safe-chains 0.219.1

# Path-operand gate (adversarial-review audit fix).
#
# The engine gates its 15 resolved commands' file reads/writes by locus (HP-20). The ~1600
# LEGACY commands are a parallel surface: a content-reader like `od`/`base64`/`diff` or a
# writer like `tee`/`shred` takes a file operand but its handler never checks the operand's
# locus — so `base64 ~/.ssh/id_rsa` exfiltrates a key and `shred /etc/hosts` destroys a system
# file, both without a prompt.
#
# This lists the legacy commands that READ or WRITE their path operands' content. A
# cross-cutting gate (`pathgate::should_deny`, called from `handlers::dispatch`) then denies
# any `looks_like_path` operand whose read/write locus is sensitive — the same locus gate the
# engine applies, retrofitted onto legacy commands by name.
#
# NOT here: metadata-only commands (`ls`, `stat`, `file`, `readlink`, `du`, `find`) — they
# reveal names/sizes, not content, and legitimately walk system paths. And `awk`, whose regex
# programs contain `/` and `$` (they'd false-positive) — it is gated in its own handler, which
# knows the program from the files. Commands that read STDIN only (`tr`) are not readers.
#
# A path operand appearing here is gated even if the command's own handler already allowed it.
# Adding a command is safe (over-gating a non-path arg is a no-op; a system path denies).

# ── Commands that READ their file operands' content → gated by read locus ──────────────────
read = [
  # hex / binary / text dumps
  "od", "xxd", "hexdump", "hd", "strings", "tac", "nl", "rev", "fold", "fmt",
  # (csplit is gated via [roles.csplit] below — first positional only, so its `/regex/`
  #  split-patterns are not misread as paths.)
  "expand", "unexpand", "colrm", "pr", "col", "column",
  # pagers / viewers
  "less", "more", "most", "bat", "cat",
  # field / column / line tools
  "cut", "paste", "join", "comm", "sort", "uniq", "tsort", "ptx", "shuf", "numsum", "datamash",
  # encoding / format converters (read a file, emit transformed content)
  "iconv", "recode", "pv", "pandoc", "xmllint", "xmlstarlet",
  # CSV / structured-data tools (their positional after flags is a file)
  "xsv", "qsv", "mlr", "csvtool", "jaq", "gojq", "pup", "yj",
  # diff family
  "diff", "diff3", "sdiff", "colordiff", "delta", "difft", "cmp",
  # encoders / structured-data query (their FILTER positional classifies worktree, harmless)
  "base64", "base32", "basenc", "jq", "yq", "xq", "tomlq", "dasel", "gron", "htmlq", "fx", "jless",
  # crypto tools that read a key/cert/data file via a path arg (`openssl rsa -in ~/.ssh/id_rsa`)
  "openssl",
  # checksums / hashes (disclose a hash of the secret)
  "md5", "md5sum", "sha1sum", "sha224sum", "sha256sum", "sha384sum", "sha512sum",
  "shasum", "cksum", "sum", "b2sum", "b3sum", "xxhsum", "rhash",
  # compressed-content viewers
  "zcat", "gzcat", "bzcat", "xzcat", "lzcat", "zstdcat", "zless", "bzless", "xzless", "zmore",
]

# ── grep-like tools: `CMD [flags] PATTERN [flags] files…` — gate the FILE operands, skipping
#    the first positional (the PATTERN, which may itself be a `/regex/`). Same shape as `awk`,
#    which is gated in its own handler. (Plain `grep`/`sed` are the engine's job.)
read_after_first = ["rg", "ag", "ack", "ugrep", "sift", "pt"]

# ── Commands that WRITE / modify / destroy their file operands → gated by write locus ──────
# (Every positional is a write-target. Tools whose args play mixed roles — an output flag, a
#  URL, an identity, a transcode input — are in [roles.*] below, not here.)
write = [
  "tee", "shred", "sponge", "truncate",
  # file/node creators + single-file removers: the positional is the path they create/destroy.
  # (`gtruncate`/`gunlink`/`gmknod` are standalone GNU-form commands, not aliases, so they're
  #  listed by their own names; `mkfifo`/`gmkfifo` share a spec via the alias map.)
  "mkfifo", "gmkfifo", "mknod", "gmknod", "unlink", "gunlink", "gtruncate",
  # in-place (re)compressors / optimizers that rewrite the file in its directory
  "bzip2", "xz", "lzma", "zstd", "lz4", "brotli", "compress", "zip",
  "pigz", "unpigz", "pbzip2", "plzip", "lzip", "optipng", "jpegoptim",
  # sox: its output is a positional but EFFECTS follow it (`sox in out reverb`), so last_write
  # can't find the output — gate every positional as a write. Cost: a home INPUT prompts (grant
  # its dir to allow); effect args (`reverb`, `0.5`) aren't paths, so they're harmless.
  "sox",
  # archivers / sync that write extracted files by path (`7z a /etc/x.7z`, `cpio -F /etc/x`,
  # `unzip -p ~/.ssh/id_rsa`). A remote spec (`host:/path`) classifies worktree.
  "7z", "7za", "7zr", "cpio", "unzip",
  # other HTTP downloaders (curl/wget have richer grammars in [roles.*]). The blanket write
  # gate catches a `-o`/`-d`/`-P` path into a sensitive locus; a URL classifies worktree.
  "aria2c", "http", "https", "xh", "httpie",
]

# ── Argument-role grammar: tools whose path arguments take DIFFERENT roles by flag/position,
#    so a flat read/write list mis-gates them. `positional` is the role of bare operands
#    (read | write | ignore); `flags` maps a path-bearing flag to its value's role; `shape`
#    (plain | skip_first | last_write | remote) adjusts the positional policy. The walker in
#    pathgate.rs interprets these. Role assignment is authored per the tool's real semantics. ──

# HTTP downloaders: the URL operand is gated by read locus, but the locus layer is scheme-aware
# — a network URL admits (so `curl https://x/a/../b` does NOT false-deny on the `..`) and a
# `file:` URL classifies the local path it names (so `curl file:///etc/shadow` denies). The
# output flag writes.
[roles.curl]
positional = "read"
flags = { "-o" = "write", "--output" = "write", "--output-dir" = "write" }

[roles.wget]
positional = "ignore"
flags = { "-o" = "write", "-O" = "write", "--output-document" = "write", "-P" = "write", "--directory-prefix" = "write", "--save-cookies" = "write", "--warc-file" = "write", "--warc-tempdir" = "write", "--post-file" = "read", "-i" = "read", "--input-file" = "read" }

# Remote copy/sync: a LOCAL source is a disclosing read (exfil), the destination is a write, a
# `host:path` endpoint is ignored (remote writes are the tool's own concern), and an `-i`
# identity / `-F` config / `-o` option / `-J` jump is auth plumbing, never a target.
[roles.scp]
positional = "read"
shape = "remote"
flags = { "-i" = "ignore", "-F" = "ignore", "-o" = "ignore", "-J" = "ignore", "-S" = "ignore" }

[roles.sftp]
positional = "read"
shape = "remote"
flags = { "-i" = "ignore", "-F" = "ignore", "-o" = "ignore", "-J" = "ignore", "-S" = "ignore", "-b" = "read" }

[roles.rsync]
positional = "read"
shape = "remote"
flags = { "-e" = "ignore", "--rsh" = "ignore" }

# Converters whose OUTPUT is the last positional: the input is a non-disclosing transcode
# (ignore, so a home input like ~/Downloads/x still allows), the last operand is the write.
[roles.magick]
positional = "ignore"
shape = "last_write"
[roles.convert]
positional = "ignore"
shape = "last_write"
[roles.ffmpeg]
positional = "ignore"
shape = "last_write"
[roles.pdftotext]
positional = "ignore"
shape = "last_write"
[roles.pdftocairo]
positional = "ignore"
shape = "last_write"
[roles.pdftoppm]
positional = "ignore"
shape = "last_write"
[roles.pdfimages]
positional = "ignore"
shape = "last_write"
[roles.pdfseparate]
positional = "ignore"
shape = "last_write"
[roles.qpdf]
positional = "ignore"
shape = "last_write"
[roles.pdftk]
positional = "ignore"
shape = "last_write"

# Converters whose OUTPUT is a flag (input is the positional → ignore).
[roles.cwebp]
positional = "ignore"
flags = { "-o" = "write", "--output" = "write" }
[roles.mutool]
positional = "ignore"
flags = { "-o" = "write", "-O" = "write" }

# Key / crypto tools with an identity flag: the `-f` key or `-o` output is a write; an `-i`
# identity is auth plumbing (ignore), and the input/recipients are non-disclosing (ignore).
[roles.ssh-keygen]
positional = "ignore"
flags = { "-f" = "write" }
[roles.age]
positional = "ignore"
flags = { "-o" = "write", "--output" = "write", "-i" = "ignore", "--identity" = "ignore" }

# pl (macOS plist checker): --input reads a file, --output writes the normalized form. Inert, but
# both flag values are real paths, so a system-path read/write must gate.
[roles.pl]
positional = "ignore"
flags = { "--input" = "read", "--output" = "write" }

# csplit FILE /regex/… — the FIRST positional is the input FILE (a disclosing read); the
# trailing `/regex/` split-patterns are positionals that look like absolute paths, so only the
# first is gated (`first_only`). Chunk files are written under the `-f` prefix (a write-target).
[roles.csplit]
positional = "read"
shape = "first_only"
flags = { "-f" = "write", "--prefix" = "write" }

# NOT here yet (documented follow-ups — policy calls, not detection):
#   disclosure inspectors pdfinfo/pdffonts/ffprobe/mediainfo/exiftool (read-gating over-denies
#   home-file inspection — a separate "should we gate metadata reads" decision); converter
#   stdout disclosure (`pdftotext ~/x.pdf -`) and file:-protocol inputs, both consequences of
#   the ignore-input policy that lets home transcodes through.
[roles."aclocal"]
flags = { "--output" = "write" }

[roles."afconvert"]
flags = { "-o" = "write" }

[roles."ameba"]
flags = { "--out" = "write" }

[roles."applesingle"]
flags = { "--directory" = "write", "--rename" = "write", "-C" = "write", "-o" = "write" }

[roles."autoconf"]
flags = { "--output" = "write", "-o" = "write" }

[roles."autom4te"]
flags = { "--output" = "write", "-o" = "write" }

[roles."automake"]
flags = { "-o" = "write" }

[roles."avbcapture"]
flags = { "--output" = "write", "-o" = "write" }

[roles."avconvert"]
flags = { "--output" = "write", "-o" = "write" }

[roles."b64decode"]
flags = { "-o" = "write" }

[roles."b64encode"]
flags = { "-o" = "write" }

[roles."bandit"]
flags = { "--output" = "write", "-o" = "write" }

[roles."binhex"]
flags = { "--directory" = "write", "--rename" = "write", "-C" = "write", "-o" = "write" }

[roles."binhex.pl"]
flags = { "-o" = "write" }

[roles."bintrans"]
flags = { "-o" = "write" }

[roles."bison"]
flags = { "--file-prefix" = "write", "--output" = "write", "--output-file" = "write", "-b" = "write", "-o" = "write" }

[roles."bitcode_strip"]
flags = { "-o" = "write" }

[roles."brakeman"]
flags = { "--output" = "write", "-o" = "write" }

[roles."bsqldb"]
flags = { "-e" = "write", "-i" = "read", "-o" = "write" }

[roles."bsqlodbc"]
flags = { "-o" = "write" }

[roles."byacc"]
flags = { "-H" = "write", "-b" = "write", "-o" = "write" }

[roles."cloc"]
flags = { "--out" = "write", "--report-file" = "write", "--sql" = "write", "--write-lang-def" = "write" }

[roles."codesign_allocate"]
flags = { "-i" = "read", "-o" = "write" }

[roles."compression_tool"]
flags = { "-i" = "read", "-o" = "write" }

[roles."coqc"]
flags = { "-o" = "write" }

[roles."ctf_insert"]
flags = { "-o" = "write" }

[roles."cucumber"]
flags = { "--out" = "write", "-o" = "write" }

[roles."debinhex.pl"]
flags = { "-o" = "write" }

[roles."defncopy"]
flags = { "-i" = "read", "-o" = "write" }

[roles."deptry"]
flags = { "--json-output" = "write", "-o" = "write" }

[roles."dotnet-symbol"]
flags = { "--output" = "write", "-o" = "write" }

[roles."dsymutil"]
flags = { "--out" = "write", "-o" = "write" }

[roles."dwarfdump"]
flags = { "-o" = "write" }

[roles."dwebp"]
flags = { "-o" = "write" }

[roles."ecpg"]
flags = { "-o" = "write" }

[roles."eleventy"]
flags = { "--output" = "write" }

[roles."eslint"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."eyapp"]
flags = { "-o" = "write" }

[roles."fantomas"]
flags = { "--out" = "write" }

[roles."fax2ps"]
flags = { "-o" = "write" }

[roles."fax2tiff"]
flags = { "-o" = "write" }

[roles."flex"]
flags = { "--header-file" = "write", "--outfile" = "write", "--skel" = "read", "--tables-file" = "write", "-S" = "read", "-o" = "write" }

[roles."frames"]
flags = { "--assets" = "read", "--output" = "write", "--subfolder" = "write", "-o" = "write" }

[roles."gcore"]
flags = { "-c" = "write", "-o" = "write" }

[roles."gen_bridge_metadata"]
flags = { "--exception" = "read", "--framework" = "read", "--output" = "write", "-e" = "read", "-f" = "read", "-o" = "write" }

[roles."genstrings"]
flags = { "-o" = "write" }

[roles."gif2webp"]
flags = { "-o" = "write" }

[roles."gifsicle"]
flags = { "--output" = "write", "--use-colormap" = "read", "-o" = "write" }

[roles."gosec"]
flags = { "--out" = "write", "-out" = "write" }

[roles."grype"]
flags = { "--file" = "write", "--output" = "write", "-o" = "write" }

[roles."headerdoc2html"]
flags = { "-o" = "write" }

[roles."heif-dec"]
flags = { "--output" = "write", "-o" = "write" }

[roles."heif-enc"]
flags = { "--output" = "write", "-o" = "write" }

[roles."hurl"]
flags = { "--output" = "write", "-o" = "write" }

[roles."ibtool"]
flags = { "--write" = "write" }

[roles."img2webp"]
flags = { "-o" = "write" }

[roles."iperf3"]
flags = { "-o" = "write" }

[roles."jasper"]
flags = { "--output" = "write", "-F" = "write" }

[roles."jbig2dec"]
flags = { "--output" = "write", "-o" = "write" }

[roles."jpgicc"]
shape = "last_write"
flags = { "-o" = "read" }

[roles."jupyter-nbconvert"]
flags = { "--output" = "write" }

[roles."jupytext"]
flags = { "--output" = "write", "-o" = "write" }

[roles."layerutil"]
flags = { "--output" = "write", "-o" = "write" }

[roles."ld"]
flags = { "-o" = "write" }

[roles."lesskey"]
flags = { "--output" = "write", "-o" = "write" }

[roles."libtool"]
flags = { "-filelist" = "read", "-o" = "write" }

[roles."license-checker"]
flags = { "--files" = "write", "--out" = "write" }

[roles."linkicc"]
flags = { "-o" = "write" }

[roles."lockstat"]
flags = { "-o" = "write" }

[roles."macbinary"]
flags = { "--directory" = "write", "--rename" = "write", "-C" = "write", "-o" = "write" }

[roles."markdownlint"]
flags = { "--output" = "write", "-o" = "write" }

[roles."marp"]
flags = { "--output" = "write", "-o" = "write" }

[roles."mongodump"]
flags = { "--archive" = "write", "--out" = "write", "-o" = "write" }

[roles."mongoexport"]
flags = { "--out" = "write", "-o" = "write" }

[roles."msgattrib"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgcat"]
flags = { "-o" = "write" }

[roles."msgcomm"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgconv"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgen"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgfmt"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msggrep"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msginit"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgmerge"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msgunfmt"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."msguniq"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."nano"]
flags = { "--backupdir" = "write", "--operatingdir" = "write", "-C" = "write", "-o" = "write" }

[roles."nmedit"]
flags = { "-o" = "write" }

[roles."ocamlformat"]
flags = { "--output" = "write", "-o" = "write" }

[roles."opj_compress"]
flags = { "-o" = "write" }

[roles."opj_decompress"]
flags = { "-o" = "write" }

[roles."opj_dump"]
flags = { "-o" = "write" }

[roles."pdfdetach"]
flags = { "-o" = "write" }

[roles."pdfjam"]
flags = { "--builddir" = "write", "--outfile" = "write", "-o" = "write" }

[roles."pg_combinebackup"]
flags = { "--output" = "write", "--tablespace-mapping" = "write", "-T" = "write", "-o" = "write" }

[roles."pip-audit"]
flags = { "--output" = "write", "-o" = "write" }

[roles."pngquant"]
flags = { "--output" = "write", "-o" = "write" }

[roles."pp"]
flags = { "--output" = "write", "-o" = "write" }

[roles."psicc"]
flags = { "-o" = "read" }

[roles."qlmanage"]
flags = { "-o" = "write" }

[roles."racc"]
flags = { "--log-file" = "write", "--output-file" = "write", "-O" = "write", "-o" = "write" }

[roles."raw2tiff"]
flags = { "-o" = "write" }

[roles."rdoc"]
flags = { "--op" = "write", "-o" = "write" }

[roles."re2c"]
flags = { "--depfile" = "write", "--header" = "write", "--include" = "read", "--output" = "write", "--type-header" = "write", "-I" = "read", "-o" = "write", "-t" = "write" }

[roles."rex"]
flags = { "--output-file" = "write", "-o" = "write" }

[roles."rollup"]
flags = { "--dir" = "write", "--file" = "write", "--sourcemapFile" = "write", "-d" = "write", "-o" = "write" }

[roles."rspec"]
flags = { "--deprecation-out" = "write", "--out" = "write", "-o" = "write" }

[roles."rubocop"]
flags = { "--out" = "write", "-o" = "write" }

[roles."say"]
flags = { "-o" = "write" }

[roles."sdp"]
flags = { "-i" = "read", "-o" = "write" }

[roles."solc"]
flags = { "-o" = "write" }

[roles."sops"]
flags = { "--output" = "write" }

[roles."spindump"]
flags = { "-i" = "read", "-microstackshots_datastore" = "write", "-microstackshots_dsc_path" = "read", "-o" = "write" }

[roles."stackprof"]
flags = { "--out" = "write" }

[roles."standardrb"]
flags = { "--out" = "write", "-o" = "write" }

[roles."strip"]
flags = { "-o" = "write" }

[roles."stylelint"]
flags = { "-o" = "write" }

[roles."terraform-docs"]
flags = { "--output" = "write", "--output-file" = "write" }

[roles."tfsec"]
flags = { "--out" = "write", "-O" = "write" }

[roles."tidy"]
flags = { "-f" = "write", "-file" = "write", "-o" = "write", "-output" = "write" }

[roles."tiff2pdf"]
flags = { "-o" = "write" }

[roles."tiff2ps"]
flags = { "-O" = "write" }

[roles."tificc"]
shape = "last_write"
flags = { "-o" = "read" }

[roles."transicc"]
flags = { "-o" = "read" }

[roles."typedoc"]
flags = { "--out" = "write" }

[roles."typeprof"]
flags = { "-o" = "write" }

[roles."uconv"]
flags = { "--output" = "write", "-o" = "write" }

[roles."unbrotli"]
flags = { "--output" = "write", "-o" = "write" }

[roles."unifdef"]
flags = { "-o" = "write" }

[roles."usdcat"]
flags = { "--out" = "write", "-o" = "write" }

[roles."usdchecker"]
flags = { "--out" = "write", "-o" = "write" }

[roles."usdcrush"]
flags = { "--out" = "write", "-o" = "write" }

[roles."usdextract"]
flags = { "--out" = "write", "-o" = "write" }

[roles."uudecode"]
flags = { "-o" = "write" }

[roles."uuencode"]
flags = { "-o" = "write" }

[roles."wasm2wat"]
flags = { "--output" = "write", "-o" = "write" }

[roles."wat2wasm"]
flags = { "--output" = "write", "-o" = "write" }

[roles."webpmux"]
flags = { "-o" = "write" }

[roles."xgettext"]
flags = { "--output" = "write", "-o" = "write" }

[roles."xgettext.pl"]
flags = { "--output" = "write", "-o" = "write" }

[roles."xsltproc"]
flags = { "--output" = "write", "-o" = "write" }

[roles."yacc"]
flags = { "-H" = "write", "-b" = "write", "-o" = "write" }

[roles."yapp"]
flags = { "-o" = "write" }

[roles."yt-dlp"]
flags = { "--output" = "write", "-o" = "write" }

[roles."ytt"]
flags = { "--dangerous-emptied-output-directory" = "write", "--output-directory" = "write", "--output-files" = "write", "--output-multi-files" = "write" }

[roles."djpeg"]
flags = { "-o" = "write" }

[roles."swc"]
flags = { "-o" = "write", "--out-dir" = "write" }

[roles."syft"]
flags = { "-o" = "write", "--output" = "write" }

[roles."vyper"]
flags = { "-o" = "write" }

[roles."shfmt"]
flags = { "-w" = "write", "--write" = "write" }
[roles."weasyprint"]
shape = "last_write"

[roles."tiffcp"]
shape = "last_write"

# ── Adversarial-review residual follow-ups: handler/sub output flags, output-dirs, and positional
#    last-arg writers the flag-focused output-flag sweep did not reach. ────────────────────────────
[roles."gs"]
flags = { "-o" = "write" }

[roles."mkdocs"]
flags = { "-d" = "write", "--site-dir" = "write" }

[roles."pdfunite"]
shape = "last_write"

[roles."ps2pdf"]
shape = "last_write"

[roles."pdf2ps"]
shape = "last_write"

[roles."pdftops"]
shape = "last_write"

[roles."sphinx-build"]
shape = "last_write"

[roles."pdfcrop"]
shape = "last_write"

[roles."lame"]
shape = "last_write"

[roles."cargo"]
flags = { "--target-dir" = "write", "--out-dir" = "write" }

[roles."webpack"]
flags = { "-o" = "write", "--output-path" = "write" }

[roles."vite"]
flags = { "--outDir" = "write" }

[roles."esbuild"]
flags = { "--outdir" = "write", "--outfile" = "write" }

[roles."tsup"]
flags = { "--out-dir" = "write", "-d" = "write" }

[roles."cjxl"]
shape = "last_write"

# Positional last-arg CONVERTERS surfaced by `positional_last_arg_writers_are_gated_or_acknowledged`:
# each reads an input and writes its output to the LAST positional (`<in> <out>`), so a sensitive
# last positional (`~/.ssh/authorized_keys`, `.git/hooks/…`) must not be an auto-approved write.
# Ghostscript wrapper scripts (`in.[e]ps out.pdf`):
[roles."dvipdf"]
shape = "last_write"
[roles."eps2eps"]
shape = "last_write"
[roles."pdf2dsc"]
shape = "last_write"
[roles."pfbtopfa"]
shape = "last_write"
[roles."ps2epsi"]
shape = "last_write"
[roles."ps2pdf12"]
shape = "last_write"
[roles."ps2pdf13"]
shape = "last_write"
[roles."ps2pdf14"]
shape = "last_write"
[roles."ps2pdfwr"]
shape = "last_write"
[roles."ps2ps"]
shape = "last_write"
# libtiff converters (`in.tif out.tif` — tiffcrop's own docs call the last arg the destination):
[roles."pal2rgb"]
shape = "last_write"
[roles."ppm2tiff"]
shape = "last_write"
[roles."rgb2ycbcr"]
shape = "last_write"
[roles."thumbnail"]
shape = "last_write"
[roles."tiff2bw"]
shape = "last_write"
[roles."tiff2icns"]
shape = "last_write"
[roles."tiff2rgba"]
shape = "last_write"
[roles."tiffcrop"]
shape = "last_write"
[roles."tiffdither"]
shape = "last_write"
[roles."tiffmedian"]
shape = "last_write"
# (Little CMS jpgicc/tificc gain shape=last_write merged into their existing -o=read blocks below;
#  psicc's output is its already-gated -o flag, so it is a non-writer acknowledged on the worklist.)
# Misc converters whose output is the last positional:
[roles."heif-thumbnailer"]
shape = "last_write"
[roles."wkhtmltopdf"]
shape = "last_write"
[roles."usdrecord"]
shape = "last_write"
[roles."gdbm_dump"]
shape = "last_write"
[roles."gdbm_load"]
shape = "last_write"
# Package builders whose output archive is the last positional (`pkgbuild [opts] out.pkg`):
[roles."pkgbuild"]
shape = "last_write"
[roles."productbuild"]
shape = "last_write"
# In-place binary/text mutators and in→out rewriters: the file they rewrite is the last positional
# (or their sole positional), so an out-of-workspace target must gate. `last_write` covers both the
# `in out` and single-file in-place forms (the sole positional is the last).
[roles."llvm-objcopy"]
shape = "last_write"
[roles."llvm-strip"]
shape = "last_write"
[roles."wasm-strip"]
shape = "last_write"
[roles."install_name_tool"]
shape = "last_write"
[roles."indent"]
shape = "last_write"
[roles."resolveLinks"]
shape = "last_write"
[roles."PlistBuddy"]
shape = "last_write"
[roles."initdb"]
shape = "last_write"
[roles."gatherheaderdoc"]
shape = "last_write"
# Multi-file in-place mutators: EVERY positional is rewritten in place, so `last_write` (which gates
# only the final arg) would miss the others — gate every positional as a write.
[roles."nbstripout"]
positional = "write"
[roles."afscexpand"]
positional = "write"

# ── Operation-aware gates (the archive/mode selector decides read vs write; see pathgate::handlers).
#    r/q/d/m/s write the .a, t/p/x read it — matters at an in-workspace protected path (.git/config:
#    readable, write-denied), where an all-write gate would over-deny the read ops.
[roles."ar"]
handler = "ar_archive"
[roles."emar"]
handler = "ar_archive"
[roles."llvm-ar"]
handler = "ar_archive"
# textutil -convert/-strip write (a sibling of each input, or -output/-outputdir); -info/-cat read.
[roles."textutil"]
handler = "textutil_mode"

# ── Derived-output writers: the output is a SIBLING of the input (same directory), so write-gating
#    the input path is locus-equivalent to gating the sibling. No read mode, so a plain write gate.
[roles."cap_mkdb"]
positional = "write"
[roles."znew"]
positional = "write"
[roles."pl2pm"]
positional = "write"

# ── Scaffolders: a scaffolder CREATEs inert code into a named target directory. That write is local
#    SafeWrite, but the target must stay in the workspace — a scaffold into ~/.ssh or an arbitrary
#    out-of-workspace dir is out of scope. Gate the target dir; the inert-code create stays SafeWrite.
[roles."create-next-app"]
positional = "write"
[roles."create-react-app"]
positional = "write"
[roles."create-vite"]
positional = "write"
[roles."degit"]
shape = "last_write"

[roles."djxl"]
shape = "last_write"