export declare function resolveToolPath(input: string, cwd: string): string;
/**
 * Enforce absolute, mode-independent floors. Workspace membership belongs to
 * the permission pipeline; this helper only blocks device/system paths that no
 * permission mode should allow through local file/media tooling.
 */
export declare function enforceAbsoluteFloors(resolved: string): string | null;
