export declare function isPathInside(basePath: string, candidatePath: string): boolean;
/**
 * Symlink-safe path containment check.
 *
 * Resolves symlinks via `fs.realpathSync` before checking that `candidatePath`
 * is inside `basePath`. Prevents workspace escape via symlinks pointing outside
 * the workspace root.
 *
 * Falls back to `path.resolve()` (no symlink resolution) if the path doesn't
 * exist yet — this allows creating new files inside the workspace.
 *
 * Inspired by PicoClaw v0.1.2 security patch (filepath.EvalSymlinks).
 */
export declare function isRealPathInside(basePath: string, candidatePath: string): boolean;
/**
 * Assert that a path stays within the workspace root after symlink resolution.
 * Throws if the path escapes.
 */
export declare function assertRealPathInWorkspace(filePath: string, workspaceRoot: string): void;
export declare function extensionUsesSkippedScannerPath(entry: string): boolean;
