One PATTERN|PATTERN) BODY ;; arm of a Cmd::Case. The patterns are glob words matched
against the subject; they are never executed, so only body carries risk.
How an output redirect opens its target. All three land the same bytes somewhere, so they
classify identically — the distinction is kept so --explain can echo the command the user
actually typed rather than a normalized one. Mutually exclusive by construction: >>| is not
a redirect, and a bool pair would let a generator build one.
Explain with the user’s allowlist patterns overlaid, so a command the user
has allowed isn’t reported as not-auto-approved. This mirrors the hook’s own
coverage check (main.rs): a segment counts as allowed when it is built-in
safe or every command in it is covered by the user’s patterns.