What
Sensitive-path and protected-path checks on PowerShell arguments now enumerate all candidate normalisations of a path rather than normalising once, and deny if any of them lands on a sensitive file.
Details
- Candidates are identity, quote-stripped and escape-stripped forms of the argument.
- When a path is not literally unquoted, the prompt no longer reports a
blockedPathand no longer offers add-directory or switch-to-acceptEdits suggestions, which could previously point at the wrong location. - A new safety-check reason covers the quote-stripping ambiguity and routes the call to manual approval.
Evidence
resolves near a sensitive file under quote-stripping and cannot be statically validated; requires manual approval
Strings lifted out of the shipped bundle, so the claim above can be checked against them.