@spec allowed_shell(String.t()) ::
  {:ok, String.t()} | {:error, {:disallowed_shell, String.t()}}

Valida que el shell este en la lista de shells permitidos.

@spec allowed_shells() :: [String.t()]

Returns la lista de nombres de shells permitidos.

@spec dangerous_commands() :: [String.t()]

Returns la lista de patrones de comandos peligrosos bloqueados por safe_command/1.

@spec max_length(String.t(), pos_integer()) ::
  {:ok, String.t()} | {:error, :command_too_long}

Valida que un comando no exceda la longitud maxima permitida.

@spec no_injection(String.t()) :: {:ok, String.t()} | {:error, :possible_injection}

Valida que un comando no contenga patrones de inyeccion de shell.

Verifica vectores de inyeccion comunes: $(...), backticks, y null bytes.

@spec not_empty(String.t()) :: {:ok, String.t()} | {:error, :empty_command}

Valida que una cadena de comando no este vacia.

@spec safe_command(String.t()) ::
  {:ok, String.t()} | {:error, {:dangerous_command, String.t()}}

Valida que un comando no coincida con ningun patron peligroso conocido.

Honours Config.get(:sudo_allowlist, []) for granular sudo exemptions. When the dangerous match is the "sudo " pattern, the part of the command after "sudo " is checked against the allowlist (list of prefixes). If it starts with any allowlisted prefix, the command is accepted even though it contains "sudo ". Other dangerous patterns (rm -rf, dd if=, etc.) are never overridable.

@spec valid_retry_count(non_neg_integer()) ::
  {:ok, non_neg_integer()} | {:error, :invalid_retry_count}

Validates that a retry count is non-negative and within limits.

@spec valid_timeout(pos_integer()) ::
  {:ok, pos_integer()} | {:error, :invalid_timeout}

Validates that a timeout value is positive and within reasonable limits.

@spec validate_env_name(String.t()) :: {:ok, String.t()} | {:error, :invalid_env_name}

Valida el nombre de una variable de entorno.

@spec validate_path(String.t()) ::
  {:ok, String.t()} | {:error, :path_contains_dangerous_pattern}

Validates that a string does not contain dangerous path patterns.

@spec validate_url(String.t()) :: {:ok, String.t()} | {:error, :invalid_url}

Valida una cadena URL.