/**
 * Canonical "local-spawn shell secret-env protection" (sema D1) — FIRST-PARTY, vendor-independent.
 *
 * When the engine (or a downstream host/exec adapter) spawns a local shell for an AUTONOMOUS model, the child's
 * inherited env MUST be fail-closed: a model-chosen `printenv DEEPSEEK_API_KEY` via the `bash` tool would
 * otherwise exfiltrate the orchestrator's brain key / git token / DB creds (the gate authorizes WHICH tool runs,
 * NOT isolation). The `scrub` policy drops secret-pattern keys (keeps PATH/build/locale → low breakage).
 *
 * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
 * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
 * adapter (service host adapter, [265]). Keeping the single source of the secret PATTERN here means:
 *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
 *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
 *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
 *
 * The `inheritEnv` THREE-STATE assembly (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is a
 * per-adapter concern (each exec env owns how it composes its child env); only the secret PATTERN is shared.
 */
/** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? */
export declare function isSecretEnvKey(key: string): boolean;
/** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub` policy. */
export declare function scrubSecretEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
//# sourceMappingURL=secret-env.d.ts.map