import { CodedError } from "@mono-agent/agent-contracts";
import { type ResolveSrtLaunchOptions } from "./sandbox-managed.js";
export declare const SANDBOX_MODES: readonly ["native", "off"];
export type SandboxMode = (typeof SANDBOX_MODES)[number];
export declare const SANDBOX_NETWORK_MODES: readonly ["none", "localhost", "allowlist", "all"];
export type SandboxNetworkMode = (typeof SANDBOX_NETWORK_MODES)[number];
export declare const SANDBOX_FALLBACKS: readonly ["fail-closed", "unsafe-host-process"];
export type SandboxFallback = (typeof SANDBOX_FALLBACKS)[number];
export type SandboxEngineId = string;
export declare const DEFAULT_DENY_WRITE: readonly [".env", ".env.*", ".git/config", ".git/hooks/**"];
export interface SandboxNetworkPolicyInput {
    readonly mode?: SandboxNetworkMode;
    readonly allowlist?: readonly string[];
}
export interface SandboxPolicyInput {
    readonly mode?: SandboxMode;
    readonly engine?: SandboxEngineId;
    readonly root?: string;
    readonly readableRoots?: readonly string[];
    readonly writableRoots?: readonly string[];
    readonly denyWrite?: readonly string[];
    readonly tempRoot?: string;
    readonly network?: SandboxNetworkPolicyInput;
    readonly fallback?: SandboxFallback;
    readonly unsafeAllowHostProcess?: boolean;
}
export interface SandboxNetworkPolicy {
    readonly mode: SandboxNetworkMode;
    readonly allowlist: readonly string[];
}
export interface SandboxPolicy {
    readonly mode: SandboxMode;
    readonly engine: SandboxEngineId;
    readonly root: string;
    readonly readableRoots: readonly string[];
    readonly writableRoots: readonly string[];
    /** Host-internal canonical roots that model tools must never read or mutate. */
    readonly protectedRoots?: readonly string[];
    readonly denyWrite: readonly string[];
    readonly tempRoot: string;
    readonly network: SandboxNetworkPolicy;
    readonly fallback: SandboxFallback;
    readonly unsafeAllowHostProcess: boolean;
}
export type SandboxErrorCode = "invalid_sandbox_policy" | "sandbox_unavailable";
export declare class SandboxPolicyError extends CodedError<SandboxErrorCode> {
}
export declare class SandboxUnavailableError extends SandboxPolicyError {
    constructor(message: string, details?: Record<string, unknown>);
}
export interface SandboxCommandSpec {
    readonly command: string;
    readonly args?: readonly string[];
    readonly cwd?: string;
    readonly env?: Record<string, string | undefined>;
    /** Trusted per-command capability; never derived from model/user tool input. */
    readonly allowLocalBinding?: boolean;
}
export interface PreparedSandboxCommand extends SandboxCommandSpec {
    readonly args: readonly string[];
    readonly cwd: string;
    readonly sandboxed: boolean;
    readonly sandboxSettingsPath?: string;
    readonly cleanup?: () => Promise<void>;
}
export interface SandboxEngine {
    readonly id: SandboxEngineId;
    isAvailable(): Promise<boolean>;
    prepareCommand(command: SandboxCommandSpec, policy: SandboxPolicy): Promise<PreparedSandboxCommand>;
}
export type SandboxEffectiveMode = "off" | "native" | "blocked" | "unsafe-host-process";
export interface SandboxEffectiveState {
    readonly configured: boolean;
    readonly configuredMode: SandboxMode | undefined;
    readonly effective: SandboxEffectiveMode;
    readonly engine: SandboxEngineId | undefined;
    readonly engineAvailable: boolean | undefined;
    readonly fallback: SandboxFallback | undefined;
    readonly fallbackActive: boolean;
    readonly unsafeAllowHostProcess: boolean;
}
export interface PrepareSandboxedCommandInput {
    readonly policy?: SandboxPolicy;
    readonly command: SandboxCommandSpec;
    readonly engine?: SandboxEngine;
}
export interface SandboxPolicyRuntimeOptions {
    readonly sandboxPolicy: SandboxPolicy;
}
export interface SrtNetworkSettings {
    readonly allowedDomains: readonly string[];
    readonly deniedDomains: readonly string[];
    readonly strictAllowlist: true;
    readonly allowLocalBinding: boolean;
    readonly allowAllUnixSockets: boolean;
}
export interface SrtFilesystemSettings {
    readonly denyRead: readonly string[];
    readonly allowRead: readonly string[];
    readonly allowWrite: readonly string[];
    readonly denyWrite: readonly string[];
}
export interface SrtSettings {
    /**
     * Absent under all-network mode: SRT starts its proxy and domain filter
     * whenever `network.allowedDomains` is defined, so unrestricted networking
     * with enforced filesystem scopes is spelled by omitting the block.
     */
    readonly network?: SrtNetworkSettings;
    readonly filesystem: SrtFilesystemSettings;
}
export interface SrtSandboxEngineOptions extends ResolveSrtLaunchOptions {
    /**
     * Host-owned runtime roots that must remain readable after request-policy
     * intersection. These roots are always denied for writes and are not widened
     * to their parent directories.
     */
    readonly trustedReadRoots?: readonly string[];
}
export declare function createSandboxPolicy(input?: SandboxPolicyInput): SandboxPolicy;
export declare function failClosedSandboxPolicy(input?: Omit<SandboxPolicyInput, "mode" | "fallback" | "unsafeAllowHostProcess">): SandboxPolicy;
export declare function sandboxRequired(policy: SandboxPolicy): boolean;
export declare function sandboxPolicyToRuntimeOptions(policy: SandboxPolicy): SandboxPolicyRuntimeOptions;
/** Add host-owned canonical roots without exposing a configuration surface. */
export declare function protectSandboxRoots(policy: SandboxPolicy, roots: readonly string[]): SandboxPolicy;
/**
 * Monotonic merge: the result is never more permissive than `configured`.
 * A request-scoped policy can only tighten roots, network access, and the
 * fallback; it can never re-enable host execution or widen filesystem access.
 */
export declare function mergeSandboxPolicies(configured: SandboxPolicy | undefined, request: SandboxPolicy | undefined): SandboxPolicy | undefined;
export declare function createSrtSandboxEngine(options?: SrtSandboxEngineOptions): SandboxEngine;
export declare function resolveSandboxEffectiveState(input: {
    readonly policy?: SandboxPolicy;
    readonly engine?: SandboxEngine;
}): Promise<SandboxEffectiveState>;
export declare function sandboxEffectiveStateWarning(state: SandboxEffectiveState): string | undefined;
export declare function describeSandboxEffectiveState(state: SandboxEffectiveState): string;
export declare function prepareSandboxedCommand(input: PrepareSandboxedCommandInput): Promise<PreparedSandboxCommand>;
export declare function srtSettingsForPolicy(policy: SandboxPolicy, protectedSettingsPath?: string, runtimeReadRoots?: readonly string[], commandCapabilities?: {
    readonly allowLocalBinding?: boolean;
}, trustedReadOnlyRoots?: readonly string[]): SrtSettings;
export declare function networkPolicyAllowsUrl(policy: SandboxPolicy | undefined, url: string): boolean;
//# sourceMappingURL=sandbox.d.ts.map