qwen-code/packages/web-shell/client/config
ytahdn 2ab3681157
fix(web-shell): preserve token and base path in session URLs (#7926)
* fix(web-shell): preserve session URL context

* fix(web-shell): keep daemon token out of the session URL (#7926)

Restore the daemon token stripping that was dropped alongside the
base-path fix: removeDaemonTokenFromUrl() on startup and the ?token=
delete in replaceStandaloneSessionUrl. The ?token= query path is still
supported for backward compatibility, so without stripping it leaks into
the address bar, history, access logs, and Referer headers.

Also extract the session pathname building into buildSessionPathname()
with unit tests covering root/sub-path deployments, the no-session case,
trailing slashes, and id encoding.

* fix(web-shell): anchor session URL parser to agree with writer (#7926)

Extract parseSessionId() next to buildSessionPathname() and anchor it to the last /session/<id> segment so the parser agrees with the greedy writer. Previously a base path ending in a session segment produced /app/session/session/<id>, which the first-match parser read back as the literal id "session". Add round-trip and trailing-slash coverage.

* test(web-shell): cover parseSessionId malformed-encoding catch branch (#7926)

* fix(web-shell): preserve base path in split-view URL (#7926)

---------

Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
2026-07-29 06:12:37 +00:00
..
daemon.test.ts fix(web-shell): persist the daemon bearer token per-tab so it survives refresh (#7374) 2026-07-21 08:26:19 +00:00
daemon.ts fix(web-shell): preserve token and base path in session URLs (#7926) 2026-07-29 06:12:37 +00:00