1 files changed, 99 insertions, 0 deletions
diff --git a/src/lib/config.clean-guard.source.sh b/src/lib/config.clean-guard.source.sh
new file mode 100644
index 0000000..785a1cd
--- /dev/null
+++ b/src/lib/config.clean-guard.source.sh
@@ -0,0 +1,99 @@
+# Destructive --clean path guard. Extracted from config.validate.source.sh
+# (task tr0) so the safety-critical "refuse to rm -rf a dangerous DIST_DIR"
+# policy lives in one isolated module with its own test surface, instead of
+# being buried among the generic config validators.
+#
+# This module owns the single source of truth for the dangerous-path blocklist
+# (the filesystem root, well-known system trees, HOME, and the current working
+# directory) plus the canonicalization needed to apply it safely. It is kept
+# separate because a regression here is catastrophic (it gates an unconditional
+# rm -rf), so the policy and its guard tests deserve a dedicated home.
+#
+# It still leans on the generic helpers in config.validate.source.sh
+# (require_config_var, config_error, validate_dist_dir); all libs are sourced
+# before any code runs, so those call sites resolve at runtime regardless of
+# module order.
+
+# Resolve DIST_DIR to a canonical absolute path so the --clean guard cannot be
+# bypassed via "." / trailing slashes / symlinks / relative paths. The directory
+# itself may not exist yet (cleaning a stale config), so when it is missing we
+# resolve its existing parent and append the basename. Output is printed; the
+# caller captures it. Returns non-zero only if even the parent cannot resolve.
+resolve_dist_dir_path() {
+    local -r target_dir="$1"; shift
+    local parent base
+
+    if [ -d "$target_dir" ]; then
+        ( cd "$target_dir" && pwd -P ) && return
+        return 1
+    fi
+
+    # DIST_DIR does not exist: canonicalize the deepest existing ancestor and
+    # re-attach the remaining path so symlinked parents are still resolved.
+    parent=$(existing_parent_dir "$target_dir")
+    base=${target_dir#"$parent"}
+    base=${base#/}
+    parent=$( cd "$parent" && pwd -P ) || return 1
+    if [ -n "$base" ]; then
+        printf '%s/%s\n' "$parent" "$base"
+    else
+        printf '%s\n' "$parent"
+    fi
+}
+
+# Guard for the destructive --clean action: refuse to "rm -rf" DIST_DIR when it
+# resolves to an empty value or a clearly dangerous location (filesystem root,
+# the user's HOME, the current working directory, or a well-known system tree).
+# This is the single place where the dangerous-path policy lives so it stays in
+# sync. NOTE (ln0): this only guards against deleting the wrong tree; leftover
+# staging artifacts are a separate concern handled by task ln0.
+validate_clean_dist_dir() {
+    local resolved home_resolved cwd_resolved
+    local -a forbidden=(
+        / /home /root /tmp /usr /etc /var /bin /sbin /lib /boot /opt
+    )
+    local entry
+
+    require_config_var DIST_DIR || return
+
+    # Reuse the shared DIST_DIR sanity checks (must be a directory, writable,
+    # parent writable) before applying the destructive-path policy.
+    validate_dist_dir || return
+
+    resolved=$(resolve_dist_dir_path "$DIST_DIR") || {
+        config_error "DIST_DIR $DIST_DIR could not be resolved"
+        return 1
+    }
+
+    if [ -z "$resolved" ]; then
+        config_error 'refusing to clean an empty DIST_DIR'
+        return 1
+    fi
+
+    # Reject the filesystem root and well-known system directories outright.
+    for entry in "${forbidden[@]}"; do
+        if [ "$resolved" = "$entry" ]; then
+            config_error \
+                "refusing to clean DIST_DIR $resolved (dangerous path)"
+            return 1
+        fi
+    done
+
+    # Reject HOME and the current working directory themselves (deleting either
+    # would be catastrophic and is never the intended DIST_DIR).
+    if [ -n "${HOME:-}" ]; then
+        home_resolved=$( cd "$HOME" 2>/dev/null && pwd -P ) || home_resolved=''
+        if [ -n "$home_resolved" ] && [ "$resolved" = "$home_resolved" ]; then
+            config_error \
+                "refusing to clean DIST_DIR $resolved (is HOME)"
+            return 1
+        fi
+    fi
+
+    cwd_resolved=$(pwd -P)
+    if [ "$resolved" = "$cwd_resolved" ]; then
+        config_error \
+            "refusing to clean DIST_DIR $resolved (is current directory)"
+        return 1
+    fi
+}