Classify PowerShell service aliases

Author: SqlRush

docs/cc-100-roadmap.md

@@ -183,6 +183,8 @@ M5 补充：WebFetch prompt-focused excerpt 的 term scoring 现在会双向匹
 
 M5 补充：PowerShell command canonicalization 现在补齐 mutating ItemProperty aliases：`sp`/`clp`/`cpp`/`mp`/`rp`/`rnp` 会分别归入 `Set/Clear/Copy/Move/Remove/Rename-ItemProperty` destructive 分类，避免属性变更 alias 被当成未知普通命令。
 
+M5 补充：PowerShell command canonicalization 现在补齐 mutating service aliases：`sasv`/`spsv`/`rsv`/`ssv` 会分别归入 `Start/Stop/Restart/Set-Service` destructive 分类，避免服务状态或配置变更 alias 被当成未知普通命令。
+
 M5 补充：WebFetch HTML-to-text rendering 现在会跳过 `hidden`、`aria-hidden="true"`、CSS `display:none`/`visibility:hidden` 的不可见元素子树，隐藏文本和图片说明不会进入 rendered body 或 prompt-focused excerpt。
 
 M5 补充：WebFetch HTML-to-text rendering 现在会为无可见文本但带 `aria-label`/`title` 的链接保留可访问名称和 resolved href，icon-only 链接可进入 rendered body 与 prompt-focused excerpt。

docs/claude-code-go-rewrite-plan.md

@@ -253,6 +253,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 本轮补充：PowerShell native read-only classifier 收紧短 flag 合并校验，`netstat -ano` 这类纯开关组合仍允许，但包含 value/path flag 的组合（如 `-anop`）不再绕过缺值校验。
 - 本轮补充：PowerShell native read-only classifier 收紧 `/FO` 输出格式参数，`systeminfo`/`tasklist`/`whoami`/`getmac` 只接受 `CSV`/`LIST`/`TABLE` literal 值，无效格式和动态值不再进入只读 fast path。
 - 本轮补充：PowerShell command canonicalization 现在补齐 mutating ItemProperty aliases：`sp`/`clp`/`cpp`/`mp`/`rp`/`rnp` 会分别归入 `Set/Clear/Copy/Move/Remove/Rename-ItemProperty` destructive 分类，避免属性变更 alias 被当成未知普通命令。
+- 本轮补充：PowerShell command canonicalization 现在补齐 mutating service aliases：`sasv`/`spsv`/`rsv`/`ssv` 会分别归入 `Start/Stop/Restart/Set-Service` destructive 分类，避免服务状态或配置变更 alias 被当成未知普通命令。
 - 本轮补充：`BashOutput` 现在设置 100k 最大结果大小，和前台 `Bash` 一起覆盖大输出 tool-result preview 截断、完整输出落盘及 `full_output_path` 元数据。
 - 本轮补充：Bash/PowerShell 后台命令现在会通过 tool progress 通道发 started/finished 事件，记录后台 ID、shell/status、exit/timed_out/cancelled、duration、时间戳和 stdout/stderr byte count，且 completed、timed_out、cancelled 终态测试确保 progress 不携带 command 文本。
 - 本轮补充：WebSearch domain filters 现在在 schema 层声明 array `items:string`，通用 tool schema validator 同步支持 `items` 校验；`allowed_domains`/`blocked_domains` 会拒绝空字符串、URL/port、非法 wildcard 和非域名 label。

internal/tools/powershell/tools.go

@@ -2146,7 +2146,7 @@ func destructiveWords(words []string) bool {
 	switch command {
 	case "git":
 		return bashtools.IsDestructiveCommand(powerShellGitCommand(words))
-	case "remove-item", "set-content", "add-content", "clear-content", "clear-item", "clear-itemproperty", "out-file", "new-item", "move-item", "move-itemproperty", "copy-item", "copy-itemproperty", "rename-item", "rename-itemproperty", "set-item", "set-itemproperty", "stop-process", "stop-service", "restart-computer", "invoke-expression", "iex", "start-process", "start-transcript", "stop-transcript":
+	case "remove-item", "set-content", "add-content", "clear-content", "clear-item", "clear-itemproperty", "out-file", "new-item", "move-item", "move-itemproperty", "copy-item", "copy-itemproperty", "rename-item", "rename-itemproperty", "set-item", "set-itemproperty", "stop-process", "start-service", "stop-service", "restart-service", "set-service", "restart-computer", "invoke-expression", "iex", "start-process", "start-transcript", "stop-transcript":
 		return true
 	default:
 		return strings.HasPrefix(command, "remove-") || strings.HasPrefix(command, "set-") || strings.HasPrefix(command, "new-") || strings.HasPrefix(command, "export-")
@@ -2271,6 +2271,14 @@ func powerShellAliasTarget(name string) string {
 		return "start-process"
 	case "gsv":
 		return "get-service"
+	case "sasv":
+		return "start-service"
+	case "spsv":
+		return "stop-service"
+	case "rsv":
+		return "restart-service"
+	case "ssv":
+		return "set-service"
 	case "gal":
 		return "get-alias"
 	case "gdr":

internal/tools/powershell/tools_test.go

@@ -569,6 +569,14 @@ func TestPowerShellCommandClassification(t *testing.T) {
 		"Stop-Process -Id 1",
 		"kill -Id 1",
 		"spps -Id 1",
+		"Start-Service -Name spooler",
+		"sasv -Name spooler",
+		"Stop-Service -Name spooler",
+		"spsv -Name spooler",
+		"Restart-Service -Name spooler",
+		"rsv -Name spooler",
+		"Set-Service -Name spooler -StartupType Disabled",
+		"ssv -Name spooler -StartupType Disabled",
 		"start calc.exe",
 		"saps calc.exe",
 		"Invoke-Expression $x",