Repository navigation
Worktree-isolated sessions refuse compound and variable-path commands that cannot be shown not to be git #5673
Description
Problem
In worktree-isolated sessions, read-only shell commands are refused when the guard cannot prove
they are not git operations on another checkout. During the Building with Claude Sonnet 5.5
digest run (2026-09-29), six subagents reported refusals of compound commands and of commands
whose paths contain github (the ghq root is ~/repos/github.com/...). On 2026-09-30 the main
session saw the same shape: sed -n ... $F with F set to a scratchpad file was refused with
"this command runs sed with a value computed at runtime ... so what it runs cannot be shown not
to be git".
Each refusal costs a retry: rewrite as single commands, inline the literal path, or switch to
the Read tool.
What to find out
- Which layer issues each refusal: this repo's guardrails hooks or the Claude Code harness's
worktree isolation. The 2026-09-30 message names no plugin. - Whether the
github-path refusals are a false positive on the ghq path layout. - Whether this is by design (some may be), and if so, whether skill and agent briefs should tell
workers the accepted command shapes up front.
Done when
The source of each refusal class is identified and either fixed (if this repo's) or documented as
expected, with the accepted command shapes written where workers read them.
Related
Parent effort: linked from its tracking issue. Prior work on the same refusal family (all closed):
#4537, #1619, #1691.
Activity
docs(source-control): bump playbooks, session-flow, source-control fo…
docs(source-control): keep worker instructions inline and scope the c…
fix: act on "Building with Claude Sonnet 5.5" findings (#5676)
docs: finish the Building with Claude Sonnet 5.5 follow-ups (#5759)
kyle-sexton commentedon Oct 4, 2026
This was generated by AI during triage.
Triage: human-gated, needs a decision
Routing reason: one open placement decision (where workers read the accepted command shapes) plus one refusal class whose layer is not yet identified. Neither can be settled by an agent alone.
What triage established
eval-word class is resolved here: Worktree-isolated sessions refuse claude plugin eval (guard reads 'eval' as shell eval) #5696 identified it as the same built-in guard, and docs(evals): stop and hand off when a worktree session refuses plugin eval #5739 documented it in/evals:plugin-eval(stop, hand the user the exact command, read the result back). That discharges theevalpart of this item's done-when; Worktree-isolated sessions refuse claude plugin eval (guard reads 'eval' as shell eval) #5696 stays open only as the upstream watch.$VARreads that never touch git. The 2026-09-30 refusal ofsed -n ... $F(a scratchpad file, no git) contradicts that. Either the record is stale or the harness regressed.Basis: verified,
plugins/playbooks/skills/skill-authoring/reference/precompute-context.md:98andplugins/source-control/skills/worktree/reference/gather-block.md:23.githubin the path): not reproduced from this repository's hooks. A user-scope hook outside this repository is a candidate layer; operator to confirm.Open question for the operator: where should the accepted command shapes for body-time and subagent Bash live?
Also confirm whether the path-shaped refusals come from a user-scope hook, which would put that half outside this repository.
Agent Brief
Type: Task
Summary: Identify the source of each worktree-isolation refusal class and give workers the accepted command shapes up front.
Current behavior:
In worktree-isolated sessions, compound commands, commands carrying a
$expansion, and commands whose paths containgithubare refused. Each refusal costs a retry. Guidance on accepted shapes exists only for skill pre-compute blocks and in scattered per-skill notes.Desired behavior:
Each refusal class is attributed to its layer (built-in isolation guard, this repository's hooks, or a user-scope hook). Classes owned by this repository are fixed; the rest are documented as expected. Workers find the accepted shapes where the operator's chosen placement puts them, before their first Bash call.
Key interfaces:
$expansions it accepts.Acceptance criteria:
$expansion without git,githubpath) names its layer with a probe or a cited source.$VAR-without-git record is either re-verified on the current Claude Code release or corrected.Out of scope:
eval-word class, tracked by Worktree-isolated sessions refuse claude plugin eval (guard reads 'eval' as shell eval) #5696.kyle-sexton commentedon Oct 13, 2026
Decision recorded. The owner approved applying independently verified recommendations on 2026-10-12.
Basis: PR docs(source-control): record the command shapes worktree-isolated sessions accept #5738 body and closing comment 2026-10-02; plugins/discovery/reference/parent-contract.md:701-708 (existing pointer to the upstream isolation page); Worktree-isolated sessions refuse compound and variable-path commands that cannot be shown not to be git #5673 body (six refusals)
Basis: ~/.claude/settings.json hooks list and grep of both hook scripts, 2026-10-12 (this machine only); triage comment 2026-10-04 (refusal text absent from repo hooks)
Worktree-isolated sessions refuse compound commands, $-expanded paths and some github-path commands from Claude Code's built-in isolation guard, costing a retry each. Triage attributed the git-shaped refusals to the built-in guard; the open decision is where workers read the accepted command shapes, and PR #5738 drafted exactly that before being closed for ownership reasons only.
Verification notes:
Verified by an independent fresh-context check (confirmed, risk low): gh issue view 5673 (body + triage 2026-10-04; no owner decision); gh pr view 5738 (CLOSED 2026-10-02, closed only for session ownership; review comments found nothing blocking; files incl. gather-block.md, precompute-context.md, session-flow/reference/gather.md); origin/main plugins/discovery/reference/parent-contract.md:699-708 (pointer to worktrees#how-claude-code-enforces-isolation); origin/main plugins/playbooks/skills/skill-authoring/reference/precompute-context.md:124-132 (2.1.257/2.1.259 record); origin/main plugins/source-control/skills/worktree/reference/gather-block.md:18-28; https://code.claude.com/docs/en/worktrees.md fetched 2026-10-12: four checks incl. command shape, applies to subagents and background
Admission to an agent lane stays with the work-class rules and owner ratification.
kyle-sexton commentedon Oct 17, 2026
Admitted in owner wave 1.
docs(source-control): point accepted-shapes record at upstream sections
kyle-sexton commentedon Oct 18, 2026
This was generated by AI during triage.
Triage after #7805 merged: one decided item left
What #7805 finished (merged 2026-10-17, 72a22ae): the owner record. On main (e59e0be)
/source-control:worktreeholds "Accepted command shapes for body-time and subagent Bash" (in its gather-block reference): the accepted shape, the three refusal classes with their layer and basis, and the unsettled$VARquestion with a recheck trigger.plugins/discovery/reference/parent-contract.mdand the skill-authoring pre-compute reference now point at it. That meets the body's done-when for identifying each refusal's source and documenting it as expected.What remains. The 2026-10-13 decision says worker briefs and per-skill notes point to that one heading. Only two files reference it today (
git grep -l 'Accepted command shapes' origin/main -- plugins), while 57 skill and agent bodies mention worktree isolation. The notes among them that restate accepted shapes have not been re-pointed.The
$VARprobe is recorded as unsettled with a recheck trigger; it is not part of this item's remaining work.Triage: briefed, delegable (Task, priority: medium, work-class: scoped).
Agent Brief
Type: Task
Summary: Re-point per-skill and per-agent notes that restate worktree-isolated Bash command shapes at the owner heading.
Current behavior:
/source-control:worktreenow owns the accepted command shapes for worktree-isolated Bash, but many skill and agent bodies still carry their own notes on which shapes the isolation guard accepts or refuses.Desired behavior: Every skill or agent note that restates accepted or refused command shapes for worktree-isolated Bash is replaced by a pointer to
/source-control:worktree, "Accepted command shapes for body-time and subagent Bash", keeping any skill-specific fact the owner heading does not hold. Notes that only mention worktree isolation without restating shapes stay as they are. Pointers name the skill by/plugin:skill, never by path.Key interfaces:
/source-control:worktreeowner heading: the single source; read, not edited, except to add a shape a note held that the heading lacks.Acceptance criteria:
/skill-quality:checkpasses on every changed skill.Out of scope:
$VARquestion.docs: point worktree-isolated Bash notes at the accepted-shapes heading