@danmoisan/drm-copilot-mcp 1.0.1 → 1.0.8

package/resources/claude-customizations/.claude/hooks/check-powershell-test-purity.ps1

@@ -20,9 +20,9 @@
       - subprocess execution (Start-Process with raw executables)
       - time-based flakiness (Start-Sleep)
 
-    If the content contains any forbidden pattern, the script writes a JSON response
-    to stdout with 'decision': 'block' and exits with code 0 to let Claude Code surface
-    the reason.
+    If the content contains any forbidden pattern, the script writes a PreToolUse JSON
+    response to stdout with hookSpecificOutput.permissionDecision = 'deny' and exits with
+    code 0 to let Claude Code surface the reason.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -32,80 +32,118 @@
 [CmdletBinding()]
 param()
 
-$toolInputRaw = $env:CLAUDE_TOOL_INPUT
-if (-not $toolInputRaw) {
-    exit 0
+function Get-PowerShellTestPurityBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
 }
 
-try {
-    $toolInput = $toolInputRaw | ConvertFrom-Json -ErrorAction Stop
-}
-catch {
-    exit 0
-}
+function Test-PowerShellTestFilePath {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $FilePath
+    )
 
-$filePath = $toolInput.file_path
-if (-not $filePath) {
-    exit 0
+    $normalized = $FilePath -replace '\\', '/'
+    return (($normalized -match '(^|/)tests/.*\.ps1$') -or ($normalized -match '\.Tests\.ps1$'))
 }
 
-$normalized = $filePath -replace '\\', '/'
-$isPowerShellTestFile = ($normalized -match '(^|/)tests/.*\.ps1$') -or ($normalized -match '\.Tests\.ps1$')
-if (-not $isPowerShellTestFile) {
-    exit 0
-}
+function Invoke-PowerShellTestPurityDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [string] $ToolInputRaw
+    )
 
-$content = $null
-if ($null -ne $toolInput.content) {
-    $content = [string]$toolInput.content
-}
-elseif ($null -ne $toolInput.new_string) {
-    $content = [string]$toolInput.new_string
-}
+    if (-not $ToolInputRaw) {
+        return $null
+    }
 
-if (-not $content) {
-    exit 0
-}
+    try {
+        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
+    }
+    catch {
+        return $null
+    }
 
-$forbiddenPatterns = @(
-    @{ Pattern = '(?m)^\s*Mock\s+git\b'; Reason = 'direct Mock git forbidden in Pester tests; mock the Invoke-GitExe wrapper instead' },
-    @{ Pattern = '(?m)^\s*Mock\s+gh\b'; Reason = 'direct Mock gh forbidden in Pester tests; mock the Invoke-GhExe wrapper instead' },
-    @{ Pattern = '(?m)^\s*Mock\s+actionlint\b'; Reason = 'direct Mock actionlint forbidden in Pester tests; mock the Invoke-ActionlintExe wrapper instead' },
-    @{ Pattern = "(?m)^\s*Mock\s+['""]git['""]"; Reason = 'direct Mock ''git'' forbidden in Pester tests; mock the Invoke-GitExe wrapper instead' },
-    @{ Pattern = "(?m)^\s*Mock\s+['""]gh['""]"; Reason = 'direct Mock ''gh'' forbidden in Pester tests; mock the Invoke-GhExe wrapper instead' },
-    @{ Pattern = '\bNew-TemporaryFile\b'; Reason = 'New-TemporaryFile forbidden in Pester unit tests' },
-    @{ Pattern = '\[System\.IO\.Path\]::GetTempFileName'; Reason = 'temporary files forbidden in Pester unit tests' },
-    @{ Pattern = '\[System\.IO\.Path\]::GetTempPath'; Reason = 'temp path usage forbidden in Pester unit tests' },
-    @{ Pattern = '\$env:TEMP\b'; Reason = '$env:TEMP usage forbidden in Pester unit tests' },
-    @{ Pattern = '\$env:TMP\b'; Reason = '$env:TMP usage forbidden in Pester unit tests' },
-    @{ Pattern = '\bInvoke-WebRequest\b'; Reason = 'network access (Invoke-WebRequest) forbidden in Pester unit tests' },
-    @{ Pattern = '\bInvoke-RestMethod\b'; Reason = 'network access (Invoke-RestMethod) forbidden in Pester unit tests' },
-    @{ Pattern = '\[System\.Net\.Http\.'; Reason = 'System.Net.Http usage forbidden in Pester unit tests' },
-    @{ Pattern = '\[System\.Net\.WebRequest\]'; Reason = 'System.Net.WebRequest usage forbidden in Pester unit tests' },
-    @{ Pattern = '\[System\.Net\.Sockets\.'; Reason = 'raw socket access forbidden in Pester unit tests' },
-    @{ Pattern = '\bStart-Process\b'; Reason = 'Start-Process forbidden in Pester unit tests; mock the wrapper seam instead' },
-    @{ Pattern = '\bStart-Sleep\b'; Reason = 'Start-Sleep forbidden in Pester unit tests; avoid timing hacks' }
-)
-
-$violations = @()
-foreach ($entry in $forbiddenPatterns) {
-    if ($content -match $entry.Pattern) {
-        $violations += $entry.Reason
+    $filePath = $toolInput.file_path
+    if (-not $filePath) {
+        return $null
+    }
+
+    if (-not (Test-PowerShellTestFilePath -FilePath $filePath)) {
+        return $null
     }
-}
 
-if ($violations.Count -eq 0) {
-    exit 0
+    $content = $null
+    if ($null -ne $toolInput.content) {
+        $content = [string]$toolInput.content
+    }
+    elseif ($null -ne $toolInput.new_string) {
+        $content = [string]$toolInput.new_string
+    }
+
+    if (-not $content) {
+        return $null
+    }
+
+    $forbiddenPatterns = @(
+        @{ Pattern = '(?m)^\s*Mock\s+git\b'; Reason = 'direct Mock git forbidden in Pester tests; mock the Invoke-GitExe wrapper instead' },
+        @{ Pattern = '(?m)^\s*Mock\s+gh\b'; Reason = 'direct Mock gh forbidden in Pester tests; mock the Invoke-GhExe wrapper instead' },
+        @{ Pattern = '(?m)^\s*Mock\s+actionlint\b'; Reason = 'direct Mock actionlint forbidden in Pester tests; mock the Invoke-ActionlintExe wrapper instead' },
+        @{ Pattern = "(?m)^\s*Mock\s+['""]git['""]"; Reason = 'direct Mock ''git'' forbidden in Pester tests; mock the Invoke-GitExe wrapper instead' },
+        @{ Pattern = "(?m)^\s*Mock\s+['""]gh['""]"; Reason = 'direct Mock ''gh'' forbidden in Pester tests; mock the Invoke-GhExe wrapper instead' },
+        @{ Pattern = '\bNew-TemporaryFile\b'; Reason = 'New-TemporaryFile forbidden in Pester unit tests' },
+        @{ Pattern = '\[System\.IO\.Path\]::GetTempFileName'; Reason = 'temporary files forbidden in Pester unit tests' },
+        @{ Pattern = '\[System\.IO\.Path\]::GetTempPath'; Reason = 'temp path usage forbidden in Pester unit tests' },
+        @{ Pattern = '\$env:TEMP\b'; Reason = '$env:TEMP usage forbidden in Pester unit tests' },
+        @{ Pattern = '\$env:TMP\b'; Reason = '$env:TMP usage forbidden in Pester unit tests' },
+        @{ Pattern = '\bInvoke-WebRequest\b'; Reason = 'network access (Invoke-WebRequest) forbidden in Pester unit tests' },
+        @{ Pattern = '\bInvoke-RestMethod\b'; Reason = 'network access (Invoke-RestMethod) forbidden in Pester unit tests' },
+        @{ Pattern = '\[System\.Net\.Http\.'; Reason = 'System.Net.Http usage forbidden in Pester unit tests' },
+        @{ Pattern = '\[System\.Net\.WebRequest\]'; Reason = 'System.Net.WebRequest usage forbidden in Pester unit tests' },
+        @{ Pattern = '\[System\.Net\.Sockets\.'; Reason = 'raw socket access forbidden in Pester unit tests' },
+        @{ Pattern = '\bStart-Process\b'; Reason = 'Start-Process forbidden in Pester unit tests; mock the wrapper seam instead' },
+        @{ Pattern = '\bStart-Sleep\b'; Reason = 'Start-Sleep forbidden in Pester unit tests; avoid timing hacks' }
+    )
+
+    $violations = @()
+    foreach ($entry in $forbiddenPatterns) {
+        if ($content -match $entry.Pattern) {
+            $violations += $entry.Reason
+        }
+    }
+
+    if ($violations.Count -eq 0) {
+        return $null
+    }
+
+    $uniqueViolations = $violations | Select-Object -Unique
+    $reason = "PowerShell unit test purity violations in '$filePath': " + ($uniqueViolations -join '; ') + ". Replace with wrapper-seam mocks, in-memory fakes, or pure code paths per .claude/rules/powershell.md."
+
+    return Get-PowerShellTestPurityBlockDecision -Reason $reason
 }
 
-$uniqueViolations = $violations | Select-Object -Unique
-$reason = "PowerShell unit test purity violations in '$filePath': " + ($uniqueViolations -join '; ') + ". Replace with wrapper-seam mocks, in-memory fakes, or pure code paths per .claude/rules/powershell.md."
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
 
-$response = @{
-    decision = 'block'
-    reason   = $reason
-} | ConvertTo-Json -Compress
+$decision = Invoke-PowerShellTestPurityDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
+if ($null -ne $decision -and $decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+}
 
-Write-Output $response
 exit 0
-

package/resources/claude-customizations/.claude/hooks/check-python-test-purity.ps1

@@ -38,8 +38,11 @@ function Get-PythonTestPurityBlockDecision {
     )
 
     [ordered]@{
-        decision = 'block'
-        reason   = $Reason
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
     }
 }
 
@@ -63,7 +66,7 @@ function Invoke-PythonTestPurityDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     try {
@@ -74,11 +77,11 @@ function Invoke-PythonTestPurityDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     if (-not (Test-PythonTestFilePath -FilePath $filePath)) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $content = $null
@@ -89,7 +92,7 @@ function Invoke-PythonTestPurityDecision {
     }
 
     if (-not $content) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $forbiddenPatterns = @(
@@ -125,7 +128,7 @@ function Invoke-PythonTestPurityDecision {
     }
 
     if ($violations.Count -eq 0) {
-        return [ordered]@{ decision = 'allow' }
+        return $null
     }
 
     $uniqueViolations = $violations | Select-Object -Unique
@@ -139,8 +142,8 @@ if ($MyInvocation.InvocationName -eq '.') {
 }
 
 $decision = Invoke-PythonTestPurityDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
-if ($decision.decision -eq 'block') {
-    $decision | ConvertTo-Json -Compress | Write-Output
+if ($null -ne $decision -and $decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 }
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-checkpoint-monotonic.ps1

@@ -27,9 +27,11 @@
 
     Entries that do not match any canonical prefix are treated as informational
     and ignored. If any pair (i, j) with i < j has a higher canonical index at
-    position i than at position j, the script blocks with a reason listing the
-    offending pair. A non-empty rollback_history array suppresses this check
-    because rollbacks legitimately reorder steps.
+    position i than at position j, the script denies via a PreToolUse JSON
+    response with hookSpecificOutput.permissionDecision='deny' and a reason
+    listing the offending pair. A non-empty rollback_history array suppresses
+    this check because rollbacks legitimately reorder steps. All allow paths
+    emit hookSpecificOutput.permissionDecision='allow'.
 
     Edit tool calls supply only old_string/new_string (a partial patch) and
     cannot be reliably validated without the full target file content, so they
@@ -204,7 +206,7 @@ function Invoke-CheckpointMonotonicDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -216,19 +218,19 @@ function Invoke-CheckpointMonotonicDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $normalized = $filePath -replace '\\', '/'
     if (-not (Test-IsCheckpointPath -NormalizedPath $normalized)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     # Write tool: validate the content payload. Edit tool: partial new_string is
     # not reliable without the full target file content, so allow.
     $content = $toolInput.content
     if (-not $content) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -237,11 +239,11 @@ function Invoke-CheckpointMonotonicDecision {
     catch {
         # The content itself is not valid JSON. Let downstream tools surface the
         # error rather than blocking with a misleading reason here.
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     if (-not $payload.PSObject.Properties.Name -contains 'completed_steps') {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $steps = @()
@@ -256,14 +258,17 @@ function Invoke-CheckpointMonotonicDecision {
         $rollbackHistory = $payload.rollback_history
     }
     if ($rollbackHistory -and @($rollbackHistory).Count -gt 0) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $pair = if ($steps.Count -ge 2) { Get-OutOfOrderPair -CompletedSteps $steps } else { $null }
     if ($null -ne $pair) {
         return [ordered]@{
-            decision = 'block'
-            reason   = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($pair.EarlierEntry)' at position $($pair.EarlierPos) before '$($pair.LaterEntry)' at position $($pair.LaterPos), but the canonical orchestrator workflow requires the later step to follow the earlier one. Reorder completed_steps or, if a rollback occurred, record it in rollback_history."
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($pair.EarlierEntry)' at position $($pair.EarlierPos) before '$($pair.LaterEntry)' at position $($pair.LaterPos), but the canonical orchestrator workflow requires the later step to follow the earlier one. Reorder completed_steps or, if a rollback occurred, record it in rollback_history."
+            }
         }
     }
 
@@ -277,12 +282,15 @@ function Invoke-CheckpointMonotonicDecision {
             $missing += 'S4_atomic_planning'
         }
         return [ordered]@{
-            decision = 'block'
-            reason   = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($missingPrerequisite.Step)' before required prerequisite step(s): $($missing -join ', '). Record promotion and planning completion before implementation, review, PR, CI, or DONE steps."
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = "CHECKPOINT_ORDER_BLOCKED: completed_steps lists '$($missingPrerequisite.Step)' before required prerequisite step(s): $($missing -join ', '). Record promotion and planning completion before implementation, review, PR, CI, or DONE steps."
+            }
         }
     }
 
-    return [ordered]@{ decision = 'allow' }
+    return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
 }
 
 # Guard allows dot-sourcing in tests without executing the entrypoint.
@@ -298,6 +306,6 @@ catch {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 
 exit 0

package/resources/claude-customizations/.claude/hooks/enforce-completion-consistency.ps1

@@ -23,9 +23,11 @@
         variables.feature-folder);
       - a ci_gate object with conclusion == "success" and a non-empty head_sha.
 
-    The block reason names the specific missing evidence so the caller can
-    remediate. When completion is not asserted, the write is allowed
-    (backward compatibility).
+    When completion evidence is missing the hook emits a PreToolUse JSON
+    response with hookSpecificOutput.permissionDecision='deny' and a reason that
+    names the specific missing evidence so the caller can remediate. When
+    completion is not asserted, the write is allowed via
+    hookSpecificOutput.permissionDecision='allow' (backward compatibility).
 
     Edit tool calls supply only old_string/new_string (a partial patch) and
     cannot be reliably validated without the full target file content, so they
@@ -331,7 +333,7 @@ function Invoke-CompletionConsistencyDecision {
     )
 
     if (-not $ToolInputRaw) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     try {
@@ -343,12 +345,12 @@ function Invoke-CompletionConsistencyDecision {
 
     $filePath = $toolInput.file_path
     if (-not $filePath) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $normalized = $filePath -replace '\\', '/'
     if (-not (Test-IsCheckpointPath -NormalizedPath $normalized)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     # Write tool: validate the content payload directly. Edit tool: no content is
@@ -360,7 +362,7 @@ function Invoke-CompletionConsistencyDecision {
         if (-not $content) {
             # No content, and the Edit could not be resolved against on-disk
             # state (missing file or non-matching patch): defer and allow.
-            return [ordered]@{ decision = 'allow' }
+            return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
         }
     }
 
@@ -370,11 +372,11 @@ function Invoke-CompletionConsistencyDecision {
     catch {
         # The content itself is not valid JSON. Let downstream tools surface the
         # error rather than blocking with a misleading reason here.
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     if (-not (Test-CompletionAsserted -Payload $payload)) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
     $missingArgs = @{ Payload = $payload; FolderExistsCheck = $FolderExistsCheck }
@@ -383,12 +385,16 @@ function Invoke-CompletionConsistencyDecision {
     }
     $missing = Get-MissingCompletionEvidence @missingArgs
     if ($missing.Count -eq 0) {
-        return [ordered]@{ decision = 'allow' }
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
 
+    $reason = "COMPLETION_CONSISTENCY_BLOCKED: the checkpoint asserts completion but is missing required completion evidence: $($missing -join ', '). A completion-asserting checkpoint must include a non-empty issue-num, a non-empty feature-folder, and a ci_gate object with conclusion == 'success' and a non-empty head_sha; routes whose requires_pr_gate is true must also include pr_gate evidence with a matching head_sha. Supply the missing evidence or remove the completion assertion."
     return [ordered]@{
-        decision = 'block'
-        reason   = "COMPLETION_CONSISTENCY_BLOCKED: the checkpoint asserts completion but is missing required completion evidence: $($missing -join ', '). A completion-asserting checkpoint must include a non-empty issue-num, a non-empty feature-folder, and a ci_gate object with conclusion == 'success' and a non-empty head_sha; routes whose requires_pr_gate is true must also include pr_gate evidence with a matching head_sha. Supply the missing evidence or remove the completion assertion."
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $reason
+        }
     }
 }
 
@@ -405,6 +411,6 @@ catch {
     exit 1
 }
 
-$decision | ConvertTo-Json -Compress | Write-Output
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
 
 exit 0