RAP Sheet home
Install the bug reporting skill
Rank, 14 days: 27 on the Claude Code sheet
30 people reported

All time, since Sep 17, including 7 thumbs-up on GitHub.

Worktree guard refuses commands and edits

“Inside a subagent dispatched with isolation: "worktree", the Bash tool refuses many read-only and worktree-local commands.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/claude-code/themes/229/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Fading. 2 reports and thumbs-up in the last 7 days and 3 the week before, down from 12 a week at the early-October peak. A fix is listed for one of its bugs, and no vendor reply yet.

9 bugs in this theme

  1. Worktree Bash refusalsNo workaround yet12 people
  2. Worktree guard blocks nested reposNo workaround yet4 people
  3. Heredoc refused in worktreeNo workaround yet3 people
  4. Worktree guard refuses rewritten gitNo workaround yet3 people
  5. Worktree refuses shell-word argsNo workaround yet3 people
  6. Subagent Bash refused after worktreeNo workaround yet2 people
  7. Empty .git treated as repo rootHas a workaround2 people
  8. Worktree guard refuses ~ git pathsHas a workaround2 people
  9. Isolation fence skips Bash writesNo workaround yet2 people

What's included

  • Non-git commands refused because their text contains "git", "github", eval, source, bind, hash or similar words as arguments
  • Heredocs with braces and quotes, $VAR paths, loops or multiple paths refused as "too complex to verify"
  • ~ paths in cd or git -C refused as "computed at runtime" while $HOME forms run, including user ! commands
  • Write/Edit blocked for files in a separate nested repo or registered worktree under the base checkout, with a suggested path that does not exist
  • Subagents and background jobs get every Bash call refused after the parent enters a worktree

Not included

  • Commands chained with ; running after a failed git step
  • EnterWorktree or isolated spawn refused intermittently when the git probe times out on Windows
  • Bash writes to the main checkout not being blocked at all

Original reports26, newest first

  1. Worktree edit guard blocks edits to a nested, gitignored repository and suggests a path that does not exist#108213
  2. Worktree guard refuses hook-rewritten rtk git#107244
  3. Worktree guard refuses quoted heredocs whose body has { then a quote (text pre-check ignores heredoc quoting)#105416
  4. Worktree isolation guard refuses non-git commands whose text contains "git"#105399
  5. An empty .git directory in a subfolder is treated as a repository root, so the folder-trust prompt reappears inside a trusted repo#104937
  6. Worktree-isolated session refuses ordinary commands whose ARGUMENTS contain the words source or bind ("runs a string through source/bind")#103819
  7. [CLI] Worktree isolation fence covers Write/Edit but not Bash writes to the parent checkout#102741
  8. Agent tool isolation:"worktree" spawns a seat whose every Bash call is refused on arrival (analyzer fails closed on plain commands too)#101887
  9. Worktree isolation guard false positive: substring match on "git" blocks commands#100806
  10. Worktree-isolation Bash guard overrides an explicit PreToolUse permissionDecision: allow#100385
Show all 26Show only the newest 10
  1. Worktree Edit guard incorrectly blocks files in nested git repos and suggests non-existent paths#100259
  2. Worktree-isolation guard refuses plain git commands after a PreToolUse hook wraps them in a launcher (rtk)#99895
  3. Worktree guard refuses git -C ~/… in user ! commands; reason withheld under Remote Control#99855
  4. Worktree guard fences all of /tmp when /tmp holds any .git entry (empty dir accepted as a repo root; resumed background sessions anchor under /tmp)#99567
  5. Worktree-isolation Bash check matches "git" inside other words (legit, digit) when a command has $(), a loop or a heredoc#98344
  6. Worktree isolation in a background session blocks subagents' Bash commands, even for other repos#98307
  7. Worktree-isolation Bash guard refuses a curl command that references a settings.json env var#97760
  8. Bash tool refuses read-only and worktree-local commands as 'too complex to verify' in git worktree isolation#97474
  9. Desktop worktree Write/Edit guard blocks files in a separate git repo nested under the base checkout#97439
  10. Bash tool in a worktree-isolated agent refuses commands that never leave the worktree#97225
  11. Worktree isolation refuses a quoted heredoc whose body has a quote inside braces ("too complex to verify"), 2.1.280#96253
  12. Worktree isolation: a subagent spawned before EnterWorktree has every Bash call refused afterward#96209
  13. Worktree isolation denies Edit under the base repo's .claude/ — including a separate registered worktree — while Bash writes to the same directory are allowed#95776
  14. Worktree isolation refuses fifteen shell words in any argv position, including in read-only commands containing no git#95611
  15. Worktree-isolated sessions refuse git after cd ~/path but allow the same command with "$HOME/path" (2.1.278)#95556
  16. Worktree isolation refuses git-free Bash on 2.1.272/2.1.273: literal-assigned variables, $(…) args, loops, heredocs after && (75 refusals in 3 days)#95122

Do you work on Claude Code?

Claim its RAP Sheet to see what your users report and answer them in one place.

Claim a tool