sift-light 1.0.3-2 → 1.0.3-4

package/src/mcp-server.mjs

@@ -7,7 +7,7 @@ import { URL as URL2 } from "node:url";
 // package.json
 var package_default = {
   name: "sift-light",
-  version: "1.0.3-2",
+  version: "1.0.3-4",
   description: "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   keywords: [
     "ai-agent",
@@ -1580,9 +1580,9 @@ async function consumeCappedLines(stream, onLine, options = {}) {
 }
 
 // src/path-policy.ts
-import { realpath } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 var POSIX_SPECIAL_ROOTS = ["/dev", "/proc", "/sys"];
 var PORTABLE_CREDENTIAL_DIRECTORY_NAMES = [
   ".ssh",
@@ -1717,6 +1717,28 @@ class SearchPathPolicy {
     ]);
     return canonical && (!isPathInsideRoot(absolute, this.cwd) || !isPathInsideRoot(canonical, canonicalCwd)) ? canonical : absolute;
   }
+  async allowsScopeExpansion(path, scope) {
+    if (scope === "strict")
+      return false;
+    if (scope === "expand")
+      return true;
+    const searchTarget = await this.resolveSearchTarget(path);
+    return isPathInsideRoot(searchTarget, this.cwd);
+  }
+  async ripgrepWorkingDirectory(searchPath) {
+    const absolute = resolve(this.cwd, searchPath);
+    if (isPathInsideRoot(absolute, this.cwd))
+      return this.cwd;
+    let isDirectory;
+    try {
+      isDirectory = (await stat(absolute)).isDirectory();
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return this.cwd;
+      throw error;
+    }
+    return isDirectory ? absolute : dirname(absolute);
+  }
   ripgrepGlobArguments(searchPath) {
     const absolute = resolve(this.cwd, searchPath);
     if (isPathInsideRoot(absolute, this.cwd))
@@ -1837,7 +1859,7 @@ async function runOwnedProcess(options, consumeOutput) {
 
 // src/ripgrep-executable.ts
 import { constants } from "node:fs";
-import { access, stat } from "node:fs/promises";
+import { access, stat as stat2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute2 } from "node:path";
 var OVERRIDE_ENV = "SIFT_LIGHT_RG_PATH";
 var BUNDLED_REPAIR = `Reinstall sift-light with optional dependencies enabled for this platform, or set ${OVERRIDE_ENV} to an absolute ripgrep executable path.`;
@@ -1856,7 +1878,7 @@ async function resolveRipgrepExecutable() {
     }
   }
   try {
-    if (!(await stat(executable)).isFile())
+    if (!(await stat2(executable)).isFile())
       throw new Error("Expected an executable file");
     await access(executable, constants.X_OK);
   } catch (cause) {
@@ -1945,12 +1967,12 @@ function describeUnreadableDiagnostics(diagnostics) {
 }
 
 // src/source.ts
-import { readFile, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { readFile, realpath as realpath2, stat as stat3 } from "node:fs/promises";
 var SOURCE_RANGE_METADATA_RESERVE_BYTES = 1024;
 var MAX_SOURCE_RANGE_BYTES = MAX_RESULT_BYTES - SOURCE_RANGE_METADATA_RESERVE_BYTES;
 async function getSourceRevision(path, onError) {
   try {
-    const metadata = await stat2(path);
+    const metadata = await stat3(path);
     return sourceRevisionFromStats(metadata);
   } catch (error) {
     onError?.(error);
@@ -2411,6 +2433,7 @@ function createRipgrepRunner(options = {}) {
     const searchPath = resolve4(cwd, request.path ?? ".");
     const policy = new SearchPathPolicy(cwd);
     const validatedSearchPath = await policy.resolveSearchTarget(searchPath);
+    const ripgrepCwd = await policy.ripgrepWorkingDirectory(validatedSearchPath);
     const expectedSearchTarget = await policy.resolveExistingPath(validatedSearchPath);
     const searchTarget = isPathInsideCwd(validatedSearchPath, cwd) ? relative2(resolve4(cwd), validatedSearchPath) || "." : validatedSearchPath;
     const args = buildRipgrepArguments(request, cwd, validatedSearchPath);
@@ -2500,7 +2523,7 @@ function createRipgrepRunner(options = {}) {
         ...policy.ripgrepGlobArguments(validatedSearchPath),
         "--",
         searchTarget
-      ], cwd, maxSourceRevisionFiles, signal, request.redact);
+      ], ripgrepCwd, maxSourceRevisionFiles, signal, request.redact);
       let ignoredFileCount = 0;
       let ignoredFileSamples = [];
       let filesystemCoverage = "complete";
@@ -2522,7 +2545,7 @@ function createRipgrepRunner(options = {}) {
           ...policy.ripgrepGlobArguments(validatedSearchPath),
           "--",
           searchTarget
-        ], cwd, maxSourceRevisionFiles, signal, request.redact);
+        ], ripgrepCwd, maxSourceRevisionFiles, signal, request.redact);
         const ignored = [...allCandidates.revisions.keys()].filter((path) => !before.revisions.has(path));
         ignoredFileCount = ignored.length;
         ignoredFileSamples = ignored.slice(0, 20).map((path) => displayPath(path, cwd).displayPath);
@@ -2551,7 +2574,7 @@ function createRipgrepRunner(options = {}) {
       if (before.unreadable.length > 0)
         filesystemCoverageReasons.add(describeUnreadableDiagnostics(before.unreadable));
       await assertSearchTargetIdentity(policy, validatedSearchPath, expectedSearchTarget);
-      const { code, stderr } = await runOwnedProcess({ executable, args, cwd, ...signal ? { signal } : {} }, (stdout) => consumeCappedLines(stdout, onLine, {
+      const { code, stderr } = await runOwnedProcess({ executable, args, cwd: ripgrepCwd, ...signal ? { signal } : {} }, (stdout) => consumeCappedLines(stdout, onLine, {
         maxLineBytes: maxEventBytes,
         onLineTooLong: ({ prefix, observedBytes }) => {
           const source = oversizedMatchPath(prefix, cwd);
@@ -2876,7 +2899,7 @@ class OwnedTaskQueue {
 }
 
 // src/concept-search.ts
-import { dirname as dirname3, join as join4, resolve as resolve12 } from "node:path";
+import { dirname as dirname4, join as join4, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import { mkdir as mkdir2 } from "node:fs/promises";
@@ -3013,7 +3036,7 @@ import { extname as extname2, resolve as resolve11 } from "node:path";
 import { lstat, mkdir, mkdtemp, open, rm, writeFile } from "node:fs/promises";
 import { constants as constants2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join as join3, parse, relative as relative4, resolve as resolve8 } from "node:path";
+import { dirname as dirname2, join as join3, parse, relative as relative4, resolve as resolve8 } from "node:path";
 
 // src/workspace-files.ts
 import { relative as relative3, resolve as resolve7, sep as sep2 } from "node:path";
@@ -3031,6 +3054,7 @@ async function listWorkspaceFiles(cwd, signal, options = {}) {
   const absolutePath = resolve7(cwd, options.path ?? ".");
   const policy = new SearchPathPolicy(cwd);
   const searchPath = await policy.resolveSearchTarget(absolutePath);
+  const ripgrepCwd = await policy.ripgrepWorkingDirectory(searchPath);
   const maxFiles = options.maxFiles ?? MAX_SOURCE_REVISION_FILES;
   if (!Number.isSafeInteger(maxFiles) || maxFiles < 1)
     throw new SiftLightError("Candidate file limit must be a positive integer");
@@ -3056,7 +3080,7 @@ async function listWorkspaceFiles(cwd, signal, options = {}) {
         "--",
         searchPath
       ],
-      cwd,
+      cwd: ripgrepCwd,
       ...signal ? { signal } : {}
     }, async (stdout) => {
       let pending = Buffer.alloc(0);
@@ -3124,11 +3148,11 @@ function partitionPaths(paths) {
 }
 function relevantDirectories(cwd, paths) {
   const directories = new Set;
-  for (const path of [cwd, ...paths.map((sourcePath) => dirname(resolve8(cwd, sourcePath)))]) {
+  for (const path of [cwd, ...paths.map((sourcePath) => dirname2(resolve8(cwd, sourcePath)))]) {
     let current = path;
     for (;; ) {
       directories.add(current);
-      const parent = dirname(current);
+      const parent = dirname2(current);
       if (current === parent)
         break;
       current = parent;
@@ -3212,12 +3236,12 @@ async function filterHistoricalPaths(cwd, paths, request, signal) {
       for (const path of group) {
         const safe = workspaceRelativePath(absoluteCwd, path);
         const placeholder = resolve8(target, safe);
-        await mkdir(dirname(placeholder), { recursive: true });
+        await mkdir(dirname2(placeholder), { recursive: true });
         await writeFile(placeholder, "");
       }
       for (const ignore of ignoreFiles) {
         const destination = join3(tree, ignore.local);
-        await mkdir(dirname(destination), { recursive: true });
+        await mkdir(dirname2(destination), { recursive: true });
         await writeFile(destination, ignore.bytes);
       }
       const privacy = await listWorkspaceFiles(tree, signal, { ignoreParents: false });
@@ -4210,7 +4234,7 @@ async function readWorkspaceDocument(path, cwd, signal, expected, readBudget = M
 }
 
 // src/syntax.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/syntax-tree.ts
@@ -4751,7 +4775,7 @@ async function parseSyntax(path, text, signal, pattern) {
     const result = await runOwnedProcess({
       executable: process.execPath,
       args,
-      cwd: dirname2(worker),
+      cwd: dirname3(worker),
       env,
       signal: controller.signal,
       input: Buffer.from(JSON.stringify({ language, text, pattern }))
@@ -5270,7 +5294,7 @@ async function similarities(query, passages, parent, onProgress) {
         worker,
         "--infer"
       ] : [worker, "--infer"],
-      cwd: dirname3(worker),
+      cwd: dirname4(worker),
       env: { ...env, SIFT_LIGHT_CONCEPT_CACHE_STAGING_DIR: stagingRoot },
       ...parent ? { signal: parent } : {},
       input: Buffer.from(JSON.stringify({
@@ -5692,7 +5716,7 @@ async function structuralSearch(input, access) {
 }
 
 // src/evidence-service.ts
-import { dirname as dirname4, extname as extname3, resolve as resolve21 } from "node:path";
+import { dirname as dirname5, extname as extname3, resolve as resolve21 } from "node:path";
 
 // src/analysis-store.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -8846,7 +8870,7 @@ async function continueSource(cursor, access, continuations, expectedPath) {
 }
 
 // src/evidence-validation.ts
-import { realpath as realpath5, stat as stat3 } from "node:fs/promises";
+import { realpath as realpath5, stat as stat4 } from "node:fs/promises";
 import { resolve as resolve19 } from "node:path";
 
 // src/evidence-validity.ts
@@ -8884,9 +8908,9 @@ async function confirmWorktreeState(path, cwd, signal) {
   const policy = new SearchPathPolicy(cwd);
   try {
     policy.assertPath(absolute);
-    const before = await stat3(absolute);
+    const before = await stat4(absolute);
     const beforeCanonical = await realpath5(absolute);
-    const after = await stat3(absolute);
+    const after = await stat4(absolute);
     const afterCanonical = await realpath5(absolute);
     if (!before.isFile() || !after.isFile()) {
       return { status: "stale", reason: "Source is no longer a regular file" };
@@ -9028,9 +9052,9 @@ async function validateSnapshotTarget(target, cwd, policy, signal) {
       const result = await confirmWorktreeState(target.path, cwd, signal);
       return { path: target.path, role: "source", ...result };
     }
-    const before = await stat3(absolute);
+    const before = await stat4(absolute);
     const beforeCanonical = canonical;
-    const after = await stat3(absolute);
+    const after = await stat4(absolute);
     const afterCanonical = await realpath5(absolute);
     if (!before.isFile() || !after.isFile()) {
       return {
@@ -10983,10 +11007,10 @@ function searchScope(request) {
 }
 async function navigationRoot(cwd, path, signal) {
   const absolute = resolve21(cwd, path);
-  const repository = await findGitRepository(dirname4(absolute), signal);
+  const repository = await findGitRepository(dirname5(absolute), signal);
   if (repository)
     return repository;
-  return isPathInsideCwd(absolute, cwd) ? resolve21(cwd) : dirname4(absolute);
+  return isPathInsideCwd(absolute, cwd) ? resolve21(cwd) : dirname5(absolute);
 }
 function navigationFilters(input) {
   const request = normalizeRequest({
@@ -11101,7 +11125,7 @@ class EvidenceService {
       maxFiles: access.maxFiles
     });
     const candidates = await collect(request);
-    if (input.changes || request.scope === "strict" || request.path === undefined || candidates.files.length > 0 || candidates.partial) {
+    if (input.changes || request.path === undefined || !await new SearchPathPolicy(access.cwd).allowsScopeExpansion(request.path, request.scope) || candidates.files.length > 0 || candidates.partial) {
       return { candidates, request };
     }
     const { path: requestedPath, ...projectRequest } = request;
@@ -11246,7 +11270,7 @@ class EvidenceService {
         });
       }, signal);
       let chunkResults = await runChunks();
-      if (!input.changes && input.path !== undefined && input.scope !== "strict" && chunkResults.every(({ candidates }) => !candidates.partial && candidates.files.length === 0)) {
+      if (!input.changes && input.path !== undefined && await new SearchPathPolicy(cwd).allowsScopeExpansion(input.path, input.scope) && chunkResults.every(({ candidates }) => !candidates.partial && candidates.files.length === 0)) {
         chunkResults = await runChunks(input.path.replace(/^@/, ""));
       }
       const reasons = new Set;
@@ -13415,7 +13439,7 @@ class SiftLightService {
       throw new SiftLightError("line requires mode=inspect");
     const request = normalizeRequest(input);
     let scan = await this.#runRipgrep(request, cwd, signal);
-    if (scan.totalMatches === 0 && request.path !== undefined && request.scope !== "strict") {
+    if (scan.totalMatches === 0 && request.path !== undefined && await new SearchPathPolicy(cwd).allowsScopeExpansion(request.path, request.scope)) {
       const { path: requestedPath, ...projectRequest } = request;
       scan = await this.#runRipgrep({ ...projectRequest, expandedFromPath: requestedPath }, cwd, signal);
     }
@@ -13685,7 +13709,7 @@ function siftLightPromptGuidelines(structuredOutput = true) {
   return [
     SIFT_LIGHT_DISCOVERY_GUIDANCE,
     `Use sift-light for read-only content search. ${SOURCE_OUTPUT_GUIDANCE} For routine development searches, start with fast exact content, filename or applicable structural modes when the request has a usable name, symbol, error text or other literal clue. Omitted mode is ordinary exact search and never loads the local embedding model. Vector search is disabled by default; concept/hybrid require vectorSearchEnabled:true in sift-light.json and an installed model. They can take tens of seconds on an uncached scope, so select them only when semantic recall is needed. Omit mode and limit for automatic detail/summary selection; use mode="matches" for ordinary match metadata.`,
-    `An omitted path searches the project cwd. Use scope:"strict" for a question restricted to one path; otherwise, if an explicit subpath has zero matches, ordinary and content-analysis searches retry from cwd and return project-wide counts with an expansion notice. Explicit absolute paths and .. traversal can search outside cwd, except protected external system areas and .git internals. Git changes mode remains cwd-scoped.`,
+    `An omitted path searches the project cwd. Use scope:"strict" to disable zero-match expansion; by default, explicit paths inside cwd that return no matches retry from cwd and report project-wide counts with an expansion notice. Explicit absolute paths and .. traversal can search outside cwd; those external targets stay isolated unless scope:"expand" opts into the same cwd retry. Protected external system areas and .git internals remain excluded. Git changes mode remains cwd-scoped.`,
     `Search output includes counts, categories, ranked paths, coverage and continuation metadata. Source excerpts may contain the searched text. Use mode="inspect" or the host read capability when exact source is required for an edit or verification.`,
     `Use file and directory distributions to choose evidence. Reuse the visible cursor with path or paths for match metadata; mode="summary" pages the remaining file statistics. Match counts are not relevance scores.`,
     `Mode="inspect" with a direct path/line or ordinary retained match returns bounded source windows and source-revision metadata. Some retained analysis selectors return only revision metadata; use direct path/line or the host read capability when source is needed. Do not use inspection merely to obtain a citation.`,

package/src/path-policy.ts

@@ -1,6 +1,6 @@
-import { realpath } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { SiftLightError } from "./errors.js";
 
 const POSIX_SPECIAL_ROOTS = ["/dev", "/proc", "/sys"] as const;
@@ -173,6 +173,26 @@ export class SearchPathPolicy {
       : absolute;
   }
 
+  async allowsScopeExpansion(path: string, scope?: "strict" | "expand"): Promise<boolean> {
+    if (scope === "strict") return false;
+    if (scope === "expand") return true;
+    const searchTarget = await this.resolveSearchTarget(path);
+    return isPathInsideRoot(searchTarget, this.cwd);
+  }
+
+  async ripgrepWorkingDirectory(searchPath: string): Promise<string> {
+    const absolute = resolve(this.cwd, searchPath);
+    if (isPathInsideRoot(absolute, this.cwd)) return this.cwd;
+    let isDirectory: boolean;
+    try {
+      isDirectory = (await stat(absolute)).isDirectory();
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") return this.cwd;
+      throw error;
+    }
+    return isDirectory ? absolute : dirname(absolute);
+  }
+
   ripgrepGlobArguments(searchPath: string): string[] {
     const absolute = resolve(this.cwd, searchPath);
     if (isPathInsideRoot(absolute, this.cwd)) return [];

package/src/prompt-guidelines.ts

@@ -10,7 +10,7 @@ export function siftLightPromptGuidelines(structuredOutput = true): string[] {
   return [
     SIFT_LIGHT_DISCOVERY_GUIDANCE,
     `Use sift-light for read-only content search. ${SOURCE_OUTPUT_GUIDANCE} For routine development searches, start with fast exact content, filename or applicable structural modes when the request has a usable name, symbol, error text or other literal clue. Omitted mode is ordinary exact search and never loads the local embedding model. Vector search is disabled by default; concept/hybrid require vectorSearchEnabled:true in sift-light.json and an installed model. They can take tens of seconds on an uncached scope, so select them only when semantic recall is needed. Omit mode and limit for automatic detail/summary selection; use mode="matches" for ordinary match metadata.`,
-    `An omitted path searches the project cwd. Use scope:"strict" for a question restricted to one path; otherwise, if an explicit subpath has zero matches, ordinary and content-analysis searches retry from cwd and return project-wide counts with an expansion notice. Explicit absolute paths and .. traversal can search outside cwd, except protected external system areas and .git internals. Git changes mode remains cwd-scoped.`,
+    `An omitted path searches the project cwd. Use scope:"strict" to disable zero-match expansion; by default, explicit paths inside cwd that return no matches retry from cwd and report project-wide counts with an expansion notice. Explicit absolute paths and .. traversal can search outside cwd; those external targets stay isolated unless scope:"expand" opts into the same cwd retry. Protected external system areas and .git internals remain excluded. Git changes mode remains cwd-scoped.`,
     `Search output includes counts, categories, ranked paths, coverage and continuation metadata. Source excerpts may contain the searched text. Use mode="inspect" or the host read capability when exact source is required for an edit or verification.`,
     `Use file and directory distributions to choose evidence. Reuse the visible cursor with path or paths for match metadata; mode="summary" pages the remaining file statistics. Match counts are not relevance scores.`,
     `Mode="inspect" with a direct path/line or ordinary retained match returns bounded source windows and source-revision metadata. Some retained analysis selectors return only revision metadata; use direct path/line or the host read capability when source is needed. Do not use inspection merely to obtain a citation.`,

package/src/rg.ts

@@ -332,6 +332,7 @@ export function createRipgrepRunner(options: RipgrepRunnerOptions = {}) {
     const searchPath = resolve(cwd, request.path ?? ".");
     const policy = new SearchPathPolicy(cwd);
     const validatedSearchPath = await policy.resolveSearchTarget(searchPath);
+    const ripgrepCwd = await policy.ripgrepWorkingDirectory(validatedSearchPath);
     const expectedSearchTarget = await policy.resolveExistingPath(validatedSearchPath);
     const searchTarget = isPathInsideCwd(validatedSearchPath, cwd)
       ? relative(resolve(cwd), validatedSearchPath) || "."
@@ -430,7 +431,7 @@ export function createRipgrepRunner(options: RipgrepRunnerOptions = {}) {
           "--",
           searchTarget,
         ],
-        cwd,
+        ripgrepCwd,
         maxSourceRevisionFiles,
         signal,
         request.redact,
@@ -463,7 +464,7 @@ export function createRipgrepRunner(options: RipgrepRunnerOptions = {}) {
             "--",
             searchTarget,
           ],
-          cwd,
+          ripgrepCwd,
           maxSourceRevisionFiles,
           signal,
           request.redact,
@@ -501,7 +502,7 @@ export function createRipgrepRunner(options: RipgrepRunnerOptions = {}) {
         filesystemCoverageReasons.add(describeUnreadableDiagnostics(before.unreadable));
       await assertSearchTargetIdentity(policy, validatedSearchPath, expectedSearchTarget);
       const { code, stderr } = await runOwnedProcess(
-        { executable, args, cwd, ...(signal ? { signal } : {}) },
+        { executable, args, cwd: ripgrepCwd, ...(signal ? { signal } : {}) },
         (stdout) =>
           consumeCappedLines(stdout, onLine, {
             maxLineBytes: maxEventBytes,

package/src/search-policy-shell.ts

@@ -6,9 +6,19 @@ import {
   type SearchKind,
   type ShellLanguage,
 } from "./search-policy-commands.js";
+import { isStdinOnlySearchFilter } from "./search-policy-stdin-filter.js";
 
 export const MAX_POLICY_COMMAND_BYTES = 64 * 1024;
 const MAX_SHELL_NESTING = 4;
+const POWERSHELL_FILE_OBJECT_PRODUCERS = new Set([
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "dir",
+  "ls",
+]);
+const POWERSHELL_STRING_CONVERTERS = new Set(["out-string", "oss", "convertto-json"]);
 
 export interface ShellSearchMatch {
   kind: SearchKind;
@@ -116,6 +126,18 @@ function commandWords(node: Node, language: ShellLanguage): Array<string | null>
   return commandWordNodes(node, language).map((word) => literalWord(word, language));
 }
 
+function hasBashWordExpansion(text: string): boolean {
+  if (text.startsWith("~") || text.startsWith("=")) return true;
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+    } else if ("*?[]{}".includes(text[index] ?? "")) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolean {
   const text = node.text;
   if (language === "powershell") {
@@ -131,8 +153,7 @@ function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolea
     );
   }
   if (["raw_string", "string", "string_content"].includes(node.type)) return false;
-  if (["word", "number", "command_name"].includes(node.type))
-    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+  if (["word", "number", "command_name"].includes(node.type)) return hasBashWordExpansion(text);
   if (node.type === "concatenation")
     return node.namedChildren.some(
       (child) => child !== null && hasUntranslatedShellSyntax(child, language),
@@ -140,36 +161,80 @@ function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolea
   return false;
 }
 
+function hasInputRedirectNodes(owner: Node): boolean {
+  return owner
+    .descendantsOfType(["file_redirect", "herestring_redirect", "heredoc_redirect"])
+    .some((redirect) => redirect !== null && /^(?:\d+)?</u.test(redirect.text));
+}
+
+function hasInputRedirect(node: Node): boolean {
+  if (hasInputRedirectNodes(node)) return true;
+  for (let parent = node.parent; parent; parent = parent.parent) {
+    if (parent.type !== "redirected_statement") continue;
+    const body = parent.childForFieldName("body");
+    const last =
+      body?.descendantsOfType("command").at(-1) ?? (body?.type === "command" ? body : undefined);
+    if (
+      last?.startIndex === node.startIndex &&
+      last.endIndex === node.endIndex &&
+      parent
+        .childrenForFieldName("redirect")
+        .some((redirect) => redirect !== null && hasInputRedirectNodes(redirect))
+    )
+      return true;
+  }
+  return false;
+}
+
 function isSafePipelineFilter(
   node: Node,
   language: ShellLanguage,
   words: Array<string | null>,
 ): boolean {
-  const executable = words[0];
-  if (executable === null || executable === undefined) return false;
-  const name = executableName(executable);
-  const filterNames =
-    language === "powershell"
-      ? new Set(["select-string", "sls"])
-      : new Set(["grep", "egrep", "fgrep"]);
-  if (!filterNames.has(language === "powershell" ? name.toLowerCase() : name)) return false;
-  const pipeline = node.parent;
-  if (!pipeline || pipeline.type !== "pipeline") return false;
-  const commands = pipeline.namedChildren.filter(
-    (child): child is Node => child !== null && child.type === "command",
-  );
-  const last = commands.at(-1);
+  const wordNodes = commandWordNodes(node, language);
   if (
-    !last ||
-    last.startIndex !== node.startIndex ||
-    last.endIndex !== node.endIndex ||
-    commands.length < 2
+    !isStdinOnlySearchFilter(
+      words,
+      language,
+      wordNodes.map((word) => word.type === "command_parameter"),
+    )
   )
     return false;
-  return commands.slice(0, -1).every((candidate) => {
-    const decision = classifyCommand(commandWords(candidate, language), language);
-    return !decision.kind && !decision.nested;
-  });
+  if (wordNodes.some((word) => hasUntranslatedShellSyntax(word, language))) return false;
+  if (hasInputRedirect(node)) return false;
+  const pipeline = node.parent;
+  if (!pipeline || !["pipeline", "pipeline_chain"].includes(pipeline.type)) return false;
+  const stages = pipeline.namedChildren.filter((child): child is Node => child !== null);
+  const position = stages.findIndex(
+    (stage) => stage.startIndex <= node.startIndex && stage.endIndex >= node.endIndex,
+  );
+  if (position < 1) return false;
+  let fileObjectFlow = false;
+  for (const [index, stage] of stages.entries()) {
+    if (index === position) continue;
+    const commands = stage.descendantsOfType("command");
+    for (const candidate of commands) {
+      if (candidate === null) continue;
+      const candidateWords = commandWords(candidate, language);
+      const decision = classifyCommand(candidateWords, language);
+      if (decision.kind || decision.nested) return false;
+      if (language !== "powershell" || index > position) continue;
+      const executable = candidateWords[0];
+      if (executable === null || executable === undefined) continue;
+      const name = executableName(executable).toLowerCase();
+      if (POWERSHELL_FILE_OBJECT_PRODUCERS.has(name)) fileObjectFlow = true;
+    }
+    if (language === "powershell" && index < position && stage.type === "command") {
+      const executable = commandWords(stage, language)[0];
+      if (
+        executable !== null &&
+        executable !== undefined &&
+        POWERSHELL_STRING_CONVERTERS.has(executableName(executable).toLowerCase())
+      )
+        fileObjectFlow = false;
+    }
+  }
+  return !fileObjectFlow;
 }
 
 /** WASM grammars are shipped with the hook; parsing never reads shell scripts or executes code. */