/**
 * pathSandbox.ts — Filesystem boundary enforcement.
 *
 * Every tool that reads/writes files should call safePath() before fs access.
 * Blocks path traversal, symlink escape, and access to sensitive directories.
 */
export interface SafePathOpts {
    /** Override default allowed roots from config */
    allowedRoots?: string[];
    /** Allow access to home directory (still blocks sensitive subdirs) */
    allowHome?: boolean;
    /** Allow access to temp directory */
    allowTemp?: boolean;
    /** Skip boundary check entirely (use for known-safe internal paths) */
    skipBoundaryCheck?: boolean;
}
/**
 * Validate and resolve a file path against security boundaries.
 *
 * @throws SecurityError if the path violates boundaries
 * @returns The resolved, validated absolute path
 */
export declare function safePath(inputPath: string, opts?: SafePathOpts): string;
