CmdSpec doesn't match commands with global flags (e.g. git -C) #9
Description
Global flags before the subcommand cause CmdSpec matching to fail. E.g. git -C /path log doesn't match the allowed git log pattern because CmdSpec checks toks[:len(name)] which sees ('git', '-C') instead of ('git', 'log').
Repro: bash('git -C /path log -5 --oneline') → DisallowedCmd
This affects any tool with global flags (git, docker, kubectl, etc).