import type { HookContext, HookDecision } from '../../hooks.js';
export declare const SENSITIVE_PATH_SIGNAL: RegExp;
export interface BashRestrictionHookOptions {
    getGrantManager?: () => (import('../grant-manager.js').GrantManager | undefined);
    disableInterpreterGuard?: boolean;
    forceInterpreterGuard?: boolean;
}
export declare function createBashRestrictionHook(opts: BashRestrictionHookOptions): (context: HookContext) => HookDecision;
export declare function builtinBashSensitiveRoots(): readonly string[];
export declare function deriveRestrictedSubstrings(grants: {
    resolveBase: string | undefined;
    readRoots: string[];
    writeRoots: string[];
}): string[];