Worktrees of a bare repository don't inherit workspace trust

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [ ] I am using the latest version of Claude Code

What's Wrong?

The docs say "In a worktree, it uses the main checkout's root" (https://code.claude.com/docs/en/permissions#project-allow-rules-and-workspace-trust). A bare repository has no main checkout, so every worktree of one is its own trust root and shows the trust dialog on first launch.

Accepting the dialog writes projects["~/work/setup/probe"], keyed on the worktree itself.

What Should Happen?

For a bare repo, key trust on the common directory (git rev-parse --git-common-dir), so trusting it once covers its worktrees.

Error Messages/Logs

_No response_

Steps to Reproduce

Layout: ~/work/setup/.bare (bare repo), with worktrees ~/work/setup/main, ~/work/setup/<branch>, …

With a fresh CLAUDE_CONFIG_DIR whose projects holds a single trusted entry:

| Trusted entry | New worktree ~/work/setup/probe prompts? |
| --------------------------------------------------------------------------------------- | ------------------------------------------ |
| ~/work/setup/.bare (the common dir) | yes |
| ~/work/setup | yes |
| ~/work | yes |
| ~/work/setup/main (another worktree), via claude --worktree + WorktreeCreate hook | yes |
| _plain clone:_ repo (has .git), worktree ../wt | no, inherits as documented |

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.294

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

OS is NixOS.

Related: #97991 (worktree re-prompts, traced there to a declined ancestor, a different cause).