One read of Claude Code CLIclaude-code-20261110T003702Z
4 pages moved out of 228 read.
Pages moved
4
significant first
Pages read
228
in this capture
Captured
00:37 UTC
Corpus hash
25a1816ea935
corpus-hash
What this read moved
1-4 of 4sandboxing Changed · +4 / -0 lines
### A git command fails with `Unable to create '…/index.lock'`
from line 899
899899
900900After the failure, Claude may [offer to rerun the command outside the sandbox](#the-unsandboxed-retry-escape-hatch). Approve that retry, or run the git command yourself in another terminal. If you've set `allowUnsandboxedCommands` to `false`, Claude can't offer the retry, so run the command yourself.
901901
902### A git command fails with `Unable to create '…/index.lock'`
903
904If you started Claude Code in a repository's subdirectory, this error can mean `.git` is outside [what sandboxed commands can write to](#filesystem-isolation). Start Claude Code from the repository root instead, or from the worktree's root in a [linked worktree](https://code.claude.com/docs/en/worktrees.md).
905
902906### A folder named `objects` or `refs` disappears after a command
903907
904908A top-level `objects` or `refs` folder that appeared during the session can be [deleted after a sandboxed command ends](#when-the-sandbox-deletes-head-objects-or-refs). It doesn't matter whether a command, Claude, or you created it. To keep a folder, leave something in it. If a `HEAD` file or symlink has been at the top level during the session, move it away, then restart every Claude Code session open there.
self-hosted-environments-configuration Changed · +7 / -5 lines
from line 231
231231set -u
232232export GIT_ALLOW_PROTOCOL=${GIT_ALLOW_PROTOCOL:-https:http:ssh}
233233IFS=':'
234rc=0 # becomes 1 when a step fails; a non-zero exit makes the runner log it
234235# -c overrides beat repo-local settings, blocking session-written fsmonitor,
235236# hook-path, and gpg-program config from executing code with the hook's
236237# privileges. -c commit.gpgsign=false also leaves these rescue commits
from line 242
241242g() { git -c core.fsmonitor=false -c core.hooksPath=/dev/null \
242243 -c commit.gpgsign=false "$@"; }
243244for ws in $CLAUDE_RUNNER_WORKSPACE_PATHS; do
244 cd "$ws" 2>/dev/null || continue
245 [ -z "$(g status --porcelain 2>/dev/null)" ] && continue
246 g add -A
247 g commit -q -m "runner snapshot: $CLAUDE_RUNNER_SESSION_ID ($CLAUDE_RUNNER_EXIT_REASON)" || continue
248 g push -q origin "HEAD:refs/heads/rescue/$CLAUDE_RUNNER_SESSION_ID" || true
245 cd "$ws" || { rc=1; continue; }
246 g add -A || rc=1
247 g diff-index --cached --quiet HEAD && continue # nothing to save
248 g commit -q -m "runner snapshot: $CLAUDE_RUNNER_SESSION_ID ($CLAUDE_RUNNER_EXIT_REASON)" || { rc=1; continue; }
249 g push -q origin "HEAD:refs/heads/rescue/$CLAUDE_RUNNER_SESSION_ID" || rc=1
249250done
251exit "$rc"
250252```
251253
252254The `GIT_ALLOW_PROTOCOL` line in the script limits git to HTTPS, HTTP, and SSH remotes. If the runner's environment already sets a non-empty `GIT_ALLOW_PROTOCOL` list of its own, the script keeps that list.
github-actions Changed · +1 / -0 lines
from line 131
131131| Merge queues | Read |
132132| Metadata | Read |
133133| Pull requests | Read and write |
134| Repository creation | Read and write |
134135| Repository hooks | Read and write |
135136| Statuses | Read |
136137| Workflows | Read and write |
worktrees Changed · +1 / -1 lines
from line 249
249249
250250A worktree gets its own files and branch, but it shares the following with the main checkout:
251251
252* **The repository's `.git` directory**: git commands in a worktree write to the main repository's shared `.git` directory, and [sandboxing](https://code.claude.com/docs/en/sandboxing.md#filesystem-isolation) allows those writes, so commands such as `git commit` work from inside a worktree with the sandbox enabled.
252* **The repository's `.git` directory**: git commands in a worktree write to the main repository's shared `.git` directory. With the [sandbox](https://code.claude.com/docs/en/sandboxing.md#filesystem-isolation) enabled, commands such as `git commit` work in a session at the worktree's root, which is where `--worktree` starts one. By default, they [fail with an `index.lock` error if you run `claude` in a subdirectory of the worktree](https://code.claude.com/docs/en/sandboxing#git-index-lock).
253253* **Plugins**: plugins installed at [project scope](https://code.claude.com/docs/en/plugins/loading.md#find-where-a-plugin-is-enabled) from the main checkout also load in worktrees of the same repository, so you don't need to reinstall them per worktree.
254254* **Permission approvals**: choosing "Yes, and don't ask again" for a Bash command in a worktree session saves the rule to the main checkout's `.claude/settings.local.json`. The rule applies in the main checkout and in every other worktree of the repository, and it survives the worktree's removal.
255255