/**
 * Detects which token/credential env vars are available on the host.
 * Returns env var names only — never values — for display in the settings UI.
 */
import type { PreferencesStore } from "./preferences-store.js";
/** Well-known non-provider tokens that users may want in sandboxes */
export declare const SANDBOX_AGENT_AUTH_RELATIVE_PATH: string;
export declare const OPENAI_CODEX_SANDBOX_AUTH_TOKEN_KEYS: Set<string>;
export declare function sandboxAgentAuthPath(scope?: string): string;
export interface SandboxAgentAuthOptions {
    prefs?: PreferencesStore | null;
    includeCodexAuth?: boolean;
    /** Separate files prevent one project's authorized mount from feeding another project's denied mount. */
    scope?: string;
}
/**
 * Build the minimal auth.json content a sandboxed pi-coding-agent needs for
 * ChatGPT / OpenAI Codex OAuth. Returns an empty object unless sandbox token
 * policy explicitly allows OpenAI/Codex credentials for this sandbox.
 */
export declare function buildSandboxAgentAuthJson(options?: PreferencesStore | SandboxAgentAuthOptions | null): Record<string, any>;
export declare function sandboxTokenPolicyAllowsCodexAuth(entries: Array<{
    key?: string;
    enabled?: boolean;
}> | undefined | null): boolean;
export declare function ensureSandboxAgentAuthFile(options?: PreferencesStore | SandboxAgentAuthOptions | null): string;
export interface DetectedHostToken {
    envVar: string;
    label: string;
    available: boolean;
}
/**
 * Scan the host for available tokens. Returns env var names + labels + availability.
 * Never returns actual token values.
 */
export declare function detectHostTokens(prefs?: PreferencesStore | null): DetectedHostToken[];
/**
 * Resolve the actual value of a host token by env var name.
 * Used by the sandbox token system when a token has an empty value (meaning "from host").
 * Returns undefined if the token cannot be resolved.
 */
export declare function resolveHostTokenValue(envVar: string, prefs?: PreferencesStore | null): string | undefined;
//# sourceMappingURL=host-tokens.d.ts.map