@takuma-hirai/hirai-method 0.1.0

package/.claude/tests/delegation-guard-deny-layers-smoke.sh

@@ -0,0 +1,356 @@
+#!/usr/bin/env bash
+# delegation-guard-deny-layers-smoke.sh — Smoke test for the 2 deny layers
+# (destructive + protected branch push) in .claude/hooks/delegation-guard.sh.
+#
+# 設計起源:
+#   - 2026-05-18 user 指示「mainAgentでgitコマンドは基本的(破壊的変更以外)に
+#     実行可能」を実装した commit b7eea6e (destructive layer 起源)。
+#     next-actions entry #13 (既実装、commit 9eacc3c)。
+#   - 2026-05-18 user 指示「gitの許可はmainとstgと含むブランチに対するpush、
+#     破壊的変更以外に対してを許可してください」を実装した commit ad2f7bc
+#     (protected branch push deny layer)。
+#     next-actions entry #14 (本 task #30 で smoke 追加)。
+#
+# 対象 hook:
+#   .claude/hooks/lib/delegation-guard/git-deny.sh の 2 layer:
+#     - check_git_destructive (L12-L42、ECC_ALLOW_DESTRUCTIVE_GIT=1 で bypass)
+#     - check_protected_branch_push (L58-L128、ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 で bypass)
+#   両 layer は .claude/hooks/delegation-guard.sh から呼ばれる。
+#
+# 検証範囲:
+#   - destructive deny:
+#     - Block cases (23): destructive git 操作が decision:"block" + reason に
+#       "[git destructive guard]" を含むこと
+#       (`git push -f` single space は 2026-05-18 hook fix で blockable 化:
+#        regex を `push[[:space:]]+([^|;&]*[[:space:]])?-f([[:space:]]|$)` に修正)
+#       (iter3 R5 MEDIUM F-03/F-04/F-05 解消: push --mirror / --all / --branches / --prune
+#        を追加、defense-in-depth 完全化)
+#     - Pass cases (10): 非破壊 git 操作が block されないこと
+#     - Bypass cases (3): ECC_ALLOW_DESTRUCTIVE_GIT=1 で block 解除されること
+#   - protected branch push deny (本 file 末尾セクションで検証):
+#     - Block cases (9): main 明示 / stg 系部分一致 (3 variant) +
+#       --force-with-lease origin main (destructive + protected 二重 guard) +
+#       HEAD:main / HEAD:refs/heads/main / +main / +HEAD:main (R5 HIGH F-01/F-02 解消) が
+#       decision:"block" + reason に "[protected branch push deny]" を含むこと
+#     - Pass cases (1): feature branch への push は block されないこと
+#       (expect_pass_protected で destructive 干渉排除 + protected 単体検証)
+#     - Bypass case (1): ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 で main push が通過
+#     - Negative bypass case (1): ECC_ALLOW_PROTECTED_BRANCH_PUSH=0 明示でも
+#       block 維持 (= "1" 比較の防御深度検証、iteration 2 追加)
+#
+# 非対象:
+#   - refspec 省略 (`git push` 引数なし) の current branch 解決 case
+#     (smoke 実行時の HEAD が任意 branch のため pure-test では再現困難、
+#      別 task で git rev-parse mock 化 or HEAD 制御 wrapper を検討)
+#   - subagent context (delegation-guard 短絡経路、本 smoke は main agent
+#     context で起動)
+#
+# 重要制約:
+#   - file-top に `set -euo pipefail` を書かない (caller leak 防止教訓
+#     `feedback_set_e_in_sourced_libs`)
+#   - subagent 短絡を避けるため CLAUDE_HARNESS_ROLE を明示的に unset し、
+#     marker dir に lock を作らない。
+#
+# 実行:
+#   bash .claude/tests/delegation-guard-deny-layers-smoke.sh
+#
+# 終了コード:
+#   0 = 全 case PASS / 1 = 1 件以上 FAIL
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+HOOK="$REPO_ROOT/.claude/hooks/delegation-guard.sh"
+
+# subagent 短絡経路を確実に閉じる (main agent 文脈で hook を起動するため)
+unset CLAUDE_HARNESS_ROLE
+unset ECC_ALLOW_DESTRUCTIVE_GIT
+unset ECC_ALLOW_PROTECTED_BRANCH_PUSH
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+# tool_input.command を含む PreToolUse JSON を python3 で安全に組み立てる
+json_input() {
+  local cmd="$1"
+  CMD="$cmd" python3 -c '
+import json, os
+print(json.dumps({"tool_input": {"command": os.environ["CMD"]}}))
+'
+}
+
+# stdout から decision フィールドを抽出 (parse 失敗時は "parse_error")
+# BrokenPipeError noise を抑制するため python3 で stdin を full read
+extract_decision() {
+  OUT_TEXT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT_TEXT"])
+    print(d.get("decision", "none"))
+except Exception:
+    print("parse_error")
+' 2>/dev/null
+}
+
+# stdout から reason フィールドを抽出
+extract_reason() {
+  OUT_TEXT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT_TEXT"])
+    print(d.get("reason", ""))
+except Exception:
+    print("")
+' 2>/dev/null
+}
+
+# block 期待 (destructive layer): decision="block" + reason が "[git destructive guard]" を含むこと
+# destructive cases では protected layer に到達しないが、念のため env で bypass し
+# layer 単体を検証する (destructive 先勝ちで block されることを保証)。
+expect_block() {
+  local label="$1"
+  local cmd="$2"
+  local out decision reason
+
+  out=$(json_input "$cmd" | ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -q '\[git destructive guard\]'; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    decision: %s\n    out: %s\n" "$label" "$cmd" "$decision" "$out"
+  fi
+}
+
+# block 期待 (protected branch push layer): decision="block" + reason が
+# "[protected branch push deny]" を含むこと。destructive layer が干渉しないよう
+# env で bypass し layer 単体を検証する (push origin main 等は destructive ではない)。
+expect_block_protected() {
+  local label="$1"
+  local cmd="$2"
+  local out decision reason
+
+  out=$(json_input "$cmd" | ECC_ALLOW_DESTRUCTIVE_GIT=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -q '\[protected branch push deny\]'; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    decision: %s\n    out: %s\n" "$label" "$cmd" "$decision" "$out"
+  fi
+}
+
+# pass 期待 (destructive layer): decision != "block" ({} or allow JSON)
+# protected layer に到達しないよう env で bypass する (例: pull origin feature/test
+# は protected 対象外だが、push 系 pass case がないので影響なし、念のため固定)。
+expect_pass() {
+  local label="$1"
+  local cmd="$2"
+  local out decision
+
+  out=$(json_input "$cmd" | ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    out: %s\n" "$label" "$cmd" "$out"
+  fi
+}
+
+# pass 期待 (protected layer 単体): decision != "block"。
+# destructive layer が干渉しないよう env で bypass する。
+expect_pass_protected() {
+  local label="$1"
+  local cmd="$2"
+  local out decision
+
+  out=$(json_input "$cmd" | ECC_ALLOW_DESTRUCTIVE_GIT=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    out: %s\n" "$label" "$cmd" "$out"
+  fi
+}
+
+# bypass 期待 (destructive): env ECC_ALLOW_DESTRUCTIVE_GIT=1 で decision != "block"
+# 併せて protected layer の干渉も排除 (push --force bypass で protected layer に到達する場合あり)。
+expect_bypass_pass() {
+  local label="$1"
+  local cmd="$2"
+  local out decision
+
+  out=$(json_input "$cmd" | ECC_ALLOW_DESTRUCTIVE_GIT=1 ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    out: %s\n" "$label" "$cmd" "$out"
+  fi
+}
+
+# bypass 期待 (protected): env ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 で decision != "block"
+# 併せて destructive layer の干渉も排除 (push origin main は destructive ではないが固定)。
+expect_bypass_pass_protected() {
+  local label="$1"
+  local cmd="$2"
+  local out decision
+
+  out=$(json_input "$cmd" | ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 ECC_ALLOW_DESTRUCTIVE_GIT=1 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    out: %s\n" "$label" "$cmd" "$out"
+  fi
+}
+
+# block 期待 (protected layer、bypass env "0" 明示設定 negative case):
+# ECC_ALLOW_PROTECTED_BRANCH_PUSH=0 を明示設定した場合、bypass は activate せず
+# block が維持されることを検証 (= "1" 比較の防御深度検証、iteration 2 追加)。
+# destructive layer の干渉を排除するため ECC_ALLOW_DESTRUCTIVE_GIT=1 を固定。
+expect_block_with_explicit_bypass_zero() {
+  local label="$1"
+  local cmd="$2"
+  local out decision reason
+
+  out=$(json_input "$cmd" | ECC_ALLOW_DESTRUCTIVE_GIT=1 ECC_ALLOW_PROTECTED_BRANCH_PUSH=0 bash "$HOOK" Bash 2>&1)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -q '\[protected branch push deny\]'; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    decision: %s\n    out: %s\n" "$label" "$cmd" "$decision" "$out"
+  fi
+}
+
+printf "===== delegation-guard-deny-layers-smoke (next-actions #13 + #14) =====\n\n"
+
+printf "Block cases (23):\n"
+expect_block "push --force"                    "git push --force"
+# 2026-05-18 hook fix で blockable 化:
+# 旧 regex `[^|;&]*[[:space:]]-f` は「push 直後の space と -f の前の space」の
+# **2 space 要求**になっていたため `git push -f` (single space) が漏れていた。
+# 新 regex `push[[:space:]]+([^|;&]*[[:space:]])?-f([[:space:]]|$)` で
+# `-f` 前の optional segment 化により single / multi space 両対応に修正。
+expect_block "push -f (single space)"          "git push -f"
+expect_block "push origin main --force"        "git push origin main --force"
+expect_block "reset --hard"                    "git reset --hard"
+expect_block "reset --hard HEAD~1"             "git reset --hard HEAD~1"
+expect_block "reset HEAD --hard"               "git reset HEAD --hard"
+expect_block "branch -D feature-x"             "git branch -D feature-x"
+expect_block "clean -f"                        "git clean -f"
+expect_block "clean -fd"                       "git clean -fd"
+expect_block "clean -fdx"                      "git clean -fdx"
+expect_block "checkout -- src/foo.ts"          "git checkout -- src/foo.ts"
+expect_block "restore --worktree src/"         "git restore --worktree src/"
+expect_block "restore --source=HEAD --worktree src/" "git restore --source=HEAD --worktree src/"
+expect_block "stash drop"                      "git stash drop"
+expect_block "stash clear"                     "git stash clear"
+expect_block "tag -d v1.0"                     "git tag -d v1.0"
+expect_block "tag -f v1.0"                     "git tag -f v1.0"
+expect_block "reflog expire --expire=now"      "git reflog expire --expire=now"
+expect_block "gc --prune=now"                  "git gc --prune=now"
+# --- iteration 3: R5 security-reviewer MEDIUM F-03/F-04/F-05 解消 (task-39 Step2 iter3) ---
+# (j) push --mirror: 全 ref 強制反映 (main 含む)、destructive group
+#     git-deny.sh: push[[:space:]]+([^|;&]*[[:space:]])?--mirror([[:space:]]|$)
+expect_block "push --mirror origin (F-03)"     "git push --mirror origin"
+# (k) push --all: 全 branch 一括 push (main 含む)、destructive group
+#     git-deny.sh: push[[:space:]]+([^|;&]*[[:space:]])?--all([[:space:]]|$)
+expect_block "push --all origin (F-04)"        "git push --all origin"
+# (l) push --branches: 全 branch 一括 push (main 含む)、destructive group
+#     git-deny.sh: push[[:space:]]+([^|;&]*[[:space:]])?--branches([[:space:]]|$)
+expect_block "push --branches origin (F-04)"   "git push --branches origin"
+# (m) push --prune: remote-only branch 削除を含む、destructive group
+#     git-deny.sh: push[[:space:]]+([^|;&]*[[:space:]])?--prune([[:space:]]|$)
+expect_block "push --prune origin (F-05)"      "git push --prune origin"
+
+printf "\nPass cases (10):\n"
+expect_pass  "status"                          "git status"
+expect_pass  "diff"                            "git diff"
+expect_pass  "log -5"                          "git log -5"
+expect_pass  "add foo.txt"                     "git add foo.txt"
+expect_pass  "commit -m"                       'git commit -m "msg"'
+expect_pass  "branch -d (lowercase, merged delete)" "git branch -d feature-merged"
+expect_pass  "rev-parse HEAD"                  "git rev-parse HEAD"
+expect_pass  "show HEAD"                       "git show HEAD"
+expect_pass  "fetch origin"                    "git fetch origin"
+expect_pass  "pull origin feature/test"        "git pull origin feature/test"
+
+printf "\nProtected branch push cases (11):\n"
+# (a) main 明示 refspec → block
+expect_block_protected "push origin main"                       "git push origin main"
+# (b) stg 系部分一致 (3 variant) → block
+expect_block_protected "push origin stg"                        "git push origin stg"
+expect_block_protected "push -u origin release/stg-prod"        "git push -u origin release/stg-prod"
+expect_block_protected "push origin feat:refs/heads/stg-v1"     "git push origin feat:refs/heads/stg-v1"
+# (c) feature branch は通過 → pass (protected layer 単体検証、destructive bypass で干渉排除)
+expect_pass_protected  "push origin feature/test"               "git push origin feature/test"
+# (d) --force-with-lease origin main は destructive layer + protected layer の
+#     二重 guard で block (destructive bypass 状態で protected layer の block 動作検証、
+#     iteration 2 追加、security-reviewer MEDIUM 指摘起源)
+expect_block_protected "push --force-with-lease origin main"    "git push --force-with-lease origin main"
+# (e) ECC_ALLOW_PROTECTED_BRANCH_PUSH=0 明示でも block 維持
+#     (= "1" 比較の防御深度検証、iteration 2 追加、security-reviewer MEDIUM 指摘起源)
+expect_block_with_explicit_bypass_zero "push origin main with ECC=0 (bypass must not activate)" "git push origin main"
+# --- iteration 3: R5 security-reviewer HIGH F-01 / F-02 解消 (task-39 Step2 iter1) ---
+# (f) HEAD:main symbolic refspec → block
+#     git-deny.sh L86-95: dst_part=main → dst_basename=main → protected branch 一致
+expect_block_protected "push origin HEAD:main"                  "git push origin HEAD:main"
+# (g) HEAD:refs/heads/main (fully-qualified refspec variant) → block
+#     dst_part=refs/heads/main → basename strip → main 一致
+expect_block_protected "push origin HEAD:refs/heads/main"       "git push origin HEAD:refs/heads/main"
+# (h) +main forced update refspec → block
+#     git-deny.sh L93: dst_basename="${dst_basename#+}" で + 除去後 main 一致
+expect_block_protected "push origin +main"                      "git push origin +main"
+# (i) +HEAD:main 複合 (forced symbolic refspec) → block
+#     + 除去 → HEAD:main → dst_part=main → main 一致
+expect_block_protected "push origin +HEAD:main"                 "git push origin +HEAD:main"
+
+printf "\nBypass cases (4):\n"
+expect_bypass_pass "push --force bypass"       "git push --force"
+expect_bypass_pass "reset --hard bypass"       "git reset --hard"
+expect_bypass_pass "clean -fdx bypass"         "git clean -fdx"
+# (f) ECC_ALLOW_PROTECTED_BRANCH_PUSH=1 + main → pass (bypass)
+expect_bypass_pass_protected "push origin main with bypass" "git push origin main"
+
+TOTAL=$((PASS + FAIL))
+printf "\n===== Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+if [ "$FAIL" -gt 0 ]; then
+  printf "\nFailed cases:\n"
+  for c in "${FAILED_CASES[@]}"; do
+    printf "  - %s\n" "$c"
+  done
+  exit 1
+fi
+exit 0

package/.claude/tests/delegation-guard-readonly-filter-smoke.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+# delegation-guard-readonly-filter-smoke.sh — task-68 Step 5 (§A 強化)
+# (delegation-guard splitter 誤検知修正、read-only filter whitelist 追加).
+#
+# 設計起源:
+#   - docs/draft/harness-design-fundamental-review.md §3.4 (delegation-guard splitter
+#     の改行/pipe 誤検知修正、C4 対処)。
+#   - user 報告: main の Bash を pipe (`| head`, `| tail`, `| wc`) で segment 分割 →
+#     各 segment を whitelist 照合する現実装が、pipe 先の read-only filter を whitelist
+#     不在で誤 BLOCK していた (本見直しセッション中だけで複数回発火)。
+#
+# 対象:
+#   .claude/bash-whitelist.txt の PATH-RESTRICTED セクションに追加した read-only filter:
+#     ^head( |$) / ^tail( |$) / ^wc( |$) / ^sort( |$) / ^uniq( |$)
+#     ^nl( |$) / ^cut( |$) / ^tr( |$) / ^column( |$)
+#   申請: .claude/bash-whitelist-requests/2026-06-01-readonly-filters.md
+#
+# 検証範囲:
+#   A. whitelist pass (pipe 先 read-only filter): 旧 BLOCK → PASS になる新挙動 (7 件)
+#   B. read-only filter 単体 / 非保護 path pass (13 件): 既存 8 件 + nl/tr/cut/column pipe/stdin 5 件
+#   C1. 危険 git deny 不変 (destructive + pipe filter) (3 件)
+#   C2. protected branch push deny 不変 (pipe filter 付き) (3 件: stg-preview 追加)
+#   C3. read-only filter で保護パス inspect → path-leak block 不変 (6 件: tr/cut 追加)
+#      ※ C3 は「保護パスへの直接 wc/head 等」と「tr/cut < src/ リダイレクト」両ケースで
+#        [サブエージェント委譲ルール] が維持されることを確認する。
+#   C4. 副作用系コマンドは whitelist 未追加で依然 BLOCK (委譲ルール) (6 件: sed/awk 追加)
+#   C5. --force-with-lease boundary (2 件): feat と main 両方 [git destructive guard] でBLOCK
+#
+# 重要制約:
+#   - file-top に `set -euo pipefail` を書かない (caller leak 防止教訓
+#     feedback_set_e_in_sourced_libs)
+#   - subagent 短絡を避けるため CLAUDE_HARNESS_ROLE を明示的に unset する。
+#
+# 実行:
+#   bash .claude/tests/delegation-guard-readonly-filter-smoke.sh
+#   cd /tmp && bash <repo_root>/.claude/tests/delegation-guard-readonly-filter-smoke.sh
+#
+# 終了コード:
+#   0 = 全 case PASS / 1 = 1 件以上 FAIL
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+HOOK="$REPO_ROOT/.claude/hooks/delegation-guard.sh"
+
+# [code HIGH-1] cwd 非依存化: hook の HC_BASH_WHITELIST_PATH=.claude/bash-whitelist.txt を
+# 解決するため、最初の test case 実行前に REPO_ROOT へ cd する。別 dir 実行時の false FAIL 解消。
+cd "$REPO_ROOT" || exit 1
+
+# subagent 短絡経路を確実に閉じる (main agent 文脈で hook を起動するため)
+unset CLAUDE_HARNESS_ROLE
+unset ECC_ALLOW_DESTRUCTIVE_GIT
+unset ECC_ALLOW_PROTECTED_BRANCH_PUSH
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+json_input() {
+  local cmd="$1"
+  CMD="$cmd" python3 -c '
+import json, os
+print(json.dumps({"tool_input": {"command": os.environ["CMD"]}}))
+'
+}
+
+extract_decision() {
+  # stderr を捨てて stdout のみ parse (config-loader WARN 等の混入を防ぐ)
+  OUT_TEXT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT_TEXT"])
+    print(d.get("decision", "none"))
+except Exception:
+    print("parse_error")
+' 2>/dev/null
+}
+
+extract_reason() {
+  OUT_TEXT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT_TEXT"])
+    print(d.get("reason", ""))
+except Exception:
+    print("")
+' 2>/dev/null
+}
+
+# pass 期待: decision != "block" ({} or allow JSON)
+# stdout のみを取得 (2>/dev/null で config-loader WARN を除去)
+expect_pass() {
+  local label="$1"
+  local cmd="$2"
+  local out decision
+  out=$(json_input "$cmd" | bash "$HOOK" Bash 2>/dev/null)
+  decision=$(extract_decision "$out")
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    cmd: %s\n    out: %s\n" "$label" "$cmd" "$out"
+  fi
+}
+
+# block 期待: decision="block" + reason が指定 marker を含むこと
+expect_block_marker() {
+  local label="$1"
+  local cmd="$2"
+  local marker="$3"
+  local out decision reason
+  out=$(json_input "$cmd" | bash "$HOOK" Bash 2>/dev/null)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -qF "$marker"; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision, marker='$marker')")
+    printf "  FAIL: %s\n    cmd: %s\n    decision: %s\n    out: %s\n" "$label" "$cmd" "$decision" "$out"
+  fi
+}
+
+printf "===== delegation-guard-readonly-filter-smoke (task-68 Step 5 §A) =====\n\n"
+
+printf "A. pipe 先 read-only filter pass (旧 BLOCK → PASS、誤検知修正) (7):\n"
+expect_pass "git push feature | tail -5"   "git push origin feat/x | tail -5"
+expect_pass "git log | wc -l"              "git log --oneline | wc -l"
+expect_pass "git log | head"               "git log | head"
+expect_pass "git diff | head -20"          "git diff | head -20"
+expect_pass "ls | sort | uniq"             "ls | sort | uniq"
+expect_pass "git status | wc -l"           "git status | wc -l"
+expect_pass "git log | head | tail"        "git log | head -5 | tail -2"
+
+# [qa HIGH-1] 残り 4 コマンド nl/tr/cut/column の pipe 後段 + head 単体
+printf "\nB. read-only filter 単体 / 非保護 path pass (13):\n"
+expect_pass "head -20 docs/x.md"           "head -20 docs/x.md"
+expect_pass "tail -5 docs/x.md"            "tail -5 docs/x.md"
+expect_pass "wc -l docs/x.md"             "wc -l docs/x.md"
+expect_pass "sort docs/x.md"              "sort docs/x.md"
+expect_pass "uniq docs/x.md"              "uniq docs/x.md"
+expect_pass "nl docs/x.md"               "nl docs/x.md"
+expect_pass "cut -d: -f1 docs/x.md"       "cut -d: -f1 docs/x.md"
+expect_pass "column -t docs/x.md"         "column -t docs/x.md"
+expect_pass "head stdin (no path)"         "head"
+expect_pass "git log --oneline | nl"       "git log --oneline | nl"
+expect_pass "git log --oneline | tr ':' '-'"  "git log --oneline | tr ':' '-'"
+expect_pass "git log --oneline | cut -d' ' -f1"  "git log --oneline | cut -d' ' -f1"
+expect_pass "git log --oneline | column -t"  "git log --oneline | column -t"
+
+printf "\nC1. 危険 git deny 不変 (destructive、pipe filter 付き) (3):\n"
+expect_block_marker "push --force | head"        "git push --force | head"        "[git destructive guard]"
+expect_block_marker "reset --hard | tail"        "git reset --hard | tail"        "[git destructive guard]"
+expect_block_marker "clean -fdx | wc -l"         "git clean -fdx | wc -l"         "[git destructive guard]"
+
+# [qa MED-5] stg-preview (stg 含み名) + pipe → protected branch push deny 維持
+printf "\nC2. protected branch push deny 不変 (pipe filter 付き) (3):\n"
+expect_block_marker "push origin main | tail"       "git push origin main | tail"       "[protected branch push deny]"
+expect_block_marker "push origin stg | head"        "git push origin stg | head"        "[protected branch push deny]"
+expect_block_marker "push origin stg-preview | head" "git push origin stg-preview | head" "[protected branch push deny]"
+
+# [qa MED-5 + security/test MED-1] 保護パス直接 inspect は path-leak でBLOCK維持。
+# wc/head/tail は non-protected path では pass (B セクション) だが、
+# src/ tests/ scripts/ を引数に取ると [サブエージェント委譲ルール] が発動する。
+# tr/cut の stdin リダイレクト (`< src/foo.ts`) も同様に path-leak で BLOCK。
+printf "\nC3. read-only filter で保護パス inspect → path-leak block 不変 (6):\n"
+expect_block_marker "head src/foo.ts"                 "head src/foo.ts"                "[サブエージェント委譲ルール]"
+expect_block_marker "tail -5 tests/x.sh"              "tail -5 tests/x.sh"             "[サブエージェント委譲ルール]"
+expect_block_marker "wc -l scripts/x.sh"              "wc -l scripts/x.sh"             "[サブエージェント委譲ルール]"
+expect_block_marker "cat .claude/x | head; wc src/y"  "cat .claude/x | head ; wc -l src/y" "[サブエージェント委譲ルール]"
+expect_block_marker "tr -d 'x' < src/foo.ts"          "tr -d 'x' < src/foo.ts"         "[サブエージェント委譲ルール]"
+expect_block_marker "cut -f1 scripts/install.sh"      "cut -f1 scripts/install.sh"     "[サブエージェント委譲ルール]"
+
+# [qa HIGH-2] C4 marker を `[Bash 委譲ルール] 未承認コマンド:` に具体化。
+# [qa MED-3] sed / awk (処理系 pipe) も BLOCK 維持を確認。
+printf "\nC4. 副作用系コマンドは whitelist 未追加で依然 BLOCK (委譲ルール) (6):\n"
+expect_block_marker "rm via pipe target"         "git log | rm -rf x"             "[Bash 委譲ルール] 未承認コマンド:"
+expect_block_marker "tee not whitelisted"        "git log | tee out.txt"          "[Bash 委譲ルール] 未承認コマンド:"
+expect_block_marker "xargs not whitelisted"      "git log | xargs rm"             "[Bash 委譲ルール] 未承認コマンド:"
+expect_block_marker "cat bare not whitelisted"   "git log | cat /etc/hosts"       "[Bash 委譲ルール] 未承認コマンド:"
+expect_block_marker "sed pipe (processing) block"  "git log | sed 's/x/y/'"       "[Bash 委譲ルール] 未承認コマンド:"
+expect_block_marker "awk pipe (processing) block"  "git log | awk '{print}'"      "[Bash 委譲ルール] 未承認コマンド:"
+
+# [test MED-2] --force-with-lease boundary:
+# 現行 hook は --force-with-lease も `push[[:space:]]+[^|;&]*--force` にマッチして
+# [git destructive guard] でBLOCK (feat/x も main も同一扱い)。
+# hook 本体無変更のため、実動作に合わせて両方 block として記録。
+printf "\nC5. --force-with-lease boundary (git destructive guard でBLOCK) (2):\n"
+expect_block_marker "force-with-lease feat/x | tail"  "git push --force-with-lease origin feat/x | tail"  "[git destructive guard]"
+expect_block_marker "force-with-lease main | tail"    "git push --force-with-lease origin main | tail"    "[git destructive guard]"
+
+TOTAL=$((PASS + FAIL))
+printf "\n===== Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+if [ "$FAIL" -gt 0 ]; then
+  printf "\nFailed cases:\n"
+  for c in "${FAILED_CASES[@]}"; do
+    printf "  - %s\n" "$c"
+  done
+  exit 1
+fi
+exit 0