/**
 * A private TMPDIR per role session (#480).
 *
 * Every role of an org run used to inherit the daemon's one TMPDIR (the
 * release org runs with `$HOME/mrg-tmp`). A bare `mktemp -d` put
 * `tmp.XXXXXXXXXX` straight into that shared root, and a role cleaning up its
 * own scratch with `rm -rf tmp.*` there deleted every other concurrently
 * running role's scratch too (13 directories matched on the 2.19.0 release run
 * where 3 were meant).
 *
 * So each role session — each task session under `session_scope: "task"` —
 * gets its own `<base>/<org>-<role>-<random>/` (mode 0700), exported as
 * TMPDIR, TMP, TEMP and CLAUDE_CODE_TMPDIR. `<base>` is the TMPDIR the role would otherwise have
 * had, so the OS sandbox's writable temp root and the file-tool roots (both
 * built from that base) already cover it.
 *
 * Cleanup is best-effort and exact: a directory is removed only by the path
 * this module created and recorded, after checking it still sits directly in
 * its base with this org's and role's prefix and is a real directory, never a
 * symlink. A sibling is never touched. On org start, sweepStaleRoleTmpdirs()
 * reclaims what a killed daemon left behind — only entries whose owner marker
 * names this org and project root and whose owning process is gone (or is
 * this process, for an earlier run). Anything it cannot attribute is left.
 */
/** Owner record written inside every role tmpdir (a dotfile, so a role's
 *  `rm -rf "$TMPDIR"/*` leaves it). */
export declare const ROLE_TMPDIR_MARKER = ".monomind-role-tmpdir.json";
/** `<org>-` — every role tmpdir of this org starts with it. */
export declare const orgTmpPrefix: (org: string) => string;
/** `<org>-<role>-` — every tmpdir of this role starts with it. */
export declare const roleTmpPrefix: (org: string, role: string) => string;
/** The TMPDIR a role gets without isolation: the daemon's own. */
export declare function roleTmpBase(env?: NodeJS.ProcessEnv): string;
/** The env overlay pointing every temp-dir convention at `dir`.
 *  CLAUDE_CODE_TMPDIR (#503): Claude Code reads it before TMPDIR, and its
 *  Bash tool exports it to every command, so an org started from a Claude
 *  Code session inherits the outer session's temp dir. Left in place, a
 *  claude role's sandboxed Bash got that shared dir as TMPDIR, and any
 *  `claude` a role ran used it too. Claude Code adds `claude-<uid>/` under it. */
export declare function roleTmpEnv(dir: string | undefined): Record<string, string>;
/** Creates `<base>/<org>-<role>-XXXXXX` (0700) with its owner marker and
 *  records it for the run's stop. Returns undefined when it cannot (base
 *  missing or unwritable): the role then keeps the shared base, as before. */
export declare function createRoleTmpdir(args: {
    org: string;
    role: string;
    run?: string;
    root: string;
    base?: string;
}): string | undefined;
/** Removes one role tmpdir by its exact path, after checking it is what
 *  createRoleTmpdir made for this org and role. Returns whether it was removed. */
export declare function removeRoleTmpdir(dir: string, args: {
    org: string;
    role: string;
    base: string;
}): boolean;
/** Removes every role tmpdir recorded for this run (org stop). */
export declare function releaseRunTmpdirs(org: string, run: string | undefined): void;
/** On org start: removes this org's role tmpdirs under `base` that belong to
 *  a run no longer live. Returns the removed paths. */
export declare function sweepStaleRoleTmpdirs(args: {
    org: string;
    root: string;
    run?: string;
    base?: string;
    isAlive?: (pid: number) => boolean;
}): string[];
//# sourceMappingURL=role-tmpdir.d.ts.map