diff --git a/src/cli.ts b/src/cli.ts
index 921f528..6879d4b 100755
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 
 import { Command } from "commander"
+import { $} from "bun"
 import { basename, join } from "path"
 import { homedir } from "os"
 import { mkdir, symlink, unlink } from "fs/promises"
@@ -173,15 +174,14 @@ program
       process.exit(1)
     }
 
-    const worktreeAbs = session.worktree
+    const wt = session.worktree
+    const spin = spinner("Staging changes")
 
-    const spin = spinner("Starting container")
-    await vm.ensure((msg) => { spin.text = msg })
+    // Run git on the host — the worktree's .git references host paths and
+    // ~/dev is mounted read-only in the container, so git must run here.
+    await $`git -C ${wt} add .`.nothrow().quiet()
 
-    spin.text = "Staging changes"
-    await vm.exec(worktreeAbs, "git add .")
-
-    const check = await vm.exec(worktreeAbs, "git diff --staged --quiet")
+    const check = await $`git -C ${wt} diff --staged --quiet`.nothrow().quiet()
     if (check.exitCode === 0) {
       spin.fail("No changes to commit")
       process.exit(1)
@@ -191,26 +191,33 @@ program
     if (message) {
       msg = message
     } else {
+      spin.text = "Starting container"
+      await vm.ensure((m) => { spin.text = m })
+
       spin.text = "Generating commit message"
+      const diff = await $`git -C ${wt} diff --staged`.nothrow().quiet().text()
+      const tmpPath = join(homedir(), '.sandlot', '.sandlot-diff-tmp')
+      await Bun.write(tmpPath, diff)
+
       const gen = await vm.exec(
-        worktreeAbs,
-        'git diff --staged | claude -p "write a short commit message summarizing these changes. output only the message, no quotes or extra text" > /tmp/sandlot_commit_msg',
+        join(homedir(), '.sandlot'),
+        'cat /sandlot/.sandlot-diff-tmp | claude -p "write a short commit message summarizing these changes. output only the message, no quotes or extra text"',
       )
+      await Bun.file(tmpPath).unlink().catch(() => {})
+
       if (gen.exitCode !== 0) {
         spin.fail("Failed to generate commit message")
         if (gen.stderr) console.error(gen.stderr)
         process.exit(1)
       }
-      const { stdout } = await vm.exec(worktreeAbs, "cat /tmp/sandlot_commit_msg")
-      await vm.exec(worktreeAbs, "rm -f /tmp/sandlot_commit_msg")
-      msg = stdout
+      msg = gen.stdout
     }
 
     spin.text = "Committing"
-    const commit = await vm.exec(worktreeAbs, `git commit -m ${JSON.stringify(msg)}`)
+    const commit = await $`git -C ${wt} commit -m ${msg}`.nothrow().quiet()
     if (commit.exitCode !== 0) {
       spin.fail("Commit failed")
-      if (commit.stderr) console.error(commit.stderr)
+      if (commit.stderr) console.error(commit.stderr.toString().trim())
       process.exit(1)
     }