@haposoft/cafekit 0.18.0 → 0.18.2

package/src/claude/hooks/lib/privacy-command-analysis.cjs

@@ -107,6 +107,7 @@ function scanShell(command) {
   const source = String(command).replace(/\\\r?\n/g, '');
   const segments = [];
   const nested = [];
+  const recordNested = command => nested.push({ command, segment: segments.length });
   let words = [];
   let word = { text: '', activeExpansion: false, started: false };
   let quote = null;
@@ -132,7 +133,7 @@ function scanShell(command) {
         if (source[index + 1] === '(') {
           const end = matchingParen(source, index + 1);
           if (end < 0) { malformed = true; continue; }
-          nested.push(source.slice(index + 2, end));
+          recordNested(source.slice(index + 2, end));
           append('()');
           index = end;
         }
@@ -142,7 +143,7 @@ function scanShell(command) {
         word.activeExpansion = true;
         const end = matchingBacktick(source, index);
         if (end < 0) { malformed = true; continue; }
-        nested.push(source.slice(index + 1, end));
+        recordNested(source.slice(index + 1, end));
         append('\x60\x60');
         index = end;
         continue;
@@ -164,7 +165,7 @@ function scanShell(command) {
       if (source[index + 1] === '(') {
         const end = matchingParen(source, index + 1);
         if (end < 0) { malformed = true; continue; }
-        nested.push(source.slice(index + 2, end));
+        recordNested(source.slice(index + 2, end));
         append('()');
         index = end;
       }
@@ -174,7 +175,7 @@ function scanShell(command) {
       word.activeExpansion = true;
       const end = matchingBacktick(source, index);
       if (end < 0) { malformed = true; continue; }
-      nested.push(source.slice(index + 1, end));
+      recordNested(source.slice(index + 1, end));
       append('\x60\x60');
       index = end;
       continue;
@@ -183,15 +184,31 @@ function scanShell(command) {
       word.activeExpansion = true;
       const end = matchingParen(source, index + 1);
       if (end < 0) { malformed = true; continue; }
-      nested.push(source.slice(index + 2, end));
+      recordNested(source.slice(index + 2, end));
       append(`${ch}()`);
       index = end;
       continue;
     }
     if ((ch === '~' && !word.text) || '*?{['.includes(ch)) { word.activeExpansion = true; append(ch); continue; }
     if (';|&\n()'.includes(ch)) { flushSegment(); continue; }
-    if (ch === '<') { flushWord(); words.push({ text: '<', activeExpansion: false, started: true }); continue; }
-    if (ch === '>') { flushWord(); continue; }
+    if (ch === '<') {
+      const descriptor = /^[0-9]+$/.test(word.text);
+      flushWord();
+      if (descriptor) (words.redirectFds ||= []).push(words.length - 1);
+      (words.inputRedirects ||= []).push(words.length, words.length + 1);
+      words.push({ text: '<', activeExpansion: false, started: true });
+      continue;
+    }
+    if (ch === '>') {
+      const descriptor = /^[0-9]+$/.test(word.text);
+      flushWord();
+      if (descriptor) (words.redirectFds ||= []).push(words.length - 1);
+      (words.redirects ||= []).push(words.length);
+      if (source[index + 1] === '>') index += 1;
+      if (source[index + 1] === '&') index += 1;
+      if (source[index + 1] === '|') index += 1;
+      continue;
+    }
     if (' \t\r'.includes(ch)) { flushWord(); continue; }
     append(ch);
   }
@@ -272,11 +289,150 @@ function genericOperands(words, start, result, {
 
 function merge(target, source) {
   source.paths.forEach((value) => target.paths.add(value));
+  target.searches.push(...source.searches);
+  source.writes.forEach(value => target.writes.add(value));
+  source.unknownWrites.forEach(value => target.unknownWrites.add(value));
   target.dynamic ||= source.dynamic;
   target.malformed ||= source.malformed;
 }
 
-function analyzeWords(words, result, depth) {
+// Describe searches separately so the existing read operands stay unchanged.
+function searchDescription(words, start, name) {
+  const grep = ['grep', 'egrep', 'fgrep'].includes(name);
+  const search = { recursive: !grep, hidden: grep, includes: [], excludes: [], roots: [] };
+  const values = new Set([...GREP_OPTION_VALUE, '-g', '--glob', '--iglob', '--include', '--exclude',
+    '--exclude-dir', '-d', '--directories', '-t', '--type', '-T', '--type-not',
+    '--max-depth', '-j', '--threads', '-M', '--max-columns', '--sort', '--sortr',
+    '--max-filesize', '--pre', '--path-separator', '--dfa-size-limit', '--regex-size-limit']);
+  let pattern = !grep && words.slice(start).some(word => word.text === '--files');
+  let unrestricted = 0;
+  let options = true;
+  const positional = [];
+  for (let index = start; index < words.length; index += 1) {
+    const word = words[index];
+    const text = word.text;
+    if (options && text === '--') { options = false; continue; }
+    if (options && text.startsWith('-') && text !== '-') {
+      let option = text.split('=')[0];
+      let value = text.includes('=') ? text.slice(text.indexOf('=') + 1) : null;
+      let shortFlags = /^-[^-]/.test(text) ? text.slice(1) : '';
+      const attached = text.match(/^-([^-]*?)([gef])(.*)$/);
+      if (attached) { shortFlags = attached[1]; option = `-${attached[2]}`; value = attached[3] || null; }
+      if (values.has(option) && value === null) value = words[++index]?.text || '';
+      if (['-e', '--regexp', '-f', '--file'].includes(option)) pattern = true;
+      if (['-g', '--glob', '--include'].includes(option)) search.includes.push(value || '');
+      if (['--exclude', '--exclude-dir'].includes(option)) search.excludes.push(value || '');
+      if (grep && (['--recursive', '--dereference-recursive'].includes(option)
+        || /[rR]/.test(shortFlags)
+        || (['-d', '--directories'].includes(option) && value === 'recurse'))) search.recursive = true;
+      if (!grep) {
+        if (option === '--hidden' || shortFlags.includes('.')) search.hidden = true;
+        unrestricted += (shortFlags.match(/u/g) || []).length + (option === '--unrestricted' ? 1 : 0);
+      }
+      continue;
+    }
+    positional.push(word);
+  }
+  if (!pattern) positional.shift();
+  search.roots = positional.filter(word => !word.activeExpansion && word.text !== '-').map(word => word.text);
+  if (!search.roots.length) search.roots.push('.');
+  if (unrestricted >= (name === 'ag' ? 1 : 2)) search.hidden = true;
+  // Case-insensitive globs are not evidence that a differently cased child is excluded.
+  if (words.slice(start).some(word => ['--glob-case-insensitive', '--iglob'].includes(word.text.split('=')[0]))) search.includes = [];
+  return search;
+}
+
+function writeTarget(word, result, directory) {
+  if (!word?.text || word.activeExpansion || word.text === '-') return;
+  if (directory === null && !word.text.startsWith('/')) {
+    result.unknownWrites.add(word.text);
+    return;
+  }
+  result.writes.add(word.text.startsWith('/') || directory === '.' ? word.text : `${directory}/${word.text}`);
+}
+
+function commandWrites(words, start, name, result, directory) {
+  const redirected = new Set([...(words.redirects || []), ...(words.redirectFds || []), ...(words.inputRedirects || [])]);
+  if (name === 'tee') {
+    for (let index = start; index < words.length; index += 1) {
+      if (!redirected.has(index) && !words[index].text.startsWith('-')) writeTarget(words[index], result, directory);
+    }
+  }
+  if (['cp', 'mv', 'install', 'ln'].includes(name)) {
+    const operands = [];
+    let targetDirectory = false;
+    const values = new Set(['-t', '--target-directory', '-S', '--suffix', '-m', '--mode', '-o', '--owner', '-g', '--group']);
+    let options = true;
+    for (let index = start; index < words.length; index += 1) {
+      if (redirected.has(index)) continue;
+      const word = words[index];
+      if (options && word.text === '--') { options = false; continue; }
+      if (options && word.text.startsWith('-')) {
+        let option = word.text.split('=')[0];
+        let value = word.text.includes('=')
+          ? { text: word.text.slice(word.text.indexOf('=') + 1), activeExpansion: word.activeExpansion }
+          : values.has(option) ? words[++index] : null;
+        if (!word.text.startsWith('--') && !values.has(option)) {
+          for (let flag = 1; flag < word.text.length; flag += 1) {
+            const candidate = `-${word.text[flag]}`;
+            if (!values.has(candidate)) continue;
+            option = candidate;
+            value = flag + 1 < word.text.length
+              ? { text: word.text.slice(flag + 1), activeExpansion: word.activeExpansion } : words[++index];
+            break;
+          }
+        }
+        if (['-t', '--target-directory'].includes(option)) {
+          targetDirectory = true;
+          writeTarget(value, result, directory);
+        }
+      } else operands.push(word);
+    }
+    if (!targetDirectory) writeTarget(operands.at(-1), result, directory);
+    if (name === 'cp' || name === 'mv') {
+      const sources = targetDirectory ? operands : operands.slice(0, -1);
+      for (const source of sources) {
+        const basename = source.text.replace(/\\/g, '/').replace(/\/+$/, '').split('/').at(-1).toLowerCase();
+        if (!['.claude', '.codex', '.omp', '.privacy'].includes(basename)) continue;
+        if (source.activeExpansion) result.unknownWrites.add(basename);
+        else writeTarget(source, result, directory);
+      }
+    }
+  }
+  if (name === 'sed') {
+    let inPlace = false;
+    let scriptOption = false;
+    const operands = [];
+    let options = true;
+    for (let index = start; index < words.length; index += 1) {
+      if (redirected.has(index)) continue;
+      const word = words[index];
+      if (options && word.text === '--') { options = false; continue; }
+      if (options && word.text.startsWith('-')) {
+        const option = word.text.split('=')[0];
+        if (option === '--in-place') inPlace = true;
+        if (['--expression', '--file'].includes(option)) {
+          scriptOption = true;
+          if (!word.text.includes('=')) index += 1;
+        } else if (!word.text.startsWith('--')) {
+          for (let flag = 1; flag < word.text.length; flag += 1) {
+            if (word.text[flag] === 'i') { inPlace = true; break; }
+            if (word.text[flag] === 'e' || word.text[flag] === 'f') {
+              scriptOption = true;
+              if (flag + 1 === word.text.length) index += 1;
+              break;
+            }
+          }
+        }
+      } else operands.push(word);
+    }
+    if (operands[0]?.text === '') operands.shift();
+    if (inPlace) for (const word of operands.slice(scriptOption ? 0 : 1)) writeTarget(word, result, directory);
+  }
+}
+
+function analyzeWords(words, result, depth, directory = '.') {
+  for (const index of words.redirects || []) writeTarget(words[index], result, directory);
   for (let index = 0; index + 1 < words.length; index += 1) {
     if (words[index].text === '<') addOperand(result, words[index + 1]);
   }
@@ -284,11 +440,13 @@ function analyzeWords(words, result, depth) {
   if (command.index < 0) return;
   const start = command.index + 1;
   const name = command.name;
+  commandWrites(words, start, name, result, directory);
   if (SIMPLE_READERS.has(name)) {
     genericOperands(words, start, result, { valueOptions: SIMPLE_OPTION_VALUES.get(name) || new Set() });
     return;
   }
   if (GREP_READERS.has(name)) {
+    result.searches.push(searchDescription(words, start, name));
     const patternOption = words.slice(start).some((word) => ['-e', '--regexp', '-f', '--file'].includes(word.text.split('=')[0]));
     genericOperands(words, start, result, {
       skipFirst: patternOption ? 0 : 1,
@@ -319,7 +477,7 @@ function analyzeWords(words, result, depth) {
   if (SHELLS.has(name)) {
     for (let index = start; index + 1 < words.length; index += 1) {
       if (words[index].text === '-c' || words[index].text === '--command') {
-        merge(result, analyzeCommand(words[index + 1].text, depth + 1));
+        merge(result, analyzeCommand(words[index + 1].text, depth + 1, directory));
         return;
       }
     }
@@ -327,7 +485,7 @@ function analyzeWords(words, result, depth) {
     return;
   }
   if (name === 'eval') {
-    merge(result, analyzeCommand(words.slice(start).map((word) => word.text).join(' '), depth + 1));
+    merge(result, analyzeCommand(words.slice(start).map((word) => word.text).join(' '), depth + 1, directory));
     return;
   }
   if (name === 'find') {
@@ -335,7 +493,7 @@ function analyzeWords(words, result, depth) {
       if (words[index].text !== '-exec' && words[index].text !== '-execdir') continue;
       const nested = [];
       for (index += 1; index < words.length && ![';', '+'].includes(words[index].text); index += 1) nested.push(words[index]);
-      analyzeWords(nested, result, depth + 1);
+      analyzeWords(nested, result, depth + 1, directory);
     }
     return;
   }
@@ -351,7 +509,7 @@ function analyzeWords(words, result, depth) {
       index = skipOption(words, index, XARGS_OPTION_VALUE);
       nestedStart = index;
     }
-    if (nestedStart < words.length) analyzeWords(words.slice(nestedStart), result, depth + 1);
+    if (nestedStart < words.length) analyzeWords(words.slice(nestedStart), result, depth + 1, directory);
     return;
   }
   if (INLINE_RUNTIMES.has(name)) {
@@ -369,13 +527,28 @@ function analyzeWords(words, result, depth) {
   if (name === 'openssl') genericOperands(words, start, result, { pathOptions: new Set(['-in', '-key', '-cert', '-config']) });
 }
 
-function analyzeCommand(command, depth = 0) {
-  const result = { paths: new Set(), dynamic: false, malformed: false };
+function analyzeCommand(command, depth = 0, directory = '.') {
+  const result = { paths: new Set(), dynamic: false, malformed: false, searches: [], writes: new Set(), unknownWrites: new Set() };
   if (depth > MAX_DEPTH) { result.dynamic = true; return result; }
   const parsed = scanShell(command);
   result.malformed = parsed.malformed;
-  for (const words of parsed.segments) analyzeWords(words, result, depth);
-  for (const nested of parsed.nested) merge(result, analyzeCommand(nested, depth + 1));
+  let currentDirectory = directory;
+  const directories = [];
+  for (const words of parsed.segments) {
+    directories.push(currentDirectory);
+    analyzeWords(words, result, depth, currentDirectory);
+    const info = unwrap(words);
+    if (['cd', 'pushd'].includes(info.name)) {
+      const target = words.slice(info.index + 1).find(word => word.text && !word.text.startsWith('-'));
+      if (!target || target.activeExpansion) currentDirectory = null;
+      else if (target.text.startsWith('/')) currentDirectory = target.text;
+      else if (currentDirectory !== null) currentDirectory = `${currentDirectory}/${target.text}`;
+    }
+  }
+  for (const nested of parsed.nested) {
+    const nestedDirectory = directories[nested.segment] === undefined ? directory : directories[nested.segment];
+    merge(result, analyzeCommand(nested.command, depth + 1, nestedDirectory));
+  }
   if (result.malformed && parsed.segments.some((words) => {
     const commandInfo = unwrap(words);
     return SIMPLE_READERS.has(commandInfo.name) || GREP_READERS.has(commandInfo.name)
@@ -387,7 +560,8 @@ function analyzeCommand(command, depth = 0) {
 
 function commandAccess(command) {
   const result = analyzeCommand(command);
-  return { paths: [...result.paths], dynamic: result.dynamic, malformed: result.malformed };
+  return { paths: [...result.paths], dynamic: result.dynamic, malformed: result.malformed, searches: result.searches,
+    writes: [...result.writes], unknownWrites: [...result.unknownWrites] };
 }
 
 module.exports = { DYNAMIC_READ_PATH, commandAccess };

package/src/claude/hooks/lib/privacy-paths.cjs

@@ -0,0 +1,313 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { commandAccess } = require('./privacy-command-analysis.cjs');
+
+const RESTRICTED = [
+  /^\.env(?:[.\[*?{]|$)/i,
+  /^credentials/i,
+  /secrets?\.(ya?ml|json)$/i,
+  /\.pem$/i,
+  /\.key$/i,
+  /\.p12$/i,
+  /\.pfx$/i,
+  /^id_(rsa|ed25519|ecdsa|dsa)$/i,
+  /\.netrc$/i,
+  /\.pgpass$/i,
+  /kubeconfig/i,
+  /\.keystore$/i,
+  /\.jks$/i,
+  /auth\.json$/i,
+  /token(s)?\.json$/i
+];
+
+const EXEMPT = [/\.env\.(example|sample|template|test)$/i];
+
+function matchesAny(filePath, rules) {
+  const base = path.basename(filePath);
+  return rules.some((rule) => rule.test(base) || rule.test(filePath));
+}
+
+function isSafe(filePath) {
+  return matchesAny(filePath, EXEMPT);
+}
+
+function isSensitive(filePath) {
+  return matchesAny(filePath, RESTRICTED);
+}
+
+function resolveTarget(filePath, cwd) {
+  try {
+    const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    return fs.realpathSync(requested);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * When realpath fails, check whether the requested path is a symlink (or chain)
+ * whose lexical target is sensitive. Dangling link to protected target -> true (fail-closed deny);
+ * dangling benign link or link to allowed example/template -> false (allow).
+ * Limit hops to avoid loops; malformed/looping -> fail closed.
+ * TOCTOU note: check and use are not atomic; target could be swapped between this check and the actual read.
+ * This is a best-effort guardrail, not an arbitrary-shell security boundary. For strong isolation use OS sandbox.
+ */
+function isSymlinkToSensitive(filePath, cwd) {
+  try {
+    const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    let current = requested;
+    let hops = 0;
+    const MAX_HOPS = 8;
+    while (hops < MAX_HOPS) {
+      let stat;
+      try {
+        stat = fs.lstatSync(current);
+      } catch {
+        return false;
+      }
+      if (!stat.isSymbolicLink()) return false;
+      let linkTarget;
+      try {
+        linkTarget = fs.readlinkSync(current);
+      } catch {
+        return true;
+      }
+      if (isSensitive(linkTarget) && !isSafe(linkTarget)) return true;
+      if (isSafe(linkTarget)) return false;
+      const next = path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(current), linkTarget);
+      if (next === current) return true;
+      try {
+        const real = fs.realpathSync(next);
+        if (isSensitive(real) && !isSafe(real)) return true;
+        if (isSafe(real)) return false;
+        return false;
+      } catch {
+        current = next;
+        hops += 1;
+        continue;
+      }
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
+
+function scrubCommand(command) {
+  return String(command).replace(
+    /(<<-?[ \t]*)(['"])([A-Za-z_]\w*)\2([^\n]*)\n[\s\S]*?\n[ \t]*\3\b/g,
+    '$1$2$3$2$4'
+  );
+}
+
+function extractCommandPaths(command) {
+  // The analyzer parses the command and returns the operands of every reading
+  // command it recognises, nested shells and `find -exec` included. Treating
+  // every unresolved expansion as sensitive, as this did before, denied
+  // `cat $FILE`, `wc -l *.cjs` and `cat ~/.zshrc` alike -- and every denial here
+  // costs a round trip through a one-shot approval prompt.
+  // A heredoc whose delimiter is quoted (<<'BODY') is inert: the shell expands
+  // nothing inside it, so no word in the body is ever read. The analyzer has no
+  // notion of heredocs and parses the body as shell, so prose that quotes a
+  // command -- a PR body carrying `cat .env` in backticks -- came back as a real
+  // command substitution. Blank those bodies out first. An unquoted delimiter
+  // (<<BODY) does expand, so it is left to the analyzer.
+  const scrubbed = scrubCommand(command);
+
+  const paths = new Set(commandAccess(scrubbed).paths);
+
+  // Two shapes the analyzer cannot return. It drops any word carrying an
+  // expansion, so `~/.ssh/id_rsa` and `certs/*.pem` still have to be matched by
+  // name. And it only walks commands it recognises, so an unknown tool handed a
+  // secret through a file-shaped option, such as
+  // `docker compose --env-file .env`, is invisible to it.
+  const FILE_OPTION = /^--?[\w-]*(?:file|config|key|cert|identity)$/i;
+  const tokens = scrubbed.split(/[\s|;&<>"'()`]+/);
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    const shaped = /^~|[*?[{]/.test(token);
+    const optionFed = index > 0 && FILE_OPTION.test(tokens[index - 1]);
+    if (!shaped && !optionFed) continue;
+    const value = token.replace(/^~/, '').replace(/^["'()`]+|["'(),]+$/g, '');
+    if (value && isSensitive(value) && !isSafe(value)) paths.add(value);
+  }
+
+  return [...paths];
+}
+
+function extractPatchPaths(patch) {
+  return [...String(patch).matchAll(
+    /^\*\*\* (?:(?:Add|Update|Delete) File:|Move to:)\s+(.+)$/gm
+  )]
+    .map((match) => match[1].trim())
+    .filter(Boolean);
+}
+
+
+function shellInput(input) {
+  const value = input?.command ?? input?.cmd;
+  if (typeof value === 'string') return value;
+  if (!Array.isArray(value)) return '';
+  const index = value.findIndex(word => word === '-c' || word === '-lc');
+  return index >= 0 ? String(value[index + 1] || '') : value.join(' ');
+}
+
+function patchInput(input) {
+  if (typeof input === 'string') return input;
+  for (const key of ['command', 'patch', 'input']) {
+    if (typeof input?.[key] === 'string') return input[key];
+  }
+  return '';
+}
+
+function isPathKey(key, mcp) {
+  return /^(?:file_?paths?|paths?|search_?paths?|director(?:y|ies)|cwd|root|locations?|notebook_path|globs?)$/i.test(key)
+    || (mcp && /path|file|dir|uri|source|dest|target/i.test(key));
+}
+
+function collectPathValues(value, key, out, mcp) {
+  if (typeof value === 'string' && isPathKey(key, mcp)) {
+    const filePath = value.trim().replace(/^file:\/\//i, '');
+    if (filePath) out.push(filePath);
+  } else if (Array.isArray(value)) {
+    for (const item of value) collectPathValues(item, key, out, mcp);
+  } else if (value && typeof value === 'object') {
+    for (const [childKey, childValue] of Object.entries(value)) {
+      collectPathValues(childValue, childKey, out, mcp);
+    }
+  }
+}
+
+function extractPaths(toolName, input) {
+  const paths = [];
+  const tool = String(toolName).toLowerCase();
+  collectPathValues(input, '', paths, tool.startsWith('mcp__'));
+  if (['bash', 'exec_command', 'shell'].includes(tool)) {
+    paths.push(...extractCommandPaths(shellInput(input)));
+  } else if (['apply_patch', 'edit', 'write'].includes(tool)) {
+    paths.push(...extractPatchPaths(patchInput(input)));
+  }
+  return [...new Set(paths)];
+}
+
+function sensitiveRequest(filePath, cwd) {
+  const target = resolveTarget(filePath, cwd);
+  if (target) {
+    if (isSensitive(target) && !isSafe(target)) return true;
+    if (isSafe(target)) return false;
+  } else {
+    if (isSymlinkToSensitive(filePath, cwd)) return true;
+  }
+  return !isSafe(filePath) && isSensitive(filePath);
+}
+
+function protectedLocation(filePath) {
+  const normalized = path.posix.normalize(filePath).toLowerCase();
+  const parts = normalized.split('/');
+  const runtimes = new Set(['.claude', '.codex', '.omp']);
+  if (runtimes.has(parts.at(-1)) || parts.at(-1) === '.privacy') return true;
+  if (parts.at(-1) === 'runtime.json' && runtimes.has(parts.at(-2))) return true;
+  for (let index = 0; index + 2 < parts.length; index += 1) {
+    if (parts[index] === '.codex' && parts[index + 1] === 'hooks' && parts[index + 2] === '.privacy') return true;
+  }
+  return false;
+}
+
+function protectedWrite(filePath, cwd) {
+  const absolute = path.posix.resolve(cwd.replace(/\\/g, '/'), filePath.replace(/\\/g, '/'));
+  if (protectedLocation(absolute)) return true;
+  let current = absolute;
+  const suffix = [];
+  const links = new Set();
+  for (;;) {
+    try {
+      if (fs.lstatSync(current).isSymbolicLink()) {
+        if (links.has(current) || links.size >= 8) return true;
+        links.add(current);
+        const target = path.posix.resolve(path.posix.dirname(current), fs.readlinkSync(current));
+        if (protectedLocation(path.posix.join(target, ...suffix.slice().reverse()))) return true;
+        current = target;
+        continue;
+      }
+      const real = fs.realpathSync(current);
+      return protectedLocation(path.posix.join(real, ...suffix.reverse()));
+    } catch (error) {
+      if (error.code === 'ELOOP') return true;
+      if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') return false;
+    }
+    const parent = path.posix.dirname(current);
+    if (parent === current) return false;
+    suffix.push(path.posix.basename(current));
+    current = parent;
+  }
+}
+
+function extractWritePaths(tool, input) {
+  if (['bash', 'exec_command', 'shell'].includes(tool)) return commandAccess(scrubCommand(shellInput(input)));
+  const paths = [];
+  if (['write', 'edit', 'multiedit', 'notebookedit'].includes(tool) || tool.startsWith('mcp__')) {
+    collectPathValues(input, '', paths, tool.startsWith('mcp__'));
+  }
+  if (['apply_patch', 'edit', 'write'].includes(tool)) paths.push(...extractPatchPaths(patchInput(input)));
+  return { writes: paths, unknownWrites: [] };
+}
+
+function protectedUnknownWrite(filePath) {
+  const parts = path.posix.normalize(filePath.replace(/\\/g, '/')).toLowerCase().split('/');
+  return parts.at(-1) === 'runtime.json' || parts.includes('.privacy')
+    || ['.claude', '.codex', '.omp'].includes(parts.at(-1));
+}
+
+function sensitivePaths(toolName, input, cwd) {
+  const paths = extractPaths(toolName, input).filter(filePath => sensitiveRequest(filePath, cwd));
+  const tool = String(toolName).toLowerCase();
+  const access = extractWritePaths(tool, input);
+  paths.push(...access.writes.filter(filePath => protectedWrite(filePath, cwd)),
+    ...access.unknownWrites.filter(protectedUnknownWrite));
+  const searches = tool === 'grep'
+    ? [{ recursive: true, hidden: true,
+      roots: [typeof input?.path === 'string' && input.path.trim() ? input.path : cwd],
+      includes: [input?.glob, ...(Array.isArray(input?.globs) ? input.globs : [])]
+        .filter(glob => typeof glob === 'string' && glob),
+    }]
+    : ['bash', 'exec_command', 'shell'].includes(tool)
+      ? commandAccess(scrubCommand(shellInput(input))).searches : [];
+  for (const search of searches) {
+    if (!search.recursive) continue;
+    // Negative globs and exclusion/type flags cannot prove a sensitive child is omitted.
+    const includes = search.includes.filter(glob => glob && !glob.startsWith('!'));
+    for (const root of search.roots) {
+      const directory = path.resolve(cwd, root);
+      let entries;
+      try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { continue; }
+      for (const entry of entries) {
+        if (entry.isDirectory() || (!search.hidden && entry.name.startsWith('.'))) continue;
+        if (includes.length && !includes.some(glob => matchesInclude(entry.name, glob))) continue;
+        const filePath = path.join(directory, entry.name);
+        if (sensitiveRequest(filePath, cwd)) paths.push(filePath);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+
+function matchesInclude(name, glob) {
+  if (typeof path.matchesGlob !== 'function') return true;
+  glob = glob.replace(/^\/+/, '');
+  if (glob.length > 256 || (glob.match(/[*?]/g) || []).length > 4 || /\{[^}]*\.\.[^}]*\}/.test(glob)
+    || !/^[\w.\-\/]*(?:[*?][\w.\-\/]*){0,4}(?:\{[\w.\-*,]*\}[\w.\-\/]*)?$/.test(glob)) return true;
+  // Prefixing both sides removes Node's implicit leading-dot exclusion for a basename.
+  return path.matchesGlob(name, glob)
+    || (name.startsWith('.') && path.matchesGlob(`x${name}`, `x${glob.replace(/^(?:\*\*\/)+/, '')}`));
+}
+
+function displayNames(filePaths) {
+  const names = [...new Set(filePaths.map((filePath) => path.basename(filePath)))].sort();
+  return names.length <= 3
+    ? names.join(', ')
+    : `${names.slice(0, 3).join(', ')} (+${names.length - 3} more)`;
+}
+
+module.exports = { isSensitive, isSafe, sensitiveRequest, extractPaths, sensitivePaths, displayNames };

package/src/claude/hooks/lib/project-root.cjs

@@ -0,0 +1,15 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const runtimeRoot = path.resolve(__dirname, '../..');
+
+function projectRoot(payload = {}) {
+  const installed = path.basename(runtimeRoot).startsWith('.') ? path.dirname(runtimeRoot) : '';
+  const configured = typeof process.env.CLAUDE_PROJECT_DIR === 'string' ? process.env.CLAUDE_PROJECT_DIR.trim() : '';
+  const cwd = typeof payload.cwd === 'string' ? payload.cwd.trim() : '';
+  const root = path.resolve(installed || configured || cwd || process.cwd());
+  try { return fs.realpathSync(root); } catch { return root; }
+}
+
+module.exports = { projectRoot };