@deftai/directive-core 0.104.0 → 0.106.0

package/dist/authz/classify.js

@@ -178,6 +178,37 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
 ]);
 /** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
 const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/**
+ * Dest-form writers #3529 harvest missed (#3545). Shared across downloader,
+ * archive-alt, positional, and indirect-write membership so a named-peer
+ * allowlist cannot be the only fail-closed path.
+ */
+const UAT_RESIDUAL_DEST_WRITE_BINS_3545 = [
+    "fromdos",
+    "todos",
+    "emacsclient",
+    "pico",
+    "pdftk",
+    "gs",
+    "dpkg",
+    "degit",
+    "composer",
+    "ddrescue",
+    "dc3dd",
+    "sg_dd",
+];
+/** In-place residual writers: any protected operand is a dest. Extract/output bins stay dest-flag gated. */
+const UAT_RESIDUAL_INPLACE_WRITE_BINS_3545 = [
+    "fromdos",
+    "todos",
+    "emacsclient",
+    "pico",
+    "degit",
+    "composer",
+    "ddrescue",
+    "dc3dd",
+    "sg_dd",
+];
 /**
  * Downloaders / decoders / remote-copy tools that can plant files without shell
  * redirects (#3206 / #3213 / #3245). Not in INDIRECT_WRITE_BINS: those feed hasWriteShape
@@ -262,10 +293,67 @@ const DOWNLOADER_DECODER_BINS = new Set([
     "sqlite3",
     "crane",
     "objcopy",
+    // #3382 residual after #3354: dest forms that are not generic -o/--output/--outfile.
+    "cmake",
+    "script",
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    "svn",
+    "fossil",
+    "bzr",
+    "cvs",
+    "darcs",
+    "ed",
+    "nvim",
+    "nano",
+    "vim",
+    "vi",
+    // #3421 residual after #3382: dest forms the harvest missed.
+    "git",
+    "ex",
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "aws",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    "new-item",
+    // #3459 residual after #3421: GNU g* peers, forge clone, iwr, fsutil.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
+    "gh",
+    "glab",
+    "hub",
+    // #3529 residual after #3459: dest-form writers harvest missed.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "pscp",
+    "jj",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual after #3529: dest-form writers harvest missed.
+    ...UAT_RESIDUAL_DEST_WRITE_BINS_3545,
 ]);
 /**
  * Archive extractors / alt writers that can plant via pathish operands without
- * shell redirects (#3245 / #3288 / #3311 / #3336 / #3354). Used for pathish authz/kill scans (prefer deny)
+ * shell redirects (#3245 / #3288 / #3311 / #3336 / #3354 / #3382). Used for pathish authz/kill scans (prefer deny)
  * and write-shape residual under UAT — not bare curl-class URL fetches.
  */
 const ARCHIVE_ALT_WRITE_BINS = new Set([
@@ -338,9 +426,45 @@ const ARCHIVE_ALT_WRITE_BINS = new Set([
     "sqlite3",
     "crane",
     "objcopy",
+    // #3382 residual: dedicated dest-form writers (not general-purpose cmake/git/editors).
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    // #3421 residual: dedicated dest-form writers (not general-purpose git/aws/editors).
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    // #3459 residual: dest writers that are not general-purpose gh/cmd.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
+    // #3529 residual: dest writers that are not general-purpose cmd/git.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: dest writers that are not general-purpose cmd/git.
+    ...UAT_RESIDUAL_INPLACE_WRITE_BINS_3545,
 ]);
 /**
- * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336 / #3354).
+ * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336 / #3354 / #3382).
  * Prefer a Set over a long `||` chain so coverage counts one membership check, not N branches.
  */
 const PROTECTED_POSITIONAL_BINS = new Set([
@@ -403,7 +527,149 @@ const PROTECTED_POSITIONAL_BINS = new Set([
     "sqlite3",
     "crane",
     "objcopy",
+    // #3382 residual: positional dest writers (cmake copy / script / VCS / editors).
+    "cmake",
+    "script",
+    "gallery-dl",
+    "megadl",
+    "ncftpget",
+    "svn",
+    "fossil",
+    "bzr",
+    "cvs",
+    "darcs",
+    "ed",
+    "nvim",
+    "nano",
+    "vim",
+    "vi",
+    // #3421 residual: positional dest writers (aws, convert, New-Item).
+    // git clone/worktree/submodule dests are harvested only on those write subcommands.
+    "ex",
+    "dos2unix",
+    "unix2dos",
+    "mac2unix",
+    "unix2mac",
+    "aws",
+    "pijul",
+    "pg_dump",
+    "pg_restore",
+    "pg_dumpall",
+    "convert",
+    "magick",
+    "mogrify",
+    "fallocate",
+    "new-item",
+    // #3459 residual: positional dest writers (fsutil createnew, iwr dest flags).
+    // gh/glab/hub clone dests are harvested only on the clone subcommand.
+    "iwr",
+    "invoke-webrequest",
+    "fsutil",
+    // #3529 residual: positional dest writers (xcopy/robocopy/BitsTransfer/pscp).
+    // jj clone dests are harvested only on the clone subcommand.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "pscp",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: positional dest writers (fromdos/dpkg/degit/ddrescue).
+    ...UAT_RESIDUAL_DEST_WRITE_BINS_3545,
+]);
+/**
+ * Bins whose dest is the last pathish operand (src … dest). A protected
+ * source that writes elsewhere is not a dest plant (#3421 residual).
+ */
+const LAST_POSITIONAL_DEST_BINS = new Set(["aws", "convert", "magick"]);
+/** Wrappers / assignments before the dest-owning bin (`env aws`, `FOO=1 convert`). */
+const COMMAND_WRAPPER_BINS = new Set([
+    "env",
+    "command",
+    "nice",
+    "nohup",
+    "sudo",
+    "doas",
+    "time",
+    "stdbuf",
+    "timeout",
+    "ionice",
+]);
+function isWrapperOrAssignmentToken(raw, n) {
+    if (COMMAND_WRAPPER_BINS.has(writeBinName(raw)))
+        return true;
+    return n.includes("=") && !n.startsWith("-") && !raw.includes("/") && !raw.includes("\\");
+}
+/** Wrapper flags that take a separate value (`env -C DIR`, `nice -n N`). */
+const WRAPPER_VALUE_FLAGS = new Set([
+    "-c",
+    "--chdir",
+    "-u",
+    "--unset",
+    "-n",
+    "--adjustment",
+    "-o",
+    "--output",
+    "-i",
+    "--input",
+    "-e",
+    "--error",
+    "-s",
+    "--signal",
+    "-k",
+    "--kill-after",
 ]);
+/** In-place ImageMagick writer: every protected operand is a dest, not last-only. */
+const MAGICK_FAMILY_BINS = new Set(["convert", "magick", "mogrify"]);
+const MAGICK_WRITE_DEST_FLAGS = new Set(["-write"]);
+/** True when this token is a subcommand of a last-positional dest bin (`aws s3 cp`). */
+function tokenEndsShellSegment(token) {
+    return isShellSegmentBreak(token) || firstUnquotedShellOpIndex(token) >= 0;
+}
+function segmentStartedByLastPositionalDest(tokens, tokenIndex) {
+    let start = tokenIndex;
+    while (start > 0 && !tokenEndsShellSegment(tokens[start - 1]))
+        start--;
+    let skipNext = false;
+    let afterWrapper = false;
+    for (let k = start; k < tokenIndex; k++) {
+        const raw = tokens[k];
+        if (isShellSegmentBreak(raw))
+            continue;
+        const n = normalizeToken(raw);
+        const bare = binBareName(raw);
+        if (skipNext) {
+            skipNext = false;
+            if (LAST_POSITIONAL_DEST_BINS.has(bare))
+                return true;
+            continue;
+        }
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && WRAPPER_VALUE_FLAGS.has(n))
+                skipNext = true;
+            continue;
+        }
+        if (isWrapperOrAssignmentToken(raw, n)) {
+            afterWrapper = COMMAND_WRAPPER_BINS.has(bare);
+            continue;
+        }
+        if (LAST_POSITIONAL_DEST_BINS.has(bare))
+            return true;
+        // timeout 5 aws / similar: skip one non-bin operand after a wrapper.
+        if (afterWrapper) {
+            afterWrapper = false;
+            continue;
+        }
+        return false;
+    }
+    return false;
+}
 /** wget family (directory-prefix dest flags). */
 const WGET_FAMILY_BINS = new Set(["wget", "wget2"]);
 /** aria2 family (dir dest flags). */
@@ -419,6 +685,82 @@ const SQLITE3_OUTPUT_META = [".output", ".once"];
 const TAR_FAMILY_BINS = new Set(["tar", "bsdtar", "gtar", "star", "gnutar"]);
 /** xh / httpie family (download-dir dest flags) (#3311). */
 const XH_FAMILY_BINS = new Set(["xh", "httpie"]);
+/** gallery-dl dest-dir flags (#3382). */
+const GALLERY_DL_FAMILY_BINS = new Set(["gallery-dl", "gallery_dl"]);
+const GALLERY_DL_DIR_DEST_FLAGS = new Set(["-d", "--destination", "--dest"]);
+/** megadl dest-path flags (#3382). */
+const MEGADL_FAMILY_BINS = new Set(["megadl"]);
+const MEGADL_PATH_DEST_FLAGS = new Set(["--path"]);
+/**
+ * Extra dest flags harvested on unknown write-shaped bins when dest is protected (#3382 / #3421).
+ * Not merged into DOWNLOADER_FILE_DEST_FLAGS: curl `-d` is POST data, not a file dest.
+ */
+const GENERIC_PROTECTED_EXTRA_DEST_FLAGS = new Set([
+    "-d",
+    "--dir",
+    "--destination",
+    "--dest",
+    "--path",
+    "--directory",
+    "--workdir",
+    "--file",
+    "--separate-git-dir",
+    "--pack-destination",
+    // #3529 residual dest flags (PowerShell single-dash + extra dir dests).
+    "--output-dir",
+    "--outdir",
+    "--target-directory",
+    "--destdir",
+    "-destination",
+    "-destinationpath",
+    "-filepath",
+    "--prefix",
+    // #3545 residual dest flags (VCS repo dest + ghostscript output).
+    "--repodir",
+    "--repo-dir",
+    "-soutputfile",
+]);
+/** Bins whose `--file` / `-f` operand is an input, not a dest plant. */
+const READ_SHAPED_FILE_FLAG_BINS = new Set([
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "ag",
+    "ack",
+    "get-content",
+    "gc",
+    "cat",
+    "type",
+    "less",
+    "more",
+    "head",
+    "tail",
+]);
+const READ_INPUT_FILE_FLAGS = new Set(["--file", "-f"]);
+/** PowerShell New-Item dest flags (not generic: Get-Content -Path is a read). */
+const NEW_ITEM_PATH_DEST_FLAGS = new Set(["-path", "-literalpath", "--literalpath"]);
+/** git subcommands whose positionals can plant a dest (#3421). */
+const GIT_WRITE_SUBCOMMANDS = new Set(["clone", "worktree", "submodule"]);
+/** git bundle subcommands that write a bundle file (#3529). Reads: verify / list-heads / unbundle. */
+const GIT_BUNDLE_WRITE_SUBCOMMANDS = new Set(["create"]);
+/** jj subcommands whose positionals can plant a dest (#3529). */
+const JJ_WRITE_SUBCOMMANDS = new Set(["clone"]);
+const JJ_PRE_SUBCOMMAND_BOOLEAN_FLAGS = new Set([
+    "--help",
+    "-h",
+    "--quiet",
+    "-q",
+    "--ignore-immutable",
+    "--no-pager",
+]);
+/** Forge CLIs whose `clone` dest is harvested like git clone (#3459). */
+const FORGE_CLONE_BINS = new Set(["gh", "glab", "hub"]);
+/** fossil dest-dir flags (#3382 PATH form + #3421 --workdir=). */
+const FOSSIL_WORKDIR_DEST_FLAGS = new Set(["--workdir"]);
+/** pg_dump family dest-file flags (#3421). */
+const PG_DUMP_FAMILY_BINS = new Set(["pg_dump", "pg_restore", "pg_dumpall"]);
+const PG_DUMP_FILE_DEST_FLAGS = new Set(["-f", "--file"]);
 /**
  * File destination flags for downloaders/decoders (#3206).
  * normalizeToken lowercases, so wget `-O` and curl `-o` share `-o`.
@@ -433,6 +775,8 @@ const DOWNLOADER_FILE_DEST_FLAGS = new Set([
     "-out",
     "--out",
     "--outfile",
+    // PowerShell iwr/Invoke-WebRequest -OutFile (single-dash long form) (#3459).
+    "-outfile",
     // unar single-dash long form; GNU/others use --output-directory.
     "-output-directory",
     "--output-directory",
@@ -479,12 +823,46 @@ function binBareName(token) {
     const base = pathish.includes("/") ? pathish.slice(pathish.lastIndexOf("/") + 1) : pathish;
     return base.endsWith(".exe") ? base.slice(0, -4) : base;
 }
+/**
+ * GNU coreutils g* prefixes (Homebrew `ginstall`, `gcp`).
+ * Stems only — `git` / `gh` / `gpg` do not map to `it` / `h` / `pg` (#3459).
+ */
+const GNU_COREUTILS_WRITE_STEMS = new Set([
+    "cp",
+    "mv",
+    "rm",
+    "rmdir",
+    "unlink",
+    "shred",
+    "truncate",
+    "chmod",
+    "chown",
+    "dd",
+    "tee",
+    "install",
+    "ln",
+    "link",
+    "mkdir",
+    "touch",
+]);
+function writeBinName(token) {
+    const bare = binBareName(token);
+    if (bare.length > 1 && bare.startsWith("g")) {
+        const stem = bare.slice(1);
+        if (GNU_COREUTILS_WRITE_STEMS.has(stem))
+            return stem;
+    }
+    return bare;
+}
 /** True when token names a downloader/decoder bin (bare or path-qualified). */
 function isDownloaderDecoderBin(token) {
     const n = normalizeToken(token);
     if (n.startsWith("-"))
         return false;
-    return DOWNLOADER_DECODER_BINS.has(binBareName(token));
+    return DOWNLOADER_DECODER_BINS.has(writeBinName(token));
+}
+function isScpFamilyBin(bin) {
+    return bin === "scp" || bin === "pscp";
 }
 /**
  * True when `flag` (normalized lower) or `rawFlag` (original token) is a dest flag for `bin`.
@@ -492,8 +870,8 @@ function isDownloaderDecoderBin(token) {
  * 7z uses attached `-oDIR` only — separate `-o PATH` is not a 7z dest form (handled elsewhere).
  */
 function isDownloaderDestFlag(flag, bin, rawFlag) {
-    // scp: `-o` is OpenSSH option (ProxyCommand, …), not a file dest flag.
-    if (bin === "scp")
+    // scp/pscp: `-o` is OpenSSH option (ProxyCommand, …), not a file dest flag.
+    if (isScpFamilyBin(bin))
         return false;
     // 7z family: only attached `-oDIR` (parsed in attached-short branch), not separate `-o PATH`.
     if (SEVEN_Z_FAMILY_BINS.has(bin)) {
@@ -532,6 +910,18 @@ function isDownloaderDestFlag(flag, bin, rawFlag) {
         return true;
     if (ATOOL_FAMILY_BINS.has(bin) && ATOOL_DIR_DEST_FLAGS.has(flag))
         return true;
+    if (GALLERY_DL_FAMILY_BINS.has(bin) && GALLERY_DL_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (MEGADL_FAMILY_BINS.has(bin) && MEGADL_PATH_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "fossil" && FOSSIL_WORKDIR_DEST_FLAGS.has(flag))
+        return true;
+    if (PG_DUMP_FAMILY_BINS.has(bin) && PG_DUMP_FILE_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "new-item" && NEW_ITEM_PATH_DEST_FLAGS.has(flag))
+        return true;
+    if (MAGICK_FAMILY_BINS.has(bin) && MAGICK_WRITE_DEST_FLAGS.has(flag))
+        return true;
     return false;
 }
 /**
@@ -582,6 +972,28 @@ function firstUnquotedShellOpIndex(raw) {
     }
     return -1;
 }
+/**
+ * dpkg/pdftk/gs only harvest protected positionals on write forms
+ * (`dpkg -x`, `pdftk … output`, gs dest flags). Inspect/read forms stay unclassifiable.
+ */
+function residualPositionalBinIsWriteShaped(bin, tokens, start) {
+    if (bin !== "dpkg" && bin !== "pdftk" && bin !== "gs")
+        return true;
+    for (let k = start; k < tokens.length; k++) {
+        const raw = tokens[k];
+        if (tokenEndsShellSegment(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (bin === "dpkg" && (n === "-x" || n === "--extract" || n === "--vextract")) {
+            return true;
+        }
+        if (bin === "pdftk" && n === "output")
+            return true;
+        if (bin === "gs" && (n.startsWith("-soutputfile") || n === "-soutputfile"))
+            return true;
+    }
+    return false;
+}
 /**
  * Destinations from curl/wget/xxd/openssl/scp/aria2c/certutil via -o/--output/-O/-out/
  * --output-dir/-P/-d/--dir (separate, =value, or attached short form), xxd -r path-like
@@ -599,7 +1011,7 @@ function downloaderDecoderDestinations(tokens) {
             i++;
             continue;
         }
-        const bin = binBareName(tokens[i]);
+        const bin = writeBinName(tokens[i]);
         i++;
         // xxd reverse mode writes; without -r, path positionals are dump inputs (read).
         let xxdReverse = false;
@@ -610,7 +1022,11 @@ function downloaderDecoderDestinations(tokens) {
         // Segment breaks (`;`/`\n`/glued ops) prevent following-command overwrite.
         let lastPositionalPath = null;
         const protectedPathish = [];
-        const collectsProtectedPositionals = PROTECTED_POSITIONAL_BINS.has(bin);
+        const collectsProtectedPositionals = (PROTECTED_POSITIONAL_BINS.has(bin) && residualPositionalBinIsWriteShaped(bin, tokens, i)) ||
+            (bin === "git" && gitHasWriteSubcommand(tokens, i)) ||
+            (bin === "git" && gitHasBundleCreate(tokens, i)) ||
+            (bin === "jj" && jjHasWriteSubcommand(tokens, i)) ||
+            (FORGE_CLONE_BINS.has(bin) && forgeHasCloneSubcommand(tokens, i));
         while (i < tokens.length) {
             const raw = tokens[i];
             const n = normalizeToken(raw);
@@ -642,8 +1058,8 @@ function downloaderDecoderDestinations(tokens) {
                 i++;
                 continue;
             }
-            // scp: skip OpenSSH value-taking flags + their values (-o Option=Value, -i key, -P port).
-            if (bin === "scp" &&
+            // scp/pscp: skip OpenSSH value-taking flags + their values (-o Option=Value, -i key, -P port).
+            if (isScpFamilyBin(bin) &&
                 (SCP_VALUE_FLAGS_LOWER.has(n) ||
                     SCP_VALUE_FLAGS_EXACT.has(raw) ||
                     SCP_VALUE_FLAGS_EXACT.has(n))) {
@@ -669,10 +1085,11 @@ function downloaderDecoderDestinations(tokens) {
                 continue;
             }
             // Attached short: -oPATH / -OPATH (after lowercasing both are -opath…)
-            // Skip for scp (OpenSSH -oOption=Value attached forms are not file dests).
+            // Skip for scp/pscp (OpenSSH -oOption=Value attached forms are not file dests).
             // 7z requires attached -oDIR (#3245).
-            if (bin !== "scp" && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
-                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output")) {
+            if (!isScpFamilyBin(bin) && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
+                // `-outfile` is PowerShell -OutFile (next token is dest), not attached -outFILE (#3459).
+                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output") && n !== "-outfile") {
                     dests.push(pathishToken(raw.slice(4)));
                     i++;
                     continue;
@@ -698,6 +1115,12 @@ function downloaderDecoderDestinations(tokens) {
                     i++;
                     continue;
                 }
+                // gallery-dl attached -dDIR (#3382)
+                if (GALLERY_DL_FAMILY_BINS.has(bin) && n.startsWith("-d") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
                 // unzip / cabextract attached -dDIR (#3245 / #3336)
                 if (UNZIP_DIR_DEST_BINS.has(bin) && n.startsWith("-d") && n.length > 2) {
                     dests.push(pathishToken(raw.slice(2)));
@@ -751,9 +1174,7 @@ function downloaderDecoderDestinations(tokens) {
                     if (p.startsWith(prefix) && p.length > prefix.length) {
                         const dest = p.slice(prefix.length);
                         dests.push(dest);
-                        if (dest.includes(".deft/authz") ||
-                            dest.includes(".deft-directive-disable") ||
-                            dest.includes(".no-deft-directive")) {
+                        if (pathishIsProtectedDest(dest)) {
                             protectedPathish.push(dest);
                         }
                         break;
@@ -765,7 +1186,7 @@ function downloaderDecoderDestinations(tokens) {
                 const meta = sqlite3MetaDest(raw, tokens[i + 1]);
                 if (meta !== null) {
                     dests.push(meta.dest);
-                    if (pathishIsAuthzDir(meta.dest) || pathishMentionsKillSwitch(meta.dest)) {
+                    if (pathishIsProtectedDest(meta.dest)) {
                         protectedPathish.push(meta.dest);
                     }
                     i += meta.consumedNext ? 2 : 1;
@@ -773,18 +1194,16 @@ function downloaderDecoderDestinations(tokens) {
                 }
             }
             // scp / certutil / rclone / archive extractors: pathish operands (quote-aware glued-op cut).
-            // Under UAT: any `.deft/authz` / kill-switch pathish is fail-closed settings
-            // (read vs write thrash deferred — prefer deny over dest-parser perfection; #3213 / #3245).
+            // Under UAT: any `.deft/authz` / approved-scope / kill-switch pathish is
+            // fail-closed settings (prefer deny over dest-parser perfection; #3213 / #3421).
+            // Last-positional dest bins (aws/convert/magick): only the last operand is dest.
             if (collectsProtectedPositionals && !n.startsWith("-")) {
                 const cut = firstUnquotedShellOpIndex(raw);
                 const cleaned = cut >= 0 ? raw.slice(0, cut) : raw;
                 const p = pathishToken(cleaned);
                 if (p.length > 0) {
                     lastPositionalPath = p;
-                    // Fail-closed: protected store/kill basenames anywhere in pathish.
-                    if (p.includes(".deft/authz") ||
-                        p.includes(".deft-directive-disable") ||
-                        p.includes(".no-deft-directive")) {
+                    if (pathishIsProtectedDest(p) && !LAST_POSITIONAL_DEST_BINS.has(bin)) {
                         protectedPathish.push(p);
                     }
                 }
@@ -886,13 +1305,316 @@ function hasPolicyAuthorityMutator(tokens) {
 }
 /** True when pathish token names a kill-switch basename (quote-strip resistant). */
 function pathishIsProtectedDest(pathish) {
-    return pathishIsAuthzDir(pathish) || pathishMentionsKillSwitch(pathish);
+    return (pathishIsAuthzDir(pathish) ||
+        pathishIsApprovedScopeDir(pathish) ||
+        pathishMentionsKillSwitch(pathish));
+}
+function isGenericProtectedDestFlag(flag) {
+    return DOWNLOADER_FILE_DEST_FLAGS.has(flag) || GENERIC_PROTECTED_EXTRA_DEST_FLAGS.has(flag);
 }
+/** Env-style dest keys harvested even without a leading `--` (`make DESTDIR=`). */
+const DEST_ASSIGNMENT_KEYS = new Set(["destdir", "prefix", "install_root", "dest_dir"]);
+/** Bins whose DESTDIR=/PREFIX= assignment is a dest plant (not `echo DESTDIR=…`). */
+const DEST_ASSIGNMENT_OWNER_BINS = new Set(["make", "gmake"]);
+/**
+ * First-command bins that print/read: a later `make` token is data, not the writer
+ * (`echo DESTDIR=… make`, `git log make DESTDIR=…`). Also the first command of a
+ * search-launcher `-exec` / `-c` payload (`find -exec echo make DESTDIR=`).
+ * Search/launchers themselves are not in this set — `find -exec make DESTDIR=`
+ * still harvests the payload writer.
+ */
+const DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS = new Set([
+    "echo",
+    "printf",
+    "true",
+    "false",
+    ":",
+    "git",
+    "gh",
+    "hg",
+    "svn",
+    "cat",
+    "ls",
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "wc",
+    "diff",
+    "stat",
+    "file",
+]);
+/**
+ * Search/launchers whose first token is not the writer. Harvest make/DESTDIR
+ * only from `-exec` / `--exec` / `-c` payloads (`find -exec make DESTDIR=`).
+ * The payload's first command still uses NON_WRITER (`find -exec echo make`).
+ * `xargs make DESTDIR=` stays a wrapper (not in the non-writer set).
+ */
+const DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS = new Set(["find"]);
+const DEST_ASSIGNMENT_EXEC_PAYLOAD_FLAGS = new Set([
+    "-exec",
+    "--exec",
+    "-execdir",
+    "--execdir",
+    "-c",
+]);
+/** find `-exec` payload terminator (`\;` or `+`). Resets so a later `-exec` is still operative. */
+function isFindExecPayloadTerminator(n) {
+    return n === ";" || n === "+";
+}
+/** make targets that do not apply DESTDIR (avoid denying `make DESTDIR=… clean`). */
+const DEST_ASSIGNMENT_NON_WRITE_TARGETS = new Set([
+    "clean",
+    "distclean",
+    "mostlyclean",
+    "maintainer-clean",
+    "check",
+    "test",
+    "tests",
+    "help",
+]);
+/** make flags that consume the next token (`-C dir`, `-f Makefile`). */
+const MAKE_VALUE_FLAGS = new Set([
+    "-c",
+    "--directory",
+    "-f",
+    "--file",
+    "--makefile",
+    "--include-dir",
+    "-j",
+    "--jobs",
+    "-l",
+    "--load-average",
+    "--eval",
+]);
 /**
- * Fail-closed dest harvest for write-shaped Shell under UAT (#3354).
+ * True when a DESTDIR/PREFIX assignment is an operative make write.
+ * Looks for make/gmake anywhere after wrappers (including unknown wrappers
+ * such as `xargs`), unless the first command is a print/read bin.
+ * Search/launchers (`find`) still harvest from `-exec` / `--exec` / `-c`
+ * payloads unless that payload's first command is a print/read bin.
+ * Payload state resets at `\;` / `+` so a later `-exec make DESTDIR=` is
+ * still operative (`find -exec echo hi \; -exec make DESTDIR= install`).
+ * Non-writing targets (`clean`) are not operative.
+ */
+function segmentDestAssignmentIsOperative(tokens, tokenIndex) {
+    let start = tokenIndex;
+    while (start > 0 && !tokenEndsShellSegment(tokens[start - 1]))
+        start--;
+    let skipNext = false;
+    let firstCommand = "";
+    let inExecPayload = false;
+    let execPayloadFirstCommand = "";
+    let sawMake = false;
+    const targets = [];
+    for (let k = start; k < tokens.length; k++) {
+        const raw = tokens[k];
+        if (tokenEndsShellSegment(raw))
+            break;
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        const n = normalizeToken(raw);
+        if (inExecPayload && isFindExecPayloadTerminator(n)) {
+            inExecPayload = false;
+            execPayloadFirstCommand = "";
+            continue;
+        }
+        // Print/read `-exec` payload: skip until terminator so a later `-exec` is seen.
+        if (inExecPayload &&
+            execPayloadFirstCommand.length > 0 &&
+            DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(execPayloadFirstCommand)) {
+            continue;
+        }
+        if (n.startsWith("-")) {
+            // find -exec / -c opens the payload; do not consume the next token as a
+            // wrapper value. After make is seen, -C still skips its directory.
+            if (DEST_ASSIGNMENT_EXEC_PAYLOAD_FLAGS.has(n) &&
+                DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS.has(firstCommand) &&
+                !sawMake) {
+                inExecPayload = true;
+                execPayloadFirstCommand = "";
+                continue;
+            }
+            if (!n.includes("=") && (WRAPPER_VALUE_FLAGS.has(n) || MAKE_VALUE_FLAGS.has(n))) {
+                skipNext = true;
+            }
+            continue;
+        }
+        if (isEnvAssign(raw))
+            continue;
+        const bare = writeBinName(raw);
+        if (COMMAND_WRAPPER_BINS.has(bare))
+            continue;
+        if (bare.length > 0 && bare[0] !== undefined && bare[0] >= "0" && bare[0] <= "9") {
+            continue;
+        }
+        if (firstCommand.length === 0) {
+            firstCommand = bare;
+            if (DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(bare))
+                return false;
+        }
+        if (inExecPayload && execPayloadFirstCommand.length === 0) {
+            execPayloadFirstCommand = bare;
+        }
+        if (inExecPayload && DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(execPayloadFirstCommand)) {
+            continue;
+        }
+        if (DEST_ASSIGNMENT_OWNER_BINS.has(bare)) {
+            if (DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS.has(firstCommand) && !inExecPayload) {
+                continue;
+            }
+            sawMake = true;
+            continue;
+        }
+        if (sawMake)
+            targets.push(n);
+    }
+    if (!sawMake)
+        return false;
+    if (targets.length === 0)
+        return true;
+    for (const t of targets) {
+        if (!DEST_ASSIGNMENT_NON_WRITE_TARGETS.has(t))
+            return true;
+    }
+    return false;
+}
+function isReadShapedInputFileFlag(bin, flag) {
+    return READ_SHAPED_FILE_FLAG_BINS.has(bin) && READ_INPUT_FILE_FLAGS.has(flag);
+}
+/**
+ * Git globals that do not take a separate value. Unlisted globals consume the
+ * next token so a later dest writer is still seen (#3421 residual).
+ */
+const GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS = new Set([
+    "--no-pager",
+    "-p",
+    "--paginate",
+    "-P",
+    "--bare",
+    "--help",
+    "-h",
+    "--version",
+    "--literal-pathspecs",
+    "--glob-pathspecs",
+    "--noglob-pathspecs",
+    "--icase-pathspecs",
+    "--no-replace-objects",
+    "--no-optional-locks",
+    "--no-lazy-fetch",
+    "--no-advice",
+    "--quiet",
+    "-q",
+]);
+/**
+ * True only when the VCS *subcommand* (first non-flag token) is a dest writer.
+ * Later operands named clone/worktree/submodule (e.g. `git log worktree -- …`)
+ * are not write subcommands (#3423 residual).
+ * Boolean globals (`--no-pager`) do not consume the next token. Other globals
+ * consume it even when that token spells a subcommand (#3421 residual).
+ */
+function hasWriteSubcommand(tokens, start, writeSubs, booleanFlags) {
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            return false;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && !booleanFlags.has(n) && !n.startsWith("--no-")) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        return writeSubs.has(n);
+    }
+    return false;
+}
+function gitHasWriteSubcommand(tokens, start) {
+    return hasWriteSubcommand(tokens, start, GIT_WRITE_SUBCOMMANDS, GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS);
+}
+/**
+ * True when this git segment is `bundle create` (write), not `bundle verify` / `list-heads`
+ * / `unbundle` (read of an existing bundle) (#3529 Greptile P1).
+ */
+function gitHasBundleCreate(tokens, start) {
+    const nonFlags = [];
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && !GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS.has(n) && !n.startsWith("--no-")) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        nonFlags.push(n);
+        if (nonFlags.length >= 2)
+            break;
+        i++;
+    }
+    return nonFlags[0] === "bundle" && GIT_BUNDLE_WRITE_SUBCOMMANDS.has(nonFlags[1] ?? "");
+}
+function jjHasWriteSubcommand(tokens, start) {
+    return hasWriteSubcommand(tokens, start, JJ_WRITE_SUBCOMMANDS, JJ_PRE_SUBCOMMAND_BOOLEAN_FLAGS);
+}
+/**
+ * True when this forge-CLI segment is a clone dest writer
+ * (`gh repo clone`, `glab repo clone`, `hub clone`) (#3459).
+ * `clone` as a later flag value (`gh pr create --title clone`) is not a dest writer.
+ */
+function forgeHasCloneSubcommand(tokens, start) {
+    const nonFlags = [];
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && (GH_VALUE_FLAGS.has(raw) || GH_VALUE_FLAGS.has(n))) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        nonFlags.push(n);
+        i++;
+    }
+    if (nonFlags[0] === "clone")
+        return true;
+    return nonFlags[0] === "repo" && nonFlags[1] === "clone";
+}
+/**
+ * Fail-closed dest harvest for write-shaped Shell under UAT (#3354 / #3382 / #3421).
  * Named-bin parsers above are not the only path: any token that looks like
- * `-o` / `--output` / `--outfile` / `--output-file` (or attached `-oDIR`)
- * whose dest is authz/kill-switch is collected even when the bin is unknown.
+ * `-o` / `--output` / `--outfile` / `--output-file` / `-d` / `--dir` /
+ * `--destination` / `--path` / `--directory` / `--workdir` / `--file` / `-f`
+ * (or attached `-oDIR` / `-dDIR`) whose dest is authz/kill-switch/approved-scope
+ * is collected even when the bin is unknown.
  * scp `-o` (OpenSSH option) and cpio `-o` (copy-out) stay excluded.
  */
 function genericProtectedDests(tokens) {
@@ -907,29 +1629,54 @@ function genericProtectedDests(tokens) {
             currentBin = "";
             continue;
         }
-        if (!n.startsWith("-")) {
+        if (!n.startsWith("-") && !isEnvAssign(raw)) {
             if (isDownloaderDecoderBin(raw)) {
-                currentBin = binBareName(raw);
+                currentBin = writeBinName(raw);
             }
             else if (currentBin.length === 0 &&
                 !raw.includes("/") &&
                 !raw.includes("\\") &&
                 n.length > 0) {
-                currentBin = binBareName(raw);
+                currentBin = writeBinName(raw);
             }
         }
-        if (currentBin === "scp" || currentBin === "cpio")
+        if (isScpFamilyBin(currentBin) || currentBin === "cpio")
             continue;
+        // Env-style dest assignments (`DESTDIR=`, `PREFIX=`) without a leading dash (#3545).
+        if (n.includes("=") && !n.startsWith("-")) {
+            const eq = raw.indexOf("=");
+            const keyRaw = raw.slice(0, eq);
+            if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(keyRaw)) {
+                const key = normalizeToken(keyRaw);
+                if (DEST_ASSIGNMENT_KEYS.has(key) && segmentDestAssignmentIsOperative(tokens, i)) {
+                    const dest = pathishToken(raw.slice(eq + 1));
+                    if (pathishIsProtectedDest(dest))
+                        dests.push(dest);
+                }
+            }
+            continue;
+        }
         if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
             const eq = raw.indexOf("=");
             const flag = normalizeToken(raw.slice(0, eq));
-            if (DOWNLOADER_FILE_DEST_FLAGS.has(flag)) {
+            if (isGenericProtectedDestFlag(flag) && !isReadShapedInputFileFlag(currentBin, flag)) {
                 const dest = pathishToken(raw.slice(eq + 1));
                 if (pathishIsProtectedDest(dest))
                     dests.push(dest);
             }
             continue;
         }
+        // Named dest flags (`-Destination`, `--output-dir`) take the next token.
+        // Check before attached `-oDIR` / `-dDIR` so `-destination` is not `-d` + `estination`.
+        if (isGenericProtectedDestFlag(n) && !isReadShapedInputFileFlag(currentBin, n)) {
+            const next = tokens[i + 1];
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                const dest = pathishToken(next);
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+            continue;
+        }
         if (n.startsWith("-") &&
             !n.startsWith("--") &&
             n.startsWith("-o") &&
@@ -940,13 +1687,10 @@ function genericProtectedDests(tokens) {
                 dests.push(dest);
             continue;
         }
-        if (DOWNLOADER_FILE_DEST_FLAGS.has(n)) {
-            const next = tokens[i + 1];
-            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
-                const dest = pathishToken(next);
-                if (pathishIsProtectedDest(dest))
-                    dests.push(dest);
-            }
+        if (n.startsWith("-") && !n.startsWith("--") && n.startsWith("-d") && n.length > 2) {
+            const dest = pathishToken(raw.slice(2));
+            if (pathishIsProtectedDest(dest))
+                dests.push(dest);
         }
     }
     return dests;
@@ -969,8 +1713,9 @@ function sqlite3MetaDest(raw, next) {
     return null;
 }
 function pathishMentionsKillSwitch(pathish) {
+    const p = canonicalizePathish(pathish);
     for (const name of KILL_SWITCH_BASENAMES) {
-        if (pathish === name || pathish.endsWith(`/${name}`) || pathish.includes(name)) {
+        if (p === name || p.endsWith(`/${name}`) || p.includes(name)) {
             return true;
         }
     }
@@ -1045,9 +1790,13 @@ function hasKillSwitchShellWrite(command, tokens) {
     ]);
     for (let ti = 0; ti < tokens.length; ti++) {
         const binTok = normalizeToken(tokens[ti]);
-        const bare = binBareName(tokens[ti]);
+        const bare = writeBinName(tokens[ti]);
         if (!killWriteBins.has(binTok) && !killWriteBins.has(bare))
             continue;
+        // Last-positional dest bins (and their subcommands): dest harvest owns dest vs source.
+        if (LAST_POSITIONAL_DEST_BINS.has(bare) || segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
         for (let tj = ti + 1; tj < tokens.length; tj++) {
             const p = pathishToken(tokens[tj]);
             if (pathishMentionsKillSwitch(p))
@@ -1061,8 +1810,14 @@ function hasKillSwitchShellWrite(command, tokens) {
         }
     }
     // Bare `touch .deft-directive-disable` / `ln -sf x .deft-directive-disable` — path later.
-    for (const t of tokens) {
-        const p = pathishToken(t);
+    // Skip tokens in a last-positional dest segment (dest harvest owns dest vs source).
+    // Other segments still scan so `aws … ; touch .deft-directive-disable` is settings.
+    for (let ti = 0; ti < tokens.length; ti++) {
+        if (LAST_POSITIONAL_DEST_BINS.has(writeBinName(tokens[ti])) ||
+            segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
+        const p = pathishToken(tokens[ti]);
         for (const name of KILL_SWITCH_BASENAMES) {
             // Exact basename or ends with /basename
             if (p === name || p.endsWith(`/${name}`)) {
@@ -1070,8 +1825,8 @@ function hasKillSwitchShellWrite(command, tokens) {
                 if (hasWriteShape(command, tokens) ||
                     lower.includes("touch") ||
                     lower.includes("new-item") ||
-                    SYMLINK_PLANT_BINS.has(binBareName(tokens[0])) ||
-                    tokens.some((tok) => SYMLINK_PLANT_BINS.has(binBareName(tok)))) {
+                    SYMLINK_PLANT_BINS.has(writeBinName(tokens[0])) ||
+                    tokens.some((tok) => SYMLINK_PLANT_BINS.has(writeBinName(tok)))) {
                     return true;
                 }
             }
@@ -1099,17 +1854,39 @@ function isProgrammaticWriteBinToken(token) {
         bare === "nodejs" ||
         bare === "perl" ||
         bare === "ruby" ||
+        bare === "jruby" ||
+        bare === "pypy" ||
+        bare === "pypy3" ||
         bare === "pwsh" ||
-        bare === "powershell") {
+        bare === "powershell" ||
+        bare === "tsx" ||
+        bare === "ts-node" ||
+        bare === "tsnode" ||
+        bare === "bun" ||
+        bare === "deno" ||
+        bare === "php" ||
+        bare === "lua" ||
+        bare === "luajit") {
         return true;
     }
-    // Versioned: python3.11, python3.12, node18, …
+    // Versioned: python3.11, python3.12, node18, php8.3, lua5.4, …
     if (bare.startsWith("python3.") || bare.startsWith("python2."))
         return true;
     if (/^python\d+(\.\d+)*$/.test(bare))
         return true;
     if (/^node\d+$/.test(bare))
         return true;
+    if (/^php\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (/^lua\d+(\.\d+)*$/.test(bare))
+        return true;
+    // #3545 residual: versioned ruby / jruby / pypy (bare `ruby` already matched).
+    if (/^ruby\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (/^jruby\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (bare.startsWith("pypy3.") || /^pypy\d+(\.\d+)*$/.test(bare))
+        return true;
     return false;
 }
 /**
@@ -1117,6 +1894,74 @@ function isProgrammaticWriteBinToken(token) {
  * Escaped quotes (`\'` / `\"`) stay inside the string. Used so `print('.write(')` is not
  * a write API while `open(p,'w').write('x')` still matches `.write(` (Greptile conf residual).
  */
+/**
+ * True when `ident` is followed by optional whitespace then `(` (PHP `file_put_contents (`).
+ * Skips matches inside quotes so `echo "file_put_contents ($x)"` is not a write.
+ * O(n) — no nested-quantifier regex.
+ */
+function includesIdentCall(haystack, ident) {
+    if (ident.length === 0 || haystack.length < ident.length)
+        return false;
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < haystack.length; i++) {
+        const c = haystack[i];
+        if (c === "\\" && i + 1 < haystack.length && (inSingle || inDouble)) {
+            i++;
+            continue;
+        }
+        if (c === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (c === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (!haystack.startsWith(ident, i))
+            continue;
+        let j = i + ident.length;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t" || w === "\n" || w === "\r") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j < haystack.length && haystack[j] === "(")
+            return true;
+    }
+    return false;
+}
+/** Strip matching wrapping quotes from a `-r`/`-e` payload. */
+function unwrapQuotedPayload(token) {
+    if (token.length >= 2) {
+        const a = token[0];
+        const b = token[token.length - 1];
+        if ((a === '"' && b === '"') || (a === "'" && b === "'")) {
+            return token.slice(1, -1);
+        }
+    }
+    return token;
+}
+/** Script bodies after interpreter `-r`/`-e`/`-c` (PHP/node one-liners). */
+function interpreterScriptPayloads(tokens) {
+    const out = [];
+    const flags = new Set(["-r", "-e", "-c", "--run", "--eval", "--execute"]);
+    for (let i = 0; i < tokens.length; i++) {
+        const n = normalizeToken(tokens[i]);
+        if (!flags.has(n))
+            continue;
+        const next = tokens[i + 1];
+        if (next === undefined || isShellSegmentBreak(next) || String(next).startsWith("-"))
+            continue;
+        out.push(unwrapQuotedPayload(next));
+    }
+    return out;
+}
 function includesOutsideQuotes(haystack, needle) {
     if (needle.length === 0 || haystack.length < needle.length)
         return false;
@@ -1143,6 +1988,85 @@ function includesOutsideQuotes(haystack, needle) {
     }
     return false;
 }
+/**
+ * Perl `open F,">dest"` / `open FH, '>'` without parens (#3545).
+ * Quote-aware so `print 'open F,>'` is not a write. O(n).
+ */
+function hasPerlBareOpenWrite(haystack) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < haystack.length; i++) {
+        const c = haystack[i];
+        if (c === "\\" && i + 1 < haystack.length && (inSingle || inDouble)) {
+            i++;
+            continue;
+        }
+        if (c === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (c === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (!haystack.startsWith("open", i))
+            continue;
+        if (i > 0) {
+            const prev = haystack[i - 1];
+            if ((prev >= "a" && prev <= "z") || (prev >= "0" && prev <= "9") || prev === "_")
+                continue;
+        }
+        let j = i + 4;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t" || w === "\n" || w === "\r") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        const identStart = j;
+        while (j < haystack.length) {
+            const ch = haystack[j];
+            if ((ch >= "a" && ch <= "z") ||
+                (ch >= "A" && ch <= "Z") ||
+                (ch >= "0" && ch <= "9") ||
+                ch === "_") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j === identStart)
+            continue;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j >= haystack.length || haystack[j] !== ",")
+            continue;
+        j++;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        const q = haystack[j];
+        if ((q === "'" || q === '"') && j + 1 < haystack.length && haystack[j + 1] === ">") {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * True when command uses a programmatic bin with a **write** API, optionally with
  * path-obfuscation markers (base64/bytes/chr). Pure reads / print-only stay unclassifiable.
@@ -1173,6 +2097,8 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
     const writeApi = lower.includes("writefilesync") ||
         lower.includes("writefile") ||
         lower.includes("writetext") ||
+        includesIdentCall(lower, "file_put_contents") ||
+        interpreterScriptPayloads(tokens).some((p) => includesIdentCall(p.toLowerCase(), "file_put_contents")) ||
         lower.includes("set-content") ||
         lower.includes("out-file") ||
         lower.includes("fs.write") ||
@@ -1180,6 +2106,17 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
         lower.includes("path.write(") ||
         lower.includes("file.write(") ||
         lower.includes("spurt") ||
+        interpreterScriptPayloads(tokens).some((p) => {
+            const pl = p.toLowerCase();
+            return (includesIdentCall(pl, "write_file") ||
+                includesIdentCall(pl, "spew") ||
+                includesOutsideQuotes(pl, "->spew") ||
+                hasPerlBareOpenWrite(pl));
+        }) ||
+        includesIdentCall(lower, "write_file") ||
+        includesIdentCall(lower, "spew") ||
+        includesOutsideQuotes(lower, "->spew") ||
+        hasPerlBareOpenWrite(lower) ||
         lower.includes(">>") ||
         lower.includes("unlink(") ||
         lower.includes("rmsync") ||
@@ -1217,7 +2154,13 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
             lower.includes("mode='a") ||
             lower.includes('mode="a') ||
             lower.includes("mode=w"));
-    const writeish = writeApi || openWriteMode;
+    // Perl `open F,">dest"` — `open(` is absent; `-e` payloads with spaces split tokens (#3545).
+    const perlBareOpenWrite = (lower.includes("open ") || lower.includes("open\t")) &&
+        (lower.includes(",'>") ||
+            lower.includes(',">') ||
+            lower.includes(", '>") ||
+            lower.includes(', ">'));
+    const writeish = writeApi || openWriteMode || perlBareOpenWrite;
     // Path construction that hides the destination from literal classifiers.
     const obfuscatedPath = lower.includes("base64") ||
         lower.includes("fromcharcode") ||
@@ -1243,17 +2186,89 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
 function pathishToken(token) {
     return token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
 }
+/**
+ * Collapse `//`, `/./`, and `/../` lexically so equivalent dests still match
+ * (`.deft/foo/../approved-scope/x`) without following symlinks or matching
+ * prefix siblings. O(n) — no nested-quantifier regex.
+ */
+function canonicalizePathish(pathish) {
+    const parts = [];
+    let cur = "";
+    const abs = pathish.startsWith("/");
+    for (let i = 0; i <= pathish.length; i++) {
+        const c = i < pathish.length ? pathish[i] : "/";
+        if (c === "/" || i === pathish.length) {
+            if (cur.length === 0 || cur === ".") {
+                // drop empty and `.`
+            }
+            else if (cur === "..") {
+                if (parts.length > 0 && parts[parts.length - 1] !== "..") {
+                    parts.pop();
+                }
+                else if (!abs) {
+                    parts.push("..");
+                }
+            }
+            else {
+                parts.push(cur);
+            }
+            cur = "";
+        }
+        else {
+            cur += c;
+        }
+    }
+    const joined = parts.join("/");
+    return abs ? `/${joined}` : joined;
+}
 /**
  * True when a pathish string targets `.deft/authz` (after quote strip / slash normalize).
  * Quote-split forms like `'.deft/'authz'/grants/x'` become `.deft/authz/grants/x` via pathishToken.
  */
+/** True when `dir` is a path segment (left-bounded; `foo.deft/authz` is not `.deft/authz`). */
+function pathishHasDirSegment(pathish, dir) {
+    const p = canonicalizePathish(pathish.trim());
+    if (p === dir || p.startsWith(`${dir}/`) || p.startsWith(`${dir}\\`))
+        return true;
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c !== "/" && c !== "\\" && c !== ":" && c !== "=")
+            continue;
+        const rest = p.slice(i + 1);
+        if (rest === dir || rest.startsWith(`${dir}/`) || rest.startsWith(`${dir}\\`))
+            return true;
+    }
+    return false;
+}
 function pathishIsAuthzDir(pathish) {
-    return pathish.includes(".deft/authz");
+    return pathishHasDirSegment(pathish, ".deft/authz");
+}
+/** True when a pathish string targets `.deft/approved-scope` (#3421 / #3410 mint). */
+function pathishIsApprovedScopeDir(pathish) {
+    return pathishHasDirSegment(pathish, ".deft/approved-scope");
+}
+function pathishIsSettingsStoreDir(pathish) {
+    return pathishIsAuthzDir(pathish) || pathishIsApprovedScopeDir(pathish);
+}
+/** True when dest is a settings-store path or a split-path `authz` segment after `.deft`. */
+function destMentionsAuthzSegment(dest) {
+    const p = canonicalizePathish(pathishToken(dest).trim());
+    if (pathishIsSettingsStoreDir(p))
+        return true;
+    const segs = p.split("/").filter((s) => s.length > 0);
+    for (let i = 0; i < segs.length; i++) {
+        if (segs[i] !== "authz")
+            continue;
+        const prev = i > 0 ? segs[i - 1] : "";
+        if (prev === ".deft" || prev.length === 0)
+            return true;
+    }
+    return false;
 }
 /**
- * Shell **write** targeting `.deft/authz/` (#3110 AC-3 / #3206 / #3213).
+ * Shell **write** targeting `.deft/authz/` or `.deft/approved-scope/` (#3110 / #3421).
  * Pure reads (`cat .deft/authz/state.json`) stay unclassifiable — use `authz:show`.
- * Redirects only count when the destination region contains `.deft/authz`.
+ * Redirects only count when the destination region contains a settings-store dir.
  * Pathish/token checks run even when the raw command lacks contiguous `.deft/authz`
  * text (quote-split residual: `cp x '.deft/'authz'/grants/y'`).
  */
@@ -1279,7 +2294,7 @@ function hasAuthzDirShellWrite(command, tokens) {
                 hay[end] !== "\n") {
                 end++;
             }
-            if (hay.slice(j, end).includes(".deft/authz"))
+            if (pathishIsSettingsStoreDir(hay.slice(j, end)))
                 return true;
         }
     }
@@ -1289,7 +2304,7 @@ function hasAuthzDirShellWrite(command, tokens) {
     // must not fail-open as unclassifiable (SLizard residual). ARCHIVE_ALT_WRITE_BINS: tar/rclone
     // residual pathish without dest-flag perfection thrash.
     for (let ti = 0; ti < tokens.length; ti++) {
-        const bare = binBareName(tokens[ti]);
+        const bare = writeBinName(tokens[ti]);
         const n = normalizeToken(tokens[ti]);
         if (!INDIRECT_WRITE_BINS.has(n) &&
             !INDIRECT_WRITE_BINS.has(bare) &&
@@ -1297,20 +2312,24 @@ function hasAuthzDirShellWrite(command, tokens) {
             !ARCHIVE_ALT_WRITE_BINS.has(bare)) {
             continue;
         }
+        // Last-positional dest bins (and their subcommands): dest harvest owns dest vs source.
+        if (LAST_POSITIONAL_DEST_BINS.has(bare) || segmentStartedByLastPositionalDest(tokens, ti)) {
+            continue;
+        }
         for (let tj = ti + 1; tj < tokens.length; tj++) {
             const p = pathishToken(tokens[tj]);
-            if (pathishIsAuthzDir(p))
+            if (pathishIsSettingsStoreDir(p))
                 return true;
             for (const prefix of SOCAT_WRITE_ADDR_PREFIXES) {
-                if (p.startsWith(prefix) && pathishIsAuthzDir(p.slice(prefix.length))) {
+                if (p.startsWith(prefix) && pathishIsSettingsStoreDir(p.slice(prefix.length))) {
                     return true;
                 }
             }
         }
     }
-    // Downloader/decoder destinations under .deft/authz (#3206 / #3213 / #3245 archive+alt).
+    // Downloader/decoder destinations under settings-store dirs (#3206 / #3421).
     for (const dest of downloaderDecoderDestinations(tokens)) {
-        if (pathishIsAuthzDir(dest))
+        if (pathishIsSettingsStoreDir(dest))
             return true;
     }
     // Contiguous mention without write shape stays false (reads like cat .deft/authz/…).
@@ -1347,8 +2366,38 @@ const INDIRECT_WRITE_BINS = new Set([
     "remove-item",
     "ri",
     "ni",
+    "new-item",
     "sc",
     "mi",
+    // #3459 residual: Windows copy / fsutil / touch / TS runners.
+    "copy",
+    "fsutil",
+    "touch",
+    "tsx",
+    "ts-node",
+    // #3529 residual: Windows dest writers / rename / moreutils sponge / runtimes.
+    "xcopy",
+    "robocopy",
+    "move",
+    "ren",
+    "rename",
+    "rename-item",
+    "sponge",
+    "bun",
+    "deno",
+    "php",
+    "lua",
+    "start-bitstransfer",
+    "bitsadmin",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: dest writers (fromdos/degit/ddrescue). dpkg/pdftk/gs stay dest-flag gated.
+    ...UAT_RESIDUAL_INPLACE_WRITE_BINS_3545,
 ]);
 /**
  * O(n): true when command expands `$…` / `` `…` `` / `%VAR%`
@@ -1390,7 +2439,7 @@ function hasWriteShape(command, tokens) {
     if (command.includes(">"))
         return true;
     for (const t of tokens) {
-        const bare = binBareName(t);
+        const bare = writeBinName(t);
         if (INDIRECT_WRITE_BINS.has(normalizeToken(t)) || INDIRECT_WRITE_BINS.has(bare))
             return true;
         // #3245: archive extractors / alt downloaders are write-shaped (defense-in-depth for
@@ -1551,15 +2600,7 @@ function hasProgrammaticAuthzEnvWrite(command, tokens) {
     const lower = command.toLowerCase();
     let hasProg = false;
     for (const t of tokens) {
-        const n = normalizeToken(t);
-        if (n === "python" ||
-            n === "python3" ||
-            n === "node" ||
-            n === "nodejs" ||
-            n === "perl" ||
-            n === "ruby" ||
-            n === "pwsh" ||
-            n === "powershell") {
+        if (isProgrammaticWriteBinToken(t)) {
             hasProg = true;
             break;
         }
@@ -1748,7 +2789,7 @@ export function classifyShellAuthzOps(command) {
                     lower[end] !== "\n") {
                     end++;
                 }
-                if (lower.slice(j, end).includes("authz")) {
+                if (destMentionsAuthzSegment(lower.slice(j, end))) {
                     found.add("settings");
                     break;
                 }