{"version":"2.1.222","anchor":"shell-tools-get-an-explicit-worktree-isolation-root","canonical_anchor":"shell-tools-get-an-explicit-worktree-isolation-root","heading":"Shell tools get an explicit worktree isolation root","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222\/e\/shell-tools-get-an-explicit-worktree-isolation-root","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.222","markdown":"### Shell tools get an explicit worktree isolation root\n\nAgent commands now have a concrete worktree boundary, so escapes get blocked with a clearer log line.\n\n**What**\n\nBash and shell execution paths now take an `isolationRoot` so the checks that keep agent commands inside their worktree have a concrete boundary to compare against.\n\n**Details**\n\n- `isolationRoot` is resolved from the agent worktree, falling back to the session worktree path.\n- Used by the checks that block commands whose cwd escapes the isolation worktree, and those that redirect git into the shared checkout.\n- Blocked commands log with `isolationRoot=` in the message and report `tengu_agent_worktree_cwd_escape_blocked`.\n- The field itself is new in this build.\n\n**Evidence**\n\n`isolationRoot`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}