shell-command: reject PowerShell param blocks

codex-rs/shell-command/src/command_safety/powershell_parser.ps1

@@ -42,6 +42,12 @@ function Invoke-ParseRequest {
         return @{ id = $RequestId; status = 'parse_errors' }
     }
 
+    # Script parameter blocks can contain expressions that are evaluated outside
+    # of the end-block statements we flatten below.
+    if ($ast.ParamBlock -ne $null) {
+        return @{ id = $RequestId; status = 'unsupported' }
+    }
+
     # PowerShell's stop-parsing marker hands the remaining source text to native
     # commands with runtime argument handling that does not match the AST shape we
     # flatten below. Keep that form out of the argv-like lowering path entirely.

codex-rs/shell-command/src/command_safety/powershell_parser.rs

@@ -310,4 +310,18 @@ mod tests {
             .unwrap();
         assert_eq!(parsed, PowershellParseOutcome::Unsupported);
     }
+
+    #[test]
+    fn parser_process_rejects_param_blocks() {
+        let Some(powershell) = try_find_powershell_executable_blocking() else {
+            return;
+        };
+        let powershell = powershell.as_path().to_str().unwrap();
+        let mut parser = PowershellParserProcess::spawn(powershell).unwrap();
+
+        let parsed = parser
+            .parse("param([string]$path = (Get-Location)) Write-Output test")
+            .unwrap();
+        assert_eq!(parsed, PowershellParseOutcome::Unsupported);
+    }
 }

codex-rs/shell-command/src/command_safety/windows_safe_commands.rs

@@ -412,6 +412,16 @@ mod tests {
         ])));
     }
 
+    #[test]
+    fn rejects_powershell_param_blocks() {
+        assert!(!is_safe_command_windows(&vec_str(&[
+            "powershell.exe",
+            "-NoProfile",
+            "-Command",
+            "param([string]$path = (Get-Location)) Write-Output test",
+        ])));
+    }
+
     #[test]
     fn rejects_powershell_commands_with_side_effects() {
         assert!(!is_safe_command_windows(&vec_str(&[