Worktree-isolation Bash check folds command substitutions in quoted-delimiter heredoc bodies but refuses braces there, though such bodies cannot expand

> **Version scope of this report.** Every observation in the probe table below is an
> observation of **specific builds at specific dates** — reporter: Claude Code 2.1.238
> (2026-08-24, from the environment block of the originating report), maintainer
> reproduction sessions: 2026-09-07 (build not recorded) and **2026-09-08 on 2.1.263**
> (fresh observation, refusal text byte-identical). Behavior in other builds is not
> asserted; if a later build has changed this, the report should be read as historical.

**Environment**: Claude Code worktree-isolated session (macOS, worktree under the
project's `.claude/worktrees/`). Originally reported against `moai-adk` by jjjh7401
(https://github.com/modu-ai/moai-adk/issues/1659, filed 2026-08-26) and reproduced
independently by the moai-adk maintainers — including a fresh reproduction on
2.1.263 the day this report was submitted.

## The asymmetry, measured

Paired probes in a worktree-isolated session, differing ONLY in the heredoc body's
content:

| # | Command shape | Result |
|---|---|---|
| 1 | `cat > target <<'EOF'` whose body line is a brace-wrapped JSON pair, e.g. `{"key": "value"}` | **Refused** — `This session is isolated in the worktree …, but this command is too complex to verify that it stays inside the worktree.` The command never executed (the target file was confirmed absent afterward). Re-confirmed 2026-09-08 on 2.1.263; the refusal also fired when the target was **outside** the worktree (`/tmp/…`), so the verdict does not depend on the target path. |
| 2 | Same heredoc shape; the body line instead contains a command substitution, e.g. `value: $(echo x)` | **Executed** — exit 0, the body written through verbatim (quoted-delimiter semantics preserved). Observed 2026-09-07. |

The refusal's own remediation ("Split it into plain, separate commands") does not
apply naturally here: the command IS plain — a single `cat` with a heredoc — and the
offending content is inert body text.

## Why the brace form is provably inert

For a quoted delimiter (`<<'EOF'`), POSIX/bash performs **no expansion of any kind**
inside the body: no parameter expansion, no command substitution, no arithmetic
expansion, no brace expansion. A brace character in such a body is a literal
character and cannot be brace expansion. The guard itself already relies on this
fact: probe 2 shows it folds a command substitution appearing in exactly that
position. Refusing braces in the same position is therefore internally inconsistent —
the analyzer treats one inert construct as folded data and another as live syntax.
(This argument and the original observation are jjjh7401's, from
https://github.com/modu-ai/moai-adk/issues/1659 — credited here as the source.)

Note the asymmetry does NOT ask for any change to **unquoted**-delimiter bodies
(`<

Start with the worktree-isolation Bash check and reproduce the quoted-delimiter heredoc probes described in the issue, including the brace body and command-substitution body. Trace how the analyzer classifies heredoc contents, then verify that quoted-body braces are handled consistently or that the refusal identifies the offending construct without changing unquoted-heredoc behavior.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.