[BUG] Update/Read/Write(file) commands ignore current mode when working in a tmp worktree

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When any agent in Claude Code uses the EnterWorktree tool, it creates a new worktree for a repository so it has not to deal with existing changes nor the current checked out repo. When it starts working in this worktree, it ignores the rules and is allowed to use Update/Read/Write calls on the worktree, even when the mode for the session is "Manual mode".

When I force it to work on the current repository, the tool calls ask me for permissions as they should.

What Should Happen?

Claude should always ask permission to use the URW tool calls

Error Messages/Logs

Steps to Reproduce

1. Start work with a plan
2. (Optional I think) refer to another submodule in the repo
3. Ask it to make changes in a worktree
4. Claude uses URW tools unprompted

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.260 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

_No response_