/**
 * Environment variables that can safely appear as prefixes.
 * Ported from cc's SAFE_ENV_VARS.
 *
 * NEVER add:
 *   PATH, LD_PRELOAD, LD_LIBRARY_PATH, DYLD_*   (execution/library loading)
 *   PYTHONPATH, NODE_PATH, CLASSPATH, RUBYLIB     (module loading)
 *   GOFLAGS, RUSTFLAGS, NODE_OPTIONS              (code execution flags)
 *   HOME, TMPDIR, SHELL, BASH_ENV                 (system behavior)
 */
export declare const SAFE_ENV_VARS: Set<string>;
/**
 * Commands that execute their arguments — should not be treated
 * as "first word" for permission prefix matching.
 * Ported from cc's BARE_SHELL_PREFIXES.
 */
export declare const BARE_SHELL_PREFIXES: Set<string>;
/**
 * Strip safe env var prefixes and wrapper commands.
 * Ported from cc's `stripSafeWrappers()`.
 *
 * `NODE_ENV=test timeout 30 grep -r foo .` → `grep -r foo .`
 */
export declare function stripSafeWrappers(command: string): string;
/**
 * Aggressively strip ALL leading env vars (not just safe ones).
 * Used for deny-rule matching where the env prefix doesn't change
 * the dangerousness of the underlying command.
 * Ported from cc's `stripAllLeadingEnvVars()`.
 */
export declare function stripAllLeadingEnvVars(command: string, blocklist?: RegExp): string;
/**
 * Extract `<cmd> <subcommand>` prefix for rule matching.
 * E.g. `git commit -m "foo"` → `git commit`
 * Ported from cc's `getSimpleCommandPrefix()`.
 */
export declare function getSimpleCommandPrefix(command: string): string | null;
/**
 * Extract the first command word for prefix-based rule matching.
 * Ported from cc's `getFirstWordPrefix()`.
 */
export declare function getFirstWordPrefix(command: string): string | null;
/**
 * Strip argv-level wrapper commands.
 * Ported from cc's `stripWrappersFromArgv()`.
 */
export declare function stripWrappersFromArgv(argv: string[]): string[];
/**
 * Detect blocking sleep/wait patterns in commands.
 * Ported from cc's `detectBlockedSleepPattern()`.
 */
export declare function detectBlockedSleepPattern(command: string): string | null;
