/**
 * OS-Level Sandbox
 *
 * Native sandboxing using OS-level isolation:
 * - Linux: Landlock + seccomp (bwrap with seccomp BPF filters, strongest)
 * - Linux: bubblewrap (bwrap)
 * - macOS: sandbox-exec (seatbelt)
 * - Windows: Not yet supported (falls back to Docker)
 *
 * Inspired by Codex CLI's execpolicy and sandbox implementation.
 */
import { EventEmitter } from 'events';
export type SandboxBackend = 'landlock' | 'bubblewrap' | 'seatbelt' | 'docker' | 'none';
export interface OSSandboxConfig {
    /** Sandbox backend to use (auto-detected if not specified) */
    backend?: SandboxBackend;
    /** Working directory */
    workDir: string;
    /** Read-only paths */
    readOnlyPaths: string[];
    /** Read-write paths */
    readWritePaths: string[];
    /** Allow network access */
    allowNetwork: boolean;
    /** Allow subprocess spawning */
    allowSubprocess: boolean;
    /** Environment variables to pass */
    env: Record<string, string>;
    /** Timeout in milliseconds */
    timeout: number;
    /** Resource limits */
    limits: {
        /** Max memory in bytes */
        maxMemory?: number;
        /** Max CPU time in seconds */
        maxCpuTime?: number;
        /** Max processes */
        maxProcesses?: number;
        /** Max file size in bytes */
        maxFileSize?: number;
    };
    /** Domain allowlist when network is enabled */
    allowedDomains: string[];
    /** Commands that bypass the sandbox */
    excludedCommands: string[];
    /** Allow running unsandboxed as fallback (default: true) */
    allowUnsandboxed: boolean;
}
export interface OSSandboxResult {
    exitCode: number;
    stdout: string;
    stderr: string;
    duration: number;
    timedOut: boolean;
    backend: SandboxBackend;
    sandboxed: boolean;
}
export interface SandboxCapabilities {
    landlock: boolean;
    bubblewrap: boolean;
    seatbelt: boolean;
    docker: boolean;
    recommended: SandboxBackend;
}
export interface OSSandboxStats {
    commandsRun: number;
    commandsSandboxed: number;
    commandsBypassed: number;
}
/**
 * Detect available sandbox backends
 */
export declare function detectCapabilities(): Promise<SandboxCapabilities>;
/**
 * Clear cached capabilities
 */
export declare function clearCapabilitiesCache(): void;
/**
 * Check if the Linux kernel supports Landlock LSM.
 * Returns true if /proc/sys/kernel/unprivileged_landlock_restrict exists
 * or kernel version >= 5.13.
 */
export declare function checkLandlockSupport(): boolean;
/**
 * Generate a seccomp BPF filter file that blocks dangerous syscalls.
 *
 * The filter is a minimal BPF program in binary format:
 * - Load syscall number (BPF_LD | BPF_W | BPF_ABS, offset 0 for seccomp data)
 * - For each blocked syscall: compare and jump to KILL if matched
 * - Default action: ALLOW
 *
 * Format: each BPF instruction is 8 bytes (struct sock_filter):
 *   uint16 code, uint8 jt, uint8 jf, uint32 k
 */
export declare function generateSeccompFilter(): Buffer;
export declare class OSSandbox extends EventEmitter {
    private config;
    private backend;
    private initialized;
    private stats;
    constructor(config?: Partial<OSSandboxConfig>);
    /**
     * Initialize sandbox and detect backend
     */
    initialize(): Promise<void>;
    /**
     * Get current backend
     */
    getBackend(): SandboxBackend;
    /**
     * Check if sandboxing is available
     */
    isAvailable(): boolean;
    /**
     * Execute command in sandbox
     */
    exec(command: string, args?: string[]): Promise<OSSandboxResult>;
    /**
     * Execute shell command in sandbox
     */
    execShell(shellCommand: string): Promise<OSSandboxResult>;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<OSSandboxConfig>): void;
    /**
     * Get current configuration
     */
    getConfig(): OSSandboxConfig;
    /**
     * Check if a domain should be allowed through the network filter
     */
    shouldAllowDomain(domain: string): boolean;
    /**
     * Check if a command should bypass the sandbox
     */
    isCommandExcluded(command: string): boolean;
    /**
     * Get execution statistics
     */
    getStats(): OSSandboxStats;
    /**
     * Execute a shell command with exclusion and stats tracking
     */
    execShellTracked(shellCommand: string): Promise<OSSandboxResult>;
}
export declare function getOSSandbox(config?: Partial<OSSandboxConfig>): OSSandbox;
export declare function resetOSSandbox(): void;
export { OSSandboxConfig as OSConfig };
