/**
 * Protected IPC/control variable names (exact), centralized so generic
 * `env-allowlist-extra` entries can never re-add them (D5). Removed AFTER
 * every merge.
 */
export declare const PROTECTED_ENV_EXACT: ReadonlySet<string>;
/**
 * Protected prefix FAMILIES. A name matching any prefix is protected even if
 * not in the exact set (covers TMUX_*, SSH_*, DBUS_*, VSCODE_* IPC handles,
 * GPG_*, NVIM_*, and known parent-agent/orchestrator markers like PI_* /
 * CLAUDE_CODE_* that would let a child masquerade as its orchestrator).
 */
export declare const PROTECTED_ENV_PREFIXES: readonly string[];
/** True when a variable name may never appear in a sandboxed child env. */
export declare function isProtectedEnvName(name: string): boolean;
export interface ScrubbedEnvOptions {
    /** The parent process environment (read-only source). */
    parentEnv: NodeJS.ProcessEnv;
    /** The REAL outer user home (never a harness's redirected child HOME). */
    realHome: string;
    /** Owned private short temp dir (becomes the child TMPDIR). */
    shortTmpDir: string;
    /**
     * Directory of the resolved harness executable, appended to the curated
     * PATH so the wrapped command can start the harness.
     */
    harnessExecutableDir?: string;
    /** Resolved `env-allowlist-extra` variable names. */
    extras?: string[];
}
export interface ScrubbedEnvResult {
    /** The complete `env -i` reconstruction (values in memory only). */
    env: Record<string, string>;
    /**
     * Extra names refused because they are protected (NAMES only). Each maps
     * to a human-readable diagnostic that never contains a value.
     */
    refusedProtected: string[];
    /** Extra names requested but not present in the parent env (names only). */
    missingExtras: string[];
}
/**
 * Build the curated PATH (D5): existing system roots, recognized user tool
 * roots under the real home, mise install bins already present on the
 * parent's PATH, and the resolved harness executable's directory. The
 * parent's PATH value itself is never copied verbatim.
 */
export declare function buildCuratedPath(opts: {
    parentPath?: string;
    realHome: string;
    harnessExecutableDir?: string;
}): string;
/**
 * Build the complete scrubbed `env -i` environment (D5).
 *
 * Order: baseline identity → curated PATH → optional TUI fidelity →
 * validated CA variables → explicit extras — then the protected scrub runs
 * LAST so no merge can reintroduce a protected name.
 */
export declare function buildScrubbedEnv(opts: ScrubbedEnvOptions): ScrubbedEnvResult;
//# sourceMappingURL=env.d.ts.map