import type { HookRegistry } from "../../contracts/hooks.js";
import type { ChatMessage } from "../../protocol/wire/index.js";
import type { ToolDefinition } from "../../protocol/wire/index.js";
import { PermissionRuleEngine } from "./rule-engine.js";
import type { ApprovalRequest, ApprovalResponse } from "./types.js";
import { type ClassifierLLMCall } from "./permission-classifier.js";
import { DenialAuditLogger } from "./denial-audit-log.js";
export type PermissionRole = "interactive" | "coordinator" | "worker";
export interface PermissionCheckerDeps {
    ruleEngine: PermissionRuleEngine;
    hookRegistry: HookRegistry;
    /** Returns the current workspace root for operation classification. */
    getWorkspaceRoot(): string;
    /**
     * Callback to send an approval request to the host (Gateway/Electron).
     * Must return a promise that resolves when the user responds.
     * If the host does not support approval, this should reject or return deny.
     */
    onRequestApproval: (request: ApprovalRequest) => Promise<ApprovalResponse>;
    /** Called when a tool is denied (for logging/observability) */
    onDenied?: (toolName: string, message: string) => void;
    /**
     * LLM call function for the auto-mode classifier (cc yoloClassifier pattern).
     * If not provided, auto mode falls back to the approval dialog.
     */
    classifierLLMCall?: ClassifierLLMCall;
    /**
     * Recent conversation messages for classifier context.
     * Called lazily when the classifier needs to run.
     */
    getRecentMessages?: () => ChatMessage[];
    /**
     * Permission role context (CC: interactive/coordinator/worker).
     * Determines how the checker behaves:
     * - interactive: full approval dialog flow (default)
     * - coordinator: auto-approve non-destructive ops, no user prompts
     * - worker: classifier-only path, no approval dialog fallback
     */
    permissionRole?: PermissionRole;
    /** Denial audit logger for persistent audit trail. */
    auditLogger?: DenialAuditLogger;
    /** Current session ID (for audit context). */
    sessionId?: string;
    /** Getter for current turn ID (changes per turn). */
    getTurnId?: () => string;
    /** Best-effort community telemetry sink for consent-gated sandbox metrics. */
    communityTelemetryRecorder?: {
        recordTelemetry(input: {
            event: "community.sandbox.violation";
            metadata?: Record<string, unknown>;
        }): Promise<unknown>;
    };
}
export declare class PermissionChecker {
    private readonly ruleEngine;
    private readonly hookRegistry;
    private readonly getWorkspaceRoot;
    private readonly onRequestApproval;
    private readonly onDenied;
    private readonly classifierLLMCall;
    private readonly getRecentMessages;
    private readonly permissionRole;
    private readonly pendingApprovals;
    private readonly auditLogger;
    private readonly sessionId;
    private readonly getTurnId;
    private readonly communityTelemetryRecorder;
    private readonly communitySandboxTurnIds;
    /**
     * cut7c — community-skill (untrusted) scoped deny/ask rules, passed per-call as
     * `ruleEngine.check(..., { extraRules })` for community turns. NOT a second engine:
     * the single rule engine evaluates these alongside the base rules. FS/exec tools are
     * absent here → they flow through the unified pipeline (workspace + prompt + OS sandbox).
     */
    private readonly communityScopedRules;
    private unregisterHook;
    /** Tool meta cache — populated from ToolDefinition[] at agent creation */
    private toolMetaCache;
    /** Classifier result cache — avoids redundant LLM calls (CC permissionCache parity) */
    private classifierCache;
    /** Denial tracking state — CC denialTracking.ts parity */
    private denialTracking;
    constructor(deps: PermissionCheckerDeps);
    /**
     * Register the permission check hook on the HookRegistry.
     * Returns an unregister function.
     */
    register(): () => void;
    /**
     * Resolve an incoming approval response (called by host RPC handler).
     */
    resolveApproval(response: ApprovalResponse): void;
    /**
     * Update tool metadata cache (call when tool list changes).
     */
    setToolMeta(tools: ToolDefinition[]): void;
    get ruleEngineRef(): PermissionRuleEngine;
    /**
     * cut7c — whether the CURRENT turn is a community-skill (untrusted) turn. Consumed by
     * the OS-sandbox builder to tighten community execs (netPolicy=deny: no outbound network
     * from the sandboxed child) as defense-in-depth on POSIX.
     */
    isCommunitySandboxTurn(): boolean;
    /** Fire permission.denied hook + onDenied callback + audit log */
    private fireDenied;
    private handleResult;
    private toConfirmationRequest;
    private handleInteractiveApproval;
    /**
     * Worker/coordinator "ask" handler: classifier-only, no approval dialog.
     * CC pattern: headless workers never prompt users.
     */
    private handleWorkerAsk;
    private requestApproval;
    /**
     * Clear the classifier cache (CC parity: called on mode change / session end).
     */
    clearClassifierCache(): void;
    private cancelAllPending;
}
