Global flags before the subcommand cause CmdSpec matching to fail. E.g. git -C /path log doesn't match the allowed git log pattern because CmdSpec checks toks[:len(name)] which sees ('git', '-C') instead of ('git', 'log').
Repro: bash('git -C /path log -5 --oneline') → DisallowedCmd
This affects any tool with global flags (git, docker, kubectl, etc).
Global flags before the subcommand cause CmdSpec matching to fail. E.g.
git -C /path logdoesn't match the allowedgit logpattern because CmdSpec checkstoks[:len(name)]which sees('git', '-C')instead of('git', 'log').Repro:
bash('git -C /path log -5 --oneline')→DisallowedCmdThis affects any tool with global flags (git, docker, kubectl, etc).