/**
 * commandSandbox.ts — Command execution with allow-list enforcement.
 *
 * Replaces raw execSync calls with validated, audited execution.
 * Uses allow-list (not deny-list) for command prefixes.
 */
export interface SafeExecOpts {
    /** Working directory (validated against safePath) */
    cwd?: string;
    /** Timeout in ms (capped at config.maxExecTimeoutMs) */
    timeout?: number;
    /** Allow pipe operators in command */
    allowPipes?: boolean;
    /** Additional allowed command prefixes beyond built-in list */
    additionalPrefixes?: string[];
    /** Max output buffer size in bytes (default: 10MB) */
    maxBuffer?: number;
}
export interface ExecResult {
    stdout: string;
    stderr: string;
    exitCode: number;
    timedOut: boolean;
    durationMs: number;
}
/**
 * Execute a command with security validation.
 *
 * @throws SecurityError if command is not on allow-list or contains injection
 */
export declare function safeExec(command: string, opts?: SafeExecOpts): ExecResult;
/** Export for testing */
export declare const _ALLOWED_PREFIXES: string[];
