/**
 * Security validation utilities for BugProof.
 * Prevents path traversal, command injection, git ref injection,
 * and environment variable hijacking from untrusted artifact data.
 */
/**
 * Validates that a resolved file path stays within the expected boundary directory.
 * Prevents path traversal attacks via `../` sequences.
 */
export declare function isPathWithinBoundary(filePath: string, boundaryDir: string): boolean;
/**
 * Validates a git ref string to prevent flag injection.
 * Git interprets arguments starting with `-` as flags, so we reject those.
 * Accepts: hex commit SHAs, branch names (alphanumeric, dots, slashes, dashes, underscores).
 */
export declare function isValidGitRef(ref: string): boolean;
/**
 * Environment variable names that must NEVER be overridden from untrusted artifact data.
 * These can be used to hijack process execution.
 */
export declare const DANGEROUS_ENV_VARS: Set<string>;
/**
 * Filters an environment record, removing keys that could hijack execution.
 * Used during replay to prevent artifact environment from overriding critical host vars.
 */
export declare function sanitizeArtifactEnvironment(artifactEnv: Record<string, string>): Record<string, string>;
//# sourceMappingURL=security.d.ts.map