import type { ExecuteParams, ExecuteResult, JobInfo } from '@loopsy/protocol';
/** Build a clean env for child processes, stripping nesting-prevention vars */
export declare function buildCleanEnv(extraEnv?: Record<string, string>): Record<string, string>;
export declare class JobManager {
    private jobs;
    private maxConcurrent;
    private denylist;
    private allowlist?;
    constructor(opts: {
        maxConcurrent?: number;
        denylist?: string[];
        allowlist?: string[];
    });
    execute(params: ExecuteParams, fromNodeId: string): Promise<ExecuteResult>;
    cancel(jobId: string): boolean;
    getActiveJobs(): JobInfo[];
    killAll(): void;
    get activeCount(): number;
    /**
     * CSO #1: the previous denylist matched only the basename of `command`,
     * which trivially fell to `sh -c "rm -rf …"`. Walk well-known shell wrappers
     * and inspect the inner command/script too. This is best-effort defense in
     * depth; a determined attacker with a valid bearer can still escape via
     * `python -c`, `find -exec`, etc., so the documented trust model is now
     * "any peer with the API key effectively has shell on this Mac" — the
     * denylist exists to catch accidental fat-finger commands, not to contain
     * malicious peers.
     */
    private validateCommand;
}
//# sourceMappingURL=job-manager.d.ts.map