import type { RepoStack } from "../profile/scan.js";
/**
 * Deterministic blueprint values for the `sandbox` capability. Kept in a sibling
 * module so `index.ts` stays thin and the golden values (image, features,
 * allowlist, worktree paths) have a single source of truth that tests assert
 * against. No dates, no random ordering — stable across runs.
 */
/**
 * Base image for the generated devcontainer. Pinned to a concrete dated tag (not
 * the floating `:ubuntu`) so rebuilds are reproducible; bump deliberately. A
 * `@sha256:` digest pin is the stronger, higher-maintenance option — tracked as a
 * Part-2 decision.
 */
export declare const DEVCONTAINER_IMAGE = "mcr.microsoft.com/devcontainers/base:ubuntu-24.04";
/** Egress allowlist baked into the managed sandbox settings. */
export declare const SANDBOX_ALLOWED_DOMAINS: readonly ["github.com", "pypi.org", "registry.npmjs.org"];
/** Where worktree-isolated checkouts live, relative to the repo root. */
export declare const WORKTREE_DIR = ".claude/worktrees";
/**
 * Human guidance on git-worktree isolation and how container edits reach the
 * host. Emitted as a `doc` action (never executed): the harness does not create
 * worktrees or run containers on your behalf — it tells you the exact commands.
 */
export declare function worktreeGuidance(): string;
export interface DevcontainerOptions {
    /** Canonical context directory name (surfaced as a VS Code search exclude). */
    contextDir: string;
    /** Detected repo stack — drives which toolchain features get installed. */
    stack: RepoStack;
}
/**
 * A sandbox-oriented devcontainer tailored to the DETECTED stack: a pinned Ubuntu
 * base plus the features the repo actually needs (Node when it's a Node project,
 * AWS CLI when it targets AWS, Python when it's Python), and a `postCreateCommand`
 * that installs dependencies (`npm install`, etc.) — not a no-op version check.
 * The container is the blast radius; edits project back over the bind-mounted
 * workspace.
 */
export declare function devcontainerConfig(opts: DevcontainerOptions): Record<string, unknown>;
/**
 * The Claude-managed sandbox policy: fail closed, refuse unsandboxed commands,
 * and constrain egress to the registries the toolchain needs — plus the detected
 * cloud's API domain (e.g. `*.amazonaws.com`) so legitimate SDK calls aren't
 * blocked. The command-policy lexicon (deny/ask/safe) is spread in as
 * `commandPolicy` so the exec policy ships alongside the egress allowlist in the
 * one managed-settings file. Deep-merged onto any pre-existing
 * `.claude/managed-settings.json`.
 */
export declare function managedSandboxSettings(stack?: RepoStack): Record<string, unknown>;