fix(guardrails): catch Windows drive-root /tmp write targets

[kyle-sexton]

Closes #2594

Summary

On Windows, POSIX /tmp resolves to a drive-root C:\tmp (or \tmp) rather than %TEMP%, and nothing caught writes there — residue accumulated silently at the volume root.

Fix

Guard Bash/PowerShell write targets of /tmp, C:\tmp, and drive-root \tmp with a clear block/redirect message toward the platform temp directory. Legitimate %TEMP% / TMPDIR usage remains allowed.

Verification

See guardrails hook tests on PR checks.

Related

Refs #2592 — related PowerShell command-position work.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 41s —— View job

---

Security review (/review:security-review)

• Gather context (PR diff, changed files)
• Run /review:security-review skill
• Post findings

Scope: New PreToolUse guardrail hook (plugins/guardrails/hooks/block-windows-drive-tmp.sh) that blocks Bash/PowerShell writes targeting Windows drive-root temp paths, plus its test file, plugin manifest/docs updates, and hook-telemetry schema/example additions. This does touch security-relevant surface (a Bash/PowerShell command-inspection guard), so the review proceeded past the skip gate.

Findings: none.

Reviewed block-windows-drive-tmp.sh for the usual classes:

• Command injection: the untrusted tool_input.command string is only ever passed through [[ "$s" =~ ... ]] bash regex matching, tr, and printf '%s' — never eval'd, sourced, or interpolated into a command that executes. No injection surface.
• ReDoS: input is capped at MAX_COMMAND_LEN=16384 before any regex evaluation, and the patterns themselves are simple bounded character classes with no nested/overlapping quantifiers — no catastrophic-backtracking shape.
• Fail-closed posture: consistent with sibling guards — NUL-byte payloads, missing jq, and oversized commands all block (exit 2) rather than silently pass.
• Data handling: telemetry payload (docs/conventions/hook-telemetry/{schema,examples}/block-windows-drive-tmp.*) only carries tool / a basenamed first-token subject / form — no full command string, consistent with the schema's own "NEVER the full command or its arguments" constraint. No secret/token leakage path.
• Scope/blast radius: purely additive — a new hook entry in hooks.json under the existing Bash|PowerShell matcher, a new userConfig toggle (default true, independently killable via block_windows_drive_tmp_enabled/env var), no changes to permissions, workflows, or existing guard logic.
• Detection is regex-based and the file's own header comment is explicit that this is "friction against accidental hardcoded roots, not a sandbox" — an incomplete match is a missed convenience block, not a new vulnerability, since no such guard existed before this PR.

No GitHub Actions workflow files are touched in this PR, so no Actions-specific findings apply (permissions, pull_request_target, unpinned actions, etc.).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60007ac3a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Last security-reviewed head: 60007ac3a2557c8f518e336e06544c44cc18a1d1. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @cursor[bot]'s task in 1m 25s —— View job

---

Code Review — skipped

• Gather context (PR diff, changed files)
• Run /review:code-review skill
• Post findings

Per the /review:code-review skip gate: this PR is merged (closed), which meets skip condition 1 ("PR is closed or not open"). No deep review was performed and no findings are posted, per the skill's own instructions.

For reference — this PR's second commit (8ab3c2f) already addressed all three findings from the earlier Codex automated review on this PR: quote-aware redirect matching (ignoring > inside quoted strings), destination-operand binding for cp/mv/install so read-only/unrelated commands aren't blocked, and Copy-Item/Move-Item (and aliases) coverage for PowerShell. The current state of plugins/guardrails/hooks/block-windows-drive-tmp.sh reflects those fixes.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.