claude-spotter 1.4.23 → 1.4.24

package/CHANGELOG.md

@@ -1,11 +1,22 @@
 # Changelog
 
-## 1.4.23 — release candidate (pending)
+## 1.4.24 — 2026-07-14
+
+- **installerがruntime error state rootをowner-privateへ正規化。** `spotter install`は
+  Hook・tool DB・daemon stateを作る前に、runtime storeと同じPOSIX uid / modeまたは
+  Windows current-SID-only DACL契約でglobal state rootを準備する。fresh installだけでなく、
+  umaskにより`0755` / `0775`で残っていた既存`~/.spotter`もPOSIXでは`0700`へ修復する。
+- **unsafe pathを修復前に拒否。** POSIXのtype・symlink・owner検証を`chmod`より前へ移し、
+  `~/.spotter`がsymlinkの場合にリンク先のmodeを変えてから失敗する副作用を防いだ。
+  read-timeのmode検証、Windows DACL、collection明示opt-in、network非依存契約は変更しない。
+
+## 1.4.23 — 2026-07-13
 
 - **Factory diagnostics と local runtime error store。** factory diagnostics と
   `spotter diagnostics runtime-errors` の公開候補。収集は canonical dotagents config の
   JSON boolean `collection.enabled: true` が明示された時だけ有効で既定OFF、保存は
-  local-only、network送信は行わない。npm公開、tag、CI、registry由来installの確認は未実施。
+  local-only、network送信は行わない。公開commit `a117a99`、CI `29238199094`、npm
+  `latest`、tag / GitHub Release、registry由来隔離installと診断snapshotを確認済み。
 - **隔離observerのdeadlineを実測へ整合。** 並列full-suite負荷でcold workerとreceipt
   reconcilerが500msに収まらず、commit済みreceiptを`store_unavailable`へ誤分類するraceを
   再現した。絶対deadlineを1.5秒へ広げたうえでreceipt reconcilerを観測workerと

package/README.md

@@ -248,9 +248,9 @@ otherwise the Haiku-compatible path. Codex native hooks automatically select Cod
 
 ## Local runtime error aggregates
 
-**v1.4.23 は release candidate（公開待ち）です。** 以下の factory diagnostics と
-local runtime error aggregate は collection が既定OFFで、公開・tag・CI・registry由来
-installの確認はいずれも未完了です。
+**v1.4.23 は2026-07-13に公開済みです。** 以下の factory diagnostics と local runtime
+error aggregate は collection が既定OFFです。npm `latest`、tag / GitHub Release、
+公開CI、registry由来installを確認済みです。
 
 Spotter collects fixed-code runtime failures only when the canonical dotagents factory reporter
 configuration contains the JSON boolean `collection.enabled: true`. Missing, malformed, and disabled

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.4.23",
+  "version": "1.4.24",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/install.mjs

@@ -23,6 +23,7 @@ import { version as SPOTTER_VERSION } from '../version.mjs';
 import { refresh } from '../tool-db/refresh.mjs';
 import { localDbPath, globalDbPath } from '../tool-db/loader.mjs';
 import { installCodexHooks } from './codex-hook-cmd.mjs';
+import { prepareRuntimeErrorStoreDirectory } from '../core/runtime-error-store.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_ROOT = resolve(HERE, '..', '..');
@@ -58,6 +59,7 @@ export async function runInstall({
   refreshFn = refresh,
   codexCliPresentFn = isCodexCliPresent,
   installCodexHooksFn = installCodexHooks,
+  prepareRuntimeErrorStoreDirectoryFn = prepareRuntimeErrorStoreDirectory,
   auditorContext,
   resolveDefaultAuditorContextFn = resolveDefaultAuditorContext,
 } = {}) {
@@ -70,6 +72,7 @@ export async function runInstall({
   console.log(`  settings: ${settingsPath}`);
 
   // 1. create directories
+  await prepareRuntimeErrorStoreDirectoryFn();
   await mkdir(SPOTTER_HOME, { recursive: true });
   await mkdir(join(SPOTTER_HOME, 'runtime'), { recursive: true });
   await mkdir(join(SPOTTER_HOME, 'workdir'), { recursive: true });

package/src/core/runtime-error-store.mjs

@@ -90,6 +90,11 @@ export function defaultRuntimeErrorStorePath({
   return join(homeDir, '.spotter', 'runtime-errors-v1.json');
 }
 
+export async function prepareRuntimeErrorStoreDirectory(options = {}) {
+  const storePath = options.storePath ?? defaultRuntimeErrorStorePath(options);
+  await ensurePrivateDirectory(dirname(storePath), options);
+}
+
 export function runtimeErrorFingerprint(definition) {
   validateDefinition(definition);
   const canonical = [
@@ -578,22 +583,29 @@ async function enforcePrivatePath(path, options, { directory, repair }) {
     if (repair) await runWindowsAcl(path, { directory }, options);
     return;
   }
+  const initialInfo = await lstat(path);
+  validatePrivateIdentity(initialInfo, options, { directory, platform });
   if (repair) await chmod(path, directory ? 0o700 : 0o600);
   const info = await lstat(path);
   validatePrivateStat(info, options, { directory, platform });
 }
 
-function validatePrivateStat(info, options, { directory, platform }) {
+function validatePrivateIdentity(info, options, { directory, platform }) {
   if ((directory ? !info.isDirectory() : !info.isFile()) || info.isSymbolicLink()) {
     throw storeError('runtime error path type is unsafe');
   }
   if (platform === 'win32') return;
-  const expectedMode = directory ? 0o700 : 0o600;
-  if ((info.mode & 0o777) !== expectedMode) throw storeError('runtime error path mode is unsafe');
   const getuid = options.getuidFn ?? process.getuid?.bind(process);
   if (typeof getuid === 'function' && info.uid !== getuid()) throw storeError('runtime error path owner is unsafe');
 }
 
+function validatePrivateStat(info, options, { directory, platform }) {
+  validatePrivateIdentity(info, options, { directory, platform });
+  if (platform === 'win32') return;
+  const expectedMode = directory ? 0o700 : 0o600;
+  if ((info.mode & 0o777) !== expectedMode) throw storeError('runtime error path mode is unsafe');
+}
+
 export function buildWindowsAclPowerShell({ directory }) {
   const securityType = directory ? 'DirectorySecurity' : 'FileSecurity';
   const ioType = directory ? 'Directory' : 'File';