import { CliExecResult } from "../types.js";
import { type Config } from "../config.js";
export declare function setSandboxOverride(mode: Config["COGENT_CODEX_SANDBOX"] | null): void;
/** Reset the override (test isolation). */
export declare function resetSandboxOverride(): void;
/** The sandbox mode execCodex will actually use (override wins over config). */
export declare function effectiveSandbox(config: Config): Config["COGENT_CODEX_SANDBOX"];
/**
 * Signature of an OS-sandbox initialization failure in Codex stderr: the sandbox
 * (bubblewrap) could not create an unprivileged user/network namespace on this
 * host. Covers the uid-map failure (`bwrap: setting up uid map: Permission
 * denied`), the netns loopback variant (`RTM_NEWADDR: Operation not permitted`,
 * memory `codex-bwrap-netns-sandbox-2026-05-31`), and bare `unshare`/userns EPERM.
 * Used to tag `CliExecResult.sandboxBlocked` so the caller surfaces an actionable
 * remedy instead of a generic exec failure.
 */
export declare const SANDBOX_FAILURE_RE: RegExp;
/**
 * Signature of the codex >=0.145 SINGLE-WRITER thread-store conflict: the target
 * thread is held by a live interactive TUI, so `codex exec resume` cannot open
 * its writer and fast-fails. Used to tag `CliExecResult.codexLiveSession` so the
 * caller surfaces an honest "queued — will answer next turn" message (and points
 * at the app-server rail) instead of a generic capture failure.
 */
export declare const ACTIVE_WRITER_RE: RegExp;
/**
 * Resume a Codex session non-interactively and return its final agent message.
 * Parallel to execClaude() in cc-cli.ts. Uses `-o <file>` to capture the last
 * message cleanly (no stdout parsing); falls back to stdout if the file is
 * unreadable. Runs sandboxed via --full-auto by default so it never blocks on
 * an approval prompt the relay cannot answer.
 */
export declare function execCodex(sessionId: string, message: string, cwd: string, timeoutMs?: number): Promise<CliExecResult>;
export declare function codexSessionsRoot(): string;
/**
 * Find the most recently active Codex session for a given cwd by scanning
 * ~/.codex/sessions/**.jsonl, matching session_meta.payload.cwd, newest mtime
 * wins. Parallel to detectCurrentSession() in cc-cli.ts. Null if none match.
 */
export declare function detectCurrentCodexSession(cwd: string): Promise<string | null>;
/**
 * List all Codex session candidates for a cwd as {sessionId, mtimeMs}, filtered
 * to rollouts whose session_meta.cwd === cwd (stronger than the CC path — it
 * verifies from file content, not a lossy escaped-path map). Returns [] on
 * error. Parallel to listCandidates() in cc-cli.ts.
 */
export declare function listCodexCandidates(cwd: string): Promise<{
    sessionId: string;
    mtimeMs: number;
}[]>;
/**
 * True if a Codex rollout with this session id exists on disk.
 *
 * Unlike cc-cli.ts's validateSession(sessionId, cwd), this takes no cwd: Codex
 * partitions rollouts by date, not by cwd, so the id must be located by scan.
 * Reads file headers until the first match (early-exit), acceptable for the
 * occasional auto-relay session-refresh path.
 */
export declare function validateCodexSession(sessionId: string): Promise<boolean>;
//# sourceMappingURL=codex-cli.d.ts.map