/**
 * Well-known tool capabilities used for authorization decisions.
 *
 * These are the preferred values for `Tool.capabilities`.
 * New capabilities should be added here with clear documentation.
 *
 * Philosophy (2026-06+):
 * - Prefer capabilities over exact tool name matching.
 * - Subagent guards and future policies should primarily key off capabilities.
 * - Name-based denylists are legacy and will be phased down.
 */
export declare const ToolCapabilities: {
    /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
    readonly SHELL_ARBITRARY: 'shell.arbitrary';
    /** Can execute a restricted set of commands (the `exec` tool). */
    readonly SHELL_RESTRICTED: 'shell.restricted';
    /** Can run a restricted project formatter/linter-style command. */
    readonly SHELL_EXEC: 'shell.exec';
    /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
    readonly FS_READ: 'fs.read';
    /** Can write / modify / delete files inside the project. */
    readonly FS_WRITE: 'fs.write';
    /** Can write files outside the current project root (very high risk). */
    readonly FS_WRITE_OUTSIDE_PROJECT: 'fs.write.outside-project';
    /** Can perform outbound network requests. */
    readonly NET_OUTBOUND: 'net.outbound';
    /** Can mutate in-memory session todos only. */
    readonly SESSION_TODO: 'session.todo';
    /** Can mutate in-memory session mode only. */
    readonly SESSION_MODE: 'session.mode';
    /** Can inspect registered tool metadata. */
    readonly TOOL_META: 'tool.meta';
    /** Can invoke arbitrary registered tools through a meta-tool. */
    readonly TOOL_MUTATE_ANY: 'tool.mutate.any';
    /** Can read persistent memory. */
    readonly MEMORY_READ: 'memory.read';
    /** Can write persistent memory. */
    readonly MEMORY_WRITE: 'memory.write';
    /** Can delete persistent memory. */
    readonly MEMORY_DELETE: 'memory.delete';
    /** Proxies tools from external MCP servers (unknown capability). */
    readonly MCP_PROXY: 'mcp.proxy';
    /** Can spawn or manage subagents / multi-agent tasks. */
    readonly SUBAGENT_SPAWN: 'subagent.spawn';
    /** Can inspect fleet/subagent coordination state without mutating it. */
    readonly COORDINATION_FLEET_READ: 'coordination.fleet.read';
    /** Can publish attributed, schema-checked events onto the fleet bus. */
    readonly COORDINATION_FLEET_EMIT: 'coordination.fleet.emit';
    /** Can submit a task-local structured result to the parent Director. */
    readonly COORDINATION_RESULT_SUBMIT: 'coordination.result.submit';
    /** Can read or write inter-agent mailbox messages. */
    readonly COORDINATION_MAIL: 'coordination.mail';
    /** Can schedule, inspect, or cancel in-session cron jobs. */
    readonly COORDINATION_CRON: 'coordination.cron';
    /** Can mutate global or session configuration / trust state. */
    readonly CONFIG_MUTATE: 'config.mutate';
    /** Can install packages or run package managers with side effects. */
    readonly PACKAGE_INSTALL: 'package.install';
};
export type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];
/**
 * Set of capabilities that are considered dangerous for subagents by default.
 * Subagents should not receive these capabilities unless the leader explicitly
 * allows the specific tool at spawn time.
 */
export declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
/**
 * Wide capability allowlist for subagents that the user has authorized to act
 * with full developer power (the CLI fleet host applies this to any subagent
 * that isn't given an explicit, narrower grant). It covers everything needed to
 * do real work end-to-end — read, write/edit inside the project, outbound
 * network, all shell/build/install capabilities, session todos, tool metadata, and read-only
 * memory lookup — so a delegated coding or build agent runs the same toolchain
 * the leader would, without per-tool confirmation it cannot answer.
 *
 * Deliberately EXCLUDED (require an explicit per-spawn `allowedCapabilities`
 * grant, because they escape the task's blast radius rather than perform it):
 *   - `fs.write.outside-project` — writing outside the repo (e.g. ~/.ssh).
 *   - `tool.mutate.any` — arbitrary meta-tool dispatch.
 *   - `memory.write` / `memory.delete` — persistent memory mutation.
 *   - `mcp.proxy` — third-party MCP tools (also hard-blocked by name).
 *   - `subagent.spawn` — recursive delegation (the baseline prompt forbids it).
 *   - `config.mutate` — rewriting trust/config is privilege escalation, not work.
 */
export declare const WIDE_SUBAGENT_CAPABILITIES: readonly ToolCapability[];
/**
 * Check if a tool (or its capabilities array) includes any dangerous capability
 * for subagent execution.
 */
export declare function hasDangerousCapabilityForSubagents(toolOrCaps: {
    capabilities?: readonly string[] | undefined;
} | readonly string[] | undefined): boolean;
/**
 * Check if a tool declares a specific capability (or any of the provided ones).
 */
export declare function hasCapability(toolOrCaps: {
    capabilities?: readonly string[] | undefined;
} | readonly string[] | undefined, capability: ToolCapability | ToolCapability[]): boolean;
/**
 * Returns the intersection of a tool's capabilities with the dangerous set.
 * Useful for logging and audit trails.
 */
export declare function getDangerousCapabilities(toolOrCaps: {
    capabilities?: readonly string[] | undefined;
} | readonly string[] | undefined): ToolCapability[];
//# sourceMappingURL=capabilities.d.ts.map