jinye bf3abdee81 fix(serve): Allow approved same-host text reads outside workspace (#8620) ... * fix(serve): allow same-host daemon text reads Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(serve): address review on same-host text reads Record what the read capability does not fix: #8618 still reproduces for the write and edit family, whose delegated writes are refused after the user has already approved the diff. Give the daemon's pre-approval SSE fan-out its own bullet in the user-facing security section, restore the sentence stating that environment isolation is not an OS security boundary, and make the design doc the single owner of the tradeoff list so tuning a limit cannot leave stale copies behind. Test fixtures no longer land in the developer's real home directory, the assertion pinned to localized rejection copy is dropped, and the combined capability case is split so deleting the write half cannot silently remove read coverage. * fix(test): declare REPO_ROOT and bind the external-read session to the daemon's workspace The external-read regression test referenced REPO_ROOT twice without declaring it, which made it unrunnable everywhere: - On a developer box the ReferenceError was swallowed by the bare catch in findExternalReadBase(), every candidate was discarded, and the test reported a green skip -- exactly the silently-disabled security test the CI loud-fail added last round was meant to prevent. The guard was defeated three lines above itself. - On CI that loud-fail branch threw at module scope, so the file failed to collect and took the four pre-existing tests down with it. Declare REPO_ROOT the way every other daemon integration test does. The session also asked for `workspaceCwd: REPO_ROOT` while beforeAll binds the daemon with `--workspace workspaceDir`, so the create returned 400 Workspace mismatch even once the constant existed. The read under test is external because externalReadDir sits outside the bound workspace, not because the session claims a wider one. Finally, collect each candidate's rejection reason instead of dropping it, and fold it into both branches: the CI throw names why every candidate failed and the developer-box skip warns with the same text. A bare catch cannot tell "no /var/tmp on this image" from a bug in the function, and the second reads as a green skip. Reported by @wenshao, who reproduced all three consequences against a real qwen serve daemon on Linux and supplied the repair. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>		2026-08-07 07:33:16 +00:00
..
configuration	docs: document serve sub-session concurrency settings (#8404)	2026-08-07 01:04:25 +00:00
extension	fix(core): Align MCP OAuth guidance and docs (#5589)	2026-06-24 07:09:53 +08:00
features	feat(review): say so when the bundle is older than the review it runs (#8390)	2026-08-07 03:21:26 +00:00
ide-integration	fix(cli): replace all emoji with Unicode text symbols in TUI rendering (#5999)	2026-06-30 15:18:01 +00:00
reference	docs: complete TUI keyboard shortcut reference (#8327)	2026-08-01 17:24:19 +00:00
support	fix(cli): add ui.mouseTracking setting to restore right-click and URL clicks (#8198)	2026-08-01 14:15:42 +00:00
_meta.ts	feat(daemon): merge daemon-mode feature batch into main (#4490)	2026-06-12 00:34:49 +08:00
common-workflow.md	docs: fix stale defaults, CLI syntax, and tool naming drift (#5158)	2026-06-15 20:06:34 +08:00
integration-github-action.md	feat(web-shell): show subagent sessions in detail panel (#7380)	2026-07-22 02:31:08 +00:00
integration-jetbrains.md	docs(integration): use CDN URLs for images and fix formatting	2026-03-16 14:12:48 +08:00
integration-vscode.md	fix(core): honor NO_PROXY for model requests (#6640)	2026-07-10 10:41:04 +00:00
integration-zed.md	docs(integration): use CDN URLs for images and fix formatting	2026-03-16 14:12:48 +08:00
overview.md	docs: fix config/command/auth drift and surface the model-providers page (#5735)	2026-06-24 06:06:01 +08:00
quickstart.md	docs: fix config/command/auth drift and surface the model-providers page (#5735)	2026-06-24 06:06:01 +08:00
qwen-serve-deploy-local.md	docs(serve): Close multi-workspace hardening gaps (#7019)	2026-07-16 17:33:53 +00:00
qwen-serve.md	fix(serve): Allow approved same-host text reads outside workspace (#8620)	2026-08-07 07:33:16 +00:00