Worktree-isolated subagent cannot create a directory link: cmd/powershell refused, Git Bash ln -s silently deep-copies (FB-033)

---
id: FB-033
class: isolated-worktree-subshell-refusal
model: harness (Claude Code Agent tool, isolation: worktree)
severity: LOW
status: open
written: 2026-09-28
source: decisions/2026-09-28_rolling_questions.md (the RECORD ~17:5xZ; the fe-fixpack-pair5b seat's process note at 17:1xZ)
---

FB-033 -- isolated-worktree-subshell-refusal

Finding. A background subagent spawned with isolation: "worktree" cannot create a directory link in its own worktree through a subshell: both cmd /c mklink /J <link> <target> and powershell.exe -Command New-Item -ItemType Junction ... are refused by the sandbox with the same message ("isolated worktree, cannot verify what cmd/powershell runs"), and the refusal is not specific to the link verb. On Windows under the Bash tool's Git Bash, the natural fallback ln -s <target> <link> silently creates a DEEP COPY of the target directory instead of a link (os.path.islink False), so a seat that trusts it copies a node_modules tree of hundreds of MB into its worktree and then runs its tests against the copy.

Evidence (measured). 2026-09-28 17:1xZ, seat fe-fixpack-pair5b (terminal-frontend, worktree isolation): two refusals (cmd /c, then powershell.exe -Command), one ln -s deep copy caught by os.path.islink before any test ran and removed; the working mechanism was Python os.symlink(target, link, target_is_directory=True) from the same seat (islink True, realpath resolving to the main tree's node_modules). The seat stopped retrying after the second denial per this project's two-denial rule and disclosed the path it took.

Why it matters. A worktree has no node_modules (and no venv), so every frontend seat needs a link to the main tree's copy before it can run vitest or tsc. The refusal is silent about the allowed alternative, and the Git Bash ln -s behaviour makes the obvious workaround a trap (a deep copy that looks like success).

Ask. (1) A documented, permitted way to create a directory link inside an isolated worktree (a first-class Bash-tool affordance, or an explicit note that Python's os.symlink is the sanctioned path). (2) The refusal message names what IS allowed. (3) A note in the Windows guidance that ln -s under Git Bash copies directories unless MSYS symlink mode is enabled.

Refresh. Append dated evidence below; never rewrite the measured history.