import type { AgentAdapter } from '../../../core/types.js';
import { type LlmProvider } from '../../../core/llm/index.js';
import { type PolicyApprovalGateConfig } from '../../../core/llm/policy-approval-gate.js';
/**
 * v1.2.47 — system prompt is rebuilt per IM turn so the model sees:
 *   - which LLM backend + role it's actually running on
 *   - the agim process working directory (no per-thread cwd today)
 *   - the live skill roster (names + one-line descriptions), with the
 *     hint to call mcp__imhub__read_skill for full bodies
 *   - external MCP servers currently connected
 *
 * Before v1.2.47 the prompt was a 4-line generic string; users
 * complained that asking "what model are you" / "what skills do you
 * have" got non-answers ("I don't know; ask the operator"). The
 * builder closes that information gap without leaking secrets — every
 * field surfaced here is operator-configured and non-sensitive.
 */
export declare function buildSystemPrompt(provider: LlmProvider, role: string, cwd: string, threadKey?: string): string;
/** Read <cwd>/AGENTS.md (if present) and prepare it for injection into
 *  the system prompt. Returns '' on missing file / read failure / empty
 *  content. Sanitises text length (8000 char cap) and scans for the
 *  classic prompt-injection signals ("ignore previous instructions",
 *  "always allow", etc.); when matches are found we still inject (the
 *  operator likely wrote them deliberately) but log a warn + audit
 *  hit so post-incident forensics can correlate. Honours
 *  IMHUB_NATIVE_AGENT_ROLE_FILE for a non-default location. */
export declare function readOperatorRole(cwd: string): string;
/** Resolve the operator's approval policy from env. Defaults to
 *  `allow-list` mode with NO allow entries — equivalent to "no tool
 *  calls". Operators that want native to actually call tools must
 *  configure at least one of these env vars:
 *
 *    IMHUB_NATIVE_AGENT_MODE=allow-all|read-only|allow-list|deny-all
 *    IMHUB_NATIVE_AGENT_AUTOALLOW=tool1,tool2,...
 *    IMHUB_NATIVE_AGENT_DENYLIST=tool1,...
 *
 *  The `read-only` mode is the recommended starter — it accepts every
 *  tool whose name starts/ends with a read-only verb (`read_*` /
 *  `list_*` / `get_*` / etc.) and the four built-ins
 *  (`native_echo`/`now`/`random_uuid` — `sleep_ms` excluded).
 */
export declare function resolvePolicy(threadKey?: string): PolicyApprovalGateConfig;
/** Plan mode resolution (v1.2.120):
 *  - `threadKey` given (and matches a /plan-toggled row) → use that row
 *  - `threadKey` given but no row → fall through to env
 *  - `threadKey` omitted → env-only (back-compat for CLI boot, tests)
 */
export declare function isPlanModeOn(threadKey?: string): boolean;
/**
 * Extract media attachments from a prompt string. Messenger adapters
 * (telegram / wechat / discord / feishu / dingtalk) inline a marker like
 * `[图片附件：/abs/path/to/file.jpg]` or `[image attachment: ...]` when a
 * user message carries a media payload. The path is already downloaded
 * to `~/.agim/media/<platform>/...` by the adapter, so we only need to
 * surface it to vision-capable providers; non-vision providers see the
 * original text and can still acknowledge the attachment.
 *
 * Heuristic-safe: matches absolute paths under common image extensions
 * + a path-safety check that the file exists. Anything ambiguous (no
 * extension, file missing, points outside ~/.agim/media) is silently
 * skipped so we never leak random filesystem paths into a vision call.
 */
export declare function parsePromptMedia(prompt: string): Array<{
    path: string;
    mime?: string;
}>;
export declare const nativeAgentAdapter: AgentAdapter;
/** Lightweight banner for cli.ts boot log. Lets operators see at a
 *  glance whether `/cc native` will work before they try it in an IM
 *  thread. */
export declare function describeNativeAgent(): string;
//# sourceMappingURL=index.d.ts.map