[jmseguin]

Summary

Blast Radius only watched the Bash tool. On Windows, where Claude Code runs shell commands through the PowerShell tool, risky commands were never held. This adds PowerShell support and the first tests for the mod.

• Registers a second tool.call hook for PowerShell. Both shells share one hold, pane and decision path (guard()), so one hold at a time still applies across them.
• Adds a PowerShell classifier: Remove-Item and its default aliases (ri, rd, erase, del, rmdir) with -Recurse or -Force, including abbreviated parameter names, plus Set-Location, Push-Location and Pop-Location for folder tracking.
• Moves git and migration detection into helpers shared by both shells. Bash behavior is unchanged.
• Measures Remove-Item through pwsh, falling back to powershell.
• Updates the README for PowerShell support and its limits.

Directory

claude-code/mods/blast-radius/

How paths reach PowerShell

pwsh -Command <script> <arg> does not fill $args. It joins trailing arguments onto the script text, so the first version of the measuring scripts failed to parse, and a path containing a space or ; would have been read as script. The mod now sends paths as percent-encoded JSON: encodeURIComponent plus an escaped quote leaves nothing in a path that can end the string literal or run. The scripts read the values from $inputs. This is the same "paths are data, never script" property the Bash path has.

Tests

The mod had no tests. This adds two files, run with claude plugin test:

• tests/classify.test.ts: classifier coverage for both shells, including the documented gaps. These cases also pin down the existing Bash behavior the refactor touches.
• tests/guard.test.ts: the hold queue (Cancel refuses, Proceed runs, a second risky call waits for the first), plus a test that records what the mod sends to PowerShell and checks that a hostile path arrives only encoded. Time is driven by the test kit's mock clock, because the hold loop polls until a button is pressed.

Verification

• claude plugin validate: passes.
• claude plugin test: 31 tests, 31 pass.
• The two PowerShell scripts were run for real, in both pwsh and Windows PowerShell 5.1, against a throwaway folder. This covered a plain folder, a glob, a missing path, a hidden file, and a folder named it's $(calc) dir. File counts and sizes were correct, and nothing in a path executed. The unit tests stub process.run, so they cannot catch a script that fails to parse; this manual run is what found the $args problem.
• Observed in a live Claude Code session by the author: with Replay Theater's pane open, Blast Radius opened its own pane alongside it, each in its own tab. This was a manual check, not covered by a test.
• Observed live by the author, after /reload-plugins: a PowerShell Remove-Item -Recurse -Force on a 31-file folder (130,843 bytes) opened the pane showing "delete 31 files (about 128 KB)" with real paths and "+ 21 more", and the command ran after Proceed was pressed. A failed measurement now reads "could not measure it" with the PowerShell error, instead of "nothing to delete". This was a manual check, not covered by a test.

Known limits (also in the README)

• A risky cmdlet after a pipe (Get-ChildItem | Remove-Item -Force) is not caught.
• $(...), script blocks, splatting, here-strings, Invoke-Expression and user-defined aliases are not read.
• -WhatIf and -Confirm:$false are not special-cased.
• cmd.exe commands such as rd /s /q do not go through the PowerShell tool and are not held.

Pre-flight

Full checklist: _template/PREFLIGHT.md

This is an outside contribution to an existing entry, not a new one, so the new-entry items (name, Dependencies table, Third-party notices) are unchanged. The items I checked:

• Public models only; nothing unreleased is used or mentioned
• No internal codenames, go-links, internal URLs, Slack links or employee-only docs
• No secrets, internal email addresses, customer data or internal metrics (commits use a personal address)
• Every code file carries the copyright and SPDX header, including the two new test files
• CLA: the CLA Assistant check will ask for a signature
• The private repository's pre-flight scan is not something I can run

CONTRIBUTING.md says outside pull requests may be closed without review, so this is offered as-is.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[jmseguin]

I have read the CLA Document and I hereby sign the CLA