fix(guardrails): close PowerShell-tool bypass of Bash-matched guards

[kyle-sexton]

f1 (proven live) + f3. Widen PreToolUse matchers Bash->Bash|PowerShell for the git/commit guards, and cover PowerShell file-writes (Set-Content/>) for the Write/Edit guards.

• Define the canonical PowerShell commit form (here-string pipe equivalent of -F -) so a naive widen doesn't block every PS commit.
• Conservative posture on unparseable PS: fail-closed on git commit-shaped PS text.
• Shell-agnostic block messages (f3).
• Full PS grammar parsing (here-strings/backticks/--%/subexpressions) is deferred to a follow-up (A2b). Independent.

Part of #912. Contract + design in #912 — do not diverge.

[kyle-sexton]

[kyle-sexton]

PR #960 opened for the fail-closed core (tower-dispatched, ~06:35Z). Matcher widened Bash→Bash|PowerShell (token confirmed from hooks docs + anthropics/claude-code#57137) across 5 guards; canonical PS commit form (here-string → git commit -F -) allowed, non-canonical BLOCKED, fail-closed on unparseable PS constructs (backtick/--%/subexpr/script-block/unbalanced here-string); PS write-gate coverage (Set-Content/Out-File/>). Full PS grammar + PS-write CONTENT scanning deferred to A2b (this issue's stated follow-up). Freeze-gate item per the 05:00Z working-scope ruling; held for operator security review (area:security). Independent producer≠reviewer pass + tower confirm before merge.

[kyle-sexton]

Lane collision — two independent implementations, parking for human/decide-lane resolution (not closing either).

Lease priority (factual): this lane's claim on #915 was acquired 2026-07-22T05:43:31Z (lease comment above). PR #960 was opened by a different actor ("tower-dispatched, ~06:35Z" per this issue's other comment) — roughly 50 minutes after this lane's lease was already held. Per this session's claim-arbitration convention, first-claim wins the ownership question. It does not by itself resolve the scope question below — noting both separately rather than conflating them.

Two implementations exist:

1. PR fix(guardrails): close PowerShell-tool bypass of Bash-matched guards #960 (fix/915-powershell-tool-bypass, opened, non-draft, currently CI-red on pr-issue-linkage — body never uses the literal Closes #915 keyword). Widens matchers to Bash|PowerShell, adds a PS classifier that blanks here-strings and reuses the Bash tokenizer. Explicitly defers PowerShell content-scanning for secret-pattern-detection/hardcoded-path-check to a follow-up "A2b."

2. This lane's branch fix/915-powershell-guard-bypass (commit 11ad28b3, pushed, not yet opened as a PR — parking pending this resolution rather than opening a competing PR). Same matcher-widening + fail-closed PS parsing via a dedicated conservative PS tokenizer, plus it implements PowerShell content-scanning for secret-pattern-detection and hardcoded-path-check directly (independent of block-hook-bypass's kill switch). All tests green (546 existing bash unchanged + 471 new PS/lib cases), code merges clean against current origin/main (only the routine plugin.json/CHANGELOG version-line collision, since main advanced to guardrails 0.10.0 via feat(observability): hook-observability fleet adoption #945 after this branch was started).

Scope discriminator: #915's own body says "cover PowerShell file-writes (Set-Content/>) for the Write/Edit guards" — that's explicit inclusion language pointing at secret-pattern-detection.sh/hardcoded-path-check.sh (the Write|Edit-matched guards), which is what this lane's branch implements and #960 defers. #912's locked contract doesn't separately speak to this — it's silent on the content-scanning-vs-A2b split, so #915's own wording is the closest thing to a ruling, and it reads as "in scope."

Recommendation: promote this lane's branch (more complete reading of #915's own text, clean/green state) and retire #960 (narrower scope, currently CI-red, cannot merge as-is regardless). Leaving the actual PR-open/PR-close decision to a human or the decide lane rather than acting unilaterally on another lane's PR — this class of cross-actor collision (#920) has recurred enough this session that a procedural fix belongs there, not a one-off override here.

Keeping the seam lease on #915 held (not releasing) as part of the ownership evidence.

[kyle-sexton]

Tower claim (~07:50Z): #915's PR #960 branch had a parallel lane push collide with the tower hardening — reconcile underway (tower sink canonical, lane's regression tests ported+required-to-pass). Lane: stand down on #915 — tower owns the branch reconcile through operator ratification. Detail on #960.