@tencent-ai/agent-harness 0.2.0-beta.7 → 0.2.0-beta.8

package/cli/dist-server/types/node/permission/sandbox-orchestrator.d.ts

@@ -0,0 +1,308 @@
+import { Logger } from '@celljs/core';
+import { type Session, SessionManager } from '../../vendor/cbc-core/node/index.js';
+import { Workspace } from '../../workspace/runtime/lib/common/index.js';
+import type { DecisionRecord } from '../../workspace/sandbox-cli/lib/common/protocol.generated.js';
+import { type BashSandboxManager as IBashSandboxManager } from '../bash-sandbox/bash-sandbox-protocol';
+import { type CommandParserService as ICommandParserService } from '../command-parser/command-parser-protocol';
+import { type ISandboxCLILifecycle } from '../sandbox-cli/sandbox-cli-lifecycle-protocol';
+import { type SandboxRuleSyncService as ISandboxRuleSyncService } from '../sandbox-cli/sandbox-rule-sync-service';
+import { SandboxTurnConfig } from '../sandbox-cli/sandbox-turn-config';
+import { type SandboxCenterIpcClient } from '../sensitive-content/sandbox-center-ipc-client-protocol';
+import { type ShellService } from '../shell/shell-protocol';
+import { type SandboxTelemetryReporter as ISandboxTelemetryReporter } from '../telemetry/sandbox-telemetry-protocol';
+import { type FileSafetyOperation } from '../utils/security-audit-log';
+import { type BrokeredSandboxApprovalCoordinator as IBrokeredSandboxApprovalCoordinator } from './brokered-sandbox/approval-coordinator';
+import { type RiskAssessment } from './file-policy-assessment';
+import { type SandboxAuditService as ISandboxAuditService } from './sandbox-audit-service';
+import { type SandboxExecPolicy as ISandboxExecPolicy } from './sandbox-exec-policy-protocol';
+import { type SandboxOrchestrator as ISandboxOrchestrator, type SandboxOrchestratorParams, type SandboxOrchestratorResult, type SandboxTelemetryContext } from './sandbox-orchestrator-protocol';
+export declare function resolveSingleFileApprovalOperation(assessments: readonly RiskAssessment[], decisionRecords?: readonly DecisionRecord[]): Exclude<FileSafetyOperation, 'access'> | undefined;
+/**
+ * 在 execute 入口捕获执行所属会话，权限判断、审批记录和审计均使用同一会话。
+ * 权限读取所属 session 的当前设置，不使用 telemetry 中的派生值。
+ */
+export interface SandboxOrchestratorAuthority {
+    readonly session: Session;
+    readonly conversationRequestId?: string;
+    readonly permissionMode?: string;
+    readonly useSandboxCLI: boolean;
+    readonly telemetry: SandboxTelemetryContext;
+}
+export declare function captureSandboxOrchestratorAuthority(session: Session | undefined, turnConfig: Pick<SandboxTurnConfig, 'useSandboxCLI'>, telemetryContext?: SandboxTelemetryContext): SandboxOrchestratorAuthority | undefined;
+/**
+ * Codex-style sandbox execution orchestrator.
+ *
+ * Owns the "sandbox-first, bypass on approval" policy described in
+ * `apps/workbuddy-desktop/docs/refactor/win-cli-sandbox/18-codex-alignment-plan.md`:
+ *
+ *   1. If the tool call carries `dangerouslyDisableSandbox=true`, surface an
+ *      approval UI up-front and go straight to the local shell on consent.
+ *   2. Consult the session-scoped {@link SandboxApprovalStore} for a cached
+ *      `allow_session` decision keyed by `(canonicalCommand, cwd)` and
+ *      short-circuit to local execution on hit.
+ *   3. Otherwise run the command under `SandboxShellService`. Successful runs
+ *      return immediately.
+ *   4. When the sandboxed attempt fails due to real sandbox denials
+ *      (`sandboxDenied`), request approval. Deny → return the failing
+ *      sandboxed handle; allow → store the approval for `allow_session`,
+ *      reset caller-held output buffers via `onSandboxRetryStart`, and
+ *      re-run through `LocalShellService`.
+ */
+export declare class SandboxOrchestratorImpl implements ISandboxOrchestrator {
+    protected readonly localShellService: ShellService;
+    protected readonly sandboxShellService: ShellService;
+    protected readonly legacySandboxShellService: ShellService;
+    protected readonly sessionManager: SessionManager;
+    protected readonly sandboxTurnConfig: SandboxTurnConfig;
+    /** 每次 execute 的所属会话与归因信息，异步等待后不再读取全局当前会话。 */
+    private readonly authorities;
+    private _authority;
+    protected readonly workspace: Workspace;
+    protected readonly commandParser: ICommandParserService;
+    protected readonly bashSandboxManager: IBashSandboxManager;
+    protected readonly execPolicy: ISandboxExecPolicy;
+    protected readonly auditService?: ISandboxAuditService;
+    protected readonly telemetryReporter?: ISandboxTelemetryReporter;
+    protected readonly brokeredApprovalCoordinator?: IBrokeredSandboxApprovalCoordinator;
+    protected readonly sandboxCenterClient?: SandboxCenterIpcClient;
+    protected readonly sandboxRuleSyncService?: ISandboxRuleSyncService;
+    protected readonly sandboxLifecycle?: ISandboxCLILifecycle;
+    protected readonly logger: Logger;
+    /**
+     * 记录本次 `execute()`（以 `params` 对象身份为 key）是否已产生过命令终局
+     * （`_finalizeOutcome` 调用过）。异常兜底据此去重——已出终局后再抛异常
+     * 不再补 `exec-exception`，保证「一条命令最多一条 outcome」。
+     */
+    private readonly _outcomeReported;
+    /**
+     * 记录本次 `execute()` 在产生终局**之前**已经真正向用户弹过一次授权窗、但
+     * 该弹窗本身没有出终局、命令继续往下跑的情况（当前来源：Center 命令 ask
+     * 或内置 unsafe-find-delete，`allow_once` 批准后继续跑沙箱）。`_finalizeOutcome` 据此把后续任意
+     * 终局（sandbox-ok / 零弹窗 auto-approved 等）的
+     * `prompted` 修正为 `true`——否则这些「已打扰过用户」的命令会被误记成
+     * `prompted=false`，污染减扰率 KPI。
+     */
+    private readonly _preExecApprovals;
+    /** 每次 execute 共享同一个 Center 策略解析上下文与命令裁决。 */
+    private readonly _centerPolicies;
+    private _centerPolicy;
+    /**
+     * 全链路入口：包一层 catch-all 守住「全漏斗」——只有当命令**还没产生任何
+     * 权限终局**就抛出未捕获异常（如沙箱进程 spawn 失败 / wait 崩溃 / 授权回调
+     * 异常等基础设施故障）时，才补一条 `stage='exception'`、`outcome='error'`、
+     * `reason='exec-exception'` 的兜底终局；若已出终局（如已 auto-approved 再
+     * 本地重跑时抛错），则不重复上报。无论是否补报，异常都原样向上抛。
+     *
+     * 注意：异常属基础设施故障而非命令业务终局，`outcome='error'` 走 logInfo 不进
+     * 告警流（详细诊断由 `sandbox.daemon.failure` 承接）；放通率分母默认剔除
+     * `reason='exec-exception'`。
+     */
+    execute(params: SandboxOrchestratorParams): Promise<SandboxOrchestratorResult>;
+    private _executeInternal;
+    /**
+     * Resolve the sandbox backend for the current host.
+     *
+     * Desktop macOS/Windows use the Rust `sandbox-cli` via IPC. Linux only uses
+     * sandbox-cli when the WorkBuddy host explicitly enables that capability;
+     * otherwise shared CodeBuddy/CBC Linux keeps the legacy backend.
+     */
+    private _resolveBackend;
+    /**
+     * 系统级工具策略分流。
+     *
+     * 返回 `SandboxOrchestratorResult` 时表示已处理（disabled / always_confirm）；
+     * 返回 `undefined` 表示 `auto_execute`，交由后续正常沙箱流程处理。
+     */
+    private _handleSystemToolPolicy;
+    /**
+     * Build a synthetic failure handle for commands forbidden by
+     * {@link SandboxExecPolicy}. No shell is spawned, no approval UI is shown.
+     *
+     * The result looks like a command that failed with exitCode=1 and an
+     * explanatory stderr message; `sandboxDenied` is set so upstream callers
+     * that inspect the flag see a consistent "sandbox-enforced failure",
+     * while `sandboxEscalationDenied` prevents any downstream logic from
+     * attempting to re-prompt the user.
+     */
+    private _handleForbidden;
+    private _handlePreExecBypass;
+    /**
+     * 命中 Center allow 规则的命令是静默放行的，终局只会落泛化的 `sandbox-executed`，
+     * 无法回答「是哪条规则放的行」。这里补一条带 matchedRule 的 allow-matched，
+     * 与 ask/deny 网关的审计口径对齐。
+     */
+    private _auditCenterCommandAllowMatches;
+    private _auditConfiguredNetworkAllowMatches;
+    private _buildAuditContext;
+    private _commandForLocalUse;
+    private _localShellCommand;
+    private _createPreExecApprovalTelemetry;
+    /**
+     * 保证严格模式拦截一定带一条模型可见的网络记录（genie/genie#122764）。
+     *
+     * Seatbelt 对 blanket deny 上报的是**规则**的地址过滤器而非目的地址，`host`
+     * 可能缺失；而投影层（`projectNetworkDecision`）要求 host 非空——缺 host 时
+     * 记录掉进 `unmappedDecisionRecords`，模型只剩内核的 `Operation not permitted`，
+     * 连「被系统层拦了」这个事实都看不到。
+     *
+     * 目标缺失时用 `unknown` 兜底：提示的价值远高于目标精确性（与审计侧
+     * `network-strict.blocked` 用 `unknown` 落库同口径）。
+     * 已有严格模式记录时原样返回，不重复注入。
+     */
+    private _ensureStrictModeNetworkRecords;
+    private _appendSandboxOutcomeAuditLog;
+    private _mergeBrokeredPromptBlocks;
+    private _handleCommandSafetyAskGate;
+    private _handleCommandSafetyDenyGate;
+    private _buildCommandSafetyAskApprovalKey;
+    private _buildPostExecRequest;
+    private _handlePostExecCommandAsk;
+    /**
+     * Handle post-exec escalation for the new permission path.
+     *
+     * Called when the attribution analyzer concludes `sandbox_denied` — the
+     * command failed because the sandbox blocked actionable file operations.
+     *
+     *   1. Consume complete native file decisions; missing coverage needs approval.
+     *   2. If every file decision allows access → Native re-run, zero prompts.
+     *   3. If any block is explicitly denied → keep the sandbox failure, zero prompts.
+     *   4. If any block `needs_approval` → delegate to the approval UI.
+     *      The UI only shows `needs_approval` items (D18: reduce cognitive load).
+     *   5. auto-approve does NOT write to ApprovalStore (D17: system judgement ≠ user auth).
+     */
+    private _handlePostExecEscalation;
+    private _handleSafeDeleteBulkConfirmEscalation;
+    private _resolveSafeDeleteBulkFilePolicy;
+    private _buildSafeDeleteBulkTargetFileBlocks;
+    private _extractSafeDeleteBulkCommandTargetCandidates;
+    private _resolveSafeDeleteBulkTargetPath;
+    private _getTelemetryCorrelation;
+    /**
+     * 上报 safe-delete 批量删除保护审批结果。
+     *
+     * 这类弹窗复用授权 UI，但不是沙箱文件 / 网络权限拦截，因此不能复用
+     * `sandbox.tool_call.intercept`。
+     */
+    private _reportSafeDeleteBulkApproval;
+    private _persistSafeDeleteBulkApproval;
+    private _persistSafeDeleteBulkRejection;
+    /**
+     * 一次性读取 side-channel 信号文件 + stderr 兜底，返回统一的检测结果。
+     * 信号文件优先（不受 PTY 输出塌缩影响），读完即删。
+     */
+    private _detectBulkGuardSignal;
+    private _readBulkGuardSignalFile;
+    private _asUserDeniedBulkResult;
+    private _handleSafeDeleteFailClosedEscalation;
+    /**
+     * 上报沙箱首跑结果。该事件只描述“命令进入沙箱后的第一次执行事实”，
+     * 不表达最终放行 / 拒绝；终局仍由 `_finalizeOutcome` 负责。
+     */
+    private _reportSandboxFirstRun;
+    /**
+     * 上报 `sandbox.tool_call.intercept`（真正向用户弹出授权弹窗的拦截场景）。
+     *
+     * 与 `sandbox_first_run` / `outcome` 复用同名公共字段（toolName /
+     * interceptType / exitCode / conversationId / conversationRequestId）便于
+     * 后台跨事件 join；`decision` 是本事件特有维度。
+     *
+     * `toolName` 由工具层透传（orchestrator 本身 tool-agnostic）。
+     */
+    private _reportIntercept;
+    /**
+     * 命令终局的**唯一出口**：本地审计日志 + 上报 `sandbox.tool_call.outcome`
+     * （贯穿 pre-exec + post-exec 全链路的命令终局事件）+ 标记本次已出终局。
+     *
+     * 合并了原 `_logOutcome`（本地日志）与 `_reportOutcome`（伽利略上报）两个出口，
+     * 保证 reason 只写一次、不漂移，且每个终止点必然同时落本地日志与远端事件。
+     * 在 `execute()` 的每个终止点恰好调用一次，提供完整漏斗与分母，与
+     * `_reportIntercept`（真实弹窗子集）互补。
+     *
+     * `stage` / `outcome` 优先用调用方显式传入，否则从 `REASON_STAGE_OUTCOME`
+     * 静态映射表按 `reason` 补齐；若 reason 未登记且未显式给值，按 `exception/error`
+     * 兜底并 warn（绝不静默落成 pre-exec/allow 污染放通率）。
+     * `toolName` 取值口径同 `_reportIntercept`。
+     * reporter 未注入时跳过上报但仍落本地日志、仍标记终局；上报异常被兜住、不影响主链路。
+     */
+    private _finalizeOutcome;
+    private _logTelemetryDiagnostic;
+    /**
+     * 推导零弹窗自动批的放通凭据（best-effort 取主因）。
+     *
+     * 优先级（强→弱）：
+     * 1. `command-allowlist`  —— 命令 allow 名单**实际把一条本应弹窗的 block 降级放通**
+     *                      （`commandAllowDowngradedCount > 0`）；若仅冗余命中（路径
+     *                      本就 low）则不记此项，落到 `baseline-low-risk`，避免高估其贡献
+     * 2. `full-access-medium` —— bypass(fullAccess) 模式下放通了 🟡 medium（仅显式 medium 规则会触发）
+     * 3. `file-allowlist`     —— 命中用户文件 allowlist（user-allowlist 规则）
+     * 4. `baseline-low-risk` —— 全部 🟢 low（显式低风险规则）
+     */
+    private _deriveAutoApproveReason;
+    /**
+     * 取一组风险评估里的最高风险等级；空集返回 undefined。
+     */
+    private _maxRiskLevel;
+    private _resolveFilePolicyRuleSources;
+    private _appendFileSafetyDecisionAuditLog;
+    /**
+     * Convert macOS `sed -i` temporary deny paths (`/.!<pid>!<name>`) back to
+     * the user-facing target path for file-safety audit readability.
+     *
+     * Example:
+     *   /Users/alice/.!79171!t.py -> /Users/alice/t.py
+     */
+    private _resolveFileSafetyAuditPath;
+    /**
+     * Re-run a command natively after sandbox denial + approval / auto-approve.
+     *
+     * Resets caller-side buffers via `onSandboxRetryStart` so the retry output
+     * replaces the first-attempt output, then runs locally.
+     *
+     */
+    private _nativeRerun;
+    private _wrapNativeRerunHandle;
+    private _buildNativeRerunPayload;
+    private _scheduleNativeRerunReport;
+    private _reportNativeRerun;
+    /**
+     * Map the session's {@link PermissionMode} to the sandbox policy's
+     * {@link ExecutionMode} (`'default'` or `'bypass'`).
+     *
+     * Unrestricted sessions (`fullAccess`, or bypass + `CODEBUDDY_IS_SANDBOX`)
+     * → `'bypass'` (🟡 medium auto-approved). Everything else
+     * (including plain `bypassPermissions`) → `'default'`.
+     */
+    private _resolveExecutionMode;
+    private _shouldEscalate;
+    /**
+     * Mirrors `SandboxShellService.execute`'s cwd resolution: join the first
+     * workspace folder (or `process.cwd()`) with the caller-supplied relative
+     * `cwd`. Keeps the approval cache key identical to the cwd the shell
+     * backend will actually use.
+     */
+    private _resolveCwd;
+    private _getSessionApproval;
+    private _isSessionApproved;
+    /**
+     * Decide whether the orchestrator should attempt the sandbox path.
+     *
+     * Single source of truth: `settings.sandbox.enabled` in
+     * `.codebuddy/settings.local.json` (or the user-level `settings.json`).
+     * Both entry points — the TUI `/sandbox` panel and the Desktop
+     * `SandboxConfigBar` toggle — write this same setting (the Desktop path
+     * via `AcpAgent.setSessionConfigOption(configId='sandbox')`).
+     *
+     * Rationale for the settings-only approach:
+     *   - Persists across CLI sidecar restarts (the Desktop app can respawn
+     *     the agent-cli child process transparently).
+     *   - Avoids the `session.useSandboxCLI` in-memory override that silently
+     *     diverged from settings when the sidecar was restarted mid-session.
+     *   - Project-level scope matches user intent: "this workspace runs in
+     *     sandbox" rather than "just this one conversation".
+     */
+    private _readSandboxConfig;
+    private _isSandboxEnabled;
+    private _persistApprovedPostExecAsks;
+    private _storeApproval;
+    private _runLocal;
+}

package/cli/dist-server/types/node/permission/sandbox-permission-gateway.d.ts

@@ -0,0 +1,36 @@
+import { Logger } from '@celljs/core';
+import { type BashSandboxManager as IBashSandboxManager } from '../bash-sandbox/bash-sandbox-protocol';
+/**
+ * DI symbol for {@link SandboxPermissionGateway}.
+ */
+export declare const SandboxPermissionGateway: unique symbol;
+/**
+ * Sandbox Permission Gateway — 新权限路径入口分流。
+ *
+ * 职责：判断当前工具目标是否应走"沙箱新路径"（跳过 8-Phase 规则链）。
+ *
+ * 设计原则：
+ * - 分流判据：本轮沙箱执行路径是否已启用（SandboxTurnConfig.useSandboxCLI）
+ * - 同一个请求只走一条路径，新旧互斥
+ * - 不改动旧路径任何逻辑
+ *
+ * 当此 Gateway 判断走新路径时，needsApproval 返回 false，权限判断完全交由
+ * SandboxOrchestrator 在执行阶段处理（ApprovalStore → 沙箱执行 → 归因 → 提权）。
+ */
+export interface SandboxPermissionGateway {
+    /**
+     * 判断工具目标（命令或文件路径）是否应走沙箱新路径。
+     * 非字符串输入直接返回 false，不读取沙箱配置。
+     *
+     * @returns true = 走新路径（跳过 8-Phase），false = 走旧路径（8-Phase 规则链）
+     */
+    shouldUseSandboxPath(target: unknown): Promise<boolean>;
+}
+/**
+ * 默认实现：基于 SandboxConfig.enabled 判断（与 Orchestrator 同口径）。
+ */
+export declare class SandboxPermissionGatewayImpl implements SandboxPermissionGateway {
+    protected readonly bashSandboxManager?: IBashSandboxManager;
+    protected readonly logger: Logger;
+    shouldUseSandboxPath(target: unknown): Promise<boolean>;
+}

package/cli/dist-server/types/node/permission/sandbox-telemetry-context.d.ts

@@ -0,0 +1,27 @@
+import type { SandboxToolCallRoute, SandboxTurnDisabledReason } from '../../workspace/telemetry/lib/common/index.js';
+import type { SandboxTelemetryContext } from './sandbox-orchestrator-protocol';
+interface SandboxTelemetrySession {
+    id: string;
+    conversationRequestId?: string;
+    messageId?: string;
+    meta?: {
+        rootRequestId?: unknown;
+        parentSessionId?: unknown;
+    };
+}
+interface SandboxTelemetryContextDiagnostics {
+    warn?: (message: string) => void;
+}
+/** 只返回当前稳定策略能证明的 Sandbox 预期，未知样本保持 undefined。 */
+export declare function deriveSandboxExpected(route: SandboxToolCallRoute, routeReason: string): boolean | undefined;
+/** 保存旁路上报状态，不向 Session.meta 注入业务字段。 */
+export declare function setSandboxTurnDisabledReason(session: object, reason: SandboxTurnDisabledReason | undefined): void;
+export declare function getSandboxTurnDisabledReason(session: object): SandboxTurnDisabledReason | undefined;
+/** 记录 ACP 最近一次成功应用到 CLI 的 Sandbox 开关状态，仅用于归因。 */
+export declare function setSandboxConfigApplicationState(session: object, enabled: boolean): void;
+export declare function getSandboxConfigApplicationState(session: object): {
+    enabled: boolean;
+} | undefined;
+/** 在 ToolCall 入口固化 Session 关联信息，避免异步弹窗期间串 Session。 */
+export declare function createSandboxTelemetryContext(session: SandboxTelemetrySession, diagnostics?: SandboxTelemetryContextDiagnostics): SandboxTelemetryContext;
+export {};

package/cli/dist-server/types/node/permission/sensitive-command-detector.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Sensitive Command Detector — 敏感指令前置粗筛。
+ *
+ * 设计文档 § 五-② 定位：
+ * - 在命令进入沙箱 **之前**，对"一眼就能看出高危"的指令做前置拦截
+ * - 这是**粗筛**：只识别明确高危的指令模式，不求覆盖所有边界
+ * - 有误判（漏放）不要紧，沙箱会兜住；宁可漏筛也不误拦
+ *
+ * 检测规则：
+ * - 读取凭据路径（如 `cat ~/.ssh/id_rsa`）— 凭据泄露到 LLM 上下文，不可逆
+ * - 写入/修改凭据路径（如 `echo "x" >> ~/.ssh/authorized_keys`）— 凭据被篡改
+ * - 删除凭据路径（如 `rm ~/.ssh/id_rsa`）— 凭据永久丢失
+ * - 不透明脚本宿主（如 `osascript`, `cscript`, `wscript`）— 通过 IPC/COM
+ *   间接执行操作，沙箱无法有效审计其行为，一律前置拦截
+ * - Shell 启动脚本写入由 Center 文件策略处理；批量删除另有独立审批链路
+ *
+ * 关键约束：
+ * - 敏感指令判断在 ApprovalStore **之前**执行
+ * - 不被 `allow_session` 绕过（🔴 高风险是安全底线）
+ * - Bypass 模式下敏感指令仍需弹窗
+ * - 跨平台路径归一化：Windows `%USERPROFILE%`/`$env:USERPROFILE`/`$HOME`/`~`
+ *   统一归一化为 `~/` 后再匹配
+ */
+import { Logger } from '@celljs/core';
+import type { SecurityCenterCommandRule } from '../bash-sandbox/bash-sandbox-protocol';
+import { type SecurityAuditContext } from '../utils/security-audit-log';
+/** DI symbol for {@link SensitiveCommandDetector}. */
+export declare const SensitiveCommandDetector: unique symbol;
+/**
+ * Result of sensitive command detection.
+ */
+export interface SensitiveDetectResult {
+    /** Whether the command is considered sensitive. */
+    sensitive: boolean;
+    /** Human-readable reason for the detection (for logging / UI). */
+    reason?: string;
+    /** Which sensitive paths were matched. */
+    matchedPaths?: string[];
+}
+export interface SensitiveCommandDetector {
+    /**
+     * Detect whether a command accesses (reads, writes, or deletes) sensitive credential paths.
+     *
+     * @param command - Raw command string (before canonicalisation).
+     * @returns Detection result; `sensitive=true` means "skip sandbox, show approval UI directly".
+     */
+    detect(command: string, auditContext?: SecurityAuditContext): SensitiveDetectResult;
+    /** Replace ordered command rules cached by the detector. */
+    setOrderedCommandRules?(rules: readonly SecurityCenterCommandRule[] | undefined): void;
+}
+export declare class SensitiveCommandDetectorImpl implements SensitiveCommandDetector {
+    protected readonly logger: Logger;
+    /**
+     * Sensitive credential path list. Defaults to {@link DEFAULT_SENSITIVE_CREDENTIAL_PATHS}.
+     * Can be overridden via product configuration in the future.
+     */
+    private sensitiveCredentialPaths;
+    private orderedCommandRules;
+    detect(command: string, auditContext?: SecurityAuditContext): SensitiveDetectResult;
+    private _detect;
+    /**
+     * Update the sensitive credential path list at runtime (e.g. from product config).
+     * Intended for future product.json configuration integration.
+     */
+    setSensitiveCredentialPaths(paths: readonly string[]): void;
+    setOrderedCommandRules(rules: readonly SecurityCenterCommandRule[] | undefined): void;
+    /**
+     * @deprecated Use {@link setSensitiveCredentialPaths} instead.
+     */
+    setSensitiveReadPaths(paths: readonly string[]): void;
+}