import { type Exec } from '../exec.js';
import type { ResolvedRole } from '../config.js';
import type { AcpLaunch, HarnessAdapter, UnattendedCapability } from './types.js';
import { type AcpAgentResolution } from './acp-agent.js';
import type { AcpSessionTransport } from './acp-session-transport.js';
import type { CodexAppServerSessionTransport } from './codex-session.js';
/**
 * What an unattended role can actually do under Codex's native settings.
 * `on-request` and `untrusted` stop to ask, and with no console attached that
 * request is refused rather than answered — so the role can only read.
 */
export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
/** Defense in depth for callers which launch a role after validation was bypassed. */
export declare function nativeCodexConfig(role: ResolvedRole): Record<string, unknown> | undefined;
/** Bind launch argv and metadata provenance to one already-completed resolution. */
export declare function codexAcpLaunchForResolution(resolution: AcpAgentResolution): Pick<AcpLaunch, 'argv' | 'permissionMetadataSource'>;
export declare function makeCodexAdapter(exec?: Exec, transport?: AcpSessionTransport, nativeTransport?: CodexAppServerSessionTransport): HarnessAdapter;
export declare const codexAdapter: HarnessAdapter;