/**
 * Git-level enforcement of `policy.git` for role sessions (#258).
 *
 * policy.ts classifies Bash command TEXT, which cannot see git calls that
 * reach a shell as data (`echo "git push" | sh`), scripts written in one tool
 * call and run in the next, `node -e`, npm scripts — and non-Claude runtimes
 * never consult it for their native shell at all. This module enforces the
 * level where git itself runs: every git process a role starts inherits the
 * session env, so the guard lives there.
 *
 * Below 'push' the guard env sets, via GIT_CONFIG_COUNT (command-scope config,
 * which beats system/global/repo config):
 *   - core.hooksPath → a monomind-managed hooks dir (scoped, see below). `pre-push` denies every
 *     push; at 'read'/'none', `reference-transaction` aborts every ref update
 *     in the org's protected repositories (git has no --no-verify for it, so
 *     it also stops `commit --no-verify`, `update-ref`, `commit-tree` +
 *     `update-ref`). Every other hook passes through to the repository's own
 *     hooks, so husky/lint hooks keep running.
 *   - protocol.file.allow=never — local-path pushes (`push --no-verify` to a
 *     bare repo, `send-pack`) have no hook to stop them.
 *   - credential.helper reset, failing askpass/ssh commands, no terminal
 *     prompt, and blank SSH_AUTH_SOCK / GitHub tokens — network pushes need
 *     credentials the role no longer gets.
 *
 * core.hooksPath and core.excludesFile change what git does inside a
 * repository, so they reach git only through `includeIf.gitdir:` entries for
 * the protected repositories (their main git dir and every linked worktree
 * under <common dir>/worktrees/). A repository the role's own tests create in
 * TMPDIR gets neither (#298, #481). The transport and credential settings
 * above stay process-wide: they are what stops a push from any repository.
 *
 * All of this is same-user, environment-level defense: a role that knows to
 * pass `-c core.hooksPath=…`, unset GIT_CONFIG_COUNT, or read a credential
 * file from disk gets past it. Only the OS sandbox (role-sandbox.ts) closes
 * those; see doc/concepts/org-runtime.md "Git policy enforcement".
 */
export type GitLevel = 'none' | 'read' | 'commit' | 'push';
export interface GitGuard {
    level: Exclude<GitLevel, 'push'>;
    /** Directory holding the generated hooks and deny scripts. */
    dir: string;
    hooksDir: string;
    /** Realpaths of the git common dirs the level protects. */
    protectedGitDirs: string[];
    /** Env overlay for the role session (merged over process.env by runners). */
    env: Record<string, string>;
}
/** Realpath of the git common dir for `path` (the main repo's .git for a
 *  worktree), or undefined when `path` is not inside a git repository. */
export declare function gitCommonDir(path: string): string | undefined;
/** Local filesystem paths the repository's remotes (url/pushurl) point at.
 *  The sandbox keeps them read-only so a role can't write refs into a local
 *  "remote" directly. Network remotes are left reachable: fetching is
 *  legitimate at every level, and the push barrier there is withheld
 *  credentials (role-sandbox.ts). */
export declare function gitLocalRemotePaths(gitDir: string): string[];
/**
 * Write the guard's hooks and deny scripts under `stateDir` and return the
 * session env overlay. Returns undefined for 'push' — push roles get no guard.
 */
export declare function prepareGitGuard(opts: {
    level: GitLevel;
    stateDir: string;
    protectedGitDirs: string[];
    baseEnv?: NodeJS.ProcessEnv;
    /** Hide the placeholder files the OS sandbox creates in the role's cwd.
     *  Only meaningful when the sandbox actually runs. */
    excludeSandboxPlaceholders?: boolean;
}): GitGuard | undefined;
//# sourceMappingURL=git-guard.d.ts.map