export declare function isAutoApproveEnabled(): boolean;
/** True when auto-approve may actually fire (env on AND open-IM gate OK). */
export declare function isAutoApproveEffective(): boolean;
/**
 * Hot-apply composer / Settings「替我审批」.
 *
 * Turning ON also sets `AGIM_AUTO_APPROVE_OPEN_IM=1` — the UI toggle is the
 * explicit open-IM acknowledgement. Without that ack, `isAutoApproveEnabled`
 * can be true while `isAutoApproveEffective` stays false (IM messengers
 * configured, no strict allowlist), and Portal still gets approval cards
 * (incl. unconfined goal `agim_exec` countdown). Turning OFF clears both.
 */
export declare function applyAutoApprovePolicy(enabled: boolean): {
    enabled: boolean;
    effective: boolean;
};
export declare function isTimeoutDefaultAllow(): boolean;
export declare function announceTimeoutDefaultIfAllow(): void;
/** Stop the C1 hourly reminder. Used by graceful shutdown + tests. */
export declare function stopTimeoutDefaultReminder(): void;
/**
 * Tools whose contract is "read filesystem state, return it" — no writes,
 * no shell exec, no network. These short-circuit the approval flow with an
 * immediate `allow` and never reach the IM notifier. Saves the ~3–5s round
 * trip per call AND removes the noise of "🔐 Read /tmp/foo.txt y/n" cards
 * that LLMs spam during exploration.
 *
 * Conservative starting list — only tools whose name guarantees the
 * contract. Excluded on purpose:
 *  - `Bash` (cannot statically tell `cat` from `rm -rf /`)
 *  - `WebFetch` / `WebSearch` (outbound HTTP — leaks context, hits rate
 *    limits, has third-party side effects even if "readonly" locally)
 *  - any `mcp__*` (third-party MCP servers; arbitrary semantics)
 *
 * Per-thread opt-out: `/approval readonly off`. Global opt-out:
 * `AGIM_AUTOALLOW_READONLY=0`.
 */
export declare const READONLY_TOOLS: Set<string>;
export declare const READONLY_AUTO_ALLOW_GLOBAL_ENABLED: boolean;
//# sourceMappingURL=policy.d.ts.map