Agent escapes worktree isolation via cd to parent project path
Checklist
- I searched existing issues and this hasn't been reported
Area
Frontend
Operating System
Windows
Version
2.7.5
What happened?
When running tasks in isolated worktree mode, the Claude agent escapes the worktree by running cd /path/to/main/project before executing commands. This causes git commits and file modifications to occur in the main project instead of the isolated worktree, defeating the isolation system.
Steps to reproduce
From task logs (E:\projects\\\x\prod\_logs\log.txt):
# Agent starts correctly in worktree
pwd
→ /e/projects/x/.auto-claude/worktrees/tasks/009-audit.../
# Agent escapes to main project (BUG)
cd /e/projects/x && git add .auto-claude/specs/...
cd /e/projects/x && git commit -m "auto-claude: subtask-2-1..."
### Expected behavior
## Root Cause
The agent sees absolute paths like `/e/projects/x/prod/...` in context files (spec.md, context.json) and decides to `cd` to what it perceives as the "project root".
The prompts say "use relative paths" but don't explicitly warn that:
1. The agent is in an isolated worktree (a complete project copy)
2. The parent project path is **FORBIDDEN**
3. All files are accessible via relative paths from the worktree
---
## Related Issue
@André identified a separate but related issue: Worktree creation may set remote to default branch, causing changes to go to wrong branch even when staying in worktree. This has the same outcome (changes in wrong location) but different root cause.
---
## Proposed Fix
### Short-term (v2.7.6) - Prompt-based detection
Update `apps/backend/prompts_pkg/prompt_generator.py` to:
1. Detect when running in worktree mode (path contains `.auto-claude/worktrees/tasks/`)
2. Extract the forbidden parent project path
3. Add explicit warning in generated prompts
4. No code changes to restrict `cd` - just inform the agent
⛔ ISOLATED WORKTREE - CRITICAL
You are in an ISOLATED GIT WORKTREE - a complete copy of the project.
YOUR LOCATION: /path/to/.auto-claude/worktrees/tasks/spec-name/
FORBIDDEN: Do NOT use cd /path/to/main/project - this escapes isolation
All project files exist HERE via relative paths:
./prod/...✅ (NOT/path/to/main/project/prod/...)
### Medium-term - Workspace Permissions in Settings
Add a **Workspace Permissions** section in Settings:
- Let users configure agent behavior per-project or globally
- App-level (global) defaults with per-project overrides
- Integrate with upcoming plugin system for agent tools
### Long-term - Settings-Based Permission System
The current "MCP overview" tab will expand to become **"Agent Tools"** with full insight and control of each agent's tools and behavior.
Settings > Agent Permissions ├── Workspace Mode │ ├── ○ Isolated (worktree) - Default, safe │ └── ○ Shared (direct) - Advanced, risky │ ├── Navigation │ ├── ☑ Allow cd within project │ ├── ☐ Allow cd to parent directories │ └── ☐ Allow absolute paths │ ├── Git Operations │ ├── ☑ Allow commits │ ├── ☐ Allow push (requires explicit approval) │ └── ☐ Allow force operations │ └── File Operations ├── ☑ Allow file creation ├── ☑ Allow file modification └── ☐ Allow file deletion outside spec
These settings would:
1. Generate permission context injected into prompts
2. Potentially hook into security layer to block violations programmatically
3. Be overridable per-project (some projects may need looser permissions)
4. Integrate with the upcoming plugin system that gives access to more tools for agents
**Note:** The foundation is ready - we already show agent tools and what they have access to in the sandbox.
---
## Files to Modify
| File | Change |
|------|--------|
| `apps/backend/prompts_pkg/prompt_generator.py` | Detect worktree mode, add isolation warning |
| `apps/backend/prompts/coder.md` | Add worktree-specific guidance section |
---
## Implementation Notes
- Do NOT blanket-disallow `cd` - agent may need it to navigate within the worktree
- Right now all tasks are in worktrees, but in the future we will allow working in a shared environment (with all the craziness that can bring) - futureproof accordingly
- Medium and long-term solutions need consideration against the upcoming plugin system that will give access to more tools for agents
- Investigate André's finding about worktree remote/branch configuration separately
---
## Team Discussion Summary
**Key decisions from Discord (2025-01-22):**
1. **Short-term for v2.7.6:** Prompt-based worktree detection + warning
2. **Don't restrict `cd` entirely** - some models use it to traverse the repo, and it may be needed within the worktree
3. **Settings approach:** App-level (global) defaults with per-project override capability
4. **Future architecture:** MCP overview tab → "Agent Tools" with full permissions control
5. **Plugin system consideration:** Medium/long-term solutions should align with upcoming plugin system
**Participants:** @p1kn1t, @André, @Sondre
### Logs / Screenshots
```shell
Source: AndyMik90/Aperant