export type ExecSandboxPosture = 'bwrap' | 'off' | 'unavailable';
export interface SecurityPosture {
    bwrapAvailable: boolean;
    execSandbox: ExecSandboxPosture;
    /** True when AGIM_NATIVE_FS_RESTRICT=1 (reads + writes workspace-confined). */
    fsRestrict: boolean;
    /** Writes confined (explicit =1, or unset while exec sandbox is on). */
    fsWriteRestrict: boolean;
    /** Explicit AGIM_NATIVE_FS_RESTRICT=0 (unconfine even though writes would follow exec). */
    fsUnconfineExplicit: boolean;
    autoApprove: boolean;
    autoApproveEffective: boolean;
}
export declare function getSecurityPosture(): SecurityPosture;
export declare function formatSecurityPostureLines(p?: SecurityPosture): string[];
/** Loud boot banner + structured log. Safe to call more than once. */
export declare function announceSecurityPosture(): void;
//# sourceMappingURL=security-posture.d.ts.map