Worktree isolation in a background session blocks subagents' Bash commands, even for other repos

What happened

In a background (claude --bg-style) job session, after the main agent called EnterWorktree to isolate its edits to one repository, the worktree-isolation guard also refused every Bash command from a subagent launched with the Agent tool, including pwd. The subagent had been asked to review a different repository and to run experiments in a scratch directory outside any git checkout.

The subagent reported, for each command:

session is isolated in the worktree <repo>/.claude/worktrees/<name> ... working directory resolved to the shared checkout

It could still read files, so it finished as a reading-only review; it could not run the test suite, the differential harnesses it was asked to use, or cross-assembly. Its verdict was therefore much weaker than intended, and nothing in the Agent tool's result made that visible until its report said so.

The main agent hit the same guard, less completely: while isolated in repo A's worktree, plain commands on a second repository or scratch path were refused whenever the command line contained a git/github substring, a $VAR path, or a loop (for example "this command names git in a form too complex to verify that it stays inside the worktree"). Every such command also affected paths such as ~/go/src/github.com/<org>/<repo>/..., where github is simply part of the path.

Expected

• The isolation guard should constrain a session's own git operations on the isolated repository, not all shell commands of subagents working elsewhere.
• A subagent should either inherit a usable working directory (its own worktree, or the path it is told to use) or be told up front that its shell is blocked, so the delegating agent can react.
• A path component named github.com should not count as invoking git.

Repro

1. Start a background job session in repo A (a git checkout).
2. Call EnterWorktree so the session is isolated in a worktree of repo A.
3. Launch a subagent (Agent tool) whose task is to run commands in repo B, or in a scratch directory under the job's tmp dir, for example go test ./... in a copy of repo B.
4. Every Bash call from the subagent is refused with the isolation message above, even pwd.

Workaround: call ExitWorktree (keep) before delegating, and EnterWorktree with path afterwards.

Environment

• Claude Code 2.1.285, Linux, background job session
• Subagent type: general-purpose, run in the background