Stricter git command checks keep worktree sessions out of the shared checkout

What

A worktree is a separate copy of a git project's files where Claude Code can work without touching your main copy, called the shared checkout. Claude Code checks git commands before running them, and those checks now cover much more.

• Flags that write to a file path count as writes in permission checks for more git subcommands: bugreport, diagnose, index-pack, mailsplit, daemon --pid-file, credential-store --file, filter-branch -d, fast-export and fast-import. Before, only archive and format-patch with -o were covered.
• GIT_WORK_TREE and --work-tree pointed at the shared checkout are refused.
• Running git from above the shared checkout, where its arguments can reach it, is refused.
• --prefix and other write options that land in the shared checkout are refused.
• Commands that hand text naming git to a shell, and exported program names, are refused.
• Changes to git configuration outside an allowed list are refused.
• Options that run outside programs are refused: --upload-pack, --exec, and ext:: and fd:: addresses.
• Output-path flags such as --output and --file are refused.
• --ignore-other-worktrees, git worktree add --force, fetch --update-head-ok, fast-import --allow-unsafe-features and apply --unsafe-paths are refused.

Each refusal comes with a message saying what to do instead.

Why

A session working in its own worktree can no longer use git to change the shared checkout or to run other programs through git options. Some git commands that ran before may now be refused or need your permission.