/**
 * R6/R2 — environment-protection constants, the host-native `ask` pattern
 * sets (Layer 1 of the unified approval gate), and the mode/config parsing.
 * Split out of the former monolithic envprotect.ts; behavior unchanged.
 *
 * These are the shapes a wildcard CAN express (head-anchored globs).  The
 * plugin NEVER self-allows; an unanswered dialog is the host's own to resolve
 * (v2 gives a plugin no dialog to raise, so the guard fails closed — see
 * src/host/v2-guard.ts).
 */
/** Audit log service identifier (also the query key for "what was blocked"). */
export declare const ENV_PROTECT_SERVICE = "team-mode-env-protect";
/**
 * Fixed structured message returned to the model on every block.  The
 * category is appended as a machine-readable suffix; tests pin both.
 */
export declare const ENV_PROTECT_MESSAGE = "TeamMode R6 env protection: \u73AF\u5883\u53D8\u91CF\u8BFB\u53D6\u5DF2\u88AB\u62E6\u622A\u3002\u9700\u8981\u53D8\u91CF\u503C\u8BF7\u5411 HUMAN \u7533\u8BF7\u3002";
/** Pattern categories surfaced in the block message and the audit log. */
export declare const CATEGORY_BASH_ENV_COMMAND = "bash-env-command";
export declare const CATEGORY_BASH_ENV_EXPANSION = "bash-env-expansion";
export declare const CATEGORY_ENV_FILE_PATH = "env-file-path";
export declare const CATEGORY_EXTRA_DENY = "extra-deny";
/**
 * Two faces are routed to the OpenCode official confirmation dialog by
 * declaring them `ask` in each agent's bash permission object.  The host
 * pops a dialog for any command matching one of these patterns and SUSPENDS
 * it: a human reply ("once"/"always") runs the command, a "reject" or NO
 * REPLY is the host's own to resolve — v2 gives a plugin no dialog to raise,
 * so the guard fails closed (see src/host/v2-guard.ts).  The plugin NEVER
 * self-allows.
 *
 * These are the shapes a wildcard CAN express (head-anchored globs, matching
 * the probe-verified grammar: `printenv*`, `rm *`, `Get-ChildItem env:*`).
 * Wildcards CANNOT express (embedded `${VAR}` / `$ALLCAPS` / `$env:` inside
 * another command, command substitution `$(printenv)`, subshell/escaped/
 * `time`-prefixed heads, `VAR=… env` assignment prefixes, split `declare -xp`,
 * env-file paths at arbitrary positions) stay the classifier's HARD THROW —
 * that is the `isAskGatedEnvCommand` boundary, kept in lockstep with the
 * classifier so a form we stop throwing on is exactly a form the dialog shows.
 */
/** R6 env face — the wildcard-expressible environment-variable reads. */
export declare const R6_ENV_BASH_ASK: Readonly<Record<string, "ask">>;
/** R2 danger face — destructive / publishing / network / install / process /
 *  privilege commands.  Independent of TM_ENV_PROTECT (R2 is its own red
 *  line); the built-in bash tool stays `allow` for everything else, so the
 *  normal verification stack (npm test, tsc, git status/diff) never pops. */
export declare const R2_DANGER_BASH_ASK: Readonly<Record<string, "ask">>;
/** Ordered key lists (frozen) — single source for the matcher + the gate. */
export declare const R6_ENV_BASH_ASK_PATTERNS: readonly string[];
export declare const R2_DANGER_BASH_ASK_PATTERNS: readonly string[];
/**
 * The bash permission object injected into the four execution-role agents
 * (team / implementer / reviewer / tester).  Default stays `allow`
 * (`"*": "allow"`, preserving the T2.1 matrix semantics — bash is granted,
 * not removed); only the listed shapes escalate to the host dialog.  The R6
 * env face is dropped when `mode === "off"` (the R6 kill switch) AND when
 * `envFace` is false — index.ts passes false while the approval gate cannot
 * arm: the R6 hook then hard-throws every env read BEFORE its dialog could
 * ever satisfy it, so injecting the env asks would only create dead popups
 * a human can answer yet never make runnable.  The R2 face is always
 * present (its dialog is the whole gate — no code-level throw is involved).
 */
export declare function bashAskPatterns(mode: EnvProtectMode, envFace?: boolean): Record<string, string>;
export type EnvProtectMode = "strict" | "standard" | "off";
/**
 * Resolve the protection mode.  Only exact "standard" / "off" switch those
 * modes on; everything else (unset, typos, wrong case) fails CLOSED into
 * strict — a mistyped opt-out must never disable the red line.
 */
export declare function resolveEnvProtectMode(raw: unknown): EnvProtectMode;
/**
 * Parse `TM_ENV_PROTECT_EXTRA_DENY` (semicolon-separated regex bodies).
 * Invalid regexes are skipped rather than crashing plugin startup; the
 * remaining rules still apply.  Empty/absent input yields no extra rules.
 */
export declare function parseExtraDeny(raw: unknown): RegExp[];
/** The block error handed back to the model (fixed text + category tag). */
export declare function envProtectError(category: string): Error;
//# sourceMappingURL=patterns.d.ts.map