import { SecurityLevel } from './config';
export interface SecurityConfig {
    enableSandbox: boolean;
    enableInputValidation: boolean;
    enableAuditLog: boolean;
    enableScreenshotEncryption: boolean;
    defaultRiskThreshold: 'low' | 'medium' | 'high' | 'critical';
    sandboxTimeout: number;
    maxExecutionTime: number;
}
export interface SecureExecutionContext {
    command: string;
    args?: any;
    sourceIP?: string;
    userAgent?: string;
    /**
     * Coarse classification of the request, used by the security pipeline to
     * decide whether sandboxing applies and how to label audit log entries.
     *
     * - `command`: invoke a named UI command (click/fill/hover) — args are JSON,
     *   not raw JS. The actual JavaScript is generated by command modules.
     * - `query`: read-only DOM/state query (`get_title`, `get_url`, `find_elements`).
     *   Low risk; bypasses sandbox.
     * - `eval`: arbitrary JavaScript supplied by caller (`electron_eval`).
     *   High risk; subject to `validateEvalContent` and security profile gates.
     * - `screenshot` / `logs` / `window_info`: I/O against the running app.
     */
    operationType: 'command' | 'query' | 'eval' | 'screenshot' | 'logs' | 'window_info';
}
export interface SecureExecutionResult {
    success: boolean;
    result?: any;
    error?: string;
    executionTime: number;
    riskLevel: 'low' | 'medium' | 'high' | 'critical';
    blocked: boolean;
    sessionId: string;
}
export declare class SecurityManager {
    private config;
    private sandbox;
    private securityLevel;
    private sandboxCache;
    constructor(config?: Partial<SecurityConfig>, securityLevel?: SecurityLevel);
    setSecurityLevel(level: SecurityLevel): void;
    getSecurityLevel(): SecurityLevel;
    executeSecurely(context: SecureExecutionContext): Promise<SecureExecutionResult>;
    updateConfig(newConfig: Partial<SecurityConfig>): void;
    getConfig(): SecurityConfig;
    private createBlockedResult;
    private logSecurityEvent;
    /**
     * Determines if a command should be executed in a sandbox
     * @param command The command to check
     * @returns true if the command should be sandboxed
     */
    shouldSandboxCommand(command: string): boolean;
    /**
     * Internal method to determine if a command should be sandboxed
     */
    private _shouldSandboxCommand;
    /**
     * Checks if a command is a simple command name (not JavaScript code)
     * @param command The command to check
     * @returns true if it's a simple command name
     */
    private isSimpleCommandName;
}
export declare const securityManager: SecurityManager;