@sdsrs/code-graph 0.160.0 → 0.162.0

package/claude-plugin/scripts/pre-grep-guide.js

@@ -50,6 +50,8 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('Pr
 
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
+const { hidden } = require('./proc-opts');
 const { cgTmpDir, cwdHash, makeCooldown } = require('./tmp-dir');
 const { recordRecommendation } = require('./recommendation-log');
 const {
@@ -376,6 +378,38 @@ function clauseWords(s) {
 // name the exact symbols the model wants to READ — extract them for `show`.
 const DECL_SYMBOL = /(?:fn|def|class|function|struct|impl|trait)\s+([A-Za-z_][A-Za-z0-9_]*)/g;
 
+// What a `show` definition must be for the grep's declaration keyword to match
+// its line: the kind label `show` prints (src/cli/symbols.rs
+// format_node_compact) AND a file of a language that spells the declaration
+// with that keyword. The label alone is coarser than the keyword — `fn` is also
+// a Python `def` and a TS method, and a Swift `struct` is labelled `class`
+// (review of D#125, round 2). `impl` names no definition of its own.
+const DECL_KEYWORD_SHAPES = {
+  fn: { labels: ['fn'], exts: ['rs'] },
+  def: { labels: ['fn'], exts: ['py', 'rb'] },
+  function: { labels: ['fn'], exts: ['js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'php', 'sh', 'bash'] },
+  class: {
+    labels: ['class'],
+    exts: ['py', 'js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'java', 'kt', 'cs', 'php', 'rb', 'dart',
+      'cpp', 'cc', 'hpp', 'h', 'scala'],
+  },
+  struct: { labels: ['struct'], exts: ['rs', 'go', 'c', 'h', 'cpp', 'cc', 'hpp', 'cs'] },
+  trait: { labels: ['trait', 'iface'], exts: ['rs', 'php', 'scala'] },
+  impl: { labels: [], exts: [] },
+};
+
+// Symbol → the (label, extension) shapes its declaration keywords match
+// (`fn foo\|def foo` → foo: Rust fn, Python/Ruby def).
+function declKindsBySymbol(patterns) {
+  const out = {};
+  for (const p of patterns) {
+    for (const m of p.matchAll(/\b(fn|def|class|function|struct|impl|trait)\s+([A-Za-z_][A-Za-z0-9_]*)/g)) {
+      (out[m[2]] = out[m[2]] || []).push(DECL_KEYWORD_SHAPES[m[1]]);
+    }
+  }
+  return out;
+}
+
 function extractDeclSymbols(patterns) {
   const out = [];
   for (const p of patterns) {
@@ -656,6 +690,30 @@ function normalizeCommandPaths(cmd, cwd) {
   return cmd.split(cwd.endsWith('/') ? cwd : cwd + '/').join('');
 }
 
+// D#125 #1 — the strip above cannot tell a path operand from a PATTERN, and
+// strips both: `grep -rn "<root>/Foo" src/` searches the literal text
+// `<root>/Foo`, but was answered for `Foo`. Re-picking the pattern with the
+// root marked was tried first and missed shapes where the mark changes which
+// word is picked (`"<root>/def foo"`, `"abc_<root>/def"`: review of D#125). The
+// narrow form: every shell word that holds `<root>/` must BE the search path
+// the answer scopes to; anything else runs as typed.
+function rootOnlyInSearchPath(cmd, cwd, target) {
+  if (!cmd || typeof cmd !== 'string') return true;
+  if (!cwd || typeof cwd !== 'string' || cwd === '/') return true;
+  const prefix = cwd.endsWith('/') ? cwd : cwd + '/';
+  if (!cmd.includes(prefix)) return true;
+  // Round 2: counting words was not enough — a lone root-holding PATTERN whose
+  // stripped text equals the path (`grep -rn "<root>/src/x" src/x`) passed. The
+  // rewrite grammar names which word is the path operand: accept only a command
+  // it reads, with the root once, in that operand, and nowhere in the pattern.
+  if (cmd.split(prefix).length !== 2) return false;
+  const plan = rewritePlan(firstShellClause(cmd), { isDir: () => true });
+  if (!plan || plan.target === undefined || plan.pattern.includes(prefix)) return false;
+  if (!plan.target.startsWith(prefix)) return false;
+  const norm = (p) => p.replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+  return target !== undefined && norm(plan.target.slice(prefix.length)) === norm(target);
+}
+
 // v0.48 — subdir-cwd fix; v0.49 — extracted to project-root.js so the read
 // hook shares it. Re-exported below for test/back-compat.
 const { resolveProjectRoot } = require('./project-root');
@@ -1199,8 +1257,10 @@ function shellWords(s) {
 // (recursion, line numbers, filenames, binary skipping, the regex dialect).
 // Per verb, because letters differ: ag's `-n` is --norecurse and `-H` is
 // --heading, rg's `-r` is --replace. Context letters (A/B/C, a count value)
-// only reach the rewrite in `show` mode, which answers with the body.
-const ALLOWED_SHORT = { grep: 'rRnHsIiwFlcEPABC', git: 'rnHIiwFlcEPABC', rg: 'nHiwFlcsABC', ag: 'iwlcsABC' };
+// only reach the rewrite in `show` mode, which answers with the body. Not
+// `-R`: it follows every symlink under the path, which cg's walk does not
+// (review of D#133, M-1).
+const ALLOWED_SHORT = { grep: 'rnHsIiwFlcEPABC', git: 'rnHIiwFlcEPABC', rg: 'nHiwFlcsABC', ag: 'iwlcsABC' };
 const VALUE_SHORT_BY_VERB = { grep: 'ABC', git: 'ABC', rg: 'gtABC', ag: 'ABC' };
 const COMMON_LONG = ['ignore-case', 'word-regexp', 'fixed-strings', 'files-with-matches', 'count', 'line-number'];
 const ALLOWED_LONG = {
@@ -1245,6 +1305,7 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
   let context = false;
   let endOfFlags = false;
   let include = false;
+  let recursive = false;
   for (; i < words.length; i++) {
     const w = words[i];
     if (!w.anyQuoted && (w.text === '2>&1' || w.text === '2>/dev/null')) continue;
@@ -1258,8 +1319,8 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
       const attachedFilter = /^--(?:include|glob|type)=/.test(w.text) || (verb === 'rg' && /^-[gt]./.test(w.text));
       if (!attachedFilter || w.bareOp) return null;
       // GNU grep's --include has no `!` negation and no `{a,b}` alternatives;
-      // cg's -g has both (round 4 L2; review of D#78).
-      if (/^--include=(?:!|.*\{)/.test(w.text)) return null;
+      // cg's -g has both (round 4 L2; review of D#78). Checked with the other
+      // --include value rules below.
     }
     if (w.text === '--') { endOfFlags = true; continue; }
     if (w.text.startsWith('--')) {
@@ -1267,9 +1328,20 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
       const name = w.text.slice(2, eq === -1 ? undefined : eq);
       if (!ALLOWED_LONG[verb].has(name)) return null;
       if (name === 'include') include = true;
+      if (name === 'recursive') recursive = true;
+      // GNU grep and ugrep print a `file:0` row for every file searched; cg,
+      // rg and git grep print only files with matches (D#133 #12).
+      if (name === 'count' && verb === 'grep') return null;
       if (VALUE_LONG.has(name) && eq === -1) {
         const v = words[++i];
-        if (!valueWordOk(v, false) || (name === 'include' && /^!|\{/.test(v.text))) return null;
+        if (!valueWordOk(v, false)) return null;
+      }
+      // GNU grep matches --include against the file's base name, so a glob
+      // with `/` or `**` finds nothing there; cg's -g matches the path
+      // (D#133 #7). Checked however the value is quoted or attached.
+      if (name === 'include') {
+        const v = eq === -1 ? words[i].text : w.text.slice(eq + 1);
+        if (/^!|[{/]|\*\*/.test(v)) return null;
       }
       if (name === 'ignore-case' || name === 'case-sensitive') caseFlag = true;
       continue;
@@ -1277,6 +1349,7 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
     const letters = w.text.slice(1);
     for (let k = 0; k < letters.length; k++) {
       const ch = letters[k];
+      if (ch === 'c' && verb === 'grep') return null;  // D#133 #12, as --count above
       if (valueShort.includes(ch)) {
         const isCount = 'ABC'.includes(ch);
         if (isCount) context = true;
@@ -1290,6 +1363,7 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
       }
       if (!allowed.includes(ch)) return null;
       if (ch === 'i' || ch === 's') caseFlag = true;
+      if (ch === 'r' || ch === 'R') recursive = true;
     }
   }
   if (operands.length === 0 || operands.length > 2) return null;
@@ -1307,10 +1381,169 @@ function rewritePlan(cmd, { isDir = looksLikeDir } = {}) {
   // `grep --include='*.py' X src/a.rs` finds nothing; rg — and so cg — searches
   // a named file whatever its -g says (D#78). Equivalent only for a directory.
   if (include && target && !isDir(target.text)) return null;
+  // Plain grep without -r reads no directory ("Is a directory") and, with no
+  // path, reads stdin; the answer would search the tree (D#125 #3). rg and ag
+  // recurse by default, and git grep searches the tracked tree.
+  if (verb === 'grep' && !recursive && (!target || isDir(target.text))) return null;
   // ag is smart-case by default: an all-lowercase pattern matches any case,
   // and cg's search is case-sensitive, so the answer would find less.
   if (verb === 'ag' && !caseFlag && !/[A-Z]/.test(pattern.text)) return null;
-  return { pattern: pattern.text, target: target ? target.text : undefined, context };
+  return { verb, pattern: pattern.text, target: target ? target.text : undefined, context };
+}
+
+/**
+ * Does the answer search the same files the grep would (D#133 #8)?
+ *
+ * cg searches ripgrep's walk (not hidden, not ignored) plus every git-tracked
+ * file. The verbs it replaces each search another set, measured on one fixture
+ * with each tool:
+ *   - grep -r (GNU, and ugrep as Claude Code's shell runs it) also reads
+ *     untracked hidden and ignored files, and ugrep skips a tracked ignored
+ *     file when the .gitignore naming it sits inside the searched path;
+ *   - git grep reads tracked files only, not untracked ones;
+ *   - rg and ag skip tracked hidden and tracked ignored files.
+ * So the answer is equivalent only when the path holds none of the files that
+ * set the two apart. Outside a git work tree cg searches ripgrep's walk alone:
+ * a hidden entry, or an ignore file ripgrep, ag or ugrep reads, differs from
+ * grep -r. Any failure to tell (git missing, a timeout, a walk too large) is
+ * a difference: the grep runs.
+ *
+ * Review of D#133 found what git's view leaves out, and each now declines for
+ * every verb:
+ *   - H-1: ripgrep reads `.ignore` and `.rgignore` (ag `.agignore`) inside
+ *     the path and in every directory above it, up to `/`; git reads none of
+ *     them. cg passes rg no `--no-config`, so RIPGREP_CONFIG_PATH changes its
+ *     search too.
+ *   - M-1: grep -r and rg skip a symlink met while recursing, cg names a
+ *     tracked one on rg's command line (followed) and git grep searches the
+ *     link's text; git grep does not enter a submodule, cg's walk does.
+ * With `show`, the answer is the index's, whose walk (src/indexer/merkle.rs)
+ * also skips hidden entries even when tracked, the INDEX_EXCLUDED_DIRS
+ * segments, files of no detected language (src/utils/config.rs), files over
+ * max_file_size (src/domain.rs) and tracked ignored files; any of them in the
+ * path declines (H-2). The three lists are pinned to the Rust source by test.
+ * @param {{root: string, target?: string, verb: string, show?: boolean}} opts
+ *   `target` is root-relative (undefined: the whole root).
+ */
+const HIDDEN_SEGMENT = /(?:^|\/)\.(?!\.?(?:\/|$))/;
+const RG_ONLY_IGNORE_FILES = ['.ignore', '.rgignore', '.agignore'];
+const WALK_LIMIT = 20000;
+const INDEX_EXCLUDED_DIRS = ['node_modules', 'vendor', 'target', 'bower_components'];
+const INDEX_EXTENSIONS = new Set(['rs', 'ts', 'tsx', 'js', 'jsx', 'mjs', 'cjs', 'go', 'py', 'pyi', 'java',
+  'c', 'h', 'cpp', 'cc', 'cxx', 'hpp', 'hh', 'hxx', 'html', 'htm', 'css', 'cs', 'kt', 'kts', 'rb', 'php',
+  'swift', 'dart', 'md', 'mdx', 'markdown', 'sh', 'bash', 'json']);
+const INDEX_DEFAULT_MAX_FILE_SIZE = 1048576;
+// As src/domain.rs reads it: a u64, else the default. The hook sees its own
+// environment, not the index process's.
+function indexMaxFileSize(env = process.env) {
+  const raw = env.CODE_GRAPH_MAX_FILE_SIZE;
+  return typeof raw === 'string' && /^\+?\d+$/.test(raw) ? Number(raw) : INDEX_DEFAULT_MAX_FILE_SIZE;
+}
+// Does the index read this root-relative file (by name; size is separate)?
+function indexReadsPath(rel) {
+  const segs = rel.split('/');
+  if (segs.some((s) => s.startsWith('.') || INDEX_EXCLUDED_DIRS.includes(s))) return false;
+  const base = segs[segs.length - 1];
+  const dot = base.lastIndexOf('.');
+  return dot > 0 && INDEX_EXTENSIONS.has(base.slice(dot + 1));
+}
+// Is there a ripgrep-only ignore file in `dir` or any directory above it?
+function rgIgnoreAbove(dir) {
+  for (let d = dir; ; d = path.dirname(d)) {
+    if (RG_ONLY_IGNORE_FILES.some((f) => fs.existsSync(path.join(d, f)))) return true;
+    if (path.dirname(d) === d) return false;
+  }
+}
+// A listed entry that cannot be read counts as a symlink (the caller declines);
+// a missing path does not.
+function isSymlink(p, { missing = true } = {}) {
+  try { return fs.lstatSync(p).isSymbolicLink(); } catch { return missing; }
+}
+function searchesSameFiles({ root, target, verb, show = false } = {}) {
+  if (!root || !['grep', 'git', 'rg', 'ag'].includes(verb)) return false;
+  const rel = target === undefined ? '' : String(target).replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+  if (rel.split('/').includes('..') || path.isAbsolute(rel)) return false;
+  if (process.env.RIPGREP_CONFIG_PATH) return false;
+  if (rgIgnoreAbove(path.join(root, rel))) return false;
+  const maxSize = indexMaxFileSize();
+  // For `show`: every file the grep reads must be one the index holds.
+  const indexHolds = (files) => files.length <= WALK_LIMIT && files.every((f) => {
+    if (!indexReadsPath(f)) return false;
+    try { return fs.statSync(path.join(root, f)).size <= maxSize; } catch { return false; }
+  });
+  const git = (args) => {
+    const budget = require('./hook-fail-open').remainingMs(1500);
+    if (budget === null) return { status: null, stdout: '' };
+    return spawnSync('git', args, hidden({
+      cwd: root, encoding: 'utf8', timeout: budget, killSignal: 'SIGKILL',
+      maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],
+    }));
+  };
+  const inside = git(['rev-parse', '--is-inside-work-tree']);
+  if (inside.status === 0 && String(inside.stdout).trim() === 'true') {
+    const ls = (...opts) => {
+      const r = git(['ls-files', '-z', ...opts, '--', rel || '.']);
+      return r.status === 0 ? String(r.stdout).split('\0').filter(Boolean) : null;
+    };
+    const staged = ls('--cached', '--stage');           // "<mode> <sha> <n>\t<path>"
+    const others = ls('--others', '--exclude-standard'); // untracked, not ignored
+    const ignoredOthers = ls('--others', '--ignored', '--exclude-standard', '--directory');
+    const ignoredTracked = ls('--cached', '--ignored', '--exclude-standard');
+    if (!staged || !others || !ignoredOthers || !ignoredTracked) return false;
+    const tracked = [];
+    for (const e of staged) {
+      // 120000: a symlink; 160000: a submodule (M-1).
+      if (/^1[26]0000 /.test(e)) return false;
+      tracked.push(e.slice(e.indexOf('\t') + 1));
+    }
+    // An untracked nested repository is listed as `dir/`; a symlink as a file.
+    if (others.length > WALK_LIMIT || others.some((f) => f.endsWith('/') || isSymlink(path.join(root, f)))) return false;
+    const base = (f) => path.posix.basename(f.replace(/\/+$/, ''));
+    if ([tracked, others, ignoredOthers].some((l) => l.some((f) => RG_ONLY_IGNORE_FILES.includes(base(f))))) return false;
+    const anyHidden = (l) => l.some((f) => HIDDEN_SEGMENT.test(f));
+    let reads;
+    if (verb === 'grep') {
+      if (anyHidden(others) || ignoredOthers.length || ignoredTracked.length) return false;
+      reads = [...tracked, ...others];
+    } else if (verb === 'git') {
+      if (others.length) return false;
+      reads = tracked;
+    } else {
+      if (anyHidden(tracked) || ignoredTracked.length) return false;
+      reads = [...tracked, ...others.filter((f) => !HIDDEN_SEGMENT.test(f))];
+    }
+    return !show || (ignoredTracked.length === 0 && indexHolds(reads));
+  }
+  // 128 is git's "not a git repository"; anything else is a failure to tell.
+  if (inside.status !== 128) return false;
+  // Not a work tree: ripgrep's walk. A .gitignore from the root down to the
+  // path (ugrep reads it; ripgrep's own ignore files were checked above), a
+  // hidden or symlinked directory on the way, or any hidden entry or symlink
+  // inside it sets the verbs apart.
+  let dir = root;
+  for (const seg of ['', ...(rel ? rel.split('/') : [])]) {
+    if (seg) dir = path.join(dir, seg);
+    if (seg.startsWith('.') || (seg && isSymlink(dir, { missing: false }))) return false;
+    if (fs.existsSync(path.join(dir, '.gitignore'))) return false;
+  }
+  const start = path.join(root, rel);
+  const files = [];
+  let seen = 0;
+  const stack = [start];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (++seen > WALK_LIMIT) return false;
+      if (e.name.startsWith('.') || e.isSymbolicLink()) return false;
+      if (e.isDirectory()) stack.push(path.join(d, e.name));
+      else if (show) files.push(path.relative(root, path.join(d, e.name)).split(path.sep).join('/'));
+    }
+  }
+  // A file named as the path itself: its own entry was never listed.
+  if (show && rel && files.length === 0 && !isDirectory(start)) files.push(rel);
+  return !show || indexHolds(files);
 }
 
 // Does `rootTarget`, run from the root, name the path the grep clause's own
@@ -1336,9 +1569,13 @@ const CWD_NEUTRAL = new Set([
   'dirname', 'perl', 'gh', 'curl', 'make', 'bash', 'sh', 'timeout', 'tar', 'sqlite3',
   'code-graph-mcp', 'nproc', 'rustc', 'go', 'wait', 'column', 'md5sum', 'sha256sum',
   'od', 'xxd', 'seq', 'paste', 'comm', 'uname', 'id', 'printenv',
-  // If an `exit` before the grep had run, the grep would not have.
-  'exit', 'return',
+  // Not `exit` or `return` (D#133 #10): if one before the grep ran, the grep
+  // did not, and its output is empty exactly when the inject fires. `set` is
+  // neutral only without errexit — see segmentCwd.
 ]);
+// `set -e`, `set -euo pipefail`, `set -o errexit`: from here a failing command
+// ends the script, so a later grep may not have run.
+const SET_ERREXIT = /(?:^|\s)(?:-[a-zA-Z]*e[a-zA-Z]*|errexit)(?=\s|$)/;
 // `X=1 Y=$(mktemp -d)`: a command substitution runs in a subshell.
 const PURE_ASSIGNMENTS =
   /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=(?:\$\([^()]*\)|"[^"]*"|'[^']*'|[^\s;|&<>()'"]*)\s*)+$/;
@@ -1378,6 +1615,7 @@ function segmentCwd(segments, idx, shellCwd, { isDir = isDirectory, seps } = {})
     if (!words) return null;
     const head = words.find((w) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(w.text));
     if (head && !(head.quotedFrom === -1 && CWD_NEUTRAL.has(head.text))) return null;
+    if (head && head.text === 'set' && SET_ERREXIT.test(clause.replace(/^\s*set\b/, ''))) return null;
   }
   return cwd;
 }
@@ -1401,37 +1639,246 @@ function rewriteMatchesBlock(plan, block, cmd, rawPattern) {
   if (block.mode === 'show') {
     const f = cgFlagSet(extractCgFlags(cmd));
     if (f.has('-l') || f.has('-c')) return false;
+    // `show` has no file filter: `--include`/`-g`/`-t` excluded definitions it
+    // would print (review of D#125).
+    const all = extractCgFlags(cmd);
+    if (all.includes('-g') || all.includes('-t')) return false;
     // show answers at most three symbols; a fourth would silently vanish.
     if (extractDeclSymbols(extractPatterns(cmd)).length > 3) return false;
+    if (!showAnswersPattern(plan.pattern, cmd)) return false;
   }
   return true;
 }
 
+// One alternative `show` answers: a declaration keyword, the name, and an end
+// of word (`\b`, or `\>` outside Perl) unless -w supplies it.
+const SHOW_ALT = /^(fn|def|class|function|struct|trait) +([A-Za-z_][A-Za-z0-9_]*)(\\b|\\>)?$/;
+
+/**
+ * Does `show` print exactly the definitions this grep's pattern matches?
+ * `show` answers whole names, case-sensitively, whatever surrounds them (0.161.0
+ * Not covered, D#133): `fn foo` also matches `fn foobar`, `-i` matches `Foo`,
+ * `pub fn foo` misses a private `fn foo`, `def foo(` misses a Ruby `def foo`,
+ * and an alternative without a keyword matches lines `show` never prints. So
+ * every alternative must be `KEYWORD NAME` ending the word, and nothing else.
+ */
+function showAnswersPattern(pattern, cmd) {
+  if (typeof pattern !== 'string') return false;
+  const flags = cgFlagSet(extractCgFlags(cmd));
+  if (flags.has('-i')) return false;
+  const fixed = flags.has('-F');
+  const word = flags.has('-w');
+  const dialect = patternDialect(cmd);
+  if (dialect === 'conflict') return false;
+  const alts = fixed ? [pattern] : pattern.split(dialect === 'basic' ? '\\|' : '|');
+  return alts.every((alt) => {
+    const m = SHOW_ALT.exec(alt);
+    if (!m) return false;
+    if (!m[3]) return word;
+    // -F reads `\b` as two characters; PCRE reads `\>` as `>`.
+    return !fixed && !(m[3] === '\\>' && dialect === 'perl');
+  });
+}
+
 // v0.49 — plain `grep` speaks BRE: alternation/grouping arrive escaped
 // (`a\|b`, `\(x\)`) and 0-hit against cg grep's rust-regex dialect, wasting
 // the answer on the ALLOW fallthrough (2026-06-12: both answered:false denies
-// were dialect/path-shape misses). Unescape for plain grep only — rg/ag and
-// grep -E/-P are already extended.
+// were dialect/path-shape misses). Unescape for plain grep only; an -E, -P or
+// ag pattern is passed on only when every dialect reads it alike; rg's is the
+// answer's own. null: no equivalent pattern, the grep runs.
 function translateBreToRg(cmd, pattern) {
   if (typeof pattern !== 'string' || !pattern) return pattern;
-  const verb = (cmd.match(GREP_HEAD) || [])[1];
-  // git grep speaks BRE like plain grep; rg/ag are already extended-regex.
-  if (!verb || !/grep$/.test(verb)) return pattern;
-  // The grep's OWN clause, not the whole command. This was the one flag check
-  // in this module that v0.96 did not clause-scope, and round 4 of pre-ship
-  // review found what it costs: `grep -rln "a\|b" src/ | xargs -P4 wc -l` read
-  // the tail's `-P4` as "this grep speaks Perl regex", so the pattern was left
-  // escaped. On its own that is a wrong dialect decision; it also desynchronised
-  // the two hooks, because post-grep-inject passes a SEGMENT here while the deny
-  // path passes the whole command — the same pattern then filed under two
-  // spellings and the funnel scored a verbatim re-grep as neutral.
-  // Read from the clause's words, like extractCgFlags: a pattern holding ` -E `
-  // is not the flag (review of D#62).
+  const dialect = patternDialect(cmd);
+  if (dialect === 'rust') return pattern;
+  if (dialect === 'conflict') return null;
+  // D#133 #5: an extended or Perl pattern was passed on unchecked, and the
+  // dialects read `\d`, `[\(]`, `a{,2}`, `a+?b` and `(?i)` differently (GNU
+  // grep 3.12, ugrep 7.8 and cg run on one fixture).
+  const out = dialect === 'basic'
+    ? breToRustRegex(pattern)
+    : portableExtended(pattern, { perl: dialect === 'perl' });
+  // ugrep, the `grep` Claude Code's shell runs, prints no line for an empty
+  // match, where GNU grep and rg print every line (review of D#133, M-2).
+  return out !== null && matchesEmpty(out) ? null : out;
+}
+
+/**
+ * Can this pattern (rust syntax, as translateBreToRg returns it) match the
+ * empty string? An assertion (`^`, `$`, `\b`, `\B`, `\<`, `\>`) matches
+ * empty; so does an atom under `*`, `?` or a `{0…}` repeat, a sequence of such
+ * atoms, and an alternation with one such branch (`a|`). Unreadable: true, so
+ * the caller declines.
+ */
+function matchesEmpty(pattern) {
+  let i = 0;
+  let bad = false;
+  const alt = () => {
+    let any = seq();
+    while (pattern[i] === '|') { i++; any = seq() || any; }
+    return any;
+  };
+  const seq = () => {
+    let all = true;
+    while (i < pattern.length && pattern[i] !== '|' && pattern[i] !== ')') {
+      let empty = atom();
+      for (;;) {
+        const c = pattern[i];
+        if (c === '*' || c === '?') { empty = true; i++; continue; }
+        if (c === '+') { i++; continue; }
+        const m = c === '{' ? /^\{(\d+)(?:,\d*)?\}/.exec(pattern.slice(i)) : null;
+        if (!m) break;
+        if (Number(m[1]) === 0) empty = true;
+        i += m[0].length;
+      }
+      all = all && empty;
+    }
+    return all;
+  };
+  const atom = () => {
+    const c = pattern[i];
+    if (c === '(') {
+      i++;
+      const inner = alt();
+      if (pattern[i] !== ')') bad = true;
+      i++;
+      return inner;
+    }
+    if (c === '\\') {
+      const n = pattern[i + 1];
+      i += 2;
+      return n === undefined || 'bB<>'.includes(n);
+    }
+    if (c === '[') {
+      const end = bracketEnd(pattern, i);
+      if (end === -1) { bad = true; i = pattern.length; return true; }
+      i = end + 1;
+      return false;
+    }
+    i++;
+    return c === '^' || c === '$';
+  };
+  const empty = alt();
+  return bad || i < pattern.length || empty;
+}
+
+/**
+ * The regex dialect a grep clause's pattern is written in: 'rust' (rg, the
+ * answer's own), 'perl' (ag, `-P`), 'extended' (`-E`), 'basic' (plain grep
+ * and git grep), or 'conflict' (`-E` and `-P` together, an error to GNU
+ * grep). `-F` is the callers' to read, from extractCgFlags, which
+ * knows a flag's value slot (`--include -F`).
+ *
+ * The grep's OWN clause, not the whole command. This was the one flag check
+ * in this module that v0.96 did not clause-scope, and round 4 of pre-ship
+ * review found what it costs: `grep -rln "a\|b" src/ | xargs -P4 wc -l` read
+ * the tail's `-P4` as "this grep speaks Perl regex", so the pattern was left
+ * escaped. On its own that is a wrong dialect decision; it also desynchronised
+ * the two hooks, because post-grep-inject passes a SEGMENT here while the deny
+ * path passes the whole command — the same pattern then filed under two
+ * spellings and the funnel scored a verbatim re-grep as neutral.
+ * Read from the clause's words, like extractCgFlags: a pattern holding ` -E `
+ * is not the flag (review of D#62). A word that is only quoted (`"-E"`) IS the
+ * flag: the shell strips the quotes before grep reads its argv (D#133 M10).
+ */
+function patternDialect(cmd) {
+  const verb = (String(cmd).match(GREP_HEAD) || [])[1];
+  if (!verb) return 'basic';
+  if (verb === 'rg') return 'rust';
+  if (verb === 'ag') return 'perl';
   const words = clauseWords(firstShellClause(cmd).replace(VERB_STRIP, '')) || [];
-  const extended = words.some((w) => w.quotedFrom === -1
-    && (/^-[a-zA-Z]*[EP][a-zA-Z]*(?:=|\d|$)/.test(w.text) || /^--(?:extended-regexp|perl-regexp)$/.test(w.text)));
-  if (extended) return pattern;
-  return breToRustRegex(pattern);
+  const has = (letter, long) => words.some((w) => w.text === `--${long}`
+    || new RegExp(`^-[a-zA-Z]*${letter}[a-zA-Z]*(?:=|\\d|$)`).test(w.text));
+  const perl = has('P', 'perl-regexp');
+  const extended = has('E', 'extended-regexp');
+  // Both: GNU grep reports "conflicting matchers specified" and exits 2
+  // (review of D#133, L-4); there is no dialect to answer in.
+  if (perl && extended) return 'conflict';
+  if (perl) return 'perl';
+  if (extended) return 'extended';
+  return 'basic';
+}
+
+// An extended (ERE) or Perl pattern that GNU grep, ugrep and rust regex all
+// read alike, returned as is; anything else is null and the grep runs. Only
+// escapes of the word/space/boundary classes and of metacharacters pass, and
+// `\<` `\>` only in ERE (PCRE reads them as the characters `<` `>`). A
+// quantifier with nothing to repeat (so every `(?` group), after another
+// quantifier (`+?` is lazy in rust, a repeated group in ERE) or after an
+// assertion (`\b{2}`, `$+`: an error or a literal to GNU grep, every line to
+// rust), a brace that is not `{n}`, `{n,}` or `{n,m}`, and a bracket holding an
+// escape, a nested `[`, a set operator or a POSIX class are refused. Not
+// `\W`: ugrep's matches a line break, so `\Wfoo` also printed the line before
+// a match; not `\d` `\D` under Perl: ASCII to GNU grep, Unicode to rust, and
+// ugrep's `\D` matches a line break (review of D#133, M-2).
+const EXT_SAME_ESCAPE = 'wsSbB.[]^$*+?(){}|\\/';
+function portableExtended(pattern, { perl = false } = {}) {
+  let atomStart = true;    // a quantifier here would repeat nothing
+  let quantified = false;  // the previous token was a quantifier
+  let assertion = false;   // the previous token matches no character
+  let altStart = true;     // an alternative starts here
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    const wasAltStart = altStart;
+    altStart = false;
+    if (c === '\\') {
+      const n = pattern[i + 1];
+      const same = n !== undefined && (EXT_SAME_ESCAPE.includes(n)
+        || (!perl && (n === '<' || n === '>')));
+      if (!same) return null;
+      i++;
+      atomStart = false;
+      quantified = false;
+      assertion = 'bB<>'.includes(n);
+      continue;
+    }
+    if (c === '*' || c === '+' || c === '?' || c === '{') {
+      if (atomStart || quantified || assertion) return null;
+      if (c === '{') {
+        const m = /^\{\d+(?:,\d*)?\}/.exec(pattern.slice(i));
+        if (!m) return null;
+        i += m[0].length - 1;
+      }
+      quantified = true;
+      continue;
+    }
+    quantified = false;
+    assertion = false;
+    // `^` and `$` only where an alternative starts or ends (so never `$+`):
+    // elsewhere ugrep reads them apart from GNU grep and rust (`\[*^[ab]`
+    // matched `[a]`). A stray `}` is an error to ugrep -P (review of D#133,
+    // M-2).
+    if (c === '^' && !wasAltStart) return null;
+    if (c === '$' && i + 1 < pattern.length && !')|'.includes(pattern[i + 1])) return null;
+    if (c === '}') return null;
+    // After `(`, `|` or `^` a quantifier repeats nothing; that also refuses
+    // every `(?` group (`(?i)`, `(?:`, a lookaround).
+    if (c === '(' || c === '|') altStart = true;
+    if (c === '(' || c === '|' || c === '^') { atomStart = true; continue; }
+    atomStart = false;
+    if (c !== '[') continue;
+    const end = bracketEnd(pattern, i);
+    if (end === -1) return null;
+    i = end;
+  }
+  return pattern;
+}
+
+// The index of the `]` closing the bracket expression opened at `i`, or -1
+// when the bracket reads differently in POSIX and rust regex: POSIX has no
+// escapes in a bracket, rust has escapes, `[` nesting and the `&&` `--` `~~`
+// set operators; a leading `]` is a member in POSIX. A POSIX class
+// (`[:alpha:]`) is ASCII to rust and follows the locale in GNU grep and ugrep
+// (`é`, `٣`; review of D#133, M-2), so it counts as a nested `[`.
+// Unterminated: -1 (grep reports an error).
+function bracketEnd(pattern, i) {
+  let j = i + 1;
+  if (pattern[j] === '^') j++;
+  if (pattern[j] === ']') return -1;
+  for (; j < pattern.length && pattern[j] !== ']'; j++) {
+    if (pattern[j] === '\\' || pattern[j] === '[') return -1;
+    if ('&-~'.includes(pattern[j]) && pattern[j + 1] === pattern[j]) return -1;
+  }
+  return j >= pattern.length ? -1 : j;
 }
 
 // The two dialects swap these characters' roles: in a basic regex `( ) { } + ?
@@ -1450,41 +1897,52 @@ function translateBreToRg(cmd, pattern) {
 // Escapes: only the ones both read alike pass — the swapped operators, the
 // word/space/boundary classes, and an escaped metacharacter. `\1`, `\d`, `\z`,
 // `\_`, `\=` mean something else (or are an error) in one of the two, and so
-// do an empty group `\(\)`, an unknown `[:class:]` and a leading `]` in a
-// bracket (review of D#65).
+// do an empty group `\(\)`, any `[:class:]` and a leading `]` in a bracket
+// (review of D#65), `\W`, which matches a line break in ugrep, and a
+// quantifier after an assertion (`\b*`, `\>\{2\}`; review of D#133, M-2).
 const BRE_SWAPPED = '(){}+?|';
-const BRE_SAME_ESCAPE = 'wWsSbB<>.*[]^$\\/';
-const POSIX_CLASSES = new Set(['alpha', 'digit', 'alnum', 'upper', 'lower', 'space',
-  'punct', 'xdigit', 'blank', 'cntrl', 'graph', 'print']);
+const BRE_SAME_ESCAPE = 'wsSbB<>.*[]^$\\/';
+// An unescaped `^` is an anchor only where an alternative starts (the pattern's
+// start, after `\(` or `\|`), and `$` only where one ends (the pattern's end,
+// before `\)` or `\|`); elsewhere BRE reads them as literals and rust regex as
+// anchors — `getUser\|$user_id` searched the text `$user_id` (D#125 #6). No
+// translation: the grep runs.
 function breToRustRegex(pattern) {
   let out = '';
+  let altStart = true;
+  let anchor = false;
+  let assertion = false;
   for (let i = 0; i < pattern.length; i++) {
     const c = pattern[i];
+    const wasAltStart = altStart;
+    const wasAnchor = anchor;
+    const wasAssertion = assertion;
+    altStart = false;
+    anchor = c === '^' && wasAltStart;
+    assertion = anchor;
     if (c === '\\' && i + 1 < pattern.length) {
       const n = pattern[++i];
       if (n === '(' && pattern.startsWith('\\)', i + 1)) return null;
+      if (wasAssertion && '+?{'.includes(n)) return null;
       if (BRE_SWAPPED.includes(n)) out += n;
       else if (BRE_SAME_ESCAPE.includes(n)) out += c + n;
       else return null;
+      altStart = n === '(' || n === '|';
+      assertion = 'bB<>'.includes(n);
       continue;
     }
+    if (c === '*' && wasAssertion) return null;
+    if (c === '^' && !wasAltStart) return null;
+    // A `*` where an alternative starts, or right after its `^`, repeats
+    // nothing: BRE reads it as a literal, rust regex as an error or a repeat of
+    // the anchor (review of D#125).
+    if (c === '*' && (wasAltStart || (wasAnchor && out.endsWith('^')))) return null;
+    if (c === '$' && i + 1 < pattern.length
+      && !pattern.startsWith('\\)', i + 1) && !pattern.startsWith('\\|', i + 1)) return null;
     if (BRE_SWAPPED.includes(c)) { out += '\\' + c; continue; }
     if (c !== '[') { out += c; continue; }
-    // `]` right after `[` or `[^` is a member, not the end.
-    let j = i + 1;
-    if (pattern[j] === '^') j++;
-    if (pattern[j] === ']') return null;
-    for (; j < pattern.length && pattern[j] !== ']'; j++) {
-      if (pattern[j] === '[' && pattern[j + 1] === ':') {
-        const close = pattern.indexOf(':]', j + 2);
-        if (close === -1 || !POSIX_CLASSES.has(pattern.slice(j + 2, close))) return null;
-        j = close + 1;
-        continue;
-      }
-      if (pattern[j] === '\\' || pattern[j] === '[') return null;
-      if ('&-~'.includes(pattern[j]) && pattern[j + 1] === pattern[j]) return null;
-    }
-    if (j >= pattern.length) return null;  // unterminated: grep reports an error
+    const j = bracketEnd(pattern, i);
+    if (j === -1) return null;
     out += pattern.slice(i, j + 1);
     i = j;
   }
@@ -1650,6 +2108,7 @@ function runMain() {
   // forwarding `-F` without this guard would make it search the wrong text.
   const cgFlags = extractCgFlags(cmd);
   const rawGrepPattern = pickBlockPattern(cmd);
+  if (!rootOnlyInSearchPath(rawCmd, root, extractSearchPath(cmd))) return;
   const grepPattern = cgFlagSet(cgFlags).has('-F')
     ? rawGrepPattern
     : translateBreToRg(cmd, rawGrepPattern);
@@ -1728,7 +2187,12 @@ function runMain() {
         // No fallback to a grep answer: a context grep (`-A5`) asked for the
         // body, and the grep rewrite would drop the context silently (pre-ship
         // review round 2). A show miss lets the raw grep run.
-        answer = runShowAnswer({ cwd: root, symbols: block.symbols });
+        // Scoped to the grep's path: `show` alone answers the whole project
+        // (D#125 #2 — `grep -A3 "fn f" lib/` was answered from src/).
+        answer = runShowAnswer({
+          cwd: root, symbols: block.symbols, within: searchPath ?? '',
+          kinds: declKindsBySymbol(extractPatterns(cmd)),
+        });
       } else if (pattern) {
         answer = runGrepAnswer({ cwd: root, pattern, searchPath, flags });
       }
@@ -1760,6 +2224,16 @@ function runMain() {
       return;
     }
 
+    // D#133 #8 — the answer searches tracked files plus ripgrep's walk; the
+    // grep's own file set differs when the path holds untracked hidden, ignored
+    // or (for git grep) untracked files. Checked only for an answer that would
+    // replace the command: it runs git. The grep runs as typed.
+    // A `show` answer reads the index instead, which skips more (review of
+    // D#133, H-2).
+    if (plan && !searchesSameFiles({
+      root, target: extractSearchPath(cmd), verb: plan.verb, show: answeredMode === 'show',
+    })) return;
+
     const answered = answer.status === 'hits';
     recordRecommendation(root, {
       // Still `deny` in the funnel: the event it counts — a raw grep intercepted
@@ -1797,11 +2271,13 @@ function runMain() {
     // Re-run exactly what answered: the resolved symbols for `show`, the same
     // argv for `grep`.
     // `-m 0`: cg caps matches at 100 per file by default and says so only on
-    // stderr; the grep being replaced has no cap (round 3 M4). Only here, not
+    // stderr; the grep being replaced has no cap (round 3 M4). `-M 0`: cg cuts
+    // each line at 512 characters, so a match past that column was not in the
+    // answer at all (D#133 #12); 0 is unlimited, as grep prints. Only here, not
     // in the in-hook answer, which is a has-hits probe.
     const argvList = answeredMode === 'show'
-      ? answer.symbols.map((sym) => ['show', sym])
-      : [[...args.slice(0, 1), '-m', '0', ...args.slice(1)]];
+      ? answer.argvs
+      : [[...args.slice(0, 1), '-m', '0', '-M', '0', ...args.slice(1)]];
     const command = buildRewriteCommand(argvList, {
       invocation: shellQuoteArg(resolveAnswerBinary({})),
       root,
@@ -1861,6 +2337,15 @@ module.exports = {
   isRevisionScopedGitGrep, // v0.71 — git grep --cached/treeish exclusion
   extractSearchPath,  // v0.47.0 — deny-with-answer
   normalizeCommandPaths, // v0.47.1 — abs-path matcher fix
+  rootOnlyInSearchPath, // D#125 #1
+  isDirectory,
+  declKindsBySymbol, // D#125 #2 review
+  searchesSameFiles, // D#133 #8
+  indexReadsPath,    // review of D#133 H-2: the index's own skip rules, mirrored
+  INDEX_EXCLUDED_DIRS,
+  INDEX_EXTENSIONS,
+  INDEX_DEFAULT_MAX_FILE_SIZE,
+  showAnswersPattern, // D#133 — show answers whole names only
   resolveProjectRoot,    // v0.48 — subdir-cwd dark fix
   rebaseRelativePaths,   // v0.48 — subdir-cwd dark fix
   commandHasBypass,      // v0.48 — bypass funnel visibility