/**
 * Declarative env-scrub SSOT for harness children.
 *
 * Previously each adapter hand-rolled a partial denylist: codex scrubbed only
 * OpenAI vars, claude only Anthropic/AWS/Google, cursor only its base-URL. The
 * result was a cross-provider credential LEAK — a codex child inherited the
 * user's `ANTHROPIC_API_KEY`, a claude child inherited `OPENAI_API_KEY`, etc.
 *
 * The contract is now uniform: scrub EVERY known provider credential / redirect
 * env var from a harness child, then have the adapter re-add ONLY the single
 * variable its chosen auth route legitimately needs (after the scrub). Base-URL
 * redirects are always scrubbed so a redirect can never exfiltrate a seeded
 * credential.
 */
export declare const PROVIDER_SECRET_ENV: readonly string[];
/**
 * Build an env patch (`{VAR: null}`) that scrubs every provider secret EXCEPT the
 * ones in `keep` (the vars the adapter's chosen route legitimately uses, which it
 * sets explicitly afterward). Apply this AFTER spreading `spec.env`.
 */
export declare function providerScrubEnv(keep?: readonly string[]): Record<string, null>;
/**
 * Minimal env an interactive CLI genuinely needs to run (locale, terminal, temp,
 * and PATH to find its own binary + tools). Everything else is dropped under
 * `env_inheritance: "clean"` — agent env isolation. Exact var values still come
 * from the parent; only the KEY SET is restricted. Provider secrets are NOT in
 * the allowlist (defense-in-depth on top of providerScrubEnv), and the adapter
 * re-adds its single chosen credential explicitly afterward.
 */
export declare const CLEAN_ENV_ALLOWLIST: readonly string[];
/**
 * Windows process-environment keys a spawned native CLI needs to start at all:
 * the system root and shell that Windows itself resolves against, the temp and
 * profile roots every vendor CLI writes to, and PATHEXT. Read case-insensitively
 * on Windows, so the canonical uppercase spelling here matches any casing the OS
 * used. Kept as one named set so every scrubbed spawn env forwards the same
 * keys instead of each caller guessing.
 */
export declare const WINDOWS_RUNTIME_ENV_KEYS: readonly string[];
/**
 * Copy allowlisted keys out of `source`. Windows spells its own variables
 * `SystemRoot`, `ComSpec`, `windir`, and a plain object copy of `process.env`
 * loses the case-insensitive lookup the live object has, so there the match is
 * case-insensitive and the value lands under the canonical spelling (Windows
 * is case-insensitive at CreateProcess). On POSIX, where `http_proxy` and
 * `HTTP_PROXY` are genuinely different variables, the match stays exact.
 */
export declare function pickAllowlistedEnv(source: NodeJS.ProcessEnv, keys: readonly string[], platform?: NodeJS.Platform): NodeJS.ProcessEnv;
/**
 * Build the base child env for a given inheritance mode. `mirror_native` copies
 * the parent env (the native CLIs' default); `clean` copies only the minimal
 * allowlist (agent isolation). The adapter's `spec.env` overrides + the
 * providerScrubEnv patch are applied ON TOP of this by the spawn layer.
 */
export declare function composeBaseEnv(inheritance: "mirror_native" | "clean", source?: NodeJS.ProcessEnv, execPath?: string, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
//# sourceMappingURL=env-scope.d.ts.map