[Bug] Worktree isolation refuses Bash commands that interpolate an environment variable, with no path, redirect or git involved (2.1.222)

Summary

Since 2.1.222, the worktree-isolation verifier refuses top-level Bash commands that
interpolate an environment variable — including commands that make no network call,
name no path, contain no redirect and touch no git state. The refusal text describes a
git/path concern the command does not have.

2.1.222 is what makes this reachable for ordinary sessions: isolation now applies to
Bash in every session type, not only subagents declaring isolation: "worktree".

Reproduction

One line, in any session started with claude -w <name>:

printf '%s\n' "$TERM"

Refused. Verbatim, trimmed:

This session is isolated in the worktree <path>, but this command is too complex to
verify that it stays inside the worktree; break it into plain, separate commands.
… Run the equivalent from <path> without the redirect.

printf '%s\n' "literal" runs in the same session, so the session is not simply unable
to run Bash.

A/B across versions

Each probe run from a fresh throwaway git repo, a fresh -w session, and an environment
with every CLAUDE_* variable stripped:

| | printf "%s\n" "$TERM" | printf "%s\n" "literal" |
|---|---|---|
| 2.1.221 | xterm-256color | literal |
| 2.1.222 | refused | literal |

Why it matters

• Commands that must read a secret from the environment become inexpressible. The

suggested rewrite cannot help — splitting the command does not remove the expansion
the verifier objects to.

• The advice misleads. "Break it into plain, separate commands" and "without the

redirect" send the reader hunting for a path, redirect or git problem that is not there.

• The blast radius grew silently. Previously confined to subagents that opted into

isolation, this now reaches ordinary interactive -w sessions.

Ask

1. Do not treat an interpolation as a potential worktree escape when the command has no

filesystem, git or redirect surface at all.

1. Make the outcome consistent across argument positions, or document what distinguishes

the accepted cases from the refused ones.

1. Make the refusal name the construct that triggered it, and drop the "redirect" and

"git operations" wording when neither is present.

Environment

Claude Code 2.1.221 and 2.1.222, Linux, native installer layout. Both versions exercised
from throwaway repos; no pre-existing worktree or session involved.

Related

• #82966 — same verifier and wording, but for path-bearing commands in subagents that

explicitly declare isolation: "worktree". This report is about commands with no path
at all, in sessions isolated implicitly as of 2.1.222.

• Replaces #84135 and #84448, both closed. They carried the same finding with a

self-contained repro script inline; automated triage timed out on both and left them
uncategorised. The script and a table of further accepted/refused pairs follow in a
comment below.