/**
 * 每 run 隔离工作区（spec §4）：
 *
 * ```
 * <daemonHome>/workspaces/<agent_run_id>/
 *   work/               # runtime 的 cwd，文件候选只从这里扫描
 *   transcript.jsonl
 * ```
 *
 * agent_run_id 来自服务端，但用作本地路径段前必须过白名单校验，防路径注入。
 */
export declare const SAFE_ID_PATTERN: RegExp;
export declare function assertSafeId(value: string, field: string): void;
export declare function workspacesRoot(): string;
export declare function runRootDir(agentRunId: string): string;
/** runtime 的 cwd。 */
export declare function runWorkspaceDir(agentRunId: string): string;
export declare function transcriptPath(agentRunId: string): string;
export declare function runtimeSessionRootDir(runtimeSessionId: string, sandboxGeneration: number): string;
/**
 * durable workspace：managed sandbox 使用稳定路径
 * `<root>/sessions/<workspace_id>/workspace`。该路径不含 generation，
 * 因为 NAS image 跨 generation 重新挂载后必须解析到同一个目录。
 */
export declare function runtimeSessionWorkspaceDir(workspaceId: string, sandboxGeneration: number): string;
export declare function runtimeSessionTranscriptPath(runtimeSessionId: string, sandboxGeneration: number, agentRunId: string): string;
export declare function ensureRunWorkspace(agentRunId: string): {
    rootDir: string;
    workspaceDir: string;
};
/**
 * session.open 时创建 per-session 目录。managed workspace 默认保持 0700，只有当前
 * activation 会通过 exposeRuntimeSessionWorkspace() 临时开放给 runtime 组。
 */
export declare function ensureRuntimeSessionDirectories(runtimeSessionId: string, sandboxGeneration: number, workspaceId?: string): {
    rootDir: string;
    workspaceDir: string;
};
/**
 * 暴露当前 activation 的 managed workspace。sandbox 根目录由 supervisor 设为
 * 0710，因此 runtime 只能穿过根目录，不能列举其他 session id；未激活 session
 * 的父目录与 workspace 始终为 0700。
 */
export declare function exposeRuntimeSessionWorkspace(runtimeSessionId: string, sandboxGeneration: number, workspaceId?: string): void;
/** Revoke a managed workspace without deleting the session's durable local materialization. */
export declare function revokeRuntimeSessionWorkspace(runtimeSessionId: string, sandboxGeneration: number, workspaceId?: string): void;
/** session.close 时删除本地 Session 状态；Workspace 由独立生命周期拥有。 */
export declare function removeRuntimeSessionWorkspace(runtimeSessionId: string, sandboxGeneration: number, preserveManagedWorkspace?: boolean, workspaceId?: string): void;
export declare function ensureRuntimeSessionWorkspace(runtimeSessionId: string, sandboxGeneration: number, agentRunId: string, workspaceId?: string): {
    rootDir: string;
    workspaceDir: string;
    transcriptFile: string;
};