/**
 * Bug-Box Filesystem Isolation
 *
 * Creates a structured temp directory with restrictive permissions.
 * Layout:
 *   bugbox-XXXXX/
 *   ├── files/       — Read-only source snapshot (locked after population)
 *   ├── workspace/   — Read-write CWD for the replayed process
 *   └── logs/        — Read-write stdout/stderr capture
 *
 * Permissions:
 *   Linux/macOS: chmod 0700 (owner-only)
 *   Windows:     icacls inheritance removal + current-user-only grant
 */
export interface IsolatedDirResult {
    /** Root of the entire Bug-Box sandbox */
    rootDir: string;
    /** Read-only directory for captured source files */
    filesDir: string;
    /** Read-write working directory (the replayed process CWD) */
    workspaceDir: string;
    /** Read-write directory for stdout/stderr log capture */
    logsDir: string;
}
/**
 * Creates a new isolated directory structure with restrictive permissions.
 * Works on Linux, macOS, and Windows without requiring root/admin.
 */
export declare function createIsolatedDir(): IsolatedDirResult;
/**
 * Locks a directory to read-only.
 * Used after populating filesDir with the source snapshot,
 * so the replayed process cannot modify captured files.
 *
 * Linux/macOS: removes write bit (chmod a-w recursively).
 * Windows: uses icacls to deny write permissions for the current user.
 */
export declare function lockDirReadOnly(dirPath: string): void;
/**
 * Restores write permissions on a directory that was previously locked.
 * Must be called before cleanup if lockDirReadOnly was used.
 */
export declare function unlockDir(dirPath: string): void;
/**
 * Removes the entire isolated directory.
 * Handles read-only files by unlocking first.
 * Never throws — best-effort cleanup with retries on Windows.
 */
export declare function cleanupIsolatedDir(result: IsolatedDirResult): void;
//# sourceMappingURL=filesystem.d.ts.map