pub fn assert_single_statement_for(
shell: ShellKind,
command: &str,
allow_shell_probe: bool,
) -> Result<()>Expand description
Validate that command is a single top-level bash statement.
allow_shell_probe controls the tree-sitter-error fallback: when the
embedded grammar flags an error, we can ask the real bash -n -c whether
the syntax is actually valid (the grammar lags real bash). That spawns a
shell on the request path, so it’s gated to trusted (wcgw) mode only — in
restricted modes (code_writer/architect) we must not spawn bash to
vet a command, so tree-sitter’s verdict is final there.
Shell-aware single-statement check: PowerShell has its own separators and
no bash grammar, so it gets a conservative scanner instead of the parser.