import type { SandboxPathSet } from "#src/sandbox/types";
/** True when `child` equals `parent` or lives beneath it. */
export declare function isPathWithin(child: string, parent: string): boolean;
/**
 * Derive the Git metadata write roots required for real edit/add/commit in
 * `projectRoot` (task 4.6). Returns only roots OUTSIDE the project root —
 * a main checkout's `.git` already lives inside the granted project. A
 * non-git directory derives nothing. Never throws.
 */
export declare function deriveGitWritablePaths(projectRoot: string): string[];
export interface SandboxPathPlanInput {
    /** Expanded, canonical user plane (from `expandUserFilesystemPaths`). */
    expandedUser: SandboxPathSet;
    /** Owned per-agent runtime dir (mandatory write root). */
    runtimeDir: string;
    /** Owned short temp dir (mandatory write root). */
    shortTmpDir: string;
    /**
     * Effective harness configuration/session write root: the synthesized
     * config dir, the user's replace-mode target, or Hermes's real `~/.hermes`.
     */
    harnessConfigWriteRoot?: string;
    /** Effective project/worktree directory (canonical). */
    effectiveProjectDir: string;
    parentEnv?: NodeJS.ProcessEnv;
    realHome: string;
    uid?: number;
    /** Injectable for tests. */
    deriveMandatoryDenyRead?: () => string[];
    deriveGitPaths?: (projectRoot: string) => string[];
}
export interface SandboxPathPlan {
    userPaths: SandboxPathSet;
    mandatoryPaths: SandboxPathSet;
    /** Contradictions — an enabled spawn with errors SHALL be refused. */
    errors: string[];
    /** Shadowed grants / omitted redundant denies (audit-visible). */
    warnings: string[];
}
/** Assemble and classify both path planes for one spawn. */
export declare function planSandboxPaths(input: SandboxPathPlanInput): SandboxPathPlan;
//# sourceMappingURL=plan.d.ts.map