Cover native PowerShell calls in Taskdeck's Claude deny floor

[Chris0Jeky]

Context

Fresh adversarial review of PR #1496 proved that Taskdeck's repo-owned Claude deny layers cover Bash-command events only:

• the .claude/settings.json PreToolUse matcher is Bash
• scripts/agent_hooks/pre_tool_use.py returns immediately for tool names other than Bash / Shell
• the declarative deny rules are all Bash(...)

Current native-Windows Claude Code exposes PowerShell as a distinct tool and permission surface. A native PowerShell(Remove-Item ... -Recurse -Force) call therefore bypasses both project deny layers even though an equivalent Bash payload is denied. This is pre-existing and was not introduced by #1496, but #1496's Windows launcher work made the boundary visible.

Scope

Design and stage the smallest reviewed T4-class change that covers native PowerShell command events without weakening the existing Bash union or duplicating policy unsafely. Coordinate with #1293 (Claude floor consolidation) and #1456/#1457 (Codex Bash adapter); do not conflate Bash-command coverage with whole-tool containment.

Acceptance criteria

• Record the chosen relationship to FLOOR consolidation: resolve the PreToolUse deny-floor double-spawn (global dispatch.py + repo pre_tool_use.py) #1293 before implementation (extend the repo hook, consolidate into one dispatcher, or another explicitly reviewed shape).
• Native PowerShell payloads for every currently protected destructive class are denied at the project boundary, including representative Remove-Item -Recurse -Force and Git force/reset cases.
• Ordinary read-only PowerShell commands remain allowed.
• The matcher, policy tool-name handling, and declarative permissions/denies agree; no layer falsely claims broader coverage.
• Missing or crashing policy launch fails closed for PreToolUse instead of proceeding without the floor.
• Static tests plus a fresh interactive /hooks inventory and safe allow/deny canaries prove the exact reviewed head.
• Two independent exact-head adversarial reviews, Codex review, CI, and all comments/threads are clean.
• Maintainer performs the merge; agents do not self-ratify or self-merge this T4 security boundary.

Routing

Security/runway follow-up from PR #1496 review. Priority I, human-held. Refs #1293, #1456, and #1496.

[Chris0Jeky]

Upstream producer tracking is now filed as Chris0Jeky/agent-harness#88. That issue contains the exact agent-harness head/floor/runtime versions, a non-writing same-command PowerShell versus Bash dispatcher reproduction, and acceptance criteria for one shared policy path plus native-tool smoke coverage. This Taskdeck issue remains the consumer rollout/human-held boundary; the upstream issue does not make the currently installed adapter safe.