phasegate 0.145.0 → 0.145.2

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.145.2] - 2026-05-11
+
+### Added
+
+- **WI-146 — structured install** — `phasegate install --dry-run|--apply [--force] [--json]` を追加し、既存設定を preserve しながら Claude / Codex hooks、Husky hooks、CI workflow、package scripts/devDependency、skills link、manifest entries を構造化 merge できるようにした。
+  - 既存カスタム hook は既定では拒否し、`--force` 時は `.phasegate/backups/` に退避してから managed block を適用する。
+
+## [0.145.1] - 2026-05-11
+
+### Fixed
+
+- **WI-145 post-publish dogfood** — `npx phasegate@0.145.0 init` 直後の `doctor` が `package-json-devdep-missing` で RED になる問題を修正した。
+  - `init` が `package.json` を作成または更新し、`devDependencies.phasegate` を現在の harness version で登録するようにした。
+
 ## [0.145.0] - 2026-05-11
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.145.0",
+  "version": "0.145.2",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",

package/scripts/harness/installation/application/ports/file-inspector-port.ts

@@ -2,10 +2,6 @@
 // @layer application
 // @work-item-id WI-145
 
-export interface FileInspectorPort {
-  exists(absolutePath: string): Promise<boolean>;
-  readText(absolutePath: string): Promise<string | null>;
-  readJson<T = unknown>(absolutePath: string): Promise<T | null>;
-  readSymlink(absolutePath: string): Promise<string | null>;
-  listFiles(absolutePath: string): Promise<string[]>;
-}
+import type { FileInspector } from "../../domain/ports/file-inspector.js";
+
+export type FileInspectorPort = FileInspector;

package/scripts/harness/installation/application/usecases/run-install.ts

@@ -0,0 +1,433 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-146
+
+import { mkdir, readFile, writeFile, copyFile, chmod, access, lstat, readlink, symlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { DeploymentEntry } from "../../domain/deployment-entry.js";
+import { DeploymentManifest } from "../../domain/deployment-manifest.js";
+import type { ManagedBlockInput } from "../../domain/managed-block.js";
+import type { RepairMode } from "../../domain/repair-mode.js";
+import type { ManifestRepositoryPort } from "../ports/manifest-repository-port.js";
+import type { HashCalculatorPort } from "../ports/hash-calculator-port.js";
+
+type InstallAction = "missing" | "will-merge" | "will-skip" | "will-overwrite";
+type StrategyType = "json" | "shell" | "yaml-add" | "package-json";
+
+export interface InstallPlanItem {
+  readonly path: string;
+  readonly action: InstallAction;
+  readonly repairMode: RepairMode;
+  readonly strategy: StrategyType;
+  readonly changed: boolean;
+  readonly summary: string;
+  readonly diff: string;
+  readonly skillHint: string | null;
+}
+
+export interface RunInstallInput {
+  readonly projectRoot: string;
+  readonly harnessRoot: string;
+  readonly phasegateVersion: string;
+  readonly dryRun: boolean;
+  readonly apply: boolean;
+  readonly force: boolean;
+  readonly includeClaude?: boolean;
+  readonly includeCodex?: boolean;
+  readonly includeHusky?: boolean;
+  readonly includeCi?: boolean;
+}
+
+export interface RunInstallResult {
+  readonly plan: readonly InstallPlanItem[];
+  readonly refused: readonly InstallPlanItem[];
+  readonly changed: readonly InstallPlanItem[];
+  readonly backupDir: string | null;
+}
+
+interface InstallTarget {
+  readonly path: string;
+  readonly strategy: StrategyType;
+  readonly templatePath: string;
+  readonly executable?: boolean;
+  readonly block?: ManagedBlockInput;
+}
+
+const SKILL_HINT = "invoke /phasegate-config-doctor";
+const PHASEGATE_SCRIPT_VERSION = "^0.0.0";
+
+const SHELL_BEGIN = "# === phasegate managed (BEGIN) ===";
+const SHELL_END = "# === phasegate managed (END) ===";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+async function exists(path: string): Promise<boolean> {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function readTextOrNull(path: string): Promise<string | null> {
+  try {
+    return await readFile(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function normalizeJsonEntry(value: unknown): string {
+  return JSON.stringify(value);
+}
+
+function mergeHookArrays(existing: unknown, incoming: unknown): unknown[] {
+  const result = Array.isArray(existing) ? [...existing] : [];
+  const seen = new Set(result.map((entry) => normalizeJsonEntry(entry)));
+  for (const entry of Array.isArray(incoming) ? incoming : []) {
+    const key = normalizeJsonEntry(entry);
+    if (!seen.has(key)) {
+      result.push(entry);
+      seen.add(key);
+    }
+  }
+  return result;
+}
+
+function mergeJsonObject(existing: Record<string, unknown>, incoming: Record<string, unknown>): Record<string, unknown> {
+  const result: Record<string, unknown> = { ...existing };
+  const existingHooks = isRecord(existing.hooks) ? existing.hooks : {};
+  const incomingHooks = isRecord(incoming.hooks) ? incoming.hooks : {};
+  result.hooks = { ...existingHooks };
+  for (const [event, incomingEntries] of Object.entries(incomingHooks)) {
+    (result.hooks as Record<string, unknown>)[event] = mergeHookArrays(existingHooks[event], incomingEntries);
+  }
+
+  const existingPermissions = isRecord(existing.permissions) ? existing.permissions : {};
+  const incomingPermissions = isRecord(incoming.permissions) ? incoming.permissions : {};
+  if (Object.keys(incomingPermissions).length > 0 || Object.keys(existingPermissions).length > 0) {
+    const deny = [
+      ...(Array.isArray(existingPermissions.deny) ? existingPermissions.deny : []),
+      ...(Array.isArray(incomingPermissions.deny) ? incomingPermissions.deny : []),
+    ];
+    result.permissions = {
+      ...existingPermissions,
+      ...incomingPermissions,
+      deny: [...new Set(deny)],
+    };
+  }
+  return result;
+}
+
+function mergeShell(existing: string | null, incoming: string): string {
+  if (existing === incoming || existing === `${incoming.trim()}\n`) return existing;
+  const block = `${SHELL_BEGIN}\n${incoming.trim()}\n${SHELL_END}`;
+  if (existing === null || existing.trim().length === 0) return `${incoming.trim()}\n`;
+  const pattern = new RegExp(`${escapeRegExp(SHELL_BEGIN)}[\\s\\S]*?${escapeRegExp(SHELL_END)}`);
+  if (pattern.test(existing)) return existing.replace(pattern, block).replace(/\s*$/, "\n");
+  return `${existing.replace(/\s*$/, "\n\n")}${block}\n`;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function mergePackageJson(existing: Record<string, unknown>, version: string): Record<string, unknown> {
+  const devDependencies = isRecord(existing.devDependencies) ? existing.devDependencies : {};
+  const scripts = isRecord(existing.scripts) ? existing.scripts : {};
+  return {
+    ...existing,
+    scripts: {
+      ...scripts,
+      "phasegate:lint": scripts["phasegate:lint"] ?? "phasegate lint",
+      "phasegate:check-ready": scripts["phasegate:check-ready"] ?? "phasegate phasegate:check-ready",
+      "phasegate:doctor": scripts["phasegate:doctor"] ?? "phasegate doctor",
+    },
+    devDependencies: {
+      ...devDependencies,
+      phasegate: `^${version}`,
+    },
+  };
+}
+
+function hasCustomJson(content: string | null): boolean {
+  if (content === null) return false;
+  try {
+    const parsed = JSON.parse(content) as unknown;
+    if (!isRecord(parsed)) return true;
+    const withoutEmptyHooks = { ...parsed };
+    if (isRecord(withoutEmptyHooks.hooks) && Object.keys(withoutEmptyHooks.hooks).length === 0) delete withoutEmptyHooks.hooks;
+    return Object.keys(withoutEmptyHooks).length > 0;
+  } catch {
+    return true;
+  }
+}
+
+function shellRepairMode(content: string | null): RepairMode {
+  if (content === null || content.trim().length === 0 || content.includes(SHELL_BEGIN)) return "mechanical";
+  return "ai-assisted";
+}
+
+function jsonRepairMode(content: string | null): RepairMode {
+  if (content === null) return "mechanical";
+  try {
+    JSON.parse(content);
+  } catch {
+    return "manual";
+  }
+  return "mechanical";
+}
+
+export class RunInstallUseCase {
+  constructor(
+    private readonly manifestRepository: ManifestRepositoryPort,
+    private readonly hashCalculator: HashCalculatorPort,
+  ) {}
+
+  async execute(input: RunInstallInput): Promise<RunInstallResult> {
+    const includeClaude = input.includeClaude ?? true;
+    const includeCodex = input.includeCodex ?? true;
+    const includeHusky = input.includeHusky ?? true;
+    const includeCi = input.includeCi ?? true;
+    const targets = this.createTargets({ includeClaude, includeCodex, includeHusky, includeCi });
+    const existingManifest = await this.manifestRepository.load(input.projectRoot);
+    const baseManifest = existingManifest ?? DeploymentManifest.create(input.phasegateVersion);
+    let manifest = baseManifest;
+    const plan: InstallPlanItem[] = [];
+    const refused: InstallPlanItem[] = [];
+    const changed: InstallPlanItem[] = [];
+    const backupStamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let backupDir: string | null = null;
+
+    for (const target of targets) {
+      const absolutePath = join(input.projectRoot, target.path);
+      const before = await readTextOrNull(absolutePath);
+      const template = await readFile(join(input.harnessRoot, target.templatePath), "utf8");
+      const repairMode = this.repairMode(target, before);
+      const next = this.merge(target, before, template, input.phasegateVersion);
+      const didChange = before !== next;
+      const action = this.actionFor(before, didChange, input.force);
+      const item: InstallPlanItem = {
+        path: target.path,
+        action,
+        repairMode,
+        strategy: target.strategy,
+        changed: didChange,
+        summary: didChange ? `${target.path}: ${action}` : `${target.path}: already up to date`,
+        diff: this.diffSummary(before, next),
+        skillHint: repairMode === "ai-assisted" ? SKILL_HINT : null,
+      };
+      plan.push(item);
+
+      if (!input.apply || !didChange) continue;
+      if ((repairMode === "ai-assisted" || repairMode === "manual") && !input.force) {
+        refused.push(item);
+        continue;
+      }
+
+      if (before !== null && (input.force || before.includes(SHELL_BEGIN))) {
+        backupDir ??= join(input.projectRoot, ".phasegate", "backups", backupStamp);
+        await this.backup(input.projectRoot, target.path, backupDir);
+      }
+
+      await mkdir(dirname(absolutePath), { recursive: true });
+      await writeFile(absolutePath, next, "utf8");
+      if (target.executable) await chmod(absolutePath, 0o755);
+      changed.push(item);
+
+      const mode = before === null ? "created" : "merged";
+      const hash = this.hashCalculator.compute(next);
+      const existingEntry = baseManifest.findEntry(target.path);
+      if (existingEntry !== null && existingEntry.hash.equals(hash)) {
+        manifest = manifest.addEntry(existingEntry);
+      } else {
+        manifest = manifest.addEntry(
+          DeploymentEntry.create({
+            path: target.path,
+            mode,
+            block: mode === "merged" ? (target.block ?? this.managedBlockFor(target)) : null,
+            hash,
+            deployedAt: new Date().toISOString(),
+          }),
+        );
+      }
+    }
+
+    const linkPaths = [
+      ...(includeClaude ? [".claude/skills"] : []),
+      ...(includeCodex ? [".codex/skills"] : []),
+    ];
+    for (const linkPath of linkPaths) {
+      const item = await this.planSkillLink(input.projectRoot, linkPath);
+      plan.push(item);
+      if (!input.apply || !item.changed) continue;
+      await mkdir(join(input.projectRoot, "skills"), { recursive: true });
+      await mkdir(dirname(join(input.projectRoot, linkPath)), { recursive: true });
+      await symlink("../skills", join(input.projectRoot, linkPath), process.platform === "win32" ? "junction" : "dir");
+      changed.push(item);
+      const hash = this.hashCalculator.compute("../skills");
+      const existingEntry = baseManifest.findEntry(linkPath);
+      if (existingEntry !== null && existingEntry.hash.equals(hash)) {
+        manifest = manifest.addEntry(existingEntry);
+      } else {
+        manifest = manifest.addEntry(
+          DeploymentEntry.create({
+            path: linkPath,
+            mode: "symlink",
+            block: null,
+            hash,
+            deployedAt: new Date().toISOString(),
+          }),
+        );
+      }
+    }
+
+    if (input.apply && changed.length > 0) {
+      await this.manifestRepository.save(input.projectRoot, manifest);
+    }
+
+    return { plan, refused, changed, backupDir };
+  }
+
+  private createTargets(options: {
+    readonly includeClaude: boolean;
+    readonly includeCodex: boolean;
+    readonly includeHusky: boolean;
+    readonly includeCi: boolean;
+  }): readonly InstallTarget[] {
+    return [
+      ...(options.includeClaude
+        ? [{ path: ".claude/settings.json", strategy: "json" as const, templatePath: "templates/.claude/settings.json" }]
+        : []),
+      ...(options.includeCodex
+        ? [{ path: ".codex/hooks.json", strategy: "json" as const, templatePath: "templates/.codex/hooks.json" }]
+        : []),
+      ...(options.includeHusky
+        ? [
+            {
+              path: ".husky/pre-commit",
+              strategy: "shell" as const,
+              templatePath: "docs/templates/hooks/pre-commit",
+              executable: true,
+              block: { start: SHELL_BEGIN, end: SHELL_END, content: "phasegate pre-commit managed block" },
+            },
+            {
+              path: ".husky/commit-msg",
+              strategy: "shell" as const,
+              templatePath: "docs/templates/hooks/commit-msg",
+              executable: true,
+              block: { start: SHELL_BEGIN, end: SHELL_END, content: "phasegate commit-msg managed block" },
+            },
+            {
+              path: ".husky/pre-push",
+              strategy: "shell" as const,
+              templatePath: "docs/templates/hooks/pre-push",
+              executable: true,
+              block: { start: SHELL_BEGIN, end: SHELL_END, content: "phasegate pre-push managed block" },
+            },
+          ]
+        : []),
+      ...(options.includeCi
+        ? [
+            {
+              path: ".github/workflows/phasegate-aidlc-gate.yml",
+              strategy: "yaml-add" as const,
+              templatePath: "docs/templates/ci/aidlc-gate.yml",
+            },
+          ]
+        : []),
+      { path: "package.json", strategy: "package-json" as const, templatePath: "package.json" },
+    ];
+  }
+
+  private repairMode(target: InstallTarget, before: string | null): RepairMode {
+    if (target.strategy === "shell") return shellRepairMode(before);
+    if (target.strategy === "json") return jsonRepairMode(before);
+    return "mechanical";
+  }
+
+  private actionFor(before: string | null, changed: boolean, force: boolean): InstallAction {
+    if (!changed) return "will-skip";
+    if (before === null) return "missing";
+    return force ? "will-overwrite" : "will-merge";
+  }
+
+  private merge(target: InstallTarget, before: string | null, template: string, version: string): string {
+    if (target.strategy === "yaml-add") return before ?? template;
+    if (target.strategy === "shell") return mergeShell(before, template);
+    if (target.strategy === "package-json") {
+      const existing = before === null ? {} : (JSON.parse(before) as unknown);
+      const merged = mergePackageJson(isRecord(existing) ? existing : {}, version || PHASEGATE_SCRIPT_VERSION);
+      return `${JSON.stringify(merged, null, 2)}\n`;
+    }
+    const existing = before === null ? {} : (JSON.parse(before) as unknown);
+    const incoming = JSON.parse(template) as unknown;
+    const merged = mergeJsonObject(isRecord(existing) ? existing : {}, isRecord(incoming) ? incoming : {});
+    return `${JSON.stringify(merged, null, 2)}\n`;
+  }
+
+  private async backup(projectRoot: string, relativePath: string, backupDir: string): Promise<void> {
+    const source = join(projectRoot, relativePath);
+    const target = join(backupDir, relativePath);
+    if (!(await exists(source))) return;
+    await mkdir(dirname(target), { recursive: true });
+    await copyFile(source, target);
+  }
+
+  private managedBlockFor(target: InstallTarget): ManagedBlockInput {
+    return {
+      start: "phasegate structured merge",
+      end: "phasegate structured merge",
+      content: `${target.strategy}:${target.path}`,
+    };
+  }
+
+  private async planSkillLink(projectRoot: string, relativePath: string): Promise<InstallPlanItem> {
+    const absolutePath = join(projectRoot, relativePath);
+    try {
+      const stat = await lstat(absolutePath);
+      if (stat.isSymbolicLink() && (await readlink(absolutePath)) === "../skills") {
+        return {
+          path: relativePath,
+          action: "will-skip",
+          repairMode: "mechanical",
+          strategy: "yaml-add",
+          changed: false,
+          summary: `${relativePath}: already linked`,
+          diff: "no changes",
+          skillHint: null,
+        };
+      }
+      return {
+        path: relativePath,
+        action: "will-merge",
+        repairMode: "manual",
+        strategy: "yaml-add",
+        changed: false,
+        summary: `${relativePath}: existing non-phasegate path requires manual review`,
+        diff: "manual review required",
+        skillHint: null,
+      };
+    } catch {
+      return {
+        path: relativePath,
+        action: "missing",
+        repairMode: "mechanical",
+        strategy: "yaml-add",
+        changed: true,
+        summary: `${relativePath}: create symlink`,
+        diff: "+ symlink ../skills",
+        skillHint: null,
+      };
+    }
+  }
+
+  private diffSummary(before: string | null, next: string): string {
+    if (before === next) return "no changes";
+    if (before === null) return `+ ${next.split(/\r?\n/).filter(Boolean).length} lines`;
+    return `~ ${before.length} bytes -> ${next.length} bytes`;
+  }
+}

package/scripts/harness/installation/composition-root.ts

@@ -11,14 +11,29 @@ import { HuskyCommitMsgMissingCheck } from "./application/checks/husky-commit-ms
 import { HuskyPreCommitMissingCheck } from "./application/checks/husky-pre-commit-missing-check.js";
 import { HuskyPrePushMissingCheck } from "./application/checks/husky-pre-push-missing-check.js";
 import { PackageJsonDevdepMissingCheck } from "./application/checks/package-json-devdep-missing-check.js";
+import { RunInstallUseCase } from "./application/usecases/run-install.js";
 import { RunDoctorDiagnosticsUseCase } from "./application/usecases/run-doctor-diagnostics.js";
+import type { MergeStrategy } from "./domain/ports/merge-strategy.js";
+import type { ReconcileStrategy } from "./domain/ports/reconcile-strategy.js";
+import type { UninstallReverseStrategy } from "./domain/ports/uninstall-reverse-strategy.js";
 import { FileSystemManifestRepositoryAdapter } from "./infrastructure/adapters/file-system-manifest-repository-adapter.js";
+import { NodeCryptoHashAdapter } from "./infrastructure/adapters/node-crypto-hash-adapter.js";
 import { NodeFsFileInspectorAdapter } from "./infrastructure/adapters/node-fs-file-inspector-adapter.js";
 import { DoctorHandler } from "./presentation/cli/doctor-handler.js";
+import { InstallHandler } from "./presentation/cli/install-handler.js";
+
+type FutureInstallationStrategyPorts = {
+  readonly merge?: MergeStrategy<unknown>;
+  readonly uninstall?: UninstallReverseStrategy;
+  readonly reconcile?: ReconcileStrategy;
+};
+
+const futureInstallationStrategyPorts: FutureInstallationStrategyPorts = {};
 
 export function createInstallationModule() {
   const inspector = new NodeFsFileInspectorAdapter();
   const manifestRepository = new FileSystemManifestRepositoryAdapter();
+  const hashCalculator = new NodeCryptoHashAdapter();
   const checks = [
     new ClaudeHookMissingCheck(),
     new CodexHookMissingCheck(),
@@ -31,9 +46,13 @@ export function createInstallationModule() {
     new CodexSkillsSymlinkCheck(),
   ];
   const runDoctorDiagnosticsUseCase = new RunDoctorDiagnosticsUseCase(checks, inspector, manifestRepository);
+  const runInstallUseCase = new RunInstallUseCase(manifestRepository, hashCalculator);
   return {
     manifestRepository,
     runDoctorDiagnosticsUseCase,
+    runInstallUseCase,
     doctorHandler: new DoctorHandler(runDoctorDiagnosticsUseCase),
+    installHandler: new InstallHandler(runInstallUseCase),
+    futureInstallationStrategyPorts,
   };
 }

package/scripts/harness/installation/domain/ports/file-inspector.ts

@@ -0,0 +1,11 @@
+// @unit installation
+// @layer domain
+// @work-item-id WI-146
+
+export interface FileInspector {
+  exists(absolutePath: string): Promise<boolean>;
+  readText(absolutePath: string): Promise<string | null>;
+  readJson<T = unknown>(absolutePath: string): Promise<T | null>;
+  readSymlink(absolutePath: string): Promise<string | null>;
+  listFiles(absolutePath: string): Promise<string[]>;
+}

package/scripts/harness/installation/domain/ports/heuristic-check.ts

@@ -2,11 +2,11 @@
 // @layer domain
 // @work-item-id WI-145
 
-import type { FileInspectorPort } from "../../application/ports/file-inspector-port.js";
 import type { CheckId } from "../check-id.js";
 import type { DiagnosticFinding } from "../diagnostic-finding.js";
+import type { FileInspector } from "./file-inspector.js";
 
 export interface HeuristicCheck {
   readonly checkId: CheckId;
-  run(projectRoot: string, inspector: FileInspectorPort): Promise<DiagnosticFinding | null>;
+  run(projectRoot: string, inspector: FileInspector): Promise<DiagnosticFinding | null>;
 }

package/scripts/harness/installation/presentation/cli/install-handler.ts

@@ -0,0 +1,50 @@
+// @unit installation
+// @layer presentation
+// @work-item-id WI-146
+
+import type { RunInstallUseCase } from "../../application/usecases/run-install.js";
+
+export interface InstallHandlerInput {
+  readonly projectRoot: string;
+  readonly harnessRoot: string;
+  readonly phasegateVersion: string;
+  readonly dryRun: boolean;
+  readonly apply: boolean;
+  readonly force: boolean;
+  readonly json: boolean;
+}
+
+export interface InstallHandlerResult {
+  readonly stdout: string;
+  readonly exitCode: number;
+}
+
+export class InstallHandler {
+  constructor(private readonly useCase: RunInstallUseCase) {}
+
+  async execute(input: InstallHandlerInput): Promise<InstallHandlerResult> {
+    const result = await this.useCase.execute(input);
+    if (input.json) {
+      return {
+        stdout: JSON.stringify(result, null, 2),
+        exitCode: result.refused.length > 0 ? 1 : 0,
+      };
+    }
+    const lines = [
+      input.apply ? "phasegate install apply" : "phasegate install dry-run",
+      ...result.plan.map((item) => {
+        const hint = item.skillHint ? `; hint: ${item.skillHint}` : "";
+        return `- ${item.path}: ${item.action} (${item.repairMode}, ${item.strategy}); diff: ${item.diff}${hint}`;
+      }),
+    ];
+    if (result.backupDir !== null) lines.push(`backups: ${result.backupDir}`);
+    if (result.refused.length > 0) {
+      lines.push("");
+      lines.push("Refused ai-assisted/manual targets. Re-run with --force after reviewing the hint.");
+    }
+    return {
+      stdout: lines.join("\n"),
+      exitCode: result.refused.length > 0 ? 1 : 0,
+    };
+  }
+}

package/scripts/harness/main.ts

@@ -8,7 +8,7 @@
  * 起動時に config-foundation で設定を解決し、他Unit に注入する（Cross-unit wiring）。
  */
 
-import { access, readFile as fsReadFile, readlink as fsReadlink } from "node:fs/promises";
+import { access, readFile as fsReadFile, readlink as fsReadlink, writeFile as fsWriteFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { createAdrFoundationModule } from "./adr-foundation/composition-root.js";
 import { createBiomeAstEngineModule } from "./biome-ast-engine/composition-root.js";
@@ -87,6 +87,60 @@ async function pathExists(path: string): Promise<boolean> {
   }
 }
 
+interface PackageJsonDocument {
+  readonly [key: string]: unknown;
+  readonly dependencies?: unknown;
+  readonly devDependencies?: unknown;
+}
+
+interface PackageDependencyResult {
+  readonly created: boolean;
+  readonly updated: boolean;
+  readonly alreadyPresent: boolean;
+  readonly skipped: boolean;
+}
+
+function isJsonRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+async function ensurePhasegatePackageDependency(rootDir: string, version: string): Promise<PackageDependencyResult> {
+  const packageJsonPath = join(rootDir, "package.json");
+  let pkg: PackageJsonDocument = {};
+  let created = false;
+
+  try {
+    const raw = await fsReadFile(packageJsonPath, "utf-8");
+    const parsed = JSON.parse(raw) as unknown;
+    if (!isJsonRecord(parsed)) {
+      return { created: false, updated: false, alreadyPresent: false, skipped: true };
+    }
+    pkg = parsed;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+      return { created: false, updated: false, alreadyPresent: false, skipped: true };
+    }
+    created = true;
+  }
+
+  if (
+    (isJsonRecord(pkg.devDependencies) && pkg.devDependencies.phasegate !== undefined) ||
+    (isJsonRecord(pkg.dependencies) && pkg.dependencies.phasegate !== undefined)
+  ) {
+    return { created: false, updated: false, alreadyPresent: true, skipped: false };
+  }
+
+  pkg = {
+    ...pkg,
+    devDependencies: {
+      ...(isJsonRecord(pkg.devDependencies) ? pkg.devDependencies : {}),
+      phasegate: `^${version}`,
+    },
+  };
+  await fsWriteFile(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
+  return { created, updated: !created, alreadyPresent: false, skipped: false };
+}
+
 function printUsage(): void {
   const usage = `
 Usage: phasegate <command> [options]
@@ -97,7 +151,7 @@ Setup:
                                 --skills <core|all>, --agent <claude|codex|both>, --with-husky, --with-ci, --yes)
   update-skills                Re-deploy skills from current harness version
   doctor                       Diagnose silent installation failures (--json, --strict, --report-out <path>)
-  install                      Install phasegate managed files (stub until WI-146)
+  install                      Install phasegate managed files (--dry-run|--apply, --force)
   uninstall                    Uninstall phasegate managed files (stub until WI-147)
   reconcile                    Reconcile phasegate managed files (stub until WI-148)
 
@@ -317,6 +371,16 @@ Options:
   --skills <core|all>             Skill set to deploy
   --agent <claude|codex|both>     Agent integration target
   --help, -h                      Show this help`,
+  install: `Usage: phasegate install [options]
+
+Install phasegate managed files with structured merge.
+
+Options:
+  --dry-run                       Preview target actions without writing (default)
+  --apply                         Write merge results and manifest
+  --force                         Force ai-assisted/manual targets after backing up existing files
+  --json                          Output machine-readable JSON
+  --help, -h                      Show this help`,
   validate: `Usage: phasegate validate [options]
 
 Run validators against the project. Without --layer, runs all enabled validator layers (L2/L3/L4).
@@ -741,6 +805,7 @@ async function main(): Promise<void> {
         const deployClaude = agent === "claude" || agent === "both";
         const deployCodex = agent === "codex" || agent === "both";
         const result = await deploySkills(harnessRoot, rootDir, skillSet);
+        const packageResult = await ensurePhasegatePackageDependency(rootDir, result.version);
         const skillLinkResult = await deployAgentSkillLinks(rootDir, {
           claude: deployClaude,
           codex: deployCodex,
@@ -770,6 +835,7 @@ async function main(): Promise<void> {
             contentForHash: `${result.version}:${skill}`,
           })),
           await createFileManifestRecord(rootDir, join("skills", ".harness-version")),
+          packageResult.created || packageResult.updated ? await createFileManifestRecord(rootDir, "package.json") : null,
           configResult.created ? await createFileManifestRecord(rootDir, "phasegate.config.json") : null,
           hooksResult.settingsCreated ? await createFileManifestRecord(rootDir, join(".claude", "settings.json")) : null,
           hooksResult.hookConfigGenerated
@@ -784,9 +850,39 @@ async function main(): Promise<void> {
           huskyPrePushResult?.created ? await createFileManifestRecord(rootDir, join(".husky", "pre-push")) : null,
           ...(ciWorkflowResult?.copiedFiles.map((path) => createFileManifestRecord(rootDir, path)) ?? []),
         ]);
+        const installModule = createInstallationModule();
+        const installResult = await installModule.runInstallUseCase.execute({
+          projectRoot: rootDir,
+          harnessRoot,
+          phasegateVersion: result.version,
+          dryRun: false,
+          apply: true,
+          force: false,
+          includeClaude: deployClaude,
+          includeCodex: deployCodex,
+          includeHusky: withHusky,
+          includeCi: withCi,
+        });
         console.log(
           `✓ Skills deployed to ${result.targetDir} (${result.deployedSkills.length} skills, set: ${skillSet})`,
         );
+        if (installResult.changed.length > 0) {
+          console.log(`✓ phasegate install structured merge applied (${installResult.changed.length} targets)`);
+        }
+        if (installResult.refused.length > 0) {
+          console.log(
+            `  phasegate install refused ${installResult.refused.length} ai-assisted/manual targets; run phasegate install --dry-run for details`,
+          );
+        }
+        if (packageResult.created) {
+          console.log(`✓ package.json created with phasegate devDependency`);
+        } else if (packageResult.updated) {
+          console.log(`✓ package.json updated with phasegate devDependency`);
+        } else if (packageResult.alreadyPresent) {
+          console.log(`  package.json already declares phasegate, skipped`);
+        } else if (packageResult.skipped) {
+          console.log(`  package.json could not be updated, skipped`);
+        }
         if (configResult.created) {
           console.log(`✓ phasegate.config.json created`);
         } else {
@@ -947,8 +1043,27 @@ async function main(): Promise<void> {
       }
 
       case "install": {
-        console.error("Not yet implemented: phasegate install is owned by WI-146");
-        process.exit(2);
+        const KNOWN_INSTALL_FLAGS = ["--dry-run", "--apply", "--force", "--json"];
+        const flagError = validateKnownFlags(args, KNOWN_INSTALL_FLAGS);
+        if (flagError) {
+          console.error(flagError);
+          process.exit(2);
+        }
+        const apply = hasFlag(args, "--apply");
+        const dryRun = hasFlag(args, "--dry-run") || !apply;
+        const mod = createInstallationModule();
+        const phasegateVersion = await getHarnessVersion(harnessRoot);
+        const result = await mod.installHandler.execute({
+          projectRoot: rootDir,
+          harnessRoot,
+          phasegateVersion,
+          dryRun,
+          apply,
+          force: hasFlag(args, "--force"),
+          json,
+        });
+        console.log(result.stdout);
+        process.exit(result.exitCode);
         break;
       }