export interface SecurityGuardrails {
    readOnly?: boolean;
    requireConfirmation?: string[];
    blockedTools?: string[];
}
/** Well-known read-only tools that are always safe */
export declare const READ_ONLY_TOOLS: Set<string>;
/** Well-known write tools (used when readOnly mode is active) */
export declare const WRITE_TOOLS: Set<string>;
/**
 * Match a tool name against glob patterns (supports `*` wildcard).
 * Slack and Pinet dispatcher actions use `<namespace>:<action>` names; legacy
 * `<namespace>_<action>` guardrail patterns still match during migration. Pinet
 * direct tools are no longer registered, but keeping alias matching prevents old
 * security configs from silently failing open.
 * Returns true if the tool name matches any of the patterns.
 */
export declare function matchesToolPattern(toolName: string, patterns: string[]): boolean;
/**
 * Check if a tool is blocked by the guardrails.
 * Returns true if:
 * - tool matches any blockedTools pattern
 * - guardrails.readOnly is true AND tool is in WRITE_TOOLS
 */
export declare function isToolBlocked(toolName: string, guardrails: SecurityGuardrails): boolean;
/**
 * Check if a tool needs confirmation.
 * Returns true if tool matches any requireConfirmation pattern.
 * Returns false if tool is already blocked (blocked takes priority).
 */
export declare function toolNeedsConfirmation(toolName: string, guardrails: SecurityGuardrails): boolean;
/**
 * Build security instructions to prepend to Slack-triggered messages.
 * Returns a clear, structured prompt with active guardrails.
 * Returns empty string if no guardrails are active.
 */
export declare function hasEffectivelyEmptyRuntimeGuardrails(guardrails: SecurityGuardrails | null | undefined): boolean;
export declare function formatRuntimeGuardrailsPosture(guardrails: SecurityGuardrails | null | undefined): string;
export declare function getEmptyRuntimeGuardrailsWarning(guardrails: SecurityGuardrails | null | undefined): string | null;
export declare function buildSecurityPrompt(guardrails: SecurityGuardrails): string;
/**
 * Tools that the broker agent must NEVER use.
 * The broker is infrastructure — it coordinates, not codes.
 * Spawning local subagents (Agent) is forbidden because they
 * have no Slack/Pinet connectivity and can't be monitored.
 * Direct file mutation tools are also blocked so the runtime
 * enforces the coordination-only role even if prompt guidance drifts.
 */
export declare const BROKER_FORBIDDEN_TOOLS: Set<string>;
/**
 * Check if a tool is forbidden for the broker role.
 * Returns true if the broker must not use this tool.
 */
export declare function isBrokerForbiddenTool(toolName: string): boolean;
/**
 * Build a prompt snippet describing broker tool restrictions.
 * Injected into the system prompt when the broker role is active.
 */
export declare function buildBrokerToolGuardrailsPrompt(): string;
/**
 * Parse whether a user message is approving a confirmation request.
 * Case-insensitive, trimmed.
 */
export declare function isConfirmationApproval(text: string): boolean;
/**
 * Parse whether a user message is rejecting a confirmation request.
 * Case-insensitive, trimmed.
 */
export declare function isConfirmationRejection(text: string): boolean;