fix(acp-bridge): map Windows-shaped workspace paths to their sandbox mount

packages/acp-bridge/src/workspacePaths.sandbox.test.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { canonicalizeWorkspace } from './workspacePaths.js';
+
+// Isolated from workspacePaths.test.ts because it mocks node:fs — the other
+// file drives real filesystem fixtures.
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = (await importOriginal()) as typeof import('node:fs');
+  return {
+    ...actual,
+    existsSync: (p: unknown) =>
+      p === '/c/qwen-repro' ? true : actual.existsSync(p as never),
+  };
+});
+
+describe('canonicalizeWorkspace inside a POSIX container sandbox (#7139)', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it.skipIf(process.platform === 'win32')(
+    'resolves a Windows-shaped workspace to its bind-mount location',
+    () => {
+      vi.stubEnv('SANDBOX', 'qwen-code-sandbox-0');
+      // The mount exists (mocked), realpath on it ENOENTs on this host, so
+      // the fallback returns the translated absolute path — NOT the cwd
+      // concatenation `path.resolve` alone would produce.
+      expect(canonicalizeWorkspace('C:\\qwen-repro')).toBe('/c/qwen-repro');
+    },
+  );
+
+  it.skipIf(process.platform === 'win32')(
+    'keeps Windows-shaped input untouched outside a sandbox',
+    () => {
+      const result = canonicalizeWorkspace('C:\\qwen-repro');
+      // Unsandboxed POSIX behavior is unchanged: the string resolves
+      // relative to the cwd (and stays broken — which is what the
+      // pre-#7139 sandbox path produced too).
+      expect(result.endsWith('C:\\qwen-repro')).toBe(true);
+      expect(result.startsWith('/')).toBe(true);
+    },
+  );
+});

packages/acp-bridge/src/workspacePaths.test.ts

@@ -8,7 +8,10 @@ import { promises as fsp, realpathSync } from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
-import { canonicalizeWorkspaces } from './workspacePaths.js';
+import {
+  canonicalizeWorkspaces,
+  translateWindowsWorkspaceForPosixSandbox,
+} from './workspacePaths.js';
 
 const scratches: string[] = [];
 
@@ -46,3 +49,77 @@ describe('canonicalizeWorkspaces', () => {
     expect(canonicalizeWorkspaces([])).toEqual([]);
   });
 });
+
+// Regression for #7139: a Windows host relaunching `qwen serve` into a Linux
+// Docker sandbox forwards `--workspace C:\…` (and client/persisted workspace
+// registrations) in host shape; every ACP child then failed with
+// `chdir(2) ENOENT`. These tests pin the container-side translation.
+describe('translateWindowsWorkspaceForPosixSandbox', () => {
+  const sandboxOpts = (exists: boolean) => ({
+    platform: 'linux' as NodeJS.Platform,
+    sandboxEnv: 'qwen-code-sandbox-0',
+    exists: () => exists,
+  });
+
+  it('maps a Windows-absolute path to its bind-mount location', () => {
+    expect(
+      translateWindowsWorkspaceForPosixSandbox(
+        'C:\\qwen-repro',
+        sandboxOpts(true),
+      ),
+    ).toBe('/c/qwen-repro');
+    expect(
+      translateWindowsWorkspaceForPosixSandbox(
+        'D:/Work/proj sub',
+        sandboxOpts(true),
+      ),
+    ).toBe('/d/Work/proj sub');
+    expect(
+      translateWindowsWorkspaceForPosixSandbox(
+        'C:\\nested\\dir\\leaf',
+        sandboxOpts(true),
+      ),
+    ).toBe('/c/nested/dir/leaf');
+  });
+
+  it('leaves the path alone when the translated mount does not exist', () => {
+    expect(
+      translateWindowsWorkspaceForPosixSandbox(
+        'C:\\qwen-repro',
+        sandboxOpts(false),
+      ),
+    ).toBe('C:\\qwen-repro');
+  });
+
+  it('leaves non-Windows-shaped paths alone', () => {
+    for (const p of ['/c/qwen-repro', 'relative/dir', 'C:', 'CC:\\x', '']) {
+      expect(
+        translateWindowsWorkspaceForPosixSandbox(p, sandboxOpts(true)),
+      ).toBe(p);
+    }
+  });
+
+  it('is inert on Windows hosts, outside sandboxes, and under seatbelt', () => {
+    expect(
+      translateWindowsWorkspaceForPosixSandbox('C:\\qwen-repro', {
+        platform: 'win32',
+        sandboxEnv: 'qwen-code-sandbox-0',
+        exists: () => true,
+      }),
+    ).toBe('C:\\qwen-repro');
+    expect(
+      translateWindowsWorkspaceForPosixSandbox('C:\\qwen-repro', {
+        platform: 'linux',
+        sandboxEnv: undefined,
+        exists: () => true,
+      }),
+    ).toBe('C:\\qwen-repro');
+    expect(
+      translateWindowsWorkspaceForPosixSandbox('C:\\qwen-repro', {
+        platform: 'darwin',
+        sandboxEnv: 'sandbox-exec',
+        exists: () => true,
+      }),
+    ).toBe('C:\\qwen-repro');
+  });
+});

packages/acp-bridge/src/workspacePaths.ts

@@ -4,9 +4,55 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { realpathSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import * as path from 'node:path';
 
+const WINDOWS_ABSOLUTE_PATH_RE = /^([A-Za-z]):[\\/](.*)$/;
+
+/**
+ * Maps a Windows-shaped absolute path to the container mount produced by the
+ * host-side sandbox launcher (`C:\work\proj` → `/c/work/proj`, mirroring
+ * `getContainerPath` in `cli/src/utils/sandbox.ts`).
+ *
+ * A Windows host relaunching `qwen serve` into a Linux Docker/Podman sandbox
+ * translates the bind mount and `--workdir`, but path-valued CLI arguments
+ * (`--workspace C:\…`), client-registered workspaces, and persisted
+ * registrations reach the in-container daemon in host shape. Left alone,
+ * `path.resolve` on Linux mangles them further (prepends the cwd) and every
+ * ACP child spawn fails with `chdir(2) ENOENT` before running anything
+ * (#7139).
+ *
+ * Deliberately conservative — the input is returned unchanged unless ALL of:
+ * - the daemon is running on POSIX inside a container sandbox (`SANDBOX` env
+ *   set by the launcher; macOS `sandbox-exec` does not remap paths and is
+ *   excluded),
+ * - the path is Windows-absolute (`<drive>:\…` or `<drive>:/…`),
+ * - the translated candidate actually exists (i.e. the drive really is
+ *   mounted the way the launcher mounts workspaces).
+ *
+ * The `opts` seams exist for tests; production callers use the defaults.
+ */
+export function translateWindowsWorkspaceForPosixSandbox(
+  p: string,
+  opts: {
+    platform?: NodeJS.Platform;
+    sandboxEnv?: string | undefined;
+    exists?: (candidate: string) => boolean;
+  } = {},
+): string {
+  const platform = opts.platform ?? process.platform;
+  const sandboxEnv =
+    'sandboxEnv' in opts ? opts.sandboxEnv : process.env['SANDBOX'];
+  const exists = opts.exists ?? existsSync;
+  if (platform === 'win32' || !sandboxEnv || sandboxEnv === 'sandbox-exec') {
+    return p;
+  }
+  const match = WINDOWS_ABSOLUTE_PATH_RE.exec(p);
+  if (!match) return p;
+  const translated = `/${match[1]!.toLowerCase()}/${match[2]!.replace(/\\/g, '/')}`;
+  return exists(translated) ? translated : p;
+}
+
 /**
  * Canonicalize a workspace path so the boot-time bound path and every
  * request's `workspaceCwd` collapse to the same key. `path.resolve`
@@ -40,7 +86,11 @@ import * as path from 'node:path';
  * at the original location.
  */
 export function canonicalizeWorkspace(p: string): string {
-  const resolved = path.resolve(p);
+  // #7139: inside a Linux container sandbox, host-shaped Windows workspace
+  // paths must be mapped to their bind-mount location BEFORE resolution —
+  // `path.resolve('C:\\x')` on POSIX treats the whole string as relative
+  // and prepends the cwd.
+  const resolved = path.resolve(translateWindowsWorkspaceForPosixSandbox(p));
   try {
     // FIXME(stage-2): switch to `fs.promises.realpath` once the
     // bridge call sites become async-friendly. This sync syscall

packages/cli/src/serve/process-env-guard.test.ts

@@ -52,6 +52,17 @@ const allowedProcessEnvAccesses = normalizeAllowances([
       accesses: { whole: 1 },
     },
   ],
+  [
+    'packages/acp-bridge/src/workspacePaths.ts',
+    {
+      reason:
+        'Whether the daemon runs inside a container sandbox is process-scoped: ' +
+        'the sandbox launcher marks the whole process via the SANDBOX env, and ' +
+        'workspace canonicalization uses it to map Windows-shaped host paths ' +
+        'to their bind-mount location (#7139).',
+      accesses: { 'key:SANDBOX': 1 },
+    },
+  ],
   [
     'packages/cli/src/serve/acp-http-enabled.ts',
     {