/**
 * Safe subprocess execution for scanner adapters.
 *
 * Wraps execFile (never a shell) so argument values — project paths,
 * target URLs, config file paths — can never be interpreted as shell
 * syntax. This is the only sanctioned way to invoke external scanner
 * binaries (CONSTITUTION: "No string-concat shell commands").
 *
 * @module util/subprocess
 */
export declare class CommandError extends Error {
    readonly binary: string;
    readonly args: string[];
    readonly exitCode: number | null;
    readonly stdout: string;
    readonly stderr: string;
    readonly cause?: Error | undefined;
    constructor(message: string, binary: string, args: string[], exitCode: number | null, stdout: string, stderr: string, cause?: Error | undefined);
}
export interface RunCommandOptions {
    /** Milliseconds before the process is killed. Default 120000. */
    timeout?: number;
    /** Max bytes captured per stream. Default 10MB. */
    maxBuffer?: number;
    cwd?: string;
    env?: NodeJS.ProcessEnv;
    /**
     * Scanners conventionally exit non-zero when findings exist (e.g.
     * bandit/semgrep exit 1). When true (default), a non-zero exit that
     * still produced stdout resolves normally instead of throwing —
     * matching the historical execAsync `.catch(e => e.stdout)` pattern.
     */
    tolerateExitWithOutput?: boolean;
}
export interface RunCommandResult {
    stdout: string;
    stderr: string;
    exitCode: number;
}
/**
 * Run a binary with discrete argv entries. No shell is ever invoked,
 * so callers MUST NOT pre-quote values or pass shell syntax
 * (pipes, redirects, `&&`) — restructure such logic in JS instead.
 */
export declare function runCommand(binary: string, args: string[], options?: RunCommandOptions): Promise<RunCommandResult>;
/**
 * Probe for a scanner binary by running it with a version-style flag.
 * Returns the first line of stdout (trimmed) or null when unavailable.
 */
export declare function probeBinary(binary: string, args?: string[], timeout?: number): Promise<string | null>;
//# sourceMappingURL=subprocess.d.ts.map