[BUG] Subagent tools fail on /tmp/ worktree paths despite bypassPermissions and additionalDirectories

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When using the Agent tool to dispatch subagents with mode: "bypassPermissions" to work on files in /tmp/ worktree directories, the subagent's Read and Bash tools fail to access files in those paths. This happens even when the /tmp/ paths are listed as additional working directories in the session environment.

The root cause appears to be sandbox filesystem restrictions: the subagent's allowed filesystem paths are derived from the primary working directory, not from the full set of additional working directories passed to the session. The /tmp/ worktree paths are visible in the environment context but not in the sandbox allowlist.

This is distinct from:

• #26479 (Agent Teams teammates ignoring bypassPermissions — that's about teams, this is regular subagents)
• #19387 / #15700 (hardcoded /tmp/claude/ path — that's about Claude's internal temp files, not user worktrees)
• #22155 (sandbox auto-restrict to cwd — related but our paths ARE in additional working directories)

What Should Happen?

Subagents spawned via the Agent tool should be able to Read/Edit/Bash files in any directory listed in the session's additional working directories, especially when mode: "bypassPermissions" is set.

Steps to Reproduce

1. Open Claude Code in a project at e.g. /Users/me/Projects/myproject
2. Create a git worktree at /tmp/myproject-fix:

``bash
git worktree add /tmp/myproject-fix some-branch
``

1. The session shows /tmp/myproject-fix in additional working directories
2. Dispatch a subagent to work on files in the worktree:

``
Agent tool with:
mode: "bypassPermissions"
prompt: "Read and fix /tmp/myproject-fix/internal/foo.go — change X to Y"
``

1. Observe: Subagent's Read tool fails on /tmp/myproject-fix/internal/foo.go. Bash commands targeting that path also fail or are denied.

Workaround

Do the work manually in the main session instead of delegating to subagents. The primary session CAN access /tmp/ worktree paths — only subagents are restricted.

Claude Model

Opus 4.6

Is this a regression?

I don't know

Claude Code Version

2.1.71

Platform

Anthropic API (Claude Max)

Operating System

macOS (Darwin, Apple Silicon)

Terminal/Shell

Ghostty

Additional Information

Use case: When multiple PRs touch the same files, I create git worktrees in /tmp/ to resolve merge conflicts in parallel. Dispatching subagents to each worktree would be ideal for parallel conflict resolution, but the sandbox restriction forces sequential manual work in the primary session.

The environment context shows these paths in "Additional working directories" — the information is there, it's just not propagated to the subagent's sandbox allowlist.