@loophubs/agent-guard 0.1.0 → 0.3.0

package/src/paths.ts

@@ -1,5 +1,5 @@
 // Filesystem checks run after lexical denials to avoid touching protected trees.
-import { statSync, realpathSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import { userInfo } from "node:os";
 import { basename, dirname, resolve } from "node:path";
 
@@ -7,15 +7,40 @@ export const appdataTrees = ["Containers", "Group Containers", "Mobile Documents
 
 // The one list of credential-bearing paths, matched against absolute paths.
 export const sensitivePaths = [
-  "**/.env", "**/.env.local*", "**/.env.*.local",
-  "**/.env.production", "**/.env.staging", "**/.env.development",
-  "**/.npmrc", "**/.zprofile*", "**/.zsh_history*", "**/*.pem", "**/*.key",
-  "**/auth.json*", "**/.credentials.json*", "**/.aws/credentials*",
-  "**/private-keys-v1.d", "**/private-keys-v1.d/**",
+  "**/.env",
+  "**/.env.*",
+  "**/.npmrc",
+  "**/.zprofile*",
+  "**/.zsh_history*",
+  "**/*.pem",
+  "**/*.key",
+  "**/auth.json*",
+  "**/.credentials.json*",
+  "**/.aws/credentials*",
+  "**/.netrc",
+  "**/.git-credentials",
+  "**/.docker/config.json",
+  "**/.kube/config",
+  "**/.pypirc",
+  "**/.pgpass",
+  "**/.cargo/credentials*",
+  "**/.config/gh/hosts.yml",
+  "**/private-keys-v1.d",
+  "**/private-keys-v1.d/**",
 ];
 
 const sensitiveGlobs = sensitivePaths.map((path) => new Bun.Glob(path));
 
+// Directories that hold listed files, so a search rooted at one reads them.
+// ~/.ssh has its own inode-based check and reason.
+const credentialRoots = [".aws", ".gnupg"];
+const credentialDirectories = [".ssh", ...credentialRoots];
+// The directory part of each listed file that sits in a named directory, such as .kube for .kube/config.
+const listedDirectories = sensitivePaths.flatMap((listed) => {
+  const tail = listed.replace(/^\*\*\//, "").split("/");
+  return tail.length > 1 && !tail.slice(0, -1).some((part) => part.includes("*")) ? [tail.slice(0, -1).join("/")] : [];
+});
+
 export function expandHome(path: string, home: string): string {
   for (const prefix of ["~", `~${userInfo().username}`]) {
     if (path === prefix || path.startsWith(`${prefix}/`)) return home + path.slice(prefix.length);
@@ -23,22 +48,34 @@ export function expandHome(path: string, home: string): string {
   return path;
 }
 
+// curl, open and git read a file:// URL as the path it names.
 export function absPath(path: string, cwd: string, home: string, quoted = false): string {
   if (!quoted) path = expandHome(path, home);
-  return resolve(cwd, path);
+  return resolve(cwd, path.replace(/^file:\/\//i, ""));
+}
+
+// Whether the shell could expand the glob's leading segments to `directory`, so
+// `~/Lib*/Cont*/x` reads inside `~/Library/Containers`. A pattern that stops at
+// the directory only names it and is left to the callers' other checks.
+function globReaches(path: string, directory: string): boolean {
+  const pattern = path.split("/");
+  const target = directory.split("/");
+  if (pattern.length <= target.length) return false;
+  return target.every((segment, i) => i === 0 || pattern[i] === "**" || new Bun.Glob(pattern[i]!.toLowerCase()).match(segment.toLowerCase()));
 }
 
 export function isAppdata(path: string, home: string, glob = false): boolean {
   if (glob) {
     const expanded = Bun.$.braces(path);
     if (expanded.length > 1) return expanded.some((each) => isAppdata(each, home, true));
+    if (appdataTrees.some((tree) => globReaches(path, `${home}/Library/${tree}`))) return true;
   }
   const library = `${home}/Library/`.toLowerCase();
   if (!path.toLowerCase().startsWith(library)) return false;
   const rest = path.slice(library.length).toLowerCase();
   if (appdataTrees.some((tree) => rest === tree.toLowerCase() || rest.startsWith(`${tree.toLowerCase()}/`))) return true;
   if (!glob) return false;
-  const fixed = rest.split(/[*?[]/)[0].replace(/\/$/, "");
+  const fixed = rest.split(/[*?[]/)[0]!.replace(/\/$/, "");
   return fixed !== "" && appdataTrees.some((tree) => tree.toLowerCase().startsWith(fixed));
 }
 
@@ -54,12 +91,12 @@ export function isBroad(path: string, home: string, glob = false): boolean {
   if (trimmed === home || trimmed === `${home}/library` || home.startsWith(`${trimmed}/`)) return true;
   if (!glob) return false;
   const pattern = new Bun.Glob(path);
-  if ([home, `${home}/library`, ...appdataTrees.flatMap((tree) => [`${home}/library/${tree.toLowerCase()}`, `${home}/library/${tree.toLowerCase()}/x`])].some((candidate) => pattern.match(candidate))) return true;
-  const prefix = path.split(/[*?[]/, 1)[0].replace(/\/$/, "");
+  if ([home, `${home}/library`, ...appdataTrees.flatMap((tree) => [`${home}/library/${tree.toLowerCase()}`, `${home}/library/${tree.toLowerCase()}/x`])].some((candidate) => pattern.match(candidate)))
+    return true;
+  const prefix = path.split(/[*?[]/, 1)[0]!.replace(/\/$/, "");
   return path.includes("**") && (prefix === home || prefix === `${home}/library` || home.startsWith(`${prefix}/`));
 }
 
-// ~/.ignore keeps rg and fd out of ~/Library only when they start above it.
 export function isLibrary(path: string, home: string): boolean {
   return path.toLowerCase() === `${home}/library`.toLowerCase() || isAppdata(path, home);
 }
@@ -77,20 +114,103 @@ export function sshPrivate(path: string): boolean {
 
 // A credential-bearing absolute path, after brace expansion. For an unquoted
 // glob, a pattern counts when it could match a listed name; a bare wildcard
-// does not.
+// does not, unless it sits in a credential directory. Names match regardless of
+// case because the default APFS volume ignores it.
 export function isSensitive(path: string, glob = false): boolean {
   const expanded = Bun.$.braces(path);
   if (expanded.length > 1) return expanded.some((each) => isSensitive(each, glob));
-  if (sshPrivate(path) || sensitiveGlobs.some((listed) => listed.match(path))) return true;
-  const base = basename(path);
-  if (!glob || /^[*?]*$/.test(base)) return false;
-  const pattern = new Bun.Glob(base);
+  const lower = path.toLowerCase();
+  if ([".env.example", ".env.age"].includes(basename(lower))) return false;
+  if (sshPrivate(path) || sensitiveGlobs.some((listed) => listed.match(lower))) return true;
+  if (!glob) return false;
+  if (globDirectory(path)) return true;
+  const base = basename(lower);
+  // A bare wildcard reaches every file in the directory, so a directory that holds a listed file counts.
+  if (/^[*?]*$/.test(base)) return credentialDirectories.includes(basename(dirname(lower))) || listedDirectories.some((dir) => dirname(lower).endsWith(`/${dir}`));
+  // A listed file inside a named directory needs the glob's directory to match too.
+  const segments = lower.split("/");
   return sensitivePaths.some((listed) => {
-    const name = basename(listed).replaceAll("*", "x");
-    return !/^x*$/.test(name) && pattern.match(name);
+    const tail = listed.replace(/^\*\*\//, "").split("/");
+    if (tail.length > segments.length) return false;
+    if (/^\**$/.test(tail.at(-1)!)) return false;
+    const names = tail.map((part) => part.replaceAll("*", "x"));
+    const offset = segments.length - tail.length;
+    if (!names.slice(0, -1).every((name, i) => new Bun.Glob(segments[offset + i]!).match(name))) return false;
+    // A named directory already narrows the match, so a glob that could reach any listed name in it counts.
+    return tail.length > 1 ? globsIntersect(segments.at(-1)!, tail.at(-1)!) : new Bun.Glob(segments.at(-1)!).match(names.at(-1)!);
+  });
+}
+
+type GlobToken = "*" | ((char: string) => boolean);
+
+// Reads `*`, `?`, `[set]` and literal characters; a backslash escapes the next one.
+function globTokens(glob: string): GlobToken[] {
+  const tokens: GlobToken[] = [];
+  for (let i = 0; i < glob.length; i++) {
+    const char = glob[i]!;
+    const close = char === "[" ? glob.indexOf("]", i + 2) : -1;
+    if (char === "*") tokens.push("*");
+    else if (char === "?") tokens.push(() => true);
+    else if (close > 0) {
+      const matcher = new Bun.Glob(glob.slice(i, close + 1));
+      tokens.push((c) => matcher.match(c));
+      i = close;
+    } else {
+      const literal = char === "\\" ? (glob[++i] ?? char) : char;
+      tokens.push((c) => c === literal);
+    }
+  }
+  return tokens;
+}
+
+// Whether some file name matches both wildcard patterns.
+function globsIntersect(a: string, b: string): boolean {
+  const [left, right] = [globTokens(a), globTokens(b)];
+  const probes = Array.from({ length: 94 }, (_, i) => String.fromCharCode(33 + i));
+  const seen = new Set<string>();
+  const walk = (i: number, j: number): boolean => {
+    const key = `${i},${j}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    const [x, y] = [left[i], right[j]];
+    if (x === undefined && y === undefined) return true;
+    if (x === "*" && walk(i + 1, j)) return true;
+    if (y === "*" && walk(i, j + 1)) return true;
+    if (x === "*" && y === "*") return false;
+    if (x === "*") return y !== undefined && walk(i, j + 1);
+    if (y === "*") return x !== undefined && walk(i + 1, j);
+    if (x === undefined || y === undefined) return false;
+    return probes.some((c) => x(c) && y(c)) && walk(i + 1, j + 1);
+  };
+  return walk(0, 0);
+}
+
+// A wildcard directory segment such as `.s*` may expand to a credential
+// directory. The shell's wildcards skip a leading dot, so only a segment that
+// starts with one counts.
+function globDirectory(path: string): boolean {
+  const segments = path.split("/");
+  return segments.slice(0, -1).some((segment, i) => {
+    if (!segment.startsWith(".") || !/[*?[]/.test(segment)) return false;
+    const pattern = new Bun.Glob(segment.toLowerCase());
+    return credentialDirectories.some((dir) => pattern.match(dir) && isSensitive([...segments.slice(0, i), dir, ...segments.slice(i + 1)].join("/"), true));
   });
 }
 
+// A search reads everything under its root, so a credential directory counts as
+// its listed files do.
+export function isSensitiveRoot(path: string, home: string): boolean {
+  const lower = path.toLowerCase();
+  // A search from the home directory's .config reaches .config/gh because gh is not hidden.
+  const ancestors = listedDirectories.flatMap((dir) =>
+    dir
+      .split("/")
+      .slice(0, -1)
+      .map((_, i, parts) => `${home.toLowerCase()}/${parts.slice(0, i + 1).join("/")}`),
+  );
+  return isSensitive(path) || credentialRoots.includes(basename(lower)) || listedDirectories.some((dir) => lower.endsWith(`/${dir}`)) || ancestors.includes(lower);
+}
+
 // A path that does not exist or cannot be searched has no inode to compare.
 function stat(path: string) {
   try {
@@ -131,12 +251,12 @@ export function sshScopeDenied(target: string, home: string, search: boolean): b
     for (const root of roots) {
       if (sameFile(candidate, root)) return true;
       if (search) {
-        for (let parent = root; parent !== "/"; ) {
+        for (let parent = root; parent !== "/";) {
           parent = dirname(parent);
           if (sameFile(candidate, parent)) return true;
         }
       }
-      for (let parent = candidate; parent !== "/"; ) {
+      for (let parent = candidate; parent !== "/";) {
         parent = dirname(parent);
         if (!sameFile(parent, root)) continue;
         if (parent !== dirname(candidate) || !sshPublic(basename(candidate))) return true;

package/src/pipeline.ts

@@ -1,26 +1,138 @@
 import { basename } from "node:path";
-import type { Command } from "./record.ts";
 
-// A literal printf value is known before xargs substitutes it into a command.
-export function xargsReplacements(left: Command[], right: Command[]): { source: string; cwd: string }[] {
-  const printf = left.find((cmd) => cmd.program >= 0 && basename(cmd.argv[cmd.program].text) === "printf");
-  const xargs = right.find((cmd) => cmd.program >= 0 && cmd.wrappers.includes("xargs"));
-  if (!printf || !xargs) return [];
-  const args = printf.argv.slice(printf.program + 1);
-  if (args.length !== 2 || !/^%s(?:\\n)?$/.test(args[0].text)) return [];
+import { stdinKind } from "./argv";
+import type { Command, Word } from "./record";
+
+// fd and ls skip hidden files unless asked; find never does.
+export function showsHidden(words: Word[]): boolean {
+  return words.some((word) => /^(--hidden|--unrestricted)$/.test(word.text) || /^-[A-Za-z]*[Hu][A-Za-z]*$/.test(word.text));
+}
+
+// A dotfile name, or a glob the shell expands to dotfiles; `.` and `..` are directories.
+const hiddenName = (text: string) => /^\.(?!\.?$)/.test(basename(text));
+
+// xargs passes the names a walk printed to its command, so mark that command.
+export function markWalkedInput(left: Command[], right: Command[]) {
+  const walks = left.some((cmd) => {
+    const name = cmd.program >= 0 ? basename(cmd.argv[cmd.program]!.text) : "";
+    const args = cmd.argv.slice(cmd.program + 1);
+    const operands = args.filter((word) => !word.text.startsWith("-"));
+    if (name === "ls") return args.some((word) => /^(--all|--almost-all|-[A-Za-z0-9]*[aA][A-Za-z0-9]*)$/.test(word.text)) || operands.some((word) => hiddenName(word.text));
+    if (name === "echo" || name === "printf") return operands.some((word) => word.globs && hiddenName(word.text));
+    return name === "find" || (name === "fd" && showsHidden(args));
+  });
+  if (walks) for (const cmd of right) if (cmd.wrappers.includes("xargs")) cmd.flags.add("walked");
+}
+
+// printf and zsh's echo decode these escapes and stop at `\c`; a NUL separates xargs -0 items, so it reads as a line break.
+// A printf format takes up to three octal digits after the backslash; %b and echo take a leading 0 as well.
+const escapes: Record<string, string> = { n: "\n", t: "\t", "\\": "\\" };
+const unescape = (text: string, operand = false) =>
+  text
+    .split("\\c", 1)[0]!
+    .replace(
+      new RegExp(`\\\\(?:x([0-9a-fA-F]{1,2})|(${operand ? "0[0-7]{0,3}|[1-7][0-7]{0,2}" : "[0-7]{1,3}"})|([nt\\\\])|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8}))`, "g"),
+      (_, hex?: string, octal?: string, named?: string, unicode?: string, wide?: string) => {
+        const hexadecimal = hex ?? unicode ?? wide;
+        const code = hexadecimal !== undefined ? parseInt(hexadecimal, 16) : octal !== undefined ? parseInt(octal, 8) : undefined;
+        return code === undefined ? escapes[named!]! : code === 0 ? "\n" : String.fromCharCode(code);
+      },
+    );
+
+// What printf writes for a format built from literal text, %s, %b and %%; another conversion is unknown.
+function printfOutput(args: Word[]): string | undefined {
+  const [format, ...operands] = (args[0]?.text === "--" ? args.slice(1) : args).map((word) => word.text);
+  if (format === undefined) return "";
+  const pieces = format.split(/(%[sb%])/);
+  if (pieces.some((piece) => piece.includes("%") && !/^%[sb%]$/.test(piece))) return undefined;
+  const converts = pieces.some((piece) => /^%[sb]$/.test(piece));
+  let out = "";
+  do {
+    for (const piece of pieces) {
+      if (piece === "%%") out += "%";
+      else if (piece === "%s") out += operands.shift() ?? "";
+      else if (piece === "%b") out += unescape(operands.shift() ?? "", true);
+      else out += unescape(piece);
+    }
+  } while (converts && operands.length);
+  return out;
+}
+
+// A literal echo or printf value piped into a shell is the command line it runs.
+export function shellInput(left: Command[], right: Command[]): { source: string; cwd: string }[] {
+  const producer = left.find((cmd) => cmd.program >= 0 && ["printf", "echo"].includes(basename(cmd.argv[cmd.program]!.text)));
+  const shell = right.find((cmd) => cmd.program >= 0 && stdinKind(cmd) === "shell");
+  if (!producer || !shell) return [];
+  const args = producer.argv.slice(producer.program + 1);
+  const source =
+    basename(producer.argv[producer.program]!.text) === "printf"
+      ? printfOutput(args)
+      : unescape(
+          args
+            .filter((word) => !word.text.startsWith("-"))
+            .map((word) => word.text)
+            .join(" "),
+          true,
+        );
+  return source === undefined ? [] : [{ source, cwd: shell.cwd }];
+}
 
+// xargs runs its command once with every item, or once per item with -I.
+function xargsCommands(xargs: Command, items: string[]): { source: string; cwd: string }[] {
   const options = xargs.argv.slice(0, xargs.program);
   let marker = "";
   for (let i = 0; i < options.length; i++) {
-    const option = options[i].text;
+    const option = options[i]!.text;
     if (option === "-I" || option === "--replace") marker = options[i + 1]?.text ?? "";
     else if (option.startsWith("-I")) marker = option.slice(2);
     else if (option.startsWith("--replace=")) marker = option.slice("--replace=".length);
   }
-  if (!marker) return [];
+  // xargs strips quotes and backslashes from what it reads, with or without -I.
+  const stripped = (value: string) => value.replace(/["'\\]/g, "");
   const quote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
-  const source = xargs.argv.slice(xargs.program).map((word) =>
-    word.text.includes(marker) ? quote(word.text.replaceAll(marker, args[1].text)) : word.raw,
-  ).join(" ");
-  return [{ source, cwd: xargs.cwd }];
+  const command = xargs.argv.slice(xargs.program);
+  // Without -I, xargs splits its input on blanks, so a printed line can become several arguments.
+  if (!marker)
+    return [
+      {
+        source: [
+          ...command.map((word) => word.raw),
+          ...items
+            .flatMap((item) => item.split(/\s+/))
+            .filter(Boolean)
+            .flatMap((item) => [item, stripped(item)])
+            .map(quote),
+        ].join(" "),
+        cwd: xargs.cwd,
+      },
+    ];
+  return items
+    .flatMap((line) => [line, stripped(line)])
+    .map((item) => ({ source: command.map((word) => (word.text.includes(marker) ? quote(word.text.replaceAll(marker, item)) : word.raw)).join(" "), cwd: xargs.cwd }));
+}
+
+// Literal printf and echo values are known before xargs passes them to a command.
+export function xargsReplacements(left: Command[], right: Command[]): { source: string; cwd: string }[] {
+  const producer = left.find((cmd) => cmd.program >= 0 && ["printf", "echo"].includes(basename(cmd.argv[cmd.program]!.text)));
+  const xargs = right.find((cmd) => cmd.program >= 0 && cmd.wrappers.includes("xargs"));
+  if (!producer || !xargs) return [];
+  const args = producer.argv.slice(producer.program + 1);
+  if (basename(producer.argv[producer.program]!.text) !== "printf")
+    return xargsCommands(
+      xargs,
+      args.filter((word) => !word.text.startsWith("-")).map((word) => unescape(word.text, true)),
+    );
+  const output = printfOutput(args);
+  return output === undefined ? [] : xargsCommands(xargs, output.split("\n").filter(Boolean));
+}
+
+// A here-string or here-document body is the item list xargs reads.
+export function xargsHereInput(xargs: Command, body: string): { source: string; cwd: string }[] {
+  return xargsCommands(
+    xargs,
+    body
+      .split("\n")
+      .flatMap((line) => line.split(/\s+/))
+      .filter(Boolean),
+  );
 }

package/src/reasons.ts

@@ -1,19 +1,22 @@
 export const reasons = {
-  appdata: "This reads a protected macOS app-data directory. Name a specific non-sensitive file under ~/Library/Application Support instead, or ask the user to inspect the protected file and share the needed fact.",
+  syntax: "The agent guard cannot inspect this shell syntax. Rewrite it as a Bash-compatible command with explicit paths, or run a narrower command that the guard can inspect.",
+  appdata:
+    "This reads a protected macOS app-data directory. Name a specific non-sensitive file under ~/Library/Application Support instead, or ask the user to inspect the protected file and share the needed fact.",
   broad: "A scan rooted at the home directory or ~/Library reaches every app-data entry. Scope the scan to a project path.",
   file: "This reads a credential or environment file. Read a non-sensitive config file instead; if a fact from this file is needed, ask the user to inspect it and share only that fact.",
+  hiddenSearch: "A recursive search that includes hidden files can read credentials. Use default rg on a project path, or search an exact non-sensitive file without recursive or hidden-file flags.",
   dump: "This dumps environment or shell variables, including secrets. Name the non-sensitive variable needed and read only that variable.",
   variable: "This prints the value of a credential variable. Ask the user for the specific non-sensitive fact needed, or let the authorized client consume the credential without printing it.",
   token: "This prints a Git hosting token. Use auth status without token-display flags; if authentication needs repair, ask the user to update the credential in their terminal.",
   keychain: "This extracts a password from the macOS Keychain. State the intended use and run the authorized client that consumes it without printing it.",
+  secretPrint:
+    "This prints a stored secret or access token. Run the command that uses the credential without printing it, or ask the user to run it in their own terminal and share only the non-secret fact needed.",
   trace: "curl verbose or trace output can print HTTP headers including Authorization. Drop -v and --trace; use a normal curl request for the needed result.",
   upload: "This sends the contents of a credential file. Send only the required non-sensitive fields explicitly, and let the client obtain authentication from its normal credential source.",
   ssh: "This reads private material under ~/.ssh. Search public material in the project or request the exact public key or client-config path; ask the user to inspect private material locally if a specific non-sensitive fact is needed.",
   grepSsh: "Grep would search private ~/.ssh material. Narrow the search to a project directory or an exact public key, client config, allowed_signers, or known_hosts file.",
   symlink: "The agent guard could not complete its symlink check. Name the direct non-sensitive file outside protected trees, or ask the user to inspect the target locally.",
-  find: "find is harder to scope for this repository's searches. Use fd with a project-root path instead.",
   replace: "rg -r means --replace. Drop -r; use -n for line numbers, or spell --replace VALUE for an intentional replacement.",
   include: "rg has no --include flag. Filter files with -g GLOB (for example -g '*.ts') or a type filter such as -t ts.",
   bre: "rg regex is not grep BRE: a\\|b matches a literal pipe. Write alternation as a|b; for a literal pipe, use [|] or -F.",
-  launcher: "An explicit path or wrapper bypasses the provider-aware Claude launcher. Run Claude as `claude ...` to use the persisted mode.",
 } as const;

package/src/record.ts

@@ -1,7 +1,7 @@
 // A search option's value keeps the option's word as option:ROLE.
 export type ValueRole = "pattern" | "patfile" | "glob" | "nglob" | "optarg";
 export type Role = "arg" | "assign" | "precommand" | "namespace" | "program" | "code" | "option" | "path" | ValueRole | `option:${ValueRole}`;
-export type Flag = "explicit" | "files" | "help" | "noignore" | "fixed" | "recursive" | "include" | "replace";
+export type Flag = "explicit" | "files" | "help" | "fixed" | "recursive" | "include" | "replace" | "hidden" | "walked";
 
 export interface Word {
   text: string; // quotes removed; ~, $HOME and ${HOME} expanded
@@ -11,11 +11,13 @@ export interface Word {
   vars: string[]; // parameter names the shell expands
   role: Role; // set by argv.ts
   value: string; // an option's value without its flag, set by argv.ts
+  pwd: boolean; // holds $PWD, $(pwd) or ~+, expanded to the directory the command was read in
 }
 
 export interface Redirect {
   direction: "in" | "out" | "herestring" | "heredoc";
   target: string; // file, word, or heredoc body
+  globs: boolean; // the target holds an unquoted glob character
   vars: string[]; // parameters the shell expands in the target or body
 }
 
@@ -32,6 +34,7 @@ export interface Command {
 export interface Script {
   commands: Command[];
   uninspectable: string[];
+  parseFailed: boolean;
 }
 
 export type Runtime = "claude" | "codex" | "pi";
@@ -42,10 +45,13 @@ export interface Request {
   tool: Tool;
   home: string;
   cwd: string;
+  inputCwd: string;
+  pathInput: string;
   operation: "" | "read" | "write" | "search";
   target: string;
   searchRoot: string;
   glob: string;
   commands: Command[];
   uninspectable: string[];
+  parseFailed: boolean;
 }

package/src/rules/appdata.ts

@@ -1,10 +1,10 @@
 // App Data rules. macOS records a Files & Folders App Data entry whenever a
 // process reads or enumerates another app's ~/Library data tree, so these deny
 // those reads and the broad walks that reach them.
-import { basename } from "node:path";
-import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths.ts";
-import { reasons } from "../reasons.ts";
-import type { Command, Request } from "../record.ts";
+import { programName } from "../argv";
+import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths";
+import { reasons } from "../reasons";
+import type { Command, Request } from "../record";
 
 const { appdata: appdataReason, broad: broadReason } = reasons;
 
@@ -26,31 +26,34 @@ export function appdataRules(req: Request): string[] {
     if (reason) denials.push(reason);
   }
   const home = req.home.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const signature = new RegExp(`(~|\\$HOME|\\$\\{HOME\\}|${home})/Library/(${trees})`);
+  const signature = new RegExp(`(~|\\$HOME|\\$\\{HOME\\}|${home})/Library/(${trees})`, "i");
   for (const fragment of req.uninspectable) if (signature.test(fragment)) denials.push(appdataReason);
   return denials;
 }
 
 function appdataCommand(cmd: Command, home: string): string | undefined {
   const cwd = cmd.cwd;
-  const prog = cmd.program >= 0 ? basename(cmd.argv[cmd.program].text) : "";
+  const prog = cmd.program >= 0 ? programName(cmd.argv[cmd.program]!.text) : "";
   const data = dataPrograms.has(prog);
   // cd reads its target but walks nothing.
-  const recursive = cmd.argv.slice(cmd.program + 1).some((word) =>
-    (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
+  const recursive = cmd.argv.slice(cmd.program + 1).some((word) => (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
   const gitConfig = prog === "git" && cmd.argv.slice(cmd.program + 1).some((word) => word.text === "config");
   const walk = !data && !gitConfig && !["cd", "pushd", "popd"].includes(prog) && !noWalkPrograms.has(prog) && !(["ls", "cp"].includes(prog) && !recursive);
   const paths: { path: string; glob: boolean }[] = [];
   for (const [i, word] of cmd.argv.entries()) {
-    if (!word.value || ["pattern", "code", "option:pattern", "optarg"].includes(word.role)) continue;
+    if (!word.value || ["pattern", "code", "option:pattern"].includes(word.role)) continue;
     if (word.role === "program" && !word.value.includes("/")) continue;
     if (data && !word.globs && i > cmd.program) continue;
-    // An expansion the front end cannot resolve may well be $HOME.
-    if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "s").test(word.value)) return appdataReason;
-    paths.push({ path: absPath(word.value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
+    // A value glued to its option, as in --env-file=PATH, is a path too.
+    const values = word.value.startsWith("-") && word.value.includes("=") ? [word.value, word.value.slice(word.value.indexOf("=") + 1)] : [word.value];
+    for (const value of values) {
+      // An expansion the front end cannot resolve may well be $HOME.
+      if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "is").test(value)) return appdataReason;
+      paths.push({ path: absPath(value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
+    }
   }
   for (const r of cmd.redirects) {
-    if ((r.direction === "in" || r.direction === "out") && r.target) paths.push({ path: absPath(r.target, cwd, home), glob: false });
+    if ((r.direction === "in" || r.direction === "out") && r.target) paths.push({ path: absPath(r.target, cwd, home), glob: r.globs });
   }
   if (paths.some(({ path, glob }) => isAppdata(path, home, glob))) return appdataReason;
   // Shell glob expansion touches directories even when the command does not walk them.
@@ -60,23 +63,15 @@ function appdataCommand(cmd: Command, home: string): string | undefined {
   // Path operands scope a walk away from the current directory; a search
   // tool's pattern is not one of them.
   let scoped = false;
-  let noignore = cmd.flags.has("noignore");
   for (const word of cmd.argv.slice(cmd.program + 1)) {
     const text = word.text;
     if ((word.role === "arg" || word.role === "path") && !text.startsWith("-")) scoped = true;
-    if (/^--(unrestricted|no-ignore)/.test(text)) noignore = true;
-    if (prog === "fd" && /^-[^-]*[uI]/.test(text)) noignore = true;
-    // A positive glob reaching Library overrides the ignore filter.
-    if (word.role === "glob" || word.role === "option:glob") {
-      const glob = new Bun.Glob(word.value.toLowerCase());
-      if (["library", ...appdataTrees.map((tree) => `library/${tree.toLowerCase()}/x`)].some((path) => glob.match(path))) noignore = true;
-    }
   }
   if (prog === "ls" && !scoped && isAppdata(cwd, home)) return appdataReason;
   // rg and fd also read ignore files from cwd when given a path operand.
   let denied = false;
-  if (prog === "find" || prog === "du") denied = !scoped && (isBroad(cwd, home) || isAppdata(cwd, home));
+  if (["find", "du", "tree"].includes(prog)) denied = !scoped && (isBroad(cwd, home) || isAppdata(cwd, home));
   else if (prog === "ls" || prog === "grep") denied = !scoped && recursive && isBroad(cwd, home);
-  else if (prog === "rg" || prog === "fd") denied = !scoped && (noignore ? isBroad(cwd, home) : isLibrary(cwd, home));
+  else if (["rg", "fd", "ag", "ack"].includes(prog)) denied = !scoped && (isBroad(cwd, home) || isLibrary(cwd, home));
   return denied ? broadReason : undefined;
 }