/**
 * Security configuration types — autonomy modes and command risk enforcement.
 *
 * Inspired by ZeroClaw's `src/safety/policy.rs` (ReadOnly/Supervised/Full tiers)
 * and IronClaw's `src/agent/cost_guard.rs` (daily/hourly rate limits).
 */
export type AutonomyLevel = "readonly" | "supervised" | "full";
export type SecurityAutonomyConfig = {
    /**
     * Autonomy mode controlling what shell commands the agent can execute:
     * - `readonly`:    Only LOW risk commands (ls, cat, grep, git status, etc.)
     * - `supervised`:  LOW allowed, MEDIUM/HIGH require explicit approval
     * - `full`:        All commands allowed (risk still logged)
     *
     * Default: `"full"` (backward compatible — no behavior change unless configured).
     */
    level?: AutonomyLevel;
    /**
     * Maximum cost per day in cents (e.g. 5000 = $50/day).
     * LLM calls refused with clear error when exceeded.
     * `undefined` or `0` = unlimited.
     */
    maxCostPerDayCents?: number;
    /**
     * Maximum LLM actions per hour (sliding window).
     * `undefined` or `0` = unlimited.
     */
    maxActionsPerHour?: number;
    /**
     * Path to declarative security.yaml policy file.
     * When set, loaded at startup and watched for hot-reload changes.
     */
    securityPolicyPath?: string;
};
/**
 * L7 method+path rule for per-endpoint request filtering.
 * Inspired by OpenShell's L7 relay inspection pattern.
 */
export type L7Rule = {
    allow: {
        /** HTTP method (GET, POST, DELETE, …). Omit to allow all methods. */
        method?: string;
        /**
         * URL path pattern. "*" matches a single non-"/" path segment.
         * Example: "/repos/{star}/pulls" matches "/repos/org/name/pulls".
         * Omit to allow all paths.
         */
        path?: string;
    };
};
/**
 * A single host entry in the egress allowlist.
 * When `rules` is present, requests to this host must match at least one rule.
 */
export type EgressHostRule = {
    /** Exact hostname or glob pattern (e.g., "*.github.com"). */
    host: string;
    /** Allowed ports — omit to allow all ports. */
    ports?: number[];
    /** When present: request method+path must match at least one rule. */
    rules?: L7Rule[];
};
/**
 * Outbound network egress policy for tool HTTP requests.
 * Complements the existing SSRF guard (src/infra/net/ssrf.ts) which blocks
 * inbound access to private networks. This controls *outbound* tool requests.
 *
 * Inspired by NemoClaw's openclaw-sandbox.yaml network policy and
 * OpenShell's OPA-evaluated L4/L7 proxy pipeline.
 */
export type EgressPolicyConfig = {
    /**
     * When true: requests to non-listed hosts are blocked.
     * When false (default): non-listed hosts are allowed with a warning log.
     * Default: false — fail-open to avoid breaking existing setups on upgrade.
     */
    strict?: boolean;
    /** Allowlisted hosts. Requests to these hosts are always permitted. */
    allowedHosts?: EgressHostRule[];
    /**
     * Hosts that are always blocked regardless of allowedHosts or strict mode.
     * Merged with the built-in ALWAYS_BLOCKED list.
     */
    extraBlockedHosts?: string[];
};
