/**
 * Cross-harness application of project / `--add-dir` directory grants.
 *
 * A multi-repo project binds several checkouts; the primary becomes cwd and the
 * rest become grants so the agent can read and write the siblings. How a grant
 * lands depends on the harness:
 *
 * - `native-flag`  — Claude, Kimi, Cursor: repeatable `--add-dir <path>`
 * - `codex-policy` — Codex: folded into the named edit profile's workspace_roots
 *                    (handled in buildExecCommand / codex-policy, not here)
 * - `grok-sandbox` — Grok: OS sandbox is off by default (siblings already
 *                    writable); when a non-off sandbox is active, write a
 *                    project-local profile with `read_write` and select it.
 *                    Always appends a short `--rules` note so the model knows
 *                    the siblings are in scope.
 * - `none`         — harness has no multi-root surface; grants are ignored
 *                    (caller may warn). Not a configuration mistake — the CLI
 *                    has nowhere to put the grant.
 *
 * Capability honesty: only strategies that actually change the launch count as
 * support. Silent no-ops stay `none`.
 */
import type { AgentId } from './types.js';
export type AddDirStrategy = 'native-flag' | 'codex-policy' | 'grok-sandbox' | 'none';
/** How each harness consumes directory grants. Keep in lockstep with apply* below. */
export declare const ADD_DIR_STRATEGY: Record<AgentId, AddDirStrategy>;
/** Agents whose launch command is widened by applyAddDirs (excludes codex — policy path). */
export declare function agentsWithNativeOrGrokAddDir(): AgentId[];
/** Expand `~` / `$HOME` and de-dupe, preserving order. */
export declare function normalizeAddDirs(dirs: string[] | undefined): string[];
/**
 * Append native `--add-dir` flags for harnesses that take them (Claude, Kimi, Cursor).
 * No-op for other strategies — call sites route by ADD_DIR_STRATEGY.
 */
export declare function appendNativeAddDirFlags(cmd: string[], dirs: string[]): void;
/** Profile name written into `.grok/sandbox.toml` under the run cwd. */
export declare const GROK_PROJECT_SANDBOX_PROFILE = "agents-project";
/**
 * Active Grok sandbox profile from the env, if a non-off profile is set.
 * Returns null when sandbox is off / unset / devbox (no widen needed).
 *
 * Only `GROK_SANDBOX` is consulted — a profile set only in config.toml is not
 * visible here (Grok does not expose it on the CLI), so those runs still get
 * the rules note but not a custom widen. Prefer env when launching sandboxed.
 */
export declare function grokActiveSandboxProfile(env?: NodeJS.ProcessEnv): string | null;
/** Whether Grok's active sandbox needs a custom profile with extra read_write. */
export declare function grokNeedsSandboxWiden(env?: NodeJS.ProcessEnv): boolean;
/**
 * Ensure `.grok/sandbox.toml` under `cwd` defines `[profiles.agents-project]`
 * with `read_write` covering every grant, **extending the active base profile**
 * (so `GROK_SANDBOX=strict` does not silently widen to `workspace`).
 * Returns the profile name to pass as `--sandbox`, or null when not needed.
 *
 * Idempotent: rewrites only the managed profile block.
 */
export declare function ensureGrokProjectSandboxProfile(cwd: string, dirs: string[], opts?: {
    extendsBase?: string;
}): string | null;
/**
 * Short rules blob so Grok's model treats sibling dirs as in-scope.
 * Wording tracks whether we actually widened the sandbox for write access.
 */
export declare function grokAddDirRules(dirs: string[], opts?: {
    writeGranted?: boolean;
}): string;
/**
 * Apply directory grants on the argv for harnesses handled here.
 * Codex is intentionally excluded — its path lives next to codexPolicyArgs.
 *
 * @returns true when any argv / on-disk change was made for the grants
 */
export declare function applyAddDirs(agent: AgentId, cmd: string[], dirs: string[] | undefined, opts?: {
    cwd?: string;
    env?: NodeJS.ProcessEnv;
}): boolean;
/** Whether this harness effectively consumes directory grants. */
export declare function supportsAddDir(agent: AgentId): boolean;
/** One-line note for harnesses that ignore grants (used by callers that want to warn). */
export declare function addDirUnsupportedNote(agent: AgentId): string | null;
