The Worktree That Reached Into the Trunk

Claude Code's desktop app uses a worktree mechanism meant to give an AI-assisted coding session its own isolated copy of a Git repository, separate from the developer's actual working files. During one such session, three gitignored directories (two Python virtual environments and a cloned third-party repository with local patches) were deleted from the main working tree, not the isolated worktree. Sibling directories covered only by a broader wildcard pattern in .gitignore were untouched; only the ones matched by literal, specific path entries were removed.

Coincidental data loss unrelated to the worktree feature, considered and ruled out; the timestamps line up precisely, with the main repo's HEAD moving to a detached state at 18:19 and the three directories emptied six to ten minutes later, right before the worktree's own directory was updated.

A deliberate cleanup action gone too broad, considered and ruled out; nothing in the available logs shows the agent being asked to clean up or remove any files, gitignored or otherwise, during this operation.

Apraxia (the tool understood its purpose (keeping a session's changes isolated) but the actual mechanism for doing so misfired), most consistent with the evidence. The selective pattern, hitting only literal-path .gitignore entries while sparing wildcard-matched ones, points to an isolation mechanism that mishandled a specific class of file reference rather than a decision the agent made about what to delete.

The whole promise of an isolation feature is that failures inside it stay inside it, this incident is dangerous precisely because it broke that promise silently, with no error at the time and a production pipeline that only revealed the damage later by quietly falling back to a legacy code path. The safeguard isn't more caution from the person using the tool; it's making the isolation boundary itself provably safe for anything outside it, gitignored or not, rather than assuming ignored files are safe to touch.

Make the isolation boundary provably safe for everything outside it, ignored files included.

Isolation testing; no deletes outside the worktree; detection of fallbacks to legacy code paths.