/**
 * Workspace trust — the per-machine record of which working directories the user
 * has agreed to run repository-supplied plugin code from.
 *
 * The problem it solves (docs/plugin-system-architecture.md §5.9): a plugin
 * committed to a repository is code that runs for whoever clones it next. Its
 * skills and commands are text the model reads, which is no worse than reading
 * the repository itself, but its **hooks and MCP servers are processes** that
 * start on session load. Nothing about a plugin's location can distinguish "I
 * installed this here" from "this arrived in the clone", because everything in
 * the repository travels with it — including any marker a plugin might carry to
 * claim otherwise.
 *
 * So the record lives **outside the repository**, in the agent dir, keyed by
 * absolute path. That is the whole design: trust cannot be forged by repository
 * content, because repository content cannot write here. It is the same shape
 * Claude Code's workspace trust dialog and VS Code's trusted folders use, and it
 * carries the same known consequence — once a directory is trusted, code pulled
 * into it later is trusted too. Trust is a statement about a *place you work*,
 * not about a specific commit.
 *
 * Granting is a human act (`/plugin trust`, or an explicit `/plugin install
 * --scope project`, where the person is demonstrably operating in the directory
 * on purpose). The autonomous install path never grants it: a model deciding
 * that a workspace should execute repository code is exactly the decision this
 * record exists to keep with a person.
 */
/** One trusted working directory. */
export interface TrustedWorkspace {
    /** Absolute, resolved path. */
    path: string;
    /** When trust was granted, ISO-8601. Informational — nothing expires today. */
    at: string;
}
/**
 * `~/.agents/trusted-workspaces.json`.
 *
 * Beside the marketplace registry rather than inside the repo, for the reason in
 * the module docstring: a file the repository can write is not a trust record.
 */
export declare function trustStorePath(agentDir?: string): string;
/** Every trusted workspace, newest grant first. */
export declare function listTrustedWorkspaces(agentDir?: string): TrustedWorkspace[];
/**
 * Whether `cwd` is trusted.
 *
 * Exact-path only, deliberately: trusting `~/src` must not silently trust every
 * repository ever cloned beneath it, which is what a prefix match would do the
 * first time someone trusts a directory one level too high.
 */
export declare function isWorkspaceTrusted(cwd: string, agentDir?: string): boolean;
/** Grant trust to `cwd`. Idempotent — re-granting refreshes the timestamp. */
export declare function trustWorkspace(cwd: string, agentDir?: string): TrustedWorkspace;
/** Revoke trust for `cwd`. Returns false when it was not trusted to begin with. */
export declare function untrustWorkspace(cwd: string, agentDir?: string): boolean;
/**
 * Whether `target` sits under any of `projectScopeRoots`, and therefore came with
 * the repository as far as anyone but its installer can tell.
 *
 * Callers supply their own roots because each capability has its own project-scope
 * homes — plugins live in `.claude/skills` and `.agents/plugins`, canvas extensions
 * in `.agents/extensions` and `.github/extensions`. What does not vary is the
 * reasoning: no location can distinguish "I put this here" from "this arrived in
 * the clone", so location only decides *whether* to ask about trust. It never
 * answers the question.
 */
export declare function isRepositorySupplied(target: string, projectScopeRoots: string[]): boolean;
/**
 * Whether repository-supplied code at `target` must be withheld: it lives in the
 * working tree and this machine has not trusted the workspace.
 *
 * What "withheld" means is the caller's to decide, and it differs by capability. A
 * plugin keeps its passive capabilities and loses only its processes; a canvas has
 * no passive half, so it is withheld whole.
 */
export declare function shouldWithholdRepositorySupplied(target: string, cwd: string, projectScopeRoots: string[], agentDir?: string): boolean;
//# sourceMappingURL=trust.d.ts.map