claude-spotter 1.4.9 → 1.4.10

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 1.4.10
+
+**Claude host primary auditor: Codex CLI 検出で自動採用、なければ Haiku の 2 段選択へ**。
+v1.4.7 までは Phase 5 opt-in の `SPOTTER_AUDITOR_BACKEND_POLICY=next` を立てたセッションだけが
+Codex CLI を primary auditor に使い、それ以外は無条件で Haiku を呼んでいた。実測 (Phase 4 matrix
+2026-05-06: `claude.codex-cli=10041ms` vs Haiku `user_input ~14.3s / turn_end ~16.6s`) で Codex CLI
+の latency 優位は十分に確定していたため、opt-in を撤廃して既定動作を「Codex CLI 検出時 CLI、
+なければ Haiku」に変更する。検出は configuration-time (daemon 起動時に env.PATH を同期 walk、
+spawn 無し)。一度選ばれた backend が runtime で落ちた場合は従来通り `AuditorBackendError` を
+throw する (§0 fallback 禁止維持) — 検出は **selection-time のみ**で、runtime 失敗時に別 backend へ
+silent retry することはない。codex-sidecar は `spotter codex *` の明示 second-pass workflow
+専用に固定 (現セッションでも `[caveat:codex-sidecar] advisory unavailable: sidecar command failed`
+を観測したため、primary chain には入れない)。Codex host の primary backend (`codex-cli` 固定) と
+監査用子プロセスのモデル指定 (`gpt-5.4-mini` / `model_reasoning_effort="low"`) は変更なし。
+
+### 変更点
+
+- **新規 [src/core/codex-cli-availability.mjs](src/core/codex-cli-availability.mjs)**:
+  `isCodexCliAvailable({env, platform, fileExists})` を追加。env.PATH を同期 walk して codex
+  バイナリの実在を判定する。Windows は PATHEXT 相当 (`.cmd` / `.exe` / `.bat`) を試行、`Path` を
+  優先しつつ `PATH` を fallback として受理。subprocess は spawn しない。
+- **編集 [src/core/auditor-backend.mjs](src/core/auditor-backend.mjs)**:
+  `selectByPolicy` を policy 区分 (`current` / `next`) ベースから availability ベースに置換。
+  Claude host = `isCodexCliAvailable` 結果で `codex-cli` / `haiku` を分岐、
+  Codex host = `codex-cli` 固定。`SPOTTER_AUDITOR_BACKEND_POLICY` 環境変数は legacy 値
+  (`current` / `next`) を引き続き受理するが selection には影響しない (back-compat)。
+  `selectAuditorBackend` / `createAuditorBackend` に `isCodexCliAvailable` DI パラメータを追加。
+  `createAuditorBackend` は選択結果と理由を logger に 1 行出力する。
+- **編集 [src/daemon/daemon.mjs](src/daemon/daemon.mjs)**:
+  `auditorBackendName` のデフォルトを `'haiku'` から `'auto'` に変更。`haikuCaller` が明示注入
+  された呼び出し (テスト経路) では `'haiku'` を既定にし、test 用 fixture が `projectRoot` 不要で
+  動作するよう保つ。
+- **編集 [src/cli/auditor-cmd.mjs](src/cli/auditor-cmd.mjs)**:
+  `parseJudgeArgs` の backend デフォルトを `'auto'` に変更 (旧: `SPOTTER_AUDITOR_BACKEND_POLICY`
+  が無いと `'haiku'` 固定だった)。
+- **新規 [test/codex-cli-availability.test.mjs](test/codex-cli-availability.test.mjs)**:
+  POSIX / Windows / 空 PATH / malformed PATH / `path.posix` vs `path.win32` の 7 件回帰ガード。
+- **編集 [test/auditor-backend.test.mjs](test/auditor-backend.test.mjs)**:
+  旧 `policy_current_*` / `policy_next_*` テストを availability-based テスト
+  (`claude_host_codex_cli_detected` / `claude_host_codex_cli_unavailable` / `codex_host`) に置換、
+  legacy policy 値の受理 + selection 無効化テスト、`createAuditorBackend` の logger 出力テストを追加。
+
+### ユーザー側で必要な手順
+
+1. `npm install -g claude-spotter@1.4.10`
+2. 既存プロジェクトでの settings.json 再生成は不要 (hook command path / contract に変更なし)。
+3. `SPOTTER_AUDITOR_BACKEND_POLICY=next` を export していたユーザーは設定を外して構わない
+   (受理はするが既定動作と同じになる)。`SPOTTER_AUDITOR_BACKEND=haiku` の明示固定は引き続き有効。
+
 ## 1.4.9
 
 **Codex hooks feature 名の現行 CLI 追従**。現行 Codex CLI の `codex features list` は

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.4.9",
+  "version": "1.4.10",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/auditor-cmd.mjs

@@ -292,7 +292,7 @@ function parseJudgeArgs(argv) {
     inputPath: null,
     projectRoot: process.cwd(),
     hostAgent: null,
-    backend: process.env.SPOTTER_AUDITOR_BACKEND || (process.env.SPOTTER_AUDITOR_BACKEND_POLICY ? 'auto' : 'haiku'),
+    backend: process.env.SPOTTER_AUDITOR_BACKEND || 'auto',
   };
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];

package/src/core/auditor-backend.mjs

@@ -12,6 +12,7 @@ import { AuditorBackendError } from './auditor-error.mjs';
 import { detectHostAgent } from './host-agent.mjs';
 import { createCodexCliAuditorBackend } from './codex-cli-backend.mjs';
 import { createCodexSidecarAuditorBackend } from './codex-sidecar-auditor-backend.mjs';
+import { isCodexCliAvailable as defaultIsCodexCliAvailable } from './codex-cli-availability.mjs';
 
 export { AuditorBackendError } from './auditor-error.mjs';
 export {
@@ -33,10 +34,17 @@ export function createAuditorBackend({
   logger = () => {},
   haikuCaller = null,
   timeoutMs = DEFAULT_HAIKU_AUDITOR_TIMEOUT_MS,
+  isCodexCliAvailable = defaultIsCodexCliAvailable,
 } = {}) {
   const selected = backend === 'auto'
-    ? selectAuditorBackend({ hostAgent, env, projectConfig: projectRoot ? { projectRoot } : null })
+    ? selectAuditorBackend({
+        hostAgent,
+        env,
+        projectConfig: projectRoot ? { projectRoot } : null,
+        isCodexCliAvailable,
+      })
     : { backend, mode: backend, compatibility: backend === 'haiku' ? 'current_haiku' : 'none', reason: 'explicit_backend' };
+  logger(`auditor backend selected: backend=${selected.backend} reason=${selected.reason}`);
   if (selected.backend === 'haiku') {
     return createHaikuAuditorBackend({ catalog, logger, haikuCaller, timeoutMs });
   }
@@ -126,6 +134,7 @@ export function selectAuditorBackend({
   env = process.env,
   projectConfig = null,
   stage = 'user_input',
+  isCodexCliAvailable = defaultIsCodexCliAvailable,
 } = {}) {
   const explicit = env?.SPOTTER_AUDITOR_BACKEND;
   const policy = env?.SPOTTER_AUDITOR_BACKEND_POLICY;
@@ -135,7 +144,7 @@ export function selectAuditorBackend({
   if (explicit !== undefined && explicit !== '') {
     assertAuditorBackend(explicit);
     if (explicit === 'auto') {
-      return selectByPolicy({ hostAgent: effectiveHost, policy, projectConfig });
+      return selectByPolicy({ hostAgent: effectiveHost, policy, projectConfig, env, isCodexCliAvailable });
     }
     return {
       backend: explicit,
@@ -145,51 +154,56 @@ export function selectAuditorBackend({
     };
   }
 
-  return selectByPolicy({ hostAgent: effectiveHost, policy, projectConfig });
+  return selectByPolicy({ hostAgent: effectiveHost, policy, projectConfig, env, isCodexCliAvailable });
 }
 
-function selectByPolicy({ hostAgent, policy, projectConfig }) {
+// v1.4.10: Claude host = Codex CLI when detected on PATH, else Haiku.
+// Codex host = Codex CLI unconditionally (Codex native hooks already require codex
+// to be installed). The `SPOTTER_AUDITOR_BACKEND_POLICY` env var (`current` / `next`)
+// is accepted for back-compat but no longer changes behavior — selection is now
+// availability-based on both hosts. `SPOTTER_AUDITOR_BACKEND=haiku` (or any explicit
+// backend name) still wins above this function via the explicit branch.
+//
+// Detection is configuration-time (synchronous PATH walk via `isCodexCliAvailable`,
+// no spawn, no network). Once a backend is chosen, runtime failures throw
+// `AuditorBackendError` — selection-time availability is not a runtime fallback.
+// Phase 4 matrix smoke (2026-05-06, GeForce 5000 fixture) measured
+// `claude.codex-cli=10041ms` vs Haiku `user_input ~14.3s / turn_end ~16.6s`, so
+// Codex CLI wins on latency when reachable; Haiku stays as the default safety net
+// for environments without codex on PATH.
+function selectByPolicy({ hostAgent, policy, projectConfig, env, isCodexCliAvailable }) {
   const effectivePolicy = policy || 'current';
   assertAuditorPolicy(effectivePolicy);
-  if (effectivePolicy === 'current') {
-    if (hostAgent === 'unknown' || hostAgent === 'automation') {
-      throw new AuditorBackendError(
-        'E_BACKEND_HOST_UNKNOWN',
-        `explicit auditor backend required for hostAgent=${hostAgent}`,
-        { backend: 'auto', diagnostics: { hostAgent, policy: effectivePolicy, projectConfig } }
-      );
-    }
-    return {
-      backend: 'haiku',
-      mode: 'compatibility_haiku',
-      compatibility: 'current_haiku',
-      reason: `policy_current_${hostAgent}`,
-    };
+  if (hostAgent === 'unknown' || hostAgent === 'automation') {
+    throw new AuditorBackendError(
+      'E_BACKEND_HOST_UNKNOWN',
+      `explicit auditor backend required for hostAgent=${hostAgent}`,
+      { backend: 'auto', diagnostics: { hostAgent, policy: effectivePolicy, projectConfig } }
+    );
   }
   if (hostAgent === 'codex') {
     return {
       backend: 'codex-cli',
       mode: 'codex-cli',
       compatibility: 'none',
-      reason: 'policy_next_codex_host',
+      reason: 'codex_host',
     };
   }
   if (hostAgent === 'claude') {
-    // Phase 5: Claude host opt-in `next` policy promotes the primary auditor backend
-    // from Haiku to Codex CLI. Phase 4 matrix smoke (2026-05-06, GeForce 5000 fixture)
-    // measured `claude.codex-cli=10041ms` vs `claude.codex-sidecar=12863ms` and Haiku
-    // diagnostics averaged `user_input ~14.3s / turn_end ~16.6s`, so Codex CLI wins on
-    // latency without giving up schema-fixed JSON judgment. Hidden fallback is
-    // forbidden — when codex-cli is unavailable / times out / exits non-zero,
-    // `createCodexCliAuditorBackend` throws `AuditorBackendError` and the daemon
-    // surfaces the structured error instead of dropping back to Haiku.
-    // Haiku stays reachable only via `current` policy or
-    // `SPOTTER_AUDITOR_BACKEND=haiku`.
+    const codexAvailable = isCodexCliAvailable({ env });
+    if (codexAvailable) {
+      return {
+        backend: 'codex-cli',
+        mode: 'codex-cli',
+        compatibility: 'none',
+        reason: 'claude_host_codex_cli_detected',
+      };
+    }
     return {
-      backend: 'codex-cli',
-      mode: 'codex-cli',
-      compatibility: 'none',
-      reason: 'policy_next_claude_codex_cli',
+      backend: 'haiku',
+      mode: 'compatibility_haiku',
+      compatibility: 'current_haiku',
+      reason: 'claude_host_codex_cli_unavailable',
     };
   }
   throw new AuditorBackendError(

package/src/core/codex-cli-availability.mjs

@@ -0,0 +1,51 @@
+import { statSync } from 'node:fs';
+import { posix, win32 } from 'node:path';
+
+// Configuration-time (synchronous) check for whether `codex` is on PATH.
+// No subprocess is spawned. The function walks env.PATH and tests each candidate
+// with `fs.statSync`; PATHEXT-equivalent extensions are added on Windows.
+//
+// This is consumed by `selectByPolicy` in auditor-backend.mjs to choose the
+// Claude-host primary auditor: when codex is reachable, the daemon prefers
+// Codex CLI over Haiku. Once chosen, the backend's runtime failures still
+// throw `AuditorBackendError` — selection-time availability does not become a
+// runtime fallback.
+
+const WINDOWS_EXTS = ['.cmd', '.exe', '.bat'];
+
+export function isCodexCliAvailable({
+  env = process.env,
+  platform = process.platform,
+  fileExists = defaultFileExists,
+} = {}) {
+  const pathVar = pickPathVar(env, platform);
+  if (typeof pathVar !== 'string' || pathVar.length === 0) return false;
+  const sep = platform === 'win32' ? ';' : ':';
+  const join = platform === 'win32' ? win32.join : posix.join;
+  const candidates = platform === 'win32'
+    ? WINDOWS_EXTS.map((ext) => `codex${ext}`)
+    : ['codex'];
+  for (const rawDir of pathVar.split(sep)) {
+    const dir = rawDir.trim();
+    if (dir.length === 0) continue;
+    for (const candidate of candidates) {
+      if (fileExists(join(dir, candidate))) return true;
+    }
+  }
+  return false;
+}
+
+function pickPathVar(env, platform) {
+  if (platform === 'win32') {
+    return env?.Path ?? env?.PATH ?? env?.path ?? '';
+  }
+  return env?.PATH ?? '';
+}
+
+function defaultFileExists(p) {
+  try {
+    return statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}

package/src/daemon/daemon.mjs

@@ -84,7 +84,11 @@ export async function startDaemon({
   codexRiskCheckEnabled = isCodexRiskDispatchEnabled(),
   codexRiskCheckDryRun = isCodexRiskDispatchDryRun(),
   dispatchCodexRiskCheckFn = dispatchCodexRiskCheck,
-  auditorBackendName = process.env.SPOTTER_AUDITOR_BACKEND || (process.env.SPOTTER_AUDITOR_BACKEND_POLICY ? 'auto' : 'haiku'),
+  // If a haikuCaller is explicitly injected (test path), default to haiku — the
+  // injection itself signals caller intent. Production callers never inject one,
+  // so they hit the `auto` branch which runs availability detection. Explicit
+  // SPOTTER_AUDITOR_BACKEND env or auditorBackendName override still wins above.
+  auditorBackendName = process.env.SPOTTER_AUDITOR_BACKEND || (haikuCaller ? 'haiku' : 'auto'),
   auditorEnv = process.env,
   stopShortFinalMaxChars = resolveStopShortFinalMaxChars(process.env),
 } = {}) {
@@ -118,13 +122,14 @@ export async function startDaemon({
   }
   logFn(`tool-db loaded: ${toolList.length} tools` + (projectRoot ? ` (project=${projectRoot})` : ''));
 
-  // Phase 1 primary backend interface: default remains Haiku, but daemon now calls through
-  // an auditor adapter so future Codex CLI / sidecar backends share one judgment surface.
-  // hostAgent is hard-coded to 'claude' because this daemon process is Claude-only
-  // (see readLocal({hostAgent:'claude'}) above and dispatchCodexRiskCheck hostAgent below).
-  // Without this, SPOTTER_AUDITOR_BACKEND_POLICY=next opt-in would fail with
-  // E_BACKEND_HOST_UNKNOWN on Claude Code launches that don't set CLAUDECODE/CLAUDE_CODE
-  // (e.g. custom wrappers), even though the daemon clearly belongs to a Claude host.
+  // v1.4.10: default `auto` triggers availability-based selection — Codex CLI when
+  // detected on PATH, Haiku otherwise. `SPOTTER_AUDITOR_BACKEND=haiku` (or any other
+  // explicit backend) still wins. hostAgent is hard-coded to 'claude' because this
+  // daemon process is Claude-only (see readLocal({hostAgent:'claude'}) above and
+  // dispatchCodexRiskCheck hostAgent below); without this, `auto` selection would
+  // fail with E_BACKEND_HOST_UNKNOWN on Claude Code launches that don't set
+  // CLAUDECODE/CLAUDE_CODE (e.g. custom wrappers), even though the daemon clearly
+  // belongs to a Claude host.
   const auditorBackend = createAuditorBackend({
     backend: auditorBackendName,
     catalog: toolList,