import type { ResolvedSandboxPolicy, SandboxAudit, SandboxAvailability, SandboxProvider } from "#src/sandbox/types";
export interface OrchestrateSandboxInput {
    policy: ResolvedSandboxPolicy;
    /** Security-relevant policy errors from resolution (task 2.3). */
    policyErrors: string[];
    /** The complete inner command (cd + redirectEnv + harness command). */
    command: string;
    provider: SandboxProvider;
    /** Cached provider availability (probed once per process). */
    availability?: SandboxAvailability;
    agentId: string;
    parentSessionId?: string;
    runtimeDir: string;
    effectiveProjectDir: string;
    realHome: string;
    parentEnv: NodeJS.ProcessEnv;
    harnessExecutableDir?: string;
    /** Effective harness config/session write root (mandatory plane). */
    harnessConfigWriteRoot?: string;
    /** Hermes real-state write consequence, when applicable. */
    harnessWriteExposure?: string;
    uid?: number;
}
export type OrchestrateSandboxResult = {
    kind: "unchanged";
} | {
    kind: "enforce";
    command: string;
    audit: SandboxAudit;
    ownedPaths: string[];
    diagnostics: string[];
} | {
    kind: "degrade";
    command: string;
    audit: SandboxAudit;
    ownedPaths: string[];
    diagnostics: string[];
} | {
    kind: "refuse";
    reason: string;
    diagnostics: string[];
};
/**
 * Orchestrate the sandbox launch for one spawn. Never throws for an ordinary
 * refusal — returns `{ kind: "refuse" }` so the spawner fails before window
 * creation. Allocated short-temp is cleaned up internally on any error path
 * BEFORE a record exists.
 */
export declare function orchestrateSandboxLaunch(input: OrchestrateSandboxInput): Promise<OrchestrateSandboxResult>;
/**
 * Keep refusal/degradation diagnostics useful without allowing a provider
 * exception to persist credential-like parent environment values. Provider
 * errors are also flattened and bounded so terminal/UI output stays terse.
 */
export declare function sanitizeSandboxReason(reason: string, parentEnv?: NodeJS.ProcessEnv): string;
//# sourceMappingURL=orchestrate.d.ts.map