feat(daemon): guard cross-worktree Git mutations

docs/users/qwen-serve.md

@@ -434,6 +434,71 @@ Notes:
 >   matched case-sensitively by yargs `choices` (`--memory-project-scope
 Workspace` is rejected). Use lowercase values when copying between the two.
 
+### Built-in daemon Git relocation guard
+
+Every managed daemon ACP session applies a built-in pre-execution guard for
+model shell commands, independent of `--external-tool-guard-mode` and without
+any capability advertisement. The daemon owns the bound workspace and the
+session's current effective working directory; both are supplied from trusted
+session state and never accepted from the ACP child.
+
+The guard inspects the tools that run a shell command line — `run_shell_command`
+and `monitor` — and denies a mutating Git
+command before execution when its repository location resolves outside the
+session's effective working directory. Relocation is recognized for literal
+forms of `git -C <path>`, `git --git-dir[=]<path>`,
+`git --work-tree[=]<path>`, leading
+`GIT_DIR`/`GIT_WORK_TREE`/`GIT_COMMON_DIR`/`GIT_INDEX_FILE` assignments (also
+when made through `export`/`declare`/`readonly`, which keep them in the
+environment of every later command in the chain),
+directory-shifting wrapper flags (`env -C`, `sudo -D`), and `cd`, `pushd`, or
+`popd` builtins earlier in the same command chain. Common wrapper prefixes
+(`sh -c`, `bash -c`, `eval`, `sudo`, `nohup`, `timeout`, `exec`, `command`,
+`builtin`,
+`env`, path-qualified `git` binaries, and `{ …; }` / `! …` shell syntax) are
+unwrapped so the same policy applies to the inner Git invocation, and `$(…)`
+or backtick substitution bodies are analyzed as commands of their own.
+
+A sub-agent pinned to its own worktree is contained to that worktree rather
+than to the session's directory; a shell call whose execution directory the
+daemon cannot place is denied.
+
+Relative targets resolve from the command's effective starting directory
+(`arguments.directory` when present, otherwise the session's current effective
+working directory) after canonical path resolution, including `.git` gitfile
+redirects, symlinks, and per-worktree administrative directories. A relocated
+target that cannot be fully resolved before execution — a dynamic target
+(`$VAR`, backticks, `~`, globs), a path that does not exist yet, or an
+unreadable indirection — is denied for mutating or unclassifiable subcommands.
+A relocated target that cannot be resolved is denied whatever the subcommand
+is — including the read-only ones. Relocated commands whose subcommand is one
+of a small verified read-only set (`rev-parse`, `cat-file`) remain allowed
+once the target resolves, unless the command carries command-executing `-c`
+config, or
+it carries a `--output`, `--textconv`, or `--filters` flag: those write a file
+or run the target repository's configured drivers. Commands with no recognized
+relocation keep their existing behavior.
+Denials are final and are reported to the model as
+`Daemon shell guard denied a mutating Git command…` for a resolved, dynamic,
+or unresolvable repository location, and as
+`Daemon shell guard denied a shell command…` when the command could not be
+parsed, its payload could not be resolved, or an unrecognized program may run
+a relocated Git command.
+
+The guard is reliable against Git relocation written in the literal forms
+above — the mis-targeted command this control exists for — and is
+**best-effort, not a boundary**, against shell text written to defeat it:
+constructions that hide the relocation from a static reader may pass, and new
+ones will keep being found. Do not grant a daemon broader trust on the
+strength of it. It does not interpret script files,
+track environment variable values across commands, or analyze heredoc bodies
+(Git-shaped text inside a heredoc can be denied even though the shell never
+executes it). `/fork` and agent-backed workspace memory remember/dream remain
+available under the built-in guard; they are only restricted while the
+external provider mode below is active. An optional external tool guard
+remains an additional policy and receives the same request only after the
+built-in policy allows it.
+
 ### Required external Tool Guard
 
 This opt-in is for managed ACP deployments that need an external allow/deny

packages/acp-bridge/src/bridgeClient.test.ts

@@ -250,10 +250,14 @@ describe('BridgeClient — managed external tool guard', () => {
     });
     const entry: {
       sessionId: string;
+      workspaceCwd: string;
+      effectiveCwd: string;
       promptActive: boolean;
       activePromptId?: string;
     } = {
       sessionId: 'session-1',
+      workspaceCwd: '/workspace',
+      effectiveCwd: '/workspace/worktree',
       promptActive: true,
       activePromptId: 'prompt-1',
     };
@@ -278,9 +282,117 @@ describe('BridgeClient — managed external tool guard', () => {
       toolCallId: 'call-1',
       toolName: 'write_file',
       arguments: { path: 'README.md' },
+      effectiveCwd: '/workspace/worktree',
     });
   });
 
+  it('ignores a forged effective directory in the child payload', async () => {
+    const handler = vi.fn<ExternalToolGuardHandler>().mockResolvedValue({
+      allowed: true,
+    });
+    const entry: {
+      sessionId: string;
+      workspaceCwd: string;
+      effectiveCwd: string;
+      promptActive: boolean;
+      activePromptId?: string;
+    } = {
+      sessionId: 'session-1',
+      workspaceCwd: '/workspace',
+      effectiveCwd: '/workspace/worktree',
+      promptActive: true,
+      activePromptId: 'prompt-1',
+    };
+    const client = makeClient(undefined, {
+      resolveEntry: (sessionId) =>
+        sessionId === entry.sessionId ? entry : undefined,
+      handler,
+    });
+
+    await expect(
+      client.extMethod(SERVE_CONTROL_EXT_METHODS.externalToolGuardPrepare, {
+        sessionId: 'session-1',
+        promptId: 'prompt-1',
+        toolCallId: 'call-1',
+        toolName: 'write_file',
+        arguments: { path: 'README.md' },
+        effectiveCwd: '/forged/effective',
+      }),
+    ).resolves.toEqual({ allowed: true });
+    expect(handler).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      promptId: 'prompt-1',
+      toolCallId: 'call-1',
+      toolName: 'write_file',
+      arguments: { path: 'README.md' },
+      effectiveCwd: '/workspace/worktree',
+    });
+  });
+
+  it('accepts a prompt-less shell check validated by session ownership', async () => {
+    const handler = vi.fn<ExternalToolGuardHandler>().mockResolvedValue({
+      allowed: true,
+    });
+    const entry: {
+      sessionId: string;
+      workspaceCwd: string;
+      effectiveCwd: string;
+      promptActive: boolean;
+      activePromptId?: string;
+    } = {
+      sessionId: 'session-1',
+      workspaceCwd: '/workspace',
+      effectiveCwd: '/workspace/worktree',
+      promptActive: false,
+    };
+    const client = makeClient(undefined, {
+      resolveEntry: (sessionId) =>
+        sessionId === entry.sessionId ? entry : undefined,
+      handler,
+    });
+
+    await expect(
+      client.extMethod(SERVE_CONTROL_EXT_METHODS.externalToolGuardPrepare, {
+        sessionId: 'session-1',
+        toolCallId: 'call-1',
+        toolName: 'run_shell_command',
+        arguments: { command: 'pwd' },
+      }),
+    ).resolves.toEqual({ allowed: true });
+    expect(handler).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      toolCallId: 'call-1',
+      toolName: 'run_shell_command',
+      arguments: { command: 'pwd' },
+      effectiveCwd: '/workspace/worktree',
+    });
+  });
+
+  it('rejects an empty prompt id in a guard request', async () => {
+    const handler = vi.fn<ExternalToolGuardHandler>().mockResolvedValue({
+      allowed: true,
+    });
+    const client = makeClient(undefined, {
+      resolveEntry: () => ({
+        sessionId: 'session-1',
+        promptActive: true,
+        activePromptId: 'prompt-1',
+      }),
+      handler,
+    });
+
+    await expect(
+      client.extMethod(SERVE_CONTROL_EXT_METHODS.externalToolGuardPrepare, {
+        sessionId: 'session-1',
+        promptId: '',
+        toolCallId: 'call-1',
+        toolName: 'run_shell_command',
+        arguments: {},
+      }),
+    ).rejects.toThrow('Invalid external tool guard request');
+    expect(handler).not.toHaveBeenCalled();
+  });
+
   it('rejects a stale prompt without contacting the host', async () => {
     const handler = vi.fn<ExternalToolGuardHandler>().mockResolvedValue({
       allowed: true,

packages/acp-bridge/src/bridgeClient.ts

@@ -603,6 +603,8 @@ function sliceLineRange(
  */
 export interface BridgeClientSessionEntry {
   sessionId: string;
+  workspaceCwd: string;
+  effectiveCwd: string;
   events: EventBus;
   artifacts: SessionArtifactStore;
   recordingDegraded: boolean;
@@ -1297,8 +1299,8 @@ export class BridgeClient implements Client {
     if (
       typeof sessionId !== 'string' ||
       sessionId.length === 0 ||
-      typeof promptId !== 'string' ||
-      promptId.length === 0 ||
+      (promptId !== undefined &&
+        (typeof promptId !== 'string' || promptId.length === 0)) ||
       typeof toolCallId !== 'string' ||
       toolCallId.length === 0 ||
       typeof toolName !== 'string' ||
@@ -1310,32 +1312,49 @@ export class BridgeClient implements Client {
         'Invalid external tool guard request',
       );
     }
+    // Context-less shell checks (subagents, cron turns, resumed background
+    // agents) carry no prompt binding; they are validated by session
+    // ownership alone. The host handler decides whether its policy can run
+    // without a live prompt.
+    const promptScoped = promptId !== undefined;
     if (!this.ownsSession(sessionId)) {
       throw RequestError.invalidParams(
         undefined,
         'External tool guard session is not owned by this connection',
       );
     }
     const entry = this.resolveEntry(sessionId);
-    if (!entry || !entry.promptActive || entry.activePromptId !== promptId) {
+    if (
+      !entry ||
+      (promptScoped &&
+        (!entry.promptActive || entry.activePromptId !== promptId))
+    ) {
       throw RequestError.invalidParams(
         undefined,
         'External tool guard prompt is not the active prompt',
       );
     }
+    const invocationCwd = params['invocationCwd'];
     const decision: unknown = await this.externalToolGuard({
       sessionId: entry.sessionId,
-      promptId: entry.activePromptId,
+      ...(promptScoped ? { promptId } : {}),
       toolCallId,
       toolName,
       arguments: args,
+      effectiveCwd: entry.effectiveCwd,
+      // Forwarded verbatim and explicitly untrusted: the host policy decides
+      // whether it can establish this scope from state it owns.
+      ...(typeof invocationCwd === 'string' && invocationCwd.length > 0
+        ? { invocationCwd }
+        : {}),
     });
     const currentEntry = this.resolveEntry(sessionId);
     if (
       !this.ownsSession(sessionId) ||
       currentEntry !== entry ||
-      !currentEntry.promptActive ||
-      currentEntry.activePromptId !== promptId
+      (promptScoped &&
+        (!currentEntry.promptActive ||
+          currentEntry.activePromptId !== promptId))
     ) {
       throw RequestError.invalidParams(
         undefined,

packages/acp-bridge/src/bridgeOptions.ts

@@ -73,10 +73,25 @@ export type BridgeSessionLifecycle = (
  */
 export interface ExternalToolGuardPrepareRequest {
   readonly sessionId: string;
-  readonly promptId: string;
+  /**
+   * Runtime-owned active-prompt binding. Absent for context-less shell
+   * checks: subagent reasoning loops, cron turns, background notifications,
+   * and resumed background agents run without an invocation context by
+   * design. A host policy that requires a live prompt must fail closed when
+   * the binding is missing.
+   */
+  readonly promptId?: string;
   readonly toolCallId: string;
   readonly toolName: string;
   readonly arguments: Readonly<Record<string, unknown>>;
+  /** Daemon-owned current session working directory. */
+  readonly effectiveCwd?: string;
+  /**
+   * Directory the child will actually run the tool in, when it differs from
+   * the session's own. Untrusted: the host validates it against state it
+   * owns before using it as a containment basis.
+   */
+  readonly invocationCwd?: string;
 }
 
 export type ExternalToolGuardPrepareResult =

packages/acp-bridge/src/externalToolGuard.ts

@@ -12,6 +12,18 @@
 export const PRIVATE_EXTERNAL_TOOL_GUARD_ENV =
   'QWEN_CODE_PRIVATE_EXTERNAL_TOOL_GUARD';
 
+/**
+ * Private, non-secret marker passed from `qwen serve` to its ACP child only
+ * when a real external tool guard provider is attached. Without it the child
+ * still installs the managed guard plumbing (the daemon's built-in policy
+ * needs it), but resolves every non-shell tool locally and keeps `/fork` and
+ * agent-backed workspace memory available: those features are only disabled
+ * for the external provider's v1 contract, which cannot observe hidden-agent
+ * execution.
+ */
+export const PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV =
+  'QWEN_CODE_PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER';
+
 /**
  * ACP initialize-response metadata proving that the child consumed the
  * private activation marker and installed the required executor callback.
@@ -26,6 +38,26 @@ export const EXTERNAL_TOOL_GUARD_READY_META_KEY =
  */
 export const EXTERNAL_TOOL_GUARD_REQUIRED_VALUE = 'required-v1';
 
+/**
+ * The provider-attached marker value `qwen serve` passes to the child when a
+ * real external tool guard provider is configured.
+ */
+export const EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE = 'attached-v1';
+
+/**
+ * Tools whose arguments carry a shell command line the host runs on the
+ * session's behalf. The daemon's built-in policy inspects exactly these, and
+ * the ACP child resolves every other tool locally when no external provider
+ * is attached. Pinned to `ToolNames.SHELL`/`ToolNames.MONITOR` in
+ * `@qwen-code/qwen-code-core`, which this package deliberately does not
+ * depend on; `daemon-git-worktree-guard.test.ts` asserts the values still
+ * match so a rename cannot silently unhook a tool from the guard.
+ */
+export const SHELL_EXECUTING_TOOL_NAMES: ReadonlySet<string> = new Set([
+  'monitor',
+  'run_shell_command',
+]);
+
 /** Daemon-local bearer token for the loopback external Tool Guard provider. */
 export const EXTERNAL_TOOL_GUARD_TOKEN_ENV =
   'QWEN_CODE_EXTERNAL_TOOL_GUARD_TOKEN';