/**
 * Sandbox clone-source resolution.
 *
 * Picks the source `git clone` uses *inside* the Linux sandbox container.
 *
 * The historical bug: when a project had no `origin` remote, the bootstrap
 * fell back to the raw HOST directory path as the clone URL. On Windows the
 * drive-letter path (`C:/Users/...`) is misparsed by git as scp/SSH syntax
 * (`host:path`) → `cannot run ssh` / `unable to fork`; on any OS the host path
 * is unreachable from inside the container.
 *
 * The fix: this resolver NEVER emits a raw host path as the clone URL, and
 * NEVER derives a bind-mount source from the `origin` value.
 * - With a network `origin` remote → clone the remote URL directly.
 * - With no origin → bind-mount the CALLER-supplied canonical main-repo root
 *   (`mountSourcePath`) at a fixed container path and clone from `file://`.
 *   The resolver never touches the filesystem and never derives any path from
 *   `origin` — this removes the entire local-origin→mount attack surface (an
 *   in-root symlink pointing outside can no longer escape, because no path is
 *   ever derived from `origin`).
 * - With a LOCAL origin (file://, absolute/relative/UNC/drive-letter path):
 *   THROW a clear, actionable error. A local origin cannot be cloned into the
 *   container (the host path is unreachable / a drive-letter is misparsed as
 *   scp), so the caller must configure a clonable network remote or remove the
 *   origin to fall back to the mounted project repo.
 */
/** Fixed container-internal mount point for the remote-less bind-mount source. */
export declare const MOUNTED_SRC_PATH = "/workspace-src";
/** Clone URL git uses inside the container for the bind-mounted source. */
export declare const MOUNTED_SRC_CLONE_URL = "file:///workspace-src";
export type SandboxCloneSource = {
    kind: "remote";
    cloneUrl: string;
} | {
    kind: "mounted";
    hostPath: string;
    mountPath: string;
    cloneUrl: string;
};
/**
 * Resolve the clone source for a sandbox container.
 *
 * @param opts.originUrl       The project's `origin` remote URL (or null/empty/undefined when absent).
 * @param opts.mountSourcePath The CANONICAL main-repo working directory to bind-mount when origin
 *                             is absent. Required. The caller resolves this (see
 *                             `resolveSandboxMountRoot`) — the resolver NEVER derives a path from
 *                             `origin` and NEVER touches the filesystem.
 * @param opts.mountPath       Container-internal mount point (default `/workspace-src`). Multi-repo
 *                             callers pass a per-repo path like `/workspace-src/web`.
 *
 * Classification:
 * - A network remote (URL scheme or scp-style `[user@]host:path`) →
 *   `{ kind: "remote", cloneUrl: stripTokenFromGitUrl(origin) }`, cloned directly.
 * - Absent/empty origin → bind-mount `mountSourcePath` (the caller-canonicalized
 *   main repo root — always safe) and clone via `file://<mountPath>`.
 * - A LOCAL origin (file://, absolute/relative/UNC/drive-letter) → THROW. A local
 *   origin can never be cloned into the container.
 *
 * Invariant: the returned `cloneUrl` is NEVER a raw host path or a Windows
 * drive-letter string. It is always a network remote URL or `file://<mountPath>`.
 */
export declare function resolveSandboxCloneSource(opts: {
    originUrl?: string | null;
    mountSourcePath: string;
    mountPath?: string;
}): SandboxCloneSource;
//# sourceMappingURL=sandbox-clone-source.d.ts.map