/**
 * Docker sandbox — network-isolated container for pi.
 *
 * The container can ONLY talk to the gateway on the host.
 * iptables in the entrypoint blocks everything else.
 *
 * Supports two modes:
 *   - sandbox: true   → Docker container, full network isolation
 *   - sandbox: false  → local child process (default, faster, no isolation)
 */
import { type ChildProcess } from "node:child_process";
export interface SandboxConfig {
    /** Gateway port on the host. */
    gatewayPort: number;
    /** Extension file paths to load. */
    extensions?: string[];
    /** Working directory for pi inside the container. */
    cwd?: string;
    /** Extra CLI args for pi. */
    piArgs?: string[];
    /** Extra environment variables. */
    env?: Record<string, string>;
    /** Docker image name. Default: auto-build "pi-mock-sandbox" */
    image?: string;
    /** Path to pi binary (local mode only). Default: "pi" */
    piBinary?: string;
    /** Extra Docker volumes: ["host:container:ro", ...] */
    volumes?: string[];
}
export interface SpawnResult {
    process: ChildProcess;
    /** Stderr accumulator. */
    stderr: string[];
    /** Temp directory (caller should clean up). */
    tmpDir: string;
}
export declare function spawnLocal(config: SandboxConfig): SpawnResult;
/**
 * Ensure the Docker image exists. Builds it if missing.
 * Returns the image name.
 */
export declare function ensureImage(image?: string): string;
export declare function spawnSandbox(config: SandboxConfig): SpawnResult;
/**
 * Check if Docker is available.
 */
export declare function hasDocker(): boolean;
//# sourceMappingURL=sandbox.d.ts.map