Git worktrees are not an isolation boundary for coding agents
4 hours ago
- Git worktrees share refs, config, stash, and hooks with the parent repository, making them insecure for parallel coding agents.
- An agent in a worktree can install hooks that execute on the host, rewrite commit authorship, or modify shared refs and stash.
- Worktrees only isolate HEAD, the index, and working directory, not config, hooks, refs, or stash.
- Mitigations like per-worktree config or hooksPath are ineffective because they rely on the agent opting in.
- A git clone with --shared provides true isolation for refs, config, stash, and hooks at the same disk cost as a worktree.
- Local clones hardlink objects and add only the working tree size, making them as fast and cheap as worktrees.
- Worktrees are appropriate only for single-user, supervised use; clones are necessary for uncoordinated agents.
- Using --shared clone avoids footguns like branch collisions, hook execution, and stash interference between agents.