import type { PermissionMode } from "../../permissions/index.js";
import type { ProjectConfigPlaceholder } from "./prepareProjectConfigPlaceholder.js";
export interface SandboxedCommand {
    args?: readonly string[];
    command: string;
    projectConfigPlaceholder?: ProjectConfigPlaceholder;
    protectedCreatePaths?: readonly string[];
}
export declare function createSandboxedCommand(options: {
    /**
     * Run this exact argument vector instead of a shell command. Background readers use it so they
     * never build a shell string and never source the user's login profile.
     */
    argv?: readonly string[];
    /**
     * Writable space this command is granted beyond its workspace, and the whole filesystem when
     * `filesystemFullAccess` is set. Read only ignores both, because a mode that withholds the
     * workspace cannot be talked into handing over more than it.
     */
    additionalWritablePaths?: readonly string[];
    /**
     * Writable even when it sits inside a protected path, for a caller whose own folder is nested
     * under something it must not otherwise touch.
     */
    alwaysWritablePaths?: readonly string[];
    /** Whether the sandboxed process may create child processes. Defaults to true. */
    allowSubprocesses?: boolean;
    command: string;
    commandCwd?: string;
    cwd: string;
    filesystemFullAccess?: boolean;
    mode: PermissionMode;
    networkAllowLocalBinding?: boolean;
    networkAllowedLoopbackPorts?: readonly number[];
    /** Unrestricted egress, for a command whose declared permissions ask for exactly that. */
    networkFullAccess?: boolean;
    networkUnixProxySockets?: {
        authenticationToken: string;
        http: string;
        loopback?: readonly {
            path: string;
            port: number;
        }[];
        socks: string;
    };
    path?: string;
    /**
     * Protects project configuration and metadata inside `cwd`. Defaults to true. Callers whose
     * working directory is application-owned data rather than a project may disable it.
     */
    protectProjectMetadata?: boolean;
    protectedPaths?: readonly string[];
    shell: string;
    /** Writable temporary directory visible to this process instead of the host's shared one. */
    temporaryDirectory?: string;
    /**
     * Exact Unix sockets this command may connect to, whatever its writable space is.
     *
     * A sandboxed command can otherwise only reach a socket it created inside its own workspace.
     * This grants one named socket outside that scope — a worklet reaching Rig's own private API —
     * without widening what the command may read or write anywhere else.
     */
    unixSocketPaths?: readonly string[];
}): Promise<SandboxedCommand>;