Validate tokens against cmd_name’s named flag policy declared
in a [command.handler_policy.KEY] block. Returns false if no
such policy is declared or the tokens fail it. Used by handlers
whose dispatch logic genuinely can’t move to TOML (e.g. gh’s
sub × action matrix) but whose per-policy WordSets should live
in TOML rather than as Rust WordSet constants.
Looks up the command in the runtime custom registry (project-local
.safe-chains.toml, then user-level ~/.config/safe-chains.toml).
A match here wins over the built-in hardcoded handlers, which is how
an override of gh takes effect.
Returns true iff this invocation is tagged eval-safe — meaning its
stdout is documented shell-init code that can safely be substituted
inside eval "$(...)".
Dispatch tokens against cmd_name’s [[command.matrix]]
blocks. Looks at tokens[1] (parent) and tokens[2] (action),
finds the first matrix whose parents contains the parent and
whose actions map contains the action, then validates
tokens[2..] against the named policy (and a guard flag if the
matrix entry declared one). Returns None if no matrix matched —
the handler can then fall through to its remaining special cases
or deny.
Look up cmd_name’s TOML-declared subs (set via [[command.sub]]
blocks alongside handler = "...") and dispatch the one whose name
matches tokens[1]. Returns None if no sub matched, so the
handler can fall through to its fallback grammar (or deny).