/**
 * Capability-worker resource guards — ADVISORY defense-in-depth, NOT a
 * containment boundary (plan 09 Phase 3, settled posture).
 *
 * In-process monkey-patching cannot be made sound in Node against malicious
 * code in the same isolate: a fresh `import('node:fs')` specifier variant,
 * `Reflect`-based prototype restoration, `worker_threads`, `vm`, or an
 * unpatched child process all recover original primitives, and Node documents
 * no in-process security boundary. The ENFORCED boundary is capability-pack
 * ADMISSION (operator trust + provenance binding in
 * `load-tool-capabilities.ts`); these patches are best-effort protection
 * against ACCIDENTAL overreach by operator-admitted code. True containment is
 * deferred to the process-level plugin-isolation roadmap.
 */
import type { CapabilityBridgeResourceDecision } from '@opensip-cli/core';
/**
 * Realpath-based containment (Task 3.4): a symlink inside the allowed root
 * must not escape it, so the logical `resolve()+startsWith` check is gone.
 * A path whose leaf does not exist yet (a pack creating a new file) is
 * checked at its deepest EXISTING ancestor — the not-yet-existing suffix
 * cannot contain a symlink, and `resolve()` already normalized `..` away.
 * Unresolvable paths fail closed, consistent with `isPathInside`'s contract.
 */
export declare function isCapabilityFilesystemPathAllowed(pathLike: unknown, roots: readonly string[]): boolean;
export declare function installCapabilityWorkerGuards(args: {
    readonly cwd: string;
    readonly packageDir: string;
    readonly resourceDecision: CapabilityBridgeResourceDecision;
}): void;
//# sourceMappingURL=guards.d.ts.map