fix: split comma-separated values for variadic flags

Previously, "Bash(git commit:*), Bash(git add:*)" was passed as a
single --allowed-tools= value. Now comma-separated strings are split
into multiple flags, properly handling tool patterns with spaces.

Author: johnlindquist

src/command-builder.ts

@@ -152,7 +152,17 @@ export function buildArgsFromFrontmatter(
     // String/number -> flag with value
     // Variadic flags need --flag=value syntax to not eat following args
     if (VARIADIC_FLAGS.has(key)) {
-      args.push(`${toFlag(key)}=${String(value)}`);
+      const strValue = String(value);
+      // Split comma-separated values for variadic flags
+      // Handle both "Read,Edit" and "Bash(git commit:*), Bash(git add:*)"
+      const parts = strValue.includes(', ')
+        ? strValue.split(', ')  // Split on ", " (comma + space)
+        : strValue.includes(',')
+          ? strValue.split(',')  // Split on just ","
+          : [strValue];          // No commas, single value
+      for (const part of parts) {
+        args.push(`${toFlag(key)}=${part.trim()}`);
+      }
     } else {
       args.push(toFlag(key), String(value));
     }

src/command.test.ts

@@ -78,9 +78,22 @@ describe("buildArgs", () => {
     ]);
   });
 
-  test("variadic allowed-tools comma-separated string works", () => {
+  test("variadic allowed-tools comma-separated string splits into multiple flags", () => {
     const result = buildArgs({ "allowed-tools": "Read,Edit,Bash" }, new Set());
-    expect(result).toEqual(["--allowed-tools=Read,Edit,Bash"]);
+    expect(result).toEqual([
+      "--allowed-tools=Read",
+      "--allowed-tools=Edit",
+      "--allowed-tools=Bash"
+    ]);
+  });
+
+  test("variadic allowed-tools comma-space-separated string splits correctly", () => {
+    // Handle tool patterns with spaces like Bash(git commit:*)
+    const result = buildArgs({ "allowed-tools": "Bash(git commit:*), Bash(git add:*)" }, new Set());
+    expect(result).toEqual([
+      "--allowed-tools=Bash(git commit:*)",
+      "--allowed-tools=Bash(git add:*)"
+    ]);
   });
 
   test("skips system keys (_inputs)", () => {

src/command.ts

@@ -216,7 +216,17 @@ export function buildArgs(
     // String/number → flag with value
     // Variadic flags need --flag=value syntax to not eat following args
     if (VARIADIC_FLAGS.has(key)) {
-      args.push(`${toFlag(key)}=${String(value)}`);
+      const strValue = String(value);
+      // Split comma-separated values for variadic flags
+      // Handle both "Read,Edit" and "Bash(git commit:*), Bash(git add:*)"
+      const parts = strValue.includes(', ')
+        ? strValue.split(', ')  // Split on ", " (comma + space)
+        : strValue.includes(',')
+          ? strValue.split(',')  // Split on just ","
+          : [strValue];          // No commas, single value
+      for (const part of parts) {
+        args.push(`${toFlag(key)}=${part.trim()}`);
+      }
     } else {
       args.push(toFlag(key), String(value));
     }