@danmoisan/drm-copilot-mcp 1.0.0 → 1.0.7

package/resources/claude-customizations/.claude/hooks/enforce-orchestration-preimplementation-gate.ps1

@@ -130,6 +130,36 @@ function Get-CheckpointContent {
     return Get-Content -Raw -LiteralPath $script:CheckpointPath
 }
 
+function Get-OrchestrationPreimplementationGateAllowDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName      = 'PreToolUse'
+            permissionDecision = 'allow'
+        }
+    }
+}
+
+function Get-OrchestrationPreimplementationGateBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
 function Invoke-OrchestrationPreimplementationGateDecision {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -139,7 +169,7 @@ function Invoke-OrchestrationPreimplementationGateDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return Get-OrchestrationPreimplementationGateAllowDecision
     }
     try {
         $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
@@ -162,7 +192,7 @@ function Invoke-OrchestrationPreimplementationGateDecision {
     }
 
     if (-not $requiresReadyCheckpoint) {
-        return [ordered]@{ decision = 'allow' }
+        return Get-OrchestrationPreimplementationGateAllowDecision
     }
 
     if (-not $CheckpointRaw) {
@@ -175,12 +205,9 @@ function Invoke-OrchestrationPreimplementationGateDecision {
     }
 
     if (Test-OrchestrationReady -Payload $checkpoint) {
-        return [ordered]@{ decision = 'allow' }
-    }
-    return [ordered]@{
-        decision = 'block'
-        reason   = 'PREIMPLEMENTATION_GATE_BLOCKED: Implementation operations require artifacts/orchestration/orchestrator-state.json to contain issue number, feature folder, route metadata, lifecycle readiness, and checkpoint state before implementation begins.'
+        return Get-OrchestrationPreimplementationGateAllowDecision
     }
+    return Get-OrchestrationPreimplementationGateBlockDecision -Reason 'PREIMPLEMENTATION_GATE_BLOCKED: Implementation operations require artifacts/orchestration/orchestrator-state.json to contain issue number, feature folder, route metadata, lifecycle readiness, and checkpoint state before implementation begins.'
 }
 
 if ($MyInvocation.InvocationName -eq '.') {
@@ -194,5 +221,5 @@ try {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-powershell-batch-budget.ps1

@@ -26,10 +26,10 @@
     before the session starts, or by writing {"prodCap": N, "testCap": M} into the
     state file.
 
-    When the cap would be exceeded by a new file, the script emits a JSON response with
-    'decision': 'block' and exits 0. The session must explicitly reset the counter by
-    deleting the state file before starting a new batch. Files already counted are
-    always allowed through.
+    When the cap would be exceeded by a new file, the script emits a PreToolUse JSON
+    response with hookSpecificOutput.permissionDecision = 'deny' and exits 0. The session
+    must explicitly reset the counter by deleting the state file before starting a new
+    batch. Files already counted are always allowed through.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -90,8 +90,11 @@ function Get-PowerShellBatchBudgetBlockDecision {
     )
 
     $decision = [ordered]@{
-        decision = 'block'
-        reason   = $Reason
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
     }
     if ($State) {
         $decision.state = $State
@@ -116,7 +119,7 @@ function Invoke-PowerShellBatchBudgetDecision {
 
     $normalized = $FilePath -replace '\\', '/'
     if ($normalized -notmatch '\.(ps1|psm1|psd1)$') {
-        return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $false }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
     $isTestFile = ($normalized -match '(^|/)tests/.*\.ps1$') -or ($normalized -match '\.Tests\.ps1$')
@@ -125,7 +128,7 @@ function Invoke-PowerShellBatchBudgetDecision {
     $kind = if ($isTestFile) { 'test' } else { 'production' }
 
     if ($targetList -contains $normalized) {
-        return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $false }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
     if ($targetList.Count -ge $cap) {
@@ -141,7 +144,7 @@ function Invoke-PowerShellBatchBudgetDecision {
         $State.prodFiles = @($State.prodFiles) + @($normalized)
     }
 
-    return [ordered]@{ decision = 'allow'; state = $State; shouldWriteState = $true }
+    return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $true }
 }
 
 function Invoke-PowerShellBatchBudgetHook {
@@ -163,7 +166,7 @@ function Invoke-PowerShellBatchBudgetHook {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -174,12 +177,12 @@ function Invoke-PowerShellBatchBudgetHook {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $normalized = $filePath -replace '\\', '/'
     if ($normalized -notmatch '\.(ps1|psm1|psd1)$') {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $stateDir = Join-Path -Path $Root -ChildPath '.claude/state'
@@ -230,9 +233,9 @@ if ($env:CLAUDE_POWERSHELL_BUDGET_TEST -match '^\d+$') {
 }
 
 $decision = Invoke-PowerShellBatchBudgetHook -ToolInputRaw $env:CLAUDE_TOOL_INPUT -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
-if ($decision.decision -eq 'block') {
+if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
     $decision.Remove('state')
-    $decision | ConvertTo-Json -Compress | Write-Output
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 }
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-pr-author-skill.epic-base-branch.ps1

@@ -0,0 +1,104 @@
+<#
+.SYNOPSIS
+    Dot-sourced by enforce-pr-author-skill.ps1 to keep that file under the repository's
+    500-line hard cap.
+
+.DESCRIPTION
+    Contains the epic-mode base-branch override check (Get-PrAuthorCheckpointContent and
+    Test-EpicBaseBranchOverride) extracted verbatim from enforce-pr-author-skill.ps1. This is a
+    structural extraction only: no logic, decision behavior, or reason-string wording changed.
+#>
+
+function Get-PrAuthorCheckpointContent {
+    <#
+    .SYNOPSIS
+        Read the raw JSON text of the per-feature orchestrator checkpoint. Tests mock this
+        function (read seam) for the epic-mode base-branch override check.
+    .DESCRIPTION
+        Returns the raw text content of artifacts/orchestration/orchestrator-state.json, or
+        $null when the file is absent. This is the injectable boundary for checkpoint content
+        used by Test-EpicBaseBranchOverride; no test writes the checkpoint file to disk.
+    .PARAMETER CheckpointPath
+        The relative path to the per-feature orchestrator checkpoint.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string] $CheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
+    )
+
+    if (-not (Test-Path -LiteralPath $CheckpointPath)) {
+        return $null
+    }
+
+    return (Get-Content -LiteralPath $CheckpointPath -Raw)
+}
+
+function Test-EpicBaseBranchOverride {
+    <#
+    .SYNOPSIS
+        Sixth ordered check: enforce the epic-mode --base override for gh pr create.
+    .DESCRIPTION
+        Reads the per-feature checkpoint via the injectable Get-PrAuthorCheckpointContent
+        seam. When the checkpoint has epic_mode == true, a gh pr create command text MUST
+        contain --base <epic_context.integration_branch> with the exact branch value recorded
+        in the checkpoint; a missing --base, or a --base value that does not match, is denied
+        with reason EPIC_BASE_BRANCH_MISMATCH. When epic_mode is absent or false, when the
+        checkpoint is unreadable, or when the command is not gh pr create (the base branch is
+        set at create time, not edit time), this check is a no-op and standalone behavior is
+        unchanged.
+    .PARAMETER CommandText
+        The Bash command text under evaluation.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $CommandText
+    )
+
+    # The epic-mode base-branch override only constrains gh pr create; gh pr edit does not
+    # re-target the base branch, so non-create commands are out of scope for this check.
+    if ($CommandText -notmatch '(?i)\bgh\s+pr\s+create\b') {
+        return $null
+    }
+
+    $checkpointRaw = Get-PrAuthorCheckpointContent
+    if ([string]::IsNullOrWhiteSpace($checkpointRaw)) {
+        return $null
+    }
+
+    try {
+        $checkpoint = $checkpointRaw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        return $null
+    }
+
+    $checkpointProps = @($checkpoint.PSObject.Properties.Name)
+    if ($checkpointProps -notcontains 'epic_mode' -or -not [bool]$checkpoint.epic_mode) {
+        return $null
+    }
+
+    $integrationBranch = $null
+    if ($checkpointProps -contains 'epic_context' -and $null -ne $checkpoint.epic_context) {
+        $epicContextProps = @($checkpoint.epic_context.PSObject.Properties.Name)
+        if ($epicContextProps -contains 'integration_branch') {
+            $integrationBranch = [string]$checkpoint.epic_context.integration_branch
+        }
+    }
+
+    if ([string]::IsNullOrWhiteSpace($integrationBranch)) {
+        return "EPIC_BASE_BRANCH_MISMATCH: checkpoint has epic_mode == true but no ``epic_context.integration_branch`` is recorded; ``gh pr create`` cannot be verified against the required ``--base`` value."
+    }
+
+    if ($CommandText -cnotmatch [regex]::Escape("--base $integrationBranch")) {
+        return "EPIC_BASE_BRANCH_MISMATCH: ``gh pr create`` must pass ``--base $integrationBranch`` (``epic_context.integration_branch``) under ``epic_mode``; the command does not carry a matching ``--base`` argument."
+    }
+
+    return $null
+}