@loophubs/agent-guard 0.1.0 → 0.3.0

package/src/rules/credentials.ts

@@ -3,18 +3,35 @@
 // Clients that consume a credential file themselves (dotenvx, node --env-file,
 // ssh -i) are not readers and stay allowed.
 import { basename } from "node:path";
-import { absPath, isSensitive, sshPrivate, sshScopeDenied } from "../paths.ts";
-import { reasons } from "../reasons.ts";
-import type { Command, Request } from "../record.ts";
+
+import { programName } from "../argv";
+import { absPath, isSensitive, isSensitiveRoot, sshPrivate, sshScopeDenied } from "../paths";
+import { showsHidden } from "../pipeline";
+import { reasons } from "../reasons";
+import type { Command, Request, Word } from "../record";
 
 const readerPrograms = new Set(
-  ("cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
-    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack").split(" "),
+  (
+    "cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
+    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack tac column pr vim vi nvim view perl ruby dd scp rsync zip ed ex hg svn sh bash zsh dash ksh wget php zgrep zless zmore"
+  ).split(" "),
 );
+// Programs a find or fd -exec command can run to print or forward what the walk found.
+const execReaders = new Set([...readerPrograms, "rg", "grep", "sh", "bash", "zsh", "dash", "ksh", "env", "sudo", "doas", "xargs", "command", "nohup", "timeout", "nice", "time", "stdbuf", "arch"]);
+// git subcommands that print the content of a file, a commit, or the index.
+const gitReaders = new Set(["show", "diff", "log", "cat-file", "blame", "annotate", "grep", "archive", "format-patch", "whatchanged", "difftool", "diff-index", "diff-tree"]);
 const {
-  file: fileReason, dump: dumpReason, variable: varReason, token: tokenReason,
-  keychain: keychainReason, trace: traceReason, upload: uploadReason,
-  ssh: sshReason, grepSsh: grepSshReason,
+  file: fileReason,
+  dump: dumpReason,
+  variable: varReason,
+  token: tokenReason,
+  keychain: keychainReason,
+  trace: traceReason,
+  upload: uploadReason,
+  ssh: sshReason,
+  grepSsh: grepSshReason,
+  hiddenSearch: hiddenSearchReason,
+  secretPrint: secretReason,
 } = reasons;
 
 const secretName = (name: string) => /TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL/.test(name.toUpperCase());
@@ -24,7 +41,7 @@ export function credentialRules(req: Request): string[] {
   if (req.operation === "read" && isSensitive(req.target)) denials.push(fileReason);
   if (req.operation === "write" && sshPrivate(req.target)) denials.push(sshReason);
   if (req.operation === "search") {
-    if (isSensitive(req.searchRoot)) denials.push(fileReason);
+    if (isSensitiveRoot(req.searchRoot, req.home)) denials.push(fileReason);
     // A positive glob selects files even past ignore rules.
     if (req.glob && !req.glob.startsWith("!") && isSensitive(`${req.searchRoot}/${basename(req.glob)}`, true)) denials.push(fileReason);
   }
@@ -37,19 +54,38 @@ export function credentialRules(req: Request): string[] {
 export function credentialFilesystemRules(req: Request): string[] {
   if ((req.operation === "read" || req.operation === "write") && sshScopeDenied(req.target, req.home, false)) return [sshReason];
   if (req.operation === "search" && sshScopeDenied(req.searchRoot, req.home, true)) return [grepSshReason];
+  for (const cmd of req.commands) {
+    for (const redirect of cmd.redirects) {
+      if ((redirect.direction === "in" || redirect.direction === "out") && redirect.target && sshScopeDenied(absPath(redirect.target, cmd.cwd, req.home), req.home, false)) return [sshReason];
+    }
+    if (cmd.program < 0) continue;
+    const name = programName(cmd.argv[cmd.program]!.text);
+    const readsPath = ["ls", "find", "tree", "rg", "grep", "ag", "ack", "fd"].includes(name);
+    if (!readsPath && !readerPrograms.has(name)) continue;
+    const words = cmd.argv.slice(cmd.program + 1);
+    // A search with no path operand reads the working directory.
+    const searches = ["rg", "ag", "ack"].includes(name) || (name === "grep" && cmd.flags.has("recursive"));
+    if (searches && !cmd.flags.has("help") && !words.some((word) => word.role === "path") && sshScopeDenied(cmd.cwd, req.home, true)) return [grepSshReason];
+    const filter = name === "jq" ? jqFilter(words) : undefined;
+    for (const word of words) {
+      if (word === filter) continue;
+      if (!["arg", "path", "patfile", "option:patfile"].includes(word.role) || word.value.startsWith("-")) continue;
+      if (sshScopeDenied(absPath(word.value, cmd.cwd, req.home, /^['"]/.test(word.raw)), req.home, false)) return [sshReason];
+    }
+  }
   return [];
 }
 
 function credentialCommand(cmd: Command, home: string): string[] {
   const denials: string[] = [];
   const sensitive = (word: string, glob = false, quoted = false) => isSensitive(absPath(word, cmd.cwd, home, quoted), glob);
-  for (const r of cmd.redirects) if (r.direction === "in" && sensitive(r.target)) denials.push(fileReason);
+  for (const r of cmd.redirects) if (r.direction === "in" && sensitive(r.target, r.globs)) denials.push(fileReason);
   if (cmd.program < 0) {
     if (cmd.wrappers.at(-1) === "env" && !cmd.wrappers.includes("env-S")) denials.push(dumpReason);
     return denials;
   }
-  const program = cmd.argv[cmd.program].text;
-  const name = basename(program);
+  const program = cmd.argv[cmd.program]!.text;
+  const name = programName(program);
   const words = cmd.argv.slice(cmd.program + 1);
   const args = words.map((w) => w.text);
   // Shell variables exist only in the shell, so a path or a wrapper that
@@ -58,10 +94,40 @@ function credentialCommand(cmd: Command, home: string): string[] {
     if (name === "export" && (!args.length || args.some((a) => /^-[^-]*p/.test(a)))) denials.push(dumpReason);
     if (name === "set" && !args.length) denials.push(dumpReason);
     if (name === "typeset" || name === "declare") {
-      if (!args.length || (args.length === 1 && /^-[^-]*[px]/.test(args[0]))) denials.push(dumpReason);
+      if (!args.length || (args.length === 1 && /^-[^-]*[px]/.test(args[0]!))) denials.push(dumpReason);
       for (const a of args) if (!a.startsWith("-") && !a.includes("=") && secretName(a)) denials.push(varReason);
     }
   }
+  // A hidden-file walk piped into xargs hands the reader every dotfile it finds.
+  if (cmd.flags.has("walked") && execReaders.has(name)) denials.push(hiddenSearchReason);
+  const options = cmd.argv.slice(0, cmd.program);
+  if (cmd.wrappers.includes("xargs")) {
+    // xargs reads its arguments from the -a file.
+    for (const [i, word] of options.entries()) {
+      const file = word.text === "-a" || word.text === "--arg-file" ? options[i + 1]?.text : word.text.startsWith("--arg-file=") ? word.text.slice("--arg-file=".length) : undefined;
+      if (file && sensitive(file)) denials.push(fileReason);
+    }
+  }
+  // Every operand, and the value of an option glued with `=`, is a file the program may read.
+  // A destination is written and a tar -C directory is entered; later operands are read relative to it.
+  const operandWords = words.filter((w) => !w.text.startsWith("-"));
+  const destination = ["cp", "rsync", "scp"].includes(name) ? operandWords.at(-1) : undefined;
+  const enters = (w: Word, i: number) => name === "tar" && (["-C", "--directory"].includes(words[i - 1]?.text ?? "") || w.text.startsWith("--directory="));
+  const readTargets = (filter?: Word) => {
+    const found: string[] = [];
+    let base = cmd.cwd;
+    for (const [i, w] of words.entries()) {
+      if (w === filter || /^--exclude=/.test(w.text)) continue;
+      const target = name === "dd" ? (w.text.startsWith("if=") ? w.text.slice(3) : "") : /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
+      if (!target || target.startsWith("-")) continue;
+      const quoted = /^['"]/.test(w.raw);
+      if (enters(w, i)) base = absPath(target, base, home, quoted);
+      // A directory that holds a listed file is read whole by tar, zip, scp and rsync.
+      if (sensitive(target, w.globs, quoted) || (!w.globs && w !== destination && !enters(w, i) && isSensitiveRoot(absPath(target, base, home, quoted), home)))
+        found.push(name === "scp" || name === "rsync" ? uploadReason : fileReason);
+    }
+    return found;
+  };
   let display = readerPrograms.has(name) || ["echo", "printf", "print"].includes(name);
   const operands = args.filter((a) => !a.startsWith("-"));
   switch (name) {
@@ -80,51 +146,125 @@ function credentialCommand(cmd: Command, home: string): string[] {
     case "ag":
     case "ack":
       if (cmd.flags.has("help")) break;
+      if ((name === "grep" && cmd.flags.has("recursive")) || (["rg", "ag"].includes(name) && cmd.flags.has("hidden"))) denials.push(hiddenSearchReason);
       for (const w of words) {
         if (w.role === "path" && absPath(w.value, cmd.cwd, home, /^['"]/.test(w.raw)) === `${home}/.ssh`) denials.push(sshReason);
       }
       if (cmd.flags.has("files")) break;
+      // A search with no path operand reads the working directory.
+      if ((name !== "grep" || cmd.flags.has("recursive")) && !words.some((w) => w.role === "path") && isSensitiveRoot(cmd.cwd, home)) denials.push(fileReason);
       // Search operands, pattern files and positive globs are read targets;
       // the pattern is not.
       for (const w of words) {
-        if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
+        const quoted = /^['"]/.test(w.raw);
+        if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, quoted)) denials.push(fileReason);
+        if (w.role === "path" && isSensitiveRoot(absPath(w.value, cmd.cwd, home, quoted), home)) denials.push(fileReason);
         if (["glob", "option:glob"].includes(w.role) && sensitive(basename(w.value), true)) denials.push(fileReason);
       }
       break;
     case "gh":
       if (args[0] === "auth" && args[1] === "token") denials.push(tokenReason);
       if (args[0] === "auth" && args[1] === "status" && ghShowsToken(args.slice(2))) denials.push(tokenReason);
+      // gist create and --body-file upload the files they are given.
+      denials.push(...readTargets());
       break;
     case "glab":
       if (args[0] === "auth" && args[1] === "status" && args.some((a) => /^(--show-token|-[^-]*t)/.test(a))) denials.push(tokenReason);
       break;
     case "security":
-      if (args.includes("-w") || args.includes("-g")) denials.push(keychainReason);
+      if (args.some((a) => /^-[A-Za-z]*[wg]/.test(a) && !a.startsWith("--")) || ["dump-keychain", "export"].includes(args[0] ?? "")) denials.push(keychainReason);
+      break;
+    // A print command gives the guard no target path, so these name the subcommand. Each is a
+    // workaround that stays until the operating system's read restrictions cover the store; do not extend the list.
+    case "gcloud":
+      if (args.includes("print-access-token") || args.includes("print-identity-token")) denials.push(secretReason);
+      break;
+    case "az":
+      if (args[0] === "account" && args[1] === "get-access-token") denials.push(secretReason);
+      break;
+    case "aws":
+      if (args[0] === "configure" && args[1] === "get" && secretName(args[2] ?? "")) denials.push(secretReason);
+      break;
+    case "npm":
+      if (args[0] === "config" && args[1] === "get" && /auth|token|password/i.test(args[2] ?? "")) denials.push(secretReason);
+      break;
+    case "kubectl":
+      if (args[0] === "config" && args[1] === "view" && args.includes("--raw")) denials.push(secretReason);
+      break;
+    case "gpg":
+      if (args.some((a) => /^--export-secret-(sub)?keys$/.test(a))) denials.push(secretReason);
       break;
     case "curl":
       denials.push(...curlRules(args, sensitive));
       break;
+    case "git": {
+      const git = gitCommand(words);
+      // A rev:path operand names a file in a commit or the index; pathspecs may be globs.
+      if (git.sub === "credential" && git.operands[0]?.text === "fill") denials.push(secretReason);
+      for (const w of git.operands) {
+        if (w.text.startsWith("-")) continue;
+        if (git.sub === "grep" && isSensitiveRoot(absPath(w.text, cmd.cwd, home, /^['"]/.test(w.raw)), home)) denials.push(fileReason);
+        if (sensitive(w.text, true) || (w.text.includes(":") && sensitive(w.text.slice(w.text.indexOf(":") + 1), true))) denials.push(fileReason);
+      }
+      break;
+    }
+    case "find":
+    case "fd":
+      if (execPrograms(name, words).some((exec) => execReaders.has(programName(exec))) && (name === "find" || showsHidden(words))) denials.push(hiddenSearchReason);
+      break;
     default:
       if (!readerPrograms.has(name)) return denials;
-      let jqFilter = name === "jq" && !args.includes("-f") && !args.includes("--from-file");
-      for (const w of words) {
-        if (jqFilter && !w.text.startsWith("-")) {
-          jqFilter = false;
-          continue;
-        }
-        const target = /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
-        if (target && !target.startsWith("-") && sensitive(target, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
-      }
+      denials.push(...readTargets(name === "jq" ? jqFilter(words) : undefined));
   }
   // A heredoc or here-string body is standard input the command prints.
   if (display && cmd.redirects.some((r) => r.vars.some(secretName))) denials.push(varReason);
   return denials;
 }
 
+// The subcommand and the operands that can name a file; git grep's pattern is not one.
+function gitCommand(words: Word[]): { sub: string; operands: Word[] } {
+  let i = 0;
+  while (i < words.length && words[i]!.text.startsWith("-")) i += ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"].includes(words[i]!.text) ? 2 : 1;
+  const sub = words[i]?.text ?? "";
+  let operands = words.slice(i + 1);
+  if (sub === "grep") {
+    const rest: Word[] = [];
+    let patterned = false;
+    let options = true;
+    for (let n = 0; n < operands.length; n++) {
+      const text = operands[n]!.text;
+      if (options && text === "--") options = false;
+      else if (options && text === "-e") {
+        patterned = true;
+        n++;
+      } else if (options && text === "-f") {
+        // The file holds the patterns; git reads it.
+        patterned = true;
+        if (operands[n + 1]) rest.push(operands[++n]!);
+      } else if (options && text.startsWith("-")) rest.push(operands[n]!);
+      else if (!patterned) patterned = true;
+      else rest.push(operands[n]!);
+    }
+    operands = rest;
+  }
+  return { sub, operands: sub === "credential" || gitReaders.has(sub) ? operands : [] };
+}
+
+// The commands a find -exec or an fd -x runs on the matches; find takes several.
+function execPrograms(name: string, words: Word[]): string[] {
+  const flags = name === "find" ? ["-exec", "-execdir", "-ok", "-okdir"] : ["-x", "-X", "--exec", "--exec-batch"];
+  return words.flatMap((word, i) => (flags.includes(word.text) && words[i + 1] ? [words[i + 1]!.text] : []));
+}
+
+function jqFilter(words: Word[]): Word | undefined {
+  if (words.some((word) => word.text === "-f" || word.text === "--from-file")) return undefined;
+  return words.find((word) => !word.text.startsWith("-"));
+}
+
 // A token-display flag counts even when a later flag cancels it.
 function ghShowsToken(args: string[]): boolean {
   for (let i = 0; i < args.length; i++) {
-    const a = args[i];
+    const a = args[i]!;
     if (a === "--") return false;
     if (["--hostname", "--jq", "--json", "--template", "-h"].includes(a)) i++;
     else if (a === "--show-token" || a.startsWith("--show-token=") || /^-[at]*t/.test(a)) return true;
@@ -138,19 +278,20 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
   const denials: string[] = [];
   const long = /^--(data|data-ascii|data-binary|data-urlencode|json|form|header|upload-file|config)(=|$)/s;
   for (let i = 0; i < args.length; i++) {
-    const word = args[i];
+    const word = args[i]!;
     let key = "";
     let value = "";
     if (word === "--") break;
+    if (/^file:\/\//i.test(word) && sensitive(word)) denials.push(fileReason);
     if (/^--(verbose|trace|trace-ascii)(=|$)/.test(word)) denials.push(traceReason);
     else if (long.test(word)) {
-      key = word.slice(2).split("=")[0];
+      key = word.slice(2).split("=")[0]!;
       value = word.includes("=") ? word.slice(word.indexOf("=") + 1) : (args[++i] ?? "");
     } else if (/^-[^-]/.test(word)) {
       for (let k = 1; k < word.length; k++) {
         if (word[k] === "v") denials.push(traceReason);
-        if (!"AbcCdDeEFHKmoPQrTtuUwxXyYz".includes(word[k])) continue;
-        key = word[k];
+        if (!"AbcCdDeEFHKmoPQrTtuUwxXyYz".includes(word[k]!)) continue;
+        key = word[k]!;
         value = word.slice(k + 1) || (args[++i] ?? "");
         break;
       }
@@ -159,7 +300,10 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
       if (!/@./s.test(value)) continue;
       value = value.slice(value.indexOf("@") + 1);
     } else if (key === "F" || key === "form") {
-      value = value.slice(value.indexOf("=") + 1).replace(/^[@<]/, "").split(";")[0];
+      value = value
+        .slice(value.indexOf("=") + 1)
+        .replace(/^[@<]/, "")
+        .split(";")[0]!;
     } else if (!["T", "upload-file", "K", "config"].includes(key)) continue;
     if (sensitive(value)) denials.push(uploadReason);
   }
@@ -167,8 +311,7 @@ function curlRules(args: string[], sensitive: (word: string) => boolean): string
 }
 
 const readers = [...readerPrograms].filter((p) => p !== ".").join("|");
-const names =
-  "\\.env(\\.(local|production|staging|development))?|\\.npmrc|\\.zsh_history|\\.zprofile|private-keys-v1\\.d|\\S*\\.(pem|key)|auth\\.json|\\.credentials\\.json|\\.aws/credentials|\\.ssh/\\S*";
+const names = "\\.env(?:\\.[A-Za-z0-9_.-]+)?|\\.npmrc|\\.zsh_history|\\.zprofile|private-keys-v1\\.d|\\S*\\.(pem|key)|auth\\.json|\\.credentials\\.json|\\.aws/credentials|\\.ssh/\\S*";
 const readerSignature = new RegExp(`(^|[^A-Za-z0-9_])(${readers})([^A-Za-z0-9_-].*)?[\\s/"'=](${names})($|[\\s/"'>|&)\`])`, "s");
 
 // Text the front end could not structure: interpreter code, case bodies, or
@@ -183,7 +326,7 @@ function credentialSignatures(fragment: string): string[] {
     )
       denials.push(dumpReason);
     const reader = segment.match(readerSignature);
-    if (reader && !(reader[4].startsWith(".ssh/") && !sshPrivate(`/${reader[4]}`))) denials.push(fileReason);
+    if (reader) denials.push(fileReason);
     if (/curl\s.*\s(-[A-Za-z]*v[A-Za-z]*|--verbose|--trace(-ascii)?)(\s|=|$)/s.test(segment)) denials.push(traceReason);
     if (/gh\s+auth\s+token/.test(segment)) denials.push(tokenReason);
     if (/security\s.*\s-[wg](\s|$)/s.test(segment)) denials.push(keychainReason);

package/src/rules/workflow.ts

@@ -1,38 +1,22 @@
-// Workflow rules differ by runtime; the safety rules do not.
-// Codex: run claude through the provider-aware launcher function, which picks
-// the persisted provider mode before gateway credentials are expanded.
 import { basename } from "node:path";
-import { reasons } from "../reasons.ts";
-import type { Request } from "../record.ts";
 
-const {
-  find: findReason, replace: replaceReason, include: includeReason,
-  bre: breReason, launcher: launcherReason,
-} = reasons;
+import { reasons } from "../reasons";
+import type { Request } from "../record";
+
+const { replace: replaceReason, include: includeReason, bre: breReason } = reasons;
 
 export function claudeWorkflowRules(req: Request): string[] {
-  const denials: string[] = [];
+  const advice: string[] = [];
   for (const cmd of req.commands) {
     if (cmd.program < 0) continue;
-    const name = basename(cmd.argv[cmd.program].text);
-    if (name === "find") denials.push(findReason);
+    const name = basename(cmd.argv[cmd.program]!.text);
     if (name !== "rg") continue;
-    if (cmd.flags.has("replace")) denials.push(replaceReason);
-    if (cmd.flags.has("include")) denials.push(includeReason);
+    if (cmd.flags.has("replace")) advice.push(replaceReason);
+    if (cmd.flags.has("include")) advice.push(includeReason);
     if (cmd.flags.has("fixed")) continue;
     for (const w of cmd.argv.slice(cmd.program + 1)) {
-      if ((w.role === "pattern" || w.role === "option:pattern") && /(^|[^\\])\\\|/.test(w.value)) denials.push(breReason);
+      if ((w.role === "pattern" || w.role === "option:pattern") && /(^|[^\\])\\\|/.test(w.value)) advice.push(breReason);
     }
   }
-  return denials;
-}
-
-export function codexWorkflowRules(req: Request): string[] {
-  const denials: string[] = [];
-  for (const cmd of req.commands) {
-    if (cmd.program < 0) continue;
-    const program = cmd.argv[cmd.program].text;
-    if (basename(program) === "claude" && (program.includes("/") || cmd.wrappers.length)) denials.push(launcherReason);
-  }
-  return denials;
+  return advice;
 }

package/src/runner.ts

@@ -0,0 +1,32 @@
+// A separate process group lets the deadline stop children inheriting hook pipes.
+const child = Bun.spawn({
+  cmd: [process.execPath, `${import.meta.dir}/guard.ts`, ...process.argv.slice(2)],
+  stdin: "inherit",
+  stdout: "pipe",
+  stderr: "pipe",
+  detached: true,
+});
+process.stdout.write(`AGENT_GUARD_PGID=${child.pid}\n`);
+const forward = async (stream: ReadableStream<Uint8Array>) => {
+  for await (const chunk of stream) process.stdout.write(chunk);
+};
+const output = Promise.all([forward(child.stdout), forward(child.stderr)]);
+
+const stopGroup = () => {
+  try {
+    process.kill(-child.pid, "SIGKILL");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ESRCH") throw error;
+  }
+};
+
+let expired = false;
+const deadline = setTimeout(() => {
+  expired = true;
+  stopGroup();
+}, 2800);
+const exit = await child.exited;
+clearTimeout(deadline);
+stopGroup();
+await output;
+process.exitCode = expired ? 1 : exit;

package/src/search-roles.ts

@@ -1,17 +1,16 @@
-import type { Command, ValueRole, Word } from "./record.ts";
+import type { Command, ValueRole, Word } from "./record";
 
 const rgShortValues = "efgtTEABCmMjrd";
 const rgLongValues = new Set(
-  ("regexp file glob iglob type type-not encoding replace color colors sort sortr max-depth max-filesize pre pre-glob " +
+  (
+    "regexp file glob iglob type type-not encoding replace color colors sort sortr max-depth max-filesize pre pre-glob " +
     "engine threads max-columns type-add type-clear path-separator context-separator field-context-separator " +
     "field-match-separator after-context before-context context max-count ignore-file dfa-size-limit " +
-    "regex-size-limit hyperlink-format").split(" "),
+    "regex-size-limit hyperlink-format"
+  ).split(" "),
 );
 const grepShortValues = "efABCmdD";
-const grepLongValues = new Set(
-  ("regexp file include exclude exclude-dir exclude-from label context after-context before-context max-count " +
-    "binary-files devices directories").split(" "),
-);
+const grepLongValues = new Set(("regexp file include exclude exclude-dir exclude-from label context after-context before-context max-count " + "binary-files devices directories").split(" "));
 
 export function searchRoles(cmd: Command, args: Word[], prog: string) {
   const rg = prog === "rg";
@@ -20,52 +19,74 @@ export function searchRoles(cmd: Command, args: Word[], prog: string) {
   const flags = cmd.flags;
   const operands: Word[] = [];
   let options = true;
+  let unrestricted = 0;
+  let noHidden = false;
 
   const value = (at: number, key: string, text: string) => {
     const target = args[at];
     if (!target) return;
+    if (!rg && (key === "d" || key === "directories") && text === "recurse") flags.add("recursive");
     let role: ValueRole = "optarg";
-    if (key === "e" || key === "regexp") (role = "pattern"), flags.add("explicit");
-    else if (key === "f" || key === "file") (role = "patfile"), flags.add("explicit");
-    else if (["g", "glob", "iglob", "include"].includes(key)) role = text.startsWith("!") ? "nglob" : "glob";
+    if (key === "e" || key === "regexp") {
+      role = "pattern";
+      flags.add("explicit");
+    } else if (key === "f" || key === "file") {
+      role = "patfile";
+      flags.add("explicit");
+    } else if (["g", "glob", "iglob", "include"].includes(key)) role = text.startsWith("!") ? "nglob" : "glob";
     target.role = target.role === "option" ? `option:${role}` : role;
     target.value = text;
   };
 
   for (let i = 0; i < args.length; i++) {
-    const word = args[i].text;
+    const word = args[i]!.text;
     if (options && word === "--") {
       options = false;
-      args[i].role = "option";
+      args[i]!.role = "option";
     } else if (options && /^--./.test(word)) {
-      args[i].role = "option";
-      const key = word.slice(2).split("=")[0];
+      args[i]!.role = "option";
+      const key = word.slice(2).split("=")[0]!;
       if (key === "files") flags.add("files");
+      else if (rg && key === "hidden") {
+        noHidden = false;
+        flags.add("hidden");
+      } else if (rg && key === "no-hidden") {
+        noHidden = true;
+        flags.delete("hidden");
+      } else if (rg && key === "unrestricted" && ++unrestricted >= 2 && !noHidden) flags.add("hidden");
+      else if (prog === "ag" && (key === "hidden" || key === "unrestricted")) flags.add("hidden");
       else if (key === "help" || key === "version") flags.add("help");
-      else if (key.startsWith("no-ignore") || key === "unrestricted") flags.add("noignore");
       else if (key === "fixed-strings") flags.add("fixed");
       else if (key === "recursive") flags.add("recursive");
       else if (key === "include") flags.add("include");
       if (word.includes("=")) value(i, key, word.slice(word.indexOf("=") + 1));
-      else if (longValues.has(key)) i++, value(i, key, args[i]?.text ?? "");
+      else if (longValues.has(key)) {
+        i++;
+        value(i, key, args[i]?.text ?? "");
+      }
     } else if (options && /^-./.test(word)) {
-      args[i].role = "option";
+      args[i]!.role = "option";
       for (let k = 1; k < word.length; k++) {
-        const c = word[k];
+        const c = word[k]!;
         if ((rg || prog === "grep") && c === "F") flags.add("fixed");
-        if (rg && c === "u") flags.add("noignore");
         if (prog === "grep" && (c === "r" || c === "R")) flags.add("recursive");
         if ((rg && c === "h") || c === "V") flags.add("help");
         if (rg && c === "r") flags.add("replace");
+        if (rg && c === ".") flags.add("hidden");
+        if (rg && c === "u" && ++unrestricted >= 2 && !noHidden) flags.add("hidden");
+        if (prog === "ag" && c === "u") flags.add("hidden");
         if (!shortValues.includes(c)) continue;
         let text = word.slice(k + 1);
         if (rg) text = text.replace(/^=/, "");
-        if (!text) i++, (text = args[i]?.text ?? "");
+        if (!text) {
+          i++;
+          text = args[i]?.text ?? "";
+        }
         value(i, c, text);
         break;
       }
     } else {
-      operands.push(args[i]);
+      operands.push(args[i]!);
     }
   }
   let explicit = flags.has("explicit") || flags.has("files");

package/src/words.ts

@@ -1,24 +1,21 @@
-import sh from "mvdan-sh";
 import type { DblQuoted, Lit, Node, ParamExp, SglQuoted, Word as WordNode } from "mvdan-sh";
-import { expandHome } from "./paths.ts";
-import type { Word } from "./record.ts";
+import sh from "mvdan-sh";
+
+import { expandHome } from "./paths";
+import type { Word } from "./record";
 
 const type = sh.syntax.NodeType;
 
-export function readWord(
-  node: WordNode,
-  slice: (start: number, end: number) => string,
-  vars: Map<string, string>,
-  home: string,
-  visit: (part: Node, names: string[]) => void,
-): Word {
+export function readWord(node: WordNode, slice: (start: number, end: number) => string, vars: Map<string, string>, home: string, pwd: string, visit: (part: Node, names: string[]) => void): Word {
   const text = (part: Node) => slice(part.Pos().Offset(), part.End().Offset());
-  const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "" };
+  const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "", pwd: false };
   const expansion = (part: Node) => {
     const param = part as ParamExp;
-    const plain = type(part) === "ParamExp" &&
-      !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
-    const known = plain ? (param.Param.Value === "HOME" ? home : vars.get(param.Param.Value)) : undefined;
+    const plain = type(part) === "ParamExp" && !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
+    const name = plain ? param.Param!.Value : "";
+    const printsPwd = name === "PWD" || (type(part) === "CmdSubst" && /^(\$\(|`)\s*pwd(\s+-[LP])?\s*(\)|`)$/.test(text(part)));
+    const known = printsPwd ? pwd : name === "HOME" ? home : plain ? vars.get(name) : undefined;
+    out.pwd ||= printsPwd;
     out.text += known ?? text(part);
     out.expands ||= known === undefined;
     visit(part, out.vars);
@@ -27,20 +24,29 @@ export function readWord(
     const kind = type(part);
     if (kind === "Lit") {
       let value = (part as Lit).Value;
-      if (index === 0) value = expandHome(value, home);
+      if (index === 0 && /^~\+(\/|$)/.test(value)) {
+        value = pwd + value.slice(2);
+        out.pwd = true;
+      } else if (index === 0) value = expandHome(value, home);
+      // Bun expands {a,b} but not the sequence {a..z}, so read a sequence as a wildcard.
+      const sequence = /(?<!\\)\{(?:-?\d+|[A-Za-z])\.\.(?:-?\d+|[A-Za-z])(?:\.\.-?\d+)?\}/g;
+      if (sequence.test(value)) {
+        value = value.replace(sequence, "*");
+        out.globs = true;
+      }
       if (Bun.$.braces(value).length > 1) out.globs = true;
       for (let i = 0; i < value.length; i++) {
         if (value[i] === "\\") {
           out.text += value[++i] ?? "";
           continue;
         }
-        if ("*?[".includes(value[i])) out.globs = true;
+        if ("*?[".includes(value[i]!)) out.globs = true;
         out.text += value[i];
       }
     } else if (kind === "SglQuoted") {
       const quoted = part as SglQuoted;
       out.text += quoted.Dollar
-        ? quoted.Value.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|([0-7]{1,3})|(.))/gs, (match, hex, unicode, octal, char) => {
+        ? quoted.Value.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|([0-7]{1,3})|(.))/gs, (_match, hex, unicode, octal, char) => {
             if (hex || unicode || octal) return String.fromCodePoint(parseInt(hex ?? unicode ?? octal, octal ? 8 : 16));
             return ({ a: "\x07", b: "\b", e: "\x1b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v" } as Record<string, string>)[char] ?? char;
           })

package/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": ["ESNext"],
+    "target": "ESNext",
+    "module": "Preserve",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "allowUnreachableCode": false,
+    "allowUnusedLabels": false,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": false,
+    "types": ["node", "bun"]
+  },
+  "include": ["src", "tests"]
+}