import type { SandboxMode } from './runner-sandbox.js';
type Decision = {
    behavior: 'allow';
    updatedInput: Record<string, unknown>;
} | {
    behavior: 'deny';
    message: string;
};
export type ExecCanUseTool = (toolName: string, input: Record<string, unknown>) => Promise<Decision>;
/** Scoped access: only the caller's own tools, plus Bash commands that start
 *  with one of `bashPrefixes` and contain no shell metacharacters. */
export declare function scopedCanUseTool(allowedToolNames: ReadonlySet<string>, bashPrefixes: readonly string[]): ExecCanUseTool;
/**
 * The tool names the scoped/read gate allows: each caller tool as the
 * SDK's `mcp__org__<name>` and, for fence runtimes, its bare name. #482: a
 * claude turn under `--sandbox read-only|workspace-write` gets only the
 * prefixed form, so a caller tool named like a native one ("Write",
 * "Bash") can never let that native tool through.
 */
export declare function execAllowedToolNames(runtime: string, sandbox: SandboxMode | undefined, tools: ReadonlyArray<{
    name: string;
}>): Set<string>;
/** The gate for a scoped or read turn. */
export declare function execCanUseTool(access: 'scoped' | 'read', allowedToolNames: ReadonlySet<string>, bashPrefixes: readonly string[]): ExecCanUseTool;
export {};
//# sourceMappingURL=agent-exec-gate.d.ts.map