/**
 * Environment Isolation Service
 *
 * Strips sensitive environment variables (API keys, tokens, secrets) from
 * child process environments when agents execute bash commands. Maintains
 * an allowlist of safe variables and provides a mechanism to explicitly
 * pass specific vars when needed.
 *
 * @module services/agent/crewly-agent/env-isolation.service
 *
 * @example
 * ```typescript
 * const isolation = new EnvIsolationService();
 * const safeEnv = isolation.createSafeEnv(process.env);
 * // safeEnv has PATH, HOME, etc. but no ANTHROPIC_API_KEY
 *
 * const withOverrides = isolation.createSafeEnv(process.env, ['MY_CUSTOM_VAR']);
 * // safeEnv + MY_CUSTOM_VAR explicitly included
 * ```
 */
/**
 * Environment variables that are always safe to pass to child processes.
 * These are essential for basic shell operation and don't contain secrets.
 */
export declare const SAFE_ENV_ALLOWLIST: readonly string[];
/**
 * Patterns that identify sensitive environment variable names.
 * Variables matching these patterns are stripped from child processes.
 */
export declare const SENSITIVE_ENV_PATTERNS: readonly RegExp[];
/**
 * Service that creates sanitized environment objects for child processes.
 */
export declare class EnvIsolationService {
    private readonly allowlist;
    private readonly sensitivePatterns;
    /**
     * Creates a new EnvIsolationService.
     *
     * @param additionalSafeVars - Extra variable names to always allow
     * @param additionalSensitivePatterns - Extra patterns to block
     */
    constructor(additionalSafeVars?: string[], additionalSensitivePatterns?: RegExp[]);
    /**
     * Creates a safe environment object by filtering out sensitive variables.
     *
     * Strategy:
     * 1. Start with all env vars
     * 2. Keep vars on the allowlist
     * 3. Remove vars matching sensitive patterns
     * 4. Add explicitly requested vars (overrides)
     *
     * @param sourceEnv - Source environment (typically process.env)
     * @param explicitVars - Variable names to explicitly include even if they'd be filtered
     * @returns Sanitized environment object safe for child processes
     */
    createSafeEnv(sourceEnv: Record<string, string | undefined>, explicitVars?: string[]): Record<string, string>;
    /**
     * Checks if an environment variable name matches any sensitive pattern.
     *
     * @param varName - Environment variable name to check
     * @returns True if the variable is considered sensitive
     */
    isSensitive(varName: string): boolean;
    /**
     * Returns the list of sensitive variable names found in the given environment.
     * Useful for audit logging.
     *
     * @param sourceEnv - Environment to scan
     * @returns Array of sensitive variable names found
     */
    findSensitiveVars(sourceEnv: Record<string, string | undefined>): string[];
    /**
     * Returns the current allowlist as an array.
     * @returns Copy of the safe variable allowlist
     */
    getAllowlist(): string[];
}
//# sourceMappingURL=env-isolation.service.d.ts.map