Worktree isolation refuses a quoted heredoc whose body has a quote inside braces ("too complex to verify"), 2.1.280

Summary

In a worktree-isolated session (a background job, or a subagent pinned to a worktree), the Bash isolation check refuses a single cat > file <<'EOF' command whenever the heredoc body contains a quote character inside a { } pair. The delimiter is quoted, so bash never expands the body, and the command has no git, cd, or path outside the worktree root. The refusal is:

This session is isolated in the worktree …, but this command is too complex to verify that it stays inside the worktree. Refusing to run it …

It looks like the verifier parses the heredoc body as shell and misreads {"…"} as a brace group or expansion.

Minimal reproduction (Claude Code 2.1.280, Linux)

Each probe was run as one separate Bash tool call in the same worktree-isolated session. Only the heredoc body changes.

| Probe | Heredoc body | Result |
|---|---|---|
| A | x = dict(a=1) | runs |
| B | x = {"a": 1} | refused |
| C | x = {a: 1} | runs |
| E | print("a") | runs |
| F | {"name": "x"} | refused |
| D | x = dict(a=1), then echo done on the next line | runs |

The command shape in every probe:

cat > /tmp/probe/b.py <<'EOF'
x = {"a": 1}
EOF

Braces alone pass (C), and quotes alone pass (E). The refusal needs a quote inside braces (B, F).

Impact

The body is inert data here, and the content that trips the check is everywhere: any JSON object, Python dict, or JS object literal with a string key. In our sessions, a heredoc body with a quote inside braces accounts for about 46% of all "too complex to verify" refusals over 7 days (roughly 500 a week across main-loop and subagent sessions). Each refusal costs a turn and a retry through the Write tool.

Expected

A heredoc with a quoted delimiter (<<'EOF') should be treated as literal data when the isolation check decides whether the command stays inside the worktree. At minimum, the body's quote and brace characters should not make the command unverifiable.

Related (broader over-refusal reports): #90293, #90307.