//! Structured fuzz over the git-over-SSH command grammar.
//!
//! Row 4 of `astra-soak-overview`: this is the pre-auth surface on
//! `ssh.makenot.work` and on the sshd `command=` door, and the failure cost
//! named there is a remote crash or an auth bypass. It is the second soak target
//! after `subst-substitute`, and the first one whose boundary is reached before
//! the caller knows who is asking.
//!
//! `git_command::parse` is the whole surface. One call runs verb dispatch,
//! whitespace and quote stripping, the owner/repo split, the traversal test and
//! the segment whitelist, so there is nothing private left to reach.
//!
//! ## The oracle lives in the crate, not here
//!
//! Everything asserted is `git_command::oracle::check_line`. That is deliberate:
//! the committed regression replay in `tests/regressions.rs` calls the same
//! function on stable, so a crash found here becomes a unit test by copying one
//! file, and neither side can drift into checking less than the other.
//!
//! What it asserts, in short: an accepted request has two valid segments, its
//! `repo_dir` adds exactly two normal components to the root it is given, and
//! its `git-shell` argument round-trips through the parser as one quoted word.
//! The last is the injection oracle — a name that could break out of the quotes
//! would come back as a different request, or not parse at all.
//!
//! Not-panicking is the weakest thing a fuzz target can assert, and a target
//! that asserts only that reports clean forever while handing `git-shell` a
//! second argument.

#![no_main]

use libfuzzer_sys::fuzz_target;

fuzz_target!(|line: &str| {
    git_command::oracle::check_line(line);
});