Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops

Summary

In worktree-isolated background sessions, the command-shape guard refuses many commands that contain no git operation and no path outside the worktree, with:

"…this command is too complex to verify that it stays inside the worktree. Refusing to run it — a worktree-isolated session's git operations must target its own worktree. Split it into plain, separate commands…"

The refusal has two problems in practice:

1. It fires on commands with no git in them. Measured examples from one session (2026-08-28):

• A plain polling loop: for i in $(seq 1 60); do gh pr view … ; sleep 30; done — no git, no writes outside /tmp.
• cd <worktree> && python3 - <<'EOF' … EOF heredocs editing a file inside the worktree.
• readlink -f ~/.claude/bin/x followed by a grep — two read-only commands joined by ;.

1. The suggested fix cannot apply to the main refusal class. "Split it into plain, separate commands" is not actionable for a loop — the loop is the command. The working workaround is writing the identical content to a script file and running bash <file>, which is allowed. The check therefore costs a round-trip per occurrence while preventing nothing.

Scale

Telemetry from one operator's fleet (harness-side capture, 30 days): ~7,100 refusals across 192 sessions; in the last 7 days this guard is the #1-ranked friction family in our store (64 distinct sessions, 3,525 events). Every occurrence resolves the same way: the same bytes, moved into a file.

Ask

Either (a) recognize obviously-inside shapes — no git/gh-mutating token, loop bodies whose commands are individually verifiable, heredocs targeting worktree paths — or (b) if fail-closed on unparsed shapes is the deliberate posture, make the refusal name the sanctioned idiom directly ("write this to a script file inside the worktree and run bash <file>"), since that is the universal workaround anyway. Option (b) is a one-line message change that would eliminate most of the retry round-trips.

We understand and support the fail-closed posture for genuinely ambiguous shapes; this report is about coverage of benign shapes and the actionability of the refusal text.

Environment

Claude Code 2.1.243, Linux (WSL2), worktree-isolated background sessions (.claude/worktrees/*).