/**
 * SECURITY (CLAUDE.md §5) — strip the auth token from a freshly-cloned repo's
 * on-disk git state. A `git clone https://x-access-token:<tok>@host/...` bakes
 * that authenticated URL into `<dest>/.git/config`; a Fargate agent then reads
 * UNTRUSTED PR/issue content with a Bash tool and could `cat .git/config` /
 * `git remote -v` to exfiltrate the tenant token (the shell ENV is scrubbed but
 * the repo config was not). This rewrites `origin` to the TOKENLESS `cleanUrl`
 * so the repo the model works in holds no secret. Push is unaffected:
 * deterministic workflow nodes re-inject the token transiently right before
 * `git push`, and the model is instructed never to push from Bash.
 *
 * `execSyncFn` is injected so this works from the execSync-based clone tools
 * (github_clone / gitlab_clone). The set-url command uses only the tokenless
 * URL, so a failure message carries no secret — but we still mask `token`
 * defensively and never throw (a scrub failure must not break a good clone; it
 * is logged so a regression is visible).
 *
 * @param {(cmd:string, opts?:object)=>any} execSyncFn
 * @param {string} destPath  the cloned repo directory
 * @param {string} cleanUrl  the tokenless remote URL to set on origin
 * @param {string} [token]   the secret, masked out of any error log
 * @param {string} [label]   caller name for the log line
 */
export function scrubClonedRemoteSync(execSyncFn: (cmd: string, opts?: object) => any, destPath: string, cleanUrl: string, token?: string, label?: string): void;
export namespace gitSkill {
    let id: string;
    let description: string;
    let envKeys: string[];
    let promptFragment: string;
    function resolve(): any;
    function handleToolCall(name: any, args: any, context: any): Promise<string>;
    let tools: ({
        name: string;
        description: string;
        input_schema: {
            type: string;
            properties: {
                url: {
                    type: string;
                    description: string;
                };
                branch: {
                    type: string;
                    description: string;
                };
                shallow: {
                    type: string;
                    description: string;
                };
                name: {
                    type: string;
                    description: string;
                };
                repo?: undefined;
                depth?: undefined;
            };
            required: string[];
        };
    } | {
        name: string;
        description: string;
        input_schema: {
            type: string;
            properties: {
                url?: undefined;
                branch?: undefined;
                shallow?: undefined;
                name?: undefined;
                repo?: undefined;
                depth?: undefined;
            };
            required?: undefined;
        };
    } | {
        name: string;
        description: string;
        input_schema: {
            type: string;
            properties: {
                repo: {
                    type: string;
                    description: string;
                };
                depth: {
                    type: string;
                    description: string;
                };
                url?: undefined;
                branch?: undefined;
                shallow?: undefined;
                name?: undefined;
            };
            required: string[];
        };
    })[];
}
