@loophubs/agent-guard 0.2.0 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loophubs/agent-guard",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Blocks filesystem scans and credential reads that macOS records as TCC App Data access, and points the agent at a safe alternative.",
   "homepage": "https://github.com/LoopHubs/agent-guard#readme",
   "bugs": {

package/src/argv.ts

@@ -4,10 +4,17 @@ import { expandHome } from "./paths";
 import type { Command, Word } from "./record";
 import { searchRoles } from "./search-roles";
 
-const shellPrograms = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+const shellPrograms = new Set(["sh", "bash", "zsh", "dash", "ksh", "csh", "tcsh"]);
 const codePrograms = new Set(["python", "python3", "node", "bun", "deno", "ruby", "perl", "php", "osascript", "lua"]);
 const zshBuiltins = new Set(["echo", "printf", "print", "export", "typeset", "declare", "set", "command", "eval", "source", "."]);
 const shellCodeFlag = /^-[a-z]*c[a-z]*$/;
+const sudoValueOption = /^(-[A-Za-z]*[ughpCDRTrtU]|--(user|group|host|prompt|chdir|chroot|role|type|other-user|close-from|command-timeout))$/;
+
+// egrep and fgrep are grep with a fixed matcher.
+export function programName(text: string): string {
+  const name = basename(text);
+  return name === "egrep" || name === "fgrep" ? "grep" : name;
+}
 
 export function resolveCommand(cmd: Command, home: string): { children: string[]; code: string[] } {
   const w = cmd.argv;
@@ -58,6 +65,31 @@ export function resolveCommand(cmd: Command, home: string): { children: string[]
         if (w[i]?.text === "-n" || w[i]?.text === "--adjustment") i += 2;
         else if (/^(-n|--adjustment=|-\d)/.test(w[i]?.text ?? "")) i++;
         break;
+      case "sudo":
+      case "doas":
+        w[i++]!.role = "precommand";
+        while (i < w.length && w[i]!.text !== "--" && (w[i]!.text.startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(w[i]!.text))) {
+          if (sudoValueOption.test(w[i]!.text)) w[++i]!.role = "precommand";
+          w[i++]!.role = "precommand";
+        }
+        if (w[i]?.text === "--") w[i++]!.role = "precommand";
+        break;
+      case "script":
+        // script [-adkpqr] [-F pipe] [-t time] [file [command ...]]
+        w[i++]!.role = "precommand";
+        while (w[i]?.text?.startsWith("-")) {
+          if (["-F", "-t"].includes(w[i]!.text)) i++;
+          i++;
+        }
+        if (w[i]) w[i++]!.role = "precommand";
+        break;
+      case "arch":
+        w[i++]!.role = "precommand";
+        while (w[i]?.text?.startsWith("-")) {
+          if (["-e", "-d", "-arch"].includes(w[i]!.text)) i++;
+          i++;
+        }
+        break;
       case "stdbuf":
         w[i++]!.role = "precommand";
         while (/^-[ioe]/.test(w[i]?.text ?? "")) {
@@ -130,7 +162,7 @@ export function resolveCommand(cmd: Command, home: string): { children: string[]
   cmd.program = i;
   w[i]!.role = "program";
   if (w[i]!.text.startsWith("=") && w[i]!.text.length > 1) w[i]!.text = w[i]!.text.slice(1);
-  const name = basename(w[i]!.text);
+  const name = programName(w[i]!.text);
   const rest = w.slice(i + 1);
   if (["rg", "grep", "ag", "ack"].includes(name)) {
     searchRoles(cmd, rest, name);

package/src/frontend.ts

@@ -5,7 +5,7 @@ import { existsSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 
-import type { Assign, BinaryCmd, CallExpr, CmdSubst, DeclClause, IfClause, Lit, Node, ParamExp, Redirect as RedirectNode, Stmt, Subshell, Word as WordNode } from "mvdan-sh";
+import type { Assign, BinaryCmd, CallExpr, CmdSubst, DeclClause, FuncDecl, IfClause, Lit, Node, ParamExp, Redirect as RedirectNode, Stmt, Subshell, Word as WordNode } from "mvdan-sh";
 import sh from "mvdan-sh";
 
 import { resolveCommand, stdinKind } from "./argv";
@@ -13,7 +13,7 @@ import { misreadComment } from "./comments";
 import { boundedDirectories } from "./cwd";
 import { movedOnSuccess } from "./moves";
 import { expandHome } from "./paths";
-import { xargsReplacements } from "./pipeline";
+import { markWalkedInput, shellInput, xargsHereInput, xargsReplacements } from "./pipeline";
 import type { Command, Redirect, Script, Word } from "./record";
 import { readWord } from "./words";
 
@@ -40,6 +40,10 @@ interface Scope {
 
 const type = (node: Node) => syntax.NodeType(node);
 
+// A function call runs the body in the caller's shell; bound the work a chain of
+// calls can multiply.
+const maxFunctionRuns = 256;
+
 export function parseScript(source: string, cwd: string, home: string): Script {
   const script: Script = { commands: [], uninspectable: [], parseFailed: false };
 
@@ -60,6 +64,10 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     for (const stmt of file.Stmts) statement(stmt!, scope);
   }
 
+  const functions = new Map<string, { body: Stmt; slice: Scope["slice"] }>();
+  const running = new Set<string>();
+  let functionRuns = 0;
+
   const text = (node: Node, scope: Scope) => scope.slice(node.Pos().Offset(), node.End().Offset());
   // A cd inside runs in a separate shell and leaves this scope's cwd alone.
   const isolated = (scope: Scope): Scope => ({ ...scope, dir: { ...scope.dir }, vars: new Map(scope.vars) });
@@ -97,16 +105,26 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), ...old], home);
       return;
     }
-    statement(cmd.Y!, op === "||" ? failed : op === "&&" ? scope : isolated(scope));
-    if (op === "|") for (const item of xargsReplacements(script.commands.slice(start, middle), script.commands.slice(middle))) parse(item.source, item.cwd);
-    if (op === "||") {
-      scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), failed.dir.cwd, ...(failed.dir.alternatives ?? [])], home);
+    // zsh runs the last element of a pipeline in this shell and bash forks it,
+    // so a cd there may or may not move the commands after it.
+    const right = op === "||" ? failed : op === "&&" ? scope : isolated(scope);
+    statement(cmd.Y!, right);
+    if (op === "|" || op === "|&") {
+      const left = script.commands.slice(start, middle);
+      const rest = script.commands.slice(middle);
+      markWalkedInput(left, rest);
+      for (const item of [...xargsReplacements(left, rest), ...shellInput(left, rest)]) parse(item.source, item.cwd);
     }
+    if (op !== "&&") scope.dir.alternatives = boundedDirectories(scope.dir.cwd, [...(scope.dir.alternatives ?? []), right.dir.cwd, ...(right.dir.alternatives ?? [])], home);
   }
 
   // Compound words may hold substitutions; branch bodies may not run.
   function children(node: Node, scope: Scope) {
-    if (type(node) === "FuncDecl") scope = isolated(scope);
+    if (type(node) === "FuncDecl") {
+      const func = node as FuncDecl;
+      if (func.Name && func.Body) functions.set(func.Name.Value, { body: func.Body, slice: scope.slice });
+      scope = isolated(scope);
+    }
     if (type(node) === "IfClause") return conditional(node as IfClause, scope);
     const outer = scope;
     const loop = type(node) === "WhileClause" || type(node) === "ForClause";
@@ -157,7 +175,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
   }
 
   function word(node: WordNode, scope: Scope): Word {
-    return readWord(node, scope.slice, scope.vars, home, (part, names) => expansions(part, scope, names));
+    return readWord(node, scope.slice, scope.vars, home, scope.dir.cwd, (part, names) => expansions(part, scope, names));
   }
 
   function assign(node: Assign, scope: Scope, role: "assign" | "arg"): Word {
@@ -171,7 +189,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       return type(child) !== "Word";
     });
     return {
-      ...(value ?? { expands: false, globs: false, vars: [] }),
+      ...(value ?? { expands: false, globs: false, vars: [], pwd: false }),
       text: `${name}=${value?.text ?? ""}`,
       raw: text(node, scope),
       role,
@@ -180,7 +198,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
   }
 
   function literal(value: string): Word {
-    return { text: value, raw: value, expands: false, globs: false, vars: [], role: "arg", value };
+    return { text: value, raw: value, expands: false, globs: false, vars: [], role: "arg", value, pwd: false };
   }
 
   function simple(cmd: Node | null, redirs: (RedirectNode | null)[], scope: Scope) {
@@ -208,7 +226,8 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     };
     script.commands.push(command);
     const { children: sources, code } = resolveCommand(command, home);
-    for (const cwd of scope.dir.alternatives ?? []) script.commands.push({ ...command, cwd });
+    const moved = (cwd: string) => command.argv.map((w) => (w.pwd ? { ...w, text: w.text.replaceAll(scope.dir.cwd, cwd), value: w.value.replaceAll(scope.dir.cwd, cwd) } : w));
+    for (const cwd of scope.dir.alternatives ?? []) script.commands.push({ ...command, cwd, argv: moved(cwd) });
     for (const src of sources) for (const cwd of [command.cwd, ...(scope.dir.alternatives ?? [])]) parse(src, cwd);
     script.uninspectable.push(...code);
     for (const r of redirects) {
@@ -216,6 +235,17 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       const stdin = stdinKind(command);
       if (stdin === "shell") parse(r.target, command.cwd);
       if (stdin === "code") script.uninspectable.push(r.target);
+      if (command.wrappers.includes("xargs")) for (const item of xargsHereInput(command, r.target)) parse(item.source, item.cwd);
+    }
+    const called = command.wrappers.every((w) => w === "time") ? command.argv[command.program]?.text : undefined;
+    const func = called === undefined ? undefined : functions.get(called);
+    if (func && !running.has(called!)) {
+      if (++functionRuns > maxFunctionRuns) script.parseFailed = true;
+      else {
+        running.add(called!);
+        statement(func.body, { ...scope, slice: func.slice });
+        running.delete(called!);
+      }
     }
     track(command, scope);
   }
@@ -226,13 +256,13 @@ export function parseScript(source: string, cwd: string, home: string): Script {
       const quoted = node.Word!.Parts.some((p) => type(p) !== "Lit" || (p as Lit).Value.includes("\\"));
       const vars: string[] = [];
       if (node.Hdoc && !quoted) expansions(node.Hdoc, scope, vars);
-      return { direction: "heredoc", target: node.Hdoc ? text(node.Hdoc, scope) : "", vars };
+      return { direction: "heredoc", target: node.Hdoc ? text(node.Hdoc, scope) : "", globs: false, vars };
     }
     const target = word(node.Word!, scope);
-    if (op === "<<<") return { direction: "herestring", target: target.text, vars: target.vars };
+    if (op === "<<<") return { direction: "herestring", target: target.text, globs: false, vars: target.vars };
     if ((op === "<&" || op === ">&") && /^(\d+|-)$/.test(target.text)) return undefined;
     const direction = op === "<" || op === "<>" ? "in" : "out";
-    return { direction, target: target.text, vars: [] };
+    return { direction, target: target.text, globs: target.globs, vars: [] };
   }
 
   function track(command: Command, scope: Scope) {
@@ -245,7 +275,7 @@ export function parseScript(source: string, cwd: string, home: string): Script {
     if (!program || !command.shell || !["cd", "pushd"].includes(program.text)) return;
     const args = command.argv.slice(command.program + 1);
     let target = args.find((w) => !w.text.startsWith("-"))?.text;
-    if (target === undefined && (!args.length || (args.length === 1 && args[0]?.text === "--")) && program.text === "cd") target = home;
+    if (target === undefined && args.every((w) => /^(--|-[PLqs]+)$/.test(w.text)) && program.text === "cd") target = home;
     if (target !== undefined) {
       scope.dir.alternatives = boundedDirectories(
         resolve(scope.dir.cwd, target),

package/src/links.ts

@@ -1,6 +1,7 @@
 import { readlinkSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 
+import { programName } from "./argv";
 import { absPath, expandHome, isAppdata, isSensitive } from "./paths";
 import type { Request, Word } from "./record";
 import { dataPrograms } from "./rules/appdata";
@@ -45,14 +46,26 @@ export function linkedRequest(req: Request): Request | undefined {
     const value = linked(w.value, cwd, /^['"]/.test(w.raw));
     return value === w.value ? w : { ...w, value, text: w.role.startsWith("option:") ? w.text : value };
   };
+  // curl reads the file after @ or < in a data or form value, or one glued to -T, -K, --upload-file or --config.
+  const curlOperand = /^((?:-[A-Za-z]|--[a-z-]+=|[^=@<-][^=@<]*=)?[@<])([^;]+)(.*)$/s;
+  const curlFile = /^(-[TK]|--(?:upload-file|config)=)([^;]+)()$/s;
+  const curlWord = (w: Word, cwd: string): Word | undefined => {
+    const operand = curlOperand.exec(w.text) ?? curlFile.exec(w.text);
+    if (!operand || w.expands) return undefined;
+    const value = linked(operand[2]!, cwd);
+    return value === operand[2] ? w : { ...w, text: `${operand[1]}${value}${operand[3]}` };
+  };
   const commands = req.commands.map((cmd) => {
+    const curl = cmd.program >= 0 && programName(cmd.argv[cmd.program]!.text) === "curl";
     const checkedCwd = linked(cmd.cwd, "/");
     const cwd = checkedCwd === cmd.cwd ? absPath(cmd.cwd, "/", req.home) : checkedCwd;
     if (cwd !== cmd.cwd) changed = true;
     return {
       ...cmd,
       cwd,
-      argv: cmd.argv.map((w, i) => (dataPrograms.has(basename(cmd.argv[cmd.program]?.text ?? "")) && i > cmd.program ? w : word(w, cmd.cwd))),
+      argv: cmd.argv.map((w, i) =>
+        dataPrograms.has(basename(cmd.argv[cmd.program]?.text ?? "")) && i > cmd.program ? w : curl && i > cmd.program ? (curlWord(w, cmd.cwd) ?? word(w, cmd.cwd)) : word(w, cmd.cwd),
+      ),
       redirects: cmd.redirects.map((r) => ((r.direction === "in" || r.direction === "out") && r.target ? { ...r, target: linked(r.target, cmd.cwd) } : r)),
     };
   });

package/src/paths.ts

@@ -17,6 +17,14 @@ export const sensitivePaths = [
   "**/auth.json*",
   "**/.credentials.json*",
   "**/.aws/credentials*",
+  "**/.netrc",
+  "**/.git-credentials",
+  "**/.docker/config.json",
+  "**/.kube/config",
+  "**/.pypirc",
+  "**/.pgpass",
+  "**/.cargo/credentials*",
+  "**/.config/gh/hosts.yml",
   "**/private-keys-v1.d",
   "**/private-keys-v1.d/**",
 ];
@@ -27,6 +35,11 @@ const sensitiveGlobs = sensitivePaths.map((path) => new Bun.Glob(path));
 // ~/.ssh has its own inode-based check and reason.
 const credentialRoots = [".aws", ".gnupg"];
 const credentialDirectories = [".ssh", ...credentialRoots];
+// The directory part of each listed file that sits in a named directory, such as .kube for .kube/config.
+const listedDirectories = sensitivePaths.flatMap((listed) => {
+  const tail = listed.replace(/^\*\*\//, "").split("/");
+  return tail.length > 1 && !tail.slice(0, -1).some((part) => part.includes("*")) ? [tail.slice(0, -1).join("/")] : [];
+});
 
 export function expandHome(path: string, home: string): string {
   for (const prefix of ["~", `~${userInfo().username}`]) {
@@ -112,14 +125,66 @@ export function isSensitive(path: string, glob = false): boolean {
   if (!glob) return false;
   if (globDirectory(path)) return true;
   const base = basename(lower);
-  if (/^[*?]*$/.test(base)) return credentialDirectories.includes(basename(dirname(lower)));
-  const pattern = new Bun.Glob(base);
+  // A bare wildcard reaches every file in the directory, so a directory that holds a listed file counts.
+  if (/^[*?]*$/.test(base)) return credentialDirectories.includes(basename(dirname(lower))) || listedDirectories.some((dir) => dirname(lower).endsWith(`/${dir}`));
+  // A listed file inside a named directory needs the glob's directory to match too.
+  const segments = lower.split("/");
   return sensitivePaths.some((listed) => {
-    const name = basename(listed).replaceAll("*", "x");
-    return !/^x*$/.test(name) && pattern.match(name);
+    const tail = listed.replace(/^\*\*\//, "").split("/");
+    if (tail.length > segments.length) return false;
+    if (/^\**$/.test(tail.at(-1)!)) return false;
+    const names = tail.map((part) => part.replaceAll("*", "x"));
+    const offset = segments.length - tail.length;
+    if (!names.slice(0, -1).every((name, i) => new Bun.Glob(segments[offset + i]!).match(name))) return false;
+    // A named directory already narrows the match, so a glob that could reach any listed name in it counts.
+    return tail.length > 1 ? globsIntersect(segments.at(-1)!, tail.at(-1)!) : new Bun.Glob(segments.at(-1)!).match(names.at(-1)!);
   });
 }
 
+type GlobToken = "*" | ((char: string) => boolean);
+
+// Reads `*`, `?`, `[set]` and literal characters; a backslash escapes the next one.
+function globTokens(glob: string): GlobToken[] {
+  const tokens: GlobToken[] = [];
+  for (let i = 0; i < glob.length; i++) {
+    const char = glob[i]!;
+    const close = char === "[" ? glob.indexOf("]", i + 2) : -1;
+    if (char === "*") tokens.push("*");
+    else if (char === "?") tokens.push(() => true);
+    else if (close > 0) {
+      const matcher = new Bun.Glob(glob.slice(i, close + 1));
+      tokens.push((c) => matcher.match(c));
+      i = close;
+    } else {
+      const literal = char === "\\" ? (glob[++i] ?? char) : char;
+      tokens.push((c) => c === literal);
+    }
+  }
+  return tokens;
+}
+
+// Whether some file name matches both wildcard patterns.
+function globsIntersect(a: string, b: string): boolean {
+  const [left, right] = [globTokens(a), globTokens(b)];
+  const probes = Array.from({ length: 94 }, (_, i) => String.fromCharCode(33 + i));
+  const seen = new Set<string>();
+  const walk = (i: number, j: number): boolean => {
+    const key = `${i},${j}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    const [x, y] = [left[i], right[j]];
+    if (x === undefined && y === undefined) return true;
+    if (x === "*" && walk(i + 1, j)) return true;
+    if (y === "*" && walk(i, j + 1)) return true;
+    if (x === "*" && y === "*") return false;
+    if (x === "*") return y !== undefined && walk(i, j + 1);
+    if (y === "*") return x !== undefined && walk(i + 1, j);
+    if (x === undefined || y === undefined) return false;
+    return probes.some((c) => x(c) && y(c)) && walk(i + 1, j + 1);
+  };
+  return walk(0, 0);
+}
+
 // A wildcard directory segment such as `.s*` may expand to a credential
 // directory. The shell's wildcards skip a leading dot, so only a segment that
 // starts with one counts.
@@ -134,8 +199,16 @@ function globDirectory(path: string): boolean {
 
 // A search reads everything under its root, so a credential directory counts as
 // its listed files do.
-export function isSensitiveRoot(path: string): boolean {
-  return isSensitive(path) || credentialRoots.includes(basename(path.toLowerCase()));
+export function isSensitiveRoot(path: string, home: string): boolean {
+  const lower = path.toLowerCase();
+  // A search from the home directory's .config reaches .config/gh because gh is not hidden.
+  const ancestors = listedDirectories.flatMap((dir) =>
+    dir
+      .split("/")
+      .slice(0, -1)
+      .map((_, i, parts) => `${home.toLowerCase()}/${parts.slice(0, i + 1).join("/")}`),
+  );
+  return isSensitive(path) || credentialRoots.includes(basename(lower)) || listedDirectories.some((dir) => lower.endsWith(`/${dir}`)) || ancestors.includes(lower);
 }
 
 // A path that does not exist or cannot be searched has no inode to compare.

package/src/pipeline.ts

@@ -1,15 +1,84 @@
 import { basename } from "node:path";
 
-import type { Command } from "./record";
+import { stdinKind } from "./argv";
+import type { Command, Word } from "./record";
 
-// A literal printf value is known before xargs substitutes it into a command.
-export function xargsReplacements(left: Command[], right: Command[]): { source: string; cwd: string }[] {
-  const printf = left.find((cmd) => cmd.program >= 0 && basename(cmd.argv[cmd.program]!.text) === "printf");
-  const xargs = right.find((cmd) => cmd.program >= 0 && cmd.wrappers.includes("xargs"));
-  if (!printf || !xargs) return [];
-  const args = printf.argv.slice(printf.program + 1);
-  if (args.length !== 2 || !/^%s(?:\\n)?$/.test(args[0]!.text)) return [];
+// fd and ls skip hidden files unless asked; find never does.
+export function showsHidden(words: Word[]): boolean {
+  return words.some((word) => /^(--hidden|--unrestricted)$/.test(word.text) || /^-[A-Za-z]*[Hu][A-Za-z]*$/.test(word.text));
+}
+
+// A dotfile name, or a glob the shell expands to dotfiles; `.` and `..` are directories.
+const hiddenName = (text: string) => /^\.(?!\.?$)/.test(basename(text));
+
+// xargs passes the names a walk printed to its command, so mark that command.
+export function markWalkedInput(left: Command[], right: Command[]) {
+  const walks = left.some((cmd) => {
+    const name = cmd.program >= 0 ? basename(cmd.argv[cmd.program]!.text) : "";
+    const args = cmd.argv.slice(cmd.program + 1);
+    const operands = args.filter((word) => !word.text.startsWith("-"));
+    if (name === "ls") return args.some((word) => /^(--all|--almost-all|-[A-Za-z0-9]*[aA][A-Za-z0-9]*)$/.test(word.text)) || operands.some((word) => hiddenName(word.text));
+    if (name === "echo" || name === "printf") return operands.some((word) => word.globs && hiddenName(word.text));
+    return name === "find" || (name === "fd" && showsHidden(args));
+  });
+  if (walks) for (const cmd of right) if (cmd.wrappers.includes("xargs")) cmd.flags.add("walked");
+}
+
+// printf and zsh's echo decode these escapes and stop at `\c`; a NUL separates xargs -0 items, so it reads as a line break.
+// A printf format takes up to three octal digits after the backslash; %b and echo take a leading 0 as well.
+const escapes: Record<string, string> = { n: "\n", t: "\t", "\\": "\\" };
+const unescape = (text: string, operand = false) =>
+  text
+    .split("\\c", 1)[0]!
+    .replace(
+      new RegExp(`\\\\(?:x([0-9a-fA-F]{1,2})|(${operand ? "0[0-7]{0,3}|[1-7][0-7]{0,2}" : "[0-7]{1,3}"})|([nt\\\\])|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8}))`, "g"),
+      (_, hex?: string, octal?: string, named?: string, unicode?: string, wide?: string) => {
+        const hexadecimal = hex ?? unicode ?? wide;
+        const code = hexadecimal !== undefined ? parseInt(hexadecimal, 16) : octal !== undefined ? parseInt(octal, 8) : undefined;
+        return code === undefined ? escapes[named!]! : code === 0 ? "\n" : String.fromCharCode(code);
+      },
+    );
+
+// What printf writes for a format built from literal text, %s, %b and %%; another conversion is unknown.
+function printfOutput(args: Word[]): string | undefined {
+  const [format, ...operands] = (args[0]?.text === "--" ? args.slice(1) : args).map((word) => word.text);
+  if (format === undefined) return "";
+  const pieces = format.split(/(%[sb%])/);
+  if (pieces.some((piece) => piece.includes("%") && !/^%[sb%]$/.test(piece))) return undefined;
+  const converts = pieces.some((piece) => /^%[sb]$/.test(piece));
+  let out = "";
+  do {
+    for (const piece of pieces) {
+      if (piece === "%%") out += "%";
+      else if (piece === "%s") out += operands.shift() ?? "";
+      else if (piece === "%b") out += unescape(operands.shift() ?? "", true);
+      else out += unescape(piece);
+    }
+  } while (converts && operands.length);
+  return out;
+}
 
+// A literal echo or printf value piped into a shell is the command line it runs.
+export function shellInput(left: Command[], right: Command[]): { source: string; cwd: string }[] {
+  const producer = left.find((cmd) => cmd.program >= 0 && ["printf", "echo"].includes(basename(cmd.argv[cmd.program]!.text)));
+  const shell = right.find((cmd) => cmd.program >= 0 && stdinKind(cmd) === "shell");
+  if (!producer || !shell) return [];
+  const args = producer.argv.slice(producer.program + 1);
+  const source =
+    basename(producer.argv[producer.program]!.text) === "printf"
+      ? printfOutput(args)
+      : unescape(
+          args
+            .filter((word) => !word.text.startsWith("-"))
+            .map((word) => word.text)
+            .join(" "),
+          true,
+        );
+  return source === undefined ? [] : [{ source, cwd: shell.cwd }];
+}
+
+// xargs runs its command once with every item, or once per item with -I.
+function xargsCommands(xargs: Command, items: string[]): { source: string; cwd: string }[] {
   const options = xargs.argv.slice(0, xargs.program);
   let marker = "";
   for (let i = 0; i < options.length; i++) {
@@ -18,11 +87,52 @@ export function xargsReplacements(left: Command[], right: Command[]): { source:
     else if (option.startsWith("-I")) marker = option.slice(2);
     else if (option.startsWith("--replace=")) marker = option.slice("--replace=".length);
   }
-  if (!marker) return [];
+  // xargs strips quotes and backslashes from what it reads, with or without -I.
+  const stripped = (value: string) => value.replace(/["'\\]/g, "");
   const quote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
-  const source = xargs.argv
-    .slice(xargs.program)
-    .map((word) => (word.text.includes(marker) ? quote(word.text.replaceAll(marker, args[1]!.text)) : word.raw))
-    .join(" ");
-  return [{ source, cwd: xargs.cwd }];
+  const command = xargs.argv.slice(xargs.program);
+  // Without -I, xargs splits its input on blanks, so a printed line can become several arguments.
+  if (!marker)
+    return [
+      {
+        source: [
+          ...command.map((word) => word.raw),
+          ...items
+            .flatMap((item) => item.split(/\s+/))
+            .filter(Boolean)
+            .flatMap((item) => [item, stripped(item)])
+            .map(quote),
+        ].join(" "),
+        cwd: xargs.cwd,
+      },
+    ];
+  return items
+    .flatMap((line) => [line, stripped(line)])
+    .map((item) => ({ source: command.map((word) => (word.text.includes(marker) ? quote(word.text.replaceAll(marker, item)) : word.raw)).join(" "), cwd: xargs.cwd }));
+}
+
+// Literal printf and echo values are known before xargs passes them to a command.
+export function xargsReplacements(left: Command[], right: Command[]): { source: string; cwd: string }[] {
+  const producer = left.find((cmd) => cmd.program >= 0 && ["printf", "echo"].includes(basename(cmd.argv[cmd.program]!.text)));
+  const xargs = right.find((cmd) => cmd.program >= 0 && cmd.wrappers.includes("xargs"));
+  if (!producer || !xargs) return [];
+  const args = producer.argv.slice(producer.program + 1);
+  if (basename(producer.argv[producer.program]!.text) !== "printf")
+    return xargsCommands(
+      xargs,
+      args.filter((word) => !word.text.startsWith("-")).map((word) => unescape(word.text, true)),
+    );
+  const output = printfOutput(args);
+  return output === undefined ? [] : xargsCommands(xargs, output.split("\n").filter(Boolean));
+}
+
+// A here-string or here-document body is the item list xargs reads.
+export function xargsHereInput(xargs: Command, body: string): { source: string; cwd: string }[] {
+  return xargsCommands(
+    xargs,
+    body
+      .split("\n")
+      .flatMap((line) => line.split(/\s+/))
+      .filter(Boolean),
+  );
 }

package/src/reasons.ts

@@ -9,6 +9,8 @@ export const reasons = {
   variable: "This prints the value of a credential variable. Ask the user for the specific non-sensitive fact needed, or let the authorized client consume the credential without printing it.",
   token: "This prints a Git hosting token. Use auth status without token-display flags; if authentication needs repair, ask the user to update the credential in their terminal.",
   keychain: "This extracts a password from the macOS Keychain. State the intended use and run the authorized client that consumes it without printing it.",
+  secretPrint:
+    "This prints a stored secret or access token. Run the command that uses the credential without printing it, or ask the user to run it in their own terminal and share only the non-secret fact needed.",
   trace: "curl verbose or trace output can print HTTP headers including Authorization. Drop -v and --trace; use a normal curl request for the needed result.",
   upload: "This sends the contents of a credential file. Send only the required non-sensitive fields explicitly, and let the client obtain authentication from its normal credential source.",
   ssh: "This reads private material under ~/.ssh. Search public material in the project or request the exact public key or client-config path; ask the user to inspect private material locally if a specific non-sensitive fact is needed.",

package/src/record.ts

@@ -1,7 +1,7 @@
 // A search option's value keeps the option's word as option:ROLE.
 export type ValueRole = "pattern" | "patfile" | "glob" | "nglob" | "optarg";
 export type Role = "arg" | "assign" | "precommand" | "namespace" | "program" | "code" | "option" | "path" | ValueRole | `option:${ValueRole}`;
-export type Flag = "explicit" | "files" | "help" | "fixed" | "recursive" | "include" | "replace" | "hidden";
+export type Flag = "explicit" | "files" | "help" | "fixed" | "recursive" | "include" | "replace" | "hidden" | "walked";
 
 export interface Word {
   text: string; // quotes removed; ~, $HOME and ${HOME} expanded
@@ -11,11 +11,13 @@ export interface Word {
   vars: string[]; // parameter names the shell expands
   role: Role; // set by argv.ts
   value: string; // an option's value without its flag, set by argv.ts
+  pwd: boolean; // holds $PWD, $(pwd) or ~+, expanded to the directory the command was read in
 }
 
 export interface Redirect {
   direction: "in" | "out" | "herestring" | "heredoc";
   target: string; // file, word, or heredoc body
+  globs: boolean; // the target holds an unquoted glob character
   vars: string[]; // parameters the shell expands in the target or body
 }
 

package/src/rules/appdata.ts

@@ -1,8 +1,7 @@
 // App Data rules. macOS records a Files & Folders App Data entry whenever a
 // process reads or enumerates another app's ~/Library data tree, so these deny
 // those reads and the broad walks that reach them.
-import { basename } from "node:path";
-
+import { programName } from "../argv";
 import { absPath, appdataTrees, isAppdata, isBroad, isLibrary } from "../paths";
 import { reasons } from "../reasons";
 import type { Command, Request } from "../record";
@@ -34,7 +33,7 @@ export function appdataRules(req: Request): string[] {
 
 function appdataCommand(cmd: Command, home: string): string | undefined {
   const cwd = cmd.cwd;
-  const prog = cmd.program >= 0 ? basename(cmd.argv[cmd.program]!.text) : "";
+  const prog = cmd.program >= 0 ? programName(cmd.argv[cmd.program]!.text) : "";
   const data = dataPrograms.has(prog);
   // cd reads its target but walks nothing.
   const recursive = cmd.argv.slice(cmd.program + 1).some((word) => (prog === "ls" ? /^(--recursive$|-[^-]*R)/ : /^(--recursive$|-[^-]*[rR])/).test(word.text));
@@ -42,15 +41,19 @@ function appdataCommand(cmd: Command, home: string): string | undefined {
   const walk = !data && !gitConfig && !["cd", "pushd", "popd"].includes(prog) && !noWalkPrograms.has(prog) && !(["ls", "cp"].includes(prog) && !recursive);
   const paths: { path: string; glob: boolean }[] = [];
   for (const [i, word] of cmd.argv.entries()) {
-    if (!word.value || ["pattern", "code", "option:pattern", "optarg"].includes(word.role)) continue;
+    if (!word.value || ["pattern", "code", "option:pattern"].includes(word.role)) continue;
     if (word.role === "program" && !word.value.includes("/")) continue;
     if (data && !word.globs && i > cmd.program) continue;
-    // An expansion the front end cannot resolve may well be $HOME.
-    if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "is").test(word.value)) return appdataReason;
-    paths.push({ path: absPath(word.value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
+    // A value glued to its option, as in --env-file=PATH, is a path too.
+    const values = word.value.startsWith("-") && word.value.includes("=") ? [word.value, word.value.slice(word.value.indexOf("=") + 1)] : [word.value];
+    for (const value of values) {
+      // An expansion the front end cannot resolve may well be $HOME.
+      if (word.expands && new RegExp(`/Library/(${trees})(/.*)?$`, "is").test(value)) return appdataReason;
+      paths.push({ path: absPath(value, cwd, home, /^['"]/.test(word.raw)), glob: word.globs });
+    }
   }
   for (const r of cmd.redirects) {
-    if ((r.direction === "in" || r.direction === "out") && r.target) paths.push({ path: absPath(r.target, cwd, home), glob: false });
+    if ((r.direction === "in" || r.direction === "out") && r.target) paths.push({ path: absPath(r.target, cwd, home), glob: r.globs });
   }
   if (paths.some(({ path, glob }) => isAppdata(path, home, glob))) return appdataReason;
   // Shell glob expansion touches directories even when the command does not walk them.

package/src/rules/credentials.ts

@@ -4,16 +4,22 @@
 // ssh -i) are not readers and stay allowed.
 import { basename } from "node:path";
 
+import { programName } from "../argv";
 import { absPath, isSensitive, isSensitiveRoot, sshPrivate, sshScopeDenied } from "../paths";
+import { showsHidden } from "../pipeline";
 import { reasons } from "../reasons";
 import type { Command, Request, Word } from "../record";
 
 const readerPrograms = new Set(
   (
     "cat head tail less more bat sed awk jq yq base64 xxd od strings diff openssl plutil cp tee tar source . sort " +
-    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack"
+    "uniq cut nl fold rev paste comm join iconv hexdump hd zcat gzcat bzcat xzcat ag ack tac column pr vim vi nvim view perl ruby dd scp rsync zip ed ex hg svn sh bash zsh dash ksh wget php zgrep zless zmore"
   ).split(" "),
 );
+// Programs a find or fd -exec command can run to print or forward what the walk found.
+const execReaders = new Set([...readerPrograms, "rg", "grep", "sh", "bash", "zsh", "dash", "ksh", "env", "sudo", "doas", "xargs", "command", "nohup", "timeout", "nice", "time", "stdbuf", "arch"]);
+// git subcommands that print the content of a file, a commit, or the index.
+const gitReaders = new Set(["show", "diff", "log", "cat-file", "blame", "annotate", "grep", "archive", "format-patch", "whatchanged", "difftool", "diff-index", "diff-tree"]);
 const {
   file: fileReason,
   dump: dumpReason,
@@ -25,6 +31,7 @@ const {
   ssh: sshReason,
   grepSsh: grepSshReason,
   hiddenSearch: hiddenSearchReason,
+  secretPrint: secretReason,
 } = reasons;
 
 const secretName = (name: string) => /TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL/.test(name.toUpperCase());
@@ -34,7 +41,7 @@ export function credentialRules(req: Request): string[] {
   if (req.operation === "read" && isSensitive(req.target)) denials.push(fileReason);
   if (req.operation === "write" && sshPrivate(req.target)) denials.push(sshReason);
   if (req.operation === "search") {
-    if (isSensitiveRoot(req.searchRoot)) denials.push(fileReason);
+    if (isSensitiveRoot(req.searchRoot, req.home)) denials.push(fileReason);
     // A positive glob selects files even past ignore rules.
     if (req.glob && !req.glob.startsWith("!") && isSensitive(`${req.searchRoot}/${basename(req.glob)}`, true)) denials.push(fileReason);
   }
@@ -52,7 +59,7 @@ export function credentialFilesystemRules(req: Request): string[] {
       if ((redirect.direction === "in" || redirect.direction === "out") && redirect.target && sshScopeDenied(absPath(redirect.target, cmd.cwd, req.home), req.home, false)) return [sshReason];
     }
     if (cmd.program < 0) continue;
-    const name = basename(cmd.argv[cmd.program]!.text);
+    const name = programName(cmd.argv[cmd.program]!.text);
     const readsPath = ["ls", "find", "tree", "rg", "grep", "ag", "ack", "fd"].includes(name);
     if (!readsPath && !readerPrograms.has(name)) continue;
     const words = cmd.argv.slice(cmd.program + 1);
@@ -72,13 +79,13 @@ export function credentialFilesystemRules(req: Request): string[] {
 function credentialCommand(cmd: Command, home: string): string[] {
   const denials: string[] = [];
   const sensitive = (word: string, glob = false, quoted = false) => isSensitive(absPath(word, cmd.cwd, home, quoted), glob);
-  for (const r of cmd.redirects) if (r.direction === "in" && sensitive(r.target)) denials.push(fileReason);
+  for (const r of cmd.redirects) if (r.direction === "in" && sensitive(r.target, r.globs)) denials.push(fileReason);
   if (cmd.program < 0) {
     if (cmd.wrappers.at(-1) === "env" && !cmd.wrappers.includes("env-S")) denials.push(dumpReason);
     return denials;
   }
   const program = cmd.argv[cmd.program]!.text;
-  const name = basename(program);
+  const name = programName(program);
   const words = cmd.argv.slice(cmd.program + 1);
   const args = words.map((w) => w.text);
   // Shell variables exist only in the shell, so a path or a wrapper that
@@ -91,6 +98,36 @@ function credentialCommand(cmd: Command, home: string): string[] {
       for (const a of args) if (!a.startsWith("-") && !a.includes("=") && secretName(a)) denials.push(varReason);
     }
   }
+  // A hidden-file walk piped into xargs hands the reader every dotfile it finds.
+  if (cmd.flags.has("walked") && execReaders.has(name)) denials.push(hiddenSearchReason);
+  const options = cmd.argv.slice(0, cmd.program);
+  if (cmd.wrappers.includes("xargs")) {
+    // xargs reads its arguments from the -a file.
+    for (const [i, word] of options.entries()) {
+      const file = word.text === "-a" || word.text === "--arg-file" ? options[i + 1]?.text : word.text.startsWith("--arg-file=") ? word.text.slice("--arg-file=".length) : undefined;
+      if (file && sensitive(file)) denials.push(fileReason);
+    }
+  }
+  // Every operand, and the value of an option glued with `=`, is a file the program may read.
+  // A destination is written and a tar -C directory is entered; later operands are read relative to it.
+  const operandWords = words.filter((w) => !w.text.startsWith("-"));
+  const destination = ["cp", "rsync", "scp"].includes(name) ? operandWords.at(-1) : undefined;
+  const enters = (w: Word, i: number) => name === "tar" && (["-C", "--directory"].includes(words[i - 1]?.text ?? "") || w.text.startsWith("--directory="));
+  const readTargets = (filter?: Word) => {
+    const found: string[] = [];
+    let base = cmd.cwd;
+    for (const [i, w] of words.entries()) {
+      if (w === filter || /^--exclude=/.test(w.text)) continue;
+      const target = name === "dd" ? (w.text.startsWith("if=") ? w.text.slice(3) : "") : /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
+      if (!target || target.startsWith("-")) continue;
+      const quoted = /^['"]/.test(w.raw);
+      if (enters(w, i)) base = absPath(target, base, home, quoted);
+      // A directory that holds a listed file is read whole by tar, zip, scp and rsync.
+      if (sensitive(target, w.globs, quoted) || (!w.globs && w !== destination && !enters(w, i) && isSensitiveRoot(absPath(target, base, home, quoted), home)))
+        found.push(name === "scp" || name === "rsync" ? uploadReason : fileReason);
+    }
+    return found;
+  };
   let display = readerPrograms.has(name) || ["echo", "printf", "print"].includes(name);
   const operands = args.filter((a) => !a.startsWith("-"));
   switch (name) {
@@ -114,42 +151,111 @@ function credentialCommand(cmd: Command, home: string): string[] {
         if (w.role === "path" && absPath(w.value, cmd.cwd, home, /^['"]/.test(w.raw)) === `${home}/.ssh`) denials.push(sshReason);
       }
       if (cmd.flags.has("files")) break;
+      // A search with no path operand reads the working directory.
+      if ((name !== "grep" || cmd.flags.has("recursive")) && !words.some((w) => w.role === "path") && isSensitiveRoot(cmd.cwd, home)) denials.push(fileReason);
       // Search operands, pattern files and positive globs are read targets;
       // the pattern is not.
       for (const w of words) {
         const quoted = /^['"]/.test(w.raw);
         if (["path", "patfile", "option:patfile"].includes(w.role) && sensitive(w.value, w.globs, quoted)) denials.push(fileReason);
-        if (w.role === "path" && isSensitiveRoot(absPath(w.value, cmd.cwd, home, quoted))) denials.push(fileReason);
+        if (w.role === "path" && isSensitiveRoot(absPath(w.value, cmd.cwd, home, quoted), home)) denials.push(fileReason);
         if (["glob", "option:glob"].includes(w.role) && sensitive(basename(w.value), true)) denials.push(fileReason);
       }
       break;
     case "gh":
       if (args[0] === "auth" && args[1] === "token") denials.push(tokenReason);
       if (args[0] === "auth" && args[1] === "status" && ghShowsToken(args.slice(2))) denials.push(tokenReason);
+      // gist create and --body-file upload the files they are given.
+      denials.push(...readTargets());
       break;
     case "glab":
       if (args[0] === "auth" && args[1] === "status" && args.some((a) => /^(--show-token|-[^-]*t)/.test(a))) denials.push(tokenReason);
       break;
     case "security":
-      if (args.includes("-w") || args.includes("-g")) denials.push(keychainReason);
+      if (args.some((a) => /^-[A-Za-z]*[wg]/.test(a) && !a.startsWith("--")) || ["dump-keychain", "export"].includes(args[0] ?? "")) denials.push(keychainReason);
+      break;
+    // A print command gives the guard no target path, so these name the subcommand. Each is a
+    // workaround that stays until the operating system's read restrictions cover the store; do not extend the list.
+    case "gcloud":
+      if (args.includes("print-access-token") || args.includes("print-identity-token")) denials.push(secretReason);
+      break;
+    case "az":
+      if (args[0] === "account" && args[1] === "get-access-token") denials.push(secretReason);
+      break;
+    case "aws":
+      if (args[0] === "configure" && args[1] === "get" && secretName(args[2] ?? "")) denials.push(secretReason);
+      break;
+    case "npm":
+      if (args[0] === "config" && args[1] === "get" && /auth|token|password/i.test(args[2] ?? "")) denials.push(secretReason);
+      break;
+    case "kubectl":
+      if (args[0] === "config" && args[1] === "view" && args.includes("--raw")) denials.push(secretReason);
+      break;
+    case "gpg":
+      if (args.some((a) => /^--export-secret-(sub)?keys$/.test(a))) denials.push(secretReason);
       break;
     case "curl":
       denials.push(...curlRules(args, sensitive));
       break;
+    case "git": {
+      const git = gitCommand(words);
+      // A rev:path operand names a file in a commit or the index; pathspecs may be globs.
+      if (git.sub === "credential" && git.operands[0]?.text === "fill") denials.push(secretReason);
+      for (const w of git.operands) {
+        if (w.text.startsWith("-")) continue;
+        if (git.sub === "grep" && isSensitiveRoot(absPath(w.text, cmd.cwd, home, /^['"]/.test(w.raw)), home)) denials.push(fileReason);
+        if (sensitive(w.text, true) || (w.text.includes(":") && sensitive(w.text.slice(w.text.indexOf(":") + 1), true))) denials.push(fileReason);
+      }
+      break;
+    }
+    case "find":
+    case "fd":
+      if (execPrograms(name, words).some((exec) => execReaders.has(programName(exec))) && (name === "find" || showsHidden(words))) denials.push(hiddenSearchReason);
+      break;
     default:
       if (!readerPrograms.has(name)) return denials;
-      const filter = name === "jq" ? jqFilter(words) : undefined;
-      for (const w of words) {
-        if (w === filter) continue;
-        const target = /^-.*=/s.test(w.text) ? w.text.slice(w.text.indexOf("=") + 1) : w.text;
-        if (target && !target.startsWith("-") && sensitive(target, w.globs, /^['"]/.test(w.raw))) denials.push(fileReason);
-      }
+      denials.push(...readTargets(name === "jq" ? jqFilter(words) : undefined));
   }
   // A heredoc or here-string body is standard input the command prints.
   if (display && cmd.redirects.some((r) => r.vars.some(secretName))) denials.push(varReason);
   return denials;
 }
 
+// The subcommand and the operands that can name a file; git grep's pattern is not one.
+function gitCommand(words: Word[]): { sub: string; operands: Word[] } {
+  let i = 0;
+  while (i < words.length && words[i]!.text.startsWith("-")) i += ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"].includes(words[i]!.text) ? 2 : 1;
+  const sub = words[i]?.text ?? "";
+  let operands = words.slice(i + 1);
+  if (sub === "grep") {
+    const rest: Word[] = [];
+    let patterned = false;
+    let options = true;
+    for (let n = 0; n < operands.length; n++) {
+      const text = operands[n]!.text;
+      if (options && text === "--") options = false;
+      else if (options && text === "-e") {
+        patterned = true;
+        n++;
+      } else if (options && text === "-f") {
+        // The file holds the patterns; git reads it.
+        patterned = true;
+        if (operands[n + 1]) rest.push(operands[++n]!);
+      } else if (options && text.startsWith("-")) rest.push(operands[n]!);
+      else if (!patterned) patterned = true;
+      else rest.push(operands[n]!);
+    }
+    operands = rest;
+  }
+  return { sub, operands: sub === "credential" || gitReaders.has(sub) ? operands : [] };
+}
+
+// The commands a find -exec or an fd -x runs on the matches; find takes several.
+function execPrograms(name: string, words: Word[]): string[] {
+  const flags = name === "find" ? ["-exec", "-execdir", "-ok", "-okdir"] : ["-x", "-X", "--exec", "--exec-batch"];
+  return words.flatMap((word, i) => (flags.includes(word.text) && words[i + 1] ? [words[i + 1]!.text] : []));
+}
+
 function jqFilter(words: Word[]): Word | undefined {
   if (words.some((word) => word.text === "-f" || word.text === "--from-file")) return undefined;
   return words.find((word) => !word.text.startsWith("-"));

package/src/words.ts

@@ -6,13 +6,16 @@ import type { Word } from "./record";
 
 const type = sh.syntax.NodeType;
 
-export function readWord(node: WordNode, slice: (start: number, end: number) => string, vars: Map<string, string>, home: string, visit: (part: Node, names: string[]) => void): Word {
+export function readWord(node: WordNode, slice: (start: number, end: number) => string, vars: Map<string, string>, home: string, pwd: string, visit: (part: Node, names: string[]) => void): Word {
   const text = (part: Node) => slice(part.Pos().Offset(), part.End().Offset());
-  const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "" };
+  const out: Word = { text: "", raw: text(node), expands: false, globs: false, vars: [], role: "arg", value: "", pwd: false };
   const expansion = (part: Node) => {
     const param = part as ParamExp;
     const plain = type(part) === "ParamExp" && !(param.Excl || param.Length || param.Width || param.Index || param.Slice || param.Repl || param.Exp);
-    const known = plain ? (param.Param!.Value === "HOME" ? home : vars.get(param.Param!.Value)) : undefined;
+    const name = plain ? param.Param!.Value : "";
+    const printsPwd = name === "PWD" || (type(part) === "CmdSubst" && /^(\$\(|`)\s*pwd(\s+-[LP])?\s*(\)|`)$/.test(text(part)));
+    const known = printsPwd ? pwd : name === "HOME" ? home : plain ? vars.get(name) : undefined;
+    out.pwd ||= printsPwd;
     out.text += known ?? text(part);
     out.expands ||= known === undefined;
     visit(part, out.vars);
@@ -21,7 +24,16 @@ export function readWord(node: WordNode, slice: (start: number, end: number) =>
     const kind = type(part);
     if (kind === "Lit") {
       let value = (part as Lit).Value;
-      if (index === 0) value = expandHome(value, home);
+      if (index === 0 && /^~\+(\/|$)/.test(value)) {
+        value = pwd + value.slice(2);
+        out.pwd = true;
+      } else if (index === 0) value = expandHome(value, home);
+      // Bun expands {a,b} but not the sequence {a..z}, so read a sequence as a wildcard.
+      const sequence = /(?<!\\)\{(?:-?\d+|[A-Za-z])\.\.(?:-?\d+|[A-Za-z])(?:\.\.-?\d+)?\}/g;
+      if (sequence.test(value)) {
+        value = value.replace(sequence, "*");
+        out.globs = true;
+      }
       if (Bun.$.braces(value).length > 1) out.globs = true;
       for (let i = 0; i < value.length; i++) {
         if (value[i] === "\\") {