import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
export declare function getProxyPort(): string;
export declare function clearProxyPortCache(): void;
export declare function safeResolvePath(workspaceRoot: string, filePath: string): {
    resolved: string;
    realResolved: string;
};
export declare function sanitizeArgsForLogging(args: Record<string, any>): Record<string, any>;
export declare function estimateTokensFromResult(result: any): number;
export declare function logError(context: string, error: unknown): void;
export declare function logWarn(context: string, message: string): void;
export declare function setMcpServerRef(server: Server): void;
/**
 * The connected host's clientInfo (name/version) from the MCP initialize handshake — e.g.
 * "cursor"/"claude-code"/"codex". Tool handlers only run after the handshake completes, so
 * this is already populated by the time any of them call it; no separate capture step needed.
 * Note this identifies the *host*, not the underlying model it's using — Cursor/Windsurf let
 * the user pick GPT or Claude per session, so it cannot be used to select a tokenizer.
 */
export declare function getConnectedClientInfo(): {
    name: string;
    version: string;
} | undefined;
/**
 * The default similarity floor a memory must clear before search_memory/smarter_cache
 * treat it as a real hit rather than noise. Shared so both paths agree on what counts.
 */
export declare const DEFAULT_MEMORY_SIMILARITY_FLOOR = 0.75;
/**
 * Ask the client to confirm a destructive action before it happens.
 *
 * Mirrors the defensive shape of trySamplingContext() in src/mcp/index.ts: most clients
 * today don't support elicitation, so any failure (unsupported capability, timeout,
 * malformed response) must fall back to "proceed without confirmation" rather than block
 * or error out the tool. This is a courtesy prompt for clients that support it, not a
 * security boundary — the allowlist/path-safety checks each handler already does are that.
 */
export declare function tryElicitConfirmation(summary: string): Promise<{
    supported: boolean;
    confirmed: boolean;
}>;
/**
 * Ask the client to pick one of several candidates via a typed (oneOf) elicitation form,
 * instead of the plain confirm/deny shape tryElicitConfirmation uses. Same defensive
 * contract: no support, a decline, or a malformed response all just mean "couldn't
 * resolve it this way" — the caller falls back to its own error/default behavior, never
 * blocks or throws.
 */
export declare function tryElicitChoice(message: string, options: Array<{
    title: string;
}>): Promise<{
    supported: boolean;
    index: number | null;
}>;
/**
 * Loads allowed command prefixes by merging the hardcoded defaults with
 * any user-defined extensions in lemma.config.json under `mcp.allowedCommandPrefixes`.
 */
export declare function loadAllowedCommands(): string[];
/**
 * Structurally validates a command string against the allowlist.
 *
 * A first-token-only check is not enough: `run_workspace_command` executes via
 * `spawn(command, { shell: true })`, so the whole string reaches a real shell. An allowed
 * prefix followed by `&&`, `;`, `|`, redirection, or substitution can run anything —
 * `git status && rm -rf ~` passes a first-token check because `git` is allowed, but the
 * shell still runs the `rm`. This walks the parsed token stream instead: every clause
 * between chain operators must independently pass the allowlist, and redirection,
 * substitution, backgrounding, and subshells are rejected outright rather than enumerated
 * as "not yet seen as dangerous".
 */
export declare function isCommandAllowed(command: string): {
    allowed: boolean;
    prefix?: string;
    reason?: string;
};
//# sourceMappingURL=utils.d.ts.map