/**
 * Obfuscated command detection guard — EE.1 (Sprint EE, Part IX).
 *
 * Detects shell commands that use common obfuscation patterns before they reach
 * the approval gate or execution layer. When detected, the caller should escalate
 * the command to require explicit user approval regardless of autonomy level.
 *
 * Patterns detected:
 *   - base64-piped-to-bash (echo <b64> | base64 -d | bash)
 *   - dynamic code eval via atob / Buffer.from
 *   - hex-escaped subshell substitutions
 *   - suspiciously long bash -c strings (>50 chars in the -c argument)
 *
 * @module
 */
export interface ObfuscationCheckResult {
    obfuscated: boolean;
    /** Which pattern matched (first match index, for diagnostics). */
    matchedPatternIndex?: number;
}
/**
 * Check whether a shell command string matches known obfuscation patterns.
 *
 * Returns { obfuscated: true } when the command looks suspicious.
 * Returns { obfuscated: false } for all other commands.
 */
export declare function checkForObfuscation(command: string): ObfuscationCheckResult;
/**
 * Extract the command string from a tool's params object.
 * Handles both { command: string } and { cmd: string } shapes.
 */
export declare function extractCommandFromParams(params: unknown): string | undefined;
