phasegate 0.335.0 → 0.340.0

package/scripts/harness/installation/application/checks/antigravity-hook-missing-check.ts

@@ -0,0 +1,79 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_TOOLS = ["write_to_file", "replace_file_content", "multi_replace_file_content", "run_command"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply. Antigravity hard blocking is supported for the agy CLI surface; IDE/desktop must rely on the L2 pre-commit backstop.";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function matches(matcher: unknown, tool: string): boolean {
+  if (typeof matcher !== "string") return false;
+  try {
+    return new RegExp(matcher).test(tool);
+  } catch {
+    return false;
+  }
+}
+
+function phasegateCommands(entry: Record<string, unknown>): Record<string, unknown>[] {
+  if (!Array.isArray(entry.hooks)) return [];
+  return entry.hooks.filter(
+    (hook): hook is Record<string, unknown> =>
+      isRecord(hook) && typeof hook.command === "string" && hook.command.includes("phasegate hook pre-tool-use"),
+  );
+}
+
+export class AntigravityHookMissingCheck implements HeuristicCheck {
+  readonly checkId = "antigravity-hook-missing" as const;
+  private readonly target = ".agents/hooks.json";
+
+  async run(projectRoot: string, inspector: FileInspectorPort): Promise<DiagnosticFinding | null> {
+    const absolutePath = projectPath(projectRoot, this.target);
+    if (!(await inspector.exists(absolutePath))) return this.finding("named definition missing", "mechanical");
+    const json = await inspector.readJson(absolutePath);
+    if (json === null) return this.finding("JSON parse failed", "manual");
+    const named = isRecord(json) && isRecord(json["phasegate-gate"]) ? json["phasegate-gate"] : undefined;
+    const entries = named !== undefined && Array.isArray(named.PreToolUse) ? named.PreToolUse : [];
+    const phasegateEntries = entries.filter(
+      (entry): entry is Record<string, unknown> => isRecord(entry) && phasegateCommands(entry).length > 0,
+    );
+    const missing = REQUIRED_TOOLS.filter(
+      (tool) => !phasegateEntries.some((entry) => matches(entry.matcher, tool)),
+    );
+    const invalidType = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.type !== "command"),
+    );
+    const invalidTimeout = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.timeout !== 30),
+    );
+    if (missing.length === 0 && phasegateEntries.length > 0 && !invalidType && !invalidTimeout) return null;
+    const details = [
+      ...missing.map((tool) => `matcher:${tool}`),
+      ...(phasegateEntries.length === 0 ? ["command"] : []),
+      ...(invalidType ? ["type=command"] : []),
+      ...(invalidTimeout ? ["timeout=30"] : []),
+    ];
+    const hasUserDefinitions = isRecord(json) && Object.keys(json).some((key) => key !== "phasegate-gate");
+    return this.finding(details.join(", "), hasUserDefinitions ? "ai-assisted" : "mechanical");
+  }
+
+  private finding(detail: string, repairMode: "mechanical" | "manual" | "ai-assisted"): DiagnosticFinding {
+    return createFinding({
+      checkId: this.checkId,
+      severity: "red",
+      target: this.target,
+      message: `.agents/hooks.json の Antigravity hook wiring が古いか不足しています: ${detail}`,
+      repairMode,
+      repairHint: REPAIR_HINT,
+    });
+  }
+}

package/scripts/harness/installation/application/checks/codex-hook-missing-check.ts

@@ -1,11 +1,60 @@
 // @unit installation
 // @layer application
 // @work-item-id WI-145
+// @work-item-id WI-384
 
-import type { FileInspectorPort } from "../ports/file-inspector-port.js";
-import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
 import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
-import { containsPhasegateHook, createFinding, hasUserCustomization, projectPath } from "./check-utils.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { containsPhasegateHook, createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_MATCHER_TOKENS = ["Bash", "apply_patch"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply, then open Codex /hooks and trust the updated hook definition hash (Codex CLI >= 0.124.0).";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function phasegateCommandFor(entry: unknown, command: "pre-tool-use" | "post-tool-use"): boolean {
+  if (!isRecord(entry) || !Array.isArray(entry.hooks)) return false;
+  return entry.hooks.some((hook) => {
+    if (!isRecord(hook) || typeof hook.command !== "string") return false;
+    return hook.command.includes(`phasegate hook ${command}`);
+  });
+}
+
+function matcherTokens(entry: unknown): ReadonlySet<string> {
+  if (!isRecord(entry) || typeof entry.matcher !== "string") return new Set();
+  return new Set(entry.matcher.match(/[A-Za-z_][A-Za-z0-9_]*/g) ?? []);
+}
+
+function missingForEvent(
+  hooks: Record<string, unknown>,
+  event: "PreToolUse" | "PostToolUse",
+  command: "pre-tool-use" | "post-tool-use",
+): string[] {
+  const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+  const phasegateEntries = entries.filter((entry) => phasegateCommandFor(entry, command));
+  if (phasegateEntries.length === 0) return [`${event}:phasegate-command`];
+  const missing: string[] = [];
+  for (const token of REQUIRED_MATCHER_TOKENS) {
+    if (!phasegateEntries.some((entry) => matcherTokens(entry).has(token))) {
+      missing.push(`${event}:${token}`);
+    }
+  }
+  return missing;
+}
+
+function hasUserHookEntry(json: Record<string, unknown>): boolean {
+  if (Array.isArray(json.hooks)) {
+    return json.hooks.some((entry) => !containsPhasegateHook(entry));
+  }
+  if (!isRecord(json.hooks)) return false;
+  return Object.values(json.hooks).some(
+    (entries) => Array.isArray(entries) && entries.some((entry) => !containsPhasegateHook(entry)),
+  );
+}
 
 export class CodexHookMissingCheck implements HeuristicCheck {
   readonly checkId = "codex-hook-missing" as const;
@@ -32,13 +81,28 @@ export class CodexHookMissingCheck implements HeuristicCheck {
         repairMode: "manual",
       });
     }
-    if (containsPhasegateHook(json)) return null;
+    if (!isRecord(json) || !isRecord(json.hooks)) {
+      return createFinding({
+        checkId: this.checkId,
+        severity: "red",
+        target: this.target,
+        message: ".codex/hooks.json に phasegate hook が登録されていません",
+        repairMode: isRecord(json) && hasUserHookEntry(json) ? "ai-assisted" : "mechanical",
+        repairHint: REPAIR_HINT,
+      });
+    }
+    const missing = [
+      ...missingForEvent(json.hooks, "PreToolUse", "pre-tool-use"),
+      ...missingForEvent(json.hooks, "PostToolUse", "post-tool-use"),
+    ];
+    if (missing.length === 0) return null;
     return createFinding({
       checkId: this.checkId,
       severity: "red",
       target: this.target,
-      message: ".codex/hooks.json に phasegate hook が登録されていません",
-      repairMode: hasUserCustomization(json) ? "ai-assisted" : "mechanical",
+      message: `.codex/hooks.json の Codex hook wiring が古いか不足しています: ${missing.join(", ")}`,
+      repairMode: hasUserHookEntry(json) ? "ai-assisted" : "mechanical",
+      repairHint: REPAIR_HINT,
     });
   }
 }

package/scripts/harness/installation/application/checks/grok-hook-missing-check.ts

@@ -0,0 +1,79 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { containsPhasegateHook, createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_TOOLS = ["Bash", "Write", "Edit", "apply_patch"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply, confirm every phasegate PreToolUse command has timeout 30, then use grok inspect and /hooks to verify trust (--trust or /hooks-trust).";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function matcherMatches(entry: Record<string, unknown>, tool: string): boolean {
+  if (typeof entry.matcher !== "string") return false;
+  try {
+    return new RegExp(`^(?:${entry.matcher})$`).test(tool);
+  } catch {
+    return false;
+  }
+}
+
+function phasegateCommands(entry: Record<string, unknown>): Record<string, unknown>[] {
+  if (!Array.isArray(entry.hooks)) return [];
+  return entry.hooks.filter(
+    (hook): hook is Record<string, unknown> =>
+      isRecord(hook) && typeof hook.command === "string" && hook.command.includes("phasegate hook pre-tool-use"),
+  );
+}
+
+function hasUserHook(entries: readonly unknown[]): boolean {
+  return entries.some((entry) => !containsPhasegateHook(entry));
+}
+
+export class GrokHookMissingCheck implements HeuristicCheck {
+  readonly checkId = "grok-hook-missing" as const;
+  private readonly target = ".claude/settings.json";
+
+  async run(projectRoot: string, inspector: FileInspectorPort): Promise<DiagnosticFinding | null> {
+    const absolutePath = projectPath(projectRoot, this.target);
+    if (!(await inspector.exists(absolutePath))) return this.finding("compatible settings missing", "mechanical");
+    const json = await inspector.readJson(absolutePath);
+    if (json === null) return this.finding("JSON parse failed", "manual");
+    const hooks = isRecord(json) && isRecord(json.hooks) ? json.hooks : undefined;
+    const entries = hooks !== undefined && Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+    const phasegateEntries = entries.filter(
+      (entry): entry is Record<string, unknown> => isRecord(entry) && phasegateCommands(entry).length > 0,
+    );
+    const missing = REQUIRED_TOOLS.filter((tool) => !phasegateEntries.some((entry) => matcherMatches(entry, tool)));
+    const invalidType = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.type !== "command"),
+    );
+    const invalidTimeout = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.timeout !== 30),
+    );
+    if (missing.length === 0 && !invalidType && !invalidTimeout) return null;
+    const details = [
+      ...missing.map((tool) => `matcher:${tool}`),
+      ...(invalidType ? ["type=command"] : []),
+      ...(invalidTimeout ? ["timeout=30"] : []),
+    ];
+    return this.finding(details.join(", "), hasUserHook(entries) ? "ai-assisted" : "mechanical");
+  }
+
+  private finding(detail: string, repairMode: "mechanical" | "manual" | "ai-assisted"): DiagnosticFinding {
+    return createFinding({
+      checkId: this.checkId,
+      severity: "red",
+      target: this.target,
+      message: `.claude/settings.json の Grok-compatible hook wiring が古いか不足しています: ${detail}`,
+      repairMode,
+      repairHint: REPAIR_HINT,
+    });
+  }
+}

package/scripts/harness/installation/application/checks/husky-runtime-inactive-check.ts

@@ -0,0 +1,33 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-390
+
+import type { DiagnosticFinding } from '../../domain/diagnostic-finding.js';
+import type { GitHooksRuntimeProbe } from '../../domain/ports/git-hooks-runtime-probe.js';
+import type { FileInspector } from '../../domain/ports/file-inspector.js';
+import type { HeuristicCheck } from '../../domain/ports/heuristic-check.js';
+import { createFinding } from './check-utils.js';
+
+export class HuskyRuntimeInactiveCheck implements HeuristicCheck {
+  readonly checkId = 'husky-runtime-inactive' as const;
+
+  constructor(private readonly runtimeProbe: GitHooksRuntimeProbe) {}
+
+  async run(projectRoot: string, _inspector: FileInspector): Promise<DiagnosticFinding | null> {
+    const state = await this.runtimeProbe.probe(projectRoot);
+    if (state.isActive()) return null;
+
+    const detail =
+      state.kind === 'unavailable'
+        ? `Git hooks runtime を確認できませんでした: ${state.detail ?? 'unknown error'}`
+        : `Husky runtime が無効です: reason=${state.reason}, core.hooksPath=${state.hooksPath ?? 'unset'}`;
+    return createFinding({
+      checkId: this.checkId,
+      severity: 'red',
+      target: 'core.hooksPath',
+      message: detail,
+      repairMode: 'mechanical',
+      repairHint: 'npx phasegate setup:agent --apply --with-husky',
+    });
+  }
+}

package/scripts/harness/installation/application/named-hook-json.ts

@@ -0,0 +1,17 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+export const PHASEGATE_NAMED_HOOK = "phasegate-gate";
+
+export function mergeNamedHookJson(
+  existing: Readonly<Record<string, unknown>>,
+  incoming: Readonly<Record<string, unknown>>,
+): Record<string, unknown> {
+  const owned = incoming[PHASEGATE_NAMED_HOOK];
+  return owned === undefined ? { ...existing } : { ...existing, [PHASEGATE_NAMED_HOOK]: owned };
+}
+
+export function removeNamedHookJson(existing: Readonly<Record<string, unknown>>): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(existing).filter(([key]) => key !== PHASEGATE_NAMED_HOOK));
+}

package/scripts/harness/installation/application/operator-notice.ts

@@ -0,0 +1,42 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-384
+// @work-item-id WI-385
+
+export interface OperatorNotice {
+  readonly code:
+    | "CODEX_HOOK_TRUST_REQUIRED"
+    | "CODEX_HOOK_TRUST_UNVERIFIABLE"
+    | "GROK_HOOK_TRUST_UNVERIFIABLE"
+    | "ANTIGRAVITY_CLI_ONLY";
+  readonly level: "info";
+  readonly message: string;
+}
+
+export const CODEX_HOOK_TRUST_REQUIRED_NOTICE: OperatorNotice = Object.freeze({
+  code: "CODEX_HOOK_TRUST_REQUIRED",
+  level: "info",
+  message:
+    "Codex CLI >= 0.124.0 is required for native apply_patch hooks. The hook definition hash changed; open /hooks and trust the updated definition before relying on the edit-time gate.",
+});
+
+export const CODEX_HOOK_TRUST_UNVERIFIABLE_NOTICE: OperatorNotice = Object.freeze({
+  code: "CODEX_HOOK_TRUST_UNVERIFIABLE",
+  level: "info",
+  message:
+    "Codex CLI >= 0.124.0 is required for native apply_patch hooks. Phasegate cannot verify the external trust store; open /hooks and confirm the current hook definition is trusted.",
+});
+
+export const GROK_HOOK_TRUST_UNVERIFIABLE_NOTICE: OperatorNotice = Object.freeze({
+  code: "GROK_HOOK_TRUST_UNVERIFIABLE",
+  level: "info",
+  message:
+    "Phasegate cannot verify Grok's project-hook trust state. Run grok inspect, open /hooks, and approve with --trust or /hooks-trust before relying on the edit-time gate; keep the L2 pre-commit backstop enabled.",
+});
+
+export const ANTIGRAVITY_CLI_ONLY_NOTICE: OperatorNotice = Object.freeze({
+  code: "ANTIGRAVITY_CLI_ONLY",
+  level: "info",
+  message:
+    "Antigravity hard blocking is supported for the agy CLI surface only. IDE/desktop hook execution is not guaranteed; the L2 pre-commit gate remains the primary backstop there.",
+});

package/scripts/harness/installation/application/usecases/run-doctor-diagnostics.ts

@@ -6,7 +6,10 @@
 // @work-item-id WI-215
 // @work-item-id WI-330
 // @work-item-id WI-343
+// @work-item-id WI-385
+// @work-item-id WI-390
 
+import type { AgentTarget } from "../../domain/agent-target.js";
 import type { CheckId } from "../../domain/check-id.js";
 import type { ConfigStatus } from "../../domain/config-status.js";
 import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
@@ -16,7 +19,7 @@ import type { ConfigStatusProbePort } from "../ports/config-status-probe-port.js
 import type { FileInspectorPort } from "../ports/file-inspector-port.js";
 import type { ManifestRepositoryPort } from "../ports/manifest-repository-port.js";
 
-export type DoctorAgentScope = "claude" | "codex" | "both";
+export type DoctorAgentScope = AgentTarget;
 
 export interface ScopedOutDiagnosticFinding {
   readonly finding: DiagnosticFinding;
@@ -40,10 +43,13 @@ export interface RunDoctorDiagnosticsOutput {
 
 const CLAUDE_ONLY_CHECKS = new Set<CheckId>(["claude-hook-missing", "claude-context-missing", "claude-skills-symlink"]);
 const CODEX_ONLY_CHECKS = new Set<CheckId>(["codex-hook-missing", "codex-context-missing", "codex-skills-symlink"]);
+const CLAUDE_COMPATIBLE_CHECKS = new Set<CheckId>(["grok-hook-missing"]);
+const ANTIGRAVITY_ONLY_CHECKS = new Set<CheckId>(["antigravity-hook-missing"]);
 const PERSONAL_SCOPED_OUT_CHECKS = new Set<CheckId>([
   "husky-pre-commit-missing",
   "husky-commit-msg-missing",
   "husky-pre-push-missing",
+  "husky-runtime-inactive",
   "ci-workflow-missing",
   "package-json-devdep-missing",
 ]);
@@ -65,9 +71,7 @@ export class RunDoctorDiagnosticsUseCase {
         : "project";
     const configStatus = (await this.configStatusProbe.probe(input.projectRoot)).status;
     const rawFindings = (
-      await Promise.all(
-        this.checks.map((check) => check.run(input.projectRoot, this.inspector, { installationMode })),
-      )
+      await Promise.all(this.checks.map((check) => check.run(input.projectRoot, this.inspector, { installationMode })))
     ).filter((finding) => finding !== null);
     const { findings, scopedOutFindings } = this.applyPersonalScope(
       this.applyAgentScope(rawFindings, agent),
@@ -91,12 +95,10 @@ export class RunDoctorDiagnosticsUseCase {
     readonly findings: readonly DiagnosticFinding[];
     readonly scopedOutFindings: readonly ScopedOutDiagnosticFinding[];
   } {
-    if (agent === "both") return { findings, scopedOutFindings: [] };
-    const scopedOutChecks = agent === "claude" ? CODEX_ONLY_CHECKS : CLAUDE_ONLY_CHECKS;
     const applicable: DiagnosticFinding[] = [];
     const scopedOut: ScopedOutDiagnosticFinding[] = [];
     for (const finding of findings) {
-      if (scopedOutChecks.has(finding.checkId)) {
+      if (!this.isApplicableAgentCheck(finding.checkId, agent)) {
         scopedOut.push({
           finding,
           scopeReason: `${finding.checkId} belongs to an unselected agent for doctor --agent ${agent}.`,
@@ -108,6 +110,15 @@ export class RunDoctorDiagnosticsUseCase {
     return { findings: applicable, scopedOutFindings: scopedOut };
   }
 
+  private isApplicableAgentCheck(checkId: CheckId, agent: DoctorAgentScope): boolean {
+    if (CLAUDE_ONLY_CHECKS.has(checkId)) return agent === "claude" || agent === "both" || agent === "all";
+    if (CODEX_ONLY_CHECKS.has(checkId)) return agent === "codex" || agent === "both" || agent === "all";
+    if (CLAUDE_COMPATIBLE_CHECKS.has(checkId))
+      return agent === "claude" || agent === "both" || agent === "grok" || agent === "all";
+    if (ANTIGRAVITY_ONLY_CHECKS.has(checkId)) return agent === "antigravity" || agent === "all";
+    return true;
+  }
+
   private applyPersonalScope(
     scoped: {
       readonly findings: readonly DiagnosticFinding[];