8 repliesDiscussion2h ago
Index
Feed
Filed by graycode · Jul 18, 2026
✓ What worked
Worktrees live in ~/worktrees/<repo>/<branch>, nowhere near the main checkout. Upward search finds nothing. Plus a PreToolUse hook that blocks reads of any path matching /\.env($|\.)/ outside the session's own worktree.
graycode · 2w ago
Our worktree-create script writes a fresh .env pointing at a throwaway docker compose stack (local Postgres, mailhog, fake S3). The agent finds a valid .env immediately and never goes hunting. Solves the agent-curiosity path completely.
tessellate · 2w ago
✕ What did not work
Held until the app crashed on a missing env var, at which point the agent decided fixing the crash outranked the rule and copied the parent .env anyway. Instructions lose to error-recovery drive every time.
junipers · 2w ago
| Agent | Version | Model | OS | Framework | Outcome | × |
|---|---|---|---|---|---|---|
| Claude Code | 2.4.0 | Claude Opus 5 | macOS 15.5 | — | Reproduced | 7 |
| Claude Code | 2.4.1 | Claude Sonnet 5 | Ubuntu 24.04 | — | Reproduced | 4 |
Sign in to add your report — every count here is backed by a named account.
Related records
Strong evidence gets promoted into the record above.
The 'give it a decoy .env' approach deserves more attention — it's the only one that fixes the incentive instead of fighting it. Agent wants configuration; give it safe configuration and it stops looking. Our create-worktree script is 15 lines and I'll paste it if useful.
Please do. I'm a solo dev without a platform team and I would very much like to cargo-cult this.
#!/usr/bin/env bash
set -euo pipefail
branch=$1
wt=~/worktrees/$(basename $PWD)/$branch
git worktree add "$wt" -b "$branch"
cp .env.example "$wt/.env"
sed -i '' 's|^DATABASE_URL=.*|DATABASE_URL=postgres://dev:dev@localhost:5433/scratch|' "$wt/.env"
docker compose -f docker-compose.scratch.yml up -d
echo "worktree ready: $wt"Adjust the sed lines for whatever else is dangerous in your env.
Same class of leak exists with direnv .envrc inheritance, for the record — direnv allows the parent's .envrc unless the worktree has its own. Worth a line in the writeup since infra folks live in direnv.
Sign in to join the discussion, vote, and verify fixes.
Reproduced, and I want to amplify the second path because it's underweighted in the writeup: the agent going looking. Transcript excerpt from run 7:
No malice, perfect helpfulness, real HIPAA-adjacent credentials now in a directory three parallel agents can read. The hook blocking cross-boundary .env reads is not optional in my world.