/**
 * Conservative read-only command classifier for plan mode.
 *
 * Deny-by-default: false negatives are safe (a read-only command merely stays
 * blocked), false positives are not (a mutating command would slip through).
 * Plan mode gates bash on `isReadOnlyCommand`; anything this function cannot
 * prove is read-only falls back to the existing plan-mode block.
 *
 * A command-name allowlist alone is not proof: several allowlisted utilities
 * mutate through flags (`git branch -D`, `find -delete`, `date -s`,
 * `sort -o file`), take create-shaped operands (`git tag v1`), or execute
 * repo-configured code (`git diff --ext-diff`). Each carries a per-flag
 * policy below.
 */
/** Split a command on shell control operators into individual segments. */
export declare function splitShellCommandSegments(command: string): string[];
export declare function hasUnsafeShellSyntax(segment: string): boolean;
/**
 * Returns true only when every segment of the command is provably read-only.
 */
export declare function isReadOnlyCommand(command: string): boolean;
/**
 * Total seconds a command sleeps when it does nothing else (`sleep 5`,
 * `sleep 2; sleep 3`), or null when it does any real work.
 *
 * Used to catch a guessed wait on a background process, which now has a real
 * answer in `task_output`'s `wait_ms`. Callers care about the duration because
 * a brief settle before poking a dev server is legitimate, while a long nap is
 * always a guess at a finish time.
 */
export declare function sleepOnlySeconds(command: string): number | null;
//# sourceMappingURL=read-only-bash.d.ts.map