/**
 * AI reviewer for /approval auto mode: commands whose shape the rule table
 * cannot classify are judged by the subagent-configured model with compact
 * context (latest user message, recent model output, the pending tool call)
 * instead of paging the human.
 *
 * Injection hardening: everything inside the marked data regions is review
 * MATERIAL, never instructions — the system prompt says so, and material that
 * tries to instruct is treated as an injection attempt and rejected. The
 * caller also enforces its own floor: `high` risk or `authorization` other
 * than `yes` is never approved, whatever the model claims.
 */
export interface ReviewInput {
    userText: string;
    segments: string[];
    toolName: string;
    command: string;
    args?: string;
    reason?: string;
    sandboxMode?: string;
}
export interface ReviewVerdict {
    risk: 'low' | 'medium' | 'high';
    authorization: 'yes' | 'no' | 'unknown';
    approved: boolean;
    reason: string;
}
export type ReviewerLocale = 'zh' | 'en';
/** Default (zh) prompt; tests and callers that do not pass a locale use this. */
export declare const REVIEW_SYSTEM_PROMPT: string;
export declare function reviewSystemPrompt(locale?: ReviewerLocale): string;
/** Assemble the compact, fence-marked user message for the reviewer. */
export declare function buildReviewUserMessage(input: ReviewInput): string;
export declare function parseReviewOutput(text: string): ReviewVerdict | undefined;