import type { ShellResolution } from "./shell.js";
export interface SandboxPolicy {
    /**
     * `workspace` always isolates and fails closed. `auto` isolates wherever the
     * OS supports it and degrades with a warning where the prerequisites are
     * absent, because SRT needs bubblewrap/socat on Linux and an elevated
     * `windows-install` on Windows — enforcing there would break every command.
     */
    mode: "auto" | "workspace" | "off";
    /**
     * Extra hosts reachable while sandboxed, on top of
     * {@link DEFAULT_ALLOWED_DOMAINS} unless {@link strictDomains} is set.
     */
    allowedDomains: string[];
    /**
     * Use only {@link allowedDomains}, dropping the built-in developer defaults.
     * Set when the user has explicitly taken over network policy.
     */
    strictDomains?: boolean;
    /** Extra workspace roots (multi-root sessions), mirroring the write guard. */
    additionalRoots?: string[];
    /** The user consented to writes outside the workspace; do not contradict them. */
    allowOutsideWorkspaceWrites?: boolean;
    /**
     * Unix socket paths sandboxed commands may open, e.g.
     * `/var/run/docker.sock`. Empty by default — each entry is a hole straight
     * through the sandbox (see {@link buildSandboxSettings}).
     */
    allowUnixSockets?: string[];
}
export interface SandboxLaunch extends ShellResolution {
    sandboxed: boolean;
}
/**
 * Environment applied only to sandboxed commands.
 *
 * The sandbox permanently protects `.git/hooks`, and git's only reason to write
 * there is copying inert `*.sample` templates during `init`/`clone` — which
 * fails the whole command. Pointing git at an empty template directory removes
 * that write, so cloning works with hook protection fully intact.
 */
export declare const SANDBOX_ENV_PATCH: Readonly<Record<string, string>>;
interface SandboxSettings {
    network: {
        allowedDomains: string[];
        deniedDomains: string[];
        strictAllowlist: boolean;
        allowUnixSockets: string[];
        allowLocalBinding: boolean;
    };
    /**
     * macOS only: let sandboxed processes reach `com.apple.trustd.agent`.
     *
     * Without it, every client that verifies certificates through Security
     * framework fails — pip (truststore) and Go-based CLIs like gh, terraform
     * and kubectl. We do not terminate TLS, so certificates are still validated
     * against the real upstream and the domain allowlist still applies; this only
     * restores certificate checking itself.
     */
    enableWeakerNetworkIsolation?: boolean;
    filesystem: {
        denyRead: string[];
        allowWrite: string[];
        denyWrite: string[];
        /** Git cannot initialise or clone a repository without writing its config. */
        allowGitConfig: boolean;
    };
}
export interface SandboxSupport {
    supported: boolean;
    reason: string;
    /** Isolation started but is missing a control we promised; null when intact. */
    degraded?: string | null;
}
/** Pure policy builder, exported so the security boundary is regression-tested. */
export declare function buildSandboxSettings(cwd: string, policy: SandboxPolicy, platform?: NodeJS.Platform): SandboxSettings;
export declare function resetSandboxSupportProbeForTests(seed?: SandboxSupport): void;
/**
 * Known limitations when `sandboxMode` is enabled (upstream, not fixable here):
 *
 * - **Linux pipes/redirections**: `echo hi | grep hi` fails with "Permission
 *   denied" on /proc/self/fd/3 because bash's pipe setup clobbers the fd the
 *   seccomp filter arrives on (sandbox-runtime#261).
 * - **git over SSH**: `git@host:` remotes fail the SOCKS handshake on macOS —
 *   the injected ProxyCommand uses `nc`, which cannot authenticate. HTTPS
 *   remotes work. `~/.ssh` is also unreadable by design.
 * - **`git config --global`**: `~/.gitconfig` is a mandatory upstream write
 *   protection with no opt-out. Repo-local `git config` works.
 * - **Corporate TLS interception / private registries**: need the CA and
 *   registry host configured explicitly.
 * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
 *   degrades to no isolation (sandbox-runtime#428, #429).
 * - **Loopback egress is unfiltered**: sandboxed commands can reach any local
 *   TCP port, because upstream ties that to port binding and dev servers need
 *   to bind. A service listening on localhost without authentication is
 *   reachable from sandboxed bash.
 *
 * These are why the default is `off`; revisit when fixed upstream.
 */
/**
 * Wrap an already-resolved shell with Anthropic's cross-platform OS sandbox.
 * Initialization and dependency failures remain visible and fail closed: the
 * original command is never spawned outside the sandbox as an implicit fallback.
 */
export declare function prepareSandboxLaunch(shell: ShellResolution, cwd: string, policy: SandboxPolicy): Promise<SandboxLaunch>;
export {};
//# sourceMappingURL=sandbox.d.ts.map