@danmoisan/drm-copilot-mcp 1.1.22 → 1.1.24

package/resources/claude-customizations/.claude/hooks/enforce-parallel-worktree-removal-gate.ps1

@@ -46,6 +46,8 @@ try { Import-Module (Join-Path $PSScriptRoot '../lib/cleanup-manifest/CleanupWor
 try { . (Join-Path $PSScriptRoot 'hook-command-scanner.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-scanner.ps1' -ErrorRecord $_ }
 try { . (Join-Path $PSScriptRoot 'hook-command-invocation.ps1') } catch { Add-HookDependencyFailure -Name 'hook-command-invocation.ps1' -ErrorRecord $_ }
 
+# Shared recorded-path matcher and main-checkout-root seam (issue #995).
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunRecordPath.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunRecordPath.psm1' -ErrorRecord $_ }
 try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeRunResolution.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'WorktreeRunResolution.psm1' -ErrorRecord $_ }
 
 $script:AllowedMergeStatuses = @('merged', 'worktree_removed')
@@ -170,7 +172,10 @@ function Find-ParallelWorktreeItemRecord {
         Name of the record array to scan. Defaults to 'items', the parallel
         checkpoint's array, so every existing caller is unchanged; the epic branch
         added for issue #688 passes 'features'. Parameterized rather than duplicated
-        so both topologies share one path-normalization implementation.
+        so both topologies share one path-comparison implementation.
+    .PARAMETER BaseRoot
+        Optional. The roots a relative recorded worktree_path is joined to (issue #995).
+        With none, a relative record matches nothing.
     .OUTPUTS
         System.Object or $null
     #>
@@ -183,7 +188,11 @@ function Find-ParallelWorktreeItemRecord {
         [string] $WorktreePath,
 
         [ValidateNotNullOrEmpty()]
-        [string] $RecordArrayName = 'items'
+        [string] $RecordArrayName = 'items',
+
+        [AllowNull()]
+        [AllowEmptyCollection()]
+        [string[]] $BaseRoot = @()
     )
 
     if ($null -eq $Checkpoint -or [string]::IsNullOrWhiteSpace($WorktreePath)) {
@@ -194,17 +203,14 @@ function Find-ParallelWorktreeItemRecord {
         return $null
     }
 
-    $normalizedTarget = ($WorktreePath -replace '\\', '/').TrimEnd('/')
-
-    # Scan every recorded item for a worktree_path that matches the removal target;
-    # path separators are normalized so Windows- and POSIX-style paths compare equal.
+    # Scan every recorded item for a worktree_path that names the removal target through
+    # the shared matcher (separator style, trailing slash, case rule, relative join).
     foreach ($item in @($Checkpoint.$RecordArrayName)) {
         $itemProps = @($item.PSObject.Properties.Name)
         if ($itemProps -notcontains 'worktree_path') {
             continue
         }
-        $normalizedItemPath = (([string]$item.worktree_path) -replace '\\', '/').TrimEnd('/')
-        if ($normalizedItemPath -eq $normalizedTarget) {
+        if (Test-WorktreeRunRecordedPathMatchesTarget -RecordedPath ([string]$item.worktree_path) -TargetPath $WorktreePath -BaseRoot $BaseRoot) {
             return $item
         }
     }
@@ -353,8 +359,13 @@ function Get-ParallelWorktreeRemovalTargetDenial {
         }
     }
     $checkpoint = $parallelRead.Checkpoint
+    # A relative record is joined to the main checkout root and to the root holding the
+    # checkpoint read (issue #995); the main root is derived once per target.
+    $mainRoot = Get-WorktreeRunMainCheckoutRoot -SessionRoot (Get-Location).Path
+    $parallelBaseRoot = Get-WorktreeRunRecordBaseRoot -MainRoot $mainRoot -Read $parallelRead
+    $epicBaseRoot = Get-WorktreeRunRecordBaseRoot -MainRoot $mainRoot -Read $epicRead
 
-    $itemRecord = Find-ParallelWorktreeItemRecord -Checkpoint $checkpoint -WorktreePath $worktreePath
+    $itemRecord = Find-ParallelWorktreeItemRecord -Checkpoint $checkpoint -WorktreePath $worktreePath -BaseRoot $parallelBaseRoot
     if (Test-ParallelWorktreeRemovalAllowed -ItemRecord $itemRecord) {
         return $null
     }
@@ -371,7 +382,7 @@ function Get-ParallelWorktreeRemovalTargetDenial {
     # $null, which yields no record, which is not allowed.
     $epicCheckpoint = $epicRead.Checkpoint
 
-    $featureRecord = Find-ParallelWorktreeItemRecord -Checkpoint $epicCheckpoint -WorktreePath $worktreePath -RecordArrayName 'features'
+    $featureRecord = Find-ParallelWorktreeItemRecord -Checkpoint $epicCheckpoint -WorktreePath $worktreePath -RecordArrayName 'features' -BaseRoot $epicBaseRoot
     if (Test-ParallelWorktreeRemovalAllowed -ItemRecord $featureRecord) {
         return $null
     }
@@ -386,7 +397,7 @@ function Get-ParallelWorktreeRemovalTargetDenial {
     # reaches the unchanged deny below. This gate defines only the parallel checkpoint
     # seam and has no epic-checkpoint seam, so its exclusion covers the items array
     # only; the epic gate covers the features array with its own exclusion.
-    if (-not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $checkpoint -RecordArrayName 'items' -WorktreePath $worktreePath) -and
+    if (-not (Test-CleanupManifestCheckpointCoversPath -Checkpoint $checkpoint -RecordArrayName 'items' -WorktreePath $worktreePath -BaseRoot $parallelBaseRoot) -and
         (Test-CleanupWorktreeManifestAuthorizesRemoval -WorktreePath $worktreePath)) {
         return $null
     }

package/resources/claude-customizations/.claude/hooks/enforce-powershell-batch-budget.ps1

@@ -7,14 +7,28 @@
     operation. When the target file is a PowerShell source file (.ps1, .psm1, .psd1),
     it decides whether the change may proceed in direct mode.
 
-    Direct mode counts distinct production PowerShell paths per Claude Code session.
-    The running set is persisted under .claude/state/powershell-batch-budget.<session_id>.json,
-    and repeated edits to the same file are counted once. The 4th distinct production
-    path is denied with a POWERSHELL_LARGE_PATH_REQUIRED reason that instructs the
-    caller to route the change through /orchestrate.
-
-    The orchestrated large path is detected from
-    <root>/artifacts/orchestration/orchestrator-state.json. The selected route is the
+    Direct mode counts distinct production PowerShell paths per Claude Code session and
+    per resolved target worktree, and repeated edits to the same file are counted once.
+    The 4th distinct production path in one worktree is denied with a
+    POWERSHELL_LARGE_PATH_REQUIRED reason that instructs the caller to route the change
+    through /orchestrate.
+
+    The edited file is placed with Resolve-HookTargetWorktree from
+    .claude/lib/worktree-resolution/HookTargetWorktree.psm1. An absolute path resolves to
+    its nearest enclosing registered git worktree; a relative path, a path inside no
+    registered worktree, and an ambiguous result use the session root (the checkout that
+    holds this hook). The route is read from
+    artifacts/orchestration/orchestrator-state.json in the resolved target worktree.
+    The running set is kept under the session root, in
+    .claude/state/powershell-batch-budget.<session_id>.json when the resolved target worktree
+    is the session root and in
+    .claude/state/powershell-batch-budget.<session_id>.<worktree key>.json otherwise,
+    where the key comes from Get-HookTargetWorktreeKey; no state is written under another
+    worktree. A path under the root-level artifacts/ directory of the resolved target worktree
+    is gitignored scratch: it is allowed, consumes no slot, and writes no state. A
+    nested directory named artifacts elsewhere in the tree still counts.
+
+    The selected route is the
     route_id value when that key is present, otherwise the path_selected value, and it
     is usable only as a non-blank string. When the selected route is large,
     remediation, or preparation and the checkpoint is not terminal (next_step is not
@@ -38,9 +52,9 @@
     is composed into a file name, so a hostile id cannot escape the state
     directory. Resolving the id never creates the state directory.
 
-    Candidate paths are contained to the resolved root. A candidate that resolves
-    outside it is discarded: the decision is 'allow', no slot is consumed, and no
-    state is written. Persisted entries that fail the same containment test are
+    Candidate paths are contained to the resolved target worktree root. A candidate
+    that resolves outside it is discarded: the decision is 'allow', no slot is consumed,
+    and no state is written. Persisted entries that fail the same containment test are
     dropped when state is rehydrated, so a state file carried between worktrees
     cannot spend this worktree's budget.
 
@@ -48,9 +62,12 @@
     hookSpecificOutput.permissionDecision = 'deny' and exits 0. Files already counted
     are always allowed through.
 
-    Known limitation: a stale non-terminal large-path checkpoint left at the root
-    exempts a later direct-mode session at that root. Orchestrator checkpoint hygiene
-    (issue #673) moves foreign checkpoints aside before a new run.
+    Known limitations: an 8.3 short-name path, or a path reached through a junction,
+    that differs textually from the long path git reports matches no registered
+    worktree and falls back to the session root. A stale non-terminal large-path
+    checkpoint in a worktree exempts a later direct-mode session editing that worktree;
+    orchestrator checkpoint hygiene (issue #673) moves foreign checkpoints aside before
+    a new run.
 
 .NOTES
     Compatible with PowerShell 7+.
@@ -61,6 +78,7 @@ $script:HookDependencyGuardLoadFailed = $false; try { . (Join-Path $PSScriptRoot
 
 
 try { Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookPayload.psm1' -ErrorRecord $_ }
+try { Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/HookTargetWorktree.psm1') -Force -ErrorAction Stop } catch { Add-HookDependencyFailure -Name 'HookTargetWorktree.psm1' -ErrorRecord $_ }
 $script:PowerShellBatchBudgetRouteImportFailure = $null; try { . (Join-Path $PSScriptRoot 'enforce-batch-budget-route.ps1') } catch { $script:PowerShellBatchBudgetRouteImportFailure = 'enforce-batch-budget-route.ps1' }
 
 function Test-PowerShellBatchBudgetPathInRoot {
@@ -351,7 +369,8 @@ function Invoke-PowerShellBatchBudgetHook {
         [scriptblock] $WriteState = {
             param([string] $Path, [System.Collections.IDictionary] $State)
             $State | ConvertTo-Json -Depth 5 | Set-Content -Path $Path -Encoding UTF8
-        }
+        },
+        [scriptblock] $WorktreeListInvoker
     )
 
     $payload = Resolve-ClaudeHookToolInput -Raw $ToolInputRaw
@@ -373,6 +392,25 @@ function Invoke-PowerShellBatchBudgetHook {
     }
     if ($script:PowerShellBatchBudgetRouteImportFailure) { return Get-PowerShellBatchBudgetBlockDecision -Reason "POWERSHELL_LARGE_PATH_REQUIRED: the route helper '$($script:PowerShellBatchBudgetRouteImportFailure)' failed to load, so the batch budget for '$normalized' cannot be evaluated; the gate fails closed." }
 
+    # The file is evaluated against the registered worktree that holds it. The session root
+    # stays the fallback for a relative path, a path in no registered worktree, and an
+    # ambiguous result, which keeps today's checkpoint, containment, and state-file name.
+    $resolverArguments = @{ SessionRoot = $Root; FilePath = @($filePath) }
+    if ($PSBoundParameters.ContainsKey('WorktreeListInvoker')) { $resolverArguments['WorktreeListInvoker'] = $WorktreeListInvoker }
+    $resolution = Resolve-HookTargetWorktree @resolverArguments
+    $targetRoot = $Root
+    $isSessionRoot = $true
+    if (-not $resolution.Ambiguous -and $null -ne $resolution.WorktreeRoot -and -not [string]::Equals($resolution.WorktreeRoot, (ConvertTo-HookTargetWorktreeNormalizedPath -Path $Root), [System.StringComparison]::OrdinalIgnoreCase)) {
+        $targetRoot = $resolution.WorktreeRoot
+        $isSessionRoot = $false
+    }
+
+    # The root-level artifacts/ directory is gitignored scratch, never a production file.
+    $relativePath = if ($normalized -match '^(/|[A-Za-z]:/)') { Get-HookTargetWorktreeRelativePath -Path $normalized -WorktreeRoot $targetRoot } else { $normalized }
+    if ($null -ne $relativePath -and $relativePath.StartsWith('artifacts/', [System.StringComparison]::OrdinalIgnoreCase)) {
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' } }
+    }
+
     $stateDir = Join-Path -Path $Root -ChildPath '.claude/state'
 
     # Resolved before the directory is ensured, because reading the session-id
@@ -383,11 +421,12 @@ function Invoke-PowerShellBatchBudgetHook {
         -SessionIdFilePath (Join-Path -Path $stateDir -ChildPath 'current-session-id') `
         -ReadSessionIdFile $ReadSessionIdFile
 
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$resolvedSessionId.json")
+    $stateLeaf = if ($isSessionRoot) { "powershell-batch-budget.$resolvedSessionId.json" } else { "powershell-batch-budget.$resolvedSessionId.$(Get-HookTargetWorktreeKey -WorktreeRoot $targetRoot).json" }
+    $stateFile = Join-Path -Path $stateDir -ChildPath $stateLeaf
 
     # The checkpoint is read before any state operation, so the large path neither
     # creates the state directory nor reads or writes the state file.
-    $checkpointPath = Join-Path -Path $Root -ChildPath 'artifacts/orchestration/orchestrator-state.json'
+    $checkpointPath = Join-Path -Path $targetRoot -ChildPath 'artifacts/orchestration/orchestrator-state.json'
     $checkpointText = ''
     try {
         $checkpointText = [string](& $ReadCheckpoint $checkpointPath)
@@ -399,7 +438,7 @@ function Invoke-PowerShellBatchBudgetHook {
     $isLargePath = Test-BatchBudgetLargePathRoute -CheckpointText $checkpointText
     $observedRoute = Get-BatchBudgetSelectedRoute -CheckpointText $checkpointText
     if ($isLargePath) {
-        return Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State (Get-PowerShellBatchBudgetState -ProdCap $ProdCap) -StateFile $stateFile -Root $Root -LargePathRoute
+        return Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State (Get-PowerShellBatchBudgetState -ProdCap $ProdCap) -StateFile $stateFile -Root $targetRoot -LargePathRoute
     }
 
     if (-not (& $TestPathExists $stateDir)) {
@@ -411,13 +450,13 @@ function Invoke-PowerShellBatchBudgetHook {
     if (& $TestPathExists $stateFile) {
         try {
             $loaded = & $ReadState $stateFile | ConvertFrom-Json -ErrorAction Stop
-            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -Root $Root
+            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -Root $targetRoot
         } catch {
             Write-Verbose "Ignoring unreadable PowerShell batch-budget state file '$stateFile': $($_.Exception.Message)"
         }
     }
 
-    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $Root -ObservedRoute $observedRoute
+    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $targetRoot -ObservedRoute $observedRoute
     if ($decision.shouldWriteState) {
         try {
             & $WriteState $stateFile $decision.state

package/resources/claude-customizations/.claude/hooks/enforce-pr-author-command-allowlist.ps1

@@ -10,8 +10,12 @@
     in one of these forms, matched by token position:
 
       - git log ...            and git rev-parse ...        (no git global option)
+      - git worktree list --porcelain                       (exactly these four tokens, issue #1011)
       - gh pr create ...       and gh pr edit ...           (no gh global option)
+      - gh pr view <N> --json closingIssuesReferences,body  (exactly these six tokens, issue #989)
       - sha256sum artifacts/pr_body_<N>.md                  (only as the whole command)
+      - sha256sum <item worktree>/artifacts/pr_body_<N>.md  (only as the whole command; an absolute
+                                                             forward-slash path, issue #1011)
       - date -u [+<format>]                                 (only as the whole command)
 
     Segments may be joined only by ';', '&&', '||', '|', or a newline. A record that is
@@ -41,7 +45,38 @@ $script:PrAuthorAllowlistWrapperWords = @(
     'sh', 'bash', 'zsh', 'dash', 'ksh', 'pwsh', 'powershell', 'eval', 'xargs',
     'env', 'timeout', 'time', 'command', 'nohup'
 )
-$script:PrAuthorAllowlistFormText = 'git log, git rev-parse, gh pr create, gh pr edit, sha256sum artifacts/pr_body_<N>.md, date -u [+<format>]'
+$script:PrAuthorAllowlistFormText = 'git log, git rev-parse, git worktree list --porcelain, gh pr create, gh pr edit, gh pr view <N> --json closingIssuesReferences,body, sha256sum artifacts/pr_body_<N>.md, sha256sum <item worktree>/artifacts/pr_body_<N>.md, date -u [+<format>]'
+
+function Test-PrAuthorAbsoluteBodyPathToken {
+    <#
+    .SYNOPSIS
+        Report whether a token is an absolute canonical body path beneath an item worktree (issue #1011).
+    .DESCRIPTION
+        The token must be rooted at '/' or at a drive letter followed by ':/', use forward slashes
+        only, hold at least one segment before 'artifacts', hold no empty, '.', or '..' segment,
+        and end in '/artifacts/pr_body_<digits>.md' with the exact case of the relative form.
+        Pure string logic: no process, file read, or module import.
+    .PARAMETER Value
+        The sha256sum argument token, quotes already stripped.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)][AllowEmptyString()][string] $Value
+    )
+
+    if ($Value.Contains('\') -or $Value -cnotmatch '^(/|[A-Za-z]:/)(?<rest>.+)/artifacts/pr_body_\d+\.md$') {
+        return $false
+    }
+    foreach ($segment in $Matches['rest'].Split('/')) {
+        if ($segment -eq '' -or $segment -eq '.' -or $segment -eq '..') {
+            return $false
+        }
+    }
+    return $true
+}
 
 function Test-PrAuthorAllowlistForm {
     <#
@@ -66,13 +101,25 @@ function Test-PrAuthorAllowlistForm {
     }
     switch -CaseSensitive ($Token[0]) {
         'git' {
-            return ($Token.Count -ge 2 -and @('log', 'rev-parse') -ccontains $Token[1])
+            if ($Token.Count -ge 2 -and @('log', 'rev-parse') -ccontains $Token[1]) {
+                return $true
+            }
+            # The read-only worktree discovery form, matched exactly (issue #1011).
+            return ($Token.Count -eq 4 -and $Token[1] -ceq 'worktree' -and $Token[2] -ceq 'list' -and $Token[3] -ceq '--porcelain')
         }
         'gh' {
-            return ($Token.Count -ge 3 -and $Token[1] -ceq 'pr' -and @('create', 'edit') -ccontains $Token[2])
+            if ($Token.Count -ge 3 -and $Token[1] -ceq 'pr' -and @('create', 'edit') -ccontains $Token[2]) {
+                return $true
+            }
+            # The read-only closing-reference verification form, matched exactly (issue #989).
+            return ($Token.Count -eq 6 -and $Token[1] -ceq 'pr' -and $Token[2] -ceq 'view' -and $Token[3] -cmatch '^\d+$' -and
+                $Token[4] -ceq '--json' -and $Token[5] -ceq 'closingIssuesReferences,body')
         }
         'sha256sum' {
-            return ($IsWholeCommand -and $Token.Count -eq 2 -and $Token[1] -cmatch '^artifacts/pr_body_\d+\.md$')
+            if (-not $IsWholeCommand -or $Token.Count -ne 2) {
+                return $false
+            }
+            return ($Token[1] -cmatch '^artifacts/pr_body_\d+\.md$' -or (Test-PrAuthorAbsoluteBodyPathToken -Value $Token[1]))
         }
         'date' {
             if (-not $IsWholeCommand -or $Token.Count -lt 2 -or $Token[1] -cne '-u') {

package/resources/claude-customizations/.claude/hooks/enforce-pr-author-skill-helpers.ps1

@@ -27,9 +27,10 @@
 
 .NOTES
     Compatible with PowerShell 7+. Dependencies are in-repository only: the command parsers
-    and worktree-resolution modules loaded below, and the artifact-root and docs-only siblings.
-    No PowerShell Gallery module is required.
-    The docs-only sibling runs the git executable at call time (issue #901).
+    and worktree-resolution modules loaded below, and the artifact-root, docs-only, and
+    current-branch siblings. No PowerShell Gallery module is required.
+    The docs-only sibling runs the git executable at call time (issue #901), and so does the
+    current-branch sibling when a call carries no target signal (issue #989).
 #>
 [CmdletBinding()]
 param()
@@ -49,6 +50,8 @@ Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeTarge
 # feature folder exists in every checkout branched from main, so it places a call in many at
 # once. The item is identified by its canonical issue number and its branch instead.
 Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/WorktreeItemResolution.psm1') -Force -ErrorAction Stop
+# Shared target-worktree resolver (issues #1009, #1011): resolves the branch a --head names.
+Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/HookTargetWorktree.psm1') -Force -ErrorAction Stop
 # Epic scope (issue #663): the epic integration pull request is gated against the epic checkpoint.
 Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeResolution.psm1') -Force -ErrorAction Stop
 Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeReadiness.psm1') -Force -ErrorAction Stop
@@ -56,6 +59,8 @@ Import-Module (Join-Path $PSScriptRoot '../lib/worktree-resolution/EpicScopeRead
 . (Join-Path $PSScriptRoot 'enforce-pr-author-skill.artifact-root.ps1')
 # Docs-only exemption from the orchestrator-state preflight (issue #901).
 . (Join-Path $PSScriptRoot 'enforce-pr-author-skill.docs-only.ps1')
+# Current-branch target derivation and the no-target guidance text (issue #989).
+. (Join-Path $PSScriptRoot 'enforce-pr-author-skill.current-branch.ps1')
 
 function Resolve-PrAuthorWorktreeTarget {
     <#
@@ -67,9 +72,15 @@ function Resolve-PrAuthorWorktreeTarget {
         directly would depend on the machine's live worktrees and would pass or fail
         according to what other sessions happen to have checked out, which the repository's
         determinism policy forbids. Mocking here lets a test state the resolution outcome it
-        is exercising and nothing else.
+        is exercising and nothing else. A branch the command names (--head, --branch, or
+        branch:) is resolved by the shared resolver Resolve-HookTargetWorktree, given only the
+        session root and that branch (issue #1011), unless the command also carries a canonical
+        issue number line, which Resolve-WorktreeItemTarget decides so the branch/issue agreement
+        check applies. Without a selection, Resolve-WorktreeItemTarget runs, and a NoTarget result
+        for a command with no signal passes through Resolve-PrAuthorCurrentBranchTarget, which
+        re-resolves the current branch (#989).
     .OUTPUTS
-        The target result object from Resolve-WorktreeItemTarget.
+        A target result object built by New-WorktreeResolutionTargetResult.
     #>
     [CmdletBinding()]
     param(
@@ -77,7 +88,57 @@ function Resolve-PrAuthorWorktreeTarget {
         [string] $CommandText
     )
 
-    return (Resolve-WorktreeItemTarget -Text $CommandText -SessionRoot (Get-Location).Path)
+    $sessionRoot = (Get-Location).Path
+    $branch = Find-WorktreeResolutionBranchSignal -Text $CommandText
+    $issueSignal = Find-WorktreeItemIssueSignal -Text $CommandText
+    if ($null -ne $branch -and @($issueSignal).Count -eq 0) {
+        $shared = Resolve-HookTargetWorktree -SessionRoot $sessionRoot -CommandBranch $branch
+        $mapped = ConvertFrom-PrAuthorHookTargetResult -Result $shared -CommandText $CommandText -SessionRoot $sessionRoot
+        if ($null -ne $mapped) { return $mapped }
+    }
+    $target = Resolve-WorktreeItemTarget -Text $CommandText -SessionRoot $sessionRoot
+    return (Resolve-PrAuthorCurrentBranchTarget -CommandText $CommandText -Target $target)
+}
+
+function ConvertFrom-PrAuthorHookTargetResult {
+    <#
+    .SYNOPSIS
+        Map a Resolve-HookTargetWorktree result onto a pr-author target result, or $null (issue #1011).
+    .DESCRIPTION
+        Returns $null (no selection) when Result is null, when CommandText carries no branch
+        signal, when Result.Source is not CommandOperand, when Result names no root, or when that
+        root fails Test-WorktreeResolutionRootMarker (a registration whose directory is gone).
+        Only a CommandOperand result selects, being branch-derived; a FilePath, SessionRoot, or
+        DelegationIdentity result never selects the worktree (issue #673). An ambiguous result
+        maps to Ambiguous. Labelling is delegated to ConvertTo-WorktreeItemResolvedResult, which
+        maps a root equal to SessionRoot, or to the worktree enclosing it, to SessionRoot and any
+        other root to OtherWorktree.
+    .PARAMETER Result
+        The Resolve-HookTargetWorktree result.
+    .PARAMETER CommandText
+        The Bash command text under evaluation.
+    .PARAMETER SessionRoot
+        The session root the result is compared with.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [AllowNull()][object] $Result,
+        [Parameter(Mandatory)][AllowEmptyString()][string] $CommandText,
+        [Parameter(Mandatory)][string] $SessionRoot
+    )
+
+    $branch = Find-WorktreeResolutionBranchSignal -Text $CommandText
+    if ($null -eq $Result -or $null -eq $branch -or $Result.Source -cne 'CommandOperand') { return $null }
+    $detail = if ([string]::IsNullOrWhiteSpace([string]$Result.Detail)) { "branch '$branch' resolved by the shared resolver" } else { [string]$Result.Detail }
+    if ($Result.Ambiguous) {
+        return (New-WorktreeResolutionTargetResult -Status Ambiguous -SessionRoot $SessionRoot -Signal Branch -SignalValue $branch -Candidate @($Result.Candidates) -Detail $detail)
+    }
+    if ([string]::IsNullOrEmpty([string]$Result.WorktreeRoot)) { return $null }
+    if (-not (Test-WorktreeResolutionRootMarker -Path $Result.WorktreeRoot)) { return $null }
+    return (ConvertTo-WorktreeItemResolvedResult -WorktreeRoot $Result.WorktreeRoot -SessionRoot $SessionRoot -Branch $branch -Detail $detail)
 }
 
 function Get-PrAuthorTargetCheckpointResolution {
@@ -91,10 +152,10 @@ function Get-PrAuthorTargetCheckpointResolution {
           SessionRoot   -> that worktree's own checkpoint, composed absolutely.
           OtherWorktree -> that worktree's own checkpoint, composed the same way.
           NoTarget      -> deny, carrying the code Get-WorktreeResolutionNoTargetReasonCode
-                           returns. pr-author passes --head on every gh pr create, so a call
-                           reaching here omitted the explicit target; the remedy is to supply
-                           it, never to fall back to whichever checkpoint occupies the
-                           session root.
+                           returns. The call named no target and no branch could be derived
+                           from the current checkout; the remedy text from
+                           Get-PrAuthorTargetGuidanceText names the accepted forms, and the
+                           gate never falls back to the session root's checkpoint.
           Ambiguous     -> deny, carrying the code
                            Get-WorktreeResolutionAmbiguityReasonCode returns.
 
@@ -125,7 +186,7 @@ function Get-PrAuthorTargetCheckpointResolution {
             return [ordered]@{ CheckpointPath = (Get-WorktreeItemCheckpointPath -WorktreeRoot $target.WorktreeRoot); Reason = $null; WorktreeRoot = $target.WorktreeRoot; Status = $target.Status }
         }
         default {
-            $reason = "$($target.ReasonCode): $($target.Detail) The pr-author gate will not validate this call against the session root's checkpoint, because that checkpoint may belong to a different item. Pass --head <branch> on the gh pr create command so the call names its own target."
+            $reason = "$($target.ReasonCode): $($target.Detail) The pr-author gate will not validate this call against the session root's checkpoint, because that checkpoint may belong to a different item. $(Get-PrAuthorTargetGuidanceText)"
             return [ordered]@{ CheckpointPath = $null; Reason = $reason; WorktreeRoot = $null; Status = $target.Status }
         }
     }

package/resources/claude-customizations/.claude/hooks/enforce-pr-author-skill.current-branch.ps1

@@ -0,0 +1,149 @@
+<#
+.SYNOPSIS
+    Current-branch target derivation for enforce-pr-author-skill.ps1 (issue #989).
+
+.DESCRIPTION
+    Dot-sourced by enforce-pr-author-skill-helpers.ps1. Resolve-PrAuthorWorktreeTarget passes its
+    command-text resolution through Resolve-PrAuthorCurrentBranchTarget, which applies one
+    fallback: when the command carries no branch signal (--head, --branch, or branch:) and no
+    canonical issue line, and resolution returned NoTarget, the branch checked out in the hook
+    process's working directory is read and re-resolved through the existing resolver as a
+    'branch: <name>' signal. gh pr edit has no --head flag, so this is how an edit run from the
+    item worktree names its own target.
+
+    Derivation order: explicit signal in the command, else the current branch, else the
+    original NoTarget result. A signal that matches no live worktree does not trigger the
+    fallback. A detached HEAD (git prints the literal HEAD), a non-zero git exit, or empty
+    output keeps the original NoTarget result and its reason code.
+
+    Get-PrAuthorTargetGuidanceText supplies the remedy sentence that follows the reason code and
+    detail in the TARGET_WORKTREE_NOT_DERIVABLE denial.
+
+.NOTES
+    PowerShell 7+. Depends, at call time, on Find-WorktreeResolutionBranchSignal,
+    Find-WorktreeItemIssueSignal, and Resolve-WorktreeItemTarget from the worktree-resolution
+    modules the helpers file imports. It reads no file content. The git executable runs only
+    through Invoke-PrAuthorCurrentBranchGitExe, the single executable seam, which never throws.
+    Mirrored byte-identically under extensions/drm-copilot/resources/claude-customizations/.
+#>
+[CmdletBinding()]
+param()
+
+function Invoke-PrAuthorCurrentBranchGitExe {
+    <#
+    .SYNOPSIS
+        Run git with the given arguments in the current directory. The single executable seam.
+    .DESCRIPTION
+        Never throws: an uncaught error ends the hook with exit 1, which PreToolUse treats as
+        non-blocking, so a throw here would allow the call. A git that cannot start returns
+        ExitCode -1. Standard error is discarded so that it is never read as a branch name.
+    .PARAMETER GitArgs
+        The git arguments.
+    .PARAMETER GitInvoker
+        The scriptblock that runs git; a unit test passes a test-local stand-in so that this
+        body runs without starting a process.
+    .OUTPUTS
+        System.Management.Automation.PSCustomObject with ExitCode and Output (trimmed).
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)][string[]] $GitArgs,
+        [ValidateNotNull()][scriptblock] $GitInvoker = { git @args 2>$null }
+    )
+
+    try {
+        $lines = @(& $GitInvoker @GitArgs 2>$null)
+        $code = $LASTEXITCODE
+    }
+    catch {
+        return [pscustomobject]@{ ExitCode = -1; Output = '' }
+    }
+    return [pscustomobject]@{ ExitCode = [int]$code; Output = ($lines -join "`n").Trim() }
+}
+
+function Get-PrAuthorCurrentBranch {
+    <#
+    .SYNOPSIS
+        Return the branch checked out in the current directory, or $null.
+    .DESCRIPTION
+        Runs git rev-parse --abbrev-ref HEAD through Invoke-PrAuthorCurrentBranchGitExe. Returns
+        $null for a non-zero exit, for empty output, for output containing whitespace, and for
+        the literal HEAD that git prints on a detached checkout.
+    .PARAMETER GitInvoker
+        Optional. Forwarded to the git seam; omitted, the seam's default invoker runs git.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [scriptblock] $GitInvoker
+    )
+
+    $seamArgs = @{ GitArgs = @('rev-parse', '--abbrev-ref', 'HEAD') }
+    if ($null -ne $GitInvoker) { $seamArgs['GitInvoker'] = $GitInvoker }
+    $result = Invoke-PrAuthorCurrentBranchGitExe @seamArgs
+    $name = [string]$result.Output
+    if ($result.ExitCode -ne 0 -or [string]::IsNullOrWhiteSpace($name) -or $name -match '\s' -or $name -ceq 'HEAD') {
+        return $null
+    }
+    return $name
+}
+
+function Resolve-PrAuthorCurrentBranchTarget {
+    <#
+    .SYNOPSIS
+        Apply the current-branch fallback to a command-text resolution result.
+    .DESCRIPTION
+        Returns Target unchanged unless its Status is NoTarget and the command text carries
+        neither a branch signal nor a canonical issue line. In that case the current branch is
+        read; a $null branch returns Target unchanged, and any other branch is re-resolved with
+        Resolve-WorktreeItemTarget as the text 'branch: <name>', so ambiguity handling and the
+        SessionRoot or OtherWorktree labelling stay with the existing resolver.
+    .PARAMETER CommandText
+        The Bash command text under evaluation.
+    .PARAMETER Target
+        The result Resolve-WorktreeItemTarget returned for the command text.
+    .OUTPUTS
+        The target result object from Resolve-WorktreeItemTarget.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory)][AllowEmptyString()][string] $CommandText,
+        [Parameter(Mandatory)][AllowNull()][object] $Target
+    )
+
+    if ($null -eq $Target -or $Target.Status -ne 'NoTarget') {
+        return $Target
+    }
+    # Find-WorktreeItemIssueSignal emits its array as one object, so it is assigned before counting.
+    $issueSignal = Find-WorktreeItemIssueSignal -Text $CommandText
+    if ($null -ne (Find-WorktreeResolutionBranchSignal -Text $CommandText) -or $issueSignal.Count -gt 0) {
+        return $Target
+    }
+    $branch = Get-PrAuthorCurrentBranch
+    if ($null -eq $branch) {
+        return $Target
+    }
+    return (Resolve-WorktreeItemTarget -Text "branch: $branch" -SessionRoot (Get-Location).Path)
+}
+
+function Get-PrAuthorTargetGuidanceText {
+    <#
+    .SYNOPSIS
+        Return the remedy sentence of the TARGET_WORKTREE_NOT_DERIVABLE denial.
+    .DESCRIPTION
+        Names the accepted target forms: --head <branch> on gh pr create, and for gh pr edit
+        either running the command from the item worktree (the branch is derived) or appending
+        the shell comment # branch: <branch>. States that --head is not valid for gh pr edit.
+    .OUTPUTS
+        System.String
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    return 'Name the target: for gh pr create, pass --head <branch> (gh pr create --head <branch> ...). For gh pr edit, run the command from the item worktree so the gate derives the branch from its checkout, or append the shell comment # branch: <branch> to the command; --head is not valid for gh pr edit.'
+}

package/resources/claude-customizations/.claude/hooks/enforce-pr-author-skill.epic-base-branch.ps1

@@ -59,7 +59,9 @@ function Test-EpicBaseBranchOverride {
         with reason EPIC_BASE_BRANCH_MISMATCH. When epic_mode is absent or false, when the
         checkpoint is unreadable, or when the command is not gh pr create (the base branch is
         set at create time, not edit time), this check is a no-op and standalone behavior is
-        unchanged.
+        unchanged. Only the JSON boolean true counts as epic mode: a string or number such as
+        "false", "true", or 1 is not epic mode, so the --base requirement does not apply
+        (issue #1001).
     .PARAMETER CommandText
         The Bash command text under evaluation.
     .PARAMETER CheckpointPath
@@ -116,7 +118,7 @@ function Test-EpicBaseBranchOverride {
     }
 
     $checkpointProps = @($checkpoint.PSObject.Properties.Name)
-    if ($checkpointProps -notcontains 'epic_mode' -or -not [bool]$checkpoint.epic_mode) {
+    if ($checkpointProps -notcontains 'epic_mode' -or -not (($checkpoint.epic_mode -is [bool]) -and $checkpoint.epic_mode)) {
         return $null
     }