/**
 * Safe command execution helpers (argv-mode, no shell).
 *
 * SECURITY: These helpers exist to eliminate the OS command-injection class
 * (CWE-78) that affected the smart_* git/system/build tools. The vulnerable
 * pattern was building a single command string with caller-controlled values
 * interpolated into it, then running it through `execSync`/`execAsync` or
 * `spawn(..., { shell: true })`. A shell then interpreted metacharacters such
 * as `;`, `|`, `$(...)`, and backticks, allowing arbitrary command execution.
 *
 * The fix is to ALWAYS pass the binary plus an argument ARRAY to
 * `execFile`/`spawn` with `shell: false`. In argv mode the OS executes the
 * binary directly and each array element is delivered to the process verbatim
 * as a single argument — no shell, so shell-metacharacter interpretation is
 * impossible regardless of input.
 *
 * Never reintroduce string-concatenated commands, `shell: true`, or
 * `execSync(`...${userInput}...`)` in tool code. Route everything through the
 * helpers below.
 */
export interface SafeExecOptions {
    cwd?: string;
    /** Text encoding for captured output. Defaults to 'utf-8'. */
    encoding?: BufferEncoding;
    /** Milliseconds before the child is killed. */
    timeout?: number;
    /** Maximum bytes of stdout/stderr to buffer. */
    maxBuffer?: number;
    /** Environment variables for the child process. */
    env?: NodeJS.ProcessEnv;
    /** Data to write to the child's stdin. */
    input?: string;
    /** When true, resolve with stdout even if the process exits non-zero. */
    ignoreExitCode?: boolean;
}
/**
 * Run a command synchronously in argv mode and return its stdout.
 *
 * @param file  The executable name or path (never a full command string).
 * @param args  Argument array; each element is passed verbatim to the process.
 */
export declare function execFileSafeSync(file: string, args?: readonly string[], options?: SafeExecOptions): string;
/**
 * Run a command asynchronously in argv mode.
 *
 * @returns Resolves with `{ stdout, stderr }`.
 */
export declare function execFileSafe(file: string, args?: readonly string[], options?: SafeExecOptions): Promise<{
    stdout: string;
    stderr: string;
}>;
/**
 * Spawn a command in argv mode (no shell) and collect its output.
 * Use this where streaming/long-running behaviour is needed instead of the
 * buffered `execFileSafe`.
 */
export declare function spawnSafe(file: string, args?: readonly string[], options?: SafeExecOptions): Promise<{
    stdout: string;
    stderr: string;
    code: number | null;
}>;
/**
 * Validate a git ref-like value. Throws on anything outside the allowlist.
 * Returns the value unchanged when valid (so it can be used inline).
 */
export declare function assertSafeGitRef(value: string, fieldName?: string): string;
/**
 * Validate a generic command argument (e.g. username, group name, path).
 * Even in argv mode we reject:
 *   - NUL / CR / LF, which can corrupt argument parsing, and
 *   - a leading '-', which a binary may interpret as an option flag rather
 *     than a positional argument (option injection).
 */
export declare function assertSafeArg(value: string, fieldName?: string): string;
/**
 * Validate a path argument used in a command. Alias of {@link assertSafeArg}
 * with a path-oriented default field name.
 */
export declare function assertSafePathArg(value: string, fieldName?: string): string;
/**
 * Ensure a value is one of an allowed set. Use for enum-like arguments such as
 * package manager name, merge strategy, etc.
 */
export declare function assertAllowed<T extends string>(value: string, allowed: readonly T[], fieldName?: string): T;
//# sourceMappingURL=safe-exec.d.ts.map