/**
 * Canonical per-harness tool catalog: the objects an Ory project grants `use`
 * on, and the set `permissions status` probes coverage across.
 *
 * These lists cover each harness's built-in tools — the names the harness
 * passes to the pre-tool-use hook. MCP server tools are intentionally
 * omitted because they're discovered dynamically per session and can't be
 * enumerated ahead of time.
 *
 * The lists are best-effort: harness vendors add and rename tools over time,
 * so a project's grants may cover more or fewer names than the catalog knows.
 */
/**
 * Built-in tool names known to ship with each supported harness.
 */
export declare const HARNESS_TOOL_CATALOG: {
    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
    readonly codex: readonly ["Bash", "apply_patch"];
    readonly "gemini-cli": readonly ["read_file", "write_file", "edit_file", "list_files", "search_files", "shell", "web_search"];
    readonly openclaw: readonly ["exec", "read", "write", "edit", "apply_patch", "web_search", "web_fetch", "browser"];
    readonly opencode: readonly ["read", "write", "edit", "bash", "glob", "grep", "webfetch"];
    readonly continue: readonly ["Bash", "Read", "Edit", "Write", "Grep", "Glob", "WebSearch"];
    readonly goose: readonly ["shell", "text_editor", "read_file", "write_file", "list_windows", "screen_capture"];
    readonly cline: readonly ["execute_command", "run_commands", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
    readonly amp: readonly ["Bash", "Read", "create_file", "edit_file", "undo_edit", "glob", "Grep", "finder", "read_web_page", "web_search", "todo_read", "todo_write", "oracle", "Task"];
    readonly pi: readonly ["read", "write", "edit", "bash", "powershell", "grep", "find", "ls"];
    readonly antigravity: readonly ["run_command", "view_file", "write_to_file", "replace_file_content", "multi_replace_file_content", "list_directory", "grep_search", "find", "read_url_content", "search_web", "call_mcp_tool"];
    readonly cursor: readonly ["Read", "Write", "Edit", "Delete", "Shell", "List", "Search", "MCP", "Task"];
};
/** Names of the harnesses with a known tool catalog. */
export type KnownHarness = keyof typeof HARNESS_TOOL_CATALOG;
export declare const KNOWN_HARNESSES: readonly KnownHarness[];
/**
 * Tools for a specific harness. Returns the canonical list when known;
 * empty array for unknown harnesses (callers can fall back to {@link
 * ALL_TOOLS} or skip the catalog-scoped step with a warning).
 */
export declare function getToolCatalog(harness: string): readonly string[];
/**
 * Union of every known tool across all harnesses, deduplicated. Used by local
 * environment seeding to grant broad access across every built-in tool set.
 */
export declare const ALL_TOOLS: readonly string[];
/**
 * Per-harness tool names whose semantics are "ask / inform the user"
 * rather than "act on an external system". These reach the pre-tool-use
 * hook the same way real tools do (e.g. Claude Code's `AskUserQuestion`
 * arrives via `PreToolUse`), but they aren't tool *executions* — gating
 * them through Ory would either block the user from being asked or, in
 * observe mode, log a misleading `permission.observe_deny` for an event
 * the user is about to handle directly.
 *
 * Plugins consult this list in their pre-tool gate and short-circuit to
 * a single `user.interaction` audit event when a match is found. See
 * `gateToolCall` in `permissions.ts`.
 *
 * The list is best-effort and additive: operators can extend it at
 * runtime via the `ORY_INTERACTIVE_TOOLS` env var (comma-separated names
 * applied to every harness).
 */
export declare const INTERACTIVE_TOOL_CATALOG: Record<string, readonly string[]>;
/**
 * Names from {@link INTERACTIVE_TOOL_CATALOG} for the given harness,
 * merged with any operator-supplied names from `ORY_INTERACTIVE_TOOLS`.
 * Unknown harnesses still respect the env-var extension.
 */
export declare function getInteractiveToolCatalog(harness: string): readonly string[];
/**
 * Does the named tool, for the given harness, represent a user-facing
 * interaction (ask / inform / confirm) rather than an external-system
 * tool execution? Treats unknown harnesses the same as known ones — the
 * env-var extension still applies.
 */
export declare function isInteractiveTool(harness: string, toolName: string): boolean;
/**
 * Per-harness name(s) of the shell/exec tool whose input is decomposed into
 * `ShellTool:<word>#use` sub-checks. Validated against each harness's
 * types/handlers. Names vary (`Bash`, `shell`, `exec`, `run_command`, …) so a
 * precise map is used rather than the {@link isBashLikeTool} heuristic.
 */
export declare const SHELL_TOOL_CATALOG: Record<string, readonly string[]>;
/**
 * Shell-tool names for a harness, merged with the operator env extension
 * `ORY_SHELL_TOOLS` (same pattern as `ORY_INTERACTIVE_TOOLS`) so a vendor tool
 * rename can be handled without a plugin release.
 */
export declare function getShellToolCatalog(harness: string): readonly string[];
/** Is the named tool, for this harness, the shell/exec tool to decompose? */
export declare function isShellTool(harness: string, toolName: string): boolean;
/**
 * Broad list of shell command *words* — common dev binaries, sensitive
 * binaries, and builtins — that an Ory project is expected to grant `use` on
 * so enforce mode is practical out of the box; revoke a specific word in the
 * Ory Console to close it. Builtins are included because they are a real
 * bypass surface (`echo "$SECRET" >/dev/tcp/…`, `read`, redirection tricks).
 * `permissions status` reports coverage against this list.
 */
export declare const SHELL_COMMAND_CATALOG: readonly string[];
/**
 * The shell command word list, merged with the operator env extension
 * `ORY_SHELL_COMMANDS`.
 */
export declare function getShellCommandCatalog(): readonly string[];
/**
 * Keto namespace for shell-command sub-tools. Defaults to `ShellTool`,
 * parallel to `mcp_servers` / `mcp_tools`. The object is the bare word (`curl`),
 * relation `use`. Override with `ORY_SHELL_COMMAND_NAMESPACE`.
 */
export declare function resolveShellCommandNamespace(): string;
/**
 * Extract shell command strings from a harness's tool-args object — the same
 * object the handler already passes to `summarizeToolInput`. Returns `undefined`
 * when the tool isn't a shell tool for this harness or no command field is
 * present. Cline's `run_commands` is the exception: malformed command data is
 * represented as an unresolvable command so enforce mode fails closed. Cline's
 * command array remains an array so independently executed entries cannot
 * change how neighboring entries parse.
 */
export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | readonly string[] | undefined;