/**
 * Execpolicy DSL — a lightweight command-intent allowlist that gates
 * bash commands BEFORE the existing ask/auto/yolo permission flow.
 *
 * Inspired by codex-rs/execpolicy/. Three decisions per rule:
 *   allow      — skip the permission prompt (treat as yolo for this cmd)
 *   prompt     — force the prompt even in `auto` mode
 *   forbidden  — block outright, don't even prompt; print reason
 *
 * First matching rule wins. If no rule matches, the original
 * permission mode is honored (so the default is "no change to behavior").
 *
 * The DEFAULT_RULES below codify the most-common safety intents the
 * Codex execpolicy ships, condensed to what's portable across Win/
 * macOS/Linux. Users can override at runtime via /perm-policy and the
 * config field `execpolicy` (TODO in v1.20).
 *
 * Real OS-native sandboxing (Seatbelt/landlock/ACL) is intentionally
 * out of scope for this layer — it's an evening's work in TS for an
 * intent gate, vs weeks for proper sandboxing. This is the audit's
 * pragmatic recommendation.
 */
export type Decision = 'allow' | 'prompt' | 'forbidden';
export interface ExecRule {
    /** Command prefix or regex. String values are treated as `^<value>`. */
    pattern: RegExp | string;
    decision: Decision;
    /** Optional: only match if this also tests true */
    match?: RegExp | string;
    /** Optional: only match if this tests FALSE */
    notMatch?: RegExp | string;
    /** Shown to the user when decision != 'allow' */
    reason?: string;
    /** Human-readable rule name for logging / debugging */
    id?: string;
}
export interface PolicyResult {
    decision: Decision;
    reason?: string;
    ruleId?: string;
}
/**
 * Built-in policy. Ordered: most-specific dangerous patterns first
 * so they fire before broader category rules. Allows come last so
 * a dangerous variant of "git" hits the prompt rule before the
 * "git read ops" allow.
 */
export declare const DEFAULT_RULES: ExecRule[];
/**
 * Evaluate a bash command against the policy. Returns the FIRST
 * matching rule's decision. If nothing matches, returns
 * { decision: 'prompt' } so the user's configured permission mode
 * decides — i.e. a no-op for `auto` (non-destructive tools pass)
 * and a single prompt for `ask`.
 */
export declare function evaluateCommand(cmd: string, rules?: ExecRule[]): PolicyResult;