@danmoisan/drm-copilot-mcp 1.0.21 → 1.0.23

package/resources/claude-customizations/.claude/hooks/enforce-parallel-worktree-removal-gate.ps1

@@ -0,0 +1,244 @@
+<#
+.SYNOPSIS
+    Pre-tool-use hook that gates git worktree remove behind parallel checkpoint merge state.
+
+.DESCRIPTION
+    Invoked by the Claude Code PreToolUse hook on the "Bash" matcher before any Bash
+    command runs. Regex-matches git worktree remove against CLAUDE_TOOL_INPUT.command,
+    extracts the target worktree path argument, reads
+    artifacts/orchestration/parallel-orchestrator-state.json, and finds the items[] record
+    whose worktree_path matches. Allows removal only when that record's merge_status is
+    merged or worktree_removed. Denies with reason PARALLEL_WORKTREE_REMOVAL_BLOCKED when
+    the checkpoint is unreadable, no matching record exists, or merge_status is anything
+    else - fail-closed, following the enforce-epic-worktree-removal-gate.ps1 precedent of
+    treating an unreadable/no-match checkpoint as deny.
+
+    Adapted from enforce-epic-worktree-removal-gate.ps1. The command interception regexes
+    and the path normalization are unchanged; the checkpoint path, the read seam name, and
+    the record collection differ, because the parallel surface records per-item state in
+    items[] rather than features[]. A parallel run has no integration branch: each item
+    opens its own pull request against main, so a removed worktree is unrecoverable work
+    unless that item's own merge has been durably confirmed.
+
+.NOTES
+    Compatible with PowerShell 7+. No external module dependencies. Filesystem reads go
+    through an injectable wrapper function so tests can mock the boundary without writing
+    temporary files.
+#>
+[CmdletBinding()]
+param()
+
+$script:ParallelCheckpointPath = 'artifacts/orchestration/parallel-orchestrator-state.json'
+$script:AllowedMergeStatuses = @('merged', 'worktree_removed')
+
+function Get-ParallelWorktreeRemovalGateCheckpointContent {
+    <#
+    .SYNOPSIS
+        Read the raw JSON text of the parallel checkpoint. Tests mock this function
+        (read seam).
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    if (-not (Test-Path -LiteralPath $script:ParallelCheckpointPath -PathType Leaf)) {
+        return $null
+    }
+    return (Get-Content -LiteralPath $script:ParallelCheckpointPath -Raw)
+}
+
+function Get-ParallelWorktreeRemovalCommandPath {
+    <#
+    .SYNOPSIS
+        Extract the target worktree path argument from a git worktree remove command.
+    .PARAMETER CommandText
+        The Bash command text under evaluation.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $CommandText
+    )
+
+    if ($CommandText -match '(?i)\bgit\s+worktree\s+remove\s+(?<path>\S+)') {
+        return $Matches['path'].Trim('"''')
+    }
+    return $null
+}
+
+function Find-ParallelWorktreeItemRecord {
+    <#
+    .SYNOPSIS
+        Locate the items[] record whose worktree_path matches the target path.
+    .PARAMETER Checkpoint
+        Parsed parallel checkpoint, or $null when absent/unreadable.
+    .PARAMETER WorktreePath
+        The target worktree path extracted from the command text.
+    .OUTPUTS
+        System.Object or $null
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowNull()]
+        $Checkpoint,
+
+        [AllowNull()]
+        [string] $WorktreePath
+    )
+
+    if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
+        return $null
+    }
+    $checkpointProps = @($Checkpoint.PSObject.Properties.Name)
+    if ($checkpointProps -notcontains 'items') {
+        return $null
+    }
+
+    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
+
+    # Scan every recorded item for a worktree_path that matches the removal target;
+    # path separators are normalized so Windows- and POSIX-style paths compare equal.
+    foreach ($item in @($Checkpoint.items)) {
+        $itemProps = @($item.PSObject.Properties.Name)
+        if ($itemProps -notcontains 'worktree_path') {
+            continue
+        }
+        $normalizedItemPath = (([string]$item.worktree_path) -replace '\\', '/').TrimEnd('/')
+        if ($normalizedItemPath -eq $normalizedTarget) {
+            return $item
+        }
+    }
+    return $null
+}
+
+function Test-ParallelWorktreeRemovalAllowed {
+    <#
+    .SYNOPSIS
+        Decision logic: allow only when the matching item record's merge_status is
+        merged or worktree_removed.
+    .PARAMETER ItemRecord
+        The matched items[] record, or $null when no match was found.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        $ItemRecord
+    )
+
+    if ($null -eq $ItemRecord) {
+        return $false
+    }
+    $props = @($ItemRecord.PSObject.Properties.Name)
+    if ($props -notcontains 'merge_status') {
+        return $false
+    }
+    return $script:AllowedMergeStatuses -contains ([string]$ItemRecord.merge_status)
+}
+
+function Get-ParallelWorktreeGateAllowDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param()
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName      = 'PreToolUse'
+            permissionDecision = 'allow'
+        }
+    }
+}
+
+function Get-ParallelWorktreeGateBlockDecision {
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Reason
+    )
+
+    return [ordered]@{
+        hookSpecificOutput = [ordered]@{
+            hookEventName            = 'PreToolUse'
+            permissionDecision       = 'deny'
+            permissionDecisionReason = $Reason
+        }
+    }
+}
+
+function Invoke-ParallelWorktreeRemovalGateDecision {
+    <#
+    .SYNOPSIS
+        Parses CLAUDE_TOOL_INPUT and returns an allow-or-block decision.
+    .PARAMETER ToolInputRaw
+        The raw JSON tool payload supplied by Claude Code.
+    .OUTPUTS
+        System.Collections.Specialized.OrderedDictionary
+    #>
+    [CmdletBinding()]
+    [OutputType([System.Collections.Specialized.OrderedDictionary])]
+    param(
+        [string] $ToolInputRaw
+    )
+
+    if (-not $ToolInputRaw) {
+        return Get-ParallelWorktreeGateAllowDecision
+    }
+
+    try {
+        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
+    } catch {
+        throw "enforce-parallel-worktree-removal-gate hook received malformed JSON in CLAUDE_TOOL_INPUT: $_"
+    }
+
+    $commandText = $toolInput.command
+    if (-not $commandText) {
+        return Get-ParallelWorktreeGateAllowDecision
+    }
+
+    if ($commandText -notmatch '(?i)\bgit\s+worktree\s+remove\b') {
+        return Get-ParallelWorktreeGateAllowDecision
+    }
+
+    $worktreePath = Get-ParallelWorktreeRemovalCommandPath -CommandText $commandText
+
+    $checkpointRaw = Get-ParallelWorktreeRemovalGateCheckpointContent
+    $checkpoint = $null
+    if (-not [string]::IsNullOrWhiteSpace($checkpointRaw)) {
+        try {
+            $checkpoint = $checkpointRaw | ConvertFrom-Json -ErrorAction Stop
+        } catch {
+            $checkpoint = $null
+        }
+    }
+
+    $itemRecord = Find-ParallelWorktreeItemRecord -Checkpoint $checkpoint -WorktreePath $worktreePath
+    if (Test-ParallelWorktreeRemovalAllowed -ItemRecord $itemRecord) {
+        return Get-ParallelWorktreeGateAllowDecision
+    }
+
+    return Get-ParallelWorktreeGateBlockDecision -Reason "PARALLEL_WORKTREE_REMOVAL_BLOCKED: git worktree remove for '$worktreePath' requires a matching parallel checkpoint items[] record with merge_status in {merged, worktree_removed}. The checkpoint was unreadable, no matching record was found, or merge_status was not yet safe for removal."
+}
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
+}
+
+try {
+    $decision = Invoke-ParallelWorktreeRemovalGateDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
+} catch {
+    Write-Error $_
+    exit 1
+}
+
+$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+
+exit 0

package/resources/claude-customizations/.claude/lib/bash/compute-cohorts.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# compute-cohorts.sh: destination-portable command-line entry point for the
+# parallel surface's cohort computation. It exists so a workspace that received
+# the Claude customization payload can compute cohorts with nothing but bash --
+# no Python, no Poetry, no repository checkout.
+#
+# Usage:
+#   bash .claude/lib/bash/compute-cohorts.sh --keys "<k1> <k2> ..." \
+#       [--edges "<a>:<b> <a>:<b> ..."]
+#
+# `--edges` is optional; omitting it, or passing an empty string, means the
+# conflict graph has no edges. Item keys and edge endpoints are decimal
+# integers matching `-?(0|[1-9][0-9]*)`; a token with a leading zero is
+# rejected fail-closed with a lexical error, because the Python authority would
+# read such a token differently and a silent disagreement is worse than a
+# refusal.
+#
+# Output contract:
+#   stdout  compact JSON array of arrays, identical to Python
+#           json.dumps(..., separators=(",", ":"))
+#   stderr  on invalid input, the exact message the Python reference
+#           implementation raises
+#   exit 0  success
+#   exit 1  invalid input (duplicate key, self-loop, unknown endpoint)
+#   exit 2  usage error or a token outside the accepted integer lexis
+set -euo pipefail
+
+# Resolve this script's own directory so the library sources regardless of cwd.
+CC_SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=.claude/lib/bash/parallel-cohorts.sh
+# shellcheck disable=SC1091
+source "$CC_SCRIPT_DIR/parallel-cohorts.sh"
+
+pc_enforce_c_locale
+
+cc_usage() {
+	# Print the entry point's usage text.
+	cat <<'EOF'
+Usage: compute-cohorts.sh --keys "<k1> <k2> ..." [--edges "<a>:<b> ..."]
+
+Computes parallel execution cohorts from an undirected conflict graph by
+deterministic greedy graph coloring in Welsh-Powell order.
+
+Options:
+  --keys    Space-separated item keys (required; may be an empty string).
+  --edges   Space-separated conflict edges as <a>:<b> (optional).
+
+Prints a compact JSON array of arrays on stdout. On invalid input, prints the
+reference implementation's exact message on stderr and exits 1.
+EOF
+}
+
+cc_require_integer() {
+	# Validate one token against the accepted decimal-integer lexis.
+	#
+	# Args: $1 = the token, $2 = a label naming where the token came from.
+	# Exits 2 with a lexical error when the token is outside the lexis.
+	local token="$1" label="$2"
+	if [[ ! $token =~ ^-?(0|[1-9][0-9]*)$ ]]; then
+		printf 'compute-cohorts.sh: %s must be a decimal integer matching -?(0|[1-9][0-9]*); found: %s\n' \
+			"$label" "$token" >&2
+		exit 2
+	fi
+}
+
+cc_validate_tokens() {
+	# Validate every key token and every edge endpoint.
+	#
+	# Args: $1 = space-separated keys, $2 = space-separated `a:b` edges.
+	local keys="$1" edges="$2" token
+	pcoh_split_words "$keys"
+	local -a key_tokens=("${PCOH_WORDS[@]}")
+	for token in "${key_tokens[@]}"; do
+		cc_require_integer "$token" "item key"
+	done
+
+	pcoh_split_words "$edges"
+	local -a edge_tokens=("${PCOH_WORDS[@]}")
+	# Each edge must be exactly two integer endpoints joined by a single colon;
+	# anything else is a malformed edge token rather than a graph error.
+	for token in "${edge_tokens[@]}"; do
+		if [[ $token != *:* || $token == *:*:* ]]; then
+			printf 'compute-cohorts.sh: edge must be <a>:<b>; found: %s\n' "$token" >&2
+			exit 2
+		fi
+		cc_require_integer "${token%%:*}" "edge endpoint"
+		cc_require_integer "${token#*:}" "edge endpoint"
+	done
+}
+
+cc_main() {
+	# Parse arguments, compute the cohorts, and print the result.
+	local keys="" edges="" keys_seen=0
+	while (($# > 0)); do
+		case "$1" in
+		--keys)
+			(($# >= 2)) || {
+				cc_usage >&2
+				return 2
+			}
+			keys="$2"
+			keys_seen=1
+			shift 2
+			;;
+		--edges)
+			(($# >= 2)) || {
+				cc_usage >&2
+				return 2
+			}
+			edges="$2"
+			shift 2
+			;;
+		--help | -h)
+			cc_usage
+			return 0
+			;;
+		*)
+			cc_usage >&2
+			return 2
+			;;
+		esac
+	done
+	((keys_seen == 1)) || {
+		cc_usage >&2
+		return 2
+	}
+
+	cc_validate_tokens "$keys" "$edges"
+	if ! pcoh_compute_cohorts "$keys" "$edges"; then
+		printf '%s\n' "$PCOH_ERROR" >&2
+		return 1
+	fi
+	printf '%s\n' "$PCOH_RESULT"
+	return 0
+}
+
+# Guard so the file can be sourced without executing main. main's return code
+# is captured and re-exited explicitly as the final statement.
+if [[ ${BASH_SOURCE[0]} == "${0}" ]]; then
+	cc_rc=0
+	cc_main "$@" || cc_rc=$?
+	exit "$cc_rc"
+fi

package/resources/claude-customizations/.claude/lib/bash/compute-concurrency-batches.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# compute-concurrency-batches.sh: destination-portable command-line entry point
+# for the parallel surface's concurrency batching. It exists so a workspace that
+# received the Claude customization payload can cap fan-out with nothing but
+# bash -- no Python, no Poetry, no repository checkout.
+#
+# Usage:
+#   bash .claude/lib/bash/compute-concurrency-batches.sh \
+#       --keys "<k1> <k2> ..." --max-concurrency <n>
+#
+# Item keys are decimal integers matching `-?(0|[1-9][0-9]*)`; a token with a
+# leading zero is rejected fail-closed with a lexical error, because the Python
+# authority would read such a token differently and a silent disagreement is
+# worse than a refusal.
+#
+# Output contract:
+#   stdout  compact JSON array of arrays, identical to Python
+#           json.dumps(..., separators=(",", ":"))
+#   stderr  on invalid input, the exact message the Python reference
+#           implementation raises
+#   exit 0  success
+#   exit 1  invalid input (max_concurrency below 1)
+#   exit 2  usage error or a token outside the accepted integer lexis
+set -euo pipefail
+
+# Resolve this script's own directory so the library sources regardless of cwd.
+CB_SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=.claude/lib/bash/parallel-cohorts.sh
+# shellcheck disable=SC1091
+source "$CB_SCRIPT_DIR/parallel-cohorts.sh"
+
+pc_enforce_c_locale
+
+cb_usage() {
+	# Print the entry point's usage text.
+	cat <<'EOF'
+Usage: compute-concurrency-batches.sh --keys "<k1> <k2> ..." --max-concurrency <n>
+
+Chunks one cohort's item keys into concurrency-capped batches in ascending key
+order. Every batch holds exactly <n> keys except a possibly smaller final batch.
+
+Options:
+  --keys              Space-separated cohort item keys (required; may be empty).
+  --max-concurrency   The fan-out cap (required).
+
+Prints a compact JSON array of arrays on stdout. When the cap is below 1, prints
+the reference implementation's exact message on stderr and exits 1.
+EOF
+}
+
+cb_require_integer() {
+	# Validate one token against the accepted decimal-integer lexis.
+	#
+	# Args: $1 = the token, $2 = a label naming where the token came from.
+	# Exits 2 with a lexical error when the token is outside the lexis.
+	local token="$1" label="$2"
+	if [[ ! $token =~ ^-?(0|[1-9][0-9]*)$ ]]; then
+		printf 'compute-concurrency-batches.sh: %s must be a decimal integer matching -?(0|[1-9][0-9]*); found: %s\n' \
+			"$label" "$token" >&2
+		exit 2
+	fi
+}
+
+cb_main() {
+	# Parse arguments, compute the batches, and print the result.
+	local keys="" cap="" keys_seen=0 token
+	while (($# > 0)); do
+		case "$1" in
+		--keys)
+			(($# >= 2)) || {
+				cb_usage >&2
+				return 2
+			}
+			keys="$2"
+			keys_seen=1
+			shift 2
+			;;
+		--max-concurrency)
+			(($# >= 2)) || {
+				cb_usage >&2
+				return 2
+			}
+			cap="$2"
+			shift 2
+			;;
+		--help | -h)
+			cb_usage
+			return 0
+			;;
+		*)
+			cb_usage >&2
+			return 2
+			;;
+		esac
+	done
+	if ((keys_seen == 0)) || [[ -z $cap ]]; then
+		cb_usage >&2
+		return 2
+	fi
+
+	cb_require_integer "$cap" "max_concurrency"
+	pcoh_split_words "$keys"
+	local -a key_tokens=("${PCOH_WORDS[@]}")
+	for token in "${key_tokens[@]}"; do
+		cb_require_integer "$token" "item key"
+	done
+
+	if ! pcoh_compute_concurrency_batches "$keys" "$cap"; then
+		printf '%s\n' "$PCOH_ERROR" >&2
+		return 1
+	fi
+	printf '%s\n' "$PCOH_RESULT"
+	return 0
+}
+
+# Guard so the file can be sourced without executing main. main's return code
+# is captured and re-exited explicitly as the final statement.
+if [[ ${BASH_SOURCE[0]} == "${0}" ]]; then
+	cb_rc=0
+	cb_main "$@" || cb_rc=$?
+	exit "$cb_rc"
+fi