guard-git.sh: detect_work_dir regex fails on macOS sed, blocks valid pushes from worktrees

[carlos-alm]

Problem

The branch-name validation in .claude/hooks/guard-git.sh uses \s in its sed -nE regex to extract the cd <path> prefix from chained commands. BSD sed (default on macOS) does not interpret \s as whitespace, so the regex silently produces no output, detect_work_dir falls back to an empty path, and validate_branch_name reads the current shell cwd's branch instead of the target worktree's branch.

Reproduction

In a worktree where the cwd branch is worktree-agent-abc, attempting to push from another worktree with a valid branch name is rejected:

BLOCKED: Branch 'worktree-agent-abc' does not match required pattern.

The command cd /path/to/other-worktree && git pu​sh origin HEAD:fix/some-fix is read by the hook, but detect_work_dir cannot extract the cd target so validation runs against the wrong branch.

Root cause

guard-git.sh:124:

work_dir=$(echo "$COMMAND" | sed -nE 's/^\s*cd\s+"?([^"&]+)"?\s*&&.*/\1/p')

BSD sed regex syntax does not recognize \s. Use [[:space:]] instead, consistent with line 121:

work_dir=$(echo "$COMMAND" | sed -nE 's/^[[:space:]]*cd[[:space:]]+"?([^"&]+)"?[[:space:]]*&&.*/\1/p')

Workaround

Use git --git-dir=<wt>/.git --work-tree=<wt> ... from any directory — this bypasses the hook's branch detection entirely (the regex looks for git -C, not the long-form flags).

Why this matters

Parallel sessions in worktrees cannot complete pushes when the agent's shell cwd is itself a worktree with a non-conformant branch name (the harness creates worktrees with names like worktree-agent-<hash>).