import type { SandboxPolicy } from '../types/enums.js';
/** True when `p` (resolved against `cwd`) lands outside the `cwd` subtree. */
export declare function pathEscapesCwd(p: string, cwd: string): boolean;
/**
 * Track `cd` segments in a chained command and return the effective cwd after
 * all `cd` invocations. Returns the original cwd when no `cd` is found.
 */
export declare function resolveEffectiveCwd(command: string, cwd: string): string;
/**
 * Scan a Bash command for a WRITE that targets a path outside `cwd`.
 * Catches:
 *   1. Classic mutating commands (rm, mv, cp, …) with absolute out-of-cwd paths
 *   2. `cd /outside && <write>` chains where the effective cwd shifts
 *   3. Interpreter subshells (`python -c`, `node -e`) with out-of-cwd absolute paths
 *   4. Download tools (`curl -o`, `wget -O`) targeting out-of-cwd paths
 */
export declare function bashWritesOutsideCwd(command: string, cwd: string): string | null;
type HookResult = {
    hookSpecificOutput?: {
        hookEventName: 'PreToolUse';
        permissionDecision: 'deny';
        permissionDecisionReason: string;
    };
};
/**
 * Evaluate confinement for `cwd-only` policy: writes inside cwd are allowed,
 * writes outside cwd are denied, reads are unrestricted.
 */
export declare function evaluateConfinement(toolName: string, toolInput: unknown, cwd: string): HookResult;
/**
 * Evaluate confinement for `read-only` policy: ALL write tools are denied
 * regardless of path. Reads are unrestricted.
 */
export declare function evaluateReadOnly(toolName: string, toolInput: unknown): HookResult;
/**
 * Build the `hooks.PreToolUse` entry for the given sandbox policy. Shape matches
 * the claude-agent-sdk `HookCallbackMatcher[]` registration.
 *
 * - `cwd-only`: confines writes to `cwd`, reads unrestricted. Needs the cwd, by definition.
 * - `read-only`: blocks all write tools regardless of path. Needs NO cwd — "no writes at all"
 *   is decidable without one, which is why `cwd` is optional here. The session used to install
 *   this hook only when a cwd was also present, so a read-only task without one ran with no
 *   write blocking whatsoever.
 */
export declare function buildConfinementHook(policy: SandboxPolicy, cwd?: string, 
/** Called once per refused tool call. This hook is the only place in the
 *  engine that observes a worker attempting to escape its sandbox, so it is
 *  also the only place that can count one for telemetry. */
onDeny?: (reason: string) => void): {
    PreToolUse: {
        hooks: ((input: {
            tool_name: string;
            tool_input: unknown;
        }) => Promise<HookResult>)[];
    }[];
};
export {};
//# sourceMappingURL=claude-cwd-confinement.d.ts.map