/**
 * Prompt-injection detector for UNTRUSTED tool output (web pages, search
 * snippets, MCP results). Modelled on sheeki03/tirith's prompt_injection rule
 * (commit ef09f18a) + its deobfuscation pass: normalise away the usual
 * obfuscations, then match a SMALL, high-precision phrase set. Precision over
 * recall — a hit only appends a one-line warning; content is never removed.
 *
 * Pure and deterministic. Work is bounded: at most the first + last
 * SCAN_WINDOW chars are scanned, and at most MAX_BLOBS encoded blobs decoded.
 *
 * Docs ABOUT prompt injection that quote a live payload verbatim (e.g. "ignore
 * all previous instructions") are flagged by design: the warning is harmless
 * there (the model should treat a quoted payload as data anyway), and
 * special-casing "this looks like a discussion" is exactly the hole an
 * attacker would use. Mere mentions of the topic ("prompt injection",
 * "system prompt") do not hit.
 */
import type { ToolResultContent } from "@kenkaiiii/gg-ai";
export interface InjectionHit {
    /** Short human label, e.g. "instruction override, base64-encoded". */
    kind: string;
    /** Normalised matched text, ≤ 80 chars. */
    sample: string;
}
/** Normalise text for matching. Exported for tests. */
export declare function normalizeForDetection(text: string): string;
/** Scan untrusted text; `null` when nothing instruction-like was found. */
export declare function detectInjection(text: string): InjectionHit | null;
/** Tools whose output is attacker-controllable content from outside the repo. */
export declare function isUntrustedTool(name: string): boolean;
export declare function injectionWarning(kind: string): string;
/**
 * `transformToolResult` hook body: for untrusted tools, append the warning
 * line on a hit. Content is never altered otherwise.
 */
export declare function flagUntrustedToolResult(call: {
    name: string;
}, content: ToolResultContent): ToolResultContent;