claude-code - 💡(How to fix) Fix Bash tool SIGBUS in .claude/worktrees/ via Helpers/disclaimer provenance-pid chain (Claude Desktop 1.8089.1)

Summary

After Claude Desktop updated to v1.8089.1 (May 19 ~18:36 PT), running mutating git operations from the Bash tool — git rebase, git stash, git checkout, git reset, git read-tree — against a feature branch checked out in a git worktree under .claude/worktrees/ started dying with SIGBUS (exit 138, signal 10) mid-write. The crashes leave the worktree's branch ref (.git/refs/heads/<branch>) and gitdir (.git/worktrees/<name>/gitdir) truncated to zero bytes while still showing their original byte count via ls, which permanently corrupts the worktree's registration. Because .git/ is shared across worktrees, the corruption is also visible to concurrent Claude Code sessions working in sibling worktrees — they see broken refs and "short read" errors during git worktree prune.

The previous Claude Desktop version (running on the same macOS + same repo) did not exhibit this. Pre-existing files in the main checkout were already getting com.apple.provenance xattr attached before the update, so the xattr stamping isn't new, but the enforcement on mmap() reads of those files appears to have flipped on with v1.8089.1.

Root cause hypothesis

The Bash tool subprocess lineage (captured live during the incident):

zsh (Bash tool subprocess)
  └── claude (Claude Code 2.1.142) at ~/Library/Application Support/Claude/claude-code/2.1.142/...
       └── /Applications/Claude.app/Contents/Helpers/disclaimer
            └── /Applications/Claude.app/Contents/MacOS/Claude  (pid 19243)
                 └── launchd

The Contents/Helpers/disclaimer wrapper between Claude Desktop and the Claude Code CLI sets the "responsible process" for the entire subtree to Q6L2SF6YDW.com.anthropic.claudefordesktop. macOS then auto-stamps every file the Bash tool writes with com.apple.provenance. I verified this live: echo test > /private/var/tmp/sandboxtest in this Bash session produces a file with the @ xattr indicator and com.apple.provenance attached.

Subsequent operations that mmap() those provenance-tagged files (which is exactly what git does for refs, the index, and pack files) intermittently return 0 bytes silently or kill the process with SIGBUS — depending on which sandbox enforcement path the kernel takes. xattr -d com.apple.provenance silently no-ops because the responsible app can't modify provenance metadata that flows back to itself.

The most likely v1.8089.1 change that introduced this:

• A new (or stricter) seatbelt profile for disclaimer-wrapped subprocesses, or
• An Electron / Chromium bump (current shows 41.6.1) altering how renderer-spawned utility children are sandboxed, or
• A new responsible-pid chain that didn't exist in the prior version's Bash tool path.

Impact

In a single session today this caused:

• A failed git stash && git rebase origin/main (from a .claude/worktrees/ cwd) to corrupt the branch ref and the worktree gitdir — the worktree de-registered itself mid-task and git status started segfaulting inside it.
• The shared .git/ corruption propagated to two other concurrent Claude Code sessions working in sibling worktrees; their refs showed as zero-hash and git worktree prune reported "short read (expected 132 bytes, read 0)" on three different worktree gitdir files. Six branch refs ended up zero-hash; three orphan worktree directories had to be manually rm -rf'd.
• Recovering required falling back to the GitHub Git Database REST API (gh api repos/.../git/{blobs,trees,commits,refs}) to push commits, because all local git mutations from inside the broken worktree continued to SIGBUS.
• Even cp/cat/wc -l/shutil.copyfile against tagged files return 0 bytes silently — Read and Edit tools intermittently see the file as empty even when ls shows it's still kilobytes on disk.

Reproduction

1. macOS 14.6.1 (23G93) on Apple Silicon.
2. Claude Desktop 1.8089.1, Claude Code 2.1.142 invoked through Claude Desktop (not via Terminal directly).
3. In a repo, create a git worktree under .claude/worktrees/<name>/ based on origin/main.
4. From a Claude Code session whose Bash tool cwd is inside that worktree, run:

   git stash && git fetch origin && git rebase origin/main && git stash pop

5. Expected: rebase succeeds.
6. Actual: rebase exits with code 138 (signal 10, SIGBUS) at the working-tree update step. .git/refs/heads/<branch> is now 41 bytes of zero, the worktree's .git/worktrees/<name>/gitdir is empty, and subsequent git status / git checkout from inside the worktree also segfault.

The same git commands run via git -C /path/to/main-checkout from outside .claude/worktrees/ complete normally — so it's specifically when the Bash tool's cwd (and therefore the file paths git touches) are under a .claude/worktrees/ subtree that the SIGBUS kicks in.

Workarounds (until fixed)

1. Run Claude Code from Terminal.app instead of Claude Desktop for worktree-heavy work. Terminal isn't part of the Claude bundle responsible-pid chain, so subprocess writes don't pick up the provenance xattr and git stays happy.
2. From inside Claude Desktop, run mutating git ops via git -C <main-checkout> from a cwd outside .claude/worktrees/. Read-only plumbing (rev-parse, show-ref, ls-tree, cat-file, gh api) is generally fine from anywhere.
3. If a worktree is already corrupted, fall back to the GitHub Git Database REST API: gh api repos/<owner>/<repo>/git/{blobs,trees,commits,refs} to build and push the commit, then gh pr merge <num> --repo <owner>/<repo> --merge --auto (the --repo flag avoids gh's local-git remote lookup, which would also hit the broken worktree).

Environment

• macOS: 14.6.1 (23G93), arm64, kernel xnu-10063.141.2~1
• Claude Desktop: 1.8089.1 (installed May 19, 18:36 local)
• Claude Code: 2.1.142
• Electron (Claude Desktop): 41.6.1
• Shell: zsh via Claude Code's Bash tool
• Repo: standard git checkout + multiple worktrees under .claude/worktrees/

Suggested fixes

• Don't route the Claude Code CLI through Contents/Helpers/disclaimer for spawning the Bash tool — or, if disclaimer is necessary for TCC consent for other reasons, isolate the Bash tool subprocess from the Claude.app responsible-pid chain so subprocess writes don't get auto-stamped with provenance.
• Failing that, ship a workaround in Claude Code that detects a .claude/worktrees/ cwd and either (a) refuses mutating git ops from there with a clear error, or (b) auto-shells through git -C <main-checkout> for them.