/**
 * CodexCliIntelligenceProvider — IntelligenceProvider using the OpenAI Codex CLI.
 *
 * Sibling of ClaudeCliIntelligenceProvider. Routes judgment calls through
 * `codex exec` for non-Claude installs. Same fast/balanced/capable tier
 * mapping the Codex adapter uses for first-class calls; same timeout
 * semantics; same fail-loudly behavior so callers can fall back.
 *
 * Provider-portability v1.0.0: this is the second IntelligenceProvider
 * implementation. Reviewers, sentinels, canaries, and JobReflector now
 * have a non-Claude path. The composition root picks the right
 * implementation based on the agent's configured framework.
 *
 * token-audit-completeness: by default calls run as `codex exec --json`
 * (streaming event parse → per-call token usage via onUsage; result read
 * ONLY from the --output-last-message file). The kill-switch
 * `intelligence.codexExecJson: false` (or env `INSTAR_CODEX_EXEC_JSON=0`)
 * restores the previous plain-output invocation byte-for-byte.
 */
import type { IntelligenceProvider, IntelligenceOptions } from './types.js';
/**
 * Build the per-call kill-switch resolver for construction sites that have a
 * project dir. Pinned closure body (spec): a TTL-cached (30 s) raw
 * `readFileSync` + `JSON.parse` of `.instar/config.json` reading ONLY
 * `intelligence.codexExecJson` — never `loadConfig()` (which drags a
 * synchronous SecretStore keychain execFileSync onto every judgment call),
 * and never a boot-time closure over the in-memory config object (no config
 * hot-reload exists, so it would never see a disk flip).
 *
 * Resolution order: the config key wins when the file parses AND the key is
 * present; otherwise — including parse/read failure — fall through to the
 * env lever (itself default-on). An operator hand-editing config under
 * pressure who leaves a JSON slip gets a once-per-process parse-failure
 * warning and a still-working env lever, not a silently-ignored kill-switch.
 * A config flip applies within 30 s, no restart.
 */
export declare function createCodexExecJsonConfigResolver(configPath?: string, ttlMs?: number): () => boolean;
/** Test-only seam. */
export declare function _resetUsageDriftEmissionForTest(): void;
export interface CodexCliIntelligenceProviderOptions {
    /** Absolute path to the `codex` CLI binary. */
    codexPath: string;
    /**
     * Optional sandbox mode. Defaults to `read-only` — judgment calls
     * should never need to write to disk; if they do, the caller has a
     * design problem, not a sandbox problem.
     */
    sandboxMode?: 'read-only' | 'workspace-write' | 'danger-full-access';
    /**
     * Retained for API compatibility. NOTE: this is intentionally NOT used as
     * the `codex exec --cd` for judgment calls. Those always run in an empty
     * instar-managed scratch dir (see `resolveIntelligenceScratchDir`) so the
     * agent's project identity + hooks never load. These calls don't depend on
     * cwd content, so ignoring this value is safe.
     */
    workingDirectory?: string;
    /**
     * Per-call kill-switch read for exec-json mode (token-audit-completeness).
     * The IntelligenceRouter caches built providers, so a PER-CALL closure read
     * is what survives that caching. Construction sites with config thread
     * `createCodexExecJsonConfigResolver()`; absent the closure, the provider
     * resolves env `INSTAR_CODEX_EXEC_JSON !== '0'` so config-less sites keep a
     * working rollback lever.
     */
    resolveExecJson?: () => boolean;
}
export declare class CodexCliIntelligenceProvider implements IntelligenceProvider {
    private readonly codexPath;
    private readonly sandboxMode;
    private readonly resolveExecJson;
    constructor(options: CodexCliIntelligenceProviderOptions);
    /** Hygiene args shared by BOTH modes (clean-call spec; pinned by the
     * both-modes unit test). */
    private hygieneArgs;
    evaluate(prompt: string, options?: IntelligenceOptions): Promise<string>;
    /**
     * Kill-switch path — the pre-exec-json invocation, byte-for-byte (result
     * semantics included: stdout.trim(), empty answer resolves '').
     *
     * SECURITY NOTE (disclosed tradeoff, not a regression): this legacy path
     * passes the prompt as a positional argv element (ps-visible to local
     * users) and execFile's error.message embeds the full command line —
     * including the prompt — into thrown Errors. The exec-json path fixes
     * both (prompt via stdin; errors carry only a bounded stderr tail).
     * Flipping the kill-switch therefore re-opens this pre-existing
     * prompt-disclosure channel in addition to going token-blind.
     */
    private evaluatePlain;
    /**
     * Default path — `codex exec --json` with streaming usage parse. The
     * result is read from the --output-last-message file, AND ONLY from there
     * (stdout events never become the result: injection surface; Signal vs
     * Authority — events are observability signal, the file is the authority).
     */
    private evaluateExecJson;
}
//# sourceMappingURL=CodexCliIntelligenceProvider.d.ts.map