export type CodexPolicyMode = 'plan' | 'edit' | 'auto' | 'skip';
export declare const CODEX_PLAN_PROFILE = "agents-plan";
export declare const CODEX_EDIT_PROFILE = "agents-edit";
export declare const CODEX_AUTO_PROFILE = "agents-auto";
/**
 * Writable roots for Codex's `edit` profile: the managed user `.agents` dir, the
 * baseline toolchain caches, and — when `cwd` is inside a repo — that repo's
 * `.agents` directory. The last entry is what lets an in-repo build write under
 * `.agents/worktrees/`; Codex's `workspace-write` sandbox hardcodes `.agents/`
 * read-only, and naming the directory as an explicit writable root is the only
 * thing that overrides it (a nested sub-path does not — bwrap refuses the mount).
 */
export declare function codexEditWritableRoots(cwd?: string): string[];
export declare function codexPermissionProfileConfig(mode: Exclude<CodexPolicyMode, 'skip'>, writableRoots?: string[]): string;
/**
 * Canonical Codex safety policy used by every native launch path.
 *
 * Config overrides are deliberately used instead of the legacy `--sandbox`
 * flags: named permission profiles are the only Codex surface that can keep a
 * plan run filesystem-read-only while independently enabling network access.
 *
 * `auto` and `edit` share one sandbox (`:workspace` plus the writable roots) and
 * differ only in `approval_policy`. `edit` is `on-request`: a command the sandbox
 * denies comes back as an approval prompt, which is right when someone is sitting
 * at the terminal. `auto` is `never`: nothing prompts, and a denied command
 * surfaces to the model as a plain command failure — the only behavior that works
 * for an unattended run, where a prompt nobody answers is an agent that has
 * stopped. Autonomy is the approval axis only; neither widens the sandbox, and
 * `skip` remains the sole mode that removes it.
 */
export declare function codexPolicyArgs(mode: CodexPolicyMode, writableRoots?: string[]): string[];
/** Preserve whether --mode was omitted when a run is re-dispatched remotely. */
export declare function modeForRemoteDispatch(mode: string, source: string | undefined): string | undefined;
/** Only the untouched Commander default selects Codex's writable default. */
export declare function modeWasImplicit(source: string | undefined, hasConfiguredDefault: boolean): boolean;
