fix(code): share MCP approvals across Git worktrees

[Mason Daugherty (mdrxy)]

Users previously had to approve the same unchanged project MCP server once per Git worktree, producing repeated approval entries when tools created temporary worktrees.

Approvals are now transport-aware when Git's shared metadata can be validated:

• Remote servers with fixed URLs (http/sse/streamable_http, no ${} interpolation, no command field) are shared across linked worktrees via the validated Git common directory. These resolve identically from any checkout, so sharing is safe.
• Local stdio servers (any definition containing command) use the exact worktree root, because the same command can execute different files in another checkout.
• Remote servers with interpolated URLs (containing ${) use the exact worktree root, because project .env files can resolve the same template to different endpoints.

The git_common_dir marker now participates in approval equality, so a transport change under the same name (e.g. stdio → http) requires re-approval. Independent clones still require their own approval, non-Git projects remain scoped to their exact resolved root, and any changed command, URL, headers, or other server configuration still requires re-approval.

Legacy persisted approvals without a git_common_dir marker remain exact-worktree scoped and are never broadened to a Git identity, so existing entries do not silently widen.

---

Linked worktrees are recognized only when their Git administration directory belongs to the repository's common metadata, points back to that exact worktree, and carries its own valid HEAD and self-referential gitdir backlink. Malformed, missing, forged, or linked metadata falls back to exact-root scoping instead of widening trust. This closes a self-consistent forgery where an attacker's admin directory passes every acceptance check except its location under worktrees/.

Disabled-server precedence and DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS retain their existing behavior.

Test plan

• Focused Git, model configuration, MCP loading, disabled-server, config-manifest, and startup trust-prompt tests: 1005 passed.
• Ruff formatting and lint checks passed for all changed Python files.
• ty passed for deepagents-code.
• git diff --check passed.

[open-swe]

✅ Open SWE Review: No issues found

Open SWE reviewed this PR and found no potential bugs to report.

Open in Web • View Open SWE trace

[corridor-security]

This PR intentionally shares MCP server approvals across Git worktrees of the same repository by normalizing the trust scope to the Git common directory. The design introduces a real trust boundary gap: the approval fingerprint covers only the server definition in .mcp.json, not the content of local scripts or binaries it executes, so a sibling worktree (e.g. a PR checkout) can reuse an existing approval to silently launch attacker-controlled code.