/**
 * Network proxy orchestrator for the sandbox.
 *
 * Starts HTTP + SOCKS5 proxy servers in the host Node.js process,
 * then spawns socat bridges in WSL to create Unix sockets accessible
 * from inside bwrap.
 *
 * Domain approval is handled via direct async callbacks — no IPC.
 */
export interface NetworkProxyConfig {
    /** WSL distro to create the Unix socket bridges in. */
    distro: string;
    /** Pre-approved domains (exact match or wildcard like *.github.com). */
    allowedDomains: string[];
    /** Called when an unknown domain is requested. Return 'once' | 'always' | false. */
    onDomainCheck: (domain: string) => Promise<'once' | 'always' | false>;
}
export interface NetworkProxyHandle {
    /** Unix socket path for the HTTP proxy (inside WSL). */
    httpSocketPath: string;
    /** Unix socket path for the SOCKS5 proxy (inside WSL). */
    socksSocketPath: string;
    /** Stop all proxy servers and bridges. */
    stop: () => void;
}
/**
 * Start the dual network proxy (HTTP + SOCKS5).
 *
 * 1. Starts Node.js HTTP and SOCKS5 servers on random TCP ports
 * 2. Spawns socat bridges in WSL to create Unix sockets
 * 3. Returns socket paths for bwrap bind-mounting
 *
 * Domain checks are direct function calls — no IPC.
 */
export declare function startNetworkProxy(config: NetworkProxyConfig): Promise<NetworkProxyHandle>;
//# sourceMappingURL=proxy.d.ts.map