/**
 * Bash risk classifier — single shared truth source for command-level risk.
 *
 * Background — issue #2 (private):
 *   Three independent bash heuristics existed today and could drift:
 *     - src/native/tui/permission.ts::detectDestructiveCommand (TUI warning)
 *     - src/runtime/tools.ts::isDangerousBash (legacy runtime)
 *     - src/native/headless-approval.ts (treated ALL bash as unsafe)
 *   None shared a contract. Updating one without the others meant the
 *   interactive UI could call a command "destructive", the headless path
 *   could call it "needs approval", and the legacy runtime could call it
 *   "fine" — pick a surface, get a different policy.
 *
 *   This module replaces the three heuristics with one structured
 *   classifier. Each surface now consults the same function and surfaces
 *   the same level + reasons + side-effect flags.
 *
 * Design rules:
 *   - Deterministic: no I/O, no clock, no env. Same input → same output.
 *   - Structured: returns `{ level, reasons, mutatesFilesystem, ... }`,
 *     never just a boolean.
 *   - Fail-closed: anything we don't recognize returns `unknown`. Headless
 *     and approval surfaces MUST treat `unknown` as needs-approval (or
 *     deny when no approval channel exists). The classifier itself never
 *     guesses optimistically.
 *   - Compound-aware: `cmd1 && cmd2 | cmd3` is decomposed into chunks
 *     and the worst-risk chunk wins. A safe `ls` chained to a dangerous
 *     `rm -rf` classifies as dangerous.
 *   - Redirection-aware: `cmd > /tmp/x` is at least `needs_approval` for
 *     the redirect even when the underlying `cmd` is safe.
 *
 * Non-goals:
 *   - This is NOT a sandbox. It does not block execution; it produces a
 *     decision for the caller. Headless mode enforces the deny; the TUI
 *     uses the level for warning copy + border color.
 *   - This is NOT a full shell parser. We split on a small set of
 *     control operators and read the leading token of each chunk. A
 *     hand-crafted obfuscation (deep $(...) nesting, eval, base64 + sh)
 *     can hide the real intent — those land in `unknown` and get denied
 *     by the fail-closed default in headless.
 */
export type BashRiskLevel = 'safe_readonly' | 'needs_approval' | 'dangerous' | 'unknown';
export interface BashRiskClassification {
    /** Worst level across all decomposed chunks. */
    level: BashRiskLevel;
    /** Human-readable reasons, one per matched chunk/pattern. */
    reasons: string[];
    /** Whether any chunk mutates the filesystem (write/edit/delete/redirect). */
    mutatesFilesystem: boolean;
    /** Whether any chunk reaches the network. */
    touchesNetwork: boolean;
    /** Original input, normalized. */
    command: string;
}
/**
 * Public entry point. Classify a single bash command string.
 *
 * Returns a `BashRiskClassification`. Empty / non-string inputs return
 * `unknown` so callers don't have to special-case them.
 */
export declare function classifyBashCommand(command: unknown): BashRiskClassification;
/**
 * Convenience boolean for legacy bridge call sites that only need to know
 * "should we ask first?". Treats `unknown` and `dangerous` and
 * `needs_approval` as true (i.e. ask). Safe-read returns false.
 *
 * Don't use this in new code — prefer the structured `classifyBashCommand`
 * so callers can render real reasons. This exists so the legacy
 * `runtime/tools.ts::isDangerousBash` and the TUI's
 * `detectDestructiveCommand` can collapse to the shared truth source
 * without changing their public signature.
 */
export declare function isUnsafeBashCommand(command: unknown): boolean;
