/**
 * OS-level enforcement of `policy.git` for claude-runtime roles (#258).
 *
 * The Claude Agent SDK can run the Bash tool inside an OS sandbox (bubblewrap
 * + socat on Linux, seatbelt on macOS). For roles below 'push' this module
 * builds that sandbox so the level holds even against a role that bypasses
 * the git guard env (git-guard.ts):
 *   - writes: the role's cwd, the org root, $HOME and the temp dir stay
 *     writable (installs, caches, test fixtures), minus the protected git dir
 *     ('read'/'none') or its config + hooks ('commit'), the guard's hooks,
 *     local-path remotes, and git/shell/Claude config that would undo the guard
 *     (a denied directory holding the cwd or ~/.claude goes in as its existing
 *     children, #323, unless it is the cwd and the runtime holds every stub
 *     in it — sandbox-deny-write.ts);
 *   - network: every host allowed (`policy.sandbox.allowedDomains`, default
 *     ['*']) minus the opt-in `policy.sandbox.deniedDomains`, deterministically,
 *     with local binding kept for dev servers and tests. Git remote hosts are
 *     not denied: read roles fetch, ls-remote and clone, and a forge's API
 *     would stay reachable anyway — the push barrier is withheld credentials;
 *   - reads of credential files (ssh keys, git-credentials, gh login, netrc).
 * Bash stays gated by canUseTool (autoAllowBashIfSandboxed: false) and
 * dangerouslyDisableSandbox is ignored (allowUnsandboxedCommands: false).
 * Write/Edit/Read run in-process, outside the sandbox, so matching permission
 * deny rules (`disallowedTools`) cover them — those need no sandbox at all.
 *
 * Availability (`policy.sandbox.mode`):
 *   'auto' (default) — sandbox when bwrap/socat (or seatbelt) are present;
 *                      otherwise run without it and emit a
 *                      `git-sandbox-unavailable` audit event (fail open, loud).
 *   'required'       — fail closed: the session refuses to start.
 *   'off'            — no sandbox; `git-sandbox-off` audit event.
 * `monomind org validate` reports the same findings before a run.
 */
import type { OrgBus } from './bus.js';
import { type ClaudeRestrictions, type SandboxAvailability } from './role-sandbox-restrictions.js';
import type { OrgDef, OrgRole } from './types.js';
export type { ClaudeRestrictions, RoleSandboxPolicy, SandboxAvailability, } from './role-sandbox-restrictions.js';
export { buildClaudeRestrictions, sandboxAvailability, } from './role-sandbox-restrictions.js';
/**
 * The authority mask (authority-mask.ts) for a role the SDK sandbox does not
 * cover: a `push` role, a role whose sandbox is off or unavailable, or any
 * non-Claude CLI runtime. Undefined when the SDK sandbox already applies it,
 * for an in-process runtime (no shell), or when bubblewrap cannot run here —
 * the last one audited once, like `git-sandbox-unavailable` (fail open).
 */
export declare function roleAuthorityMask(args: {
    bus: OrgBus;
    roleId: string;
    inSdkSandbox: boolean;
    inProcess: boolean;
    cwd: string;
    orgRoot?: string;
    /** The role's `policy.fileWrite`: dirs it names under an org dir are created. */
    fileWrite?: string[];
    /** The role's signed `policy.sandbox.allowWrite`. */
    allowWrite?: string[];
    home?: string;
    env?: NodeJS.ProcessEnv;
    availability?: {
        available: boolean;
        reason?: string;
    };
}): string[] | undefined;
/**
 * Per-session enforcement for one role: the git guard env (every runtime) and,
 * for the Claude runtime, the SDK restrictions. Throws when
 * policy.sandbox.mode is 'required' and the sandbox cannot start.
 */
export declare function resolveRoleGitEnforcement(args: {
    org: string;
    role: OrgRole;
    cwd: string;
    orgRoot?: string;
    orgDir?: string;
    /** The current run, whose event log the SDK sandbox makes read-only. */
    run?: string;
    bus: OrgBus;
    claudeRuntime: boolean;
    runtime?: string;
    availability?: SandboxAvailability;
    /** Defaults to process.env; injectable for tests. */
    env?: NodeJS.ProcessEnv;
    /** Directories the role may not read (see buildClaudeRestrictions). */
    denyReadDirs?: string[];
    /** Directories the role may not write (see buildClaudeRestrictions). */
    denyWriteDirs?: string[];
    /** See buildClaudeRestrictions: called only when the sandbox is built. */
    holdStubs?: (writableRoots: string[]) => string[];
}): {
    env: Record<string, string>;
    claudeRestrictions?: ClaudeRestrictions;
};
/** `monomind org validate` findings: roles whose policy.git will not have the
 *  OS sandbox behind it on this host. */
export declare function gitEnforcementFindings(def: OrgDef, availability?: SandboxAvailability): {
    warnings: string[];
    errors: string[];
};
//# sourceMappingURL=role-sandbox.d.ts.map