Worktree-isolated subagents launched from a worktree session can't Write/Edit their own worktree (guard resolves the parent's worktree root)

Summary

Subagents launched with Agent(..., isolation: "worktree") from a session that is itself running in a git worktree cannot write files in their own isolated worktree. The Write/Edit worktree guard resolves the "session worktree" to the parent session's worktree root, calls the subagent's own isolated worktree "the base repo checkout", refuses the write, and suggests a redirect path under the parent's worktree that does not exist. At the same time the Bash guard correctly identifies the subagent as isolated in its own worktree and refuses heredoc writes there as "too complex". Together they leave the subagent no sanctioned way to edit files.

Environment

• Claude Code 2.1.274, desktop app (Code tab), macOS (Darwin 27)
• Parent session cwd: a git worktree nested under the repo, e.g. <repo>/apps/hoa/.claude/worktrees/<parent-worktree>
• Subagents created with isolation: "worktree" land in <repo>/.claude/worktrees/agent-<id> (a separate, locked worktree on its own branch; git rev-parse --show-toplevel inside it returns that path)

Steps to reproduce

1. Start a session whose working directory is a git worktree (not the main checkout).
2. From it, launch a subagent with isolation: "worktree".
3. In the subagent, Write or Edit any file inside its own worktree.

Expected

The write succeeds: the subagent's isolated worktree is exactly where it is meant to edit.

Actual

• Write/Edit is refused: the guard says the file is in "the base repo checkout" and suggests an equivalent path under the parent's worktree root (<repo>/apps/hoa/.claude/worktrees/<parent-worktree>/...), which does not exist.
• Bash heredoc writes in the same worktree are refused as too complex.
• Reproduced by 9 of 9 concurrently launched worktree-isolated subagents in one session.

Workaround

Write patch scripts/files into the session scratchpad (allowed), then apply them into the subagent worktree with a plain python3 script.py / cp Bash call.

Related

#87890 (EnterWorktree not propagating to PreToolUse hooks). This report is the Agent-tool isolation: "worktree" case, where the guard picks the parent session's worktree instead of the subagent's.