Worktree isolation verifies complexity, not targets: a simple Bash command writing an absolute path outside the worktree passes unchecked

Summary

In a worktree-isolated session (claude --worktree), the Bash guard refuses any non-simple command as "too complex to verify that it stays inside the worktree" (#88776, #87959; root cause named in #84720). This report is about the counterpart, which as far as I can find is not yet filed for plain Bash in an ordinary worktree session: simple commands are not verified at all. A plain touch <absolute path in the main checkout> runs unchecked and creates the file outside the worktree — precisely the cross-contamination the isolation exists to prevent.

Related, but different channels: #85118 (jj resolves to the parent repo), #74726 (Agent tool Edit/Write with absolute paths), #88038 (Write tool vs. Bash sandbox).

Reproduction

mkdir /tmp/wt-demo && cd /tmp/wt-demo && git init -q && git commit --allow-empty -m init -q
claude -p 'Run exactly this Bash command and report its result: touch /tmp/wt-demo/outside-probe.txt' \
  --worktree demo
ls -la /tmp/wt-demo/outside-probe.txt   # exists afterwards, in the MAIN checkout

The session's working directory is /tmp/wt-demo/.claude/worktrees/demo; the target path is the main checkout. The command runs with exit 0 and the file is created outside the worktree, silently.

For contrast, the same session refuses a harmless substitution that touches no path outside the worktree:

echo "$(cat file.txt)" | head -1

This session is isolated in the worktree <worktree-path>, but this command is too complex to verify that it stays inside the worktree. Refusing to run it — a worktree-isolated session's git operations must target its own worktree.

Expected

Either simple commands receive the same target verification (refuse writes whose paths resolve outside the worktree), or the refusal message should stop claiming that "stays inside the worktree" is being verified. Currently the guard uses command complexity as a proxy for risk: complex-but-harmless commands are refused while simple-but-harmful ones pass. Both directions defeat the isolation promise, and the strict side trains users to move commands into script files, which then also pass unchecked.

Why it matters

The worktree flow is promoted for running parallel sessions against one repository. A session that is believed to be isolated can silently modify the shared main checkout where another session may be working — the exact failure mode worktree isolation is meant to rule out.

Environment

• Claude Code 2.1.250
• Linux
• plain git repository, no submodules