import type { ToolPermissionCheckInput } from "../../runtime/ports/permission-contracts.js";
/**
 * 确定性操作归类。注意两个危险信号是分工的、互不包含:
 * - `isDestructive`:shell 破坏性操作(rm -rf、dd、管道下载执行等)+ 递归删除 → 下游走"无条件保底必弹"。
 * - `isDelete`:任意删除(含 meta 标注的删除工具)→ 下游单独走"该文件是否有用"的语义复核,不并入 isDestructive。
 * 消费方(决策流水线)分别独立检查 isDestructive 与 isDelete。
 */
export interface OperationClassification {
    targetPaths: string[];
    inWorkspace: boolean;
    crossWorkspace: boolean;
    isDelete: boolean;
    isRecursiveDelete: boolean;
    isEgress: boolean;
    egressCarriesData: boolean;
    isDestructive: boolean;
    /**
     * Shell command performs network egress (curl/wget/nc/scp/...). Used to gate
     * untrusted community-skill shell commands (which would otherwise bypass the
     * web_fetch/web_search deny via raw shell). Best-effort detection; the OS sandbox
     * (netPolicy=deny on community turns) is the robust second layer on POSIX.
     */
    commandNetworkEgress: boolean;
}
export interface ClassifyContext {
    workspaceRoot: string;
}
/**
 * Canonical set of shell-command tool names. This is the single source of truth,
 * imported and used by BOTH `classifyOperation` (below) AND hook-runner's bash
 * pre-filter, so the two stay aligned. Includes the `Bash` case-variant.
 */
export declare const SHELL_TOOL_NAMES: Set<string>;
export declare function isWithinWorkspace(resolved: string, root: string): boolean;
/**
 * 提取 shell 命令引用的路径(重定向目标 + Unix/Windows/相对路径),解析为绝对路径。
 * 移植自 exec validateCommand;win32 下把 /c/Users → C:\Users;跳过单字母 flag(/c /s …);
 * /dev/null 不计入(由绝对底线另处理)。供 classifyOperation 与 exec validateCommand 共用(单一源)。
 * 扫描层用聚焦 shell tokenizer(替代正则):正确处理带空格的引号路径、管道/&& 后的路径、
 * 以及单/双引号内的字面 `>`(不当作重定向)。push() 的过滤/解析逻辑保持不变。
 */
export declare function extractCommandPaths(command: string, root: string): string[];
export declare function classifyOperation(input: ToolPermissionCheckInput, ctx: ClassifyContext): OperationClassification;
