@danmoisan/drm-copilot-mcp 0.0.1

package/resources/claude-customizations/.claude/hooks/enforce-python-batch-budget.ps1

@@ -0,0 +1,235 @@
+<#
+.SYNOPSIS
+    Pre-tool-use hook that enforces the Python per-batch change budget.
+
+.DESCRIPTION
+    This script is invoked by the Claude Code PreToolUse hook before any Write or Edit
+    operation. When the target file is a Python file, it classifies the file as either
+    production or test and checks the running count against the per-batch cap:
+      - 3 production .py files per batch
+      - 3 test .py files per batch
+
+    A "batch" is scoped to the current Claude Code session. The running count is
+    persisted under .claude/state/python-batch-budget.<session_id>.json. Only distinct
+    file paths are counted; repeated edits to the same file consume one slot.
+
+    Test files are those matching:
+      - tests/**/*.py
+      - test_*.py
+
+    All other .py files are treated as production files. Non-Python paths pass through.
+
+    The cap may be overridden per session by setting the environment variable
+    CLAUDE_PYTHON_BUDGET_PROD or CLAUDE_PYTHON_BUDGET_TEST to a positive integer before
+    the session starts, or by writing {"prodCap": N, "testCap": M} into the state file.
+
+    When the cap would be exceeded by a new file, the script emits a JSON response with
+    'decision': 'block' and exits 0. The session must explicitly reset the counter by
+    deleting the state file before starting a new batch. Files already counted are
+    always allowed through.
+
+.NOTES
+    Compatible with PowerShell 7+.
+#>
+[CmdletBinding()]
+param()
+
+function Get-PythonBatchBudgetState {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [int] $ProdCap,
+
+        [Parameter(Mandatory)]
+        [int] $TestCap
+    )
+
+    [ordered]@{
+        prodCap   = $ProdCap
+        testCap   = $TestCap
+        prodFiles = @()
+        testFiles = @()
+    }
+}
+
+function ConvertTo-PythonBatchBudgetState {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        $InputObject,
+
+        [Parameter(Mandatory)]
+        [int] $ProdCap,
+
+        [Parameter(Mandatory)]
+        [int] $TestCap
+    )
+
+    $state = Get-PythonBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
+    if ($null -ne $InputObject.prodCap) { $state.prodCap = [int]$InputObject.prodCap }
+    if ($null -ne $InputObject.testCap) { $state.testCap = [int]$InputObject.testCap }
+    if ($null -ne $InputObject.prodFiles) { $state.prodFiles = @($InputObject.prodFiles) }
+    if ($null -ne $InputObject.testFiles) { $state.testFiles = @($InputObject.testFiles) }
+
+    return $state
+}
+
+function Get-PythonBatchBudgetBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason,
+
+        [System.Collections.IDictionary] $State
+    )
+
+    $decision = [ordered]@{
+        decision = 'block'
+        reason   = $Reason
+    }
+    if ($State) {
+        $decision.state = $State
+    }
+
+    return $decision
+}
+
+function Invoke-PythonBatchBudgetDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $FilePath,
+
+        [Parameter(Mandatory)]
+        [System.Collections.IDictionary] $State,
+
+        [Parameter(Mandatory)]
+        [string] $StateFile
+    )
+
+    $normalized = $FilePath -replace '\\', '/'
+    if ($normalized -notmatch '\.py$') {
+        return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $false }
+    }
+
+    $isTestFile = ($normalized -match '(^|/)tests/.*\.py$') -or ($normalized -match '(^|/)test_[^/]+\.py$')
+    $targetList = if ($isTestFile) { @($State.testFiles) } else { @($State.prodFiles) }
+    $cap = if ($isTestFile) { [int]$State.testCap } else { [int]$State.prodCap }
+    $kind = if ($isTestFile) { 'test' } else { 'production' }
+
+    if ($targetList -contains $normalized) {
+        return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $false }
+    }
+
+    if ($targetList.Count -ge $cap) {
+        $currentFiles = ($targetList -join ', ')
+        $kindUpper = $kind.ToUpperInvariant()
+        $reason = "Python per-batch budget exceeded: $kind file cap is $cap and is already full ($currentFiles). Requested new file: $normalized. Split the work into a new batch, raise the cap via CLAUDE_PYTHON_BUDGET_$kindUpper environment variable with approved scope, or reset the batch by deleting $StateFile."
+        return Get-PythonBatchBudgetBlockDecision -Reason $reason -State $State
+    }
+
+    if ($isTestFile) {
+        $State.testFiles = @($State.testFiles) + @($normalized)
+    } else {
+        $State.prodFiles = @($State.prodFiles) + @($normalized)
+    }
+
+    return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $true }
+}
+
+function Invoke-PythonBatchBudgetHook {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [string] $ToolInputRaw,
+        [string] $SessionId = 'default',
+        [string] $Root = (Get-Location).Path,
+        [int] $ProdCap = 3,
+        [int] $TestCap = 3,
+        [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -Path $Path },
+        [scriptblock] $EnsureDirectory = { param([string] $Path) New-Item -ItemType Directory -Path $Path -Force | Out-Null },
+        [scriptblock] $ReadState = { param([string] $Path) Get-Content -Path $Path -Raw },
+        [scriptblock] $WriteState = {
+            param([string] $Path, [System.Collections.IDictionary] $State)
+            $State | ConvertTo-Json -Depth 5 | Set-Content -Path $Path -Encoding UTF8
+        }
+    )
+
+    if (-not $ToolInputRaw) {
+        return [ordered]@{ decision = 'allow' }
+    }
+
+    try {
+        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        return Get-PythonBatchBudgetBlockDecision -Reason 'Python batch-budget hook received malformed JSON in CLAUDE_TOOL_INPUT.'
+    }
+
+    $filePath = $toolInput.file_path
+    if (-not $filePath) {
+        return [ordered]@{ decision = 'allow' }
+    }
+
+    $normalized = $filePath -replace '\\', '/'
+    if ($normalized -notmatch '\.py$') {
+        return [ordered]@{ decision = 'allow' }
+    }
+
+    $stateDir = Join-Path -Path $Root -ChildPath '.claude/state'
+    if (-not (& $TestPathExists $stateDir)) {
+        & $EnsureDirectory $stateDir
+    }
+
+    $stateFile = Join-Path -Path $stateDir -ChildPath ("python-batch-budget.$SessionId.json")
+    $state = Get-PythonBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
+
+    if (& $TestPathExists $stateFile) {
+        try {
+            $loaded = & $ReadState $stateFile | ConvertFrom-Json -ErrorAction Stop
+            $state = ConvertTo-PythonBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap
+        } catch {
+            Write-Verbose "Ignoring unreadable Python batch-budget state file '$stateFile': $($_.Exception.Message)"
+        }
+    }
+
+    $decision = Invoke-PythonBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile
+    if ($decision.shouldWriteState) {
+        try {
+            & $WriteState $stateFile $decision.state
+        } catch {
+            Write-Verbose "Unable to write Python batch-budget state file '$stateFile': $($_.Exception.Message)"
+        }
+    }
+
+    return $decision
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$sessionId = $env:CLAUDE_SESSION_ID
+if (-not $sessionId) {
+    $sessionId = 'default'
+}
+
+$prodCap = 3
+$testCap = 3
+if ($env:CLAUDE_PYTHON_BUDGET_PROD -match '^\d+$') {
+    $prodCap = [int]$env:CLAUDE_PYTHON_BUDGET_PROD
+}
+if ($env:CLAUDE_PYTHON_BUDGET_TEST -match '^\d+$') {
+    $testCap = [int]$env:CLAUDE_PYTHON_BUDGET_TEST
+}
+
+$decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $env:CLAUDE_TOOL_INPUT -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
+if ($decision.decision -eq 'block') {
+    $decision.Remove('state')
+    $decision | ConvertTo-Json -Compress | Write-Output
+}
+
+exit 0

package/resources/claude-customizations/.claude/hooks/validate-bash.ps1

@@ -0,0 +1,69 @@
+<#
+.SYNOPSIS
+    Pre-tool-use hook for Claude Code that blocks dangerous Bash commands.
+
+.DESCRIPTION
+    This script is invoked by the Claude Code PreToolUse hook before any Bash
+    command is executed. It reads the proposed command string from the
+    CLAUDE_TOOL_INPUT environment variable (JSON with a 'command' field) or
+    falls back to the first positional argument. If the command matches any
+    blocked pattern (destructive operations such as forced deletions, forced
+    pushes, or hard resets), the script exits with code 1 to prevent execution.
+    Safe commands exit with code 0.
+
+.NOTES
+    Compatible with PowerShell 7+.
+    This script must not modify any state; it is a read-only validation gate.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Position = 0, Mandatory = $false)]
+    [string]$CommandInput
+)
+
+# Blocked patterns that represent destructive or irreversible operations.
+$blockedPatterns = @(
+    'rm -rf',
+    'git push --force',
+    'git push origin --force',
+    'Remove-Item -Recurse -Force',
+    'git reset --hard',
+    'git push -f'
+)
+
+# Resolve the command string from CLAUDE_TOOL_INPUT JSON or positional argument.
+$commandToCheck = ''
+
+if ($env:CLAUDE_TOOL_INPUT) {
+    try {
+        $parsed = $env:CLAUDE_TOOL_INPUT | ConvertFrom-Json
+        if ($parsed.command) {
+            $commandToCheck = $parsed.command
+        }
+    }
+    catch {
+        # If JSON parsing fails, treat the raw environment variable as the command.
+        $commandToCheck = $env:CLAUDE_TOOL_INPUT
+    }
+}
+
+# Fall back to positional argument when the environment variable is absent or empty.
+if (-not $commandToCheck -and $CommandInput) {
+    $commandToCheck = $CommandInput
+}
+
+# When no command is provided, allow execution (nothing to validate).
+if (-not $commandToCheck) {
+    exit 0
+}
+
+# Check the command against each blocked pattern.
+foreach ($pattern in $blockedPatterns) {
+    if ($commandToCheck.Contains($pattern)) {
+        Write-Error "Blocked dangerous command pattern detected: '$pattern'"
+        exit 1
+    }
+}
+
+# Command passed all checks.
+exit 0

package/resources/claude-customizations/.claude/hooks/validate-executor-output.ps1

@@ -0,0 +1,296 @@
+<#
+.SYNOPSIS
+    SubagentStop hook for the atomic-executor subagent.
+
+.DESCRIPTION
+    Blocks termination of the atomic-executor subagent unless the output and
+    plan state satisfy the executor's mechanical contract.
+
+    Enforced checks:
+      - hook payload is valid JSON and contains non-empty output,
+      - output advertises `plan-path: <path>` (or supported equivalent forms),
+      - the advertised plan exists on disk,
+      - preflight-only runs return an exact preflight signal and may not claim
+        non-canonical blocked text,
+      - non-preflight runs may not stop in a blocked state,
+      - non-preflight plans contain checkboxes and all are checked,
+      - non-preflight output includes `AC Status Summary`,
+      - non-preflight output includes command/status reporting,
+      - for each language referenced by explicit file paths in the plan, the
+        output includes a PASS or FAIL status line for that language.
+
+.NOTES
+    Reads the hook payload from CLAUDE_HOOK_INPUT as JSON. Exits 0 to allow
+    termination; exits 1 with an error message to block. Plan file contents are
+    read through Get-PlanFileContent so tests can mock the filesystem boundary
+    without writing temporary files.
+#>
+
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Get-PlanFileContent {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Path
+    )
+
+    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) {
+        return @{ Exists = $false; Lines = @() }
+    }
+
+    $lines = Get-Content -LiteralPath $Path -ErrorAction Stop
+    if ($null -eq $lines) {
+        $lines = @()
+    }
+    elseif ($lines -isnot [array]) {
+        $lines = @($lines)
+    }
+
+    return @{ Exists = $true; Lines = $lines }
+}
+
+function Get-PlanPathFromOutput {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $AgentOutput
+    )
+
+    $pattern = 'plan-path\s*[:=]\s*["'']?([^\s"''\)`]+)|\[plan-path\]\(([^)]+)\)'
+    $match = [regex]::Match($AgentOutput, $pattern, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+    if (-not $match.Success) {
+        return $null
+    }
+
+    $value = if ($match.Groups[1].Success) { $match.Groups[1].Value } else { $match.Groups[2].Value }
+    $value = $value.Trim()
+    if ([string]::IsNullOrWhiteSpace($value)) {
+        return $null
+    }
+
+    return $value
+}
+
+function Test-IsPreflightPlan {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]] $Lines
+    )
+
+    return @($Lines | Where-Object { $_ -match '(?i)^\s*DIRECTIVE:\s*PREFLIGHT VALIDATION ONLY\s*$' }).Count -gt 0
+}
+
+function Get-TouchedLanguagesFromPlan {
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]] $Lines
+    )
+
+    $languages = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $pathPattern = '(?i)(?:[.\w*?-]+[\\/])+[.\w*?-]+'
+
+    foreach ($line in $Lines) {
+        foreach ($match in [regex]::Matches($line, $pathPattern)) {
+            $extension = [System.IO.Path]::GetExtension($match.Value).ToLowerInvariant()
+            switch -Regex ($extension) {
+                '^\.(ts|tsx)$' { $null = $languages.Add('TypeScript') }
+                '^\.py$' { $null = $languages.Add('Python') }
+                '^\.(ps1|psm1|psd1)$' { $null = $languages.Add('PowerShell') }
+                '^\.cs$' { $null = $languages.Add('CSharp') }
+            }
+        }
+    }
+
+    return [string[]]@($languages)
+}
+
+function Test-OutputHasLanguageStatus {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $AgentOutput,
+
+        [Parameter(Mandatory = $true)]
+        [string] $Language
+    )
+
+    $labelMap = @{
+        'TypeScript' = @('TypeScript', 'typescript')
+        'Python'     = @('Python', 'python')
+        'PowerShell' = @('PowerShell', 'powershell')
+        'CSharp'     = @('C#', 'CSharp', 'csharp', '\.NET', 'dotnet')
+    }
+
+    $labels = $labelMap[$Language]
+    $labelPattern = '(?i)(' + (($labels | ForEach-Object { $_ }) -join '|') + ')'
+    return [regex]::IsMatch($AgentOutput, "(?im)^.*$labelPattern.*\b(PASS|FAIL)\b.*$")
+}
+
+function Test-HasPreflightSignal {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $AgentOutput
+    )
+
+    return [regex]::IsMatch(
+        $AgentOutput,
+        '(?m)^\s*PREFLIGHT:\s*(ALL CLEAR|REVISIONS REQUIRED)\s*$'
+    )
+}
+
+function Test-HasCanonicalBlockedText {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $AgentOutput
+    )
+
+    if ($AgentOutput -notmatch 'BLOCKED') {
+        return $true
+    }
+
+    if ($AgentOutput -notmatch 'BLOCKED at preflight \(before \[P0-T1\]\)') {
+        return $false
+    }
+
+    if ($AgentOutput -notmatch '(?i)plan delta' -and $AgentOutput -notmatch '\[P\d+-T\d+\]') {
+        return $false
+    }
+
+    return $true
+}
+
+function Invoke-ExecutorOutputValidation {
+    [CmdletBinding()]
+    [OutputType([hashtable])]
+    param(
+        [string] $RawPayload
+    )
+
+    if ([string]::IsNullOrWhiteSpace($RawPayload)) {
+        return @{ Ok = $false; Message = 'atomic-executor hook: CLAUDE_HOOK_INPUT is empty; cannot validate executor output.' }
+    }
+
+    try {
+        $payload = $RawPayload | ConvertFrom-Json -ErrorAction Stop
+    }
+    catch {
+        return @{ Ok = $false; Message = "atomic-executor hook: failed to parse CLAUDE_HOOK_INPUT as JSON: $($_.Exception.Message)" }
+    }
+
+    $agentOutput = $null
+    if ($payload.PSObject.Properties.Name -contains 'output') {
+        $agentOutput = $payload.output
+    }
+    if ([string]::IsNullOrWhiteSpace($agentOutput)) {
+        return @{ Ok = $false; Message = 'atomic-executor hook: agent output is empty; executor must return plan-path and final completion summary.' }
+    }
+
+    $planPath = Get-PlanPathFromOutput -AgentOutput $agentOutput
+    if ($null -eq $planPath) {
+        return @{ Ok = $false; Message = 'atomic-executor hook: agent output does not advertise a plan-path. Executor must report `plan-path: <path>` per atomic-plan-contract.' }
+    }
+
+    $file = Get-PlanFileContent -Path $planPath
+    if (-not $file.Exists) {
+        return @{ Ok = $false; Message = "atomic-executor hook: executor advertised plan-path '$planPath' but no file exists at that location." }
+    }
+
+    $isPreflight = Test-IsPreflightPlan -Lines $file.Lines
+    if ($isPreflight) {
+        if (-not (Test-HasCanonicalBlockedText -AgentOutput $agentOutput)) {
+            return @{ Ok = $false; Message = 'atomic-executor hook: blocked preflight output must include the exact text `BLOCKED at preflight (before [P0-T1])` plus a concrete plan delta.' }
+        }
+        if ($agentOutput -notmatch 'BLOCKED' -and -not (Test-HasPreflightSignal -AgentOutput $agentOutput)) {
+            return @{ Ok = $false; Message = 'atomic-executor hook: preflight output must include `PREFLIGHT: ALL CLEAR` or `PREFLIGHT: REVISIONS REQUIRED`.' }
+        }
+        return @{ Ok = $true; Message = $null }
+    }
+
+    if ($agentOutput -match 'BLOCKED') {
+        return @{ Ok = $false; Message = 'atomic-executor hook: blocking is permitted only during preflight validation (before [P0-T1]).' }
+    }
+
+    $checkboxLineCount = 0
+    $uncheckedLineNumbers = [System.Collections.Generic.List[int]]::new()
+    $uncheckedPattern = '^\s*-\s\[\s\]\s'
+    $checkedPattern = '^\s*-\s\[[xX]\]\s'
+
+    for ($i = 0; $i -lt $file.Lines.Count; $i++) {
+        $line = $file.Lines[$i]
+        if ($line -match $uncheckedPattern) {
+            $checkboxLineCount++
+            $uncheckedLineNumbers.Add($i + 1)
+        }
+        elseif ($line -match $checkedPattern) {
+            $checkboxLineCount++
+        }
+    }
+
+    if ($checkboxLineCount -eq 0) {
+        return @{ Ok = $false; Message = "atomic-executor hook: plan file '$planPath' contains no task checkboxes; executor cannot complete against an empty plan." }
+    }
+
+    if ($uncheckedLineNumbers.Count -gt 0) {
+        $reported = $uncheckedLineNumbers
+        $suffix = ''
+        if ($uncheckedLineNumbers.Count -gt 5) {
+            $reported = $uncheckedLineNumbers.GetRange(0, 5)
+            $suffix = ' (showing first 5)'
+        }
+        $lineList = ($reported -join ', ')
+        $message = "atomic-executor hook: plan file '$planPath' has $($uncheckedLineNumbers.Count) unchecked task(s) at line(s) ${lineList}${suffix}. All `- [ ]` items must be ticked to `- [x]` before termination."
+        return @{ Ok = $false; Message = $message }
+    }
+
+    if ($agentOutput -notmatch '(?i)\bAC Status Summary\b') {
+        return @{ Ok = $false; Message = 'atomic-executor hook: completion output must include an `AC Status Summary` section.' }
+    }
+
+    $hasCommandEvidence = $agentOutput -match '(?i)(Commands Run|Command[s]?:|poetry run |npx |pwsh |git |mcp__drmCopilotExtension__)'
+    $hasStatusEvidence = $agentOutput -match '(?i)\b(PASS|FAIL)\b'
+    if (-not $hasCommandEvidence -or -not $hasStatusEvidence) {
+        return @{ Ok = $false; Message = 'atomic-executor hook: completion output must report commands run and pass/fail status results.' }
+    }
+
+    $missingLanguageStatuses = [System.Collections.Generic.List[string]]::new()
+    foreach ($language in Get-TouchedLanguagesFromPlan -Lines $file.Lines) {
+        if (-not (Test-OutputHasLanguageStatus -AgentOutput $agentOutput -Language $language)) {
+            $missingLanguageStatuses.Add($language)
+        }
+    }
+
+    if ($missingLanguageStatuses.Count -gt 0) {
+        $missingList = $missingLanguageStatuses -join ', '
+        return @{ Ok = $false; Message = "atomic-executor hook: completion output is missing explicit PASS/FAIL toolchain status lines for: $missingList." }
+    }
+
+    return @{ Ok = $true; Message = $null }
+}
+
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+$result = Invoke-ExecutorOutputValidation -RawPayload $env:CLAUDE_HOOK_INPUT
+if (-not $result.Ok) {
+    Write-Error $result.Message
+    exit 1
+}
+
+exit 0