/**
 * Command risk classification engine.
 *
 * Classifies shell commands into HIGH / MEDIUM / LOW risk tiers.
 * Used by the autonomy mode enforcement to block or warn about
 * dangerous commands depending on the configured security posture.
 *
 * Inspired by ZeroClaw's `src/safety/policy.rs` and IronClaw's
 * `src/safety/validator.rs`.
 */
import { type ScanResult } from "./pre-exec-scanner.js";
export type RiskLevel = "high" | "medium" | "low";
export type AutonomyMode = "readonly" | "supervised" | "full";
export interface RiskAssessment {
    /** Overall risk level (highest across all sub-commands). */
    level: RiskLevel;
    /** The specific sub-command that triggered the highest risk. */
    trigger: string;
    /** Human-readable reason for the classification. */
    reason: string;
    /** Whether shell injection was detected. */
    injectionDetected: boolean;
    /** Pre-execution scan result (Tirith-inspired deep scan). */
    preExecScan?: ScanResult;
}
/**
 * Classify a shell command string into a risk level.
 *
 * The command is tokenized into sub-commands (respecting quotes), and
 * each sub-command is independently classified.  The overall risk is
 * the highest risk found across all sub-commands.
 */
export declare function classifyCommandRisk(command: string): RiskAssessment;
export interface AutonomyDecision {
    allowed: boolean;
    reason: string;
    risk: RiskAssessment;
}
/**
 * Decide whether a command should be allowed under the given autonomy mode.
 *
 * - `readonly`:    Only LOW risk commands allowed.
 * - `supervised`:  LOW always allowed.  MEDIUM/HIGH require explicit approval (returns allowed=false with reason).
 * - `full`:        Everything allowed (risk still reported for logging).
 */
export declare function enforceAutonomy(command: string, mode: AutonomyMode): AutonomyDecision;
