Sandbox doesn't allowlist git worktree gitdir, blocking all git writes

Description

When using git worktree, the .git entry in the working tree is a file (not a directory) that points to the actual gitdir elsewhere:

$ cat /home/user/project/main/.git
gitdir: /home/user/project/worktrees/main

The bubblewrap sandbox allows writes to . (the working tree), but the actual gitdir at the worktree path is not in the write allowlist. Git operations that need to write to the gitdir (like git add, which creates index.lock) fail:

fatal: Unable to create '/home/user/project/worktrees/main/index.lock': Read-only file system

This blocks git add, git commit, git stash, and essentially all git write operations.

Expected behavior

The sandbox should follow the .git file to resolve the actual gitdir (via git rev-parse --git-dir) and add it to the write allowlist automatically.

Workaround

Manually add the worktrees parent directory to additionalDirectories in ~/.claude/settings.json:

{
  "permissions": {
    "additionalDirectories": ["/home/user/project/worktrees"]
  }
}

Environment

• OS: Linux (Arch, btrfs)
• Claude Code: latest
• Git worktrees created via git worktree add