/**
 * Password supply: reuse the in-memory cache while fresh (CACHE_MS,
 * mirroring sudo's timestamp_timeout), otherwise prompt the user via the
 * masked TUI input, showing the exact command about to run.
 */
import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
import { type AsrootState } from "./state.js";
/**
 * Return a valid sudo password, prompting when the cache is cold/expired.
 * Throws on cancel, wrong password, or non-TUI mode.
 */
export declare function ensurePassword(ctx: ExtensionContext, st: AsrootState, command: string): Promise<string>;