You'll notice
The worktree git guard now parses complex shell commands instead of refusing them all, only refusing what it cannot verify.
The worktree git-isolation guard, which blocks git commands from escaping an isolated worktree, no longer refuses every non-simple shell command outright. It now parses complex commands (subshells, pipes, etc.) into an AST and only refuses when the command is unparseable, contains an error node, or a regex flags the git invocation as too complex to verify; otherwise it walks the parsed tree looking for actual worktree-escaping redirection.