audit-tools 0.28.0

package/dist/shared/observability/runLog.js

@@ -0,0 +1,40 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+export class RunLogger {
+    path;
+    enabled;
+    now;
+    constructor(path, options = {}) {
+        this.path = path;
+        this.enabled = options.enabled ?? true;
+        this.now = options.now ?? (() => Date.now());
+    }
+    /** A logger that drops every event. Use when observability is disabled. */
+    static disabled() {
+        return new RunLogger("", { enabled: false });
+    }
+    get isEnabled() {
+        return this.enabled;
+    }
+    /** Append one event line. Atomic per line (O_APPEND); swallows all errors. */
+    event(event) {
+        if (!this.enabled || this.path.length === 0)
+            return;
+        let line;
+        try {
+            line = JSON.stringify({ ts: new Date(this.now()).toISOString(), ...event }) + "\n";
+        }
+        catch {
+            // Non-serializable payload: log a minimal marker instead of throwing.
+            line = JSON.stringify({ ts: new Date(this.now()).toISOString(), kind: event.kind, note: "unserializable_event" }) + "\n";
+        }
+        try {
+            mkdirSync(dirname(this.path), { recursive: true });
+            appendFileSync(this.path, line, "utf8");
+        }
+        catch {
+            // Observability must never break a run.
+        }
+    }
+}
+//# sourceMappingURL=runLog.js.map

package/dist/shared/observability/runLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runLog.js","sourceRoot":"","sources":["../../../src/shared/observability/runLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CpC,MAAM,OAAO,SAAS;IACH,IAAI,CAAS;IACb,OAAO,CAAU;IACjB,GAAG,CAAe;IAEnC,YAAY,IAAY,EAAE,UAA4B,EAAE;QACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,KAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,GAAG,IAAI,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;CACF"}

package/dist/shared/opencodePermissions.d.ts

@@ -0,0 +1,49 @@
+/**
+ * OpenCode permission deployment helpers shared by the audit-code and
+ * remediate-code install flows (postinstall scripts and the remediate-code
+ * `ensure` command). Two named scopes exist:
+ *
+ * - **Global top-level scope** — the `permission` block at the root of
+ *   `~/.config/opencode/opencode.json`. This scope must never seed broad
+ *   allows: no `bash["*"] = "allow"` and no forced
+ *   `external_directory["*"] = "allow"`. It also actively migrates away
+ *   previously deployed broad rules whose value exactly matches the
+ *   historically managed value (`"allow"`); a matching value is treated as
+ *   tool-managed and removed even if it happened to be user-authored
+ *   (accepted safer failure direction). Any non-matching value (e.g. `"ask"`,
+ *   `"deny"`, or a different rule shape) is left completely untouched.
+ * - **Agent scope** — a per-agent `permission` block (e.g.
+ *   `agent.auditor.permission`). This scope keeps the
+ *   broad-allow-with-denylist deployment unchanged.
+ */
+/** The broad value the deploy helpers historically wrote ("tool-managed"). */
+export declare const OPENCODE_MANAGED_BROAD_VALUE = "allow";
+type PermissionRule = Record<string, string>;
+/** Returns a copy of `rules` without its `"*"` wildcard entry. */
+export declare function withoutOpenCodeWildcard(rules: PermissionRule): PermissionRule;
+/**
+ * Agent-scope rule merge: generated rules seed the entry, existing
+ * non-wildcard user entries win over generated ones, and managed rules always
+ * win (including a managed wildcard when the caller provides one — pass
+ * `withoutOpenCodeWildcard(rules)` to let an existing wildcard survive).
+ */
+export declare function mergeOpenCodeAgentPermissionRule(existingRule: unknown, generatedRule: unknown, managedRules?: PermissionRule): unknown;
+/**
+ * Global-scope rule merge: never seeds a wildcard. An existing wildcard is
+ * preserved verbatim unless it exactly matches the historically managed broad
+ * value (`"allow"`), in which case it is removed as migration cleanup.
+ * Non-wildcard rules merge like the agent scope (existing wins over
+ * generated; managed wins over existing).
+ */
+export declare function mergeOpenCodeGlobalPermissionRule(existingRule: unknown, generatedRule: PermissionRule, managedRules?: PermissionRule): PermissionRule;
+/**
+ * Global-scope `external_directory` migration: the deploy helpers
+ * historically forced `external_directory: { "*": "allow" }` at the top
+ * level. That broad rule is no longer seeded; when an existing entry's
+ * wildcard exactly matches the historically managed value it is removed.
+ * Returns `undefined` when the whole entry should be dropped from the
+ * permission block; any non-matching value is returned untouched.
+ */
+export declare function migrateOpenCodeGlobalExternalDirectory(existingRule: unknown): unknown;
+export {};
+//# sourceMappingURL=opencodePermissions.d.ts.map

package/dist/shared/opencodePermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodePermissions.d.ts","sourceRoot":"","sources":["../../src/shared/opencodePermissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,UAAU,CAAC;AAEpD,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAQ7C,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAI7E;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,OAAO,EACrB,aAAa,EAAE,OAAO,EACtB,YAAY,GAAE,cAAmB,GAChC,OAAO,CA2BT;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,OAAO,EACrB,aAAa,EAAE,cAAc,EAC7B,YAAY,GAAE,cAAmB,GAChC,cAAc,CAwBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CACpD,YAAY,EAAE,OAAO,GACpB,OAAO,CAcT"}

package/dist/shared/opencodePermissions.js

@@ -0,0 +1,118 @@
+/**
+ * OpenCode permission deployment helpers shared by the audit-code and
+ * remediate-code install flows (postinstall scripts and the remediate-code
+ * `ensure` command). Two named scopes exist:
+ *
+ * - **Global top-level scope** — the `permission` block at the root of
+ *   `~/.config/opencode/opencode.json`. This scope must never seed broad
+ *   allows: no `bash["*"] = "allow"` and no forced
+ *   `external_directory["*"] = "allow"`. It also actively migrates away
+ *   previously deployed broad rules whose value exactly matches the
+ *   historically managed value (`"allow"`); a matching value is treated as
+ *   tool-managed and removed even if it happened to be user-authored
+ *   (accepted safer failure direction). Any non-matching value (e.g. `"ask"`,
+ *   `"deny"`, or a different rule shape) is left completely untouched.
+ * - **Agent scope** — a per-agent `permission` block (e.g.
+ *   `agent.auditor.permission`). This scope keeps the
+ *   broad-allow-with-denylist deployment unchanged.
+ */
+/** The broad value the deploy helpers historically wrote ("tool-managed"). */
+export const OPENCODE_MANAGED_BROAD_VALUE = "allow";
+function permissionRuleObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+/** Returns a copy of `rules` without its `"*"` wildcard entry. */
+export function withoutOpenCodeWildcard(rules) {
+    const copy = { ...rules };
+    delete copy["*"];
+    return copy;
+}
+/**
+ * Agent-scope rule merge: generated rules seed the entry, existing
+ * non-wildcard user entries win over generated ones, and managed rules always
+ * win (including a managed wildcard when the caller provides one — pass
+ * `withoutOpenCodeWildcard(rules)` to let an existing wildcard survive).
+ */
+export function mergeOpenCodeAgentPermissionRule(existingRule, generatedRule, managedRules = {}) {
+    if (!generatedRule ||
+        typeof generatedRule !== "object" ||
+        Array.isArray(generatedRule)) {
+        return existingRule ?? generatedRule;
+    }
+    const generatedObject = generatedRule;
+    const existingObject = permissionRuleObject(existingRule);
+    const merged = {};
+    if (typeof existingRule === "string") {
+        merged["*"] = existingRule;
+    }
+    else {
+        merged["*"] = existingObject["*"] ?? generatedObject["*"] ?? "ask";
+    }
+    for (const [key, value] of Object.entries(generatedObject)) {
+        if (key !== "*")
+            merged[key] = value;
+    }
+    for (const [key, value] of Object.entries(existingObject)) {
+        if (key !== "*")
+            merged[key] = value;
+    }
+    for (const [key, value] of Object.entries(managedRules)) {
+        merged[key] = value;
+    }
+    return merged;
+}
+/**
+ * Global-scope rule merge: never seeds a wildcard. An existing wildcard is
+ * preserved verbatim unless it exactly matches the historically managed broad
+ * value (`"allow"`), in which case it is removed as migration cleanup.
+ * Non-wildcard rules merge like the agent scope (existing wins over
+ * generated; managed wins over existing).
+ */
+export function mergeOpenCodeGlobalPermissionRule(existingRule, generatedRule, managedRules = {}) {
+    const existingObject = typeof existingRule === "string"
+        ? { "*": existingRule }
+        : permissionRuleObject(existingRule);
+    const merged = {};
+    const existingWildcard = existingObject["*"];
+    if (existingWildcard !== undefined &&
+        existingWildcard !== OPENCODE_MANAGED_BROAD_VALUE) {
+        merged["*"] = existingWildcard;
+    }
+    for (const [key, value] of Object.entries(generatedRule)) {
+        if (key !== "*")
+            merged[key] = value;
+    }
+    for (const [key, value] of Object.entries(existingObject)) {
+        if (key !== "*")
+            merged[key] = value;
+    }
+    for (const [key, value] of Object.entries(managedRules)) {
+        if (key !== "*")
+            merged[key] = value;
+    }
+    return merged;
+}
+/**
+ * Global-scope `external_directory` migration: the deploy helpers
+ * historically forced `external_directory: { "*": "allow" }` at the top
+ * level. That broad rule is no longer seeded; when an existing entry's
+ * wildcard exactly matches the historically managed value it is removed.
+ * Returns `undefined` when the whole entry should be dropped from the
+ * permission block; any non-matching value is returned untouched.
+ */
+export function migrateOpenCodeGlobalExternalDirectory(existingRule) {
+    if (!existingRule ||
+        typeof existingRule !== "object" ||
+        Array.isArray(existingRule)) {
+        return existingRule;
+    }
+    const existingObject = existingRule;
+    if (existingObject["*"] !== OPENCODE_MANAGED_BROAD_VALUE) {
+        return existingRule;
+    }
+    const rest = withoutOpenCodeWildcard(existingObject);
+    return Object.keys(rest).length > 0 ? rest : undefined;
+}
+//# sourceMappingURL=opencodePermissions.js.map

package/dist/shared/opencodePermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodePermissions.js","sourceRoot":"","sources":["../../src/shared/opencodePermissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAIpD,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAwB;QAC3B,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CAAC,KAAqB;IAC3D,MAAM,IAAI,GAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAqB,EACrB,aAAsB,EACtB,eAA+B,EAAE;IAEjC,IACE,CAAC,aAAa;QACd,OAAO,aAAa,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAC5B,CAAC;QACD,OAAO,YAAY,IAAI,aAAa,CAAC;IACvC,CAAC;IACD,MAAM,eAAe,GAAG,aAA+B,CAAC;IACxD,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3D,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAqB,EACrB,aAA6B,EAC7B,eAA+B,EAAE;IAEjC,MAAM,cAAc,GAClB,OAAO,YAAY,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE;QACvB,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,IACE,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,4BAA4B,EACjD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sCAAsC,CACpD,YAAqB;IAErB,IACE,CAAC,YAAY;QACb,OAAO,YAAY,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,cAAc,GAAG,YAA8B,CAAC;IACtD,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,4BAA4B,EAAE,CAAC;QACzD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC"}

package/dist/shared/parsing/stringAwareScanner.d.ts

@@ -0,0 +1,32 @@
+/** Quote characters recognised as string delimiters. */
+export type QuoteChar = '"' | "'" | "`";
+export interface StringAwareScannerOptions {
+    /** Which characters open/close a string literal. */
+    quoteChars: readonly QuoteChar[];
+    /**
+     * Quote chars for which backslash-escape processing applies.
+     * Typically just `'"'`; backtick raw strings and single-quoted TOML
+     * strings never treat `\\` as an escape sequence.
+     */
+    escapedQuotes?: readonly QuoteChar[];
+}
+/**
+ * Scans `input` character-by-character while tracking string-literal state.
+ *
+ * Calls:
+ * - `callbacks.onUnquoted(char, index)` for every character that is NOT inside
+ *   a string literal.  Returning `false` stops the scan early.
+ * - `callbacks.onQuoteOpen(quoteChar, index)` when a string literal opens
+ *   (called with the opening quote character and its position).
+ * - `callbacks.onQuoteClose(quoteChar, index)` when a string literal closes
+ *   (called with the closing quote character and its position).
+ *
+ * The quote-open and quote-close characters themselves are NOT passed to
+ * `onUnquoted` — only truly unquoted content reaches that callback.
+ */
+export declare function scanStringAware(input: string, options: StringAwareScannerOptions, callbacks: {
+    onUnquoted?: (char: string, index: number) => boolean | void;
+    onQuoteOpen?: (quoteChar: QuoteChar, index: number) => void;
+    onQuoteClose?: (quoteChar: QuoteChar, index: number) => void;
+}): void;
+//# sourceMappingURL=stringAwareScanner.d.ts.map

package/dist/shared/parsing/stringAwareScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stringAwareScanner.d.ts","sourceRoot":"","sources":["../../../src/shared/parsing/stringAwareScanner.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,MAAM,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAExC,MAAM,WAAW,yBAAyB;IACxC,oDAAoD;IACpD,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE;IACT,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC7D,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D,GACA,IAAI,CAwCN"}

package/dist/shared/parsing/stringAwareScanner.js

@@ -0,0 +1,51 @@
+/**
+ * Scans `input` character-by-character while tracking string-literal state.
+ *
+ * Calls:
+ * - `callbacks.onUnquoted(char, index)` for every character that is NOT inside
+ *   a string literal.  Returning `false` stops the scan early.
+ * - `callbacks.onQuoteOpen(quoteChar, index)` when a string literal opens
+ *   (called with the opening quote character and its position).
+ * - `callbacks.onQuoteClose(quoteChar, index)` when a string literal closes
+ *   (called with the closing quote character and its position).
+ *
+ * The quote-open and quote-close characters themselves are NOT passed to
+ * `onUnquoted` — only truly unquoted content reaches that callback.
+ */
+export function scanStringAware(input, options, callbacks) {
+    const { quoteChars, escapedQuotes } = options;
+    const escapedSet = new Set(escapedQuotes ?? ['"']);
+    let currentQuote;
+    let escaped = false;
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (currentQuote !== undefined) {
+            // Inside a string literal.
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (escapedSet.has(currentQuote) && char === "\\") {
+                escaped = true;
+                continue;
+            }
+            if (char === currentQuote) {
+                const closing = currentQuote;
+                currentQuote = undefined;
+                callbacks.onQuoteClose?.(closing, index);
+            }
+            continue;
+        }
+        // Outside any string literal.
+        if (quoteChars.includes(char)) {
+            currentQuote = char;
+            callbacks.onQuoteOpen?.(currentQuote, index);
+            continue;
+        }
+        const result = callbacks.onUnquoted?.(char, index);
+        if (result === false) {
+            return;
+        }
+    }
+}
+//# sourceMappingURL=stringAwareScanner.js.map

package/dist/shared/parsing/stringAwareScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stringAwareScanner.js","sourceRoot":"","sources":["../../../src/shared/parsing/stringAwareScanner.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,OAAkC,EAClC,SAIC;IAED,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,UAAU,GAA2B,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3E,IAAI,YAAmC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAuB,CAAC;QAEhD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,2BAA2B;YAC3B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClD,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,YAAY,CAAC;gBAC7B,YAAY,GAAG,SAAS,CAAC;gBACzB,SAAS,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,CAAC;YACD,SAAS;QACX,CAAC;QAED,8BAA8B;QAC9B,IAAK,UAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,YAAY,GAAG,IAAiB,CAAC;YACjC,SAAS,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/shared/prompts.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Parts of a cacheable prompt: a static shared prefix (identical across all
+ * agents in a wave) and a per-agent payload (varies per invocation).
+ *
+ * Anthropic's prompt-caching mechanism requires the cacheable portion to appear
+ * at the start of the prompt and remain byte-identical across calls. Only the
+ * trailing per-agent payload should vary.
+ */
+export interface CacheablePromptParts {
+    /** Static context shared across all agents in a wave (design spec, codebase
+     *  summary, repo conventions, etc.). Must be identical across calls for
+     *  caching to apply. */
+    sharedPrefix: string;
+    /** Per-invocation task-specific payload that varies between agents. */
+    perAgentPayload: string;
+}
+/**
+ * Assemble a prompt that places the cacheable shared prefix first, followed by
+ * the per-agent payload. This ordering is required for Anthropic's prompt-caching
+ * mechanism: the static portion must appear at the start and remain identical
+ * across all agents in a wave; only the trailing payload varies.
+ *
+ * - If `sharedPrefix` is non-empty, the result is `sharedPrefix + "\n\n" + perAgentPayload`.
+ * - If `sharedPrefix` is empty, the result is just `perAgentPayload` (no leading separator).
+ *
+ * Use for design-review prompts, auditor-worker review packets, and
+ * seam-negotiation prompts rather than free-form string concatenation.
+ */
+export declare function buildCacheablePrompt(parts: CacheablePromptParts): string;
+/**
+ * Host instruction emitted in dispatch step prompts: control-plane orchestrator
+ * commands (`next-step`, `merge-and-ingest`, the per-phase merge commands) must be
+ * run directly, never piped through a token-compression wrapper that would corrupt
+ * their JSON / prompt-contract output. Single-sourced so audit-code and
+ * remediate-code stay in parity on the command-class wrap policy.
+ */
+export declare const DO_NOT_TOKEN_WRAP_NOTE: string;
+/**
+ * Host instruction emitted in dispatch step prompts: each subagent should
+ * receive its `prompt_path` file path and follow it directly. Loading worker
+ * prompts into the main conversation inflates context for no benefit — the
+ * worker executes in its own context and reports results back through its
+ * assigned result path. Single-sourced so audit-code and remediate-code stay
+ * in parity on the dispatch handoff policy.
+ */
+export declare const DISPATCH_PROMPT_HANDOFF_NOTE: string;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/shared/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/shared/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC;;4BAEwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAMxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAGG,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAG+C,CAAC"}

package/dist/shared/prompts.js

@@ -0,0 +1,41 @@
+/**
+ * Assemble a prompt that places the cacheable shared prefix first, followed by
+ * the per-agent payload. This ordering is required for Anthropic's prompt-caching
+ * mechanism: the static portion must appear at the start and remain identical
+ * across all agents in a wave; only the trailing payload varies.
+ *
+ * - If `sharedPrefix` is non-empty, the result is `sharedPrefix + "\n\n" + perAgentPayload`.
+ * - If `sharedPrefix` is empty, the result is just `perAgentPayload` (no leading separator).
+ *
+ * Use for design-review prompts, auditor-worker review packets, and
+ * seam-negotiation prompts rather than free-form string concatenation.
+ */
+export function buildCacheablePrompt(parts) {
+    const { sharedPrefix, perAgentPayload } = parts;
+    if (sharedPrefix.length === 0) {
+        return perAgentPayload;
+    }
+    return `${sharedPrefix}\n\n${perAgentPayload}`;
+}
+/**
+ * Host instruction emitted in dispatch step prompts: control-plane orchestrator
+ * commands (`next-step`, `merge-and-ingest`, the per-phase merge commands) must be
+ * run directly, never piped through a token-compression wrapper that would corrupt
+ * their JSON / prompt-contract output. Single-sourced so audit-code and
+ * remediate-code stay in parity on the command-class wrap policy.
+ */
+export const DO_NOT_TOKEN_WRAP_NOTE = "Run these backend commands directly — do not pipe them through a " +
+    "token-compression wrapper; their JSON / prompt-contract output is parsed " +
+    "verbatim and wrapping corrupts it.";
+/**
+ * Host instruction emitted in dispatch step prompts: each subagent should
+ * receive its `prompt_path` file path and follow it directly. Loading worker
+ * prompts into the main conversation inflates context for no benefit — the
+ * worker executes in its own context and reports results back through its
+ * assigned result path. Single-sourced so audit-code and remediate-code stay
+ * in parity on the dispatch handoff policy.
+ */
+export const DISPATCH_PROMPT_HANDOFF_NOTE = "For each subagent, pass its `prompt_path` to the agent tool directly — " +
+    "do not read the worker prompt file into this conversation. " +
+    "Each worker executes in its own context and writes only to its assigned result path.";
+//# sourceMappingURL=prompts.js.map

package/dist/shared/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/shared/prompts.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,YAAY,OAAO,eAAe,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,mEAAmE;IACnE,2EAA2E;IAC3E,oCAAoC,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yEAAyE;IACzE,6DAA6D;IAC7D,sFAAsF,CAAC"}

package/dist/shared/providers/claudeCodeProvider.d.ts

@@ -0,0 +1,56 @@
+import type { FreshSessionProvider, LaunchFreshSessionInput } from "./types.js";
+import type { ClaudeCodeConfig } from "../types/sessionConfig.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+export declare const CLAUDE_CODE_PROVIDER_NAME: "claude-code";
+/**
+ * Per-orchestrator tuning for the otherwise-identical claude-code provider. The
+ * single principled default (prompt via stdin + launch/done diagnostics) is the
+ * same for every orchestrator; the only intended delta is the skip-permissions
+ * default and the session-config path quoted in the nested-session guard
+ * message. Centralizing the class here keeps audit-code and remediate-code from
+ * re-implementing — and accidentally drifting — the spawn/argv/diagnostics
+ * logic (drift-plan E4).
+ */
+export interface ClaudeCodeProviderOptions {
+    /**
+     * Whether to default to `--dangerously-skip-permissions` when the config does
+     * not set `dangerously_skip_permissions` explicitly. `false` (the safe
+     * default) keeps permission prompts on; the autonomous remediator passes
+     * `true` because it applies changes unattended and cannot pause mid-run.
+     * Either way an explicit `dangerously_skip_permissions` in the config wins.
+     */
+    skipPermissionsDefault?: boolean;
+    /**
+     * The session-config path to quote in the nested-Claude-Code-session guard
+     * error so each orchestrator points the operator at its own config file.
+     */
+    activeSessionMessage?: string;
+}
+/**
+ * Build the nested-session guard message for an orchestrator. claude-code cannot
+ * spawn a fresh `claude` from inside an active Claude Code session, so the
+ * provider throws this guidance instead.
+ */
+export declare function buildActiveClaudeCodeSessionMessage(args: {
+    sessionConfigPath: string;
+    slashCommand: string;
+}): string;
+/**
+ * claude-code backend. claude is a headless coding CLI: it is handed the
+ * rendered prompt (here via stdin) and runs to completion. The prompt is piped
+ * through stdin rather than an argv flag so very large prompts never hit the
+ * platform command-line length limit, and structured launch/done diagnostics
+ * are emitted to stderr for run-correlated observability. Both behaviors are the
+ * single principled default shared by every orchestrator; per-orchestrator
+ * options carry only the skip-permissions default and the guard message.
+ */
+export declare class ClaudeCodeProvider implements FreshSessionProvider {
+    name: "claude-code";
+    private readonly config;
+    private readonly launchCommand;
+    private readonly skipPermissionsDefault;
+    private readonly activeSessionMessage;
+    constructor(config?: ClaudeCodeConfig, options?: ClaudeCodeProviderOptions, launchCommand?: typeof spawnLoggedCommand);
+    launch(input: LaunchFreshSessionInput): Promise<import("./types.js").LaunchFreshSessionResult>;
+}
+//# sourceMappingURL=claudeCodeProvider.d.ts.map

package/dist/shared/providers/claudeCodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeProvider.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/claudeCodeProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAU7D,eAAO,MAAM,yBAAyB,EAAG,aAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAMT;AAOD;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,IAAI,gBAA6B;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;IAC1D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;gBAG5C,MAAM,GAAE,gBAAqB,EAC7B,OAAO,GAAE,yBAA8B,EACvC,aAAa,GAAE,OAAO,kBAAuC;IASzD,MAAM,CAAC,KAAK,EAAE,uBAAuB;CAyB5C"}

package/dist/shared/providers/claudeCodeProvider.js

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import { readJsonFile } from "../io/json.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+import { applyWorkerTaskLaunchSettings, } from "./workerTaskLaunch.js";
+import { emitProviderLaunchDiagnostic, emitProviderDoneDiagnostic, } from "./providerDiagnostics.js";
+export const CLAUDE_CODE_PROVIDER_NAME = "claude-code";
+/**
+ * Build the nested-session guard message for an orchestrator. claude-code cannot
+ * spawn a fresh `claude` from inside an active Claude Code session, so the
+ * provider throws this guidance instead.
+ */
+export function buildActiveClaudeCodeSessionMessage(args) {
+    return ("claude-code provider cannot be used inside an active Claude Code session. " +
+        `Set provider to "local-subprocess" in ${args.sessionConfigPath}, ` +
+        `then run ${args.slashCommand} conversationally and follow the dispatch prompts manually.`);
+}
+const DEFAULT_ACTIVE_SESSION_MESSAGE = "claude-code provider cannot be used inside an active Claude Code session. " +
+    'Set provider to "local-subprocess" in the session-config.json, then run ' +
+    "the orchestrator conversationally and follow the dispatch prompts manually.";
+/**
+ * claude-code backend. claude is a headless coding CLI: it is handed the
+ * rendered prompt (here via stdin) and runs to completion. The prompt is piped
+ * through stdin rather than an argv flag so very large prompts never hit the
+ * platform command-line length limit, and structured launch/done diagnostics
+ * are emitted to stderr for run-correlated observability. Both behaviors are the
+ * single principled default shared by every orchestrator; per-orchestrator
+ * options carry only the skip-permissions default and the guard message.
+ */
+export class ClaudeCodeProvider {
+    name = CLAUDE_CODE_PROVIDER_NAME;
+    config;
+    launchCommand;
+    skipPermissionsDefault;
+    activeSessionMessage;
+    constructor(config = {}, options = {}, launchCommand = spawnLoggedCommand) {
+        this.config = config;
+        this.launchCommand = launchCommand;
+        this.skipPermissionsDefault = options.skipPermissionsDefault ?? false;
+        this.activeSessionMessage =
+            options.activeSessionMessage ?? DEFAULT_ACTIVE_SESSION_MESSAGE;
+    }
+    async launch(input) {
+        if (process.env.CLAUDECODE) {
+            throw new Error(this.activeSessionMessage);
+        }
+        const prompt = await readFile(input.promptPath, "utf8");
+        const task = await readJsonFile(input.taskPath);
+        const command = this.config.command ?? "claude";
+        const promptFlag = this.config.prompt_flag ?? "-p";
+        // The prompt is delivered via stdin (see below), so `promptFlag` is passed
+        // as a bare flag with no inline prompt value.
+        const skipPermissions = this.config.dangerously_skip_permissions ?? this.skipPermissionsDefault;
+        const args = [
+            promptFlag,
+            ...(this.config.extra_args ?? []),
+            ...(skipPermissions ? ["--dangerously-skip-permissions"] : []),
+        ];
+        emitProviderLaunchDiagnostic(this.name, input);
+        const result = await this.launchCommand(command, args, {
+            ...applyWorkerTaskLaunchSettings(input, task),
+            stdinText: prompt,
+        });
+        emitProviderDoneDiagnostic(this.name, input, result);
+        return result;
+    }
+}
+//# sourceMappingURL=claudeCodeProvider.js.map

package/dist/shared/providers/claudeCodeProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeProvider.js","sourceRoot":"","sources":["../../../src/shared/providers/claudeCodeProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAM5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAsB,CAAC;AA2BhE;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAGnD;IACC,OAAO,CACL,4EAA4E;QAC5E,yCAAyC,IAAI,CAAC,iBAAiB,IAAI;QACnE,YAAY,IAAI,CAAC,YAAY,6DAA6D,CAC3F,CAAC;AACJ,CAAC;AAED,MAAM,8BAA8B,GAClC,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAC7B,IAAI,GAAG,yBAAyB,CAAC;IAChB,MAAM,CAAmB;IACzB,aAAa,CAA4B;IACzC,sBAAsB,CAAU;IAChC,oBAAoB,CAAS;IAE9C,YACE,SAA2B,EAAE,EAC7B,UAAqC,EAAE,EACvC,gBAA2C,kBAAkB;QAE7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC;QACtE,IAAI,CAAC,oBAAoB;YACvB,OAAO,CAAC,oBAAoB,IAAI,8BAA8B,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAwB,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;QACnD,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,eAAe,GACnB,IAAI,CAAC,MAAM,CAAC,4BAA4B,IAAI,IAAI,CAAC,sBAAsB,CAAC;QAC1E,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;YACrD,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC;YAC7C,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/shared/providers/codexProvider.d.ts

@@ -0,0 +1,37 @@
+import type { FreshSessionProvider, LaunchFreshSessionInput, ProviderRateLimits } from "./types.js";
+import type { CodexConfig } from "../types/sessionConfig.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+export declare const CODEX_PROVIDER_NAME: "codex";
+/**
+ * Codex CLI backend. Codex is a headless coding CLI in the same family as
+ * claude-code. The non-interactive entrypoint is `codex exec`, which reads the
+ * rendered prompt from STDIN (so very large prompts never hit the command-line
+ * length limit) and runs to completion editing files in its working root. The
+ * invocation shape is verified against codex-cli 0.140.0:
+ *
+ *   codex exec --sandbox <policy> --cd <root> --add-dir <resultDir> [--model M]
+ *
+ * `exec` is inherently non-interactive (it has no `--ask-for-approval` flag); the
+ * sandbox policy governs what it may write. `--cd` roots the agent (and its
+ * sandbox) at the node's isolated worktree; `--add-dir` grants write access to the
+ * result-file directory, which lives outside the worktree. On Windows the `codex`
+ * launcher is a `.cmd`/`.ps1` shim that `spawn` cannot run without a shell, so it
+ * is routed through cmd.exe (no-op on other OSes). Launch/done diagnostics match
+ * the other CLI providers.
+ */
+export declare class CodexProvider implements FreshSessionProvider {
+    name: "codex";
+    private readonly config;
+    private readonly launchCommand;
+    constructor(config: CodexConfig | undefined, launchCommand?: typeof spawnLoggedCommand);
+    launch(input: LaunchFreshSessionInput): Promise<import("./types.js").LaunchFreshSessionResult>;
+    /**
+     * Best-effort, never-throwing. Codex is a hosted backend whose 429/RPM/TPM
+     * ceilings are not introspectable from the CLI, so this returns null today.
+     * Resolution falls back to classifyProvider("codex")=hosted defaults plus the
+     * learned-limits subsystem (which absorbs the real usage-limit signal Codex
+     * surfaces on stderr when a quota is exhausted).
+     */
+    queryLimits(_model: string | null): Promise<ProviderRateLimits | null>;
+}
+//# sourceMappingURL=codexProvider.d.ts.map

package/dist/shared/providers/codexProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexProvider.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/codexProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAW7D,eAAO,MAAM,mBAAmB,EAAG,OAAgB,CAAC;AAKpD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAc,YAAW,oBAAoB;IACxD,IAAI,UAAuB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;gBAGxD,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,aAAa,GAAE,OAAO,kBAAuC;IAMzD,MAAM,CAAC,KAAK,EAAE,uBAAuB;IAqC3C;;;;;;OAMG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CAG7E"}