/**
 * @fileoverview Per-instance shared hook secret (COD-54).
 *
 * Claude Code hooks POST to `/api/hook-event` with no Basic-Auth credentials,
 * relying on a localhost bypass in `web/middleware/auth.ts`. That bypass is safe
 * for loopback-only deploys, but a `cloudflared --url http://127.0.0.1:port`
 * tunnel proxies internet traffic INTO the loopback origin, so tunneled requests
 * arrive with `req.ip === 127.0.0.1` and would otherwise pass the bypass and
 * drive respawn/Ralph signals unauthenticated.
 *
 * To close that hole WITHOUT breaking the loop's own (credential-less) hook
 * channel, every locally-generated hook command now presents a per-instance
 * shared secret in the `X-Codeman-Hook-Secret` header. The middleware requires
 * a matching secret for the bypass WHEN A TUNNEL IS RUNNING. Tunneled internet
 * traffic can't know the secret; local hooks (which we generate) do.
 *
 * Storage mirrors the VAPID-key pattern in `push-store.ts`: a small file under
 * the instance data dir (`dataPath('hook-secret')`), read-if-present /
 * generate-if-missing, stable across restarts. 256 bits of hex.
 */
/** HTTP header local hooks use to present the shared secret. */
export declare const HOOK_SECRET_HEADER = "X-Codeman-Hook-Secret";
/**
 * Return this instance's hook secret, generating and persisting it on first use.
 * Stable across restarts. Cached in-process after the first read.
 */
export declare function getHookSecret(): string;
//# sourceMappingURL=hook-secret.d.ts.map