import type { Sandbox, SandboxConfig, SandboxResult } from './types';
export declare class MacOSSandbox implements Sandbox {
    protected readonly logger: import("global-logger-factory").Logger<unknown>;
    isAvailable(): boolean;
    launch(config: SandboxConfig): SandboxResult;
    /**
     * Create a Seatbelt profile for the sandbox.
     *
     * Strategy: Allow most operations by default, then deny writes outside workdir.
     * This is more robust than deny-by-default which breaks many macOS subsystems.
     *
     * Profile:
     * - Allow default (reading, processes, etc.)
     * - Deny writes to root filesystem
     * - Allow writes only to: workdir, temp dirs, var/folders
     * - Optionally deny network
     */
    private createProfile;
}