The worker guard's bulk-staging block lowercased the command before matching
`*git add -a*`, which could match `-a` + `-u` clusters or (more subtly) any
text starting with `-a` after `git add `. Legitimate selective patterns like
`git add -u` (update-only) happened to slip past only because `-u` doesn't
contain `-a`, but the intent was already murky.
Split the patterns:
- commit/push/--all/. match against the lowercased command (subcommand
names can reasonably be case-insensitive in alias contexts)
- `-A` is checked against the raw command, so only the uppercase bulk flag
trips the block
Adds four regression tests: `-A` still blocks, `--all` still blocks,
selective `-u` is allowed, filenames containing `-a` are allowed.
Embedded hook copy resynced via `make sync-hooks`.
https://claude.ai/code/session_01TZeRkm97SrPchDwPsD41rd
Claude
767de4e12c