/**
 * OS-Level Sandbox
 *
 * Native sandboxing using OS-level isolation:
 * - Linux: bubblewrap (bwrap)
 * - macOS: sandbox-exec (seatbelt)
 * - Windows: Not yet supported (falls back to Docker)
 *
 * Inspired by Codex CLI's execpolicy and sandbox implementation.
 */
import { EventEmitter } from 'events';
export type SandboxBackend = 'bubblewrap' | 'seatbelt' | 'docker' | 'none';
export interface OSSandboxConfig {
    /** Sandbox backend to use (auto-detected if not specified) */
    backend?: SandboxBackend;
    /** Working directory */
    workDir: string;
    /** Read-only paths */
    readOnlyPaths: string[];
    /** Read-write paths */
    readWritePaths: string[];
    /** Allow network access */
    allowNetwork: boolean;
    /** Allow subprocess spawning */
    allowSubprocess: boolean;
    /** Environment variables to pass */
    env: Record<string, string>;
    /** Timeout in milliseconds */
    timeout: number;
    /** Resource limits */
    limits: {
        /** Max memory in bytes */
        maxMemory?: number;
        /** Max CPU time in seconds */
        maxCpuTime?: number;
        /** Max processes */
        maxProcesses?: number;
        /** Max file size in bytes */
        maxFileSize?: number;
    };
}
export interface OSSandboxResult {
    exitCode: number;
    stdout: string;
    stderr: string;
    duration: number;
    timedOut: boolean;
    backend: SandboxBackend;
    sandboxed: boolean;
}
export interface SandboxCapabilities {
    bubblewrap: boolean;
    seatbelt: boolean;
    docker: boolean;
    recommended: SandboxBackend;
}
/**
 * Detect available sandbox backends
 */
export declare function detectCapabilities(): Promise<SandboxCapabilities>;
/**
 * Clear cached capabilities
 */
export declare function clearCapabilitiesCache(): void;
export declare class OSSandbox extends EventEmitter {
    private config;
    private backend;
    private initialized;
    constructor(config?: Partial<OSSandboxConfig>);
    /**
     * Initialize sandbox and detect backend
     */
    initialize(): Promise<void>;
    /**
     * Get current backend
     */
    getBackend(): SandboxBackend;
    /**
     * Check if sandboxing is available
     */
    isAvailable(): boolean;
    /**
     * Execute command in sandbox
     */
    exec(command: string, args?: string[]): Promise<OSSandboxResult>;
    /**
     * Execute shell command in sandbox
     */
    execShell(shellCommand: string): Promise<OSSandboxResult>;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<OSSandboxConfig>): void;
    /**
     * Get current configuration
     */
    getConfig(): OSSandboxConfig;
}
export declare function getOSSandbox(config?: Partial<OSSandboxConfig>): OSSandbox;
export declare function resetOSSandbox(): void;
export { OSSandboxConfig as OSConfig };
