import { CommandScanner } from '../command-scan';
/** Which shell construct was found inside an inline commit message. */
export type MessageHazardKind = 'backtick' | 'command-substitution' | 'newline';
/**
 * One hazard found in one inline `-m` message: the flag that carried it, what it is, and the text
 * around it. Data-only → a class, per CLAUDE.md.
 *
 * `excerpt` is a short window around the hit rather than the whole message: the refusal is read
 * mid-task, and a 40-line commit message pasted back at the agent buries the one thing it must see.
 */
export declare class MessageHazard {
    readonly flag: string;
    readonly kind: MessageHazardKind;
    readonly excerpt: string;
    constructor(flag: string, kind: MessageHazardKind, excerpt: string);
}
/**
 * Finds a commit message passed INLINE (`-m` / `--message` / `-am`) whose text carries a shell
 * construct the shell will expand before git ever sees it.
 *
 * Split out from the guard for the same reason `WholeRepoBuildScan` is: WHAT counts as a hit is a
 * tokenizer question with its own tests, while the guard owns the verdict, the log line and the words
 * of the refusal.
 */
export declare class CommitMessageSubstitutionScan {
    private readonly scanner;
    constructor(scanner: CommandScanner);
    /**
     * The first hazard anywhere in the command, or null.
     *
     * `command` is the RAW command — see the guard's docstring for why `commandCode` cannot be used.
     */
    firstHit(command: string): MessageHazard | null;
    private hazardInArgs;
    /** The message carried IN the flag token itself (`-mfix`, `--message=fix`), or null. */
    private attachedMessage;
    /** True when the flag's message is the FOLLOWING token (`-m msg`, `-am msg`, `--message msg`). */
    private takesFollowingMessage;
    /** The EARLIEST hazard in this text, so the excerpt points at what the shell hits first. */
    private hazardIn;
    private excerpt;
}