/**
 * Child-process environment scrubbing (ren's adversarial review: MCP servers
 * and other spawned helpers must not inherit the operator's credentials).
 *
 * {@link scrubbedChildEnv} builds a copy of `process.env` with every variable
 * dropped whose NAME matches {@link SECRET_NAME_PATTERN} or whose VALUE matches
 * {@link SECRET_VALUE_PATTERN} — the same two patterns `secrets.ts` already
 * trusts for output redaction, so the scrub and the redactor can never drift
 * apart. `CI=1` is set so spawned tools pick their non-interactive behaviour.
 *
 * `extra` is applied LAST: an operator-explicit override (e.g. an MCP server's
 * `config.env` entry in ~/.openkai/mcp.json) always wins over the scrub — the
 * operator is the trust root, and an explicit config entry is a deliberate
 * hand-over, not a leak.
 */
/**
 * Build a scrubbed copy of `process.env` for a spawned child process.
 * `extra` entries are applied last (an `undefined` value deletes the key).
 */
export declare function scrubbedChildEnv(extra?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
//# sourceMappingURL=procenv.d.ts.map