/**
 * Filters process environment before passing it to child processes (e.g. exec_command)
 * to avoid leaking API keys and other credentials.
 */
export interface SanitizedEnvVars {
    safe: Record<string, string>;
    blocked: string[];
    warnings: string[];
}
export declare function sanitizeEnvVars(env: Record<string, string | undefined>, options?: {
    allowedVars?: string[];
    customBlocked?: RegExp[];
}): SanitizedEnvVars;
/**
 * Environment for agent command execution: strips secrets, keeps normal tooling vars.
 */
export declare function prepareSafeToolEnv(baseEnv: NodeJS.ProcessEnv | Record<string, string | undefined>, options?: {
    allowedVars?: string[];
}): Record<string, string>;