/**
 * Delivering the password and passphrase to the system ssh
 *
 * The OpenSSH client doesn't read a password from stdin — it requests it
 * through the program named in SSH_ASKPASS. This is a built-in mechanism,
 * so no third-party wrappers like sshpass are needed.
 *
 * The secret lives only in the environment of the specific process being
 * spawned:
 *  - it never ends up in arguments (argv is visible system-wide via ps);
 *  - it isn't written to disk (the script only reads the variable);
 *  - process environment is readable only by its owner and root — the same
 *    circle that already has access to the profile file with the password inside.
 */
import type { RunnerConfig } from './ssh-args.js';
/** Name of the variable that carries the secret into the askpass script */
export declare const SECRET_ENV_VAR = "SSH_MCP_SECRET";
/** Name of the askpass script inside the control directory */
export declare const ASKPASS_SCRIPT_NAME = "askpass.sh";
/**
 * Create (or refresh) the askpass script and return its path.
 *
 * The script is written alongside the target and put in place by renaming:
 * the control directory is shared across all profiles and all server
 * processes, so a sibling ssh may be executing the same file at write time.
 * Writing straight to the final path would truncate it first — the client
 * would receive an empty secret and be denied login.
 */
export declare function ensureAskpassScript(controlDir: string): string;
/**
 * Which secret the profile needs.
 *
 * With a key configured, ssh will ask for its passphrase; the user's
 * password is only needed when there is no key.
 */
export declare function selectSecret(config: RunnerConfig): string | undefined;
/**
 * Environment for running ssh.
 *
 * Returns a new object — the base process environment is left untouched,
 * so the secret can't leak into other spawned commands.
 */
export declare function buildRunnerEnv(input: {
    config: RunnerConfig;
    askpassScriptPath?: string;
    baseEnv?: NodeJS.ProcessEnv;
}): NodeJS.ProcessEnv;