/**
 * Network egress allowlist.
 *
 * Two layers, with very different strength:
 *
 * 1. **Real enforcement** — the agent's own egress paths (`web-fetch`,
 *    `web-search`) check every request URL and every redirect hop against the
 *    allowlist. Nothing gets out of those tools to a disallowed host.
 *
 * 2. **Defence in depth (bypassable by design)** — {@link extractCommandHosts}
 *    recognises the common network command shapes (`curl`, `wget`, `git`,
 *    `ssh`/`scp`, package installs) so `bash` can refuse an obvious egress to a
 *    disallowed host. It is *not* a sandbox: `python -c`, a shell variable, a
 *    base64'd URL, or any unrecognised tool walks straight past it. It exists
 *    to catch accidents, not to contain a hostile model. Real containment needs
 *    OS-level enforcement (sandbox-exec, Landlock/seccomp, a netns proxy).
 *
 * Deliberately allow-shaped, not deny-shaped: a command with no recognised host
 * is never blocked, so ordinary work is unaffected.
 */
/** Host pattern match: exact, or `*.example.com` matching any subdomain. */
export declare function isHostAllowed(host: string, allow: readonly string[]): boolean;
/** Hostname of a URL-ish token, or undefined when it isn't one. */
export declare function hostFromUrl(value: string): string | undefined;
/**
 * Best-effort extraction of the hosts a shell command would contact.
 * Returns an empty array when nothing recognisable is found — never guesses.
 */
export declare function extractCommandHosts(command: string): string[];
/**
 * Check a shell command against the allowlist.
 * @returns an error string when a recognised host is disallowed, else null.
 */
export declare function checkCommandNetwork(command: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
/** Check a URL the agent is about to fetch (or a redirect target). */
export declare function checkUrlNetwork(url: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
/** Resolved egress policy, read lazily so a settings change applies live. */
export interface NetworkPolicy {
    mode: "off" | "allowlist";
    allow: readonly string[];
}
export type GetNetworkPolicy = () => NetworkPolicy | undefined;
/** Check a URL against a possibly-absent policy. */
export declare function checkUrlPolicy(url: string, getPolicy?: GetNetworkPolicy): string | null;
/** Check a shell command against a possibly-absent policy. */
export declare function checkCommandPolicy(command: string, getPolicy?: GetNetworkPolicy): string | null;
//# sourceMappingURL=network-guard.d.ts.map