Agent tool isolation=worktree: subagent's file writes leak into parent checkout's working tree

Summary

When spawning a subagent via the Agent tool with isolation: "worktree" and run_in_background: true, the subagent's file writes appear in the parent session's working tree rather than (or in addition to) the subagent's isolated worktree. The parent then ends up with untracked files matching exactly what the subagent claims to have written and committed in its own worktree.

This is distinct from #47548 (branch-switch leak) — no branch switching observed in my case; just file-write spillage.

Environment

• Claude Code on macOS (Darwin 25.3.0)
• Parent session running in the primary clone at /Users/.../Development/kairix on branch develop
• Spawned multiple subagents in parallel with isolation: "worktree"
• Subagent's own report on completion: "Session ran in worktree agent-ac43bb2f then moved to main checkout mid-session due to parallel-worktree convergence. Work was stashed (stash@{0}: F7 batch A mid-execution leakage), then recovered and merged into develop after resolving conflicts."

The subagent itself diagnosed it as "parallel-worktree convergence" — i.e. when multiple isolation: worktree agents run concurrently, their working trees can collide with the parent's.

What I observed

1. Parent session at /Users/.../Development/kairix (primary clone, branch develop).
2. Spawn 4 background subagents with isolation: "worktree" (each gets its own .claude/worktrees/agent-XXXX).
3. Run git status in the parent session mid-execution.
4. Find untracked files in the parent's working tree matching the file paths the subagents are working on in their own worktrees. Example: tests/test_credentials.py appeared as ?? in the parent's git status even though the F7 batch A subagent (in its own worktree agent-ac43bb2f) was the one creating it. Confirmed via ls /path/to/.claude/worktrees/agent-ac43bb2f/tests/test_credentials.py returning "No such file or directory" — the file was ONLY in the parent.

1. When I tried git cherry-pick <subagent's-SHA> from the parent, it failed with "your local changes would be overwritten by cherry-pick" — because the parent's working tree had the untracked file the cherry-pick wanted to add.

Workarounds

• git stash push -u in the parent before each cherry-pick.
• Single-agent dispatch (avoid parallel worktree mode) — but that defeats the parallelism design.

Expected behaviour

isolation: "worktree" should isolate the subagent's file system writes to its own worktree directory; the parent's working tree should be unaffected for the duration of the subagent's run.

Suggested

• Either: enforce that subagent shell sessions cannot cd (or otherwise resolve paths) outside their assigned worktree root.
• Or: document in the Agent tool docs that parallel isolation: worktree subagents may leak into the parent's working tree, and recommend git stash between dispatches.

The current behaviour is genuinely surprising because the agent's own report claims it worked in its worktree, but the side effects are in the parent.

Related

#47548 (different symptom — branch hijack — but possibly same root cause: worktree isolation isn't enforced after the initial cd).