import { type EvalRunSpec, isSensitiveCredentialPath, type ResolvedEvalExecutable } from "./isolation.js";
export interface EvalRunResult {
    readonly exitCode: number;
    readonly signal: NodeJS.Signals | null;
    readonly stdout: string;
    readonly stderr: string;
    readonly timedOut?: boolean;
    readonly containmentFailure?: boolean;
    readonly interrupted?: NodeJS.Signals;
    readonly warning?: string;
    readonly workLogPath?: string;
}
export interface RunEvalOptions {
    readonly deniedReadProbePaths?: readonly string[];
    readonly timeoutMs?: number;
    readonly workLogPath?: string;
    readonly onWorkLogReady?: (path: string) => void;
    /**
     * Directory holding this run's controller-only scratch. Defaults to the platform's short
     * shared temporary directory, which keeps the proxy bridge socket inside `sun_path`. A
     * caller that supplies one owns its safety: the actor's write grants follow it, so it is
     * validated against the same broad-and-protected rules as a writable run directory.
     */
    readonly controllerScratchBase?: string;
}
export declare function captureEvalProcess(argv: readonly [string, ...string[]], cwd: string, env: NodeJS.ProcessEnv, timeoutMs: number, abortSignal?: AbortSignal): Promise<EvalRunResult>;
export declare function buildEvalLaunchCommand(resolved: Pick<ResolvedEvalExecutable, "command" | "commandPath" | "readPaths">, actorArguments: readonly string[]): [string, ...string[]];
export declare function confirmReusedExtension(canonical: string, stagedPath: string, sourceAgentDir: string): Promise<void>;
export { isSensitiveCredentialPath };
interface EvalPiActor {
    readonly trusted: boolean;
    readonly hostsExtensionRuntime: boolean;
    readonly hostsAuthAdapter: boolean;
    readonly packageRoot?: string;
}
/** Trusted Pi identity, separate from whether this run stages extensions. */
export declare function inspectEvalPiActor(command: readonly [string, ...string[]], runDir: string, environment: NodeJS.ProcessEnv): Promise<EvalPiActor>;
export declare function runEvalCommand(spec: EvalRunSpec, options?: RunEvalOptions): Promise<EvalRunResult>;
//# sourceMappingURL=runner.d.ts.map