/**
 * SkillShield — Runtime Monitor + Kill Switch
 *
 * Real-time monitoring of skill execution. Watches stdout/stderr
 * for threat patterns, tracks resource consumption, and kills the
 * process if anomalies are detected.
 *
 * This is the core differentiator: Snyk scans before install,
 * SkillShield watches DURING execution.
 */
import { ChildProcess } from 'child_process';
import { type ThreatCategory, type SeverityLevel } from '../guard/patterns.js';
export interface MonitorPolicy {
    /** Max execution time in ms (kill switch) */
    maxExecutionTime: number;
    /** Max memory in MB (kill switch) */
    maxMemoryMB: number;
    /** Max output size in bytes (prevent output flooding) */
    maxOutputBytes: number;
    /** Severity threshold to trigger kill (CRITICAL = kill immediately) */
    killOnSeverity: SeverityLevel;
    /** Re-scan output for threats in real-time */
    enableOutputScanning: boolean;
    /** Max violations before kill */
    maxViolations: number;
    /** Categories that trigger immediate kill */
    criticalCategories: ThreatCategory[];
}
export interface RuntimeEvent {
    timestamp: string;
    type: 'STDOUT' | 'STDERR' | 'THREAT_DETECTED' | 'RESOURCE_LIMIT' | 'KILL_SWITCH' | 'ANOMALY' | 'EXIT';
    severity: SeverityLevel;
    details: string;
    data?: unknown;
}
export interface MonitorReport {
    startTime: string;
    endTime?: string;
    durationMs: number;
    events: RuntimeEvent[];
    threatsDetected: number;
    killed: boolean;
    killReason?: string;
    resourceUsage: {
        peakMemoryMB: number;
        totalOutputBytes: number;
        cpuTimeMs: number;
    };
}
export declare class RuntimeMonitor {
    private policy;
    private events;
    private startTime;
    private outputBytes;
    private threatsDetected;
    private killed;
    private killReason?;
    private process?;
    private killTimer?;
    private memoryCheckInterval?;
    /** Subset of patterns optimized for real-time output scanning */
    private runtimePatterns;
    constructor(policy: MonitorPolicy);
    /**
     * Attach the monitor to a running child process.
     */
    attach(childProcess: ChildProcess): void;
    /**
     * Process output from the skill and check for threats.
     */
    private onOutput;
    /**
     * Scan skill output for threat patterns in real-time.
     * This catches skills that generate malicious output (e.g., writing
     * shell commands to stdout that another tool might execute).
     */
    private scanOutput;
    /**
     * Check process memory usage.
     */
    private checkMemory;
    /**
     * Kill the child process — the kill switch.
     */
    killProcess(reason: string, details: string): void;
    /**
     * Clean up timers and intervals.
     */
    private cleanup;
    /**
     * Compare severity levels. Returns positive if a >= b.
     */
    private compareSeverity;
    private recordEvent;
    /**
     * Generate the final monitoring report.
     */
    getReport(): MonitorReport;
    isKilled(): boolean;
    getEventCount(): number;
}
/**
 * Default monitor policy — strict but reasonable for developer use.
 */
export declare function getDefaultMonitorPolicy(): MonitorPolicy;
//# sourceMappingURL=runtime-monitor.d.ts.map