/**
 * Bypass detector — T3 signal source.
 *
 * Rule.policy 자연어에서 "피해야 할 패턴" 을 추출하고, Write/Edit/Bash 도구
 * 출력에서 해당 패턴을 찾아 BypassEntry 후보로 반환한다.
 *
 * Heuristic priority (most explicit first):
 *   0) Parenthesized examples (e.g., "(rm -rf, DROP, force-push)") → tokens inside
 *   1) "use X not Y" / "use X instead of Y" / "X over Y" → bypass = Y
 *   2) "avoid X" / "don't use X" / "never use X" / "do not use X" → bypass = X
 *   3) Korean: "X 말라" / "X 금지" / "X 하지 않" → bypass = X
 *   4) 그 외: 빈 배열 (탐지 불가).
 *
 * Stop list filter: generic Korean verbs (실행/사용/선언/...) extracted by Korean
 * heuristic are removed — they cause massive FP (RC5/E9: matched the word "실행"
 * everywhere instead of "rm -rf"). 64 false-positive bypasses observed before fix.
 *
 * 반환된 패턴은 escape 된 정규식 문자열 — caller 가 `new RegExp(p)` 로 사용.
 */
import type { Rule } from '../../store/types.js';
export declare function extractBypassPatterns(rule: Rule): string[];
export interface BypassScanInput {
    rules: Rule[];
    tool_name: string;
    tool_output: string;
    session_id: string;
}
export interface BypassCandidate {
    rule_id: string;
    session_id: string;
    tool: string;
    pattern_preview: string;
    matched: string;
}
/**
 * Pure — rules + tool output 으로 bypass candidates 추출.
 * 같은 rule/pattern 이 여러 번 매칭돼도 한 번만 기록.
 */
export declare function scanForBypass(input: BypassScanInput): BypassCandidate[];