pub fn reject_flag_like(program: &str, what: &str, value: &str) -> Result<()>Expand description
Injection guard for bare positional argv slots: a caller-supplied value with a
leading - would be parsed by the CLI as a flag (verified: git checkout -evil → “unknown switch”; jj likewise), and an empty (or whitespace-only)
value silently changes most commands’ meaning. Refuse both before anything
spawns, surfacing an Error::Spawn naming program. An interior NUL is
refused too (it can’t be passed in argv and otherwise surfaces as an opaque
OS spawn error). Flag-VALUE positions (-m <msg>, --branch <b>) don’t need
this — the CLI consumes the next token verbatim there.
The leading-- test is applied to the trimmed value, so a value like
" --upload-pack=…" (leading whitespace) is still refused — the empty-check
and the flag-check now agree on what “the value” is.