return { dumps: !hasCommand && !ignoreEnvironment, named: [] };
+}
+
+// True when `token` introduces inline program text for `cmd`. POSIX shells only
+// take code after -c; other interpreters also use -e and combined forms (-pe).
+function isInlineCodeFlag(cmd: string, token: string): boolean {
+  if (token === "-c" || token === "--command" || token === "--eval")
+    return true;
+  if (POSIX_SHELLS.has(cmd)) {
+    // A shell bundles its switches too: `bash -lc 'cat secrets'` runs the same
+    // string `bash -c` would, and only the exact spelling was recognised. The
+    // letters before the `c` have to be switches that take no value of their
+    // own, or the `c` is part of something else's value.
+    return /^-[abefhilmnpuvxCPT]*c$/.test(token);
+  }
+  if (token === "-r") return true; // php -r
+  return /^-[A-Za-z]*[eE]$/.test(token);
+}
+
+// Everything a Bash command reveals that the hook can inspect before it runs:
+// the files whose contents it may print, and the environment it may expose.
+export function extractCommandRefs(command: string, depth = 0): CommandRefs {
+  const refs: CommandRefs = {
+    paths: [],
+    envVars: [],
+    dumpsEnvironment: false,
+    searchesWorkingDirectory: false,
+  };
+
+  if (depth > MAX_NESTING_DEPTH) return refs;
+
+  // Heredoc bodies are text, not commands; strip them before any other pass.
+  const text = stripHeredocBodies(command);
+
+  // `echo $(cat secrets)` reads secrets just as `cat secrets` does.
+  for (const inner of extractSubstitutions(text)) {
+    mergeRefs(refs, extractCommandRefs(inner, depth + 1));
+  }
+
+  for (const tokens of tokenizeCommand(text)) {
+    const environment = inspectEnvironmentCommand(tokens);
+    if (environment.dumps) refs.dumpsEnvironment = true;
+    refs.envVars.push(...environment.named);
+
+    mergeRefs(refs, collectSegmentRefs(tokens, depth));
+  }
+
+  return {
+    paths: [...new Set(refs.paths)],
+    envVars: [...new Set(refs.envVars)],
+    dumpsEnvironment: refs.dumpsEnvironment,
+    searchesWorkingDirectory: refs.searchesWorkingDirectory,
+  };
+}
+
+// File paths one segment of a command line may print, plus anything found inside
+// inline program text it carries.
+function collectSegmentRefs(tokens: ShellToken[], depth: number): CommandRefs {
+  const refs: CommandRefs = {
+    paths: [],
+    envVars: [],
+    dumpsEnvironment: false,
+    searchesWorkingDirectory: false,
+  };
+
+  const start = findCommandIndex(tokens);
+  const cmdToken = tokens[start];
+  if (cmdToken === undefined) return refs;
+
+  const cmd = path.basename(cmdToken.value);
+  const operands = tokens.slice(start + 1);
+
+  // `< secrets cat` puts the redirection before the command, so its target is
+  // not among the operands and the loop below never sees it. The command still
+  // reads it.
+  //
+  // `$(<secrets)` has no command at all: bash reads the file and substitutes its
+  // contents. There the whole token list is in front of the "command", which is
+  // the redirection operator itself.
+  const beforeCommand = cmdToken.redirect ? tokens.length : start;
+  for (let i = 0; i < beforeCommand; i++) {
+    if (tokens[i]?.redirect !== true) continue;
+    if (tokens[i]?.value !== "<") continue;
+    const target = tokens[i + 1];
+    if (target === undefined || target.redirect) continue;
+    if (!classifyCommand(cmd).printsNoFileContents) {
+      refs.paths.push(target.value);
+    }
+  }
+
+  // In-place editing sends the result back to the file, so nothing reaches
+  // stdout and nothing is read into the conversation.
+  if (editsInPlace(cmd, operands)) {
+    return refs;
+  }
+
+  // `eval 'cat secrets'` is a command line in a single word, the same shape
+  // `env -S` carries. Stepping past `eval` finds that word as the command name,
+  // which classifies as nothing at all.
+  if (cmd === "eval") {
+    for (const operand of operands) {
+      if (operand.redirect) continue;
+      mergeRefs(refs, extractCommandRefs(operand.value, depth + 1));
+      refs.paths.push(...extractQuotedLiterals(operand.value));
+    }
+  }
+
+  // `env -S "cmd args"` splits the string into the command it runs, so scan
+  // inside it the way inline code is scanned.
+  if (cmd === "env") {
+    for (let k = 0; k < operands.length; k++) {
+      const t = operands[k]?.value;
+      if (t !== "-S" && t !== "--split-string") continue;
+      const script = operands[k + 1]?.value;
+      if (script === undefined) continue;
+      mergeRefs(refs, extractCommandRefs(script, depth + 1));
+      k++;
+    }
+  }
+
+  const behaviour = classifyCommand(cmd);
+
+  let skipNext = false;
+  let collectNext = false;
+  let codeNext = false;
+  let inlineCodeSeen = false;
+  let patternSkipped = false;
+  let gitSubcommandSeen = false;
+  let gitReadsFiles = false;
+  let optionsEnded = false;
+  let lineRangeNext = false;
+
+  for (const tok of operands) {
+    if (skipNext) {
+      skipNext = false;
+      continue;
+    }
+    if (collectNext) {
+      collectNext = false;
+      refs.paths.push(tok.value);
+      continue;
+    }
+    if (codeNext) {
+      codeNext = false;
+      // The expression came from -e/-c, so a later operand is a file, not the
+      // script `perl file` would have run. That is `inlineCodeSeen` below: no
+      // command takes inline code *and* a leading pattern, an assumption the
+      // tests pin, so there is no pattern here to mark as supplied.
+      if (behaviour.inlineCodeReadsOperands) inlineCodeSeen = true;
+      mergeRefs(refs, extractCommandRefs(tok.value, depth + 1));
+      refs.paths.push(...extractQuotedLiterals(tok.value));
+      continue;
+    }
+
+    if (tok.redirect) {
+      if (tok.value === "<") {
+        // stdin is fed from the next token, unless nothing of it is printed
+        collectNext = !behaviour.printsNoFileContents;
+        skipNext = behaviour.printsNoFileContents;
+      } else {
+        // A heredoc or herestring delimiter, or an output target: never read.
+        skipNext = true;
+      }
+      continue;
+    }
+
+    // `--` ends option parsing: every token after it is an operand, whatever it
+    // is spelled like. `grep -- -aws secrets` searches for `-aws` in `secrets`,
+    // so the file is a file — read as a flag, `-aws` left the pattern
+    // unaccounted for and `secrets` was consumed in its place.
+    if (!optionsEnded && tok.value === "--") {
+      optionsEnded = true;
+      continue;
+    }
+
+    if (
+      !optionsEnded &&
+      behaviour.takesInlineCode &&
+      isInlineCodeFlag(cmd, tok.value)
+    ) {
+      codeNext = true;
+      continue;
+    }
+
+    // `git log -L1,10:f` prints the lines of `f` themselves, and the file is
+    // written inside the range spec after the last `:`. The flag branch below
+    // consumes any `-`-shaped token, so this has to come before it, and the
+    // operand branch would never see the file anyway.
+    if (
+      behaviour.isGit &&
+      (tok.value.startsWith("-L") || tok.value.startsWith("--line-range"))
+    ) {
+      const inFlag = gitLineRangeFile(tok.value);
+      if (inFlag !== null) refs.paths.push(inFlag);
+      else lineRangeNext = true;
+      continue;
+    }
+    if (lineRangeNext) {
+      lineRangeNext = false;
+      const separate = gitLineRangeFile(tok.value);
+      if (separate !== null) refs.paths.push(separate);
+      continue;
+    }
+
+    if (!optionsEnded && tok.value.startsWith("-")) {
+      // A global git flag with a separate value consumes the next token too:
+      // in `git -C repo show f`, `repo` is not the subcommand.
+      if (
+        behaviour.isGit &&
+        !gitSubcommandSeen &&
+        GIT_GLOBAL_FLAGS_WITH_OPERAND.has(tok.value)
+      ) {
+        skipNext = true;
+      }
+
+      // The value of an output flag is written, not read.
+      if (WRITE_TARGET_FLAGS[cmd]?.has(tok.value)) skipNext = true;
+
+      // The pattern arrived as a flag, so no operand stands in for it.
+      if (behaviour.firstOperandIsPatternOrScript) {
+        const supply = patternSupplyingFlag(tok.value);
+        if (supply !== null) {
+          patternSkipped = true;
+          // Only a flag still waiting for its value consumes the next token. A
+          // value already attached — `--regexp=aws`, or `-eaws` — is part of
+          // this one.
+          if (supply === "separate") skipNext = true;
+        }
+      }
+      continue;
+    }
+
+    if (behaviour.isGit) {
+      if (!gitSubcommandSeen) {
+        gitSubcommandSeen = true;
+        gitReadsFiles = gitSubcommandPrintsFiles(tok.value, operands);
+        continue;
+      }
+      if (gitReadsFiles) refs.paths.push(tok.value);
+      continue;
+    }
+
+    // `if=<file>` names an input only for `dd`; other commands taking an
+    // `if=` argument are not reading the file it names.
+    if (behaviour.isDd) {
+      const ddInput = /^if=(.+)$/.exec(tok.value);
+      if (ddInput?.[1]) {
+        refs.paths.push(ddInput[1]);
+        continue;
+      }
+    }
+
+    if (behaviour.firstOperandIsPatternOrScript && !patternSkipped) {
+      patternSkipped = true; // the pattern, expression or script name
+      // An awk or sed program can name a file inside itself, the way inline code
+      // does: `awk 'BEGIN{ while ((getline l < "secrets") > 0) print l }'` reads
+      // one without ever naming it as an operand.
+      refs.paths.push(...extractQuotedLiterals(tok.value));
+      continue;
+    }
+
+    if (
+      behaviour.printsOperands ||
+      behaviour.firstOperandIsPatternOrScript ||
+      inlineCodeSeen
+    ) {
+      refs.paths.push(tok.value);
+    }
+  }
+
+  // A searcher handed no file searches where it is run. `rg PATTERN` and
+  // `grep -r PATTERN` are the ordinary forms and name nothing, so the loop above
+  // collects the pattern and stops with no path — and the tree they print from
+  // is the working directory. The caller is what knows which directory that is.
+  if (
+    refs.paths.length === 0 &&
+    (RECURSIVE_BY_DEFAULT.has(cmd) ||
+      (GREP_FAMILY.has(cmd) && asksForRecursion(operands)))
+  ) {
+    refs.searchesWorkingDirectory = true;
+  }
+
+  return refs;
+}