export type CodexHookTrustStatus = "managed" | "trusted" | "untrusted" | "modified";
export type CodexHookAuthorizationStatus = "runnable" | "review_required" | "disabled" | "not_wired" | "error";
export interface CodexHookAuthorizationResult {
    status: CodexHookAuthorizationStatus;
    detail: string;
    hookCount: number;
    disabledCount: number;
    trustCounts: Partial<Record<CodexHookTrustStatus, number>>;
}
export interface CodexHookAuthorizationProbeOptions {
    cwd: string;
    codexBin?: string;
    appServerArgs?: string[];
    env?: NodeJS.ProcessEnv;
    timeoutMs?: number;
}
/**
 * Convert Codex app-server's `hooks/list` response into the one authorization
 * state doctor needs. This is intentionally read-only: hashes are observed but
 * never persisted, and only commands containing Harnery's `agent-hook` binary
 * are included in the result.
 */
export declare function assessCodexHookList(response: unknown, cwd: string): CodexHookAuthorizationResult;
/**
 * Ask the active Codex CLI for hook authorization through its app-server
 * protocol. The child is closed as soon as `hooks/list` responds. Harnery never
 * calls the trust-write method and never reads Codex's private config format.
 */
export declare function probeCodexHookAuthorization(options: CodexHookAuthorizationProbeOptions): Promise<CodexHookAuthorizationResult>;
//# sourceMappingURL=codex-authorization.d.ts.map