export type SandboxProfile = "readonly" | "workspace-write" | "network" | "unrestricted-local-dev";
export interface SandboxDeclaration {
    readonly profile: SandboxProfile;
    readonly cwdPolicy?: "skill-directory" | "workspace" | "custom";
    readonly envAllowlist?: readonly string[];
    readonly network?: boolean;
    readonly writablePaths?: readonly string[];
}
export type SandboxAdmissionDecision = {
    readonly status: "allow";
    readonly reasons: readonly string[];
} | {
    readonly status: "approval_required";
    readonly reasons: readonly string[];
} | {
    readonly status: "deny";
    readonly reasons: readonly string[];
};
export declare function normalizeSandboxDeclaration(sandbox: SandboxDeclaration | undefined): RequiredSandboxDeclaration;
export interface RequiredSandboxDeclaration {
    readonly profile: SandboxProfile;
    readonly cwdPolicy: "skill-directory" | "workspace" | "custom";
    readonly envAllowlist?: readonly string[];
    readonly network: boolean;
    readonly writablePaths: readonly string[];
}
export declare function sandboxRequiresApproval(sandbox: SandboxDeclaration | undefined): boolean;
export declare function admitSandbox(sandbox: SandboxDeclaration | undefined, options?: {
    readonly approvedEscalation?: boolean;
    readonly skipEscalation?: boolean;
}): SandboxAdmissionDecision;