feat(daemon): restore worktree isolation on session load/resume

packages/acp-bridge/src/bridge.ts

@@ -5564,6 +5564,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
           {
             sessionId,
             path: req.path,
+            ...(req.allowedRoots ? { allowedRoots: req.allowedRoots } : {}),
           },
         );
         const extResult = raw as {
@@ -5624,6 +5625,13 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
       return { sessionId, ...result };
     },
 
+    setSessionWorktree(sessionId, worktree) {
+      const entry = byId.get(sessionId);
+      if (entry) {
+        entry.worktree = worktree;
+      }
+    },
+
     async closeSession(sessionId, context, closeOpts) {
       return closeSessionImpl(sessionId, context, closeOpts);
     },

packages/acp-bridge/src/bridgeTypes.ts

@@ -270,6 +270,14 @@ export interface BridgeForkAgentResult {
 
 export interface ChangeSessionCwdRequest {
   path: string;
+  /**
+   * Server-controlled containment roots. When present, the agent-side
+   * sessionCd handler verifies (after its own realpath) that the
+   * canonical target is under one of these roots. Only set by the
+   * daemon's worktree create/restore paths; direct user cd omits this
+   * field, preserving existing behavior.
+   */
+  allowedRoots?: string[];
 }
 
 export interface ChangeSessionCwdResult {
@@ -723,6 +731,17 @@ export interface AcpSessionBridge {
     context?: BridgeClientRequestContext,
   ): Promise<ChangeSessionCwdResult>;
 
+  /**
+   * Set worktree metadata on an existing session entry. Used when
+   * restoring a worktree session after daemon restart — the sidecar
+   * file provides the metadata, and this populates the in-memory entry
+   * so `getSessionSummary` returns it.
+   */
+  setSessionWorktree(
+    sessionId: string,
+    worktree: { slug: string; path: string; branch: string },
+  ): void;
+
   /**
    * Forward a prompt to the agent. Concurrent prompts against the same
    * session FIFO-serialize through a per-session queue.

packages/cli/src/acp-integration/acpAgent.ts

@@ -7571,6 +7571,25 @@ class QwenAgent implements Agent {
         // Canonicalize path
         const canonicalPath = await fs.realpath(targetPath);
 
+        // Server-controlled containment check (worktree create/restore).
+        // Must run BEFORE the no-op check: a no-op cd to a directory
+        // outside the allowed roots must still be rejected.
+        const allowedRoots = params['allowedRoots'];
+        if (Array.isArray(allowedRoots) && allowedRoots.length > 0) {
+          const contained = allowedRoots.some((root: unknown) => {
+            if (typeof root !== 'string') return false;
+            const rel = path.relative(root, canonicalPath);
+            return !rel.startsWith('..') && !path.isAbsolute(rel);
+          });
+          if (!contained) {
+            throw new RequestError(
+              -32004,
+              `Path outside allowed roots: ${canonicalPath}`,
+              { errorKind: 'containment_violation', path: canonicalPath },
+            );
+          }
+        }
+
         // Noop check
         const previousCwd = config.getTargetDir();
         if (canonicalPath === previousCwd) {

packages/cli/src/serve/routes/session.ts

@@ -5,6 +5,7 @@
  */
 
 import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 import {
   APPROVAL_MODES,
@@ -23,6 +24,7 @@ import {
   runWithoutDebugLogSession,
   writeWorktreeSessionMarker,
   writeWorktreeSession,
+  readWorktreeSession,
   type ApprovalMode,
   type SessionGroupColor,
   type SessionGroupPresetColor,
@@ -1376,8 +1378,28 @@ export function registerSessionRoutes(
       // before any subsequent prompt is processed.
       if (worktreeMeta) {
         try {
+          // Compute allowed roots for the sessionCd containment check.
+          // Narrow to <root>/.qwen/worktrees (not the whole repo) so a
+          // symlink .qwen/worktrees/task -> <repo>/src is rejected.
+          const createAllowedRoots = [
+            path.join(workspaceCwd, '.qwen', 'worktrees'),
+          ];
+          let createRepoTop: string | null = null;
+          try {
+            createRepoTop = await new GitWorktreeService(
+              workspaceCwd,
+            ).getRepoTopLevel();
+          } catch {
+            // Not a git repo or getRepoTopLevel unavailable.
+          }
+          if (createRepoTop && createRepoTop !== workspaceCwd) {
+            createAllowedRoots.push(
+              path.join(createRepoTop, '.qwen', 'worktrees'),
+            );
+          }
           await runtime.bridge.changeSessionCwd(session.sessionId, {
             path: worktreeMeta.path,
+            allowedRoots: createAllowedRoots,
           });
           await writeWorktreeSessionMarker(
             worktreeMeta.path,
@@ -1551,6 +1573,93 @@ export function registerSessionRoutes(
           }
           return;
         }
+        // Restore worktree isolation. Read the sidecar AFTER load/resume
+        // so we inherit the ACP layer's verdict: #restoreWorktreeOnResume
+        // clears the sidecar on dead-worktree / containment-failure paths,
+        // so a post-read naturally skips those cases. On the healthy path
+        // the sidecar is untouched and we relocate + populate the entry.
+        // Note: the !res.writable early-return above skips this restore;
+        // a client that disconnects mid-load leaves the session parked in
+        // the main workspace (pre-existing shape, low frequency).
+        if (!session.worktree) {
+          const sidecar = await readWorktreeSession(
+            new SessionService(workspaceCwd).getWorktreeSessionPath(sessionId),
+          ).catch(() => null);
+          if (sidecar) {
+            // Defense-in-depth: resolve symlinks on both the target and
+            // the expected worktrees root, then verify containment. This
+            // defeats both `..` traversal and symlink escapes (e.g.
+            // .qwen/worktrees/escape -> /etc). The allowed root is always
+            // derived from the server (never from the sidecar, which is
+            // attacker-writable). The canonical realTarget is passed to
+            // changeSessionCwd to eliminate the TOCTOU window between
+            // validation and relocation.
+            // For monorepo subdirectory workspaces, worktrees live under
+            // the repo top-level, not the workspace cwd. Try workspaceCwd
+            // first, then fall back to the git repo top-level.
+            let realTarget: string | undefined;
+            const candidateRoots = [
+              path.join(workspaceCwd, '.qwen', 'worktrees'),
+            ];
+            try {
+              realTarget = fs.realpathSync(sidecar.worktreePath);
+              let repoTop: string | null = null;
+              try {
+                repoTop = await new GitWorktreeService(
+                  workspaceCwd,
+                ).getRepoTopLevel();
+              } catch {
+                // Not a git repo or getRepoTopLevel unavailable.
+              }
+              if (repoTop && repoTop !== workspaceCwd) {
+                candidateRoots.push(path.join(repoTop, '.qwen', 'worktrees'));
+              }
+              const contained = candidateRoots.some((root) => {
+                try {
+                  const realRoot = fs.realpathSync(root);
+                  const rel = path.relative(realRoot, realTarget!);
+                  return !rel.startsWith('..') && !path.isAbsolute(rel);
+                } catch {
+                  return false;
+                }
+              });
+              if (!contained) {
+                realTarget = undefined;
+              }
+            } catch {
+              realTarget = undefined;
+            }
+            if (!realTarget) {
+              daemonLog?.warn('worktree sidecar path failed containment', {
+                sessionId,
+                path: sidecar.worktreePath,
+              });
+            } else {
+              const wt = {
+                slug: sidecar.slug,
+                path: realTarget,
+                branch: sidecar.worktreeBranch,
+              };
+              try {
+                await runtime.bridge.changeSessionCwd(sessionId, {
+                  path: wt.path,
+                  allowedRoots: candidateRoots,
+                });
+                runtime.bridge.setSessionWorktree(sessionId, wt);
+                session.worktree = wt;
+              } catch (restoreErr) {
+                daemonLog?.warn('worktree restore failed on load/resume', {
+                  sessionId,
+                  worktreePath: wt.path,
+                  error:
+                    restoreErr instanceof Error
+                      ? restoreErr.message
+                      : String(restoreErr),
+                });
+              }
+            }
+          }
+        }
         res.status(200).json(session);
       } catch (err) {
         sendBridgeError(res, err, {