internal/

Package validate constrains the caller-supplied strings that devctl interpolates into filesystem paths, subprocess arguments and URLs.

Package versiongate is the check that precedes every devctl command but the version commands: an outdated devctl refuses to run until it is updated, or until DEVCTL_UNSAFE_FORCE_VERSION names the running version.