/**
 * Execution policy layer — unified entry point for sandbox enforcement.
 *
 * Integrates:
 * - Environment variable sanitization (sanitize-env-vars.ts)
 * - Path safety validation (path-policy.ts)
 * - Command injection detection (command-validator.ts)
 *
 * Tool implementations call `evaluateExecPolicy()` before spawning processes
 * and `evaluateFilePolicy()` before file read/write/edit operations.
 */
import type { ExecPolicyResult, SandboxConfig, PathValidationResult } from './types.js';
/**
 * Evaluate whether a shell command execution is allowed under the current sandbox policy.
 *
 * Checks (in order):
 * 1. Command injection / dangerous patterns
 * 2. Working directory path safety
 * 3. Environment variable sanitization
 */
export declare function evaluateExecPolicy(params: {
    command: string;
    cwd: string;
    config?: Partial<SandboxConfig>;
    allowedEnvVars?: string[];
}): ExecPolicyResult;
/**
 * Evaluate whether a file operation (read/write/edit/delete) is allowed.
 */
export declare function evaluateFilePolicy(params: {
    operation: 'read' | 'write' | 'edit' | 'delete';
    path: string;
    workspaceRoot: string;
    config?: Partial<SandboxConfig>;
}): PathValidationResult;
/**
 * Generate a full audit report for a command — useful for security logging.
 */
export declare function auditExecRequest(params: {
    command: string;
    cwd: string;
}): {
    findings: {
        severity: 'critical' | 'high' | 'medium';
        reason: string;
    }[];
};