Two forks per path (`git ls-files --error-unmatch`, `grep -qiE <<<`) made
the gate a 5 s step on a 2053-file repo. The tracked set now comes from a
single `git ls-files -z -- "$@"` and the extension match is bash's own
`=~` on the lower-cased path (same case-insensitive semantics as `grep -i`).
0.2 s on the same tree; verdicts unchanged (blocked / allowlisted /
untracked-ignored checked on a throwaway repo).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016P4KZw1E2sXJjYqfcZWf1x
Every repo should give the same answer to "may this file be committed?",
and until now only testsAndMisc had a checker. signal-bot is public, had
three binary SQLite files in its history before anyone noticed, and
holds a private message database one `git add -f` away from the same
fate -- so .gitignore is evidently not the whole defence.
Two changes from the testsAndMisc original: sqlite3-wal and sqlite3-shm
are blocked by name, because a live SQLite database is three files and
blocking only the first blocks nothing useful; and the error message no
longer names a testsAndMisc-specific directory to move things to.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom
