/**
 * A read-only permission policy wrapper.
 *
 * Wraps an existing `PermissionPolicy` and, when the session-level
 * `readOnly` flag is set in `ctx.meta['readOnly']`, denies any tool that
 * carries a mutation capability (write, delete, shell, install, etc.) —
 * unless the tool is writing a `.md` report file under the project's
 * `.temp_files/` directory, which is the sole write operation allowed
 * in read-only mode.
 *
 * The wrapper is a no-op pass-through when `ctx.meta['readOnly']` is
 * not set or is `false`. It can be permanently installed around the
 * `DefaultPermissionPolicy`; the session toggle controls activation.
 *
 * Session-level toggle (set `ctx.meta['readOnly'] = true/false`):
 * ```ts
 * agent.ctx.meta['readOnly'] = true;  // enable
 * agent.ctx.meta['readOnly'] = false; // disable
 * ```
 *
 * This is designed for the leader agent. Subagents independently inherit
 * read-only constraints through `AutoApprovePermissionPolicy` with a
 * read-only capability allowlist.
 *
 * Usage:
 * ```ts
 * const policy = new ReadOnlyPermissionPolicy(innerPolicy, projectRoot);
 * container.rebind(TOKENS.PermissionPolicy, () => policy);
 * ```
 */
import type { Context } from '../core/context.js';
import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
import type { Tool } from '../types/tool.js';
/**
 * Read-only permission policy — session-scoped toggle via ctx.meta['readOnly'].
 *
 * Wraps an inner policy and, when `ctx.meta['readOnly'] === true`, denies
 * mutation-capable tools unless they target `.temp_files/*.md`. When the
 * flag is not set or false, the wrapper is a transparent pass-through.
 *
 * Read-only tools (fs.read, net.outbound, memory.read, …) always pass
 * through to the inner policy unchanged.
 */
export declare class ReadOnlyPermissionPolicy implements PermissionPolicy {
    private readonly inner;
    private readonly projectRoot;
    constructor(inner: PermissionPolicy, projectRoot: string);
    evaluate(tool: Tool, input: unknown, ctx: Context): Promise<PermissionDecision>;
    trust(rule: {
        tool: string;
        pattern: string;
    }): Promise<void>;
    deny(rule: {
        tool: string;
        pattern: string;
    }): Promise<void>;
    denyOnce(rule: {
        tool: string;
        pattern: string;
    }): void;
    allowOnce(rule: {
        tool: string;
        pattern: string;
    }): void;
    reload(): Promise<void>;
    explain(tool: Tool, input: unknown, ctx: Context): Promise<PermissionTrace>;
}
//# sourceMappingURL=readonly-permission-policy.d.ts.map