@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-powershell-batch-budget.ps1

@@ -8,14 +8,26 @@
     operation. When the target file is a PowerShell source file (.ps1, .psm1, .psd1),
     it decides whether the change may proceed in direct mode.
 
-    Direct mode counts distinct production PowerShell paths per Codex session. The
-    running set is persisted under .codex/state/powershell-batch-budget.<session_id>.json,
-    and repeated edits to the same file are counted once. The 4th distinct production
-    path is denied with a POWERSHELL_LARGE_PATH_REQUIRED reason that instructs the
-    caller to route the change through .codex/prompts/orchestrate-work.md.
-
-    The orchestrated large path is detected from
-    <root>/artifacts/orchestration/orchestrator-state.json. The selected route is the
+    Direct mode counts distinct production PowerShell paths per Codex session and per
+    resolved target worktree, and repeated edits to the same file are counted once. The
+    4th distinct production path in one worktree is denied with a
+    POWERSHELL_LARGE_PATH_REQUIRED reason that instructs the caller to route the change
+    through .codex/prompts/orchestrate-work.md.
+
+    Each evaluated path is placed with Resolve-HookTargetWorktree from the dot-sourced
+    hook-target-worktree.ps1. An absolute path resolves to its nearest enclosing
+    registered git worktree; a relative path, a path inside no registered worktree, and
+    an ambiguous result use the session root. The route is read from
+    artifacts/orchestration/orchestrator-state.json in the resolved target worktree.
+    The running set is kept under the session root, in
+    .codex/state/powershell-batch-budget.<session_id>.json when the resolved target worktree
+    is the session root and in .codex/state/powershell-batch-budget.<session_id>.<worktree key>.json
+    otherwise; no state is written under another worktree. A path under the root-level
+    artifacts/ directory of the resolved target worktree is never counted and writes no
+    state. No containment filter applies: a path outside every registered worktree is
+    counted against the session root, as before.
+
+    The selected route is the
     route_id value when that key is present, otherwise the path_selected value, and it
     is usable only as a non-blank string. When the selected route is large,
     remediation, or preparation and the checkpoint is not terminal (next_step is not
@@ -36,9 +48,12 @@
     hookSpecificOutput.permissionDecision = 'deny' and exits 0. Files already counted
     are always allowed through.
 
-    Known limitation: a stale non-terminal large-path checkpoint left at the root
-    exempts a later direct-mode session at that root. Orchestrator checkpoint hygiene
-    (issue #673) moves foreign checkpoints aside before a new run.
+    Known limitations: an 8.3 short-name path, or a path reached through a junction,
+    that differs textually from the long path git reports matches no registered
+    worktree and falls back to the session root. A stale non-terminal large-path
+    checkpoint in a worktree exempts a later direct-mode session editing that worktree;
+    orchestrator checkpoint hygiene (issue #673) moves foreign checkpoints aside before
+    a new run.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -51,6 +66,9 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
 try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
+# Shared target-worktree resolver; the Codex twin of HookTargetWorktree.psm1.
+try { . (Join-Path $PSScriptRoot 'hook-target-worktree.ps1') } catch { Add-HookDependencyFailure -Name 'hook-target-worktree.ps1' -ErrorRecord $_ }
+
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
 $script:PowerShellBatchBudgetRouteImportFailure = $null; try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { $script:PowerShellBatchBudgetRouteImportFailure = 'enforce-batch-budget-route.ps1' }
 
@@ -194,7 +212,8 @@ function Invoke-PowerShellBatchBudgetHook {
         [scriptblock] $WriteState = {
             param([string] $Path, [System.Collections.IDictionary] $State)
             $State | ConvertTo-Json -Depth 5 | Set-Content -Path $Path -Encoding UTF8
-        }
+        },
+        [scriptblock] $WorktreeListInvoker
     )
 
     if (-not $ToolInputRaw) {
@@ -218,12 +237,31 @@ function Invoke-PowerShellBatchBudgetHook {
     }
     if ($script:PowerShellBatchBudgetRouteImportFailure) { return Get-PowerShellBatchBudgetBlockDecision -Reason "POWERSHELL_LARGE_PATH_REQUIRED: the route helper '$($script:PowerShellBatchBudgetRouteImportFailure)' failed to load, so the batch budget for '$normalized' cannot be evaluated; the gate fails closed." }
 
+    # The path is evaluated against the registered worktree that holds it; the session root
+    # is the fallback for a relative path, a path in no registered worktree, and an ambiguous result.
+    $resolverArguments = @{ SessionRoot = $Root; FilePath = @($filePath) }
+    if ($PSBoundParameters.ContainsKey('WorktreeListInvoker')) { $resolverArguments['WorktreeListInvoker'] = $WorktreeListInvoker }
+    $resolution = Resolve-HookTargetWorktree @resolverArguments
+    $targetRoot = $Root
+    $isSessionRoot = $true
+    if (-not $resolution.Ambiguous -and $null -ne $resolution.WorktreeRoot -and -not [string]::Equals($resolution.WorktreeRoot, (ConvertTo-HookTargetWorktreeNormalizedPath -Path $Root), [System.StringComparison]::OrdinalIgnoreCase)) {
+        $targetRoot = $resolution.WorktreeRoot
+        $isSessionRoot = $false
+    }
+
+    # The root-level artifacts/ directory is gitignored scratch, never a production file.
+    $relativePath = if ($normalized -match '^(/|[A-Za-z]:/)') { Get-HookTargetWorktreeRelativePath -Path $normalized -WorktreeRoot $targetRoot } else { $normalized }
+    if ($null -ne $relativePath -and $relativePath.StartsWith('artifacts/', [System.StringComparison]::OrdinalIgnoreCase)) {
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+    }
+
     $stateDir = Join-Path -Path $Root -ChildPath '.codex/state'
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$SessionId.json")
+    $stateLeaf = if ($isSessionRoot) { "powershell-batch-budget.$SessionId.json" } else { "powershell-batch-budget.$SessionId.$(Get-HookTargetWorktreeKey -WorktreeRoot $targetRoot).json" }
+    $stateFile = Join-Path -Path $stateDir -ChildPath $stateLeaf
 
     # The checkpoint is read before any state operation, so the large path neither
     # creates the state directory nor reads or writes the state file.
-    $checkpointPath = Join-Path -Path $Root -ChildPath 'artifacts/orchestration/orchestrator-state.json'
+    $checkpointPath = Join-Path -Path $targetRoot -ChildPath 'artifacts/orchestration/orchestrator-state.json'
     $checkpointText = ''
     try {
         $checkpointText = [string](& $ReadCheckpoint $checkpointPath)
@@ -279,7 +317,8 @@ function Invoke-PowerShellBatchBudgetCodexEntryPoint {
     .PARAMETER PayloadRaw
         Raw PreToolUse payload text.
     .PARAMETER RepositoryRoot
-        Root used to locate the Codex state directory and the orchestrator checkpoint.
+        Session root: it locates the Codex state directory and is the fallback root. The
+        orchestrator checkpoint comes from the resolved target worktree of each path.
     .PARAMETER HookSeams
         Optional seam overrides splatted into Invoke-PowerShellBatchBudgetHook.
     #>

package/resources/codex-and-agents-customizations/.codex/hooks/enforce-python-batch-budget.ps1

@@ -8,14 +8,26 @@
     operation. When the target file is a Python file (.py), it decides whether the
     change may proceed in direct mode.
 
-    Direct mode counts distinct production Python paths per Codex session. The running
-    set is persisted under .codex/state/python-batch-budget.<session_id>.json, and
-    repeated edits to the same file are counted once. The 4th distinct production path
-    is denied with a PYTHON_LARGE_PATH_REQUIRED reason that instructs the caller to
-    route the change through .codex/prompts/orchestrate-work.md.
-
-    The orchestrated large path is detected from
-    <root>/artifacts/orchestration/orchestrator-state.json. The selected route is the
+    Direct mode counts distinct production Python paths per Codex session and per
+    resolved target worktree, and repeated edits to the same file are counted once. The
+    4th distinct production path in one worktree is denied with a
+    PYTHON_LARGE_PATH_REQUIRED reason that instructs the caller to route the change
+    through .codex/prompts/orchestrate-work.md.
+
+    Each evaluated path is placed with Resolve-HookTargetWorktree from the dot-sourced
+    hook-target-worktree.ps1. An absolute path resolves to its nearest enclosing
+    registered git worktree; a relative path, a path inside no registered worktree, and
+    an ambiguous result use the session root. The route is read from
+    artifacts/orchestration/orchestrator-state.json in the resolved target worktree.
+    The running set is kept under the session root, in
+    .codex/state/python-batch-budget.<session_id>.json when the resolved target worktree
+    is the session root and in .codex/state/python-batch-budget.<session_id>.<worktree key>.json
+    otherwise; no state is written under another worktree. A path under the root-level
+    artifacts/ directory of the resolved target worktree is never counted and writes no
+    state. No containment filter applies: a path outside every registered worktree is
+    counted against the session root, as before.
+
+    The selected route is the
     route_id value when that key is present, otherwise the path_selected value, and it
     is usable only as a non-blank string. When the selected route is large,
     remediation, or preparation and the checkpoint is not terminal (next_step is not
@@ -36,9 +48,12 @@
     hookSpecificOutput.permissionDecision = 'deny' and exits 0. Files already counted
     are always allowed through.
 
-    Known limitation: a stale non-terminal large-path checkpoint left at the root
-    exempts a later direct-mode session at that root. Orchestrator checkpoint hygiene
-    (issue #673) moves foreign checkpoints aside before a new run.
+    Known limitations: an 8.3 short-name path, or a path reached through a junction,
+    that differs textually from the long path git reports matches no registered
+    worktree and falls back to the session root. A stale non-terminal large-path
+    checkpoint in a worktree exempts a later direct-mode session editing that worktree;
+    orchestrator checkpoint hygiene (issue #673) moves foreign checkpoints aside before
+    a new run.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -51,6 +66,9 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 # mapping for every tool name the ^(apply_patch|Edit|Write)$ matcher admits.
 try { . (Join-Path $PSScriptRoot 'codex-pretooluse-file-mapping.ps1') } catch { Add-HookDependencyFailure -Name 'codex-pretooluse-file-mapping.ps1' -ErrorRecord $_ }
 
+# Shared target-worktree resolver; the Codex twin of HookTargetWorktree.psm1.
+try { . (Join-Path $PSScriptRoot 'hook-target-worktree.ps1') } catch { Add-HookDependencyFailure -Name 'hook-target-worktree.ps1' -ErrorRecord $_ }
+
 # Shared route helpers; this file is byte-identical to the Claude runtime copy.
 $script:PythonBatchBudgetRouteImportFailure = $null; try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { $script:PythonBatchBudgetRouteImportFailure = 'enforce-batch-budget-route.ps1' }
 
@@ -197,7 +215,8 @@ function Invoke-PythonBatchBudgetHook {
         [scriptblock] $WriteState = {
             param([string] $Path, [System.Collections.IDictionary] $State)
             $State | ConvertTo-Json -Depth 5 | Set-Content -Path $Path -Encoding UTF8
-        }
+        },
+        [scriptblock] $WorktreeListInvoker
     )
 
     if (-not $ToolInputRaw) {
@@ -221,12 +240,31 @@ function Invoke-PythonBatchBudgetHook {
     }
     if ($script:PythonBatchBudgetRouteImportFailure) { return Get-PythonBatchBudgetBlockDecision -Reason "PYTHON_LARGE_PATH_REQUIRED: the route helper '$($script:PythonBatchBudgetRouteImportFailure)' failed to load, so the batch budget for '$normalized' cannot be evaluated; the gate fails closed." }
 
+    # The path is evaluated against the registered worktree that holds it; the session root
+    # is the fallback for a relative path, a path in no registered worktree, and an ambiguous result.
+    $resolverArguments = @{ SessionRoot = $Root; FilePath = @($filePath) }
+    if ($PSBoundParameters.ContainsKey('WorktreeListInvoker')) { $resolverArguments['WorktreeListInvoker'] = $WorktreeListInvoker }
+    $resolution = Resolve-HookTargetWorktree @resolverArguments
+    $targetRoot = $Root
+    $isSessionRoot = $true
+    if (-not $resolution.Ambiguous -and $null -ne $resolution.WorktreeRoot -and -not [string]::Equals($resolution.WorktreeRoot, (ConvertTo-HookTargetWorktreeNormalizedPath -Path $Root), [System.StringComparison]::OrdinalIgnoreCase)) {
+        $targetRoot = $resolution.WorktreeRoot
+        $isSessionRoot = $false
+    }
+
+    # The root-level artifacts/ directory is gitignored scratch, never a production file.
+    $relativePath = if ($normalized -match '^(/|[A-Za-z]:/)') { Get-HookTargetWorktreeRelativePath -Path $normalized -WorktreeRoot $targetRoot } else { $normalized }
+    if ($null -ne $relativePath -and $relativePath.StartsWith('artifacts/', [System.StringComparison]::OrdinalIgnoreCase)) {
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+    }
+
     $stateDir = Join-Path -Path $Root -ChildPath '.codex/state'
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("python-batch-budget.$SessionId.json")
+    $stateLeaf = if ($isSessionRoot) { "python-batch-budget.$SessionId.json" } else { "python-batch-budget.$SessionId.$(Get-HookTargetWorktreeKey -WorktreeRoot $targetRoot).json" }
+    $stateFile = Join-Path -Path $stateDir -ChildPath $stateLeaf
 
     # The checkpoint is read before any state operation, so the large path neither
     # creates the state directory nor reads or writes the state file.
-    $checkpointPath = Join-Path -Path $Root -ChildPath 'artifacts/orchestration/orchestrator-state.json'
+    $checkpointPath = Join-Path -Path $targetRoot -ChildPath 'artifacts/orchestration/orchestrator-state.json'
     $checkpointText = ''
     try {
         $checkpointText = [string](& $ReadCheckpoint $checkpointPath)
@@ -282,7 +320,8 @@ function Invoke-PythonBatchBudgetCodexEntryPoint {
     .PARAMETER PayloadRaw
         Raw PreToolUse payload text.
     .PARAMETER RepositoryRoot
-        Root used to locate the Codex state directory and the orchestrator checkpoint.
+        Session root: it locates the Codex state directory and is the fallback root. The
+        orchestrator checkpoint comes from the resolved target worktree of each path.
     .PARAMETER HookSeams
         Optional seam overrides splatted into Invoke-PythonBatchBudgetHook.
     #>

package/resources/codex-and-agents-customizations/.codex/hooks/file-size-policy.ps1

@@ -0,0 +1,421 @@
+<#
+.SYNOPSIS
+    Codex twin of the tiered file-size policy functions (500 guidance, 700 advisory, 800 hard limit).
+
+.DESCRIPTION
+    Dot-sourced by .codex/hooks/enforce-file-size-limit.ps1 as:
+    . (Join-Path $PSScriptRoot 'file-size-policy.ps1')
+
+    Codex hooks cannot import .claude/lib in a consumer repository, so the policy
+    functions of .claude/lib/file-size-policy/FileSizePolicy.psm1 are mirrored here.
+    Every function definition in this file is text-identical to the definition of the
+    same name in that module; tests/scripts/codex-hooks/file-size-policy.Tests.ps1
+    parses both files and fails on any difference, and runs the shared case rows
+    against this file. Edit the module first, then copy each changed definition here.
+
+.NOTES
+    Compatible with PowerShell 7+.
+
+    Entrypoint-free by design: this file contains only function definitions, so
+    dot-sourcing it has no side effects and no exit-code semantics. It never reads
+    standard input and never reads any legacy Claude environment variable. Every
+    function is pure: no filesystem, process, network, environment, or clock access.
+#>
+
+function Get-FileSizePolicyLimit {
+    <#
+    .SYNOPSIS
+        Return the three tier limits of the file-size policy.
+    .OUTPUTS
+        A PSCustomObject with Guidance (500), Advisory (700), and HardLimit (800).
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param()
+
+    return [pscustomobject]@{
+        Guidance  = 500
+        Advisory  = 700
+        HardLimit = 800
+    }
+}
+
+function Get-FileSizeExcludedSegment {
+    <#
+    .SYNOPSIS
+        Return the directory names excluded from the file-size policy.
+    .DESCRIPTION
+        A path with any of these names as a directory segment is not covered. This
+        function is the single source of the excluded names: Test-FileSizeCoveredPath
+        and the repository gate traversal both read it. Each call returns a new array.
+    .OUTPUTS
+        System.String[].
+    #>
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param()
+
+    return [string[]]@('.git', 'node_modules', 'artifacts', 'coverage', 'dist', 'out', 'virtual', 'docs',
+        'build', '.venv', 'venv', 'env', '__pycache__', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.tox',
+        '.nox', 'htmlcov', '.vscode-test')
+}
+
+function Get-FileSizeLogicalLineCount {
+    <#
+    .SYNOPSIS
+        Count the logical lines of a text.
+    .DESCRIPTION
+        Splits the content on CRLF or LF. A trailing line terminator does not add a
+        line, and empty or null content has zero lines.
+    .PARAMETER Content
+        The file content.
+    .OUTPUTS
+        System.Int32.
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Content
+    )
+
+    if ([string]::IsNullOrEmpty($Content)) {
+        return 0
+    }
+
+    $count = [regex]::Split($Content, '\r?\n').Count
+    if ($Content.EndsWith("`n")) {
+        # The split yields one empty trailing element after a final terminator.
+        $count--
+    }
+    return $count
+}
+
+function Get-FileSizeTier {
+    <#
+    .SYNOPSIS
+        Classify a logical line count into a policy tier.
+    .DESCRIPTION
+        Returns 'Below' (under 500), 'Guidance' (500 through 699), 'Advisory' (700
+        through 799), or 'HardLimit' (800 and above). The hard block applies only
+        above 800; a count of exactly 800 is in the HardLimit tier and still passes.
+    .PARAMETER LineCount
+        A non-negative logical line count.
+    .OUTPUTS
+        System.String.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [int] $LineCount
+    )
+
+    if ($LineCount -lt 0) {
+        throw "Get-FileSizeTier: LineCount must be non-negative; received $LineCount."
+    }
+
+    $limit = Get-FileSizePolicyLimit
+    if ($LineCount -ge $limit.HardLimit) { return 'HardLimit' }
+    if ($LineCount -ge $limit.Advisory) { return 'Advisory' }
+    if ($LineCount -ge $limit.Guidance) { return 'Guidance' }
+    return 'Below'
+}
+
+function ConvertTo-FileSizeRelativePath {
+    <#
+    .SYNOPSIS
+        Convert a file path to a repository-relative forward-slash path.
+    .DESCRIPTION
+        Backslashes are normalized to forward slashes. A relative path is returned
+        without a leading './'. An absolute path under the repository root is
+        returned relative to the root (compared case-insensitively, because the
+        root may come from a case-insensitive file system). A path outside the root,
+        a relative path that climbs above the root, and the root itself return
+        $null, which callers treat as not covered.
+    .PARAMETER Path
+        The file path from a tool payload or a discovery.
+    .PARAMETER RepositoryRoot
+        The repository root directory.
+    .OUTPUTS
+        System.String, or $null for a path outside the repository root.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Path,
+
+        [Parameter(Mandatory)]
+        [string] $RepositoryRoot
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Path)) {
+        return $null
+    }
+
+    $normalized = $Path.Replace('\', '/')
+    $isRooted = $normalized.StartsWith('/') -or ($normalized -match '^[A-Za-z]:/')
+    if (-not $isRooted) {
+        while ($normalized.StartsWith('./')) {
+            $normalized = $normalized.Substring(2)
+        }
+        if ($normalized -eq '..' -or $normalized.StartsWith('../') -or $normalized.Length -eq 0) {
+            return $null
+        }
+        return $normalized
+    }
+
+    $root = $RepositoryRoot.Replace('\', '/').TrimEnd('/')
+    $prefix = $root + '/'
+    if (-not $normalized.StartsWith($prefix, [System.StringComparison]::OrdinalIgnoreCase)) {
+        return $null
+    }
+
+    $relative = $normalized.Substring($prefix.Length)
+    if ($relative.Length -eq 0) {
+        return $null
+    }
+    return $relative
+}
+
+function Test-FileSizeCoveredPath {
+    <#
+    .SYNOPSIS
+        Report whether a repository-relative path is covered by the file-size policy.
+    .DESCRIPTION
+        A path is covered when its extension (case-insensitive) is in the allowlist
+        (py, ps1, psm1, ts, tsx, js, cjs, mjs, cs, sh, and bats), no directory segment
+        is an excluded name, and it is not under the worktrees folder of .claude.
+        Excluded directory names are matched exactly. Null or empty input is not covered.
+    .PARAMETER RelativePath
+        A repository-relative path, for example from ConvertTo-FileSizeRelativePath.
+    .OUTPUTS
+        System.Boolean.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $RelativePath
+    )
+
+    if ([string]::IsNullOrWhiteSpace($RelativePath)) {
+        return $false
+    }
+
+    $allowedExtension = @('.py', '.ps1', '.psm1', '.ts', '.tsx', '.js', '.cjs', '.mjs', '.cs', '.sh', '.bats')
+    $excludedSegment = @(Get-FileSizeExcludedSegment)
+
+    $normalized = $RelativePath.Replace('\', '/')
+    if ($normalized.StartsWith('.claude/worktrees/')) {
+        return $false
+    }
+
+    $segment = @($normalized.Split('/'))
+    for ($index = 0; $index -lt ($segment.Count - 1); $index++) {
+        if ($excludedSegment -ccontains $segment[$index]) {
+            return $false
+        }
+    }
+
+    $extension = [System.IO.Path]::GetExtension($segment[-1]).ToLowerInvariant()
+    return ($allowedExtension -contains $extension)
+}
+
+function Compare-FileSizeBaselineEntry {
+    <#
+    .SYNOPSIS
+        Compare one file's current size with its baseline entry under the strict ratchet.
+    .DESCRIPTION
+        Rows (S is the current size, B the recorded size):
+          S <= 800, no entry       -> pass
+          S <= 800, entry          -> 'stale-entry' (remove the entry)
+          S > 800, no entry        -> 'new-over-limit'
+          S > 800, entry, S > B    -> 'grew'
+          S > 800, entry, S == B   -> pass
+          S > 800, entry, S < B    -> 'tighten' (tighten the entry to S)
+          no file, entry           -> 'missing-file' (stale entry for a deleted or renamed file)
+          no file, no entry        -> pass
+    .PARAMETER Path
+        The repository-relative path, used in the violation message.
+    .PARAMETER CurrentSize
+        The current logical line count, or $null when no file exists on disk.
+    .PARAMETER BaselineSize
+        The recorded size, or $null when the baseline has no entry.
+    .OUTPUTS
+        $null on pass; otherwise a PSCustomObject with Path, Rule, and Message.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)]
+        [string] $Path,
+
+        [AllowNull()]
+        [Nullable[int]] $CurrentSize,
+
+        [AllowNull()]
+        [Nullable[int]] $BaselineSize
+    )
+
+    $hardLimit = (Get-FileSizePolicyLimit).HardLimit
+    $rule = $null
+    $message = $null
+
+    if ($null -eq $CurrentSize) {
+        if ($null -ne $BaselineSize) {
+            $rule = 'missing-file'
+            $message = "stale baseline entry: '$Path' has no file on disk (deleted or renamed); remove the entry or move it with its recorded size unchanged."
+        }
+    } elseif ($CurrentSize -le $hardLimit) {
+        if ($null -ne $BaselineSize) {
+            $rule = 'stale-entry'
+            $message = "stale baseline entry: '$Path' has $CurrentSize lines, at or below the $hardLimit-line hard limit; remove the entry."
+        }
+    } elseif ($null -eq $BaselineSize) {
+        $rule = 'new-over-limit'
+        $message = "new file over the hard limit: '$Path' has $CurrentSize lines, above the $hardLimit-line hard limit; split the file."
+    } elseif ($CurrentSize -gt $BaselineSize) {
+        $rule = 'grew'
+        $message = "baselined file grew: '$Path' has $CurrentSize lines, above its recorded $BaselineSize; a baselined file may not grow."
+    } elseif ($CurrentSize -lt $BaselineSize) {
+        $rule = 'tighten'
+        $message = "baselined file shrank: '$Path' has $CurrentSize lines, below its recorded $BaselineSize; tighten the entry to $CurrentSize."
+    }
+
+    if ($null -eq $rule) {
+        return $null
+    }
+    return [pscustomobject]@{ Path = $Path; Rule = $rule; Message = $message }
+}
+
+function Resolve-FileSizeEditContent {
+    <#
+    .SYNOPSIS
+        Apply an Edit-tool old_string to new_string replacement to pre-edit content in memory.
+    .DESCRIPTION
+        Follows the replacement approach of Resolve-EditedCheckpointContent in
+        .claude/hooks/enforce-completion-consistency.ps1: CRLF is normalized to LF in
+        all three strings, matching is ordinal (no regular expression, so '$' in the
+        new text stays literal), one occurrence is replaced unless ReplaceAll is true,
+        and a second match after the first is ambiguous. Failure is 'no-old-string'
+        (absent or empty old string), 'not-found', or 'ambiguous'.
+    .PARAMETER Content
+        The pre-edit file content.
+    .PARAMETER OldString
+        The text to replace.
+    .PARAMETER NewString
+        The replacement text; null is treated as empty.
+    .PARAMETER ReplaceAll
+        Replace every occurrence instead of exactly one.
+    .OUTPUTS
+        A PSCustomObject with Content (the edited text, or $null on failure) and
+        Failure (a failure code, or $null on success).
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Content,
+
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $OldString,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $NewString = '',
+
+        [bool] $ReplaceAll = $false
+    )
+
+    if ([string]::IsNullOrEmpty($OldString)) {
+        return [pscustomobject]@{ Content = $null; Failure = 'no-old-string' }
+    }
+
+    $text = ([string]$Content).Replace("`r`n", "`n")
+    $old = $OldString.Replace("`r`n", "`n")
+    $new = ([string]$NewString).Replace("`r`n", "`n")
+
+    $first = $text.IndexOf($old, [System.StringComparison]::Ordinal)
+    if ($first -lt 0) {
+        return [pscustomobject]@{ Content = $null; Failure = 'not-found' }
+    }
+    if ($ReplaceAll) {
+        return [pscustomobject]@{ Content = $text.Replace($old, $new); Failure = $null }
+    }
+
+    $second = $text.IndexOf($old, $first + $old.Length, [System.StringComparison]::Ordinal)
+    if ($second -ge 0) {
+        return [pscustomobject]@{ Content = $null; Failure = 'ambiguous' }
+    }
+
+    $edited = $text.Substring(0, $first) + $new + $text.Substring($first + $old.Length)
+    return [pscustomobject]@{ Content = $edited; Failure = $null }
+}
+
+function Get-FileSizeHookDecision {
+    <#
+    .SYNOPSIS
+        Decide whether a Write or Edit may leave a file at its resulting size.
+    .DESCRIPTION
+        Baseline-free pre-edit-size ratchet. A path that is not covered is allowed.
+        A covered result of at most 800 lines is allowed. A covered result above 800
+        lines is allowed only when the file already existed and the result is not
+        larger than its pre-edit size, so an already-large file may shrink or stay
+        the same size but may not grow; every other case is denied. The deny reason
+        starts with 'FILE_SIZE_LIMIT_BLOCKED:' and names the path, the resulting
+        count, the three tiers, and the split requirement.
+    .PARAMETER RelativePath
+        The repository-relative path; $null or empty (outside the repository) is not covered.
+    .PARAMETER ResultLineCount
+        The logical line count the file would have after the operation.
+    .PARAMETER PreEditLineCount
+        The logical line count before the operation, or $null for a new file.
+    .OUTPUTS
+        A PSCustomObject with Allowed (bool) and Reason ($null when allowed).
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $RelativePath,
+
+        [Parameter(Mandatory)]
+        [int] $ResultLineCount,
+
+        [AllowNull()]
+        [Nullable[int]] $PreEditLineCount
+    )
+
+    $limit = Get-FileSizePolicyLimit
+    $isAllowed = (-not (Test-FileSizeCoveredPath -RelativePath $RelativePath)) -or
+    ($ResultLineCount -le $limit.HardLimit) -or
+    (($null -ne $PreEditLineCount) -and ($ResultLineCount -le $PreEditLineCount))
+    if ($isAllowed) {
+        return [pscustomobject]@{ Allowed = $true; Reason = $null }
+    }
+
+    $growth = ''
+    if ($null -ne $PreEditLineCount) {
+        $growth = " It has $PreEditLineCount lines now; a file already above the hard limit may shrink or stay the same size but may not grow."
+    }
+    $reason = "FILE_SIZE_LIMIT_BLOCKED: '$RelativePath' would have $ResultLineCount logical lines, above the " +
+    "$($limit.HardLimit)-line hard limit.$growth File-size policy tiers: $($limit.Guidance) lines is guidance " +
+    "(look for a logical split), $($limit.Advisory) lines is advisory (split more aggressively; reviewers report " +
+    "a non-blocking Warning), and above $($limit.HardLimit) lines a split is enforced regardless of logical " +
+    "separability. Split the file into smaller files so each stays at or below $($limit.HardLimit) lines."
+    return [pscustomobject]@{ Allowed = $false; Reason = $reason }
+}