/**
 * The vendor allow rule documented as matching "all files on the system".
 * Claude and Codex agents read anywhere in every access profile; agy instead
 * asks before a read outside its workspace folders, and a headless run cannot
 * answer, so the read is auto-denied and the turn often ends without output.
 * A read grant changes no write confinement: plan mode still withholds edits,
 * accept-edits still asks before an edit outside the workspace, and shell
 * commands keep their own approval. The vendor evaluates Deny > Ask > Allow,
 * so a read_file deny rule in the same file still wins, and
 * `toolPermission: "strict"` prompts before every read even when an allow rule
 * matches.
 */
export declare const AGY_READ_ANYWHERE_RULE = "read_file(*)";
export type AgyReadGrant = {
    state: "present" | "added";
} | {
    state: "unavailable";
    reason: string;
};
/** The readonly capability delta, disclosed in the child's own instructions. */
export declare function agyReadonlyAccessNote(readGrant: AgyReadGrant): string;
/** agy has no settings-path variable: the profile HOME selects this file. */
export declare function agySettingsPath(profileHome: string): string;
/**
 * Ensure the Claudexor-owned profile settings carry the read grant, keeping
 * every other key and rule. The file belongs to the whole profile, so the
 * grant applies to every run on it. Unreadable or unexpected settings are
 * never rewritten: the run proceeds with the vendor's own read policy and the
 * caller discloses the reason.
 */
export declare function ensureAgyReadGrant(profileHome: string): AgyReadGrant;
//# sourceMappingURL=read-grant.d.ts.map