[0x5t4l1n]

Summary

HostPattern::new documents that ** is only valid as a complete DNS label
(e.g. **.example.com for multi-label matching). However a label like
api**.example.com slipped through validation: the glob crate (v0.3)
silently accepted api** and treated it as a single-label wildcard, which
contradicts the documented semantics.

The existing test in host_matching_rejects_invalid_patterns asserts that
api**.example.com returns Err, but without an explicit guard the test
relied on an undocumented glob crate behaviour that could silently regress
on a crate version bump.

Change

Add a check before glob::Pattern::new that rejects any label whose text
contains ** as a substring (while still allowing the complete-label **
form):

if label.contains("**") {
    return Err(format!(
        "host pattern label {label:?} contains '**' as a substring; \
         '**' is only valid as a complete label (e.g. '**.example.com')"
    ));
}

This makes the already-present test assertion hold deterministically and
aligns the validator with its own documentation.

Test plan

• cargo test -p openshell-core host_matching_rejects_invalid_patterns — now passes reliably, not by accident
• cargo test -p openshell-core — no regressions in existing pattern tests

🤖 Generated with Claude Code

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @0x5t4l1n.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}