export declare const destructiveCommandPatterns: RegExp[];
/**
 * Commands that pipe remote content into a shell or push local data into a
 * network sink. These are RECOVERABLE and routinely legitimate — `curl
 * https://sh.rustup.rs | sh` is a documented installer, and `base64 file | nc
 * target 4444` is a textbook authorized-exfiltration test on an engagement —
 * so they are CONFIRMED rather than hard-blocked. The operator is the right
 * authority; a hard block only pushed the model into retrying variants.
 */
export declare const exfiltrationPatterns: RegExp[];
export declare const networkScanTools: string[];
/**
 * One parsed executable segment of a command line. Every safety decision that
 * needs to know "which programs does this command actually run" goes through
 * {@link splitCommandSegments} so a single shared representation is used
 * instead of per-rule substring matching.
 */
export interface CommandSegment {
    raw: string;
    tokens: string[];
    base: string;
    sub: string | undefined;
    elevated: boolean;
}
/**
 * Split a command line on pipes / chaining operators and resolve the real
 * executable of each segment, seeing through env-var prefixes, `command`,
 * `exec`, `time`, and `sudo`/`doas` (including their value-taking flags).
 */
export declare function splitCommandSegments(command: string): CommandSegment[];
export declare function isApprovedScannerSegment(segment: CommandSegment): boolean;
/**
 * Commands that never mutate state and never expose secrets through their
 * default arguments. Powerful commands whose arguments can leak data
 * (cat, env, python, node, git, npm, pip, tee, xargs, curl, wget) are
 * intentionally NOT here — they fall through to `subcommandSafeMap` or
 * to the metacharacter-aware confirm path in classifier.ts.
 */
export declare const readOnlyShellCommands: Set<string>;
/**
 * Subcommand allowlist for powerful CLIs. The classifier treats
 * `<cmd> <subcmd> …` as safe iff `subcommandSafeMap[cmd]` contains
 * `subcmd`. Anything else falls through to confirm.
 *
 * `config` is intentionally NOT here for git/npm/pnpm/yarn — `git config
 * --global ...` and `npm config set ...` mutate user-level state and
 * should always confirm. Read-only forms (`git config --get foo`,
 * `npm config get registry`) are caught by `mutatingArgPatterns` below
 * so they can still auto-execute when the args are clearly read-only.
 */
export declare const subcommandSafeMap: Record<string, Set<string>>;
/**
 * True when a network-configuration command mutates host state. `ip`, `nmcli`,
 * `route`, and `arp` are argument-shaped rather than subcommand-shaped, so the
 * read verbs are enumerated explicitly and everything else (set/add/del/
 * delete/flush/up/down/modify/replace/change) requires confirmation.
 */
export declare function commandHasStatefulSysadminArg(command: string): boolean;
/**
 * Patterns that move an otherwise-safe-looking command into the
 * confirm bucket because their arguments mutate state, exfiltrate
 * data, or escape into another shell:
 *   - `sed -i …`            in-place file rewrite
 *   - `awk … system(...)`   shell-out via awk's system()
 *   - `awk … |getline …`    arbitrary command via getline
 *   - `find … -exec …`      run arbitrary commands
 *   - `find … -delete`      delete matched files
 *   - `git config --global` / `git config --system` write user/system git config
 *   - `npm config set …`    persist npm/yarn/pnpm config
 *   - `<cmd> --output-document=…` / `-o …` for fetchers (curl/wget) when
 *     not GET — handled separately, but pattern caught here for safety
 */
export declare const mutatingArgPatterns: RegExp[];
export declare function commandHasMutatingArg(command: string): boolean;
/**
 * Base commands whose whole job is to MUTATE state — create/copy/move/delete
 * files, change ownership/permissions, write to disk, install packages, build
 * artifacts, or control services/processes. These always require confirmation
 * even when they appear without any obviously dangerous flag.
 *
 * The policy this powers is: benign/read-only commands auto-run, but anything
 * that installs, deletes, modifies, moves, or copies (or needs elevation) must
 * be confirmed first. Package managers and build tools are included because
 * they write to disk and pull remote code.
 */
export declare const mutatingCommandBases: Set<string>;
/**
 * Detect a redirection that WRITES TO A REAL FILE — the only kind that should
 * gate behind a confirmation. Discards and fd-duplications are NOT real
 * writes and must auto-run, because the agent uses them on nearly every
 * command:
 *   - `2>/dev/null`, `>/dev/null`, `&>/dev/null`   → discard (safe)
 *   - `2>&1`, `>&2`, `1>&2`                         → fd-dup (safe)
 *   - `> out.txt`, `>> log`, `&> out`              → real write (confirm)
 *
 * Command substitution `$(...)`/backticks and plain `sudo` are intentionally
 * NOT treated as writes here: they are extremely common and any actual
 * mutation is caught by {@link commandIsMutating} (which sees through a
 * leading `sudo`/`doas`). Keeping them out of the confirm path is what lets
 * the agent run ordinary commands without a prompt on every call.
 */
export declare function commandWritesOrEscalates(command: string): boolean;
export declare function isVersionOrHelpProbe(command: string): boolean;
/**
 * Split a command line on pipes / chaining operators and report whether ANY
 * segment is a mutating command. A segment is mutating when its base command
 * is in {@link mutatingCommandBases} AND it is not a known read-only
 * subcommand of that base (so `git status` / `docker ps` / `npm list` are NOT
 * flagged, while `git push` / `docker run` / `npm install` are). In-place /
 * state-mutating ARGUMENTS (sed -i, find -exec, …) are handled separately by
 * {@link commandHasMutatingArg}, which callers check first.
 *
 * This lets a chain of purely read-only commands (`grep x foo | sort | head`)
 * auto-run, while a chain that includes a mutator (`cat a | tee b`) is flagged.
 */
export declare function commandIsMutating(command: string): boolean;
/**
 * True only when EVERY executable segment of the command is either an
 * approved network scanner or an already-read-only command, and at least one
 * segment is a scanner. This is what makes the scanner exemption monotonic:
 * a scanner token can never turn a mutating or unknown segment into `safe`,
 * so `nmap host && rm -rf build` or `nmap host > /etc/hosts` keep the risk
 * level they would have had without the scanner word.
 */
export declare function commandIsScannerOnly(command: string): boolean;
/**
 * @deprecated Secret-path hard blocks were removed. Patterns retained only
 * for diagnostics / legacy tests — {@link isSecretPath} always returns false
 * so pentest reads of .ssh/.env on targets are never gated by the agent.
 */
export declare const secretPathPatterns: RegExp[];
/**
 * Always false — secret-path hard gates were removed so agents can freely
 * read/write/fetch paths used in pentest (e.g. remote .ssh, .env dumps).
 * Destructive deletes still go through the confirmation UI separately.
 */
export declare function isSecretPath(_path: string): boolean;
export declare function containsShellMetacharacter(command: string): boolean;