declare function getNodeBinaryPath(): string | null;
declare function getCliclickBinaryPath(): string | null;
declare const TCC_SERVICES: {
    readonly screenRecording: "kTCCServiceScreenCapture";
    readonly accessibility: "kTCCServiceAccessibility";
    readonly appleEvents: "kTCCServiceAppleEvents";
    readonly fullDiskAccess: "kTCCServiceSystemPolicyAllFiles";
    readonly camera: "kTCCServiceCamera";
    readonly microphone: "kTCCServiceMicrophone";
    readonly contacts: "kTCCServiceAddressBook";
    readonly calendar: "kTCCServiceCalendar";
    readonly reminders: "kTCCServiceReminders";
    readonly photos: "kTCCServicePhotos";
    readonly speechRecognition: "kTCCServiceSpeechRecognition";
    readonly inputMonitoring: "kTCCServiceListenEvent";
    readonly desktopFolder: "kTCCServiceSystemPolicyDesktopFolder";
    readonly documentsFolder: "kTCCServiceSystemPolicyDocumentsFolder";
    readonly downloadsFolder: "kTCCServiceSystemPolicyDownloadsFolder";
};
type TCCService = keyof typeof TCC_SERVICES;
/**
 * Grant a TCC permission to Apple Terminal (bundle ID-based).
 */
export declare function grantTCCPermission(service: TCCService): Promise<boolean>;
/**
 * Grant a TCC permission to the Node.js binary (path-based).
 * TCC tracks executable permissions by absolute path for non-bundled binaries.
 */
export declare function grantTCCPermissionForNode(service: TCCService): Promise<boolean>;
/**
 * Open the System Settings panel for a given TCC permission category.
 */
export declare function openSystemSettingsForPermission(permission: TCCService): void;
/**
 * Attempt to grant all required TCC permissions for Apple Terminal and Node.js.
 * Also grants Accessibility specifically to cliclick, which calls the API directly.
 * Tries direct TCC.db writes; returns which permissions were successfully granted
 * for Terminal (Node/cliclick results are best-effort alongside Terminal).
 */
export declare function grantAllTerminalPermissions(): Promise<Record<TCCService, boolean>>;
/**
 * Attempt to grant all required TCC permissions specifically for the Node.js binary.
 * Also grants Accessibility to cliclick which is the actual API caller.
 * Returns which permissions were successfully granted.
 */
export declare function grantAllNodePermissions(): Promise<Record<TCCService, boolean>>;
/**
 * Get the resolved Node.js binary path (for display purposes).
 */
export { getNodeBinaryPath };
/**
 * Get the resolved cliclick binary path (for display purposes).
 */
export { getCliclickBinaryPath };
/**
 * Check if Screen Recording permission is granted on macOS.
 *
 * We do this by attempting a silent screenshot. If it succeeds and
 * produces a non-trivial file, we have permission. If the file is
 * tiny or missing, the permission was denied.
 */
export declare function checkScreenRecordingPermission(): Promise<boolean>;
/**
 * Check if cliclick is installed (required for computer_use tools).
 */
export declare function checkCliclickInstalled(): Promise<boolean>;
/**
 * Check if ffmpeg is installed (required for screenshot compression and audio transcription).
 */
export declare function checkFfmpegInstalled(): Promise<boolean>;
/**
 * Check if whisper-cli is installed (required for audio transcription).
 */
export declare function checkWhisperCppInstalled(): Promise<boolean>;
export declare const WHISPER_MODEL_DIR: string;
export declare const WHISPER_MODEL_PATH: string;
export declare const WHISPER_MODEL_URL = "https://screenshots.tos-accelerate.volces.com/uploads/ggml-large-v3-turbo.bin";
/**
 * Check if the whisper-cpp model file exists AND has the expected size.
 * Fetches expected size from the remote URL via HEAD request (cached).
 * Returns "valid" if present and correct size, "incomplete" if present but wrong
 * size (e.g. interrupted download), or "missing" if not found.
 * If the remote size cannot be determined (no network), a present file is
 * assumed valid.
 */
export declare function checkWhisperModelIntegrity(): "valid" | "incomplete" | "missing";
/**
 * Check if the whisper-cpp model file exists (legacy boolean wrapper).
 */
export declare function checkWhisperModelExists(): boolean;
/**
 * Check if pm2 is installed globally (used as the process manager in production).
 */
export declare function checkPm2Installed(): Promise<boolean>;
/**
 * Check if the GitHub CLI (`gh`) is installed.
 */
export declare function checkGhInstalled(): Promise<boolean>;
/**
 * Check if the GitHub CLI is authenticated (logged in).
 */
export declare function checkGhAuthenticated(): Promise<boolean>;
/**
 * Check if Google Chrome or Chromium is installed (required for Playwright browser tools).
 */
export declare function checkChromeInstalled(): Promise<boolean>;
/**
 * Check if Accessibility permission is granted on macOS.
 *
 * Uses `cliclick p` (print cursor position) which requires the Accessibility
 * API (CGEventPost / AXUIElement). The previous osascript-based check tested
 * Automation permission to System Events, not the actual Accessibility API
 * that cliclick needs at runtime.
 */
export declare function checkAccessibilityPermission(): Promise<boolean>;
/**
 * Check if Automation (AppleScript) permission is granted on macOS.
 *
 * Tests whether osascript can send Apple Events to System Events, which is
 * the primary Automation target at runtime (pressKey uses `key code` via
 * System Events). macOS tracks Automation permission per-target app, so
 * we must test the actual target the agent depends on.
 */
export declare function checkAutomationPermission(): Promise<boolean>;
/**
 * Check if Files & Folders / Full Disk Access is sufficient.
 *
 * Tests whether we can read a protected location (~/Library/Mail).
 * Full Disk Access protects ~/Library/Mail, ~/Library/Messages, etc.
 * If we can list it, Terminal has FDA.
 */
export declare function checkFullDiskAccessPermission(): Promise<boolean>;
/**
 * Check if Camera permission is granted.
 * Uses AVFoundation's authorizationStatus API via a compiled Swift helper.
 */
export declare function checkCameraPermission(): Promise<boolean>;
/**
 * Check if Microphone permission is granted.
 */
export declare function checkMicrophonePermission(): Promise<boolean>;
/**
 * Check if Contacts permission is granted.
 */
export declare function checkContactsPermission(): Promise<boolean>;
/**
 * Check if Calendar permission is granted.
 */
export declare function checkCalendarPermission(): Promise<boolean>;
/**
 * Check if Reminders permission is granted.
 */
export declare function checkRemindersPermission(): Promise<boolean>;
/**
 * Check if Photos permission is granted.
 */
export declare function checkPhotosPermission(): Promise<boolean>;
/**
 * Check if Speech Recognition permission is granted.
 */
export declare function checkSpeechRecognitionPermission(): Promise<boolean>;
/**
 * Check if Input Monitoring permission is granted for Terminal, Node, and (in Electron) the app bundle.
 *
 * Input Monitoring is a system-level TCC service — entries may live in either the
 * user-level or system-level TCC.db depending on how the permission was granted
 * (manual toggle vs MDM profile). We check both databases to avoid false negatives,
 * which was observed on Mac Mini where entries only existed in the system DB.
 */
export declare function checkInputMonitoringPermission(): Promise<boolean>;
/**
 * Check if Desktop folder access is granted.
 */
export declare function checkDesktopFolderPermission(): Promise<boolean>;
/**
 * Check if Documents folder access is granted.
 */
export declare function checkDocumentsFolderPermission(): Promise<boolean>;
/**
 * Check if Downloads folder access is granted.
 */
export declare function checkDownloadsFolderPermission(): Promise<boolean>;
export type PermissionType = "screen-recording" | "accessibility" | "automation" | "full-disk-access" | "camera" | "microphone" | "contacts" | "calendar" | "reminders" | "photos" | "speech-recognition" | "input-monitoring" | "desktop-folder" | "documents-folder" | "downloads-folder";
/**
 * Print instructions for granting a macOS permission to Apple Terminal.
 */
export declare function printPermissionInstructions(permission: PermissionType): void;
/**
 * Run all macOS permission checks and report results.
 * Returns true if all required permissions are granted.
 */
export declare function checkMacOSPermissions(): Promise<boolean>;
/**
 * Save the current binary paths so we can detect changes on next startup.
 */
export declare function saveTccPaths(): void;
/**
 * Detect if Homebrew-managed binary paths have changed since the last
 * `saveTccPaths()` call. If so, re-grant all non-system TCC permissions
 * for the new paths automatically and return a list of system-level
 * services that need manual re-granting in System Settings.
 *
 * Call this on every agent startup (in index.ts) to self-heal after
 * accidental `brew upgrade`.
 *
 * Returns null if no path change was detected, or a summary object.
 */
export declare function repairTccPathsIfChanged(): Promise<{
    nodeChanged: boolean;
    cliclickChanged: boolean;
    autoRepaired: string[];
    manualRequired: string[];
} | null>;
/**
 * Pin Homebrew formulae that VisionClaw depends on for TCC permissions.
 * Prevents `brew upgrade` from changing their Cellar paths, which would
 * invalidate macOS permissions granted to the old versioned binary.
 *
 * Safe to call multiple times — `brew pin` on an already-pinned formula
 * is a no-op (exits 0).
 */
export declare function pinHomebrewBinaries(): void;
//# sourceMappingURL=macos-permissions.d.ts.map