/**
 * Lightweight HTTP/HTTPS forward proxy with hostname allowlist.
 * Used to restrict network access from Docker sandboxed agent containers.
 *
 * - HTTPS tunneling via HTTP CONNECT method
 * - Plain HTTP proxying for non-TLS requests
 * - Only allows requests to hostnames in the allowlist (case-insensitive)
 * - Returns 403 for blocked hosts
 */
export declare class SandboxProxy {
    private server;
    private _allowlist;
    private _port;
    private _allowlistSet;
    constructor(allowlist: string[]);
    get port(): number;
    get allowlist(): string[];
    /** Dynamically add a hostname to the allowlist (e.g. the gateway's real address). */
    addToAllowlist(hostname: string): void;
    private isAllowed;
    start(): Promise<number>;
    stop(): void;
    /**
     * Handle HTTP CONNECT method (HTTPS tunneling).
     * The client sends CONNECT hostname:port, and we create a TCP tunnel if allowed.
     */
    private handleConnect;
    /**
     * Handle plain HTTP requests (non-CONNECT).
     * Parse the target hostname from the request URL and proxy if allowed.
     */
    private handleRequest;
}
//# sourceMappingURL=sandbox-proxy.d.ts.map