/**
 * Local runner sandbox profiles — command allowlists, deny patterns, dry-run explain.
 */
export declare const SANDBOX_PROFILE_VERSION = "todos.sandbox-profile.v1";
export interface SandboxProfile {
    name: string;
    version: number;
    description?: string;
    allow_commands: string[];
    deny_commands: string[];
    allow_paths?: string[];
    deny_network?: boolean;
    redact_env_keys?: string[];
}
export interface SandboxCheckInput {
    command: string;
    cwd?: string;
    env?: Record<string, string>;
}
export interface SandboxCheckResult {
    allowed: boolean;
    profile: string;
    violations: string[];
    explanations: string[];
    redacted_env?: Record<string, string>;
}
export declare function resetSandboxProfileCache(): void;
export declare function getDefaultSandboxProfiles(): SandboxProfile[];
export declare function loadSandboxProfiles(): SandboxProfile[];
export declare function getSandboxProfile(name: string): SandboxProfile | null;
export declare function saveSandboxProfiles(profiles: SandboxProfile[]): void;
export declare function checkSandboxCommand(input: SandboxCheckInput, profileName?: string, dryRun?: boolean): SandboxCheckResult;
//# sourceMappingURL=sandbox-profiles.d.ts.map