/**
 * Extension Security Module
 *
 *  Plugin security and sandboxing.
 * Provides path safety checks, permission validation, and allowlist management.
 */
export type ExtensionSourceOrigin = 'workspace' | 'global' | 'bundled' | 'config';
export interface SafetyCheckResult {
    safe: boolean;
    reason?: 'world_writable' | 'ownership_mismatch' | 'symlink_escape' | 'hardlink' | 'stat_failed';
    detail?: string;
}
export interface SecurityConfig {
    /** Enable security checks */
    checkPermissions: boolean;
    /** Allow loading untrusted extensions (not in allowlist) */
    allowUntrusted: boolean;
    /** List of allowed extension IDs */
    allow: string[];
    /** Enable provenance tracking */
    trackProvenance: boolean;
    /** Allow extensions to inject content into system prompts */
    allowPromptInjection: boolean;
}
export declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
/**
 * Check if a path is safe for extension loading.
 * - Rejects world-writable directories (mode & 0o002)
 * - Verifies file ownership (UID match)
 * - Detects symlink escape (realpath outside root)
 * - Rejects hardlinks to non-bundled files
 */
export declare function checkExtensionPathSafety(sourcePath: string, rootDir: string, origin: ExtensionSourceOrigin): SafetyCheckResult;
/**
 * Check all files in an extension directory recursively
 */
export declare function checkExtensionDirSafety(extensionDir: string, rootDir: string, origin: ExtensionSourceOrigin): {
    safe: boolean;
    issues: SafetyCheckResult[];
};
/**
 * Check if an extension is allowed by the allowlist
 */
export declare function isExtensionAllowed(extensionId: string, config: SecurityConfig): boolean;
export interface ProvenanceInfo {
    extensionId: string;
    source: ExtensionSourceOrigin;
    installMethod?: 'manual' | 'npm' | 'git' | 'download' | 'unknown';
    installDate?: Date;
    checksum?: string;
}
/**
 * Simple provenance tracking (in-memory for now)
 */
declare class ProvenanceTracker {
    private provenance;
    track(extensionId: string, source: ExtensionSourceOrigin, method?: string): void;
    get(extensionId: string): ProvenanceInfo | undefined;
    getAll(): ProvenanceInfo[];
}
export declare const provenanceTracker: ProvenanceTracker;
export declare function logSecurityIssue(extensionId: string, result: SafetyCheckResult): void;
export {};