npm - @danmoisan/drm-copilot-mcp - Versions diffs - 1.0.19 → 1.0.21 - Mend

@danmoisan/drm-copilot-mcp 1.0.19 → 1.0.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-checkpoint-monotonic.ps1 CHANGED Viewed

@@ -44,6 +44,15 @@
 [CmdletBinding()]
 param()
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
+# The only path this hook governs. On-disk reconstruction of an apply_patch
+# Update is requested for this path alone, so a patch that merely happens to
+# touch other files can never fail the hook.
+$script:GovernedCheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 $script:CanonicalStepPrefixes = @(
     'S0_startup_checks',
     'S1_change_budget_estimation',
@@ -300,112 +309,22 @@ function Invoke-CheckpointMonotonicDecision {
 }
 # Guard allows dot-sourcing in tests without executing the entrypoint.
-function ConvertFrom-CodexCheckpointHookPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-checkpoint-monotonic hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-checkpoint-monotonic hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-checkpoint-monotonic hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-checkpoint-monotonic requires a PreToolUse apply_patch payload.'
-    }
-    return $payload
-}
-function ConvertTo-CodexApplyPatchCheckpointInput {
-    [CmdletBinding()]
-    [OutputType([object[]])]
-    param([Parameter(Mandatory)] $Payload)
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return , $Payload.tool_input
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-checkpoint-monotonic cannot map tool_input to a file edit.'
-    }
-    $fileMatches = [regex]::Matches(
-        $command,
-        '(?ms)^\*\*\* (?<operation>Add|Update|Delete) File:\s*(?<path>.+?)\r?\n(?<body>.*?)(?=^\*\*\* (?:(?:Add|Update|Delete) File:|End Patch)\s*|\z)'
-    )
-    if ($fileMatches.Count -eq 0) {
-        throw 'enforce-checkpoint-monotonic received an unrecognized apply_patch command.'
-    }
-    $inputs = [System.Collections.Generic.List[object]]::new()
-    foreach ($match in $fileMatches) {
-        $sourcePath = ([string]$match.Groups['path'].Value).Trim()
-        $path = $sourcePath
-        $operation = [string]$match.Groups['operation'].Value
-        $body = ([string]$match.Groups['body'].Value) -replace '\r\n', "`n"
-        $moveMatch = [regex]::Match($body, '(?m)^\*\*\* Move to:\s*(?<path>.+?)\s*$')
-        if ($moveMatch.Success) {
-            $path = ([string]$moveMatch.Groups['path'].Value).Trim()
-        }
-        if ($operation -eq 'Delete') {
-            $content = ''
-        } elseif ($operation -eq 'Add') {
-            $content = (($body -split "`n") | ForEach-Object {
-                    if ($_.StartsWith('+') -and -not $_.StartsWith('+++')) {
-                        $_.Substring(1)
-                    }
-                }) -join "`n"
-        } else {
-            if (-not (Test-Path -LiteralPath $sourcePath -PathType Leaf)) {
-                throw "enforce-checkpoint-monotonic cannot read update source '$sourcePath'."
-            }
-            $content = (Get-Content -Raw -LiteralPath $sourcePath) -replace '\r\n', "`n"
-            $hunks = @([regex]::Split($body, '(?m)^@@[^\r\n]*\r?\n') | Where-Object { $_ -match '\S' })
-            foreach ($hunk in $hunks) {
-                $oldLines = [System.Collections.Generic.List[string]]::new()
-                $newLines = [System.Collections.Generic.List[string]]::new()
-                foreach ($line in ($hunk -split "`n")) {
-                    if ($line -match '^\*\*\* (?:Move to|End of File)') {
-                        continue
-                    }
-                    if ($line.StartsWith('+') -and -not $line.StartsWith('+++')) {
-                        $newLines.Add($line.Substring(1))
-                    } elseif ($line.StartsWith('-') -and -not $line.StartsWith('---')) {
-                        $oldLines.Add($line.Substring(1))
-                    } elseif ($line.StartsWith(' ')) {
-                        $oldLines.Add($line.Substring(1))
-                        $newLines.Add($line.Substring(1))
-                    } else {
-                        $oldLines.Add($line)
-                        $newLines.Add($line)
-                    }
-                }
-                $oldText = $oldLines -join "`n"
-                $newText = $newLines -join "`n"
-                $index = $content.IndexOf($oldText, [System.StringComparison]::Ordinal)
-                if ($index -lt 0) {
-                    throw "enforce-checkpoint-monotonic could not apply an in-memory patch hunk for '$path'."
-                }
-                $content = $content.Substring(0, $index) + $newText + $content.Substring($index + $oldText.Length)
-            }
-        }
-        $inputs.Add([pscustomobject]@{ file_path = $path; content = $content })
-    }
-    return $inputs.ToArray()
-}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 try {
-    $payload = ConvertFrom-CodexCheckpointHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
-    foreach ($toolInput in @(ConvertTo-CodexApplyPatchCheckpointInput -Payload $payload)) {
+    # Transport and mapping come from the shared module. Update reconstruction is
+    # requested for the governed checkpoint path only: an Update touching any
+    # other file yields no record and therefore allows, instead of failing the
+    # whole invocation because an unrelated source could not be read. A governed
+    # reconstruction failure yields empty content, which routes into the existing
+    # fail-closed deny below rather than exit 2.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-checkpoint-monotonic'
+    $mappedInputs = @(
+        ConvertTo-CodexFileEditInput -Payload $payload -ResolveUpdateContent -GovernedPath $script:GovernedCheckpointPath
+    )
+    foreach ($toolInput in $mappedInputs) {
         $toolInputRaw = $toolInput | ConvertTo-Json -Compress -Depth 20
         $decision = Invoke-CheckpointMonotonicDecision -ToolInputRaw $toolInputRaw
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-completion-consistency.ps1 CHANGED Viewed

@@ -41,9 +41,16 @@
 [CmdletBinding()]
 param()
-# Reuse the adjacent hook's read-only Codex apply_patch adapter.
+# Reuse the adjacent hook's shared checkpoint policy logic. This dot-source is by
+# design, not a copy-paste defect, so the hook is not renamed.
 . (Join-Path $PSScriptRoot 'enforce-checkpoint-monotonic.ps1')
+# Shared Codex PreToolUse transport. Dot-sourced explicitly rather than relying on
+# the transitive load above, so this hook's transport does not depend on its
+# neighbour's internals. Every transport error it raises names this hook, because
+# the shared parser is called with -HookName 'enforce-completion-consistency'.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 # Dot-source the shared validation helpers. Guarded so a missing file produces a
 # clear error and so dot-sourcing this hook in tests loads the helpers too.
 $script:CompletionHelpersPath = Join-Path $PSScriptRoot 'enforce-completion-helpers.ps1'
@@ -409,8 +416,14 @@ if ($MyInvocation.InvocationName -eq '.') {
 }
 try {
-    $payload = ConvertFrom-CodexCheckpointHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
-    foreach ($toolInput in @(ConvertTo-CodexApplyPatchCheckpointInput -Payload $payload)) {
+    # -HookName makes every transport error name this hook rather than the
+    # neighbour it dot-sources. Update reconstruction is scoped to the governed
+    # checkpoint path for the same reason as in enforce-checkpoint-monotonic.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-completion-consistency'
+    $mappedInputs = @(
+        ConvertTo-CodexFileEditInput -Payload $payload -ResolveUpdateContent -GovernedPath $script:GovernedCheckpointPath
+    )
+    foreach ($toolInput in $mappedInputs) {
         $toolInputRaw = $toolInput | ConvertTo-Json -Compress -Depth 20
         $decision = Invoke-CompletionConsistencyDecision -ToolInputRaw $toolInputRaw
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-child-worktree-binding.ps1 CHANGED Viewed

@@ -267,6 +267,18 @@ function Invoke-CodexChildGuardGit {
     return & git @GitArgs 2>&1
 }
+function Get-CodexChildGuardLiveBranch {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $RepositoryRoot)
+    $liveBranch = [string](Invoke-CodexChildGuardGit -GitArgs @('-C', $RepositoryRoot, 'branch', '--show-current'))
+    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($liveBranch)) {
+        return ''
+    }
+    return $liveBranch.Trim()
+}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
@@ -308,12 +320,9 @@ try {
     } else {
         ''
     }
-    $liveBranch = [string](Invoke-CodexChildGuardGit -GitArgs @('-C', $repositoryRoot, 'branch', '--show-current'))
-    if ($LASTEXITCODE -ne 0) {
-        $liveBranch = ''
-    }
+    $liveBranch = Get-CodexChildGuardLiveBranch -RepositoryRoot $repositoryRoot
     $decision = Invoke-CodexEpicChildGuardDecision -PayloadRaw $payloadRaw -ReceiptRaw $receiptRaw `
-        -Attestation $attestation -HookRepositoryRoot $repositoryRoot -LiveBranch $liveBranch.Trim() `
+        -Attestation $attestation -HookRepositoryRoot $repositoryRoot -LiveBranch $liveBranch `
         -ActualSpecSha256 $actualSpecSha256 -ActualProfileSha256 $actualProfileSha256
     if ($null -ne $decision) {
         $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-planning-only.ps1 CHANGED Viewed

@@ -245,6 +245,28 @@ function Invoke-EpicPlanningOnlyDecision {
     return Get-EpicPlanningDenyDecision -Reason "tool '$toolName' is not classified for preparation mode."
 }
+function Invoke-EpicPlanningGit {
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][string[]] $GitArgs)
+    return & git @GitArgs 2>$null
+}
+function Get-EpicPlanningCurrentBranch {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)][string] $RepositoryRoot)
+    $currentBranch = [string](Invoke-EpicPlanningGit -GitArgs @('-C', $RepositoryRoot, 'branch', '--show-current'))
+    if ($LASTEXITCODE -ne 0) {
+        throw 'EPIC_PLANNING_ONLY_BLOCKED: current branch could not be resolved before push.'
+    }
+    if ([string]::IsNullOrWhiteSpace($currentBranch)) {
+        return ''
+    }
+    return $currentBranch.Trim()
+}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
@@ -270,11 +292,7 @@ try {
     }
     if ([string]$payload.tool_name -eq 'Bash' -and
         [string]$payload.tool_input.command -match '^\s*git\s+push\b') {
-        $currentBranch = [string](& git -C $repositoryRoot branch --show-current 2>$null)
-        if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($currentBranch)) {
-            throw 'EPIC_PLANNING_ONLY_BLOCKED: current branch could not be resolved before push.'
-        }
-        $currentBranch = $currentBranch.Trim()
+        $currentBranch = Get-EpicPlanningCurrentBranch -RepositoryRoot $repositoryRoot
     }
     $decision = Invoke-EpicPlanningOnlyDecision `
         -PayloadRaw $payloadRaw `

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-evidence-locations.ps1 CHANGED Viewed

@@ -30,9 +30,9 @@
     If the file_path resolves to a forbidden prefix, the script writes a PreToolUse JSON
     response to stdout with hookSpecificOutput.permissionDecision = 'deny' and exits with
-    code 0 so Codex surfaces the reason. For allowed paths, a PreToolUse response
-    with permissionDecision = 'allow' is written to stdout and the script exits 0. On hard
-    failure (malformed JSON input), the script exits 2.
+    code 0 so Codex surfaces the reason. Allowed paths produce NO stdout at all: the
+    script allows silently and exits 0. On hard failure (empty, malformed, or
+    tool_input-less stdin) the script writes the reason to stderr and exits 2.
 .NOTES
     Compatible with PowerShell 7+.
@@ -41,6 +41,10 @@
 [CmdletBinding()]
 param()
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 function Test-EvidenceLocationForbidden {
     <#
     .SYNOPSIS
@@ -142,60 +146,34 @@ function Invoke-EvidenceLocationDecision {
     return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
 }
-function ConvertFrom-CodexEvidenceLocationPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-evidence-locations hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-evidence-locations hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-evidence-locations hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-evidence-locations requires a PreToolUse apply_patch payload.'
-    }
-    return $payload
-}
-function Get-CodexEvidenceLocationPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-evidence-locations cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-evidence-locations received an unrecognized apply_patch command.'
-    }
-    foreach ($path in $paths) {
-        Write-Output ([string]$path)
-    }
-}
 function Invoke-EvidenceLocationEntryPoint {
+    <#
+    .SYNOPSIS
+        Reads one Codex PreToolUse payload and returns the process exit code.
+    .PARAMETER PayloadRaw
+        The raw stdin text. AllowEmptyString is required so empty input reaches
+        the shared parser and fails closed with exit 2, rather than raising a
+        parameter-binding error that would skip the exit and allow silently.
+    #>
     [CmdletBinding()]
     [OutputType([int])]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
+    param([Parameter(Mandatory)][AllowEmptyString()][string] $PayloadRaw)
     try {
-        $payload = ConvertFrom-CodexEvidenceLocationPayload -PayloadRaw $PayloadRaw
-        foreach ($path in @(Get-CodexEvidenceLocationPath -Payload $payload)) {
+        $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw $PayloadRaw -HookName 'enforce-evidence-locations'
+        # Both sides of a rename are evaluated, matching the pre-fix path scan
+        # that collected Add/Update/Delete targets and Move destinations alike.
+        # A well-formed payload that maps to no file yields no paths, so the loop
+        # body never runs and the hook allows silently.
+        $paths = @(
+            @(ConvertTo-CodexFileEditInput -Payload $payload) |
+                ForEach-Object { $_.source_path; $_.file_path } |
+                    Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                        Select-Object -Unique
+        )
+        foreach ($path in $paths) {
             $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
             $decision = Invoke-EvidenceLocationDecision -ToolInputRaw $toolInputRaw
             if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-orchestration-preimplementation-gate.ps1 CHANGED Viewed

@@ -6,6 +6,10 @@
 [CmdletBinding()]
 param()
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 $script:CheckpointPath = 'artifacts/orchestration/orchestrator-state.json'
 function ConvertFrom-CheckpointJson {
@@ -224,38 +228,35 @@ function Invoke-OrchestrationPreimplementationGateDecision {
     return Get-OrchestrationPreimplementationGateBlockDecision -Reason 'PREIMPLEMENTATION_GATE_BLOCKED: Implementation operations require artifacts/orchestration/orchestrator-state.json to contain issue number, feature folder, route metadata, lifecycle readiness, and checkpoint state before implementation begins.'
 }
-function ConvertFrom-CodexPreimplementationHookPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-orchestration-preimplementation-gate hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-orchestration-preimplementation-gate hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-orchestration-preimplementation-gate hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or
-        @('Bash', 'apply_patch') -notcontains [string]$payload.tool_name) {
-        throw 'enforce-orchestration-preimplementation-gate requires a supported PreToolUse payload.'
-    }
-    return $payload
-}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 try {
-    $payload = ConvertFrom-CodexPreimplementationHookPayload -PayloadRaw ([Console]::In.ReadToEnd())
-    $toolInputRaw = $payload.tool_input | ConvertTo-Json -Compress -Depth 20
-    $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw $toolInputRaw
-    if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
-        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-orchestration-preimplementation-gate'
+    $toolName = [string]$payload.tool_name
+    # Bash and apply_patch take the pre-fix path unchanged: the raw tool_input is
+    # serialized and evaluated by the untouched decision function, so every
+    # allow/deny outcome those two tool names produce today is preserved exactly.
+    if (@('Bash', 'apply_patch') -contains $toolName) {
+        $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw ($payload.tool_input | ConvertTo-Json -Compress -Depth 20)
+        if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+            $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+        }
+        exit 0
+    }
+    # Edit and Write map to file paths through the shared module; each mapped
+    # path enters the same untouched Test-ImplementationPath decision flow. Any
+    # other well-formed tool name maps to no records, so the hook allows.
+    foreach ($toolInput in @(ConvertTo-CodexFileEditInput -Payload $payload)) {
+        $mappedRaw = @{ file_path = [string]$toolInput.file_path } | ConvertTo-Json -Compress
+        $decision = Invoke-OrchestrationPreimplementationGateDecision -ToolInputRaw $mappedRaw
+        if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+            $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+            exit 0
+        }
     }
     exit 0
 } catch {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-powershell-batch-budget.ps1 CHANGED Viewed

@@ -36,6 +36,10 @@
 [CmdletBinding()]
 param()
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 function Get-PowerShellBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -212,65 +216,31 @@ function Invoke-PowerShellBatchBudgetHook {
     return $decision
 }
-function ConvertFrom-CodexPowerShellBudgetPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-powershell-batch-budget hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-powershell-batch-budget hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-powershell-batch-budget hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-powershell-batch-budget requires a PreToolUse apply_patch payload.'
-    }
-    if ([string]::IsNullOrWhiteSpace([string]$payload.session_id)) {
-        throw 'enforce-powershell-batch-budget hook input is missing session_id.'
-    }
-    return $payload
-}
-function Get-CodexPowerShellBudgetPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-powershell-batch-budget cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-powershell-batch-budget received an unrecognized apply_patch command.'
-    }
-    return $paths
-}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 try {
-    $payload = ConvertFrom-CodexPowerShellBudgetPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    # Transport and mapping come from the shared module. session_id is still
+    # required because the batch counter is keyed by it.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-powershell-batch-budget' -RequireSessionId
     $sessionId = ([string]$payload.session_id) -replace '[^A-Za-z0-9._-]', '_'
     $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
     $prodCap = 3
     $testCap = 3
-    foreach ($path in @(Get-CodexPowerShellBudgetPath -Payload $payload)) {
+    # Both sides of a rename consume budget, matching the pre-fix path scan that
+    # collected Add/Update/Delete targets and Move destinations alike. Ordering
+    # and de-duplication are preserved. A well-formed payload that maps to no
+    # file yields no paths, so no state is written and the hook allows silently.
+    $budgetPaths = @(
+        @(ConvertTo-CodexFileEditInput -Payload $payload) |
+            ForEach-Object { $_.source_path; $_.file_path } |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                    Select-Object -Unique
+    )
+    foreach ($path in $budgetPaths) {
         $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
         $decision = Invoke-PowerShellBatchBudgetHook -ToolInputRaw $toolInputRaw -SessionId $sessionId -Root $repositoryRoot -ProdCap $prodCap -TestCap $testCap
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-python-batch-budget.ps1 CHANGED Viewed

@@ -34,6 +34,10 @@
 [CmdletBinding()]
 param()
+# Shared Codex PreToolUse transport: stdin payload parsing and tool_input-to-file
+# mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
+. (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1')
 function Get-PythonBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -210,65 +214,31 @@ function Invoke-PythonBatchBudgetHook {
     return $decision
 }
-function ConvertFrom-CodexPythonBudgetPayload {
-    [CmdletBinding()]
-    param([Parameter(Mandatory)][string] $PayloadRaw)
-    if ([string]::IsNullOrWhiteSpace($PayloadRaw)) {
-        throw 'enforce-python-batch-budget hook input is empty.'
-    }
-    try {
-        $payload = $PayloadRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-python-batch-budget hook input is malformed JSON: $_"
-    }
-    if ($payload.PSObject.Properties.Name -notcontains 'tool_input' -or $null -eq $payload.tool_input) {
-        throw 'enforce-python-batch-budget hook input is missing tool_input.'
-    }
-    if ([string]$payload.hook_event_name -ne 'PreToolUse' -or [string]$payload.tool_name -ne 'apply_patch') {
-        throw 'enforce-python-batch-budget requires a PreToolUse apply_patch payload.'
-    }
-    if ([string]::IsNullOrWhiteSpace([string]$payload.session_id)) {
-        throw 'enforce-python-batch-budget hook input is missing session_id.'
-    }
-    return $payload
-}
-function Get-CodexPythonBudgetPath {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param([Parameter(Mandatory)] $Payload)
-    if ($Payload.tool_input.PSObject.Properties.Name -contains 'file_path') {
-        return [string]$Payload.tool_input.file_path
-    }
-    $command = [string]$Payload.tool_input.command
-    if ([string]::IsNullOrWhiteSpace($command)) {
-        throw 'enforce-python-batch-budget cannot map tool_input to a file edit.'
-    }
-    [string[]] $paths = @(
-        [regex]::Matches($command, '(?m)^\*\*\* (?:(?:Add|Update|Delete) File|Move to):\s*(?<path>.+?)\s*$') |
-            ForEach-Object { ([string]$_.Groups['path'].Value).Trim() }
-    )
-    $paths = @($paths | Select-Object -Unique)
-    if ($paths.Count -eq 0) {
-        throw 'enforce-python-batch-budget received an unrecognized apply_patch command.'
-    }
-    return $paths
-}
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 try {
-    $payload = ConvertFrom-CodexPythonBudgetPayload -PayloadRaw ([Console]::In.ReadToEnd())
+    # Transport and mapping come from the shared module. session_id is still
+    # required because the batch counter is keyed by it.
+    $payload = ConvertFrom-CodexPreToolUsePayload -PayloadRaw ([Console]::In.ReadToEnd()) -HookName 'enforce-python-batch-budget' -RequireSessionId
     $sessionId = ([string]$payload.session_id) -replace '[^A-Za-z0-9._-]', '_'
     $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
     $prodCap = 3
     $testCap = 3
-    foreach ($path in @(Get-CodexPythonBudgetPath -Payload $payload)) {
+    # Both sides of a rename consume budget, matching the pre-fix path scan that
+    # collected Add/Update/Delete targets and Move destinations alike. Ordering
+    # and de-duplication are preserved. A well-formed payload that maps to no
+    # file yields no paths, so no state is written and the hook allows silently.
+    $budgetPaths = @(
+        @(ConvertTo-CodexFileEditInput -Payload $payload) |
+            ForEach-Object { $_.source_path; $_.file_path } |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                    Select-Object -Unique
+    )
+    foreach ($path in $budgetPaths) {
         $toolInputRaw = @{ file_path = $path } | ConvertTo-Json -Compress
         $decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $toolInputRaw -SessionId $sessionId -Root $repositoryRoot -ProdCap $prodCap -TestCap $testCap
         if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {

package/resources/codex-and-agents-customizations/pack-manifests/core.json CHANGED Viewed

@@ -29,6 +29,7 @@
     ".codex/hooks/codex-agent-profile-attestation.ps1",
     ".codex/hooks/codex-authority-store.ps1",
     ".codex/hooks/codex-epic-child-launch-attestation.ps1",
+    ".codex/hooks/codex-pretooluse-file-mapping.ps1",
     ".codex/hooks/enforce-codex-model-routing.ps1",
     ".codex/hooks/enforce-epic-child-worktree-binding.ps1",
     ".codex/hooks/enforce-epic-merge-gate.ps1",

package/resources/powershell/PoshQC/settings/pester.runsettings.psd1 CHANGED Viewed

@@ -95,6 +95,25 @@
             # entry path hosts the Pester run in the global session state; measured here so
             # the fix produces real per-file changed-line coverage evidence.
             'scripts/powershell/PoshQC/PoshQC.Testing.psm1'
+            # Issue #415 remediation cycle 1 (R1): the PreToolUse hook transport fix added the
+            # shared payload-parsing module and rewired seven Codex hooks to consume it. Those
+            # production files were absent from this list, so the changed surface was outside
+            # the coverage denominator. Measured here so the changed production surface is not
+            # excluded from coverage.
+            '.codex/hooks/codex-pretooluse-file-mapping.ps1'
+            '.codex/hooks/check-python-test-purity.ps1'
+            '.codex/hooks/check-powershell-test-purity.ps1'
+            '.codex/hooks/enforce-python-batch-budget.ps1'
+            '.codex/hooks/enforce-powershell-batch-budget.ps1'
+            '.codex/hooks/enforce-evidence-locations.ps1'
+            '.codex/hooks/enforce-checkpoint-monotonic.ps1'
+            '.codex/hooks/enforce-orchestration-preimplementation-gate.ps1'
+            # Issue #415 remediation cycle 2 (R-COV): the detached-HEAD null-guard fix changed
+            # these two Codex PreToolUse hooks. Both were absent from this list, so the changed
+            # production surface was outside the coverage denominator. Measured here so the
+            # changed production surface is not excluded from coverage.
+            '.codex/hooks/enforce-epic-child-worktree-binding.ps1'
+            '.codex/hooks/enforce-epic-planning-only.ps1'
         )
         # Optional: don't fail the run on coverage percentage
         CoveragePercentTarget = 0