/**
 * Opt-in container sandbox for run_workspace_command.
 *
 * The allowlist and path checks are guards, not isolation: `node -e`, `python -c` and `npm run`
 * run arbitrary code with the user's permissions. With `mcp.sandbox.mode: "docker"` the validated
 * command instead runs inside a throwaway container that sees only the workspace, has no network
 * by default, none of the host's environment, no capabilities, and bounded memory, CPU and
 * processes. Docker is the one isolation layer that behaves the same on macOS, Linux and Windows.
 *
 * Fail closed: if the sandbox is enabled but cannot start, the command does not run on the host.
 */
export interface SandboxPolicy {
    mode: "off" | "docker";
    /** Needs the toolchain the project's commands use; node:22 ships node, npm, git, python3, make, gcc. */
    image: string;
    /** "none" blocks all network; "bridge" allows it (npm install, git fetch). `host` is never accepted. */
    network: "none" | "bridge";
    memory: string;
    cpus: string;
    pidsLimit: number;
}
export interface DockerInvocation {
    file: string;
    args: string[];
    /** Container name, so a timed-out run can be killed by name. */
    name: string;
    image: string;
}
export declare const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm";
/**
 * Reads `mcp.sandbox` from lemma.config.json. A bad value throws instead of falling back: a typo in
 * `network` or `image` must not silently widen what the sandbox allows or run on the host.
 */
export declare function loadSandboxPolicy(dir?: string): SandboxPolicy;
/**
 * Names (never values) of the host variables to forward: the harmless ones from the filtered env,
 * plus whatever the project allowed explicitly. Values travel through the docker CLI's own
 * environment (`-e NAME`), so they do not show up in `ps` output.
 */
export declare function containerEnvNames(filteredEnv: NodeJS.ProcessEnv, extraAllow?: string[]): string[];
export declare function buildDockerInvocation(command: string, workspaceRoot: string, policy: SandboxPolicy, filteredEnv: NodeJS.ProcessEnv, extraEnvAllow?: string[]): DockerInvocation;
//# sourceMappingURL=CommandSandbox.d.ts.map