import type { AgentRunArgs } from './agent-runner.js';
import type { CodexStreamEvent, TurnOutcome } from './codex-runner-types.js';
export declare const TURN_TIMEOUT_MS: number;
/**
 * Security (#535): codex's `shell_snapshot` feature is enabled by default
 * (stable) in codex 0.156.1, and `codex exec` — what this runner runs —
 * creates `$CODEX_HOME/shell_snapshots/`. A snapshot holds the user's shell
 * environment, every exported API key and token included, and codex creates
 * it with the process umask, so 0644 under the usual 022.
 *  - `-c features.shell_snapshot=false` (and `_v2`): codex's own feature
 *    flags (`codex features list`) — the fix; no snapshot is written. A codex
 *    that lacks a key only logs "unknown feature key in config".
 *  - `restrictCodexHome` makes `$CODEX_HOME` and its `sessions/` and
 *    `shell_snapshots/` 0700 before each spawn, when the current user owns
 *    them: a 0700 dir hides its files whatever their own modes, so rollouts
 *    and any snapshot an older codex wrote are not readable by other users.
 *    The process umask is left alone, so workspace files keep their modes.
 * CODEX_HOME is never redirected: codex's auth lives in the user's own
 * `~/.codex/auth.json`, which this runner has never copied.
 */
export declare const CODEX_SNAPSHOT_OFF_ARGS: readonly ['-c', 'features.shell_snapshot=false', '-c', 'features.shell_snapshot_v2=false'];
/** `$CODEX_HOME` for a child env: codex's own default is `~/.codex`. */
export declare function codexHomeDir(env: NodeJS.ProcessEnv): string;
/**
 * chmod 0700 `codexHome` and its `sessions/` and `shell_snapshots/`, each
 * only when it is a real directory owned by the current user. A symlinked
 * `codexHome` (dotfile managers) is resolved with realpath and its target
 * tightened under the same checks (#540); symlinked subdirs are left alone.
 * Missing dirs are left for codex to create; errors are ignored (best effort,
 * never blocks a turn). Returns the paths it tightened. No-op on win32.
 */
export declare function restrictCodexHome(codexHome: string): string[];
/**
 * `codex exec` argv for one turn. ARG ORDER — see file header for the
 * live-verified citation:
 *   codex exec --json [--model X] [-c model_reasoning_effort=L]
 *              -c features.shell_snapshot=false -c features.shell_snapshot_v2=false [--cd Y]
 *              [--skip-git-repo-check] [--sandbox <mode> | --dangerously-…]
 *              [resume <threadId>] [--image <file>]… -- -
 * The prompt goes over STDIN, not argv: a single argv element is capped
 * at 128 KiB on Linux (E2BIG), and a system prompt + tool protocol +
 * tool results routinely exceeds that. `-` is codex's documented "read
 * instructions from stdin" marker on both `exec` and `exec resume`
 * (confirmed live, v0.153.2); `--` ends option parsing so nothing
 * positional is ever mistaken for a flag.
 *
 * Coder mode (`access: 'full'`, rev 19): `--dangerously-bypass-approvals-
 * and-sandbox` (no approvals, no codex sandbox — codex-cli 0.156.1 `exec`
 * and `exec resume` both accept it) replaces the role's `--sandbox`. The
 * user's codex config (`$CODEX_HOME/config.toml`, its MCP servers, project
 * AGENTS.md) is never isolated by this runner in any mode — no CODEX_HOME
 * override, no `--ignore-user-config` — so `settingSources` needs nothing
 * here; agent-exec names what codex loads in a `status` notice.
 * `access: 'read'` (#388) passes `--sandbox read-only`: the whole filesystem
 * read-only and no network for model-generated shell commands.
 * An explicit `sandbox` (#396, `agent exec --sandbox`) of read-only or
 * workspace-write replaces both the role's default and the full-access
 * bypass flag; `full` or unset keeps the behaviour above.
 * `images` (rev 32, `agent exec --attach`) come after `resume <id>`, so a
 * resumed turn uses `exec resume`'s own `--image` (codex-cli 0.159.3 has
 * `-i, --image` on both `exec` and `exec resume`).
 */
export declare function codexExecArgs(args: AgentRunArgs, threadId: string | undefined, images?: string[]): string[];
/**
 * Run one `codex exec` invocation and stream its JSONL output
 * INCREMENTALLY: each parsed event is yielded as soon as its line arrives
 * on stdout (see the header's "Streaming / liveness" note for why
 * buffering until process exit was a bug, #204). End-of-turn facts (exit
 * code, stderr tail, thread id, usage, error, timeout flag) are written
 * into `outcome`, which the caller reads after this generator completes.
 * `idPrefix` keeps tool-call ids unique across spawns (codex restarts its
 * item numbering per process — codex-runner-tools.ts). `images` go to
 * `--image` (rev 32).
 */
export declare function streamTurn(bin: string, prompt: string, threadId: string | undefined, args: AgentRunArgs, outcome: TurnOutcome, idPrefix?: string, images?: string[]): AsyncGenerator<CodexStreamEvent>;
/** Build the actionable error for a failed codex turn. */
export declare function turnError(outcome: TurnOutcome, round: number, _bin: string): Error;
//# sourceMappingURL=codex-runner-stream.d.ts.map