@sdsrs/code-graph 0.159.0 → 0.160.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.159.0",
+  "version": "0.160.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/post-grep-inject.js

@@ -47,6 +47,9 @@ const {
   cgFlagSet,
   extractSearchPath,
   bareSourceTarget,
+  segmentCwd,
+  segmentSeparators,
+  operandMatches,
   firstShellClause,
   normalizeCommandPaths,
   rebaseRelativePaths,
@@ -273,6 +276,18 @@ function runMain() {
   // closes, so a bare dir is answered only when the grep is the FIRST segment.
   if (bareSourceTarget(firstShellClause(segment))
       && (relPrefix || splitTopLevelSegments(cmd)[0] !== segment)) return;
+  // D#76 — the answer searches `extractSearchPath(segment)` from the root. The
+  // segment ran where the shell was by then: its own cwd, moved by any `cd`
+  // before it. Segments are read from the RAW command (normalizing strips the
+  // root from `cd <root>/x` too), which splits into the same segments.
+  const segs = splitTopLevelSegments(cmd);
+  const rawSegs = splitTopLevelSegments(rawCmd);
+  const idx = segs.indexOf(segment);
+  if (rawSegs.length !== segs.length) return;
+  const segCwd = segmentCwd(rawSegs, idx, shellCwd, { seps: segmentSeparators(rawCmd) });
+  if (segCwd === null) return;
+  if ((segCwd !== root || relPrefix)
+      && !operandMatches(firstShellClause(rawSegs[idx]), extractSearchPath(segment), root, segCwd)) return;
   // Run the answer exactly like the deny path.
   const rawPattern = pickBlockPattern(segment);
   // Grep-response gate (2026-07-03 audit: 18/18 injects were 0 CONSUMED because they

package/claude-plugin/scripts/pre-grep-guide.js

@@ -255,8 +255,18 @@ function extractPatterns(cmd) {
   const stripped = firstShellClause(cmd).replace(VERB_STRIP, '');
   // Collect every quoted argument — first one is the pattern in standard grep
   // usage; subsequent ones (e.g. `-e "second"`) are also patterns or filter
-  // expressions and worth screening too.
-  return quotedSpans(stripped).map(s => s.body).filter(Boolean);
+  // expressions and worth screening too. Whole words, as the shell passes them
+  // (D#63): `"Foo"'BarBaz'` is `FooBarBaz`, not two patterns; a flag's attached
+  // quoted value (`-e"Foo"`, `--include='*.rs'`) is the value. A clause the
+  // shell would reject, or whose quoted words it expands (`"$MAX"`, D#64), has
+  // no pattern we can read.
+  const words = clauseWords(stripped);
+  if (!words) return [];
+  const quoted = words.filter((w) => w.quotedFrom !== -1);
+  if (quoted.some((w) => w.expands)) return [];
+  return quoted
+    .map((w) => (!w.startsQuoted && w.text[0] === '-' ? w.text.slice(w.quotedFrom) : w.text))
+    .filter(Boolean);
 }
 
 /**
@@ -299,6 +309,69 @@ function quotedSpans(s) {
   return spans;
 }
 
+/**
+ * The words of a shell clause, split and unquoted the way quotedSpans reads
+ * quotes: whitespace separates words only outside quotes, and adjacent quoted
+ * and bare parts join into one word (`-r"l"` is `-rl`, `"Foo"'Bar'` is
+ * `FooBar`). Per word:
+ *   - `startsQuoted`: the first character was a quote — an argument, never a
+ *     flag, so `"-l"` searches for the string `-l`;
+ *   - `quotedFrom`: where in `text` the first quoted part begins (-1 if none),
+ *     so `-e"Foo"` yields the value `Foo`;
+ *   - `expands`: the shell substitutes something into it — `$NAME`, `${…}`,
+ *     `$(…)`, a backtick, or `$'…'`/`$"…"` quoting — outside single quotes,
+ *     so `text` is not what the command received.
+ * Returns null for an unterminated quote: the shell would not run it at all.
+ *
+ * A whitespace split read `-l` out of `grep -rn "FooBar -l x" src/` and the
+ * rewrite answered with a file list (D#62).
+ * @returns {{text: string, startsQuoted: boolean, quotedFrom: number, expands: boolean}[]|null}
+ */
+function clauseWords(s) {
+  const words = [];
+  if (typeof s !== 'string') return words;
+  let cur = null;
+  // Inside double quotes `$"` is a literal `$` before the closing quote
+  // (`"FooBar$"`); bare, `$'…'` and `$"…"` are quoting forms that translate.
+  const expandsAt = (k, inDouble) => s[k] === '`'
+    || (s[k] === '$' && k + 1 < s.length
+      && (inDouble ? /[A-Za-z0-9_{(@*#?$!-]/ : /[A-Za-z0-9_{(@*#?$!'"-]/).test(s[k + 1]));
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === ' ' || c === '\t' || c === '\n') {
+      if (cur) words.push(cur);
+      cur = null;
+      continue;
+    }
+    if (!cur) cur = { text: '', startsQuoted: c === '"' || c === "'", quotedFrom: -1, expands: false };
+    if (c === '\\') {
+      if (i + 1 < s.length && s[i + 1] !== '\n') cur.text += s[i + 1];
+      i++;
+      continue;
+    }
+    if (c !== '"' && c !== "'") {
+      if (expandsAt(i, false)) cur.expands = true;
+      cur.text += c;
+      continue;
+    }
+    if (cur.quotedFrom === -1) cur.quotedFrom = cur.text.length;
+    let j = i + 1;
+    for (; j < s.length && s[j] !== c; j++) {
+      if (c === '"' && s[j] === '\\' && j + 1 < s.length && '"\\$`\n'.includes(s[j + 1])) {
+        j++;
+        if (s[j] === '\n') continue;
+      } else if (c === '"' && expandsAt(j, true)) {
+        cur.expands = true;
+      }
+      cur.text += s[j];
+    }
+    if (j >= s.length) return null;
+    i = j;
+  }
+  if (cur) words.push(cur);
+  return words;
+}
+
 // Declaration anchors inside a pattern (`def cascade_failure|class TaskState`)
 // name the exact symbols the model wants to READ — extract them for `show`.
 const DECL_SYMBOL = /(?:fn|def|class|function|struct|impl|trait)\s+([A-Za-z_][A-Za-z0-9_]*)/g;
@@ -475,17 +548,21 @@ const CG_FLAG_ORDER = ['-i', '-w', '-F', '-l', '-c'];
  * file list was asked for (field report 2026-09-08).
  *
  * Scanning rules that matter: only the grep's OWN clause (a tail command's
- * `-l` is not this grep's), and a token that STARTS quoted is an argument, not
- * a flag — `grep "-l" src/` searches for the string `-l`.
+ * `-l` is not this grep's), words as the shell splits them (clauseWords — a
+ * quoted pattern holding ` -l ` is one word), and a word that STARTS quoted is
+ * an argument, not a flag — `grep "-l" src/` searches for the string `-l`.
  */
 function extractCgFlags(cmd) {
   if (!cmd || typeof cmd !== 'string') return [];
   const clause = firstShellClause(cmd);
   const isRg = RG_VERB.test((clause.match(GREP_HEAD) || [])[1] || '');
-  const toks = clause.replace(VERB_STRIP, '').trim().split(/\s+/);
+  const words = clauseWords(clause.replace(VERB_STRIP, ''));
+  if (!words) return [];
+  const toks = words.map((w) => (w.startsQuoted ? '' : w.text));
   const found = new Set();
   const filters = [];  // [cgFlag, value] pairs, in the order the user wrote them
-  const unquote = (s) => (s || '').replace(/^["']|["']$/g, '');
+  // A value is read from the word, whatever its quoting: `--include '*.rs'`.
+  const valueAt = (k) => (words[k] ? words[k].text : '');
   const addFilter = (flag, value) => {
     if (!value) return;
     // `-g '*.rs' -g '*.rs'` is one filter written twice; cg would honour both
@@ -494,12 +571,12 @@ function extractCgFlags(cmd) {
   };
   for (let i = 0; i < toks.length; i++) {
     const tok = toks[i];
-    if (!tok || tok[0] === '"' || tok[0] === "'" || tok[0] !== '-') continue;
+    if (!tok || tok[0] !== '-') continue;
     if (tok.startsWith('--')) {
       const eq = tok.indexOf('=');
       const name = eq === -1 ? tok : tok.slice(0, eq);
       if (CG_VALUE_FLAGS[name]) {
-        addFilter(CG_VALUE_FLAGS[name], unquote(eq === -1 ? toks[i + 1] : tok.slice(eq + 1)));
+        addFilter(CG_VALUE_FLAGS[name], eq === -1 ? valueAt(i + 1) : tok.slice(eq + 1));
         if (eq === -1) i++;  // the value was a separate token — do not rescan it
         continue;
       }
@@ -515,8 +592,8 @@ function extractCgFlags(cmd) {
       const ch = letters[k];
       if (isRg && CG_VALUE_SHORT[ch]) {
         const attached = letters.slice(k + 1);
-        addFilter(CG_VALUE_SHORT[ch], attached ? unquote(attached) : unquote(toks[i + 1]));
-        // Consume the value token so the next pass cannot read it as a flag
+        addFilter(CG_VALUE_SHORT[ch], attached || valueAt(i + 1));
+        // Consume the value word so the next pass cannot read it as a flag
         // cluster: `rg -g -i 'sym' src/` must be `-g` with value `-i`, not `-g`
         // plus a phantom `-i` (round 2 of pre-ship review — the test that named
         // this property used a quoted value, which the quote guard already
@@ -611,7 +688,10 @@ function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   // Shell sits outside any known source dir (docs/, target/, …) — don't guess.
   if (!SRC_PATH_TOKEN.test(prefix + '/')) return cmd;
   let verbSeen = false;
-  return cmd.split(/(\s+)/).map((tok) => {
+  // Split on whitespace outside quotes only: a quoted pattern is one token and
+  // its inner words are never paths (D#63 — `"fn main utils here"` from src/
+  // became `"fn main src/utils here"`).
+  return splitKeepingQuotes(cmd).map((tok) => {
     if (!tok || /^\s+$/.test(tok)) return tok;
     if (!verbSeen) {
       if (/^(?:env|[A-Za-z_][A-Za-z0-9_]*=\S*)$/.test(tok)) return tok;
@@ -635,6 +715,36 @@ function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   }).join('');
 }
 
+// Words and the whitespace between them, text unchanged, splitting on
+// whitespace outside quotes only (the quotedSpans rules).
+function splitKeepingQuotes(s) {
+  const out = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      cur += c;
+      if (quote === '"' && c === '\\' && i + 1 < s.length) { cur += s[++i]; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '\\' && i + 1 < s.length) { cur += c + s[++i]; continue; }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (/\s/.test(c)) {
+      if (cur) out.push(cur);
+      cur = c;
+      while (i + 1 < s.length && /\s/.test(s[i + 1])) cur += s[++i];
+      out.push(cur);
+      cur = '';
+      continue;
+    }
+    cur += c;
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+
 // v0.48 — bypass detection on the RAW command. (The deny copy stopped teaching
 // the escape in v0.49, but models that already know it — or learned it from a
 // session summary — must stay visible to the funnel.)
@@ -763,22 +873,117 @@ function pickBlockPattern(cmd) {
 // inside single/double quotes are literal command text, never split points.
 // Returns trimmed, non-empty segments. Shared by post-grep-inject so the
 // PostToolUse path reuses this splitter instead of copying it.
-function splitTopLevelSegments(cmd) {
+//
+// A heredoc body is skipped (D#66): it is data on the reading command's stdin,
+// not commands. Lexed as shell, a Python `\'` in a `<<'PY'` body flipped the
+// quote parity for the rest of the command, and a `grep` line in a script body
+// was folded as if the shell had run it. The `<<WORD` stays in its segment;
+// the lines after that segment's newline, through the terminator line, go.
+//
+// Also read as the shell reads them, because each misreading drops or invents
+// commands: a comment (`#` at the start of a word) runs to the end of its line;
+// `<<<` is a here-string and `<<` inside `((…))` a shift, neither a heredoc;
+// the heredoc delimiter is a whole word with its quoting removed (`E"O"F`,
+// `$'EOF'`, `\EOF` all end at a line `EOF`).
+function readHeredocDelim(cmd, i) {
+  let j = i;
+  let delim = '';
+  while (j < cmd.length && !/[\s;&|<>()]/.test(cmd[j])) {
+    const c = cmd[j];
+    if (c === '$' && (cmd[j + 1] === "'" || cmd[j + 1] === '"')) { j++; continue; }
+    if (c === "'" || c === '"') {
+      const close = cmd.indexOf(c, j + 1);
+      if (close === -1) return null;
+      delim += cmd.slice(j + 1, close);
+      j = close + 1;
+      continue;
+    }
+    if (c === '\\' && j + 1 < cmd.length) { delim += cmd[j + 1]; j += 2; continue; }
+    delim += c;
+    j++;
+  }
+  return delim ? { delim, end: j } : null;
+}
+
+// Stronger of two separators joining the same pair of segments (an empty
+// segment between them collapses): anything conditional beats `;`/newline.
+const SEP_RANK = { '': 0, ';': 1, '\n': 1, '&&': 2, '||': 2, ctrl: 3 };
+function joinSep(a, b) {
+  if (a === undefined) return b;
+  if (SEP_RANK[a] === 2 && SEP_RANK[b] === 2 && a !== b) return 'ctrl';
+  return SEP_RANK[b] > SEP_RANK[a] ? b : a;
+}
+
+/**
+ * Top-level segments with the separator before each: '' (the first), ';',
+ * '\n', '&&', '||', or 'ctrl' (after a `do`/`then`/… control word, where
+ * whether the segment runs is not a matter of the previous one).
+ * @returns {{text: string, sep: string}[]}
+ */
+function splitTopLevelSegmentsWithSeps(cmd) {
   if (!cmd || typeof cmd !== 'string') return [];
   const segs = [];
   let cur = '';
+  let sep = '';
   let quote = null;
+  let arith = 0;      // depth of `((` … `))`
+  let heredocs = [];  // [{delim, stripTabs}] started on the current line
+  // The last char appended to `cur`, kept apart: reading `cur` itself flattens
+  // the string `+=` built, once per `#` — a 300 KB `echo a#a#…` took 7.9 s in
+  // a 5 s hook (pre-release review #11).
+  let last = '';
+  const add = (s) => { cur += s; last = s[s.length - 1]; };
+  const cut = (next) => { segs.push({ text: cur, sep }); cur = ''; last = ''; sep = next; };
   for (let i = 0; i < cmd.length; i++) {
     const c = cmd[i];
+    if (!quote) {
+      if (c === '#' && (last === '' || /[\s|(]/.test(last))) {
+        const nl = cmd.indexOf('\n', i);
+        i = (nl === -1 ? cmd.length : nl) - 1;
+        continue;
+      }
+      if (c === '(' && cmd[i + 1] === '(') { arith++; add('(('); i++; continue; }
+      if (c === ')' && cmd[i + 1] === ')' && arith > 0) { arith--; add('))'); i++; continue; }
+      if (c === '<' && cmd[i + 1] === '<' && cmd[i + 2] === '<') { add('<<<'); i += 2; continue; }
+      if (c === '<' && cmd[i + 1] === '<' && arith === 0) {
+        let j = i + 2;
+        const stripTabs = cmd[j] === '-';
+        if (stripTabs) j++;
+        while (cmd[j] === ' ' || cmd[j] === '\t') j++;
+        const d = readHeredocDelim(cmd, j);
+        if (d) {
+          heredocs.push({ delim: d.delim, stripTabs });
+          add(cmd.slice(i, d.end));
+          i = d.end - 1;
+          continue;
+        }
+      }
+      if (c === '\n' && heredocs.length > 0) {
+        cut('\n');
+        let j = i + 1;
+        for (const { delim, stripTabs } of heredocs) {
+          while (j < cmd.length) {
+            const nl = cmd.indexOf('\n', j);
+            const end = nl === -1 ? cmd.length : nl;
+            const line = cmd.slice(j, end);
+            j = end + 1;
+            if ((stripTabs ? line.replace(/^\t+/, '') : line) === delim) break;
+          }
+        }
+        heredocs = [];
+        i = j - 1;
+        continue;
+      }
+    }
     if (quote) {
-      cur += c;
+      add(c);
       // Inside DOUBLE quotes a backslash escapes the next char, so `\"` does NOT
       // close the quote (POSIX). Single quotes do no escaping — `\` is literal
       // and `'` always closes — so this only applies to `"`. Without it,
       // `echo "x\" && grep \"Y\" src/"` (one literal echo arg) mis-closes at
       // `\"`, splits on `&&`, and yields a phantom foldable grep segment.
       if (quote === '"' && c === '\\' && i + 1 < cmd.length) {
-        cur += cmd[i + 1];
+        add(cmd[i + 1]);
         i++;
         continue;
       }
@@ -790,46 +995,58 @@ function splitTopLevelSegments(cmd) {
     // removes both. Keeping them left `&& \⏎ grep …` a segment that starts
     // with `\`, which GREP_HEAD rejects (pre-ship review round 2 F1).
     if (c === '\\' && i + 1 < cmd.length) {
-      if (cmd[i + 1] !== '\n') cur += c + cmd[i + 1];
+      if (cmd[i + 1] !== '\n') add(c + cmd[i + 1]);
       i++;
       continue;
     }
-    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (c === '"' || c === "'") { quote = c; add(c); continue; }
     // `&&` and `||` (a single `&`/`|` is NOT a split — `|` is an output-filter
     // pipe, lone `&` is background and rare in tool calls).
     if ((c === '&' && cmd[i + 1] === '&') || (c === '|' && cmd[i + 1] === '|')) {
-      segs.push(cur); cur = ''; i++; continue;
+      cut(c + c); i++; continue;
     }
-    if (c === ';' || c === '\n') { segs.push(cur); cur = ''; continue; }
-    cur += c;
+    if (c === ';' || c === '\n') { cut(c); continue; }
+    add(c);
   }
-  segs.push(cur);
+  cut(undefined);
   // Split out `for … in` / `do` / `done` control words as their own boundaries
   // so a loop body grep is isolated (the head of `for s in …; do grep …` is the
   // `for` keyword, which would otherwise mask the grep). Quote-safety already
   // handled above — these run per already-split segment on whitespace-delimited
-  // control words only.
-  const out = [];
-  const CTRL = /(?:^|\s)(for\s+\S+\s+in\b|do\b|done\b|then\b|fi\b)(?=\s|$)/g;
-  for (const raw of segs) {
+  // control words only. A `for` header takes its word list with it: the list
+  // is data, and left behind as a segment it read as a command that segmentCwd
+  // cannot place (D#76).
+  const pieces = [];
+  const CTRL = /(?:^|\s)(for\s+\S+\s+in\b[\s\S]*$|do\b|done\b|then\b|fi\b)(?=\s|$)/g;
+  for (const { text: raw, sep: rawSep } of segs) {
     let last = 0;
     let m;
+    let pieceSep = rawSep;
     CTRL.lastIndex = 0;
-    let pushed = false;
     while ((m = CTRL.exec(raw)) !== null) {
-      const before = raw.slice(last, m.index);
-      if (before.trim()) out.push(before);
+      pieces.push({ text: raw.slice(last, m.index), sep: pieceSep });
       last = CTRL.lastIndex;
-      pushed = true;
-    }
-    if (pushed) {
-      const tail = raw.slice(last);
-      if (tail.trim()) out.push(tail);
-    } else {
-      out.push(raw);
+      pieceSep = 'ctrl';
     }
+    pieces.push({ text: raw.slice(last), sep: pieceSep });
   }
-  return out.map(s => s.trim()).filter(Boolean);
+  const out = [];
+  let carried;
+  for (const { text, sep: s } of pieces) {
+    carried = joinSep(carried, s);
+    if (!text.trim()) continue;
+    out.push({ text: text.trim(), sep: out.length === 0 ? '' : carried });
+    carried = undefined;
+  }
+  return out;
+}
+
+function splitTopLevelSegments(cmd) {
+  return splitTopLevelSegmentsWithSeps(cmd).map((s) => s.text);
+}
+
+function segmentSeparators(cmd) {
+  return splitTopLevelSegmentsWithSeps(cmd).map((s) => s.sep);
 }
 
 // One implementation of the cooldown quartet, in tmp-dir.js (ARC-02/ARC-06);
@@ -937,6 +1154,9 @@ function buildRewriteContext(mode, cmdShown) {
 // `-`, and anything the tokenizer does not know — newline, `;`, `&`, `\`, `$`,
 // a backtick, parentheses, braces, `~`. Returns a plan or null.
 const WORD_CHAR = /[A-Za-z0-9_.,:@%+=/*?<>&-]/;
+function isDirectory(p) {
+  try { return fs.statSync(p).isDirectory(); } catch { return false; }
+}
 function shellWords(s) {
   const words = [];
   let cur = null;
@@ -1000,10 +1220,15 @@ function valueWordOk(w, isCount) {
   return !(w.bareSpecial);
 }
 
-function rewritePlan(cmd) {
+// `isDir(target)` answers whether the path operand is a directory. runMain asks
+// the filesystem, resolved against the root its command is relative to; the
+// default is the spelling alone (a trailing `/`, or a last segment with no
+// extension), which keeps the classifiers that call this pure.
+const looksLikeDir = (t) => t.endsWith('/') || !/\.[A-Za-z0-9]{1,6}$/.test(t);
+function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
   if (!cmd || typeof cmd !== 'string' || cmd.length > 1000) return null;
   const words = shellWords(cmd);
-  if (!words || words.some((w) => w.op)) return null;
+  if (!words || words.length === 0 || words.some((w) => w.op)) return null;
   let i = 0;
   let verb = !words[0].anyQuoted ? words[0].text : '';
   if (verb === 'git') {
@@ -1019,6 +1244,7 @@ function rewritePlan(cmd) {
   let caseFlag = false;
   let context = false;
   let endOfFlags = false;
+  let include = false;
   for (; i < words.length; i++) {
     const w = words[i];
     if (!w.anyQuoted && (w.text === '2>&1' || w.text === '2>/dev/null')) continue;
@@ -1031,17 +1257,19 @@ function rewritePlan(cmd) {
       // (`--include='*.rs'`, rg `-g'*.rs'`); an unquoted `<>&` is shell syntax.
       const attachedFilter = /^--(?:include|glob|type)=/.test(w.text) || (verb === 'rg' && /^-[gt]./.test(w.text));
       if (!attachedFilter || w.bareOp) return null;
-      // GNU grep's --include has no `!` negation; cg's -g does (round 4 L2).
-      if (/^--include=!/.test(w.text)) return null;
+      // GNU grep's --include has no `!` negation and no `{a,b}` alternatives;
+      // cg's -g has both (round 4 L2; review of D#78).
+      if (/^--include=(?:!|.*\{)/.test(w.text)) return null;
     }
     if (w.text === '--') { endOfFlags = true; continue; }
     if (w.text.startsWith('--')) {
       const eq = w.text.indexOf('=');
       const name = w.text.slice(2, eq === -1 ? undefined : eq);
       if (!ALLOWED_LONG[verb].has(name)) return null;
+      if (name === 'include') include = true;
       if (VALUE_LONG.has(name) && eq === -1) {
         const v = words[++i];
-        if (!valueWordOk(v, false) || (name === 'include' && v.text.startsWith('!'))) return null;
+        if (!valueWordOk(v, false) || (name === 'include' && /^!|\{/.test(v.text))) return null;
       }
       if (name === 'ignore-case' || name === 'case-sensitive') caseFlag = true;
       continue;
@@ -1075,12 +1303,85 @@ function rewritePlan(cmd) {
   // A `..` segment: extractSearchPath refuses to scope it, so the answer would
   // search the whole repo (round 4 M2).
   if (target && /(?:^|\/)\.\.(?:\/|$)/.test(target.text)) return null;
+  // GNU grep applies --include to a file named on the command line too, so
+  // `grep --include='*.py' X src/a.rs` finds nothing; rg — and so cg — searches
+  // a named file whatever its -g says (D#78). Equivalent only for a directory.
+  if (include && target && !isDir(target.text)) return null;
   // ag is smart-case by default: an all-lowercase pattern matches any case,
   // and cg's search is case-sensitive, so the answer would find less.
   if (verb === 'ag' && !caseFlag && !/[A-Z]/.test(pattern.text)) return null;
   return { pattern: pattern.text, target: target ? target.text : undefined, context };
 }
 
+// Does `rootTarget`, run from the root, name the path the grep clause's own
+// operand names from `cwd` — the directory the clause ran in? The raw clause is
+// parsed with the rewrite grammar; an absolute operand resolves the same from
+// anywhere. A clause the grammar cannot read proves nothing.
+function operandMatches(rawClause, rootTarget, root, cwd) {
+  const raw = rewritePlan(rawClause, { isDir: (t) => isDirectory(path.resolve(cwd, t)) });
+  if (!raw || raw.target === undefined || rootTarget === undefined) return false;
+  return path.resolve(cwd, raw.target) === path.resolve(root, rootTarget);
+}
+
+// Commands that cannot move the shell: external programs run in a child, and
+// these builtins leave the cwd alone. An allowlist, because the commands that
+// DO move it are open-ended — `builtin cd`, `if cd`, `{ cd …; }`, `eval`,
+// `source`, `popd`, any function (D#73 round 3 reproduced 19 forms).
+const CWD_NEUTRAL = new Set([
+  'echo', 'printf', 'grep', 'rg', 'ag', 'git', 'sed', 'awk', 'cat', 'head', 'tail', 'wc',
+  'ls', 'find', 'sort', 'uniq', 'cut', 'tr', 'diff', 'cmp', 'test', '[', 'true', 'false',
+  ':', 'node', 'python', 'python3', 'cargo', 'npm', 'npx', 'jq', 'xargs', 'tee', 'stat',
+  'file', 'du', 'df', 'date', 'sleep', 'which', 'env', 'export', 'set', 'unset', 'nl',
+  'rm', 'mkdir', 'cp', 'mv', 'touch', 'chmod', 'ln', 'readlink', 'realpath', 'basename',
+  'dirname', 'perl', 'gh', 'curl', 'make', 'bash', 'sh', 'timeout', 'tar', 'sqlite3',
+  'code-graph-mcp', 'nproc', 'rustc', 'go', 'wait', 'column', 'md5sum', 'sha256sum',
+  'od', 'xxd', 'seq', 'paste', 'comm', 'uname', 'id', 'printenv',
+  // If an `exit` before the grep had run, the grep would not have.
+  'exit', 'return',
+]);
+// `X=1 Y=$(mktemp -d)`: a command substitution runs in a subshell.
+const PURE_ASSIGNMENTS =
+  /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=(?:\$\([^()]*\)|"[^"]*"|'[^']*'|[^\s;|&<>()'"]*)\s*)+$/;
+const CD_LITERAL = /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*cd\s+('[^']*'|"[^"$`\\]*"|[^\s'"$`\\~*?[{|;&<>()]+)\s*$/;
+
+/**
+ * The directory `segments[idx]` runs in, or null when the segments before it
+ * could have moved the shell somewhere we cannot name (D#76). Follows
+ * cwd-neutral commands and `cd` to one literal path that exists; a relative
+ * `cd` under a set CDPATH is not literal. A `cd` is followed only when it is
+ * certain to have run if the grep did: it is unconditional (its `seps` entry,
+ * from segmentSeparators, is '', `;` or a newline) or every separator from it
+ * to the grep is `&&`, the one before it included: `true || cd x && grep` is
+ * `(true || cd x) && grep`, which runs the grep without the cd. `false && cd x;
+ * grep` and `cd x | cat` did not move the shell. Without `seps` every segment
+ * counts as unconditional.
+ */
+function segmentCwd(segments, idx, shellCwd, { isDir = isDirectory, seps } = {}) {
+  let cwd = shellCwd;
+  const ran = (k) => !seps || SEP_RANK[seps[k]] <= 1
+    || seps.slice(k, idx + 1).every((x) => x === '&&');
+  for (let k = 0; k < idx; k++) {
+    const seg = segments[k];
+    if (/^\s*#/.test(seg) || PURE_ASSIGNMENTS.test(seg)) continue;
+    const clause = firstShellClause(seg);
+    const cd = CD_LITERAL.exec(seg);
+    if (cd) {
+      if (!ran(k)) return null;
+      const arg = /^['"]/.test(cd[1]) ? cd[1].slice(1, -1) : cd[1];
+      if (!arg || arg === '-' || (!path.isAbsolute(arg) && process.env.CDPATH)) return null;
+      const next = path.resolve(cwd, arg);
+      if (!isDir(next)) return null;  // `cd x; grep` runs the grep where it was
+      try { cwd = fs.realpathSync(next); } catch { cwd = next; }
+      continue;
+    }
+    const words = clauseWords(clause);
+    if (!words) return null;
+    const head = words.find((w) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(w.text));
+    if (head && !(head.quotedFrom === -1 && CWD_NEUTRAL.has(head.text))) return null;
+  }
+  return cwd;
+}
+
 // The plan must describe the same search classifyBlock decided on. The pattern
 // the answer ran is picked from quoted spans (pickBlockPattern); the grammar's
 // pattern operand is the one the shell passes — `"is"'Foo'` or an unquoted
@@ -1124,11 +1425,70 @@ function translateBreToRg(cmd, pattern) {
   // the two hooks, because post-grep-inject passes a SEGMENT here while the deny
   // path passes the whole command — the same pattern then filed under two
   // spellings and the funnel scored a verbatim re-grep as neutral.
-  const clause = firstShellClause(cmd);
-  if (/(?:^|\s)-[a-zA-Z]*[EP][a-zA-Z]*(?:\s|=|\d|$)|--(?:extended-regexp|perl-regexp)\b/.test(clause)) {
-    return pattern;
+  // Read from the clause's words, like extractCgFlags: a pattern holding ` -E `
+  // is not the flag (review of D#62).
+  const words = clauseWords(firstShellClause(cmd).replace(VERB_STRIP, '')) || [];
+  const extended = words.some((w) => w.quotedFrom === -1
+    && (/^-[a-zA-Z]*[EP][a-zA-Z]*(?:=|\d|$)/.test(w.text) || /^--(?:extended-regexp|perl-regexp)$/.test(w.text)));
+  if (extended) return pattern;
+  return breToRustRegex(pattern);
+}
+
+// The two dialects swap these characters' roles: in a basic regex `( ) { } + ?
+// |` are literals and `\(` … `\|` the operators, in rust regex the reverse. Only
+// unescaping the operators (the translation until D#65) left the literals as
+// operators, so `tombstoneActive()` searched `tombstoneActive` and the rewrite
+// returned a superset of grep's lines. Checked against the grep Claude Code's
+// shell runs (ugrep -G): `f()`, `a+b`, `a|b`, `{x}`, `a?` match only literally.
+//
+// A bracket expression is copied as written. Inside one, BRE has no escapes and
+// rust has escapes, `[` nesting and the `&&` `--` `~~` set operators, so a
+// bracket holding any of those means different things in the two; that pattern
+// is untranslatable and the result is null — the caller lets the grep run.
+// (`[:alpha:]` is a POSIX class in both and is kept.)
+//
+// Escapes: only the ones both read alike pass — the swapped operators, the
+// word/space/boundary classes, and an escaped metacharacter. `\1`, `\d`, `\z`,
+// `\_`, `\=` mean something else (or are an error) in one of the two, and so
+// do an empty group `\(\)`, an unknown `[:class:]` and a leading `]` in a
+// bracket (review of D#65).
+const BRE_SWAPPED = '(){}+?|';
+const BRE_SAME_ESCAPE = 'wWsSbB<>.*[]^$\\/';
+const POSIX_CLASSES = new Set(['alpha', 'digit', 'alnum', 'upper', 'lower', 'space',
+  'punct', 'xdigit', 'blank', 'cntrl', 'graph', 'print']);
+function breToRustRegex(pattern) {
+  let out = '';
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === '\\' && i + 1 < pattern.length) {
+      const n = pattern[++i];
+      if (n === '(' && pattern.startsWith('\\)', i + 1)) return null;
+      if (BRE_SWAPPED.includes(n)) out += n;
+      else if (BRE_SAME_ESCAPE.includes(n)) out += c + n;
+      else return null;
+      continue;
+    }
+    if (BRE_SWAPPED.includes(c)) { out += '\\' + c; continue; }
+    if (c !== '[') { out += c; continue; }
+    // `]` right after `[` or `[^` is a member, not the end.
+    let j = i + 1;
+    if (pattern[j] === '^') j++;
+    if (pattern[j] === ']') return null;
+    for (; j < pattern.length && pattern[j] !== ']'; j++) {
+      if (pattern[j] === '[' && pattern[j + 1] === ':') {
+        const close = pattern.indexOf(':]', j + 2);
+        if (close === -1 || !POSIX_CLASSES.has(pattern.slice(j + 2, close))) return null;
+        j = close + 1;
+        continue;
+      }
+      if (pattern[j] === '\\' || pattern[j] === '[') return null;
+      if ('&-~'.includes(pattern[j]) && pattern[j + 1] === pattern[j]) return null;
+    }
+    if (j >= pattern.length) return null;  // unterminated: grep reports an error
+    out += pattern.slice(i, j + 1);
+    i = j;
   }
-  return pattern.replace(/\\([|(){}+?])/g, '$1');
+  return out;
 }
 
 // v0.47.0 — cg grep found nothing. Regex-dialect differences (BRE `\|` vs
@@ -1334,8 +1694,17 @@ function runMain() {
   // The rewrite replaces the WHOLE command. One it cannot reproduce runs as
   // typed (see rewritePlan) — decided before the answer is spent on it. The
   // opt-in static deny keeps its own, older scope.
-  const plan = block && !isAnswerDisabled() ? rewritePlan(cmd) : null;
+  const plan = block && !isAnswerDisabled()
+    ? rewritePlan(cmd, { isDir: (t) => isDirectory(path.resolve(root, t)) })
+    : null;
   if (block && !isAnswerDisabled() && !rewriteMatchesBlock(plan, block, cmd, rawGrepPattern)) return;
+  // A pattern the dialect bridge cannot translate (null) has no equivalent search.
+  if (block && !isAnswerDisabled() && block.mode === 'grep' && grepPattern === null) return;
+  // D#76 — the rewrite searches its root-relative target from the root; the
+  // command searched its own operand from the shell's cwd. From a subdirectory
+  // the rebase moves only operands that exist there, so an operand it left
+  // alone (`src/` from `xtask/`, `tests/` from `src/`) names another directory.
+  if (plan && relPrefix && !operandMatches(rawCmd, plan.target, root, shellCwd)) return;
   if (block) {
     // v0.47.0 — run the AST-aware equivalent inside the hook and embed the
     // results in the deny reason ("answer in the deny"). Degrades to the
@@ -1481,6 +1850,9 @@ module.exports = {
   shellWords,            // rewrite — the tokenizer rewritePlan's grammar reads
   rewritePlan,           // rewrite — does the whole command parse as one the rewrite reproduces
   rewriteMatchesBlock,   // rewrite — does that plan describe the search classifyBlock chose
+  operandMatches,        // D#76 — does a root-relative target name the path the command searched
+  segmentCwd,            // D#76 — the directory a compound command's segment runs in
+  segmentSeparators,     // D#76 — the separator before each top-level segment
   extractSedReadTargets, // v0.49 — sed-range reads feed the read-fanout state
   extractUnansweredTail, // v0.50 — compound-tail honesty in answered denies
   extractPatterns,    // v0.32.1 — exposed for tests

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.159.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.160.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.159.0",
+  "version": "0.160.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.159.0",
-    "@sdsrs/code-graph-linux-arm64": "0.159.0",
-    "@sdsrs/code-graph-darwin-x64": "0.159.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.159.0",
-    "@sdsrs/code-graph-win32-x64": "0.159.0"
+    "@sdsrs/code-graph-linux-x64": "0.160.0",
+    "@sdsrs/code-graph-linux-arm64": "0.160.0",
+    "@sdsrs/code-graph-darwin-x64": "0.160.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.160.0",
+    "@sdsrs/code-graph-win32-x64": "0.160.0"
   }
 }