/**
 * owner-terminal-guard.ts, the owner's terminal is not a surface this platform
 * types into.
 *
 * ── The rule ───────────────────────────────────────────────────────────────
 *
 * Recorded owner doctrine: never touch tmux sessions the platform did not
 * create. This module is that rule made enforceable at the exec layer, for
 * turns that run without anyone watching: a command that INTERACTS with an
 * existing tmux session, window or pane, send-keys, kill, resize, attach,
 * respawn, rename, is refused, and the refusal names the rule.
 *
 * Creating and driving the platform's OWN tmux sessions stays allowed, because
 * that is not the owner's terminal: a session this platform made is a session
 * this platform may type into. Ownership is proved by NAME
 * ({@link PLATFORM_TMUX_SESSION_PREFIX}), plus any names a composition
 * registers, because a name is the only thing a shell command carries that can
 * be checked before the command runs. A pane id (`%3`), a window id (`@2`) or a
 * session id (`$1`) proves nothing about who created it, so a target spelled
 * that way is refused rather than guessed at.
 *
 * Reading is not touching. `list-sessions`, `list-panes`, `capture-pane` and
 * the other observation verbs are allowed: the platform's fleet view already
 * reads the pane list to notice externally-launched agents
 * (runtime/fleet/observed/detect.ts), and refusing to LOOK would break that
 * without protecting anything.
 *
 * ── What this is not ───────────────────────────────────────────────────────
 *
 * It is not the frozen catastrophic block, which lives in the classifier, is
 * unconditional, and is untouched by this file. It is not a command-class
 * policy either, class risk stays with the permission settings. It is one
 * named rule about one named tool, applied where a composition asks for it, and
 * it can only ever refuse.
 *
 * It does not reach the platform's own tmux drill-in steer
 * (runtime/fleet/observed/source.ts), which spawns tmux directly rather than
 * through the exec tool and is an affordance the owner drives himself from the
 * fleet view.
 */
/**
 * The name prefix that marks a tmux session as the platform's own.
 *
 * A session the platform creates is named `goodvibes-<something>`; a command
 * targeting one is a command about the platform's own workspace, not the
 * owner's terminal.
 */
export declare const PLATFORM_TMUX_SESSION_PREFIX = "goodvibes-";
/** Whether the guard is applied to this composition's commands. */
export type OwnerTerminalGuardPosture = 
/** Commands that drive an existing tmux session the platform does not own are refused. */
'enforced'
/** No guard. The default, so composing this concept changes nothing by itself. */
 | 'off';
/** What a composition states about the owner's terminal. */
export interface OwnerTerminalGuard {
    readonly posture: OwnerTerminalGuardPosture;
    /**
     * Extra tmux session names this composition owns, beyond the
     * {@link PLATFORM_TMUX_SESSION_PREFIX} convention. Exact names, no patterns.
     */
    readonly ownedSessionNames?: readonly string[] | undefined;
}
/** The verdict for one command. */
export interface OwnerTerminalDecision {
    readonly allowed: boolean;
    /** Present when `allowed` is false: the plain refusal, ready to return. */
    readonly refusal?: string | undefined;
}
/**
 * Decide whether a command may run under this composition's owner-terminal
 * posture. Pure; never throws.
 *
 * @param command - The raw shell command string, exactly as it would run.
 * @param guard - The composition's posture. `undefined` reads as `off`.
 */
export declare function decideOwnerTerminalAccess(command: string, guard: OwnerTerminalGuard | null | undefined): OwnerTerminalDecision;
//# sourceMappingURL=owner-terminal-guard.d.ts.map