@danmoisan/drm-copilot-mcp 1.1.9 → 1.1.11

package/resources/claude-customizations/.claude/hooks/validate-bash.ps1

@@ -39,6 +39,11 @@ param(
 )
 
 Import-Module (Join-Path $PSScriptRoot '../lib/hook-payload/HookPayload.psm1') -Force
+# Shared command-line parser (issue #545). Both detectors below run against the segment
+# list rather than against the unsegmented command string, so a dangerous phrase quoted
+# inside a message body is no longer a match and a relocating spelling no longer escapes.
+. (Join-Path $PSScriptRoot 'hook-command-scanner.ps1')
+. (Join-Path $PSScriptRoot 'hook-command-invocation.ps1')
 
 function Get-BlockedBashPattern {
     [CmdletBinding()]
@@ -55,7 +60,119 @@ function Get-BlockedBashPattern {
     )
 }
 
+function Test-BlockedPatternTokenRun {
+    <#
+    .SYNOPSIS
+        Report whether a literal's token sequence occurs as a contiguous run in a token list.
+    .DESCRIPTION
+        Whole-token equality, element by element. This is the comparison primitive that
+        replaces String.Contains. It is what makes '--force-with-lease' stop matching the
+        literal 'git push --force': the two are different tokens, whereas one is a substring
+        of the other.
+    .OUTPUTS
+        System.Boolean
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory)][AllowEmptyCollection()][string[]] $Token,
+        [Parameter(Mandatory)][ValidateNotNullOrEmpty()][string[]] $PatternToken
+    )
+
+    if ($PatternToken.Count -eq 0 -or $Token.Count -lt $PatternToken.Count) {
+        return $false
+    }
+
+    for ($start = 0; $start -le $Token.Count - $PatternToken.Count; $start++) {
+        $matched = $true
+        for ($offset = 0; $offset -lt $PatternToken.Count; $offset++) {
+            if ($Token[$start + $offset] -ne $PatternToken[$offset]) {
+                $matched = $false
+                break
+            }
+        }
+        if ($matched) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+function Get-BlockedStructuralGitMatch {
+    <#
+    .SYNOPSIS
+        Report the denylist literal a segment's structural git invocation stands for, or $null.
+    .DESCRIPTION
+        The flag conjunction is required rather than optional. Classifying on the bare
+        subcommand would deny 'git push --force-with-lease origin HEAD', which spec Test
+        Strategy row AT-8 requires to allow, and would deny 'git reset --soft HEAD~1'.
+
+        When a segment carries both '--force' and '-f' the '--force' leg is evaluated first,
+        so the returned value is 'git push --force'.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)][AllowEmptyString()][string] $SegmentText,
+        [Parameter(Mandatory)][AllowEmptyCollection()][string[]] $Token
+    )
+
+    if (Test-CommandLineInvocation -CommandText $SegmentText -CommandWord 'git' -SubcommandPath @('push')) {
+        if ($Token -contains '--force') { return 'git push --force' }
+        if ($Token -contains '-f') { return 'git push -f' }
+    }
+    if (Test-CommandLineInvocation -CommandText $SegmentText -CommandWord 'git' -SubcommandPath @('reset')) {
+        if ($Token -contains '--hard') { return 'git reset --hard' }
+    }
+
+    return $null
+}
+
 function Get-BlockedPatternMatch {
+    <#
+    .SYNOPSIS
+        Return the denylist literal a command matches, or $null.
+    .DESCRIPTION
+        Two legs, in this order, over the segment list produced by Read-CommandLineSegment.
+
+        Leg 1 (literal): each of the six byte-unchanged literals from Get-BlockedBashPattern
+        is split into its own whitespace-delimited token sequence and reported as a match
+        when that sequence occurs as a CONTIGUOUS RUN inside a segment's Tokens, every
+        element compared by whole-token equality. The value returned is the literal string
+        itself, and the literals are tested in their existing declaration order. Because a
+        quoted span is one token, 'git commit -m "why rm -rf is banned"' no longer matches.
+
+        Leg 1 has a second condition, the wrapper carve-out of D2 Piece 2 together with the two
+        other clauses under which the scanner selects raw scan text. A wrapper's quoted argument is
+        a nested command line rather than inert data, and ConvertTo-CommandLineToken collapses a
+        balanced quoted span into ONE token, so a multi-token literal can never form a contiguous
+        token run inside it. The same masking hides a literal carried inside a quoted span or a
+        heredoc that never closes. For a segment that is wrapper-led, that carries a live
+        substitution, or whose quoting or heredoc did not close, the scanner already selects
+        RawText as ScanText, and this leg reads that field with an Ordinal IndexOf, matching the
+        culture-insensitive String.Contains it replaced. The three disjuncts here are exactly the
+        three clauses of that ScanText selection, so no segment the scanner scans raw is left
+        unscanned by this leg. That is what keeps both 'bash -c "rm -rf /tmp/x"' and
+        'echo "rm -rf /tmp/x' denying. A segment matching none of the three is never scanned this
+        way, so 'git commit -m "docs: explain why rm -rf is banned"' still allows.
+
+        Leg 2 (structural): a relocating spelling such as 'git -C ../wt push --force origin
+        HEAD' contains no literal as a token run, so it is classified structurally instead.
+
+        Leg 1 is evaluated IN FULL, over every segment and every literal, before any leg 2
+        evaluation. That ordering is what keeps 'git push origin --force' returning the
+        literal 'git push origin --force' rather than the leg 2 value 'git push --force',
+        which is what the existing case at tests/scripts/claude-hooks/validate-bash.Tests.ps1
+        line 29 asserts.
+
+        Spec D11.3 rules that rule R2 governs the literal TEXT, not the comparison operator,
+        so all six literals stay byte-unchanged; only the comparison primitive changed.
+    .OUTPUTS
+        System.String or $null
+    #>
     [CmdletBinding()]
     [OutputType([string])]
     param(
@@ -69,12 +186,139 @@ function Get-BlockedPatternMatch {
         return $null
     }
 
+    $segments = @(Read-CommandLineSegment -CommandText $Command)
+
     foreach ($pattern in (Get-BlockedBashPattern)) {
-        if ($Command.Contains($pattern)) {
-            return $pattern
+        $patternTokens = [string[]]@($pattern -split '\s+' | Where-Object { $_ })
+        foreach ($segment in $segments) {
+            if (Test-BlockedPatternTokenRun -Token @($segment.Tokens) -PatternToken $patternTokens) {
+                return $pattern
+            }
+            if (($segment.IsWrapperLed -or $segment.HasLiveSubstitution -or $segment.Unbalanced) -and
+                $segment.ScanText.IndexOf($pattern, [System.StringComparison]::Ordinal) -ge 0) {
+                return $pattern
+            }
+        }
+    }
+
+    foreach ($segment in $segments) {
+        $structural = Get-BlockedStructuralGitMatch -SegmentText $segment.RawText -Token @($segment.Tokens)
+        if ($structural) {
+            return $structural
+        }
+    }
+
+    return $null
+}
+
+# File-reading commands Claude Code's Bash permission engine resolves against
+# Read() rules rather than Bash() prefix rules. Measured empirically (2026-09):
+# once one of these co-occurs with a preceding `cd` in the same command line
+# (chained via `&&` or `;`), the engine always requires manual approval -
+# regardless of any Read() or Bash() allow rule present, and regardless of
+# whether the read command's own path argument is relative or absolute. No
+# settings.json configuration can suppress that prompt; the only fix is to
+# never chain `cd` with one of these in the same command.
+$script:CdChainedReadCommandPattern = 'cd\s+\S.*?(&&|;)\s*(grep|cat|head|tail|less|more|awk|sed\s+-n)\b'
+
+# The read-command family the pattern above enumerates, as command words. Retained
+# alongside the pattern so the rule R2 literal-text obligation stays visibly discharged:
+# the pattern string is byte-unchanged and is kept as a declared constant, while the
+# evaluation moves to the segment list.
+$script:CdChainedReadCommandWords = @('grep', 'cat', 'head', 'tail', 'less', 'more', 'awk', 'sed')
+
+function Get-CdChainedReadCommandMatch {
+    <#
+    .SYNOPSIS
+        Return the read command chained after a cd on the same command line, or $null.
+    .DESCRIPTION
+        Walks the segment list in order and reports a match when a segment whose CommandWord
+        is 'cd' and whose Tokens count is at least two is followed, at ANY later position in
+        the segment list, by a segment whose CommandWord is one of the read-command family.
+        The returned value is that later segment's CommandWord, except that a 'sed' segment
+        matches only when its second token is '-n' and then returns 'sed -n'. When more than
+        one later segment qualifies, the earliest supplies the return value.
+
+        The regex could not simply be evaluated per segment: '&&' and ';' are segment
+        delimiters under spec D2 Piece 1, so no single segment ever contains both sides of
+        the chain.
+
+        A second leg therefore runs first, before the walk: the retained regex constant is
+        evaluated against the ScanText of each segment the scanner already reads raw, which
+        is where a wrapper's quoted argument collapses a whole nested chain into one segment
+        the walk cannot decompose. The two legs are complementary and neither replaces the
+        other, so the ordering between them changes only which leg reports a chain that both
+        could see, never whether a chain is reported at all.
+
+        Adjacency is deliberately NOT required. The retained pattern places a lazy '.*?'
+        between the cd argument and the delimiter, so 'cd /x && npm test && grep foo bar.txt'
+        is denied today; requiring the read segment to follow the cd segment immediately
+        would turn that existing denial into an allow, which acceptance criterion 9 forbids.
+        This formulation also widens the delimiter set from '&&' and ';' to every segment
+        delimiter, so every command line in which a real cd segment precedes a real read
+        segment and is denied today is still denied.
+
+        One narrowing is intended and is stated rather than left implicit: a cd-then-read
+        phrase occurring only inside a quoted span or a heredoc body is denied today and
+        allows after this change, because the scanner masks that span before the segment list
+        is built. That narrowing is the over-match fix this issue exists to deliver.
+    .OUTPUTS
+        System.String or $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $false)]
+        [AllowEmptyString()]
+        [AllowNull()]
+        [string] $Command
+    )
+
+    if (-not $Command) {
+        return $null
+    }
+
+    $segments = @(Read-CommandLineSegment -CommandText $Command)
+
+    # D12 call-site row for line 105: the retained pattern, evaluated per segment against
+    # ScanText. Complementary to the CommandWord walk below rather than a replacement for it.
+    # '&&' and ';' delimit segments, so an unquoted chain never puts both halves in one
+    # segment and only the walk can see it; a wrapper-led chain sits entirely inside one
+    # segment whose command word is the wrapper, and only this leg can see that. Restricting
+    # the leg to segments the scanner already scans raw preserves the intended narrowing:
+    # echo "cd /x && head f" is masked and still allows.
+    foreach ($segment in $segments) {
+        if ((Test-CommandLineSegmentRawScan -Segment $segment) -and
+            $segment.ScanText -match $script:CdChainedReadCommandPattern) {
+            return ($Matches[2] -replace '\s+', ' ')
         }
     }
 
+    $seenCd = $false
+
+    foreach ($segment in $segments) {
+        $tokens = @($segment.Tokens)
+        $word = [string]$segment.CommandWord
+
+        if (-not $seenCd) {
+            if ($word -eq 'cd' -and $tokens.Count -ge 2) {
+                $seenCd = $true
+            }
+            continue
+        }
+
+        if ($script:CdChainedReadCommandWords -notcontains $word) {
+            continue
+        }
+        if ($word -eq 'sed') {
+            if ($tokens.Count -ge 2 -and $tokens[1] -eq '-n') {
+                return 'sed -n'
+            }
+            continue
+        }
+        return $word
+    }
+
     return $null
 }
 
@@ -89,11 +333,16 @@ function Get-BashBlockReason {
     )
 
     $pattern = Get-BlockedPatternMatch -Command $Command
-    if (-not $pattern) {
-        return $null
+    if ($pattern) {
+        return "Blocked dangerous command pattern detected: '$pattern'"
+    }
+
+    $readOp = Get-CdChainedReadCommandMatch -Command $Command
+    if ($readOp) {
+        return "Forbidden Bash pattern: 'cd ... && $readOp' (or ';'-chained). Claude Code's Bash permission engine cannot resolve a file-reading command ($readOp) against Read() rules once a preceding 'cd' has changed the working directory in the same command line - it always requires manual approval, regardless of any Read() or Bash() allow rule, and regardless of whether the path argument is relative or absolute. Rewrite as a single command using an absolute path instead of 'cd'-ing first, e.g. run $readOp directly against the absolute file path, with no leading 'cd'."
     }
 
-    return "Blocked dangerous command pattern detected: '$pattern'"
+    return $null
 }
 
 function Get-BashDenyDecision {

package/resources/claude-customizations/.claude/lib/blast-radius/BlastRadius.psm1

@@ -6,10 +6,11 @@
     Destination-runtime PowerShell facade for the blast-radius library, porting
     scripts/dev_tools/compute_blast_radius.py (derive_blast_radius,
     radius_from_observed_paths, _feature_folder_glob) and
-    scripts/dev_tools/_blast_radius_conflicts.py (conflicts,
-    _smallest_path_overlap, _smallest_common). It imports the extraction, glob,
-    truth-table, and validation modules that sit beside it and re-exports the
-    five functions the spec PowerShell surface fixes:
+    scripts/dev_tools/_blast_radius_conflicts.py (conflicts). The ports of
+    _smallest_path_overlap and _smallest_common, and the mechanically-mergeable
+    path exclusion, live in BlastRadiusConflict.psm1. It imports the extraction,
+    glob, truth-table, conflict, and validation modules that sit beside it and
+    re-exports the five functions the spec PowerShell surface fixes:
 
       - Get-PlanPaths                     port of extract_plan_paths
       - Get-BlastRadius                   port of derive_blast_radius
@@ -58,6 +59,7 @@ Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusGlob.psm1')
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusConfig.psm1') -Force -ErrorAction Stop
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusNormalization.psm1') -Force -ErrorAction Stop
 Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusValidation.psm1') -Force -ErrorAction Stop
+Import-Module (Join-Path -Path $PSScriptRoot -ChildPath 'BlastRadiusConflict.psm1') -Force -ErrorAction Stop
 
 # Feature-folder handling. Every radius contains its own feature folder, and a
 # caller may pass either a bare folder name or an already-qualified path.
@@ -81,10 +83,6 @@ $script:ConflictModuleOverlap = 'module_overlap'
 $script:ConflictSharedSurfaceOverlap = 'shared_surface_overlap'
 $script:ConflictContractDependency = 'contract_dependency'
 
-# Separator used in an overlapping-pair detail string. The pair is ordered
-# ordinally before formatting so the detail is identical in both argument orders.
-$script:PairDetailSeparator = ' ~ '
-
 
 # Port of _feature_folder_glob. Accepting an already-qualified path avoids
 # producing a doubled docs/features/active/docs/features/active/... entry when a
@@ -341,68 +339,6 @@ function Get-BlastRadiusFromObservedPaths {
     }
 }
 
-# Port of _smallest_path_overlap. Each overlapping pair is ordered before it is
-# recorded, so the minimum is taken over a set that does not depend on argument
-# order; that is what makes the reported detail symmetric.
-function Get-SmallestPathOverlap {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param(
-        [Parameter(Mandatory = $true)]
-        [AllowEmptyCollection()]
-        [AllowEmptyString()]
-        [string[]] $PathA,
-        [Parameter(Mandatory = $true)]
-        [AllowEmptyCollection()]
-        [AllowEmptyString()]
-        [string[]] $PathB
-    )
-
-    $detail = [System.Collections.Generic.List[string]]::new()
-    foreach ($entryA in $PathA) {
-        foreach ($entryB in $PathB) {
-            if (-not (Test-EntryOverlap -EntryA $entryA -EntryB $entryB)) {
-                continue
-            }
-            $ordered = if ([string]::CompareOrdinal($entryA, $entryB) -le 0) {
-                @($entryA, $entryB)
-            } else {
-                @($entryB, $entryA)
-            }
-            $detail.Add($ordered -join $script:PairDetailSeparator)
-        }
-    }
-
-    return (Get-OrdinalSmallestEntry -Entry $detail.ToArray())
-}
-
-# Port of _smallest_common. Two empty collections share nothing, so the result is
-# $null and the level contributes no reason.
-function Get-SmallestCommonEntry {
-    [CmdletBinding()]
-    [OutputType([string])]
-    param(
-        [Parameter(Mandatory = $true)]
-        [AllowEmptyCollection()]
-        [AllowEmptyString()]
-        [string[]] $Left,
-        [Parameter(Mandatory = $true)]
-        [AllowEmptyCollection()]
-        [AllowEmptyString()]
-        [string[]] $Right
-    )
-
-    $rightSet = [System.Collections.Generic.HashSet[string]]::new($Right, [StringComparer]::Ordinal)
-    $common = [System.Collections.Generic.List[string]]::new()
-    foreach ($entry in $Left) {
-        if ($rightSet.Contains($entry)) {
-            $common.Add($entry)
-        }
-    }
-
-    return (Get-OrdinalSmallestEntry -Entry $common.ToArray())
-}
-
 function Test-BlastRadiusConflict {
     <#
     .SYNOPSIS
@@ -423,9 +359,10 @@ function Test-BlastRadiusConflict {
         Second radius record.
 
     .PARAMETER Config
-        Parsed config/blast-radius.json. The relation reads no key from it today;
-        it is validated and kept in the signature because the contract is frozen
-        for downstream consumers.
+        Parsed config/blast-radius.json. The relation reads exactly one key from
+        it, mergeable_paths, whose entries are dropped from both radii before the
+        path comparison; the mapping is otherwise validated and kept in the
+        signature because the contract is frozen for downstream consumers.
 
     .OUTPUTS
         System.Collections.Hashtable. Keys conflict (a boolean) and reasons (an
@@ -461,8 +398,14 @@ function Test-BlastRadiusConflict {
     $right = ConvertTo-NormalizedBlastRadius -Radius $RadiusB
 
     $reason = [System.Collections.Generic.List[hashtable]]::new()
-    $pathDetail = Get-SmallestPathOverlap -PathA ([string[]]@($left['paths'])) `
-        -PathB ([string[]]@($right['paths']))
+    # The mechanically-mergeable exclusion lives only here: it filters the two
+    # collections this comparison reads and rewrites no radius record, so a
+    # derived, declared, or observed radius still lists every project file it
+    # cited (issue #643).
+    $mergeable = [string[]]@(Get-ConfigMergeablePath -Config $Config)
+    $pathDetail = Get-SmallestPathOverlap `
+        -PathA ([string[]]@(Get-NonMergeablePathEntry -Entry ([string[]]@($left['paths'])) -MergeablePath $mergeable)) `
+        -PathB ([string[]]@(Get-NonMergeablePathEntry -Entry ([string[]]@($right['paths'])) -MergeablePath $mergeable))
     if ($null -ne $pathDetail) {
         $reason.Add(@{ kind = $script:ConflictPathOverlap; detail = $pathDetail })
     }