instar 1.3.485 → 1.3.487

package/dist/core/componentCategories.js.map

@@ -1 +1 @@
-{"version":3,"file":"componentCategories.js","sourceRoot":"","sources":["../../src/core/componentCategories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO;CAChD,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgD;IAC7E,uEAAuE;IACvE,aAAa,EAAE,UAAU;IACzB,UAAU,EAAE,UAAU;IACtB,uBAAuB,EAAE,UAAU;IACnC,gBAAgB,EAAE,UAAU;IAC5B,kBAAkB,EAAE,UAAU;IAC9B,aAAa,EAAE,UAAU;IACzB,aAAa,EAAE,UAAU;IACzB,eAAe,EAAE,UAAU;IAC3B,mBAAmB,EAAE,UAAU;IAC/B,wBAAwB,EAAE,UAAU;IACpC,mBAAmB,EAAE,UAAU;IAC/B,eAAe,EAAE,UAAU;IAC3B,mBAAmB,EAAE,UAAU;IAE/B,iDAAiD;IACjD,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,MAAM;IACpB,eAAe,EAAE,MAAM;IACvB,qBAAqB,EAAE,MAAM;IAC7B,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,MAAM;IAC3B,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,MAAM;IAEzB,gEAAgE;IAChE,YAAY,EAAE,WAAW;IACzB,kBAAkB,EAAE,WAAW;IAC/B,iBAAiB,EAAE,WAAW;IAC9B,UAAU,EAAE,WAAW;IACvB,eAAe,EAAE,WAAW;IAC5B,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,WAAW;IAChC,4BAA4B,EAAE,WAAW;IACzC,kBAAkB,EAAE,WAAW;IAE/B,8BAA8B;IAC9B,kBAAkB,EAAE,KAAK;IACzB,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,iBAAiB,EAAE,KAAK;IACxB,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,sEAAsE;IACtE,4EAA4E;IAC5E,2BAA2B,EAAE,KAAK;CACnC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA6B;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;AAC7C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"componentCategories.js","sourceRoot":"","sources":["../../src/core/componentCategories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO;CAChD,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgD;IAC7E,uEAAuE;IACvE,aAAa,EAAE,UAAU;IACzB,UAAU,EAAE,UAAU;IACtB,uBAAuB,EAAE,UAAU;IACnC,gBAAgB,EAAE,UAAU;IAC5B,kBAAkB,EAAE,UAAU;IAC9B,aAAa,EAAE,UAAU;IACzB,aAAa,EAAE,UAAU;IACzB,eAAe,EAAE,UAAU;IAC3B,mBAAmB,EAAE,UAAU;IAC/B,wBAAwB,EAAE,UAAU;IACpC,mBAAmB,EAAE,UAAU;IAC/B,eAAe,EAAE,UAAU;IAC3B,mBAAmB,EAAE,UAAU;IAC/B,wEAAwE;IACxE,iDAAiD;IACjD,0BAA0B,EAAE,UAAU;IACtC,iEAAiE;IACjE,YAAY,EAAE,UAAU;IAExB,iDAAiD;IACjD,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,MAAM;IACpB,eAAe,EAAE,MAAM;IACvB,qBAAqB,EAAE,MAAM;IAC7B,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,MAAM;IAC3B,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,MAAM;IACzB,2EAA2E;IAC3E,YAAY,EAAE,MAAM;IACpB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,MAAM;IAEtB,gEAAgE;IAChE,YAAY,EAAE,WAAW;IACzB,kBAAkB,EAAE,WAAW;IAC/B,iBAAiB,EAAE,WAAW;IAC9B,UAAU,EAAE,WAAW;IACvB,eAAe,EAAE,WAAW;IAC5B,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,WAAW;IAChC,4BAA4B,EAAE,WAAW;IACzC,kBAAkB,EAAE,WAAW;IAE/B,8BAA8B;IAC9B,kBAAkB,EAAE,KAAK;IACzB,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,iBAAiB,EAAE,KAAK;IACxB,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,sEAAsE;IACtE,4EAA4E;IAC5E,2BAA2B,EAAE,KAAK;CACnC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA6B;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;AAC7C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/core/intelligenceProviderFactory.d.ts

@@ -91,6 +91,14 @@ export interface BuildIntelligenceProviderOptions {
      * Even when true, allowed calls are audit-logged with a cost warning.
      */
     piAllowAnthropicProviders?: boolean;
+    /**
+     * codex-cli only (token-audit-completeness): per-call kill-switch read for
+     * exec-json mode. Construction sites with config thread
+     * `createCodexExecJsonConfigResolver()`; absent, the provider falls back to
+     * env `INSTAR_CODEX_EXEC_JSON !== '0'` so config-less sites keep a working
+     * rollback lever.
+     */
+    resolveExecJson?: () => boolean;
 }
 /**
  * Build an IntelligenceProvider for the given framework. Returns null

package/dist/core/intelligenceProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intelligenceProviderFactory.d.ts","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,4EAA4E;QAC5E,WAAW,EAAE,eAAe,CAAC;QAC7B,gEAAgE;QAChE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;QAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;QAChD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;KACrD,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,oBAAoB,GAAG,IAAI,CAyG7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,GAAG,IAAI,CAOnG"}
+{"version":3,"file":"intelligenceProviderFactory.d.ts","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6DAA6D,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,4EAA4E;QAC5E,WAAW,EAAE,eAAe,CAAC;QAC7B,gEAAgE;QAChE,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;QAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;QAChD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;KACrD,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,oBAAoB,GAAG,IAAI,CA0G7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,GAAG,IAAI,CAOnG"}

package/dist/core/intelligenceProviderFactory.js

@@ -74,6 +74,7 @@ export function buildIntelligenceProvider(options = {}) {
             return wrapIntelligenceWithCircuitBreaker(new CodexCliIntelligenceProvider({
                 codexPath: path,
                 ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),
+                ...(options.resolveExecJson ? { resolveExecJson: options.resolveExecJson } : {}),
             }), options.breaker);
         }
         case 'gemini-cli': {

package/dist/core/intelligenceProviderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"intelligenceProviderFactory.js","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,2BAA2B,GAI5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAgF/F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IAErD,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,qEAAqE;YACrE,4DAA4D;YAC5D,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,2BAA2B,CAAC;oBAC7C,QAAQ;oBACR,IAAI,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC,WAAW,CAAC;oBAC7D,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,aAAa,EAAE,EAAE,CAAC,aAAa;oBAC/B,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS;wBACvC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;gBACH,OAAO,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,4BAA4B,CAAC;gBAC/B,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,6BAA6B,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,sEAAsE;YACtE,qDAAqD;YACrD,6CAA6C;YAC7C,oDAAoD;YACpD,kEAAkE;YAClE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV,8FAA8F;oBAC9F,qGAAqG,CACtG,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,kCAAkC,CACvC,IAAI,yBAAyB,CAAC;oBAC5B,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;wBACjD,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,yBAAyB,EAAE;wBAChE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,WAAW,GAAU,SAAS,CAAC;YACrC,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACpE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"intelligenceProviderFactory.js","sourceRoot":"","sources":["../../src/core/intelligenceProviderFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,2BAA2B,GAI5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAwF/F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IAErD,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,qEAAqE;YACrE,4DAA4D;YAC5D,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,2BAA2B,CAAC;oBAC7C,QAAQ;oBACR,IAAI,EAAE,IAAI,mCAAmC,CAAC,EAAE,CAAC,WAAW,CAAC;oBAC7D,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,aAAa,EAAE,EAAE,CAAC,aAAa;oBAC/B,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS;wBACvC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;gBACH,OAAO,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,4BAA4B,CAAC;gBAC/B,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,kCAAkC,CACvC,IAAI,6BAA6B,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,sEAAsE;YACtE,qDAAqD;YACrD,6CAA6C;YAC7C,oDAAoD;YACpD,kEAAkE;YAClE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV,8FAA8F;oBAC9F,qGAAqG,CACtG,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,kCAAkC,CACvC,IAAI,yBAAyB,CAAC;oBAC5B,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;wBACjD,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,yBAAyB,EAAE;wBAChE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC,EACF,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,0DAA0D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,WAAW,GAAU,SAAS,CAAC;YACrC,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACpE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC/D,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/raw-file-path.d.ts

@@ -0,0 +1,33 @@
+/**
+ * raw-file-path — deterministic detector for literal filesystem paths in
+ * user-facing messages.
+ *
+ * Sibling of `localhost-link.ts`, held to the same linear-regex discipline —
+ * but unlike the localhost guard this is a pure SIGNAL, never a block
+ * (spec: docs/specs/outbound-jargon-filepath-gap.md §2.3). A literal repo
+ * path shown to a user ("/Users/justin/...", ".instar/config.json",
+ * "src/core/Foo.ts") is something the user usually can't act on; the
+ * existing B2_FILE_PATH judgment belongs to the LLM authority, and on
+ * automated sends the preflight advisory informs the SENDER. This detector
+ * only surfaces the observation.
+ *
+ * Hard requirements (r2 convergence):
+ * - ReDoS-safe: linear, non-backtracking patterns; bounded segment count
+ *   and length; an indexOf prescreen so the regex only runs when a path is
+ *   plausibly present.
+ * - Never matches inside an `http(s)://` URL — URLs containing paths are
+ *   the legitimate form to preserve.
+ * - Bounded match echo: the returned match is the regex token (whose char
+ *   class already stops at whitespace/quote/`?`/`#`/`)`), truncated to
+ *   120 chars, so a secret adjacent to a path can never ride into
+ *   logs/advisories/transcripts.
+ * - Callers wrap every call fail-OPEN: a throw skips the signal, never
+ *   withholds a message and never 500s a route.
+ */
+export interface RawFilePathResult {
+    detected: boolean;
+    /** First offending path, bounded to 120 chars — safe to echo in advisories/audits. */
+    match?: string;
+}
+export declare function detectRawFilePath(text: string): RawFilePathResult;
+//# sourceMappingURL=raw-file-path.d.ts.map

package/dist/core/raw-file-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-file-path.d.ts","sourceRoot":"","sources":["../../src/core/raw-file-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAmCH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2BD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAsBjE"}

package/dist/core/raw-file-path.js

@@ -0,0 +1,105 @@
+/**
+ * raw-file-path — deterministic detector for literal filesystem paths in
+ * user-facing messages.
+ *
+ * Sibling of `localhost-link.ts`, held to the same linear-regex discipline —
+ * but unlike the localhost guard this is a pure SIGNAL, never a block
+ * (spec: docs/specs/outbound-jargon-filepath-gap.md §2.3). A literal repo
+ * path shown to a user ("/Users/justin/...", ".instar/config.json",
+ * "src/core/Foo.ts") is something the user usually can't act on; the
+ * existing B2_FILE_PATH judgment belongs to the LLM authority, and on
+ * automated sends the preflight advisory informs the SENDER. This detector
+ * only surfaces the observation.
+ *
+ * Hard requirements (r2 convergence):
+ * - ReDoS-safe: linear, non-backtracking patterns; bounded segment count
+ *   and length; an indexOf prescreen so the regex only runs when a path is
+ *   plausibly present.
+ * - Never matches inside an `http(s)://` URL — URLs containing paths are
+ *   the legitimate form to preserve.
+ * - Bounded match echo: the returned match is the regex token (whose char
+ *   class already stops at whitespace/quote/`?`/`#`/`)`), truncated to
+ *   120 chars, so a secret adjacent to a path can never ride into
+ *   logs/advisories/transcripts.
+ * - Callers wrap every call fail-OPEN: a throw skips the signal, never
+ *   withholds a message and never 500s a route.
+ */
+/** Truncation cap for the echoed match (privacy bound on adjacent content). */
+const MATCH_ECHO_MAX = 120;
+/** Defensive input cap — callers already cap analyzed text (64KB at the
+ * preflight route); this keeps the detector itself bounded regardless. */
+const INPUT_MAX = 64 * 1024;
+/**
+ * Path-segment char class: stops at whitespace, quotes, `?`, `#`, `)`,
+ * backticks and other prose punctuation by construction. Bounded segment
+ * length (1–64) and bounded segment count keep the scan linear.
+ *
+ * Three alternatives, all anchored on a real separator so prose like
+ * "and/or" or "TCP/IP" cannot match:
+ *  A) absolute or home paths with at least two segments:  /Users/justin/x, ~/.config/foo
+ *  B) dot-directory relative paths:                       .instar/config.json, .claude/hooks/x
+ *  C) repo-relative paths under well-known dirs:          src/core/Foo.ts, logs/server.log
+ */
+const SEG = '[A-Za-z0-9._-]{1,64}';
+const RAW_FILE_PATH_RE = new RegExp(
+// A: "/seg/seg..." or "~/seg/seg..." (>= 2 segments so "/tmp" alone or a
+//    lone slash in prose stays legal)
+`(?:(?:~)?/${SEG}(?:/${SEG}){1,12}` +
+    // B: ".instar/...", ".claude/...", ".github/...", ".husky/..." (single
+    //    segment after the dot-dir is enough — ".instar/config.json")
+    `|\\.(?:instar|claude|github|husky|vscode|config)/${SEG}(?:/${SEG}){0,12}` +
+    // C: repo-relative under well-known top-level dirs; require the word
+    //    boundary via a non-path char or string start (handled in code, not
+    //    lookbehind, to keep the pattern simple and linear)
+    `|(?:src|docs|tests|scripts|logs|state|upgrades|dist|node_modules)/${SEG}(?:/${SEG}){0,12})`, 'g');
+/**
+ * True when `index` sits inside a scheme-bearing URL token: the
+ * whitespace-delimited token containing the match start carries "://"
+ * before the match. Linear scan-back, bounded by the token itself.
+ */
+function insideUrl(text, index) {
+    let start = index;
+    while (start > 0 && !/\s/.test(text[start - 1]))
+        start--;
+    const prefix = text.slice(start, index);
+    // `://` fully before the match, OR the match starts at the second slash of
+    // a scheme separator (prefix ends with `:/` — e.g. match begins at
+    // "/example.com/…" inside "https://example.com/…").
+    return prefix.includes('://') || /:\/$/.test(prefix);
+}
+/**
+ * For alternative C (bare repo-relative prefixes like "src/"), require a
+ * word boundary on the left so "missrc/foo" or "RandomLogs/x" can't match.
+ * Alternatives A/B self-anchor on '/', '~' or '.'.
+ */
+function hasWordBoundaryLeft(text, index) {
+    if (index === 0)
+        return true;
+    return !/[A-Za-z0-9._\-/]/.test(text[index - 1]);
+}
+export function detectRawFilePath(text) {
+    if (typeof text !== 'string' || text.length === 0)
+        return { detected: false };
+    const input = text.length > INPUT_MAX ? text.slice(0, INPUT_MAX) : text;
+    // indexOf prescreen — the regex only runs when a path separator exists.
+    if (!input.includes('/'))
+        return { detected: false };
+    RAW_FILE_PATH_RE.lastIndex = 0;
+    let m;
+    while ((m = RAW_FILE_PATH_RE.exec(input)) !== null) {
+        const token = m[0];
+        const at = m.index;
+        // Never flag a path that lives inside an http(s):// URL.
+        if (insideUrl(input, at))
+            continue;
+        // Bare repo-relative alternative needs a real word boundary.
+        const firstChar = token[0];
+        if (firstChar !== '/' && firstChar !== '~' && firstChar !== '.') {
+            if (!hasWordBoundaryLeft(input, at))
+                continue;
+        }
+        return { detected: true, match: token.slice(0, MATCH_ECHO_MAX) };
+    }
+    return { detected: false };
+}
+//# sourceMappingURL=raw-file-path.js.map

package/dist/core/raw-file-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-file-path.js","sourceRoot":"","sources":["../../src/core/raw-file-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,+EAA+E;AAC/E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;0EAC0E;AAC1E,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,GAAG,GAAG,sBAAsB,CAAC;AACnC,MAAM,gBAAgB,GAAG,IAAI,MAAM;AACjC,yEAAyE;AACzE,sCAAsC;AACtC,aAAa,GAAG,OAAO,GAAG,SAAS;IACjC,uEAAuE;IACvE,kEAAkE;IAClE,oDAAoD,GAAG,OAAO,GAAG,SAAS;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,qEAAqE,GAAG,OAAO,GAAG,UAAU,EAC9F,GAAG,CACJ,CAAC;AAQF;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAE,KAAK,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,2EAA2E;IAC3E,mEAAmE;IACnE,oDAAoD;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAErD,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;QACnB,yDAAyD;QACzD,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAAE,SAAS;QACnC,6DAA6D;QAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAChE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC;gBAAE,SAAS;QAChD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/core/types.d.ts

@@ -798,27 +798,35 @@ export interface IntelligenceOptions {
     };
     /**
      * Optional token-usage callback (Iris-audit item 1, spec
-     * iris-audit-session-observability.md). When the underlying provider can
-     * surface usage — e.g. ClaudeCliIntelligenceProvider parsing `claude -p
-     * --output-format json` — it invokes this exactly once per successful call
-     * with the token counts. ADDITIVE and OPTIONAL: evaluate() still returns
+     * iris-audit-session-observability.md; contract widened by
+     * token-audit-completeness). When the underlying provider can surface
+     * usage — e.g. ClaudeCliIntelligenceProvider parsing `claude -p
+     * --output-format json`, or CodexCliIntelligenceProvider parsing the
+     * `codex exec --json` event stream — it invokes this EXACTLY ONCE PER CALL
+     * WHENEVER USAGE WAS PARSED, INCLUDING CALLS THAT SUBSEQUENTLY REJECT
+     * (a timeout-killed call's already-burned tokens must still reach the
+     * ledger's error row — under-reporting failed-call cost is the inversion
+     * of auditability). `cachedTokens` is an informational SUBSET of
+     * `inputTokens` (cache-read tokens; fresh cost = inputTokens −
+     * cachedTokens). ADDITIVE and OPTIONAL: evaluate() still returns
      * Promise<string>, so every existing caller is byte-identical. The wrapper
      * CircuitBreakingIntelligenceProvider sets it to feed per-feature token
-     * counts into the metrics ledger (/metrics/features), which previously always
-     * reported 0 because no usage ever reached the tap.
+     * counts into the metrics ledger (/metrics/features).
      */
     onUsage?: (usage: {
         inputTokens: number;
         outputTokens: number;
+        cachedTokens?: number;
     }) => void;
     /**
      * Observable Intelligence standard (docs/specs/observable-intelligence.md):
      * surface the resolved provider/model so the per-feature metrics funnel can
      * record WHICH provider + model actually ran on this call. Distinct from
      * onUsage on purpose — onUsage only fires when a provider can parse token
-     * counts (Claude can; codex/gemini/pi cannot), so tying model to it would
-     * leave the exact providers we most need to audit unlabeled. Every provider
-     * invokes onModel once per call regardless of whether it can report tokens.
+     * counts (claude, codex in exec-json mode, and pi can; gemini and the
+     * interactive pool cannot), so tying model to it would leave the providers
+     * we most need to audit unlabeled. Every provider invokes onModel once per
+     * call regardless of whether it can report tokens.
      * ADDITIVE + OPTIONAL: evaluate() still returns Promise<string>; existing
      * callers are byte-identical. The wrapper CircuitBreakingIntelligenceProvider
      * sets it to feed model/framework into the metrics ledger.