@volter/teams 0.2.46 → 0.2.47

package/board-process-guard.mjs

@@ -10,13 +10,27 @@ export function patternKill(command) {
   const text = String(command).replace(/\\\r?\n/g, '').replace(/\\([a-zA-Z-])/g, '$1').replace(/["']/g, '');
   const head = String.raw`(?:^|[;|&(\n{}]|\s-[a-zA-Z]*c\s+)\s*(?:(?:env|sudo|exec|command|xargs|nohup|do|then|else|!)\s+(?:--?[^\s;|&()]+\s+)*|[A-Za-z_][A-Za-z0-9_]*=[^\s;|&()]+\s+)*(?:[\w./-]+/)?`;
   return new RegExp(head + String.raw`(?:pkill|killall)(?=$|[\s;|&()])`).test(text) ||
-    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text);
+    new RegExp(head + String.raw`pgrep\s+[^;|&\n)]*(?:--full\b|-[a-zA-Z]*f[a-zA-Z]*(?=$|\s))`).test(text) ||
+    windowsPatternKill(text);
+}
+// Windows names a process by image, title or command line through its own tools (cmd, PowerShell, Git Bash's
+// `//IM`): each such kill is refused as pkill is. A kill by PID (`taskkill /PID`, `Stop-Process -Id`) stays allowed.
+function windowsPatternKill(text) {
+  return /\btaskkill(?:\.exe)?\b[^;|&\n]*\s(?:\/{1,2}|-)(?:im|fi)\b/i.test(text) ||
+    /(?:^|[^\w-])(?:Stop-Process|spps)\b[^;|\n]*\s-(?:N[a-z]*|ProcessName)\b/i.test(text) ||
+    // PowerShell's `kill` alias; Bash's own `kill -n <signal>` is not a name
+    /(?:^|[^\w-])kill\b[^;|\n]*\s-(?:Name|ProcessName)\b/i.test(text) ||
+    /\b(?:Get-Process|gps)\b(?![^|;\n]*\s-Id\b)[^|;\n]*\|\s*(?:Stop-Process|spps|kill)\b/i.test(text) ||
+    /\bwmic\b[^;|&\n]*\bprocess\b[^;|&\n]*\bwhere\b[^;|&\n]*\b(?:name|commandline|executablepath)\b/i.test(text) ||
+    /\bWin32_Process\b[^\n]*\b(?:Name|CommandLine|ExecutablePath)\b[^\n]*\b(?:Terminate|Remove-CimInstance|Remove-WmiObject|Stop-Process)\b/i.test(text);
 }
 const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
 export function boardGuardArguments(kind, args, { cwd, enabled, node = process.execPath } = {}) {
   if (!enabled) return args;
   const command = `${quote(node)} ${quote(fileURLToPath(import.meta.url))}`;
-  const hooks = [{ matcher: '^Bash$', hooks: [{ type: 'command', command, timeout: 10 }] }];
+  // Claude's exec form spawns the policy with no shell on every platform (Windows included, where its shell form
+  // runs Git Bash or PowerShell and the POSIX quoting above would not parse); its PowerShell tool is guarded as Bash is.
+  const hooks = [{ matcher: '^(Bash|PowerShell)$', hooks: [{ type: 'command', command: node, args: [fileURLToPath(import.meta.url)], timeout: 10 }] }];
   if (kind === 'claude-code') {
     const next = [...args], at = next.findIndex(arg => arg === '--settings' || arg.startsWith('--settings='));
     if (at < 0) return [...next, '--settings', JSON.stringify({ hooks: { PreToolUse: hooks } })];
@@ -30,6 +44,7 @@ export function boardGuardArguments(kind, args, { cwd, enabled, node = process.e
     // Native Codex rules cannot split substitutions such as kill $(pgrep -f …).
     // Its synchronous Bash hook can deny the entire command before execution.
     // This invocation enables and trusts the board-vetted command policy.
+    if (process.platform === 'win32') throw new Error('board process guard is unavailable for codex on Windows; no unguarded session was launched');
     const handler = `{ matcher = "^Bash$", hooks = [{ type = "command", command = ${JSON.stringify(command)}, timeout = 10 }] }`;
     // Codex's own flags go before any subcommand (`app-server`, `resume`) or prompt: after `app-server`, Codex
     // 0.159 refuses --dangerously-bypass-hook-trust and the worker never starts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",