import type { AgentTool } from "@catui/agent-core";
import { type Static } from "@sinclair/typebox";
import { type TruncationResult } from "./truncate.js";
interface BackgroundTask {
    id: string;
    outputPath: string;
    status: "running" | "completed" | "failed";
    exitCode: number | null;
    startTime: number;
    endTime?: number;
    pid?: number;
}
/** Get a background task by ID. */
export declare function getBackgroundTask(taskId: string): BackgroundTask | undefined;
/** List all background tasks. */
export declare function listBackgroundTasks(): BackgroundTask[];
/** Kill a background task's process tree. Returns true if task was found and killed. */
export declare function killBackgroundTask(taskId: string): boolean;
/** Read the output of a background task (if finished). */
export declare function readBackgroundTaskOutput(taskId: string): string | null;
declare const bashSchema: import("@sinclair/typebox").TObject<{
    command: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
    timeout: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
    description: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
    run_in_background: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
    task_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
}>;
export type BashToolInput = Static<typeof bashSchema>;
export interface BashToolDetails {
    truncation?: TruncationResult;
    fullOutputPath?: string;
}
/**
 * Result of a dangerous-command pattern check.
 * See ADR `.dev-docs/architecture-review/bash-pre-execution-approval-decision/ADR.md`.
 */
export interface DangerousCommandCheck {
    matched: boolean;
    /** Pattern label when matched, e.g. "shell command via -c/-lc flag". */
    reason?: string;
}
/**
 * Check whether `command` matches any DANGEROUS_PATTERNS entry.
 * Returns `{ matched, reason }` — `reason` is the human-readable pattern label.
 *
 * Pure function — no side effects, no I/O. Intended to be used by spawn
 * pre-hook (Layer 2) and by tests.
 */
export declare function isDangerousCommand(command: string): DangerousCommandCheck;
/**
 * Pluggable operations for the bash tool.
 * Override these to delegate command execution to remote systems (e.g., SSH).
 */
export interface BashOperations {
    /**
     * Execute a command and stream output.
     * @param command - The command to execute
     * @param cwd - Working directory
     * @param options - Execution options
     * @returns Promise resolving to exit code (null if killed)
     */
    exec: (command: string, cwd: string, options: {
        onData: (data: Buffer) => void;
        signal?: AbortSignal;
        timeout?: number;
        /**
         * How long to wait for the child process to finish reading from stdin
         * before forcibly closing it. Defaults to 30000 (30s).
         *
         * Background: previously `stdio[0]` was `"ignore"`, which made any
         * interactive command (`npm init`, `npx create-x`, `read -p`, etc.)
         * either fail with EOF immediately or hang forever. With `"pipe"`,
         * the child waits for stdin; this timeout prevents indefinite hangs
         * by closing stdin after the grace period, letting the command fall
         * back to its default behavior.
         *
         * See `.dev-docs/architecture-review/bash-stdin-pipe-decision/ADR.md`.
         */
        stdinTimeoutMs?: number;
        env?: NodeJS.ProcessEnv;
        onSpawn?: (pid: number) => void;
    }) => Promise<{
        exitCode: number | null;
        pid?: number;
    }>;
}
export interface BashSpawnContext {
    command: string;
    cwd: string;
    env: NodeJS.ProcessEnv;
}
export type BashSpawnHook = (context: BashSpawnContext) => BashSpawnContext;
export interface BashToolOptions {
    /** Custom operations for command execution. Default: local shell */
    operations?: BashOperations;
    /** Command prefix prepended to every command (e.g., "shopt -s expand_aliases" for alias support) */
    commandPrefix?: string;
    /** Hook to adjust command, cwd, or env before execution */
    spawnHook?: BashSpawnHook;
    /**
     * Layer 2: pre-execution approval client. When provided, dangerous
     * commands (see isDangerousCommand) will prompt the user before spawn.
     * When omitted, no approval gating happens — fast-path only.
     * See ADR .dev-docs/architecture-review/bash-pre-execution-approval-decision/ADR.md.
     */
    approval?: ApprovalClient;
    /**
     * Layer 2: skip approval gating entirely (for tests or non-interactive
     * modes). Defaults to false.
     */
    skipApproval?: boolean;
}
/**
 * Client injected into bash tool for pre-execution approval prompts.
 * `request()` should resolve to a user choice; if it rejects or times out,
 * the bash tool fails closed (treats as "deny").
 */
export interface ApprovalClient {
    request(decision: ApprovalDecision): Promise<ApprovalChoice>;
}
/**
 * Reducer of what we send to the approval client.
 */
export interface ApprovalDecision {
    command: string;
    description: string;
    reason: string;
}
export type ApprovalChoice = "once" | "session" | "always" | "deny";
export declare function createBashTool(cwd: string, options?: BashToolOptions): AgentTool<typeof bashSchema>;
/** Default bash tool using process.cwd() - for backwards compatibility */
export declare const bashTool: AgentTool<import("@sinclair/typebox").TObject<{
    command: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
    timeout: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
    description: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
    run_in_background: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
    task_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
}>, any>;
export interface BashSandboxOptions {
    /** Additional patterns to block (in addition to default blocked patterns) */
    additionalBlockedPatterns?: RegExp[];
    /** Custom error message for blocked commands */
    blockedMessage?: string;
    /** Optional path allowlist hook for simple write commands. Defaults to denying all writes. */
    allowWritePath?: (absolutePath: string) => boolean;
}
/**
 * Create a sandboxed bash hook that blocks dangerous write operations.
 * This is a defense-in-depth measure for read-only SubAgents.
 */
export declare function createSandboxHook(options?: BashSandboxOptions): BashSpawnHook;
export {};