fix(core): stop scanning git args after first subcommand

codex-rs/core/src/command_safety/is_dangerous_command.rs

@@ -90,6 +90,11 @@ pub(crate) fn find_git_subcommand<'a>(
         if subcommands.contains(&arg) {
             return Some((idx, arg));
         }
+
+        // In git, the first non-option token is the subcommand. If it isn't
+        // one of the subcommands we're looking for, we must stop scanning to
+        // avoid misclassifying later positional args (e.g., branch names).
+        return None;
     }
 
     None
@@ -231,6 +236,15 @@ mod tests {
         ])));
     }
 
+    #[test]
+    fn git_checkout_reset_is_not_dangerous() {
+        // The first non-option token is "checkout", so later positional args
+        // like branch names must not be treated as subcommands.
+        assert!(!command_might_be_dangerous(&vec_str(&[
+            "git", "checkout", "reset",
+        ])));
+    }
+
     #[test]
     fn rm_rf_is_dangerous() {
         assert!(command_might_be_dangerous(&vec_str(&["rm", "-rf", "/"])));

codex-rs/core/src/command_safety/is_safe_command.rs

@@ -311,6 +311,15 @@ mod tests {
         );
     }
 
+    #[test]
+    fn git_first_positional_is_the_subcommand() {
+        // In git, the first non-option token is the subcommand. Later positional
+        // args (like branch names) must not be treated as subcommands.
+        assert!(!is_known_safe_command(&vec_str(&[
+            "git", "checkout", "status",
+        ])));
+    }
+
     #[test]
     fn zsh_lc_safe_command_sequence() {
         assert!(is_known_safe_command(&vec_str(&["zsh", "-lc", "ls"])));