import type { SandboxConfig, SandboxDockerConfig } from "./types.js";
/**
 * A machine without Docker must not be able to kill the gateway.
 *
 * This only ever listened for "close". When `docker` isn't on PATH the spawn
 * fails asynchronously on the child's "error" event instead, and an "error"
 * with no listener is an uncaught exception — so the ENOENT took the whole
 * gateway process down, the supervisor restarted it seconds later, and the
 * user saw the terminal drop into "reconnecting". With `sandbox.mode: all`
 * that happened on EVERY request, because resolving the sandbox context is
 * the first thing a run does. Found on a user's machine, where "hey koi,
 * what's 2+2?" crashed the gateway four times in one afternoon (LV-157).
 *
 * A failed spawn is now an ordinary rejection, which the run reports as a
 * turn error the way it reports any other tool failure. ENOENT gets a message
 * that names the actual problem, since "spawn docker ENOENT" tells a user
 * nothing about what to do next.
 */
export declare function execDocker(args: string[], opts?: {
    allowFailure?: boolean;
}): Promise<{
    stdout: string;
    stderr: string;
    code: number;
}>;
/** Turn a spawn failure into something a user can act on. */
export declare function describeDockerSpawnFailure(error: unknown): Error;
export declare function readDockerPort(containerName: string, port: number): Promise<number | null>;
export declare function ensureDockerImage(image: string): Promise<void>;
export declare function dockerContainerState(name: string): Promise<{
    exists: boolean;
    running: boolean;
}>;
export declare function buildSandboxCreateArgs(params: {
    name: string;
    cfg: SandboxDockerConfig;
    scopeKey: string;
    createdAtMs?: number;
    labels?: Record<string, string>;
    configHash?: string;
}): string[];
export declare function ensureSandboxContainer(params: {
    sessionKey: string;
    workspaceDir: string;
    koiWorkspaceDir: string;
    cfg: SandboxConfig;
}): Promise<string>;