claude-spotter 1.4.18 → 1.4.20

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 1.4.20 — 2026-07-13
+
+### Added
+
+- **Throughline監査文脈のopt-in配布。** 新規projectは既定`disabled`のまま、ownerがabsoluteなThroughline commandとrepeatableな先頭引数で有効化できる。freshな完了L2 user/assistant pairだけを`N=2`、body 600文字、total 4,000文字に制限し、Codex CLIへstdinで渡す。Haikuはこのcontext経路では呼ばず、fresh以外でもAIを呼ばない。connector障害は固定警告に限定する。親出力は安全なcatalog tool ID由来の固定・非命令形助言だけで、L2、reason、provider rawを反射しない。7日・30 fresh resultのproduction default昇格gateは未完了のため、配布後もproject opt-inを維持する。
+
+## 1.4.19
+
+親セッションの暴走を誘発できたHook出力の信頼境界を修正する。監査用AIは内部で構造化判定を返すだけとし、
+その自由文やprovider出力を親モデルへ渡さない。親向け出力はSpotterプログラムが検証済みtool IDから
+決定論的に生成する、採否を親が独立判断できる非命令形の助言へ限定する。
+
+### 変更点
+
+- **共通parent-output projector**: Claude / Codexの両Hookが同じprojectorを使う。tool IDは
+  ASCII grammar、160文字、5件、重複排除、安定sort、助言全体2,000文字の上限を持ち、改行・制御文字・
+  backtick・Markdown・超長大IDを拒否する。監査用AIの`reason` / `raw`はAPI入力に持たない。
+- **非命令形のUserPrompt助言**: `additionalContext`はcatalog照合済みtool IDと固定テンプレートだけから
+  作る。「使え」「補正せよ」「ユーザーへ伝えよ」といった命令や監査用AIの説明文を含めない。
+- **failure分離**: backend codeをallow-list済みの固定状態へ写像し、固定`systemMessage`・固定stderr・
+  構造Hook eventへ出す。backend message、provider stdout / stderr、未知code本文を反射しない。この保証は
+  Hook出力生成までで、全Codex App/background面でのUI可視性は未保証。
+- **Stop持ち越し廃止**: finding / failureを`.spotter/pending/`へ新規保存せず、次の無関係な
+  UserPromptSubmitへ配送しない。findingは構造Hook event、failureは固定診断として当該Stopで完結する。
+  旧same-session pendingは内容を読まずにunlinkし、`ENOENT`以外の失敗も固定診断だけにする。
+- **安全性維持**: `decision:"block"`、Stop継続、UserPromptSubmit exit 2の範囲拡大は行わず、既存の
+  再帰Hook / daemon proliferation防止、marker、short prompt、non-blocking failure契約を維持する。
+
+### 検証
+
+projector / Claude / Codexのtargeted testとfull suiteを実行し、447件中445 pass・0 fail・既存2 skip。
+AI/backend/provider sentinel、unsafe ID、legacy pending非読取unlink、Stop次turn非配送、catalog/transcript
+読込例外の固定degradationを確認した。敵対的再監査は初回BLOCKER 2件（Codex読込例外の境界外、
+UI可視性の過剰主張）を検出・修正し、再監査BLOCKER 0。`npm pack --dry-run`は62 files、global
+`spotter 1.4.19`へlocal installし、projector smoke・Hook diagnostics・global UserPromptSubmit smokeを
+確認した。公開前release gateでfull test、pack、秘密混入を再検証し、公開SHA`5393919`のCIは
+macOS/Linux/Windows × Node 22.5/22.xの6/6 green。`v1.4.19` tag、npm `latest`、
+[GitHub Release](https://github.com/kitepon-rgb/Spotter/releases/tag/v1.4.19)、registry由来global installを
+1.4.19へ揃え、global projector smokeとHook diagnosticsもgreen。
+
 ## 1.4.18
 
 auditor model の更新を model 名の場当たり的な置換から切り離し、versioned policy と再現可能な比較 eval を

package/README.ja.md

@@ -15,7 +15,7 @@
 
 Claude には「使えるツールがあるのに、使うべきタイミングで使わない」という構造的な弱点があります。記録すべき決定を memory / caveat MCP に残さない、docs lookup MCP を呼ばずに古い知識で応答する、ブラウザ自動化 MCP で確認せず UI 状態を推測する — **「分からないと自覚できない」から、ツールを取りに行けない**。
 
-Spotter はツールカタログを完全に把握した別の監査エージェントで、ユーザー入力と主役 AI の応答を並走監査します。自動選択では Claude host は Codex CLI があればそれを、なければ session-scoped Haiku を選び、Codex host は Codex CLI を既定にします。明示 backend override は host より優先しますが、runtime failure で別 backend へ黙って切り替えません。見落としは透明化された指摘として次に利用できる文脈へ届けます。**主役 AI が自覚して自己監査する**設計は本プロダクトの存在意義を破壊するため、hook 経由でその意思と独立に検出します。
+Spotter はツールカタログを完全に把握した別の監査エージェントで、ユーザー入力と主役 AI の応答を並走監査します。自動選択では Claude host は Codex CLI があればそれを、なければ session-scoped Haiku を選び、Codex host は Codex CLI を既定にします。明示 backend override は host より優先しますが、runtime failure で別 backend へ黙って切り替えません。応答前は検証済みtool IDだけを固定・非命令形の助言へ変換でき、応答後のfindingは構造eventに留めて後続turnへ注入しません。監査用AIの自由文が親セッションへ入ることはありません。**主役 AI が自覚して自己監査する**設計は本プロダクトの存在意義を破壊するため、hook 経由でその意思と独立に検出します。
 
 <p align="center">
   <img src=".github/concept.svg" alt="Claude が答え、Spotter が見ている" width="80%">
@@ -62,6 +62,7 @@ Codex 側では現行の `[features].hooks = true` を有効化し、互換の
 Spotter が所有する Codex handler は現行の同期 command schema で生成します。install / upgrade 後は `/hooks` で review して新しい Codex session を開いてください。`spotter codex-hook diagnostics` は登録と readiness を診断しますが、trust を内部状態から推測しません。
 
 Spotter を upgrade した後、release note で hook 設定変更が案内されている場合は、各 install 済みプロジェクトで `spotter install` を再実行してください。global package update でコード経路は変わりますが、既存 `.claude/settings.json` の timeout 値は自動では書き換わりません。
+`v1.4.19`はruntimeの出力変換だけを変更するため、install済みprojectで`spotter install`をやり直す必要はありません。global packageを更新し、新しいClaude/Codexセッションを開いてください。
 
 ```bash
 spotter uninstall        # このプロジェクトの hook 登録を解除
@@ -88,20 +89,19 @@ spotter codex-hook install
 
 ### 1 ターンの監査フロー
 
-Claude Code と Codex では `Stop` の受け口が違います。下の図は Claude host の流れです。
-Codex native `Stop` は遅延配送で、不足ツールの指摘を queue し、次の same-session
-`UserPromptSubmit` で提示します。
+Claude Code と Codex は同じ安全なparent-output projectorを使います。監査用AIの自由文は内部に留め、
+`UserPromptSubmit`では検証済みtool IDだけを固定・非命令形の助言へ変換します。`Stop` findingは
+構造eventに記録し、後のturnへ注入しません。
 
 ```mermaid
 flowchart TD
     U([User 発話]) --> UPH[UserPromptSubmit hook<br/>Spotter が発話とカタログから一次判定]
-    UPH --> BT[Claude Thinking<br/>Spotter の推奨を<br/>additionalContext で受信]
+    UPH --> BT[Host model<br/>検証済みtool IDの<br/>固定助言を受け取る場合がある]
     BT --> BA([Claude の最初の応答])
     BA --> SH[Stop hook<br/>応答と使用済みツールから最終チェック]
     SH --> DEC{見落とし<br/>あり?}
     DEC -->|なし| DONE([完了])
-    DEC -->|あり| SB[.spotter/pending/ に積む<br/>v1.4.8 deferred delivery]
-    SB --> NEXT([次の UserPromptSubmit で<br/>additionalContext として配信])
+    DEC -->|あり| EVT[構造Hook eventへ記録<br/>次turnへは注入しない]
 ```
 
 ### カタログの収集経路
@@ -146,6 +146,54 @@ flowchart LR
 
 両者に共通するのは **「主体に頼らない仕組み」**。併用できます。
 
+### 任意の Throughline auditor context canary
+
+新規の project install では auditor context は **disabled** が既定です。これは project が所有する
+opt-in であり、Spotter 全体の production 既定ではありません。現在の候補は Spotter リポジトリだけの
+canary です。auditor-context オプションなしで `spotter install` を再実行した場合、既存プロジェクトの
+設定は保持されます。無効化へ戻すには次を実行します。
+
+```bash
+spotter install -y --auditor-context disabled
+```
+
+project を opt-in するには、絶対パスの Throughline 実行ファイルと、必要なら繰り返し指定できる
+`--throughline-arg` を設定します。
+
+```bash
+spotter install -y --auditor-context throughline \
+  --throughline-command /absolute/path/to/throughline
+```
+
+Windows では shell injection を避けるため `.cmd` / `.bat` wrapper を意図的に拒否します。絶対パスの
+`node.exe` を command にし、絶対パスの `throughline.mjs` を繰り返し引数として渡してください。
+
+```powershell
+spotter install -y --auditor-context throughline `
+  --throughline-command 'C:\Program Files\nodejs\node.exe' `
+  --throughline-arg 'C:\absolute\path\to\throughline\bin\throughline.mjs'
+```
+
+この connector の AI 呼出しは Codex CLI のみです。コンテキストを argv には載せず、AI へは stdin 経由で
+渡します。Haiku はこの context path に未対応であり、呼び出しません。Throughline 結果が `fresh` の時だけ
+AI 呼出し候補になり、それ以外の status では AI を呼びません。enabled connector の障害は hidden fallback
+ではなく固定 warning として出します。
+
+Throughline から渡すのは fresh な完了済み L2 user/assistant pair だけです。直近 2 pair (N=2)、各 body は
+600 文字、合計は 4,000 文字に制限します。Spotter は Throughline の L2、`reason`、`raw` を親へ反射せず、
+親には安全な catalog tool ID から作る固定・非命令形の助言だけを渡します。`spotter doctor` は command / args
+を表示せず、auditor-context mode と固定の availability detail だけを表示します。
+
+v2 model-matrix では context choice を明示できます。
+
+```bash
+spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v2.json \
+  --recent-turns 2 --body-cap 600
+```
+
+評価結論は現在 N=2 / 600 です。ただし rollout 承認ではありません。Spotter リポジトリ canary の
+7 日・30 fresh result gate は未完了です。
+
 ## よく使うコマンド
 
 ```bash
@@ -172,7 +220,7 @@ spotter codex-hook install
                          # Codex native hooks の修復 / 明示登録 (通常は spotter install が実行)
 spotter codex-hook diagnostics
                          # Codex hook の登録/readiness を診断。trust は /hooks で review
-spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v1.json
+spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v2.json --recent-turns 2 --body-cap 600
                          # pinned auditor model profile を再現可能に比較する experimental eval
 spotter uninstall        # hook 登録を解除 (~/.spotter は残す)
 ```
@@ -209,15 +257,16 @@ profile から production へ自動昇格しません。`latest` alias や
 
 ## 既知の制約
 
-- v1.4.8 以降、Claude / Codex 両 host で `Stop` hook は **遅延配送 (deferred delivery)** に統一されています。`Stop` で見落としツールを検出した場合、Spotter は `<projectRoot>/.spotter/pending/<sessionId>.json` に指摘を積み、次の same-session `UserPromptSubmit` で `additionalContext` として配信します。当ターンの最初の応答は transcript にそのまま残ります
-- pending ファイルは Claude / Codex が同じパス (`.spotter/pending/`) を共有します。host-neutral 設計です
-- **Haiku の JSON スキーマ違反は v0.5.0 以降「想定済み異常」として session renew + `role_collapse_reset` で回復**します。**v1.4.15 以降、auditor/daemon の失敗はプロンプトをブロックしません**: `UserPromptSubmit` は `[Spotter からの警告]` を出して exit 0。`Stop` 失敗も warning pending に積み、次の same-session prompt で1回配信します。直後に session が終わる場合だけ、配送先となる次 prompt がありません
+- `Stop` hookは最初の応答がstream済みになった後で発火します。v1.4.19以降は応答の書換え・継続強制・次turnへの監査文配送をせず、findingを構造Hook eventへ記録します。pre-responseの`UserPromptSubmit`精度が引き続き主軸です
+- `UserPromptSubmit.additionalContext`は受動的metadataではなくモデル可視contextです。v1.4.19以降はcatalog一致・grammar検証済みtool IDだけから決定論的に生成し、監査用AIのreason、backend message、provider stdout/stderrを反射しません
+- **Haiku の JSON スキーマ違反は v0.5.0 以降「想定済み異常」として session renew + `role_collapse_reset` で回復**します。**v1.4.19以降、auditor/daemonの失敗はモデルcontextにせずnon-blockingを維持**します。allow-list済み固定`systemMessage`・固定stderr・構造Hook eventだけを出してexit 0にします
 
 <details>
 <summary><strong>📋 最近のハイライト</strong></summary>
 
+- **親出力をルールベース化** (v1.4.19) — 監査用AIの自由文は親セッションへ入りません。検証済みtool IDだけがUserPromptSubmitの任意助言になり、Stop findingは無関係な次turnへ持ち越されません
 - **daemon は異常死しても復活する** (v1.4.16) — daemon が graceful shutdown を経ず死んでも (マシンスリープ / 強制終了 / `SessionEnd` 前の crash)、残った Unix socket が以後の起動を塞がなくなった。`startDaemon` が bind 前に orphan socket を除去するので、次の `UserPromptSubmit` の auto-resurrect が `EADDRINUSE` で crash-loop せずに成功し、「そのセッションが永久に未監査」になる事態を防ぐ
-- **失敗は声に出して縮退、host を固めない** (v1.4.15) — auditor backend が失敗したとき (例: codex のログイン失効) も、`UserPromptSubmit` hook はプロンプトを黙って消さずに `[Spotter からの警告]` を出して通す。codex ログイン失効時は直し方 (`codex login`) を明示する
+- **失敗は声に出して縮退、hostを固めない** (v1.4.15) — この版でbackend failureによるpromptのsilent消去を止めた。v1.4.19以降もnon-blocking挙動は維持し、旧model可視警告文は固定`systemMessage`・stderr・構造event診断へ置換した
 - **プラグイン形式の MCP サーバー対応** — `plugin:everything-claude-code:context7` のように名前に内部コロンを含むサーバーを正しくパースし、配下のツールをカタログに取り込めるようになった (旧版はこの形式のサーバーをすべて単一の `"plugin"` に潰して、Claude の監査から silent に脱落させていた)
 - **プロジェクト単位の監査隔離** — daemon が監査に使うのはローカル DB のみ。グローバル DB は description 再利用キャッシュに役割限定。**他プロジェクト**でインストールしたツールが現プロジェクトの監査に混入することはない
 - **手放しでカタログ維持** — `spotter install` が Claude DB を自動 seed、Claude / Codex それぞれの SessionStart が host-local DB を bg refresh する。手書き管理は一切不要

package/README.md

@@ -15,7 +15,7 @@
 
 Claude has a structural blind spot: **it can't reach for a tool it doesn't realize it needs**. It may skip a project memory MCP when a decision should be recorded, answer from stale memory instead of a docs-lookup MCP, or reason about UI state without a browser-automation MCP. The model can't always tell when it doesn't know — so the tool stays unused.
 
-Spotter runs a separate auditor with the full tool catalog and checks both the user's prompt and the primary agent's reply. Automatic selection uses Codex CLI on a Claude host when available, otherwise the session-scoped Haiku path; on a Codex host it defaults to Codex CLI. An explicit backend override takes precedence, but a runtime failure never silently switches backend. When Spotter finds a missed tool, it injects a transparent recommendation into the next available context. **The primary agent is never asked to self-audit** — that would defeat the premise. Detection happens through hooks, independent of the primary agent's intent.
+Spotter runs a separate auditor with the full tool catalog and checks both the user's prompt and the primary agent's reply. Automatic selection uses Codex CLI on a Claude host when available, otherwise the session-scoped Haiku path; on a Codex host it defaults to Codex CLI. An explicit backend override takes precedence, but a runtime failure never silently switches backend. Before the primary reply, validated tool IDs may become fixed, non-directive advice; after the reply, findings remain structured events and are not injected into a later turn. Auditor prose never enters the parent session. **The primary agent is never asked to self-audit** — that would defeat the premise. Detection happens through hooks, independent of the primary agent's intent.
 
 <p align="center">
   <img src=".github/concept.svg" alt="Claude answers · Spotter watches" width="80%">
@@ -62,6 +62,7 @@ For Codex, install enables the current `[features].hooks = true` flag and still
 Installer-owned Codex handlers use the current synchronous command schema. After install or upgrade, review them with `/hooks`, then open a fresh Codex session; `spotter codex-hook diagnostics` reports registration/readiness but does not guess hook trust.
 
 After upgrading Spotter, re-run `spotter install` in each installed project when release notes mention hook setting changes. The global package update changes the code path, but existing `.claude/settings.json` timeout values are not rewritten automatically.
+`v1.4.19` changes runtime output projection only, so already installed projects do not need another `spotter install`; update the global package and open a fresh Claude/Codex session.
 
 ```bash
 spotter uninstall        # remove hooks from this project
@@ -88,20 +89,19 @@ spotter codex-hook install
 
 ### Audit flow per turn
 
-Claude Code and Codex have different `Stop` surfaces. The diagram below is the Claude
-host flow. Codex native `Stop` uses deferred delivery: findings are queued and shown on
-the next same-session `UserPromptSubmit`.
+Claude Code and Codex share the same safe parent-output projector. Auditor prose stays
+internal; only validated tool IDs can become fixed, non-imperative advice on
+`UserPromptSubmit`. `Stop` records structured findings without injecting them into a later turn.
 
 ```mermaid
 flowchart TD
     U([User prompt]) --> UPH[UserPromptSubmit hook<br/>Spotter audits prompt against catalog]
-    UPH --> BT[Claude thinking<br/>receives Spotter's recommendations<br/>as additionalContext]
+    UPH --> BT[Host model<br/>may receive fixed advisory<br/>with validated tool IDs]
     BT --> BA([Claude's first answer])
     BA --> SH[Stop hook<br/>Spotter re-audits answer + tools used]
     SH --> DEC{Missed<br/>tool?}
     DEC -->|No| DONE([Done])
-    DEC -->|Yes| SB[Queue finding to .spotter/pending/<br/>v1.4.8 deferred delivery]
-    SB --> NEXT([Surfaces as additionalContext<br/>on next UserPromptSubmit])
+    DEC -->|Yes| EVT[Record structured Hook event<br/>no next-turn injection]
 ```
 
 ### Catalog discovery
@@ -146,6 +146,58 @@ The audited catalog is host-local: Claude uses `<project>/.spotter/tool-db.json`
 
 Both share the principle of **"don't rely on the primary agent to do it itself."** They compose well — you can run them together.
 
+### Optional Throughline auditor context canary
+
+Fresh project installs keep auditor context **disabled**. This is a project-owned
+opt-in, not a production-wide default: the current candidate is a canary in the
+Spotter repository only. Re-running `spotter install` without auditor-context
+options preserves the project's existing setting. Disable it again with:
+
+```bash
+spotter install -y --auditor-context disabled
+```
+
+To opt a project in, configure a direct absolute Throughline executable and any
+leading arguments with repeatable `--throughline-arg`:
+
+```bash
+spotter install -y --auditor-context throughline \
+  --throughline-command /absolute/path/to/throughline
+```
+
+On Windows, `.cmd` and `.bat` wrappers are deliberately rejected to avoid shell
+injection. Point at an absolute `node.exe` and pass the absolute
+`throughline.mjs` path as a repeated argument instead:
+
+```powershell
+spotter install -y --auditor-context throughline `
+  --throughline-command 'C:\Program Files\nodejs\node.exe' `
+  --throughline-arg 'C:\absolute\path\to\throughline\bin\throughline.mjs'
+```
+
+The connector is Codex CLI-only. It sends no context in argv: the bounded
+projection is supplied to that AI over stdin. Haiku does not support this
+context path and is never called for it. Only a `fresh` Throughline result is
+eligible for an AI call; every other status skips AI. An enabled connector
+failure becomes a fixed warning, not a hidden fallback.
+
+Throughline contributes only fresh, completed L2 user/assistant pairs: two
+recent pairs (N=2), each body capped at 600 characters and 4,000 characters in
+total. Spotter never reflects Throughline L2, `reason`, or `raw` to the parent.
+The parent receives only fixed non-imperative advice built from safe catalog tool
+IDs. `spotter doctor` displays the auditor-context mode and a fixed availability
+detail without printing its command or arguments.
+
+The v2 model-matrix can make the context choice explicit:
+
+```bash
+spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v2.json \
+  --recent-turns 2 --body-cap 600
+```
+
+Current evaluation conclusion is N=2 / 600. It is not a rollout approval: the
+Spotter-repository canary still lacks its 7-day and 30-fresh-result gates.
+
 ## Common commands
 
 ```bash
@@ -173,7 +225,7 @@ spotter codex-hook install
                          # repair / explicitly register Codex native hooks (normally handled by spotter install)
 spotter codex-hook diagnostics
                          # check Codex hook registration/readiness; trust is reviewed with /hooks
-spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v1.json
+spotter auditor model-matrix --fixtures test/fixtures/auditor-model-matrix.v2.json --recent-turns 2 --body-cap 600
                          # experimental reproducible comparison of pinned auditor model profiles
 spotter uninstall        # remove hooks from this project (leaves ~/.spotter intact)
 ```
@@ -211,15 +263,16 @@ the production values for controlled experiments; diagnostics mark overrides as
 
 ## Known limitations
 
-- The `Stop` hook fires **after** the first answer has already been streamed. Spotter therefore queues a finding for the next same-session prompt instead of rewriting that answer. Detection accuracy in `UserPromptSubmit` (the *pre-response* stage) remains the primary quality axis
-- `Stop` hook is **deferred** for both Claude and Codex hosts as of v1.4.8. When Spotter finds a missed tool at `Stop`, it appends the finding to `<projectRoot>/.spotter/pending/<sessionId>.json` and surfaces it on the next same-session `UserPromptSubmit` as `additionalContext`. The original assistant message stays as the turn's final transcript entry — no `decision:"block"` re-generation cycle. The same pending file is shared by Claude and Codex (host-neutral path)
-- **Since v0.5.0, JSON schema violations from Haiku are treated as expected anomalies** (session renew + `role_collapse_reset`). **Since v1.4.15, an auditor/daemon failure no longer blocks the prompt**: `UserPromptSubmit` emits a loud `[Spotter からの警告]` and exits 0. A `Stop` failure is queued as the same kind of warning and delivered once on the next same-session prompt. If the session ends immediately, no later prompt exists and that final warning cannot be surfaced
+- The `Stop` hook fires **after** the first answer has already been streamed. Spotter records a structured finding but does not rewrite the answer, force a continuation, or inject auditor text into the next prompt. Detection accuracy in `UserPromptSubmit` (the *pre-response* stage) remains the primary quality axis
+- `UserPromptSubmit.additionalContext` is model-visible context, not passive metadata. Since v1.4.19 it is generated only by a deterministic projector from catalog-matched, grammar-checked tool IDs. Auditor reasons, backend messages, and provider stdout/stderr are never reflected into it
+- **Since v0.5.0, JSON schema violations from Haiku are treated as expected anomalies** (session renew + `role_collapse_reset`). **Since v1.4.19, an auditor/daemon failure remains non-blocking without becoming model context**: Claude and Codex emit only an allow-listed fixed `systemMessage`, fixed stderr, and a structured Hook event, then exit 0
 
 <details>
 <summary><strong>📋 Recent highlights</strong></summary>
 
+- **Rule-based parent output boundary** (v1.4.19) — auditor AI prose cannot enter parent-session Hook output. Validated tool IDs become optional fixed advice on `UserPromptSubmit`; `Stop` findings stay structured and are never carried into an unrelated next turn
 - **Daemon recovers after an ungraceful death** (v1.4.16) — if the daemon dies without graceful shutdown (machine sleep, force-quit, crash before `SessionEnd`), the Unix socket it leaves behind no longer bricks every restart. `startDaemon` removes the orphaned socket before binding, so the next `UserPromptSubmit` auto-resurrect succeeds instead of crash-looping on `EADDRINUSE` and leaving the session permanently unaudited
-- **Failures degrade loudly, never freeze the host** (v1.4.15) — when the auditor backend fails (e.g. codex login expired), the `UserPromptSubmit` hook surfaces a `[Spotter からの警告]` and lets your prompt through instead of silently erasing it. codex login expiry names the one-line fix (`codex login`)
+- **Failures degrade loudly, never freeze the host** (v1.4.15) — this release stopped backend failure from silently erasing a prompt. Since v1.4.19, the non-blocking behavior remains but the old model-visible warning text is replaced by fixed `systemMessage`, stderr, and structured event diagnostics
 - **Plugin-scoped MCP servers** — names like `plugin:everything-claude-code:context7` (with internal colons) are now parsed correctly and their tools enter the catalog. Earlier versions silently collapsed all plugin MCP servers into a single literal `"plugin"`, dropping their tools from Claude's audit
 - **Per-project / per-host audit isolation** — the daemon audits against the local DB only; global DBs are host-specific description caches. Tools discovered in *other* projects or another host can never bleed into this project's audit set
 - **Zero-touch catalog** — `spotter install` seeds the Claude DB automatically; Claude and Codex SessionStart hooks keep their host-local DBs fresh in the background. You never have to maintain the tool list by hand

package/bin/spotter.mjs

@@ -21,7 +21,9 @@ import { runSessionEnd } from '../src/hooks/session-end.mjs';
 const USAGE = `spotter — Claude Code tool-call auditor
 
 Usage:
-  spotter install [-y]                  register hooks in <cwd>/.claude/settings.json
+  spotter install [-y] [--auditor-context disabled|throughline]
+                                        [--throughline-command ABS] [--throughline-arg VALUE]
+                                        register hooks in <cwd>/.claude/settings.json
                                         and create <cwd>/.spotter/marker.json
                                         (run inside each project you want audited)
   spotter install --user [-y]           legacy: register globally in ~/.claude/settings.json
@@ -75,9 +77,8 @@ async function main() {
   const [cmd, ...rest] = argv;
   switch (cmd) {
     case 'install': {
-      const target = rest.includes('--user') ? 'user' : 'project';
-      const autoYes = rest.includes('-y') || rest.includes('--yes');
-      await runInstall({ target, autoYes });
+      const options = parseInstallArgs(rest);
+      await runInstall(options);
       return;
     }
     case 'uninstall': {
@@ -140,6 +141,60 @@ async function main() {
   }
 }
 
+function parseInstallArgs(argv) {
+  let target = 'project';
+  let autoYes = false;
+  let mode = null;
+  let command = null;
+  const args = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--user') {
+      if (target === 'user') throw invalidInstallArgs();
+      target = 'user';
+    } else if (arg === '-y' || arg === '--yes') {
+      if (autoYes) throw invalidInstallArgs();
+      autoYes = true;
+    } else if (arg === '--auditor-context') {
+      if (mode !== null) throw invalidInstallArgs();
+      mode = argv[++index];
+      if (mode !== 'disabled' && mode !== 'throughline') throw invalidInstallArgs();
+    } else if (arg === '--throughline-command') {
+      if (command !== null) throw invalidInstallArgs();
+      command = argv[++index];
+      if (typeof command !== 'string' || command.length === 0) throw invalidInstallArgs();
+    } else if (arg === '--throughline-arg') {
+      const value = argv[++index];
+      if (typeof value !== 'string' || value.length === 0) throw invalidInstallArgs();
+      args.push(value);
+    } else {
+      throw invalidInstallArgs();
+    }
+  }
+  if (mode === null && (command !== null || args.length > 0)) throw invalidInstallArgs();
+  if (mode === 'disabled' && (command !== null || args.length > 0)) throw invalidInstallArgs();
+  if (mode === 'throughline' && (command === null || !isAbsoluteCommand(command) || isShellWrapper(command))) throw invalidInstallArgs();
+  const auditorContext = mode === null ? undefined : mode === 'disabled'
+    ? { mode: 'disabled' }
+    : { mode: 'throughline', command, args };
+  return { target, autoYes, auditorContext };
+}
+
+function isAbsoluteCommand(value) {
+  return value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value);
+}
+
+function isShellWrapper(value) {
+  return /\.(?:cmd|bat)$/i.test(value);
+}
+
+function invalidInstallArgs() {
+  const err = new Error('invalid install arguments');
+  err.stack = '';
+  err.exitCode = 2;
+  return err;
+}
+
 main().catch((err) => {
   process.stderr.write(`spotter: ${err.stack || err.message || err}\n`);
   process.exit(err.exitCode ?? 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.4.18",
+  "version": "1.4.20",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/auditor-cmd.mjs

@@ -37,7 +37,7 @@ export async function runAuditorCommand({ argv = process.argv.slice(2) } = {}) {
   }
   if (sub === 'model-matrix') {
     if (argv.slice(1).includes('--help') || argv.slice(1).includes('-h')) {
-      process.stdout.write(`Usage: spotter auditor model-matrix --fixtures FILE [--profile baseline|luna|terra|terra-medium]...\n       [--repeat N] [--project DIR] [--output FILE]\n`);
+      process.stdout.write(`Usage: spotter auditor model-matrix --fixtures FILE [--profile baseline|luna|terra|terra-medium]...\n       [--repeat N] [--recent-turns 0|1|2|3] [--body-cap CHARS] [--project DIR] [--output FILE]\n`);
       return;
     }
     await runAuditorModelMatrixCommand({ argv: argv.slice(1) });

package/src/cli/auditor-model-matrix-cmd.mjs

@@ -4,7 +4,7 @@ import { promisify } from 'node:util';
 import { readFile, writeFile } from 'node:fs/promises';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { version } from '../version.mjs';
-import { createCodexCliAuditorBackend } from '../core/codex-cli-backend.mjs';
+import { CODEX_AUDITOR_PROMPT_VERSION, createCodexCliAuditorBackend } from '../core/codex-cli-backend.mjs';
 import { CODEX_AUDITOR_MODEL_POLICY, resolveCodexAuditorModelSelection } from '../core/codex-auditor-model-policy.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -21,6 +21,7 @@ export async function runAuditorModelMatrixCommand({
   const raw = await readFileFn(opts.fixturesPath);
   const fixtureBytes = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
   const fixture = parseAndValidateFixture(fixtureBytes.toString('utf8'));
+  const contextOptions = resolveContextOptions(opts, fixture.schema);
   if (fixture.cases.length * opts.repeat * opts.profiles.length > MAX_MODEL_MATRIX_RUNS) {
     throw new Error(`model-matrix run count exceeds maximum ${MAX_MODEL_MATRIX_RUNS}`);
   }
@@ -40,7 +41,7 @@ export async function runAuditorModelMatrixCommand({
     const modelSelection = selections[profile];
     try {
       const backend = backends[profile];
-      const judgment = await backend.judge({ ...toAuditorInput(item), meta: { caseId: item.id, repeat, profile } });
+      const judgment = await backend.judge({ ...toAuditorInput(item, contextOptions), meta: { caseId: item.id, repeat, profile } });
       if (!sameSelection(modelSelection, judgment?.meta?.modelSelection)) {
         throw new Error('judgment model selection does not match backend model selection');
       }
@@ -87,6 +88,7 @@ export async function runAuditorModelMatrixCommand({
     schema: 'spotter.auditor_model_matrix.v1', generatedAt: generatedAt(), packageVersion: version,
     fixture: { schema: fixture.schema, path: safeFixturePath(opts.fixturesPath, opts.projectRoot), sha256: createHash('sha256').update(fixtureBytes).digest('hex'), cases: fixture.cases.length, catalogCount: fixture.catalog.length },
     codexCli: cliVersion, policy: { schema: CODEX_AUDITOR_MODEL_POLICY.schema, version: CODEX_AUDITOR_MODEL_POLICY.policyVersion },
+    auditorPromptVersion: CODEX_AUDITOR_PROMPT_VERSION,
     profiles: Object.fromEntries(Object.entries(selections).map(([profile, selection]) => [profile, {
       model: selection.effectiveModel,
       reasoningEffort: selection.effectiveReasoningEffort,
@@ -96,7 +98,7 @@ export async function runAuditorModelMatrixCommand({
       selection,
     }])), runs, summary: summarize(runs, opts.profiles), usageStatus: usage.status, tokenUsage: usage.summary,
     costStatus: 'not-available-chatgpt-plan', cost: null,
-    evaluation: { repeat: opts.repeat, profiles: opts.profiles, maxRuns: MAX_MODEL_MATRIX_RUNS },
+    evaluation: { repeat: opts.repeat, profiles: opts.profiles, maxRuns: MAX_MODEL_MATRIX_RUNS, recentTurns: contextOptions.recentTurns, bodyCap: contextOptions.bodyCap },
     executionOrdering: 'case-repeat-profile', promotionEligible: false, blockingReasons: blockingReasons(runs, usage.status),
   };
   const json = JSON.stringify(artifact, null, 2) + '\n';
@@ -106,7 +108,7 @@ export async function runAuditorModelMatrixCommand({
 }
 
 function parseArgs(argv) {
-  const opts = { fixturesPath: null, profiles: [], repeat: 1, projectRoot: process.cwd(), outputPath: null };
+  const opts = { fixturesPath: null, profiles: [], repeat: 1, projectRoot: process.cwd(), outputPath: null, recentTurns: null, bodyCap: null };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i]; const value = () => { const v = argv[++i]; if (!v || v.startsWith('--')) throw new Error(`${arg} requires a value`); return v; };
     if (arg === '--fixtures') opts.fixturesPath = resolve(value());
@@ -114,10 +116,14 @@ function parseArgs(argv) {
     else if (arg === '--repeat') opts.repeat = Number(value());
     else if (arg === '--project') opts.projectRoot = resolve(value());
     else if (arg === '--output') opts.outputPath = resolve(value());
+    else if (arg === '--recent-turns') opts.recentTurns = Number(value());
+    else if (arg === '--body-cap') opts.bodyCap = Number(value());
     else throw new Error(`unknown auditor model-matrix option: ${arg}`);
   }
   if (!opts.fixturesPath) throw new Error('--fixtures FILE is required');
   if (!Number.isInteger(opts.repeat) || opts.repeat < 1) throw new Error('--repeat must be a positive integer');
+  if (opts.recentTurns !== null && (!Number.isInteger(opts.recentTurns) || opts.recentTurns < 0 || opts.recentTurns > 3)) throw new Error('--recent-turns must be 0, 1, 2, or 3');
+  if (opts.bodyCap !== null && (!Number.isInteger(opts.bodyCap) || opts.bodyCap <= 0)) throw new Error('--body-cap must be a positive integer');
   opts.profiles = opts.profiles.length ? opts.profiles : [...DEFAULT_PROFILES];
   if (new Set(opts.profiles).size !== opts.profiles.length || opts.profiles.some((profile) => !ALLOWED_PROFILES.includes(profile))) throw new Error('--profile must be baseline, luna, terra, or terra-medium without duplicates');
   return opts;
@@ -126,7 +132,7 @@ function parseArgs(argv) {
 function parseAndValidateFixture(raw) {
   let fixture; try { fixture = JSON.parse(raw); } catch { throw new Error('fixture must be valid JSON'); }
   objectOnly(fixture, ['schema', 'catalog', 'cases'], 'fixture');
-  if (fixture.schema !== 'spotter.auditor_model_fixtures.v1') throw new Error('unsupported fixture schema');
+  if (!['spotter.auditor_model_fixtures.v1', 'spotter.auditor_model_fixtures.v2'].includes(fixture.schema)) throw new Error('unsupported fixture schema');
   if (!Array.isArray(fixture.catalog) || !Array.isArray(fixture.cases) || fixture.cases.length === 0) throw new Error('fixture catalog and non-empty cases are required');
   const catalogNames = new Set();
   for (const tool of fixture.catalog) { objectOnly(tool, ['name', 'description'], 'catalog tool'); clean(tool.name, 'catalog name'); clean(tool.description, 'catalog description'); if (catalogNames.has(tool.name)) throw new Error('duplicate catalog name'); catalogNames.add(tool.name); }
@@ -135,7 +141,7 @@ function parseAndValidateFixture(raw) {
     objectOnly(item, ['id', 'stage', 'input', 'expected'], 'case'); clean(item.id, 'case id');
     if (ids.has(item.id)) throw new Error('duplicate case id'); ids.add(item.id);
     if (!['user_input', 'turn_end'].includes(item.stage)) throw new Error('case stage is invalid');
-    validateInput(item.stage, item.input); objectOnly(item.expected, ['pass', 'missingTools'], 'case expected');
+    validateInput(fixture.schema, item.stage, item.input); objectOnly(item.expected, ['pass', 'missingTools'], 'case expected');
     if (typeof item.expected.pass !== 'boolean' || !Array.isArray(item.expected.missingTools)
       || new Set(item.expected.missingTools).size !== item.expected.missingTools.length
       || item.expected.missingTools.some((name) => typeof name !== 'string' || !catalogNames.has(name))
@@ -145,8 +151,9 @@ function parseAndValidateFixture(raw) {
 }
 function objectOnly(value, keys, label) { if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some((key) => !keys.includes(key))) throw new Error(`${label} has invalid fields`); }
 function clean(value, label) { if (typeof value !== 'string' || value.length === 0 || value.trim() !== value) throw new Error(`${label} must be a clean non-empty string`); }
-function validateInput(stage, input) { if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('case input is invalid'); if (stage === 'user_input') { objectOnly(input, ['userInput'], 'user_input input'); clean(input.userInput, 'userInput'); } else { objectOnly(input, ['finalResponse', 'usedTools'], 'turn_end input'); clean(input.finalResponse, 'finalResponse'); if (!Array.isArray(input.usedTools) || input.usedTools.some((tool) => typeof tool !== 'string' || tool.length === 0 || tool.trim() !== tool) || new Set(input.usedTools).size !== input.usedTools.length) throw new Error('usedTools is invalid'); } }
-function toAuditorInput(item) { return item.stage === 'user_input' ? { stage: item.stage, userInput: item.input.userInput } : { stage: item.stage, finalResponse: item.input.finalResponse, usedTools: item.input.usedTools }; }
+function validateInput(schema, stage, input) { if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('case input is invalid'); if (stage === 'user_input') { objectOnly(input, schema === 'spotter.auditor_model_fixtures.v2' ? ['userInput', 'recentContext'] : ['userInput'], 'user_input input'); clean(input.userInput, 'userInput'); if (schema === 'spotter.auditor_model_fixtures.v2') { if (!Array.isArray(input.recentContext) || input.recentContext.length < 1 || input.recentContext.length > 3) throw new Error('recentContext must contain one to three turns'); for (const turn of input.recentContext) { objectOnly(turn, ['user', 'assistant'], 'recentContext turn'); clean(turn.user, 'recentContext user'); clean(turn.assistant, 'recentContext assistant'); } } } else { objectOnly(input, ['finalResponse', 'usedTools'], 'turn_end input'); clean(input.finalResponse, 'finalResponse'); if (!Array.isArray(input.usedTools) || input.usedTools.some((tool) => typeof tool !== 'string' || tool.length === 0 || tool.trim() !== tool) || new Set(input.usedTools).size !== input.usedTools.length) throw new Error('usedTools is invalid'); } }
+function resolveContextOptions(opts, schema) { if (schema === 'spotter.auditor_model_fixtures.v1') { if (opts.recentTurns !== null || opts.bodyCap !== null) throw new Error('--recent-turns and --body-cap require a v2 fixture'); return { recentTurns: null, bodyCap: null }; } return { recentTurns: opts.recentTurns ?? 2, bodyCap: opts.bodyCap ?? 1200 }; }
+function toAuditorInput(item, contextOptions) { if (item.stage !== 'user_input') return { stage: item.stage, finalResponse: item.input.finalResponse, usedTools: item.input.usedTools }; const input = { stage: item.stage, userInput: item.input.userInput }; if (contextOptions.recentTurns > 0 && item.input.recentContext) input.recentContext = item.input.recentContext.slice(-contextOptions.recentTurns).map((turn) => ({ user: turn.user.slice(-contextOptions.bodyCap), assistant: turn.assistant.slice(-contextOptions.bodyCap) })); return input; }
 function isCleanString(value) { return typeof value === 'string' && value.length > 0 && value.trim() === value; }
 function cleanStrings(values = []) { return [...new Set(values.filter(isCleanString))]; }
 function successRun({ order, item, repeat, profile, modelSelection, durationMs, schemaSuccess, actualPass, actualTools, invalidFindingCount, droppedTools, droppedToolCount, anomalyTypes, anomalyCount, tokenUsage }) { const expectedTools = item.expected.missingTools; const fp = [...actualTools.filter((tool) => !expectedTools.includes(tool)), ...droppedTools.filter((tool) => !expectedTools.includes(tool))]; const fn = expectedTools.filter((tool) => !actualTools.includes(tool)); return { order, caseId: item.id, repeat, profile, status: 'success', durationMs, schemaSuccess, exactMatch: schemaSuccess && actualPass === item.expected.pass && actualTools.length === expectedTools.length && fp.length === 0 && fn.length === 0 && droppedToolCount === 0 && anomalyCount === 0, expected: item.expected, actual: { pass: actualPass, missingTools: actualTools, invalidFindingCount, droppedCatalogExternalNames: droppedTools, droppedCatalogExternalNameCount: droppedToolCount, anomalies: anomalyTypes, anomalyCount }, falsePositiveTools: fp, falseNegativeTools: fn, modelSelection, tokenUsage }; }