import { t as AgentPermissionPolicy } from "./schema-BXTTXvJl.cjs";
//#region src/confine.d.ts
/** What happens to a file tool call outside the roots: `ask` prompts (default mode `restricted`), `deny` refuses (default mode `readonly`). */
export type OutsideBehaviour = "ask" | "deny";
/** Inputs to {@link confine}. */
export interface ConfineOptions {
  /** Directories the file tools may reach. Relative entries resolve against `cwd`. */
  roots: readonly string[];
  /** The agent's working directory, which needs no `additionalDirectories` entry. */
  cwd: string;
  /** Behaviour outside the roots. Defaults to `ask`. */
  outside?: OutsideBehaviour;
}
/**
 * Generate a canonical policy that confines `Read`, `Edit` and `Write` to `options.roots`.
 *
 * Paths are normalised with `path.resolve` against `cwd`: made absolute, `.` and `..` segments collapsed, trailing separators removed, duplicates dropped. Tool inputs are matched as literal text, so a call whose path is relative or contains `..` is never allowed by the root rules.
 *
 * @throws Error if `roots` is empty.
 */
export declare function confine(options: ConfineOptions): AgentPermissionPolicy;
//#endregion
//# sourceMappingURL=confine.d.cts.map