/**
 * AiderAdapter -- Aider terminal AI pair-programmer adapter.
 *
 * Aider (https://aider.chat) is a terminal-based AI pair programmer with
 * full project access: it reads, edits and creates files, runs git commands,
 * executes shell commands via `/run`, and can auto-commit. This adapter
 * governs every programmable surface Aider exposes and is purpose-built for
 * the risks that surface brings.
 *
 * Unlike in-IDE adapters, Aider operates on the raw filesystem and git
 * working tree. The governance challenges are therefore different:
 *
 *   - Shell commands (`/run`) are arbitrary -- fork bombs, curl-pipe-sh,
 *     and rm -rf / are live threats, not hypotheticals.
 *   - File context (`/add`, repo-map) sends file contents to an LLM provider.
 *     If the added file contains a .env or private key, the secret is now
 *     transmitted to an external party.
 *   - Auto-commit writes to git history with no human gate unless governance
 *     intervenes.
 *   - Voice input (transcription) may contain PII; CI deployments must never
 *     accept interactive input.
 *   - CI mode (`aider-ci-mode`) removes the human-in-the-loop entirely;
 *     stricter rules apply unconditionally.
 *
 * Deployment modes:
 *   aider-cli-individual  -- single developer; interactive; moderate defaults.
 *   aider-cli-team        -- shared dev environment; secretScanFiles forced on.
 *   aider-ci-mode         -- CI/CD pipeline; no interactive surfaces; shell
 *                            commands always denied; voice always denied;
 *                            auto-commit requires explicit opt-in.
 *
 * Hook surfaces (10):
 *
 *   wrapChat(prompt)
 *     User prompt forwarded to the LLM. Audited; packBinding enforced.
 *
 *   wrapFileEdit(filePath, searchBlock, replaceBlock, affectedFileCount)
 *     Aider-proposed SEARCH/REPLACE edit applied to a tracked file.
 *     Central governance surface. `affectedFileCount` > `multiFileEditCap`
 *     denied with `aider-multi-file-edit-cap-exceeded`.
 *
 *   wrapFileAdd(filePath, content)
 *     Aider adds a file to its context (sent to LLM provider).
 *     Secret scan applied unless `secretScanFiles: false` (individual only).
 *     Denied with `aider-file-add-secret-detected` on finding.
 *     Path allowlist (`allowedFilePaths`) bypasses the scan.
 *
 *   wrapGitCommit(message, stagedFiles)
 *     Aider auto-commit gate. Denied unless `allowAutoCommit: true`.
 *     In `aider-ci-mode`: also requires `allowAutoCommit: true`; without it
 *     denied unconditionally.
 *
 *   wrapGitDiff(args)
 *     Aider runs git diff to understand changes. Audited; low risk. Always
 *     allowed unless packBinding is missing.
 *
 *   wrapShellCommand(command)
 *     Aider's `/run` surface. HIGH RISK.
 *     In `aider-ci-mode`: ALWAYS denied with `aider-shell-not-permitted-ci-mode`.
 *     In non-CI modes: requires `allowShellCommands: true`.
 *     Dangerous patterns always denied regardless of config (see below).
 *     If `allowedShellPrefixes` configured, commands not matching any prefix
 *     denied with `aider-shell-prefix-not-allowed`.
 *
 *   wrapTestRun(testCommand)
 *     Aider runs the project test suite. Audited.
 *
 *   wrapLintRun(lintCommand)
 *     Aider runs the linter. Audited.
 *
 *   wrapVoiceInput(transcribedText)
 *     Aider voice transcription. Denied unless `allowVoiceInput: true`.
 *     In `aider-ci-mode`: ALWAYS denied.
 *
 *   wrapRepomapBuild(repomapContent)
 *     Aider builds a repo-map (file structure + code summaries) sent to LLM.
 *     Enforces `repoMapMaxBytes` cap (default 64 KB).
 *     Scans for embedded sensitive-path references (.env, .aws/, id_rsa,
 *     keystore). Denied with `aider-repomap-sensitive-paths-detected` on find.
 *
 * Dangerous shell patterns (always denied, no bypass):
 *   rm -rf /  (root filesystem destruction)
 *   fork bomb  :(){ :|: & };:
 *   curl|sh, wget|sh  (arbitrary code execution)
 *   sudo rm  (privileged deletion)
 *   > /dev/sda  (disk overwrite)
 *   dd if=  (disk-level write)
 *   chmod 777  (world-write escalation)
 *   git push --force (destructive push)
 *   git reset --hard (destructive reset)
 *
 * CI-mode safeguards (the differentiators):
 *   - `allowShellCommands: true` rejected at construction in CI mode.
 *   - Shell commands denied unconditionally in CI mode.
 *   - Voice input denied unconditionally in CI mode.
 *   - `secretScanFiles: false` rejected at construction in CI/team mode.
 *
 * Secret scanning:
 *   File content scanned for: AWS access keys, GitHub PATs, Anthropic API keys,
 *   OpenAI API keys, private key headers, generic SECRET/PASSWORD/API_KEY env
 *   vars, database URLs with embedded credentials, Bearer tokens.
 *   Secrets are NEVER echoed in audit entries (sanitized before emission).
 *
 * Pen-tests:
 *   PT-ADAPT-AIDER-1: empty packBinding[] denied at every wrap call
 *   PT-ADAPT-AIDER-2: secrets in scanned content never echoed in audit entries
 *   PT-ADAPT-AIDER-3: malformed config throws at construction (invalid mode,
 *                      negative cap, secretScanFiles: false in team/CI)
 *   PT-ADAPT-AIDER-4: CI mode with allowShellCommands: true rejected at construction
 *   PT-ADAPT-AIDER-5: dangerous shell patterns denied with explicit reason codes
 *                      regardless of allowedShellPrefixes setting
 *   PT-ADAPT-AIDER-6: file add with .env-like content denied with
 *                      aider-file-add-secret-detected even if user added it manually
 *
 * Spec: P3-SUB-IDE-12
 *
 * @connexum/ai-governance
 */
import { BaseIdeAdapter } from './base';
import { type IdeAdapterConfig, type IdeAdapterCapabilities, type IdeSessionContext, type ToolInvocationContext, type ToolInvocationDecision, type UserIdentity } from './index';
/**
 * Aider deployment modes.
 *
 *   aider-cli-individual  -- interactive single-developer session (default).
 *   aider-cli-team        -- shared dev environment; stricter defaults.
 *   aider-ci-mode         -- CI/CD pipeline; no interactive surfaces allowed.
 */
export type AiderDeploymentMode = 'aider-cli-individual' | 'aider-cli-team' | 'aider-ci-mode';
export declare const AIDER_VALID_DEPLOYMENT_MODES: readonly AiderDeploymentMode[];
export interface AiderAdapterConfig extends IdeAdapterConfig {
    /**
     * Aider deployment context.
     * Default: 'aider-cli-individual'
     */
    deploymentMode?: AiderDeploymentMode;
    /**
     * Allow Aider to execute shell commands via `/run`.
     * Default: false.
     * MUST remain false in `aider-ci-mode` -- setting true in CI mode throws
     * at construction (PT-ADAPT-AIDER-4).
     */
    allowShellCommands?: boolean;
    /**
     * When `allowShellCommands` is true, only commands matching at least one
     * of these prefixes are permitted.
     * Dangerous patterns are denied regardless of this allowlist.
     */
    allowedShellPrefixes?: string[];
    /**
     * Allow Aider to auto-commit changes to git.
     * Default: false.
     * In `aider-ci-mode`: must be explicitly true or all commits are denied.
     */
    allowAutoCommit?: boolean;
    /**
     * Allow Aider voice input (transcription surface).
     * Default: false.
     * Always denied in `aider-ci-mode` regardless of this setting.
     */
    allowVoiceInput?: boolean;
    /**
     * Scan files before adding them to LLM context.
     * Default: true.
     * Cannot be set to false in `aider-cli-team` or `aider-ci-mode` --
     * throws at construction (PT-ADAPT-AIDER-3).
     */
    secretScanFiles?: boolean;
    /**
     * File paths that bypass the secret scan when added to Aider context.
     * Matched as exact path or path prefix.
     */
    allowedFilePaths?: string[];
    /**
     * Maximum repo-map content size in bytes.
     * Aider sends the full repo-map to the LLM on every request when enabled.
     * Default: 65536 (64 KB).
     */
    repoMapMaxBytes?: number;
    /**
     * Maximum number of files that may be modified in a single Aider edit cycle.
     * Default: 20.
     */
    multiFileEditCap?: number;
}
export declare class AiderAdapter extends BaseIdeAdapter {
    readonly adapterId = "aider";
    readonly ideId = "aider";
    private deploymentMode;
    private allowShellCommands;
    private allowedShellPrefixes;
    private allowAutoCommit;
    private allowVoiceInput;
    private secretScanFiles;
    private allowedFilePaths;
    private repoMapMaxBytes;
    private multiFileEditCap;
    initialize(config: AiderAdapterConfig): void;
    resolveUserIdentity(session: IdeSessionContext): Promise<UserIdentity>;
    getIdeCapabilities(): IdeAdapterCapabilities;
    interceptToolInvocation(ctx: ToolInvocationContext): Promise<ToolInvocationDecision>;
    wrapChat(ctx: ToolInvocationContext, prompt: string): Promise<ToolInvocationDecision>;
    wrapFileEdit(ctx: ToolInvocationContext, filePath: string, searchBlock: string, replaceBlock: string, affectedFileCount: number): Promise<ToolInvocationDecision>;
    wrapFileAdd(ctx: ToolInvocationContext, filePath: string, content: string): Promise<ToolInvocationDecision>;
    wrapGitCommit(ctx: ToolInvocationContext, message: string, stagedFiles?: string[]): Promise<ToolInvocationDecision>;
    wrapGitDiff(ctx: ToolInvocationContext, args: string): Promise<ToolInvocationDecision>;
    wrapShellCommand(ctx: ToolInvocationContext, command: string): Promise<ToolInvocationDecision>;
    wrapTestRun(ctx: ToolInvocationContext, testCommand: string): Promise<ToolInvocationDecision>;
    wrapLintRun(ctx: ToolInvocationContext, lintCommand: string): Promise<ToolInvocationDecision>;
    wrapVoiceInput(ctx: ToolInvocationContext, transcribedText: string): Promise<ToolInvocationDecision>;
    wrapRepomapBuild(ctx: ToolInvocationContext, repomapContent: string): Promise<ToolInvocationDecision>;
    private checkPackBinding;
}
//# sourceMappingURL=aider.d.ts.map