/**
 * G3 — behavioral smoke for a plugin's executable capabilities.
 *
 * G1 and G2 read files. G3 is the first gate that finds out whether the thing
 * actually runs, which is the most common real failure: a plugin that installs
 * cleanly and breaks the session at the next tool call.
 *
 * **What this is and is not.** Hooks run with `cwd`, `HOME`, `TMPDIR` and the
 * plugin data dir redirected into a throwaway directory, and with a hard
 * timeout. That reduces blast radius; it is *not* containment. Without OS-level
 * sandboxing a shell command can still write wherever it likes, and claiming
 * otherwise in a confirmation prompt would be worse than saying nothing — the
 * whole point of showing gate results to a human is that they are true.
 *
 * **Why it runs before the human confirms.** It does execute not-yet-approved
 * code, which is a real cost. Against it: the code was authored in this session
 * from the user's own request rather than fetched from anywhere, G2 has already
 * screened it for destructive shapes, and absent the smoke test the very same
 * command runs moments later anyway — unscreened, unredirected, and in the real
 * working directory. Running it once under redirection to find out whether it
 * even works is the smaller risk. G3 is therefore authored-only: it is never
 * applied to a marketplace plugin, where the code is someone else's and
 * executing it pre-consent would not be defensible.
 */
import type { GateFinding } from "./gates.js";
import type { NormalizedPlugin } from "./manifest.js";
export interface SmokeOptions {
    /** Skip the whole gate (no UI to report into, or an explicit opt-out). */
    skip?: boolean;
}
/** Run G3 over a plugin's executable capabilities. Returns findings; empty means nothing to test. */
export declare function runSmokeGate(plugin: NormalizedPlugin, opts?: SmokeOptions): Promise<GateFinding[]>;
//# sourceMappingURL=smoke.d.ts.map