/**
 * Conservative read-only command classifier for plan mode.
 *
 * Deny-by-default: false negatives are safe (a read-only command merely stays
 * blocked), false positives are not (a mutating command would slip through).
 * Plan mode gates bash on `isReadOnlyCommand`; anything this function cannot
 * prove is read-only falls back to the existing plan-mode block.
 *
 * A command-name allowlist alone is not proof: several allowlisted utilities
 * mutate through flags (`git branch -D`, `find -delete`, `date -s`,
 * `sort -o file`), take create-shaped operands (`git tag v1`), or execute
 * repo-configured code (`git diff --ext-diff`). Each carries a per-flag
 * policy below.
 */
/** Split a command on shell control operators into individual segments. */
export declare function splitShellCommandSegments(command: string): string[];
export declare function hasUnsafeShellSyntax(segment: string): boolean;
/**
 * Returns true only when every segment of the command is provably read-only.
 */
export declare function isReadOnlyCommand(command: string): boolean;
//# sourceMappingURL=read-only-bash.d.ts.map