@loophubs/agent-guard 0.1.0

package/src/record.ts

@@ -0,0 +1,51 @@
+// A search option's value keeps the option's word as option:ROLE.
+export type ValueRole = "pattern" | "patfile" | "glob" | "nglob" | "optarg";
+export type Role = "arg" | "assign" | "precommand" | "namespace" | "program" | "code" | "option" | "path" | ValueRole | `option:${ValueRole}`;
+export type Flag = "explicit" | "files" | "help" | "noignore" | "fixed" | "recursive" | "include" | "replace";
+
+export interface Word {
+  text: string; // quotes removed; ~, $HOME and ${HOME} expanded
+  raw: string;
+  expands: boolean; // holds an expansion the front end cannot resolve
+  globs: boolean; // holds an unquoted glob character
+  vars: string[]; // parameter names the shell expands
+  role: Role; // set by argv.ts
+  value: string; // an option's value without its flag, set by argv.ts
+}
+
+export interface Redirect {
+  direction: "in" | "out" | "herestring" | "heredoc";
+  target: string; // file, word, or heredoc body
+  vars: string[]; // parameters the shell expands in the target or body
+}
+
+export interface Command {
+  argv: Word[];
+  redirects: Redirect[];
+  cwd: string; // after the cd commands that run before it in the same shell
+  program: number; // argv index of the word that runs, -1 when nothing runs
+  wrappers: string[];
+  shell: boolean; // the program runs in this shell rather than behind a wrapper
+  flags: Set<Flag>;
+}
+
+export interface Script {
+  commands: Command[];
+  uninspectable: string[];
+}
+
+export type Runtime = "claude" | "codex" | "pi";
+export type Tool = "bash" | "read" | "edit" | "write" | "grep";
+
+export interface Request {
+  runtime: Runtime;
+  tool: Tool;
+  home: string;
+  cwd: string;
+  operation: "" | "read" | "write" | "search";
+  target: string;
+  searchRoot: string;
+  glob: string;
+  commands: Command[];
+  uninspectable: string[];
+}

package/src/rules/appdata.ts

@@ -0,0 +1,82 @@
+// App Data rules. macOS records a Files & Folders App Data entry whenever a
+// process reads or enumerates another app's ~/Library data tree, so these deny
+// those reads and the broad walks that reach them.
+import { basename } from "node:path";
+import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths.ts";
+import { reasons } from "../reasons.ts";
+import type { Command, Request } from "../record.ts";
+
+const { appdata: appdataReason, broad: broadReason } = reasons;
+
+const trees = appdataTrees.join("|");
+// These print or assign their arguments; only a glob the shell expands before
+// they run reads a directory.
+export const dataPrograms = new Set(["echo", "printf", "print", ":", "true", "false", "export", "set", "unset", "typeset", "declare", "local"]);
+const noWalkPrograms = new Set(["mv", "stat", "test", "[", "mkdir"]);
+
+export function appdataRules(req: Request): string[] {
+  const denials: string[] = [];
+  if ((req.operation === "read" || req.operation === "write") && isAppdata(req.target, req.home)) denials.push(appdataReason);
+  if (req.operation === "search") {
+    if (isAppdata(req.searchRoot, req.home)) denials.push(appdataReason);
+    else if (isLibrary(req.searchRoot, req.home)) denials.push(broadReason);
+  }
+  for (const cmd of req.commands) {
+    const reason = appdataCommand(cmd, req.home);
+    if (reason) denials.push(reason);
+  }
+  const home = req.home.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const signature = new RegExp(`(~|\\$HOME|\\$\\{HOME\\}|${home})/Library/(${trees})`);
+  for (const fragment of req.uninspectable) if (signature.test(fragment)) denials.push(appdataReason);
+  return denials;
+}
+
+function appdataCommand(cmd: Command, home: string): string | undefined {
+  const cwd = cmd.cwd;
+  const prog = cmd.program >= 0 ? basename(cmd.argv[cmd.program].text) : "";
+  const data = dataPrograms.has(prog);
+  // cd reads its target but walks nothing.
+  const recursive = cmd.argv.slice(cmd.program + 1).some((word) =>
+    (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
+  const gitConfig = prog === "git" && cmd.argv.slice(cmd.program + 1).some((word) => word.text === "config");
+  const walk = !data && !gitConfig && !["cd", "pushd", "popd"].includes(prog) && !noWalkPrograms.has(prog) && !(["ls", "cp"].includes(prog) && !recursive);
+  const paths: { path: string; glob: boolean }[] = [];
+  for (const [i, word] of cmd.argv.entries()) {
+    if (!word.value || ["pattern", "code", "option:pattern", "optarg"].includes(word.role)) continue;
+    if (word.role === "program" && !word.value.includes("/")) continue;
+    if (data && !word.globs && i > cmd.program) continue;
+    // An expansion the front end cannot resolve may well be $HOME.
+    if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "s").test(word.value)) return appdataReason;
+    paths.push({ path: absPath(word.value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
+  }
+  for (const r of cmd.redirects) {
+    if ((r.direction === "in" || r.direction === "out") && r.target) paths.push({ path: absPath(r.target, cwd, home), glob: false });
+  }
+  if (paths.some(({ path, glob }) => isAppdata(path, home, glob))) return appdataReason;
+  // Shell glob expansion touches directories even when the command does not walk them.
+  if (paths.some(({ path, glob }) => isBroad(path, home, glob) && (walk || glob))) return broadReason;
+  if (cmd.program < 0) return undefined;
+
+  // Path operands scope a walk away from the current directory; a search
+  // tool's pattern is not one of them.
+  let scoped = false;
+  let noignore = cmd.flags.has("noignore");
+  for (const word of cmd.argv.slice(cmd.program + 1)) {
+    const text = word.text;
+    if ((word.role === "arg" || word.role === "path") && !text.startsWith("-")) scoped = true;
+    if (/^--(unrestricted|no-ignore)/.test(text)) noignore = true;
+    if (prog === "fd" && /^-[^-]*[uI]/.test(text)) noignore = true;
+    // A positive glob reaching Library overrides the ignore filter.
+    if (word.role === "glob" || word.role === "option:glob") {
+      const glob = new Bun.Glob(word.value.toLowerCase());
+      if (["library", ...appdataTrees.map((tree) => `library/${tree.toLowerCase()}/x`)].some((path) => glob.match(path))) noignore = true;
+    }
+  }
+  if (prog === "ls" && !scoped && isAppdata(cwd, home)) return appdataReason;
+  // rg and fd also read ignore files from cwd when given a path operand.
+  let denied = false;
+  if (prog === "find" || prog === "du") denied = !scoped && (isBroad(cwd, home) || isAppdata(cwd, home));
+  else if (prog === "ls" || prog === "grep") denied = !scoped && recursive && isBroad(cwd, home);
+  else if (prog === "rg" || prog === "fd") denied = !scoped && (noignore ? isBroad(cwd, home) : isLibrary(cwd, home));
+  return denied ? broadReason : undefined;
+}

package/src/rules/credentials.ts

@@ -0,0 +1,193 @@
+// Credential rules: keep credential files, environment and shell-variable
+// dumps, stored tokens and verbose HTTP traces out of what the model reads.
+// Clients that consume a credential file themselves (dotenvx, node --env-file,
+// ssh -i) are not readers and stay allowed.
+import { basename } from "node:path";
+import { absPath, isSensitive, sshPrivate, sshScopeDenied } from "../paths.ts";
+import { reasons } from "../reasons.ts";
+import type { Command, Request } from "../record.ts";
+
+const readerPrograms = new Set(
+  ("cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
+    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack").split(" "),
+);
+const {
+  file: fileReason, dump: dumpReason, variable: varReason, token: tokenReason,
+  keychain: keychainReason, trace: traceReason, upload: uploadReason,
+  ssh: sshReason, grepSsh: grepSshReason,
+} = reasons;
+
+const secretName = (name: string) => /TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL/.test(name.toUpperCase());
+
+export function credentialRules(req: Request): string[] {
+  const denials: string[] = [];
+  if (req.operation === "read" && isSensitive(req.target)) denials.push(fileReason);
+  if (req.operation === "write" && sshPrivate(req.target)) denials.push(sshReason);
+  if (req.operation === "search") {
+    if (isSensitive(req.searchRoot)) denials.push(fileReason);
+    // A positive glob selects files even past ignore rules.
+    if (req.glob && !req.glob.startsWith("!") && isSensitive(`${req.searchRoot}/${basename(req.glob)}`, true)) denials.push(fileReason);
+  }
+  for (const cmd of req.commands) denials.push(...credentialCommand(cmd, req.home));
+  for (const fragment of req.uninspectable) denials.push(...credentialSignatures(fragment));
+  return denials;
+}
+
+// The core runs this last: it follows symlinks, so it touches the filesystem.
+export function credentialFilesystemRules(req: Request): string[] {
+  if ((req.operation === "read" || req.operation === "write") && sshScopeDenied(req.target, req.home, false)) return [sshReason];
+  if (req.operation === "search" && sshScopeDenied(req.searchRoot, req.home, true)) return [grepSshReason];
+  return [];
+}
+
+function credentialCommand(cmd: Command, home: string): string[] {
+  const denials: string[] = [];
+  const sensitive = (word: string, glob = false, quoted = false) => isSensitive(absPath(word, cmd.cwd, home, quoted), glob);
+  for (const r of cmd.redirects) if (r.direction === "in" && sensitive(r.target)) denials.push(fileReason);
+  if (cmd.program < 0) {
+    if (cmd.wrappers.at(-1) === "env" && !cmd.wrappers.includes("env-S")) denials.push(dumpReason);
+    return denials;
+  }
+  const program = cmd.argv[cmd.program].text;
+  const name = basename(program);
+  const words = cmd.argv.slice(cmd.program + 1);
+  const args = words.map((w) => w.text);
+  // Shell variables exist only in the shell, so a path or a wrapper that
+  // execs a program never reaches these builtins.
+  if (cmd.shell && !program.includes("/")) {
+    if (name === "export" && (!args.length || args.some((a) => /^-[^-]*p/.test(a)))) denials.push(dumpReason);
+    if (name === "set" && !args.length) denials.push(dumpReason);
+    if (name === "typeset" || name === "declare") {
+      if (!args.length || (args.length === 1 && /^-[^-]*[px]/.test(args[0]))) denials.push(dumpReason);
+      for (const a of args) if (!a.startsWith("-") && !a.includes("=") && secretName(a)) denials.push(varReason);
+    }
+  }
+  let display = readerPrograms.has(name) || ["echo", "printf", "print"].includes(name);
+  const operands = args.filter((a) => !a.startsWith("-"));
+  switch (name) {
+    case "printenv":
+      if (!operands.length) denials.push(dumpReason);
+      for (const a of operands) if (secretName(a)) denials.push(varReason);
+      break;
+    case "echo":
+    case "printf":
+    case "print":
+      if (name !== "echo" && args[0] === "-v") display = false;
+      if (display && words.some((w) => w.vars.some(secretName))) denials.push(varReason);
+      break;
+    case "rg":
+    case "grep":
+    case "ag":
+    case "ack":
+      if (cmd.flags.has("help")) break;
+      for (const w of words) {
+        if (w.role === "path" && absPath(w.value, cmd.cwd, home, /^['"]/.test(w.raw)) === `${home}/.ssh`) denials.push(sshReason);
+      }
+      if (cmd.flags.has("files")) break;
+      // Search operands, pattern files and positive globs are read targets;
+      // the pattern is not.
+      for (const w of words) {
+        if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
+        if (["glob", "option:glob"].includes(w.role) && sensitive(basename(w.value), true)) denials.push(fileReason);
+      }
+      break;
+    case "gh":
+      if (args[0] === "auth" && args[1] === "token") denials.push(tokenReason);
+      if (args[0] === "auth" && args[1] === "status" && ghShowsToken(args.slice(2))) denials.push(tokenReason);
+      break;
+    case "glab":
+      if (args[0] === "auth" && args[1] === "status" && args.some((a) => /^(--show-token|-[^-]*t)/.test(a))) denials.push(tokenReason);
+      break;
+    case "security":
+      if (args.includes("-w") || args.includes("-g")) denials.push(keychainReason);
+      break;
+    case "curl":
+      denials.push(...curlRules(args, sensitive));
+      break;
+    default:
+      if (!readerPrograms.has(name)) return denials;
+      let jqFilter = name === "jq" && !args.includes("-f") && !args.includes("--from-file");
+      for (const w of words) {
+        if (jqFilter && !w.text.startsWith("-")) {
+          jqFilter = false;
+          continue;
+        }
+        const target = /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
+        if (target && !target.startsWith("-") && sensitive(target, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
+      }
+  }
+  // A heredoc or here-string body is standard input the command prints.
+  if (display && cmd.redirects.some((r) => r.vars.some(secretName))) denials.push(varReason);
+  return denials;
+}
+
+// A token-display flag counts even when a later flag cancels it.
+function ghShowsToken(args: string[]): boolean {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") return false;
+    if (["--hostname", "--jq", "--json", "--template", "-h"].includes(a)) i++;
+    else if (a === "--show-token" || a.startsWith("--show-token=") || /^-[at]*t/.test(a)) return true;
+  }
+  return false;
+}
+
+// curl reads ~/.curlrc and may add credentials the command line never shows,
+// so any trace is denied; @file data and uploads name files it sends.
+function curlRules(args: string[], sensitive: (word: string) => boolean): string[] {
+  const denials: string[] = [];
+  const long = /^--(data|data-ascii|data-binary|data-urlencode|json|form|header|upload-file|config)(=|$)/s;
+  for (let i = 0; i < args.length; i++) {
+    const word = args[i];
+    let key = "";
+    let value = "";
+    if (word === "--") break;
+    if (/^--(verbose|trace|trace-ascii)(=|$)/.test(word)) denials.push(traceReason);
+    else if (long.test(word)) {
+      key = word.slice(2).split("=")[0];
+      value = word.includes("=") ? word.slice(word.indexOf("=") + 1) : (args[++i] ?? "");
+    } else if (/^-[^-]/.test(word)) {
+      for (let k = 1; k < word.length; k++) {
+        if (word[k] === "v") denials.push(traceReason);
+        if (!"AbcCdDeEFHKmoPQrTtuUwxXyYz".includes(word[k])) continue;
+        key = word[k];
+        value = word.slice(k + 1) || (args[++i] ?? "");
+        break;
+      }
+    }
+    if (key === "d" || key.startsWith("data") || key === "json" || key === "H" || key === "header") {
+      if (!/@./s.test(value)) continue;
+      value = value.slice(value.indexOf("@") + 1);
+    } else if (key === "F" || key === "form") {
+      value = value.slice(value.indexOf("=") + 1).replace(/^[@<]/, "").split(";")[0];
+    } else if (!["T", "upload-file", "K", "config"].includes(key)) continue;
+    if (sensitive(value)) denials.push(uploadReason);
+  }
+  return denials;
+}
+
+const readers = [...readerPrograms].filter((p) => p !== ".").join("|");
+const names =
+  "\\.env(\\.(local|production|staging|development))?|\\.npmrc|\\.zsh_history|\\.zprofile|private-keys-v1\\.d|\\S*\\.(pem|key)|auth\\.json|\\.credentials\\.json|\\.aws/credentials|\\.ssh/\\S*";
+const readerSignature = new RegExp(`(^|[^A-Za-z0-9_])(${readers})([^A-Za-z0-9_-].*)?[\\s/"'=](${names})($|[\\s/"'>|&)\`])`, "s");
+
+// Text the front end could not structure: interpreter code, case bodies, or
+// source the parser rejects. Match the commands that would expose a credential.
+function credentialSignatures(fragment: string): string[] {
+  const denials: string[] = [];
+  for (const segment of fragment.replace(/&&|\|\||\n/g, ";").split(";")) {
+    if (
+      /(^|[^A-Za-z0-9_-])printenv([^A-Za-z0-9_-]|$)/.test(segment) ||
+      /(^|[|(])\s*(env|export|set|typeset|declare)\s*($|[|>)])/.test(segment) ||
+      /(declare|typeset|export)\s+-[a-z]*[px]/.test(segment)
+    )
+      denials.push(dumpReason);
+    const reader = segment.match(readerSignature);
+    if (reader && !(reader[4].startsWith(".ssh/") && !sshPrivate(`/${reader[4]}`))) denials.push(fileReason);
+    if (/curl\s.*\s(-[A-Za-z]*v[A-Za-z]*|--verbose|--trace(-ascii)?)(\s|=|$)/s.test(segment)) denials.push(traceReason);
+    if (/gh\s+auth\s+token/.test(segment)) denials.push(tokenReason);
+    if (/security\s.*\s-[wg](\s|$)/s.test(segment)) denials.push(keychainReason);
+    if (/(ECHO|PRINTF|PRINT)\s.*\$\{?[A-Z0-9_]*(TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL)/s.test(segment.toUpperCase())) denials.push(varReason);
+  }
+  return denials;
+}

package/src/rules/workflow.ts

@@ -0,0 +1,38 @@
+// Workflow rules differ by runtime; the safety rules do not.
+// Codex: run claude through the provider-aware launcher function, which picks
+// the persisted provider mode before gateway credentials are expanded.
+import { basename } from "node:path";
+import { reasons } from "../reasons.ts";
+import type { Request } from "../record.ts";
+
+const {
+  find: findReason, replace: replaceReason, include: includeReason,
+  bre: breReason, launcher: launcherReason,
+} = reasons;
+
+export function claudeWorkflowRules(req: Request): string[] {
+  const denials: string[] = [];
+  for (const cmd of req.commands) {
+    if (cmd.program < 0) continue;
+    const name = basename(cmd.argv[cmd.program].text);
+    if (name === "find") denials.push(findReason);
+    if (name !== "rg") continue;
+    if (cmd.flags.has("replace")) denials.push(replaceReason);
+    if (cmd.flags.has("include")) denials.push(includeReason);
+    if (cmd.flags.has("fixed")) continue;
+    for (const w of cmd.argv.slice(cmd.program + 1)) {
+      if ((w.role === "pattern" || w.role === "option:pattern") && /(^|[^\\])\\\|/.test(w.value)) denials.push(breReason);
+    }
+  }
+  return denials;
+}
+
+export function codexWorkflowRules(req: Request): string[] {
+  const denials: string[] = [];
+  for (const cmd of req.commands) {
+    if (cmd.program < 0) continue;
+    const program = cmd.argv[cmd.program].text;
+    if (basename(program) === "claude" && (program.includes("/") || cmd.wrappers.length)) denials.push(launcherReason);
+  }
+  return denials;
+}

package/src/search-roles.ts

@@ -0,0 +1,76 @@
+import type { Command, ValueRole, Word } from "./record.ts";
+
+const rgShortValues = "efgtTEABCmMjrd";
+const rgLongValues = new Set(
+  ("regexp file glob iglob type type-not encoding replace color colors sort sortr max-depth max-filesize pre pre-glob " +
+    "engine threads max-columns type-add type-clear path-separator context-separator field-context-separator " +
+    "field-match-separator after-context before-context context max-count ignore-file dfa-size-limit " +
+    "regex-size-limit hyperlink-format").split(" "),
+);
+const grepShortValues = "efABCmdD";
+const grepLongValues = new Set(
+  ("regexp file include exclude exclude-dir exclude-from label context after-context before-context max-count " +
+    "binary-files devices directories").split(" "),
+);
+
+export function searchRoles(cmd: Command, args: Word[], prog: string) {
+  const rg = prog === "rg";
+  const shortValues = rg ? rgShortValues : grepShortValues;
+  const longValues = rg ? rgLongValues : grepLongValues;
+  const flags = cmd.flags;
+  const operands: Word[] = [];
+  let options = true;
+
+  const value = (at: number, key: string, text: string) => {
+    const target = args[at];
+    if (!target) return;
+    let role: ValueRole = "optarg";
+    if (key === "e" || key === "regexp") (role = "pattern"), flags.add("explicit");
+    else if (key === "f" || key === "file") (role = "patfile"), flags.add("explicit");
+    else if (["g", "glob", "iglob", "include"].includes(key)) role = text.startsWith("!") ? "nglob" : "glob";
+    target.role = target.role === "option" ? `option:${role}` : role;
+    target.value = text;
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    const word = args[i].text;
+    if (options && word === "--") {
+      options = false;
+      args[i].role = "option";
+    } else if (options && /^--./.test(word)) {
+      args[i].role = "option";
+      const key = word.slice(2).split("=")[0];
+      if (key === "files") flags.add("files");
+      else if (key === "help" || key === "version") flags.add("help");
+      else if (key.startsWith("no-ignore") || key === "unrestricted") flags.add("noignore");
+      else if (key === "fixed-strings") flags.add("fixed");
+      else if (key === "recursive") flags.add("recursive");
+      else if (key === "include") flags.add("include");
+      if (word.includes("=")) value(i, key, word.slice(word.indexOf("=") + 1));
+      else if (longValues.has(key)) i++, value(i, key, args[i]?.text ?? "");
+    } else if (options && /^-./.test(word)) {
+      args[i].role = "option";
+      for (let k = 1; k < word.length; k++) {
+        const c = word[k];
+        if ((rg || prog === "grep") && c === "F") flags.add("fixed");
+        if (rg && c === "u") flags.add("noignore");
+        if (prog === "grep" && (c === "r" || c === "R")) flags.add("recursive");
+        if ((rg && c === "h") || c === "V") flags.add("help");
+        if (rg && c === "r") flags.add("replace");
+        if (!shortValues.includes(c)) continue;
+        let text = word.slice(k + 1);
+        if (rg) text = text.replace(/^=/, "");
+        if (!text) i++, (text = args[i]?.text ?? "");
+        value(i, c, text);
+        break;
+      }
+    } else {
+      operands.push(args[i]);
+    }
+  }
+  let explicit = flags.has("explicit") || flags.has("files");
+  for (const operand of operands) {
+    operand.role = explicit ? "path" : "pattern";
+    explicit = true;
+  }
+}

package/src/words.ts

@@ -0,0 +1,62 @@
+import sh from "mvdan-sh";
+import type { DblQuoted, Lit, Node, ParamExp, SglQuoted, Word as WordNode } from "mvdan-sh";
+import { expandHome } from "./paths.ts";
+import type { Word } from "./record.ts";
+
+const type = sh.syntax.NodeType;
+
+export function readWord(
+  node: WordNode,
+  slice: (start: number, end: number) => string,
+  vars: Map<string, string>,
+  home: string,
+  visit: (part: Node, names: string[]) => void,
+): Word {
+  const text = (part: Node) => slice(part.Pos().Offset(), part.End().Offset());
+  const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "" };
+  const expansion = (part: Node) => {
+    const param = part as ParamExp;
+    const plain = type(part) === "ParamExp" &&
+      !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
+    const known = plain ? (param.Param.Value === "HOME" ? home : vars.get(param.Param.Value)) : undefined;
+    out.text += known ?? text(part);
+    out.expands ||= known === undefined;
+    visit(part, out.vars);
+  };
+  node.Parts.forEach((part, index) => {
+    const kind = type(part);
+    if (kind === "Lit") {
+      let value = (part as Lit).Value;
+      if (index === 0) value = expandHome(value, home);
+      if (Bun.$.braces(value).length > 1) out.globs = true;
+      for (let i = 0; i < value.length; i++) {
+        if (value[i] === "\\") {
+          out.text += value[++i] ?? "";
+          continue;
+        }
+        if ("*?[".includes(value[i])) out.globs = true;
+        out.text += value[i];
+      }
+    } else if (kind === "SglQuoted") {
+      const quoted = part as SglQuoted;
+      out.text += quoted.Dollar
+        ? quoted.Value.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|([0-7]{1,3})|(.))/gs, (match, hex, unicode, octal, char) => {
+            if (hex || unicode || octal) return String.fromCodePoint(parseInt(hex ?? unicode ?? octal, octal ? 8 : 16));
+            return ({ a: "\x07", b: "\b", e: "\x1b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v" } as Record<string, string>)[char] ?? char;
+          })
+        : quoted.Value;
+    } else if (kind === "DblQuoted") {
+      for (const inner of (part as DblQuoted).Parts) {
+        if (type(inner) === "Lit") out.text += (inner as Lit).Value.replace(/\\\n/g, "").replace(/\\([$`"\\])/g, "$1");
+        else expansion(inner);
+      }
+    } else if (kind === "ExtGlob") {
+      out.globs = true;
+      out.text += text(part);
+    } else {
+      expansion(part);
+    }
+  });
+  out.value = out.text;
+  return out;
+}