export type CallToolFn = (server: string, tool: string, args: Record<string, unknown>) => Promise<string>;
/** Wrap a real callTool so each invocation raises `mcp::call` and calls the
 *  underlying tool ONLY on an explicit approve. Runs inside a fresh resumable
 *  scope so agency.interrupt always has a Runner-seeded frame. FAIL-CLOSED:
 *  reject, propagate (no handler), or any non-approve outcome blocks the call.
 *  In the agent cliPolicyHandler is always installed and resolves approve or
 *  reject; the fail-closed default guards reuse outside that wiring and the
 *  --print path. */
export declare function gate(realCallTool: CallToolFn): CallToolFn;