[BUG] --worktree session enforces the launch checkout's permission rules instead of the worktree's .claude/settings.json

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a session is started with claude --worktree <name> from a checkout whose .claude/settings.json differs from the one in .claude/worktrees/<name>, the session enforces the launch checkout's permission rules. The worktree's own SessionStart hooks do run, and $CLAUDE_PROJECT_DIR, the cwd and the SessionStart payload's transcript_path all name the worktree, but the transcript file is written under the launch checkout's project directory.

What Should Happen?

A session running in a worktree enforces that worktree's settings, as in step 3

Error Messages/Logs

Steps to Reproduce

1. In a repo, git worktree add -b worktree-probe .claude/worktrees/probe.In a repo, git worktree add -b worktree-probe .claude/worktrees/probe.
2. In .claude/worktrees/probe/.claude/settings.json only, add "permissions": {"deny": ["Bash(echo probe:*)"]}.
3. cd .claude/worktrees/probe && claude, ask it to run echo probe ran → refused by the deny rule (expected).
4. From the repo root: claude --worktree probe, ask the same → not refused; with auto mode it goes to the classifier and runs.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.283 (also seen on 2.1.259)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_