/** * Values that end up in a command string on the server. * * A path, and any other value that isn't meant to reveal anything, goes * through `shellQuote`: inside single quotes the shell sees no space, no * `$(…)`, no backslash. The remaining four cases are the ones where quoting * is either too little or forbidden by meaning: * * - a number (`lines`, `context`, `top_n`) — the schema type guarantees * nothing: MCP validates the request envelope, and `arguments` comes * through as-is; * - permissions and owner — go into `chmod` and `install` as separate words; * - a name pattern (`pattern`) — must expand on the server, so it can't be * quoted; backslash escaping is what protects it instead. * * A bad value is a rejection with a message, not a silent fix: silently * clipped permissions or a silently altered pattern would go unnoticed. */ /** * A value as a single word for the shell on the server. * * Inside single quotes nothing is special except the quote itself: it has * to be closed, an escaped quote inserted, and reopened. */ export declare function shellQuote(value: string): string; /** A whole non-negative number: a line count, a sample size */ export declare function shellCount(value: unknown, name: string): number; /** * Permissions: octal (`644`, `0755`) or symbolic (`u+x`, `go-w,a+r`). * * The symbolic form is accepted alongside octal: the danger isn't in its * letters but in what might ride along with them. Everything a permission * string can't legitimately contain is stripped — that's enough protection, * and there's no reason to take away a working form. */ export declare function shellMode(value: unknown, name: string): string; /** * Owner: `user` or `user:group`. * * A leading dash is rejected separately: `install -o -rf` would parse such * a name as its own flag, and quoting doesn't protect against that. */ export declare function shellOwner(value: unknown, name: string): string; /** * A file name pattern: `*`, `?`, `[…]` reach the server intact, everything * else gets a backslash and becomes a plain character. * * Quoting is forbidden here: inside quotes the pattern would stop * expanding, and expansion is the whole point of the parameter. A newline * and other control characters are rejected — a backslash before a newline * means command continuation, exactly what we're guarding against. */ export declare function shellGlob(value: unknown, name: string): string;