The system that prevents worktree-isolated agents from writing outside their assigned worktree has been substantially rewritten to handle complex path forms that could previously bypass containment.
New protections:
- UNC shares (Windows
\\server\sharepaths) are detected and blocked when the session root is local /net/automount paths (Linux/macOS NFS automounts) are recognized and normalized- Apple
/System/Volumes/Data/paths are remapped to their real root - Paths with raw dot-segments that survive
path.normalizeare blocked - Windows paths with trailing dots or spaces (a Windows security concern) are detected
- Device namespace paths (
\\?\) are unwrapped or blocked as appropriate - Symlink resolution now iterates up to 8 rounds to reach a stable canonical form
Error messages are more specific. For example, a network-shaped path against a local checkout says: > This write was blocked because the path is network-shaped (a UNC share or /net automount spelling) while this session's checkout is local.
A path that can't be safely resolved says: > This write was blocked because the path is spelled in a form that cannot be safely resolved (for example through a symlink storing a raw dot segment, a network-share or device-namespace shape, or an unreadable ancestor directory).
Commands run by worktree-isolated agents now get a more specific rejection if their working directory resolves outside the worktree due to letter-case mismatch: "(this path differs from the registered spelling only by letter case — respell it to match exactly)".
Path resolution (search for "resolves-to-trailing-dot-or-space") and network-shaped block (search for "network-shaped (a UNC share")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.