export declare function setScanToolOutputs(on: boolean): void;
import type { PermissionRules } from '../config.js';
/**
 * Hook que el REPL inyecta para que el tool `Task` (sub-agente) use el mismo
 * SqAgent / auth / config sin tener que pasar el mundo entero al executor.
 * Si no está, `Task` devuelve un error.
 */
export type SubAgentRunner = (description: string, prompt: string, subagentType?: string, model?: string) => Promise<string>;
export declare function setSubAgentRunner(fn: SubAgentRunner | null): void;
/**
 * Hook que el REPL inyecta para que `AskUserQuestion` pregunte interactivo.
 */
export type UserQuestioner = (question: string, options: Array<{
    label: string;
    description?: string;
}>, multiSelect: boolean) => Promise<string>;
export declare function setUserQuestioner(fn: UserQuestioner | null): void;
/**
 * Hook para `ExitPlanMode`. El REPL pinta el plan, pregunta y/n al usuario, y
 * si acepta cambia el modo a `accept-edits`. Devuelve true/false.
 */
export type PlanApprover = (plan: string) => Promise<boolean>;
export declare function setPlanApprover(fn: PlanApprover | null): void;
export declare const DANGEROUS_TOOLS: string[];
export type PermissionMode = 'default' | 'accept-edits' | 'plan' | 'bypass' | 'auto' | 'yolo';
export interface ToolExecOpts {
    cwd: string;
    /**
     * Modo de operación del agente:
     *   - default: pregunta antes de Bash/Write/Edit/NotebookEdit
     *   - accept-edits: auto-aprueba Write/Edit/NotebookEdit, pregunta Bash
     *   - plan: solo-lectura (bloquea Write/Edit/Bash/NotebookEdit)
     *   - bypass (alias yolo/auto): aprueba todo sin preguntar
     */
    permissions: PermissionMode;
    /** Reglas granulares (allow/deny) del sq.toml o runtime. */
    rules?: PermissionRules;
    /** Sandbox Docker para Bash. Si está, los comandos corren dentro del container. */
    sandbox?: {
        enabled: boolean;
        image: string;
    };
    askPermission?: (toolName: string, input: Record<string, unknown>) => Promise<{
        approved: boolean;
        explanation?: string;
    }>;
    /** If true, skip the permission gate entirely — the caller has already
     *  resolved it (e.g. via `resolveToolPermission`) and is about to run
     *  the tool. Prevents the prompt from appearing twice. */
    preApproved?: boolean;
}
/**
 * Decide whether a tool call is allowed, denied or needs to prompt the
 * user — WITHOUT running the tool itself. Exposed so the agent can call
 * this BEFORE emitting `tool_start`, otherwise the scrollback shows the
 * "▸ Edit foo.ts" line before the user has had a chance to answer the
 * picker, and it looks like the edit already happened.
 */
export declare function resolveToolPermission(name: string, input: Record<string, unknown>, opts: ToolExecOpts): Promise<{
    allowed: true;
} | {
    allowed: false;
    message: string;
}>;
export declare function executeTool(name: string, input: Record<string, unknown>, opts: ToolExecOpts): Promise<string>;
//# sourceMappingURL=executor.d.ts.map