/**
 * Node-worktree context guard (backlog "shared-state clobber from node context",
 * observed live 2026-07-22): a dispatched worker whose CWD is inside a
 * tool-created worktree (`<root>/.audit-tools/worktrees/<name>` — remediation
 * implementation worktrees and audit review snapshots) ran a driver lifecycle
 * CLI
 * against the REAL shared run state: `resolveRepoRoot`'s climb-out-of-
 * `.audit-tools` anchoring resolved the worker's drifted cwd to the real repo
 * root, so the stray invocation rewrote shared run state and falsely blocked an
 * in-flight node. Prompt-level "don't do that" is host
 * discretion; this module is the mechanical refusal.
 *
 * Enforcement model — deny by default, allow a tight worker-safe set:
 *   • Each CLI refuses EVERY subcommand invoked with a node-worktree cwd except
 *     an explicit worker-safe allowlist (currently only remediation's
 *     result-scoped validators). A NEW command is therefore refused from worker
 *     context until
 *     someone consciously classifies it — fail-closed, never silently exposed.
 *   • The session/state WRITERS additionally assert the process cwd
 *     (`assertNotNodeWorktreeCwd`) as defense-in-depth, so an invocation shape
 *     that bypasses the CLI guard (explicit `--artifacts-dir` from a worktree
 *     cwd, an embedding that never enters the CLI) still cannot clobber.
 *
 * Deliberately NOT chosen (recorded so the decision isn't re-derived):
 *   • Owner-token discrimination — driver and worker are processes on one
 *     filesystem; any token the driver can read from disk the worker can read
 *     too, and a CLI-flag token would be a manual flag the host must remember
 *     (a bug signal by house rule). CWD is the honest mechanical discriminator.
 *   • Forced state-dir redirection for workers — the conversation host owns
 *     execution, so the tool cannot force a worker's environment.
 */
/**
 * When `p` lies inside a tool-created worktree, return that worktree's root
 * (`…/.audit-tools/worktrees/<name>`); otherwise null. Matches the OUTERMOST
 * `.audit-tools/worktrees/<name>` segment run (consistent with
 * `climbOutOfAuditTools`). Purely path-shape-based — no filesystem access — so
 * the check is cheap and cannot mis-answer on a half-deleted worktree.
 */
export declare function nodeWorktreeAncestor(p: string): string | null;
/**
 * Env var through which a cwd-changing wrapper propagates the CALLER's real
 * working directory to the CLI it spawns. The packaged audit-code wrapper
 * spawns `dist/audit/index.js` with `cwd` set to the PACKAGE root, so the
 * CLI's own `process.cwd()` carries no worktree evidence — the wrapper
 * stamps this var from its own cwd instead (the caller's true location). The
 * literal is re-spelled in `wrapper/audit-code-wrapper-lib.mjs` (plain node,
 * cannot import this module pre-build); `tests/shared/node-worktree-guard.test.mjs`
 * pins the two spellings equal. Scrubbed from child commands
 * (`stripAuditToolsControlEnv`) so a worker never inherits the driver's
 * stamped value and reads it as its own.
 */
export declare const AUDIT_TOOLS_CALLER_CWD_ENV = "AUDIT_TOOLS_CALLER_CWD";
/**
 * Refuse a CLI subcommand invoked from a node-worktree context unless it is in
 * the CLI's worker-safe allowlist. Call once at the CLI's command-dispatch
 * chokepoint so every subcommand — including future ones — is covered without a
 * per-command call site. Checks the caller cwd (wrapper-propagated + own) and,
 * when supplied, the RAW `--root` value — both BEFORE `resolveRepoRoot`, whose
 * climb-out-of-`.audit-tools` anchoring erases exactly the evidence this guard
 * keys on. Throws (loud, actionable); the CLI exits non-zero.
 */
export declare function assertCliCommandAllowedFromCwd(opts: {
    cliName: string;
    commandName: string;
    workerSafeCommands: ReadonlySet<string>;
    /** Raw `--root` flag value as supplied, pre-anchoring (optional). */
    rawRoot?: string;
    /** Test seam: overrides both cwd candidates when provided. */
    cwd?: string;
}): void;
/**
 * Writer-side defense-in-depth: assert the current process is not running from
 * inside a node worktree before mutating shared session/state files. Covers
 * invocation shapes the CLI-level guard never sees (explicit `--artifacts-dir`
 * targeting, embedded library use).
 */
export declare function assertNotNodeWorktreeCwd(context: string, cwd?: string): void;
//# sourceMappingURL=nodeWorktreeGuard.d.ts.map