import { type GitGuard } from './git-guard.js';
export interface RoleSandboxPolicy {
    mode?: 'auto' | 'required' | 'off';
    allowedDomains?: string[];
    deniedDomains?: string[];
    allowWrite?: string[];
    denyWrite?: string[];
    denyExec?: string[];
    denyRead?: string[];
    homeWriteAllow?: string[];
    allowUnixSockets?: boolean;
}
/** What ClaudeAgentRunner merges into the SDK's query() options. */
export interface ClaudeRestrictions {
    sandbox?: Record<string, unknown>;
    disallowedTools: string[];
}
export interface SandboxAvailability {
    available: boolean;
    reason?: string;
}
/** Whether the SDK sandbox can start for a CLI spawned with `env`. Mirrors the
 *  SDK's own dependency check, so 'auto' can decide before query() fails. */
export declare function sandboxAvailability(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SandboxAvailability;
export declare const uniq: (xs: Array<string | undefined>) => string[];
export declare function buildClaudeRestrictions(guard: GitGuard, cfg: RoleSandboxPolicy | undefined, ctx: {
    cwd: string;
    orgRoot?: string;
    /** The org and run this role runs in: that run's event log is denied. */
    current?: {
        org: string;
        run?: string;
    };
    home?: string;
    tmp?: string;
    env?: NodeJS.ProcessEnv;
    platform?: NodeJS.Platform;
    /** Directories this role may not read (GA row R3: other roles' mail digests). */
    denyReadDirs?: string[];
    /** Directories no role may write (GA row R4: the mail root). */
    denyWriteDirs?: string[];
    /** Linux: holds the sandbox's mount-point stubs for these writable roots
     *  (sandbox-stubs.ts) and returns the stub paths still not in place. */
    holdStubs?: (writableRoots: string[]) => string[];
}, sandboxEnabled: boolean): ClaudeRestrictions;
//# sourceMappingURL=role-sandbox-restrictions.d.ts.map