Destructive Command Guard Files

v0.9.0

Closes the entire post-v0.8.0 issue backlog: two new agent surfaces and six user-reported defects, all with regression coverage.

Added

• Posit Assistant support (idea from PR [#254], independently reimplemented). Installer/uninstaller manage a Claude-compatible PreToolUse hook in ~/.posit/assistant/settings.json with the lowercase exact matcher "bash|powershell" its matcher grammar requires; runtime detection via PA_PROJECT_DIR and the pa process name; a powershell tool inside a Posit hook now gets the Claude-compatible deny payload instead of Codex's minimal shape.
• VS Code Agent Host batched toolCalls envelope (#252). The newer Copilot Agent Host envelope previously deserialized without a recognized command and failed open. Every shell entry in a batch is now extracted and evaluated; one destructive entry denies the whole batch.

Fixed

• UTF-8 panic in dcg explain/dcg test when an escape character preceded a multi-byte character (#255) — all 21 escape-scanner sites now advance by the escaped character's real width.
• Wrapper prefixes defeating data-flag masking (#257): mise exec --, nice, time, nohup, stdbuf, timeout, ionice, setsid, chrt no longer cause a commit-message word to trip core.git:restore-worktree; wrapped destructive commands still deny.
• Leading VAR="$(cmd)" assignments misread as the executable (#256), which denied benign gh invocations whose search operands contained the letter c.
• Cross-dialect ; artifacts tripping the git-alias boundary (#250): git status; ls, for d in …; do cd "$d" && git pull; done, and sh -c 'cd {} && git pull' no longer fail closed as git-alias-semantic-unverified.
• for-loop literal narrowing (#242): for f in a b; do mv "$f" d/; done (and loop-bound redirect targets) now allow when every candidate value independently proves safe; all dynamic/rebinding variants still deny.
• Installer interactivity (#251): prompts now read /dev/tty, so the documented interactive mode actually prompts under curl … | bash; the no-TTY path announces every auto-decision and honors the documented rustup default.
• Copilot hook key casing reconciliation (#253): case-insensitive merge, dual-casing file repair, and casing-insensitive uninstall on both platforms.

Verification

Built and published via DSR. Every archive carries a SHA256 sidecar, minisign signature (key 69B3955C8D2E62A8), Sigstore cosign bundle (pinned local-release key), and SLSA provenance; SHA256SUMS is signed. Full CHANGELOG: https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/CHANGELOG.md