/**
 * Remediation sandbox — PR-5a-2 real execution
 *
 * Executes codemod transform functions inside vm.runInNewContext() with a
 * restricted module allowlist. Denies dangerous modules per Shield H-3.
 *
 * Security model (Shield H-3):
 *   - Codemods execute in vm.runInNewContext() with a restricted module
 *     allowlist. Accessing denied modules throws RemediationSandboxViolation.
 *   - ALLOW: ts-morph, path, fs/promises (read-only mode — write is intercepted)
 *   - DENY: child_process, os, dgram, cluster, worker_threads, repl,
 *           net, tls, http, https, crypto (raw), vm (no re-entry)
 *   - Sandbox timeout: 5 seconds (configurable via SandboxContext.timeoutMs)
 *
 * @connexum/ai-governance PR-5a-2
 */
export interface SandboxContext {
    /** The agent directory — used to resolve relative file paths safely */
    agentDir: string;
    /**
     * Execution timeout in milliseconds. Defaults to 5000.
     * The vm runInNewContext will throw a timeout error if exceeded.
     */
    timeoutMs?: number;
    /**
     * Dry-run mode: if true, file writes are captured in-memory and NOT
     * written to disk. The caller can inspect SandboxResult.pendingWrites.
     */
    dryRun?: boolean;
}
export interface SandboxResult {
    /** Return value from the sandboxed transform function */
    returnValue: unknown;
    /**
     * Files that the transform requested to write.
     * In dryRun mode these are never flushed to disk.
     * In live mode these have already been written.
     */
    pendingWrites: Array<{
        filePath: string;
        content: string;
    }>;
    /** Log messages emitted by helpers.log() inside the transform */
    logs: string[];
}
/**
 * Execute a codemod payload string inside a restricted vm context.
 *
 * The payload must be a CommonJS-style script. The transform function
 * is invoked as:
 *   module.exports.transform(sourceFile, helpers)  — for ts-morph
 *   module.exports.transform(sourceCode, helpers)  — for Python-style string transforms
 *
 * The sandbox provides:
 *   - require: restricted to ts-morph, path, fs (read-only proxy)
 *   - path: Node.js path module
 *   - fs: read-only proxy over fs/promises
 *   - console.log/warn/error: captured to logs[]
 *   - helpers: wrapToolCall, addImport, log, writeFile (captured to pendingWrites)
 *   - module / exports: CommonJS module object
 *
 * @param payload  The transform function source string (embedded in pack).
 * @param context  Execution context (agentDir, timeoutMs, dryRun).
 */
export declare function runInSandbox(payload: string, context: SandboxContext): Promise<SandboxResult>;
/**
 * Build the restricted require function for the sandbox.
 * Exported for testing; callers outside sandbox.ts should not use this.
 * @internal
 */
export declare function buildRestrictedRequireForTest(denied?: Set<string>): (moduleName: string) => unknown;
//# sourceMappingURL=sandbox.d.ts.map