@deftai/directive-core 0.105.0 → 0.106.0

package/dist/authz/classify.js

@@ -178,6 +178,37 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
 ]);
 /** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
 const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/**
+ * Dest-form writers #3529 harvest missed (#3545). Shared across downloader,
+ * archive-alt, positional, and indirect-write membership so a named-peer
+ * allowlist cannot be the only fail-closed path.
+ */
+const UAT_RESIDUAL_DEST_WRITE_BINS_3545 = [
+    "fromdos",
+    "todos",
+    "emacsclient",
+    "pico",
+    "pdftk",
+    "gs",
+    "dpkg",
+    "degit",
+    "composer",
+    "ddrescue",
+    "dc3dd",
+    "sg_dd",
+];
+/** In-place residual writers: any protected operand is a dest. Extract/output bins stay dest-flag gated. */
+const UAT_RESIDUAL_INPLACE_WRITE_BINS_3545 = [
+    "fromdos",
+    "todos",
+    "emacsclient",
+    "pico",
+    "degit",
+    "composer",
+    "ddrescue",
+    "dc3dd",
+    "sg_dd",
+];
 /**
  * Downloaders / decoders / remote-copy tools that can plant files without shell
  * redirects (#3206 / #3213 / #3245). Not in INDIRECT_WRITE_BINS: those feed hasWriteShape
@@ -302,6 +333,23 @@ const DOWNLOADER_DECODER_BINS = new Set([
     "gh",
     "glab",
     "hub",
+    // #3529 residual after #3459: dest-form writers harvest missed.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "pscp",
+    "jj",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual after #3529: dest-form writers harvest missed.
+    ...UAT_RESIDUAL_DEST_WRITE_BINS_3545,
 ]);
 /**
  * Archive extractors / alt writers that can plant via pathish operands without
@@ -399,6 +447,21 @@ const ARCHIVE_ALT_WRITE_BINS = new Set([
     "iwr",
     "invoke-webrequest",
     "fsutil",
+    // #3529 residual: dest writers that are not general-purpose cmd/git.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: dest writers that are not general-purpose cmd/git.
+    ...UAT_RESIDUAL_INPLACE_WRITE_BINS_3545,
 ]);
 /**
  * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336 / #3354 / #3382).
@@ -502,6 +565,23 @@ const PROTECTED_POSITIONAL_BINS = new Set([
     "iwr",
     "invoke-webrequest",
     "fsutil",
+    // #3529 residual: positional dest writers (xcopy/robocopy/BitsTransfer/pscp).
+    // jj clone dests are harvested only on the clone subcommand.
+    "xcopy",
+    "robocopy",
+    "bitsadmin",
+    "start-bitstransfer",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "pscp",
+    "sponge",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: positional dest writers (fromdos/dpkg/degit/ddrescue).
+    ...UAT_RESIDUAL_DEST_WRITE_BINS_3545,
 ]);
 /**
  * Bins whose dest is the last pathish operand (src … dest). A protected
@@ -626,6 +706,19 @@ const GENERIC_PROTECTED_EXTRA_DEST_FLAGS = new Set([
     "--file",
     "--separate-git-dir",
     "--pack-destination",
+    // #3529 residual dest flags (PowerShell single-dash + extra dir dests).
+    "--output-dir",
+    "--outdir",
+    "--target-directory",
+    "--destdir",
+    "-destination",
+    "-destinationpath",
+    "-filepath",
+    "--prefix",
+    // #3545 residual dest flags (VCS repo dest + ghostscript output).
+    "--repodir",
+    "--repo-dir",
+    "-soutputfile",
 ]);
 /** Bins whose `--file` / `-f` operand is an input, not a dest plant. */
 const READ_SHAPED_FILE_FLAG_BINS = new Set([
@@ -649,6 +742,18 @@ const READ_INPUT_FILE_FLAGS = new Set(["--file", "-f"]);
 const NEW_ITEM_PATH_DEST_FLAGS = new Set(["-path", "-literalpath", "--literalpath"]);
 /** git subcommands whose positionals can plant a dest (#3421). */
 const GIT_WRITE_SUBCOMMANDS = new Set(["clone", "worktree", "submodule"]);
+/** git bundle subcommands that write a bundle file (#3529). Reads: verify / list-heads / unbundle. */
+const GIT_BUNDLE_WRITE_SUBCOMMANDS = new Set(["create"]);
+/** jj subcommands whose positionals can plant a dest (#3529). */
+const JJ_WRITE_SUBCOMMANDS = new Set(["clone"]);
+const JJ_PRE_SUBCOMMAND_BOOLEAN_FLAGS = new Set([
+    "--help",
+    "-h",
+    "--quiet",
+    "-q",
+    "--ignore-immutable",
+    "--no-pager",
+]);
 /** Forge CLIs whose `clone` dest is harvested like git clone (#3459). */
 const FORGE_CLONE_BINS = new Set(["gh", "glab", "hub"]);
 /** fossil dest-dir flags (#3382 PATH form + #3421 --workdir=). */
@@ -756,14 +861,17 @@ function isDownloaderDecoderBin(token) {
         return false;
     return DOWNLOADER_DECODER_BINS.has(writeBinName(token));
 }
+function isScpFamilyBin(bin) {
+    return bin === "scp" || bin === "pscp";
+}
 /**
  * True when `flag` (normalized lower) or `rawFlag` (original token) is a dest flag for `bin`.
  * tar `-C` must use raw case: lowercased `-c` is create-archive, not chdir (#3245).
  * 7z uses attached `-oDIR` only — separate `-o PATH` is not a 7z dest form (handled elsewhere).
  */
 function isDownloaderDestFlag(flag, bin, rawFlag) {
-    // scp: `-o` is OpenSSH option (ProxyCommand, …), not a file dest flag.
-    if (bin === "scp")
+    // scp/pscp: `-o` is OpenSSH option (ProxyCommand, …), not a file dest flag.
+    if (isScpFamilyBin(bin))
         return false;
     // 7z family: only attached `-oDIR` (parsed in attached-short branch), not separate `-o PATH`.
     if (SEVEN_Z_FAMILY_BINS.has(bin)) {
@@ -864,6 +972,28 @@ function firstUnquotedShellOpIndex(raw) {
     }
     return -1;
 }
+/**
+ * dpkg/pdftk/gs only harvest protected positionals on write forms
+ * (`dpkg -x`, `pdftk … output`, gs dest flags). Inspect/read forms stay unclassifiable.
+ */
+function residualPositionalBinIsWriteShaped(bin, tokens, start) {
+    if (bin !== "dpkg" && bin !== "pdftk" && bin !== "gs")
+        return true;
+    for (let k = start; k < tokens.length; k++) {
+        const raw = tokens[k];
+        if (tokenEndsShellSegment(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (bin === "dpkg" && (n === "-x" || n === "--extract" || n === "--vextract")) {
+            return true;
+        }
+        if (bin === "pdftk" && n === "output")
+            return true;
+        if (bin === "gs" && (n.startsWith("-soutputfile") || n === "-soutputfile"))
+            return true;
+    }
+    return false;
+}
 /**
  * Destinations from curl/wget/xxd/openssl/scp/aria2c/certutil via -o/--output/-O/-out/
  * --output-dir/-P/-d/--dir (separate, =value, or attached short form), xxd -r path-like
@@ -892,8 +1022,10 @@ function downloaderDecoderDestinations(tokens) {
         // Segment breaks (`;`/`\n`/glued ops) prevent following-command overwrite.
         let lastPositionalPath = null;
         const protectedPathish = [];
-        const collectsProtectedPositionals = PROTECTED_POSITIONAL_BINS.has(bin) ||
+        const collectsProtectedPositionals = (PROTECTED_POSITIONAL_BINS.has(bin) && residualPositionalBinIsWriteShaped(bin, tokens, i)) ||
             (bin === "git" && gitHasWriteSubcommand(tokens, i)) ||
+            (bin === "git" && gitHasBundleCreate(tokens, i)) ||
+            (bin === "jj" && jjHasWriteSubcommand(tokens, i)) ||
             (FORGE_CLONE_BINS.has(bin) && forgeHasCloneSubcommand(tokens, i));
         while (i < tokens.length) {
             const raw = tokens[i];
@@ -926,8 +1058,8 @@ function downloaderDecoderDestinations(tokens) {
                 i++;
                 continue;
             }
-            // scp: skip OpenSSH value-taking flags + their values (-o Option=Value, -i key, -P port).
-            if (bin === "scp" &&
+            // scp/pscp: skip OpenSSH value-taking flags + their values (-o Option=Value, -i key, -P port).
+            if (isScpFamilyBin(bin) &&
                 (SCP_VALUE_FLAGS_LOWER.has(n) ||
                     SCP_VALUE_FLAGS_EXACT.has(raw) ||
                     SCP_VALUE_FLAGS_EXACT.has(n))) {
@@ -953,9 +1085,9 @@ function downloaderDecoderDestinations(tokens) {
                 continue;
             }
             // Attached short: -oPATH / -OPATH (after lowercasing both are -opath…)
-            // Skip for scp (OpenSSH -oOption=Value attached forms are not file dests).
+            // Skip for scp/pscp (OpenSSH -oOption=Value attached forms are not file dests).
             // 7z requires attached -oDIR (#3245).
-            if (bin !== "scp" && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
+            if (!isScpFamilyBin(bin) && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
                 // `-outfile` is PowerShell -OutFile (next token is dest), not attached -outFILE (#3459).
                 if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output") && n !== "-outfile") {
                     dests.push(pathishToken(raw.slice(4)));
@@ -1180,6 +1312,179 @@ function pathishIsProtectedDest(pathish) {
 function isGenericProtectedDestFlag(flag) {
     return DOWNLOADER_FILE_DEST_FLAGS.has(flag) || GENERIC_PROTECTED_EXTRA_DEST_FLAGS.has(flag);
 }
+/** Env-style dest keys harvested even without a leading `--` (`make DESTDIR=`). */
+const DEST_ASSIGNMENT_KEYS = new Set(["destdir", "prefix", "install_root", "dest_dir"]);
+/** Bins whose DESTDIR=/PREFIX= assignment is a dest plant (not `echo DESTDIR=…`). */
+const DEST_ASSIGNMENT_OWNER_BINS = new Set(["make", "gmake"]);
+/**
+ * First-command bins that print/read: a later `make` token is data, not the writer
+ * (`echo DESTDIR=… make`, `git log make DESTDIR=…`). Also the first command of a
+ * search-launcher `-exec` / `-c` payload (`find -exec echo make DESTDIR=`).
+ * Search/launchers themselves are not in this set — `find -exec make DESTDIR=`
+ * still harvests the payload writer.
+ */
+const DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS = new Set([
+    "echo",
+    "printf",
+    "true",
+    "false",
+    ":",
+    "git",
+    "gh",
+    "hg",
+    "svn",
+    "cat",
+    "ls",
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "wc",
+    "diff",
+    "stat",
+    "file",
+]);
+/**
+ * Search/launchers whose first token is not the writer. Harvest make/DESTDIR
+ * only from `-exec` / `--exec` / `-c` payloads (`find -exec make DESTDIR=`).
+ * The payload's first command still uses NON_WRITER (`find -exec echo make`).
+ * `xargs make DESTDIR=` stays a wrapper (not in the non-writer set).
+ */
+const DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS = new Set(["find"]);
+const DEST_ASSIGNMENT_EXEC_PAYLOAD_FLAGS = new Set([
+    "-exec",
+    "--exec",
+    "-execdir",
+    "--execdir",
+    "-c",
+]);
+/** find `-exec` payload terminator (`\;` or `+`). Resets so a later `-exec` is still operative. */
+function isFindExecPayloadTerminator(n) {
+    return n === ";" || n === "+";
+}
+/** make targets that do not apply DESTDIR (avoid denying `make DESTDIR=… clean`). */
+const DEST_ASSIGNMENT_NON_WRITE_TARGETS = new Set([
+    "clean",
+    "distclean",
+    "mostlyclean",
+    "maintainer-clean",
+    "check",
+    "test",
+    "tests",
+    "help",
+]);
+/** make flags that consume the next token (`-C dir`, `-f Makefile`). */
+const MAKE_VALUE_FLAGS = new Set([
+    "-c",
+    "--directory",
+    "-f",
+    "--file",
+    "--makefile",
+    "--include-dir",
+    "-j",
+    "--jobs",
+    "-l",
+    "--load-average",
+    "--eval",
+]);
+/**
+ * True when a DESTDIR/PREFIX assignment is an operative make write.
+ * Looks for make/gmake anywhere after wrappers (including unknown wrappers
+ * such as `xargs`), unless the first command is a print/read bin.
+ * Search/launchers (`find`) still harvest from `-exec` / `--exec` / `-c`
+ * payloads unless that payload's first command is a print/read bin.
+ * Payload state resets at `\;` / `+` so a later `-exec make DESTDIR=` is
+ * still operative (`find -exec echo hi \; -exec make DESTDIR= install`).
+ * Non-writing targets (`clean`) are not operative.
+ */
+function segmentDestAssignmentIsOperative(tokens, tokenIndex) {
+    let start = tokenIndex;
+    while (start > 0 && !tokenEndsShellSegment(tokens[start - 1]))
+        start--;
+    let skipNext = false;
+    let firstCommand = "";
+    let inExecPayload = false;
+    let execPayloadFirstCommand = "";
+    let sawMake = false;
+    const targets = [];
+    for (let k = start; k < tokens.length; k++) {
+        const raw = tokens[k];
+        if (tokenEndsShellSegment(raw))
+            break;
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        const n = normalizeToken(raw);
+        if (inExecPayload && isFindExecPayloadTerminator(n)) {
+            inExecPayload = false;
+            execPayloadFirstCommand = "";
+            continue;
+        }
+        // Print/read `-exec` payload: skip until terminator so a later `-exec` is seen.
+        if (inExecPayload &&
+            execPayloadFirstCommand.length > 0 &&
+            DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(execPayloadFirstCommand)) {
+            continue;
+        }
+        if (n.startsWith("-")) {
+            // find -exec / -c opens the payload; do not consume the next token as a
+            // wrapper value. After make is seen, -C still skips its directory.
+            if (DEST_ASSIGNMENT_EXEC_PAYLOAD_FLAGS.has(n) &&
+                DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS.has(firstCommand) &&
+                !sawMake) {
+                inExecPayload = true;
+                execPayloadFirstCommand = "";
+                continue;
+            }
+            if (!n.includes("=") && (WRAPPER_VALUE_FLAGS.has(n) || MAKE_VALUE_FLAGS.has(n))) {
+                skipNext = true;
+            }
+            continue;
+        }
+        if (isEnvAssign(raw))
+            continue;
+        const bare = writeBinName(raw);
+        if (COMMAND_WRAPPER_BINS.has(bare))
+            continue;
+        if (bare.length > 0 && bare[0] !== undefined && bare[0] >= "0" && bare[0] <= "9") {
+            continue;
+        }
+        if (firstCommand.length === 0) {
+            firstCommand = bare;
+            if (DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(bare))
+                return false;
+        }
+        if (inExecPayload && execPayloadFirstCommand.length === 0) {
+            execPayloadFirstCommand = bare;
+        }
+        if (inExecPayload && DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(execPayloadFirstCommand)) {
+            continue;
+        }
+        if (DEST_ASSIGNMENT_OWNER_BINS.has(bare)) {
+            if (DEST_ASSIGNMENT_SEARCH_LAUNCHER_BINS.has(firstCommand) && !inExecPayload) {
+                continue;
+            }
+            sawMake = true;
+            continue;
+        }
+        if (sawMake)
+            targets.push(n);
+    }
+    if (!sawMake)
+        return false;
+    if (targets.length === 0)
+        return true;
+    for (const t of targets) {
+        if (!DEST_ASSIGNMENT_NON_WRITE_TARGETS.has(t))
+            return true;
+    }
+    return false;
+}
 function isReadShapedInputFileFlag(bin, flag) {
     return READ_SHAPED_FILE_FLAG_BINS.has(bin) && READ_INPUT_FILE_FLAGS.has(flag);
 }
@@ -1208,13 +1513,13 @@ const GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS = new Set([
     "-q",
 ]);
 /**
- * True only when the git *subcommand* (first non-flag token) is a dest writer.
+ * True only when the VCS *subcommand* (first non-flag token) is a dest writer.
  * Later operands named clone/worktree/submodule (e.g. `git log worktree -- …`)
  * are not write subcommands (#3423 residual).
  * Boolean globals (`--no-pager`) do not consume the next token. Other globals
  * consume it even when that token spells a subcommand (#3421 residual).
  */
-function gitHasWriteSubcommand(tokens, start) {
+function hasWriteSubcommand(tokens, start, writeSubs, booleanFlags) {
     let i = start;
     while (i < tokens.length) {
         const raw = tokens[i];
@@ -1222,7 +1527,7 @@ function gitHasWriteSubcommand(tokens, start) {
             return false;
         const n = normalizeToken(raw);
         if (n.startsWith("-")) {
-            if (!n.includes("=") && !GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS.has(n)) {
+            if (!n.includes("=") && !booleanFlags.has(n) && !n.startsWith("--no-")) {
                 const next = tokens[i + 1];
                 if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
                     i += 2;
@@ -1232,10 +1537,46 @@ function gitHasWriteSubcommand(tokens, start) {
             i++;
             continue;
         }
-        return GIT_WRITE_SUBCOMMANDS.has(n);
+        return writeSubs.has(n);
     }
     return false;
 }
+function gitHasWriteSubcommand(tokens, start) {
+    return hasWriteSubcommand(tokens, start, GIT_WRITE_SUBCOMMANDS, GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS);
+}
+/**
+ * True when this git segment is `bundle create` (write), not `bundle verify` / `list-heads`
+ * / `unbundle` (read of an existing bundle) (#3529 Greptile P1).
+ */
+function gitHasBundleCreate(tokens, start) {
+    const nonFlags = [];
+    let i = start;
+    while (i < tokens.length) {
+        const raw = tokens[i];
+        if (isShellSegmentBreak(raw))
+            break;
+        const n = normalizeToken(raw);
+        if (n.startsWith("-")) {
+            if (!n.includes("=") && !GIT_PRE_SUBCOMMAND_BOOLEAN_FLAGS.has(n) && !n.startsWith("--no-")) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+            }
+            i++;
+            continue;
+        }
+        nonFlags.push(n);
+        if (nonFlags.length >= 2)
+            break;
+        i++;
+    }
+    return nonFlags[0] === "bundle" && GIT_BUNDLE_WRITE_SUBCOMMANDS.has(nonFlags[1] ?? "");
+}
+function jjHasWriteSubcommand(tokens, start) {
+    return hasWriteSubcommand(tokens, start, JJ_WRITE_SUBCOMMANDS, JJ_PRE_SUBCOMMAND_BOOLEAN_FLAGS);
+}
 /**
  * True when this forge-CLI segment is a clone dest writer
  * (`gh repo clone`, `glab repo clone`, `hub clone`) (#3459).
@@ -1288,7 +1629,7 @@ function genericProtectedDests(tokens) {
             currentBin = "";
             continue;
         }
-        if (!n.startsWith("-")) {
+        if (!n.startsWith("-") && !isEnvAssign(raw)) {
             if (isDownloaderDecoderBin(raw)) {
                 currentBin = writeBinName(raw);
             }
@@ -1299,8 +1640,22 @@ function genericProtectedDests(tokens) {
                 currentBin = writeBinName(raw);
             }
         }
-        if (currentBin === "scp" || currentBin === "cpio")
+        if (isScpFamilyBin(currentBin) || currentBin === "cpio")
             continue;
+        // Env-style dest assignments (`DESTDIR=`, `PREFIX=`) without a leading dash (#3545).
+        if (n.includes("=") && !n.startsWith("-")) {
+            const eq = raw.indexOf("=");
+            const keyRaw = raw.slice(0, eq);
+            if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(keyRaw)) {
+                const key = normalizeToken(keyRaw);
+                if (DEST_ASSIGNMENT_KEYS.has(key) && segmentDestAssignmentIsOperative(tokens, i)) {
+                    const dest = pathishToken(raw.slice(eq + 1));
+                    if (pathishIsProtectedDest(dest))
+                        dests.push(dest);
+                }
+            }
+            continue;
+        }
         if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
             const eq = raw.indexOf("=");
             const flag = normalizeToken(raw.slice(0, eq));
@@ -1311,6 +1666,17 @@ function genericProtectedDests(tokens) {
             }
             continue;
         }
+        // Named dest flags (`-Destination`, `--output-dir`) take the next token.
+        // Check before attached `-oDIR` / `-dDIR` so `-destination` is not `-d` + `estination`.
+        if (isGenericProtectedDestFlag(n) && !isReadShapedInputFileFlag(currentBin, n)) {
+            const next = tokens[i + 1];
+            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                const dest = pathishToken(next);
+                if (pathishIsProtectedDest(dest))
+                    dests.push(dest);
+            }
+            continue;
+        }
         if (n.startsWith("-") &&
             !n.startsWith("--") &&
             n.startsWith("-o") &&
@@ -1325,15 +1691,6 @@ function genericProtectedDests(tokens) {
             const dest = pathishToken(raw.slice(2));
             if (pathishIsProtectedDest(dest))
                 dests.push(dest);
-            continue;
-        }
-        if (isGenericProtectedDestFlag(n) && !isReadShapedInputFileFlag(currentBin, n)) {
-            const next = tokens[i + 1];
-            if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
-                const dest = pathishToken(next);
-                if (pathishIsProtectedDest(dest))
-                    dests.push(dest);
-            }
         }
     }
     return dests;
@@ -1497,20 +1854,39 @@ function isProgrammaticWriteBinToken(token) {
         bare === "nodejs" ||
         bare === "perl" ||
         bare === "ruby" ||
+        bare === "jruby" ||
+        bare === "pypy" ||
+        bare === "pypy3" ||
         bare === "pwsh" ||
         bare === "powershell" ||
         bare === "tsx" ||
         bare === "ts-node" ||
-        bare === "tsnode") {
+        bare === "tsnode" ||
+        bare === "bun" ||
+        bare === "deno" ||
+        bare === "php" ||
+        bare === "lua" ||
+        bare === "luajit") {
         return true;
     }
-    // Versioned: python3.11, python3.12, node18, …
+    // Versioned: python3.11, python3.12, node18, php8.3, lua5.4, …
     if (bare.startsWith("python3.") || bare.startsWith("python2."))
         return true;
     if (/^python\d+(\.\d+)*$/.test(bare))
         return true;
     if (/^node\d+$/.test(bare))
         return true;
+    if (/^php\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (/^lua\d+(\.\d+)*$/.test(bare))
+        return true;
+    // #3545 residual: versioned ruby / jruby / pypy (bare `ruby` already matched).
+    if (/^ruby\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (/^jruby\d+(\.\d+)*$/.test(bare))
+        return true;
+    if (bare.startsWith("pypy3.") || /^pypy\d+(\.\d+)*$/.test(bare))
+        return true;
     return false;
 }
 /**
@@ -1518,6 +1894,74 @@ function isProgrammaticWriteBinToken(token) {
  * Escaped quotes (`\'` / `\"`) stay inside the string. Used so `print('.write(')` is not
  * a write API while `open(p,'w').write('x')` still matches `.write(` (Greptile conf residual).
  */
+/**
+ * True when `ident` is followed by optional whitespace then `(` (PHP `file_put_contents (`).
+ * Skips matches inside quotes so `echo "file_put_contents ($x)"` is not a write.
+ * O(n) — no nested-quantifier regex.
+ */
+function includesIdentCall(haystack, ident) {
+    if (ident.length === 0 || haystack.length < ident.length)
+        return false;
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < haystack.length; i++) {
+        const c = haystack[i];
+        if (c === "\\" && i + 1 < haystack.length && (inSingle || inDouble)) {
+            i++;
+            continue;
+        }
+        if (c === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (c === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (!haystack.startsWith(ident, i))
+            continue;
+        let j = i + ident.length;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t" || w === "\n" || w === "\r") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j < haystack.length && haystack[j] === "(")
+            return true;
+    }
+    return false;
+}
+/** Strip matching wrapping quotes from a `-r`/`-e` payload. */
+function unwrapQuotedPayload(token) {
+    if (token.length >= 2) {
+        const a = token[0];
+        const b = token[token.length - 1];
+        if ((a === '"' && b === '"') || (a === "'" && b === "'")) {
+            return token.slice(1, -1);
+        }
+    }
+    return token;
+}
+/** Script bodies after interpreter `-r`/`-e`/`-c` (PHP/node one-liners). */
+function interpreterScriptPayloads(tokens) {
+    const out = [];
+    const flags = new Set(["-r", "-e", "-c", "--run", "--eval", "--execute"]);
+    for (let i = 0; i < tokens.length; i++) {
+        const n = normalizeToken(tokens[i]);
+        if (!flags.has(n))
+            continue;
+        const next = tokens[i + 1];
+        if (next === undefined || isShellSegmentBreak(next) || String(next).startsWith("-"))
+            continue;
+        out.push(unwrapQuotedPayload(next));
+    }
+    return out;
+}
 function includesOutsideQuotes(haystack, needle) {
     if (needle.length === 0 || haystack.length < needle.length)
         return false;
@@ -1544,6 +1988,85 @@ function includesOutsideQuotes(haystack, needle) {
     }
     return false;
 }
+/**
+ * Perl `open F,">dest"` / `open FH, '>'` without parens (#3545).
+ * Quote-aware so `print 'open F,>'` is not a write. O(n).
+ */
+function hasPerlBareOpenWrite(haystack) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < haystack.length; i++) {
+        const c = haystack[i];
+        if (c === "\\" && i + 1 < haystack.length && (inSingle || inDouble)) {
+            i++;
+            continue;
+        }
+        if (c === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (c === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (!haystack.startsWith("open", i))
+            continue;
+        if (i > 0) {
+            const prev = haystack[i - 1];
+            if ((prev >= "a" && prev <= "z") || (prev >= "0" && prev <= "9") || prev === "_")
+                continue;
+        }
+        let j = i + 4;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t" || w === "\n" || w === "\r") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        const identStart = j;
+        while (j < haystack.length) {
+            const ch = haystack[j];
+            if ((ch >= "a" && ch <= "z") ||
+                (ch >= "A" && ch <= "Z") ||
+                (ch >= "0" && ch <= "9") ||
+                ch === "_") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j === identStart)
+            continue;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        if (j >= haystack.length || haystack[j] !== ",")
+            continue;
+        j++;
+        while (j < haystack.length) {
+            const w = haystack[j];
+            if (w === " " || w === "\t") {
+                j++;
+                continue;
+            }
+            break;
+        }
+        const q = haystack[j];
+        if ((q === "'" || q === '"') && j + 1 < haystack.length && haystack[j + 1] === ">") {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * True when command uses a programmatic bin with a **write** API, optionally with
  * path-obfuscation markers (base64/bytes/chr). Pure reads / print-only stay unclassifiable.
@@ -1574,6 +2097,8 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
     const writeApi = lower.includes("writefilesync") ||
         lower.includes("writefile") ||
         lower.includes("writetext") ||
+        includesIdentCall(lower, "file_put_contents") ||
+        interpreterScriptPayloads(tokens).some((p) => includesIdentCall(p.toLowerCase(), "file_put_contents")) ||
         lower.includes("set-content") ||
         lower.includes("out-file") ||
         lower.includes("fs.write") ||
@@ -1581,6 +2106,17 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
         lower.includes("path.write(") ||
         lower.includes("file.write(") ||
         lower.includes("spurt") ||
+        interpreterScriptPayloads(tokens).some((p) => {
+            const pl = p.toLowerCase();
+            return (includesIdentCall(pl, "write_file") ||
+                includesIdentCall(pl, "spew") ||
+                includesOutsideQuotes(pl, "->spew") ||
+                hasPerlBareOpenWrite(pl));
+        }) ||
+        includesIdentCall(lower, "write_file") ||
+        includesIdentCall(lower, "spew") ||
+        includesOutsideQuotes(lower, "->spew") ||
+        hasPerlBareOpenWrite(lower) ||
         lower.includes(">>") ||
         lower.includes("unlink(") ||
         lower.includes("rmsync") ||
@@ -1618,7 +2154,13 @@ function hasWriteCapableProgrammaticShell(command, tokens) {
             lower.includes("mode='a") ||
             lower.includes('mode="a') ||
             lower.includes("mode=w"));
-    const writeish = writeApi || openWriteMode;
+    // Perl `open F,">dest"` — `open(` is absent; `-e` payloads with spaces split tokens (#3545).
+    const perlBareOpenWrite = (lower.includes("open ") || lower.includes("open\t")) &&
+        (lower.includes(",'>") ||
+            lower.includes(',">') ||
+            lower.includes(", '>") ||
+            lower.includes(', ">'));
+    const writeish = writeApi || openWriteMode || perlBareOpenWrite;
     // Path construction that hides the destination from literal classifiers.
     const obfuscatedPath = lower.includes("base64") ||
         lower.includes("fromcharcode") ||
@@ -1833,6 +2375,29 @@ const INDIRECT_WRITE_BINS = new Set([
     "touch",
     "tsx",
     "ts-node",
+    // #3529 residual: Windows dest writers / rename / moreutils sponge / runtimes.
+    "xcopy",
+    "robocopy",
+    "move",
+    "ren",
+    "rename",
+    "rename-item",
+    "sponge",
+    "bun",
+    "deno",
+    "php",
+    "lua",
+    "start-bitstransfer",
+    "bitsadmin",
+    "expand-archive",
+    "tee-object",
+    "export-csv",
+    "expand",
+    "extrac32",
+    "makecab",
+    "replace",
+    // #3545 residual: dest writers (fromdos/degit/ddrescue). dpkg/pdftk/gs stay dest-flag gated.
+    ...UAT_RESIDUAL_INPLACE_WRITE_BINS_3545,
 ]);
 /**
  * O(n): true when command expands `$…` / `` `…` `` / `%VAR%`
@@ -2035,15 +2600,7 @@ function hasProgrammaticAuthzEnvWrite(command, tokens) {
     const lower = command.toLowerCase();
     let hasProg = false;
     for (const t of tokens) {
-        const n = normalizeToken(t);
-        if (n === "python" ||
-            n === "python3" ||
-            n === "node" ||
-            n === "nodejs" ||
-            n === "perl" ||
-            n === "ruby" ||
-            n === "pwsh" ||
-            n === "powershell") {
+        if (isProgrammaticWriteBinToken(t)) {
             hasProg = true;
             break;
         }