---

date: 2026-06-09 tags: [hooks, settings, worktree-builder, sandbox, claude-code] status: active graduated_to:

.claude/settings.json is a guarded write — worktree-builder / subagents can't register hooks

Symptom — worktree-builder built gate.sh end to end but reported one item BLOCKED: every write path to .claude/settings.json (Edit, Write, jq via Bash) was denied in its sandbox, so it couldn't register the hook.

Root cause — settings.json controls permissions + hooks, so it's a sandbox-guarded file; subagents / worktree builds can't modify it.

Fix — the main thread applied the two hook entries after integrating the branch (.claude/settings.json, SHA c4c02df), then validated the JSON and the hook behaviour.

Guard — when building hooks via worktree-builder (or any subagent), expect settings.json registration to come back BLOCKED and apply it from the main thread. Note kept here.