@blogic-cz/agent-tools 1.14.2 → 1.14.4

package/README.md

@@ -730,6 +730,33 @@ Literal heredoc bodies can be written as data. Unquoted heredoc expansion is ana
 
 Copy operations in a Herdr chain require `credentialGuard.chainCopyDestinations`. Copies also receive this destination proof whenever the configured list is nonempty. The synchronous filesystem check refuses errors, symlinks, missing parent directories, and destinations outside the configured directories. Ordinary copies without a Herdr invocation or configured destinations still receive normal source and destination checks.
 
+#### Agent instruction and configuration writes
+
+The Bash `agent-config-write` rule refuses writes to these paths:
+
+- Any file named `AGENTS.md`, `CLAUDE.md`, or `.mcp.json`, with case normalized.
+- Project `.codex/` trees, `.claude/settings*.json`, and `.claude/commands/`, `.claude/agents/`, and `.claude/skills/` trees.
+- Home `.codex/config.toml` and `.codex/prompts/`.
+- Home `.claude.json`, `.claude/settings*.json`, and `.claude/commands/`, `.claude/agents/`, `.claude/skills/`, and `.claude/hooks/` trees.
+- Home `.agents/skills/` and replacement of the home `.agents` directory itself.
+- Replacement of a `.claude` directory itself.
+
+The rule checks redirects, `tee`, in-place `sed`, copy and link destinations, and supported writer operands. These include `rsync`, `ditto`, `tmutil restore` destinations, archive output files and destinations, `git checkout` paths with or without `--`, `patch`, `truncate`, `touch`, and `wget` output paths. Without an output-document option, the `wget` URL basename supplies the output name. A glob that can match a protected name refuses. A bracket expression that the matcher cannot translate also refuses. A configured copy grant remains subject to the filesystem proof above.
+
+Work data such as `~/.agents/jobs/`, `~/.claude/plans/`, and `~/.claude/projects/` remains writable. Ordinary document paths such as `README.md` remain writable. Reading an instruction file or copying it to `/tmp/x.md` can pass.
+
+The guard treats an extensionless destination outside temporary roots as a possible directory and also checks that destination plus the source basename. The added candidate does not apply under `/tmp`, `/private/tmp`, `/var/folders`, or `/private/var/folders`. A literal local `TMPDIR` binding resolves through the same path checks. An unknown ambient `TMPDIR` still requires environment approval and a resolvable path. Explicit directory syntax retains its existing checks.
+
+The check is static. It cannot establish whether a dotted destination is an existing directory. It does not inspect archive members, patch contents, remote transfers, source directory contents, or filesystem aliases. Named archive members such as `tar -xf x.tar AGENTS.md` also stay outside this check because the archive contents are unknown. Those contents can contain protected names that the command text does not name. General path checks do not resolve symlinks. The copy proof above is the bounded exception. PowerShell does not receive the Bash agent-configuration write rule.
+
+#### Herdr launches
+
+The `agent-launch-override` rule checks native arguments after `herdr agent start ... --`. It also checks modeled `tab create` and `pane split` forms that directly launch Codex or Claude. Global Herdr options do not skip the check. Prompt text stays data.
+
+Codex accepts `-m` or `--model`, `--add-dir`, `--cd` or `-C`, and `--sandbox` or `-s` with `workspace-write` or `read-only`. Supported `-c` settings are `model_reasoning_effort`, `sandbox_workspace_write.network_access`, and the literal `shell_environment_policy.set.HERDR_*` values used by the supported launch form. Claude accepts `--model` and `--add-dir`. Both accept `--prompt` and one trailing prompt. Other native arguments refuse, including permission bypasses, arbitrary config overrides, and config profiles.
+
+`herdr pane run`, `send-keys`, and `send-text` refuse with `no-analyzer` because the terminal state is unknown. The guard does not certify a running agent or an existing terminal.
+
 Sensitive paths include credential files and configured blocked paths. Known template paths and explicit allowed paths can provide exceptions. Process-environment files cannot be allowed by a path exception. Slash direction and Windows path case are normalized independently of the host OS. General path checks do not resolve filesystem symlinks or confine commands to the repository; the copy-destination check above is the bounded filesystem exception. Custom command patterns apply to the original text, nested shell text, and resolved invocations.
 
 The kubeconfig pattern protects path segments containing `kubeconfig`. A final ordinary Markdown basename such as `check-kubeconfig-topology.md` has a documentation exception; `kubeconfig.md` and kubeconfig-containing parent directories remain protected. Explicit allowed paths take precedence over ordinary blocked patterns. This filename convention does not attest file contents.

package/dist/credential-guard/backlog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backlog.test.d.ts.map

package/dist/credential-guard/backlog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/backlog.test.ts"],"names":[],"mappings":""}

package/dist/credential-guard/engine.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/engine.test.ts"],"names":[],"mappings":"AA+aA,eAAO,MAAM,cAAc,UAoI1B,CAAC;AACF,eAAO,MAAM,gBAAgB,UA0T5B,CAAC;AA4FF,eAAO,MAAM,oBAAoB,UAShC,CAAC;AACF,eAAO,MAAM,sBAAsB,UA+BlC,CAAC"}
+{"version":3,"file":"engine.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/engine.test.ts"],"names":[],"mappings":"AA+fA,eAAO,MAAM,cAAc,UAoI1B,CAAC;AACF,eAAO,MAAM,gBAAgB,UA0T5B,CAAC;AA4FF,eAAO,MAAM,oBAAoB,UAShC,CAAC;AACF,eAAO,MAAM,sBAAsB,UA+BlC,CAAC"}

package/dist/credential-guard/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/credential-guard/policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAiB,UAAU,EAAsB,MAAM,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAO9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB5D,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQ7D,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E,CAAC;AACF,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAiBxD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,cAAc,QAAQ,CAAC;AAyHpC,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,QAAQ,CAs8CnF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/credential-guard/policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAiB,UAAU,EAAsB,MAAM,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAO9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB5D,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQ7D,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E,CAAC;AACF,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAiBxD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,cAAc,QAAQ,CAAC;AA4JpC,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,QAAQ,CA67CnF"}

package/dist/credential-guard/registry.d.ts

@@ -1,6 +1,6 @@
 import type { XargsInput } from "./xargs";
 export type Language = "bash" | "powershell" | "jq" | "sed" | "awk" | "runtime";
-export type OperandRole = "data" | "path" | "content" | "path-pattern" | "search-filter" | "names" | "env-name" | "script" | "test-filter" | "member" | "rg-type" | "write" | {
+export type OperandRole = "data" | "path" | "content" | "path-pattern" | "search-filter" | "names" | "env-name" | "script" | "test-filter" | "member" | "rg-type" | "write" | "write-name" | {
     readonly code: Language;
 };
 export type Issue = {
@@ -15,6 +15,7 @@ export type Option = {
 };
 export type ExecutableEntry = {
     readonly name: string;
+    readonly rejectsAbbreviations?: boolean;
     readonly readsContent?: boolean;
     readonly readsStdinCode?: boolean;
     readonly builtinOnly?: boolean;

package/dist/credential-guard/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS;QACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EA28FjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AA+7CD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP,YAAY,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS;QACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EA8kGjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AAilDD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.14.2",
+  "version": "1.14.4",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/backlog.test.ts

@@ -0,0 +1,343 @@
+import { expect, it } from "vitest";
+import { parseBash } from "./bash";
+import { judge } from "./policy";
+
+const bash = (command: string) => judge(parseBash(command), { cwd: "/repo", home: "/users/test" });
+
+it.each([
+  "tar -cf /tmp/o.tar -L ~/.ssh/id_rsa",
+  "tar -cf /tmp/o.tar -L ~/.ssh/id_rsa src",
+  "tar -cf /tmp/o.tar -I ~/.ssh/id_rsa",
+  "tar -cf /tmp/o.tar -I ~/.aws/credentials",
+  "tar -cf /tmp/o.tar -I ~/.ssh/id_rsa src",
+  "tar -cf /tmp/o.tar -b ~/.ssh/id_rsa",
+  "tar -cf /tmp/o.tar -s ~/.ssh/id_rsa",
+  "tar -cf /tmp/o.tar --exclude ~/.ssh/id_rsa src",
+  "tar -cf /tmp/o.tar --exclude=~/.ssh/id_rsa src",
+  "tar -cf/tmp/o.tar -I~/.ssh/id_rsa src",
+  "tar -cf /tmp/o.tar -W file=~/.ssh/id_rsa src",
+])("checks every tar value as a read: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "sensitive-path" })]),
+  });
+});
+
+it.each([
+  "tar -c -Bf AGENTS.md src",
+  "tar -c -Sf AGENTS.md src",
+  "tar -c -wf AGENTS.md src",
+  "tar -r -Bf AGENTS.md src",
+  "tar --create -Sf AGENTS.md src",
+  "tar -Bf AGENTS.md -c src",
+  "tar Bf AGENTS.md -c src",
+  "tar -cLf AGENTS.md src",
+  "tar -cvLf AGENTS.md src",
+  "tar cLf AGENTS.md src",
+  "tar -cLf ~/.codex/config.toml src",
+  "tar -c -L -f AGENTS.md src",
+  "tar -c -W file=AGENTS.md src",
+  "tar -cW file=AGENTS.md src",
+  "tar -c -Wfile=AGENTS.md src",
+  "tar -cf /tmp/o.tar -W file=AGENTS.md src",
+  "tar -cf /tmp/x.tar -T AGENTS.md",
+  "tar -c -BfAGENTS.md src",
+  "tar -cf /tmp/o.tar --unknown=file=AGENTS.md src",
+  "tar -Af AGENTS.md src",
+  "tar Af AGENTS.md src",
+  "tar --catenate -f AGENTS.md src",
+  "tar --concatenate --file=AGENTS.md src",
+  "tar -W create -f AGENTS.md src",
+  "tar -W append -f AGENTS.md src",
+  "tar -W create -W file=AGENTS.md src",
+  "tar -f AGENTS.md -W create src",
+  "tar -W create -f ~/.codex/config.toml src",
+  "tar -W catenate -f AGENTS.md x.tar",
+  "tar -W concatenate -f AGENTS.md x.tar",
+  "tar -W update -f AGENTS.md src",
+  "tar -Wcreate -f AGENTS.md src",
+])("checks every tar value in whole-command write mode: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "agent-config-write" })]),
+  });
+});
+
+it("checks BSD tar -W write mode against startup files", () => {
+  expect(bash("tar -W create -f ~/.zshrc src")).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "startup-mutation" })]),
+  });
+});
+
+it.each([
+  ["tar -c -W file=/users/test/.zshrc src", "startup-mutation"],
+  ["tar -c -W file=/users/test/.ssh/config src", "sensitive-path"],
+  ["tar -xf x.tar --directory=/users/test/.zshrc", "startup-mutation"],
+  ["tar -xf x.tar -C /users/test/.ssh/config", "sensitive-path"],
+])("applies every tar destination rule: %s", (command, rule) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule })]),
+  });
+});
+
+it.each(["tar -xf x.tar", "tar -tvf x.tar", "tar -Af /tmp/x.tar src", "tar -W verbose -xf x.tar"])(
+  "accepts ordinary tar modes: %s",
+  (command) => expect(bash(command)).toEqual({ kind: "pass" }),
+);
+
+it.each([
+  "tar -cf out.tar -T files.txt",
+  "tar -cf out.tar --files-from files.txt",
+  "tar -cf out.tar -X excl.txt src",
+  "tar -cvf out.tar -I zstd src",
+  "tar -cf out.tar -b 20 src",
+  "tar -cf out.tar -L 100 src",
+  "tar -cf /tmp/o.tar -n src",
+  "tar -cf /tmp/o.tar -l src",
+  "tar -cvf /tmp/o.tar -s /a/b/ src",
+  "tar -xf x.tar -O",
+  "tar -xOf x.tar",
+  "tar xOf x.tar",
+  "tar -xf x.tar -k",
+  "tar -xkf x.tar",
+  "tar xkf x.tar",
+  "tar -xmf x.tar",
+  "tar xmf x.tar",
+  "tar -xf x.tar -U",
+  "tar -xvf x.tar -W",
+  "tar -xf x.tar -s /a/b/",
+  "tar -cf out.tar --exclude build src",
+  "tar -cf out.tar -q src",
+  "tar -xqf x.tar",
+  "tar xqf x.tar",
+])("accepts tar options outside ambiguous write keys: %s", (command) => {
+  expect(bash(command)).toEqual({ kind: "pass" });
+});
+
+it.each([
+  "wget --execute=output_document=AGENTS.md https://example.com/x",
+  "wget --execute=output_document=/Users/test/.zshrc https://example.com/x",
+  "wget --execute=dir_prefix=/Users/test/.codex https://example.com/config.toml",
+  "wget --execute=input=urls.txt https://example.com/x",
+  "wget --config=/tmp/evil.rc https://example.com/x",
+  "wget --input-metalink=x.meta4",
+  "wget -e input=urls.txt",
+  "wget -e dir_prefix=/tmp https://example.com/x",
+  "wget -e output_document=AGENTS.md https://example.com/x",
+  "wget --execute output_document=AGENTS.md https://example.com/x",
+  "wget --config /tmp/evil.rc https://example.com/x",
+  "wget --input-metalink x.meta4",
+  "wget -eoutput_document=AGENTS.md https://example.com/x",
+])("refuses indirect wget output configuration: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "no-analyzer" })]),
+  });
+});
+
+it.each([
+  "printf x > ./AGENT?.md",
+  "printf x > ./AGENT[]S].md",
+  "printf x >> ./AGENT[]S].md",
+  "printf x > ./AGENT[S].md",
+  "echo x | tee /tmp/output > ./AGENT[]S].md",
+  "echo x | tee /tmp/output > ./AGENT?.md",
+  "cp /tmp/evil/AGENTS.md ~/repo",
+  "cp -R .claude ~/claude-backup",
+  "cp -R /tmp/evil/.codex ~/somedir",
+  "ln -s /tmp/evil/AGENTS.md /repo",
+  "cp -r /tmp/evil/.claude ~/repo",
+  "cp /tmp/evil/.mcp.json /repo",
+  "rsync /tmp/x ~/.codex/AGENTS.md",
+  "rsync -a /tmp/evil/ ~/.claude/",
+  "ditto /tmp/x ~/.codex/AGENTS.md",
+  "wget -O AGENTS.md https://example.com/x",
+  "tar -xf /tmp/x.tar -C ~/.claude",
+  "unzip /tmp/x.zip -d ~/.codex",
+  "git checkout /tmp/x -- AGENTS.md",
+  "patch AGENTS.md /tmp/x.patch",
+  "truncate -s 0 AGENTS.md",
+  "touch ~/.codex/AGENTS.md",
+  "touch AGENT?.md",
+  "touch ./AGENT[]S].md",
+  "sed --in-pl=bak -e s/a/b/ AGENTS.md",
+  "sed --in-pl AGENTS.md",
+  "sed --in-pl s/a/b/ AGENTS.md",
+  "sed --in s/a/b/ ~/.codex/AGENTS.md",
+  "sort --out=AGENTS.md /tmp/x",
+  "sort --outp=./AGENTS.md in.txt",
+  "base64 --out=AGENTS.md /tmp/x",
+  "tar --dir=~/.claude -xf /tmp/x.tar",
+  "tar --direc=~/.claude -xf /tmp/x.tar",
+  "patch --out=AGENTS.md public.txt /tmp/x.patch",
+  "wget --output-d=AGENTS.md https://example.com/x",
+  "wget --output-doc=AGENTS.md https://example.com/x",
+  "tmutil restore /Volumes/TM/x/AGENTS.md AGENTS.md",
+  "tmutil restore /Volumes/Backup/x ~/.claude/settings.json",
+  "tar -cf AGENTS.md /tmp/evil",
+  "tar --create --file=AGENTS.md /tmp/evil",
+  "tar -cv -f AGENTS.md /tmp/evil",
+  "tar --cre -f AGENTS.md /tmp/evil",
+  "wget https://example.com/AGENTS.md",
+  "wget --directory-prefix=~/.codex https://example.com/config.toml",
+  "wget -P ~/.codex https://example.com/config.toml",
+  "wget -P ~/.claude https://example.com/settings.json",
+  "tar czf ~/.claude/settings.json src",
+  "tar czf AGENTS.md src",
+  "tar -rf ~/.codex/config.toml src",
+  "tar -rf AGENTS.md x",
+  "tar -uf AGENTS.md src",
+  "tar -uf AGENTS.md x",
+  "tar --append -f AGENTS.md x",
+  "tar --append --file=AGENTS.md src",
+  "tar --app -f AGENTS.md src",
+  "tar --update -f AGENTS.md src",
+  "tar cfz AGENTS.md src",
+  "tar cpf ~/.claude/settings.json src",
+  "tar cpzf AGENTS.md src",
+  "tar caf AGENTS.md src",
+  "tar chf AGENTS.md src",
+  "tar cPf AGENTS.md src",
+  "tar -cpf AGENTS.md src",
+  "tar -caf AGENTS.md src",
+  "tar -cvpf AGENTS.md src",
+  "tar -cpzf ~/.codex/config.toml src",
+  "wget -P ~/.codex -i urls.txt",
+  "tar vczf AGENTS.md src",
+  "tar rf AGENTS.md src",
+  "tar uf AGENTS.md src",
+  "wget -a AGENTS.md https://example.com/x",
+  "wget --append-output=AGENTS.md https://example.com/x",
+  "git checkout HEAD AGENTS.md",
+  "git checkout -p HEAD ./AGENTS.md",
+])("refuses protected writes: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "agent-config-write" })]),
+  });
+});
+
+it.each([
+  "cp AGENTS.md /tmp/x.md",
+  "cp AGENTS.md ~/backup.md",
+  "printf x > ./REPORT?.md",
+  "cp -R .claude /tmp/claude-backup",
+  "cp AGENTS.md /private/tmp/backup",
+  "cp AGENTS.md /var/folders/test/backup",
+  "cp AGENTS.md /private/var/folders/test/backup",
+  'TMPDIR=/private/tmp/job; cp AGENTS.md "$TMPDIR/backup"',
+  "rsync /tmp/x /tmp/y",
+  "rsync -e ssh -a src/ host:/srv/",
+  "rsync --rsh='ssh -p 2222' -a src/ host:/srv/",
+  "ditto /tmp/x /tmp/y",
+  "wget -O /tmp/x https://example.com/x",
+  "tar -xf /tmp/x.tar -C /tmp/out",
+  "tar -cf /tmp/out.tar public.txt",
+  "tar -xf/repo/.codex/config.toml",
+  "wget https://example.com/public.txt",
+  "wget -P downloads https://example.com/x",
+  "wget -P /tmp https://example.com/x",
+  "wget -t 3 https://example.com/x",
+  "wget -t 3 https://example.com/x.zip",
+  "wget --tries 3 https://example.com/x.zip",
+  "wget -T 10 https://example.com/x.zip",
+  "wget -U agent https://example.com/x.zip",
+  "wget --limit-rate 1m https://example.com/x.zip",
+  "wget -a log.txt https://example.com/x",
+  "wget --directory-prefix downloads --timeout 10 --user-agent agent --header 'Accept: text/plain' -l 2 -q -c -N -r -np -nd -nc https://example.com/x",
+  "tar czf /tmp/out.tar src",
+  "tar -czf /tmp/x.tgz src",
+  "tar -cpf /tmp/x.tar src",
+  "wget -i urls.txt -O /tmp/out",
+  "wget --input-file=urls.txt --output-document=/tmp/out",
+  "wget -P /tmp -i urls.txt",
+  "wget --directory-prefix=/private/tmp --input-file=urls.txt",
+  "wget -P /var/folders/job -i urls.txt",
+  'TMPDIR=/private/tmp/job; wget -P "$TMPDIR" -i urls.txt',
+  "tar cfz /tmp/out.tar src",
+  "tar -rf /tmp/out.tar src",
+  "tar -uf /tmp/out.tar src",
+  "tar --append --file=/tmp/out.tar src",
+  "tar vczf /tmp/out.tar src",
+  "tar tf /tmp/out.tar",
+  "tar xf /tmp/out.tar",
+  "wget -O /tmp/x https://example.com/AGENTS.md",
+  "unzip /tmp/x.zip -d /tmp/out",
+  "git checkout main -- public.txt",
+  "git checkout main public.txt",
+  "patch public.txt /tmp/x.patch",
+  "truncate -s 0 public.txt",
+  "touch public.txt",
+  "touch .env",
+  "touch build/*.o",
+  "tmutil restore public /tmp/x",
+  "tmutil restore /Volumes/TM/a /tmp/x",
+  "tmutil restore",
+])("accepts ordinary operands: %s", (command) => {
+  expect(bash(command)).toEqual({ kind: "pass" });
+});
+
+it.each(["jq --rawf /tmp/x.txt file.txt", "jq --slurpf=/tmp/x.txt file.txt"])(
+  "keeps dangerous prefix fallback: %s",
+  (command) => {
+    expect(bash(command)).toMatchObject({
+      findings: expect.arrayContaining([expect.objectContaining({ rule: "no-analyzer" })]),
+    });
+  },
+);
+
+it("keeps restore startup writes blocked", () => {
+  expect(bash("tmutil restore /Volumes/Backup/x ~/.zshrc")).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "startup-mutation" })]),
+  });
+});
+
+it.each([
+  "wget -i urls.txt",
+  "wget --input-file urls.txt",
+  "wget --input-file=urls.txt",
+  "wget -i -",
+  "wget -B https://example.com/ -i urls.txt",
+  "wget -P /tmp/../repo -i urls.txt",
+  "tar -cqf AGENTS.md src",
+  "tar cqf AGENTS.md src",
+])("refuses unknown output paths: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "no-analyzer" })]),
+  });
+});
+
+it.each([
+  "wget -P ~ https://example.com/.zshrc",
+  "wget -P ~ https://example.com/.profile",
+  "wget -P ~ https://example.com/.bashrc",
+  "wget -O ~/.zshrc https://example.com/x",
+])("refuses wget startup writes: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "startup-mutation" })]),
+  });
+});
+
+it.each([
+  "wget -P ~ https://example.com/.npmrc",
+  "wget -P ~/.ssh https://example.com/config",
+  "wget -P ~ https://example.com/.envrc",
+])("refuses wget sensitive destinations: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "sensitive-path" })]),
+  });
+});
+
+it.each([
+  "rsync -e 'ssh -F ~/.ssh/config' src/ host:/srv/",
+  "rsync -e 'cat ~/.ssh/id_rsa' src/ host:/srv/",
+])("inspects remote shell arguments: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "sensitive-path" })]),
+  });
+});
+
+it.each(["tmutil restore ~/.ssh/id_rsa /tmp/x", "tmutil restore /tmp/x ~/.aws/credentials"])(
+  "keeps sensitive restore refusal: %s",
+  (command) => {
+    expect(bash(command)).toMatchObject({
+      findings: expect.arrayContaining([expect.objectContaining({ rule: "sensitive-path" })]),
+    });
+  },
+);

package/src/credential-guard/engine.test.ts

@@ -207,6 +207,86 @@ describe("agent configuration boundaries", () => {
           ]),
         });
   });
+  it.each([
+    "--remote unix:// --sandbox read-only",
+    "--sandbox read-only --remote unix://",
+    "--remote=unix:// --sandbox=read-only",
+    "--remote unix:// -s read-only",
+    "-sread-only --remote=unix://",
+    "-s=read-only --remote unix://",
+    "--remote unix:// -s read-only -m example -c model_reasoning_effort=low 'Read the brief'",
+  ])("allows local read-only remote launch %s", (args) => {
+    for (const prefix of ["", "rtk proxy "])
+      expect(
+        bash(`${prefix}herdr agent start worker --kind codex --pane w1:p2 -- ${args}`).kind,
+      ).toBe("pass");
+  });
+  it.each([
+    "--remote unix://",
+    "--remote",
+    "--remote unix:// --sandbox",
+    "--remote unix:// --sandbox workspace-write",
+    "--sandbox workspace-write --remote unix://",
+    "--remote unix:// -sworkspace-write",
+    "--remote unix:// --sandbox read-only -s read-only",
+    "--remote unix:// --sandbox read-only -s workspace-write",
+    "--remote unix:// --remote unix:// --sandbox read-only",
+    "--remote unix:// --remote=wss://example --sandbox read-only",
+    "--remote unix:// --sandbox read-only --add-dir /repo",
+    "--add-dir=/repo --sandbox read-only --remote unix://",
+    "--remote unix:// --sandbox read-only --yolo",
+    "--remote unix:// --sandbox read-only --dangerously-bypass-approvals-and-sandbox",
+    "--remote unix:// --sandbox read-only --dangerously-skip-permissions",
+    "--remote unix:// --sandbox read-only -c sandbox_mode=read-only",
+    "--remote unix:// --sandbox read-only -c approval_policy=never",
+    "--remote unix:// --sandbox read-only -c shell_environment_policy.inherit=all",
+    "--remote unix:// --sandbox read-only -c shell_environment_policy.exclude=[]",
+    "--remote unix:// --sandbox read-only --unknown-option value",
+  ])("refuses remote launch override %s even before a trailing prompt", (args) => {
+    for (const prompt of ["", " 'Read the brief'"])
+      expect(
+        bash(`rtk proxy herdr agent start worker --kind codex --pane w1:p2 -- ${args}${prompt}`),
+      ).toMatchObject({
+        findings: expect.arrayContaining([
+          expect.objectContaining({ rule: "agent-launch-override" }),
+        ]),
+      });
+  });
+  it.each([
+    "ws://localhost",
+    "wss://localhost",
+    "tcp://localhost:9000",
+    "/users/test/.codex/server.sock",
+    "unix:///users/test/.codex/server.sock",
+    "/users/test/.codex-other/server.sock",
+    "/users/test/.codex/../server.sock",
+    ".codex/server.sock",
+    "../.codex/server.sock",
+    "unix://relative.sock",
+    "unix:///tmp/server.sock",
+    "unix:///",
+  ])("refuses unproved remote endpoint %s", (endpoint) => {
+    expect(
+      bash(
+        `herdr agent start worker --kind codex --pane w1:p2 -- --sandbox read-only --remote ${endpoint}`,
+      ),
+    ).toMatchObject({
+      findings: expect.arrayContaining([
+        expect.objectContaining({ rule: "agent-launch-override" }),
+      ]),
+    });
+  });
+  it("keeps remote launch support exclusive to Codex", () => {
+    expect(
+      bash(
+        "herdr agent start worker --kind claude --pane w1:p2 -- --remote unix:// --sandbox read-only",
+      ),
+    ).toMatchObject({
+      findings: expect.arrayContaining([
+        expect.objectContaining({ rule: "agent-launch-override" }),
+      ]),
+    });
+  });
   it.each([
     "herdr tab create -- codex -c shell_environment_policy.inherit=all",
     "herdr pane split w1:p2 -- codex -c shell_environment_policy.inherit=all",

package/src/credential-guard/policy.ts

@@ -96,6 +96,41 @@ const glob = (text: string): Value => ({ ...opaque(text), globPatterns: [text] }
 function mentions(value: Value): readonly string[] {
   return value.kind === "literal" ? value.texts : value.kind === "opaque" ? value.mentions : [];
 }
+function agentConfigGlob(value: Value): boolean {
+  return mentions(value).some((text) =>
+    text
+      .replace(/\\/g, "/")
+      .split("/")
+      .some((part) => {
+        if (!/[*?[]/.test(part)) return false;
+        if (part.replace(/\[[A-Za-z0-9._]\]/g, "").includes("[")) return true;
+        const pattern = new RegExp(
+          `^${part
+            .replace(/[.+^${}()|\\]/g, "\\$&")
+            .replace(/\[([A-Za-z0-9_]|\\\.)\]/g, "$1")
+            .replace(/\*/g, ".*")
+            .replace(/\?/g, ".")}$`,
+          "i",
+        );
+        return [
+          "AGENTS.md",
+          "CLAUDE.md",
+          ".mcp.json",
+          ".claude",
+          ".claude.json",
+          ".codex",
+          ".agents",
+          "config.toml",
+          "settings.json",
+          "settings.local.json",
+          "commands",
+          "agents",
+          "skills",
+          "hooks",
+        ].some((name) => pattern.test(name));
+      }),
+  );
+}
 function join(a: Value, b: Value): Value {
   const texts = [...new Set([...mentions(a), ...mentions(b)])];
   return a.kind === "literal" && b.kind === "literal" && texts.length <= MAX_VALUE_ALTERNATIVES
@@ -251,7 +286,7 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
     path.startsWith(`${home}/.agents/skills/`);
   const agentConfigPath = (path: string): boolean =>
     agentConfigDirectory(path) ||
-    /(?:^|\/)(?:agents\.md|claude\.md|\.mcp\.json|\.claude)$/.test(path) ||
+    /(?:^|\/)(?:agents\.md|claude\.md|\.mcp\.json|\.claude)\/?$/.test(path) ||
     /(?:^|\/)\.claude\/settings[^/]*\.json$/.test(path) ||
     path === `${home}/.agents` ||
     path === `${home}/.codex/config.toml` ||
@@ -527,7 +562,7 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
         stdin = target.kind === "stream" ? target.stdout : { ...opaque(...paths), supplied: true };
       }
       if (redirect.op !== "<") {
-        if (current.dialect === "bash" && paths.some(agentConfigPath))
+        if (current.dialect === "bash" && (paths.some(agentConfigPath) || agentConfigGlob(target)))
           emit("agent-config-write", "write to agent instructions or configuration", span, true);
         outputs.push(
           ...paths.map((path) => ({
@@ -759,6 +794,24 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
           ? literal(operand.literal)
           : (values[operand.index] ?? opaque());
       const role = operand.role;
+      if (role === "write-name") {
+        if (
+          (value.kind !== "literal" && !(value.kind === "opaque" && value.globPatterns)) ||
+          invocationScope.cwd.kind !== "literal"
+        )
+          emit("opaque-path", "write target is not a known name or glob", span, true);
+        if (
+          scope.dialect === "bash" &&
+          (agentConfigGlob(value) ||
+            mentions(value).some((text) =>
+              mentions(invocationScope.cwd).some((cwd) =>
+                agentConfigPath(normalizePath(text, context.home, cwd)),
+              ),
+            ))
+        )
+          emit("agent-config-write", "write to agent instructions or configuration", span, true);
+        continue;
+      }
       if (typeof role !== "string") {
         const analyzedOutput = analyze(
           role.code,
@@ -841,39 +894,7 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
           scope.dialect === "bash" &&
           (role === "write" ||
             plan.directoryWrites.some((write) => write.sources.includes(operand.index))) &&
-          mentions(value).some((text) =>
-            text
-              .replace(/\\/g, "/")
-              .split("/")
-              .some((part) => {
-                if (!/[*?[]/.test(part)) return false;
-                if (part.replace(/\[[A-Za-z0-9._]\]/g, "").includes("[")) return true;
-                const pattern = new RegExp(
-                  `^${part
-                    .replace(/[.+^${}()|\\]/g, "\\$&")
-                    .replace(/\[([A-Za-z0-9_]|\\\.)\]/g, "$1")
-                    .replace(/\*/g, ".*")
-                    .replace(/\?/g, ".")}$`,
-                  "i",
-                );
-                return [
-                  "AGENTS.md",
-                  "CLAUDE.md",
-                  ".mcp.json",
-                  ".claude",
-                  ".claude.json",
-                  ".codex",
-                  ".agents",
-                  "config.toml",
-                  "settings.json",
-                  "settings.local.json",
-                  "commands",
-                  "agents",
-                  "skills",
-                  "hooks",
-                ].some((name) => pattern.test(name));
-              }),
-          )
+          agentConfigGlob(value)
         )
           emit(
             "agent-config-write",
@@ -954,6 +975,8 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
                   );
                   const directory =
                     destination.directory ||
+                    (!/^\/(?:tmp|private\/tmp|(?:private\/)?var\/folders)(?:\/|$)/.test(path) &&
+                      mentions(value).some((text) => !/\.[^./]+$/.test(text))) ||
                     path === normalizePath(context.home, context.home, context.cwd) ||
                     agentConfigDirectory(path) ||
                     mentions(value).some((text) => /(?:\/|^\.\.?|\/\.\.?)$/.test(text));
@@ -961,7 +984,10 @@ export function judge(script: Script | ParseError, context: PolicyContext): Deci
                   if (directory || plan.copyDestination) targets.push(target);
                 }
           if (
-            plan.copyDestination &&
+            (plan.copyDestination ||
+              executableName(first.texts[0] ?? "") === "wget" ||
+              executableName(first.texts[0] ?? "") === "tar" ||
+              (executableName(first.texts[0] ?? "") === "tmutil" && argv[1] === "restore")) &&
             targets.some((target) =>
               /(?:^|\/)(?:\.?(?:bashrc|bash_profile|profile|zshrc|zshenv|zprofile)|config\.fish)$/.test(
                 target,

package/src/credential-guard/registry.ts

@@ -18,6 +18,7 @@ export type OperandRole =
   | "member"
   | "rg-type"
   | "write"
+  | "write-name"
   | { readonly code: Language };
 export type Issue = {
   readonly kind: "violation" | "missing-knowledge";
@@ -40,6 +41,7 @@ export type Option = {
 };
 export type ExecutableEntry = {
   readonly name: string;
+  readonly rejectsAbbreviations?: boolean;
   readonly readsContent?: boolean;
   readonly readsStdinCode?: boolean;
   readonly builtinOnly?: boolean;
@@ -1431,6 +1433,7 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
   },
   {
     name: "jq",
+    rejectsAbbreviations: true,
     readsContent: true,
     startupFiles: [/(?:^|\/)\.jq$/],
     operands: [code("jq"), path],
@@ -1957,8 +1960,7 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
           name,
           {
             operands: [path],
-            effect:
-              name === "restore" ? unknown("unmodeled Time Machine restore operation") : "none",
+            effect: "none",
           } satisfies Omit<ExecutableEntry, "name">,
         ]),
       ),
@@ -3091,6 +3093,137 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
       ),
     },
   },
+  {
+    name: "rsync",
+    operands: [path],
+    options: {
+      ...flags("-a", "-r", "-v", "-z", "--archive", "--recursive", "--delete"),
+      "-e": arg(code("bash")),
+      "--rsh": arg(code("bash")),
+    },
+  },
+  { name: "ditto", operands: [path], options: flags("-V", "-v", "--rsrc", "--norsrc") },
+  {
+    name: "tar",
+    operands: [path],
+    options: {
+      ...flags(
+        "-x",
+        "--extract",
+        "-c",
+        "--create",
+        "-r",
+        "--append",
+        "-u",
+        "--update",
+        "-A",
+        "--catenate",
+        "--concatenate",
+        "-t",
+        "--list",
+        "-v",
+        "-z",
+        "-j",
+        "-J",
+        "-p",
+        "-a",
+        "-h",
+        "-P",
+        "-O",
+        "--to-stdout",
+        "-k",
+        "-m",
+        "-U",
+        "-W",
+        "-n",
+        "-l",
+      ),
+      "-f": arg(path),
+      "--file": arg(path),
+      "-T": arg(path),
+      "--files-from": arg(path),
+      "-X": arg(path),
+      "--exclude-from": arg(path),
+      "--exclude": arg(data),
+      "-b": arg(data),
+      "-L": arg(data),
+      "-I": arg(data),
+      "-s": arg(data),
+      "-C": arg("write"),
+      "--directory": arg("write"),
+    },
+  },
+  {
+    name: "unzip",
+    operands: [path],
+    options: { ...flags("-q", "-o", "-n", "-l", "-t", "-v"), "-d": arg("write") },
+  },
+  {
+    name: "patch",
+    operands: ["write", path],
+    options: {
+      "-i": arg(path),
+      "--input": arg(path),
+      "-o": arg("write"),
+      "--output": arg("write"),
+      "-d": arg("write"),
+      "--directory": arg("write"),
+      "-p": arg(data),
+      ...flags("-s", "-f", "-R", "--dry-run"),
+    },
+  },
+  {
+    name: "truncate",
+    operands: ["write"],
+    options: {
+      "-s": arg(data),
+      "--size": arg(data),
+      "-r": arg(path),
+      "--reference": arg(path),
+      ...flags("-c", "--no-create"),
+    },
+  },
+  {
+    name: "touch",
+    operands: ["write-name"],
+    options: {
+      "-t": arg(data),
+      "-d": arg(data),
+      "-r": arg(path),
+      ...flags("-a", "-m", "-c", "-h", "--no-create"),
+    },
+  },
+  {
+    name: "wget",
+    operands: [data],
+    options: {
+      "-O": arg("write"),
+      "--output-document": arg("write"),
+      "-o": arg("write"),
+      "--output-file": arg("write"),
+      "-a": arg("write"),
+      "--append-output": arg("write"),
+      "-P": arg("write"),
+      "--directory-prefix": arg("write"),
+      "-t": arg(data),
+      "--tries": arg(data),
+      "-T": arg(data),
+      "--timeout": arg(data),
+      "-U": arg(data),
+      "--user-agent": arg(data),
+      "--header": arg(data),
+      "--limit-rate": arg(data),
+      "-l": arg(data),
+      "--level": arg(data),
+      "-i": arg(path),
+      "--input-file": arg(path),
+      "-e": { roles: [data], issue: unknown("wget output configuration") },
+      "--execute": { roles: [data], issue: unknown("wget output configuration") },
+      "--config": { roles: [path], issue: unknown("wget output configuration") },
+      "--input-metalink": { roles: [path], issue: unknown("wget output configuration") },
+      ...flags("-q", "-c", "-nv", "-N", "-r", "-np", "-nd", "-nc"),
+    },
+  },
   { name: "seq", operands: [data], semantics: "seq" },
   { name: "tr", operands: [data], stdout: "opaque", options: flags("-c", "-C", "-d", "-s", "-t") },
   {
@@ -3116,7 +3249,7 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
   },
   {
     name: "rm",
-    aliases: ["touch", "du", "stat", "chown", "df"],
+    aliases: ["du", "stat", "chown", "df"],
     options: {
       ...flags("-f", "-r", "-R", "-v", "-n", "-i", "-p", "-a", "-m", "-c", "-h", "-s"),
       "-t": arg(data),
@@ -3521,6 +3654,9 @@ function classifyInvocation(
   let codePositionals: number[] = [];
   const directoryWrites: Array<InvocationPlan["directoryWrites"][number]> = [];
   const writerCandidates: { index: number; literal: string }[] = [];
+  let wgetOutputDocument = false;
+  let wgetInputFile = false;
+  let wgetDirectoryPrefix: string | undefined = ".";
   let inPlaceBackupSuffix: string | null = null;
   let sedEmptySuffix = false;
   let maxArgs: number | null = null;
@@ -4065,6 +4201,31 @@ function classifyInvocation(
     }
     return result();
   }
+  const writesArchive =
+    entry.name === "tar" &&
+    argv.slice(1).some((word, index) => {
+      if (word === undefined) return false;
+      const longOption =
+        word === "-W"
+          ? argv[index + 2]?.split("=", 1)[0]
+          : word.startsWith("-W")
+            ? word.slice(2).split("=", 1)[0]
+            : undefined;
+      if (
+        longOption &&
+        ["create", "append", "update", "catenate", "concatenate"].some((option) =>
+          option.startsWith(longOption),
+        )
+      )
+        return true;
+      if (word.startsWith("--"))
+        return ["--create", "--append", "--update", "--catenate", "--concatenate"].some(
+          (option) => word.length > 2 && option.startsWith(word.split("=")[0] ?? word),
+        );
+      const cluster =
+        /^-([A-Za-z]+)/.exec(word)?.[1] ?? (index === 0 && /^[A-Za-z]+$/.test(word) ? word : "");
+      return /[cruA]/.test(cluster);
+    });
   while (position < argv.length) {
     if (skippedValues.has(position)) {
       position++;
@@ -4147,6 +4308,25 @@ function classifyInvocation(
             ...mode.options,
           }
         : { ...entry.options, ...mode.options };
+    if (
+      entry.name === "tar" &&
+      position === 1 &&
+      !endOptions &&
+      /^[A-Za-z]+$/.test(a) &&
+      [...a].some((letter) => "cxtru".includes(letter))
+    ) {
+      for (const letter of a) {
+        if (!options[`-${letter}`] && writesArchive && a.includes("f"))
+          issues.push(unknown(`unclassified tar option -${letter}`));
+        for (const role of options[`-${letter}`]?.roles ?? []) {
+          const index = ++position;
+          if (index >= argv.length) issues.push(unknown(`missing -${letter} argument`));
+          optionRoles.push({ index, role });
+        }
+      }
+      position++;
+      continue;
+    }
     if (entry.semantics === "sed" && !endOptions && /^-[^-]/.test(a)) {
       const inPlaceIndex = a.indexOf("i", 1);
       if (
@@ -4180,7 +4360,9 @@ function classifyInvocation(
     if (!endOptions && !(optionName in options) && /^-[^-].+/.test(a)) {
       let offset = 1;
       const directoryWriter =
-        entry.semantics === "copy" || ["mv", "install", "ln"].includes(entry.name);
+        entry.semantics === "copy" ||
+        ["mv", "install", "ln"].includes(entry.name) ||
+        (entry.name === "tar" && writesArchive && a.includes("f"));
       while (offset < a.length) {
         const option = options[`-${a[offset]}`];
         if (
@@ -4232,7 +4414,7 @@ function classifyInvocation(
       : [];
     const option =
       options[optionName] ??
-      (longOptions.length === 1 ? longOptions[0]?.[1] : undefined) ??
+      (!entry.rejectsAbbreviations && longOptions.length === 1 ? longOptions[0]?.[1] : undefined) ??
       longOptions.find(
         ([, candidate]) =>
           candidate.issue || candidate.roles.some((role) => typeof role !== "string"),
@@ -4242,6 +4424,8 @@ function classifyInvocation(
             ([key]) => key.toLowerCase() === optionName.toLowerCase(),
           )?.[1]
         : undefined);
+    if (option && !entry.rejectsAbbreviations && longOptions.length === 1 && !options[optionName])
+      optionName = longOptions[0]?.[0] ?? optionName;
     if (
       !endOptions &&
       optionName.startsWith("--") &&
@@ -4265,6 +4449,10 @@ function classifyInvocation(
         issues.push(unknown("git config override"));
     }
     if (!endOptions && option && a.startsWith("-")) {
+      if (entry.name === "wget" && ["-O", "--output-document"].includes(optionName))
+        wgetOutputDocument = true;
+      if (entry.name === "wget" && ["-i", "--input-file"].includes(optionName))
+        wgetInputFile = true;
       if (
         entry.name === "bun" &&
         ["--filter", "--cwd"].includes(optionName) &&
@@ -4287,6 +4475,8 @@ function classifyInvocation(
       for (let i = 0; i < option.roles.length; i++) {
         const role = option.roles[i] ?? data;
         const index = i === 0 && attached !== undefined ? position : ++position;
+        if (entry.name === "wget" && ["-P", "--directory-prefix"].includes(optionName))
+          wgetDirectoryPrefix = attached ?? argv[index];
         if (
           index >= argv.length &&
           !(
@@ -4310,7 +4500,13 @@ function classifyInvocation(
         optionRoles.push({
           index,
           role,
-          ...(i === 0 && attached !== undefined ? { literal: attached } : {}),
+          ...(entry.name === "rsync" &&
+          typeof role !== "string" &&
+          (attached ?? argv[index]) !== undefined
+            ? { literal: `${attached ?? argv[index]} guard.invalid` }
+            : i === 0 && attached !== undefined
+              ? { literal: attached }
+              : {}),
         });
         if (entry.semantics === "python" && optionName === "-m") {
           pythonModule = { index, name: attached ?? argv[index] };
@@ -4614,7 +4810,7 @@ function classifyInvocation(
   }
   if (inPlaceBackupSuffix !== null) {
     for (const operand of roles) if (operand.role === "path") operand.role = "write";
-    if (sedEmptySuffix && !filterOption && positional[0] !== undefined)
+    if ((sedEmptySuffix || positional.length === 1) && !filterOption && positional[0] !== undefined)
       roles.push({ index: positional[0], role: "write" });
   }
   if (entry.name === "install") {
@@ -4630,7 +4826,74 @@ function classifyInvocation(
       if (operand.role === "write")
         directoryWrites.push({ index: operand.index, sources: candidates, directory: true });
   }
-  if (entry.semantics === "copy" || ["mv", "ln"].includes(entry.name)) {
+  if (entry.name === "git" && mode === entry.subcommands?.checkout) {
+    const separator = argv.indexOf("--");
+    for (const operand of roles)
+      if (separator >= 0 ? operand.index > separator : positional.slice(1).includes(operand.index))
+        operand.role = "write";
+  }
+  if (entry.name === "tar") {
+    const candidates = optionRoles.map(({ index, literal }) => ({ index, literal }));
+    for (let index = 1; index < argv.length; index++) {
+      const word = argv[index];
+      if (word === undefined || !/^--?[A-Za-z0-9-]+$/.test(word)) {
+        candidates.push({ index, literal: word });
+        if (word?.startsWith("-") && !word.startsWith("--")) {
+          for (
+            let offset = 2;
+            offset < word.length && /[A-Za-z]/.test(word[offset - 1] ?? "");
+            offset++
+          )
+            candidates.push({ index, literal: word.slice(offset) });
+          candidates.push({ index, literal: word.slice(1) });
+        }
+      }
+    }
+    for (const candidate of candidates) {
+      roles.push({ ...candidate, role: path });
+      if (writesArchive) roles.push({ ...candidate, role: "write" });
+      const word = candidate.literal ?? argv[candidate.index];
+      if (word !== undefined) {
+        for (let equal = word.indexOf("="); equal >= 0; equal = word.indexOf("=", equal + 1)) {
+          const value = { index: candidate.index, literal: word.slice(equal + 1) };
+          roles.push({ ...value, role: path });
+          if (writesArchive) roles.push({ ...value, role: "write" });
+        }
+      }
+    }
+  }
+  if (entry.name === "wget" && !wgetOutputDocument) {
+    if (
+      wgetInputFile &&
+      (wgetDirectoryPrefix === undefined ||
+        !/^\/(?:tmp|private\/tmp|(?:private\/)?var\/folders)(?:\/|$)/.test(wgetDirectoryPrefix) ||
+        wgetDirectoryPrefix.split("/").includes(".."))
+    )
+      issues.push(unknown("wget input file output names are not known"));
+    for (const index of positional) {
+      const url = argv[index];
+      if (url === undefined || wgetDirectoryPrefix === undefined)
+        issues.push(unknown("wget output name is not known"));
+      else {
+        try {
+          const basename = new URL(url).pathname.split("/").at(-1);
+          if (basename)
+            roles.push({
+              index,
+              role: "write",
+              literal: `${wgetDirectoryPrefix}/${decodeURIComponent(basename)}`,
+            });
+        } catch {
+          issues.push(unknown("wget output name is not known"));
+        }
+      }
+    }
+  }
+  if (
+    entry.semantics === "copy" ||
+    ["mv", "ln", "rsync", "ditto"].includes(entry.name) ||
+    (entry.name === "tmutil" && mode === entry.subcommands?.restore)
+  ) {
     const targetDirectory = optionRoles.find((operand) => operand.role === "write");
     const destination = targetDirectory?.index ?? positional.at(-1);
     if (destination !== undefined) {
@@ -4693,13 +4956,16 @@ function classifyInvocation(
     const command = argv[commandIndex];
     const action = argv[commandIndex + 1];
     const checkAgentArguments = (kind: string | undefined, start: number): void => {
+      const launchOptions = new Map<string, (string | undefined)[]>();
       for (let index = start; index < argv.length; index++) {
         const argument = argv[index] ?? "";
         if (index === argv.length - 1 && argv[index] !== undefined && !argument.startsWith("-"))
-          return;
+          break;
         const attached = /^(--[^=]+)=(.*)$/.exec(argument) ?? /^(-[mcCs])=?(.+)$/.exec(argument);
         const option = attached?.[1] ?? argument;
         const value = attached ? attached[2] : argv[++index];
+        const key = option === "-s" ? "--sandbox" : option;
+        launchOptions.set(key, [...(launchOptions.get(key) ?? []), value]);
         const configuration =
           value !== undefined &&
           (/^model_reasoning_effort=(?:minimal|low|medium|high|xhigh|max)$/.test(value) ||
@@ -4715,6 +4981,7 @@ function classifyInvocation(
             ["codex", "claude"].includes(kind ?? "")) ||
             (kind === "codex" &&
               (["-m", "--cd", "-C"].includes(option) ||
+                (option === "--remote" && value === "unix://") ||
                 (["--sandbox", "-s"].includes(option) &&
                   ["workspace-write", "read-only"].includes(value)) ||
                 (option === "-c" && configuration))));
@@ -4727,6 +4994,18 @@ function classifyInvocation(
           return;
         }
       }
+      if (
+        launchOptions.has("--remote") &&
+        (launchOptions.get("--remote")?.length !== 1 ||
+          launchOptions.get("--sandbox")?.length !== 1 ||
+          launchOptions.get("--sandbox")?.[0] !== "read-only" ||
+          launchOptions.has("--add-dir"))
+      )
+        issues.push({
+          kind: "missing-knowledge",
+          rule: "agent-launch-override",
+          detail: "remote agents require one local endpoint and one read-only sandbox",
+        });
     };
     if (command === "agent" && action === "start" && separator >= 0) {
       let kind: string | undefined;