fix(security): shell-quote Rust conventional-crate manifest path

The Rust mapper's conventional-crate discovery reads `crates/*` directly
via readdir and interpolated each directory name into
`cargo test --manifest-path <dir>/Cargo.toml` unquoted. Because the
validation pipeline runs commands through `spawn(_, { shell: true })`, a
crate directory literally named e.g. `$(id)` executed arbitrary commands —
the same command-injection class this PR closes for the Node/Nx/Turbo/
Elixir/Swift mappers, but this one filesystem-derived sink was missed.

Route the manifest path through `shellQuotePath`, matching every other
mapper. Ordinary crate names stay unquoted (no over-quoting); names with
shell metacharacters are quoted and escaped.

Adds an end-to-end regression test that builds a workspace containing a
`crates/$(id)-crate` directory and asserts the produced `--manifest-path`
command is shell-safe. The test fails against the prior code and passes
with the fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aaronjmars

src/cmd-injection-regression.test.ts

@@ -74,15 +74,9 @@ describe("validation pipeline shell-quotes filesystem-derived names (regression)
   it("turboCommand: malicious turbo --filter (package name or root) is shell-quoted", () => {
     for (const pm of ["pnpm", "yarn", "bun", "npm"] as const) {
       // package.json `name`
-      expect(
-        isShellSafe(turboCommand(pm, "test", "$(id)")),
-        `pm=${pm}`,
-      ).toBe(true);
+      expect(isShellSafe(turboCommand(pm, "test", "$(id)")), `pm=${pm}`).toBe(true);
       // root fallback `./${project.root}`
-      expect(
-        isShellSafe(turboCommand(pm, "test", "./packages/$(id)-pkg")),
-        `pm=${pm}`,
-      ).toBe(true);
+      expect(isShellSafe(turboCommand(pm, "test", "./packages/$(id)-pkg")), `pm=${pm}`).toBe(true);
     }
   });
 
@@ -140,4 +134,45 @@ describe("validation pipeline shell-quotes filesystem-derived names (regression)
       await rm(root, { recursive: true, force: true });
     }
   });
+
+  it("rust end-to-end: malicious conventional crate directory cannot inject into cargo --manifest-path", async () => {
+    const root = await mkdtemp(join(tmpdir(), "clawpatch-cmd-inj-rust-"));
+    try {
+      // A workspace with no declared members triggers conventional crate
+      // discovery, which reads `crates/*` straight off disk — so the directory
+      // name flows into `cargo test --manifest-path <dir>/Cargo.toml`.
+      await writeFile(join(root, "Cargo.toml"), '[workspace]\nresolver = "2"\n');
+      const maliciousCrate = join("crates", "$(id)-crate");
+      await mkdir(join(root, maliciousCrate, "src"), { recursive: true });
+      await writeFile(
+        join(root, maliciousCrate, "Cargo.toml"),
+        '[package]\nname = "evil"\nversion = "0.1.0"\nedition = "2021"\n',
+      );
+      await writeFile(join(root, maliciousCrate, "src", "lib.rs"), "pub fn evil() {}\n");
+      await mkdir(join(root, maliciousCrate, "tests"), { recursive: true });
+      await writeFile(join(root, maliciousCrate, "tests", "it.rs"), "#[test]\nfn it() {}\n");
+
+      const project = await detectProject(root);
+      const result = await mapFeatures(root, project, []);
+      const allCommands = result.features.flatMap((feature) =>
+        validationCommandsForFeature(feature, {
+          typecheck: null,
+          lint: null,
+          format: null,
+          test: null,
+        }),
+      );
+      // Guard against a silently-empty assertion: the malicious crate must
+      // actually produce the manifest-path command we're checking.
+      expect(
+        allCommands.some((c) => c.includes("--manifest-path")),
+        `expected a --manifest-path command, got: ${JSON.stringify(allCommands)}`,
+      ).toBe(true);
+      for (const c of allCommands) {
+        expect(isShellSafe(c), `unsafe command produced: ${c}`).toBe(true);
+      }
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
 });

src/mappers/rust.ts

@@ -1,6 +1,7 @@
 import { readFile, readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { pathExists } from "../fs.js";
+import { shellQuotePath } from "../shell.js";
 import {
   isSafeDirectory,
   isSafeFile,
@@ -89,7 +90,10 @@ async function rustMemberDirs(root: string): Promise<RustMemberDir[]> {
     for (const member of await conventionalCrateDirs(root, workspace.excluded)) {
       dirs.set(member, {
         dir: member,
-        testCommand: `cargo test --manifest-path ${member}/Cargo.toml`,
+        // `member` is a directory name discovered via readdir, so a crate dir
+        // literally named e.g. `$(id)` would inject under `spawn(_, {shell:true})`.
+        // Quote it like every other filesystem-derived validation-command fragment.
+        testCommand: `cargo test --manifest-path ${shellQuotePath(`${member}/Cargo.toml`)}`,
       });
     }
   }