Function validate_bash_command

loom/src/hooks/validators/bash.rs:126–156

Validate a bash command for worktree isolation violations. # Arguments `command` - The bash command to validate `current_stage` - The current stage ID (used to allow access to own worktree) # Returns `ValidationResult::Allowed` if the command is safe `ValidationResult::Blocked(reason)` if the command violates isolation # Examples ``` use loom::hooks::validators::validate_bash_command; // Safe

(command: &str, current_stage: &str)

/// assert!(result.is_blocked());
/// ```
pub fn validate_bash_command(command: &str, current_stage: &str) -> ValidationResult {
    let stripped = strip_embedded_content(command);
    let command = &stripped; // Shadow command with stripped version for all checks

    // Check for git -C (directory override)
    if GIT_DASH_C_PATTERN.is_match(command) {
        return ValidationResult::Blocked(BlockedReason::GitDirectoryOverride);
    }

    // Check for git --work-tree (directory override)
    if GIT_WORK_TREE_PATTERN.is_match(command) {
        return ValidationResult::Blocked(BlockedReason::GitDirectoryOverride);
    }

    // Check for ../../ path traversal
    if PATH_TRAVERSAL_PATTERN.is_match(command) {
        return ValidationResult::Blocked(BlockedReason::PathTraversal);
    }

    // Check for .worktrees/ access (allow current stage only)
    if let Some(captures) = WORKTREES_ACCESS_PATTERN.captures(command) {
        let accessed_stage = captures.get(1).map(|m| m.as_str()).unwrap_or("");
        if accessed_stage != current_stage {
            return ValidationResult::Blocked(BlockedReason::CrossWorktreeAccess {
                target_stage: Some(accessed_stage.to_string()),
            });
        }
    }

    ValidationResult::Allowed
}

#[cfg(test)]
mod tests {