/**
 * `agent exec --access read` (#388): read the project and the web, never
 * edit, never run an arbitrary command, never spawn a subagent. Enforced
 * in-process by `readAccessCanUseTool` on claude (canUseTool plus the
 * PreToolUse hook `coverEveryToolCall` installs, so every call is seen).
 * Other runtimes map `read` to their CLI's own read-only mode instead
 * (runner-access.ts lists which ones have one).
 *
 * Shell: only through an allowlist of command prefixes (the
 * `--allow-bash-prefix` machinery, with READ_BASH_PREFIXES as the default
 * list), a single literal invocation (agent-exec-shell-syntax.ts plus no
 * subshell parentheses), and no argument that makes an allowed command
 * write or run something (find -exec/-delete/-fprint*, rg --pre, git
 * --output/--ext-diff).
 */
/** Native tools a read turn may call (Claude Code names). `Skill` only reads
 *  a SKILL.md into context; `ToolSearch` only loads deferred tool schemas
 *  (WebFetch/WebSearch can be deferred). */
export declare const READ_TOOLS: ReadonlySet<string>;
/** Default read-only shell prefixes; `--allow-bash-prefix` adds to them. */
export declare const READ_BASH_PREFIXES: readonly string[];
/** Split a command already cleared by hasUnsafeShellSyntax into words, with
 *  quotes and backslashes removed the way bash would (so `'-delete'` is
 *  seen as `-delete`). */
export declare function shellWords(cmd: string): string[];
export type ShellVerdict = {
    ok: true;
} | {
    ok: false;
    message: string;
};
/** Whether one Bash command is allowed in read access. */
export declare function checkReadOnlyCommand(command: string, extraPrefixes?: readonly string[]): ShellVerdict;
type Decision = {
    behavior: 'allow';
    updatedInput: Record<string, unknown>;
} | {
    behavior: 'deny';
    message: string;
};
/**
 * canUseTool for `--access read`: caller tools (both name forms — see
 * agent-exec.ts), READ_TOOLS, and Bash through checkReadOnlyCommand. Every
 * other native tool (Edit, Write, MultiEdit, NotebookEdit, Task/Agent, MCP
 * tools the user's settings load) is denied.
 */
export declare function readAccessCanUseTool(callerToolNames: ReadonlySet<string>, extraPrefixes?: readonly string[]): (toolName: string, input: Record<string, unknown>) => Promise<Decision>;
export {};
//# sourceMappingURL=agent-exec-read.d.ts.map