/**
 * The shared worker git policy (FR-7). ONE definition; Claude's PreToolUse hook and Codex's
 * launch guard both derive from it, so the two runners cannot drift.
 *
 * Why this exists: write routes used to run inside a throwaway git worktree, so the caller's
 * real `.git` sat OUTSIDE the worker's writable subtree and a misbehaving worker could only
 * damage a directory we were about to delete. Running in place puts the caller's real `.git`
 * inside that subtree, where `git reset --hard` or `git checkout .` destroys actual work.
 *
 * Workers lose nothing: the engine commits server-side, outside every sandbox, and no skill
 * instructs a worker to run git.
 *
 * Two independent rules, because they close two different holes:
 *   1. SUBCOMMAND allow-list — only four read-only subcommands may run.
 *   2. FLAG allow-list — even an allowed subcommand can be turned into arbitrary code
 *      execution (`git -c core.pager='sh -c …' log`, `git log --show-signature` invoking a
 *      configured `gpg.program`). Enumerating bad flags is unwinnable, so unknown flags deny.
 *
 * Both are DEFAULT-DENY. A subcommand or flag nobody has thought of — including ones added by
 * future git versions — is denied, not allowed by omission.
 */
type GitDecision = {
    allowed: true;
} | {
    allowed: false;
    reason: string;
};
/**
 * Decide a single `git …` invocation from its already-tokenized argv (excluding the leading
 * `git`). Exported for direct unit testing of both runners against one scenario matrix.
 */
export declare function evaluateGitArgv(argv: readonly string[]): GitDecision;
/**
 * Scan a (possibly chained) shell command for a git invocation and return the first denial.
 * Returns null when the command contains no git invocation, or every one is permitted.
 *
 * Resolves a COMMAND POSITION rather than searching for the word `git`: `echo "do not run git
 * reset --hard"` is prose, and a policy that denied it would make the rule impossible to
 * explain. That is why wrappers and shell `-c` payloads are handled by name instead of by
 * scanning every token.
 */
export declare function gitDenialInCommand(command: string): string | null;
/**
 * True when a path (relative or absolute) reaches into a `.git` directory.
 *
 * One test, not three: the regex's `(^|/)` and `(/|$)` anchors already cover the bare `.git`
 * and leading `.git/` cases the two extra clauses spelled out, and `.gitignore` is excluded by
 * all three alike. Extra clauses that cannot change an answer read as if they cover a case the
 * regex misses.
 */
export declare function pathTouchesGitDir(p: string): boolean;
export {};
//# sourceMappingURL=git-policy.d.ts.map