/**
 * The command guard a Claude Code agent's `PreToolUse` hook runs before each
 * `Bash` call (native-reviewer-agent/AC-4..AC-8, DD-2, DD-5).
 *
 * Why a script and not the agent's `tools` list: Claude Code's `tools` takes
 * tool names only, and a specifier such as `Bash(git diff *)` in
 * `disallowedTools` removes Bash outright. A hook that inspects each command is
 * the harness's documented way to allow some commands and not others.
 * `permissionMode: plan` was the other candidate and loses to a parent session
 * that bypasses permissions — which is how an unattended run starts.
 *
 * The rendered script is an allowlist anchored at the start of the command,
 * never a denylist, and every way it can fail ends in a block:
 *
 * - the script exits 2, Claude Code's blocking code, on anything it does not
 *   positively allow — unreadable input included;
 * - the hook command ends `|| exit 2`, so a missing script, a missing `node`, an
 *   unset `CLAUDE_PROJECT_DIR` or a crash block as well, instead of being the
 *   non-blocking hook error any other exit code is.
 *
 * Commands reach `renderGuard` already validated by `compile/agents.ts` as
 * lowercase words, so embedding them as JSON cannot inject source.
 *
 * @module
 */
/**
 * Long options refused even on an allowed command, because each can write a
 * file or run a program: `git diff --output=<file>` writes, and the other two
 * run whatever a config names. Git accepts any unambiguous abbreviation of a
 * long option, so the guard refuses abbreviations too (`--outp=x`).
 */
export declare const DANGEROUS_OPTIONS: readonly ["output", "ext-diff", "textconv"];
/** Repo-relative path of an agent's guard. */
export declare function guardPath(agentName: string): string;
/**
 * The hook's shell command. `$CLAUDE_PROJECT_DIR` rather than a relative path:
 * a hook's working directory is the session's, which need not be the root.
 */
export declare function guardHookCommand(agentName: string): string;
/**
 * Render the guard script for one agent.
 *
 * @param agentName - Used only in the refusal message.
 * @param commands - Allowed command prefixes, validated by `resolveAgents`.
 */
export declare function renderGuard(agentName: string, commands: string[]): string;
//# sourceMappingURL=reviewer-guard.d.ts.map