Worktree-isolation Bash check matches "git" inside other words (legit, digit) when a command has $(), a loop or a heredoc

What happens

In subagents spawned with isolation: "worktree", the Bash tool refuses commands with "git in a form too complex to verify … stays inside the worktree" when the command contains a $() substitution, a for loop or a heredoc and the letters g-i-t appear anywhere in the text, including inside unrelated words. The check appears to fall back to a raw substring search for "git" once the command is too complex to parse.

Repro (inside a worktree-isolated subagent)

| Command | Result |
|---|---|
| echo $(echo legit) | refused |
| echo $(echo hello) | runs |
| for w in legit; do echo $w; done | refused |
| for w in hello; do echo $w; done | runs |
| echo legit | runs |
| curl -s https://example.com/legit \| head -c 80 | runs |

The same happens with other words such as digit, and "git" inside heredoc bodies or --body text of unrelated commands.

Expected

Only an actual git command word (at a command position, e.g. start of a pipeline segment, after &&, ;, |, $(, or as git -C …) should trigger the git-verification check. A substring of another word should not.

Impact

Any project whose domain names, hostnames or file names contain those letters trips the check on every scripted step. Agents have to rewrite commands as separate script files. We hit it dozens of times in two days. The docs say the check can't be turned off ("You can't turn this check off"), which is fine — the ask is only that it not match "git" inside other words.

Environment

• Claude Code 2.1.285, macOS (Darwin 24.6.0)
• Subagents spawned via the Agent tool with isolation: "worktree"