/**
 * codexHookArm — arm instar's project-scoped Codex gate hooks so they actually run
 * on a freshly-init'd agent without a human clicking "trust". P0 of codex-full-parity.
 *
 * G2 verdict (spec §P0): per-agent scoping comes from trust entries being keyed by the
 * project hooks.json PATH, so arming only the agent's own project hooks never touches the
 * operator's personal Codex. Mechanism: Codex's own trust flow (the "Trust all and continue"
 * prompt), driven non-interactively — NOT the machine-wide managed-config (rejected, G1).
 *
 * Review gates baked in (spec §7 F1-F3):
 *   F1 — manifest verify: only arm when the project hooks.json is exactly instar's own
 *        (matches buildInstarCodexHookGroups); never blind-trust arbitrary on-disk hooks.
 *        And the trust spawn runs WITHOUT the dangerous approvals/sandbox bypass flags.
 *   F2 — idempotent + readback: skip the spawn entirely when already armed; after the spawn,
 *        re-read config.toml and confirm the slots are now trusted (return armed=false if not).
 *   F3 — never silently re-enable a user-disabled hook (enabled=false is left as the user set it).
 *
 * The fragile TUI keystroke step is injected (`trustDriver`) so the orchestration — the part
 * that decides whether/what to arm and verifies the outcome — is unit-testable without a real
 * codex. The default driver spawns interactive codex in tmux and sends the trust keystrokes;
 * it is validated by test-as-self on a live agent, not by unit tests.
 */
export interface ArmCodexHooksOptions {
    projectDir: string;
    /** CODEX_HOME (defaults to ~/.codex). config.toml [hooks.state] lives here. */
    codexHome?: string;
    /**
     * Drives Codex's interactive trust flow for the project's hooks. Returns when the
     * trust-all selection has been submitted (or throws on failure). Injected for testability.
     */
    trustDriver?: (ctx: {
        projectDir: string;
        codexHome: string;
        hooksJsonPath: string;
    }) => void;
}
export type ArmOutcome = {
    status: 'already-armed';
} | {
    status: 'armed';
} | {
    status: 'partial';
    untrusted: string[];
    disabled: string[];
} | {
    status: 'skipped';
    reason: string;
};
/**
 * F1 manifest verify: is the project's `.codex/hooks.json` exactly instar's own set?
 * We compare the instar-owned hook command paths the file declares against what
 * buildInstarCodexHookGroups would produce. If the file is missing, malformed, or carries
 * a hook command outside `.instar/hooks/instar/`, we refuse to arm (don't blind-trust).
 */
export declare function projectHooksAreInstarOwned(projectDir: string): boolean;
/**
 * Arm the agent's project Codex hooks. Idempotent. Returns the outcome without throwing
 * on a benign no-op; throws only on a programming error in the driver.
 */
export declare function armCodexHooks(opts: ArmCodexHooksOptions): ArmOutcome;
/**
 * Default trust driver — spawns interactive Codex in tmux and sends the "Trust all and
 * continue" keystrokes, WITHOUT any approvals/sandbox bypass (F1). Validated by test-as-self,
 * not unit tests (unit tests inject their own driver, so this never runs there). Bounded:
 * polls capture-pane for the trust prompt, sends the selection, then exits + kills the pane.
 *
 * Requires a resolved codex binary + tmux on PATH; the caller passes binaryPath via env. We
 * keep config-driven values (tmux path, codex binary, model) in the env the caller sets up.
 */
interface TrustDriverDeps {
    tmuxPath: string;
    codexBinary: string;
    model?: string;
}
export declare function makeTmuxTrustDriver(deps: TrustDriverDeps): (ctx: {
    projectDir: string;
    codexHome: string;
    hooksJsonPath: string;
}) => void;
export {};
//# sourceMappingURL=codexHookArm.d.ts.map