@yagni-app/code 1.0.6 → 1.0.7

package/dist/extension/sandbox/config.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Sandbox settings schema + layered config load (user + project), shaped after
+ * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
+ * copied verbatim parses and resolves identically.
+ *
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
+ * .yagni-code/config.json (project) — the same pair permissionRules reads,
+ * so one settings file drives both the permission layer and the sandbox.
+ *
+ * Merge semantics (Claude parity): scalars — project wins over user over
+ * defaults; arrays — union + dedupe across sources (lists merge, never
+ * replace). Fail-soft: a malformed file is skipped whole with a warning
+ * (same posture as permissionRules/loadConfig.ts).
+ *
+ * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
+ * allowed by default with denyRead regions + allowRead re-allow; writes are
+ * allow-only (default-deny, /tmp included). Network: proxy-enforced
+ * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
+ * — loopback bypasses the proxy via no_proxy).
+ */
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+export interface SandboxNetworkSettings {
+    allowedDomains?: string[];
+    deniedDomains?: string[];
+    allowUnixSockets?: string[];
+    allowAllUnixSockets?: boolean;
+    allowLocalBinding?: boolean;
+    httpProxyPort?: number;
+    socksProxyPort?: number;
+}
+export interface SandboxFilesystemSettings {
+    allowRead?: string[];
+    denyRead?: string[];
+    allowWrite?: string[];
+    denyWrite?: string[];
+}
+export interface SandboxSettings {
+    enabled?: boolean;
+    /** Sandboxed bash auto-allows (explicit deny/ask rules still win). Default true. */
+    autoAllowBashIfSandboxed?: boolean;
+    /** false = strict mode: dangerouslyDisableSandbox is ignored entirely. Default true. */
+    allowUnsandboxedCommands?: boolean;
+    /** Exit-with-error posture when enabled but deps/platform unavailable. Default false. */
+    failIfUnavailable?: boolean;
+    excludedCommands?: string[];
+    network?: SandboxNetworkSettings;
+    filesystem?: SandboxFilesystemSettings;
+    ignoreViolations?: Record<string, string[]>;
+    enableWeakerNestedSandbox?: boolean;
+    enableWeakerNetworkIsolation?: boolean;
+}
+export interface SandboxConfigDiagnostics {
+    warnings: string[];
+    unknownKeys: string[];
+}
+export interface LoadedSandboxConfig {
+    settings: SandboxSettings;
+    diagnostics: SandboxConfigDiagnostics;
+}
+/**
+ * Read the `sandbox` object from one config file. Returns undefined when the
+ * file is missing, unreadable, malformed, or has no sandbox key. Collects
+ * unknown keys for diagnostics (ignored, never fatal).
+ */
+export declare function readSandboxSettingsFromFile(configPath: string, warnings: string[], unknownKeys: string[]): SandboxSettings | undefined;
+/**
+ * Load + merge sandbox settings from both config files. Scalars: project
+ * beats user; arrays: union. Defaults for scalars land here too (Claude
+ * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
+ * everything else unset/false.
+ */
+export declare function loadSandboxSettings(opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    stateHomeOverride?: string | null;
+}): LoadedSandboxConfig;
+export interface SandboxRuntimePaths {
+    cwd: string;
+    /** ~/.yagni-code (user `/`-anchor base + protected paths). */
+    userStateHome: string;
+    /** Project root; null outside a repo. */
+    projectRoot: string | null;
+    homeDir?: string;
+}
+export interface SandboxRuntimeMerge {
+    network: SandboxNetworkSettings & {
+        allowedDomains: string[];
+        deniedDomains: string[];
+    };
+    filesystem: SandboxFilesystemSettings & {
+        allowRead: string[];
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+    };
+    /** Permission rules that could not map into sandbox restrictions (surfaced
+     * in diagnostics — never silently dropped). */
+    droppedRules: string[];
+}
+/**
+ * Merge sandbox settings + permission rules into srt's effective filesystem /
+ * network restriction sets. Rule mapping (Claude parity):
+ *   Edit(path) allow  -> allowWrite
+ *   Edit(path) deny   -> denyWrite
+ *   Read(path) deny   -> denyRead
+ *   WebFetch(domain:) allow/deny -> allowedDomains / deniedDomains
+ *
+ * Rule paths use the permission-rule anchors (~/, //, settings-relative /,
+ * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
+ * path semantics (/ = absolute) exactly like Claude's two resolvers.
+ */
+export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths): SandboxRuntimeMerge;
+//# sourceMappingURL=config.d.ts.map

package/dist/extension/sandbox/config.js

@@ -0,0 +1,366 @@
+/**
+ * Sandbox settings schema + layered config load (user + project), shaped after
+ * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
+ * copied verbatim parses and resolves identically.
+ *
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
+ * .yagni-code/config.json (project) — the same pair permissionRules reads,
+ * so one settings file drives both the permission layer and the sandbox.
+ *
+ * Merge semantics (Claude parity): scalars — project wins over user over
+ * defaults; arrays — union + dedupe across sources (lists merge, never
+ * replace). Fail-soft: a malformed file is skipped whole with a warning
+ * (same posture as permissionRules/loadConfig.ts).
+ *
+ * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
+ * allowed by default with denyRead regions + allowRead re-allow; writes are
+ * allow-only (default-deny, /tmp included). Network: proxy-enforced
+ * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
+ * — loopback bypasses the proxy via no_proxy).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { codeStateHome } from "../stateHome.js";
+const KNOWN_TOP_LEVEL_KEYS = new Set([
+    "enabled",
+    "autoAllowBashIfSandboxed",
+    "allowUnsandboxedCommands",
+    "failIfUnavailable",
+    "excludedCommands",
+    "network",
+    "filesystem",
+    "ignoreViolations",
+    "enableWeakerNestedSandbox",
+    "enableWeakerNetworkIsolation",
+]);
+const KNOWN_NETWORK_KEYS = new Set([
+    "allowedDomains",
+    "deniedDomains",
+    "allowUnixSockets",
+    "allowAllUnixSockets",
+    "allowLocalBinding",
+    "httpProxyPort",
+    "socksProxyPort",
+]);
+const KNOWN_FILESYSTEM_KEYS = new Set(["allowRead", "denyRead", "allowWrite", "denyWrite"]);
+const ARRAY_KEYS_BY_SECTION = {
+    "": ["excludedCommands"],
+    network: ["allowedDomains", "deniedDomains", "allowUnixSockets"],
+    filesystem: ["allowRead", "denyRead", "allowWrite", "denyWrite"],
+};
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function stringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string") ? v : undefined;
+}
+/**
+ * Read the `sandbox` object from one config file. Returns undefined when the
+ * file is missing, unreadable, malformed, or has no sandbox key. Collects
+ * unknown keys for diagnostics (ignored, never fatal).
+ */
+export function readSandboxSettingsFromFile(configPath, warnings, unknownKeys) {
+    if (!existsSync(configPath))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+    }
+    catch (err) {
+        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    if (!isPlainObject(parsed) || parsed.sandbox === undefined)
+        return undefined;
+    if (!isPlainObject(parsed.sandbox)) {
+        warnings.push(`sandbox: "sandbox" in ${configPath} must be an object — ignored`);
+        return undefined;
+    }
+    const out = {};
+    const src = parsed.sandbox;
+    for (const [k, v] of Object.entries(src)) {
+        if (k === "network") {
+            if (isPlainObject(v)) {
+                const net = {};
+                for (const [nk, nv] of Object.entries(v)) {
+                    if (!KNOWN_NETWORK_KEYS.has(nk)) {
+                        unknownKeys.push(`network.${nk}`);
+                        continue;
+                    }
+                    if ((nk === "allowAllUnixSockets" || nk === "allowLocalBinding") && typeof nv === "boolean") {
+                        net[nk] = nv;
+                    }
+                    else if ((nk === "httpProxyPort" || nk === "socksProxyPort") && typeof nv === "number") {
+                        net[nk] = nv;
+                    }
+                    else {
+                        const arr = stringArray(nv);
+                        if (arr === undefined) {
+                            warnings.push(`sandbox: network.${nk} has an unsupported value type — ignored`);
+                        }
+                        else {
+                            net[nk] = arr;
+                        }
+                    }
+                }
+                out.network = net;
+            }
+            else {
+                warnings.push(`sandbox: network in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (k === "filesystem") {
+            if (isPlainObject(v)) {
+                const fs = {};
+                for (const [fk, fv] of Object.entries(v)) {
+                    if (!KNOWN_FILESYSTEM_KEYS.has(fk)) {
+                        unknownKeys.push(`filesystem.${fk}`);
+                        continue;
+                    }
+                    const arr = stringArray(fv);
+                    if (arr === undefined) {
+                        warnings.push(`sandbox: filesystem.${fk} has an unsupported value type — ignored`);
+                    }
+                    else {
+                        fs[fk] = arr;
+                    }
+                }
+                out.filesystem = fs;
+            }
+            else {
+                warnings.push(`sandbox: filesystem in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (!KNOWN_TOP_LEVEL_KEYS.has(k)) {
+            unknownKeys.push(k);
+            continue;
+        }
+        if (k === "ignoreViolations") {
+            if (isPlainObject(v)) {
+                const iv = {};
+                for (const [pat, arr] of Object.entries(v)) {
+                    const list = stringArray(arr);
+                    if (list === undefined) {
+                        warnings.push(`sandbox: ignoreViolations["${pat}"] must be a string array — ignored`);
+                    }
+                    else {
+                        iv[pat] = list;
+                    }
+                }
+                out.ignoreViolations = iv;
+            }
+            else {
+                warnings.push(`sandbox: ignoreViolations in ${configPath} must be an object — ignored`);
+            }
+            continue;
+        }
+        if (k === "excludedCommands") {
+            const list = stringArray(v);
+            if (list === undefined)
+                warnings.push(`sandbox: excludedCommands must be a string array — ignored`);
+            else
+                out.excludedCommands = list;
+            continue;
+        }
+        if (typeof v === "boolean")
+            out[k] = v;
+        else
+            warnings.push(`sandbox: ${k} must be a boolean — ignored`);
+    }
+    return out;
+}
+function union(...lists) {
+    const present = lists.filter((l) => Array.isArray(l));
+    if (present.length === 0)
+        return undefined;
+    return [...new Set(present.flat())];
+}
+function mergeNetwork(user, project) {
+    const u = user ?? {};
+    const p = project ?? {};
+    return {
+        allowedDomains: union(u.allowedDomains, p.allowedDomains) ?? [],
+        deniedDomains: union(u.deniedDomains, p.deniedDomains) ?? [],
+        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets),
+        allowAllUnixSockets: p.allowAllUnixSockets ?? u.allowAllUnixSockets,
+        allowLocalBinding: p.allowLocalBinding ?? u.allowLocalBinding,
+        httpProxyPort: p.httpProxyPort ?? u.httpProxyPort,
+        socksProxyPort: p.socksProxyPort ?? u.socksProxyPort,
+    };
+}
+function mergeFilesystem(user, project) {
+    const u = user ?? {};
+    const p = project ?? {};
+    return {
+        allowRead: union(u.allowRead, p.allowRead),
+        denyRead: union(u.denyRead, p.denyRead) ?? [],
+        allowWrite: union(u.allowWrite, p.allowWrite) ?? [],
+        denyWrite: union(u.denyWrite, p.denyWrite) ?? [],
+    };
+}
+/**
+ * Load + merge sandbox settings from both config files. Scalars: project
+ * beats user; arrays: union. Defaults for scalars land here too (Claude
+ * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
+ * everything else unset/false.
+ */
+export function loadSandboxSettings(opts = {}) {
+    const warnings = [];
+    const unknownKeys = [];
+    const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const userPath = join(stateHome, "config.json");
+    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
+    const userSettings = readSandboxSettingsFromFile(userPath, warnings, unknownKeys);
+    const projectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
+    const settings = {
+        enabled: projectSettings?.enabled ?? userSettings?.enabled ?? false,
+        autoAllowBashIfSandboxed: projectSettings?.autoAllowBashIfSandboxed ?? userSettings?.autoAllowBashIfSandboxed ?? true,
+        allowUnsandboxedCommands: projectSettings?.allowUnsandboxedCommands ?? userSettings?.allowUnsandboxedCommands ?? true,
+        failIfUnavailable: projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
+        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands) ?? [],
+        network: mergeNetwork(userSettings?.network, projectSettings?.network),
+        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem),
+        ignoreViolations: projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
+        enableWeakerNestedSandbox: projectSettings?.enableWeakerNestedSandbox ?? userSettings?.enableWeakerNestedSandbox,
+        enableWeakerNetworkIsolation: projectSettings?.enableWeakerNetworkIsolation ?? userSettings?.enableWeakerNetworkIsolation,
+    };
+    return { settings, diagnostics: { warnings, unknownKeys } };
+}
+function expandHome(p, homeDir) {
+    if (p === "~")
+        return homeDir;
+    if (p.startsWith("~/"))
+        return join(homeDir, p.slice(2));
+    return p;
+}
+function resolveSandboxPath(pattern, base) {
+    const homeDir = base.homeDir ?? homeDirDefault();
+    if (pattern.startsWith("//"))
+        return pattern.slice(1); // absolute from root (Claude legacy)
+    if (pattern.startsWith("/")) {
+        // Claude permission-rule convention: settings-dir-relative. User rules
+        // resolve against ~/.yagni-code, project rules against the project root.
+        return join(base.userStateHome, pattern.slice(1));
+    }
+    return expandHome(pattern, homeDir);
+}
+function resolveSandboxFsPath(pattern, base) {
+    // sandbox.filesystem.* uses STANDARD path semantics (Claude #30067):
+    //   /path  -> absolute (as written)
+    //   //path -> absolute (legacy permission-rule escape, kept for compat)
+    //   ~/path, ./path, path -> expanded / settings-dir-relative
+    const homeDir = base.homeDir ?? homeDirDefault();
+    if (pattern.startsWith("//"))
+        return pattern.slice(1);
+    if (pattern.startsWith("/"))
+        return pattern;
+    return expandHome(pattern, homeDir);
+}
+let homeDirDefault = () => homeDirImpl();
+import { homedir as homeDirImpl } from "node:os";
+function homeDirDefaultFn() { return homeDirImpl(); }
+homeDirDefault = homeDirDefaultFn;
+/**
+ * Merge sandbox settings + permission rules into srt's effective filesystem /
+ * network restriction sets. Rule mapping (Claude parity):
+ *   Edit(path) allow  -> allowWrite
+ *   Edit(path) deny   -> denyWrite
+ *   Read(path) deny   -> denyRead
+ *   WebFetch(domain:) allow/deny -> allowedDomains / deniedDomains
+ *
+ * Rule paths use the permission-rule anchors (~/, //, settings-relative /,
+ * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
+ * path semantics (/ = absolute) exactly like Claude's two resolvers.
+ */
+export function mergeRulesIntoSandbox(settings, rules, base) {
+    const homeDir = base.homeDir ?? homeDirDefault();
+    const allowWrite = new Set([base.cwd, tmpdir()]);
+    const denyWrite = new Set();
+    const denyRead = new Set();
+    const allowRead = new Set();
+    const allowedDomains = new Set(settings.network?.allowedDomains ?? []);
+    const deniedDomains = new Set(settings.network?.deniedDomains ?? []);
+    /** Permission rules that could not map into sandbox restrictions —
+     * surfaced to the caller (diagnostics), never silently dropped. */
+    const droppedRules = [];
+    // Permission rules: user rules resolve /-anchors against the user state
+    // home, project rules against the project root (pathRules semantics).
+    for (const rule of rules) {
+        const anchorBase = {
+            ...base,
+            userStateHome: rule.source === "user" ? base.userStateHome : (base.projectRoot ?? base.userStateHome),
+        };
+        if (rule.toolName === "edit" || rule.toolName === "write") {
+            if (!rule.ruleContent)
+                continue;
+            const p = resolveSandboxPath(rule.ruleContent, anchorBase);
+            if (rule.behavior === "allow")
+                allowWrite.add(p);
+            // ask and deny BOTH deny in the sandbox: an ask rule's contract is
+            // "consult the user for writes here", and sandbox auto-allow would
+            // silently skip that consultation for bash — degrading ask to allow.
+            // denyWrite blocks bash at the OS level; the file tools still honor
+            // ask through the ordinary gate flow.
+            else if (rule.behavior === "deny" || rule.behavior === "ask")
+                denyWrite.add(p);
+        }
+        else if (rule.toolName === "read") {
+            if (!rule.ruleContent)
+                continue;
+            const p = resolveSandboxPath(rule.ruleContent, anchorBase);
+            if (rule.behavior === "deny")
+                denyRead.add(p);
+        }
+        else if (rule.toolName === "web_fetch") {
+            const m = rule.ruleContent?.match(/^domain:(.*)$/);
+            if (!m) {
+                // Non-domain web_fetch rules (bare tool-name form) cannot map into
+                // the network lists — surface instead of silently dropping.
+                droppedRules.push(rule.raw);
+                continue;
+            }
+            const domain = m[1];
+            if (rule.behavior === "allow")
+                allowedDomains.add(domain);
+            else if (rule.behavior === "deny")
+                deniedDomains.add(domain);
+            else if (rule.behavior === "ask")
+                deniedDomains.add(domain); // same ask-wins reasoning
+        }
+    }
+    // sandbox.filesystem.*: standard path semantics (NOT settings-relative).
+    for (const p of settings.filesystem?.allowWrite ?? [])
+        allowWrite.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.denyWrite ?? [])
+        denyWrite.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.denyRead ?? [])
+        denyRead.add(resolveSandboxFsPath(p, base));
+    for (const p of settings.filesystem?.allowRead ?? [])
+        allowRead.add(resolveSandboxFsPath(p, base));
+    // Protected paths: always denyWrite, never exempted (Claude parity + our
+    // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
+    denyWrite.add(join(base.userStateHome, "config.json"));
+    if (base.projectRoot)
+        denyWrite.add(join(base.projectRoot, ".yagni-code", "config.json"));
+    denyWrite.add(base.userStateHome);
+    if (base.projectRoot)
+        denyWrite.add(join(base.projectRoot, ".yagni-code"));
+    return {
+        network: {
+            ...settings.network,
+            allowedDomains: [...allowedDomains],
+            deniedDomains: [...deniedDomains],
+        },
+        filesystem: {
+            allowRead: [...allowRead],
+            denyRead: [...denyRead],
+            allowWrite: [...allowWrite],
+            denyWrite: [...denyWrite],
+        },
+        droppedRules,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/extension/sandbox/manager.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Sandbox manager adapter — wraps @anthropic-ai/sandbox-runtime's
+ * SandboxManager with YAGNI Code wiring: dependency check against the
+ * vendored ripgrep, settings-derived runtime config (config.ts merge), and
+ * an injectable network ask-callback so the UI layer owns prompting (M5)
+ * while headless fails closed (deny).
+ *
+ * All state is session-scoped behind a single holder; nothing module-global
+ * is mutated except the underlying srt manager, which initialize/reset
+ * bracket. Pure functions (config building) live in config.ts.
+ */
+import { type SandboxSettings, type SandboxRuntimeMerge } from "./config.js";
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+/** Where the network ask-callback surfaces a decision. */
+export type NetworkAskHandler = (host: string) => Promise<boolean>;
+export interface SandboxDependencyStatus {
+    /** Fatal: sandbox cannot run. */
+    errors: string[];
+    warnings: string[];
+}
+export interface SandboxManagerEvents {
+    onStateChange?: (enabled: boolean) => void;
+}
+export interface SandboxSessionOptions {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    stateHomeOverride?: string | null;
+    projectRoot?: string | null;
+    /** Ripgrep binary for srt's dependency check (default: vendored rg). */
+    rgPath?: string;
+    askHandler?: NetworkAskHandler | null;
+    events?: SandboxManagerEvents;
+}
+export interface SandboxSessionState {
+    /** srt initialized and commands will be wrapped. */
+    initialized: boolean;
+    /** Last dependency status (memoized per init attempt). */
+    dependencies: SandboxDependencyStatus | null;
+    /** The settings snapshot this session initialized with. */
+    settings: SandboxSettings | null;
+}
+/** Default vendored rg shipped with the CLI install. */
+export declare function defaultRgPath(env?: NodeJS.ProcessEnv): string | undefined;
+export declare class YagniSandboxManager {
+    private state;
+    private askHandler;
+    private readonly opts;
+    constructor(opts: SandboxSessionOptions);
+    get initialized(): boolean;
+    get settings(): SandboxSettings | null;
+    get dependencies(): SandboxDependencyStatus | null;
+    setAskHandler(handler: NetworkAskHandler | null): void;
+    /** The failure-trail wrapper handed to srt — exported for tests so the
+     * catch-and-log contract (fail closed + sink line) is observable without
+     * driving a real wrapped network connection. */
+    networkAsk(host: string): Promise<boolean>;
+    checkDependencies(): SandboxDependencyStatus;
+    /**
+     * Build the runtime filesystem/network config from current settings +
+     * permission rules. Exposed for diagnostics (/sandbox config display) and
+     * tests; initialize() consumes it internally.
+     */
+    buildRuntimeMerge(rules: readonly PermissionRule[]): SandboxRuntimeMerge;
+    private runtimeConfig;
+    /**
+     * Initialize srt for this session. Returns an error string when the sandbox
+     * cannot start (deps/platform) — the caller decides fail-soft (notify) vs
+     * fail-hard (refuse to run, `failIfUnavailable`). Idempotent: a second call
+     * while initialized is a no-op.
+     *
+     * `force` bypasses the disk `enabled` check: the session-level toggle
+     * (/sandbox enable, Alt+S) must be able to START the sandbox in a
+     * default-off config — that is its entire purpose. Config-driven starts
+     * (session_start) never pass force.
+     */
+    initialize(rules: readonly PermissionRule[], opts?: {
+        force?: boolean;
+    }): Promise<string | undefined>;
+    /**
+     * Rebuild + push the srt config without reset (settings changed or a grant
+     * landed). No-op when not initialized.
+     */
+    refreshConfig(rules: readonly PermissionRule[]): void;
+    /**
+     * Re-init from scratch (config grant changed semantics srt can't hot-swap,
+     * or a toggle). Tears down proxies + violation store first.
+     */
+    reinitialize(rules: readonly PermissionRule[]): Promise<string | undefined>;
+    /** Tear down srt (proxies, violation store, seatbelt state). */
+    reset(): Promise<void>;
+    wrapWithSandbox(command: string, binShell?: string): Promise<string>;
+    cleanupAfterCommand(): void;
+    annotateStderrWithSandboxFailures(command: string, stderr: string): string;
+    getProxyPort(): number | undefined;
+    getSocksProxyPort(): number | undefined;
+}
+//# sourceMappingURL=manager.d.ts.map