/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { type EnvironmentSanitizationConfig } from './environmentSanitization.js';
/**
 * Request for preparing a command to run in a sandbox.
 */
export interface SandboxRequest {
    /** The program to execute. */
    command: string;
    /** Arguments for the program. */
    args: string[];
    /** The working directory. */
    cwd: string;
    /** Environment variables to be passed to the program. */
    env: NodeJS.ProcessEnv;
    /** Optional sandbox-specific configuration. */
    config?: {
        sanitizationConfig?: Partial<EnvironmentSanitizationConfig>;
    };
}
/**
 * A command that has been prepared for sandboxed execution.
 */
export interface SandboxedCommand {
    /** The program or wrapper to execute. */
    program: string;
    /** Final arguments for the program. */
    args: string[];
    /** Sanitized environment variables. */
    env: NodeJS.ProcessEnv;
    /** The working directory. */
    cwd?: string;
}
/**
 * Interface for a service that prepares commands for sandboxed execution.
 */
export interface SandboxManager {
    /**
     * Prepares a command to run in a sandbox, including environment sanitization.
     */
    prepareCommand(req: SandboxRequest): Promise<SandboxedCommand>;
}
/**
 * A no-op implementation of SandboxManager that silently passes commands
 * through while applying environment sanitization.
 */
export declare class NoopSandboxManager implements SandboxManager {
    /**
     * Prepares a command by sanitizing the environment and passing through
     * the original program and arguments.
     */
    prepareCommand(req: SandboxRequest): Promise<SandboxedCommand>;
}
/**
 * SandboxManager that implements actual sandboxing.
 */
export declare class LocalSandboxManager implements SandboxManager {
    prepareCommand(_req: SandboxRequest): Promise<SandboxedCommand>;
}
/**
 * Creates a sandbox manager based on the provided settings.
 */
export declare function createSandboxManager(sandboxingEnabled: boolean, workspace: string): SandboxManager;
