Edit tool refuses writes under a .git/ directory in acceptEdits, with --add-dir and an explicit allow rule; behaviour is undocumented

Summary

In acceptEdits mode, with the directory passed via --add-dir (and listed in permissions.additionalDirectories), and even with an explicit matching Edit(//abs/path/file.md) allow rule, the Edit tool refuses to write a file whose path is under a .git/ directory. The same write to a path outside .git/ succeeds. I could not find this behaviour documented.

Context: our orchestration keeps per-worktree agent record files at <repo>/.git/worktrees/<name>/herdr/ (a place git never tracks). Every write there raises a permission dialog despite the mode and rules, so an unattended agent cannot write its own report.

Reproduction (headless, Haiku; 2.1.289 (Claude Code))

S=$(mktemp -d); mkdir -p "$S/plain/herdr" "$S/repo"; (cd "$S/repo" && git init -q && mkdir -p .git/worktrees/X/herdr)
printf 'alpha\n' > "$S/plain/herdr/report.md"; printf 'alpha\n' > "$S/repo/.git/worktrees/X/herdr/report.md"
echo '{}' > "$S/s0.json"

# A: plain path — allowed
claude -p "Use the Edit tool to replace the word alpha with beta in $S/plain/herdr/report.md. Reply done or blocked." \
  --permission-mode acceptEdits --add-dir "$S/plain/herdr" --settings "$S/s0.json" --output-format json | jq -r .result
cat "$S/plain/herdr/report.md"          # beta

# B: same thing under .git/ — blocked
G="$S/repo/.git/worktrees/X/herdr"
claude -p "Use the Edit tool to replace the word alpha with beta in $G/report.md. Reply done or blocked." \
  --permission-mode acceptEdits --add-dir "$G" --settings "$S/s0.json" --output-format json | jq -r .result
cat "$G/report.md"                      # alpha

# C: B plus an explicit allow rule and additionalDirectories — still blocked
printf '{"permissions":{"allow":["Edit(//%s/report.md)"],"additionalDirectories":["%s"]}}' "${G#/}" "$G" > "$S/s2.json"
claude -p "Use the Edit tool to replace the word alpha with beta in $G/report.md. Reply done or blocked." \
  --permission-mode acceptEdits --add-dir "$G" --settings "$S/s2.json" --output-format json | jq -r .result
cat "$G/report.md"                      # alpha

Observed: A writes beta; B and C leave alpha and the model reports blocked. Control: default mode with no rule on the plain path is also blocked, so A is not a false positive. Both //abs and ///abs rule spellings matched in the plain-path case, so rule shape is not the cause.

Expected

Either the write is allowed when the mode and rules permit it, or the .git/ protection is documented (and ideally reported in the denial message) so tooling can keep its state elsewhere by design rather than by discovery.

Environment

macOS (Darwin 25.2), 2.1.289 (Claude Code), headless claude -p, model claude-haiku-4-5-20251001.