/**
 * How an agent that cannot run with a read-only config home is pointed at a
 * relocated, per-launch writable home instead. The safehouse launch stages a
 * temp dir, seeds it with the minimal files the agent needs to authenticate +
 * keep its config, exports `configDirEnv` to that dir, and grants it write.
 * Credential files that Codex refreshes are copied back by the host after the
 * agent exits, without granting the sandbox the whole real home.
 *
 * Empirically validated on macOS: codex hard-fails to launch
 * with a read-only `~/.codex` ("failed to initialize in-process app-server
 * client") and authenticates from a file (`auth.json`), so relocating
 * `CODEX_HOME` + seeding `auth.json`/`config.toml` both unblocks it and closes
 * persistence.
 */
export interface AgentConfigRelocation {
    /** Env var that points the agent at a relocated config home. */
    configDirEnv: string;
    /** Home-relative dir the seed files come from (the agent's real home). */
    sourceHomeRelativeDir: string;
    /** Files (relative to `sourceHomeRelativeDir`) seeded into the relocated home. */
    seedFiles: readonly string[];
    /** Seed files whose writes must persist back to the source store. */
    persistedFiles: readonly string[];
}
/**
 * Return the config-relocation spec for an agent, or `undefined` when the
 * agent has no registered relocation (claude, unknown agents) — the caller
 * then runs that agent against its real home.
 */
export declare function agentConfigRelocation(agent: string): AgentConfigRelocation | undefined;
export interface StagedAgentConfigHome {
    /** The relocated, writable config/state home staged for this launch. */
    configDir: string;
    /** Env var (e.g. `CODEX_HOME`) that points the agent at `configDir`. */
    configDirEnv: {
        name: string;
        value: string;
    };
    /** Files the host copies back after the sandboxed agent exits. */
    writeBackFiles: readonly StagedAgentConfigWriteBack[];
}
interface StagedAgentConfigWriteBack {
    baselinePath: string;
    sourcePath: string;
    stagedPath: string;
}
/**
 * Stage + seed a relocated, writable config home for an agent that cannot run
 * with a read-only config home (codex's `CODEX_HOME`) under the safehouse
 * runner. `parentDir` must already exist (the caller stages it inside a
 * dedicated per-launch temp dir); the config home itself is created here.
 */
export declare function stageRelocatedAgentConfigHome(input: {
    agent: string;
    relocation: AgentConfigRelocation;
    parentDir: string;
    sourceConfigDir: string;
}): StagedAgentConfigHome;
export {};
//# sourceMappingURL=codexConfigRelocation.d.ts.map