/**
 * Defense-in-depth sanitizer for assistant text emitted by the Claude Agent
 * SDK driver.
 *
 * The model occasionally leaks control markup into the *plaintext* of an
 * assistant `text` block:
 *
 * 1. A verbatim function-call XML wrapper
 *    (`[function_calls] … [invoke name="Bash"] … [/antml:invoke] … [/function_calls]`)
 *    — the same call is *also* emitted as a structured `tool_use` block, so the
 *    inline copy is pure duplication.
 * 2. A fabricated follow-up turn the model auto-completes from the prepended
 *    conversation transcript, e.g. a trailing `[User]: "…"` (or `[Assistant]:`)
 *    line. This hallucinated turn swallows the user's real next message in the
 *    UI.
 *
 * Neither belongs in persisted assistant prose. The primary fix lives in the
 * prompt shape (`enrichPromptWithHistory` no longer renders a continuable
 * `[User]:`/`[Assistant]:` transcript); this strips the residue if a leak still
 * slips through. It is deliberately conservative — only the clearly-leaked
 * control markup above is removed; legitimate prose (including a user *quoting*
 * a bracketed phrase mid-sentence) is left untouched.
 *
 * @module
 */
/**
 * Strip leaked control markup from an assistant text block.
 *
 * Order matters: remove function-call wrappers first (they may span multiple
 * lines and contain role-like text), then drop any trailing fabricated role
 * turns. Only *trailing* role turns are removed — a `[User]:` line in the
 * middle of genuine prose is left alone, because a real answer never emits one
 * mid-stream, whereas the hallucinated follow-up always lands at the end.
 *
 * @param text - Raw assistant text (possibly a partial stream so far).
 * @returns The text with leaked markup removed. Returns the input unchanged
 *   when it contains none.
 */
export declare function sanitizeAssistantText(text: string): string;
/**
 * Streaming-safe variant of {@link sanitizeAssistantText}.
 *
 * Returns the sanitized text truncated before (a) any surviving unclosed
 * markup opener and (b) any trailing partial marker fragment, so the caller can
 * emit the result so far without ever flushing the first half of a marker that
 * will complete in a later delta. The held-back portion is re-evaluated on the
 * next call once more text arrives.
 *
 * @param text - The accumulated assistant text so far (not a single delta).
 * @returns The sanitized, complete-marker-free prefix safe to emit now.
 */
export declare function streamingSafeSanitize(text: string): string;
//# sourceMappingURL=sanitize-assistant-text.d.ts.map