/**
 * What each mode is allowed to do, and which permissions have been granted standing.
 *
 * Modes used to be prompt prefixes and nothing more — "plan mode" asked the model nicely to plan
 * and then let it write files anyway. A mode that cannot stop an action is a suggestion, and the
 * point of choosing one is to decide what may happen without being asked each time.
 *
 * The opposite failure matters just as much. An agent exploring a project reads and lists dozens
 * of times in a minute; prompting for each would make the safe modes unusable and train anyone
 * using them to approve without reading. So reads are never gated, and a granted permission
 * sticks — by tool, or by command prefix, which is how "yes, npm is fine" is actually meant.
 */
export type Decision = 'allow' | 'ask' | 'deny';
/** What a tool does, which is what a policy can reason about. Names alone cannot be. */
export type ToolRisk = 'read' | 'write' | 'exec';
export type ModeName = 'auto' | 'edits' | 'careful' | 'plan';
export interface ModeSpec {
    name: ModeName;
    /** Shown in the status bar and the mode switcher. */
    label: string;
    /** One line saying what it will and will not do without asking. */
    blurb: string;
    policy: Record<ToolRisk, Decision>;
    /** Prepended to the task, where the mode also changes how the work should be approached. */
    prefix: string;
}
export declare const MODES: readonly ModeSpec[];
export declare function modeSpec(name: string): ModeSpec;
export declare function toolRisk(name: string): ToolRisk;
/** A standing permission: a whole tool, or commands beginning with a particular prefix. */
export interface AllowRule {
    tool: string;
    /** For execute_command: the command must start with this. */
    prefix?: string;
}
/**
 * The prefix to offer as a standing rule for a command, or '' if none should be offered.
 *
 * Two words, because that is the unit people actually mean: "npm install" and "npm test" are the
 * same decision to almost nobody, while "npm" alone hands over "npm publish" as well. A command
 * with one word offers that word.
 */
export declare function commandPrefixSuggestion(command: string): string;
/** Whether a granted rule covers this call. */
export declare function ruleMatches(rule: AllowRule, tool: string, argsJson: string): boolean;
/**
 * Whether a command only reads.
 *
 * A chained command is never trusted, however it starts: `ls | rm -rf .` begins with `ls`. The
 * same reasoning that keeps a granted prefix from covering a chain applies here, and for the same
 * reason — the check looks at the front of the line and the danger is at the back.
 */
export declare function isReadOnlyCommand(command: string): boolean;
/**
 * What should happen to one tool call: run it, ask, or refuse.
 *
 * A standing rule can turn an "ask" into an "allow", and never turns a "deny" into anything. Plan
 * mode means plan mode even if the same command was approved forever an hour ago.
 */
export declare function decide(mode: string, tool: string, argsJson: string, rules: readonly AllowRule[]): Decision;
/**
 * Standing permissions for this workspace.
 *
 * Per workspace rather than global: allowing `npm run` where you are working on a web app is not
 * a decision about every folder on the machine.
 */
export declare function loadRules(cwd: string): Promise<AllowRule[]>;
export declare function saveRules(cwd: string, rules: readonly AllowRule[]): Promise<void>;
/** Adds a rule, ignoring one that is already covered. */
export declare function addRule(rules: readonly AllowRule[], rule: AllowRule): AllowRule[];
/** How a granted rule reads back to the person who granted it. */
export declare function describeRule(rule: AllowRule): string;
//# sourceMappingURL=permissions.d.ts.map