/**
 * Workspace Isolation Module
 *
 * Provides security isolation to ensure file operations stay within the workspace.
 * Prevents access to files outside the current workspace directory.
 *
 * Security features:
 * - Validates all paths are under the workspace root
 * - Blocks path traversal attacks (../)
 * - Blocks symlinks pointing outside the workspace
 * - Whitelist for necessary system files
 * - Logs all blocked access attempts
 *
 * Configuration:
 * - Can be disabled with --allow-outside CLI flag
 * - Whitelist can be extended via configuration
 */
import { EventEmitter } from 'events';
export interface WorkspaceIsolationConfig {
    /** Enable workspace isolation (default: true) */
    enabled: boolean;
    /** Workspace root directory */
    workspaceRoot: string;
    /** Additional allowed paths outside workspace */
    additionalAllowedPaths: string[];
    /** Log blocked access attempts (default: true) */
    logBlockedAccess: boolean;
    /** Strict mode - block even whitelisted paths (default: false) */
    strictMode: boolean;
}
export interface PathValidationResult {
    /** Whether the path is valid and allowed */
    valid: boolean;
    /** Resolved absolute path */
    resolved: string;
    /** Error message if invalid */
    error?: string;
    /** Reason for blocking */
    reason?: 'outside_workspace' | 'path_traversal' | 'symlink_escape' | 'blocked_path';
}
export interface BlockedAccessLog {
    timestamp: Date;
    requestedPath: string;
    resolvedPath: string;
    reason: string;
    operation: string;
}
export declare class WorkspaceIsolation extends EventEmitter {
    private config;
    private blockedAccessLog;
    private systemWhitelist;
    private blockedPaths;
    constructor(config?: Partial<WorkspaceIsolationConfig>);
    /**
     * Get current configuration
     */
    getConfig(): Readonly<WorkspaceIsolationConfig>;
    /**
     * Update workspace root
     */
    setWorkspaceRoot(root: string): void;
    /**
     * Enable or disable isolation
     */
    setEnabled(enabled: boolean): void;
    /**
     * Add an allowed path to the whitelist
     */
    addAllowedPath(allowedPath: string): void;
    /**
     * Check if a path is in the blocked list
     */
    private isBlockedPath;
    /**
     * Check if a path is in the system whitelist
     */
    private isWhitelisted;
    /**
     * Check if a path is within the workspace
     */
    private isWithinWorkspace;
    /**
     * Log a blocked access attempt
     */
    private logBlockedAccess;
    /**
     * Validate a file path against workspace isolation rules
     *
     * @param filePath - Path to validate (can be relative or absolute)
     * @param operation - Description of the operation (for logging)
     * @returns Validation result with resolved path or error
     */
    validatePath(filePath: string, operation?: string): PathValidationResult;
    /**
     * Validate multiple paths at once
     */
    validatePaths(filePaths: string[], operation?: string): {
        valid: boolean;
        results: Map<string, PathValidationResult>;
        errors: string[];
    };
    /**
     * Quick check if a path is safe (returns boolean only)
     */
    isSafe(filePath: string): boolean;
    /**
     * Validate and resolve a path, throwing if invalid
     */
    resolveOrThrow(filePath: string, operation?: string): string;
    /**
     * Get the blocked access log
     */
    getBlockedAccessLog(): readonly BlockedAccessLog[];
    /**
     * Clear the blocked access log
     */
    clearBlockedAccessLog(): void;
    /**
     * Format blocked access log for display
     */
    formatBlockedAccessLog(): string;
}
/**
 * Get the workspace isolation singleton
 */
export declare function getWorkspaceIsolation(config?: Partial<WorkspaceIsolationConfig>): WorkspaceIsolation;
/**
 * Reset the workspace isolation singleton (for testing)
 */
export declare function resetWorkspaceIsolation(): void;
/**
 * Initialize workspace isolation from CLI options
 */
export declare function initializeWorkspaceIsolation(options: {
    allowOutside?: boolean;
    directory?: string;
    additionalPaths?: string[];
}): WorkspaceIsolation;
/**
 * Convenience function to validate a path
 */
export declare function validateWorkspacePath(filePath: string, operation?: string): PathValidationResult;
/**
 * Convenience function to check if a path is safe
 */
export declare function isPathInWorkspace(filePath: string): boolean;
declare const _default: {
    WorkspaceIsolation: typeof WorkspaceIsolation;
    getWorkspaceIsolation: typeof getWorkspaceIsolation;
    resetWorkspaceIsolation: typeof resetWorkspaceIsolation;
    initializeWorkspaceIsolation: typeof initializeWorkspaceIsolation;
    validateWorkspacePath: typeof validateWorkspacePath;
    isPathInWorkspace: typeof isPathInWorkspace;
};
export default _default;
