using-worktrees — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-worktrees (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Git worktrees create isolated workspaces sharing the same repository, allowing work on multiple branches simultaneously without switching.
Core principle: Systematic directory selection + safety verification = reliable isolation.
This skill covers git worktree setup, lifecycle, and known limitations for rageatc-code-oss workflows. It does NOT cover process-level isolation (Docker sandboxes), CI/CD pipeline isolation, or worktree usage outside of chunk-based development.
The orchestrator creates and manages worktrees manually using git worktree add, then points developer-agents to the worktree directory.
Why manual, not automated: Claude Code's isolation: "worktree" subagent frontmatter has critical open bugs (as of early 2026) — permission bypass doesn't work, and silent data loss on cleanup has been reported. The manual approach is reliable. See Known Limitations below.
Orchestrator:
1. git worktree add <path> -b <branch>
2. Run setup in worktree
3. Launch developer-agent pointed at worktree path
4. After review + accept: merge branch, remove worktreeFollow this priority order:
ls -d .worktrees 2>/dev/null # Preferred (hidden)
ls -d worktrees 2>/dev/null # AlternativeIf found: Use that directory. If both exist, .worktrees wins.
grep -i "worktree.*director" CLAUDE.md 2>/dev/nullIf preference specified: Use it.
If no directory exists and no CLAUDE.md preference:
No worktree directory found. Where should I create worktrees?
Recommended: .worktrees/ (project-local, hidden)MUST verify before creating any project-local worktree:
git check-ignore -q .worktrees 2>/dev/nullIf NOT ignored:
.worktrees/ to .gitignoreWhy critical: Prevents accidentally committing worktree contents to repository.
# Name branch after chunk for traceability
git worktree add .worktrees/chunk-003 -b chunk-003/recipe-serviceAuto-detect and run appropriate setup:
# Node.js
if [ -f package.json ]; then npm install; fi
# Rust
if [ -f Cargo.toml ]; then cargo build; fi
# Python
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
if [ -f pyproject.toml ]; then poetry install; fi
# Go
if [ -f go.mod ]; then go mod download; fiRun tests to ensure worktree starts clean:
# Use project-appropriate command
npm testIf tests fail: Report failures, ask whether to proceed or investigate.
If tests pass: Worktree is ready for the developer-agent.
Orchestrator launches developer-agent with the worktree path as the working directory.
# Merge the chunk branch back to main
git checkout main
git merge chunk-003/recipe-service
# Clean up
git worktree remove .worktrees/chunk-003
git branch -d chunk-003/recipe-service# Discard the worktree — main is untouched
git worktree remove --force .worktrees/chunk-003
git branch -D chunk-003/recipe-serviceProblem: Developer-agents running in worktrees via isolation: "worktree" subagent frontmatter may not be able to run bash commands (tests, git commit). The permissionMode: "bypassPermissions" flag is broken in this context (GitHub #29110, open as of early 2026).
Workaround: If the developer-agent reports BLOCKED due to permission issues:
Problem: Worktrees created via isolation: "worktree" can be silently deleted during cleanup, destroying uncommitted work with no warning.
Prevention: Always commit work before exiting a worktree session. The manual git worktree add approach avoids the auto-cleanup behaviour entirely.
background: true and isolation: "worktree" do not currently work together — background agents run in the main repository regardless of isolation setting.
The isolation: "worktree" frontmatter generates opaque branch names (worktree-agent-{hash}). Manual worktree creation avoids this — name branches after chunks for traceability.
| Scenario | Recommendation |
|---|---|
| Quick workflow (1-3 files) | Branch — simpler, no setup overhead |
| Standard workflow (sequential chunks) | Worktree per chunk — isolation without switching |
| Thorough workflow (parallel chunks) | Worktree per chunk — enables true parallelism |
| Single developer, small project | Branch may suffice — worktree overhead not always justified |
| Situation | Action |
|---|---|
.worktrees/ exists | Use it (verify ignored) |
worktrees/ exists | Use it (verify ignored) |
| Both exist | Use .worktrees/ |
| Neither exists | Check CLAUDE.md → ask user |
| Directory not ignored | Add to .gitignore + commit |
| Tests fail during baseline | Report failures + ask |
| No package.json/Cargo.toml | Skip dependency install |
| Agent can't run bash in worktree | Orchestrator runs tests/commits from main session |
Never:
isolation: "worktree" with permissionMode: "bypassPermissions" (broken)isolation: "worktree" with background: true (ignored)Always:
isolation: "worktree" frontmatter without awareness of permission bugs.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.