@haposoft/cafekit 0.18.1 → 0.18.2

package/src/claude/hooks/lib/inspect-paths.cjs

@@ -0,0 +1,304 @@
+'use strict';
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const BLOCKED_DIRS = new Set([
+  'node_modules', 'dist', 'build', '.next', '.nuxt', '.output',
+  '__pycache__', '.venv', 'venv', 'vendor', 'target',
+  '.git', 'coverage', '.nyc_output'
+]);
+const BROAD_GLOBS = [/^\*\*\/\*$/, /^\*\*\.\w+$/, /^\*\*\/\*\.\w+$/];
+const PATH_KEYS = /^(?:file_?paths?|paths?|search_?paths?|notebook_path|(?:source|target|destination)_?paths?|dirs?|director(?:y|ies)|folders?|cwd|root|locations?|uris?)$/i;
+const WRITE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
+const READERS = new Set(['cat', 'head', 'tail', 'nl', 'less', 'more', 'bat', 'ls', 'tree', 'find', 'rg', 'grep', 'sed', 'awk', 'wc', 'du', 'file', 'stat']);
+const clean = (value) => String(value || '').trim();
+const nameOf = (value) => String(value || '').replace(/\\/g, '/').split('/').pop();
+function real(value) { try { return fs.realpathSync(value); } catch { return value; } }
+function relativeInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative) ? relative : null;
+}
+function blockedSegment(value, { cwd, projectRoot }) {
+  let candidate = clean(value).replace(/\\/g, '/');
+  if (candidate === '~' || candidate.startsWith('~/')) candidate = os.homedir() + candidate.slice(1);
+  if (path.isAbsolute(candidate)) {
+    // Prefer project root over a nested session cwd. Compare lexical and canonical
+    // roots so /var and /private/var (or a symlink install) have the same boundary.
+    for (const base of [projectRoot, cwd].filter(base => typeof base === 'string' && base)) {
+      const root = path.resolve(base);
+      const relative = relativeInside(root, candidate) ?? relativeInside(real(root), candidate);
+      if (relative !== null) { candidate = relative; break; }
+    }
+  } else candidate = path.normalize(candidate);
+  return candidate.split('/').find((segment) => BLOCKED_DIRS.has(segment));
+}
+function narrowPath(value, context) {
+  if (context.cwd !== undefined && typeof context.cwd !== 'string') return false;
+  let requested = clean(value).replace(/\\/g, '/');
+  if (!requested) return false;
+  if (requested === '~' || requested.startsWith('~/')) requested = os.homedir() + requested.slice(1);
+  const root = path.resolve(context.projectRoot || context.cwd || process.cwd());
+  const candidate = path.resolve(context.cwd || root, requested);
+  const relative = relativeInside(root, candidate) ?? relativeInside(real(root), candidate);
+  // Both boundaries must hold: a symlink cannot turn an outside read into a
+  // narrow scope, nor point a lexical child at the project root or beyond it.
+  const canonical = relative === null ? candidate : real(path.resolve(real(root), relative));
+  return !!relative && !!relativeInside(real(root), canonical)
+    && !blockedSegment(candidate, context) && !blockedSegment(canonical, context);
+}
+function collectStructured(value, key, toolName, paths, globs) {
+  if (typeof value === 'string') {
+    if (PATH_KEYS.test(key)) paths.push(value);
+    if ((toolName === 'Glob' && key === 'pattern') || /^(?:glob|globs)$/i.test(key)) globs.push(value);
+  } else if (Array.isArray(value)) {
+    for (const child of value) collectStructured(child, key, toolName, paths, globs);
+  } else if (value && typeof value === 'object') {
+    for (const [childKey, child] of Object.entries(value)) collectStructured(child, childKey, toolName, paths, globs);
+  }
+}
+
+// A small shell lexer, not an executor: quoted prose is data, while substitutions
+// contribute their own command groups. Heredoc bodies are data, never commands.
+function commandGroups(command) {
+  function scan(start, closing = '') {
+    const groups = []; let group = []; let token = ''; let quote = ''; let index = start;
+    const heredocs = [];
+    const flush = () => { if (token) group.push(token); token = ''; };
+    const boundary = () => { flush(); if (group.length) groups.push(group); group = []; };
+    for (; index < command.length; index += 1) {
+      const char = command[index];
+      if (!quote && closing && char === closing) { boundary(); return { groups, index }; }
+      if (char === '\\' && quote !== "'") {
+        if (command[index + 1] !== '\n') token += command[index + 1] || '';
+        index += 1; continue;
+      }
+      if (quote === "'") { if (char === "'") quote = ''; else token += char; continue; }
+      if (char === '$' && command[index + 1] === '(') {
+        const sub = scan(index + 2, ')'); groups.push(...sub.groups);
+        token += '__substitution__'; index = sub.index; continue;
+      }
+      if (char === '`') {
+        const sub = scan(index + 1, '`'); groups.push(...sub.groups);
+        token += '__substitution__'; index = sub.index; continue;
+      }
+      if (quote) { if (char === quote) quote = ''; else token += char; continue; }
+      if (char === '"' || char === "'") { quote = char; continue; }
+      if (char === '(') {
+        boundary(); const sub = scan(index + 1, ')');
+        groups.push(...sub.groups); index = sub.index; continue;
+      }
+      if (command.startsWith('<<', index) && !command.startsWith('<<<', index)) {
+        const match = command.slice(index).match(/^<<(-?)[ \t]*((?:'[^']*'|"[^"]*"|\\[^\n]|[^\s;|&<>'"\\])+)/);
+        if (match) {
+          const delimiter = match[2].replace(/'([^']*)'|"([^"]*)"|\\(.)/g, (_, single, double, escaped) => single ?? double ?? escaped);
+          flush(); heredocs.push({ delimiter, tabs: !!match[1] });
+          index += match[0].length - 1; continue;
+        }
+      }
+      if (char === '>' || char === '<') {
+        // Preserve operator identity (quoted > remains ordinary text). A numeric
+        // token touching the operator is its fd, not a positional argument.
+        if (/^\d+$/.test(token)) token = '';
+        flush();
+        const operator = command.slice(index).match(/^(?:>>|>&|>|<)/)[0];
+        group.push({ redirect: operator }); index += operator.length - 1; continue;
+      }
+      if (char === '\n') {
+        boundary();
+        for (const here of heredocs.splice(0)) {
+          while (index < command.length) {
+            const end = command.indexOf('\n', index + 1);
+            const stop = end < 0 ? command.length : end;
+            const line = command.slice(index + 1, stop);
+            index = stop;
+            if ((here.tabs ? line.replace(/^\t+/, '') : line) === here.delimiter) break;
+          }
+        }
+      } else if (';&|'.includes(char)) {
+        boundary();
+        if (command[index + 1] === char) index += 1;
+      } else if (/\s/.test(char)) flush();
+      else token += char;
+    }
+    boundary(); return { groups, index };
+  }
+  return scan(0).groups;
+}
+
+const WRAPPER_OPTIONS = {
+  sudo: ['-u', '-g', '-h', '-p', '-C', '-T', '-R', '-D', '--user', '--group', '--host', '--prompt', '--chdir', '--chroot'],
+  env: ['-u', '--unset', '-C', '--chdir', '-S', '--split-string'],
+  time: ['-f', '--format', '-o', '--output'], command: [], builtin: [],
+  nice: ['-n', '--adjustment'], nohup: [],
+  xargs: ['-I', '-i', '-n', '-L', '-P', '-s', '-d', '-E', '-a', '--replace', '--max-args', '--max-lines', '--max-procs', '--arg-file', '--delimiter', '--eof'],
+  npm: ['-p', '--package', '-c', '--call', '--prefix', '--workspace', '-w'],
+  npx: ['-p', '--package', '-c', '--call', '--cache'],
+  pnpm: ['--dir', '-C', '--filter'], pnpx: ['-p', '--package'],
+  yarn: ['--cwd'], bunx: ['-p', '--package'],
+};
+function unwrap(group, state) {
+  let index = 0;
+  while (index < group.length) {
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(group[index] || '')) index += 1;
+    const name = nameOf(group[index]);
+    if (!Object.hasOwn(WRAPPER_OPTIONS, name)) return group.slice(index);
+    if (name === 'xargs') state.unknownCwd = true;
+    index += 1;
+    // npm/pnpm/yarn only wrap a reader in exec mode; run/build remain opaque.
+    let exec = !['npm', 'pnpm', 'yarn'].includes(name);
+    while (index < group.length) {
+      const token = group[index];
+      const cwdOptions = { env: ['-C', '--chdir'], sudo: ['-D', '--chdir'],
+        npm: ['--prefix'], pnpm: ['-C', '--dir'], yarn: ['--cwd'] };
+      if (cwdOptions[name]?.some(option => String(token).split('=')[0] === option
+        || (option.length === 2 && String(token).startsWith(option)))) state.unknownCwd = true;
+      if (name === 'env' && /^-[^-]*C/.test(token)) state.unknownCwd = true;
+      if (token === 'exec' && !exec) { exec = true; index += 1; continue; }
+      if (token === '--') { index += 1; break; }
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { index += 1; continue; }
+      const commandOption = name === 'env' ? /^(?:-S|--split-string)(?:=|$)/ : ['npm', 'npx'].includes(name) ? /^(?:-c|--call)(?:=|$)/ : null;
+      if (commandOption?.test(token)) {
+        const equals = token.indexOf('=');
+        return { command: equals < 0 ? group[index + 1] || '' : token.slice(equals + 1),
+          rest: name === 'env' ? group.slice(index + (equals < 0 ? 2 : 1)) : [] };
+      }
+      if (!token.startsWith('-')) break;
+      index += WRAPPER_OPTIONS[name].includes(token) ? 2 : 1;
+    }
+    if (!exec) return [];
+  }
+  return [];
+}
+function positional(tokens, options) {
+  const values = []; let afterDash = false;
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!afterDash && token === '--') { afterDash = true; continue; }
+    if (!afterDash && options.has(token)) { index += 1; continue; }
+    if (afterDash || !token.startsWith('-') || token === '-') values.push(token);
+  }
+  return values;
+}
+function knownSearchOptions(tokens, options, name) {
+  const booleans = new Set(['-n', '-i', '-v', '-w', '-x', '-F', '-P', '-l', '-L', '-q', '-s', '-h', '-H', '-o', '-c', '-a', '-u', '-U', '-z',
+    '--line-number', '--ignore-case', '--invert-match', '--word-regexp', '--line-regexp', '--fixed-strings', '--pcre2',
+    '--files-with-matches', '--files-without-match', '--quiet', '--no-messages', '--no-filename', '--with-filename',
+    '--only-matching', '--count', '--text', '--multiline', '--null', '--hidden', '--files', '--stats']);
+  if (name === 'grep') for (const flag of ['-r', '-R', '--recursive', '--dereference-recursive']) booleans.add(flag);
+  if (name === 'rg') for (const flag of ['--json', '-S', '--smart-case', '-N', '--no-heading', '--heading',
+    '--column', '--vimgrep', '--follow', '--no-ignore', '--no-ignore-dot', '--no-ignore-exclude',
+    '--no-ignore-files', '--no-ignore-global', '--no-ignore-parent', '--no-ignore-vcs', '--no-ignore-messages',
+    '--no-ignore-file-case-insensitive', '--count-matches', '-b', '--trim']) booleans.add(flag);
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token === '--') return true;
+    if (!token.startsWith('-') || token === '-') continue;
+    if (options.has(token)) { index += 1; continue; }
+    if (/^-[ABCmMjdt]\S+/.test(token) && options.has(token.slice(0, 2))) continue;
+    if (token.startsWith('--') && options.has(token.split('=')[0]) && token.includes('=')) continue;
+    if (booleans.has(token)) continue;
+    if (!token.startsWith('--') && [...token.slice(1)].every(flag => booleans.has(`-${flag}`))) continue;
+    return false;
+  }
+  return true;
+}
+function commandPaths(group, globs, scopes, state) {
+  const inputs = []; const args = [];
+  for (let index = 0; index < group.length; index += 1) {
+    const token = group[index];
+    if (token.redirect) {
+      const operand = group[index += 1];
+      if (token.redirect === '<' && typeof operand === 'string') inputs.push(operand);
+    } else args.push(token);
+  }
+  return [...inputs, ...readerPaths(args, globs, scopes, state)];
+}
+function readerPaths(group, globs, scopes, state) {
+  const tokens = unwrap(group, state);
+  if (tokens.command !== undefined) {
+    const groups = commandGroups(tokens.command);
+    if (groups.length) groups[groups.length - 1].push(...tokens.rest);
+    return groups.flatMap((nested) => commandPaths(nested, globs, scopes, state));
+  }
+  const name = nameOf(tokens[0]);
+  if (['cd', 'pushd', 'popd', 'eval', 'source', '.'].includes(name)) state.unknownCwd = true;
+  if (!READERS.has(name)) return []; // Executables and non-reader arguments are never paths.
+  if (name === 'find') {
+    let index = 1;
+    while (['-H', '-L', '-P'].includes(tokens[index]) || /^-O\d+$/.test(tokens[index] || '')) index += 1;
+    if (tokens[index] === '-D') index += 2;
+    if (tokens[index] === '--') index += 1;
+    const roots = [];
+    for (; index < tokens.length && !/^(?:-|!|\(|\))/.test(tokens[index]); index += 1) roots.push(tokens[index]);
+    return roots; // Expressions such as -path ... -prune are not read roots.
+  }
+  if (['rg', 'grep'].includes(name)) {
+    const firstGlob = globs.length;
+    for (let index = 1; index < tokens.length; index += 1) {
+      const token = tokens[index];
+      if (['-g', '--glob', '--iglob'].includes(token)) globs.push(tokens[index + 1] || '');
+      else if (/^--i?glob=/.test(token)) globs.push(token.slice(token.indexOf('=') + 1));
+    }
+    const options = new Set(['-e', '--regexp', '-f', '--file', '-g', '--glob', '--iglob', '-t', '--type', '-T', '--type-not', '--exclude', '--exclude-dir', '--include', '-m', '--max-count', '-A', '-B', '-C', '--after-context', '--before-context', '--context', '--encoding', '--color',
+      '--max-depth', '-d', '-j', '--threads', '-M', '--max-columns', '--sort', '--sortr', '--replace', '--max-filesize', '--pre', '--path-separator', '--dfa-size-limit', '--regex-size-limit', '--directories', '-D', '--devices', '--label']);
+    // rg -r takes replacement text; grep -r is a recursive flag.
+    if (name === 'rg') options.add('-r');
+    const values = positional(tokens, options);
+    const explicit = tokens.some((token) => /^(?:-[ef]|--(?:regexp|file)(?:=|$))/.test(token)) || tokens.includes('--files');
+    const paths = explicit ? values : values.slice(1);
+    scopes.push({ paths: state.unknownCwd || !knownSearchOptions(tokens, options, name) ? [] : paths, globs: globs.slice(firstGlob) });
+    return paths;
+  }
+  if (['sed', 'awk'].includes(name)) {
+    const options = new Set(['-e', '--expression', '-f', '--file', '-F', '-v']);
+    const values = positional(tokens, options);
+    return tokens.some((token) => /^(?:-[ef]|--(?:expression|file)(?:=|$))/.test(token)) ? values : values.slice(1);
+  }
+  // A flag's meaning belongs to its reader: cat -n and wc -c are booleans,
+  // whereas head -n consumes a number. Never swallow the following read path.
+  const options = {
+    head: ['-n', '--lines', '-c', '--bytes'], tail: ['-n', '--lines', '-c', '--bytes', '--pid', '-s', '--sleep-interval'],
+    nl: ['-b', '-d', '-f', '-h', '-i', '-l', '-n', '-s', '-v', '-w'],
+    tree: ['-I', '-P', '-L', '-o', '--filelimit', '--sort'],
+    ls: ['-I', '--ignore', '--hide', '--format', '--sort', '--time', '--block-size', '--quoting-style', '-w', '--width'],
+    du: ['-d', '--max-depth', '--exclude', '-X', '--exclude-from', '-B', '--block-size'],
+    stat: ['-c', '--format', '--printf'], file: ['-m', '--magic-file', '-f', '--files-from', '-F', '--separator'],
+    bat: ['--color', '--style', '--language', '--paging', '--theme', '--line-range', '-r', '--tabs'],
+    less: ['-x', '--tabs', '-j', '-p', '-P', '-z'],
+  };
+  return positional(tokens, new Set(options[name] || []));
+}
+function broadGlobFor(paths, globs, context) {
+  if (paths.length > 0 && paths.every(requested => narrowPath(requested, context))) return undefined;
+  return globs.find(glob => !glob.startsWith('!') && BROAD_GLOBS.some(rule => rule.test(clean(glob))));
+}
+function inspectInput(toolName, toolInput, context = {}) {
+  if (WRITE_TOOLS.has(toolName)) return {};
+  const paths = []; const globs = [];
+  collectStructured(toolInput, '', toolName, paths, globs);
+  let broadGlob = broadGlobFor(paths, globs, context);
+  const scopes = [];
+  const commandContext = { ...context };
+  let unknownCwd = context.cwd !== undefined && typeof context.cwd !== 'string';
+  const overrides = ['cwd', 'workdir'].filter(key => Object.hasOwn(toolInput || {}, key));
+  for (const key of overrides) {
+    if (typeof toolInput[key] !== 'string' || !toolInput[key].trim()) unknownCwd = true;
+    else commandContext.cwd = path.resolve(typeof context.cwd === 'string' ? context.cwd : process.cwd(), toolInput[key]);
+  }
+  if (overrides.length > 1 && toolInput.cwd !== toolInput.workdir) unknownCwd = true;
+  for (const key of ['command', 'cmd']) {
+    if (typeof toolInput?.[key] === 'string') {
+      const state = { unknownCwd };
+      for (const group of commandGroups(toolInput[key])) paths.push(...commandPaths(group, globs, scopes, state));
+    }
+  }
+  const included = globs.filter((glob) => !glob.startsWith('!'));
+  for (const scope of scopes) broadGlob ||= broadGlobFor(scope.paths, scope.globs, commandContext);
+  paths.push(...included);
+  return {
+    broadGlob,
+    blockedPath: paths.map((requested) => ({ requested, blocked: blockedSegment(requested, context) })).find((result) => result.blocked),
+  };
+}
+
+module.exports = { BLOCKED_DIRS, inspectInput };

package/src/claude/hooks/lib/parser.cjs

@@ -80,7 +80,7 @@ function processEntry(entry, toolMap, agentMap, latestTodos, result) {
   for (const block of content) {
     // Handle tool_use blocks
     if (block.type === 'tool_use' && block.id && block.name) {
-      if (block.name === 'Task') {
+      if (block.name === 'Task' || block.name === 'Agent') {
         // Agent spawn
         agentMap.set(block.id, {
           id: block.id,

package/src/claude/hooks/lib/privacy-command-analysis.cjs

@@ -107,6 +107,7 @@ function scanShell(command) {
   const source = String(command).replace(/\\\r?\n/g, '');
   const segments = [];
   const nested = [];
+  const recordNested = command => nested.push({ command, segment: segments.length });
   let words = [];
   let word = { text: '', activeExpansion: false, started: false };
   let quote = null;
@@ -132,7 +133,7 @@ function scanShell(command) {
         if (source[index + 1] === '(') {
           const end = matchingParen(source, index + 1);
           if (end < 0) { malformed = true; continue; }
-          nested.push(source.slice(index + 2, end));
+          recordNested(source.slice(index + 2, end));
           append('()');
           index = end;
         }
@@ -142,7 +143,7 @@ function scanShell(command) {
         word.activeExpansion = true;
         const end = matchingBacktick(source, index);
         if (end < 0) { malformed = true; continue; }
-        nested.push(source.slice(index + 1, end));
+        recordNested(source.slice(index + 1, end));
         append('\x60\x60');
         index = end;
         continue;
@@ -164,7 +165,7 @@ function scanShell(command) {
       if (source[index + 1] === '(') {
         const end = matchingParen(source, index + 1);
         if (end < 0) { malformed = true; continue; }
-        nested.push(source.slice(index + 2, end));
+        recordNested(source.slice(index + 2, end));
         append('()');
         index = end;
       }
@@ -174,7 +175,7 @@ function scanShell(command) {
       word.activeExpansion = true;
       const end = matchingBacktick(source, index);
       if (end < 0) { malformed = true; continue; }
-      nested.push(source.slice(index + 1, end));
+      recordNested(source.slice(index + 1, end));
       append('\x60\x60');
       index = end;
       continue;
@@ -183,15 +184,31 @@ function scanShell(command) {
       word.activeExpansion = true;
       const end = matchingParen(source, index + 1);
       if (end < 0) { malformed = true; continue; }
-      nested.push(source.slice(index + 2, end));
+      recordNested(source.slice(index + 2, end));
       append(`${ch}()`);
       index = end;
       continue;
     }
     if ((ch === '~' && !word.text) || '*?{['.includes(ch)) { word.activeExpansion = true; append(ch); continue; }
     if (';|&\n()'.includes(ch)) { flushSegment(); continue; }
-    if (ch === '<') { flushWord(); words.push({ text: '<', activeExpansion: false, started: true }); continue; }
-    if (ch === '>') { flushWord(); continue; }
+    if (ch === '<') {
+      const descriptor = /^[0-9]+$/.test(word.text);
+      flushWord();
+      if (descriptor) (words.redirectFds ||= []).push(words.length - 1);
+      (words.inputRedirects ||= []).push(words.length, words.length + 1);
+      words.push({ text: '<', activeExpansion: false, started: true });
+      continue;
+    }
+    if (ch === '>') {
+      const descriptor = /^[0-9]+$/.test(word.text);
+      flushWord();
+      if (descriptor) (words.redirectFds ||= []).push(words.length - 1);
+      (words.redirects ||= []).push(words.length);
+      if (source[index + 1] === '>') index += 1;
+      if (source[index + 1] === '&') index += 1;
+      if (source[index + 1] === '|') index += 1;
+      continue;
+    }
     if (' \t\r'.includes(ch)) { flushWord(); continue; }
     append(ch);
   }
@@ -272,11 +289,150 @@ function genericOperands(words, start, result, {
 
 function merge(target, source) {
   source.paths.forEach((value) => target.paths.add(value));
+  target.searches.push(...source.searches);
+  source.writes.forEach(value => target.writes.add(value));
+  source.unknownWrites.forEach(value => target.unknownWrites.add(value));
   target.dynamic ||= source.dynamic;
   target.malformed ||= source.malformed;
 }
 
-function analyzeWords(words, result, depth) {
+// Describe searches separately so the existing read operands stay unchanged.
+function searchDescription(words, start, name) {
+  const grep = ['grep', 'egrep', 'fgrep'].includes(name);
+  const search = { recursive: !grep, hidden: grep, includes: [], excludes: [], roots: [] };
+  const values = new Set([...GREP_OPTION_VALUE, '-g', '--glob', '--iglob', '--include', '--exclude',
+    '--exclude-dir', '-d', '--directories', '-t', '--type', '-T', '--type-not',
+    '--max-depth', '-j', '--threads', '-M', '--max-columns', '--sort', '--sortr',
+    '--max-filesize', '--pre', '--path-separator', '--dfa-size-limit', '--regex-size-limit']);
+  let pattern = !grep && words.slice(start).some(word => word.text === '--files');
+  let unrestricted = 0;
+  let options = true;
+  const positional = [];
+  for (let index = start; index < words.length; index += 1) {
+    const word = words[index];
+    const text = word.text;
+    if (options && text === '--') { options = false; continue; }
+    if (options && text.startsWith('-') && text !== '-') {
+      let option = text.split('=')[0];
+      let value = text.includes('=') ? text.slice(text.indexOf('=') + 1) : null;
+      let shortFlags = /^-[^-]/.test(text) ? text.slice(1) : '';
+      const attached = text.match(/^-([^-]*?)([gef])(.*)$/);
+      if (attached) { shortFlags = attached[1]; option = `-${attached[2]}`; value = attached[3] || null; }
+      if (values.has(option) && value === null) value = words[++index]?.text || '';
+      if (['-e', '--regexp', '-f', '--file'].includes(option)) pattern = true;
+      if (['-g', '--glob', '--include'].includes(option)) search.includes.push(value || '');
+      if (['--exclude', '--exclude-dir'].includes(option)) search.excludes.push(value || '');
+      if (grep && (['--recursive', '--dereference-recursive'].includes(option)
+        || /[rR]/.test(shortFlags)
+        || (['-d', '--directories'].includes(option) && value === 'recurse'))) search.recursive = true;
+      if (!grep) {
+        if (option === '--hidden' || shortFlags.includes('.')) search.hidden = true;
+        unrestricted += (shortFlags.match(/u/g) || []).length + (option === '--unrestricted' ? 1 : 0);
+      }
+      continue;
+    }
+    positional.push(word);
+  }
+  if (!pattern) positional.shift();
+  search.roots = positional.filter(word => !word.activeExpansion && word.text !== '-').map(word => word.text);
+  if (!search.roots.length) search.roots.push('.');
+  if (unrestricted >= (name === 'ag' ? 1 : 2)) search.hidden = true;
+  // Case-insensitive globs are not evidence that a differently cased child is excluded.
+  if (words.slice(start).some(word => ['--glob-case-insensitive', '--iglob'].includes(word.text.split('=')[0]))) search.includes = [];
+  return search;
+}
+
+function writeTarget(word, result, directory) {
+  if (!word?.text || word.activeExpansion || word.text === '-') return;
+  if (directory === null && !word.text.startsWith('/')) {
+    result.unknownWrites.add(word.text);
+    return;
+  }
+  result.writes.add(word.text.startsWith('/') || directory === '.' ? word.text : `${directory}/${word.text}`);
+}
+
+function commandWrites(words, start, name, result, directory) {
+  const redirected = new Set([...(words.redirects || []), ...(words.redirectFds || []), ...(words.inputRedirects || [])]);
+  if (name === 'tee') {
+    for (let index = start; index < words.length; index += 1) {
+      if (!redirected.has(index) && !words[index].text.startsWith('-')) writeTarget(words[index], result, directory);
+    }
+  }
+  if (['cp', 'mv', 'install', 'ln'].includes(name)) {
+    const operands = [];
+    let targetDirectory = false;
+    const values = new Set(['-t', '--target-directory', '-S', '--suffix', '-m', '--mode', '-o', '--owner', '-g', '--group']);
+    let options = true;
+    for (let index = start; index < words.length; index += 1) {
+      if (redirected.has(index)) continue;
+      const word = words[index];
+      if (options && word.text === '--') { options = false; continue; }
+      if (options && word.text.startsWith('-')) {
+        let option = word.text.split('=')[0];
+        let value = word.text.includes('=')
+          ? { text: word.text.slice(word.text.indexOf('=') + 1), activeExpansion: word.activeExpansion }
+          : values.has(option) ? words[++index] : null;
+        if (!word.text.startsWith('--') && !values.has(option)) {
+          for (let flag = 1; flag < word.text.length; flag += 1) {
+            const candidate = `-${word.text[flag]}`;
+            if (!values.has(candidate)) continue;
+            option = candidate;
+            value = flag + 1 < word.text.length
+              ? { text: word.text.slice(flag + 1), activeExpansion: word.activeExpansion } : words[++index];
+            break;
+          }
+        }
+        if (['-t', '--target-directory'].includes(option)) {
+          targetDirectory = true;
+          writeTarget(value, result, directory);
+        }
+      } else operands.push(word);
+    }
+    if (!targetDirectory) writeTarget(operands.at(-1), result, directory);
+    if (name === 'cp' || name === 'mv') {
+      const sources = targetDirectory ? operands : operands.slice(0, -1);
+      for (const source of sources) {
+        const basename = source.text.replace(/\\/g, '/').replace(/\/+$/, '').split('/').at(-1).toLowerCase();
+        if (!['.claude', '.codex', '.omp', '.privacy'].includes(basename)) continue;
+        if (source.activeExpansion) result.unknownWrites.add(basename);
+        else writeTarget(source, result, directory);
+      }
+    }
+  }
+  if (name === 'sed') {
+    let inPlace = false;
+    let scriptOption = false;
+    const operands = [];
+    let options = true;
+    for (let index = start; index < words.length; index += 1) {
+      if (redirected.has(index)) continue;
+      const word = words[index];
+      if (options && word.text === '--') { options = false; continue; }
+      if (options && word.text.startsWith('-')) {
+        const option = word.text.split('=')[0];
+        if (option === '--in-place') inPlace = true;
+        if (['--expression', '--file'].includes(option)) {
+          scriptOption = true;
+          if (!word.text.includes('=')) index += 1;
+        } else if (!word.text.startsWith('--')) {
+          for (let flag = 1; flag < word.text.length; flag += 1) {
+            if (word.text[flag] === 'i') { inPlace = true; break; }
+            if (word.text[flag] === 'e' || word.text[flag] === 'f') {
+              scriptOption = true;
+              if (flag + 1 === word.text.length) index += 1;
+              break;
+            }
+          }
+        }
+      } else operands.push(word);
+    }
+    if (operands[0]?.text === '') operands.shift();
+    if (inPlace) for (const word of operands.slice(scriptOption ? 0 : 1)) writeTarget(word, result, directory);
+  }
+}
+
+function analyzeWords(words, result, depth, directory = '.') {
+  for (const index of words.redirects || []) writeTarget(words[index], result, directory);
   for (let index = 0; index + 1 < words.length; index += 1) {
     if (words[index].text === '<') addOperand(result, words[index + 1]);
   }
@@ -284,11 +440,13 @@ function analyzeWords(words, result, depth) {
   if (command.index < 0) return;
   const start = command.index + 1;
   const name = command.name;
+  commandWrites(words, start, name, result, directory);
   if (SIMPLE_READERS.has(name)) {
     genericOperands(words, start, result, { valueOptions: SIMPLE_OPTION_VALUES.get(name) || new Set() });
     return;
   }
   if (GREP_READERS.has(name)) {
+    result.searches.push(searchDescription(words, start, name));
     const patternOption = words.slice(start).some((word) => ['-e', '--regexp', '-f', '--file'].includes(word.text.split('=')[0]));
     genericOperands(words, start, result, {
       skipFirst: patternOption ? 0 : 1,
@@ -319,7 +477,7 @@ function analyzeWords(words, result, depth) {
   if (SHELLS.has(name)) {
     for (let index = start; index + 1 < words.length; index += 1) {
       if (words[index].text === '-c' || words[index].text === '--command') {
-        merge(result, analyzeCommand(words[index + 1].text, depth + 1));
+        merge(result, analyzeCommand(words[index + 1].text, depth + 1, directory));
         return;
       }
     }
@@ -327,7 +485,7 @@ function analyzeWords(words, result, depth) {
     return;
   }
   if (name === 'eval') {
-    merge(result, analyzeCommand(words.slice(start).map((word) => word.text).join(' '), depth + 1));
+    merge(result, analyzeCommand(words.slice(start).map((word) => word.text).join(' '), depth + 1, directory));
     return;
   }
   if (name === 'find') {
@@ -335,7 +493,7 @@ function analyzeWords(words, result, depth) {
       if (words[index].text !== '-exec' && words[index].text !== '-execdir') continue;
       const nested = [];
       for (index += 1; index < words.length && ![';', '+'].includes(words[index].text); index += 1) nested.push(words[index]);
-      analyzeWords(nested, result, depth + 1);
+      analyzeWords(nested, result, depth + 1, directory);
     }
     return;
   }
@@ -351,7 +509,7 @@ function analyzeWords(words, result, depth) {
       index = skipOption(words, index, XARGS_OPTION_VALUE);
       nestedStart = index;
     }
-    if (nestedStart < words.length) analyzeWords(words.slice(nestedStart), result, depth + 1);
+    if (nestedStart < words.length) analyzeWords(words.slice(nestedStart), result, depth + 1, directory);
     return;
   }
   if (INLINE_RUNTIMES.has(name)) {
@@ -369,13 +527,28 @@ function analyzeWords(words, result, depth) {
   if (name === 'openssl') genericOperands(words, start, result, { pathOptions: new Set(['-in', '-key', '-cert', '-config']) });
 }
 
-function analyzeCommand(command, depth = 0) {
-  const result = { paths: new Set(), dynamic: false, malformed: false };
+function analyzeCommand(command, depth = 0, directory = '.') {
+  const result = { paths: new Set(), dynamic: false, malformed: false, searches: [], writes: new Set(), unknownWrites: new Set() };
   if (depth > MAX_DEPTH) { result.dynamic = true; return result; }
   const parsed = scanShell(command);
   result.malformed = parsed.malformed;
-  for (const words of parsed.segments) analyzeWords(words, result, depth);
-  for (const nested of parsed.nested) merge(result, analyzeCommand(nested, depth + 1));
+  let currentDirectory = directory;
+  const directories = [];
+  for (const words of parsed.segments) {
+    directories.push(currentDirectory);
+    analyzeWords(words, result, depth, currentDirectory);
+    const info = unwrap(words);
+    if (['cd', 'pushd'].includes(info.name)) {
+      const target = words.slice(info.index + 1).find(word => word.text && !word.text.startsWith('-'));
+      if (!target || target.activeExpansion) currentDirectory = null;
+      else if (target.text.startsWith('/')) currentDirectory = target.text;
+      else if (currentDirectory !== null) currentDirectory = `${currentDirectory}/${target.text}`;
+    }
+  }
+  for (const nested of parsed.nested) {
+    const nestedDirectory = directories[nested.segment] === undefined ? directory : directories[nested.segment];
+    merge(result, analyzeCommand(nested.command, depth + 1, nestedDirectory));
+  }
   if (result.malformed && parsed.segments.some((words) => {
     const commandInfo = unwrap(words);
     return SIMPLE_READERS.has(commandInfo.name) || GREP_READERS.has(commandInfo.name)
@@ -387,7 +560,8 @@ function analyzeCommand(command, depth = 0) {
 
 function commandAccess(command) {
   const result = analyzeCommand(command);
-  return { paths: [...result.paths], dynamic: result.dynamic, malformed: result.malformed };
+  return { paths: [...result.paths], dynamic: result.dynamic, malformed: result.malformed, searches: result.searches,
+    writes: [...result.writes], unknownWrites: [...result.unknownWrites] };
 }
 
 module.exports = { DYNAMIC_READ_PATH, commandAccess };