/**
 * Shared deterministic checks for model-authored free text that the host is
 * about to display to an operator or persist durably.
 *
 * These are defense in depth, not a guarantee. `SECURITY.md` is explicit that
 * free-form model, user, and tool text may still contain sensitive data: what
 * follows catches known credential shapes and this agent's own configured
 * secrets, not every conceivable secret. Callers reject rather than redact, so
 * a partial match never produces a silently mangled value that still reports
 * success.
 */
/**
 * Reject terminal and bidi control characters. Ordinary Unicode text and LF
 * newlines stay intact; what goes is anything that could clear, overwrite, or
 * visually reorder text an operator later reads.
 */
export declare function containsUnsafeReviewControl(value: string): boolean;
/** Whether the text carries a value shaped like a well-known credential. */
export declare function containsSecretLikeValue(value: string): boolean;
/**
 * The live credential values this process actually holds, taken from
 * environment variables whose NAME looks credential-bearing. Matching against
 * these is exact rather than heuristic: it catches the agent echoing back a
 * secret it was configured with, which no shape rule can promise.
 */
export declare function knownEnvironmentSecretValues(env: Record<string, string | undefined>): readonly string[];
/**
 * Whether the text contains any of this agent's own configured secret values.
 *
 * Both sides are NFKC-folded before comparison. Callers normalize the text they
 * are about to store, so comparing it against a raw environment value would
 * miss a credential that is itself configured in a compatibility form (a
 * fullwidth password matches only once both sides agree on a domain).
 */
export declare function containsKnownSecretValue(value: string, secrets: readonly string[]): boolean;
//# sourceMappingURL=untrusted-text.d.ts.map