Handoff stop refused by the worktree guard when its text contains git #854

New issue

Closed

opened 2026-09-30 17:59:06 +00:00 by jared · 2 comments

jared commented

2026-09-30 17:59:06 +00:00

Owner

Problem

In a worktree-isolated session, Claude Code refuses a Bash command when it cannot prove that the command does not run git. The check reacts to the word git anywhere in the command text, including inside a JSON argument. os-sdlc-subagent-stop takes its handoff as JSON on the command line or on stdin. When the handoff text names a git command, the stop call is refused. Bash-only agents (behavior-verifier, suite-check) have no Write tool, so they cannot move the payload into a file.

Observed

Implementation 16 (#852), behavior-verifier dispatch 128. The handoff item said "The git remote -v call is unchanged". Three forms were refused:

os-sdlc-subagent-stop --json '{"dispatch_id": 128, ...}'
cd <worktree> && os-sdlc-subagent-stop --json '...'
os-sdlc-subagent-stop <<'EOF' ... EOF

This session is isolated in the worktree /home/jared/dev/cc-os/.claude/worktrees/ticket-852, but this command runs os-sdlc-subagent-stop with the text {"dispatch_id": 128, "session_id":… in a plain command, so what it runs cannot be shown not to be git. Refusing to run it — a worktree-isolated session's git operations must target its own worktree.

The call passed after the agent replaced "git remote -v" with "the remote-listing call".

Reproduce

# in a session entered with EnterWorktree, from a Bash-only subagent:
os-sdlc-subagent-stop --json '{"dispatch_id": N, "summary": "git diff unchanged"}'

Origin

Trigger: /os-sdlc:implement 852, implementation 16, 2026-09-30.
Improvised this session: the orchestrator told each later agent to keep the word "git" out of its stop payload.
Chain: behavior-verifier cannot submit its handoff ← Bash guard refuses a command whose text contains git ← UPSTREAM-TOOL: Claude Code 2.1.285 worktree-isolation Bash check.
Root candidate: this ticket (a cc-os-side path that does not put handoff text in the command line)
Where: plugins/os-sdlc bin/os-sdlc-subagent-stop and the Bash-only agent definitions
Session: f090dd39-8ad6-4f4e-8743-7bbedb8f08d4
Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/f090dd39-8ad6-4f4e-8743-7bbedb8f08d4.jsonl

VERDICT: CREATE

## Problem In a worktree-isolated session, Claude Code refuses a Bash command when it cannot prove that the command does not run git. The check reacts to the word `git` anywhere in the command text, including inside a JSON argument. `os-sdlc-subagent-stop` takes its handoff as JSON on the command line or on stdin. When the handoff text names a git command, the stop call is refused. Bash-only agents (behavior-verifier, suite-check) have no Write tool, so they cannot move the payload into a file. ## Observed Implementation 16 (#852), behavior-verifier dispatch 128. The handoff item said "The git remote -v call is unchanged". Three forms were refused: ``` os-sdlc-subagent-stop --json '{"dispatch_id": 128, ...}' cd <worktree> && os-sdlc-subagent-stop --json '...' os-sdlc-subagent-stop <<'EOF' ... EOF ``` ``` This session is isolated in the worktree /home/jared/dev/cc-os/.claude/worktrees/ticket-852, but this command runs os-sdlc-subagent-stop with the text {"dispatch_id": 128, "session_id":… in a plain command, so what it runs cannot be shown not to be git. Refusing to run it — a worktree-isolated session's git operations must target its own worktree. ``` The call passed after the agent replaced "git remote -v" with "the remote-listing call". ## Reproduce ``` # in a session entered with EnterWorktree, from a Bash-only subagent: os-sdlc-subagent-stop --json '{"dispatch_id": N, "summary": "git diff unchanged"}' ``` ## Origin - Trigger: `/os-sdlc:implement 852`, implementation 16, 2026-09-30. - Improvised this session: the orchestrator told each later agent to keep the word "git" out of its stop payload. - Chain: behavior-verifier cannot submit its handoff ← Bash guard refuses a command whose text contains `git` ← UPSTREAM-TOOL: Claude Code 2.1.285 worktree-isolation Bash check. - Root candidate: this ticket (a cc-os-side path that does not put handoff text in the command line) - Where: plugins/os-sdlc bin/os-sdlc-subagent-stop and the Bash-only agent definitions - Session: f090dd39-8ad6-4f4e-8743-7bbedb8f08d4 - Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/f090dd39-8ad6-4f4e-8743-7bbedb8f08d4.jsonl VERDICT: CREATE

jared added the

plugin/os-sdlc

filed-by/agent

labels

2026-09-30 17:59:06 +00:00

jared referenced this issue

2026-09-30 17:59:12 +00:00

Replace the which lookup in os-backlog inspect with a PATH check #852

jared commented

2026-10-02 20:03:35 +00:00

Author

Owner

New evidence, 2026-10-02: the same refusal happened again.
Implementation 22 (#907), test-reviewer dispatch 193.
The handoff text quoted "git add exit 128".
The guard message, verbatim: "this command runs os-sdlc-subagent-stop with the text {"dispatch_id": 193, ...} in a plain command, so what it runs cannot be shown not to be git. Refusing to run it."
The agent retried with reworded text or file input, and the retry succeeded.
The refusal cost one extra orchestrator turn.
Prediction agents in the same session also hit the guard on compound and multi-line Bash commands.
This ticket also affects agents that have a Write tool, not only Bash-only agents.
A ticket about git behavior makes the problem likely, because its handoff text names git commands.
Guard source: the Claude Code worktree-isolation Bash check (upstream tool). No file under plugins/ holds the message text.

Session: 84a6f8a1-361d-47d8-8b1c-cd2e8f8dff33
Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/84a6f8a1-361d-47d8-8b1c-cd2e8f8dff33.jsonl

New evidence, 2026-10-02: the same refusal happened again. Implementation 22 (#907), test-reviewer dispatch 193. The handoff text quoted "git add exit 128". The guard message, verbatim: "this command runs os-sdlc-subagent-stop with the text {"dispatch_id": 193, ...} in a plain command, so what it runs cannot be shown not to be git. Refusing to run it." The agent retried with reworded text or file input, and the retry succeeded. The refusal cost one extra orchestrator turn. Prediction agents in the same session also hit the guard on compound and multi-line Bash commands. This ticket also affects agents that have a Write tool, not only Bash-only agents. A ticket about git behavior makes the problem likely, because its handoff text names git commands. Guard source: the Claude Code worktree-isolation Bash check (upstream tool). No file under plugins/ holds the message text. Session: 84a6f8a1-361d-47d8-8b1c-cd2e8f8dff33 Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/84a6f8a1-361d-47d8-8b1c-cd2e8f8dff33.jsonl

jared added the

category/owner-ruling

label

2026-10-10 13:31:56 +00:00

jared referenced this issue

2026-10-18 18:58:42 +00:00

Worktree command guard refuses pipeline agents' os-sdlc-subagent-stop calls #1096

jared commented

2026-10-18 18:59:24 +00:00

Author

Owner