Agent tool `isolation: "worktree"` sometimes leaves sub-agent in parent agent's cwd

Summary

When spawning sub-agents via the Agent tool with isolation: "worktree", the SDK reliably creates the new worktree at <repo>/.claude/worktrees/agent-<id>/, but does not reliably set the sub-agent's working directory to that worktree. The sub-agent inherits the parent agent's cwd and writes/commits there instead, silently breaking isolation.

Repro

In a Claude Code session running inside a worktree (e.g. <repo>/.claude/worktrees/orchestrator-foo), launch 2–3 sub-agents in separate messages via the Agent tool with:

• isolation: "worktree"
• run_in_background: true
• subagent_type: <a custom agent>
• model: "sonnet"

Each prompt instructs the agent to write source files under server/ and commit. Wait for completion.

Expected

Each sub-agent's cwd is its own agent-<id>/ worktree. Each one writes and commits inside that worktree. The orchestrator's tree stays clean.

Actual

Of three sub-agents launched sequentially in one session today, one landed correctly in its isolated worktree; two inherited the orchestrator's worktree as cwd. Both wrote files into the orchestrator's tree and committed onto the orchestrator's branch, interleaving each other's writes. Their assigned isolated worktrees were auto-cleaned (no commits), leaving no trace.

The two failing agents' commits ended up stacked on the orchestrator's branch in temporal order. One commit accidentally swept up files the next agent had not yet committed — and imported a route handler from a file that wouldn't exist until the next commit landed. The combined branch is unsplittable by SHA.

Evidence (transcript excerpts)

Failed sub-agent — every Bash call cd's into the orchestrator's worktree, never its own:

"command":"cd /Users/me/code/repo/.claude/worktrees/orchestrator-foo/server && bun add @react-pdf/renderer qrcode ..."
"command":"cd /Users/me/code/repo/.claude/worktrees/orchestrator-foo/server && npx tsc --noEmit ..."

file_path parameters in Write/Edit calls all target …/orchestrator-foo/….

Successful sub-agent (same session, same parent prompt structure) — uses relative cd server, and file_path parameters target its own agent-<id> worktree:

"command":"cd server && bun run test ..."
"file_path":"/Users/me/code/repo/.claude/worktrees/agent-<id>/server/migrations/..."

Same Agent tool params for both. Same parent agent. Same parent CLAUDE.md. Different cwd at startup.

Impact

Silently breaks parallel/background agent orchestration. The caller trusts the <worktree> block in the result, but for the failed agents that block is omitted (the empty worktree was auto-cleaned), so the failure looks identical to "the agent didn't return a worktree because it didn't change anything." Meanwhile the orchestrator's branch is now polluted with cross-agent commits that can't be cleanly separated.

Workaround

In each spawned agent's prompt (and/or in the custom-agent's persona), require a pwd check as the first tool call. If cwd doesn't contain /.claude/worktrees/agent-, the agent must STOP and report instead of writing files. Caught at agent level, not at SDK level.

Environment

• macOS (Darwin 25.4.0)
• Claude Code CLI 2.1.119
• Parent agent: Claude Opus 4.7
• Sub-agent: Claude Sonnet (4.6)
• All three sub-agents launched sequentially in three separate messages, all with run_in_background: true