@loophubs/agent-guard 0.1.0 → 0.2.0

package/src/rules/appdata.ts

@@ -2,9 +2,10 @@
 // process reads or enumerates another app's ~/Library data tree, so these deny
 // those reads and the broad walks that reach them.
 import { basename } from "node:path";
-import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths.ts";
-import { reasons } from "../reasons.ts";
-import type { Command, Request } from "../record.ts";
+
+import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths";
+import { reasons } from "../reasons";
+import type { Command, Request } from "../record";
 
 const { appdata: appdataReason, broad: broadReason } = reasons;
 
@@ -26,18 +27,17 @@ export function appdataRules(req: Request): string[] {
     if (reason) denials.push(reason);
   }
   const home = req.home.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const signature = new RegExp(`(~|\\$HOME|\\$\\{HOME\\}|${home})/Library/(${trees})`);
+  const signature = new RegExp(`(~|\\$HOME|\\$\\{HOME\\}|${home})/Library/(${trees})`, "i");
   for (const fragment of req.uninspectable) if (signature.test(fragment)) denials.push(appdataReason);
   return denials;
 }
 
 function appdataCommand(cmd: Command, home: string): string | undefined {
   const cwd = cmd.cwd;
-  const prog = cmd.program >= 0 ? basename(cmd.argv[cmd.program].text) : "";
+  const prog = cmd.program >= 0 ? basename(cmd.argv[cmd.program]!.text) : "";
   const data = dataPrograms.has(prog);
   // cd reads its target but walks nothing.
-  const recursive = cmd.argv.slice(cmd.program + 1).some((word) =>
-    (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
+  const recursive = cmd.argv.slice(cmd.program + 1).some((word) => (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
   const gitConfig = prog === "git" && cmd.argv.slice(cmd.program + 1).some((word) => word.text === "config");
   const walk = !data && !gitConfig && !["cd", "pushd", "popd"].includes(prog) && !noWalkPrograms.has(prog) && !(["ls", "cp"].includes(prog) && !recursive);
   const paths: { path: string; glob: boolean }[] = [];
@@ -46,7 +46,7 @@ function appdataCommand(cmd: Command, home: string): string | undefined {
     if (word.role === "program" && !word.value.includes("/")) continue;
     if (data && !word.globs && i > cmd.program) continue;
     // An expansion the front end cannot resolve may well be $HOME.
-    if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "s").test(word.value)) return appdataReason;
+    if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "is").test(word.value)) return appdataReason;
     paths.push({ path: absPath(word.value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
   }
   for (const r of cmd.redirects) {
@@ -60,23 +60,15 @@ function appdataCommand(cmd: Command, home: string): string | undefined {
   // Path operands scope a walk away from the current directory; a search
   // tool's pattern is not one of them.
   let scoped = false;
-  let noignore = cmd.flags.has("noignore");
   for (const word of cmd.argv.slice(cmd.program + 1)) {
     const text = word.text;
     if ((word.role === "arg" || word.role === "path") && !text.startsWith("-")) scoped = true;
-    if (/^--(unrestricted|no-ignore)/.test(text)) noignore = true;
-    if (prog === "fd" && /^-[^-]*[uI]/.test(text)) noignore = true;
-    // A positive glob reaching Library overrides the ignore filter.
-    if (word.role === "glob" || word.role === "option:glob") {
-      const glob = new Bun.Glob(word.value.toLowerCase());
-      if (["library", ...appdataTrees.map((tree) => `library/${tree.toLowerCase()}/x`)].some((path) => glob.match(path))) noignore = true;
-    }
   }
   if (prog === "ls" && !scoped && isAppdata(cwd, home)) return appdataReason;
   // rg and fd also read ignore files from cwd when given a path operand.
   let denied = false;
-  if (prog === "find" || prog === "du") denied = !scoped && (isBroad(cwd, home) || isAppdata(cwd, home));
+  if (["find", "du", "tree"].includes(prog)) denied = !scoped && (isBroad(cwd, home) || isAppdata(cwd, home));
   else if (prog === "ls" || prog === "grep") denied = !scoped && recursive && isBroad(cwd, home);
-  else if (prog === "rg" || prog === "fd") denied = !scoped && (noignore ? isBroad(cwd, home) : isLibrary(cwd, home));
+  else if (["rg", "fd", "ag", "ack"].includes(prog)) denied = !scoped && (isBroad(cwd, home) || isLibrary(cwd, home));
   return denied ? broadReason : undefined;
 }

package/src/rules/credentials.ts

@@ -3,18 +3,28 @@
 // Clients that consume a credential file themselves (dotenvx, node --env-file,
 // ssh -i) are not readers and stay allowed.
 import { basename } from "node:path";
-import { absPath, isSensitive, sshPrivate, sshScopeDenied } from "../paths.ts";
-import { reasons } from "../reasons.ts";
-import type { Command, Request } from "../record.ts";
+
+import { absPath, isSensitive, isSensitiveRoot, sshPrivate, sshScopeDenied } from "../paths";
+import { reasons } from "../reasons";
+import type { Command, Request, Word } from "../record";
 
 const readerPrograms = new Set(
-  ("cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
-    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack").split(" "),
+  (
+    "cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
+    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack"
+  ).split(" "),
 );
 const {
-  file: fileReason, dump: dumpReason, variable: varReason, token: tokenReason,
-  keychain: keychainReason, trace: traceReason, upload: uploadReason,
-  ssh: sshReason, grepSsh: grepSshReason,
+  file: fileReason,
+  dump: dumpReason,
+  variable: varReason,
+  token: tokenReason,
+  keychain: keychainReason,
+  trace: traceReason,
+  upload: uploadReason,
+  ssh: sshReason,
+  grepSsh: grepSshReason,
+  hiddenSearch: hiddenSearchReason,
 } = reasons;
 
 const secretName = (name: string) => /TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL/.test(name.toUpperCase());
@@ -24,7 +34,7 @@ export function credentialRules(req: Request): string[] {
   if (req.operation === "read" && isSensitive(req.target)) denials.push(fileReason);
   if (req.operation === "write" && sshPrivate(req.target)) denials.push(sshReason);
   if (req.operation === "search") {
-    if (isSensitive(req.searchRoot)) denials.push(fileReason);
+    if (isSensitiveRoot(req.searchRoot)) denials.push(fileReason);
     // A positive glob selects files even past ignore rules.
     if (req.glob && !req.glob.startsWith("!") && isSensitive(`${req.searchRoot}/${basename(req.glob)}`, true)) denials.push(fileReason);
   }
@@ -37,6 +47,25 @@ export function credentialRules(req: Request): string[] {
 export function credentialFilesystemRules(req: Request): string[] {
   if ((req.operation === "read" || req.operation === "write") && sshScopeDenied(req.target, req.home, false)) return [sshReason];
   if (req.operation === "search" && sshScopeDenied(req.searchRoot, req.home, true)) return [grepSshReason];
+  for (const cmd of req.commands) {
+    for (const redirect of cmd.redirects) {
+      if ((redirect.direction === "in" || redirect.direction === "out") && redirect.target && sshScopeDenied(absPath(redirect.target, cmd.cwd, req.home), req.home, false)) return [sshReason];
+    }
+    if (cmd.program < 0) continue;
+    const name = basename(cmd.argv[cmd.program]!.text);
+    const readsPath = ["ls", "find", "tree", "rg", "grep", "ag", "ack", "fd"].includes(name);
+    if (!readsPath && !readerPrograms.has(name)) continue;
+    const words = cmd.argv.slice(cmd.program + 1);
+    // A search with no path operand reads the working directory.
+    const searches = ["rg", "ag", "ack"].includes(name) || (name === "grep" && cmd.flags.has("recursive"));
+    if (searches && !cmd.flags.has("help") && !words.some((word) => word.role === "path") && sshScopeDenied(cmd.cwd, req.home, true)) return [grepSshReason];
+    const filter = name === "jq" ? jqFilter(words) : undefined;
+    for (const word of words) {
+      if (word === filter) continue;
+      if (!["arg", "path", "patfile", "option:patfile"].includes(word.role) || word.value.startsWith("-")) continue;
+      if (sshScopeDenied(absPath(word.value, cmd.cwd, req.home, /^['"]/.test(word.raw)), req.home, false)) return [sshReason];
+    }
+  }
   return [];
 }
 
@@ -48,7 +77,7 @@ function credentialCommand(cmd: Command, home: string): string[] {
     if (cmd.wrappers.at(-1) === "env" && !cmd.wrappers.includes("env-S")) denials.push(dumpReason);
     return denials;
   }
-  const program = cmd.argv[cmd.program].text;
+  const program = cmd.argv[cmd.program]!.text;
   const name = basename(program);
   const words = cmd.argv.slice(cmd.program + 1);
   const args = words.map((w) => w.text);
@@ -58,7 +87,7 @@ function credentialCommand(cmd: Command, home: string): string[] {
     if (name === "export" && (!args.length || args.some((a) => /^-[^-]*p/.test(a)))) denials.push(dumpReason);
     if (name === "set" && !args.length) denials.push(dumpReason);
     if (name === "typeset" || name === "declare") {
-      if (!args.length || (args.length === 1 && /^-[^-]*[px]/.test(args[0]))) denials.push(dumpReason);
+      if (!args.length || (args.length === 1 && /^-[^-]*[px]/.test(args[0]!))) denials.push(dumpReason);
       for (const a of args) if (!a.startsWith("-") && !a.includes("=") && secretName(a)) denials.push(varReason);
     }
   }
@@ -80,6 +109,7 @@ function credentialCommand(cmd: Command, home: string): string[] {
     case "ag":
     case "ack":
       if (cmd.flags.has("help")) break;
+      if ((name === "grep" && cmd.flags.has("recursive")) || (["rg", "ag"].includes(name) && cmd.flags.has("hidden"))) denials.push(hiddenSearchReason);
       for (const w of words) {
         if (w.role === "path" && absPath(w.value, cmd.cwd, home, /^['"]/.test(w.raw)) === `${home}/.ssh`) denials.push(sshReason);
       }
@@ -87,7 +117,9 @@ function credentialCommand(cmd: Command, home: string): string[] {
       // Search operands, pattern files and positive globs are read targets;
       // the pattern is not.
       for (const w of words) {
-        if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
+        const quoted = /^['"]/.test(w.raw);
+        if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, quoted)) denials.push(fileReason);
+        if (w.role === "path" && isSensitiveRoot(absPath(w.value, cmd.cwd, home, quoted))) denials.push(fileReason);
         if (["glob", "option:glob"].includes(w.role) && sensitive(basename(w.value), true)) denials.push(fileReason);
       }
       break;
@@ -106,12 +138,9 @@ function credentialCommand(cmd: Command, home: string): string[] {
       break;
     default:
       if (!readerPrograms.has(name)) return denials;
-      let jqFilter = name === "jq" && !args.includes("-f") && !args.includes("--from-file");
+      const filter = name === "jq" ? jqFilter(words) : undefined;
       for (const w of words) {
-        if (jqFilter && !w.text.startsWith("-")) {
-          jqFilter = false;
-          continue;
-        }
+        if (w === filter) continue;
         const target = /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
         if (target && !target.startsWith("-") && sensitive(target, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
       }
@@ -121,10 +150,15 @@ function credentialCommand(cmd: Command, home: string): string[] {
   return denials;
 }
 
+function jqFilter(words: Word[]): Word | undefined {
+  if (words.some((word) => word.text === "-f" || word.text === "--from-file")) return undefined;
+  return words.find((word) => !word.text.startsWith("-"));
+}
+
 // A token-display flag counts even when a later flag cancels it.
 function ghShowsToken(args: string[]): boolean {
   for (let i = 0; i < args.length; i++) {
-    const a = args[i];
+    const a = args[i]!;
     if (a === "--") return false;
     if (["--hostname", "--jq", "--json", "--template", "-h"].includes(a)) i++;
     else if (a === "--show-token" || a.startsWith("--show-token=") || /^-[at]*t/.test(a)) return true;
@@ -138,19 +172,20 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
   const denials: string[] = [];
   const long = /^--(data|data-ascii|data-binary|data-urlencode|json|form|header|upload-file|config)(=|$)/s;
   for (let i = 0; i < args.length; i++) {
-    const word = args[i];
+    const word = args[i]!;
     let key = "";
     let value = "";
     if (word === "--") break;
+    if (/^file:\/\//i.test(word) && sensitive(word)) denials.push(fileReason);
     if (/^--(verbose|trace|trace-ascii)(=|$)/.test(word)) denials.push(traceReason);
     else if (long.test(word)) {
-      key = word.slice(2).split("=")[0];
+      key = word.slice(2).split("=")[0]!;
       value = word.includes("=") ? word.slice(word.indexOf("=") + 1) : (args[++i] ?? "");
     } else if (/^-[^-]/.test(word)) {
       for (let k = 1; k < word.length; k++) {
         if (word[k] === "v") denials.push(traceReason);
-        if (!"AbcCdDeEFHKmoPQrTtuUwxXyYz".includes(word[k])) continue;
-        key = word[k];
+        if (!"AbcCdDeEFHKmoPQrTtuUwxXyYz".includes(word[k]!)) continue;
+        key = word[k]!;
         value = word.slice(k + 1) || (args[++i] ?? "");
         break;
       }
@@ -159,7 +194,10 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
       if (!/@./s.test(value)) continue;
       value = value.slice(value.indexOf("@") + 1);
     } else if (key === "F" || key === "form") {
-      value = value.slice(value.indexOf("=") + 1).replace(/^[@<]/, "").split(";")[0];
+      value = value
+        .slice(value.indexOf("=") + 1)
+        .replace(/^[@<]/, "")
+        .split(";")[0]!;
     } else if (!["T", "upload-file", "K", "config"].includes(key)) continue;
     if (sensitive(value)) denials.push(uploadReason);
   }
@@ -167,8 +205,7 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
 }
 
 const readers = [...readerPrograms].filter((p) => p !== ".").join("|");
-const names =
-  "\\.env(\\.(local|production|staging|development))?|\\.npmrc|\\.zsh_history|\\.zprofile|private-keys-v1\\.d|\\S*\\.(pem|key)|auth\\.json|\\.credentials\\.json|\\.aws/credentials|\\.ssh/\\S*";
+const names = "\\.env(?:\\.[A-Za-z0-9_.-]+)?|\\.npmrc|\\.zsh_history|\\.zprofile|private-keys-v1\\.d|\\S*\\.(pem|key)|auth\\.json|\\.credentials\\.json|\\.aws/credentials|\\.ssh/\\S*";
 const readerSignature = new RegExp(`(^|[^A-Za-z0-9_])(${readers})([^A-Za-z0-9_-].*)?[\\s/"'=](${names})($|[\\s/"'>|&)\`])`, "s");
 
 // Text the front end could not structure: interpreter code, case bodies, or
@@ -183,7 +220,7 @@ function credentialSignatures(fragment: string): string[] {
     )
       denials.push(dumpReason);
     const reader = segment.match(readerSignature);
-    if (reader && !(reader[4].startsWith(".ssh/") && !sshPrivate(`/${reader[4]}`))) denials.push(fileReason);
+    if (reader) denials.push(fileReason);
     if (/curl\s.*\s(-[A-Za-z]*v[A-Za-z]*|--verbose|--trace(-ascii)?)(\s|=|$)/s.test(segment)) denials.push(traceReason);
     if (/gh\s+auth\s+token/.test(segment)) denials.push(tokenReason);
     if (/security\s.*\s-[wg](\s|$)/s.test(segment)) denials.push(keychainReason);

package/src/rules/workflow.ts

@@ -1,38 +1,22 @@
-// Workflow rules differ by runtime; the safety rules do not.
-// Codex: run claude through the provider-aware launcher function, which picks
-// the persisted provider mode before gateway credentials are expanded.
 import { basename } from "node:path";
-import { reasons } from "../reasons.ts";
-import type { Request } from "../record.ts";
 
-const {
-  find: findReason, replace: replaceReason, include: includeReason,
-  bre: breReason, launcher: launcherReason,
-} = reasons;
+import { reasons } from "../reasons";
+import type { Request } from "../record";
+
+const { replace: replaceReason, include: includeReason, bre: breReason } = reasons;
 
 export function claudeWorkflowRules(req: Request): string[] {
-  const denials: string[] = [];
+  const advice: string[] = [];
   for (const cmd of req.commands) {
     if (cmd.program < 0) continue;
-    const name = basename(cmd.argv[cmd.program].text);
-    if (name === "find") denials.push(findReason);
+    const name = basename(cmd.argv[cmd.program]!.text);
     if (name !== "rg") continue;
-    if (cmd.flags.has("replace")) denials.push(replaceReason);
-    if (cmd.flags.has("include")) denials.push(includeReason);
+    if (cmd.flags.has("replace")) advice.push(replaceReason);
+    if (cmd.flags.has("include")) advice.push(includeReason);
     if (cmd.flags.has("fixed")) continue;
     for (const w of cmd.argv.slice(cmd.program + 1)) {
-      if ((w.role === "pattern" || w.role === "option:pattern") && /(^|[^\\])\\\|/.test(w.value)) denials.push(breReason);
+      if ((w.role === "pattern" || w.role === "option:pattern") && /(^|[^\\])\\\|/.test(w.value)) advice.push(breReason);
     }
   }
-  return denials;
-}
-
-export function codexWorkflowRules(req: Request): string[] {
-  const denials: string[] = [];
-  for (const cmd of req.commands) {
-    if (cmd.program < 0) continue;
-    const program = cmd.argv[cmd.program].text;
-    if (basename(program) === "claude" && (program.includes("/") || cmd.wrappers.length)) denials.push(launcherReason);
-  }
-  return denials;
+  return advice;
 }

package/src/runner.ts

@@ -0,0 +1,32 @@
+// A separate process group lets the deadline stop children inheriting hook pipes.
+const child = Bun.spawn({
+  cmd: [process.execPath, `${import.meta.dir}/guard.ts`, ...process.argv.slice(2)],
+  stdin: "inherit",
+  stdout: "pipe",
+  stderr: "pipe",
+  detached: true,
+});
+process.stdout.write(`AGENT_GUARD_PGID=${child.pid}\n`);
+const forward = async (stream: ReadableStream<Uint8Array>) => {
+  for await (const chunk of stream) process.stdout.write(chunk);
+};
+const output = Promise.all([forward(child.stdout), forward(child.stderr)]);
+
+const stopGroup = () => {
+  try {
+    process.kill(-child.pid, "SIGKILL");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ESRCH") throw error;
+  }
+};
+
+let expired = false;
+const deadline = setTimeout(() => {
+  expired = true;
+  stopGroup();
+}, 2800);
+const exit = await child.exited;
+clearTimeout(deadline);
+stopGroup();
+await output;
+process.exitCode = expired ? 1 : exit;

package/src/search-roles.ts

@@ -1,17 +1,16 @@
-import type { Command, ValueRole, Word } from "./record.ts";
+import type { Command, ValueRole, Word } from "./record";
 
 const rgShortValues = "efgtTEABCmMjrd";
 const rgLongValues = new Set(
-  ("regexp file glob iglob type type-not encoding replace color colors sort sortr max-depth max-filesize pre pre-glob " +
+  (
+    "regexp file glob iglob type type-not encoding replace color colors sort sortr max-depth max-filesize pre pre-glob " +
     "engine threads max-columns type-add type-clear path-separator context-separator field-context-separator " +
     "field-match-separator after-context before-context context max-count ignore-file dfa-size-limit " +
-    "regex-size-limit hyperlink-format").split(" "),
+    "regex-size-limit hyperlink-format"
+  ).split(" "),
 );
 const grepShortValues = "efABCmdD";
-const grepLongValues = new Set(
-  ("regexp file include exclude exclude-dir exclude-from label context after-context before-context max-count " +
-    "binary-files devices directories").split(" "),
-);
+const grepLongValues = new Set(("regexp file include exclude exclude-dir exclude-from label context after-context before-context max-count " + "binary-files devices directories").split(" "));
 
 export function searchRoles(cmd: Command, args: Word[], prog: string) {
   const rg = prog === "rg";
@@ -20,52 +19,74 @@ export function searchRoles(cmd: Command, args: Word[], prog: string) {
   const flags = cmd.flags;
   const operands: Word[] = [];
   let options = true;
+  let unrestricted = 0;
+  let noHidden = false;
 
   const value = (at: number, key: string, text: string) => {
     const target = args[at];
     if (!target) return;
+    if (!rg && (key === "d" || key === "directories") && text === "recurse") flags.add("recursive");
     let role: ValueRole = "optarg";
-    if (key === "e" || key === "regexp") (role = "pattern"), flags.add("explicit");
-    else if (key === "f" || key === "file") (role = "patfile"), flags.add("explicit");
-    else if (["g", "glob", "iglob", "include"].includes(key)) role = text.startsWith("!") ? "nglob" : "glob";
+    if (key === "e" || key === "regexp") {
+      role = "pattern";
+      flags.add("explicit");
+    } else if (key === "f" || key === "file") {
+      role = "patfile";
+      flags.add("explicit");
+    } else if (["g", "glob", "iglob", "include"].includes(key)) role = text.startsWith("!") ? "nglob" : "glob";
     target.role = target.role === "option" ? `option:${role}` : role;
     target.value = text;
   };
 
   for (let i = 0; i < args.length; i++) {
-    const word = args[i].text;
+    const word = args[i]!.text;
     if (options && word === "--") {
       options = false;
-      args[i].role = "option";
+      args[i]!.role = "option";
     } else if (options && /^--./.test(word)) {
-      args[i].role = "option";
-      const key = word.slice(2).split("=")[0];
+      args[i]!.role = "option";
+      const key = word.slice(2).split("=")[0]!;
       if (key === "files") flags.add("files");
+      else if (rg && key === "hidden") {
+        noHidden = false;
+        flags.add("hidden");
+      } else if (rg && key === "no-hidden") {
+        noHidden = true;
+        flags.delete("hidden");
+      } else if (rg && key === "unrestricted" && ++unrestricted >= 2 && !noHidden) flags.add("hidden");
+      else if (prog === "ag" && (key === "hidden" || key === "unrestricted")) flags.add("hidden");
       else if (key === "help" || key === "version") flags.add("help");
-      else if (key.startsWith("no-ignore") || key === "unrestricted") flags.add("noignore");
       else if (key === "fixed-strings") flags.add("fixed");
       else if (key === "recursive") flags.add("recursive");
       else if (key === "include") flags.add("include");
       if (word.includes("=")) value(i, key, word.slice(word.indexOf("=") + 1));
-      else if (longValues.has(key)) i++, value(i, key, args[i]?.text ?? "");
+      else if (longValues.has(key)) {
+        i++;
+        value(i, key, args[i]?.text ?? "");
+      }
     } else if (options && /^-./.test(word)) {
-      args[i].role = "option";
+      args[i]!.role = "option";
       for (let k = 1; k < word.length; k++) {
-        const c = word[k];
+        const c = word[k]!;
         if ((rg || prog === "grep") && c === "F") flags.add("fixed");
-        if (rg && c === "u") flags.add("noignore");
         if (prog === "grep" && (c === "r" || c === "R")) flags.add("recursive");
         if ((rg && c === "h") || c === "V") flags.add("help");
         if (rg && c === "r") flags.add("replace");
+        if (rg && c === ".") flags.add("hidden");
+        if (rg && c === "u" && ++unrestricted >= 2 && !noHidden) flags.add("hidden");
+        if (prog === "ag" && c === "u") flags.add("hidden");
         if (!shortValues.includes(c)) continue;
         let text = word.slice(k + 1);
         if (rg) text = text.replace(/^=/, "");
-        if (!text) i++, (text = args[i]?.text ?? "");
+        if (!text) {
+          i++;
+          text = args[i]?.text ?? "";
+        }
         value(i, c, text);
         break;
       }
     } else {
-      operands.push(args[i]);
+      operands.push(args[i]!);
     }
   }
   let explicit = flags.has("explicit") || flags.has("files");

package/src/words.ts

@@ -1,24 +1,18 @@
-import sh from "mvdan-sh";
 import type { DblQuoted, Lit, Node, ParamExp, SglQuoted, Word as WordNode } from "mvdan-sh";
-import { expandHome } from "./paths.ts";
-import type { Word } from "./record.ts";
+import sh from "mvdan-sh";
+
+import { expandHome } from "./paths";
+import type { Word } from "./record";
 
 const type = sh.syntax.NodeType;
 
-export function readWord(
-  node: WordNode,
-  slice: (start: number, end: number) => string,
-  vars: Map<string, string>,
-  home: string,
-  visit: (part: Node, names: string[]) => void,
-): Word {
+export function readWord(node: WordNode, slice: (start: number, end: number) => string, vars: Map<string, string>, home: string, visit: (part: Node, names: string[]) => void): Word {
   const text = (part: Node) => slice(part.Pos().Offset(), part.End().Offset());
   const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "" };
   const expansion = (part: Node) => {
     const param = part as ParamExp;
-    const plain = type(part) === "ParamExp" &&
-      !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
-    const known = plain ? (param.Param.Value === "HOME" ? home : vars.get(param.Param.Value)) : undefined;
+    const plain = type(part) === "ParamExp" && !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
+    const known = plain ? (param.Param!.Value === "HOME" ? home : vars.get(param.Param!.Value)) : undefined;
     out.text += known ?? text(part);
     out.expands ||= known === undefined;
     visit(part, out.vars);
@@ -34,13 +28,13 @@ export function readWord(
           out.text += value[++i] ?? "";
           continue;
         }
-        if ("*?[".includes(value[i])) out.globs = true;
+        if ("*?[".includes(value[i]!)) out.globs = true;
         out.text += value[i];
       }
     } else if (kind === "SglQuoted") {
       const quoted = part as SglQuoted;
       out.text += quoted.Dollar
-        ? quoted.Value.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|([0-7]{1,3})|(.))/gs, (match, hex, unicode, octal, char) => {
+        ? quoted.Value.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|([0-7]{1,3})|(.))/gs, (_match, hex, unicode, octal, char) => {
             if (hex || unicode || octal) return String.fromCodePoint(parseInt(hex ?? unicode ?? octal, octal ? 8 : 16));
             return ({ a: "\x07", b: "\b", e: "\x1b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v" } as Record<string, string>)[char] ?? char;
           })

package/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": ["ESNext"],
+    "target": "ESNext",
+    "module": "Preserve",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "allowUnreachableCode": false,
+    "allowUnusedLabels": false,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": false,
+    "types": ["node", "bun"]
+  },
+  "include": ["src", "tests"]
+}

package/src/mvdan-sh.d.ts

@@ -1,92 +0,0 @@
-// The mvdan-sh package ships no types. This declares only the AST subset the
-// front end reads, so the package needs no type dependency. Positions are
-// UTF-8 byte offsets into the parsed source.
-declare module "mvdan-sh" {
-  export interface Pos {
-    Offset(): number;
-  }
-  export interface Node {
-    Pos(): Pos;
-    End(): Pos;
-  }
-  export interface Lit extends Node {
-    Value: string;
-  }
-  export interface Comment extends Node {
-    Hash: Pos;
-  }
-  export interface Word extends Node {
-    Parts: Node[];
-  }
-  export interface Assign extends Node {
-    Naked: boolean;
-    Name: Lit | null;
-    Value: Word | null;
-  }
-  export interface Redirect extends Node {
-    OpPos: Pos;
-    Word: Word;
-    Hdoc: Word | null;
-  }
-  export interface Stmt extends Node {
-    Cmd: Node | null;
-    Background: boolean;
-    Redirs: Redirect[];
-  }
-  export interface File extends Node {
-    Stmts: Stmt[];
-  }
-  export interface CallExpr extends Node {
-    Assigns: Assign[];
-    Args: Word[];
-  }
-  export interface DeclClause extends Node {
-    Variant: Lit;
-    Args: Assign[];
-  }
-  export interface BinaryCmd extends Node {
-    OpPos: Pos;
-    X: Stmt;
-    Y: Stmt;
-  }
-  export interface Subshell extends Node {
-    Stmts: Stmt[];
-  }
-  export interface IfClause extends Node {
-    Cond: Stmt[];
-    Then: Stmt[];
-    Else: IfClause | null;
-  }
-  export interface SglQuoted extends Node {
-    Dollar: boolean;
-    Value: string;
-  }
-  export interface DblQuoted extends Node {
-    Parts: Node[];
-  }
-  export interface ParamExp extends Node {
-    Excl: boolean;
-    Length: boolean;
-    Width: boolean;
-    Param: Lit;
-    Index: Node | null;
-    Slice: object | null;
-    Repl: object | null;
-    Exp: object | null;
-  }
-  export interface CmdSubst extends Node {
-    Stmts: Stmt[];
-  }
-
-  const sh: {
-    syntax: {
-      NewParser(...options: unknown[]): { Parse(source: string, name: string): File };
-      NodeType(node: Node): string;
-      Walk(node: Node, visit: (node: Node | null) => boolean): void;
-      KeepComments(keep: boolean): unknown;
-      Variant(language: unknown): unknown;
-      LangBash: unknown;
-    };
-  };
-  export default sh;
-}