/**
 * sandbox-policy.ts, the sandbox-aware INPUT to the exec permission decision.
 *
 * This is ordinary permission-layer policy, not a new enforcement path: given a
 * command and whether the per-command exec sandbox is active, it decides whether
 * a command that would otherwise prompt ("ask") under prompt mode can auto-allow
 * because it runs entirely inside the OS boundary with no host-access need, or
 * must still surface as an explicit escalation ask that NAMES what it wants
 * (network, host-privilege escalation, a package install that reaches the
 * network). A consumer composes this with its existing decision machinery: when
 * the base policy would ask an exec, it consults this to see whether the sandbox
 * turns that ask into an allow.
 *
 * FROZEN CATASTROPHIC BLOCK IS UNTOUCHED. This module never inspects, relaxes,
 * or re-implements the unconditional catastrophic block (rm -rf /, dd to a
 * device, mkfs, fork bomb …). That block is enforced independently, at exec
 * time, and stays in force identically inside the sandbox, a boundary never
 * buys a catastrophic command an allow. Doctrine: "permission settings are the
 * sole authority for command-class risk; the exec-layer unconditional block is a
 * frozen catastrophic-only list … that must NEVER expand without the owner's explicit
 * approval." This layer only ever RELAXES an ask to an allow for boundary-safe
 * commands; it can never turn a deny into an allow.
 */
export type SandboxPolicyEffect = 'allow' | 'ask';
export interface SandboxPolicyDecision {
    /** The resolved effect for this exec under the sandbox-aware policy. */
    readonly effect: SandboxPolicyEffect;
    /** Whether the command would run inside the boundary. */
    readonly sandboxed: boolean;
    /**
     * Named host-access needs when `effect` is 'ask' because of them (e.g.
     * "wants network"). Empty when the command is boundary-safe and auto-allowed,
     * or when the sandbox is inactive (base policy applies).
     */
    readonly escalations: string[];
    /** Human-readable justification for the decision. */
    readonly reason: string;
}
export interface SandboxPolicyInput {
    readonly command: string;
    /**
     * Whether the sandbox is genuinely active: the capability gate
     * is on, `sandbox.enabled` config is true, AND the host can provide a boundary.
     * When false, the base policy applies unchanged.
     */
    readonly sandboxActive: boolean;
    /** Command base names (or `*`) whose network access is re-enabled in the boundary. */
    readonly egressAllowlist: readonly string[];
    /**
     * What the existing permission layer would decide for this exec absent the
     * sandbox (prompt mode → 'ask'). Returned unchanged when the sandbox is
     * inactive, so this policy is purely additive.
     */
    readonly baseEffectWhenNotSandboxed: SandboxPolicyEffect;
}
/**
 * Decide, for a single exec, whether the active sandbox turns a base "ask" into
 * an "allow", or whether the command still needs a named escalation ask.
 */
export declare function decideSandboxedExec(input: SandboxPolicyInput): SandboxPolicyDecision;
//# sourceMappingURL=sandbox-policy.d.ts.map