/**
 * Restricted shell hook — wires RestrictedShellEnforcer into tool.execute.before
 * to block disallowed commands for the current agent.
 *
 * Since tool.execute.before doesn't receive the agent name, we maintain
 * a lightweight sessionID → agent mapping populated from chat.message.
 */
import type { Logger, PluginConfig } from '../types';
export interface RestrictedShellHooks {
    /** Call from chat.message to record session→agent mapping. */
    trackAgent: (input: {
        sessionID: string;
        agent?: string;
    }) => void;
    /** Call from tool.execute.before for bash tool commands. */
    toolBefore: (input: {
        tool: string;
        sessionID: string;
        callID: string;
    }, output: {
        args: unknown;
    }) => void;
}
export declare function createRestrictedShellHooks(logger: Logger, config: PluginConfig): RestrictedShellHooks;
//# sourceMappingURL=restricted-shell.d.ts.map