Function validate_windows_cmd_interpolation_arg

src/mcp/mcp.c:9492–9498

These characters retain command-language meaning inside quoted cmd.exe * arguments: percent expands environment variables, exclamation can expand * delayed variables, and caret changes parsing. Never interpolate them from a * stored project root or request branch into the Windows detect_changes payload. * /V:OFF is defense in depth for exclamation; validation remains the boundary. */

 * stored project root or request branch into the Windows detect_changes payload.
 * /V:OFF is defense in depth for exclamation; validation remains the boundary. */
static bool validate_windows_cmd_interpolation_arg(const char *s) {
#ifdef _WIN32
    return s && strpbrk(s, "%!^") == NULL;
#else
    return s != NULL;
#endif
}

static bool validate_search_args(const char *root_path, const char *file_pattern) {
    if (!validate_search_path_arg(root_path)) {