/**
 * Built-in patterns we always block. These are not user-configurable; they
 * represent paths where a key would conventionally live and that the agent
 * should never read.
 */
export declare const DEFAULT_PATH_PATTERNS: readonly string[];
export interface BlockDecision {
    blocked: boolean;
    /** The pattern that matched, useful for surfacing in the error to the agent. */
    matchedPattern?: string;
}
export interface BlockerOpts {
    /** Extra glob patterns to block, in addition to the built-ins. */
    extraPatterns?: readonly string[];
}
/**
 * Decide whether to block a path read. Both the resolved absolute path AND
 * the raw user-supplied path are checked, because attackers (or confused
 * agents) may pass paths with `..` or symlinks that resolve to a blocked
 * location while looking innocent.
 *
 * Note: this does NOT resolve symlinks itself. Symlink resolution is best
 * left to the caller (who has filesystem access). For sigil's hook context,
 * the agent already has filesystem access and would do the symlink read
 * before our hook fires; the meaningful protection is preventing direct
 * reads through obvious paths.
 */
export declare function isBlockedPath(path: string, opts?: BlockerOpts): BlockDecision;
//# sourceMappingURL=path-blocker.d.ts.map