@qwen-code/qwen-code 0.21.12-preview.5 → 0.21.13

package/bundled/qc-helper/docs/configuration/settings.md

@@ -109,11 +109,13 @@ Settings are organized into categories. Most settings should be placed within th
 
 #### review
 
-| Setting              | Type    | Description                                                                                                                                                                                                                                                                                                                                                                                          | Default  |
-| -------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
-| `review.attribution` | boolean | Append the attribution footer naming the model and CLI version (e.g. `_— qwen3-coder via Qwen Code /review (v0.21.2)_`) to review bodies and inline comments posted by `/review`. Disable to post reviews without AI attribution. With the footer off, presubmit duplicate detection still recognizes earlier posts by the same GitHub account, but footer-less posts from other accounts escape it. | `true`   |
-| `review.effort`      | enum    | Default effort for `/review` when `--effort` is not given: `"low"`, `"medium"`, `"high"`, or `"auto"` (the built-in rule: high for PRs, medium for local changes). An explicit `--effort` wins; an effective `--comment` still forces high and `--fix` still floors at medium.                                                                                                                       | `"auto"` |
-| `review.comment`     | boolean | Treat every PR `/review` as if `--comment` was passed: findings are posted to the pull request without the flag. The post still binds to the PR named in the invocation. Enable only if you always want reviews published.                                                                                                                                                                           | `false`  |
+| Setting                     | Type    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Default     |
+| --------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| `review.attribution`        | boolean | Append the attribution footer naming the model and CLI version (e.g. `_— qwen3-coder via Qwen Code /review (v0.21.2)_`) to review bodies and inline comments posted by `/review`. Disable to post reviews without AI attribution. With the footer off, presubmit duplicate detection still recognizes earlier posts by the same GitHub account, but footer-less posts from other accounts escape it.                                                                                                                                                                                                | `true`      |
+| `review.effort`             | enum    | Default effort for `/review` when `--effort` is not given: `"low"`, `"medium"`, `"high"`, or `"auto"` (the built-in rule: high for PRs, medium for local changes). An explicit `--effort` wins; an effective `--comment` still forces high and `--fix` still floors at medium.                                                                                                                                                                                                                                                                                                                      | `"auto"`    |
+| `review.comment`            | boolean | Treat every PR `/review` as if `--comment` was passed: findings are posted to the pull request without the flag. The post still binds to the PR named in the invocation. Enable only if you always want reviews published.                                                                                                                                                                                                                                                                                                                                                                          | `false`     |
+| `review.severityFloor`      | enum    | The lowest severity a PR `/review` posts when `--severity-floor` is not given: `"auto"` (the round-adaptive default — Suggestions post through round 5, only Criticals from round 6, with otherwise-postable high-confidence Suggestions recorded and deferred, and rounds 2–5 deferring new Suggestions on code unchanged since the previous round; low-confidence and Nice-to-have findings stay terminal-only), `"critical"` (that posture from round 1), or `"suggestion"` (Suggestions post at every round; turns the convergence posture off). Non-PR targets have no rounds and ignore this. | `"auto"`    |
+| `review.reverseAuditRounds` | number  | Lower the reverse-audit loop's round cap for every high-effort review. The cap otherwise follows the diff topology (10 small / 5 chunked; a huge diff is 3 with a review deadline and 5 without). This can only **lower** whichever tier applies: a value below 3, above the tier, or not a whole number above zero is ignored. Cutting the cap does not make reviews converge sooner — the loop ends on two consecutive dry rounds — it makes them stop before converging more often, and every such stop caps the verdict at Comment.                                                             | `0` (unset) |
 
 These settings are read from operator scopes only (User, System, and SystemDefaults); values in a workspace `.qwen/settings.json` are ignored, so a repository cannot set review policy for its reviewers.
 

package/bundled/qc-helper/docs/features/channels/overview.md

@@ -61,7 +61,7 @@ Channels are configured under the `channels` key in `settings.json`. Each channe
 | `model`                  | No               | Model to use for this channel (e.g., `qwen3.5-plus`). Overrides the default model. Useful for multimodal models that support image input                                                                                |
 | `senderPolicy`           | No               | Who can talk to the bot: `allowlist` (default), `open`, or `pairing`                                                                                                                                                    |
 | `allowedUsers`           | No               | List of user IDs allowed to use the bot (used by `allowlist` and `pairing` policies)                                                                                                                                    |
-| `sessionScope`           | No               | How sessions are scoped: `user` (default), `thread`, or `single`                                                                                                                                                        |
+| `sessionScope`           | No               | How sessions are scoped: `user` (default), `chat_thread`, or `single`. Legacy `thread` remains compatible when already configured but is not offered for new Web Shell configurations                                   |
 | `cwd`                    | No               | Working directory for the agent. Defaults to the current directory                                                                                                                                                      |
 | `approvalMode`           | No               | Tool approval mode for channel sessions. Unattended webhook tasks require `yolo`; the setting applies to every session on the channel                                                                                   |
 | `instructions`           | No               | Custom instructions prepended to the first message of each session                                                                                                                                                      |

package/bundled/qc-helper/docs/features/channels/plugins.md

@@ -46,17 +46,17 @@ The `type` must match a channel type registered by an installed extension. Check
 
 All standard channel options work with custom channels:
 
-| Option         | Description                                    |
-| -------------- | ---------------------------------------------- |
-| `senderPolicy` | `allowlist`, `pairing`, or `open`              |
-| `allowedUsers` | Static allowlist of sender IDs                 |
-| `sessionScope` | `user`, `thread`, or `single`                  |
-| `cwd`          | Working directory for the agent                |
-| `instructions` | Prepended to the first message of each session |
-| `model`        | Model override for the channel                 |
-| `groupPolicy`  | `disabled`, `allowlist`, `pairing`, or `open`  |
-| `dmPolicy`     | `open` or `disabled`                           |
-| `groups`       | Per-group settings                             |
+| Option         | Description                                                                                        |
+| -------------- | -------------------------------------------------------------------------------------------------- |
+| `senderPolicy` | `allowlist`, `pairing`, or `open`                                                                  |
+| `allowedUsers` | Static allowlist of sender IDs                                                                     |
+| `sessionScope` | `user`, `chat_thread`, or `single`; legacy `thread` remains compatible for existing configurations |
+| `cwd`          | Working directory for the agent                                                                    |
+| `instructions` | Prepended to the first message of each session                                                     |
+| `model`        | Model override for the channel                                                                     |
+| `groupPolicy`  | `disabled`, `allowlist`, `pairing`, or `open`                                                      |
+| `dmPolicy`     | `open` or `disabled`                                                                               |
+| `groups`       | Per-group settings                                                                                 |
 
 See [Overview](./overview) for details on each option.
 

package/bundled/qc-helper/docs/features/code-review.md

@@ -83,7 +83,7 @@ Step 3B: high, >500 src OR >3200 total: territory x dim.   [N+5..7+3H calls]
 Step 4:  Deduplicate --> Sharded verify (<=8 findings each)
            --> Aggregate                    [ceil(F/8) calls, F=findings]
 Step 5:  Iterative reverse audit, fanned out per chunk;
-           stop after 2 consecutive dry rounds (cap 5)
+           stop after 2 consecutive dry rounds (cap 10/5/3 by topology)
 Step 6:  Present findings + verdict (high; low pass: findings only)
          Canonicalize findings -> .qwen/tmp/...-findings.json
 Step 6B: Apply findings + record per-finding outcomes  (--fix only)
@@ -124,7 +124,7 @@ A **source** file that is largely rewritten (an existing file of 300+ lines that
 
 The checklist is split three ways on purpose. Handing one agent all eight checks over a 2 400-line file gets one of them done properly; three agents with two or three checks each get all of them done. Chunk agents do not substitute for this — on PR #6457 they held every one of these defects inside their assigned territory and reported none. What they lacked was not the lines but the question.
 
-Findings are verified in **sharded batches** (at most 8 findings per verification agent, all launched together). A verifier may reject a Critical only by quoting the code that contradicts it (or when the diff's own comments document the flagged behavior as deliberate); anything less certain is downgraded to low confidence rather than deleted — a silently rejected Critical is invisible to every later stage, while a downgraded one still reaches a human. After verification, **iterative reverse audit** hunts for gaps, fanned out one auditor per chunk per round, each with the cumulative finding list. The loop stops after **two consecutive dry rounds** (or 5 rounds, hard cap — reported as such rather than as convergence). One dry round is not evidence of convergence, and reverse-audit findings are verified like any other.
+Findings are verified in **sharded batches** (at most 8 findings per verification agent, all launched together). A verifier may reject a Critical only by quoting the code that contradicts it (or when the diff's own comments document the flagged behavior as deliberate); anything less certain is downgraded to low confidence rather than deleted — a silently rejected Critical is invisible to every later stage, while a downgraded one still reaches a human. After verification, **iterative reverse audit** hunts for gaps, fanned out one auditor per chunk per round, each with the cumulative finding list. The loop stops after **two consecutive dry rounds** (or at the plan's round cap — reported as such rather than as convergence). That cap follows the diff's topology: **10** on a small diff, where a round is a single auditor; **5** on a chunked one, where it is one auditor per chunk; and **3** on a huge diff (≥ 3000 effective lines) _when the run has a deadline_, because five ~90-minute rounds do not fit a six-hour CI ceiling and a review killed mid-flight posts nothing — with no deadline a huge diff keeps the chunked cap of 5. An operator can lower whichever cap applies for every review with the `review.reverseAuditRounds` setting; it can never raise one. One dry round is not evidence of convergence, and reverse-audit findings are verified like any other.
 
 ## Severity Levels
 
@@ -145,7 +145,8 @@ When reviewing a PR, `/review` creates a temporary git worktree (`.qwen/tmp/revi
 - Build and test commands run in isolation without polluting your local build cache
 - If anything goes wrong, your environment is unaffected — just delete the worktree
 - The worktree is automatically cleaned up after the review completes
-- If a review is interrupted (Ctrl+C, crash), the next `/review` of the same PR automatically cleans up the stale worktree before starting fresh
+- If a review is interrupted (Ctrl+C, crash), the next `/review` of the same PR automatically cleans up the stale worktree before starting fresh. If the interrupted session still leaves its lease behind — a hard kill that skips this, or a multi-prompt review interrupted during a later prompt — `/review` refuses and names the lease file to delete. Clean stops release it: a finished review and the early stops (empty diff, no new changes since the last review) all run `cleanup`, which releases the lease
+- The worktree is leased to its session: a second `/review` of a PR that is already under review refuses to start (naming the holder) rather than tear down the running review's worktree
 - Review reports and cache are saved to the main project directory (not the worktree)
 
 ## Cross-repo PR Review
@@ -299,9 +300,9 @@ For PR reviews the manifest is read from the merge base, so the PR under review
 
 ## Issue Fidelity
 
-For bugfix PRs, the Issue Fidelity agent fetches issue evidence directly instead of relying on PR description text. It uses `gh pr view <pr> --repo <owner/repo> --json closingIssuesReferences` for GitHub's strong closing-issue metadata, then `gh issue view <number> --repo <issue_owner>/<issue_repo> --json title,body,comments` for the original report and discussion — the `--json` form includes the issue **body** (the reporter's original repro), which `--comments` alone omits, and the issue's own repository is read from each reference (a PR can close an issue in a different repo). This agent runs only for PR targets; local-diff and file-path reviews skip it.
+For bugfix PRs, the Issue Fidelity agent fetches issue evidence directly instead of relying on PR description text. It runs the `qwen review issue-context <pr> --repo <owner/repo> --out <file>` subcommand, which resolves GitHub's strong closing-issue metadata and then fetches each referenced issue's title, **body** (the reporter's original repro), and full comment thread — each from the issue's own repository (a PR can close an issue in a different repo). This agent runs only for PR targets; local-diff and file-path reviews skip it.
 
-`closingIssuesReferences` is a discovery hint rather than proof the author linked the right issue: if it is empty but the PR references an apparent target issue, the agent still fetches it after judging relevance. Fetched issue text is treated as untrusted data (facts extracted, embedded instructions ignored). For relevant issues, the original reproduction, observed payload, expected behavior, and maintainer comments are treated as the highest-priority evidence for whether the PR fixes the right problem.
+The closing-issue set is a discovery hint rather than proof the author linked the right issue: if it is empty but the PR references an apparent target issue, the agent still fetches it after judging relevance (re-running with `--issue <n>`; a bare number resolves in the PR's repo, while `--issue <owner>/<repo>#<n>` fetches a cross-repo reference from its own repo). Fetched issue text is treated as untrusted data (facts extracted, embedded instructions ignored). For relevant issues, the original reproduction, observed payload, expected behavior, and maintainer comments are treated as the highest-priority evidence for whether the PR fixes the right problem.
 
 If the issue evidence shows an upstream service or provider returned malformed data outside the client contract, client-side parser or sanitizer changes are not treated as a valid root-cause fix unless a maintainer explicitly requested a defensive workaround. A test that replays malformed upstream output proves only that the workaround handles that shape; it does not prove the workaround is architecturally appropriate.
 
@@ -361,7 +362,7 @@ Medium- and high-effort reviews also save a structured JSON companion with the s
 
 The deterministic halves of the pipeline — argument parsing (`qwen review parse-args`) and the event/body decision (`qwen review compose-review`) — are tested subcommands rather than prompt text, so `--effort` grammar, `--comment` forcing, verdict caps, and downgrade behavior are pinned by unit tests and cannot drift with the model.
 
-**GitHub Enterprise:** reviewing a PR URL on a non-`github.com` host routes every GitHub call at that host — the review subcommands (`fetch-pr`, `pr-context`, `comment-status`, `presubmit`) accept `--host` and set it in code, so a forgotten host cannot silently retarget the review at `github.com`.
+**GitHub Enterprise:** reviewing a PR URL on a non-`github.com` host routes every GitHub call at that host — the review subcommands (`match-remote`, `meta`, `fetch-pr`, `pr-context`, `comment-status`, `issue-context`, `fetch-diff`, `comment-body`, `plan-diff`, `test-plan`, `presubmit`, `compose-review`, `submit`, `publish-assets`) accept `--host` and set it in code, so a forgotten host cannot silently retarget the review at `github.com`.
 
 Every run ends with one machine-readable line (`Review complete: <target> — <disposition>`), so scripts and CI wrappers can detect completion and outcome with a single `^Review complete: ` match.
 
@@ -421,12 +422,12 @@ Why the floors are where they are: on a nine-line typo fix, six inline walks are
 
 The high-effort pipeline bounds each stage (shard size, audit rounds), but total calls scale with findings — `ceil(F/8)` verification shards — and, under 3B, with chunk count (reverse audit runs per chunk per round). Typical 3A profile:
 
-| Stage                            | LLM calls                      | Notes                                                                                                          |
-| -------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------- |
-| Review agents (Step 3)           | 14 (+0-2)                      | Run in parallel; cross-repo skips Agents 1c and 7 (12), local/file skips Agent 0 (13)                          |
-| Sharded verification (Step 4)    | ceil(F/8)                      | F = findings; at most 8 per verification agent, launched together                                              |
-| Iterative reverse audit (Step 5) | 2-5 (3A); rounds × chunks (3B) | Two consecutive dry rounds to stop (cap 5); 3B fans out one auditor per chunk per round                        |
-| **Total**                        | **~17-23 (~15-22)**            | 3A same-repo: ~17-23 (typical ~17-19); cross-repo or local/file: ~15-22; 3B scales with chunks (see DESIGN.md) |
+| Stage                            | LLM calls                       | Notes                                                                                                                                                                                               |
+| -------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Review agents (Step 3)           | 14 (+0-2)                       | Run in parallel; cross-repo skips Agents 1c and 7 (12), local/file skips Agent 0 (13)                                                                                                               |
+| Sharded verification (Step 4)    | ceil(F/8)                       | F = findings; at most 8 per verification agent, launched together                                                                                                                                   |
+| Iterative reverse audit (Step 5) | 2-10 (3A); rounds × chunks (3B) | Two consecutive dry rounds to stop; the cap follows the topology — 10 on a small diff, 5 on a chunked one, 3 on a huge one when the run has a deadline. 3B fans out one auditor per chunk per round |
+| **Total**                        | **~17-28 (~15-27)**             | 3A same-repo: ~17-28 (typical ~17-19); cross-repo or local/file: ~15-27; 3B scales with chunks (see DESIGN.md)                                                                                      |
 
 Most PRs converge to the lower end of the range; the caps prevent runaway cost on pathological cases. At `--effort low` the review runs entirely inline — **0 subagent calls** — walking the diff once per angle instead of once in total.
 

package/bundled/qc-helper/docs/qwen-serve.md

@@ -434,6 +434,71 @@ Notes:
 >   matched case-sensitively by yargs `choices` (`--memory-project-scope
 Workspace` is rejected). Use lowercase values when copying between the two.
 
+### Built-in daemon Git relocation guard
+
+Every managed daemon ACP session applies a built-in pre-execution guard for
+model shell commands, independent of `--external-tool-guard-mode` and without
+any capability advertisement. The daemon owns the bound workspace and the
+session's current effective working directory; both are supplied from trusted
+session state and never accepted from the ACP child.
+
+The guard inspects the tools that run a shell command line — `run_shell_command`
+and `monitor` — and denies a mutating Git
+command before execution when its repository location resolves outside the
+session's effective working directory. Relocation is recognized for literal
+forms of `git -C <path>`, `git --git-dir[=]<path>`,
+`git --work-tree[=]<path>`, leading
+`GIT_DIR`/`GIT_WORK_TREE`/`GIT_COMMON_DIR`/`GIT_INDEX_FILE` assignments (also
+when made through `export`/`declare`/`readonly`, which keep them in the
+environment of every later command in the chain),
+directory-shifting wrapper flags (`env -C`, `sudo -D`), and `cd`, `pushd`, or
+`popd` builtins earlier in the same command chain. Common wrapper prefixes
+(`sh -c`, `bash -c`, `eval`, `sudo`, `nohup`, `timeout`, `exec`, `command`,
+`builtin`,
+`env`, path-qualified `git` binaries, and `{ …; }` / `! …` shell syntax) are
+unwrapped so the same policy applies to the inner Git invocation, and `$(…)`
+or backtick substitution bodies are analyzed as commands of their own.
+
+A sub-agent pinned to its own worktree is contained to that worktree rather
+than to the session's directory; a shell call whose execution directory the
+daemon cannot place is denied.
+
+Relative targets resolve from the command's effective starting directory
+(`arguments.directory` when present, otherwise the session's current effective
+working directory) after canonical path resolution, including `.git` gitfile
+redirects, symlinks, and per-worktree administrative directories. A relocated
+target that cannot be fully resolved before execution — a dynamic target
+(`$VAR`, backticks, `~`, globs), a path that does not exist yet, or an
+unreadable indirection — is denied for mutating or unclassifiable subcommands.
+A relocated target that cannot be resolved is denied whatever the subcommand
+is — including the read-only ones. Relocated commands whose subcommand is one
+of a small verified read-only set (`rev-parse`, `cat-file`) remain allowed
+once the target resolves, unless the command carries command-executing `-c`
+config, or
+it carries a `--output`, `--textconv`, or `--filters` flag: those write a file
+or run the target repository's configured drivers. Commands with no recognized
+relocation keep their existing behavior.
+Denials are final and are reported to the model as
+`Daemon shell guard denied a mutating Git command…` for a resolved, dynamic,
+or unresolvable repository location, and as
+`Daemon shell guard denied a shell command…` when the command could not be
+parsed, its payload could not be resolved, or an unrecognized program may run
+a relocated Git command.
+
+The guard is reliable against Git relocation written in the literal forms
+above — the mis-targeted command this control exists for — and is
+**best-effort, not a boundary**, against shell text written to defeat it:
+constructions that hide the relocation from a static reader may pass, and new
+ones will keep being found. Do not grant a daemon broader trust on the
+strength of it. It does not interpret script files,
+track environment variable values across commands, or analyze heredoc bodies
+(Git-shaped text inside a heredoc can be denied even though the shell never
+executes it). `/fork` and agent-backed workspace memory remember/dream remain
+available under the built-in guard; they are only restricted while the
+external provider mode below is active. An optional external tool guard
+remains an additional policy and receives the same request only after the
+built-in policy allows it.
+
 ### Required external Tool Guard
 
 This opt-in is for managed ACP deployments that need an external allow/deny