phasegate 0.315.0 → 0.340.0

package/scripts/harness/agent-integration/domain/value-objects/protected-file-list.ts

@@ -1,6 +1,7 @@
 /**
  * @layer domain
  * @unit agent-integration
+ * @work-item-id WI-390
  *
  * ProtectedFileList 値オブジェクト
  * 変更をブロックすべきファイルのパターンリスト
@@ -14,19 +15,42 @@ export class ProtectedFileListEmptyError extends Error {
   }
 }
 
-/** デフォルトの保護対象ファイルパターン */
-const DEFAULT_PATTERNS = [
+/**
+ * 設定から除外できない agent trust roots。
+ * これらを protectedFiles.exclude で解除できると、防御機構そのものを agent が
+ * 無効化してから書き換えられるため、通常の保護対象とは別の集合で保持する。
+ */
+const NON_EXCLUDABLE_PATTERNS = [
+  'phasegate.config.json',
+  '.phasegate-local/phasegate.config.json',
+  '**/phasegate.config.json',
+  // baseline.json は grandfather 判定の信頼基盤。手動追記による protected file の
+  // grandfather bypass を防ぐため、書き込み自体を保護対象とする。
+  '.phasegate/baseline.json',
+  '**/.phasegate/baseline.json',
+  // WI-363: .husky/ 配下は L0 runtime の実施点（pre-commit / commit-msg / pre-push）。
+  // WI-352 で config カテゴリに分類されるようになり Quick Mode の書き込み許可対象に
+  // 入ったため、防御機構そのものの書き換えを protected file として明示的に止める。
+  '.husky/**',
+  '**/.husky/**',
+  // Root agent instructions determine the permissions and operating procedure
+  // used by coding agents, so direct agent writes must remain blocked.
+  'CLAUDE.md',
+  'AGENTS.md',
+  'GEMINI.md',
+];
+
+/** 利用者設定で除外可能な通常のデフォルト保護対象。 */
+const EXCLUDABLE_DEFAULT_PATTERNS = [
   'biome.json',
   '.biome.json',
   'tsconfig.json',
   'package.json',
   'package-lock.json',
-  // baseline.json は grandfather 判定の信頼基盤。手動追記による protected file の
-  // grandfather bypass を防ぐため、書き込み自体を保護対象とする。
-  '.phasegate/baseline.json',
-  '**/.phasegate/baseline.json',
 ];
 
+const DEFAULT_PATTERNS = [...NON_EXCLUDABLE_PATTERNS, ...EXCLUDABLE_DEFAULT_PATTERNS];
+
 /**
  * glob パターンのシンプルなマッチング実装
  * micromatch なしで基本的な glob をサポート
@@ -74,23 +98,21 @@ export class ProtectedFileList {
   }
 
   static createWithExclusions(exclusions: string[]): ProtectedFileList {
-    const filtered = DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
-    if (filtered.length === 0) {
-      return new ProtectedFileList([...DEFAULT_PATTERNS]);
-    }
-    return new ProtectedFileList(filtered);
+    const excludable = EXCLUDABLE_DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
+    return new ProtectedFileList([...NON_EXCLUDABLE_PATTERNS, ...excludable]);
   }
 
   static createWithAdditionalAndExclusions(
     additionalPatterns: string[],
     exclusions: string[],
   ): ProtectedFileList {
-    const base = DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
-    const allPatterns = [...base, ...additionalPatterns];
-    if (allPatterns.length === 0) {
-      return new ProtectedFileList([...DEFAULT_PATTERNS]);
-    }
-    return new ProtectedFileList(allPatterns);
+    const excludableDefaults = EXCLUDABLE_DEFAULT_PATTERNS.filter((p) => !exclusions.includes(p));
+    const excludableAdditional = additionalPatterns.filter((p) => !exclusions.includes(p));
+    return new ProtectedFileList([
+      ...NON_EXCLUDABLE_PATTERNS,
+      ...excludableDefaults,
+      ...excludableAdditional,
+    ]);
   }
 
   matches(filePath: string): boolean {

package/scripts/harness/agent-integration/infrastructure/adapters/quick-mode-full-mode-requirement-adapter.ts

@@ -1,5 +1,6 @@
 // @unit agent-integration
 // @layer infrastructure
+// @work-item-id WI-373
 
 import type {
   FullModeRequirementQueryPort,
@@ -7,6 +8,7 @@ import type {
   FullModeTargetChange,
 } from '../../domain/ports/full-mode-requirement-query-port.js';
 import type { ClassifyChangeCategoryUseCase } from '../../../quick-mode/application/usecases/classify-change-category-usecase.js';
+import { QuickModeConfigError } from '../../../quick-mode/domain/errors/quick-mode-config-error.js';
 
 export interface QuickModeFullModeRequirementAdapterDeps {
   classifyUseCaseFactory: () => ClassifyChangeCategoryUseCase;
@@ -45,7 +47,19 @@ export class QuickModeFullModeRequirementAdapter implements FullModeRequirementQ
         rejectionReason: contract.rejectionReason,
         dominantCategory: contract.dominantCategory ?? undefined,
       };
-    } catch {
+    } catch (error) {
+      // WI-373: quickMode 設定そのものが不正な場合は fail-closed。
+      // allowedCategories / categoryOverrides の enum 検証が入ったことで
+      // config の typo が例外になるため、ここで一律 fail-open のままだと
+      // 「設定を壊すと全書き込みが素通りする」という最悪の穴になる。
+      // config 不在・IO エラー等その他の例外は WI-333 の fail-open を維持する。
+      if (error instanceof QuickModeConfigError) {
+        return {
+          requiresFullMode: true,
+          rejectionRule: 'MIXED_CHANGES',
+          rejectionReason: `quickMode 設定が不正なため Quick Mode 判定を実行できません: ${error.message}`,
+        };
+      }
       return { requiresFullMode: false };
     }
   }

package/scripts/harness/agent-integration/presentation/phasegate-status-context.ts

@@ -243,7 +243,7 @@ export function buildSessionStartContext(status: PhasegateStatus): string {
     "",
     "- Do NOT write to protected files without going through `/quick-implementor` skill.",
     '- Do NOT create/structurally modify source files under units listed as "blocked" below — the required design docs (logical_design.md / domain_model.md) are missing, and pre-tool-use hooks will block writes.',
-    "- Prefer the native `apply_patch` tool for edits, BUT note that Codex's apply_patch bypasses pre-edit hooks. Violations surface at pre-commit time.",
+    "- Native `apply_patch` edits are phase-gated at PreToolUse; the Codex matcher is `Bash|apply_patch`. L2 pre-commit remains the backstop for skipped or untrusted hooks.",
     "",
   ];
 

package/scripts/harness/agent-integration/presentation/post-tool-use-hook.ts

@@ -3,6 +3,7 @@
  * @unit agent-integration
  * @work-item-id WI-208
  * @work-item-id WI-323
+ * @work-item-id WI-384
  *
  * PostToolUse Hook Adapter
  * Claude Code の PostToolUse Hook エントリポイント

package/scripts/harness/agent-integration/presentation/pre-tool-use-hook.ts

@@ -6,45 +6,50 @@
  * @work-item-id WI-208
  * @work-item-id WI-345
  * @work-item-id WI-347
+ * @work-item-id WI-376
+ * @work-item-id WI-384
+ * @work-item-id WI-385
+ * @work-item-id WI-386
  *
  * PreToolUse Hook Adapter
  * Claude Code の PreToolUse Hook エントリポイント
  * stdin からJSON を読み取り、HandlePreToolUseUseCase を呼び出す
  */
 
-import { HandlePreToolUseUseCase } from '../application/usecases/handle-pre-tool-use-usecase.js';
-import { BashWriteTargetExtractor } from '../domain/services/bash-write-target-extractor.js';
-import { HarnessConfigConfigQueryAdapter } from '../infrastructure/adapters/harness-config-config-query-adapter.js';
-import { PhaseGateQueryAdapter } from '../infrastructure/adapters/phase-gate-query-adapter.js';
-import { FileSystemStoryReflectionQueryAdapter } from '../infrastructure/adapters/file-system-story-reflection-query-adapter.js';
-import { QuickModeFullModeRequirementAdapter } from '../infrastructure/adapters/quick-mode-full-mode-requirement-adapter.js';
-import { CiGovernanceBaselineGrandfatherAdapter } from '../infrastructure/adapters/ci-governance-baseline-grandfather-adapter.js';
-import { HarnessErrorGuidanceAdapter } from '../infrastructure/adapters/harness-error-guidance-adapter.js';
-import { FileSystemFullModeSessionQueryAdapter } from '../infrastructure/adapters/file-system-full-mode-session-query-adapter.js';
-import { createQuickModeCompositionRoot } from '../../quick-mode/composition-root.js';
-import * as path from 'node:path';
-import * as fs from 'node:fs/promises';
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { createQuickModeCompositionRoot } from "../../quick-mode/composition-root.js";
+import type {
+  CanonicalPreToolUseInput,
+  HookResponseProfile,
+} from "../application/dto/normalized-pre-tool-use-request.js";
+import { HandlePreToolUseUseCase } from "../application/usecases/handle-pre-tool-use-usecase.js";
+import { ApplyPatchWriteTargetExtractor } from "../domain/services/apply-patch-write-target-extractor.js";
+import { BashWriteTargetExtractor } from "../domain/services/bash-write-target-extractor.js";
+import { CiGovernanceBaselineGrandfatherAdapter } from "../infrastructure/adapters/ci-governance-baseline-grandfather-adapter.js";
+import { FileSystemFullModeSessionQueryAdapter } from "../infrastructure/adapters/file-system-full-mode-session-query-adapter.js";
+import { FileSystemStoryReflectionQueryAdapter } from "../infrastructure/adapters/file-system-story-reflection-query-adapter.js";
+import { HarnessConfigConfigQueryAdapter } from "../infrastructure/adapters/harness-config-config-query-adapter.js";
+import { HarnessErrorGuidanceAdapter } from "../infrastructure/adapters/harness-error-guidance-adapter.js";
+import { PhaseGateQueryAdapter } from "../infrastructure/adapters/phase-gate-query-adapter.js";
+import { QuickModeFullModeRequirementAdapter } from "../infrastructure/adapters/quick-mode-full-mode-requirement-adapter.js";
+import { PreToolUsePayloadNormalizer } from "./pre-tool-use-payload-normalizer.js";
+import { PreToolUseResponseRenderer } from "./pre-tool-use-response-renderer.js";
 
+/**
+ * WI-376 (ADR-039): 呼び出し元 skill 名を受け取るフィールド（caller_skill）は持たない。
+ * Claude Code の PreToolUse payload に skill 情報は無く、エージェントの自己申告値は
+ * authorization / guidance の入力にしない。未知キーが来ても単に無視される。
+ */
 interface PreToolUseHookInput {
   cwd?: string;
-  tool_name?: string;
-  caller_skill?: string;
-  tool_input?: {
-    path?: string;
-    file_path?: string;
-    paths?: string[];
-    command?: string;
-    content?: string;
-    old_string?: string;
-    new_string?: string;
-    old_str?: string;
-    new_str?: string;
-    [key: string]: unknown;
-  };
+  tool_name: string;
+  tool_input: CanonicalPreToolUseInput;
 }
 
 interface TargetChange {
   filePath: string;
+  changeKind?: "CREATE" | "MODIFY" | "DELETE";
   beforeContent?: string | null;
   afterContent?: string | null;
 }
@@ -54,15 +59,15 @@ async function readStdin(): Promise<string> {
   for await (const chunk of process.stdin) {
     chunks.push(chunk as Buffer);
   }
-  return Buffer.concat(chunks).toString('utf8');
+  return Buffer.concat(chunks).toString("utf8");
 }
 
 async function findConfigPath(startDir: string): Promise<string> {
   let dir = startDir;
   while (true) {
     const candidates = [
-      path.join(dir, 'phasegate.config.json'),
-      path.join(dir, '.phasegate-local', 'phasegate.config.json'),
+      path.join(dir, "phasegate.config.json"),
+      path.join(dir, ".phasegate-local", "phasegate.config.json"),
     ];
     for (const candidate of candidates) {
       try {
@@ -74,18 +79,22 @@ async function findConfigPath(startDir: string): Promise<string> {
     if (parent === dir) break;
     dir = parent;
   }
-  return path.join(startDir, 'phasegate.config.json');
+  return path.join(startDir, "phasegate.config.json");
 }
 
 function projectRootForConfig(configPath: string): string {
   const configDir = path.dirname(configPath);
-  return path.basename(configDir) === '.phasegate-local' ? path.dirname(configDir) : configDir;
+  return path.basename(configDir) === ".phasegate-local" ? path.dirname(configDir) : configDir;
 }
 
 function isProjectExternalPath(filePath: string, cwd: string, projectRoot: string): boolean {
   const resolvedPath = path.resolve(cwd, filePath);
   const relativePath = path.relative(projectRoot, resolvedPath);
-  return relativePath === '..' || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath);
+  return relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath);
+}
+
+function normalizeProjectPath(filePath: string, cwd: string, projectRoot: string): string {
+  return path.relative(projectRoot, path.resolve(cwd, filePath)).split(path.sep).join("/");
 }
 
 async function main(): Promise<void> {
@@ -93,29 +102,41 @@ async function main(): Promise<void> {
   try {
     raw = await readStdin();
   } catch {
-    process.stderr.write('stdin読み取りエラー\n');
+    process.stderr.write("stdin読み取りエラー\n");
     process.exit(2);
   }
 
-  let input: PreToolUseHookInput;
+  let parsed: unknown;
   try {
-    input = JSON.parse(raw) as PreToolUseHookInput;
+    parsed = JSON.parse(raw) as unknown;
   } catch {
     process.stderr.write(`不正なJSONです: ${raw}\n`);
     process.exit(2);
   }
 
-  const toolName = input.tool_name;
-  if (!toolName) {
-    process.stderr.write('tool_nameフィールドが必要です\n');
-    process.exit(2);
+  const normalizer = new PreToolUsePayloadNormalizer();
+  const normalized = normalizer.normalize(parsed);
+  if (!normalized.ok) {
+    if (normalized.responseProfile === undefined) {
+      process.stderr.write(`${normalized.reason}\n`);
+      process.exit(2);
+    }
+    exitWithRenderedResponse(new PreToolUseResponseRenderer().deny(normalized.responseProfile, normalized.reason));
   }
+  const request = normalized.request;
+  const responseProfile = request.responseProfile;
+  const input: PreToolUseHookInput = {
+    cwd: request.cwd,
+    tool_name: request.toolName,
+    tool_input: request.toolInput,
+  };
+  const toolName = input.tool_name;
 
   const cwd = path.resolve(input.cwd ?? process.cwd());
   const toRelative = (p: string): string => {
     if (path.isAbsolute(p)) {
       const rel = path.relative(cwd, p);
-      return rel.startsWith('..') ? p : rel;
+      return rel.startsWith("..") ? p : rel;
     }
     return p;
   };
@@ -140,7 +161,26 @@ async function main(): Promise<void> {
   // translator の WRITE_TOOLS チェックを通過させる（Bash のままではフェーズゲートが
   // スキップされるため）。
   let effectiveToolName = toolName;
-  if (toolName === 'Bash' && typeof input.tool_input?.command === 'string') {
+  if (toolName === "apply_patch") {
+    const command = input.tool_input?.command;
+    if (typeof command !== "string" || command.length === 0) {
+      deny(responseProfile, "apply_patch の tool_input.command が必要です");
+    }
+    const extractor = new ApplyPatchWriteTargetExtractor();
+    const patchTargets = extractor.extract(command);
+    if (patchTargets.length === 0) {
+      deny(responseProfile, "apply_patch command から書き込み対象を抽出できませんでした");
+    }
+    targetFilePaths.push(...patchTargets.map((target) => toRelative(target.filePath)));
+    targetChanges.push(
+      ...patchTargets.map((target) => ({
+        filePath: toRelative(target.filePath),
+        changeKind: target.changeKind,
+      })),
+    );
+    effectiveToolName = "Write";
+  }
+  if (toolName === "Bash" && typeof input.tool_input?.command === "string") {
     const extractor = new BashWriteTargetExtractor();
     const bashTargets = extractor.extract(input.tool_input.command);
     if (bashTargets.length > 0) {
@@ -155,19 +195,22 @@ async function main(): Promise<void> {
           recordedTargetPaths.add(change.filePath);
         }
       }
-      effectiveToolName = 'Write';
+      effectiveToolName = "Write";
     }
   }
 
   try {
     const configPath = await findConfigPath(cwd);
     const projectRoot = projectRootForConfig(configPath);
-    const projectTargetFilePaths = targetFilePaths.filter(
-      (filePath) => !isProjectExternalPath(filePath, cwd, projectRoot),
-    );
-    const projectTargetChanges = targetChanges.filter(
-      (change) => !isProjectExternalPath(change.filePath, cwd, projectRoot),
-    );
+    const projectTargetFilePaths = targetFilePaths
+      .filter((filePath) => !isProjectExternalPath(filePath, cwd, projectRoot))
+      .map((filePath) => normalizeProjectPath(filePath, cwd, projectRoot));
+    const projectTargetChanges = targetChanges
+      .filter((change) => !isProjectExternalPath(change.filePath, cwd, projectRoot))
+      .map((change) => ({
+        ...change,
+        filePath: normalizeProjectPath(change.filePath, cwd, projectRoot),
+      }));
     const configQueryPort = new HarnessConfigConfigQueryAdapter(configPath);
     const phaseGateQueryPort = new PhaseGateQueryAdapter();
     const storyReflectionQueryPort = new FileSystemStoryReflectionQueryAdapter({
@@ -199,49 +242,60 @@ async function main(): Promise<void> {
       fullModeSessionQueryPort,
     });
 
-    const callerSkill = input.caller_skill ?? process.env.PHASEGATE_CALLER_SKILL;
     const output = await useCase.execute({
       toolName: effectiveToolName,
       targetFilePaths: projectTargetFilePaths,
-      callerSkill,
       targetChanges: projectTargetChanges,
     });
 
     if (output.shouldBlock) {
-      const msg = output.error?.message
-        ?? `ファイル保護によりブロックされました: ${output.blockedFilePath ?? '不明なファイル'}`;
-      process.stderr.write(`${msg}\n`);
-      process.exit(2);
+      const msg =
+        output.error?.message ?? `ファイル保護によりブロックされました: ${output.blockedFilePath ?? "不明なファイル"}`;
+      deny(responseProfile, msg);
     }
 
     // Quick Mode が write を許可した場合に visibility を上げる informational notice。
     // exit 0 は維持し semantics は変えない。WI-087 finding #3。
     if (output.quickModeAllowed !== undefined) {
       const cat = output.quickModeAllowed.dominantCategory;
-      const suffix = cat !== undefined && cat !== '' ? `, category=${cat}` : '';
+      const suffix = cat !== undefined && cat !== "" ? `, category=${cat}` : "";
       process.stderr.write(`phasegate: write allowed (Quick Mode${suffix})\n`);
     }
     if (output.fullModeSessionAllowed !== undefined) {
       const session = output.fullModeSessionAllowed;
-      const workItem = session.workItemId !== undefined ? `, workItem=${session.workItemId}` : '';
-      const unit = session.unit !== undefined ? `, unit=${session.unit}` : '';
+      const workItem = session.workItemId !== undefined ? `, workItem=${session.workItemId}` : "";
+      const unit = session.unit !== undefined ? `, unit=${session.unit}` : "";
       process.stderr.write(`phasegate: write allowed (Full Mode session${workItem}${unit})\n`);
     }
 
     process.exit(0);
   } catch (error) {
-    process.stderr.write(`実行エラー: ${String(error)}\n`);
-    process.exit(2);
+    deny(responseProfile, `実行エラー: ${String(error)}`);
   }
 }
 
+function exitWithRenderedResponse(response: {
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly exitCode: 0 | 2;
+}): never {
+  if (response.stdout.length > 0) process.stdout.write(response.stdout);
+  if (response.stderr.length > 0) process.stderr.write(response.stderr);
+  process.exit(response.exitCode);
+  throw new Error("process.exit returned unexpectedly");
+}
+
+function deny(profile: HookResponseProfile, reason: string): never {
+  exitWithRenderedResponse(new PreToolUseResponseRenderer().deny(profile, reason));
+}
+
 async function buildTargetChanges(
   input: PreToolUseHookInput,
   cwd: string,
   toRelative: (p: string) => string,
 ): Promise<TargetChange[]> {
   const toolInput = input.tool_input;
-  if (toolInput == null || typeof toolInput !== 'object') {
+  if (toolInput == null || typeof toolInput !== "object") {
     return [];
   }
 
@@ -251,18 +305,20 @@ async function buildTargetChanges(
   }
 
   const filePath = toRelative(rawPath);
-  const oldString = typeof toolInput.old_string === 'string' ? toolInput.old_string : toolInput.old_str;
-  const newString = typeof toolInput.new_string === 'string' ? toolInput.new_string : toolInput.new_str;
-  if (typeof oldString === 'string' && typeof newString === 'string') {
+  const oldString = toolInput.old_string;
+  const newString = toolInput.new_string;
+  if (typeof oldString === "string" && typeof newString === "string") {
     return [{ filePath, beforeContent: oldString, afterContent: newString }];
   }
 
-  if (typeof toolInput.content === 'string') {
-    return [{
-      filePath,
-      beforeContent: await readExistingContent(cwd, rawPath),
-      afterContent: toolInput.content,
-    }];
+  if (typeof toolInput.content === "string") {
+    return [
+      {
+        filePath,
+        beforeContent: await readExistingContent(cwd, rawPath),
+        afterContent: toolInput.content,
+      },
+    ];
   }
 
   return [];
@@ -271,7 +327,7 @@ async function buildTargetChanges(
 async function readExistingContent(cwd: string, filePath: string): Promise<string | null> {
   const absolutePath = path.isAbsolute(filePath) ? filePath : path.join(cwd, filePath);
   try {
-    return await fs.readFile(absolutePath, 'utf8');
+    return await fs.readFile(absolutePath, "utf8");
   } catch {
     return null;
   }
@@ -283,7 +339,7 @@ async function buildBashTargetChange(
   toRelative: (p: string) => string,
 ): Promise<TargetChange> {
   const filePath = toRelative(rawPath);
-  if (rawPath.includes('$') || rawPath.includes('`') || rawPath.startsWith('~')) {
+  if (rawPath.includes("$") || rawPath.includes("`") || rawPath.startsWith("~")) {
     // hook ではシェル展開後の実パスを解決できないため、存在チェックを避けて MODIFY 既定にする。
     return { filePath };
   }
@@ -293,10 +349,10 @@ async function buildBashTargetChange(
     return { filePath };
   } catch (error) {
     const code = (error as NodeJS.ErrnoException).code;
-    if (code === 'ENOENT' || code === 'ENOTDIR') {
+    if (code === "ENOENT" || code === "ENOTDIR") {
       // Bash では afterContent を取得できないため、空文字を CREATE 判定用の
       // 「変更後内容あり」sentinel として渡す。実ファイルへの書き込みは行わない。
-      return { filePath, beforeContent: null, afterContent: '' };
+      return { filePath, beforeContent: null, afterContent: "" };
     }
     // 権限エラー等で存在を確認できない場合は従来どおり MODIFY 既定（安全側）。
     return { filePath };