[Bug] Windows: `/plugin marketplace update` fails when cwd is ancestor of git.exe path

Bug Description

## What's Wrong? On Windows, /plugin marketplace update fails with:This happens only when the current working directory is an ancestor of the git executable's installation path. The error message is misleading — git is correctly installed and in PATH; the actual root cause is Node.js's security check rejecting the spawn because it sees git.exe as residing under cwd's subtree. ## Reproduction Steps 1. Install Portable Git into a path under user home (e.g. C:\Users\<user>\Apps\PortableGit\) 2. Add the git path to User PATH; verify where.exe git works in PowerShell 3. Launch Claude Code from C:\Users\<user>\ (the default user home cwd): cd C:\Users\<user> && claude 4. Inside Claude Code, run /plugin marketplace update 5. Observe the failure above ## Workaround (Confirmed Working) Launch Claude Code from any directory that is not an ancestor of git.exe's path. For example: ``powershell cd C:\ claude ` /plugin marketplace update then succeeds immediately. A PowerShell $PROFILE wrapper function makes this transparent: `powershell function claude { $originalLocation = Get-Location Set-Location C:\ try { & "$env:USERPROFILE\.local\bin\claude.exe" $args } finally { Set-Location $originalLocation } } ` ## Expected Behavior The marketplace clone should succeed regardless of the relationship between cwd and the git installation path. When invoking git via child_process.spawn, Claude Code should either: - Pass an absolute git path resolved at startup, OR - Set spawn cwd to a neutral location (e.g. the marketplace target directory) before invoking git, OR - Set the NoDefaultCurrentDirectoryInExePath env var on the spawn options to bypass Windows's legacy cwd-in-PATH behavior ## Why This Matters This affects a common installation pattern: - Users without admin rights install Portable Git under %USERPROFILE% - fnm/nvm-managed Node also lives under %USERPROFILE% - Default cwd when launching claude is %USERPROFILE% All three conditions are normal for corporate/restricted Windows environments, yet the combination silently breaks marketplace functionality. The error message ("not found") leads users to spend hours debugging PATH instead of cwd. ## Environment - OS: Windows 11 (24H2) - Claude Code: v2.1.116 - Shell: PowerShell 5.1 / 7.x - Node: v24.11.1 (managed by fnm) - Git: Portable Git 2.51.2.windows.1 at C:\Users\<user>\Apps\PortableGit\ - No admin privileges (user-scope installations only) ## Diagnostic Evidence Confirming git is correctly accessible at the OS level: `powershell PS> where.exe git C:\Users\<user>\Apps\PortableGit\mingw64\bin\git.exe C:\Users\<user>\AppData\Local\Programs\Git\cmd\git.exe PS> git --version git version 2.51.2.windows.1 ` Confirming the cwd-relative trigger by changing only the launch directory: | Launch cwd | /plugin marketplace update | |---|---| | C:\Users\<user> | ❌ Fails with "unsafe location" | | C:\ | ✅ Succeeds | | D:\` | ✅ Succeeds (any non-ancestor path works) | ## Suggested Documentation Improvement Until the underlying behavior is fixed, the troubleshooting docs at https://code.claude.com/docs/en/troubleshooting should mention that "unsafe location (current directory)" specifically indicates a cwd parent-child relationship with git.exe — not a missing git installation.

Environment Info

• Platform: win32
• Terminal: null
• Version: 2.1.116
• Feedback ID: 84408c5f-3613-48ed-9999-cf29a8439448

Errors

[]