/**
 * Bash write-path detection for ownership enforcement.
 *
 * The PreToolUse ownership hook originally saw only Edit/Write/MultiEdit, which
 * left the shell as an unguarded write path: an agent denied an edit could
 * reach the same file through `sed -i`, `python -c`, a `>` redirect, or `mv`.
 *
 * The strategy here is deliberately conservative. Commands whose head cannot
 * write files pass untouched; everything else contributes *every* path-like
 * token it mentions as a candidate for the ownership check. Naming an owned
 * file anywhere in a mutating command is enough to be blocked — which is what
 * makes a path buried in a Python string literal catchable without parsing
 * Python. False positives fail toward "delegate to the owner", the behavior
 * enforcement wants anyway.
 *
 * This raises the cost of a bypass and makes attempts visible; it is not a
 * sandbox. Paths assembled from shell variables, `$(...)` substitution, or an
 * indirection through a helper script written elsewhere are accepted misses.
 */
/**
 * Splits a command into independently-analyzed segments on `&&`, `||`, `;`,
 * `|` and newlines. This is not a shell parser — an operator inside quotes
 * splits too. That over-splits, which is safe: more segments means more
 * candidate tokens checked, never fewer.
 */
export declare function splitSegments(command: string): string[];
/**
 * The segment's effective command name: the first real word with env
 * assignments and wrappers skipped and any directory prefix stripped, so
 * `/usr/bin/sed` and `sudo sed` both read as `sed`.
 */
export declare function commandHead(segment: string): string;
/** True when the segment's head — and, for git, its subcommand — cannot write files. */
export declare function isReadOnlySegment(segment: string): boolean;
/**
 * Targets of `>` / `>>` and `tee`, extracted regardless of the head — a
 * read-only command still writes when its output is redirected
 * (`cat template > Owned.cs`). Skips `2>&1`-style fd duplication and `<` input.
 */
export declare function redirectTargets(segment: string): string[];
/**
 * Every path-like token in a segment. Quotes, parens and commas are treated as
 * delimiters, so `open('src/Cache.cs','w')` yields `src/Cache.cs` with no
 * language-specific parsing.
 */
export declare function pathTokens(segment: string): string[];
/**
 * Candidate paths to run through the ownership check for a whole command.
 *
 * Per segment: redirect targets always count; a read-only segment contributes
 * nothing further, while any other segment contributes every token it mentions.
 */
export declare function bashCandidatePaths(command: string): string[];
//# sourceMappingURL=bash-guard.d.ts.map