throughline 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -10,6 +10,39 @@ shipped to npm but were not individually tagged on GitHub.
 
 ## [Unreleased]
 
+## [0.10.2] — 2026-08-24
+
+### Changed
+
+- 挙動不変のOS/harness層集約リファクタ（harness用語統一campaignの分離規約）:
+  - LOCALAPPDATA / XDG_CONFIG_HOME / XDG_STATE_HOME のベースディレクトリ組み立てを
+    新設`src/os/app-dirs.mjs`へ一本化（runtime-error-store / completed-turn-receipts
+    に3重実装されていた）。
+  - hostリテラル比較（`'claude'`／`'codex'`）6ファイルを`src/hosts/identity.mjs`の
+    定数importへ統一し、「識別の唯一の正本」宣言と実装を一致させた。
+  - codex-auto-refreshの独自パス正規化を`src/os/paths.mjs`の
+    `foldPathCaseForPlatform`へ、codex-sidecarのwin32判定を同`isWin32Platform`へ委譲。
+  - `hosts/identity.mjs`の分類語をvendorからharnessへ更新（用語のみ）。
+
+## [0.10.1] — 2026-08-23
+
+### Changed
+
+- Internal refactor with no behavior change. Vendor (hook host) identity and
+  per-host behavior moved into `src/hosts/` — `hosts/identity.mjs` is the
+  single source of the `codex:` / `grok:` session prefixes (previously
+  duplicated across four files), and the shared hook entrypoints
+  (`session-start` / `prompt-submit` / `process-turn`) now branch through
+  `hosts/{claude,codex,grok}.mjs` adapters instead of inline host checks.
+  `src/hook-envelope.mjs` is merged into `hosts/grok.mjs`.
+- OS-specific code moved into `src/os/` — the Windows owner-only ACL
+  PowerShell implementation that was duplicated verbatim in
+  `runtime-error-store` and `completed-turn-receipts` is now the single
+  `os/windows-acl.mjs`, alongside macOS Terminal launch, OS URL open,
+  shell/AppleScript quoting, Windows path case folding, and the portable
+  spawn helper. DB schema, injection contract, and every CLI surface are
+  unchanged; full regression is 761 pass / 0 fail.
+
 ## [0.10.0] — 2026-08-17
 
 ### Added
@@ -1271,7 +1304,11 @@ two attempts, instrument first instead of patching again.
 
 ---
 
-[Unreleased]: https://github.com/kitepon-rgb/Throughline/compare/v0.8.9...HEAD
+[Unreleased]: https://github.com/kitepon-rgb/Throughline/compare/v0.10.1...HEAD
+[0.10.1]: https://github.com/kitepon-rgb/Throughline/compare/v0.10.0...v0.10.1
+[0.10.0]: https://github.com/kitepon-rgb/Throughline/compare/v0.9.1...v0.10.0
+[0.9.1]: https://github.com/kitepon-rgb/Throughline/compare/v0.9.0...v0.9.1
+[0.9.0]: https://github.com/kitepon-rgb/Throughline/compare/v0.8.9...v0.9.0
 [0.8.9]: https://github.com/kitepon-rgb/Throughline/compare/v0.8.8...v0.8.9
 [0.8.8]: https://github.com/kitepon-rgb/Throughline/compare/v0.8.7...v0.8.8
 [0.8.7]: https://github.com/kitepon-rgb/Throughline/compare/v0.8.6...v0.8.7

package/README.ja.md

@@ -390,7 +390,7 @@ throughline handoff-context --session codex:<thread-id> --json
 成功時の`throughline.handoff_context.v1`は`schema`、`status`、`sessionId`、`context`だけを返す。
 `context`はSessionStartと同じ予算付き継承文脈で、DB作成・migration・baton消費・session merge・
 latest session推測・`sessions.merged_into`変更・L1/L2/L3 rowの所属変更は行わない。AItermは任意の
-別vendor portable forkでこの境界を使う。Observer feedはcompleted-turn projectionであり代替ではない。
+別harness portable forkでこの境界を使う。Observer feedはcompleted-turn projectionであり代替ではない。
 
 スラッシュコマンド (Claude Code 内でユーザーが叩く):
 

package/README.md

@@ -834,7 +834,7 @@ local-only contracts.
 | `throughline runtime-errors reopen <fingerprint> --json` | Explicitly reopen a resolved aggregate without fabricating a new occurrence |
 | `throughline runtime-errors compact --json`    | Remove only acknowledged, resolved aggregates after retention; open or unacknowledged records remain |
 | `throughline handoff-preview --session <id>`   | Print a Codex-facing `throughline_handoff` JSON projection    |
-| `throughline handoff-context --session <id> --json` | Print the exact SessionStart inheritance context as versioned JSON without moving memory rows or changing `sessions.merged_into`; intended for local launchers that need portable cross-vendor context |
+| `throughline handoff-context --session <id> --json` | Print the exact SessionStart inheritance context as versioned JSON without moving memory rows or changing `sessions.merged_into`; intended for local launchers that need portable cross-harness context |
 | `throughline grok-continue --session <id>` | Spawn a person-facing Grok seat whose first user text is the handoff-context body. cwd is the source session `project_path`. Does not spawn without ready context. No `--rules`. macOS Terminal only |
 | `throughline codex-capture --codex-thread-id <id>` | Capture active Codex rollout turns into a `codex:<thread_id>` DB session |
 | `throughline codex-summarize --session codex:<id>` | Summarize captured Codex L2 into L1 with the Codex CLI backend |
@@ -872,7 +872,7 @@ The successful `throughline.handoff_context.v1` object contains only `schema`,
 inheritance text used by SessionStart. The command does not create or migrate a
 database, consume a baton, merge sessions, infer a latest session, change
 `sessions.merged_into`, or reassign L1/L2/L3 rows. AIterm uses this boundary for
-its optional cross-vendor portable fork; the Observer feed is a separate
+its optional cross-harness portable fork; the Observer feed is a separate
 completed-turn projection and is not a substitute.
 
 Slash commands (invoked by the user in Claude Code):

package/docs/16_readonly_handoff_context_plan.md

@@ -4,14 +4,14 @@
 
 通常 handoff が使う `buildBudgetedResumeContext` の出力を、DB 所有権を変えずにローカルプログラムが
 取得できる read-only CLI として公開する。最初の consumer は AIterm の portable fork だが、I/F は
-特定 consumer や vendor に依存させない。
+特定 consumer や harness に依存させない。
 
 実行 ToDo、依存、状態、完了証拠の正本は Lattice plan `readonly-handoff-context` とする。
 
 ## 完了
 
 2026-08-04に`throughline@0.9.0`としてnpm、tag、GitHub Release、global installまで公開した。
-focused契約testと全回帰は729 pass／1 skip／0 fail。AIterm v0.23.0の代表cross-vendor smokeでは
+focused契約testと全回帰は729 pass／1 skip／0 fail。AIterm v0.23.0の代表cross-harness smokeでは
 Codex source memoryをClaudeへ注入し、前後でsource session、`sessions.merged_into`、L1/L2/L3 row所属が
 完全一致することを確認した。公開後の現行ドキュメント全域監査は、Latticeの終端ToDoを再openして
 README、作業者入口、配布Codex skill、docs索引、計画、CHANGELOGへ同期した。変更Markdownの

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "throughline",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "type": "module",
   "description": "Persistent memory hooks for Claude Code, Codex, and Grok (/clear-safe context compression)",
   "keywords": [

package/src/auditor-context.mjs

@@ -3,6 +3,7 @@ import { homedir } from 'node:os';
 import { isAbsolute, join, resolve, sep } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { buildBodyRowsFromActiveTurns } from './codex-capture.mjs';
+import { CLAUDE_HOST, CODEX_HOST, isCodexSessionId } from './hosts/identity.mjs';
 import { parseCodexRolloutFile } from './codex-rollout-memory.mjs';
 import { getLogicalTurnGroups } from './transcript-reader.mjs';
 import { hashAuditorBody, normalizeAuditorBody } from './body-digest.mjs';
@@ -23,7 +24,7 @@ export function defaultAuditorContextDbPath() {
 export function deriveAuditorFreshnessExpectation({ host, transcriptPath, sessionId } = {}) {
   assertNonEmptyString(transcriptPath, 'transcriptPath');
   assertNonEmptyString(sessionId, 'sessionId');
-  if (host === 'claude') {
+  if (host === CLAUDE_HOST) {
     const latest = getLogicalTurnGroups(transcriptPath).at(-1);
     if (!latest) return null;
     return {
@@ -33,7 +34,7 @@ export function deriveAuditorFreshnessExpectation({ host, transcriptPath, sessio
       expectedAssistantSha256: hashAuditorBody(latest.representative.content),
     };
   }
-  if (host === 'codex') {
+  if (host === CODEX_HOST) {
     const parsed = parseCodexRolloutFile(transcriptPath, { includeInFlightTurn: false });
     const rows = buildBodyRowsFromActiveTurns(parsed.activeTurns, { sessionId, now: 0 });
     const latestTurnNumber = rows.reduce((max, row) => Math.max(max, row.turnNumber), 0);
@@ -119,7 +120,7 @@ export function readAuditorContext({
 
     const latest = completed.at(-1);
     const stableTurnIdentityAvailable = Number.isInteger(expectedTurnNumber) && expectedTurnNumber >= 0;
-    const codexPairIdentity = sessionId.startsWith('codex:') && expectedOriginSessionId === sessionId;
+    const codexPairIdentity = isCodexSessionId(sessionId) && expectedOriginSessionId === sessionId;
     const expectationComplete =
       typeof expectedOriginSessionId === 'string' && expectedOriginSessionId.length > 0 &&
       (stableTurnIdentityAvailable || codexPairIdentity) &&

package/src/cli/auditor-context.mjs

@@ -1,3 +1,4 @@
+import { CLAUDE_HOST, CODEX_HOST } from '../hosts/identity.mjs';
 import {
   AUDITOR_CONTEXT_SCHEMA,
   deriveAuditorFreshnessExpectation,
@@ -53,7 +54,7 @@ export function parseArgs(argv = []) {
     else if (arg === '--max-body-chars') out.maxBodyChars = parsePositiveInteger(value);
     else if (arg === '--max-total-chars') out.maxTotalChars = parsePositiveInteger(value);
     else if (arg === '--db') out.dbPath = value;
-    else if (arg === '--host' && (value === 'claude' || value === 'codex')) out.host = value;
+    else if (arg === '--host' && (value === CLAUDE_HOST || value === CODEX_HOST)) out.host = value;
     else if (arg === '--transcript') out.transcriptPath = value;
     else throw new TypeError('unknown option');
   }

package/src/cli/codex-handoff-start.mjs

@@ -6,7 +6,9 @@ import { buildCodexHandoffModelSmokePrompt } from '../codex-handoff-model-smoke.
 import { runCodexNewThreadHandoff } from '../codex-app-server.mjs';
 import { estimateTokens } from '../token-estimator.mjs';
 import { sameProjectPath } from '../project-path.mjs';
-import { spawnSync } from 'node:child_process';
+import { shQuote } from '../os/shell.mjs';
+import { openUrlWithOsHandler } from '../os/open-url.mjs';
+import { runTerminalDoScript } from '../os/macos-terminal.mjs';
 
 async function readStdin() {
   let raw = '';
@@ -319,12 +321,7 @@ function openStartedCodexThread({ threadId, host, cwd }) {
 
   if (resolvedHost === 'desktop' || resolvedHost === 'vscode') {
     const url = resolvedHost === 'desktop' ? desktopUrl : vscodeUrl;
-    const result =
-      process.platform === 'darwin'
-        ? spawnSync('open', [url], { encoding: 'utf8' })
-        : process.platform === 'win32'
-          ? spawnSync('cmd.exe', ['/c', 'start', '', url], { encoding: 'utf8' })
-          : spawnSync('xdg-open', [url], { encoding: 'utf8' });
+    const result = openUrlWithOsHandler(url);
     if (result.status !== 0) {
       return {
         status: 'failed',
@@ -353,14 +350,7 @@ function openStartedCodexThread({ threadId, host, cwd }) {
   if (resolvedHost === 'cli') {
     if (process.platform === 'darwin') {
       const shellCommand = `cd ${shQuote(cwd)} && TERM=xterm-256color codex resume ${shQuote(threadId)} --no-alt-screen`;
-      const result = spawnSync('osascript', [], {
-        input: `tell application "Terminal"
-  activate
-  do script ${appleString(shellCommand)}
-end tell
-`,
-        encoding: 'utf8',
-      });
+      const result = runTerminalDoScript(shellCommand);
       if (result.status !== 0) {
         return {
           status: 'failed',
@@ -409,14 +399,6 @@ end tell
   };
 }
 
-function shQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-function appleString(value) {
-  return `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
-}
-
 export async function run(args) {
   let parsed;
   try {

package/src/cli/codex-summarize.mjs

@@ -1,4 +1,5 @@
 import { getDb } from '../db.mjs';
+import { isCodexSessionId } from '../hosts/identity.mjs';
 import {
   L2_WINDOW,
   countDistinctBodyTurns,
@@ -94,7 +95,7 @@ function insertSkeleton(db, { sessionId, originSessionId, turnNumber, summary, c
 }
 
 export function summarizeCodexSession(db, { sessionId, projectPath, max, env = process.env }) {
-  if (!sessionId?.startsWith('codex:')) {
+  if (!isCodexSessionId(sessionId)) {
     throw new Error('codex-summarize requires a codex:<thread-id> session');
   }
 

package/src/cli/codex-visibility-smoke.mjs

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { CODEX_SESSION_PREFIX, codexSessionIdToThreadId, isCodexSessionId } from '../hosts/identity.mjs';
 
 import { getDb } from '../db.mjs';
 import { buildHandoffRecord } from '../handoff-record.mjs';
@@ -82,10 +83,10 @@ function parseArgs(args) {
   }
 
   if (!out.sessionId && out.codexThreadId) {
-    out.sessionId = `codex:${out.codexThreadId}`;
+    out.sessionId = `${CODEX_SESSION_PREFIX}${out.codexThreadId}`;
   }
-  if (!out.codexThreadId && out.sessionId?.startsWith('codex:')) {
-    out.codexThreadId = out.sessionId.slice('codex:'.length);
+  if (!out.codexThreadId && isCodexSessionId(out.sessionId)) {
+    out.codexThreadId = codexSessionIdToThreadId(out.sessionId);
   }
 
   return out;
@@ -154,7 +155,7 @@ export async function run(args) {
   const db = getDb();
   const sessionId = parsed.sessionId ?? findLatestCodexSessionId(db, process.cwd());
   const codexThreadId =
-    parsed.codexThreadId ?? (sessionId?.startsWith('codex:') ? sessionId.slice('codex:'.length) : null);
+    parsed.codexThreadId ?? codexSessionIdToThreadId(sessionId);
   if (!sessionId || !codexThreadId) {
     process.stderr.write(
       '[codex-visibility-smoke] pass --session codex:<thread-id> or --codex-thread-id <id>.\n',

package/src/cli/doctor.mjs

@@ -14,6 +14,7 @@
  */
 
 import { existsSync, accessSync, readFileSync, constants, readdirSync, statSync } from 'node:fs';
+import { CODEX_HOST } from '../hosts/identity.mjs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync } from 'node:child_process';
@@ -302,9 +303,9 @@ function runTrimDiagnosis(
 ) {
   const info = describeTrimHost(host);
   const codexIdentity =
-    info.host === 'codex' ? resolveCodexThreadIdentity({ codexThreadId: null }, env) : null;
+    info.host === CODEX_HOST ? resolveCodexThreadIdentity({ codexThreadId: null }, env) : null;
   const hostPrimitiveDiagnosis =
-    info.host === 'codex' ? readCodexHostPrimitiveDiagnosis({ env, auditRunner }) : null;
+    info.host === CODEX_HOST ? readCodexHostPrimitiveDiagnosis({ env, auditRunner }) : null;
   console.log(`${BOLD}[Trim]${RESET}\n`);
   console.log(`  host:                  ${info.host}`);
   console.log(`  default keep-recent:   ${DEFAULT_TRIM_KEEP_RECENT}`);
@@ -330,19 +331,19 @@ function runTrimDiagnosis(
   }
   console.log('');
   console.log('  dry-run command:');
-  if (info.host === 'codex' && !codexIdentity?.codexThreadId) {
+  if (info.host === CODEX_HOST && !codexIdentity?.codexThreadId) {
     console.log('    throughline trim --dry-run --host codex --codex-thread-id <id>');
     console.log('    throughline trim --preflight --host codex --codex-thread-id <id>');
-  } else if (info.host === 'codex') {
+  } else if (info.host === CODEX_HOST) {
     console.log('    throughline trim --dry-run --host codex');
     console.log('    throughline trim --preflight --host codex');
   } else {
     console.log(`    throughline trim --dry-run --host ${info.host}`);
   }
-  if (info.host === 'codex') {
+  if (info.host === CODEX_HOST) {
     console.log('    throughline trim --execute --host codex');
   }
-  if (info.host === 'codex') {
+  if (info.host === CODEX_HOST) {
     const sessionId = codexIdentity?.codexThreadId
       ? `codex:${codexIdentity.codexThreadId}`
       : 'codex:<thread-id>';

package/src/cli/grok-continue.mjs

@@ -1,10 +1,11 @@
-import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { delimiter, join } from 'node:path';
 
 import { readHandoffContext, readSessionProjectPath } from './handoff-context.mjs';
+import { shQuote } from '../os/shell.mjs';
+import { appleScriptForTerminalExec, runTerminalScriptDetached } from '../os/macos-terminal.mjs';
 
 export const GROK_CONTINUE_PREAMBLE = 'この発言は直前 Throughline 席の履歴を前提とする。';
 export const GROK_CONTINUE_REQUEST = '直前の作業の自然な続きとして応答すること。';
@@ -29,10 +30,6 @@ export function buildGrokContinuePrompt(context) {
   return `${GROK_CONTINUE_PREAMBLE}\n\n${context}\n\n${GROK_CONTINUE_REQUEST}\n\n${GROK_CONTINUE_WAIT}`;
 }
 
-export function shQuote(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`;
-}
-
 export function resolveGrokBin({
   home = homedir(),
   env = process.env,
@@ -62,15 +59,8 @@ export function buildLaunchScript({ cwd, grokBin, sessionUuid, promptFile }) {
   ].join('\n');
 }
 
-export function appleScriptForLaunch(launchScriptPath) {
-  return [
-    'tell application "Terminal"',
-    '  activate',
-    `  do script "exec " & quoted form of ${JSON.stringify(launchScriptPath)}`,
-    'end tell',
-    '',
-  ].join('\n');
-}
+// macOS Terminal 起動の実体は os/macos-terminal.mjs (OS 境界)。
+export const appleScriptForLaunch = appleScriptForTerminalExec;
 
 export function buildContinuePlan({
   context,
@@ -113,13 +103,10 @@ export function writeLaunchArtifacts({
   return { promptFile, launchFile };
 }
 
-export function defaultSpawnLaunch({ launchFile, spawnImpl = spawn }) {
-  const child = spawnImpl('osascript', ['-e', appleScriptForLaunch(launchFile)], {
-    detached: true,
-    stdio: 'ignore',
-  });
-  child.unref?.();
-  return child;
+export function defaultSpawnLaunch({ launchFile, spawnImpl }) {
+  return spawnImpl === undefined
+    ? runTerminalScriptDetached({ launchFile })
+    : runTerminalScriptDetached({ launchFile, spawnImpl });
 }
 
 export function run(argv = [], {

package/src/cli/runtime-errors.test.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 
 import { parseArgs, run } from './runtime-errors.mjs';
 import { defaultFactoryReporterConfigPath } from '../runtime-error-store.mjs';
-import { applyWindowsPrivateAcl } from '../windows-acl-test-helper.mjs';
+import { applyWindowsPrivateAcl } from '../os/windows-acl-test-helper.mjs';
 
 test('runtime-errors CLI: strict command surface accepts no raw payload options', () => {
   assert.deepEqual(parseArgs(['snapshot', '--after-cursor', '2', '--limit', '3', '--json']), {

package/src/cli/trim.mjs

@@ -1,4 +1,5 @@
 import { runCodexTrimExecution, runCodexTrimPreflight } from '../codex-app-server.mjs';
+import { CODEX_HOST } from '../hosts/identity.mjs';
 import {
   buildCodexRolloutTrimSource,
   parseCodexRolloutFile,
@@ -122,7 +123,7 @@ export async function run(args) {
   const inflightMemo = parsed.memoStdin ? await readStdin() : null;
   const db = getDb();
   const trimSource =
-    parsed.host === 'codex' && parsed.codexThreadId
+    parsed.host === CODEX_HOST && parsed.codexThreadId
       ? buildCodexRolloutTrimSource({
           threadId: parsed.codexThreadId,
           projectPath: process.cwd(),
@@ -376,7 +377,7 @@ async function runPreflight(parsed, plan) {
 }
 
 function validateCodexAction(parsed, plan, action) {
-  if (parsed.host !== 'codex') {
+  if (parsed.host !== CODEX_HOST) {
     return {
       status: `${action}-refused`,
       reason: `${action}_requires_codex_host`,

package/src/codex-auto-refresh.mjs

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir, platform } from 'node:os';
+import { foldPathCaseForPlatform } from './os/paths.mjs';
+import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 
 import { runCodexTrimExecution } from './codex-app-server.mjs';
@@ -509,8 +510,7 @@ function normalizeProjectPath(value) {
   if (typeof value !== 'string' || value.length === 0) return '';
   let result = resolve(value).replace(/\\/g, '/');
   if (result.length > 1 && result.endsWith('/')) result = result.slice(0, -1);
-  if (platform() === 'win32') result = result.toLowerCase();
-  return result;
+  return foldPathCaseForPlatform(result);
 }
 
 function numberOrNull(value) {

package/src/codex-capture.mjs

@@ -1,23 +1,19 @@
 import { parseCodexRolloutFile } from './codex-rollout-memory.mjs';
 import { defaultCodexHome, findCodexThreadCandidate } from './codex-thread-index.mjs';
-
-export const CODEX_SESSION_PREFIX = 'codex:';
-
-export function buildCodexThroughlineSessionId(threadId) {
-  if (typeof threadId !== 'string' || threadId.trim().length === 0) {
-    throw new Error('threadId is required');
-  }
-  return `${CODEX_SESSION_PREFIX}${threadId.trim()}`;
-}
-
-export function isCodexThroughlineSessionId(sessionId) {
-  return typeof sessionId === 'string' && sessionId.startsWith(CODEX_SESSION_PREFIX);
-}
-
-export function codexSessionIdToThreadId(sessionId) {
-  if (!isCodexThroughlineSessionId(sessionId)) return null;
-  return sessionId.slice(CODEX_SESSION_PREFIX.length) || null;
-}
+import {
+  CODEX_SESSION_PREFIX,
+  buildCodexThroughlineSessionId,
+  codexSessionIdToThreadId,
+  isCodexSessionId,
+} from './hosts/identity.mjs';
+
+// session identity の正本は hosts/identity.mjs。既存 import 面のため再 export する。
+export {
+  CODEX_SESSION_PREFIX,
+  buildCodexThroughlineSessionId,
+  codexSessionIdToThreadId,
+};
+export const isCodexThroughlineSessionId = isCodexSessionId;
 
 export function captureCodexRolloutToDb(
   db,

package/src/codex-handoff-model-smoke.mjs

@@ -1,4 +1,4 @@
-import { spawnPortableSync } from './portable-spawn-sync.mjs';
+import { spawnPortableSync } from './os/portable-spawn-sync.mjs';
 
 export const CODEX_HANDOFF_MODEL_SMOKE_ENV = 'THROUGHLINE_EXPERIMENTAL_CODEX_HANDOFF_MODEL_SMOKE';
 export const DEFAULT_CODEX_HANDOFF_MODEL_SMOKE_TIMEOUT_MS = 120_000;

package/src/codex-sidecar.mjs

@@ -1,4 +1,5 @@
-import { spawnPortableSync } from './portable-spawn-sync.mjs';
+import { spawnPortableSync } from './os/portable-spawn-sync.mjs';
+import { isWin32Platform } from './os/paths.mjs';
 
 export const CODEX_SIDECAR_WORKFLOWS = Object.freeze([
   'review',
@@ -23,7 +24,7 @@ function resolveCommand({ command, env }) {
 }
 
 export function shouldShellWrapSidecarCommand(platform = process.platform) {
-  return platform === 'win32';
+  return isWin32Platform(platform);
 }
 
 export function runCodexSidecarCommand(command, args, options = {}) {

package/src/completed-turn-receipts.mjs

@@ -1,4 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { CLAUDE_HOST } from './hosts/identity.mjs';
 import {
   chmodSync,
   lstatSync,
@@ -8,12 +9,12 @@ import {
   rmSync,
   writeFileSync,
 } from 'node:fs';
-import childProcess from 'node:child_process';
-import { homedir, platform as hostPlatform } from 'node:os';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { hashAuditorBody } from './body-digest.mjs';
 import { normalizeProjectPathForCompare } from './project-path.mjs';
+import { applyAndVerifyWindowsAcl, isWindows, verifyWindowsAcl } from './os/windows-acl.mjs';
+import { windowsLocalAppData, xdgStateHome } from './os/app-dirs.mjs';
 
 export const COMPLETED_TURN_RECEIPT_STORE_SCHEMA = 'throughline.completed_turn_receipts.v1';
 export const COMPLETED_TURN_RECEIPT_SCHEMA_VERSION = '1.0';
@@ -21,15 +22,13 @@ export const COMPLETED_TURN_RECEIPT_LIMIT = 256;
 
 const PRIVATE_DIRECTORY_CAPABILITY = Symbol('throughline.completed-turn-receipt-directory');
 // CI実測でPowerShellコールドスタートが3.0〜3.2秒に達しflakeしたため15秒 (run 29586852389 / 29628634501)
-const WINDOWS_ACL_TIMEOUT_MS = 15_000;
 
 export function defaultCompletedTurnReceiptStorePath(projectSha256, env = process.env) {
   if (!isSha256(projectSha256)) throw new TypeError('projectSha256 must be a SHA-256 digest');
-  const home = env.HOME || env.USERPROFILE || homedir();
   if (isWindows(env)) {
-    return join(env.LOCALAPPDATA || join(home, 'AppData', 'Local'), 'throughline', 'completed-turn-receipts', `${projectSha256}.json`);
+    return join(windowsLocalAppData(env), 'throughline', 'completed-turn-receipts', `${projectSha256}.json`);
   }
-  return join(env.XDG_STATE_HOME || join(home, '.local', 'state'), 'throughline', 'completed-turn-receipts', `${projectSha256}.json`);
+  return join(xdgStateHome(env), 'throughline', 'completed-turn-receipts', `${projectSha256}.json`);
 }
 
 /**
@@ -274,7 +273,7 @@ function validateReceipt(receipt, nextSequence) {
   ];
   if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt) ||
     !exactKeys(receipt, keys) || receipt.schema_version !== COMPLETED_TURN_RECEIPT_SCHEMA_VERSION ||
-    receipt.host !== 'claude' || !isSha256(receipt.project_sha256) ||
+    receipt.host !== CLAUDE_HOST || !isSha256(receipt.project_sha256) ||
     !isIdentity(receipt.target_session_id) || !isIdentity(receipt.origin_session_id) ||
     !isSha256(receipt.user_sha256) || !isSha256(receipt.assistant_sha256) ||
     !Number.isSafeInteger(receipt.completed_at) || receipt.completed_at < 0 ||
@@ -351,30 +350,4 @@ function assertExactOptions(options) {
     throw new TypeError('completed turn receipt options are invalid');
   }
 }
-function isWindows(env = process.env) { return env.OS === 'Windows_NT' || hostPlatform() === 'win32'; }
-
-function applyAndVerifyWindowsAcl(path, directory) { runWindowsAclScript(path, directory, WINDOWS_ACL_APPLY_SCRIPT); }
-function verifyWindowsAcl(path, directory) { runWindowsAclScript(path, directory, WINDOWS_ACL_VERIFY_SCRIPT); }
-function runWindowsAclScript(path, directory, script) {
-  const result = childProcess.spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
-    env: { ...process.env, THROUGHLINE_ACL_PATH: path, THROUGHLINE_ACL_DIRECTORY: directory ? '1' : '0' },
-    stdio: 'ignore', timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true,
-  });
-  if (result.status !== 0) throw new Error('Windows owner-only ACL verification failed');
-}
 
-const WINDOWS_ACL_VERIFY_SCRIPT = String.raw`
-$p=$env:THROUGHLINE_ACL_PATH; $isDir=$env:THROUGHLINE_ACL_DIRECTORY -eq '1'; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
-$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)}
-$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
-if($owner -ne $sid){exit 41}; $rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])); if($rules.Count -ne 1){exit 42}
-$r=$rules[0]; if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}
-`;
-
-const WINDOWS_ACL_APPLY_SCRIPT = String.raw`
-$p=$env:THROUGHLINE_ACL_PATH; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$isDir=$env:THROUGHLINE_ACL_DIRECTORY -eq '1'; $acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity}; $acl.SetAccessRuleProtection($true,$false)
-$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None}
-$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)
-$acl.SetOwner($sid); $acl.AddAccessRule($rule); if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)}
-` + WINDOWS_ACL_VERIFY_SCRIPT;

package/src/completed-turn-receipts.test.mjs

@@ -12,7 +12,7 @@ import {
   writeCompletedTurnReceipt,
 } from './completed-turn-receipts.mjs';
 import { seedCompletedTurnReceiptStore } from './completed-turn-receipts-test-fixture.mjs';
-import { verifyWindowsPrivateAcl } from './windows-acl-test-helper.mjs';
+import { verifyWindowsPrivateAcl } from './os/windows-acl-test-helper.mjs';
 
 function sandbox() {
   const root = mkdtempSync(join(tmpdir(), 'throughline-completed-receipts-'));

package/src/haiku-summarizer.mjs

@@ -50,7 +50,7 @@ import {
   CODEX_SIDECAR_STATUS,
   runCodexSidecarCommand,
 } from './codex-sidecar.mjs';
-import { spawnPortableSync } from './portable-spawn-sync.mjs';
+import { spawnPortableSync } from './os/portable-spawn-sync.mjs';
 
 const MODEL = 'claude-haiku-4-5-20251001';
 // Codex CLI 要約の既定。gpt-5.6-luna@low@1/5 は 2026-07-17 の実測評価で選定

package/src/handoff-record.mjs

@@ -6,9 +6,11 @@
  * persisted to DB; adapters can render it for Claude, Codex, or diagnostics.
  */
 
+import { CODEX_SESSION_PREFIX } from './hosts/identity.mjs';
+
 export const HANDOFF_RECORD_VERSION = 1;
 export const N_RECENT_L2 = 20;
-export const CODEX_SESSION_PREFIX = 'codex:';
+export { CODEX_SESSION_PREFIX };
 
 const DEFAULT_INTENT = 'continue implementation';
 const DEFAULT_CONSTRAINTS = [

package/src/hosts/claude.mjs

@@ -0,0 +1,27 @@
+/**
+ * hosts/claude.mjs — Claude host adapter
+ *
+ * Claude は Throughline の基準 host。hook payload は snake_case のまま届き、
+ * 引き継ぎ注入は UserPromptSubmit hook の stdout でモデルへ渡る。
+ */
+import { CLAUDE_HOST, hostOfSessionId } from './identity.mjs';
+
+export const claudeHostAdapter = Object.freeze({
+  host: CLAUDE_HOST,
+  matchesSessionId: (sessionId) => hostOfSessionId(sessionId) === CLAUDE_HOST,
+  // Claude Stop payload の last_assistant_message を transcript 可視化の
+  // barrier に使う (ADR 0012)。
+  waitsForStopTranscriptFlush: true,
+  // Claude は UserPromptSubmit stdout がそのままモデル可視 context になる。
+  deliverHandoffInjection({ text, stdout = process.stdout }) {
+    stdout.write(text + '\n');
+    return { delivered: true };
+  },
+  // Claude の prompt は裸の slash command がそのまま届く。
+  resolveCommandPrompt({ prompt }) {
+    return prompt;
+  },
+  afterBatonWrite() {
+    return { launched: false };
+  },
+});