import type { ExecutionEnv } from "../internal/harness.js";
import type { ToolPolicy } from "./tool-policy.js";
/**
 * Build a composable policy that DENIES writes (via the guarded fs tools) whose canonical target
 * lands on a sensitive path. `patterns` are deployment-supplied (no default list is shipped — the
 * set of escalation-vector paths is deployment-specific); an empty list is a no-op allow.
 *
 * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
 * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
 * `rootPath` is the raw tracked cwd a relative path resolves against (omit = paths resolve as given).
 *
 * Fail-open by design: a tool with no string `path`, or a path that cannot be canonicalized, returns
 * `allow` here — this guard adds a denial on top of the other gates, it is not the only line of
 * defense, and it must not turn an unrelated tool call into a spurious deny. The verdict it owns is
 * narrow and certain: "the real target IS a guarded path → deny".
 */
export declare function createSensitivePathPolicy(opts: {
    env: ExecutionEnv;
    patterns: string[];
    rootPath?: string;
    /** Override the guarded tool set (default: `Write`, `Edit`, `MultiEdit`-legacy → Edit). */
    tools?: string[];
}): ToolPolicy;
//# sourceMappingURL=sensitive-path-policy.d.ts.map