/**
 * config.ts — Centralized security configuration.
 *
 * Reads from env vars at startup, cached for the process lifetime.
 * Test helpers follow the embeddingProvider.ts pattern.
 */
export type SecurityMode = "strict" | "permissive" | "audit_only";
export interface SecurityConfig {
    /** strict = block + log, permissive = allow all, audit_only = log but don't block */
    mode: SecurityMode;
    /** Filesystem roots tools are allowed to access (default: cwd) */
    allowedRoots: string[];
    /** Max command execution timeout in ms (hard cap) */
    maxExecTimeoutMs: number;
    /** Whether audit logging is enabled */
    auditEnabled: boolean;
    /** Additional command prefixes allowed beyond the built-in list */
    extraExecAllowList: string[];
}
export declare function getSecurityConfig(): SecurityConfig;
export declare function setSecurityConfig(partial: Partial<SecurityConfig>): void;
/** Test helper — reset to defaults */
export declare function _resetSecurityConfigForTesting(): void;
