/**
 * Host-neutral sandbox provider seam (subagent-os-sandbox D3/D10).
 *
 * Core resolves policy, derives paths, and builds the scrubbed environment;
 * a SandboxProvider turns that into one launchable command plus redacted
 * enforcement facts. Nothing in this module may import srt or pi packages —
 * the only srt runtime import lives under `src/child/**` (the per-agent
 * launcher process).
 */
/** What to do when the sandbox is requested but the provider is unavailable. */
export type SandboxOnUnavailable = "refuse-spawn" | "warn-and-spawn";
/** Network policy default: `allow` = host network, `deny` = strict allowlist. */
export type SandboxNetworkDefault = "allow" | "deny";
/** Actually-enforced network boundary shape. */
export type SandboxNetworkMode = "host" | "isolated-proxy";
/** Canonical filesystem policy arrays (user-facing vocabulary). */
export interface SandboxFilesystemPolicy {
    /** Narrow re-allow inside a denied region — NOT a global read allowlist. */
    read: string[];
    write: string[];
    denyRead: string[];
    denyWrite: string[];
}
export interface SandboxNetworkPolicy {
    default: SandboxNetworkDefault;
    allow: string[];
    deny: string[];
}
/**
 * Fully resolved sandbox policy for one spawn (hardcoded ← global ← role).
 * `envAllowlistExtra` carries variable NAMES only — never values.
 */
export interface ResolvedSandboxPolicy {
    enabled: boolean;
    onUnavailable: SandboxOnUnavailable;
    envAllowlistExtra: string[];
    filesystem: SandboxFilesystemPolicy;
    network: SandboxNetworkPolicy;
}
/** A set of absolute, canonicalized paths grouped by access class. */
export interface SandboxPathSet {
    read: string[];
    write: string[];
    denyRead: string[];
    denyWrite: string[];
}
export declare function emptyPathSet(): SandboxPathSet;
/** Cached result of the provider's one-per-process capability probe. */
export interface SandboxAvailability {
    available: boolean;
    /** Sanitized human-readable reason when unavailable. */
    reason?: string;
    providerVersion?: string;
    /** Individual capability facts (diagnostic only — never a partial tier). */
    features?: Record<string, boolean>;
}
/**
 * Everything a provider needs to wrap one launch. All values are in-memory
 * only; env VALUES must never be logged or persisted by the provider.
 */
export interface SandboxLaunchInput {
    /** The complete inner child command (cd + redirectEnv + harness command). */
    command: string;
    policy: ResolvedSandboxPolicy;
    /** Scrubbed launch environment (baseline + extras), applied via `env -i`. */
    env: Record<string, string>;
    /** Effective project/worktree directory the INNER command cds into. */
    cwd: string;
    /** Owned per-agent runtime dir (layer-A anchored). */
    runtimeDir: string;
    /** Owned short temp dir (srt mux sockets live below TMPDIR). */
    shortTmpDir: string;
    /** Mandatory plane: security denies + runtime/config/temp grants. */
    mandatoryPaths: SandboxPathSet;
    /** User plane: canonical read/write/deny arrays, expanded+canonicalized. */
    userPaths: SandboxPathSet;
    /** Disclosed real-state write consequence (e.g. Hermes `~/.hermes`). */
    harnessWriteExposure?: string;
    agentId: string;
    parentSessionId?: string;
}
/**
 * Write-once enforcement audit persisted on the subagent record (D10).
 * Redacted by construction: requested policy carries env names only; no env
 * value, token, auth-file content, or proxy credential may appear here.
 */
export interface SandboxAudit {
    status: "enforced" | "degraded";
    requested: ResolvedSandboxPolicy;
    providerId?: string;
    providerVersion?: string;
    /** Enforced canonical absolute paths (not the user's spelling). */
    effectivePaths?: SandboxPathSet;
    networkMode?: SandboxNetworkMode;
    afUnixBlocked?: boolean;
    harnessWriteExposure?: string;
    shortTmpDir?: string;
    /** Sanitized degradation reason (degraded records only). */
    reason?: string;
}
/** Audit shape a successful prepareLaunch must return. */
export type EnforcedSandboxAudit = SandboxAudit & {
    status: "enforced";
};
/** One launchable command plus its enforcement facts and cleanup scope. */
export interface SandboxLaunchPlan {
    /** Complete outer command handed to tmux (env -i … node launcher …). */
    command: string;
    audit: EnforcedSandboxAudit;
    /** Provider-owned paths the existing validated cleanup may remove. */
    ownedPaths: string[];
}
/**
 * The provider seam. `probe()` is cached per process by the caller; a later
 * per-spawn `prepareLaunch` failure is still handled as unavailable.
 */
export interface SandboxProvider {
    readonly id: string;
    probe(): Promise<SandboxAvailability>;
    prepareLaunch(input: SandboxLaunchInput): Promise<SandboxLaunchPlan>;
}
//# sourceMappingURL=types.d.ts.map