/**
 * Allowlisted environment variables for spawned CLI processes.
 *
 * Only these variables are forwarded from the host process to prevent
 * leaking secrets, user identity, SSH agent sockets, workspace paths,
 * and other sensitive host data to AI CLI tools.
 */
/**
 * Minimal PATH for sandboxed AI CLI processes. Contains only standard
 * system directories. CLI binaries are invoked via `process.execPath`
 * (node) directly, bypassing shebang resolution, so the node binary
 * directory is NOT needed here.
 */
export declare const MINIMAL_PATH = "/usr/local/bin:/usr/bin:/bin";
export declare const ENV_ALLOWLIST: readonly string[];
/**
 * Build a safe environment object from the current process, forwarding
 * only allowlisted keys. Callers can spread additional overrides on top.
 */
export declare function buildSafeEnv(overrides?: Record<string, string | undefined>): NodeJS.ProcessEnv;
/**
 * Convenience helper that returns both `cwd` and `env` in one object,
 * making it harder to forget either when spawning a child process.
 */
export declare function buildSafeSpawnOpts(cwd: string, envOverrides?: Record<string, string | undefined>): {
    cwd: string;
    env: NodeJS.ProcessEnv;
};
//# sourceMappingURL=env-allowlist.d.ts.map