/**
 * Path-safety helpers for file-writing tools.
 *
 * Two distinct guards live here:
 *
 *   1. `safeOutputPath()` — path-traversal guard. Resolves `requested` against
 *      `cwd`, then refuses absolute paths that escape the configured allow-list
 *      of roots (cwd, system tempdir, the per-user output dir under ~/Documents).
 *      Tools writing on behalf of the agent must call this before opening any
 *      file handle — it stops the agent from writing to `../../etc/passwd` even
 *      when the user has not validated the value.
 *
 *   2. `safeResolveOutputPath()` — sandbox redirect for paths that NLE hosts
 *      (Resolve, Premiere) need to read back. macOS-sandboxed Node writes under
 *      `/var/folders/...` are invisible to the host process, so we transparently
 *      redirect to `~/Documents/gg-editor-out/`. The redirect is reported back
 *      through tool output so the agent can surface it.
 */
/** Default user-visible output directory for sandbox-redirected files. */
export declare const USER_OUTPUT_DIR_NAME = "gg-editor-out";
/** Build the full path of the per-user output directory. */
export declare function userOutputDir(): string;
export interface SafeOutputOptions {
    /** Additional absolute paths that are valid output roots. */
    allowRoots?: string[];
}
/**
 * Resolve `requested` against `cwd` and verify it lies under an allowed root.
 * Throws an Error whose message follows the `error:` format consumed by tools.
 */
export declare function safeOutputPath(cwd: string, requested: string, opts?: SafeOutputOptions): string;
export interface SafeResolveResult {
    /** Final absolute path after redirect (if any). */
    path: string;
    /** True when the original request landed in a sandbox-only location. */
    redirected: boolean;
    /** Human-readable reason for the redirect, when applicable. */
    reason?: string;
}
/**
 * Like `safeOutputPath`, but additionally redirects sandbox-only paths to the
 * user-visible output dir so that NLE host processes (which run outside Node's
 * sandbox) can read the result back. Use for stills / thumbnails / GIFs that
 * the host might import.
 *
 * Order matters here: we check the sandbox-redirect FIRST. Sandbox roots
 * (`/tmp`, `/var/folders/…`, `/private/var/…`) are trusted OS-managed temp
 * locations — we always want to remap them into the user-visible output dir,
 * even when they don't happen to match the runner's `tmpdir()` allow-root
 * (e.g. `/tmp/foo.jpg` when `tmpdir()` is `/var/folders/…`). After redirect,
 * the resulting path is under `userOutputDir()` and is implicitly safe.
 *
 * Non-sandbox paths fall through to the regular `safeOutputPath()` traversal
 * check, so escapes like `../../etc/passwd` or absolute `/etc/hosts` are still
 * rejected exactly as before.
 */
export declare function safeResolveOutputPath(cwd: string, requested: string, opts?: SafeOutputOptions): SafeResolveResult;
//# sourceMappingURL=safe-paths.d.ts.map