/**
 * Workspace confinement for `LocalSandboxEnv.exec()`.
 *
 * The local backend spawns commands through the host shell, so the
 * path-prefix checks that guard `readFile` / `writeFile` / `resolvePath`
 * never see what a shell command touches. This module statically scans the
 * command string for filesystem path references — absolute paths, `~`
 * expansion, `..` traversal, and redirection targets (`>`, `>>`, `<`) — and
 * denies the command (FabricError `SANDBOX_ESCAPE_BLOCKED`) when any
 * reference resolves outside the allowed roots.
 *
 * This is a guardrail, not a hard security boundary: paths constructed
 * dynamically at runtime (shell variables, command substitution that hides
 * the path characters, encoded payloads) cannot be statically analyzed.
 * Workloads that need a real isolation boundary should use the `docker`
 * backend or a provider container/microVM sandbox.
 */
export interface LocalCommandConfinement {
    /** Workspace root. Always allowed. */
    workspaceRoot: string;
    /** Additional allowed roots (absolutized by the caller). */
    allowedRoots?: string[];
}
/**
 * Deny (FabricError `SANDBOX_ESCAPE_BLOCKED`) when any path referenced by
 * `command` resolves outside the workspace root and `allowedRoots`.
 * `cwd` is the effective exec working directory and must already be
 * confined by the caller.
 */
export declare function assertLocalCommandConfined(command: string, cwd: string, confinement: LocalCommandConfinement): Promise<void>;
//# sourceMappingURL=local-confinement.d.ts.map