@wrongstack/tools 0.308.0 → 0.308.1

package/dist/exec.js

@@ -43,6 +43,40 @@ var RULES = [
     },
     reason: "Remove-Item with -Recurse -Force"
   },
+  // ----- Windows PowerShell Disk & Volume destruction -----
+  {
+    id: "powershell-disk-volume-destroy",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some(
+        (a) => /^(?:Format-Volume|Clear-Disk|Initialize-Disk|Remove-Partition|Clear-Volume)(?:\s|$)/i.test(a)
+      );
+    },
+    reason: "PowerShell disk/volume partition destruction"
+  },
+  // ----- Windows PowerShell System Restart / Shutdown -----
+  {
+    id: "powershell-stop-restart-computer",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some((a) => /^(?:Stop-Computer|Restart-Computer)(?:\s|$)/i.test(a));
+    },
+    reason: "PowerShell system shutdown or restart"
+  },
+  // ----- Windows PowerShell ExecutionPolicy / Payload evasion -----
+  {
+    id: "powershell-execution-policy-bypass",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some(
+        (a) => /Set-ExecutionPolicy\s+(?:Bypass|Unrestricted)|-(?:EncodedCommand|enc)\b/i.test(a)
+      );
+    },
+    reason: "PowerShell execution policy bypass or encoded command"
+  },
   // ----- find -exec / -ok / -execdir -----
   {
     id: "find-exec",

package/dist/index.d.ts

@@ -40,6 +40,7 @@ export { getProcessGuardian, type ProcessGuardianConfig, startProcessGuardian, s
 export { _resetProcessRegistry, type BreakerCountdown, getProcessRegistry, type KillOpts, type ProcessRegistryImpl, type RegistryStats, type TrackedProcess, } from './process-registry.js';
 export { getPersistentProcessRegistry, type PersistentProcessEntry, type PersistentRegistryData, resetPersistentProcessRegistry, } from './process-registry-persistent.js';
 export { createGlobalPsSlashCommand, formatGlobalStatus, formatInstanceList, formatInstanceSummary, type GlobalProcessStatus, getInstanceCount, type InstanceInfo, type InstanceListOptions, listInstances, } from './ps-slash.js';
+export { pwshTool, PWSH_TOOL_DESCRIPTION, type PwshInput, type PwshOutput } from './pwsh.js';
 export { readTool } from './read.js';
 export { replaceTool } from './replace.js';
 export { scaffoldTool } from './scaffold.js';