@takuma-hirai/hirai-method 0.1.0

package/.claude/tests/gateguard-smoke.sh

@@ -0,0 +1,213 @@
+#!/usr/bin/env bash
+# gateguard-smoke.sh — task-22 W3 smoke for gateguard.sh (F1 事前ゲート)
+#
+# 設計起源:
+#   docs/draft/hook-reliability-uplift.md W3
+#
+# 対象 hook:
+#   .claude/hooks/gateguard.sh
+#
+# 検証範囲 (5 ケース):
+#   Case 1: 初回 Edit (cleared state 不在) → BLOCK + 事実材料要求 reason
+#   Case 2: 同 file 2 回目 Edit (cleared marker 存在) → PASS
+#   Case 3: 破壊的 Bash (rm -rf) 初回 → BLOCK + rollback/影響範囲/逐語要求
+#   Case 4: ECC_GATEGUARD=off で初回 Edit → PASS (素通し)
+#   Case 5: 除外 path (CLAUDE.md) への Edit → PASS (hook hardcoded exclusion)
+#
+# 重要制約:
+#   - file-top に set -euo pipefail を書かない (feedback_set_e_in_sourced_libs 教訓)
+#   - state_dir は独立した /tmp/ 配下に隔離して既存 state を汚染しない
+#   - subagent 短絡を避けるため CLAUDE_HARNESS_ROLE をクリア
+#
+# 実行:
+#   bash .claude/tests/gateguard-smoke.sh
+#
+# 終了コード:
+#   0 = 5/5 PASS / 1 = 1 件以上 FAIL
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+HOOK="$REPO_ROOT/.claude/hooks/gateguard.sh"
+
+# clean main agent context
+unset CLAUDE_HARNESS_ROLE
+unset ECC_GATEGUARD
+unset ECC_F1_OFF
+
+# 独立 state_dir (既存 .gateguard-state を触らない)
+TMP_STATE_DIR="$(mktemp -d /tmp/gateguard-smoke-state.XXXXXX)"
+trap 'rm -rf "$TMP_STATE_DIR"' EXIT
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+# Edit JSON 入力を組み立てる
+json_edit_input() {
+  local fp="$1"
+  FP="$fp" python3 -c '
+import json, os
+print(json.dumps({"tool_name": "Edit", "tool_input": {"file_path": os.environ["FP"]}}))
+'
+}
+
+# Bash JSON 入力を組み立てる
+json_bash_input() {
+  local cmd="$1"
+  CMD="$cmd" python3 -c '
+import json, os
+print(json.dumps({"tool_name": "Bash", "tool_input": {"command": os.environ["CMD"]}}))
+'
+}
+
+# stdout (1 行 JSON) から decision フィールド抽出
+extract_decision() {
+  OUT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT"])
+    print(d.get("decision", "none"))
+except Exception:
+    print("parse_error")
+' 2>/dev/null
+}
+
+# stdout から reason 文字列抽出
+extract_reason() {
+  OUT="$1" python3 -c '
+import os, json
+try:
+    d = json.loads(os.environ["OUT"])
+    print(d.get("reason", ""))
+except Exception:
+    print("")
+' 2>/dev/null
+}
+
+# === Case 1: 初回 Edit → BLOCK ===
+case1_initial_edit_blocked() {
+  local label="Case 1: initial Edit (no cleared state) → BLOCK"
+  local fp="/tmp/gateguard-smoke-case1.ts"
+  local out decision reason
+  out=$(json_edit_input "$fp" | HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Edit 2>/dev/null)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -q "GateGuard"; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    decision: %s\n    out: %s\n" "$label" "$decision" "$out"
+  fi
+}
+
+# === Case 2: 2 回目 Edit (cleared marker あり) → PASS ===
+case2_cleared_edit_pass() {
+  local label="Case 2: 2nd Edit (cleared marker exists) → PASS"
+  local fp="/tmp/gateguard-smoke-case2.ts"
+  local out decision
+
+  # 1 回目で marker 作成 (BLOCK)
+  json_edit_input "$fp" | HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Edit >/dev/null 2>&1
+
+  # 2 回目 — marker 存在で PASS 期待
+  out=$(json_edit_input "$fp" | HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Edit 2>/dev/null)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    decision: %s\n    out: %s\n" "$label" "$decision" "$out"
+  fi
+}
+
+# === Case 3: 破壊的 Bash (rm -rf) 初回 → BLOCK ===
+case3_destructive_bash_blocked() {
+  local label="Case 3: initial 'rm -rf' destructive bash → BLOCK"
+  local cmd="rm -rf /tmp/gateguard-smoke-fake-target-$$"
+  local out decision reason
+  out=$(json_bash_input "$cmd" | HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Bash 2>/dev/null)
+  decision=$(extract_decision "$out")
+  reason=$(extract_reason "$out")
+
+  if [ "$decision" = "block" ] && printf '%s' "$reason" | grep -q "destructive"; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    decision: %s\n    out: %s\n" "$label" "$decision" "$out"
+  fi
+}
+
+# === Case 4: ECC_GATEGUARD=off で初回 Edit → PASS ===
+case4_bypass_env_pass() {
+  local label="Case 4: ECC_GATEGUARD=off bypass on initial Edit → PASS"
+  local fp="/tmp/gateguard-smoke-case4.ts"
+  local out decision
+  out=$(json_edit_input "$fp" | ECC_GATEGUARD=off HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Edit 2>/dev/null)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    decision: %s\n    out: %s\n" "$label" "$decision" "$out"
+  fi
+}
+
+# === Case 5: 除外 path (CLAUDE.md) への Edit → PASS ===
+# hook 内 hardcoded exclusion: */CLAUDE.md|*/README.md|*/.gitignore|*/.env.example etc.
+case5_excluded_path_pass() {
+  local label="Case 5: excluded path (CLAUDE.md) Edit → PASS"
+  # hook が `*/CLAUDE.md` glob で除外判定するため、parent dir を実体として持たせる
+  local tmpdir
+  tmpdir=$(mktemp -d /tmp/gateguard-smoke-case5.XXXXXX)
+  local fp="${tmpdir}/CLAUDE.md"
+  local out decision
+  out=$(json_edit_input "$fp" | HC_GATEGUARD_STATE_DIR="$TMP_STATE_DIR" bash "$HOOK" Edit 2>/dev/null)
+  decision=$(extract_decision "$out")
+
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (decision=$decision)")
+    printf "  FAIL: %s\n    decision: %s\n    out: %s\n" "$label" "$decision" "$out"
+  fi
+}
+
+printf "===== gateguard-smoke (task-22 W3.1, 5 cases) =====\n\n"
+
+case1_initial_edit_blocked
+case2_cleared_edit_pass
+case3_destructive_bash_blocked
+case4_bypass_env_pass
+case5_excluded_path_pass
+
+TOTAL=$((PASS + FAIL))
+printf "\n===== Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+
+if [ "$FAIL" -gt 0 ]; then
+  printf "Failed cases:\n"
+  for c in "${FAILED_CASES[@]}"; do
+    printf "  - %s\n" "$c"
+  done
+  printf "\nsummary: %d/%d PASS\n" "$PASS" "$TOTAL"
+  exit 1
+fi
+
+printf "\nsummary: %d/%d PASS\n" "$PASS" "$TOTAL"
+exit 0

package/.claude/tests/git-deny-mainline-policy-smoke.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# git-deny-mainline-policy-smoke.sh — task-77 Step 2 unit smoke for the
+# policy-aware 3-tier protected branch push judgement in
+# .claude/hooks/lib/delegation-guard/git-deny.sh (check_protected_branch_push).
+#
+# 設計 SSoT: docs/draft/git-integration-policy.md §3.3 (3 tier) / Step 7 smoke matrix (push 系 cell)。
+#
+# 検証形式:
+#   git-deny.sh を source して check_protected_branch_push を直接呼び出す unit 形式。
+#   block 時は関数が `exit 0` で {"decision":"block"} を stdout に出すため、各 assert は
+#   subshell ( ... ) で実行して exit を局所化し、stdout を decision で判定する。
+#
+# 3 tier (mainline=${HC_MAINLINE_BRANCH:-main} / policy=${HC_MAINLINE_INTEGRATION_POLICY:-pr-required}):
+#   Tier 1 (常時 block): stg* / release/* / main (main != mainline の時のみ)
+#   Tier 2 (policy): mainline push は policy=local-merge-push の時のみ allow、他は block (fail-safe pr-required)
+#   Tier 3 (素通し): feature branch 等
+#
+# 重要制約:
+#   - file-top に `set -euo pipefail` を書かない (caller leak 防止教訓 feedback_set_e_in_sourced_libs)。
+#   - current-branch fallback 経路は git stub で HEAD を制御する。
+#
+# honor-system / smoke 境界 (draft §3.4 H-3 / qa M2):
+#   本 smoke が検証するのは git-deny.sh の **hook 実行パス = push 判定 (block/allow)** のみ。
+#   merge 実施有無 (pr-required で本流 merge しない / local-merge(-push) で merge する) と
+#   mainline 存在確認 (P1/P2 behavioral + 存在 cell) は **merge が hook 非 gate (push のみ gate) の
+#   設計判断 H-3 により honor-system で統治** され、finish-task.md Phase 4.5 / resume-state.md Phase 6
+#   の norm 手順がカバーする。push-gate smoke (本 file) が hook 強制部分をカバーし、merge-commit
+#   behavioral と存在確認は norm-smoke 境界 (qa M2 と同じ) で smoke 直接対象外。
+#
+# 実行: bash .claude/tests/git-deny-mainline-policy-smoke.sh
+# 終了コード: 0 = 全 case PASS / 1 = 1 件以上 FAIL
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+GIT_DENY="$REPO_ROOT/.claude/hooks/lib/delegation-guard/git-deny.sh"
+
+# subagent 短絡無関係 (本 smoke は git-deny.sh を直接 source する)
+unset CLAUDE_HARNESS_ROLE
+unset ECC_ALLOW_PROTECTED_BRANCH_PUSH
+unset ECC_ALLOW_DESTRUCTIVE_GIT
+
+# stub 用 dir を PATH 先頭に置き、current-branch fallback の `git rev-parse` を制御する。
+STUB_DIR="$(mktemp -d)"
+cleanup() { rm -rf "$STUB_DIR"; }
+trap cleanup EXIT
+
+# git stub: `git rev-parse --abbrev-ref HEAD` で STUB_CURRENT_BRANCH を返す。
+# それ以外の git は本物に委譲する (本 smoke では rev-parse 以外不要だが安全のため)。
+cat > "$STUB_DIR/git" <<'STUB'
+#!/usr/bin/env bash
+if [ "$1" = "rev-parse" ] && [ "$2" = "--abbrev-ref" ] && [ "$3" = "HEAD" ]; then
+  printf '%s\n' "${STUB_CURRENT_BRANCH:-main}"
+  exit 0
+fi
+exec /usr/bin/git "$@"
+STUB
+chmod +x "$STUB_DIR/git"
+export PATH="$STUB_DIR:$PATH"
+
+# shellcheck source=../hooks/lib/delegation-guard/git-deny.sh
+source "$GIT_DENY"
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+# check_protected_branch_push を呼び、stdout の decision を返す。
+# 引数: $1 = mainline ("" = 未設定/unset) / $2 = policy ("" = unset) /
+#       $3 = cmd / $4 = current_branch (refspec 省略経路用、default main)。
+# block 時に関数が `exit 0` するため、$( ... ) の command substitution subshell で
+# 局所化する (本体 shell は exit しない)。env もこの subshell 内でのみ設定/unset する。
+run_check() {
+  local mainline="$1" policy="$2" cmd="$3" curbr="${4:-main}"
+  local out
+  out=$(
+    if [ -n "$mainline" ]; then export HC_MAINLINE_BRANCH="$mainline"; else unset HC_MAINLINE_BRANCH; fi
+    if [ -n "$policy" ]; then export HC_MAINLINE_INTEGRATION_POLICY="$policy"; else unset HC_MAINLINE_INTEGRATION_POLICY; fi
+    export STUB_CURRENT_BRANCH="$curbr"
+    check_protected_branch_push "$cmd" 2>/dev/null
+  )
+  printf '%s' "$out" | python3 -c '
+import sys, json
+try:
+    d = json.loads(sys.stdin.read())
+    print(d.get("decision", "none"))
+except Exception:
+    print("none")
+' 2>/dev/null
+}
+
+# block 期待: $1=label $2=mainline $3=policy $4=cmd [$5=current_branch]
+expect_block() {
+  local label="$1" decision
+  decision=$(run_check "$2" "$3" "$4" "${5:-main}")
+  if [ "$decision" = "block" ]; then
+    PASS=$((PASS + 1)); printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1)); FAILED_CASES+=("$label (decision=$decision, want=block)")
+    printf "  FAIL: %s (decision=%s, want=block)\n" "$label" "$decision"
+  fi
+}
+
+# allow / 素通し期待 (decision != block): $1=label $2=mainline $3=policy $4=cmd [$5=current_branch]
+expect_allow() {
+  local label="$1" decision
+  decision=$(run_check "$2" "$3" "$4" "${5:-main}")
+  if [ "$decision" != "block" ]; then
+    PASS=$((PASS + 1)); printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1)); FAILED_CASES+=("$label (decision=$decision, want=allow)")
+    printf "  FAIL: %s (decision=%s, want=allow)\n" "$label" "$decision"
+  fi
+}
+
+printf "===== git-deny-mainline-policy-smoke (task-77 Step 2) =====\n\n"
+
+# expect_block / expect_allow 引数: label / mainline ("" = unset) / policy ("" = unset) / cmd [/ current_branch]
+
+# --- 回帰: mainline 未設定 / default、main 保護維持 ---
+printf "Regression (default fallback, main protected):\n"
+# 回帰1: env unset (default) + policy 未設定 → main block
+expect_block "回帰1: default (env unset) → push origin main block" \
+  "" "" "git push origin main"
+# 回帰2: HC_MAINLINE_BRANCH=main + policy=pr-required → main block
+expect_block "回帰2: mainline=main + pr-required → push origin main block" \
+  "main" "pr-required" "git push origin main"
+
+# --- Tier 2: mainline policy 連動 ---
+printf "\nTier 2 (mainline policy):\n"
+# P2: policy=local-merge → mainline push block
+expect_block "P2: mainline=main + local-merge → push origin main block" \
+  "main" "local-merge" "git push origin main"
+# P3: policy=local-merge-push → mainline (=main) push allow (明示 refspec)
+expect_allow "P3: mainline=main + local-merge-push → push origin main allow (explicit refspec)" \
+  "main" "local-merge-push" "git push origin main"
+# P3: refspec 省略経路 (current branch=main) → allow
+expect_allow "P3: mainline=main + local-merge-push → push (no refspec, current=main) allow" \
+  "main" "local-merge-push" "git push" "main"
+# P1: refspec 省略 + policy=pr-required + current=mainline(main) → block
+# (block 側 refspec-omit 経路の網羅、architect H4。現状 allow 側両経路 + Tier3 のみ検証で
+#  block 側の refspec 省略経路が未検証だった)
+expect_block "P1: mainline=main + pr-required → push (no refspec, current=main) block" \
+  "main" "pr-required" "git push" "main"
+
+# --- Tier 1: stg* 常時 block (3 policy) ---
+printf "\nTier 1 (stg* always block, all 3 policies):\n"
+expect_block "stg×pr-required: push origin stg-x block" \
+  "main" "pr-required" "git push origin stg-x"
+expect_block "stg×local-merge: push origin stg-x block" \
+  "main" "local-merge" "git push origin stg-x"
+expect_block "stg×local-merge-push: push origin stg-x block (policy must not leak)" \
+  "main" "local-merge-push" "git push origin stg-x"
+
+# --- Tier 1: release/* 常時 block (新 arm、3 policy) ---
+printf "\nTier 1 (release/* always block, new arm, all 3 policies):\n"
+expect_block "rel×pr-required: push origin release/v1.0 block" \
+  "main" "pr-required" "git push origin release/v1.0"
+expect_block "rel×local-merge: push origin release/v1.0 block" \
+  "main" "local-merge" "git push origin release/v1.0"
+expect_block "rel×local-merge-push: push origin release/v1.0 block (policy must not leak)" \
+  "main" "local-merge-push" "git push origin release/v1.0"
+
+# --- 追従: mainline=develop ---
+printf "\nMainline follow (mainline=develop):\n"
+# develop push は policy 連動で allow (local-merge-push)
+expect_allow "追従: mainline=develop + local-merge-push → push origin develop allow" \
+  "develop" "local-merge-push" "git push origin develop"
+# develop だが policy=local-merge → block (Tier2 fail-safe)
+expect_block "追従: mainline=develop + local-merge → push origin develop block" \
+  "develop" "local-merge" "git push origin develop"
+# main は mainline=develop でも Tier1 常時 block (mainline 移動で main 無保護化しない)
+expect_block "追従: mainline=develop + local-merge-push → push origin main 常時 block (Tier1)" \
+  "develop" "local-merge-push" "git push origin main"
+# 追従 refspec 省略経路: current=develop + local-merge-push → allow
+expect_allow "追従: mainline=develop + local-merge-push → push (no refspec, current=develop) allow" \
+  "develop" "local-merge-push" "git push" "develop"
+
+# --- 不正値: fail-safe pr-required ---
+printf "\nInvalid policy (fail-safe pr-required):\n"
+expect_block "不正値: policy=yolo → mainline push block (fail-safe)" \
+  "main" "yolo" "git push origin main"
+
+# --- Tier 3: feature branch 素通し (回帰、task-39 緩和維持) ---
+printf "\nTier 3 (feature branch passthrough, task-39 緩和維持):\n"
+expect_allow "Tier3: push origin feature/test allow" \
+  "main" "pr-required" "git push origin feature/test"
+expect_allow "Tier3: push -u origin feat/task-77-x allow" \
+  "main" "pr-required" "git push -u origin feat/task-77-x"
+# Tier3 refspec 省略経路: current=feature branch → allow
+expect_allow "Tier3: push (no refspec, current=feat/task-77-x) allow" \
+  "main" "pr-required" "git push" "feat/task-77-x"
+
+# --- 2-guard: autonomous-action-guard が git push 系 pattern を持たないことを直接確認 ---
+# (qa H1 / sec L-1 / architect H4) git-deny.sh が唯一の push gate であることの片側確認。
+# 「block / allow が pass する」ではなく「autonomous-action-guard の DEFAULT_PATTERNS に
+#  `git push` を捕捉する regex が存在しない」ことを source 後の変数 grep で直接 assert する
+# (task-39 緩和で削除済の回帰防止)。
+printf "\n2-guard (autonomous-action-guard has no git push pattern):\n"
+AAG="$REPO_ROOT/.claude/hooks/autonomous-action-guard.sh"
+# DEFAULT_PATTERNS だけを取り出す (hook 全体を実行せず変数定義行群を抽出)。
+# 'DEFAULT_PATTERNS=' 開始の single-quote heredoc-like 複数行代入を sed で切り出し。
+AAG_PATTERNS="$(sed -n "/^DEFAULT_PATTERNS=/,/'$/p" "$AAG")"
+# `git ... push` を捕捉する regex 行が無いことを確認 (`git tag ... origin` は push でなく tag、別物)。
+if printf '%s' "$AAG_PATTERNS" | grep -Eq 'git\[\[:space:\]\]\+push'; then
+  FAIL=$((FAIL + 1)); FAILED_CASES+=("2-guard: autonomous-action-guard に git push pattern が存在する (want=不在)")
+  printf "  FAIL: 2-guard: autonomous-action-guard に git push pattern が存在 (want=不在)\n"
+else
+  PASS=$((PASS + 1)); printf "  PASS: 2-guard: autonomous-action-guard に git push pattern が不在 (git-deny が唯一の push gate)\n"
+fi
+
+TOTAL=$((PASS + FAIL))
+printf "\n===== Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+if [ "$FAIL" -gt 0 ]; then
+  printf "\nFailed cases:\n"
+  for c in "${FAILED_CASES[@]}"; do
+    printf "  - %s\n" "$c"
+  done
+  exit 1
+fi
+exit 0