/** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
export declare const ALLOWLISTED_EXEC_TIMEOUT_MS = 60000;
/** Read-only git subcommands an anchor may run (no checkout/reset/clean/push/…). */
export declare const GIT_READONLY_SUBCOMMANDS: ReadonlySet<string>;
/**
 * The set of executables the runner will auto-run, for callers that want to
 * display the allowlist. Derived from the per-executable policies plus git.
 */
export declare const ANCHOR_ALLOWLIST: ReadonlySet<string>;
/** Bare executable name: strip any directory and a Windows .cmd/.bat/.exe suffix. */
export declare function executableBaseName(token: string): string;
/**
 * The single authority for what the tool will auto-run on the model's behalf:
 * `command[0]` must be an allowlisted inspection-only executable, AND every
 * argument must satisfy that executable's default-deny argument policy (git:
 * read-only subcommand + no write/reconfigure option). Anything else → false.
 *
 * CRIT ARC-a06a3945: argument validation is the point — an allowed executable
 * carrying a code-exec/file-write flag (`rg --pre`, `ast-grep --rewrite`,
 * `git log -o file`, …) is REFUSED, not run.
 */
export declare function isAllowedAnchorCommand(command: string[]): boolean;
/** Outcome of actually running an allowlisted command (injectable for tests). */
export interface AllowlistedExecOutcome {
    exit_code: number | null;
    timed_out: boolean;
    spawn_error?: string;
    /** Full combined stdout+stderr (bounded), used to evaluate output matches. */
    output: string;
    /**
     * True when `output` was cut short by `MAX_CAPTURED_OUTPUT` — the command
     * produced more combined stdout+stderr than this outcome contains. A caller
     * must treat `output` as an incomplete prefix, never as proof that missing
     * text is absent: "the capture was cut off" is a distinct state from "the
     * command genuinely produced/omitted X" and must not be read as the latter.
     * Absent (not `false`) on every outcome whose `output` is the full capture.
     */
    truncated?: boolean;
    /**
     * True when the internal allowlist gate refused `command` BEFORE any spawn
     * was attempted (`isAllowedAnchorCommand` returned false) — a structured
     * refusal, never a spawn, never a throw. Distinct from `spawn_error` (which
     * means a spawn WAS attempted and the OS failed to launch it): a refusal
     * never touches the child_process API at all. Absent (not `false`) on every
     * outcome that reached a real spawn attempt.
     */
    refused?: boolean;
}
export type AllowlistedExecRunner = (command: string[], cwd: string, timeoutMs: number) => Promise<AllowlistedExecOutcome>;
/**
 * Spawn an allowlisted read-only command argv-only (never a shell), capturing
 * combined stdout+stderr (bounded). Strips the host-signalling env
 * (`stripAuditToolsControlEnv`), resolves the platform-correct argv via the shared
 * `resolveExecArgv`, and kills a command that exceeds `timeoutMs`
 * (SIGTERM→SIGKILL). The single runner both orchestrators use for the grounding
 * anchor pass.
 *
 * INTERNAL GATE (invariants[2]): enforces {@link isAllowedAnchorCommand} on
 * itself, unconditionally, before ever spawning — `isAllowedAnchorCommand` is
 * pure, total, and non-throwing, so this check is cheap and correctness no
 * longer depends on every call site remembering to gate first. A refused
 * command resolves a structured refusal (`refused: true`); it is NEVER spawned
 * and this function NEVER throws for a refusal. A caller-side pre-check (e.g.
 * `anchorGrounding.ts`'s `isAllowedAnchorCommand` call before invoking this
 * function) is now a redundant, OPTIONAL fast path: double-gating is
 * observationally identical to single-gating, since the check is idempotent.
 *
 * Its reach is the model-authored anchor/targeted command class ONLY — it does
 * NOT reach `runtimeCommand.ts`'s project-test spawn (a discovered, non-model-
 * authored vector the default-deny anchor premise excludes by construction;
 * see `projectTestAdmission.ts` for that surface's own admission gate).
 */
export declare const runAllowlistedReadOnlyCommand: AllowlistedExecRunner;
//# sourceMappingURL=allowlistedExec.d.ts.map