@danmoisan/drm-copilot-mcp 1.1.10 → 1.1.12

package/resources/codex-and-agents-customizations/.agents/skills/repo-automation-adapter/SKILL.md

@@ -50,6 +50,32 @@ Use these semantic MCP tools when the corresponding operation is required:
 - `run_poshqc_analyze`
 - `run_poshqc_analyze_autofix`
 - `run_poshqc_test`
+- `resolve_orchestration_topology`
+- `resolve_provider_routing`
+- `transition_prepared_orchestration`
+
+## Independent Expected Context for Portable Handoff Tools
+
+The three portable prepared-orchestration tools bind a handoff to one specific
+destination checkout. Every call to `resolve_orchestration_topology`,
+`resolve_provider_routing`, and `transition_prepared_orchestration` must carry
+the complete caller-controlled independent expected context:
+
+- `expected_repository_id`
+- `expected_workspace_root`
+- `expected_branch`
+- `expected_source_head_sha`
+- `allowed_head_relationship`
+- `expected_issue_number`
+- `expected_feature_folder`
+- `expected_work_mode`
+- `expected_plan_path`
+- `expected_plan_sha256`
+
+Derive each value from the destination checkout and the caller's own record.
+The envelope under validation is never the source of the values it is
+validated against. A call that omits a value, or that copies one from the
+envelope, is rejected before the service is invoked.
 
 Legacy VS Code command IDs are historical source material only and must not be invoked:
 

package/resources/codex-and-agents-customizations/.codex/config.toml

@@ -2,7 +2,7 @@ default_permissions = ":danger-full-access"
 
 [mcp_servers.drm-copilot]
 command = "npx"
-args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.10"]
+args = ["-y", "@danmoisan/drm-copilot-mcp@1.1.12"]
 required = true
 enabled_tools = [
     "collect_commit_context",

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-merge-gate.ps1

@@ -5,6 +5,20 @@
 [CmdletBinding()]
 param()
 
+# Shared command-line parser (issue #545). The scope filter and the PR-number resolver below
+# both run against the segment that structurally invokes `gh pr merge`, which is what keeps
+# the two runtimes on one implementation of the same concern.
+. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
+. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
+
+# Reason codes for the standalone-merge authorization branch (issue #670), spelled
+# byte-identically to the Claude helpers file. Each of the four assignments below is the only
+# place its code literal appears in this file.
+$script:CodexStandaloneAbsentReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_ABSENT'
+$script:CodexStandalonePrMismatchReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_PR_MISMATCH'
+$script:CodexStandaloneMalformedReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_MALFORMED'
+$script:CodexStandaloneNotPrSpecificReasonCode = 'STANDALONE_MERGE_AUTHORIZATION_NOT_PR_SPECIFIC'
+
 function ConvertFrom-CodexMergeJson {
     [CmdletBinding()]
     param([AllowNull()][AllowEmptyString()][string] $Raw, [Parameter(Mandatory)][string] $Name, [switch] $Optional)
@@ -26,13 +40,37 @@ function ConvertFrom-CodexMergeJson {
 }
 
 function Get-CodexMergeCommandPrNumber {
+    <#
+    .SYNOPSIS
+        Resolve the explicit pull-request number of a gh pr merge invocation, or $null.
+    .DESCRIPTION
+        The number is taken from the segment that structurally invokes `gh pr merge` and
+        from nowhere else: the positional spelling through Get-CommandLineOperand, the
+        flag-led and equals-joined spellings through Get-CommandLineFlagValue. A leading
+        `cd <path>` segment contributes no operand and no flag value, so no digit run
+        outside the merge segment can be mistaken for a pull-request number.
+
+        This copy has never carried the Claude copy's unanchored whole-text digit scan and
+        deliberately does not acquire one. No regular expression matching a bare digit run
+        is introduced here; the only pattern below anchors an all-digit token end to end.
+    .OUTPUTS
+        System.Nullable[int]
+    #>
     [CmdletBinding()]
     [OutputType([int])]
     param([Parameter(Mandatory)][string] $Command)
 
-    if ($Command -match '(?i)\bgh\s+pr\s+merge\s+(\d+)\b') {
-        return [int]$Matches[1]
+    foreach ($operand in @(Get-CommandLineOperand -CommandText $Command -CommandWord 'gh' -SubcommandPath @('pr', 'merge'))) {
+        if ($operand -match '^\d+$') {
+            return [int]$operand
+        }
+    }
+
+    $flagValue = Get-CommandLineFlagValue -CommandText $Command -CommandWord 'gh' -SubcommandPath @('pr', 'merge') -FlagName '--merge'
+    if ($null -ne $flagValue -and $flagValue -match '^\d+$') {
+        return [int]$flagValue
     }
+
     return $null
 }
 
@@ -95,7 +133,23 @@ function Invoke-CodexEpicMergeDecision {
         return $null
     }
     $command = [string]$payload.tool_input.command
-    if ($command -notmatch '(?i)\bgh\s+pr\s+merge\b' -or $command -notmatch '(?i)--merge\b') {
+    # Both legs are read structurally from the segment that invokes the command, so a
+    # quoted mention of the phrase no longer brings a command into scope. The flag leg needs
+    # a raw-scan fallback: a wrapper's quoted argument collapses into ONE token, so a flag
+    # inside it is never read as a token, and the token-only read took
+    # bash -c "gh pr merge --merge 688" out of scope.
+    $isMergeInvocation = Test-CommandLineInvocation -CommandText $command -CommandWord 'gh' -SubcommandPath @('pr', 'merge')
+    $hasMergeFlag = Test-CommandLineFlag -CommandText $command -CommandWord 'gh' -SubcommandPath @('pr', 'merge') -FlagName '--merge'
+    if (-not $hasMergeFlag) {
+        foreach ($segment in @(Read-CommandLineSegment -CommandText $command)) {
+            if ((Test-CommandLineSegmentRawScan -Segment $segment) -and
+                $segment.ScanText.IndexOf('--merge', [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+                $hasMergeFlag = $true
+                break
+            }
+        }
+    }
+    if (-not $isMergeInvocation -or -not $hasMergeFlag) {
         return $null
     }
 
@@ -109,6 +163,24 @@ function Invoke-CodexEpicMergeDecision {
         return $null
     }
 
+    # Standalone branch (issue #670), evaluated last and only for an explicit PR number: a
+    # PR-specific authorization record bound to the payload session. Its deny keeps the gate
+    # token first.
+    if ($null -ne $prNumber) {
+        $sessionId = [string]$payload.session_id
+        $verdict = Test-CodexStandaloneMergeAuthorization -Checkpoints @($child, $epic) -CommandPrNumber $prNumber -SessionId $sessionId
+        if ($verdict.Allowed) {
+            return $null
+        }
+        return [ordered]@{
+            hookSpecificOutput = [ordered]@{
+                hookEventName            = 'PreToolUse'
+                permissionDecision       = 'deny'
+                permissionDecisionReason = 'EPIC_MERGE_GATE_BLOCKED: ' + $verdict.ReasonCode + ': ' + $verdict.Message
+            }
+        }
+    }
+
     return [ordered]@{
         hookSpecificOutput = [ordered]@{
             hookEventName            = 'PreToolUse'
@@ -118,6 +190,173 @@ function Invoke-CodexEpicMergeDecision {
     }
 }
 
+function Test-CodexStandalonePositiveInteger {
+    <#
+    .SYNOPSIS
+        Report whether a parsed JSON value is an integer greater than zero; a digit string fails.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([AllowNull()] $Value)
+
+    return (($Value -is [int] -or $Value -is [long]) -and $Value -gt 0)
+}
+
+function Test-CodexStandaloneText {
+    <#
+    .SYNOPSIS
+        Report whether a value is a string whose trimmed length reaches a minimum.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([AllowNull()] $Value, [int] $MinimumLength = 1)
+
+    return ($Value -is [string] -and $Value.Trim().Length -ge $MinimumLength)
+}
+
+function Get-CodexStandaloneField {
+    <#
+    .SYNOPSIS
+        Read a named field off a parsed record, or $null; the unary comma keeps a
+        one-element array from unrolling into its scalar.
+    #>
+    [CmdletBinding()]
+    [OutputType([object], [object[]])]
+    param([Parameter(Mandatory)] $Record, [Parameter(Mandatory)][string] $Name)
+
+    $property = $Record.PSObject.Properties[$Name]
+    if ($null -eq $property) {
+        return $null
+    }
+    return , $property.Value
+}
+
+function Get-CodexStandaloneRecordFailure {
+    <#
+    .SYNOPSIS
+        Return the first failing field of a matched record, or $null when every check passes.
+    .DESCRIPTION
+        Uses the same fixed order as the Claude helpers file: pr_url, issue_num, branch_name,
+        authorized_by, authorized_at, basis, run_slug, session_id. branch_name is checked for
+        presence only. A blank payload session fails closed.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([Parameter(Mandatory)] $Record, [AllowNull()][AllowEmptyString()][string] $SessionId)
+
+    $prUrl = Get-CodexStandaloneField -Record $Record -Name 'pr_url'
+    if (-not (Test-CodexStandaloneText -Value $prUrl) -or
+        -not $prUrl.EndsWith('/pull/' + [string]$Record.pr_number, [System.StringComparison]::Ordinal)) {
+        return 'pr_url'
+    }
+    if (-not (Test-CodexStandalonePositiveInteger -Value (Get-CodexStandaloneField -Record $Record -Name 'issue_num'))) {
+        return 'issue_num'
+    }
+    foreach ($name in @('branch_name', 'authorized_by')) {
+        if (-not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name $name))) {
+            return $name
+        }
+    }
+    $authorizedAt = Get-CodexStandaloneField -Record $Record -Name 'authorized_at'
+    $parsedAt = [DateTime]::MinValue
+    $timestampValid = $authorizedAt -is [DateTime] -or $authorizedAt -is [DateTimeOffset]
+    if (-not $timestampValid -and (Test-CodexStandaloneText -Value $authorizedAt)) {
+        $timestampValid = [DateTime]::TryParse(
+            $authorizedAt,
+            [System.Globalization.CultureInfo]::InvariantCulture,
+            [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal,
+            [ref] $parsedAt)
+    }
+    if (-not $timestampValid) {
+        return 'authorized_at'
+    }
+    if (-not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name 'basis') -MinimumLength 20)) {
+        return 'basis'
+    }
+    if ($null -ne $Record.PSObject.Properties['run_slug'] -and
+        -not (Test-CodexStandaloneText -Value (Get-CodexStandaloneField -Record $Record -Name 'run_slug'))) {
+        return 'run_slug'
+    }
+    $recordSession = Get-CodexStandaloneField -Record $Record -Name 'session_id'
+    if (-not (Test-CodexStandaloneText -Value $recordSession) -or
+        [string]::IsNullOrWhiteSpace($SessionId) -or
+        -not [string]::Equals($recordSession, $SessionId, [System.StringComparison]::Ordinal)) {
+        return 'session_id'
+    }
+    return $null
+}
+
+function Test-CodexStandaloneMergeAuthorization {
+    <#
+    .SYNOPSIS
+        Codex counterpart of the Claude standalone-merge authorization predicate.
+    .DESCRIPTION
+        Evaluates the parsed child and epic checkpoints with the same activation condition
+        as the Claude side: a PR-specific record naming CommandPrNumber, with well-formed
+        fields and a session_id equal to the payload session. Returns an object whose
+        Allowed member is $true on success, or $false with ReasonCode and Message.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()][AllowEmptyCollection()][object[]] $Checkpoints,
+        [Parameter(Mandatory)][int] $CommandPrNumber,
+        [AllowNull()][AllowEmptyString()][string] $SessionId
+    )
+
+    $key = 'standalone_merge_authorizations'
+    $present = $false
+    $specific = $true
+    $match = $null
+    foreach ($checkpoint in @($Checkpoints)) {
+        if ($checkpoint -isnot [System.Management.Automation.PSCustomObject] -or
+            $null -eq $checkpoint.PSObject.Properties[$key]) {
+            continue
+        }
+        $present = $true
+        $block = $checkpoint.PSObject.Properties[$key].Value
+        if ($block -isnot [System.Array] -or $block.Count -eq 0) {
+            $specific = $false
+            continue
+        }
+        foreach ($entry in $block) {
+            $number = $null
+            if ($entry -is [System.Management.Automation.PSCustomObject]) {
+                $number = Get-CodexStandaloneField -Record $entry -Name 'pr_number'
+            }
+            if (-not (Test-CodexStandalonePositiveInteger -Value $number)) {
+                $specific = $false
+            } elseif ($null -eq $match -and $number -eq $CommandPrNumber) {
+                $match = $entry
+            }
+        }
+    }
+
+    if (-not $present) {
+        $code = $script:CodexStandaloneAbsentReasonCode
+        $message = 'no orchestrator checkpoint carries an authorization record, but an authorized standalone merge path exists.'
+    } elseif (-not $specific) {
+        $code = $script:CodexStandaloneNotPrSpecificReasonCode
+        $message = 'an orchestrator checkpoint carries the authorization key but names no specific pull request; a blanket flag is not an authorization record.'
+    } elseif ($null -eq $match) {
+        $code = $script:CodexStandalonePrMismatchReasonCode
+        $message = "authorization records exist, but none names pull request $CommandPrNumber."
+    } else {
+        $field = Get-CodexStandaloneRecordFailure -Record $match -SessionId $SessionId
+        if ($null -eq $field) {
+            return [pscustomobject]@{ Allowed = $true; ReasonCode = $null; Message = $null }
+        }
+        $code = $script:CodexStandaloneMalformedReasonCode
+        $message = "the matched authorization record has an invalid '$field'."
+    }
+
+    return [pscustomobject]@{
+        Allowed    = $false
+        ReasonCode = $code
+        Message    = "$message To authorize a standalone merge, write a $key record naming this pull request and the current session_id into an orchestrator checkpoint, as described in .claude/rules/orchestrator-state.md."
+    }
+}
+
 if ($MyInvocation.InvocationName -eq '.') {
     return
 }

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-planning-only.ps1

@@ -16,8 +16,13 @@ $script:AllowedPreparationMcpTools = @(
     'mcp__drm-copilot__potential_to_issue',
     'mcp__drm-copilot__new_active_feature_folder',
     'mcp__drm-copilot__resolve_atomic_plan_prompt',
-    'mcp__drm-copilot__resolve_execute_hard_lock_prompt',
-    'mcp__drm-copilot__validate_orchestration_artifacts'
+    'mcp__drm-copilot__resolve_execute_hard_lock_prompt'
+)
+$script:PreparationSemanticMcpIds = @(
+    'drm-copilot.validate_orchestration_artifacts',
+    'drm-copilot.resolve_orchestration_topology',
+    'drm-copilot.resolve_provider_routing',
+    'drm-copilot.transition_prepared_orchestration'
 )
 
 function ConvertFrom-EpicPlanningJson {
@@ -41,6 +46,44 @@ function ConvertFrom-EpicPlanningJson {
     }
 }
 
+function Get-EpicPlanningRegisteredMcpTool {
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param(
+        [Parameter(Mandatory)][string] $RegistryPath,
+        [Parameter(Mandatory)][string[]] $SemanticIds
+    )
+
+    if (-not (Test-Path -LiteralPath $RegistryPath -PathType Leaf)) {
+        throw "EPIC_PLANNING_ONLY_BLOCKED: semantic MCP registry '$RegistryPath' does not exist."
+    }
+    $registry = ConvertFrom-EpicPlanningJson `
+        -Raw (Get-Content -Raw -LiteralPath $RegistryPath) `
+        -Name 'semantic MCP registry'
+    $registered = [System.Collections.Generic.List[string]]::new()
+    foreach ($semanticId in $SemanticIds) {
+        $property = $registry.semantic_tools.PSObject.Properties[$semanticId]
+        if ($null -eq $property) {
+            throw "EPIC_PLANNING_ONLY_BLOCKED: semantic MCP id '$semanticId' is not registered."
+        }
+        $entry = $property.Value
+        $operation = $semanticId.Substring($semanticId.LastIndexOf('.') + 1)
+        if ([string]$entry.operation -ne $operation) {
+            throw "EPIC_PLANNING_ONLY_BLOCKED: semantic MCP id '$semanticId' has an invalid operation."
+        }
+        foreach ($alias in @($entry.transport_aliases)) {
+            $escapedOperation = [regex]::Escape($operation)
+            if ([string]$alias -notmatch "^mcp__(?:drm-copilot|drm_copilot)__$escapedOperation`$") {
+                throw "EPIC_PLANNING_ONLY_BLOCKED: semantic MCP id '$semanticId' has an invalid transport alias."
+            }
+            $registered.Add([string]$alias)
+        }
+    }
+    return [string[]]($registered | Sort-Object -Unique)
+}
+
+$script:EpicPlanningRepositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+
 function Get-EpicPlanningDenyDecision {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -163,7 +206,8 @@ function Invoke-EpicPlanningOnlyDecision {
         [AllowNull()][AllowEmptyString()][string] $CheckpointRaw,
         [AllowNull()][AllowEmptyString()][string] $EpicExecutionContext,
         [AllowNull()][string[]] $StagedPaths,
-        [AllowNull()][AllowEmptyString()][string] $CurrentBranch
+        [AllowNull()][AllowEmptyString()][string] $CurrentBranch,
+        [string] $RegistryPath = (Join-Path $script:EpicPlanningRepositoryRoot 'config/orchestration-handoff-registry.json')
     )
 
     $payload = ConvertFrom-EpicPlanningJson -Raw $PayloadRaw -Name 'PreToolUse input'
@@ -223,11 +267,21 @@ function Invoke-EpicPlanningOnlyDecision {
         return Get-EpicPlanningDenyDecision -Reason 'the Bash command is outside the preparation read, branch, commit, push, or validator allowlist.'
     }
 
-    if ($toolName -like 'mcp__*' -and $toolName -notlike 'mcp__drm-copilot__*') {
-        return Get-EpicPlanningDenyDecision -Reason "MCP tool '$toolName' is not part of the repository-scoped preparation surface."
+    # Lifecycle tools are decided first and never need the registry. Only a
+    # registry-dependent mcp__ call reads it, so a destination without the
+    # registry keeps every other decision and fails closed for semantic MCP.
+    $allowedRepositoryMcp = $script:AllowedPreparationMcpTools -contains $toolName
+    $allowedSemanticMcp = $false
+    if (-not $allowedRepositoryMcp -and $toolName -like 'mcp__*') {
+        if (-not (Test-Path -LiteralPath $RegistryPath -PathType Leaf)) {
+            return Get-EpicPlanningDenyDecision -Reason "semantic MCP registry '$RegistryPath' does not exist; registry-dependent MCP tool '$toolName' is denied in preparation mode."
+        }
+        $registeredSemanticMcp = @(Get-EpicPlanningRegisteredMcpTool `
+                -RegistryPath $RegistryPath `
+                -SemanticIds $script:PreparationSemanticMcpIds)
+        $allowedSemanticMcp = $registeredSemanticMcp -contains $toolName
     }
-
-    if ($toolName -like 'mcp__drm-copilot__*') {
+    if ($allowedRepositoryMcp -or $allowedSemanticMcp) {
         if ($attestedPreparation) {
             $workspaceRoot = [string]$payload.tool_input.workspace_root
             if ([string]::IsNullOrWhiteSpace($workspaceRoot) -or
@@ -236,10 +290,11 @@ function Invoke-EpicPlanningOnlyDecision {
                 return Get-EpicPlanningDenyDecision -Reason 'preparation MCP calls require workspace_root equal to the attested session cwd.'
             }
         }
-        if ($script:AllowedPreparationMcpTools -contains $toolName) {
-            return $null
-        }
-        return Get-EpicPlanningDenyDecision -Reason "MCP tool '$toolName' is outside the preparation lifecycle and validator allowlist."
+        return $null
+    }
+
+    if ($toolName -like 'mcp__*') {
+        return Get-EpicPlanningDenyDecision -Reason "MCP tool '$toolName' is outside the registered preparation lifecycle and semantic allowlist."
     }
 
     return Get-EpicPlanningDenyDecision -Reason "tool '$toolName' is not classified for preparation mode."
@@ -273,7 +328,7 @@ if ($MyInvocation.InvocationName -eq '.') {
 
 try {
     $payloadRaw = [Console]::In.ReadToEnd()
-    $repositoryRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    $repositoryRoot = $script:EpicPlanningRepositoryRoot
     $checkpointPath = Join-Path $repositoryRoot 'artifacts/orchestration/orchestrator-state.json'
     $checkpointRaw = if (Test-Path -LiteralPath $checkpointPath -PathType Leaf) {
         Get-Content -Raw -LiteralPath $checkpointPath

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-epic-worktree-removal-gate.ps1

@@ -5,6 +5,12 @@
 [CmdletBinding()]
 param()
 
+# Shared command-line parser (issue #545). The scope filter and the operand extractor below
+# both run against the segment that structurally invokes `git worktree remove`, which is what
+# keeps the two runtimes on one implementation of the same concern.
+. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
+. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
+
 $script:SafeWorktreeStatuses = @('merged', 'worktree_removed')
 
 function ConvertFrom-CodexWorktreeJson {
@@ -28,18 +34,35 @@ function ConvertFrom-CodexWorktreeJson {
 }
 
 function Get-CodexWorktreeRemovalPath {
+    <#
+    .SYNOPSIS
+        Extract the target worktree path from a git worktree remove command.
+    .DESCRIPTION
+        The operand comes from the segment that structurally invokes git worktree remove, so
+        a chained 'cd <path> &&' segment contributes nothing and a quoted mention of the
+        phrase resolves to no operand. The tokenizer strips balanced double and single
+        quotes, which is what the previous pattern's `double` and `single` alternatives did.
+
+        The previous pattern accepted '--force' only immediately after 'remove'. That
+        spelling is preserved and the trailing spelling now works too, because '--force' is a
+        zero-argument flag that never contributes an operand wherever it is written. Its
+        presence is read structurally through Test-CommandLineFlag rather than by a raw-text
+        search. The empty-string-on-miss contract is unchanged: callers test `if ($target)`.
+    .OUTPUTS
+        System.String
+    #>
     [CmdletBinding()]
     [OutputType([string])]
     param([Parameter(Mandatory)][AllowEmptyString()][string] $Command)
 
-    $pattern = '(?i)\bgit\s+worktree\s+remove(?:\s+--force)?\s+(?:"(?<double>[^"]+)"|''(?<single>[^'']+)''|(?<bare>\S+))'
-    if ($Command -notmatch $pattern) {
-        return ''
+    $hasForce = Test-CommandLineFlag -CommandText $Command -CommandWord 'git' -SubcommandPath @('worktree', 'remove') -FlagName '--force'
+    $operands = @(Get-CommandLineOperand -CommandText $Command -CommandWord 'git' -SubcommandPath @('worktree', 'remove'))
+
+    if ($operands.Count -gt 0) {
+        return [string]$operands[0]
     }
-    foreach ($name in @('double', 'single', 'bare')) {
-        if ($Matches[$name]) {
-            return [string]$Matches[$name]
-        }
+    if ($hasForce) {
+        return '--force'
     }
     return ''
 }
@@ -97,7 +120,10 @@ function Invoke-CodexWorktreeRemovalDecision {
         return $null
     }
     $command = [string]$payload.tool_input.command
-    if ($command -notmatch '(?i)\bgit\s+worktree\s+remove\b') {
+    # Scope filter. Structural, so a relocating spelling such as
+    # 'git -C <dir> worktree remove <path>' is in scope and quoted prose that merely mentions
+    # the phrase is not (issue #545).
+    if (-not (Test-CommandLineInvocation -CommandText $command -CommandWord 'git' -SubcommandPath @('worktree', 'remove'))) {
         return $null
     }
     $target = Get-CodexWorktreeRemovalPath -Command $command