Compound cd && git commands in worktrees should not require approval

Summary

When working in git worktrees, Claude Code flags cd <worktree-path> && git <command> as requiring user approval with the message:

Compound commands with cd and git require approval to prevent bare repository attacks

This is overly broad when the target directory is a known worktree of the current repository (e.g., under .claude/worktrees/).

The inconsistency

git -C <path> <command> does exactly the same thing as cd <path> && git <command> — both run git commands in a different directory. However, only the cd && form triggers the security approval. This means:

• git -C /some/untrusted/path status — no approval required
• cd /some/untrusted/path && git status — approval required

Both can target unexpected repositories equally, so the security check is inconsistent.

The worktree problem

When Claude Code spawns agents in worktrees (via isolation: "worktree" or EnterWorktree), the agent needs to run git commands in the worktree directory. Since the worktree is a subdirectory of the original repo (.claude/worktrees/<name>), it's not an "unexpected repository" — it's the same repo, just a different working copy.

Currently, every git command in a worktree triggers an approval prompt, which defeats the purpose of autonomous worktree-based agents.

Suggested fix

The security check should recognize worktree paths as safe. Specifically:

1. If the target of cd is a git worktree of the current repository (verifiable via git worktree list), it should be treated the same as running git commands in the main working directory.
2. Alternatively, if git -C is not going to be checked, cd && git shouldn't be checked either — the current inconsistency provides a false sense of security.

Reproduction

1. Create a worktree: git worktree add .claude/worktrees/test-branch
2. Have Claude Code run: cd .claude/worktrees/test-branch && git status
3. Observe the approval prompt about bare repository attacks
4. Compare with: git -C .claude/worktrees/test-branch status (no prompt)

Environment

• Claude Code CLI
• Any git repository using worktrees