import type { Tool } from '../../types/tools.js';
import { OverflowHandler } from '../shared/overflow.js';
import type { ExecCommandResult } from './schema.js';
import { ProcessManager } from '../shared/process-manager.js';
import type { FeatureFlagManager } from '../../runtime/feature-flags/index.js';
import { type CredentialEnvScrubConfig } from './credential-env.js';
import { type ExecSandboxRuntime } from './sandbox.js';
import { type ExecInteractionRuntime } from './interactive.js';
import type { ExecContainmentRequirement } from './containment.js';
import type { OwnerTerminalGuard } from './owner-terminal-guard.js';
/**
 * Classify whether a failed exec result is retryable.
 *
 * Retryable: network errors (ECONNRESET, ENOTFOUND, ETIMEDOUT), lock/busy
 * (EBUSY, ENOMEM, ECONNREFUSED), HTTP-gateway-style exit codes (124=timeout,
 * 28=curl timeout). Terminal: permission denied (EACCES), missing binary
 * (ENOENT), syntax errors.
 *
 * @param result - The failed command result.
 * @param allowed - Optional allowlist of error category strings.
 */
export declare function isRetryableExecResult(result: ExecCommandResult, allowed?: ReadonlyArray<'network' | 'lock' | 'busy' | 'oom'>): boolean;
export declare function createExecTool(processManager: ProcessManager, options?: {
    readonly featureFlags?: Pick<FeatureFlagManager, 'isEnabled'> | null | undefined;
    readonly overflowHandler?: OverflowHandler | undefined;
    /**
     * Default working directory used when a call omits the top-level
     * working_dir (and no single command supplies one to promote). Callers
     * register this tool with the session/project working directory they
     * already have in hand (see tools/index.ts registerAllTools) so the
     * parameter stays genuinely optional for the model instead of a
     * mandatory-in-practice field that fails a call after the user has
     * already approved it.
     */
    readonly defaultWorkingDirectory?: string | undefined;
    /**
     * Credential-bearing env-var scrub applied to every spawned command's
     * environment. Enabled by default (see resolveCredentialEnvScrub). Consumers
     * wire their `permissions.exec.*` config through here; the withheld names are
     * reported on each ExecCommandResult (`withheld_env`) by name only.
     */
    readonly credentialEnvScrub?: CredentialEnvScrubConfig | undefined;
    /**
     * Per-command exec sandbox wiring. When present AND active (gate on,
     * config enabled, host provides a boundary), each foreground command runs
     * inside a bwrap boundary and its result carries sandbox metadata. Omitted or
     * inactive → every command runs the unchanged non-sandboxed path.
     */
    readonly sandbox?: ExecSandboxRuntime | null | undefined;
    /**
     * PTY prompt-answer wiring. When present AND the host has a PTY backend,
     * prompt-prone / explicitly-interactive commands run under a PTY and
     * detected prompts ride the approval machinery through its seam. Omitted
     * or unavailable → every command runs the unchanged pipe-based path.
     */
    readonly interaction?: ExecInteractionRuntime | null | undefined;
    /**
     * Whether this composition REQUIRES the exec boundary (containment.ts).
     * Omitted ⇒ `host-allowed`: no boundary means the command runs on the host
     * with the self-labelling note, exactly as before. A hosted conversational
     * turn passes `required`, so an absent boundary refuses instead.
     */
    readonly containment?: ExecContainmentRequirement | null | undefined;
    /**
     * Whether commands that drive an existing tmux session the platform did not
     * create are refused (owner-terminal-guard.ts). Omitted ⇒ `off`, so every
     * existing caller is unchanged.
     */
    readonly ownerTerminal?: OwnerTerminalGuard | null | undefined;
}): Tool;
//# sourceMappingURL=runtime.d.ts.map