pub fn allowlist_gate(command: &str) -> Option<i32>Expand description
Shared allowlist gate for the CLI shell entrypoints — -c (via exec) and
-t (via exec_argv). Both must apply the SAME boundary so the track path
(the default shell hook) cannot be weaker than the compress path.
Returns Some(126) when the command is blocked and the caller must return
that exit code; None when execution may proceed (allowed, or warn-only for
an interactive human — see allowlist_must_enforce).
Also the gate of the CLI pass-through path (lean-ctx -c / -t under an
inherited LEAN_CTX_WRAPPED or LEAN_CTX_DISABLED), which skips
compression but must never skip this boundary (GH #2004).