@sdsrs/code-graph 0.159.0 → 0.161.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.159.0",
+  "version": "0.161.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/cg-answer.js

@@ -347,10 +347,45 @@ function runGrepAnswer(opts = {}) {
  *   `no-binary` distinguishes a missing/unlocatable binary from a runtime
  *   `unavailable`, so the deny funnel can see a dark flagship answer-in-deny.
  */
+/**
+ * The files of the definitions a `show` printed: each definition opens with an
+ * unindented header `<kind> <name>  <path>:<start>-<end>  <signature>`, its body
+ * indented below. null when an unindented line is not such a header, so a
+ * caller that must account for every definition can refuse.
+ */
+function showDefinitionFiles(out) {
+  const defs = [];
+  for (const line of out.split('\n')) {
+    if (line === '' || /^\s/.test(line)) continue;
+    const m = /^(\S+) \S+ {2}(\S+):\d+-\d+(?: |$)/.exec(line);
+    if (!m) return null;
+    defs.push({ kind: m[1], file: m[2] });
+  }
+  return defs.length ? defs : null;
+}
+
+/** Whether a root-relative file lies under a grep path ('' = the whole root). */
+function pathWithin(file, within) {
+  const w = within.replace(/^(\.\/)+/, '').replace(/\/+$/, '');
+  return w === '' || w === '.' || file === w || file.startsWith(w + '/');
+}
+
 function runShowAnswer(opts = {}) {
   const {
     cwd,
     symbols,
+    // A grep path the answer must stay inside (D#125 #2): `show` prints every
+    // same-named definition in the project. With `within`, a symbol is answered
+    // only when EVERY definition `show` prints lies inside the path and is one
+    // the grep's declaration keyword matches (`kinds`: symbol → the label and
+    // file-extension shapes it matches); a symbol with no definition inside is
+    // skipped (the grep finds none either), and any other mix refuses the whole
+    // answer. Narrowing with `show --file` was tried and removed: the label is
+    // coarser than the keyword, so a narrowed answer dropped real matches, and
+    // the inject printed the unnarrowed text (review of D#125, round 2).
+    // undefined: unscoped, as before.
+    within,
+    kinds,
     timeoutMs = DEFAULT_TIMEOUT_MS,
     maxBytes = DEFAULT_MAX_BYTES,
   } = opts;
@@ -365,6 +400,8 @@ function runShowAnswer(opts = {}) {
     // Which symbols actually resolved — the rewrite re-runs exactly these, so a
     // symbol that printed nothing here cannot turn into an exit-1 in the Bash call.
     const resolved = [];
+    // The argv that re-runs each resolved symbol, scoped when `within` is set.
+    const argvs = [];
     for (const sym of symbols.slice(0, 3)) {
       if (typeof sym !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(sym)) continue;
       const res = runCg(binary, ['show', sym], { cwd, timeoutMs });
@@ -383,12 +420,24 @@ function runShowAnswer(opts = {}) {
       if (classifyRun(res, { exitOneIsNoHits: false }) !== 'ok') continue;
       const out = (res.stdout || '').trim();
       if (isEmptyAnswer(out)) continue;
-      parts.push(`$ code-graph-mcp show ${sym}\n${out}`);
+      const argv = ['show', sym];
+      if (within !== undefined) {
+        const defs = showDefinitionFiles(out);
+        if (!defs) return { status: 'unavailable', reason: 'scope' };
+        if (!defs.some((d) => pathWithin(d.file, within))) continue;
+        const shapes = (kinds && kinds[sym]) || [];
+        const ext = (f) => (f.match(/\.([A-Za-z0-9]+)$/) || [])[1];
+        const matches = (d) => pathWithin(d.file, within)
+          && shapes.some((k) => k.labels.includes(d.kind) && k.exts.includes(ext(d.file)));
+        if (!defs.every(matches)) return { status: 'unavailable', reason: 'scope' };
+      }
+      parts.push(`$ code-graph-mcp ${argv.join(' ')}\n${out}`);
       resolved.push(sym);
+      argvs.push(argv);
     }
     if (parts.length === 0) return { status: 'no-hits' };
     const { text, truncated } = truncateAtLine(parts.join('\n\n'), maxBytes);
-    return { status: 'hits', text, truncated, symbols: resolved };
+    return { status: 'hits', text, truncated, symbols: resolved, argvs };
   } catch {
     return { status: 'unavailable' };
   }

package/claude-plugin/scripts/post-grep-inject.js

@@ -47,8 +47,16 @@ const {
   cgFlagSet,
   extractSearchPath,
   bareSourceTarget,
+  segmentCwd,
+  segmentSeparators,
+  operandMatches,
   firstShellClause,
   normalizeCommandPaths,
+  rootOnlyInSearchPath,
+  grepSearchesNoDirectory,
+  isDirectory,
+  declKindsBySymbol,
+  extractPatterns,
   rebaseRelativePaths,
   resolveProjectRoot,
 } = require('./pre-grep-guide');
@@ -273,6 +281,23 @@ function runMain() {
   // closes, so a bare dir is answered only when the grep is the FIRST segment.
   if (bareSourceTarget(firstShellClause(segment))
       && (relPrefix || splitTopLevelSegments(cmd)[0] !== segment)) return;
+  // D#76 — the answer searches `extractSearchPath(segment)` from the root. The
+  // segment ran where the shell was by then: its own cwd, moved by any `cd`
+  // before it. Segments are read from the RAW command (normalizing strips the
+  // root from `cd <root>/x` too), which splits into the same segments.
+  const segs = splitTopLevelSegments(cmd);
+  const rawSegs = splitTopLevelSegments(rawCmd);
+  const idx = segs.indexOf(segment);
+  if (rawSegs.length !== segs.length) return;
+  const segCwd = segmentCwd(rawSegs, idx, shellCwd, { seps: segmentSeparators(rawCmd) });
+  if (segCwd === null) return;
+  if ((segCwd !== root || relPrefix)
+      && !operandMatches(firstShellClause(rawSegs[idx]), extractSearchPath(segment), root, segCwd)) return;
+  // D#125 #1 — the root strip rewrote a pattern that held the root.
+  if (!rootOnlyInSearchPath(rawSegs[idx], root, extractSearchPath(segment))) return;
+  // D#125 #3 — a plain grep without -r searched no directory.
+  if (grepSearchesNoDirectory(firstShellClause(segment), extractSearchPath(segment),
+    (t) => isDirectory(path.resolve(root, t)))) return;
   // Run the answer exactly like the deny path.
   const rawPattern = pickBlockPattern(segment);
   // Grep-response gate (2026-07-03 audit: 18/18 injects were 0 CONSUMED because they
@@ -367,7 +392,14 @@ function runMain() {
   if (answer.status !== 'hits') {
     if (block.mode === 'show') {
       answeredMode = 'show';
-      answer = runShowAnswer({ cwd: root, symbols: block.symbols });
+      // Scoped like the rewrite: the grep's path and declaration kinds; a grep
+      // with a file filter gets the grep answer, which honors it.
+      answer = flags.includes('-g') || flags.includes('-t')
+        ? { status: 'unavailable' }
+        : runShowAnswer({
+          cwd: root, symbols: block.symbols, within: searchPath ?? '',
+          kinds: declKindsBySymbol(extractPatterns(segment)),
+        });
       if (answer.status !== 'hits' && pattern) {
         answeredMode = 'grep';
         answer = runGrepAnswer({ cwd: root, pattern, searchPath, flags });

package/claude-plugin/scripts/pre-grep-guide.js

@@ -255,8 +255,18 @@ function extractPatterns(cmd) {
   const stripped = firstShellClause(cmd).replace(VERB_STRIP, '');
   // Collect every quoted argument — first one is the pattern in standard grep
   // usage; subsequent ones (e.g. `-e "second"`) are also patterns or filter
-  // expressions and worth screening too.
-  return quotedSpans(stripped).map(s => s.body).filter(Boolean);
+  // expressions and worth screening too. Whole words, as the shell passes them
+  // (D#63): `"Foo"'BarBaz'` is `FooBarBaz`, not two patterns; a flag's attached
+  // quoted value (`-e"Foo"`, `--include='*.rs'`) is the value. A clause the
+  // shell would reject, or whose quoted words it expands (`"$MAX"`, D#64), has
+  // no pattern we can read.
+  const words = clauseWords(stripped);
+  if (!words) return [];
+  const quoted = words.filter((w) => w.quotedFrom !== -1);
+  if (quoted.some((w) => w.expands)) return [];
+  return quoted
+    .map((w) => (!w.startsQuoted && w.text[0] === '-' ? w.text.slice(w.quotedFrom) : w.text))
+    .filter(Boolean);
 }
 
 /**
@@ -299,10 +309,105 @@ function quotedSpans(s) {
   return spans;
 }
 
+/**
+ * The words of a shell clause, split and unquoted the way quotedSpans reads
+ * quotes: whitespace separates words only outside quotes, and adjacent quoted
+ * and bare parts join into one word (`-r"l"` is `-rl`, `"Foo"'Bar'` is
+ * `FooBar`). Per word:
+ *   - `startsQuoted`: the first character was a quote — an argument, never a
+ *     flag, so `"-l"` searches for the string `-l`;
+ *   - `quotedFrom`: where in `text` the first quoted part begins (-1 if none),
+ *     so `-e"Foo"` yields the value `Foo`;
+ *   - `expands`: the shell substitutes something into it — `$NAME`, `${…}`,
+ *     `$(…)`, a backtick, or `$'…'`/`$"…"` quoting — outside single quotes,
+ *     so `text` is not what the command received.
+ * Returns null for an unterminated quote: the shell would not run it at all.
+ *
+ * A whitespace split read `-l` out of `grep -rn "FooBar -l x" src/` and the
+ * rewrite answered with a file list (D#62).
+ * @returns {{text: string, startsQuoted: boolean, quotedFrom: number, expands: boolean}[]|null}
+ */
+function clauseWords(s) {
+  const words = [];
+  if (typeof s !== 'string') return words;
+  let cur = null;
+  // Inside double quotes `$"` is a literal `$` before the closing quote
+  // (`"FooBar$"`); bare, `$'…'` and `$"…"` are quoting forms that translate.
+  const expandsAt = (k, inDouble) => s[k] === '`'
+    || (s[k] === '$' && k + 1 < s.length
+      && (inDouble ? /[A-Za-z0-9_{(@*#?$!-]/ : /[A-Za-z0-9_{(@*#?$!'"-]/).test(s[k + 1]));
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === ' ' || c === '\t' || c === '\n') {
+      if (cur) words.push(cur);
+      cur = null;
+      continue;
+    }
+    if (!cur) cur = { text: '', startsQuoted: c === '"' || c === "'", quotedFrom: -1, expands: false };
+    if (c === '\\') {
+      if (i + 1 < s.length && s[i + 1] !== '\n') cur.text += s[i + 1];
+      i++;
+      continue;
+    }
+    if (c !== '"' && c !== "'") {
+      if (expandsAt(i, false)) cur.expands = true;
+      cur.text += c;
+      continue;
+    }
+    if (cur.quotedFrom === -1) cur.quotedFrom = cur.text.length;
+    let j = i + 1;
+    for (; j < s.length && s[j] !== c; j++) {
+      if (c === '"' && s[j] === '\\' && j + 1 < s.length && '"\\$`\n'.includes(s[j + 1])) {
+        j++;
+        if (s[j] === '\n') continue;
+      } else if (c === '"' && expandsAt(j, true)) {
+        cur.expands = true;
+      }
+      cur.text += s[j];
+    }
+    if (j >= s.length) return null;
+    i = j;
+  }
+  if (cur) words.push(cur);
+  return words;
+}
+
 // Declaration anchors inside a pattern (`def cascade_failure|class TaskState`)
 // name the exact symbols the model wants to READ — extract them for `show`.
 const DECL_SYMBOL = /(?:fn|def|class|function|struct|impl|trait)\s+([A-Za-z_][A-Za-z0-9_]*)/g;
 
+// What a `show` definition must be for the grep's declaration keyword to match
+// its line: the kind label `show` prints (src/cli/symbols.rs
+// format_node_compact) AND a file of a language that spells the declaration
+// with that keyword. The label alone is coarser than the keyword — `fn` is also
+// a Python `def` and a TS method, and a Swift `struct` is labelled `class`
+// (review of D#125, round 2). `impl` names no definition of its own.
+const DECL_KEYWORD_SHAPES = {
+  fn: { labels: ['fn'], exts: ['rs'] },
+  def: { labels: ['fn'], exts: ['py', 'rb'] },
+  function: { labels: ['fn'], exts: ['js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'php', 'sh', 'bash'] },
+  class: {
+    labels: ['class'],
+    exts: ['py', 'js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'java', 'kt', 'cs', 'php', 'rb', 'dart',
+      'cpp', 'cc', 'hpp', 'h', 'scala'],
+  },
+  struct: { labels: ['struct'], exts: ['rs', 'go', 'c', 'h', 'cpp', 'cc', 'hpp', 'cs'] },
+  trait: { labels: ['trait', 'iface'], exts: ['rs', 'php', 'scala'] },
+  impl: { labels: [], exts: [] },
+};
+
+// Symbol → the (label, extension) shapes its declaration keywords match
+// (`fn foo\|def foo` → foo: Rust fn, Python/Ruby def).
+function declKindsBySymbol(patterns) {
+  const out = {};
+  for (const p of patterns) {
+    for (const m of p.matchAll(/\b(fn|def|class|function|struct|impl|trait)\s+([A-Za-z_][A-Za-z0-9_]*)/g)) {
+      (out[m[2]] = out[m[2]] || []).push(DECL_KEYWORD_SHAPES[m[1]]);
+    }
+  }
+  return out;
+}
+
 function extractDeclSymbols(patterns) {
   const out = [];
   for (const p of patterns) {
@@ -475,17 +580,21 @@ const CG_FLAG_ORDER = ['-i', '-w', '-F', '-l', '-c'];
  * file list was asked for (field report 2026-09-08).
  *
  * Scanning rules that matter: only the grep's OWN clause (a tail command's
- * `-l` is not this grep's), and a token that STARTS quoted is an argument, not
- * a flag — `grep "-l" src/` searches for the string `-l`.
+ * `-l` is not this grep's), words as the shell splits them (clauseWords — a
+ * quoted pattern holding ` -l ` is one word), and a word that STARTS quoted is
+ * an argument, not a flag — `grep "-l" src/` searches for the string `-l`.
  */
 function extractCgFlags(cmd) {
   if (!cmd || typeof cmd !== 'string') return [];
   const clause = firstShellClause(cmd);
   const isRg = RG_VERB.test((clause.match(GREP_HEAD) || [])[1] || '');
-  const toks = clause.replace(VERB_STRIP, '').trim().split(/\s+/);
+  const words = clauseWords(clause.replace(VERB_STRIP, ''));
+  if (!words) return [];
+  const toks = words.map((w) => (w.startsQuoted ? '' : w.text));
   const found = new Set();
   const filters = [];  // [cgFlag, value] pairs, in the order the user wrote them
-  const unquote = (s) => (s || '').replace(/^["']|["']$/g, '');
+  // A value is read from the word, whatever its quoting: `--include '*.rs'`.
+  const valueAt = (k) => (words[k] ? words[k].text : '');
   const addFilter = (flag, value) => {
     if (!value) return;
     // `-g '*.rs' -g '*.rs'` is one filter written twice; cg would honour both
@@ -494,12 +603,12 @@ function extractCgFlags(cmd) {
   };
   for (let i = 0; i < toks.length; i++) {
     const tok = toks[i];
-    if (!tok || tok[0] === '"' || tok[0] === "'" || tok[0] !== '-') continue;
+    if (!tok || tok[0] !== '-') continue;
     if (tok.startsWith('--')) {
       const eq = tok.indexOf('=');
       const name = eq === -1 ? tok : tok.slice(0, eq);
       if (CG_VALUE_FLAGS[name]) {
-        addFilter(CG_VALUE_FLAGS[name], unquote(eq === -1 ? toks[i + 1] : tok.slice(eq + 1)));
+        addFilter(CG_VALUE_FLAGS[name], eq === -1 ? valueAt(i + 1) : tok.slice(eq + 1));
         if (eq === -1) i++;  // the value was a separate token — do not rescan it
         continue;
       }
@@ -515,8 +624,8 @@ function extractCgFlags(cmd) {
       const ch = letters[k];
       if (isRg && CG_VALUE_SHORT[ch]) {
         const attached = letters.slice(k + 1);
-        addFilter(CG_VALUE_SHORT[ch], attached ? unquote(attached) : unquote(toks[i + 1]));
-        // Consume the value token so the next pass cannot read it as a flag
+        addFilter(CG_VALUE_SHORT[ch], attached || valueAt(i + 1));
+        // Consume the value word so the next pass cannot read it as a flag
         // cluster: `rg -g -i 'sym' src/` must be `-g` with value `-i`, not `-g`
         // plus a phantom `-i` (round 2 of pre-ship review — the test that named
         // this property used a quoted value, which the quote guard already
@@ -579,6 +688,30 @@ function normalizeCommandPaths(cmd, cwd) {
   return cmd.split(cwd.endsWith('/') ? cwd : cwd + '/').join('');
 }
 
+// D#125 #1 — the strip above cannot tell a path operand from a PATTERN, and
+// strips both: `grep -rn "<root>/Foo" src/` searches the literal text
+// `<root>/Foo`, but was answered for `Foo`. Re-picking the pattern with the
+// root marked was tried first and missed shapes where the mark changes which
+// word is picked (`"<root>/def foo"`, `"abc_<root>/def"`: review of D#125). The
+// narrow form: every shell word that holds `<root>/` must BE the search path
+// the answer scopes to; anything else runs as typed.
+function rootOnlyInSearchPath(cmd, cwd, target) {
+  if (!cmd || typeof cmd !== 'string') return true;
+  if (!cwd || typeof cwd !== 'string' || cwd === '/') return true;
+  const prefix = cwd.endsWith('/') ? cwd : cwd + '/';
+  if (!cmd.includes(prefix)) return true;
+  // Round 2: counting words was not enough — a lone root-holding PATTERN whose
+  // stripped text equals the path (`grep -rn "<root>/src/x" src/x`) passed. The
+  // rewrite grammar names which word is the path operand: accept only a command
+  // it reads, with the root once, in that operand, and nowhere in the pattern.
+  if (cmd.split(prefix).length !== 2) return false;
+  const plan = rewritePlan(firstShellClause(cmd), { isDir: () => true });
+  if (!plan || plan.target === undefined || plan.pattern.includes(prefix)) return false;
+  if (!plan.target.startsWith(prefix)) return false;
+  const norm = (p) => p.replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+  return target !== undefined && norm(plan.target.slice(prefix.length)) === norm(target);
+}
+
 // v0.48 — subdir-cwd fix; v0.49 — extracted to project-root.js so the read
 // hook shares it. Re-exported below for test/back-compat.
 const { resolveProjectRoot } = require('./project-root');
@@ -611,7 +744,10 @@ function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   // Shell sits outside any known source dir (docs/, target/, …) — don't guess.
   if (!SRC_PATH_TOKEN.test(prefix + '/')) return cmd;
   let verbSeen = false;
-  return cmd.split(/(\s+)/).map((tok) => {
+  // Split on whitespace outside quotes only: a quoted pattern is one token and
+  // its inner words are never paths (D#63 — `"fn main utils here"` from src/
+  // became `"fn main src/utils here"`).
+  return splitKeepingQuotes(cmd).map((tok) => {
     if (!tok || /^\s+$/.test(tok)) return tok;
     if (!verbSeen) {
       if (/^(?:env|[A-Za-z_][A-Za-z0-9_]*=\S*)$/.test(tok)) return tok;
@@ -635,6 +771,36 @@ function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   }).join('');
 }
 
+// Words and the whitespace between them, text unchanged, splitting on
+// whitespace outside quotes only (the quotedSpans rules).
+function splitKeepingQuotes(s) {
+  const out = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      cur += c;
+      if (quote === '"' && c === '\\' && i + 1 < s.length) { cur += s[++i]; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '\\' && i + 1 < s.length) { cur += c + s[++i]; continue; }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (/\s/.test(c)) {
+      if (cur) out.push(cur);
+      cur = c;
+      while (i + 1 < s.length && /\s/.test(s[i + 1])) cur += s[++i];
+      out.push(cur);
+      cur = '';
+      continue;
+    }
+    cur += c;
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+
 // v0.48 — bypass detection on the RAW command. (The deny copy stopped teaching
 // the escape in v0.49, but models that already know it — or learned it from a
 // session summary — must stay visible to the funnel.)
@@ -763,22 +929,117 @@ function pickBlockPattern(cmd) {
 // inside single/double quotes are literal command text, never split points.
 // Returns trimmed, non-empty segments. Shared by post-grep-inject so the
 // PostToolUse path reuses this splitter instead of copying it.
-function splitTopLevelSegments(cmd) {
+//
+// A heredoc body is skipped (D#66): it is data on the reading command's stdin,
+// not commands. Lexed as shell, a Python `\'` in a `<<'PY'` body flipped the
+// quote parity for the rest of the command, and a `grep` line in a script body
+// was folded as if the shell had run it. The `<<WORD` stays in its segment;
+// the lines after that segment's newline, through the terminator line, go.
+//
+// Also read as the shell reads them, because each misreading drops or invents
+// commands: a comment (`#` at the start of a word) runs to the end of its line;
+// `<<<` is a here-string and `<<` inside `((…))` a shift, neither a heredoc;
+// the heredoc delimiter is a whole word with its quoting removed (`E"O"F`,
+// `$'EOF'`, `\EOF` all end at a line `EOF`).
+function readHeredocDelim(cmd, i) {
+  let j = i;
+  let delim = '';
+  while (j < cmd.length && !/[\s;&|<>()]/.test(cmd[j])) {
+    const c = cmd[j];
+    if (c === '$' && (cmd[j + 1] === "'" || cmd[j + 1] === '"')) { j++; continue; }
+    if (c === "'" || c === '"') {
+      const close = cmd.indexOf(c, j + 1);
+      if (close === -1) return null;
+      delim += cmd.slice(j + 1, close);
+      j = close + 1;
+      continue;
+    }
+    if (c === '\\' && j + 1 < cmd.length) { delim += cmd[j + 1]; j += 2; continue; }
+    delim += c;
+    j++;
+  }
+  return delim ? { delim, end: j } : null;
+}
+
+// Stronger of two separators joining the same pair of segments (an empty
+// segment between them collapses): anything conditional beats `;`/newline.
+const SEP_RANK = { '': 0, ';': 1, '\n': 1, '&&': 2, '||': 2, ctrl: 3 };
+function joinSep(a, b) {
+  if (a === undefined) return b;
+  if (SEP_RANK[a] === 2 && SEP_RANK[b] === 2 && a !== b) return 'ctrl';
+  return SEP_RANK[b] > SEP_RANK[a] ? b : a;
+}
+
+/**
+ * Top-level segments with the separator before each: '' (the first), ';',
+ * '\n', '&&', '||', or 'ctrl' (after a `do`/`then`/… control word, where
+ * whether the segment runs is not a matter of the previous one).
+ * @returns {{text: string, sep: string}[]}
+ */
+function splitTopLevelSegmentsWithSeps(cmd) {
   if (!cmd || typeof cmd !== 'string') return [];
   const segs = [];
   let cur = '';
+  let sep = '';
   let quote = null;
+  let arith = 0;      // depth of `((` … `))`
+  let heredocs = [];  // [{delim, stripTabs}] started on the current line
+  // The last char appended to `cur`, kept apart: reading `cur` itself flattens
+  // the string `+=` built, once per `#` — a 300 KB `echo a#a#…` took 7.9 s in
+  // a 5 s hook (pre-release review #11).
+  let last = '';
+  const add = (s) => { cur += s; last = s[s.length - 1]; };
+  const cut = (next) => { segs.push({ text: cur, sep }); cur = ''; last = ''; sep = next; };
   for (let i = 0; i < cmd.length; i++) {
     const c = cmd[i];
+    if (!quote) {
+      if (c === '#' && (last === '' || /[\s|(]/.test(last))) {
+        const nl = cmd.indexOf('\n', i);
+        i = (nl === -1 ? cmd.length : nl) - 1;
+        continue;
+      }
+      if (c === '(' && cmd[i + 1] === '(') { arith++; add('(('); i++; continue; }
+      if (c === ')' && cmd[i + 1] === ')' && arith > 0) { arith--; add('))'); i++; continue; }
+      if (c === '<' && cmd[i + 1] === '<' && cmd[i + 2] === '<') { add('<<<'); i += 2; continue; }
+      if (c === '<' && cmd[i + 1] === '<' && arith === 0) {
+        let j = i + 2;
+        const stripTabs = cmd[j] === '-';
+        if (stripTabs) j++;
+        while (cmd[j] === ' ' || cmd[j] === '\t') j++;
+        const d = readHeredocDelim(cmd, j);
+        if (d) {
+          heredocs.push({ delim: d.delim, stripTabs });
+          add(cmd.slice(i, d.end));
+          i = d.end - 1;
+          continue;
+        }
+      }
+      if (c === '\n' && heredocs.length > 0) {
+        cut('\n');
+        let j = i + 1;
+        for (const { delim, stripTabs } of heredocs) {
+          while (j < cmd.length) {
+            const nl = cmd.indexOf('\n', j);
+            const end = nl === -1 ? cmd.length : nl;
+            const line = cmd.slice(j, end);
+            j = end + 1;
+            if ((stripTabs ? line.replace(/^\t+/, '') : line) === delim) break;
+          }
+        }
+        heredocs = [];
+        i = j - 1;
+        continue;
+      }
+    }
     if (quote) {
-      cur += c;
+      add(c);
       // Inside DOUBLE quotes a backslash escapes the next char, so `\"` does NOT
       // close the quote (POSIX). Single quotes do no escaping — `\` is literal
       // and `'` always closes — so this only applies to `"`. Without it,
       // `echo "x\" && grep \"Y\" src/"` (one literal echo arg) mis-closes at
       // `\"`, splits on `&&`, and yields a phantom foldable grep segment.
       if (quote === '"' && c === '\\' && i + 1 < cmd.length) {
-        cur += cmd[i + 1];
+        add(cmd[i + 1]);
         i++;
         continue;
       }
@@ -790,46 +1051,58 @@ function splitTopLevelSegments(cmd) {
     // removes both. Keeping them left `&& \⏎ grep …` a segment that starts
     // with `\`, which GREP_HEAD rejects (pre-ship review round 2 F1).
     if (c === '\\' && i + 1 < cmd.length) {
-      if (cmd[i + 1] !== '\n') cur += c + cmd[i + 1];
+      if (cmd[i + 1] !== '\n') add(c + cmd[i + 1]);
       i++;
       continue;
     }
-    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (c === '"' || c === "'") { quote = c; add(c); continue; }
     // `&&` and `||` (a single `&`/`|` is NOT a split — `|` is an output-filter
     // pipe, lone `&` is background and rare in tool calls).
     if ((c === '&' && cmd[i + 1] === '&') || (c === '|' && cmd[i + 1] === '|')) {
-      segs.push(cur); cur = ''; i++; continue;
+      cut(c + c); i++; continue;
     }
-    if (c === ';' || c === '\n') { segs.push(cur); cur = ''; continue; }
-    cur += c;
+    if (c === ';' || c === '\n') { cut(c); continue; }
+    add(c);
   }
-  segs.push(cur);
+  cut(undefined);
   // Split out `for … in` / `do` / `done` control words as their own boundaries
   // so a loop body grep is isolated (the head of `for s in …; do grep …` is the
   // `for` keyword, which would otherwise mask the grep). Quote-safety already
   // handled above — these run per already-split segment on whitespace-delimited
-  // control words only.
-  const out = [];
-  const CTRL = /(?:^|\s)(for\s+\S+\s+in\b|do\b|done\b|then\b|fi\b)(?=\s|$)/g;
-  for (const raw of segs) {
+  // control words only. A `for` header takes its word list with it: the list
+  // is data, and left behind as a segment it read as a command that segmentCwd
+  // cannot place (D#76).
+  const pieces = [];
+  const CTRL = /(?:^|\s)(for\s+\S+\s+in\b[\s\S]*$|do\b|done\b|then\b|fi\b)(?=\s|$)/g;
+  for (const { text: raw, sep: rawSep } of segs) {
     let last = 0;
     let m;
+    let pieceSep = rawSep;
     CTRL.lastIndex = 0;
-    let pushed = false;
     while ((m = CTRL.exec(raw)) !== null) {
-      const before = raw.slice(last, m.index);
-      if (before.trim()) out.push(before);
+      pieces.push({ text: raw.slice(last, m.index), sep: pieceSep });
       last = CTRL.lastIndex;
-      pushed = true;
-    }
-    if (pushed) {
-      const tail = raw.slice(last);
-      if (tail.trim()) out.push(tail);
-    } else {
-      out.push(raw);
+      pieceSep = 'ctrl';
     }
+    pieces.push({ text: raw.slice(last), sep: pieceSep });
+  }
+  const out = [];
+  let carried;
+  for (const { text, sep: s } of pieces) {
+    carried = joinSep(carried, s);
+    if (!text.trim()) continue;
+    out.push({ text: text.trim(), sep: out.length === 0 ? '' : carried });
+    carried = undefined;
   }
-  return out.map(s => s.trim()).filter(Boolean);
+  return out;
+}
+
+function splitTopLevelSegments(cmd) {
+  return splitTopLevelSegmentsWithSeps(cmd).map((s) => s.text);
+}
+
+function segmentSeparators(cmd) {
+  return splitTopLevelSegmentsWithSeps(cmd).map((s) => s.sep);
 }
 
 // One implementation of the cooldown quartet, in tmp-dir.js (ARC-02/ARC-06);
@@ -937,6 +1210,9 @@ function buildRewriteContext(mode, cmdShown) {
 // `-`, and anything the tokenizer does not know — newline, `;`, `&`, `\`, `$`,
 // a backtick, parentheses, braces, `~`. Returns a plan or null.
 const WORD_CHAR = /[A-Za-z0-9_.,:@%+=/*?<>&-]/;
+function isDirectory(p) {
+  try { return fs.statSync(p).isDirectory(); } catch { return false; }
+}
 function shellWords(s) {
   const words = [];
   let cur = null;
@@ -1000,10 +1276,15 @@ function valueWordOk(w, isCount) {
   return !(w.bareSpecial);
 }
 
-function rewritePlan(cmd) {
+// `isDir(target)` answers whether the path operand is a directory. runMain asks
+// the filesystem, resolved against the root its command is relative to; the
+// default is the spelling alone (a trailing `/`, or a last segment with no
+// extension), which keeps the classifiers that call this pure.
+const looksLikeDir = (t) => t.endsWith('/') || !/\.[A-Za-z0-9]{1,6}$/.test(t);
+function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
   if (!cmd || typeof cmd !== 'string' || cmd.length > 1000) return null;
   const words = shellWords(cmd);
-  if (!words || words.some((w) => w.op)) return null;
+  if (!words || words.length === 0 || words.some((w) => w.op)) return null;
   let i = 0;
   let verb = !words[0].anyQuoted ? words[0].text : '';
   if (verb === 'git') {
@@ -1019,6 +1300,8 @@ function rewritePlan(cmd) {
   let caseFlag = false;
   let context = false;
   let endOfFlags = false;
+  let include = false;
+  let recursive = false;
   for (; i < words.length; i++) {
     const w = words[i];
     if (!w.anyQuoted && (w.text === '2>&1' || w.text === '2>/dev/null')) continue;
@@ -1031,17 +1314,20 @@ function rewritePlan(cmd) {
       // (`--include='*.rs'`, rg `-g'*.rs'`); an unquoted `<>&` is shell syntax.
       const attachedFilter = /^--(?:include|glob|type)=/.test(w.text) || (verb === 'rg' && /^-[gt]./.test(w.text));
       if (!attachedFilter || w.bareOp) return null;
-      // GNU grep's --include has no `!` negation; cg's -g does (round 4 L2).
-      if (/^--include=!/.test(w.text)) return null;
+      // GNU grep's --include has no `!` negation and no `{a,b}` alternatives;
+      // cg's -g has both (round 4 L2; review of D#78).
+      if (/^--include=(?:!|.*\{)/.test(w.text)) return null;
     }
     if (w.text === '--') { endOfFlags = true; continue; }
     if (w.text.startsWith('--')) {
       const eq = w.text.indexOf('=');
       const name = w.text.slice(2, eq === -1 ? undefined : eq);
       if (!ALLOWED_LONG[verb].has(name)) return null;
+      if (name === 'include') include = true;
+      if (name === 'recursive') recursive = true;
       if (VALUE_LONG.has(name) && eq === -1) {
         const v = words[++i];
-        if (!valueWordOk(v, false) || (name === 'include' && v.text.startsWith('!'))) return null;
+        if (!valueWordOk(v, false) || (name === 'include' && /^!|\{/.test(v.text))) return null;
       }
       if (name === 'ignore-case' || name === 'case-sensitive') caseFlag = true;
       continue;
@@ -1062,6 +1348,7 @@ function rewritePlan(cmd) {
       }
       if (!allowed.includes(ch)) return null;
       if (ch === 'i' || ch === 's') caseFlag = true;
+      if (ch === 'r' || ch === 'R') recursive = true;
     }
   }
   if (operands.length === 0 || operands.length > 2) return null;
@@ -1075,12 +1362,111 @@ function rewritePlan(cmd) {
   // A `..` segment: extractSearchPath refuses to scope it, so the answer would
   // search the whole repo (round 4 M2).
   if (target && /(?:^|\/)\.\.(?:\/|$)/.test(target.text)) return null;
+  // GNU grep applies --include to a file named on the command line too, so
+  // `grep --include='*.py' X src/a.rs` finds nothing; rg — and so cg — searches
+  // a named file whatever its -g says (D#78). Equivalent only for a directory.
+  if (include && target && !isDir(target.text)) return null;
+  // Plain grep without -r reads no directory ("Is a directory") and, with no
+  // path, reads stdin; the answer would search the tree (D#125 #3). rg and ag
+  // recurse by default, and git grep searches the tracked tree.
+  if (verb === 'grep' && !recursive && (!target || isDir(target.text))) return null;
   // ag is smart-case by default: an all-lowercase pattern matches any case,
   // and cg's search is case-sensitive, so the answer would find less.
   if (verb === 'ag' && !caseFlag && !/[A-Z]/.test(pattern.text)) return null;
   return { pattern: pattern.text, target: target ? target.text : undefined, context };
 }
 
+// D#125 #3 for the PostToolUse side, which has no rewrite grammar: a plain
+// `grep` with no recursion flag searches no directory ("Is a directory" under
+// GNU grep) and, with no path, reads its input.
+function grepSearchesNoDirectory(clause, target, isDir) {
+  const words = shellWords(clause || '');
+  if (!words || words.length === 0 || words[0].anyQuoted || words[0].text !== 'grep') return false;
+  for (let k = 1; k < words.length; k++) {
+    const w = words[k];
+    if (w.op || w.startsQuoted) continue;
+    if (w.text === '--') break;
+    if (/^--(?:recursive|dereference-recursive|directories=recurse)$/.test(w.text)) return false;
+    if (w.text === '-d' && words[k + 1] && words[k + 1].text === 'recurse') return false;
+    if (/^-[^-]/.test(w.text)) {
+      for (const ch of w.text.slice(1)) {
+        if (ch === 'r' || ch === 'R') return false;
+        if ('ABCefmdDg'.includes(ch)) break;  // the rest is that flag's value
+      }
+    }
+  }
+  return target === undefined || isDir(target);
+}
+
+// Does `rootTarget`, run from the root, name the path the grep clause's own
+// operand names from `cwd` — the directory the clause ran in? The raw clause is
+// parsed with the rewrite grammar; an absolute operand resolves the same from
+// anywhere. A clause the grammar cannot read proves nothing.
+function operandMatches(rawClause, rootTarget, root, cwd) {
+  const raw = rewritePlan(rawClause, { isDir: (t) => isDirectory(path.resolve(cwd, t)) });
+  if (!raw || raw.target === undefined || rootTarget === undefined) return false;
+  return path.resolve(cwd, raw.target) === path.resolve(root, rootTarget);
+}
+
+// Commands that cannot move the shell: external programs run in a child, and
+// these builtins leave the cwd alone. An allowlist, because the commands that
+// DO move it are open-ended — `builtin cd`, `if cd`, `{ cd …; }`, `eval`,
+// `source`, `popd`, any function (D#73 round 3 reproduced 19 forms).
+const CWD_NEUTRAL = new Set([
+  'echo', 'printf', 'grep', 'rg', 'ag', 'git', 'sed', 'awk', 'cat', 'head', 'tail', 'wc',
+  'ls', 'find', 'sort', 'uniq', 'cut', 'tr', 'diff', 'cmp', 'test', '[', 'true', 'false',
+  ':', 'node', 'python', 'python3', 'cargo', 'npm', 'npx', 'jq', 'xargs', 'tee', 'stat',
+  'file', 'du', 'df', 'date', 'sleep', 'which', 'env', 'export', 'set', 'unset', 'nl',
+  'rm', 'mkdir', 'cp', 'mv', 'touch', 'chmod', 'ln', 'readlink', 'realpath', 'basename',
+  'dirname', 'perl', 'gh', 'curl', 'make', 'bash', 'sh', 'timeout', 'tar', 'sqlite3',
+  'code-graph-mcp', 'nproc', 'rustc', 'go', 'wait', 'column', 'md5sum', 'sha256sum',
+  'od', 'xxd', 'seq', 'paste', 'comm', 'uname', 'id', 'printenv',
+  // If an `exit` before the grep had run, the grep would not have.
+  'exit', 'return',
+]);
+// `X=1 Y=$(mktemp -d)`: a command substitution runs in a subshell.
+const PURE_ASSIGNMENTS =
+  /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=(?:\$\([^()]*\)|"[^"]*"|'[^']*'|[^\s;|&<>()'"]*)\s*)+$/;
+const CD_LITERAL = /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*cd\s+('[^']*'|"[^"$`\\]*"|[^\s'"$`\\~*?[{|;&<>()]+)\s*$/;
+
+/**
+ * The directory `segments[idx]` runs in, or null when the segments before it
+ * could have moved the shell somewhere we cannot name (D#76). Follows
+ * cwd-neutral commands and `cd` to one literal path that exists; a relative
+ * `cd` under a set CDPATH is not literal. A `cd` is followed only when it is
+ * certain to have run if the grep did: it is unconditional (its `seps` entry,
+ * from segmentSeparators, is '', `;` or a newline) or every separator from it
+ * to the grep is `&&`, the one before it included: `true || cd x && grep` is
+ * `(true || cd x) && grep`, which runs the grep without the cd. `false && cd x;
+ * grep` and `cd x | cat` did not move the shell. Without `seps` every segment
+ * counts as unconditional.
+ */
+function segmentCwd(segments, idx, shellCwd, { isDir = isDirectory, seps } = {}) {
+  let cwd = shellCwd;
+  const ran = (k) => !seps || SEP_RANK[seps[k]] <= 1
+    || seps.slice(k, idx + 1).every((x) => x === '&&');
+  for (let k = 0; k < idx; k++) {
+    const seg = segments[k];
+    if (/^\s*#/.test(seg) || PURE_ASSIGNMENTS.test(seg)) continue;
+    const clause = firstShellClause(seg);
+    const cd = CD_LITERAL.exec(seg);
+    if (cd) {
+      if (!ran(k)) return null;
+      const arg = /^['"]/.test(cd[1]) ? cd[1].slice(1, -1) : cd[1];
+      if (!arg || arg === '-' || (!path.isAbsolute(arg) && process.env.CDPATH)) return null;
+      const next = path.resolve(cwd, arg);
+      if (!isDir(next)) return null;  // `cd x; grep` runs the grep where it was
+      try { cwd = fs.realpathSync(next); } catch { cwd = next; }
+      continue;
+    }
+    const words = clauseWords(clause);
+    if (!words) return null;
+    const head = words.find((w) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(w.text));
+    if (head && !(head.quotedFrom === -1 && CWD_NEUTRAL.has(head.text))) return null;
+  }
+  return cwd;
+}
+
 // The plan must describe the same search classifyBlock decided on. The pattern
 // the answer ran is picked from quoted spans (pickBlockPattern); the grammar's
 // pattern operand is the one the shell passes — `"is"'Foo'` or an unquoted
@@ -1100,6 +1486,10 @@ function rewriteMatchesBlock(plan, block, cmd, rawPattern) {
   if (block.mode === 'show') {
     const f = cgFlagSet(extractCgFlags(cmd));
     if (f.has('-l') || f.has('-c')) return false;
+    // `show` has no file filter: `--include`/`-g`/`-t` excluded definitions it
+    // would print (review of D#125).
+    const all = extractCgFlags(cmd);
+    if (all.includes('-g') || all.includes('-t')) return false;
     // show answers at most three symbols; a fourth would silently vanish.
     if (extractDeclSymbols(extractPatterns(cmd)).length > 3) return false;
   }
@@ -1124,11 +1514,89 @@ function translateBreToRg(cmd, pattern) {
   // the two hooks, because post-grep-inject passes a SEGMENT here while the deny
   // path passes the whole command — the same pattern then filed under two
   // spellings and the funnel scored a verbatim re-grep as neutral.
-  const clause = firstShellClause(cmd);
-  if (/(?:^|\s)-[a-zA-Z]*[EP][a-zA-Z]*(?:\s|=|\d|$)|--(?:extended-regexp|perl-regexp)\b/.test(clause)) {
-    return pattern;
+  // Read from the clause's words, like extractCgFlags: a pattern holding ` -E `
+  // is not the flag (review of D#62).
+  const words = clauseWords(firstShellClause(cmd).replace(VERB_STRIP, '')) || [];
+  const extended = words.some((w) => w.quotedFrom === -1
+    && (/^-[a-zA-Z]*[EP][a-zA-Z]*(?:=|\d|$)/.test(w.text) || /^--(?:extended-regexp|perl-regexp)$/.test(w.text)));
+  if (extended) return pattern;
+  return breToRustRegex(pattern);
+}
+
+// The two dialects swap these characters' roles: in a basic regex `( ) { } + ?
+// |` are literals and `\(` … `\|` the operators, in rust regex the reverse. Only
+// unescaping the operators (the translation until D#65) left the literals as
+// operators, so `tombstoneActive()` searched `tombstoneActive` and the rewrite
+// returned a superset of grep's lines. Checked against the grep Claude Code's
+// shell runs (ugrep -G): `f()`, `a+b`, `a|b`, `{x}`, `a?` match only literally.
+//
+// A bracket expression is copied as written. Inside one, BRE has no escapes and
+// rust has escapes, `[` nesting and the `&&` `--` `~~` set operators, so a
+// bracket holding any of those means different things in the two; that pattern
+// is untranslatable and the result is null — the caller lets the grep run.
+// (`[:alpha:]` is a POSIX class in both and is kept.)
+//
+// Escapes: only the ones both read alike pass — the swapped operators, the
+// word/space/boundary classes, and an escaped metacharacter. `\1`, `\d`, `\z`,
+// `\_`, `\=` mean something else (or are an error) in one of the two, and so
+// do an empty group `\(\)`, an unknown `[:class:]` and a leading `]` in a
+// bracket (review of D#65).
+const BRE_SWAPPED = '(){}+?|';
+const BRE_SAME_ESCAPE = 'wWsSbB<>.*[]^$\\/';
+const POSIX_CLASSES = new Set(['alpha', 'digit', 'alnum', 'upper', 'lower', 'space',
+  'punct', 'xdigit', 'blank', 'cntrl', 'graph', 'print']);
+// An unescaped `^` is an anchor only where an alternative starts (the pattern's
+// start, after `\(` or `\|`), and `$` only where one ends (the pattern's end,
+// before `\)` or `\|`); elsewhere BRE reads them as literals and rust regex as
+// anchors — `getUser\|$user_id` searched the text `$user_id` (D#125 #6). No
+// translation: the grep runs.
+function breToRustRegex(pattern) {
+  let out = '';
+  let altStart = true;
+  let anchor = false;
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    const wasAltStart = altStart;
+    const wasAnchor = anchor;
+    altStart = false;
+    anchor = c === '^' && wasAltStart;
+    if (c === '\\' && i + 1 < pattern.length) {
+      const n = pattern[++i];
+      if (n === '(' && pattern.startsWith('\\)', i + 1)) return null;
+      if (BRE_SWAPPED.includes(n)) out += n;
+      else if (BRE_SAME_ESCAPE.includes(n)) out += c + n;
+      else return null;
+      altStart = n === '(' || n === '|';
+      continue;
+    }
+    if (c === '^' && !wasAltStart) return null;
+    // A `*` where an alternative starts, or right after its `^`, repeats
+    // nothing: BRE reads it as a literal, rust regex as an error or a repeat of
+    // the anchor (review of D#125).
+    if (c === '*' && (wasAltStart || (wasAnchor && out.endsWith('^')))) return null;
+    if (c === '$' && i + 1 < pattern.length
+      && !pattern.startsWith('\\)', i + 1) && !pattern.startsWith('\\|', i + 1)) return null;
+    if (BRE_SWAPPED.includes(c)) { out += '\\' + c; continue; }
+    if (c !== '[') { out += c; continue; }
+    // `]` right after `[` or `[^` is a member, not the end.
+    let j = i + 1;
+    if (pattern[j] === '^') j++;
+    if (pattern[j] === ']') return null;
+    for (; j < pattern.length && pattern[j] !== ']'; j++) {
+      if (pattern[j] === '[' && pattern[j + 1] === ':') {
+        const close = pattern.indexOf(':]', j + 2);
+        if (close === -1 || !POSIX_CLASSES.has(pattern.slice(j + 2, close))) return null;
+        j = close + 1;
+        continue;
+      }
+      if (pattern[j] === '\\' || pattern[j] === '[') return null;
+      if ('&-~'.includes(pattern[j]) && pattern[j + 1] === pattern[j]) return null;
+    }
+    if (j >= pattern.length) return null;  // unterminated: grep reports an error
+    out += pattern.slice(i, j + 1);
+    i = j;
   }
-  return pattern.replace(/\\([|(){}+?])/g, '$1');
+  return out;
 }
 
 // v0.47.0 — cg grep found nothing. Regex-dialect differences (BRE `\|` vs
@@ -1290,6 +1758,7 @@ function runMain() {
   // forwarding `-F` without this guard would make it search the wrong text.
   const cgFlags = extractCgFlags(cmd);
   const rawGrepPattern = pickBlockPattern(cmd);
+  if (!rootOnlyInSearchPath(rawCmd, root, extractSearchPath(cmd))) return;
   const grepPattern = cgFlagSet(cgFlags).has('-F')
     ? rawGrepPattern
     : translateBreToRg(cmd, rawGrepPattern);
@@ -1334,8 +1803,17 @@ function runMain() {
   // The rewrite replaces the WHOLE command. One it cannot reproduce runs as
   // typed (see rewritePlan) — decided before the answer is spent on it. The
   // opt-in static deny keeps its own, older scope.
-  const plan = block && !isAnswerDisabled() ? rewritePlan(cmd) : null;
+  const plan = block && !isAnswerDisabled()
+    ? rewritePlan(cmd, { isDir: (t) => isDirectory(path.resolve(root, t)) })
+    : null;
   if (block && !isAnswerDisabled() && !rewriteMatchesBlock(plan, block, cmd, rawGrepPattern)) return;
+  // A pattern the dialect bridge cannot translate (null) has no equivalent search.
+  if (block && !isAnswerDisabled() && block.mode === 'grep' && grepPattern === null) return;
+  // D#76 — the rewrite searches its root-relative target from the root; the
+  // command searched its own operand from the shell's cwd. From a subdirectory
+  // the rebase moves only operands that exist there, so an operand it left
+  // alone (`src/` from `xtask/`, `tests/` from `src/`) names another directory.
+  if (plan && relPrefix && !operandMatches(rawCmd, plan.target, root, shellCwd)) return;
   if (block) {
     // v0.47.0 — run the AST-aware equivalent inside the hook and embed the
     // results in the deny reason ("answer in the deny"). Degrades to the
@@ -1359,7 +1837,12 @@ function runMain() {
         // No fallback to a grep answer: a context grep (`-A5`) asked for the
         // body, and the grep rewrite would drop the context silently (pre-ship
         // review round 2). A show miss lets the raw grep run.
-        answer = runShowAnswer({ cwd: root, symbols: block.symbols });
+        // Scoped to the grep's path: `show` alone answers the whole project
+        // (D#125 #2 — `grep -A3 "fn f" lib/` was answered from src/).
+        answer = runShowAnswer({
+          cwd: root, symbols: block.symbols, within: searchPath ?? '',
+          kinds: declKindsBySymbol(extractPatterns(cmd)),
+        });
       } else if (pattern) {
         answer = runGrepAnswer({ cwd: root, pattern, searchPath, flags });
       }
@@ -1431,7 +1914,7 @@ function runMain() {
     // stderr; the grep being replaced has no cap (round 3 M4). Only here, not
     // in the in-hook answer, which is a has-hits probe.
     const argvList = answeredMode === 'show'
-      ? answer.symbols.map((sym) => ['show', sym])
+      ? answer.argvs
       : [[...args.slice(0, 1), '-m', '0', ...args.slice(1)]];
     const command = buildRewriteCommand(argvList, {
       invocation: shellQuoteArg(resolveAnswerBinary({})),
@@ -1481,6 +1964,9 @@ module.exports = {
   shellWords,            // rewrite — the tokenizer rewritePlan's grammar reads
   rewritePlan,           // rewrite — does the whole command parse as one the rewrite reproduces
   rewriteMatchesBlock,   // rewrite — does that plan describe the search classifyBlock chose
+  operandMatches,        // D#76 — does a root-relative target name the path the command searched
+  segmentCwd,            // D#76 — the directory a compound command's segment runs in
+  segmentSeparators,     // D#76 — the separator before each top-level segment
   extractSedReadTargets, // v0.49 — sed-range reads feed the read-fanout state
   extractUnansweredTail, // v0.50 — compound-tail honesty in answered denies
   extractPatterns,    // v0.32.1 — exposed for tests
@@ -1489,6 +1975,10 @@ module.exports = {
   isRevisionScopedGitGrep, // v0.71 — git grep --cached/treeish exclusion
   extractSearchPath,  // v0.47.0 — deny-with-answer
   normalizeCommandPaths, // v0.47.1 — abs-path matcher fix
+  rootOnlyInSearchPath, // D#125 #1
+  isDirectory,
+  grepSearchesNoDirectory, // D#125 #3
+  declKindsBySymbol, // D#125 #2 review
   resolveProjectRoot,    // v0.48 — subdir-cwd dark fix
   rebaseRelativePaths,   // v0.48 — subdir-cwd dark fix
   commandHasBypass,      // v0.48 — bypass funnel visibility

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.159.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.161.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.159.0",
+  "version": "0.161.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.159.0",
-    "@sdsrs/code-graph-linux-arm64": "0.159.0",
-    "@sdsrs/code-graph-darwin-x64": "0.159.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.159.0",
-    "@sdsrs/code-graph-win32-x64": "0.159.0"
+    "@sdsrs/code-graph-linux-x64": "0.161.0",
+    "@sdsrs/code-graph-linux-arm64": "0.161.0",
+    "@sdsrs/code-graph-darwin-x64": "0.161.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.161.0",
+    "@sdsrs/code-graph-win32-x64": "0.161.0"
   }
 }