@danmoisan/drm-copilot-mcp 1.0.18 → 1.0.20

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-planning-only.ps1

@@ -245,6 +245,28 @@ function Invoke-EpicPlanningOnlyDecision {
     return Get-EpicPlanningDenyDecision -Reason "tool '$toolName' is not classified for preparation mode."
 }
 
+function Invoke-EpicPlanningGit {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string[]] $GitArgs)
+
+    return & git @GitArgs 2>$null
+}
+
+function Get-EpicPlanningCurrentBranch {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $RepositoryRoot)
+
+    $currentBranch = [string](Invoke-EpicPlanningGit -GitArgs @('-C', $RepositoryRoot, 'branch', '--show-current'))
+    if ($LASTEXITCODE -ne 0) {
+        throw 'EPIC_PLANNING_ONLY_BLOCKED: current branch could not be resolved before push.'
+    }
+    if ([string]::IsNullOrWhiteSpace($currentBranch)) {
+        return ''
+    }
+    return $currentBranch.Trim()
+}
+
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
@@ -270,11 +292,7 @@ try {
     }
     if ([string]$payload.tool_name -eq 'Bash' -and
         [string]$payload.tool_input.command -match '^\s*git\s+push\b') {
-        $currentBranch = [string](& git -C $repositoryRoot branch --show-current 2>$null)
-        if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($currentBranch)) {
-            throw 'EPIC_PLANNING_ONLY_BLOCKED: current branch could not be resolved before push.'
-        }
-        $currentBranch = $currentBranch.Trim()
+        $currentBranch = Get-EpicPlanningCurrentBranch -RepositoryRoot $repositoryRoot
     }
     $decision = Invoke-EpicPlanningOnlyDecision `
         -PayloadRaw $payloadRaw `

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-evidence-locations.ps1

@@ -30,9 +30,9 @@
 
     If the file_path resolves to a forbidden prefix, the script writes a PreToolUse JSON
     response to stdout with hookSpecificOutput.permissionDecision = 'deny' and exits with
-    code 0 so Codex surfaces the reason. For allowed paths, a PreToolUse response
-    with permissionDecision = 'allow' is written to stdout and the script exits 0. On hard
-    failure (malformed JSON input), the script exits 2.
+    code 0 so Codex surfaces the reason. Allowed paths produce NO stdout at all: the
+    script allows silently and exits 0. On hard failure (empty, malformed, or
+    tool_input-less stdin) the script writes the reason to stderr and exits 2.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -41,6 +41,10 @@
 [CmdletBinding()]
 param()
 
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+
 function Test-EvidenceLocationForbidden {
     <#
     .SYNOPSIS
@@ -142,60 +146,34 @@ function Invoke-EvidenceLocationDecision {
     return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
 }
 
-function ConvertFrom-CodexEvidenceLocationPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-evidence-locations hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-evidence-locations hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-evidence-locations hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-evidence-locations requires a PreToolUse apply_patch payload.'
-    }
-    return $payload
-}
-
-function Get-CodexEvidenceLocationPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-evidence-locations cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-evidence-locations received an unrecognized apply_patch command.'
-    }
-    foreach ($path in $paths) {
-        Write-Output ([string]$path)
-    }
-}
-
 function Invoke-EvidenceLocationEntryPoint {
+    <#
+    .SYNOPSIS
+        Reads one Codex PreToolUse payload and returns the process exit code.
+    .PARAMETER PayloadRaw
+        The raw stdin text. AllowEmptyString is required so empty input reaches
+        the shared parser and fails closed with exit 2, rather than raising a
+        parameter-binding error that would skip the exit and allow silently.
+    #>
     [CmdletBinding()]
     [OutputType([int])]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $PayloadRaw)
 
     try {
-        $payload = ConvertFrom-CodexEvidenceLocationPayload -PayloadRaw $PayloadRaw
-        foreach ($path in @(Get-CodexEvidenceLocationPath -Payload $payload)) {
+        $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw $PayloadRaw -HookName 'enforce-evidence-locations'
+
+        # Both sides of a rename are evaluated, matching the pre-fix path scan
+        # that collected Add/Update/Delete targets and Move destinations alike.
+        # A well-formed payload that maps to no file yields no paths, so the loop
+        # body never runs and the hook allows silently.
+        $paths = @(
+            @(ConvertTo-CodexFileEditInput -Payload $payload) |
+                ForEach-Object { $_.source_path; $_.file_path } |
+                    Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                        Select-Object -Unique
+        )
+
+        foreach ($path in $paths) {
             $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
             $decision = Invoke-EvidenceLocationDecision -ToolInputRaw $toolInputRaw
             if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1

@@ -6,6 +6,10 @@
 [CmdletBinding()]
 param()
 
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+
 $script:CheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 
 function ConvertFrom-CheckpointJson {
@@ -224,38 +228,35 @@ function Invoke-OrchestrationPreimplementationGateDecision {
     return Get-OrchestrationPreimplementationGateBlockDecision -Reason 'PREIMPLEMENTATION_GATE_BLOCKED: Implementation operations require artifacts/orchestration/orchestrator-state.json to contain issue number, feature folder, route metadata, lifecycle readiness, and checkpoint state before implementation begins.'
 }
 
-function ConvertFrom-CodexPreimplementationHookPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-orchestration-preimplementation-gate hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-orchestration-preimplementation-gate hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-orchestration-preimplementation-gate hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or
-        @('Bash', 'apply_patch') -notcontains [string]$payload.tool_name) {
-        throw 'enforce-orchestration-preimplementation-gate requires a supported PreToolUse payload.'
-    }
-    return $payload
-}
-
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
 try {
-    $payload = ConvertFrom-CodexPreimplementationHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
-    $toolInputRaw = $payload.tool_input | ConvertTo-Json -Compress -Depth 20
-    $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw $toolInputRaw
-    if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
-        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-orchestration-preimplementation-gate'
+    $toolName = [string]$payload.tool_name
+
+    # Bash and apply_patch take the pre-fix path unchanged: the raw tool_input is
+    # serialized and evaluated by the untouched decision function, so every
+    # allow/deny outcome those two tool names produce today is preserved exactly.
+    if (@('Bash', 'apply_patch') -contains $toolName) {
+        $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw ($payload.tool_input | ConvertTo-Json -Compress -Depth 20)
+        if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+            $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+        }
+        exit 0
+    }
+
+    # Edit and Write map to file paths through the shared module; each mapped
+    # path enters the same untouched Test-ImplementationPath decision flow. Any
+    # other well-formed tool name maps to no records, so the hook allows.
+    foreach ($toolInput in @(ConvertTo-CodexFileEditInput -Payload $payload)) {
+        $mappedRaw = @{ file_path = [string]$toolInput.file_path } | ConvertTo-Json -Compress
+        $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw $mappedRaw
+        if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+            $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+            exit 0
+        }
     }
     exit 0
 } catch {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-powershell-batch-budget.ps1

@@ -36,6 +36,10 @@
 [CmdletBinding()]
 param()
 
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+
 function Get-PowerShellBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -212,65 +216,31 @@ function Invoke-PowerShellBatchBudgetHook {
     return $decision
 }
 
-function ConvertFrom-CodexPowerShellBudgetPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-powershell-batch-budget hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-powershell-batch-budget hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-powershell-batch-budget hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-powershell-batch-budget requires a PreToolUse apply_patch payload.'
-    }
-    if ([string]::IsNullOrWhiteSpace([string]$payload.session_id)) {
-        throw 'enforce-powershell-batch-budget hook input is missing session_id.'
-    }
-    return $payload
-}
-
-function Get-CodexPowerShellBudgetPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-powershell-batch-budget cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-powershell-batch-budget received an unrecognized apply_patch command.'
-    }
-    return $paths
-}
-
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
 try {
-    $payload = ConvertFrom-CodexPowerShellBudgetPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    # Transport and mapping come from the shared module. session_id is still
+    # required because the batch counter is keyed by it.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-powershell-batch-budget' -RequireSessionId
     $sessionId = ([string]$payload.session_id) -replace '[^A-Za-z0-9._-]', '_'
     $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
     $prodCap = 3
     $testCap = 3
 
-    foreach ($path in @(Get-CodexPowerShellBudgetPath -Payload $payload)) {
+    # Both sides of a rename consume budget, matching the pre-fix path scan that
+    # collected Add/Update/Delete targets and Move destinations alike. Ordering
+    # and de-duplication are preserved. A well-formed payload that maps to no
+    # file yields no paths, so no state is written and the hook allows silently.
+    $budgetPaths = @(
+        @(ConvertTo-CodexFileEditInput -Payload $payload) |
+            ForEach-Object { $_.source_path; $_.file_path } |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                    Select-Object -Unique
+    )
+
+    foreach ($path in $budgetPaths) {
         $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
         $decision = Invoke-PowerShellBatchBudgetHook -ToolInputRaw $toolInputRaw -SessionId $sessionId -Root $repositoryRoot -ProdCap $prodCap -TestCap $testCap
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-python-batch-budget.ps1

@@ -34,6 +34,10 @@
 [CmdletBinding()]
 param()
 
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+
 function Get-PythonBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -210,65 +214,31 @@ function Invoke-PythonBatchBudgetHook {
     return $decision
 }
 
-function ConvertFrom-CodexPythonBudgetPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-python-batch-budget hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-python-batch-budget hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-python-batch-budget hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-python-batch-budget requires a PreToolUse apply_patch payload.'
-    }
-    if ([string]::IsNullOrWhiteSpace([string]$payload.session_id)) {
-        throw 'enforce-python-batch-budget hook input is missing session_id.'
-    }
-    return $payload
-}
-
-function Get-CodexPythonBudgetPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-python-batch-budget cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-python-batch-budget received an unrecognized apply_patch command.'
-    }
-    return $paths
-}
-
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
 try {
-    $payload = ConvertFrom-CodexPythonBudgetPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    # Transport and mapping come from the shared module. session_id is still
+    # required because the batch counter is keyed by it.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-python-batch-budget' -RequireSessionId
     $sessionId = ([string]$payload.session_id) -replace '[^A-Za-z0-9._-]', '_'
     $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
     $prodCap = 3
     $testCap = 3
 
-    foreach ($path in @(Get-CodexPythonBudgetPath -Payload $payload)) {
+    # Both sides of a rename consume budget, matching the pre-fix path scan that
+    # collected Add/Update/Delete targets and Move destinations alike. Ordering
+    # and de-duplication are preserved. A well-formed payload that maps to no
+    # file yields no paths, so no state is written and the hook allows silently.
+    $budgetPaths = @(
+        @(ConvertTo-CodexFileEditInput -Payload $payload) |
+            ForEach-Object { $_.source_path; $_.file_path } |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                    Select-Object -Unique
+    )
+
+    foreach ($path in $budgetPaths) {
         $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
         $decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $toolInputRaw -SessionId $sessionId -Root $repositoryRoot -ProdCap $prodCap -TestCap $testCap
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/pack-manifests/core.json

@@ -29,6 +29,7 @@
     ".codex/hooks/codex-agent-profile-attestation.ps1",
     ".codex/hooks/codex-authority-store.ps1",
     ".codex/hooks/codex-epic-child-launch-attestation.ps1",
+    ".codex/hooks/codex-pretooluse-file-mapping.ps1",
     ".codex/hooks/enforce-codex-model-routing.ps1",
     ".codex/hooks/enforce-epic-child-worktree-binding.ps1",
     ".codex/hooks/enforce-epic-merge-gate.ps1",

package/resources/powershell/PoshQC/PoshQC.Testing.psm1

@@ -343,7 +343,27 @@ function Invoke-PoshQCTest {
                         if ([IO.Path]::IsPathRooted($_)) { $_ } else { Join-Path $Root $_ }
                     }
             )
-            $config.CodeCoverage.Path = $resolvedCoveragePaths
+
+            # Prune coverage paths that do not exist under the resolved root before Pester sees
+            # them. Pester's Resolve-CoverageInfo discards the whole set and raises a terminating
+            # error on the first unresolvable entry, which aborts the run at RunStart in any
+            # workspace that does not contain this repository's coverage layout (issue #409).
+            # Rooted entries are tested as-is; they are never re-joined to $Root.
+            $survivingCoveragePaths = @($resolvedCoveragePaths | Where-Object { & $TestPathExists $_ })
+            foreach ($prunedPath in @($resolvedCoveragePaths | Where-Object { $survivingCoveragePaths -notcontains $_ })) {
+                # Log every prune individually so coverage removal is never silent.
+                & $Logger "Pruned nonexistent code coverage path: $prunedPath"
+            }
+
+            if ($survivingCoveragePaths.Count -gt 0) {
+                $config.CodeCoverage.Path = $survivingCoveragePaths
+            } else {
+                # An enabled-but-empty path set makes Pester instrument every Run.Path directory,
+                # so disable coverage for this invocation instead and continue with the test run.
+                $config.CodeCoverage.Enabled = $false
+                $coverageEnabled = $false
+                & $Logger "Code coverage disabled for this invocation: no configured coverage path exists under root '$Root'."
+            }
         }
 
         if ($config.CodeCoverage.OutputPath.Value) {

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1

@@ -95,6 +95,25 @@
             # entry path hosts the Pester run in the global session state; measured here so
             # the fix produces real per-file changed-line coverage evidence.
             'scripts/powershell/PoshQC/PoshQC.Testing.psm1'
+            # Issue #415 remediation cycle 1 (R1): the PreToolUse hook transport fix added the
+            # shared payload-parsing module and rewired seven Codex hooks to consume it. Those
+            # production files were absent from this list, so the changed surface was outside
+            # the coverage denominator. Measured here so the changed production surface is not
+            # excluded from coverage.
+            '.codex/hooks/codex-pretooluse-file-mapping.ps1'
+            '.codex/hooks/check-python-test-purity.ps1'
+            '.codex/hooks/check-powershell-test-purity.ps1'
+            '.codex/hooks/enforce-python-batch-budget.ps1'
+            '.codex/hooks/enforce-powershell-batch-budget.ps1'
+            '.codex/hooks/enforce-evidence-locations.ps1'
+            '.codex/hooks/enforce-checkpoint-monotonic.ps1'
+            '.codex/hooks/enforce-orchestration-preimplementation-gate.ps1'
+            # Issue #415 remediation cycle 2 (R-COV): the detached-HEAD null-guard fix changed
+            # these two Codex PreToolUse hooks. Both were absent from this list, so the changed
+            # production surface was outside the coverage denominator. Measured here so the
+            # changed production surface is not excluded from coverage.
+            '.codex/hooks/enforce-epic-child-worktree-binding.ps1'
+            '.codex/hooks/enforce-epic-planning-only.ps1'
         )
         # Optional: don't fail the run on coverage percentage
         CoveragePercentTarget = 0