EnterWorktree while subagents are running flips a session-wide isolation latch that breaks Bash for every concurrent agent (including agents in their own isolated worktrees)

Environment

Claude Code CLI 2.1.241 era (first observed two days earlier on the then-current build), macOS. Paths and branch names below are placeholders.

What happened

The main conversation called EnterWorktree{name: "<task-branch>"} in the same parallel tool batch that also spawned a fork subagent. Afterwards, three different agents of that session had every Bash call refused, including a bare pwd, with (paths replaced):

This session is isolated in the worktree <repo>/<task-worktree>, but this command's working directory resolved to the shared checkout (<repo>). Refusing to run it there - a worktree-isolated session's commands must run inside its worktree. Re-run the command from <repo>/<task-worktree>.

The three affected agents:

1. The fork spawned in the same batch (its cwd was the shared checkout).
2. A teammate agent spawned minutes later specifically to test Bash access (same error on its first call).
3. An isolation: "worktree" agent running in its OWN dedicated worktree (<repo>/.claude/worktrees/agent-<id>): its first Bash call had worked normally and printed its own worktree as cwd; minutes later, with no change on its side, even a bare pwd was refused with the error above, claiming its session was isolated in a worktree it had no relationship with. This case shows the latch is session-global while cwd expectations are per-agent, so the check can never pass for concurrent agents.

Impact

Beyond breaking Bash for the whole agent team, the failure mode is toxic downstream: the fork whose Bash genuinely died built an "environment is broken, repair it" narrative around this error and ended up instructing another agent to git worktree remove the user's active worktree and rename its own branch to take over (see companion issue #89101). The recruited agent refused; but the trigger was this real state race, not model fantasy.

Suggested directions

• Scope isolation per agent: validate each agent's Bash against that agent's own cwd/worktree, not against a session-global latch.
• Or refuse/queue EnterWorktree while background agents are live, and document that it must not share a parallel batch with Agent spawns.