[BUG] bgIsolation containment check isn't realpath-canonicalized; symlinked cwd bypasses it

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The bgIsolation guard's "is this path inside the shared checkout?" test is a literal prefix match against the checkout root, not realpath-resolved. In a background session, a Write/Edit/NotebookEdit addressed via a symlink-alias path bypasses bgIsolation; the canonical path to the same file is correctly blocked.

What Should Happen?

Identical enforcement for files in the same folder regardless of which equivalent path string is used (e.g. use realpath to canonicalize both the target path and the checkout root before the containment test).

Error Messages/Logs

Steps to Reproduce

Run the below script in a test environment with Claude Code 2.1.207 and no worktree.bgIsolation override, then observe that canon.txt is blocked by bgIsolation, while alias.txt is written into the checkout.

#!/bin/bash
base="$(mktemp -d)"
git init -q "$base/canonical"
ln -s "$base/canonical" "$base/alias"

cd "$base/canonical"
PROMPT="Using the Write tool, create two files: $base/canonical/canon.txt and $base/alias/alias.txt . "
PROMPT+="Do not call EnterWorktree. Report whether each Write succeeded or was blocked, then stop."
claude --bg "$PROMPT" --allowedTools "Write"
id=$(claude agents --json --all --cwd "$base/canonical" | jq -r '.[0].id')
claude attach "$id"

claude rm "$id"
rm -rf "$base/canonical/.git"
ls -alR "$base"
rm -f "$base"/canonical/{canon,alias}.txt "$base/alias"
rmdir "$base/canonical" "$base"

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.207

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Xterm

Additional Information

_No response_