sift-light 1.0.3-2 → 1.0.3-4

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.3-4 — 2026-10-05
+
+- Allow recognized stdin-only filters at any pipeline position, including `cmd | grep pattern | head` and `cmd | grep pattern | wc -l`. Deny file operands, recursive search, file-sourced patterns, input redirection, and unsafe dynamic arguments even when a filter receives piped input ([#109](https://github.com/lightsifter/sift-light/issues/109)).
+- Apply the same input-aware policy to Pi, OMP, and native plugin hooks, including PowerShell file-object pipeline handling.
+
+## 1.0.3-3 — 2026-10-04
+
+- Keep explicit paths outside the MCP project isolated after zero matches by default, and evaluate content-search and file-discovery globs/exclusions from the selected external root. Explicit `scope: "expand"` still retries the MCP project ([#106](https://github.com/lightsifter/sift-light/issues/106)).
+
 ## 1.0.3-2 — 2026-09-30
 
 - Accept an empty `sourceCursor` placeholder outside `mode: "inspect"` by removing the key before mode validation, with the normalization disclosed in text and `details.requestNotes` ([#101](https://github.com/lightsifter/sift-light/issues/101)). Nonempty source continuation tokens still require inspection mode; empty inspection tokens and ordinary `cursor` validation retain their existing failure behavior.

package/README.md

@@ -44,7 +44,7 @@ The first uncached Concept or hybrid search loads the local model and may take t
 
 Ask the agent to restrict a search to one folder when that is the scope you need. If you remember only part of a filename, start by finding the file and then inspect its contents—like narrowing a cabinet down to a shelf and then a document.
 
-Multi-word `files` queries require each word literally in the path; a single abbreviation still supports fuzzy matching. Use `hybrid` or `concept` for business intent. Ordinary content searches retain their default zero-result expansion; use `scope: "strict"` to stay within an explicit path. Expansion is announced before returned evidence.
+Multi-word `files` queries require each word literally in the path; a single abbreviation still supports fuzzy matching. Use `hybrid` or `concept` for business intent. Content searches inside the active project still expand after zero results by default. An explicit path outside the project stays isolated; pass `scope: "expand"` to retry the server project. Use `scope: "strict"` to prevent in-project expansion. Expansion is announced before returned evidence.
 
 ### Know what has been shown
 
@@ -179,7 +179,7 @@ Kimi Code's web mode can start plugin MCP servers from its installation director
 
 Restart after installation. Native hooks use hard enforcement by default. To keep the native plugin, MCP tool and model guidance without denying conventional searches, start the host with `SIFT_LIGHT_ENFORCE_SEARCH=prefer`; use `off` to disable only hook enforcement. Accepted values are `hard`, `prefer`, and `off`; an unsupported value fails closed instead of silently allowing a search. The setting is inherited from the host process, so a project cannot lower a user's policy merely by committing a repository configuration file. You can still disable the complete integration through Claude Code `/plugin`, Codex `/hooks`, or Kimi `/plugins disable sift-light` followed by `/reload`.
 
-In hard mode, a direct search such as `grep warning report.txt` is denied. A trailing filter such as `cat report.txt | grep warning` remains available because it filters output from a non-search producer; `find src | grep test` and `rg warning src | grep result` remain denied because their pipelines already contain a direct search producer. If one subcommand in a compound shell call is denied, the host executes none of that call. The denial identifies the detected search and tells the agent to retry non-search operations separately.
+In hard mode, a direct search such as `grep warning report.txt` is denied. A recognized stdin-only filter such as `cat report.txt | grep warning | head` remains available at any pipeline position because it filters output from a non-search producer. A filter with a file operand, recursive option, file-sourced pattern, or input redirection is denied even when piped. Put grep options before the pattern and quote shell wildcard characters; unknown options and dynamic arguments fail closed. PowerShell `Select-String` is also denied when a known file-object producer such as `Get-Item` feeds it. `find src | grep test` and `rg warning src | grep result` remain denied because their pipelines contain a direct search producer. If one subcommand in a compound shell call is denied, the host executes none of that call. The denial identifies the detected search and tells the agent to retry non-search operations separately.
 
 Local searches stay on your machine. Only grant access to files your agent is allowed to read. HTTP deployments need an authenticated gateway before public exposure; see [Security](SECURITY.md).
 

package/README.zh-CN.md

@@ -44,7 +44,7 @@ Concept 或 hybrid 较慢时，会在默认五秒等待窗口内返回 `status:
 
 需要只查某个文件夹时，可以明确告诉 Agent 限定范围。只记得文件名的一部分，也可以先找文件，再看内容。像先确定资料柜的哪一层，再逐步缩小到要找的那一份。
 
-`files` 多词查询要求每个词都在路径中按字面出现；单个缩写仍支持模糊匹配。业务意图使用 `hybrid` 或 `concept`。普通内容搜索保留零匹配后扩大范围的既有默认；需要限定目录时传 `scope: "strict"`。范围扩大的提示会先于证据显示。
+`files` 多词查询要求每个词都在路径中按字面出现；单个缩写仍支持模糊匹配。业务意图使用 `hybrid` 或 `concept`。项目内路径仍保留零匹配后扩展到项目根目录的既有默认。显式指定到当前 MCP 项目之外的路径时，零匹配后仍默认只查该路径；需要继续查服务器项目时传 `scope: "expand"`。需要始终限定显式路径时传 `scope: "strict"`。范围扩大前会先给出提示。
 
 ### 看到了多少，说得清楚
 
@@ -179,7 +179,7 @@ Kimi Code 的 web 模式可能从安装目录启动插件 MCP 服务。如果相
 
 安装后重启。原生钩子默认使用严格模式。如需保留原生插件、MCP 工具和模型指引，但不硬性拒绝其他搜索，请使用 `SIFT_LIGHT_ENFORCE_SEARCH=prefer` 启动宿主；设置为 `off` 只关闭钩子强制策略。可用值为 `hard`、`prefer` 和 `off`，非法值会安全拒绝并明确报错，不会静默放行。该设置由宿主进程继承，因此项目不能仅靠提交仓库配置文件降低用户的全局策略。仍可通过 Claude Code `/plugin`、Codex `/hooks`，或 Kimi `/plugins disable sift-light` 后执行 `/reload` 来关闭整个集成。
 
-严格模式下，`grep warning report.txt` 这类直接搜索会被拒绝；`cat report.txt | grep warning` 仍可用，因为它只是过滤一个非搜索命令的输出。`find src | grep test` 和 `rg warning src | grep result` 仍会被拒绝，因为管道中已经包含直接搜索来源。复合 shell 调用中只要一个子命令被拒绝，宿主就不会执行其中任何操作；拒绝信息会指出检测到的搜索，并要求 Agent 单独重试非搜索操作。
+严格模式下，`grep warning report.txt` 这类直接搜索会被拒绝；`cat report.txt | grep warning | head` 这类可静态确认只读取标准输入的过滤命令可放在管道中的任意位置，因为它过滤的是非搜索命令的输出。即使位于管道中，带文件参数、递归选项、从文件读取模式或输入重定向的过滤命令仍会被拒绝。请把 grep 选项放在模式之前，并用引号保护 shell 通配符；无法识别的选项和动态参数会保守拦截。PowerShell 中，`Get-Item` 等已知会输出文件对象的命令接入 `Select-String` 时也会被拒绝。`find src | grep test` 和 `rg warning src | grep result` 仍会被拒绝，因为管道中包含直接搜索来源。复合 shell 调用中只要一个子命令被拒绝，宿主就不会执行其中任何操作；拒绝信息会指出检测到的搜索，并要求 Agent 单独重试非搜索操作。
 
 本地搜索在你的机器上进行。请只允许 Agent 读取已获授权的文件。HTTP 服务对外开放前需要认证网关，详见[安全说明](SECURITY.md)。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-2",
+  "version": "1.0.3-4",
   "description": "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   "keywords": [
     "ai-agent",

package/plugins/sift-light/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-2",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-2",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.0.3-2",
+        "sift-light-runtime@npm:sift-light@1.0.3-4",
         "sift-light-mcp",
         "--stdio"
       ],

package/plugins/sift-light/hooks/search-policy.mjs

@@ -3779,9 +3779,182 @@ function classifyCommand(argv, language, depth = 0) {
   return classifyCommand(args2.slice(start2), language, depth + 1);
 }
 
+// src/search-policy-stdin-filter.ts
+var GREP_SWITCHES = new Set("abcEFGHhiILlnoPqsTUuvwxyzZ".split(""));
+var GREP_VALUE_OPTIONS = new Set(["A", "B", "C", "m"]);
+var GREP_LONG_SWITCHES = new Set([
+  "--basic-regexp",
+  "--extended-regexp",
+  "--fixed-strings",
+  "--perl-regexp",
+  "--ignore-case",
+  "--no-ignore-case",
+  "--invert-match",
+  "--word-regexp",
+  "--line-regexp",
+  "--count",
+  "--files-with-matches",
+  "--files-without-match",
+  "--only-matching",
+  "--quiet",
+  "--silent",
+  "--no-messages",
+  "--byte-offset",
+  "--line-number",
+  "--with-filename",
+  "--no-filename",
+  "--initial-tab",
+  "--null",
+  "--null-data",
+  "--text",
+  "--binary",
+  "--line-buffered",
+  "--no-group-separator"
+]);
+var GREP_LONG_VALUES = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--max-count",
+  "--binary-files",
+  "--label",
+  "--group-separator",
+  "--include",
+  "--exclude",
+  "--exclude-dir"
+]);
+function isStdinOnlyGrep(args2) {
+  const positionals = [];
+  let hasPatternOption = false;
+  let optionsEnded = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (positionals.length > 0 && arg !== "-")
+      return false;
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("--")) {
+      const separator = arg.indexOf("=");
+      const option = separator < 0 ? arg : arg.slice(0, separator);
+      const attached = separator < 0 ? undefined : arg.slice(separator + 1);
+      if (option === "--regexp") {
+        hasPatternOption = true;
+      } else if (option === "--color" || option === "--colour") {
+        continue;
+      } else if (GREP_LONG_SWITCHES.has(option) && attached === undefined) {
+        continue;
+      } else if (!GREP_LONG_VALUES.has(option)) {
+        return false;
+      }
+      if (attached === undefined) {
+        index += 1;
+        if (args2[index] === null || args2[index] === undefined)
+          return false;
+      }
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("-") && arg !== "-") {
+      for (let optionIndex = 1;optionIndex < arg.length; optionIndex += 1) {
+        const option = arg[optionIndex];
+        if (option === "e") {
+          hasPatternOption = true;
+        } else if (option !== undefined && GREP_SWITCHES.has(option)) {
+          continue;
+        } else if (option === undefined || !GREP_VALUE_OPTIONS.has(option)) {
+          return false;
+        }
+        if (optionIndex === arg.length - 1) {
+          index += 1;
+          if (args2[index] === null || args2[index] === undefined)
+            return false;
+        }
+        break;
+      }
+      continue;
+    }
+    positionals.push(arg);
+  }
+  return hasPatternOption ? positionals.every((operand) => operand === "-") : positionals.length > 0 && positionals.slice(1).every((operand) => operand === "-");
+}
+var SELECT_STRING_SWITCHES = new Set([
+  "simplematch",
+  "casesensitive",
+  "quiet",
+  "list",
+  "noemphasis",
+  "notmatch",
+  "allmatches",
+  "raw",
+  "verbose",
+  "debug"
+]);
+var SELECT_STRING_VALUES = new Set([
+  "culture",
+  "encoding",
+  "context",
+  "erroraction",
+  "warningaction",
+  "informationaction",
+  "outvariable",
+  "pipelinevariable"
+]);
+function isPipelineOnlySelectString(args2, namedParameters) {
+  let hasPattern = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (!namedParameters[index]) {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+      continue;
+    }
+    const separator = arg.indexOf(":");
+    const option = (separator < 0 ? arg.slice(1) : arg.slice(1, separator)).toLowerCase();
+    if (SELECT_STRING_SWITCHES.has(option) && separator < 0)
+      continue;
+    if (option !== "pattern" && !SELECT_STRING_VALUES.has(option))
+      return false;
+    if (option === "pattern") {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+    }
+    if (separator < 0) {
+      index += 1;
+      if (args2[index] === null || args2[index] === undefined)
+        return false;
+    }
+  }
+  return hasPattern;
+}
+function isStdinOnlySearchFilter(words, language, namedParameters) {
+  const executable = words[0];
+  if (executable === null || executable === undefined)
+    return false;
+  const name2 = executableName(executable);
+  if (language === "powershell")
+    return ["select-string", "sls"].includes(name2.toLowerCase()) && isPipelineOnlySelectString(words.slice(1), namedParameters.slice(1));
+  return ["grep", "egrep", "fgrep"].includes(name2) && isStdinOnlyGrep(words.slice(1));
+}
+
 // src/search-policy-shell.ts
 var MAX_POLICY_COMMAND_BYTES = 64 * 1024;
 var MAX_SHELL_NESTING = 4;
+var POWERSHELL_FILE_OBJECT_PRODUCERS = new Set([
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "dir",
+  "ls"
+]);
+var POWERSHELL_STRING_CONVERTERS = new Set(["out-string", "oss", "convertto-json"]);
 function decodeBashDoubleQuoted(value) {
   let result = "";
   for (let index = 0;index < value.length; index += 1) {
@@ -3867,6 +4040,18 @@ function commandWordNodes(node, language) {
 function commandWords(node, language) {
   return commandWordNodes(node, language).map((word) => literalWord(word, language));
 }
+function hasBashWordExpansion(text) {
+  if (text.startsWith("~") || text.startsWith("="))
+    return true;
+  for (let index = 0;index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+    } else if ("*?[]{}".includes(text[index] ?? "")) {
+      return true;
+    }
+  }
+  return false;
+}
 function hasUntranslatedShellSyntax(node, language) {
   const text = node.text;
   if (language === "powershell") {
@@ -3879,30 +4064,70 @@ function hasUntranslatedShellSyntax(node, language) {
   if (["raw_string", "string", "string_content"].includes(node.type))
     return false;
   if (["word", "number", "command_name"].includes(node.type))
-    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+    return hasBashWordExpansion(text);
   if (node.type === "concatenation")
     return node.namedChildren.some((child) => child !== null && hasUntranslatedShellSyntax(child, language));
   return false;
 }
+function hasInputRedirectNodes(owner) {
+  return owner.descendantsOfType(["file_redirect", "herestring_redirect", "heredoc_redirect"]).some((redirect) => redirect !== null && /^(?:\d+)?</u.test(redirect.text));
+}
+function hasInputRedirect(node) {
+  if (hasInputRedirectNodes(node))
+    return true;
+  for (let parent = node.parent;parent; parent = parent.parent) {
+    if (parent.type !== "redirected_statement")
+      continue;
+    const body2 = parent.childForFieldName("body");
+    const last = body2?.descendantsOfType("command").at(-1) ?? (body2?.type === "command" ? body2 : undefined);
+    if (last?.startIndex === node.startIndex && last.endIndex === node.endIndex && parent.childrenForFieldName("redirect").some((redirect) => redirect !== null && hasInputRedirectNodes(redirect)))
+      return true;
+  }
+  return false;
+}
 function isSafePipelineFilter(node, language, words) {
-  const executable = words[0];
-  if (executable === null || executable === undefined)
+  const wordNodes = commandWordNodes(node, language);
+  if (!isStdinOnlySearchFilter(words, language, wordNodes.map((word) => word.type === "command_parameter")))
     return false;
-  const name2 = executableName(executable);
-  const filterNames = language === "powershell" ? new Set(["select-string", "sls"]) : new Set(["grep", "egrep", "fgrep"]);
-  if (!filterNames.has(language === "powershell" ? name2.toLowerCase() : name2))
+  if (wordNodes.some((word) => hasUntranslatedShellSyntax(word, language)))
+    return false;
+  if (hasInputRedirect(node))
     return false;
   const pipeline = node.parent;
-  if (!pipeline || pipeline.type !== "pipeline")
+  if (!pipeline || !["pipeline", "pipeline_chain"].includes(pipeline.type))
     return false;
-  const commands = pipeline.namedChildren.filter((child) => child !== null && child.type === "command");
-  const last = commands.at(-1);
-  if (!last || last.startIndex !== node.startIndex || last.endIndex !== node.endIndex || commands.length < 2)
+  const stages = pipeline.namedChildren.filter((child) => child !== null);
+  const position = stages.findIndex((stage) => stage.startIndex <= node.startIndex && stage.endIndex >= node.endIndex);
+  if (position < 1)
     return false;
-  return commands.slice(0, -1).every((candidate) => {
-    const decision = classifyCommand(commandWords(candidate, language), language);
-    return !decision.kind && !decision.nested;
-  });
+  let fileObjectFlow = false;
+  for (const [index, stage] of stages.entries()) {
+    if (index === position)
+      continue;
+    const commands = stage.descendantsOfType("command");
+    for (const candidate of commands) {
+      if (candidate === null)
+        continue;
+      const candidateWords = commandWords(candidate, language);
+      const decision = classifyCommand(candidateWords, language);
+      if (decision.kind || decision.nested)
+        return false;
+      if (language !== "powershell" || index > position)
+        continue;
+      const executable = candidateWords[0];
+      if (executable === null || executable === undefined)
+        continue;
+      const name2 = executableName(executable).toLowerCase();
+      if (POWERSHELL_FILE_OBJECT_PRODUCERS.has(name2))
+        fileObjectFlow = true;
+    }
+    if (language === "powershell" && index < position && stage.type === "command") {
+      const executable = commandWords(stage, language)[0];
+      if (executable !== null && executable !== undefined && POWERSHELL_STRING_CONVERTERS.has(executableName(executable).toLowerCase()))
+        fileObjectFlow = false;
+    }
+  }
+  return !fileObjectFlow;
 }
 
 class ShellSearchPolicy {

package/plugins/sift-light/kimi.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-2",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"
@@ -13,7 +13,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.0.3-2",
+        "sift-light-runtime@npm:sift-light@1.0.3-4",
         "sift-light-mcp",
         "--stdio"
       ],