import type { ExecutionEnv } from "../../internal/harness.js";
import type { ToolEffect } from "../types.js";
import { type ToolPolicy } from "../tool-policy.js";
import type { SessionPermissionRules } from "../session-policy-store.js";
/** Path-segment-aware containment, FAMILY-AWARE ([K-PLATFORM-SWEEP] MAJOR#2: canonical keys are
 *  backslash-form on a win32 env — the "/"-hardcoded suffix rejected every legitimate write there).
 *  Compare in "/" form with drive-letter case folded; never keyed on process.platform (the env may be
 *  remote and of the OTHER family than the host). */
export declare function isWithin(root: string, p: string): boolean;
/**
 * Build the per-session deny-narrowing policy. For each tool call:
 *  - `toolDeny` → deny the listed tools.
 *  - `toolAllow` (if set) → deny any tool NOT listed (a narrowing allowlist).
 *  - `commandAllow`/`commandDeny` → delegate to {@link createCoarseCommandNamePolicy} (argv[0] names; only
 *    speaks about shell tools). allowlist mode denies the un-listed/un-parseable; blocklist mode asks on the
 *    un-parseable bypass surface (the gate decides).
 *  - `allowDirs` (if set) → a WRITE tool must land inside one of the dirs (resolved via `canonicalizeTarget`,
 *    so a symlink can't smuggle a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
 *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
 * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + cwd, so
 * matching sees the actual filesystem (a remote/E2B task resolves in its container).
 */
export declare function createSessionRulePolicy(rules: SessionPermissionRules, opts: {
    env: ExecutionEnv;
    rootPath?: string;
    toolEffects?: ReadonlyMap<string, ToolEffect>;
}): ToolPolicy;
//# sourceMappingURL=session-rule-policy.d.ts.map