/** Harness-location failure — maps to exit code 2. */
export declare class HarnessLocationError extends Error {
    readonly exitCode: 2;
    constructor(message: string);
}
/**
 * Deterministic harness key for a subject set: sorted, sanitized names plus a
 * short content hash of the joined raw names (so distinct sets that sanitize
 * to the same tokens still differ).
 */
export declare function deriveHarnessKey(skillNames: string[]): string;
/** Resolve the deterministic harness root under the OS tmp dir. */
export declare function resolveHarnessRoot(skillNames: string[], tmpRoot?: string): string;
/**
 * Refuse a --workdir whose ancestry contains CLAUDE.md or .claude/ — cwd
 * discovery would re-pollute the run (spec §7). Defense in depth with
 * --setting-sources "".
 *
 * `stopAt` (optional) bounds the ancestry walk: when the walk reaches that
 * directory it stops *before* inspecting it (exclusive boundary), mirroring
 * `assertSafeHarnessRoot`'s `trustedRoot`. Default (undefined) walks to the
 * filesystem root, preserving the strictest production behavior. Tests use it
 * to scope the walk to a sandbox — necessary on Windows, where the OS tmp dir
 * lives inside the user's home and would otherwise surface an ambient
 * ~/.claude during the walk.
 */
export declare function assertSafeWorkdir(dir: string, stopAt?: string): void;
/**
 * Prepare the harness root directory so that `assertSafeHarnessRoot` will
 * pass on the next call. If the path does not exist, this is a no-op (the
 * caller creates it at 0700 via mkdirSyncReal). If it exists:
 *
 * - Symlink → throw HarnessLocationError (security gate; never relax).
 * - Real directory whose mode != 0700 → chmod to 0700. Removing group/other
 *   access is strictly safer, never a relaxation.
 *
 * Mode checks/changes are only performed on non-win32 (matching
 * assertSafeHarnessRoot's platform guard).
 */
export declare function prepareHarnessRoot(dir: string): void;
/**
 * FS-bound hardening for the shared-tmp harness root (spec §7). Validates EVERY
 * path component from the leaf up to (but excluding) `trustedRoot`: no component
 * may be a symlink, and on POSIX each must be owned by the current uid. This
 * closes the shared-/tmp TOCTOU where the recursively-created intermediate parent
 * (`<tmp>/vat-skill-test`) — not just the leaf — could be pre-created as a symlink
 * or under another user's ownership. The leaf must additionally be 0700.
 *
 * `trustedRoot` (default: the OS tmp dir) is the boundary: it is system-owned
 * (sticky-bit /tmp) so ownership/mode checks are not applied to it. When the leaf
 * is not a descendant of `trustedRoot` (an explicit --out elsewhere), validation
 * degrades to the leaf alone.
 *
 * Integration-tested (requires real lstat/stat). On Windows, uid checks are
 * skipped (process.getuid is undefined) but the symlink refusal still applies.
 */
export declare function assertSafeHarnessRoot(dir: string, currentUid: number, trustedRoot?: string): void;
//# sourceMappingURL=harness-location.d.ts.map