phasegate 0.16.0 → 0.32.0

package/scripts/harness/agent-integration/domain/services/bash-write-target-extractor.ts

@@ -0,0 +1,258 @@
+/**
+ * @layer domain
+ * @unit agent-integration
+ *
+ * BashWriteTargetExtractor ドメインサービス
+ *
+ * Bash コマンド文字列を静的解析し、書き込み対象となるファイルパスを抽出する。
+ * Phase Gate フックが Bash 経由のファイル書き込みを検知して保護するための基盤。
+ *
+ * 副作用なし・純粋関数相当。対応パターンは以下:
+ *   - リダイレクト `>` / `>>`
+ *   - heredoc (`<<EOF > path`)
+ *   - `tee` / `tee -a`
+ *   - `sed -i` / `sed -i ''` (BSD)
+ *   - `cp` / `mv` (宛先のみ)
+ *   - `touch`
+ *   - 複合コマンド (`&&`, `;`, `||`) とパイプ (`|`) 分割
+ *   - ダブル/シングルクォート対応
+ */
+
+/** 引数トークン (値とクォート種別) */
+type Token = {
+  readonly value: string;
+  readonly quoted: 'none' | 'single' | 'double';
+};
+
+/** シェル風の簡易トークナイザ。クォート境界を尊重する。 */
+function tokenize(input: string): Token[] {
+  const tokens: Token[] = [];
+  let i = 0;
+  const len = input.length;
+
+  while (i < len) {
+    const ch = input[i];
+
+    // 空白スキップ
+    if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+      i += 1;
+      continue;
+    }
+
+    // 演算子をそのままトークン化
+    if (ch === '>' || ch === '<' || ch === '|' || ch === ';' || ch === '&') {
+      let op = ch;
+      if (i + 1 < len && input[i + 1] === ch && (ch === '>' || ch === '<' || ch === '|' || ch === '&')) {
+        op = ch + ch;
+        i += 2;
+      } else {
+        i += 1;
+      }
+      tokens.push({ value: op, quoted: 'none' });
+      continue;
+    }
+
+    // ダブルクォート
+    if (ch === '"') {
+      let buf = '';
+      i += 1;
+      while (i < len && input[i] !== '"') {
+        if (input[i] === '\\' && i + 1 < len) {
+          buf += input[i + 1];
+          i += 2;
+        } else {
+          buf += input[i];
+          i += 1;
+        }
+      }
+      i += 1; // closing quote
+      tokens.push({ value: buf, quoted: 'double' });
+      continue;
+    }
+
+    // シングルクォート
+    if (ch === "'") {
+      let buf = '';
+      i += 1;
+      while (i < len && input[i] !== "'") {
+        buf += input[i];
+        i += 1;
+      }
+      i += 1; // closing quote
+      tokens.push({ value: buf, quoted: 'single' });
+      continue;
+    }
+
+    // 通常トークン
+    let buf = '';
+    while (i < len) {
+      const c = input[i];
+      if (c === ' ' || c === '\t' || c === '\n' || c === '\r') break;
+      if (c === '>' || c === '<' || c === '|' || c === ';' || c === '&') break;
+      if (c === '"' || c === "'") break;
+      buf += c;
+      i += 1;
+    }
+    if (buf.length > 0) {
+      tokens.push({ value: buf, quoted: 'none' });
+    }
+  }
+
+  return tokens;
+}
+
+const OPERATOR_SEPARATORS = new Set(['&&', '||', ';', '|']);
+
+/** トークン列を複合・パイプ境界で分割 */
+function splitByOperators(tokens: Token[]): Token[][] {
+  const groups: Token[][] = [];
+  let current: Token[] = [];
+  for (const t of tokens) {
+    if (t.quoted === 'none' && OPERATOR_SEPARATORS.has(t.value)) {
+      if (current.length > 0) {
+        groups.push(current);
+        current = [];
+      }
+      continue;
+    }
+    current.push(t);
+  }
+  if (current.length > 0) groups.push(current);
+  return groups;
+}
+
+/** コマンドグループ先頭の環境変数代入 (`FOO=bar`) をスキップして実コマンドを返す */
+function getCommandName(tokens: Token[]): string | undefined {
+  for (const t of tokens) {
+    if (t.quoted === 'none' && /^[A-Za-z_][A-Za-z0-9_]*=/.test(t.value)) continue;
+    return t.value;
+  }
+  return undefined;
+}
+
+/**
+ * 1 コマンド分のトークン列から書き込み先を抽出する。
+ * リダイレクト先はコマンド種別によらず検出する (全コマンド共通)。
+ */
+function extractFromSingleCommand(tokens: Token[]): string[] {
+  const results: string[] = [];
+
+  // 1) リダイレクト `>` / `>>` の右辺 (heredoc の `>` もこのパスで拾える)
+  for (let i = 0; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t.quoted === 'none' && (t.value === '>' || t.value === '>>')) {
+      const next = tokens[i + 1];
+      if (next !== undefined) {
+        results.push(next.value);
+      }
+    }
+  }
+
+  const cmd = getCommandName(tokens);
+  if (cmd === undefined) return results;
+
+  // コマンド別の特殊処理
+  const baseName = cmd.split('/').pop() ?? cmd;
+
+  if (baseName === 'tee') {
+    // `tee [-a] FILE...`
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '|' || t.value === '<')) break;
+      results.push(t.value);
+    }
+  } else if (baseName === 'sed') {
+    // `sed -i [''] SCRIPT FILE` — `-i` の直後の空文字列 (BSD) はバックアップ拡張子
+    const argTokens = tokens.slice(1);
+    let inPlace = false;
+    let skipBackupExt = false;
+    const positionals: Token[] = [];
+    for (let i = 0; i < argTokens.length; i += 1) {
+      const t = argTokens[i];
+      if (t.quoted === 'none' && t.value === '-i') {
+        inPlace = true;
+        skipBackupExt = true;
+        continue;
+      }
+      if (t.quoted === 'none' && t.value.startsWith('-i')) {
+        // -iBAK
+        inPlace = true;
+        continue;
+      }
+      if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+      if (skipBackupExt && t.quoted !== 'none' && t.value === '') {
+        // BSD `sed -i ''` — 空文字はバックアップ拡張子扱いで無視
+        skipBackupExt = false;
+        continue;
+      }
+      skipBackupExt = false;
+      positionals.push(t);
+    }
+    if (inPlace && positionals.length >= 2) {
+      // 先頭はスクリプト、残りはファイル
+      for (let i = 1; i < positionals.length; i += 1) {
+        results.push(positionals[i].value);
+      }
+    }
+  } else if (baseName === 'cp' || baseName === 'mv') {
+    // 宛先は最後の非オプション引数
+    const positionals: Token[] = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '|' || t.value === '<')) break;
+      positionals.push(t);
+    }
+    if (positionals.length >= 2) {
+      results.push(positionals[positionals.length - 1].value);
+    }
+  } else if (baseName === 'touch') {
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t.quoted === 'none' && t.value.startsWith('-')) continue;
+      if (t.quoted === 'none' && (t.value === '>' || t.value === '>>' || t.value === '|' || t.value === '<')) break;
+      results.push(t.value);
+    }
+  }
+
+  return results;
+}
+
+export class BashWriteTargetExtractor {
+  /**
+   * Bash コマンド文字列から書き込み先ファイルパスを抽出する。
+   * 副作用なし、純粋関数相当。
+   *
+   * @param command Bash コマンド文字列
+   * @returns 書き込み先ファイルパスの配列 (重複除去済み・入力順)
+   */
+  extract(command: string): readonly string[] {
+    if (typeof command !== 'string' || command.length === 0) {
+      return Object.freeze([]);
+    }
+
+    const tokens = tokenize(command);
+    const groups = splitByOperators(tokens);
+
+    const collected: string[] = [];
+    for (const group of groups) {
+      const found = extractFromSingleCommand(group);
+      for (const path of found) {
+        collected.push(path);
+      }
+    }
+
+    // 重複除去 (挿入順保持)
+    const seen = new Set<string>();
+    const unique: string[] = [];
+    for (const p of collected) {
+      if (p.length === 0) continue;
+      if (seen.has(p)) continue;
+      seen.add(p);
+      unique.push(p);
+    }
+
+    return Object.freeze(unique);
+  }
+}

package/scripts/harness/agent-integration/domain/services/hook-to-cli-translator.ts

@@ -169,7 +169,7 @@ export class AsyncHookToCliTranslator {
     hasCommand(commandName: string): Promise<boolean>;
   };
   private readonly phaseGateQueryPort: {
-    checkGate(scope: WriteTargetScope): Promise<{
+    checkGate(scope: WriteTargetScope, targetFilePath?: string): Promise<{
       hasPassed(): boolean;
       getBlockers(): readonly string[];
       getWarnings(): readonly string[];
@@ -181,7 +181,7 @@ export class AsyncHookToCliTranslator {
     reentryGuard: ReentryGuard;
     cliCommandRegistryPort: { hasCommand(commandName: string): Promise<boolean> };
     phaseGateQueryPort?: {
-      checkGate(scope: WriteTargetScope): Promise<{
+      checkGate(scope: WriteTargetScope, targetFilePath?: string): Promise<{
         hasPassed(): boolean;
         getBlockers(): readonly string[];
         getWarnings(): readonly string[];
@@ -222,7 +222,11 @@ export class AsyncHookToCliTranslator {
   private async translatePreToolUse(event: PreToolUseEvent): Promise<HookTranslationResult> {
     // Step 1: Protected file check (applies to all tools)
     const additionalPatterns = await this.configQueryPort.getProtectedFilePatterns();
-    const protectedFileList = ProtectedFileList.createWithAdditional(additionalPatterns);
+    const exclusions = await this.configQueryPort.getProtectedFileExclusions();
+    const protectedFileList = ProtectedFileList.createWithAdditionalAndExclusions(
+      additionalPatterns,
+      exclusions,
+    );
 
     const blockedPath = event.targetFilePaths.find((fp) => protectedFileList.matches(fp));
     if (blockedPath !== undefined) {
@@ -256,7 +260,20 @@ export class AsyncHookToCliTranslator {
       });
     }
 
-    const phaseGateResult = await this.phaseGateQueryPort.checkGate(detectedScope);
+    // Step 3: Check if phase gate is relaxed via quickMode.relaxedGates
+    const relaxedGates = await this.configQueryPort.getRelaxedGates();
+    if (relaxedGates.includes('phase-gate')) {
+      return HookTranslationResult.create({
+        shouldBlock: false,
+        cliArgs: [],
+        expectedExitCode: 0,
+      });
+    }
+
+    const phaseGateResult = await this.phaseGateQueryPort.checkGate(
+      detectedScope,
+      event.targetFilePaths[0],
+    );
     if (!phaseGateResult.hasPassed()) {
       return HookTranslationResult.block({
         reason: 'PHASE_GATE',

package/scripts/harness/agent-integration/domain/value-objects/protected-file-list.ts

@@ -69,6 +69,26 @@ export class ProtectedFileList {
     return new ProtectedFileList(allPatterns);
   }
 
+  static createWithExclusions(exclusions: string[]): ProtectedFileList {
+    const filtered = DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
+    if (filtered.length === 0) {
+      return new ProtectedFileList([...DEFAULT_PATTERNS]);
+    }
+    return new ProtectedFileList(filtered);
+  }
+
+  static createWithAdditionalAndExclusions(
+    additionalPatterns: string[],
+    exclusions: string[],
+  ): ProtectedFileList {
+    const base = DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
+    const allPatterns = [...base, ...additionalPatterns];
+    if (allPatterns.length === 0) {
+      return new ProtectedFileList([...DEFAULT_PATTERNS]);
+    }
+    return new ProtectedFileList(allPatterns);
+  }
+
   matches(filePath: string): boolean {
     if (filePath === '') return false;
     return this.patterns.some((pattern) => {

package/scripts/harness/agent-integration/domain/value-objects/story-reflection-query-result.ts

@@ -0,0 +1,63 @@
+// @unit agent-integration
+// @layer domain
+
+export class StoryReflectionQueryResultInvariantError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'StoryReflectionQueryResultInvariantError';
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+export class StoryReflectionQueryResult {
+  readonly passed: boolean;
+  readonly blockers: readonly string[];
+  readonly warnings: readonly string[];
+  readonly skipped: boolean;
+
+  private constructor(
+    passed: boolean,
+    blockers: readonly string[],
+    warnings: readonly string[],
+    skipped: boolean,
+  ) {
+    this.passed = passed;
+    this.blockers = Object.freeze([...blockers]);
+    this.warnings = Object.freeze([...warnings]);
+    this.skipped = skipped;
+  }
+
+  static pass(): StoryReflectionQueryResult {
+    return new StoryReflectionQueryResult(true, [], [], false);
+  }
+
+  static skipped(warnings: string[] = []): StoryReflectionQueryResult {
+    return new StoryReflectionQueryResult(true, [], warnings, true);
+  }
+
+  static block(blockers: string[], warnings: string[]): StoryReflectionQueryResult {
+    if (blockers.length === 0) {
+      throw new StoryReflectionQueryResultInvariantError(
+        'passed=falseの場合、blockersは1件以上必要です',
+      );
+    }
+
+    return new StoryReflectionQueryResult(false, blockers, warnings, false);
+  }
+
+  hasPassed(): boolean {
+    return this.passed;
+  }
+
+  getBlockers(): readonly string[] {
+    return this.blockers;
+  }
+
+  getWarnings(): readonly string[] {
+    return this.warnings;
+  }
+
+  isSkipped(): boolean {
+    return this.skipped;
+  }
+}

package/scripts/harness/agent-integration/infrastructure/adapters/file-system-story-reflection-query-adapter.ts

@@ -0,0 +1,122 @@
+// @unit agent-integration
+// @layer infrastructure
+/**
+ * FileSystemStoryReflectionQueryAdapter
+ *
+ * agent-integration ドメインの `StoryReflectionQueryPort` を、
+ * phase-dependency-model 側の CheckStoryReflectionUseCase +
+ * FileSystemStoryReflectionAdapter + HarnessConfigPhaseConfigProvider を
+ * オーケストレートして実装するアダプタ。
+ *
+ * 役割:
+ *   1. phasegate.config.json を読み込み、PhaseConfigSection へ正規化
+ *   2. HarnessConfigPhaseConfigProvider 経由で storyReflection 設定を解決
+ *   3. StoryReflectionChecker + FileSystemStoryReflectionAdapter 経由で
+ *      inception → product の @story-id 反映を検証
+ *   4. 結果を agent-integration の StoryReflectionQueryResult に写像
+ *
+ * 例外: 設定ファイルが存在しない/読めない場合は "skipped" を返し、
+ *       hook 全体をブロックしない（Fail-safe）。
+ */
+
+import { readFile } from 'node:fs/promises';
+
+import type { StoryReflectionQueryPort } from '../../domain/ports/story-reflection-query-port.js';
+import { StoryReflectionQueryResult } from '../../domain/value-objects/story-reflection-query-result.js';
+import { FileSystemStoryReflectionAdapter } from '../../../phase-dependency-model/infrastructure/filesystem/file-system-story-reflection-adapter.js';
+import { StoryReflectionChecker } from '../../../phase-dependency-model/domain/services/story-reflection-checker.js';
+import { CheckStoryReflectionUseCase } from '../../../phase-dependency-model/application/usecases/check-story-reflection-usecase.js';
+import {
+  HarnessConfigPhaseConfigProvider,
+  type PhaseConfigSection,
+  type PhasePresetInput,
+  type StoryReflectionSectionInput,
+} from '../../../phase-dependency-model/infrastructure/config/harness-config-phase-config-provider.js';
+import type { StoryReflectionResult } from '../../../phase-dependency-model/domain/values/story-reflection-result.js';
+
+export interface FileSystemStoryReflectionQueryAdapterDeps {
+  readonly rootDir: string;
+  readonly configPath: string;
+}
+
+interface RawPhaseDependenciesSection {
+  readonly preset?: PhasePresetInput;
+  readonly override?: boolean;
+  readonly storyReflection?: StoryReflectionSectionInput;
+}
+
+interface RawConfigDocument {
+  readonly phaseDependencies?: RawPhaseDependenciesSection;
+  readonly reporting?: { readonly outputDir?: string };
+}
+
+export class FileSystemStoryReflectionQueryAdapter
+  implements StoryReflectionQueryPort
+{
+  private readonly rootDir: string;
+  private readonly configPath: string;
+
+  constructor(deps: FileSystemStoryReflectionQueryAdapterDeps) {
+    this.rootDir = deps.rootDir;
+    this.configPath = deps.configPath;
+  }
+
+  async checkReflection(unitId: string): Promise<StoryReflectionQueryResult> {
+    let raw: RawConfigDocument;
+    try {
+      const content = await readFile(this.configPath, 'utf8');
+      raw = JSON.parse(content) as RawConfigDocument;
+    } catch {
+      // 設定が読めない場合は fail-safe で skipped 扱い
+      return StoryReflectionQueryResult.skipped();
+    }
+
+    const phaseConfigSection: PhaseConfigSection = {
+      customization: {
+        preset: raw.phaseDependencies?.preset,
+        overrideEnabled: raw.phaseDependencies?.override ?? false,
+      },
+      storyReflection: raw.phaseDependencies?.storyReflection,
+      reportingOutputDir: raw.reporting?.outputDir,
+    };
+
+    const provider = new HarnessConfigPhaseConfigProvider({
+      config: phaseConfigSection,
+      defaultOutputDir: raw.reporting?.outputDir ?? '.harness/reports',
+    });
+
+    const config = await provider.getStoryReflectionConfig();
+
+    if (!config.enabled) {
+      return StoryReflectionQueryResult.skipped();
+    }
+
+    const fsAdapter = new FileSystemStoryReflectionAdapter({ rootDir: this.rootDir });
+    const checker = new StoryReflectionChecker(fsAdapter);
+    const useCase = new CheckStoryReflectionUseCase({ checker });
+
+    const result = await useCase.execute({ unitId, config });
+
+    return FileSystemStoryReflectionQueryAdapter.mapResult(result);
+  }
+
+  private static mapResult(
+    result: StoryReflectionResult,
+  ): StoryReflectionQueryResult {
+    const warnings = result.warnings.map(
+      (w) =>
+        `${w.storyId}: ${w.productPath} に @story-id ${w.storyId} が未反映 (optional, inception: ${w.inceptionPath})`,
+    );
+
+    if (!result.isBlocked()) {
+      return StoryReflectionQueryResult.pass();
+    }
+
+    const blockers = result.violations.map(
+      (v) =>
+        `${v.productPath} に @story-id ${v.storyId} が反映されていません (inception: ${v.inceptionPath})`,
+    );
+
+    return StoryReflectionQueryResult.block(blockers, warnings);
+  }
+}

package/scripts/harness/agent-integration/infrastructure/adapters/harness-config-config-query-adapter.ts

@@ -31,9 +31,19 @@ interface HarnessesSection {
   deadCodeGC?: boolean;
 }
 
+interface ProtectedFilesSection {
+  exclude?: string[];
+}
+
+interface QuickModeSection {
+  relaxedGates?: string[];
+}
+
 interface HarnessConfigDocument {
   harnesses?: HarnessesSection;
   project?: ProjectSection;
+  protectedFiles?: ProtectedFilesSection;
+  quickMode?: QuickModeSection;
 }
 
 export class HarnessConfigConfigQueryAdapter implements ConfigQueryPort {
@@ -77,6 +87,16 @@ export class HarnessConfigConfigQueryAdapter implements ConfigQueryPort {
     return [];
   }
 
+  async getProtectedFileExclusions(): Promise<string[]> {
+    const config = this.loadConfig();
+    return config.protectedFiles?.exclude ?? [];
+  }
+
+  async getRelaxedGates(): Promise<readonly string[]> {
+    const config = this.loadConfig();
+    return config.quickMode?.relaxedGates ?? [];
+  }
+
   getProjectPaths(): ProjectPaths {
     const config = this.loadConfig();
     const paths = config.project?.paths;

package/scripts/harness/agent-integration/infrastructure/adapters/phase-gate-query-adapter.ts

@@ -4,16 +4,26 @@
 import type { PhaseGateQueryPort } from '../../domain/ports/phase-gate-query-port.js';
 import type { WriteTargetScope } from '../../domain/value-objects/write-target-scope.js';
 import { PhaseGateQueryResult } from '../../domain/value-objects/phase-gate-query-result.js';
+import { toPhaseConfigSection } from '../../../config-foundation/application/mappers/phase-config-section-mapper.js';
+import { createConfigFoundationModule } from '../../../config-foundation/composition-root.js';
+import { ConfigValidationError } from '../../../config-foundation/domain/errors/config-validation-error.js';
 
 export class PhaseGateQueryAdapter implements PhaseGateQueryPort {
-  async checkGate(scope: WriteTargetScope): Promise<PhaseGateQueryResult> {
+  async checkGate(scope: WriteTargetScope, targetFilePath?: string): Promise<PhaseGateQueryResult> {
     try {
+      const configModule = createConfigFoundationModule();
+      const resolvedConfig = await configModule.usecases.loadResolvedConfigUseCase.execute();
       const { createPhaseDependencyModelModule } = await import('../../../phase-dependency-model/composition-root.js');
-      const mod = createPhaseDependencyModelModule({ rootDir: process.cwd() });
+      const mod = createPhaseDependencyModelModule({
+        rootDir: process.cwd(),
+        phaseConfig: toPhaseConfigSection(resolvedConfig.config),
+        reportOutputDir: resolvedConfig.config.reporting.outputDir,
+      });
       const result = await mod.checkPhaseGateCommandHandler.execute({
         targetLevel: scope.level,
         unitId: scope.unitId,
         storyId: scope.storyId,
+        targetFilePath,
       });
 
       if (result.exitCode === 0) {
@@ -25,7 +35,11 @@ export class PhaseGateQueryAdapter implements PhaseGateQueryPort {
       }
 
       return PhaseGateQueryResult.create(true, [], ['phase gate check returned error']);
-    } catch {
+    } catch (error) {
+      if (error instanceof ConfigValidationError) {
+        return PhaseGateQueryResult.create(false, [error.message], []);
+      }
+
       return PhaseGateQueryResult.create(true, [], ['phase-dependency-model not available']);
     }
   }

package/scripts/harness/agent-integration/presentation/pre-tool-use-hook.ts

@@ -8,8 +8,10 @@
  */
 
 import { HandlePreToolUseUseCase } from '../application/usecases/handle-pre-tool-use-usecase.js';
+import { BashWriteTargetExtractor } from '../domain/services/bash-write-target-extractor.js';
 import { HarnessConfigConfigQueryAdapter } from '../infrastructure/adapters/harness-config-config-query-adapter.js';
 import { PhaseGateQueryAdapter } from '../infrastructure/adapters/phase-gate-query-adapter.js';
+import { FileSystemStoryReflectionQueryAdapter } from '../infrastructure/adapters/file-system-story-reflection-query-adapter.js';
 import * as path from 'node:path';
 import * as fs from 'node:fs/promises';
 
@@ -20,6 +22,7 @@ interface PreToolUseHookInput {
     path?: string;
     file_path?: string;
     paths?: string[];
+    command?: string;
     [key: string]: unknown;
   };
 }
@@ -91,13 +94,37 @@ async function main(): Promise<void> {
     targetFilePaths.push(...input.tool_input.paths.map(toRelative));
   }
 
+  // Bash 経由書き込みのフェーズゲート対応 (A-2.5)
+  // Bash command 文字列からリダイレクト・tee・sed -i・cp・mv・touch 等の
+  // 書き込み先ファイルパスを抽出し、フェーズゲートチェック対象に含める。
+  // Bash 書き込みを検出した場合、effectiveToolName を 'Write' に偽装して
+  // translator の WRITE_TOOLS チェックを通過させる（Bash のままではフェーズゲートが
+  // スキップされるため）。
+  let effectiveToolName = toolName;
+  if (toolName === 'Bash' && typeof input.tool_input?.command === 'string') {
+    const extractor = new BashWriteTargetExtractor();
+    const bashTargets = extractor.extract(input.tool_input.command);
+    if (bashTargets.length > 0) {
+      targetFilePaths.push(...bashTargets.map(toRelative));
+      effectiveToolName = 'Write';
+    }
+  }
+
   try {
     const configPath = await findConfigPath();
     const configQueryPort = new HarnessConfigConfigQueryAdapter(configPath);
     const phaseGateQueryPort = new PhaseGateQueryAdapter();
-    const useCase = new HandlePreToolUseUseCase({ configQueryPort, phaseGateQueryPort });
+    const storyReflectionQueryPort = new FileSystemStoryReflectionQueryAdapter({
+      rootDir: path.dirname(configPath),
+      configPath,
+    });
+    const useCase = new HandlePreToolUseUseCase({
+      configQueryPort,
+      phaseGateQueryPort,
+      storyReflectionQueryPort,
+    });
 
-    const output = await useCase.execute({ toolName, targetFilePaths });
+    const output = await useCase.execute({ toolName: effectiveToolName, targetFilePaths });
 
     if (output.shouldBlock) {
       const msg = output.error?.message