@loophubs/agent-guard 0.1.0 → 0.3.0

package/src/frontend.ts

@@ -1,30 +1,51 @@
-// Parse shell structure into command records; rejected syntax remains
-// available to the signature rules.
+// Parse shell structure into command records. Failed syntax blocks the call;
+// interpreter code still reaches the signature rules.
+
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+import type { Assign, BinaryCmd, CallExpr, CmdSubst, DeclClause, FuncDecl, IfClause, Lit, Node, ParamExp, Redirect as RedirectNode, Stmt, Subshell, Word as WordNode } from "mvdan-sh";
 import sh from "mvdan-sh";
-import type { Assign, BinaryCmd, CallExpr, CmdSubst, DeclClause, IfClause, Lit, Node, ParamExp, Redirect as RedirectNode, Stmt, Subshell, Word as WordNode } from "mvdan-sh";
-import { resolve } from "node:path";
-import { resolveCommand, stdinKind } from "./argv.ts";
-import { misreadComment } from "./comments.ts";
-import { boundedDirectories } from "./cwd.ts";
-import { movedOnSuccess } from "./moves.ts";
-import { expandHome } from "./paths.ts";
-import { xargsReplacements } from "./pipeline.ts";
-import type { Command, Redirect, Script, Word } from "./record.ts";
-import { readWord } from "./words.ts";
+
+import { resolveCommand, stdinKind } from "./argv";
+import { misreadComment } from "./comments";
+import { boundedDirectories } from "./cwd";
+import { movedOnSuccess } from "./moves";
+import { expandHome } from "./paths";
+import { markWalkedInput, shellInput, xargsHereInput, xargsReplacements } from "./pipeline";
+import type { Command, Redirect, Script, Word } from "./record";
+import { readWord } from "./words";
 
 const { syntax } = sh;
+let packageDir = import.meta.dir;
+let parserPath = "";
+while (!parserPath) {
+  const candidate = join(packageDir, "node_modules/mvdan-sh/index.js");
+  if (existsSync(candidate)) parserPath = candidate;
+  else {
+    const parent = dirname(packageDir);
+    if (parent === packageDir) throw new Error("mvdan-sh dependency is missing");
+    packageDir = parent;
+  }
+}
+if (sh !== (await import(pathToFileURL(parserPath).href)).default) throw new Error("mvdan-sh resolved outside its dependency package");
 const parser = syntax.NewParser(syntax.KeepComments(true), syntax.Variant(syntax.LangBash));
 
 interface Scope {
-  readonly dir: { cwd: string; previous?: string; alternatives?: string[] }; // shared by the commands a cd in this scope moves
+  readonly dir: { cwd: string; alternatives?: string[] | undefined }; // shared by the commands a cd in this scope moves
   readonly vars: Map<string, string>;
   readonly slice: (start: number, end: number) => string;
 }
 
 const type = (node: Node) => syntax.NodeType(node);
 
+// A function call runs the body in the caller's shell; bound the work a chain of
+// calls can multiply.
+const maxFunctionRuns = 256;
+
 export function parseScript(source: string, cwd: string, home: string): Script {
-  const script: Script = { commands: [], uninspectable: [] };
+  const script: Script = { commands: [], uninspectable: [], parseFailed: false };
 
   function parse(src: string, cwd: string) {
     const bytes = Buffer.from(src);
@@ -35,14 +56,18 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       file = undefined;
     }
     if (!file || misreadComment(file, bytes)) {
-      script.uninspectable.push(src);
+      script.parseFailed = true;
       return;
     }
     const slice = (start: number, end: number) => bytes.subarray(start, end).toString();
     const scope: Scope = { dir: { cwd }, vars: new Map(), slice };
-    for (const stmt of file.Stmts) statement(stmt, scope);
+    for (const stmt of file.Stmts) statement(stmt!, scope);
   }
 
+  const functions = new Map<string, { body: Stmt; slice: Scope["slice"] }>();
+  const running = new Set<string>();
+  let functionRuns = 0;
+
   const text = (node: Node, scope: Scope) => scope.slice(node.Pos().Offset(), node.End().Offset());
   // A cd inside runs in a separate shell and leaves this scope's cwd alone.
   const isolated = (scope: Scope): Scope => ({ ...scope, dir: { ...scope.dir }, vars: new Map(scope.vars) });
@@ -59,7 +84,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     if (kind === "BinaryCmd") return binary(cmd as BinaryCmd, scope);
     if (kind === "Subshell") {
       const inner = isolated(scope);
-      for (const s of (cmd as Subshell).Stmts) statement(s, inner);
+      for (const s of (cmd as Subshell).Stmts) statement(s!, inner);
       return;
     }
     children(cmd, scope);
@@ -70,26 +95,36 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     const op = scope.slice(cmd.OpPos.Offset(), cmd.OpPos.Offset() + 2).trim();
     const failed = isolated(scope);
     const start = script.commands.length;
-    statement(cmd.X, op === "&&" || op === "||" ? scope : isolated(scope));
+    statement(cmd.X!, op === "&&" || op === "||" ? scope : isolated(scope));
     const middle = script.commands.length;
-    const directCd = op === "&&" && movedOnSuccess(cmd.X, scope.slice);
+    const directCd = op === "&&" && movedOnSuccess(cmd.X!, scope.slice);
     if (directCd) {
       const old = [failed.dir.cwd, ...(failed.dir.alternatives ?? [])];
       scope.dir.alternatives = scope.dir.alternatives?.filter((cwd) => !old.includes(cwd));
-      statement(cmd.Y, scope);
+      statement(cmd.Y!, scope);
       scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), ...old], home);
       return;
     }
-    statement(cmd.Y, op === "||" ? failed : op === "&&" ? scope : isolated(scope));
-    if (op === "|") for (const item of xargsReplacements(script.commands.slice(start, middle), script.commands.slice(middle))) parse(item.source, item.cwd);
-    if (op === "||") {
-      scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), failed.dir.cwd, ...(failed.dir.alternatives ?? [])], home);
+    // zsh runs the last element of a pipeline in this shell and bash forks it,
+    // so a cd there may or may not move the commands after it.
+    const right = op === "||" ? failed : op === "&&" ? scope : isolated(scope);
+    statement(cmd.Y!, right);
+    if (op === "|" || op === "|&") {
+      const left = script.commands.slice(start, middle);
+      const rest = script.commands.slice(middle);
+      markWalkedInput(left, rest);
+      for (const item of [...xargsReplacements(left, rest), ...shellInput(left, rest)]) parse(item.source, item.cwd);
     }
+    if (op !== "&&") scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), right.dir.cwd, ...(right.dir.alternatives ?? [])], home);
   }
 
   // Compound words may hold substitutions; branch bodies may not run.
   function children(node: Node, scope: Scope) {
-    if (type(node) === "FuncDecl") scope = isolated(scope);
+    if (type(node) === "FuncDecl") {
+      const func = node as FuncDecl;
+      if (func.Name && func.Body) functions.set(func.Name.Value, { body: func.Body, slice: scope.slice });
+      scope = isolated(scope);
+    }
     if (type(node) === "IfClause") return conditional(node as IfClause, scope);
     const outer = scope;
     const loop = type(node) === "WhileClause" || type(node) === "ForClause";
@@ -103,8 +138,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
         for (const cwd of [scope.dir.cwd, ...(scope.dir.alternatives ?? [])]) {
           script.commands.push({ argv: [value], redirects: [], cwd, program: -1, wrappers: [], shell: true, flags: new Set() });
         }
-      }
-      else return true;
+      } else return true;
       return false;
     });
     if (loop) outer.dir.alternatives = boundedDirectories(outer.dir.cwd, [...(outer.dir.alternatives ?? []), scope.dir.cwd, ...(scope.dir.alternatives ?? [])], home);
@@ -112,32 +146,36 @@ export function parseScript(source: string, cwd: string, home: string): Script {
 
   function conditional(node: IfClause, scope: Scope) {
     const condition = isolated(scope);
-    for (const stmt of node.Cond) statement(stmt, condition);
+    for (const stmt of node.Cond) statement(stmt!, condition);
     const then = isolated(condition);
-    for (const stmt of node.Then) statement(stmt, then);
+    for (const stmt of node.Then) statement(stmt!, then);
     const branches = [scope, condition, then];
     if (node.Else) {
       const otherwise = isolated(condition);
       conditional(node.Else, otherwise);
       branches.push(otherwise);
     }
-    scope.dir.alternatives = boundedDirectories(scope.dir.cwd, branches.flatMap((branch) => [branch.dir.cwd, ...(branch.dir.alternatives ?? [])]), home);
+    scope.dir.alternatives = boundedDirectories(
+      scope.dir.cwd,
+      branches.flatMap((branch) => [branch.dir.cwd, ...(branch.dir.alternatives ?? [])]),
+      home,
+    );
   }
 
   function expansions(node: Node, scope: Scope, vars: string[]) {
     syntax.Walk(node, (child) => {
       if (!child) return true;
       const kind = type(child);
-      if (kind === "ParamExp") vars.push((child as ParamExp).Param.Value);
+      if (kind === "ParamExp") vars.push((child as ParamExp).Param!.Value);
       if (kind !== "CmdSubst" && kind !== "ProcSubst") return true;
       const inner = isolated(scope);
-      for (const s of (child as CmdSubst).Stmts) statement(s, inner);
+      for (const s of (child as CmdSubst).Stmts) statement(s!, inner);
       return false;
     });
   }
 
   function word(node: WordNode, scope: Scope): Word {
-    return readWord(node, scope.slice, scope.vars, home, (part, names) => expansions(part, scope, names));
+    return readWord(node, scope.slice, scope.vars, home, scope.dir.cwd, (part, names) => expansions(part, scope, names));
   }
 
   function assign(node: Assign, scope: Scope, role: "assign" | "arg"): Word {
@@ -151,7 +189,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       return type(child) !== "Word";
     });
     return {
-      ...(value ?? { expands: false, globs: false, vars: [] }),
+      ...(value ?? { expands: false, globs: false, vars: [], pwd: false }),
       text: `${name}=${value?.text ?? ""}`,
       raw: text(node, scope),
       role,
@@ -160,23 +198,23 @@ export function parseScript(source: string, cwd: string, home: string): Script {
   }
 
   function literal(value: string): Word {
-    return { text: value, raw: value, expands: false, globs: false, vars: [], role: "arg", value };
+    return { text: value, raw: value, expands: false, globs: false, vars: [], role: "arg", value, pwd: false };
   }
 
-  function simple(cmd: Node | null, redirs: RedirectNode[], scope: Scope) {
+  function simple(cmd: Node | null, redirs: (RedirectNode | null)[], scope: Scope) {
     const argv: Word[] = [];
     if (cmd && type(cmd) === "CallExpr") {
-      for (const a of (cmd as CallExpr).Assigns) argv.push(assign(a, scope, "assign"));
-      for (const w of (cmd as CallExpr).Args) argv.push(word(w, scope));
+      for (const a of (cmd as CallExpr).Assigns) argv.push(assign(a!, scope, "assign"));
+      for (const w of (cmd as CallExpr).Args) argv.push(word(w!, scope));
     } else if (cmd) {
       const decl = cmd as DeclClause;
-      argv.push(literal(decl.Variant.Value));
+      argv.push(literal(decl.Variant!.Value));
       for (const a of decl.Args) {
-        if (!a.Naked) argv.push(assign(a, scope, "arg"));
-        else argv.push(a.Value ? word(a.Value, scope) : literal(a.Name?.Value ?? ""));
+        if (!a!.Naked) argv.push(assign(a!, scope, "arg"));
+        else argv.push(a!.Value ? word(a!.Value, scope) : literal(a!.Name?.Value ?? ""));
       }
     }
-    const redirects = redirs.map((r) => redirect(r, scope)).filter((r) => r !== undefined);
+    const redirects = redirs.map((r) => redirect(r!, scope)).filter((r) => r !== undefined);
     const command: Command = {
       argv,
       redirects,
@@ -188,7 +226,8 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     };
     script.commands.push(command);
     const { children: sources, code } = resolveCommand(command, home);
-    for (const cwd of scope.dir.alternatives ?? []) script.commands.push({ ...command, cwd });
+    const moved = (cwd: string) => command.argv.map((w) => (w.pwd ? { ...w, text: w.text.replaceAll(scope.dir.cwd, cwd), value: w.value.replaceAll(scope.dir.cwd, cwd) } : w));
+    for (const cwd of scope.dir.alternatives ?? []) script.commands.push({ ...command, cwd, argv: moved(cwd) });
     for (const src of sources) for (const cwd of [command.cwd, ...(scope.dir.alternatives ?? [])]) parse(src, cwd);
     script.uninspectable.push(...code);
     for (const r of redirects) {
@@ -196,23 +235,34 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       const stdin = stdinKind(command);
       if (stdin === "shell") parse(r.target, command.cwd);
       if (stdin === "code") script.uninspectable.push(r.target);
+      if (command.wrappers.includes("xargs")) for (const item of xargsHereInput(command, r.target)) parse(item.source, item.cwd);
+    }
+    const called = command.wrappers.every((w) => w === "time") ? command.argv[command.program]?.text : undefined;
+    const func = called === undefined ? undefined : functions.get(called);
+    if (func && !running.has(called!)) {
+      if (++functionRuns > maxFunctionRuns) script.parseFailed = true;
+      else {
+        running.add(called!);
+        statement(func.body, { ...scope, slice: func.slice });
+        running.delete(called!);
+      }
     }
     track(command, scope);
   }
 
   function redirect(node: RedirectNode, scope: Scope): Redirect | undefined {
-    const op = scope.slice(node.OpPos.Offset(), node.Word.Pos().Offset()).trim();
+    const op = scope.slice(node.OpPos.Offset(), node.Word!.Pos().Offset()).trim();
     if (op === "<<" || op === "<<-") {
-      const quoted = node.Word.Parts.some((p) => type(p) !== "Lit" || (p as Lit).Value.includes("\\"));
+      const quoted = node.Word!.Parts.some((p) => type(p) !== "Lit" || (p as Lit).Value.includes("\\"));
       const vars: string[] = [];
       if (node.Hdoc && !quoted) expansions(node.Hdoc, scope, vars);
-      return { direction: "heredoc", target: node.Hdoc ? text(node.Hdoc, scope) : "", vars };
+      return { direction: "heredoc", target: node.Hdoc ? text(node.Hdoc, scope) : "", globs: false, vars };
     }
-    const target = word(node.Word, scope);
-    if (op === "<<<") return { direction: "herestring", target: target.text, vars: target.vars };
+    const target = word(node.Word!, scope);
+    if (op === "<<<") return { direction: "herestring", target: target.text, globs: false, vars: target.vars };
     if ((op === "<&" || op === ">&") && /^(\d+|-)$/.test(target.text)) return undefined;
     const direction = op === "<" || op === "<>" ? "in" : "out";
-    return { direction, target: target.text, vars: [] };
+    return { direction, target: target.text, globs: target.globs, vars: [] };
   }
 
   function track(command: Command, scope: Scope) {
@@ -223,14 +273,15 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       if (!word.expands) scope.vars.set(word.text.slice(0, at), expandHome(word.text.slice(at + 1), home));
     }
     if (!program || !command.shell || !["cd", "pushd"].includes(program.text)) return;
-    let target = command.argv.slice(command.program + 1).find((w) => !w.text.startsWith("-"))?.text;
-    const previous = command.argv.slice(command.program + 1).some((w) => w.text === "-");
-    if (previous) target = scope.dir.previous;
-    if (previous && target === undefined) return;
-    if (target === undefined && program.text === "cd") target = home;
+    const args = command.argv.slice(command.program + 1);
+    let target = args.find((w) => !w.text.startsWith("-"))?.text;
+    if (target === undefined && args.every((w) => /^(--|-[PLqs]+)$/.test(w.text)) && program.text === "cd") target = home;
     if (target !== undefined) {
-      scope.dir.alternatives = boundedDirectories(resolve(scope.dir.cwd, target), [scope.dir.cwd, ...(scope.dir.alternatives ?? []), ...(scope.dir.alternatives ?? []).map((cwd) => resolve(cwd, target))], home);
-      scope.dir.previous = scope.dir.cwd;
+      scope.dir.alternatives = boundedDirectories(
+        resolve(scope.dir.cwd, target),
+        [scope.dir.cwd, ...(scope.dir.alternatives ?? []), ...(scope.dir.alternatives ?? []).map((cwd) => resolve(cwd, target))],
+        home,
+      );
       scope.dir.cwd = resolve(scope.dir.cwd, target);
     }
   }

package/src/guard.ts

@@ -6,31 +6,47 @@
 // objection and exit 2 denies with the reason on stderr. The wrapper turns
 // every other outcome into a denial.
 import { homedir } from "node:os";
-import { buildRequest, evaluate, suggestions } from "./core.ts";
-import type { Runtime, Tool } from "./record.ts";
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
 
-const [flag, runtime, cwdFlag, hookCwd] = process.argv.slice(2) as [string, Runtime, string, string];
-if (flag !== "--runtime" || !["claude", "codex", "pi"].includes(runtime) || cwdFlag !== "--cwd" || !hookCwd) {
-  console.error("usage: agent-guard --runtime claude|codex|pi < event.json");
+import { buildRequest, evaluate, suggestions } from "./core";
+import type { Runtime, Tool } from "./record";
+
+const usage = "usage: agent-guard --runtime claude|codex|pi < event.json";
+let flags: { runtime?: string; cwd?: string };
+try {
+  flags = parseArgs({ options: { runtime: { type: "string" }, cwd: { type: "string" } } as const }).values;
+} catch {
+  console.error(usage);
+  process.exit(2);
+}
+const runtime = flags.runtime as Runtime | undefined;
+const hookCwd = flags.cwd;
+if (!runtime || !["claude", "codex", "pi"].includes(runtime) || !hookCwd) {
+  console.error(usage);
   process.exit(2);
 }
 
-// A missing tool_input throws, which the wrapper turns into a denial. A
-// tool_input without the field a tool needs names nothing to check and passes.
+// A missing tool_input, or a known tool whose field is not a string, throws,
+// which the wrapper turns into a denial: a runtime that renames or retypes a
+// field must not silently stop being guarded. Tools the guard does not know pass.
 const event: { tool_name?: unknown; cwd?: unknown; tool_input: Record<string, unknown> } = JSON.parse(await Bun.stdin.text());
 const input = event.tool_input;
 const string = (value: unknown) => (typeof value === "string" ? value : undefined);
-const cwd = string(event.cwd) ?? string(input.cwd) ?? hookCwd;
+const cwd = string(event.cwd) ?? string(input["cwd"]) ?? hookCwd;
 
-const tools: Record<string, [Tool, string | undefined]> = {
-  bash: ["bash", string(input.command)],
-  read: ["read", string(input.file_path)],
-  edit: ["edit", string(input.file_path)],
-  write: ["write", string(input.file_path)],
-  grep: ["grep", string(input.path) ?? ""],
+const fields: Record<string, [Tool, string]> = {
+  bash: ["bash", "command"],
+  read: ["read", "file_path"],
+  edit: ["edit", "file_path"],
+  write: ["write", "file_path"],
+  grep: ["grep", "path"],
 };
-const [tool, value] = tools[(string(event.tool_name) ?? "Bash").toLowerCase()] ?? [];
-const request = tool && value !== undefined ? buildRequest(runtime, tool, cwd, value, string(input.glob) ?? "", homedir()) : undefined;
+const [tool, field] = fields[(string(event.tool_name) ?? "Bash").toLowerCase()] ?? [];
+// Grep searches the working directory when it names no path.
+const value = field && (tool === "grep" && input[field] === undefined ? "" : string(input[field]));
+if (field && value === undefined) throw new Error(`tool_input.${field} is not a string`);
+const request = tool && value !== undefined ? buildRequest(runtime, tool, cwd, value, string(input["glob"]) ?? "", resolve(homedir())) : undefined;
 const reason = request && evaluate(request);
 if (reason) {
   console.error(runtime === "claude" ? `DENIED: ${reason} Do NOT bypass this restriction or retry the same blocked command.` : reason);

package/src/links.ts

@@ -1,8 +1,10 @@
 import { readlinkSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
-import { expandHome, isAppdata, isSensitive } from "./paths.ts";
-import type { Request, Word } from "./record.ts";
-import { dataPrograms } from "./rules/appdata.ts";
+
+import { programName } from "./argv";
+import { absPath, expandHome, isAppdata, isSensitive } from "./paths";
+import type { Request, Word } from "./record";
+import { dataPrograms } from "./rules/appdata";
 
 export function linkedRequest(req: Request): Request | undefined {
   let changed = false;
@@ -15,7 +17,8 @@ export function linkedRequest(req: Request): Request | undefined {
     let followed = false;
     let depth = 0;
     while (parts.length) {
-      path = resolve(path, parts.shift()!);
+      const part = parts.shift()!;
+      path = part === ".." ? dirname(path) : resolve(path, part);
       // Do not ask the filesystem about a path inside a protected tree.
       if (protectedPath(path)) {
         changed = true;
@@ -28,13 +31,10 @@ export function linkedRequest(req: Request): Request | undefined {
         continue;
       }
       if (++depth > 8) throw new Error("Symlink chain exceeds the agent guard limit");
-      const targetPath = resolve(dirname(path), target);
+      const targetPath = target.startsWith("/") ? target : `${dirname(path)}/${target}`;
       followed = true;
       changed = true;
-      if (protectedPath(targetPath)) return targetPath;
-      const next = resolve(targetPath, ...parts);
-      if (protectedPath(next)) return next;
-      parts = next.split("/").filter(Boolean);
+      parts = [...targetPath.split("/").filter(Boolean), ...parts];
       path = "/";
     }
     return followed ? path : value;
@@ -43,17 +43,35 @@ export function linkedRequest(req: Request): Request | undefined {
     if (w.expands || w.globs || !w.value || w.value.startsWith("-")) return w;
     if (w.role === "program" && !w.value.includes("/")) return w;
     if (!["arg", "path", "patfile", "option:patfile", "program"].includes(w.role)) return w;
-    const value = linked(w.value, cwd, /^[\'"]/.test(w.raw));
+    const value = linked(w.value, cwd, /^['"]/.test(w.raw));
     return value === w.value ? w : { ...w, value, text: w.role.startsWith("option:") ? w.text : value };
   };
-  const commands = req.commands.map((cmd) => ({
-    ...cmd,
-    argv: cmd.argv.map((w, i) =>
-      dataPrograms.has(basename(cmd.argv[cmd.program]?.text ?? "")) && i > cmd.program ? w : word(w, cmd.cwd)),
-    redirects: cmd.redirects.map((r) =>
-      (r.direction === "in" || r.direction === "out") && r.target ? { ...r, target: linked(r.target, cmd.cwd) } : r),
-  }));
-  const target = req.target ? linked(req.target, req.cwd) : req.target;
-  const searchRoot = req.searchRoot ? linked(req.searchRoot, req.cwd) : req.searchRoot;
-  return changed ? { ...req, target, searchRoot, commands } : undefined;
+  // curl reads the file after @ or < in a data or form value, or one glued to -T, -K, --upload-file or --config.
+  const curlOperand = /^((?:-[A-Za-z]|--[a-z-]+=|[^=@<-][^=@<]*=)?[@<])([^;]+)(.*)$/s;
+  const curlFile = /^(-[TK]|--(?:upload-file|config)=)([^;]+)()$/s;
+  const curlWord = (w: Word, cwd: string): Word | undefined => {
+    const operand = curlOperand.exec(w.text) ?? curlFile.exec(w.text);
+    if (!operand || w.expands) return undefined;
+    const value = linked(operand[2]!, cwd);
+    return value === operand[2] ? w : { ...w, text: `${operand[1]}${value}${operand[3]}` };
+  };
+  const commands = req.commands.map((cmd) => {
+    const curl = cmd.program >= 0 && programName(cmd.argv[cmd.program]!.text) === "curl";
+    const checkedCwd = linked(cmd.cwd, "/");
+    const cwd = checkedCwd === cmd.cwd ? absPath(cmd.cwd, "/", req.home) : checkedCwd;
+    if (cwd !== cmd.cwd) changed = true;
+    return {
+      ...cmd,
+      cwd,
+      argv: cmd.argv.map((w, i) =>
+        dataPrograms.has(basename(cmd.argv[cmd.program]?.text ?? "")) && i > cmd.program ? w : curl && i > cmd.program ? (curlWord(w, cmd.cwd) ?? word(w, cmd.cwd)) : word(w, cmd.cwd),
+      ),
+      redirects: cmd.redirects.map((r) => ((r.direction === "in" || r.direction === "out") && r.target ? { ...r, target: linked(r.target, cmd.cwd) } : r)),
+    };
+  });
+  const checkedCwd = linked(req.inputCwd, "/");
+  const cwd = checkedCwd === req.inputCwd ? req.cwd : checkedCwd;
+  const target = req.target ? linked(req.pathInput, req.inputCwd) : req.target;
+  const searchRoot = req.searchRoot ? linked(req.pathInput || req.inputCwd, req.inputCwd) : req.searchRoot;
+  return changed ? { ...req, cwd, target, searchRoot, commands } : undefined;
 }

package/src/moves.ts

@@ -1,5 +1,5 @@
-import sh from "mvdan-sh";
 import type { BinaryCmd, CallExpr, Lit, Stmt } from "mvdan-sh";
+import sh from "mvdan-sh";
 
 // Discard the prior cwd only when every move in an && chain has a literal destination.
 export function movedOnSuccess(stmt: Stmt, slice: (start: number, end: number) => string): boolean {
@@ -20,8 +20,8 @@ export function movedOnSuccess(stmt: Stmt, slice: (start: number, end: number) =
     if (type(node) !== "BinaryCmd") return "uncertain";
     const chain = node as BinaryCmd;
     if (slice(chain.OpPos.Offset(), chain.OpPos.Offset() + 2) !== "&&") return "uncertain";
-    const left = state(chain.X);
-    const right = state(chain.Y);
+    const left = state(chain.X!);
+    const right = state(chain.Y!);
     return left === "uncertain" || right === "uncertain" ? "uncertain" : left === "moved" || right === "moved" ? "moved" : "unchanged";
   };
   return state(stmt) === "moved";