import type { BashContext } from '../types';
import { CommandScanner } from '../command-scan';
export declare class RecoveryAllowlist {
    private readonly scanner;
    private readonly shell;
    constructor(scanner: CommandScanner);
    /**
     * Is EVERY segment of this command one that gets you out, or tells you where you are?
     *
     * An empty command is `false` — nothing to be sure about, and the default here is deny. (Note this
     * is one of the three places the two Bash guards genuinely differ; the stale-main blocklist allows
     * the empty command because its default is the other way round.)
     */
    isFullyRecovery(ctx: BashContext): boolean;
    private isRecoverySegment;
    /**
     * `gh` GENERALLY — it talks to GitHub, not to the working tree.
     *
     * This used to be an allowlist of read-only actions (`gh pr view|list|status|checks`, `gh run
     * view`), which fell over the moment an agent needed `gh pr close`, `gh pr comment` or `gh api`
     * from a parked session: those change something on GitHub and NOTHING in this tree, so the branch
     * state cannot be an argument against them. The exclusions are therefore the `gh` subcommands that
     * write LOCAL files — a clone, a checkout, a download — plus any segment carrying a `> file`
     * redirect.
     *
     * gh commands that are wrong for OTHER reasons stay wrong: `gh pr create`/`push` is governed by
     * pr-creation-or-push-guard and `gh pr merge` by pr-merge-guard. Those are separate policies and
     * this list was never what enforced them.
     *
     * YES, THIS ONE SUBLIST IS A BLOCKLIST, and that is the opposite polarity to the guard around it.
     * The argument against a blocklist elsewhere is that the hazardous set is UNBOUNDED — any program
     * can write a file as a side effect of doing something else, so no enumeration could ever be
     * complete. `gh`'s surface is not: it is one vendor's CLI, its verbs are documented, and writing
     * into the working tree is the rare exception rather than the ambient default. A new `gh`
     * subcommand that clones or downloads is a known, greppable maintenance point — `GH_LOCAL_FILE_WRITES`
     * — where "every future program that might write" is not.
     */
    private isGh;
    /**
     * `curl` / `wget` — a network fetch reads a URL, not this repo.
     *
     * Excluded: the forms that name a local FILE to write (`curl -o`, `curl -O`, `wget -O`, an
     * `--output-dir`/`-P`, or a `> file` redirect), because those are how a fetch becomes a write into
     * the tree. A bare `wget <url>` still drops its download into the cwd; that CREATES an untracked
     * file rather than modifying tracked content, which is the line this list draws everywhere else.
     */
    private isNetworkClient;
    private isPackageRecovery;
}