@deftai/directive-core 0.103.0 → 0.105.0

package/dist/authz/classify.js

@@ -245,10 +245,67 @@ const DOWNLOADER_DECODER_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual after #3336: nc/7zz/msgfmt peers + plant writers.
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
+    // #3382 residual after #3354: dest forms that are not generic -o/--output/--outfile.
+    "cmake",
+    "script",
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    "svn",
+    "fossil",
+    "bzr",
+    "cvs",
+    "darcs",
+    "ed",
+    "nvim",
+    "nano",
+    "vim",
+    "vi",
+    // #3421 residual after #3382: dest forms the harvest missed.
+    "git",
+    "ex",
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "aws",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    "new-item",
+    // #3459 residual after #3421: GNU g* peers, forge clone, iwr, fsutil.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
+    "gh",
+    "glab",
+    "hub",
 ]);
 /**
  * Archive extractors / alt writers that can plant via pathish operands without
- * shell redirects (#3245 / #3288 / #3311 / #3336). Used for pathish authz/kill scans (prefer deny)
+ * shell redirects (#3245 / #3288 / #3311 / #3336 / #3354 / #3382). Used for pathish authz/kill scans (prefer deny)
  * and write-shape residual under UAT — not bare curl-class URL fetches.
  */
 const ARCHIVE_ALT_WRITE_BINS = new Set([
@@ -304,9 +361,47 @@ const ARCHIVE_ALT_WRITE_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual after #3336.
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
+    // #3382 residual: dedicated dest-form writers (not general-purpose cmake/git/editors).
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    // #3421 residual: dedicated dest-form writers (not general-purpose git/aws/editors).
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    // #3459 residual: dest writers that are not general-purpose gh/cmd.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
 ]);
 /**
- * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336).
+ * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336 / #3354 / #3382).
  * Prefer a Set over a long `||` chain so coverage counts one membership check, not N branches.
  */
 const PROTECTED_POSITIONAL_BINS = new Set([
@@ -352,17 +447,215 @@ const PROTECTED_POSITIONAL_BINS = new Set([
     "dpkg-deb",
     "hg",
     "msguniq",
+    // #3354 residual: positional dest writers (nc/7zz/unrar/ftpget/crane/objcopy/sqlite3).
+    "nc",
+    "netcat",
+    "7zz",
+    "msgfmt",
+    "msgcat",
+    "lz4",
+    "lzop",
+    "unrar",
+    "rar",
+    "aunpack",
+    "atool",
+    "ftpget",
+    "tftp",
+    "sqlite3",
+    "crane",
+    "objcopy",
+    // #3382 residual: positional dest writers (cmake copy / script / VCS / editors).
+    "cmake",
+    "script",
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    "svn",
+    "fossil",
+    "bzr",
+    "cvs",
+    "darcs",
+    "ed",
+    "nvim",
+    "nano",
+    "vim",
+    "vi",
+    // #3421 residual: positional dest writers (aws, convert, New-Item).
+    // git clone/worktree/submodule dests are harvested only on those write subcommands.
+    "ex",
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "aws",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    "new-item",
+    // #3459 residual: positional dest writers (fsutil createnew, iwr dest flags).
+    // gh/glab/hub clone dests are harvested only on the clone subcommand.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
 ]);
+/**
+ * Bins whose dest is the last pathish operand (src … dest). A protected
+ * source that writes elsewhere is not a dest plant (#3421 residual).
+ */
+const LAST_POSITIONAL_DEST_BINS = new Set(["aws", "convert", "magick"]);
+/** Wrappers / assignments before the dest-owning bin (`env aws`, `FOO=1 convert`). */
+const COMMAND_WRAPPER_BINS = new Set([
+    "env",
+    "command",
+    "nice",
+    "nohup",
+    "sudo",
+    "doas",
+    "time",
+    "stdbuf",
+    "timeout",
+    "ionice",
+]);
+function isWrapperOrAssignmentToken(raw, n) {
+    if (COMMAND_WRAPPER_BINS.has(writeBinName(raw)))
+        return true;
+    return n.includes("=") && !n.startsWith("-") && !raw.includes("/") && !raw.includes("\\");
+}
+/** Wrapper flags that take a separate value (`env -C DIR`, `nice -n N`). */
+const WRAPPER_VALUE_FLAGS = new Set([
+    "-c",
+    "--chdir",
+    "-u",
+    "--unset",
+    "-n",
+    "--adjustment",
+    "-o",
+    "--output",
+    "-i",
+    "--input",
+    "-e",
+    "--error",
+    "-s",
+    "--signal",
+    "-k",
+    "--kill-after",
+]);
+/** In-place ImageMagick writer: every protected operand is a dest, not last-only. */
+const MAGICK_FAMILY_BINS = new Set(["convert", "magick", "mogrify"]);
+const MAGICK_WRITE_DEST_FLAGS = new Set(["-write"]);
+/** True when this token is a subcommand of a last-positional dest bin (`aws s3 cp`). */
+function tokenEndsShellSegment(token) {
+    return isShellSegmentBreak(token) || firstUnquotedShellOpIndex(token) >= 0;
+}
+function segmentStartedByLastPositionalDest(tokens, tokenIndex) {
+    let start = tokenIndex;
+    while (start > 0 && !tokenEndsShellSegment(tokens[start - 1]))
+        start--;
+    let skipNext = false;
+    let afterWrapper = false;
+    for (let k = start; k < tokenIndex; k++) {
+        const raw = tokens[k];
+        if (isShellSegmentBreak(raw))
+            continue;
+        const n = normalizeToken(raw);
+        const bare = binBareName(raw);
+        if (skipNext) {
+            skipNext = false;
+            if (LAST_POSITIONAL_DEST_BINS.has(bare))
+                return true;
+            continue;
+        }
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && WRAPPER_VALUE_FLAGS.has(n))
+                skipNext = true;
+            continue;
+        }
+        if (isWrapperOrAssignmentToken(raw, n)) {
+            afterWrapper = COMMAND_WRAPPER_BINS.has(bare);
+            continue;
+        }
+        if (LAST_POSITIONAL_DEST_BINS.has(bare))
+            return true;
+        // timeout 5 aws / similar: skip one non-bin operand after a wrapper.
+        if (afterWrapper) {
+            afterWrapper = false;
+            continue;
+        }
+        return false;
+    }
+    return false;
+}
 /** wget family (directory-prefix dest flags). */
 const WGET_FAMILY_BINS = new Set(["wget", "wget2"]);
 /** aria2 family (dir dest flags). */
 const ARIA2_FAMILY_BINS = new Set(["aria2c", "aria2"]);
-/** 7z family (attached -oDIR only). */
-const SEVEN_Z_FAMILY_BINS = new Set(["7z", "7za", "7zr"]);
+/** 7z family (attached -oDIR only). Includes 7zz (#3354). */
+const SEVEN_Z_FAMILY_BINS = new Set(["7z", "7za", "7zr", "7zz"]);
+/** aunpack / atool extract-to dest flags (#3354). */
+const ATOOL_FAMILY_BINS = new Set(["aunpack", "atool"]);
+const ATOOL_DIR_DEST_FLAGS = new Set(["-x", "--extract-to"]);
+/** sqlite3 meta-commands that plant a file dest (#3354). */
+const SQLITE3_OUTPUT_META = [".output", ".once"];
 /** tar family (chdir -C / --directory). Includes GNU/Schily aliases (#3311). */
 const TAR_FAMILY_BINS = new Set(["tar", "bsdtar", "gtar", "star", "gnutar"]);
 /** xh / httpie family (download-dir dest flags) (#3311). */
 const XH_FAMILY_BINS = new Set(["xh", "httpie"]);
+/** gallery-dl dest-dir flags (#3382). */
+const GALLERY_DL_FAMILY_BINS = new Set(["gallery-dl", "gallery_dl"]);
+const GALLERY_DL_DIR_DEST_FLAGS = new Set(["-d", "--destination", "--dest"]);
+/** megadl dest-path flags (#3382). */
+const MEGADL_FAMILY_BINS = new Set(["megadl"]);
+const MEGADL_PATH_DEST_FLAGS = new Set(["--path"]);
+/**
+ * Extra dest flags harvested on unknown write-shaped bins when dest is protected (#3382 / #3421).
+ * Not merged into DOWNLOADER_FILE_DEST_FLAGS: curl `-d` is POST data, not a file dest.
+ */
+const GENERIC_PROTECTED_EXTRA_DEST_FLAGS = new Set([
+    "-d",
+    "--dir",
+    "--destination",
+    "--dest",
+    "--path",
+    "--directory",
+    "--workdir",
+    "--file",
+    "--separate-git-dir",
+    "--pack-destination",
+]);
+/** Bins whose `--file` / `-f` operand is an input, not a dest plant. */
+const READ_SHAPED_FILE_FLAG_BINS = new Set([
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "ag",
+    "ack",
+    "get-content",
+    "gc",
+    "cat",
+    "type",
+    "less",
+    "more",
+    "head",
+    "tail",
+]);
+const READ_INPUT_FILE_FLAGS = new Set(["--file", "-f"]);
+/** PowerShell New-Item dest flags (not generic: Get-Content -Path is a read). */
+const NEW_ITEM_PATH_DEST_FLAGS = new Set(["-path", "-literalpath", "--literalpath"]);
+/** git subcommands whose positionals can plant a dest (#3421). */
+const GIT_WRITE_SUBCOMMANDS = new Set(["clone", "worktree", "submodule"]);
+/** Forge CLIs whose `clone` dest is harvested like git clone (#3459). */
+const FORGE_CLONE_BINS = new Set(["gh", "glab", "hub"]);
+/** fossil dest-dir flags (#3382 PATH form + #3421 --workdir=). */
+const FOSSIL_WORKDIR_DEST_FLAGS = new Set(["--workdir"]);
+/** pg_dump family dest-file flags (#3421). */
+const PG_DUMP_FAMILY_BINS = new Set(["pg_dump", "pg_restore", "pg_dumpall"]);
+const PG_DUMP_FILE_DEST_FLAGS = new Set(["-f", "--file"]);
 /**
  * File destination flags for downloaders/decoders (#3206).
  * normalizeToken lowercases, so wget `-O` and curl `-o` share `-o`.
@@ -377,6 +670,8 @@ const DOWNLOADER_FILE_DEST_FLAGS = new Set([
     "-out",
     "--out",
     "--outfile",
+    // PowerShell iwr/Invoke-WebRequest -OutFile (single-dash long form) (#3459).
+    "-outfile",
     // unar single-dash long form; GNU/others use --output-directory.
     "-output-directory",
     "--output-directory",
@@ -423,12 +718,43 @@ function binBareName(token) {
     const base = pathish.includes("/") ? pathish.slice(pathish.lastIndexOf("/") + 1) : pathish;
     return base.endsWith(".exe") ? base.slice(0, -4) : base;
 }
+/**
+ * GNU coreutils g* prefixes (Homebrew `ginstall`, `gcp`).
+ * Stems only — `git` / `gh` / `gpg` do not map to `it` / `h` / `pg` (#3459).
+ */
+const GNU_COREUTILS_WRITE_STEMS = new Set([
+    "cp",
+    "mv",
+    "rm",
+    "rmdir",
+    "unlink",
+    "shred",
+    "truncate",
+    "chmod",
+    "chown",
+    "dd",
+    "tee",
+    "install",
+    "ln",
+    "link",
+    "mkdir",
+    "touch",
+]);
+function writeBinName(token) {
+    const bare = binBareName(token);
+    if (bare.length > 1 && bare.startsWith("g")) {
+        const stem = bare.slice(1);
+        if (GNU_COREUTILS_WRITE_STEMS.has(stem))
+            return stem;
+    }
+    return bare;
+}
 /** True when token names a downloader/decoder bin (bare or path-qualified). */
 function isDownloaderDecoderBin(token) {
     const n = normalizeToken(token);
     if (n.startsWith("-"))
         return false;
-    return DOWNLOADER_DECODER_BINS.has(binBareName(token));
+    return DOWNLOADER_DECODER_BINS.has(writeBinName(token));
 }
 /**
  * True when `flag` (normalized lower) or `rawFlag` (original token) is a dest flag for `bin`.
@@ -474,6 +800,20 @@ function isDownloaderDestFlag(flag, bin, rawFlag) {
         return true;
     if (XH_FAMILY_BINS.has(bin) && XH_DIR_DEST_FLAGS.has(flag))
         return true;
+    if (ATOOL_FAMILY_BINS.has(bin) && ATOOL_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (GALLERY_DL_FAMILY_BINS.has(bin) && GALLERY_DL_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (MEGADL_FAMILY_BINS.has(bin) && MEGADL_PATH_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "fossil" && FOSSIL_WORKDIR_DEST_FLAGS.has(flag))
+        return true;
+    if (PG_DUMP_FAMILY_BINS.has(bin) && PG_DUMP_FILE_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "new-item" && NEW_ITEM_PATH_DEST_FLAGS.has(flag))
+        return true;
+    if (MAGICK_FAMILY_BINS.has(bin) && MAGICK_WRITE_DEST_FLAGS.has(flag))
+        return true;
     return false;
 }
 /**
@@ -541,7 +881,7 @@ function downloaderDecoderDestinations(tokens) {
             i++;
             continue;
         }
-        const bin = binBareName(tokens[i]);
+        const bin = writeBinName(tokens[i]);
         i++;
         // xxd reverse mode writes; without -r, path positionals are dump inputs (read).
         let xxdReverse = false;
@@ -552,7 +892,9 @@ function downloaderDecoderDestinations(tokens) {
         // Segment breaks (`;`/`\n`/glued ops) prevent following-command overwrite.
         let lastPositionalPath = null;
         const protectedPathish = [];
-        const collectsProtectedPositionals = PROTECTED_POSITIONAL_BINS.has(bin);
+        const collectsProtectedPositionals = PROTECTED_POSITIONAL_BINS.has(bin) ||
+            (bin === "git" && gitHasWriteSubcommand(tokens, i)) ||
+            (FORGE_CLONE_BINS.has(bin) && forgeHasCloneSubcommand(tokens, i));
         while (i < tokens.length) {
             const raw = tokens[i];
             const n = normalizeToken(raw);
@@ -614,7 +956,8 @@ function downloaderDecoderDestinations(tokens) {
             // Skip for scp (OpenSSH -oOption=Value attached forms are not file dests).
             // 7z requires attached -oDIR (#3245).
             if (bin !== "scp" && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
-                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output")) {
+                // `-outfile` is PowerShell -OutFile (next token is dest), not attached -outFILE (#3459).
+                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output") && n !== "-outfile") {
                     dests.push(pathishToken(raw.slice(4)));
                     i++;
                     continue;
@@ -640,12 +983,24 @@ function downloaderDecoderDestinations(tokens) {
                     i++;
                     continue;
                 }
+                // gallery-dl attached -dDIR (#3382)
+                if (GALLERY_DL_FAMILY_BINS.has(bin) && n.startsWith("-d") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
                 // unzip / cabextract attached -dDIR (#3245 / #3336)
                 if (UNZIP_DIR_DEST_BINS.has(bin) && n.startsWith("-d") && n.length > 2) {
                     dests.push(pathishToken(raw.slice(2)));
                     i++;
                     continue;
                 }
+                // aunpack / atool attached -XDIR (#3354)
+                if (ATOOL_FAMILY_BINS.has(bin) && n.startsWith("-x") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
                 // tar attached -CDIR (rare; capital C required)
                 if (TAR_FAMILY_BINS.has(bin) && raw.startsWith("-C") && raw.length > 2) {
                     dests.push(pathishToken(raw.slice(2)));
@@ -687,28 +1042,36 @@ function downloaderDecoderDestinations(tokens) {
                     if (p.startsWith(prefix) && p.length > prefix.length) {
                         const dest = p.slice(prefix.length);
                         dests.push(dest);
-                        if (dest.includes(".deft/authz") ||
-                            dest.includes(".deft-directive-disable") ||
-                            dest.includes(".no-deft-directive")) {
+                        if (pathishIsProtectedDest(dest)) {
                             protectedPathish.push(dest);
                         }
                         break;
                     }
                 }
             }
+            // sqlite3 `.output` / `.once` dest (separate token or `.output PATH` in one token) (#3354).
+            if (bin === "sqlite3") {
+                const meta = sqlite3MetaDest(raw, tokens[i + 1]);
+                if (meta !== null) {
+                    dests.push(meta.dest);
+                    if (pathishIsProtectedDest(meta.dest)) {
+                        protectedPathish.push(meta.dest);
+                    }
+                    i += meta.consumedNext ? 2 : 1;
+                    continue;
+                }
+            }
             // scp / certutil / rclone / archive extractors: pathish operands (quote-aware glued-op cut).
-            // Under UAT: any `.deft/authz` / kill-switch pathish is fail-closed settings
-            // (read vs write thrash deferred — prefer deny over dest-parser perfection; #3213 / #3245).
+            // Under UAT: any `.deft/authz` / approved-scope / kill-switch pathish is
+            // fail-closed settings (prefer deny over dest-parser perfection; #3213 / #3421).
+            // Last-positional dest bins (aws/convert/magick): only the last operand is dest.
             if (collectsProtectedPositionals && !n.startsWith("-")) {
                 const cut = firstUnquotedShellOpIndex(raw);
                 const cleaned = cut >= 0 ? raw.slice(0, cut) : raw;
                 const p = pathishToken(cleaned);
                 if (p.length > 0) {
                     lastPositionalPath = p;
-                    // Fail-closed: protected store/kill basenames anywhere in pathish.
-                    if (p.includes(".deft/authz") ||
-                        p.includes(".deft-directive-disable") ||
-                        p.includes(".no-deft-directive")) {
+                    if (pathishIsProtectedDest(p) && !LAST_POSITIONAL_DEST_BINS.has(bin)) {
                         protectedPathish.push(p);
                     }
                 }
@@ -727,6 +1090,10 @@ function downloaderDecoderDestinations(tokens) {
             dests.push(lastPositionalPath);
         }
     }
+    // #3354: fail-closed dest flags on unknown write-shaped bins (not named-peer only).
+    for (const dest of genericProtectedDests(tokens)) {
+        dests.push(dest);
+    }
     return dests;
 }
 function authzSubcommandFromToken(token) {
@@ -805,9 +1172,193 @@ function hasPolicyAuthorityMutator(tokens) {
     return false;
 }
 /** True when pathish token names a kill-switch basename (quote-strip resistant). */
+function pathishIsProtectedDest(pathish) {
+    return (pathishIsAuthzDir(pathish) ||
+        pathishIsApprovedScopeDir(pathish) ||
+        pathishMentionsKillSwitch(pathish));
+}
+function isGenericProtectedDestFlag(flag) {
+    return DOWNLOADER_FILE_DEST_FLAGS.has(flag) || GENERIC_PROTECTED_EXTRA_DEST_FLAGS.has(flag);
+}
+function isReadShapedInputFileFlag(bin, flag) {
+    return READ_SHAPED_FILE_FLAG_BINS.has(bin) && READ_INPUT_FILE_FLAGS.has(flag);
+}
+/**
+ * Git globals that do not take a separate value. Unlisted globals consume the
+ * next token so a later dest writer is still seen (#3421 residual).
+ */
+const GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS = new Set([
+    "--no-pager",
+    "-p",
+    "--paginate",
+    "-P",
+    "--bare",
+    "--help",
+    "-h",
+    "--version",
+    "--literal-pathspecs",
+    "--glob-pathspecs",
+    "--noglob-pathspecs",
+    "--icase-pathspecs",
+    "--no-replace-objects",
+    "--no-optional-locks",
+    "--no-lazy-fetch",
+    "--no-advice",
+    "--quiet",
+    "-q",
+]);
+/**
+ * True only when the git *subcommand* (first non-flag token) is a dest writer.
+ * Later operands named clone/worktree/submodule (e.g. `git log worktree -- …`)
+ * are not write subcommands (#3423 residual).
+ * Boolean globals (`--no-pager`) do not consume the next token. Other globals
+ * consume it even when that token spells a subcommand (#3421 residual).
+ */
+function gitHasWriteSubcommand(tokens, start) {
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            return false;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && !GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS.has(n)) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        return GIT_WRITE_SUBCOMMANDS.has(n);
+    }
+    return false;
+}
+/**
+ * True when this forge-CLI segment is a clone dest writer
+ * (`gh repo clone`, `glab repo clone`, `hub clone`) (#3459).
+ * `clone` as a later flag value (`gh pr create --title clone`) is not a dest writer.
+ */
+function forgeHasCloneSubcommand(tokens, start) {
+    const nonFlags = [];
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && (GH_VALUE_FLAGS.has(raw) || GH_VALUE_FLAGS.has(n))) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        nonFlags.push(n);
+        i++;
+    }
+    if (nonFlags[0] === "clone")
+        return true;
+    return nonFlags[0] === "repo" && nonFlags[1] === "clone";
+}
+/**
+ * Fail-closed dest harvest for write-shaped Shell under UAT (#3354 / #3382 / #3421).
+ * Named-bin parsers above are not the only path: any token that looks like
+ * `-o` / `--output` / `--outfile` / `--output-file` / `-d` / `--dir` /
+ * `--destination` / `--path` / `--directory` / `--workdir` / `--file` / `-f`
+ * (or attached `-oDIR` / `-dDIR`) whose dest is authz/kill-switch/approved-scope
+ * is collected even when the bin is unknown.
+ * scp `-o` (OpenSSH option) and cpio `-o` (copy-out) stay excluded.
+ */
+function genericProtectedDests(tokens) {
+    const dests = [];
+    // Track the current command bin — scp `-o` is OpenSSH option, cpio `-o` is copy-out.
+    // Skipping only when the current token itself is `scp`/`cpio` missed later `-o` values (#3354).
+    let currentBin = "";
+    for (let i = 0; i < tokens.length; i++) {
+        const raw = tokens[i];
+        const n = normalizeToken(raw);
+        if (isShellSegmentBreak(raw)) {
+            currentBin = "";
+            continue;
+        }
+        if (!n.startsWith("-")) {
+            if (isDownloaderDecoderBin(raw)) {
+                currentBin = writeBinName(raw);
+            }
+            else if (currentBin.length === 0 &&
+                !raw.includes("/") &&
+                !raw.includes("\\") &&
+                n.length > 0) {
+                currentBin = writeBinName(raw);
+            }
+        }
+        if (currentBin === "scp" || currentBin === "cpio")
+            continue;
+        if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
+            const eq = raw.indexOf("=");
+            const flag = normalizeToken(raw.slice(0, eq));
+            if (isGenericProtectedDestFlag(flag) && !isReadShapedInputFileFlag(currentBin, flag)) {
+                const dest = pathishToken(raw.slice(eq + 1));
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+            continue;
+        }
+        if (n.startsWith("-") &&
+            !n.startsWith("--") &&
+            n.startsWith("-o") &&
+            !n.startsWith("-out") &&
+            n.length > 2) {
+            const dest = pathishToken(raw.slice(2));
+            if (pathishIsProtectedDest(dest))
+                dests.push(dest);
+            continue;
+        }
+        if (n.startsWith("-") && !n.startsWith("--") && n.startsWith("-d") && n.length > 2) {
+            const dest = pathishToken(raw.slice(2));
+            if (pathishIsProtectedDest(dest))
+                dests.push(dest);
+            continue;
+        }
+        if (isGenericProtectedDestFlag(n) && !isReadShapedInputFileFlag(currentBin, n)) {
+            const next = tokens[i + 1];
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                const dest = pathishToken(next);
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+        }
+    }
+    return dests;
+}
+function sqlite3MetaDest(raw, next) {
+    const p = pathishToken(raw);
+    for (const meta of SQLITE3_OUTPUT_META) {
+        if (p === meta) {
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                return { dest: pathishToken(next), consumedNext: true };
+            }
+            return null;
+        }
+        if (p.startsWith(`${meta} `) || p.startsWith(`${meta}\t`)) {
+            const dest = p.slice(meta.length).trim();
+            if (dest.length > 0 && dest !== "|")
+                return { dest, consumedNext: false };
+        }
+    }
+    return null;
+}
 function pathishMentionsKillSwitch(pathish) {
+    const p = canonicalizePathish(pathish);
     for (const name of KILL_SWITCH_BASENAMES) {
-        if (pathish === name || pathish.endsWith(`/${name}`) || pathish.includes(name)) {
+        if (p === name || p.endsWith(`/${name}`) || p.includes(name)) {
             return true;
         }
     }
@@ -882,9 +1433,13 @@ function hasKillSwitchShellWrite(command, tokens) {
     ]);
     for (let ti = 0; ti < tokens.length; ti++) {
         const binTok = normalizeToken(tokens[ti]);
-        const bare = binBareName(tokens[ti]);
+        const bare = writeBinName(tokens[ti]);
         if (!killWriteBins.has(binTok) && !killWriteBins.has(bare))
             continue;
+        // Last-positional dest bins (and their subcommands): dest harvest owns dest vs source.
+        if (LAST_POSITIONAL_DEST_BINS.has(bare) || segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
         for (let tj = ti + 1; tj < tokens.length; tj++) {
             const p = pathishToken(tokens[tj]);
             if (pathishMentionsKillSwitch(p))
@@ -898,8 +1453,14 @@ function hasKillSwitchShellWrite(command, tokens) {
         }
     }
     // Bare `touch .deft-directive-disable` / `ln -sf x .deft-directive-disable` — path later.
-    for (const t of tokens) {
-        const p = pathishToken(t);
+    // Skip tokens in a last-positional dest segment (dest harvest owns dest vs source).
+    // Other segments still scan so `aws … ; touch .deft-directive-disable` is settings.
+    for (let ti = 0; ti < tokens.length; ti++) {
+        if (LAST_POSITIONAL_DEST_BINS.has(writeBinName(tokens[ti])) ||
+            segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
+        const p = pathishToken(tokens[ti]);
         for (const name of KILL_SWITCH_BASENAMES) {
             // Exact basename or ends with /basename
             if (p === name || p.endsWith(`/${name}`)) {
@@ -907,8 +1468,8 @@ function hasKillSwitchShellWrite(command, tokens) {
                 if (hasWriteShape(command, tokens) ||
                     lower.includes("touch") ||
                     lower.includes("new-item") ||
-                    SYMLINK_PLANT_BINS.has(binBareName(tokens[0])) ||
-                    tokens.some((tok) => SYMLINK_PLANT_BINS.has(binBareName(tok)))) {
+                    SYMLINK_PLANT_BINS.has(writeBinName(tokens[0])) ||
+                    tokens.some((tok) => SYMLINK_PLANT_BINS.has(writeBinName(tok)))) {
                     return true;
                 }
             }
@@ -937,7 +1498,10 @@ function isProgrammaticWriteBinToken(token) {
         bare === "perl" ||
         bare === "ruby" ||
         bare === "pwsh" ||
-        bare === "powershell") {
+        bare === "powershell" ||
+        bare === "tsx" ||
+        bare === "ts-node" ||
+        bare === "tsnode") {
         return true;
     }
     // Versioned: python3.11, python3.12, node18, …
@@ -1080,17 +1644,89 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
 function pathishToken(token) {
     return token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
 }
+/**
+ * Collapse `//`, `/./`, and `/../` lexically so equivalent dests still match
+ * (`.deft/foo/../approved-scope/x`) without following symlinks or matching
+ * prefix siblings. O(n) — no nested-quantifier regex.
+ */
+function canonicalizePathish(pathish) {
+    const parts = [];
+    let cur = "";
+    const abs = pathish.startsWith("/");
+    for (let i = 0; i <= pathish.length; i++) {
+        const c = i < pathish.length ? pathish[i] : "/";
+        if (c === "/" || i === pathish.length) {
+            if (cur.length === 0 || cur === ".") {
+                // drop empty and `.`
+            }
+            else if (cur === "..") {
+                if (parts.length > 0 && parts[parts.length - 1] !== "..") {
+                    parts.pop();
+                }
+                else if (!abs) {
+                    parts.push("..");
+                }
+            }
+            else {
+                parts.push(cur);
+            }
+            cur = "";
+        }
+        else {
+            cur += c;
+        }
+    }
+    const joined = parts.join("/");
+    return abs ? `/${joined}` : joined;
+}
 /**
  * True when a pathish string targets `.deft/authz` (after quote strip / slash normalize).
  * Quote-split forms like `'.deft/'authz'/grants/x'` become `.deft/authz/grants/x` via pathishToken.
  */
+/** True when `dir` is a path segment (left-bounded; `foo.deft/authz` is not `.deft/authz`). */
+function pathishHasDirSegment(pathish, dir) {
+    const p = canonicalizePathish(pathish.trim());
+    if (p === dir || p.startsWith(`${dir}/`) || p.startsWith(`${dir}\\`))
+        return true;
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c !== "/" && c !== "\\" && c !== ":" && c !== "=")
+            continue;
+        const rest = p.slice(i + 1);
+        if (rest === dir || rest.startsWith(`${dir}/`) || rest.startsWith(`${dir}\\`))
+            return true;
+    }
+    return false;
+}
 function pathishIsAuthzDir(pathish) {
-    return pathish.includes(".deft/authz");
+    return pathishHasDirSegment(pathish, ".deft/authz");
+}
+/** True when a pathish string targets `.deft/approved-scope` (#3421 / #3410 mint). */
+function pathishIsApprovedScopeDir(pathish) {
+    return pathishHasDirSegment(pathish, ".deft/approved-scope");
+}
+function pathishIsSettingsStoreDir(pathish) {
+    return pathishIsAuthzDir(pathish) || pathishIsApprovedScopeDir(pathish);
+}
+/** True when dest is a settings-store path or a split-path `authz` segment after `.deft`. */
+function destMentionsAuthzSegment(dest) {
+    const p = canonicalizePathish(pathishToken(dest).trim());
+    if (pathishIsSettingsStoreDir(p))
+        return true;
+    const segs = p.split("/").filter((s) => s.length > 0);
+    for (let i = 0; i < segs.length; i++) {
+        if (segs[i] !== "authz")
+            continue;
+        const prev = i > 0 ? segs[i - 1] : "";
+        if (prev === ".deft" || prev.length === 0)
+            return true;
+    }
+    return false;
 }
 /**
- * Shell **write** targeting `.deft/authz/` (#3110 AC-3 / #3206 / #3213).
+ * Shell **write** targeting `.deft/authz/` or `.deft/approved-scope/` (#3110 / #3421).
  * Pure reads (`cat .deft/authz/state.json`) stay unclassifiable — use `authz:show`.
- * Redirects only count when the destination region contains `.deft/authz`.
+ * Redirects only count when the destination region contains a settings-store dir.
  * Pathish/token checks run even when the raw command lacks contiguous `.deft/authz`
  * text (quote-split residual: `cp x '.deft/'authz'/grants/y'`).
  */
@@ -1116,7 +1752,7 @@ function hasAuthzDirShellWrite(command, tokens) {
                 hay[end] !== "\n") {
                 end++;
             }
-            if (hay.slice(j, end).includes(".deft/authz"))
+            if (pathishIsSettingsStoreDir(hay.slice(j, end)))
                 return true;
         }
     }
@@ -1126,7 +1762,7 @@ function hasAuthzDirShellWrite(command, tokens) {
     // must not fail-open as unclassifiable (SLizard residual). ARCHIVE_ALT_WRITE_BINS: tar/rclone
     // residual pathish without dest-flag perfection thrash.
     for (let ti = 0; ti < tokens.length; ti++) {
-        const bare = binBareName(tokens[ti]);
+        const bare = writeBinName(tokens[ti]);
         const n = normalizeToken(tokens[ti]);
         if (!INDIRECT_WRITE_BINS.has(n) &&
             !INDIRECT_WRITE_BINS.has(bare) &&
@@ -1134,20 +1770,24 @@ function hasAuthzDirShellWrite(command, tokens) {
             !ARCHIVE_ALT_WRITE_BINS.has(bare)) {
             continue;
         }
+        // Last-positional dest bins (and their subcommands): dest harvest owns dest vs source.
+        if (LAST_POSITIONAL_DEST_BINS.has(bare) || segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
         for (let tj = ti + 1; tj < tokens.length; tj++) {
             const p = pathishToken(tokens[tj]);
-            if (pathishIsAuthzDir(p))
+            if (pathishIsSettingsStoreDir(p))
                 return true;
             for (const prefix of SOCAT_WRITE_ADDR_PREFIXES) {
-                if (p.startsWith(prefix) && pathishIsAuthzDir(p.slice(prefix.length))) {
+                if (p.startsWith(prefix) && pathishIsSettingsStoreDir(p.slice(prefix.length))) {
                     return true;
                 }
             }
         }
     }
-    // Downloader/decoder destinations under .deft/authz (#3206 / #3213 / #3245 archive+alt).
+    // Downloader/decoder destinations under settings-store dirs (#3206 / #3421).
     for (const dest of downloaderDecoderDestinations(tokens)) {
-        if (pathishIsAuthzDir(dest))
+        if (pathishIsSettingsStoreDir(dest))
             return true;
     }
     // Contiguous mention without write shape stays false (reads like cat .deft/authz/…).
@@ -1184,8 +1824,15 @@ const INDIRECT_WRITE_BINS = new Set([
     "remove-item",
     "ri",
     "ni",
+    "new-item",
     "sc",
     "mi",
+    // #3459 residual: Windows copy / fsutil / touch / TS runners.
+    "copy",
+    "fsutil",
+    "touch",
+    "tsx",
+    "ts-node",
 ]);
 /**
  * O(n): true when command expands `$…` / `` `…` `` / `%VAR%`
@@ -1227,7 +1874,7 @@ function hasWriteShape(command, tokens) {
     if (command.includes(">"))
         return true;
     for (const t of tokens) {
-        const bare = binBareName(t);
+        const bare = writeBinName(t);
         if (INDIRECT_WRITE_BINS.has(normalizeToken(t)) || INDIRECT_WRITE_BINS.has(bare))
             return true;
         // #3245: archive extractors / alt downloaders are write-shaped (defense-in-depth for
@@ -1585,7 +2232,7 @@ export function classifyShellAuthzOps(command) {
                     lower[end] !== "\n") {
                     end++;
                 }
-                if (lower.slice(j, end).includes("authz")) {
+                if (destMentionsAuthzSegment(lower.slice(j, end))) {
                     found.add("settings");
                     break;
                 }