@danmoisan/drm-copilot-mcp 1.1.7 → 1.1.8

package/out/mcp-server.js

@@ -19289,6 +19289,65 @@ var BlastRadiusDeriveFileSystem = class {
   }
 };
 
+// ../../extensions/drm-copilot/src/lib/push-down/claude-gitignore-merge.ts
+var CLAUDE_GITIGNORE_RELATIVE_PATH = ".gitignore";
+var CLAUDE_GITIGNORE_BEGIN_SENTINEL = "# BEGIN drm-copilot managed ignores";
+var CLAUDE_GITIGNORE_END_SENTINEL = "# END drm-copilot managed ignores";
+var CLAUDE_MANAGED_IGNORE_ENTRIES = [
+  ".claude/state/",
+  ".codex/state/"
+];
+var LINE_SEPARATOR = "\n";
+function normalizeLineEndings(text) {
+  return text.replace(/\r\n?/g, LINE_SEPARATOR);
+}
+function toLines(normalized) {
+  if (normalized === "") {
+    return [];
+  }
+  const lines = normalized.split(LINE_SEPARATOR);
+  if (lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  return lines;
+}
+function renderManagedBlock() {
+  return [
+    CLAUDE_GITIGNORE_BEGIN_SENTINEL,
+    ...CLAUDE_MANAGED_IGNORE_ENTRIES,
+    CLAUDE_GITIGNORE_END_SENTINEL
+  ];
+}
+function mergeClaudeGitignore(currentText) {
+  const lines = toLines(normalizeLineEndings(currentText));
+  const managedBlock = renderManagedBlock();
+  const beginIndex = lines.indexOf(CLAUDE_GITIGNORE_BEGIN_SENTINEL);
+  if (beginIndex === -1) {
+    return appendManagedBlock(lines, managedBlock);
+  }
+  const endOffset = lines.slice(beginIndex).indexOf(CLAUDE_GITIGNORE_END_SENTINEL);
+  const endIndex = endOffset === -1 ? beginIndex : beginIndex + endOffset;
+  const merged = [
+    ...lines.slice(0, beginIndex),
+    ...managedBlock,
+    ...lines.slice(endIndex + 1)
+  ];
+  return toDocument(merged);
+}
+function appendManagedBlock(lines, managedBlock) {
+  const trailingBlankRemoved = [...lines];
+  while (trailingBlankRemoved.length > 0 && trailingBlankRemoved[trailingBlankRemoved.length - 1] === "") {
+    trailingBlankRemoved.pop();
+  }
+  if (trailingBlankRemoved.length === 0) {
+    return toDocument(managedBlock);
+  }
+  return toDocument([...trailingBlankRemoved, "", ...managedBlock]);
+}
+function toDocument(lines) {
+  return `${lines.join(LINE_SEPARATOR)}${LINE_SEPARATOR}`;
+}
+
 // ../../extensions/drm-copilot/src/lib/push-down/claude-customizations.ts
 var ARTIFACT_DIRECTORY4 = "artifacts/claude-customizations";
 var ROOT_FOLDERS2 = [".claude", "config"];
@@ -19365,7 +19424,7 @@ function pushDownCustomizations4(options) {
       variantRoot: effectiveBundle
     }
   );
-  return pushDownCustomizations({
+  const summary = pushDownCustomizations({
     repoRoot,
     destinationRoot,
     fs: excludingFs,
@@ -19376,6 +19435,19 @@ function pushDownCustomizations4(options) {
     rewriteReferences: passthroughRewrite2,
     ...clock === void 0 ? {} : { clock }
   });
+  deliverDestinationGitignore(fs10, destinationRoot);
+  return summary;
+}
+function deliverDestinationGitignore(fs10, destinationRoot) {
+  const destinationPath = joinPosix7(
+    destinationRoot,
+    CLAUDE_GITIGNORE_RELATIVE_PATH
+  );
+  const currentText = fs10.isFile(destinationPath) ? fs10.readTextFile(destinationPath) : "";
+  const mergedText = mergeClaudeGitignore(currentText);
+  if (mergedText !== currentText) {
+    fs10.writeTextFile(destinationPath, mergedText);
+  }
 }
 
 // ../../extensions/drm-copilot/src/lib/push-down/push-down-service-call.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danmoisan/drm-copilot-mcp",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "Stdio MCP server exposing drm-copilot repo-automation tools.",
   "license": "MIT",
   "type": "commonjs",

package/resources/claude-customizations/.claude/agents/parallel-orchestrator.md

@@ -89,11 +89,12 @@ reference; it is not invoked on the destination-runtime path. Cohort recoloring
 batching use `compute-cohorts.sh` and `compute-concurrency-batches.sh` under the same allowlist
 entry.
 
-The two `poetry run` grants remain for the repository-local paths that still need an interpreter:
-the checkpoint-validator CLI fallback the skill names in its `## Parallel-Level Checkpoint` section
-is invoked as `poetry run python -m`, and the drift-detection CLI likewise. Both grants stay scoped
-to those two invocation forms only — not to `poetry run` as a whole — so `pytest`, `black`, `ruff`,
-and every other `poetry run` subcommand remain outside the allowlist. The sibling persona
+The `poetry run` grants remain for the repository-local paths that still need an interpreter. The
+skill's `## Parallel-Level Checkpoint` section now validates through
+`mcp__drm-copilot__validate_orchestration_artifacts`, so exactly one named consumer is left: the
+drift-detection CLI, invoked as `poetry run python -m`. Each grant stays scoped to its own
+`poetry run python` invocation form — not to `poetry run` as a whole — so `pytest`, `black`,
+`ruff`, and every other `poetry run` subcommand remain outside the allowlist. The sibling persona
 `.claude/agents/parallel-planner.md` records the same destination-runtime posture.
 
 ## Startup Protocol

package/resources/claude-customizations/.claude/agents/parallel-planner.md

@@ -17,6 +17,7 @@ tools:
   - "Bash(bash .claude/lib/bash/compute-cohorts.sh*)"
   - "Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"
   - "Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"
+  - "Bash(bash .claude/lib/bash/report-lane-assertion.sh*)"
   - "mcp__drm-copilot__validate_orchestration_artifacts"
 skills:
   - policy-compliance-order
@@ -148,19 +149,24 @@ plan a parallel run.
 relation come from `.claude/lib/blast-radius/BlastRadius.psm1`:
 
 ```powershell
-Import-Module .claude/lib/blast-radius/BlastRadius.psm1 -Force
+$repoRoot = git rev-parse --show-toplevel
+Import-Module (Join-Path $repoRoot '.claude/lib/blast-radius/BlastRadius.psm1') -Force -ErrorAction Stop
 ```
 
+The default PowerShell 5.1 execution policy blocks `Import-Module` of a `.psm1` file, so `pwsh` is
+mandatory here.
+
 The facade exports `Get-PlanPaths`, `Get-BlastRadius`, `Get-BlastRadiusFromObservedPaths`,
 `Test-BlastRadius`, and `Test-BlastRadiusConflict`. Its truth table is
 `config/blast-radius.json`, which push-down publishes alongside `.claude`.
 
 **Cohort seeding and concurrency batching — bash entry points.** The bash library is granted as
-three entry-point-specific allowlist entries — `"Bash(bash .claude/lib/bash/compute-cohorts.sh*)"`,
-`"Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"`, and
-`"Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"` — one per command-line entry point.
-The six sourceable libraries carry no grant because they are never invoked directly. The two
-commands below require the first two of those entries:
+four entry-point-specific allowlist entries — `"Bash(bash .claude/lib/bash/compute-cohorts.sh*)"`,
+`"Bash(bash .claude/lib/bash/compute-concurrency-batches.sh*)"`,
+`"Bash(bash .claude/lib/bash/validate-parallel-manifest.sh*)"`, and the entry for
+`.claude/lib/bash/report-lane-assertion.sh` declared in this persona's `tools:` list — one per
+command-line entry point. The seven sourceable libraries carry no grant because they are never
+invoked directly. The two commands below require the first two of those entries:
 
 ```bash
 bash .claude/lib/bash/compute-cohorts.sh --keys "<k1> <k2> ..." --edges "<a>:<b> ..."
@@ -176,6 +182,16 @@ bash .claude/lib/bash/validate-parallel-manifest.sh --print-mode <manifest-path>
 bash .claude/lib/bash/validate-parallel-manifest.sh --print-max-concurrency <manifest-path>
 ```
 
+**Lane assertion — bash entry point.** The entry-point grant for
+`.claude/lib/bash/report-lane-assertion.sh` covers:
+
+```bash
+bash .claude/lib/bash/report-lane-assertion.sh --manifest <manifest-path> --edges "<a>:<b> ..."
+```
+
+The diagnostic is advisory only. It never blocks the run, never modifies or suppresses a derived
+edge, never feeds cohort computation, and always exits 0, including when it reports disagreements.
+
 **Python modules are the repository authority, not the runtime path.**
 `scripts/dev_tools/compute_blast_radius.py`, `scripts/dev_tools/parallel_cohort_computation.py`,
 and `scripts/dev_tools/parallel_manifest_contract.py` remain the reference implementations that the
@@ -183,4 +199,5 @@ ported libraries are asserted against by shared fixture corpora. Do not invoke t
 destination-runtime path; cite them for their contract.
 
 The `"Bash(poetry run *)"` allowlist entry is retained for the repository-local paths that still
-need it — it is not required by any step above.
+need a Python interpreter. The four bash entry points above and the PowerShell blast-radius facade
+run without it, so no destination-runtime step depends on that grant.

package/resources/claude-customizations/.claude/hooks/enforce-orchestration-preimplementation-gate-modes.ps1

@@ -267,7 +267,7 @@ function Find-OrchestrationDelegationIssueNumber {
 
     if (-not $Prompt) { return $null }
 
-    $keyed = [regex]::Match($Prompt, 'issue[_-]?num(?:ber)?\s*[:=]\s*#?(\d+)', 'IgnoreCase')
+    $keyed = [regex]::Match($Prompt, 'issue(?:[_-]?num(?:ber)?|\s+number)\s*[:=]\s*#?(\d+)', 'IgnoreCase')
     if ($keyed.Success) { return $keyed.Groups[1].Value }
     $hashForm = [regex]::Match($Prompt, '(?:^|\s)#(\d+)\b')
     if ($hashForm.Success) { return $hashForm.Groups[1].Value }
@@ -344,14 +344,17 @@ function Find-OrchestrationModeRecord {
     )
 
     if ($null -eq $Records) { return $null }
-    foreach ($record in @($Records)) {
-        if ($null -eq $record) { continue }
-        if ($TargetFolder) {
+    if ($TargetFolder) {
+        foreach ($record in @($Records)) {
+            if ($null -eq $record) { continue }
             $folder = Get-OrchestrationModeString -Value $record -Name 'feature_folder'
             $basename = Get-OrchestrationModeFolderBasename -Path $folder
             if ($basename -and $basename -eq $TargetFolder) { return $record }
         }
-        if ($IssueNumber) {
+    }
+    if ($IssueNumber) {
+        foreach ($record in @($Records)) {
+            if ($null -eq $record) { continue }
             $issue = Get-OrchestrationModeString -Value $record -Name 'issue_num'
             if ($issue -and $issue -eq $IssueNumber) { return $record }
         }

package/resources/claude-customizations/.claude/hooks/enforce-powershell-batch-budget.ps1

@@ -14,6 +14,19 @@
     persisted under .claude/state/powershell-batch-budget.<session_id>.json. Only
     distinct file paths are counted; repeated edits to the same file consume one slot.
 
+    The session id is resolved from the first non-empty of: the CLAUDE_SESSION_ID
+    environment variable; the contents of <root>/.claude/state/current-session-id;
+    a worktree-derived identifier built from the root's leaf name and a short
+    stable hash of its normalized path. The resolved value is sanitized before it
+    is composed into a file name, so a hostile id cannot escape the state
+    directory. Resolving the id never creates the state directory.
+
+    Candidate paths are contained to the resolved root. A candidate that resolves
+    outside it is discarded: the decision is 'allow', no slot is consumed, and no
+    state is written. Persisted entries that fail the same containment test are
+    dropped when state is rehydrated, so a state file carried between worktrees
+    cannot spend this worktree's budget.
+
     Test files are those matching:
       - tests/**/*.ps1
       - *.Tests.ps1
@@ -39,6 +52,127 @@ param()
 
 
 Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+
+function Test-PowerShellBatchBudgetPathInRoot {
+    <#
+    .SYNOPSIS
+        Reports whether a candidate path belongs to the batch-budget root.
+    .DESCRIPTION
+        Compares forward-slash-normalized forms of the candidate and the root,
+        case-insensitively. A relative candidate carries no root of its own and is
+        admitted, which is what keeps a relative path recorded by one worktree from
+        being treated as foreign by another.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Path,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Path)) {
+        return $false
+    }
+
+    $normalizedPath = $Path -replace '\\', '/'
+    if ($normalizedPath -notmatch '^(/|[A-Za-z]:/)') {
+        return $true
+    }
+
+    $normalizedRoot = ($Root -replace '\\', '/').TrimEnd('/')
+    if ([string]::IsNullOrWhiteSpace($normalizedRoot)) {
+        return $true
+    }
+
+    return ([string]::Equals($normalizedPath, $normalizedRoot, [System.StringComparison]::OrdinalIgnoreCase) -or $normalizedPath.StartsWith($normalizedRoot + '/', [System.StringComparison]::OrdinalIgnoreCase))
+}
+
+function ConvertTo-PowerShellBatchBudgetSafeSegment {
+    <#
+    .SYNOPSIS
+        Reduces a session id to characters that are safe in a file name.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Value
+    )
+
+    return ($Value -replace '[^A-Za-z0-9._-]', '_')
+}
+
+function Get-PowerShellBatchBudgetSessionId {
+    <#
+    .SYNOPSIS
+        Resolves the session id used to compose the batch-budget state-file name.
+    .DESCRIPTION
+        Returns the first non-empty of: the explicit SessionId argument; the
+        CLAUDE_SESSION_ID environment variable; the contents of the session-id state
+        file; a worktree-derived identifier. The result is sanitized so it cannot
+        escape the state directory. The session-id state file is read through the
+        ReadSessionIdFile seam and is never created, so resolution performs no write.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $SessionId,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root,
+
+        [Parameter(Mandatory)]
+        [string] $SessionIdFilePath,
+
+        [scriptblock] $ReadSessionIdFile
+    )
+
+    $candidates = @(
+        $SessionId
+        $env:CLAUDE_SESSION_ID
+    )
+
+    foreach ($candidate in $candidates) {
+        if (-not [string]::IsNullOrWhiteSpace($candidate)) {
+            return (ConvertTo-PowerShellBatchBudgetSafeSegment -Value $candidate.Trim())
+        }
+    }
+
+    $fromFile = ''
+    try {
+        $fromFile = [string](& $ReadSessionIdFile $SessionIdFilePath)
+    } catch {
+        Write-Verbose "Ignoring unreadable session-id file '$SessionIdFilePath': $($_.Exception.Message)"
+        $fromFile = ''
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($fromFile)) {
+        return (ConvertTo-PowerShellBatchBudgetSafeSegment -Value $fromFile.Trim())
+    }
+
+    $normalizedRoot = ($Root -replace '\\', '/').TrimEnd('/')
+    $leaf = ConvertTo-PowerShellBatchBudgetSafeSegment -Value (Split-Path -Path $normalizedRoot -Leaf)
+
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $hashBytes = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($normalizedRoot))
+    } finally {
+        $sha.Dispose()
+    }
+    $shortHash = -join (@($hashBytes[0..3]) | ForEach-Object { $_.ToString('x2') })
+
+    return "worktree-$leaf-$shortHash"
+}
+
 function Get-PowerShellBatchBudgetState {
     [CmdletBinding()]
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
@@ -69,14 +203,26 @@ function ConvertTo-PowerShellBatchBudgetState {
         [int] $ProdCap,
 
         [Parameter(Mandatory)]
-        [int] $TestCap
+        [int] $TestCap,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
     )
 
     $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
     if ($null -ne $InputObject.prodCap) { $state.prodCap = [int]$InputObject.prodCap }
     if ($null -ne $InputObject.testCap) { $state.testCap = [int]$InputObject.testCap }
-    if ($null -ne $InputObject.prodFiles) { $state.prodFiles = @($InputObject.prodFiles) }
-    if ($null -ne $InputObject.testFiles) { $state.testFiles = @($InputObject.testFiles) }
+
+    # Persisted entries that resolve outside this root belong to another worktree
+    # and are dropped, so a state file carried across worktrees cannot spend this
+    # worktree's budget.
+    if ($null -ne $InputObject.prodFiles) {
+        $state.prodFiles = @(@($InputObject.prodFiles) | Where-Object { Test-PowerShellBatchBudgetPathInRoot -Path $_ -Root $Root })
+    }
+    if ($null -ne $InputObject.testFiles) {
+        $state.testFiles = @(@($InputObject.testFiles) | Where-Object { Test-PowerShellBatchBudgetPathInRoot -Path $_ -Root $Root })
+    }
 
     return $state
 }
@@ -116,7 +262,11 @@ function Invoke-PowerShellBatchBudgetDecision {
         [System.Collections.IDictionary] $State,
 
         [Parameter(Mandatory)]
-        [string] $StateFile
+        [string] $StateFile,
+
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent)
     )
 
     $normalized = $FilePath -replace '\\', '/'
@@ -124,6 +274,13 @@ function Invoke-PowerShellBatchBudgetDecision {
         return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
     }
 
+    # An out-of-root candidate is discarded rather than denied: it consumes no
+    # slot and writes no state, so this hook stays deny-only for real overruns.
+    if (-not (Test-PowerShellBatchBudgetPathInRoot -Path $normalized -Root $Root)) {
+        Write-Verbose "Discarding batch-budget candidate '$normalized': it resolves outside the batch-budget root '$Root'."
+        return [ordered]@{ hookSpecificOutput = [ordered]@{ hookEventName = 'PreToolUse'; permissionDecision = 'allow' }; state = $State; shouldWriteState = $false }
+    }
+
     $isTestFile = ($normalized -match '(^|/)tests/.*\.ps1$') -or ($normalized -match '\.Tests\.ps1$')
     $targetList = if ($isTestFile) { @($State.testFiles) } else { @($State.prodFiles) }
     $cap = if ($isTestFile) { [int]$State.testCap } else { [int]$State.prodCap }
@@ -154,10 +311,17 @@ function Invoke-PowerShellBatchBudgetHook {
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
     param(
         [string] $ToolInputRaw,
-        [string] $SessionId = 'default',
-        [string] $Root = (Get-Location).Path,
+        [string] $SessionId = '',
+        [string] $Root = (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent),
         [int] $ProdCap = 3,
         [int] $TestCap = 3,
+        [scriptblock] $ReadSessionIdFile = {
+            param([string] $Path)
+            if (Test-Path -LiteralPath $Path -PathType Leaf) {
+                return (Get-Content -LiteralPath $Path -Raw)
+            }
+            return ''
+        },
         [scriptblock] $TestPathExists = { param([string] $Path) Test-Path -Path $Path },
         [scriptblock] $EnsureDirectory = { param([string] $Path) New-Item -ItemType Directory -Path $Path -Force | Out-Null },
         [scriptblock] $ReadState = { param([string] $Path) Get-Content -Path $Path -Raw },
@@ -186,23 +350,32 @@ function Invoke-PowerShellBatchBudgetHook {
     }
 
     $stateDir = Join-Path -Path $Root -ChildPath '.claude/state'
+
+    # Resolved before the directory is ensured, because reading the session-id
+    # file must never be what creates the state directory.
+    $resolvedSessionId = Get-PowerShellBatchBudgetSessionId `
+        -SessionId $SessionId `
+        -Root $Root `
+        -SessionIdFilePath (Join-Path -Path $stateDir -ChildPath 'current-session-id') `
+        -ReadSessionIdFile $ReadSessionIdFile
+
     if (-not (& $TestPathExists $stateDir)) {
         & $EnsureDirectory $stateDir
     }
 
-    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$SessionId.json")
+    $stateFile = Join-Path -Path $stateDir -ChildPath ("powershell-batch-budget.$resolvedSessionId.json")
     $state = Get-PowerShellBatchBudgetState -ProdCap $ProdCap -TestCap $TestCap
 
     if (& $TestPathExists $stateFile) {
         try {
             $loaded = & $ReadState $stateFile | ConvertFrom-Json -ErrorAction Stop
-            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap
+            $state = ConvertTo-PowerShellBatchBudgetState -InputObject $loaded -ProdCap $ProdCap -TestCap $TestCap -Root $Root
         } catch {
             Write-Verbose "Ignoring unreadable PowerShell batch-budget state file '$stateFile': $($_.Exception.Message)"
         }
     }
 
-    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile
+    $decision = Invoke-PowerShellBatchBudgetDecision -FilePath $filePath -State $state -StateFile $stateFile -Root $Root
     if ($decision.shouldWriteState) {
         try {
             & $WriteState $stateFile $decision.state
@@ -245,10 +418,10 @@ function Invoke-PowerShellBatchBudgetEntryPoint {
         $ToolInputRaw = [string](& $ReadPayload)
     }
 
-    $sessionId = $env:CLAUDE_SESSION_ID
-    if (-not $sessionId) {
-        $sessionId = 'default'
-    }
+    # No literal fallback here: an empty value routes through the hook's session
+    # resolution, which falls back to the session-id state file and then to a
+    # worktree-derived identifier.
+    $sessionId = [string]$env:CLAUDE_SESSION_ID
 
     $prodCap = 3
     $testCap = 3