audit-tools 0.28.0

package/dist/shared/providers/opencodeProvider.d.ts

@@ -0,0 +1,19 @@
+import type { FreshSessionProvider, LaunchFreshSessionInput } from "./types.js";
+import type { OpenCodeConfig } from "../types/sessionConfig.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+export declare const OPENCODE_PROVIDER_NAME: "opencode";
+/**
+ * opencode backend. Like claude-code, opencode is handed the rendered prompt via
+ * stdin and runs to completion; the same launch/done diagnostics are emitted.
+ * opencode takes no skip-permissions flag, so it has no per-orchestrator delta —
+ * the class is fully shared (drift-plan E4) and the injectable `launchCommand`
+ * supports unit testing.
+ */
+export declare class OpenCodeProvider implements FreshSessionProvider {
+    name: "opencode";
+    private readonly config;
+    private readonly launchCommand;
+    constructor(config?: OpenCodeConfig, launchCommand?: typeof spawnLoggedCommand);
+    launch(input: LaunchFreshSessionInput): Promise<import("./types.js").LaunchFreshSessionResult>;
+}
+//# sourceMappingURL=opencodeProvider.d.ts.map

package/dist/shared/providers/opencodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodeProvider.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/opencodeProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAW7D,eAAO,MAAM,sBAAsB,EAAG,UAAmB,CAAC;AAE1D;;;;;;GAMG;AACH,qBAAa,gBAAiB,YAAW,oBAAoB;IAC3D,IAAI,aAA0B;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;gBAGxD,MAAM,GAAE,cAAmB,EAC3B,aAAa,GAAE,OAAO,kBAAuC;IAMzD,MAAM,CAAC,KAAK,EAAE,uBAAuB;CAiB5C"}

package/dist/shared/providers/opencodeProvider.js

@@ -0,0 +1,41 @@
+import { readFile } from "node:fs/promises";
+import { readJsonFile } from "../io/json.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+import { resolveOpenCodeSpawnCommand } from "./opencodeLaunch.js";
+import { applyWorkerTaskLaunchSettings, } from "./workerTaskLaunch.js";
+import { emitProviderLaunchDiagnostic, emitProviderDoneDiagnostic, } from "./providerDiagnostics.js";
+export const OPENCODE_PROVIDER_NAME = "opencode";
+/**
+ * opencode backend. Like claude-code, opencode is handed the rendered prompt via
+ * stdin and runs to completion; the same launch/done diagnostics are emitted.
+ * opencode takes no skip-permissions flag, so it has no per-orchestrator delta —
+ * the class is fully shared (drift-plan E4) and the injectable `launchCommand`
+ * supports unit testing.
+ */
+export class OpenCodeProvider {
+    name = OPENCODE_PROVIDER_NAME;
+    config;
+    launchCommand;
+    constructor(config = {}, launchCommand = spawnLoggedCommand) {
+        this.config = config;
+        this.launchCommand = launchCommand;
+    }
+    async launch(input) {
+        const prompt = await readFile(input.promptPath, "utf8");
+        const task = await readJsonFile(input.taskPath);
+        const baseCommand = this.config.command ?? "opencode";
+        // The prompt is delivered via stdin, so it is not appended to argv.
+        const baseArgs = ["run", ...(this.config.extra_args ?? [])];
+        // On Windows the `opencode` launcher is a `.cmd` shim that `spawn` cannot
+        // run without a shell; resolve it through cmd.exe (no-op on other OSes).
+        const { command, args } = resolveOpenCodeSpawnCommand(baseCommand, baseArgs);
+        emitProviderLaunchDiagnostic(this.name, input);
+        const result = await this.launchCommand(command, args, {
+            ...applyWorkerTaskLaunchSettings(input, task),
+            stdinText: prompt,
+        });
+        emitProviderDoneDiagnostic(this.name, input, result);
+        return result;
+    }
+}
+//# sourceMappingURL=opencodeProvider.js.map

package/dist/shared/providers/opencodeProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodeProvider.js","sourceRoot":"","sources":["../../../src/shared/providers/opencodeProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAM5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,6BAA6B,GAE9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAmB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IAC3B,IAAI,GAAG,sBAAsB,CAAC;IACb,MAAM,CAAiB;IACvB,aAAa,CAA4B;IAE1D,YACE,SAAyB,EAAE,EAC3B,gBAA2C,kBAAkB;QAE7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAwB,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC;QACtD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,2BAA2B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7E,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;YACrD,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC;YAC7C,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/shared/providers/providerConfirmation.d.ts

@@ -0,0 +1,56 @@
+import type { ResolvedProviderName, SessionConfig } from "../types/sessionConfig.js";
+import type { FreshSessionProvider, ProviderRateLimits } from "./types.js";
+export type CapabilityTier = "frontier" | "capable" | "fast" | "unknown";
+export interface DiscoveredProvider {
+    name: ResolvedProviderName;
+    command?: string;
+    capabilityTier: CapabilityTier;
+    quotaState?: ProviderRateLimits | null;
+    detected: boolean;
+    reason?: string;
+}
+export interface ConfirmedProviderPool {
+    providers: DiscoveredProvider[];
+    excluded: ResolvedProviderName[];
+    addedUndetected: DiscoveredProvider[];
+}
+/**
+ * Probe PATH for each known CLI and return a DiscoveredProvider entry for each
+ * detected tool. Uses `resolveFreshSessionProviderName` to honour session-config
+ * overrides when determining which CLI name to probe.
+ *
+ * @param sessionConfig - Current session config (may be empty `{}`).
+ * @param env           - Process env snapshot; defaults to `process.env`.
+ */
+export declare function discoverProviders(sessionConfig: SessionConfig, env?: NodeJS.ProcessEnv): DiscoveredProvider[];
+/**
+ * Query the rate-limit state from a live provider if the `queryLimits` method
+ * is available. Returns `null` on timeout/error — never throws.
+ *
+ * OBS-9a9091ad: a `queryLimits` rejection was previously swallowed with no
+ * signal, so a provider whose rate-limit query consistently fails was invisible
+ * to operators (the sibling CompositeQuotaSource logs the same swallow). Accept
+ * an optional injectable `log` (mirroring analyzerDeps' injectable-log pattern)
+ * that is invoked with the provider name + error on the swallowed-error path.
+ * The contract is unchanged — `log` is optional, the function still never throws
+ * and still returns null — so existing callers need no change while a caller
+ * that cares can route the diagnostic into its RunLogger.
+ */
+export declare function queryProviderQuota(provider: DiscoveredProvider, freshSessionProvider: FreshSessionProvider, log?: (providerName: string, error: unknown) => void): Promise<ProviderRateLimits | null>;
+/**
+ * Build a markdown table summarising the discovered provider pool for display
+ * in Gate-0 confirmation prompts.
+ *
+ * | Provider | Tier | Quota | Default |
+ */
+export declare function buildProviderConfirmationDisplay(discovered: DiscoveredProvider[]): string;
+/**
+ * Apply user selections to the discovered pool, returning a ConfirmedProviderPool
+ * suitable for persistence in SessionConfig.confirmed_provider_pool.
+ *
+ * @param discovered      - Output of `discoverProviders`.
+ * @param exclude         - Provider names to remove from the pool.
+ * @param addUndetected   - Manually specified providers not found on PATH.
+ */
+export declare function applyProviderConfirmationSelections(discovered: DiscoveredProvider[], exclude: ResolvedProviderName[], addUndetected: DiscoveredProvider[]): ConfirmedProviderPool;
+//# sourceMappingURL=providerConfirmation.d.ts.map

package/dist/shared/providers/providerConfirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerConfirmation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAU3E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,eAAe,EAAE,kBAAkB,EAAE,CAAC;CACvC;AA6ED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,EAAE,CAmDtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,oBAAoB,EAAE,oBAAoB,EAC1C,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACnD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAUpC;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,kBAAkB,EAAE,GAC/B,MAAM,CAiCR;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,kBAAkB,EAAE,EAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,aAAa,EAAE,kBAAkB,EAAE,GAClC,qBAAqB,CAYvB"}

package/dist/shared/providers/providerConfirmation.js

@@ -0,0 +1,195 @@
+import { spawnSync } from "node:child_process";
+import { resolveFreshSessionProviderName, hasConfiguredOpenAiCompatible, } from "./providerFactory.js";
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Default capability tier for a given provider name.
+ *
+ * This is a fallback used only when no session-config override is available.
+ * Tiers are intentionally coarse and static here; the scheduler discovery
+ * path (HostModelRosterEntry / DiscoveredRateLimitsInput) is the authoritative
+ * source of per-model capability at dispatch time.
+ *
+ * INV-shared-core-02: provider-name → tier mapping must NOT be a flat lookup
+ * table that gates dispatch routing. Capability tier on DiscoveredProvider is
+ * a declared/discoverable input, not an opaque internal enum. This function
+ * is the single place where a default is applied; all routing uses the
+ * DispatchModelTier vocabulary on CapacityPool, not this field.
+ */
+function defaultCapabilityTier(name) {
+    switch (name) {
+        case "claude-code":
+            return "frontier";
+        case "opencode":
+        case "codex":
+        case "openai-compatible":
+        case "subprocess-template":
+        case "vscode-task":
+        case "antigravity":
+            return "capable";
+        case "local-subprocess":
+            return "unknown";
+    }
+}
+/** Probe PATH for a single command. Returns true if the command resolves. */
+function commandExists(command) {
+    const lookupCommand = process.platform === "win32" ? "where" : "which";
+    const result = spawnSync(lookupCommand, [command], { stdio: "ignore" });
+    return result.status === 0;
+}
+const CLI_PROBES = [
+    {
+        providerName: "claude-code",
+        defaultCommand: "claude",
+        configCommand: (cfg) => cfg.claude_code?.command,
+    },
+    {
+        providerName: "opencode",
+        defaultCommand: "opencode",
+        configCommand: (cfg) => cfg.opencode?.command,
+    },
+    {
+        providerName: "codex",
+        defaultCommand: "codex",
+        configCommand: (cfg) => cfg.codex?.command,
+    },
+];
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Probe PATH for each known CLI and return a DiscoveredProvider entry for each
+ * detected tool. Uses `resolveFreshSessionProviderName` to honour session-config
+ * overrides when determining which CLI name to probe.
+ *
+ * @param sessionConfig - Current session config (may be empty `{}`).
+ * @param env           - Process env snapshot; defaults to `process.env`.
+ */
+export function discoverProviders(sessionConfig, env = process.env) {
+    const discovered = [];
+    for (const probe of CLI_PROBES) {
+        const command = (probe.configCommand(sessionConfig) ?? "").trim() || probe.defaultCommand;
+        const available = commandExists(command);
+        if (!available)
+            continue;
+        // Self-spawn guard: mirror providerFactory — don't surface claude-code when
+        // already inside a claude-code session, codex when inside codex, etc.
+        const resolvedName = resolveFreshSessionProviderName("auto", sessionConfig, {
+            env,
+            commandExists: (cmd) => cmd === command,
+        });
+        // If auto-resolution wouldn't pick this provider (e.g. self-spawn blocked),
+        // still surface it — but note the restriction in `reason`.
+        const blocked = (probe.providerName === "claude-code" && Boolean(env.CLAUDECODE)) ||
+            (probe.providerName === "codex" && Boolean(env.CODEX));
+        discovered.push({
+            name: probe.providerName,
+            command,
+            capabilityTier: defaultCapabilityTier(probe.providerName),
+            detected: true,
+            reason: blocked
+                ? `detected on PATH but cannot self-spawn from within an active ${probe.providerName} session`
+                : resolvedName === probe.providerName
+                    ? undefined
+                    : `detected on PATH; auto-resolution may prefer a higher-priority provider`,
+        });
+    }
+    // openai-compatible (NIM / vLLM / LM Studio / …) is an API pool, not a CLI: it
+    // is config-gated (base_url + model), never PATH-probed, so the CLI loop above
+    // can't surface it. Surface it here when configured so it joins the confirmed
+    // pool as a real spill target (INV-QD-14) alongside the PATH-detected CLIs.
+    if (hasConfiguredOpenAiCompatible(sessionConfig.openai_compatible)) {
+        discovered.push({
+            name: "openai-compatible",
+            command: sessionConfig.openai_compatible?.model,
+            capabilityTier: defaultCapabilityTier("openai-compatible"),
+            detected: true,
+            reason: "configured background API pool (base_url + model); not PATH-probed",
+        });
+    }
+    return discovered;
+}
+/**
+ * Query the rate-limit state from a live provider if the `queryLimits` method
+ * is available. Returns `null` on timeout/error — never throws.
+ *
+ * OBS-9a9091ad: a `queryLimits` rejection was previously swallowed with no
+ * signal, so a provider whose rate-limit query consistently fails was invisible
+ * to operators (the sibling CompositeQuotaSource logs the same swallow). Accept
+ * an optional injectable `log` (mirroring analyzerDeps' injectable-log pattern)
+ * that is invoked with the provider name + error on the swallowed-error path.
+ * The contract is unchanged — `log` is optional, the function still never throws
+ * and still returns null — so existing callers need no change while a caller
+ * that cares can route the diagnostic into its RunLogger.
+ */
+export async function queryProviderQuota(provider, freshSessionProvider, log) {
+    if (typeof freshSessionProvider.queryLimits !== "function") {
+        return null;
+    }
+    try {
+        return await freshSessionProvider.queryLimits(null);
+    }
+    catch (error) {
+        log?.(provider.name, error);
+        return null;
+    }
+}
+/**
+ * Build a markdown table summarising the discovered provider pool for display
+ * in Gate-0 confirmation prompts.
+ *
+ * | Provider | Tier | Quota | Default |
+ */
+export function buildProviderConfirmationDisplay(discovered) {
+    if (discovered.length === 0) {
+        return "No providers detected on PATH.";
+    }
+    const rows = discovered.map((p) => {
+        const tier = p.capabilityTier;
+        const quota = p.quotaState == null
+            ? "—"
+            : [
+                p.quotaState.requests_per_minute != null
+                    ? `${p.quotaState.requests_per_minute} rpm`
+                    : null,
+                p.quotaState.input_tokens_per_minute != null
+                    ? `${p.quotaState.input_tokens_per_minute} itpm`
+                    : null,
+            ]
+                .filter(Boolean)
+                .join(", ") || "—";
+        // Local-subprocess requires explicit addition because it blocks auto-dispatch.
+        const isDefault = p.name !== "local-subprocess";
+        const defaultCol = isDefault ? "included" : "add explicitly";
+        const statusNote = p.reason ? ` *(${p.reason})*` : "";
+        return `| ${p.name}${statusNote} | ${tier} | ${quota} | ${defaultCol} |`;
+    });
+    return [
+        "| Provider | Tier | Quota | Default |",
+        "| --- | --- | --- | --- |",
+        ...rows,
+    ].join("\n");
+}
+/**
+ * Apply user selections to the discovered pool, returning a ConfirmedProviderPool
+ * suitable for persistence in SessionConfig.confirmed_provider_pool.
+ *
+ * @param discovered      - Output of `discoverProviders`.
+ * @param exclude         - Provider names to remove from the pool.
+ * @param addUndetected   - Manually specified providers not found on PATH.
+ */
+export function applyProviderConfirmationSelections(discovered, exclude, addUndetected) {
+    const excludeSet = new Set(exclude);
+    const filtered = discovered.filter((p) => !excludeSet.has(p.name));
+    const undetectedNormalized = addUndetected.map((p) => ({
+        ...p,
+        detected: false,
+    }));
+    return {
+        providers: [...filtered, ...undetectedNormalized],
+        excluded: exclude,
+        addedUndetected: undetectedNormalized,
+    };
+}
+//# sourceMappingURL=providerConfirmation.js.map

package/dist/shared/providers/providerConfirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfirmation.js","sourceRoot":"","sources":["../../../src/shared/providers/providerConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAuB9B,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAAC,IAA0B;IACvD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,mBAAmB,CAAC;QACzB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,kBAAkB;YACrB,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAcD,MAAM,UAAU,GAAe;IAC7B;QACE,YAAY,EAAE,aAAa;QAC3B,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO;KACjD;IACD;QACE,YAAY,EAAE,UAAU;QACxB,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO;KAC9C;IACD;QACE,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,OAAO;QACvB,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;KAC3C;CACF,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,cAAc,CAAC;QAC5E,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,YAAY,GAAG,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE;YAC1E,GAAG;YACH,aAAa,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO;SAChD,CAAC,CAAC;QAEH,4EAA4E;QAC5E,2DAA2D;QAC3D,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,YAAY,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,OAAO;YACP,cAAc,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;YACzD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,gEAAgE,KAAK,CAAC,YAAY,UAAU;gBAC9F,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;oBACnC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,yEAAyE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,6BAA6B,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,aAAa,CAAC,iBAAiB,EAAE,KAAK;YAC/C,cAAc,EAAE,qBAAqB,CAAC,mBAAmB,CAAC;YAC1D,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA4B,EAC5B,oBAA0C,EAC1C,GAAoD;IAEpD,IAAI,OAAO,oBAAoB,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAgC;IAEhC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC;QAC9B,MAAM,KAAK,GACT,CAAC,CAAC,UAAU,IAAI,IAAI;YAClB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,CAAC,CAAC,UAAU,CAAC,mBAAmB,IAAI,IAAI;oBACtC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,mBAAmB,MAAM;oBAC3C,CAAC,CAAC,IAAI;gBACR,CAAC,CAAC,UAAU,CAAC,uBAAuB,IAAI,IAAI;oBAC1C,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,uBAAuB,OAAO;oBAChD,CAAC,CAAC,IAAI;aACT;iBACE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAE3B,+EAA+E;QAC/E,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,UAAU,MAAM,IAAI,MAAM,KAAK,MAAM,UAAU,IAAI,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,uCAAuC;QACvC,2BAA2B;QAC3B,GAAG,IAAI;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAgC,EAChC,OAA+B,EAC/B,aAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC;QACJ,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,oBAAoB,CAAC;QACjD,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,oBAAoB;KACtC,CAAC;AACJ,CAAC"}

package/dist/shared/providers/providerDiagnostics.d.ts

@@ -0,0 +1,11 @@
+import type { LaunchFreshSessionInput, LaunchFreshSessionResult } from "./types.js";
+/**
+ * Structured provider launch/done diagnostics, emitted as single JSON lines on
+ * stderr (the FINDING-012 one-line-JSON convention). Single-sourced here so the
+ * shared ClaudeCode / OpenCode providers emit byte-identical `provider_launch` /
+ * `provider_done` records instead of each re-building the object inline (the
+ * accidental-drift source the per-orchestrator copies suffered from).
+ */
+export declare function emitProviderLaunchDiagnostic(provider: string, input: LaunchFreshSessionInput): void;
+export declare function emitProviderDoneDiagnostic(provider: string, input: LaunchFreshSessionInput, result: LaunchFreshSessionResult): void;
+//# sourceMappingURL=providerDiagnostics.d.ts.map

package/dist/shared/providers/providerDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerDiagnostics.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerDiagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,IAAI,CAWN;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,EAC9B,MAAM,EAAE,wBAAwB,GAC/B,IAAI,CAWN"}

package/dist/shared/providers/providerDiagnostics.js

@@ -0,0 +1,28 @@
+/**
+ * Structured provider launch/done diagnostics, emitted as single JSON lines on
+ * stderr (the FINDING-012 one-line-JSON convention). Single-sourced here so the
+ * shared ClaudeCode / OpenCode providers emit byte-identical `provider_launch` /
+ * `provider_done` records instead of each re-building the object inline (the
+ * accidental-drift source the per-orchestrator copies suffered from).
+ */
+export function emitProviderLaunchDiagnostic(provider, input) {
+    process.stderr.write(JSON.stringify({
+        event: "provider_launch",
+        provider,
+        runId: input.runId,
+        obligationId: input.obligationId,
+        promptPath: input.promptPath,
+        taskPath: input.taskPath,
+    }) + "\n");
+}
+export function emitProviderDoneDiagnostic(provider, input, result) {
+    process.stderr.write(JSON.stringify({
+        event: "provider_done",
+        provider,
+        runId: input.runId,
+        obligationId: input.obligationId,
+        accepted: result.accepted,
+        exitCode: result.exitCode ?? null,
+    }) + "\n");
+}
+//# sourceMappingURL=providerDiagnostics.js.map

package/dist/shared/providers/providerDiagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerDiagnostics.js","sourceRoot":"","sources":["../../../src/shared/providers/providerDiagnostics.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,KAA8B;IAE9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,iBAAiB;QACxB,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,KAA8B,EAC9B,MAAgC;IAEhC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,eAAe;QACtB,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;KAClC,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC"}

package/dist/shared/providers/providerFactory.d.ts

@@ -0,0 +1,72 @@
+import type { FreshSessionProvider } from "./types.js";
+import type { ResolvedProviderName, SessionConfig, ClaudeCodeConfig, OpenCodeConfig } from "../types/sessionConfig.js";
+import { RunLogger } from "../observability/runLog.js";
+/**
+ * openai-compatible is configured when both an endpoint and a model are set. The
+ * API key is resolved (and degrades) at launch — env presence is intentionally
+ * not probed here, mirroring how the agentic providers don't read credentials
+ * during resolution.
+ */
+export declare function hasConfiguredOpenAiCompatible(config: SessionConfig["openai_compatible"]): boolean;
+/**
+ * Snapshot of the environment + session-config signals the auto-resolver reads.
+ * Captured once so `chooseAutoProvider` is a pure function of these inputs.
+ */
+export interface AutoProviderContext {
+    inVSCode: boolean;
+    insideOpenCode: boolean;
+    insideClaudeCode: boolean;
+    insideCodex: boolean;
+    inAntigravity: boolean;
+    hasVSCodeTaskTemplate: boolean;
+    hasAntigravityTemplate: boolean;
+    hasSubprocessTemplate: boolean;
+    hasClaudeCodeConfig: boolean;
+    hasOpenCodeConfig: boolean;
+    hasCodexConfig: boolean;
+    hasOpenAiCompatibleConfig: boolean;
+    claudeAvailable: boolean;
+    opencodeAvailable: boolean;
+    codexAvailable: boolean;
+}
+/**
+ * Resolve a concrete provider name. Only the explicit `"auto"` sentinel triggers
+ * environment auto-detection; any other requested name (or `sessionConfig.provider`)
+ * passes through verbatim, and an entirely unspecified provider defaults to
+ * `"local-subprocess"`. Callers that want auto-detection on an unspecified
+ * provider should pass `"auto"` (see `createFreshSessionProvider`).
+ */
+export declare function resolveFreshSessionProviderName(name: string | undefined, sessionConfig?: SessionConfig, options?: {
+    env?: NodeJS.ProcessEnv;
+    commandExists?: (command: string) => boolean;
+}): ResolvedProviderName;
+/**
+ * Per-orchestrator hooks for the two providers that legitimately differ between
+ * audit-code and remediate-code (prompt delivery, skip-permissions default, and
+ * the session-config path referenced in error messages). The shared factory owns
+ * all wiring except the construction of these two, which each orchestrator injects
+ * so its own `ClaudeCodeProvider` / `OpenCodeProvider` semantics are preserved.
+ */
+export interface FreshSessionProviderDeps {
+    /** Human-readable orchestrator name, interpolated into the fallback warning. */
+    orchestratorName: string;
+    createClaudeCodeProvider: (config: ClaudeCodeConfig | undefined) => FreshSessionProvider;
+    createOpenCodeProvider: (config: OpenCodeConfig | undefined) => FreshSessionProvider;
+    /**
+     * Optional structured run logger. When provided, auto-resolution decisions are
+     * emitted as a structured `provider_launch` event in addition to the human-readable
+     * stderr line. This enables machine-parseable, run-correlated observability of
+     * provider auto-selection decisions (FND-OBS-12e8582b).
+     */
+    runLogger?: RunLogger;
+}
+/**
+ * Instantiate the resolved provider. When neither `name` nor
+ * `sessionConfig.provider` is set, auto-detection is requested on the caller's
+ * behalf (the conversation-first default). The claude-code and opencode providers
+ * are built via the injected `deps` so each orchestrator keeps its own behavior;
+ * every other provider lives in shared and is instantiated here directly. The
+ * auto-fallback warning is attributed to `deps.orchestratorName`.
+ */
+export declare function createFreshSessionProvider(name: string | undefined, sessionConfig: SessionConfig | undefined, deps: FreshSessionProviderDeps): FreshSessionProvider;
+//# sourceMappingURL=providerFactory.d.ts.map

package/dist/shared/providers/providerFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerFactory.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerFactory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAEhB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAyBvD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,GACzC,OAAO,CAET;AAQD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,sBAAsB,EAAE,OAAO,CAAC;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;CACzB;AAyJD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,GAAE,aAAkB,EACjC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC,GACL,oBAAoB,CAYtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,wBAAwB,EAAE,CACxB,MAAM,EAAE,gBAAgB,GAAG,SAAS,KACjC,oBAAoB,CAAC;IAC1B,sBAAsB,EAAE,CACtB,MAAM,EAAE,cAAc,GAAG,SAAS,KAC/B,oBAAoB,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,EAAE,aAAa,YAAK,EACjC,IAAI,EAAE,wBAAwB,GAC7B,oBAAoB,CAkFtB"}