/**
 * Dangerous-command inspection for the PreToolUse side of the agent firewall.
 *
 * A prompt-injected agent's most dangerous capability is running shell commands.
 * This screens a command the agent is ABOUT to execute and decides deny / ask /
 * allow. Patterns are deliberately HIGH-confidence (remote-code execution,
 * reverse shells, disk/destructive ops, credential exfiltration, persistence) so
 * that everyday commands pass untouched — a guard that cries wolf gets disabled.
 *
 * Layer 1 (primary) is STRUCTURAL: the command is resolved symbolically and
 * judged by capability (see ./capability.ts), so adaptive evasions — globbed
 * binary names, variable concatenation, runtime byte-building — are caught by
 * behaviour, not spelling. Layer 2 is the high-confidence regex set below, kept
 * as defense-in-depth.
 */
export type CommandDecision = "deny" | "ask" | "allow";
export type CommandResult = {
    decision: CommandDecision;
    /** Human reason (shown to the agent / user). */
    reason: string;
    /** Rule id that fired, if any. */
    rule: string | null;
};
export declare function inspectFileWrite(path: string, content: string): CommandResult;
/**
 * Reveal a command's intent past trivial shell obfuscation: strip in-word
 * backslash escapes (`cur\l` → `curl`) and quotes (`c"u"rl`, `c'u'rl` → `curl`),
 * which the shell collapses but a naive regex would miss. Used as a SECOND pass —
 * a normalized-only match is reported as "ask" (not "deny"), because stripping
 * quotes can also surface a benign string (`echo "rm -rf /tmp"`), so it raises a
 * flag rather than hard-blocking. The guard is a high-signal tripwire, not a
 * sandbox: a determined attacker can obfuscate further (env indirection, base64,
 * here-docs). It raises the bar and surfaces the obvious; pair it with real
 * sandboxing / least privilege for untrusted code.
 */
export declare function normalizeCommand(cmd: string): string;
export declare function inspectCommand(command: string): CommandResult;