Repository navigation
Worktree-isolated sessions refuse claude plugin eval (guard reads 'eval' as shell eval) #5696
Description
Summary
In a worktree-isolated Claude Code session, the Bash tool refuses any command that contains eval as a word, including claude plugin eval and claude plugin eval --help. The guard reads the subcommand as the shell builtin eval. Plugin skills that run plugin evals (/evals:plugin-eval) therefore cannot run from an isolated worktree session.
The guard is built into Claude Code: its message text is in the 2.1.285 binary, not in any plugin in this repo. Per our rule against filing on Anthropic's repositories, this issue tracks the limitation here.
Repro
- Start a session isolated in a git worktree (Claude Code 2.1.285, Linux/WSL2).
- Have the model run
claude plugin eval --help. - Observed: refused with "this command runs a string through eval, which can't be verified to stay inside the worktree."
- Expected:
claude plugin evalis a CLI subcommand, not shelleval, so it should run.
claude --version and claude plugin --help pass. Another message from the same guard: "uses a subshell in a command inside a construct too complex to verify".
Workaround
Run the command in a separate terminal outside Claude Code. The ! prefix does not work: the user's own ! command in the same session is refused with the identical message (verified 2026-10-01). Do not bypass the guard with wrapper scripts.
Follow-ups
/evals:plugin-evalshould name this limitation and give the user the exact command to run in a separate terminal when it runs in a worktree-isolated session.- The refusal message ends "a worktree-isolated session's git operations must target its own worktree", which is misleading because this command is not a git operation.
- Recheck on each Claude Code release: run
claude plugin eval --helpfrom an isolated worktree session, and close this issue once it passes.
Found while running an approved observation run during the eval-design/hillclimbing digest interview (branch feat/eval-design-hillclimbing-digest).
🤖 Generated with Claude Code
Activity
docs(evals): scope the worktree handoff to run and init and pin absol…
docs(evals): fit the worktree handoff to init and match the refusal text
kyle-sexton commentedon Oct 4, 2026
This was generated by AI during triage.
Triage: human-gated, upstream watch
Routing reason: the plugin-side follow-up is done, and the remaining closure criterion is upstream:
claude plugin eval --helphas to pass from a worktree-isolated session, which only a Claude Code release can change. Re-running it needs an isolated session, so this item stays parked rather than agent-ready.What triage established
/evals:plugin-evalnow stops on this refusal, prints the exact command for the user to run outside Claude Code, and reads the result back. Its verification record carries this issue as the basis, with a recheck trigger of "a Claude Code release note touches worktree isolation orplugin eval".Basis: verified,
plugins/evals/skills/plugin-eval/SKILL.md:89and:104.plugin eval(a fix for a stale copy of a locally installed plugin, not the guard). That meets the recorded trigger. The current release is 2.1.289; this issue was reproduced on 2.1.285.Basis: verified, https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md fetched 2026-10-04, section 2.1.289.
eval-word class is the one already attributed and documented.Next human action: from a worktree-isolated session on 2.1.289, run
claude plugin eval --help. If it passes, close this issue and refresh the plugin-eval verification row. If it is still refused, refresh the row's version and as-of date and leave this open.Agent Brief
Type: Task
Summary: Recheck whether the built-in worktree guard still refuses
claude plugin evalon each Claude Code release that touches worktree isolation orplugin eval.Current behavior:
On 2.1.285 the built-in guard refuses any command containing the word
evalin a worktree-isolated session, includingclaude plugin eval --helpand the user's own!command.Desired behavior:
After each triggering release, the outcome of
claude plugin eval --helpfrom an isolated session is recorded in the plugin-eval verification record. The issue closes once the command passes.Key interfaces:
Acceptance criteria:
claude plugin eval --helprun from a worktree-isolated session on the current release, with the result recorded.Out of scope:
kyle-sexton commentedon Oct 13, 2026
Owner ratified this admission in an attended session on 2026-10-13. Relabelled work-class: mechanical, because the step is a one-line SKILL.md edit, which read-only does not allow.
kyle-sexton commentedon Oct 14, 2026
docs(evals): give each worktree-guard clause its own Sources row
kyle-sexton commentedon Oct 19, 2026
work-item-lease reclaimed: lease expired (renewed_at 2026-10-14T00:51:21Z) with no activity.