/**
 * BoundaryManager handles execution-time policy controls for security boundaries.
 */
export declare class BoundaryManager {
    private readonly workspace;
    private allowedNetworkHosts;
    constructor(workspace: string);
    addNetworkHost(host: string): void;
    isNetworkAllowed(host: string): boolean;
    /**
     * Resolve a user requested filesystem path against workspace and ensure
     * it cannot escape the workspace root.
     */
    resolveWorkspacePath(relativeOrAbsolutePath: string): string;
    private isWithinWorkspace;
    /**
     * Verify that a command is safe before exec.
     */
    validateCommand(command: string, args: string[]): void;
    /**
     * Child processes must not inherit runtime secrets from the parent process.
     */
    scrubEnvironment(extraKeys?: string[]): NodeJS.ProcessEnv;
    /** Returns human-readable boundaries for system prompts and audit logs. */
    describeCapabilities(): string;
    static isFileReadable(path: string): boolean;
    static isFileWritable(path: string): boolean;
    static canFollowSymlink(path: string): boolean;
}
//# sourceMappingURL=boundary.d.ts.map