/**
 * What a run is allowed to touch, and whether the operating system is enforcing it.
 *
 * There are two layers here and they are not equally strong, which matters enough to say plainly
 * rather than bury. Path checks on KONECK's own file tools are certain: those tools are ours, and
 * a refusal there is a refusal. A shell command is a different matter — once `bash -c` is running
 * it can write anywhere the user can, and no amount of checking the command string changes that.
 * The only real answer for commands is the operating system, so on Linux they are run inside
 * bubblewrap where it is installed.
 *
 * Where no such facility exists — Windows, or a Linux box without bwrap — commands are not
 * confined at all, and this module says so rather than implying a protection that is not there.
 * A sandbox that is believed in but absent is worse than no sandbox, because it changes what
 * people are willing to run.
 */
export type { SandboxMode } from './sandbox-modes.js';
import type { SandboxMode } from './sandbox-modes.js';
export interface SandboxSpec {
    mode: SandboxMode;
    /** Absolute directories that may be written, in workspace-write. Empty in read-only. */
    writableRoots: string[];
}
/** How commands are confined on this machine, if at all. */
export type Confinement = 'bubblewrap' | 'none';
export { SANDBOX_MODES } from './sandbox-modes.js';
/**
 * Whether a real sandbox is available for shell commands.
 *
 * Probed once by running it, not by looking for the binary: bubblewrap is present but unusable on
 * plenty of systems — unprivileged user namespaces disabled, or a container that forbids nesting —
 * and finding that out when the first command fails would break the run instead of degrading.
 */
export declare function detectConfinement(platform?: string): Confinement;
/** Only for tests, which must be able to ask the question again. */
export declare function resetConfinementCache(): void;
export declare function resolveSandbox(mode: SandboxMode | undefined, cwd: string, extraDirs?: readonly string[]): SandboxSpec;
export interface PathVerdict {
    allowed: boolean;
    reason?: string;
}
/**
 * Whether a file tool may write to a path.
 *
 * Reads are not restricted. An agent that cannot read outside its workspace cannot look up the
 * library it is being asked to use, and confining reads buys little: the risk being managed here
 * is a run that damages something, not one that learns something.
 */
export declare function checkWrite(spec: SandboxSpec, absPath: string): PathVerdict;
/**
 * The command line that runs a shell command under confinement, or null for none.
 *
 * Everything is bound read-only, the writable roots are bound read-write over the top, and /tmp is
 * a fresh tmpfs. The network is left alone: an agent that cannot reach the network cannot install
 * a dependency, which is most of what it is asked to do, and cutting it off would make the mode
 * unusable rather than safe.
 */
export declare function confineCommand(spec: SandboxSpec, cwd: string, file: string, args: readonly string[], confinement?: Confinement): {
    file: string;
    args: string[];
} | null;
/** What the mode actually gives you here, said without overstating it. */
export declare function describeSandbox(spec: SandboxSpec, confinement?: Confinement): string;
//# sourceMappingURL=sandbox.d.ts.map