/**
 * Ad-hoc SSH command executor used by the `ssh_exec` command handler (see
 * `commands/index.ts`). Ports the timeout / stdout+stderr aggregation /
 * exit-code formatting logic from `api/src/llm/tools/ssh.tool.ts`'s
 * `executeViaSsh`, and additionally supports routing the SSH TCP connection
 * through a Tailscale sidecar's SOCKS5 proxy (see admin-docs
 * `docs/specifications/ssh-tailscale-support.md`, section 2).
 *
 * When the resolved credential's `connectionType` is `'tailscale'`, a SOCKS5
 * socket to `tailnetHostname:port` is established first (via the `socks`
 * package, talking to the ECS oneshot task's `tailscaled` sidecar on
 * `127.0.0.1:<socksPort>`) and handed to ssh2's `Client.connect({ sock })`.
 * Otherwise ssh2 connects directly to `hostname`/`port` as before.
 *
 * Fallback禁止 (see CLAUDE.md / the design doc's "フォールバック禁止"
 * section): a failed SOCKS5 hop is a hard failure — this never falls back
 * to a direct, non-Tailscale connection.
 *
 * `ssh2`/`socks` are loaded via dynamic `import()` so agents that never run
 * `ssh_exec` do not pay their require() cost at startup, mirroring the
 * lazy-load pattern used for `ecs-launcher`/`server-setup-runner` in
 * `commands/index.ts`.
 *
 * SECURITY: `credential.privateKey` (holds either the SSH private key or a
 * password, depending on `authType`) and `credential.tailscaleAuthKey` must
 * never be logged.
 */
import { type SshExecCredential } from '../types';
/** Default timeout when the caller/payload does not specify one. */
export declare const DEFAULT_SSH_EXEC_TIMEOUT_SECONDS = 30;
/**
 * Default SOCKS5 listen port for the Tailscale sidecar (design doc section 2).
 * Re-exported from `constants.ts`'s `TAILSCALE_SOCKS_PORT` — the single
 * source of truth also used by `server-setup-runner.ts` and
 * `task-definition-registrar.ts` — so this module keeps its existing export
 * name for callers that already import `DEFAULT_TAILSCALE_SOCKS_PORT` from here.
 */
export declare const DEFAULT_TAILSCALE_SOCKS_PORT = 1055;
/**
 * Execute `command` over SSH against the host described by `credential`,
 * returning combined stdout/stderr formatted the same way as the api-side
 * `SshTool.executeViaSsh`: plain stdout on a clean (0) exit, or an
 * "Exit code: N\nSTDOUT:\n...\nSTDERR:\n..." block otherwise.
 */
export declare function executeSshCommand(credential: SshExecCredential, command: string, timeoutSeconds?: number): Promise<string>;
//# sourceMappingURL=ssh-executor.d.ts.map