sift-light 1.0.3-3 → 1.0.3-4

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.0.3-4 — 2026-10-05
+
+- Allow recognized stdin-only filters at any pipeline position, including `cmd | grep pattern | head` and `cmd | grep pattern | wc -l`. Deny file operands, recursive search, file-sourced patterns, input redirection, and unsafe dynamic arguments even when a filter receives piped input ([#109](https://github.com/lightsifter/sift-light/issues/109)).
+- Apply the same input-aware policy to Pi, OMP, and native plugin hooks, including PowerShell file-object pipeline handling.
+
 ## 1.0.3-3 — 2026-10-04
 
 - Keep explicit paths outside the MCP project isolated after zero matches by default, and evaluate content-search and file-discovery globs/exclusions from the selected external root. Explicit `scope: "expand"` still retries the MCP project ([#106](https://github.com/lightsifter/sift-light/issues/106)).

package/README.md

@@ -179,7 +179,7 @@ Kimi Code's web mode can start plugin MCP servers from its installation director
 
 Restart after installation. Native hooks use hard enforcement by default. To keep the native plugin, MCP tool and model guidance without denying conventional searches, start the host with `SIFT_LIGHT_ENFORCE_SEARCH=prefer`; use `off` to disable only hook enforcement. Accepted values are `hard`, `prefer`, and `off`; an unsupported value fails closed instead of silently allowing a search. The setting is inherited from the host process, so a project cannot lower a user's policy merely by committing a repository configuration file. You can still disable the complete integration through Claude Code `/plugin`, Codex `/hooks`, or Kimi `/plugins disable sift-light` followed by `/reload`.
 
-In hard mode, a direct search such as `grep warning report.txt` is denied. A trailing filter such as `cat report.txt | grep warning` remains available because it filters output from a non-search producer; `find src | grep test` and `rg warning src | grep result` remain denied because their pipelines already contain a direct search producer. If one subcommand in a compound shell call is denied, the host executes none of that call. The denial identifies the detected search and tells the agent to retry non-search operations separately.
+In hard mode, a direct search such as `grep warning report.txt` is denied. A recognized stdin-only filter such as `cat report.txt | grep warning | head` remains available at any pipeline position because it filters output from a non-search producer. A filter with a file operand, recursive option, file-sourced pattern, or input redirection is denied even when piped. Put grep options before the pattern and quote shell wildcard characters; unknown options and dynamic arguments fail closed. PowerShell `Select-String` is also denied when a known file-object producer such as `Get-Item` feeds it. `find src | grep test` and `rg warning src | grep result` remain denied because their pipelines contain a direct search producer. If one subcommand in a compound shell call is denied, the host executes none of that call. The denial identifies the detected search and tells the agent to retry non-search operations separately.
 
 Local searches stay on your machine. Only grant access to files your agent is allowed to read. HTTP deployments need an authenticated gateway before public exposure; see [Security](SECURITY.md).
 

package/README.zh-CN.md

@@ -179,7 +179,7 @@ Kimi Code 的 web 模式可能从安装目录启动插件 MCP 服务。如果相
 
 安装后重启。原生钩子默认使用严格模式。如需保留原生插件、MCP 工具和模型指引，但不硬性拒绝其他搜索，请使用 `SIFT_LIGHT_ENFORCE_SEARCH=prefer` 启动宿主；设置为 `off` 只关闭钩子强制策略。可用值为 `hard`、`prefer` 和 `off`，非法值会安全拒绝并明确报错，不会静默放行。该设置由宿主进程继承，因此项目不能仅靠提交仓库配置文件降低用户的全局策略。仍可通过 Claude Code `/plugin`、Codex `/hooks`，或 Kimi `/plugins disable sift-light` 后执行 `/reload` 来关闭整个集成。
 
-严格模式下，`grep warning report.txt` 这类直接搜索会被拒绝；`cat report.txt | grep warning` 仍可用，因为它只是过滤一个非搜索命令的输出。`find src | grep test` 和 `rg warning src | grep result` 仍会被拒绝，因为管道中已经包含直接搜索来源。复合 shell 调用中只要一个子命令被拒绝，宿主就不会执行其中任何操作；拒绝信息会指出检测到的搜索，并要求 Agent 单独重试非搜索操作。
+严格模式下，`grep warning report.txt` 这类直接搜索会被拒绝；`cat report.txt | grep warning | head` 这类可静态确认只读取标准输入的过滤命令可放在管道中的任意位置，因为它过滤的是非搜索命令的输出。即使位于管道中，带文件参数、递归选项、从文件读取模式或输入重定向的过滤命令仍会被拒绝。请把 grep 选项放在模式之前，并用引号保护 shell 通配符；无法识别的选项和动态参数会保守拦截。PowerShell 中，`Get-Item` 等已知会输出文件对象的命令接入 `Select-String` 时也会被拒绝。`find src | grep test` 和 `rg warning src | grep result` 仍会被拒绝，因为管道中包含直接搜索来源。复合 shell 调用中只要一个子命令被拒绝，宿主就不会执行其中任何操作；拒绝信息会指出检测到的搜索，并要求 Agent 单独重试非搜索操作。
 
 本地搜索在你的机器上进行。请只允许 Agent 读取已获授权的文件。HTTP 服务对外开放前需要认证网关，详见[安全说明](SECURITY.md)。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-3",
+  "version": "1.0.3-4",
   "description": "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   "keywords": [
     "ai-agent",

package/plugins/sift-light/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-3",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-3",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.0.3-3",
+        "sift-light-runtime@npm:sift-light@1.0.3-4",
         "sift-light-mcp",
         "--stdio"
       ],

package/plugins/sift-light/hooks/search-policy.mjs

@@ -3779,9 +3779,182 @@ function classifyCommand(argv, language, depth = 0) {
   return classifyCommand(args2.slice(start2), language, depth + 1);
 }
 
+// src/search-policy-stdin-filter.ts
+var GREP_SWITCHES = new Set("abcEFGHhiILlnoPqsTUuvwxyzZ".split(""));
+var GREP_VALUE_OPTIONS = new Set(["A", "B", "C", "m"]);
+var GREP_LONG_SWITCHES = new Set([
+  "--basic-regexp",
+  "--extended-regexp",
+  "--fixed-strings",
+  "--perl-regexp",
+  "--ignore-case",
+  "--no-ignore-case",
+  "--invert-match",
+  "--word-regexp",
+  "--line-regexp",
+  "--count",
+  "--files-with-matches",
+  "--files-without-match",
+  "--only-matching",
+  "--quiet",
+  "--silent",
+  "--no-messages",
+  "--byte-offset",
+  "--line-number",
+  "--with-filename",
+  "--no-filename",
+  "--initial-tab",
+  "--null",
+  "--null-data",
+  "--text",
+  "--binary",
+  "--line-buffered",
+  "--no-group-separator"
+]);
+var GREP_LONG_VALUES = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--max-count",
+  "--binary-files",
+  "--label",
+  "--group-separator",
+  "--include",
+  "--exclude",
+  "--exclude-dir"
+]);
+function isStdinOnlyGrep(args2) {
+  const positionals = [];
+  let hasPatternOption = false;
+  let optionsEnded = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (positionals.length > 0 && arg !== "-")
+      return false;
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("--")) {
+      const separator = arg.indexOf("=");
+      const option = separator < 0 ? arg : arg.slice(0, separator);
+      const attached = separator < 0 ? undefined : arg.slice(separator + 1);
+      if (option === "--regexp") {
+        hasPatternOption = true;
+      } else if (option === "--color" || option === "--colour") {
+        continue;
+      } else if (GREP_LONG_SWITCHES.has(option) && attached === undefined) {
+        continue;
+      } else if (!GREP_LONG_VALUES.has(option)) {
+        return false;
+      }
+      if (attached === undefined) {
+        index += 1;
+        if (args2[index] === null || args2[index] === undefined)
+          return false;
+      }
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("-") && arg !== "-") {
+      for (let optionIndex = 1;optionIndex < arg.length; optionIndex += 1) {
+        const option = arg[optionIndex];
+        if (option === "e") {
+          hasPatternOption = true;
+        } else if (option !== undefined && GREP_SWITCHES.has(option)) {
+          continue;
+        } else if (option === undefined || !GREP_VALUE_OPTIONS.has(option)) {
+          return false;
+        }
+        if (optionIndex === arg.length - 1) {
+          index += 1;
+          if (args2[index] === null || args2[index] === undefined)
+            return false;
+        }
+        break;
+      }
+      continue;
+    }
+    positionals.push(arg);
+  }
+  return hasPatternOption ? positionals.every((operand) => operand === "-") : positionals.length > 0 && positionals.slice(1).every((operand) => operand === "-");
+}
+var SELECT_STRING_SWITCHES = new Set([
+  "simplematch",
+  "casesensitive",
+  "quiet",
+  "list",
+  "noemphasis",
+  "notmatch",
+  "allmatches",
+  "raw",
+  "verbose",
+  "debug"
+]);
+var SELECT_STRING_VALUES = new Set([
+  "culture",
+  "encoding",
+  "context",
+  "erroraction",
+  "warningaction",
+  "informationaction",
+  "outvariable",
+  "pipelinevariable"
+]);
+function isPipelineOnlySelectString(args2, namedParameters) {
+  let hasPattern = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (!namedParameters[index]) {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+      continue;
+    }
+    const separator = arg.indexOf(":");
+    const option = (separator < 0 ? arg.slice(1) : arg.slice(1, separator)).toLowerCase();
+    if (SELECT_STRING_SWITCHES.has(option) && separator < 0)
+      continue;
+    if (option !== "pattern" && !SELECT_STRING_VALUES.has(option))
+      return false;
+    if (option === "pattern") {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+    }
+    if (separator < 0) {
+      index += 1;
+      if (args2[index] === null || args2[index] === undefined)
+        return false;
+    }
+  }
+  return hasPattern;
+}
+function isStdinOnlySearchFilter(words, language, namedParameters) {
+  const executable = words[0];
+  if (executable === null || executable === undefined)
+    return false;
+  const name2 = executableName(executable);
+  if (language === "powershell")
+    return ["select-string", "sls"].includes(name2.toLowerCase()) && isPipelineOnlySelectString(words.slice(1), namedParameters.slice(1));
+  return ["grep", "egrep", "fgrep"].includes(name2) && isStdinOnlyGrep(words.slice(1));
+}
+
 // src/search-policy-shell.ts
 var MAX_POLICY_COMMAND_BYTES = 64 * 1024;
 var MAX_SHELL_NESTING = 4;
+var POWERSHELL_FILE_OBJECT_PRODUCERS = new Set([
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "dir",
+  "ls"
+]);
+var POWERSHELL_STRING_CONVERTERS = new Set(["out-string", "oss", "convertto-json"]);
 function decodeBashDoubleQuoted(value) {
   let result = "";
   for (let index = 0;index < value.length; index += 1) {
@@ -3867,6 +4040,18 @@ function commandWordNodes(node, language) {
 function commandWords(node, language) {
   return commandWordNodes(node, language).map((word) => literalWord(word, language));
 }
+function hasBashWordExpansion(text) {
+  if (text.startsWith("~") || text.startsWith("="))
+    return true;
+  for (let index = 0;index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+    } else if ("*?[]{}".includes(text[index] ?? "")) {
+      return true;
+    }
+  }
+  return false;
+}
 function hasUntranslatedShellSyntax(node, language) {
   const text = node.text;
   if (language === "powershell") {
@@ -3879,30 +4064,70 @@ function hasUntranslatedShellSyntax(node, language) {
   if (["raw_string", "string", "string_content"].includes(node.type))
     return false;
   if (["word", "number", "command_name"].includes(node.type))
-    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+    return hasBashWordExpansion(text);
   if (node.type === "concatenation")
     return node.namedChildren.some((child) => child !== null && hasUntranslatedShellSyntax(child, language));
   return false;
 }
+function hasInputRedirectNodes(owner) {
+  return owner.descendantsOfType(["file_redirect", "herestring_redirect", "heredoc_redirect"]).some((redirect) => redirect !== null && /^(?:\d+)?</u.test(redirect.text));
+}
+function hasInputRedirect(node) {
+  if (hasInputRedirectNodes(node))
+    return true;
+  for (let parent = node.parent;parent; parent = parent.parent) {
+    if (parent.type !== "redirected_statement")
+      continue;
+    const body2 = parent.childForFieldName("body");
+    const last = body2?.descendantsOfType("command").at(-1) ?? (body2?.type === "command" ? body2 : undefined);
+    if (last?.startIndex === node.startIndex && last.endIndex === node.endIndex && parent.childrenForFieldName("redirect").some((redirect) => redirect !== null && hasInputRedirectNodes(redirect)))
+      return true;
+  }
+  return false;
+}
 function isSafePipelineFilter(node, language, words) {
-  const executable = words[0];
-  if (executable === null || executable === undefined)
+  const wordNodes = commandWordNodes(node, language);
+  if (!isStdinOnlySearchFilter(words, language, wordNodes.map((word) => word.type === "command_parameter")))
     return false;
-  const name2 = executableName(executable);
-  const filterNames = language === "powershell" ? new Set(["select-string", "sls"]) : new Set(["grep", "egrep", "fgrep"]);
-  if (!filterNames.has(language === "powershell" ? name2.toLowerCase() : name2))
+  if (wordNodes.some((word) => hasUntranslatedShellSyntax(word, language)))
+    return false;
+  if (hasInputRedirect(node))
     return false;
   const pipeline = node.parent;
-  if (!pipeline || pipeline.type !== "pipeline")
+  if (!pipeline || !["pipeline", "pipeline_chain"].includes(pipeline.type))
     return false;
-  const commands = pipeline.namedChildren.filter((child) => child !== null && child.type === "command");
-  const last = commands.at(-1);
-  if (!last || last.startIndex !== node.startIndex || last.endIndex !== node.endIndex || commands.length < 2)
+  const stages = pipeline.namedChildren.filter((child) => child !== null);
+  const position = stages.findIndex((stage) => stage.startIndex <= node.startIndex && stage.endIndex >= node.endIndex);
+  if (position < 1)
     return false;
-  return commands.slice(0, -1).every((candidate) => {
-    const decision = classifyCommand(commandWords(candidate, language), language);
-    return !decision.kind && !decision.nested;
-  });
+  let fileObjectFlow = false;
+  for (const [index, stage] of stages.entries()) {
+    if (index === position)
+      continue;
+    const commands = stage.descendantsOfType("command");
+    for (const candidate of commands) {
+      if (candidate === null)
+        continue;
+      const candidateWords = commandWords(candidate, language);
+      const decision = classifyCommand(candidateWords, language);
+      if (decision.kind || decision.nested)
+        return false;
+      if (language !== "powershell" || index > position)
+        continue;
+      const executable = candidateWords[0];
+      if (executable === null || executable === undefined)
+        continue;
+      const name2 = executableName(executable).toLowerCase();
+      if (POWERSHELL_FILE_OBJECT_PRODUCERS.has(name2))
+        fileObjectFlow = true;
+    }
+    if (language === "powershell" && index < position && stage.type === "command") {
+      const executable = commandWords(stage, language)[0];
+      if (executable !== null && executable !== undefined && POWERSHELL_STRING_CONVERTERS.has(executableName(executable).toLowerCase()))
+        fileObjectFlow = false;
+    }
+  }
+  return !fileObjectFlow;
 }
 
 class ShellSearchPolicy {

package/plugins/sift-light/kimi.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-3",
+  "version": "1.0.3-4",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"
@@ -13,7 +13,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.0.3-3",
+        "sift-light-runtime@npm:sift-light@1.0.3-4",
         "sift-light-mcp",
         "--stdio"
       ],

package/plugins/sift-light/omp-extension.mjs

@@ -1845,7 +1845,7 @@ function createCtagsStructureProvider(options = {}) {
 // package.json
 var package_default = {
   name: "sift-light",
-  version: "1.0.3-3",
+  version: "1.0.3-4",
   description: "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   keywords: [
     "ai-agent",
@@ -20458,9 +20458,182 @@ function classifyCommand(argv, language, depth = 0) {
   return classifyCommand(args2.slice(start2), language, depth + 1);
 }
 
+// src/search-policy-stdin-filter.ts
+var GREP_SWITCHES = new Set("abcEFGHhiILlnoPqsTUuvwxyzZ".split(""));
+var GREP_VALUE_OPTIONS = new Set(["A", "B", "C", "m"]);
+var GREP_LONG_SWITCHES = new Set([
+  "--basic-regexp",
+  "--extended-regexp",
+  "--fixed-strings",
+  "--perl-regexp",
+  "--ignore-case",
+  "--no-ignore-case",
+  "--invert-match",
+  "--word-regexp",
+  "--line-regexp",
+  "--count",
+  "--files-with-matches",
+  "--files-without-match",
+  "--only-matching",
+  "--quiet",
+  "--silent",
+  "--no-messages",
+  "--byte-offset",
+  "--line-number",
+  "--with-filename",
+  "--no-filename",
+  "--initial-tab",
+  "--null",
+  "--null-data",
+  "--text",
+  "--binary",
+  "--line-buffered",
+  "--no-group-separator"
+]);
+var GREP_LONG_VALUES = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--max-count",
+  "--binary-files",
+  "--label",
+  "--group-separator",
+  "--include",
+  "--exclude",
+  "--exclude-dir"
+]);
+function isStdinOnlyGrep(args2) {
+  const positionals = [];
+  let hasPatternOption = false;
+  let optionsEnded = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (positionals.length > 0 && arg !== "-")
+      return false;
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("--")) {
+      const separator = arg.indexOf("=");
+      const option = separator < 0 ? arg : arg.slice(0, separator);
+      const attached = separator < 0 ? undefined : arg.slice(separator + 1);
+      if (option === "--regexp") {
+        hasPatternOption = true;
+      } else if (option === "--color" || option === "--colour") {
+        continue;
+      } else if (GREP_LONG_SWITCHES.has(option) && attached === undefined) {
+        continue;
+      } else if (!GREP_LONG_VALUES.has(option)) {
+        return false;
+      }
+      if (attached === undefined) {
+        index += 1;
+        if (args2[index] === null || args2[index] === undefined)
+          return false;
+      }
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("-") && arg !== "-") {
+      for (let optionIndex = 1;optionIndex < arg.length; optionIndex += 1) {
+        const option = arg[optionIndex];
+        if (option === "e") {
+          hasPatternOption = true;
+        } else if (option !== undefined && GREP_SWITCHES.has(option)) {
+          continue;
+        } else if (option === undefined || !GREP_VALUE_OPTIONS.has(option)) {
+          return false;
+        }
+        if (optionIndex === arg.length - 1) {
+          index += 1;
+          if (args2[index] === null || args2[index] === undefined)
+            return false;
+        }
+        break;
+      }
+      continue;
+    }
+    positionals.push(arg);
+  }
+  return hasPatternOption ? positionals.every((operand) => operand === "-") : positionals.length > 0 && positionals.slice(1).every((operand) => operand === "-");
+}
+var SELECT_STRING_SWITCHES = new Set([
+  "simplematch",
+  "casesensitive",
+  "quiet",
+  "list",
+  "noemphasis",
+  "notmatch",
+  "allmatches",
+  "raw",
+  "verbose",
+  "debug"
+]);
+var SELECT_STRING_VALUES = new Set([
+  "culture",
+  "encoding",
+  "context",
+  "erroraction",
+  "warningaction",
+  "informationaction",
+  "outvariable",
+  "pipelinevariable"
+]);
+function isPipelineOnlySelectString(args2, namedParameters) {
+  let hasPattern = false;
+  for (let index = 0;index < args2.length; index += 1) {
+    const arg = args2[index];
+    if (arg === null || arg === undefined)
+      return false;
+    if (!namedParameters[index]) {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+      continue;
+    }
+    const separator = arg.indexOf(":");
+    const option = (separator < 0 ? arg.slice(1) : arg.slice(1, separator)).toLowerCase();
+    if (SELECT_STRING_SWITCHES.has(option) && separator < 0)
+      continue;
+    if (option !== "pattern" && !SELECT_STRING_VALUES.has(option))
+      return false;
+    if (option === "pattern") {
+      if (hasPattern)
+        return false;
+      hasPattern = true;
+    }
+    if (separator < 0) {
+      index += 1;
+      if (args2[index] === null || args2[index] === undefined)
+        return false;
+    }
+  }
+  return hasPattern;
+}
+function isStdinOnlySearchFilter(words, language, namedParameters) {
+  const executable = words[0];
+  if (executable === null || executable === undefined)
+    return false;
+  const name2 = executableName(executable);
+  if (language === "powershell")
+    return ["select-string", "sls"].includes(name2.toLowerCase()) && isPipelineOnlySelectString(words.slice(1), namedParameters.slice(1));
+  return ["grep", "egrep", "fgrep"].includes(name2) && isStdinOnlyGrep(words.slice(1));
+}
+
 // src/search-policy-shell.ts
 var MAX_POLICY_COMMAND_BYTES = 64 * 1024;
 var MAX_SHELL_NESTING = 4;
+var POWERSHELL_FILE_OBJECT_PRODUCERS = new Set([
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "dir",
+  "ls"
+]);
+var POWERSHELL_STRING_CONVERTERS = new Set(["out-string", "oss", "convertto-json"]);
 function decodeBashDoubleQuoted(value) {
   let result = "";
   for (let index = 0;index < value.length; index += 1) {
@@ -20546,6 +20719,18 @@ function commandWordNodes(node, language) {
 function commandWords(node, language) {
   return commandWordNodes(node, language).map((word) => literalWord(word, language));
 }
+function hasBashWordExpansion(text) {
+  if (text.startsWith("~") || text.startsWith("="))
+    return true;
+  for (let index = 0;index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+    } else if ("*?[]{}".includes(text[index] ?? "")) {
+      return true;
+    }
+  }
+  return false;
+}
 function hasUntranslatedShellSyntax(node, language) {
   const text = node.text;
   if (language === "powershell") {
@@ -20558,30 +20743,70 @@ function hasUntranslatedShellSyntax(node, language) {
   if (["raw_string", "string", "string_content"].includes(node.type))
     return false;
   if (["word", "number", "command_name"].includes(node.type))
-    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+    return hasBashWordExpansion(text);
   if (node.type === "concatenation")
     return node.namedChildren.some((child) => child !== null && hasUntranslatedShellSyntax(child, language));
   return false;
 }
+function hasInputRedirectNodes(owner) {
+  return owner.descendantsOfType(["file_redirect", "herestring_redirect", "heredoc_redirect"]).some((redirect) => redirect !== null && /^(?:\d+)?</u.test(redirect.text));
+}
+function hasInputRedirect(node) {
+  if (hasInputRedirectNodes(node))
+    return true;
+  for (let parent = node.parent;parent; parent = parent.parent) {
+    if (parent.type !== "redirected_statement")
+      continue;
+    const body2 = parent.childForFieldName("body");
+    const last = body2?.descendantsOfType("command").at(-1) ?? (body2?.type === "command" ? body2 : undefined);
+    if (last?.startIndex === node.startIndex && last.endIndex === node.endIndex && parent.childrenForFieldName("redirect").some((redirect) => redirect !== null && hasInputRedirectNodes(redirect)))
+      return true;
+  }
+  return false;
+}
 function isSafePipelineFilter(node, language, words) {
-  const executable = words[0];
-  if (executable === null || executable === undefined)
+  const wordNodes = commandWordNodes(node, language);
+  if (!isStdinOnlySearchFilter(words, language, wordNodes.map((word) => word.type === "command_parameter")))
     return false;
-  const name2 = executableName(executable);
-  const filterNames = language === "powershell" ? new Set(["select-string", "sls"]) : new Set(["grep", "egrep", "fgrep"]);
-  if (!filterNames.has(language === "powershell" ? name2.toLowerCase() : name2))
+  if (wordNodes.some((word) => hasUntranslatedShellSyntax(word, language)))
+    return false;
+  if (hasInputRedirect(node))
     return false;
   const pipeline = node.parent;
-  if (!pipeline || pipeline.type !== "pipeline")
+  if (!pipeline || !["pipeline", "pipeline_chain"].includes(pipeline.type))
     return false;
-  const commands = pipeline.namedChildren.filter((child) => child !== null && child.type === "command");
-  const last = commands.at(-1);
-  if (!last || last.startIndex !== node.startIndex || last.endIndex !== node.endIndex || commands.length < 2)
+  const stages = pipeline.namedChildren.filter((child) => child !== null);
+  const position = stages.findIndex((stage) => stage.startIndex <= node.startIndex && stage.endIndex >= node.endIndex);
+  if (position < 1)
     return false;
-  return commands.slice(0, -1).every((candidate) => {
-    const decision = classifyCommand(commandWords(candidate, language), language);
-    return !decision.kind && !decision.nested;
-  });
+  let fileObjectFlow = false;
+  for (const [index, stage] of stages.entries()) {
+    if (index === position)
+      continue;
+    const commands = stage.descendantsOfType("command");
+    for (const candidate of commands) {
+      if (candidate === null)
+        continue;
+      const candidateWords = commandWords(candidate, language);
+      const decision = classifyCommand(candidateWords, language);
+      if (decision.kind || decision.nested)
+        return false;
+      if (language !== "powershell" || index > position)
+        continue;
+      const executable = candidateWords[0];
+      if (executable === null || executable === undefined)
+        continue;
+      const name2 = executableName(executable).toLowerCase();
+      if (POWERSHELL_FILE_OBJECT_PRODUCERS.has(name2))
+        fileObjectFlow = true;
+    }
+    if (language === "powershell" && index < position && stage.type === "command") {
+      const executable = commandWords(stage, language)[0];
+      if (executable !== null && executable !== undefined && POWERSHELL_STRING_CONVERTERS.has(executableName(executable).toLowerCase()))
+        fileObjectFlow = false;
+    }
+  }
+  return !fileObjectFlow;
 }
 
 class ShellSearchPolicy {
@@ -20663,7 +20888,7 @@ class ShellSearchPolicy {
 }
 
 // src/search-policy.ts
-var SEARCH_POLICY_GUIDANCE = "Local content and filename searches must use sift-light. Built-in search tools and direct search commands are blocked before execution; filtering output from an unrelated producer at a pipeline tail remains available. Use pattern for contents or mode=files with query for filenames. Keep read/edit/write, tests and builds available. After a denial, call sift-light once with the stated repair; do not paste the denial into the request, repeat the blocked call, use another shell/custom script, or weaken the search mode.";
+var SEARCH_POLICY_GUIDANCE = "Local content and filename searches must use sift-light. Built-in search tools and direct search commands are blocked before execution; recognized stdin-only filtering of output from an unrelated producer remains available at any pipeline position. File operands, recursive search options, file-sourced patterns and input redirection are not filter exceptions. Use pattern for contents or mode=files with query for filenames. Keep read/edit/write, tests and builds available. After a denial, call sift-light once with the stated repair; do not paste the denial into the request, repeat the blocked call, use another shell/custom script, or weaken the search mode.";
 var PI_REPLACED_SEARCH_TOOLS = new Set(["grep", "find"]);
 var PREFERRED_SEARCH_GUIDANCE = "Prefer sift-light for local content and filename searches because it provides bounded evidence, coverage and continuation details. Conventional search entries remain available in advisory mode.";
 var contentTools = new Set(["grep", "Grep", "SearchFileContent"]);

package/plugins/sift-light/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.0.3-3",
+  "version": "1.0.3-4",
   "private": true,
   "type": "module",
   "omp": {

package/src/mcp-server.mjs

@@ -7,7 +7,7 @@ import { URL as URL2 } from "node:url";
 // package.json
 var package_default = {
   name: "sift-light",
-  version: "1.0.3-3",
+  version: "1.0.3-4",
   description: "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   keywords: [
     "ai-agent",

package/src/search-policy-shell.ts

@@ -6,9 +6,19 @@ import {
   type SearchKind,
   type ShellLanguage,
 } from "./search-policy-commands.js";
+import { isStdinOnlySearchFilter } from "./search-policy-stdin-filter.js";
 
 export const MAX_POLICY_COMMAND_BYTES = 64 * 1024;
 const MAX_SHELL_NESTING = 4;
+const POWERSHELL_FILE_OBJECT_PRODUCERS = new Set([
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "dir",
+  "ls",
+]);
+const POWERSHELL_STRING_CONVERTERS = new Set(["out-string", "oss", "convertto-json"]);
 
 export interface ShellSearchMatch {
   kind: SearchKind;
@@ -116,6 +126,18 @@ function commandWords(node: Node, language: ShellLanguage): Array<string | null>
   return commandWordNodes(node, language).map((word) => literalWord(word, language));
 }
 
+function hasBashWordExpansion(text: string): boolean {
+  if (text.startsWith("~") || text.startsWith("=")) return true;
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+    } else if ("*?[]{}".includes(text[index] ?? "")) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolean {
   const text = node.text;
   if (language === "powershell") {
@@ -131,8 +153,7 @@ function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolea
     );
   }
   if (["raw_string", "string", "string_content"].includes(node.type)) return false;
-  if (["word", "number", "command_name"].includes(node.type))
-    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+  if (["word", "number", "command_name"].includes(node.type)) return hasBashWordExpansion(text);
   if (node.type === "concatenation")
     return node.namedChildren.some(
       (child) => child !== null && hasUntranslatedShellSyntax(child, language),
@@ -140,36 +161,80 @@ function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolea
   return false;
 }
 
+function hasInputRedirectNodes(owner: Node): boolean {
+  return owner
+    .descendantsOfType(["file_redirect", "herestring_redirect", "heredoc_redirect"])
+    .some((redirect) => redirect !== null && /^(?:\d+)?</u.test(redirect.text));
+}
+
+function hasInputRedirect(node: Node): boolean {
+  if (hasInputRedirectNodes(node)) return true;
+  for (let parent = node.parent; parent; parent = parent.parent) {
+    if (parent.type !== "redirected_statement") continue;
+    const body = parent.childForFieldName("body");
+    const last =
+      body?.descendantsOfType("command").at(-1) ?? (body?.type === "command" ? body : undefined);
+    if (
+      last?.startIndex === node.startIndex &&
+      last.endIndex === node.endIndex &&
+      parent
+        .childrenForFieldName("redirect")
+        .some((redirect) => redirect !== null && hasInputRedirectNodes(redirect))
+    )
+      return true;
+  }
+  return false;
+}
+
 function isSafePipelineFilter(
   node: Node,
   language: ShellLanguage,
   words: Array<string | null>,
 ): boolean {
-  const executable = words[0];
-  if (executable === null || executable === undefined) return false;
-  const name = executableName(executable);
-  const filterNames =
-    language === "powershell"
-      ? new Set(["select-string", "sls"])
-      : new Set(["grep", "egrep", "fgrep"]);
-  if (!filterNames.has(language === "powershell" ? name.toLowerCase() : name)) return false;
-  const pipeline = node.parent;
-  if (!pipeline || pipeline.type !== "pipeline") return false;
-  const commands = pipeline.namedChildren.filter(
-    (child): child is Node => child !== null && child.type === "command",
-  );
-  const last = commands.at(-1);
+  const wordNodes = commandWordNodes(node, language);
   if (
-    !last ||
-    last.startIndex !== node.startIndex ||
-    last.endIndex !== node.endIndex ||
-    commands.length < 2
+    !isStdinOnlySearchFilter(
+      words,
+      language,
+      wordNodes.map((word) => word.type === "command_parameter"),
+    )
   )
     return false;
-  return commands.slice(0, -1).every((candidate) => {
-    const decision = classifyCommand(commandWords(candidate, language), language);
-    return !decision.kind && !decision.nested;
-  });
+  if (wordNodes.some((word) => hasUntranslatedShellSyntax(word, language))) return false;
+  if (hasInputRedirect(node)) return false;
+  const pipeline = node.parent;
+  if (!pipeline || !["pipeline", "pipeline_chain"].includes(pipeline.type)) return false;
+  const stages = pipeline.namedChildren.filter((child): child is Node => child !== null);
+  const position = stages.findIndex(
+    (stage) => stage.startIndex <= node.startIndex && stage.endIndex >= node.endIndex,
+  );
+  if (position < 1) return false;
+  let fileObjectFlow = false;
+  for (const [index, stage] of stages.entries()) {
+    if (index === position) continue;
+    const commands = stage.descendantsOfType("command");
+    for (const candidate of commands) {
+      if (candidate === null) continue;
+      const candidateWords = commandWords(candidate, language);
+      const decision = classifyCommand(candidateWords, language);
+      if (decision.kind || decision.nested) return false;
+      if (language !== "powershell" || index > position) continue;
+      const executable = candidateWords[0];
+      if (executable === null || executable === undefined) continue;
+      const name = executableName(executable).toLowerCase();
+      if (POWERSHELL_FILE_OBJECT_PRODUCERS.has(name)) fileObjectFlow = true;
+    }
+    if (language === "powershell" && index < position && stage.type === "command") {
+      const executable = commandWords(stage, language)[0];
+      if (
+        executable !== null &&
+        executable !== undefined &&
+        POWERSHELL_STRING_CONVERTERS.has(executableName(executable).toLowerCase())
+      )
+        fileObjectFlow = false;
+    }
+  }
+  return !fileObjectFlow;
 }
 
 /** WASM grammars are shipped with the hook; parsing never reads shell scripts or executes code. */

package/src/search-policy-stdin-filter.ts

@@ -0,0 +1,174 @@
+import { executableName, type ShellLanguage } from "./search-policy-commands.js";
+
+// Only options whose operands cannot name an input file are accepted here. Unknown
+// options fail closed, since grep variants and PowerShell aliases can add file inputs.
+const GREP_SWITCHES = new Set("abcEFGHhiILlnoPqsTUuvwxyzZ".split(""));
+const GREP_VALUE_OPTIONS = new Set(["A", "B", "C", "m"]);
+const GREP_LONG_SWITCHES = new Set([
+  "--basic-regexp",
+  "--extended-regexp",
+  "--fixed-strings",
+  "--perl-regexp",
+  "--ignore-case",
+  "--no-ignore-case",
+  "--invert-match",
+  "--word-regexp",
+  "--line-regexp",
+  "--count",
+  "--files-with-matches",
+  "--files-without-match",
+  "--only-matching",
+  "--quiet",
+  "--silent",
+  "--no-messages",
+  "--byte-offset",
+  "--line-number",
+  "--with-filename",
+  "--no-filename",
+  "--initial-tab",
+  "--null",
+  "--null-data",
+  "--text",
+  "--binary",
+  "--line-buffered",
+  "--no-group-separator",
+]);
+const GREP_LONG_VALUES = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--max-count",
+  "--binary-files",
+  "--label",
+  "--group-separator",
+  "--include",
+  "--exclude",
+  "--exclude-dir",
+]);
+
+function isStdinOnlyGrep(args: readonly (string | null)[]): boolean {
+  const positionals: string[] = [];
+  let hasPatternOption = false;
+  let optionsEnded = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === null || arg === undefined) return false;
+    // Some grep implementations (and GNU grep with POSIXLY_CORRECT) stop option
+    // parsing at the first operand. Later option-looking words can be file names.
+    if (positionals.length > 0 && arg !== "-") return false;
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("--")) {
+      const separator = arg.indexOf("=");
+      const option = separator < 0 ? arg : arg.slice(0, separator);
+      const attached = separator < 0 ? undefined : arg.slice(separator + 1);
+      if (option === "--regexp") {
+        hasPatternOption = true;
+      } else if (option === "--color" || option === "--colour") {
+        continue;
+      } else if (GREP_LONG_SWITCHES.has(option) && attached === undefined) {
+        continue;
+      } else if (!GREP_LONG_VALUES.has(option)) {
+        return false;
+      }
+      if (attached === undefined) {
+        index += 1;
+        if (args[index] === null || args[index] === undefined) return false;
+      }
+      continue;
+    }
+    if (!optionsEnded && arg.startsWith("-") && arg !== "-") {
+      for (let optionIndex = 1; optionIndex < arg.length; optionIndex += 1) {
+        const option = arg[optionIndex];
+        if (option === "e") {
+          hasPatternOption = true;
+        } else if (option !== undefined && GREP_SWITCHES.has(option)) {
+          continue;
+        } else if (option === undefined || !GREP_VALUE_OPTIONS.has(option)) {
+          return false;
+        }
+        if (optionIndex === arg.length - 1) {
+          index += 1;
+          if (args[index] === null || args[index] === undefined) return false;
+        }
+        break;
+      }
+      continue;
+    }
+    positionals.push(arg);
+  }
+  return hasPatternOption
+    ? positionals.every((operand) => operand === "-")
+    : positionals.length > 0 && positionals.slice(1).every((operand) => operand === "-");
+}
+
+const SELECT_STRING_SWITCHES = new Set([
+  "simplematch",
+  "casesensitive",
+  "quiet",
+  "list",
+  "noemphasis",
+  "notmatch",
+  "allmatches",
+  "raw",
+  "verbose",
+  "debug",
+]);
+const SELECT_STRING_VALUES = new Set([
+  "culture",
+  "encoding",
+  "context",
+  "erroraction",
+  "warningaction",
+  "informationaction",
+  "outvariable",
+  "pipelinevariable",
+]);
+
+function isPipelineOnlySelectString(
+  args: readonly (string | null)[],
+  namedParameters: readonly boolean[],
+): boolean {
+  let hasPattern = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === null || arg === undefined) return false;
+    if (!namedParameters[index]) {
+      if (hasPattern) return false; // Further positional values can bind to -Path.
+      hasPattern = true;
+      continue;
+    }
+    const separator = arg.indexOf(":");
+    const option = (separator < 0 ? arg.slice(1) : arg.slice(1, separator)).toLowerCase();
+    if (SELECT_STRING_SWITCHES.has(option) && separator < 0) continue;
+    if (option !== "pattern" && !SELECT_STRING_VALUES.has(option)) return false;
+    if (option === "pattern") {
+      if (hasPattern) return false;
+      hasPattern = true;
+    }
+    if (separator < 0) {
+      index += 1;
+      if (args[index] === null || args[index] === undefined) return false;
+    }
+  }
+  return hasPattern;
+}
+
+/** The exception is for filters consuming the pipeline, never for file operands. */
+export function isStdinOnlySearchFilter(
+  words: readonly (string | null)[],
+  language: ShellLanguage,
+  namedParameters: readonly boolean[],
+): boolean {
+  const executable = words[0];
+  if (executable === null || executable === undefined) return false;
+  const name = executableName(executable);
+  if (language === "powershell")
+    return (
+      ["select-string", "sls"].includes(name.toLowerCase()) &&
+      isPipelineOnlySelectString(words.slice(1), namedParameters.slice(1))
+    );
+  return ["grep", "egrep", "fgrep"].includes(name) && isStdinOnlyGrep(words.slice(1));
+}

package/src/search-policy.ts

@@ -3,7 +3,7 @@ import { recoverShellSearch } from "./search-policy-recovery.js";
 import { ShellSearchPolicy, type ShellSearchMatch } from "./search-policy-shell.js";
 
 export const SEARCH_POLICY_GUIDANCE =
-  "Local content and filename searches must use sift-light. Built-in search tools and direct search commands are blocked before execution; filtering output from an unrelated producer at a pipeline tail remains available. Use pattern for contents or mode=files with query for filenames. Keep read/edit/write, tests and builds available. After a denial, call sift-light once with the stated repair; do not paste the denial into the request, repeat the blocked call, use another shell/custom script, or weaken the search mode.";
+  "Local content and filename searches must use sift-light. Built-in search tools and direct search commands are blocked before execution; recognized stdin-only filtering of output from an unrelated producer remains available at any pipeline position. File operands, recursive search options, file-sourced patterns and input redirection are not filter exceptions. Use pattern for contents or mode=files with query for filenames. Keep read/edit/write, tests and builds available. After a denial, call sift-light once with the stated repair; do not paste the denial into the request, repeat the blocked call, use another shell/custom script, or weaken the search mode.";
 export const PI_REPLACED_SEARCH_TOOLS = new Set(["grep", "find"]);
 export const PREFERRED_SEARCH_GUIDANCE =
   "Prefer sift-light for local content and filename searches because it provides bounded evidence, coverage and continuation details. Conventional search entries remain available in advisory mode.";