Probe the checkout boundary, not merely worktree creation
Use when.
Claude
Code
delegates
modifying
work
to
subagents
configured
with
isolation:
worktree
especially
when
agents
run
concurrently,
create
branches,
stash,
reset,
or
receive
prompts
containing
absolute
paths
into
the
parent
checkout.
Action.
Set
the
deployment
floor
to
Claude
Code
2.1.210
or
later.
Before
re-enabling
parallel
writers,
use
a
disposable,
clean
clone.
Record
git
rev-parse
HEAD
plus
git
branch
--show-current
and
git
status
--porcelain=v1
from
the
main
checkout.
Dispatch
one
modifying
subagent
with
isolation:
worktree
ask
it
to
create
and
commit
a
sentinel
inside
its
temporary
worktree,
then
deliberately
ask
it
to
attempt
git
-C
<absolute-main-checkout>
switch
-c
isolation-escape-probe
Finally,
inspect
git
worktree
list
--porcelain
and
repeat
the
three
main-checkout
readings.
snapshot
parent
→
mutate
child
→
attempt
parent
escape
→
compare
both
trees
Acceptance check. The child’s sentinel and commit exist only on its worktree branch; the escape command is rejected or has no effect; and the parent’s branch, HEAD, index, tracked files, and porcelain status exactly match the recorded baseline. Any new parent branch, status entry, reflog movement, or missing child commit blocks rollout.
2.1.210
release
explicitly
fixes
worktree
subagents
running
Git-mutating
commands
against
the
main
checkout.
The
linked
public
failure
report
includes
exact
tool-call
records
from
2.1.119
and
2.1.126
parent
HEAD
switches,
empty
child
branches,
lost
files,
and
two
escapes
among
four
parallel
agents.
Current
official
documentation
states
that
worktree-isolated
subagent
commands
run
inside
that
worktree.
Caveat. The release note names Git-mutating commands, not a complete filesystem sandbox, and Anthropic publishes no regression-test output for this closed-source fix. Absolute Read, Edit, or Write paths therefore still deserve separate probes. Keep the destructive escape test disposable, and avoid parent-checkout absolute paths in normal subagent briefs.