@danmoisan/drm-copilot-mcp 1.0.27 → 1.1.0

package/resources/claude-customizations/.claude/hooks/enforce-promotion-mcp-only.ps1

@@ -4,8 +4,8 @@
 
 .DESCRIPTION
     This script is invoked by the Claude Code PreToolUse hook before any Bash
-    command runs. It reads the tool input from the CLAUDE_TOOL_INPUT environment
-    variable, inspects the attempted command text, and blocks direct promotion
+    command runs. It acquires the hook payload through the shared reader and reads
+    the command from the envelope's nested tool_input, then blocks direct promotion
     script execution that would bypass the repository's MCP-only promotion path.
 
     Forbidden command tokens (legacy promotion-script bypass):
@@ -29,6 +29,8 @@
 [CmdletBinding()]
 param()
 
+
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 $script:PromotionMcpOnlyBlockedReason = 'PROMOTION_MCP_ONLY_BLOCKED: Direct Bash promotion-script execution is not allowed in agent sessions. Use the drm-copilot MCP promotion tools instead.'
 
 $script:PromotionMcpOnlyGhIssueBlockedReason = 'PROMOTION_MCP_ONLY_BLOCKED: Direct GitHub issue creation via `gh` bypasses the approved drm-copilot MCP promotion path (`mcp__drm-copilot__new_potential_entry` -> `mcp__drm-copilot__potential_to_issue` -> `mcp__drm-copilot__new_active_feature_folder`). Use those MCP tools instead.'
@@ -70,7 +72,7 @@ function Get-PromotionBypassReason {
         Returns the gh-CLI issue creation reason when a forbidden gh pattern is matched.
         Returns $null when the command is allowed.
     .PARAMETER CommandText
-        The Bash command text extracted from CLAUDE_TOOL_INPUT.
+        The Bash command text extracted from the envelope's tool_input.
     .OUTPUTS
         System.String or $null.
     #>
@@ -118,7 +120,7 @@ function Test-PromotionBypassToken {
     .SYNOPSIS
         Return $true when a Bash command contains a forbidden promotion bypass pattern.
     .PARAMETER CommandText
-        The Bash command text extracted from CLAUDE_TOOL_INPUT.
+        The Bash command text extracted from the envelope's tool_input.
     .OUTPUTS
         System.Boolean
     #>
@@ -183,7 +185,7 @@ function Get-PromotionMcpOnlyAllowDecision {
 function Invoke-PromotionMcpOnlyDecision {
     <#
     .SYNOPSIS
-        Parse CLAUDE_TOOL_INPUT and return an allow-or-block decision.
+        Parse the PreToolUse envelope and return an allow-or-block decision.
     .PARAMETER ToolInputRaw
         The raw JSON tool payload supplied by Claude Code.
     .OUTPUTS
@@ -198,17 +200,15 @@ function Invoke-PromotionMcpOnlyDecision {
         [string] $ToolInputRaw
     )
 
-    if (-not $ToolInputRaw) {
-        return Get-PromotionMcpOnlyAllowDecision
-    }
-
-    try {
-        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        throw "enforce-promotion-mcp-only hook received malformed JSON in CLAUDE_TOOL_INPUT: $_"
+    $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
+    if (-not $payload.IsValid) {
+        return Get-PromotionMcpOnlyBlockDecision -Reason (
+            'PROMOTION_MCP_ONLY_BLOCKED: payload anomaly - ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
     }
 
-    $commandText = $toolInput.command
+    $commandText = Get-ClaudeHookToolInputString -ToolInput $payload.Value -Name 'command'
     if (-not $commandText) {
         return Get-PromotionMcpOnlyAllowDecision
     }
@@ -221,18 +221,55 @@ function Invoke-PromotionMcpOnlyDecision {
     return Get-PromotionMcpOnlyAllowDecision
 }
 
+function Invoke-PromotionMcpOnlyEntryPoint {
+    <#
+    .SYNOPSIS
+        Runs the hook decision and returns the process exit code.
+    .DESCRIPTION
+        Acquires the payload through the shared reader unless the caller supplies
+        one, emits the compact decision JSON, and returns 0. It never returns 1:
+        exit 1 is non-blocking for PreToolUse, so every anomaly is already a deny
+        decision by the time control reaches here. The function does not call exit;
+        the thin tail converts the returned code into a process exit.
+    .PARAMETER ToolInputRaw
+        Optional pre-acquired payload text. When omitted the ReadPayload seam runs.
+    .PARAMETER ReadPayload
+        Seam for payload acquisition, so tests can drive the empty-on-all-transports
+        case without touching a console.
+    .OUTPUTS
+        System.Int32
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
+
+        [scriptblock] $ReadPayload = { Read-ClaudeHookRawPayload }
+    )
+
+    if (-not $PSBoundParameters.ContainsKey('ToolInputRaw')) {
+        $ToolInputRaw = [string](& $ReadPayload)
+    }
+
+    $decision = Invoke-PromotionMcpOnlyDecision -ToolInputRaw $ToolInputRaw
+    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+
+    return 0
+}
+
 # Allow dot-sourcing in tests without executing the entrypoint.
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
-try {
-    $decision = Invoke-PromotionMcpOnlyDecision -ToolInputRaw $env:CLAUDE_TOOL_INPUT
-} catch {
-    Write-Error $_
-    exit 1
+# The entry point returns its [int] exit code as the last pipeline element and the
+# decision JSON before it. `exit (<call>)` would capture BOTH into the exit
+# expression and emit nothing, so the decision is written explicitly here first.
+$entryPointResult = @(Invoke-PromotionMcpOnlyEntryPoint)
+if ($entryPointResult.Count -gt 1) {
+    $entryPointResult[0..($entryPointResult.Count - 2)] | Write-Output
 }
 
-$decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
-
-exit 0
+exit ([int]$entryPointResult[-1])

package/resources/claude-customizations/.claude/hooks/enforce-python-batch-budget.ps1

@@ -34,6 +34,8 @@
 [CmdletBinding()]
 param()
 
+
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
 function Get-PythonBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -162,17 +164,15 @@ function Invoke-PythonBatchBudgetHook {
         }
     )
 
-    if (-not $ToolInputRaw) {
-        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
-    }
-
-    try {
-        $toolInput = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-    } catch {
-        return Get-PythonBatchBudgetBlockDecision -Reason 'Python batch-budget hook received malformed JSON in CLAUDE_TOOL_INPUT.'
+    $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
+    if (-not $payload.IsValid) {
+        return Get-PythonBatchBudgetBlockDecision -Reason (
+            'Python batch-budget hook received an unreadable PreToolUse envelope: ' +
+            (Get-ClaudeHookPayloadAnomalyReason -Anomaly $payload.Anomaly) +
+            '. The gate fails closed on an envelope it cannot read.')
     }
 
-    $filePath = $toolInput.file_path
+    $filePath = Get-ClaudeHookToolInputString -ToolInput $payload.Value -Name 'file_path'
     if (-not $filePath) {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
     }
@@ -211,28 +211,71 @@ function Invoke-PythonBatchBudgetHook {
     return $decision
 }
 
-if ($MyInvocation.InvocationName -eq '.') {
-    return
-}
+function Invoke-PythonBatchBudgetEntryPoint {
+    <#
+    .SYNOPSIS
+        Runs the Python batch-budget decision and returns the process exit code.
+    .DESCRIPTION
+        Wraps the dispatch logic that the hook entry point performs so it can be
+        exercised by unit tests. It acquires the payload through the shared reader
+        unless the caller supplies one, writes the compact JSON decision to the output
+        stream only when the decision is a deny (this hook is deny-only: an allow
+        decision emits nothing), and returns 0. This function does not call exit; the
+        thin entry-point wiring converts the returned code into a process exit.
+    .PARAMETER ToolInputRaw
+        Optional pre-acquired payload text. When omitted the ReadPayload seam runs.
+    .PARAMETER ReadPayload
+        Seam for payload acquisition, so tests can drive the empty-on-all-transports
+        case without touching a console.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $ToolInputRaw,
 
-$sessionId = $env:CLAUDE_SESSION_ID
-if (-not $sessionId) {
-    $sessionId = 'default'
-}
+        [scriptblock] $ReadPayload = { Read-ClaudeHookRawPayload }
+    )
 
-$prodCap = 3
-$testCap = 3
-if ($env:CLAUDE_PYTHON_BUDGET_PROD -match '^\d+$') {
-    $prodCap = [int]$env:CLAUDE_PYTHON_BUDGET_PROD
+    if (-not $PSBoundParameters.ContainsKey('ToolInputRaw')) {
+        $ToolInputRaw = [string](& $ReadPayload)
+    }
+
+    $sessionId = $env:CLAUDE_SESSION_ID
+    if (-not $sessionId) {
+        $sessionId = 'default'
+    }
+
+    $prodCap = 3
+    $testCap = 3
+    if ($env:CLAUDE_PYTHON_BUDGET_PROD -match '^\d+$') {
+        $prodCap = [int]$env:CLAUDE_PYTHON_BUDGET_PROD
+    }
+    if ($env:CLAUDE_PYTHON_BUDGET_TEST -match '^\d+$') {
+        $testCap = [int]$env:CLAUDE_PYTHON_BUDGET_TEST
+    }
+
+    $decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $ToolInputRaw -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
+    if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
+        $decision.Remove('state')
+        $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+    }
+
+    return 0
 }
-if ($env:CLAUDE_PYTHON_BUDGET_TEST -match '^\d+$') {
-    $testCap = [int]$env:CLAUDE_PYTHON_BUDGET_TEST
+
+# Guard allows dot-sourcing in tests without executing the entrypoint.
+if ($MyInvocation.InvocationName -eq '.') {
+    return
 }
 
-$decision = Invoke-PythonBatchBudgetHook -ToolInputRaw $env:CLAUDE_TOOL_INPUT -SessionId $sessionId -ProdCap $prodCap -TestCap $testCap
-if ($decision.hookSpecificOutput.permissionDecision -eq 'deny') {
-    $decision.Remove('state')
-    $decision | ConvertTo-Json -Compress -Depth 5 | Write-Output
+# The entry point returns its [int] exit code as the last pipeline element and the
+# decision JSON before it. `exit (<call>)` would capture BOTH into the exit
+# expression and emit nothing, so the decision is written explicitly here first.
+$entryPointResult = @(Invoke-PythonBatchBudgetEntryPoint)
+if ($entryPointResult.Count -gt 1) {
+    $entryPointResult[0..($entryPointResult.Count - 2)] | Write-Output
 }
 
-exit 0
+exit ([int]$entryPointResult[-1])

package/resources/claude-customizations/.claude/hooks/validate-bash.ps1

@@ -4,13 +4,14 @@
 
 .DESCRIPTION
     This script is invoked by the Claude Code PreToolUse hook before any Bash
-    command is executed. It reads the proposed command string from the
-    CLAUDE_TOOL_INPUT (or CLAUDE_HOOK_INPUT) environment variable (JSON with a
-    'command' field) or falls back to the first positional argument. If the
-    command matches any blocked pattern (destructive operations such as forced
-    deletions, forced pushes, or hard resets), the script writes a PreToolUse
-    deny decision to stdout and exits with code 0. The deny decision uses the
-    Claude Code PreToolUse schema:
+    command is executed. It acquires the hook payload through the shared reader
+    (.claude/lib/hook-payload/HookPayload.psm1: stdin first, then the two
+    environment-variable fallbacks) and reads the proposed command string from the
+    envelope's nested tool_input.command, or falls back to the first positional
+    argument. If the command matches any blocked pattern (destructive operations
+    such as forced deletions, forced pushes, or hard resets), the script writes a
+    PreToolUse deny decision to stdout and exits with code 0. The deny decision
+    uses the Claude Code PreToolUse schema:
 
         {"hookSpecificOutput":{"hookEventName":"PreToolUse",
          "permissionDecision":"deny","permissionDecisionReason":"<reason>"}}
@@ -20,6 +21,13 @@
     deny-path 'exit 1' are intentionally NOT used: PreToolUse fail-opens on both,
     so they would silently fail to block.
 
+    Deliberate exception to the fail-closed envelope policy (issue #501, AC-5): this
+    hook is a dangerous-command denylist, not a receipt gate, so an empty payload
+    remains an allow and unparseable raw text is still treated as the command text
+    for denylist matching. Both behaviours preserve the documented manual/CLI usage
+    'pwsh -NoProfile -File validate-bash.ps1 "<command>"'. Every other PreToolUse
+    hook denies on those two conditions.
+
 .NOTES
     Compatible with PowerShell 7+.
     This script must not modify any state; it is a read-only validation gate.
@@ -30,6 +38,8 @@ param(
     [string]$CommandInput
 )
 
+Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+
 function Get-BlockedBashPattern {
     [CmdletBinding()]
     [OutputType([string[]])]
@@ -119,14 +129,21 @@ function Get-BashCommandToCheck {
     )
 
     if ($ToolInputRaw) {
-        try {
-            $parsed = $ToolInputRaw | ConvertFrom-Json -ErrorAction Stop
-            if ($parsed.command) {
-                return [string]$parsed.command
+        $parsed = ConvertFrom-ClaudeHookEnvelope -Raw $ToolInputRaw
+        if (-not $parsed.IsValid) {
+            # AC-5 exception: unparseable raw text is still treated as the command
+            # text, which is what the documented manual/CLI usage supplies.
+            if ($parsed.Anomaly -eq 'UnparseableJson') {
+                return [string]$ToolInputRaw
+            }
+        } else {
+            $extracted = Get-ClaudeHookToolInput -Envelope $parsed.Value
+            if ($extracted.IsValid) {
+                $command = Get-ClaudeHookToolInputString -ToolInput $extracted.Value -Name 'command'
+                if ($command) {
+                    return $command
+                }
             }
-        } catch {
-            # If JSON parsing fails, treat the raw input as the command.
-            return $ToolInputRaw
         }
     }
 
@@ -166,10 +183,7 @@ if ($MyInvocation.InvocationName -eq '.') {
     return
 }
 
-$toolInputRaw = $env:CLAUDE_TOOL_INPUT
-if (-not $toolInputRaw) {
-    $toolInputRaw = $env:CLAUDE_HOOK_INPUT
-}
+$toolInputRaw = Read-ClaudeHookRawPayload
 
 $decision = Invoke-ValidateBashDecision -ToolInputRaw $toolInputRaw -PositionalInput $CommandInput
 if ($null -ne $decision -and $decision.hookSpecificOutput.permissionDecision -eq 'deny') {