/** Explicit isolated visitor profile. See ADR 0022; never a general shell runner. */
import { type ChildProcess } from 'node:child_process';
import type { StreamSegment } from './gateway.js';
export declare const RESTRICTED_CODEX_VERSION = "codex-cli 0.153.4";
export interface IsolatedVisitor {
    actor: string;
    model: 'gpt-6-astra';
    effort: 'high';
    instructions: string;
    tools: string[];
    service: {
        command: string;
        args: string[];
        cwd: string;
        env?: Record<string, string>;
    };
}
export declare function validateVisitor(value: unknown, actor: string): IsolatedVisitor;
export declare function narrowedCatalog(catalog: {
    models: Array<Record<string, unknown>>;
}): {
    models: {
        shell_type: string;
        apply_patch_tool_type: null;
        experimental_supported_tools: never[];
        tool_mode: null;
        supports_search_tool: boolean;
        multi_agent_version: null;
    }[];
};
export declare function restrictedSettings(featureList: string, catalog: string): Record<string, unknown>;
export declare function settingsArgs(settings: Record<string, unknown>): string[];
/** One ephemeral Codex thread, with the gateway holding the bound MCP connection. */
export declare function runRestrictedVisitor(opts: {
    actor: string;
    visitor: IsolatedVisitor;
    message: string;
    signal?: AbortSignal;
    onSpawn?: (child: ChildProcess) => void;
    onSegment?: (segment: StreamSegment) => void;
    onText?: (text: string) => void;
    binding?: {
        dispatchId: string;
        eventId: number;
        role: string;
        asOf: string;
    };
    testProvider?: {
        baseUrl: string;
    };
}): Promise<{
    response: string;
    interrupted: boolean;
    provenance: Record<string, unknown>;
}>;
//# sourceMappingURL=restricted-codex.d.ts.map