[BUG] CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 makes .git/worktrees read-only on Linux: git worktree add and commits in linked worktrees fail

What's wrong

On Linux, setting CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 makes <repo>/.git/worktrees/ read-only to every Bash command. No sandbox settings are needed to trigger it. As a result, git worktree add fails, and so does any commit inside an existing linked worktree, because each worktree's index.lock lives in .git/worktrees/<name>/. Other writes in the repo still work.

The variable is documented only as stripping credentials from subprocess environments. Nothing in the docs says it changes filesystem writability. It does force every command into the sandbox on Linux, so this is probably the sandbox's .git protection reaching .git/worktrees. sandbox.filesystem.allowWrite on .git/worktrees doesn't lift it, and neither does excludedCommands: ["git *"].

This blocks any unattended or CI setup that uses the scrub and runs parallel agents in git worktrees.

Repro (Claude Code 2.1.296, Linux/WSL2, bubblewrap + socat installed)

mkdir /tmp/repro && cd /tmp/repro && git init -q main && cd main
git commit -q --allow-empty -m init
git worktree add -q .wt/a -b a
printf '/.wt/\n/t.sh\n' > .git/info/exclude
cat > t.sh <<'S'
git worktree add -q .wt/b -b b && echo ADD-OK || echo ADD-FAIL
git -C .wt/a commit -q --allow-empty -m x && echo COMMIT-OK || echo COMMIT-FAIL
mkdir -p newdir && echo REPO-WRITE-OK || echo REPO-WRITE-FAIL
S
for v in 1 0; do
  CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=$v claude -p 'Run this exact Bash command once: sh t.sh   Then output ONLY its raw output.' \
    --model haiku --setting-sources project --allowedTools 'Bash(sh t.sh)' --permission-mode default --permission-prompts none
done

CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1

fatal: could not create directory of '/tmp/.../main/.git/worktrees/b': Read-only file system
ADD-FAIL
fatal: Unable to create '/tmp/.../main/.git/worktrees/a/index.lock': Read-only file system
COMMIT-FAIL
REPO-WRITE-OK

CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0

ADD-OK
COMMIT-OK
REPO-WRITE-OK

Expected

Either .git/worktrees/ stays writable under the scrub, the same as the rest of .git minus hooks/ and config, or the docs say plainly that the scrub stops git worktrees from working and name a supported way to allow them.

Related

• #51258: the scrub also forces the permission mode to default, closed as not planned.
• #90569, #95949, #80278: other sandbox and worktree interactions.