From 96404be37b80aecbcfaed82ba8df413850c55788 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Sun, 30 Aug 2026 08:58:12 +0200
Subject: [PATCH] Catch a privileged heredoc redirected with >|

`>|` is a plain redirect with noclobber overridden, not a redirect followed by a pipe. command_destinations detached `>` from its target before looking at the bar, so the target read as `|` and the privileged path behind it was never examined: `cat <<EOF >| /etc/udev/rules.d/99-x.rules` with `$HOME` in the body produced no finding at all, while the same write through `>` produced one.

Normalizing `>|` to `>` alongside the existing `>>` handling closes it. The fixture fails without the normalization.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../fixtures/privileged-heredoc/route-noclobber-redirect.sh | 4 ++++
 test/shell.d/privileged-heredoc-test.sh                     | 6 ++++++
 2 files changed, 10 insertions(+)
 create mode 100644 test/shell.d/fixtures/privileged-heredoc/route-noclobber-redirect.sh

diff --git a/test/shell.d/fixtures/privileged-heredoc/route-noclobber-redirect.sh b/test/shell.d/fixtures/privileged-heredoc/route-noclobber-redirect.sh
new file mode 100644
index 00000000..050f92fb
--- /dev/null
+++ b/test/shell.d/fixtures/privileged-heredoc/route-noclobber-redirect.sh
@@ -0,0 +1,4 @@
+# `>|` is a plain redirect with noclobber overridden, not a redirect into a pipe.
+cat >|/etc/omarchy/agent.conf <<EOF
+helper=$HOME/.local/share/omarchy/bin/omarchy-agent
+EOF
diff --git a/test/shell.d/privileged-heredoc-test.sh b/test/shell.d/privileged-heredoc-test.sh
index 0caa4215..00dcc985 100755
--- a/test/shell.d/privileged-heredoc-test.sh
+++ b/test/shell.d/privileged-heredoc-test.sh
@@ -380,6 +380,10 @@ command_destinations() {
   # contain spaces anywhere this check runs.
   line=${line//\"/ }
   line=${line//\'/ }
+  # `>|` overrides noclobber; the bar belongs to the operator, not to a pipe.
+  # Left alone it becomes the redirect's target and hides the privileged path
+  # behind it, so a `cat <<EOF >| /etc/...` heredoc reports no destination.
+  line=${line//">|"/">"}
   # Preserve append redirects before detaching redirect operators from their
   # targets, so ">> /etc/x" does not become two ">" tokens whose first target
   # is the second operator.
@@ -922,6 +926,8 @@ fixture_flags route-prebody-escaped-pipeline.sh \
   "flags an escaped-line pipeline consumer before the heredoc body"
 fixture_flags route-dash-delimiter.sh "flags an indented <<- heredoc"
 fixture_flags route-append-redirect.sh "flags an append redirect into /etc"
+fixture_flags route-noclobber-redirect.sh \
+  "flags a noclobber-override redirect into /etc"
 fixture_flags arithmetic-left-shift-before-heredoc.sh \
   "an arithmetic left shift does not swallow a later privileged heredoc" \
   "path-shaped expansions: HOME"