/**
 * Danger classifier for a single shell action's argv (PHNX-3442, producer side).
 *
 * Safety-sensitive: the schema-2 `BashAction.danger` drives the console's
 * destructive-operation surfacing and risk scoring. So this is CONSERVATIVE by
 * construction — it defaults to `normal` and only escalates on CLEAR structural
 * evidence in the tokenized argv, never on a substring of raw command text. The
 * argv it reads is one tokenizeBash segment (see `tokenizeBash` in
 * `session/bash-command.ts`): the executable at argv[0] and its already-split
 * arguments, so a flag like `-rf` is a whole token, not a substring hunt.
 *
 * The three levels mirror the shipped consumer union (`BashDanger`):
 *   - DESTRUCTIVE            — irrecoverable data loss / history rewrite / force
 *                              overwrite of an important path. Requires a WHERE-less
 *                              DELETE, a recursive/force delete, a hard reset, etc.
 *   - potentially-destructive — plain `rm`, soft/mixed `git reset`, `mv` over a
 *                              path, plain `kill` — recoverable-ish but worth a flag.
 *   - normal                 — everything else.
 *
 * `destructiveOperation` is a short stable label (never raw text) naming WHY the
 * action was flagged, so the console can group by operation without re-parsing.
 */
import type { BashDanger } from './schema2.js';
export interface DangerVerdict {
    danger: BashDanger;
    /** Short stable label naming the operation, e.g. `recursive-delete`. Omitted for `normal`. */
    destructiveOperation?: string;
}
/**
 * Classify one tokenized shell action. `argvComplete` is false when a dynamic node
 * (command substitution / glob / var expansion) kept the argv incomplete; when a
 * DESTRUCTIVE signal depends on a token that could have been mangled by expansion
 * we DO still flag it (a `rm -rf $DIR` is destructive regardless of what `$DIR`
 * expands to), because the operation itself is the danger, not its target.
 */
export declare function classifyActionDanger(argv: string[], _argvComplete?: boolean): DangerVerdict;
