Destructive Command Guard Files

v0.9.2

Second hardening patch from the continuing adversarial-review campaign over the v0.9.x line. Three independent reviewers probed the v0.9.1 fixes A/B against the released binaries on both evaluation routes; everything they surfaced is fixed here with regression coverage.

Fixed

• Warn-mode batch masking: a Warn-mode toolCalls entry ended the request before later entries were evaluated, silently allowing them. The hook now resolves every entry and publishes exactly one response by precedence (Deny > Indeterminate > Ask > Warn > Allow).
• Batch sibling decoys: a toolCalls envelope carrying a destructive tool_input/tool_args command evaluated only the batch; siblings are now evaluated too.
• Protocol hijack by non-shell batches: any non-empty toolCalls array forced the Claude wire shape, so Gemini/Hermes/Grok/Codex payloads carrying a readFile-style batch got a deny their parsers drop; the branch now requires a shell entry.
• mise modeled at its real grammar: global flags before the subcommand (mise -v exec -- …) and post-subcommand flags outside the modeled set bypassed the wrapper model on the real hook path; both engines now share one option table.
• Constant-propagation hazards hardened: while read f, { read f; }, command read, if read, getopts, select, and IFS changes now refuse the variable proof; the NAME[/NAME= scan requires a word boundary (a regex class like conf[ig] or jq's .n[0] no longer reads as mutation); glob values are rejected only at unquoted use sites.
• Oversized-command side effects: the v0.9.1 refactor made oversized payloads construct the history database and worker thread; restored to pre-construction refusal with byte-identical output.
• Installers: install.ps1 quotes the Copilot hook binary path (spaced Windows profiles); the uninstaller anchors its machine marker.

Known-limitation follow-ups filed from the same review: [#259] (mise exec -c inline payloads), [#260] (frontend strip-failure blind spot).

Full details in the CHANGELOG. Same signing chain: SHA256 + minisign (69B3955C8D2E62A8) + Sigstore cosign + SLSA provenance on every artifact.