After EnterWorktree, the Bash cwd pin does not follow, so bash refuses everywhere the agent is standing; a default-value echo trips the same guard as too complex

Environment

• Claude Code (not Cursor). Two independent in-repo measurements under confirmed git-worktree isolation, 2026-08-15 and 2026-09-03.
• Cursor Cloud negative control on the complexity arm: the same echo runs.

Two defects in the Bash isolation-pin layer, same guard.

1. After EnterWorktree, the Bash cwd pin does not follow

EnterWorktree into a sibling worktree succeeds and moves cwd. Bash stays pinned to the launch worktree. A command whose working directory is the agent's own new cwd is refused with:

this command's working directory resolved to the shared checkout

…even when that cwd is a linked worktree, not the shared checkout. Write to the original/launch path still succeeds. Result: a window where Bash can run nowhere the agent is standing.

Round-tripping EnterWorktree back to the launch worktree restores Bash (measured 2026-08-15).

Minimal sequence:

1. Session launched in worktree A (or the primary checkout).
2. EnterWorktree into a sibling / nested worktree B.
3. From B, run a trivial Bash command (pwd, echo hi) with cwd = B.
4. Observe the shared-checkout refusal naming B.
5. EnterWorktree back to A; Bash works again from A. From A, (cd B && <non-git>) still works; git -C B may still be refused depending on whether B is classified as the shared checkout.

Independent measurements: same refusal text six weeks apart (2026-08-15, 2026-09-03).

Related but not the same: #86020 (EnterWorktree moves cwd but not session root), #88082 (cwd becomes unresolvable; different refusal text).

2. ${VAR:-default} on a bare echo is "too complex"

Minimal command, no path, no git:

echo "${VAR:-default}"

Refused as too complex to verify that it stays inside the worktree. After a switch the same heuristic also refuses redirects, ; chains, and a git / .github token inside a cd subshell.

Negative control: Cursor Cloud echo "${UNSET_VAR:-default-value}" prints default-value and exits 0. This trip is Claude Code Bash-guard specific.

Related: #86340 (classifier abort refuses every Bash command as too complex in isolated sessions). This report's trip is narrower — a default-value expansion on an otherwise-plain echo — but it is the same guard family.

Expected

1. After EnterWorktree, Bash's notion of cwd follows the switch, or the refusal names the actual pin rather than calling the agent's real cwd "the shared checkout". Write and Bash must agree.
2. A non-git echo with ${VAR:-default} is simple enough to run.

Workaround we documented for agents
Do not EnterWorktree into a sibling — nest the worktree inside the launch tree instead. If already switched: EnterWorktree back to the launch worktree, then git -C "$WT" / (cd "$WT" && <non-git>). Expand ${VAR:-default} in a prior assignment or drop the :- form; do not wrap the echo in more syntax to "simplify" it.