@qwen-code/qwen-code 0.21.6 → 0.21.7

package/chunks/{agent-headless-NTXKKGRO.js → agent-headless-PR7YCB7S.js}

@@ -4,69 +4,69 @@ import {
   AgentHeadless,
   ContextState,
   templateString
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-Y7E5LNLO.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
-import "./chunk-Z7JILXGX.js";
-import "./chunk-T5U6IM4C.js";
-import "./chunk-TSERKWCX.js";
-import "./chunk-33FNCQSY.js";
+import "./chunk-CNIID3TV.js";
+import "./chunk-MVUQRLOH.js";
+import "./chunk-XCWO3SMQ.js";
+import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DIT4V3XH.js";
+import "./chunk-RMH5OWLD.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-MOHAWIAW.js";
-import "./chunk-3PRJYMXC.js";
+import "./chunk-GNPNYXJB.js";
+import "./chunk-Y4NGLFGJ.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-4S4OEQ6U.js";
+import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-A5YZ3FA2.js";
-import "./chunk-YAVY33G4.js";
-import "./chunk-2UISUFHQ.js";
-import "./chunk-MBEMTXQT.js";
-import "./chunk-6WBWIPBF.js";
+import "./chunk-GM463R2B.js";
+import "./chunk-SEZ556DZ.js";
+import "./chunk-CJXIIILK.js";
+import "./chunk-3K7FH2KQ.js";
+import "./chunk-BVWVWGLE.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-WVAESIM6.js";
+import "./chunk-LZC3B5N2.js";
 import "./chunk-K623ENWT.js";
 import "./chunk-AQ37AY7B.js";
-import "./chunk-432XCUHF.js";
-import "./chunk-HU5TUALO.js";
-import "./chunk-XC656O42.js";
+import "./chunk-EQL65XGA.js";
+import "./chunk-IIJEYBNH.js";
+import "./chunk-22NBYCPD.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-QYPT3QUD.js";
-import "./chunk-QMBEW7EW.js";
+import "./chunk-3ULCB3NE.js";
+import "./chunk-BGG4MBYD.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
-import "./chunk-GLNBDYUX.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-QZKYZCN3.js";
-import "./chunk-MGSSJT27.js";
+import "./chunk-33ACCIIY.js";
+import "./chunk-L4N6TIP7.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-6O5DVH27.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-2DNKEBXY.js";
-import "./chunk-PX5DNLSA.js";
+import "./chunk-EI3HZX6C.js";
+import "./chunk-2U3WZGZG.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-E4WHKETF.js";
-import "./chunk-ZPPP6VCL.js";
-import "./chunk-D7D7RXIJ.js";
-import "./chunk-BOGOR4HB.js";
+import "./chunk-FVKHVJZQ.js";
+import "./chunk-NG2R4N5O.js";
+import "./chunk-IC4Z6LX6.js";
+import "./chunk-6EOI4HOK.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-BFHXDAR7.js";
-import "./chunk-TYERNYH4.js";
-import "./chunk-UH7Z7Y45.js";
-import "./chunk-5L6CQ4ZU.js";
+import "./chunk-KKBPOU75.js";
+import "./chunk-EUNWC2VS.js";
+import "./chunk-FOGU3LJX.js";
+import "./chunk-6M26GBKX.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-LKRMNRSN.js";
-import "./chunk-3RXUYQJI.js";
+import "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";

package/chunks/{anthropicContentGenerator-3CAHEZBM.js → anthropicContentGenerator-DTMVEL5M.js}

@@ -9,11 +9,11 @@ import {
 } from "./chunk-DGEIYUC3.js";
 import {
   RequestTokenizer
-} from "./chunk-H36SETQS.js";
+} from "./chunk-B2GJNDTV.js";
 import "./chunk-MPHPFVKK.js";
 import {
   resolveRequestTimeout
-} from "./chunk-GLNBDYUX.js";
+} from "./chunk-AXMWHKXA.js";
 import {
   createChildAbortController
 } from "./chunk-DJ2GSRLV.js";
@@ -27,7 +27,7 @@ import {
   convertSchema,
   safeJsonParse,
   setGenAiUsageProvenance
-} from "./chunk-WK4TJUEA.js";
+} from "./chunk-CKASRHZI.js";
 import {
   runtimeDiagnostics,
   setToolCallPreparations
@@ -37,8 +37,8 @@ import {
   reportAnthropicFollowingRequest,
   reportAnthropicRequest,
   reportAnthropicResponse
-} from "./chunk-URN76TKR.js";
-import "./chunk-2DNKEBXY.js";
+} from "./chunk-WCG5O7IP.js";
+import "./chunk-EI3HZX6C.js";
 import "./chunk-5WV5S2GT.js";
 import "./chunk-XWRJCPHC.js";
 import {
@@ -54,10 +54,10 @@ import {
 import {
   buildRuntimeFetchOptions,
   redactProxyError
-} from "./chunk-BFHXDAR7.js";
+} from "./chunk-KKBPOU75.js";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   require_ms
 } from "./chunk-YQ3U5MUC.js";

package/chunks/{artifact-tool-RROCCJDA.js → artifact-tool-U4VOZIK5.js}

@@ -8,7 +8,7 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-D7D7RXIJ.js";
+} from "./chunk-IC4Z6LX6.js";
 import {
   Storage,
   createDebugLogger,
@@ -18,7 +18,7 @@ import {
   makeRelative,
   shortenPath,
   unescapePath
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import "./chunk-QUGAUQGJ.js";
 import {
   init_esbuild_shims

package/chunks/{askUserQuestion-2EPPBPUZ.js → askUserQuestion-XOBQLPFA.js}

@@ -6,10 +6,10 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-D7D7RXIJ.js";
+} from "./chunk-IC4Z6LX6.js";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import "./chunk-QUGAUQGJ.js";
 import {
   init_esbuild_shims

package/chunks/{bridge-RPAU64CA.js → bridge-NU6YEEHK.js}

@@ -6,12 +6,12 @@ import {
   createHttpAcpBridge,
   extractErrorCode,
   extractErrorMessage
-} from "./chunk-OP2OHZ7K.js";
-import "./chunk-GLWP3FDB.js";
+} from "./chunk-LA7YLSR6.js";
+import "./chunk-MZSJ43WV.js";
 import "./chunk-XCGIMOLN.js";
 import "./chunk-OCPBI7J5.js";
-import "./chunk-SQC6K5HI.js";
-import "./chunk-UGTWD35F.js";
+import "./chunk-E33LOKRA.js";
+import "./chunk-NLREQJFK.js";
 import "./chunk-R574ATRM.js";
 import "./chunk-J26HHFI5.js";
 import "./chunk-6PLDPT2C.js";
@@ -19,69 +19,69 @@ import "./chunk-HIBNSEJE.js";
 import "./chunk-BKHCW2BI.js";
 import "./chunk-M5GB774H.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-A4VTILZT.js";
+import "./chunk-Y7E5LNLO.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
-import "./chunk-Z7JILXGX.js";
-import "./chunk-T5U6IM4C.js";
-import "./chunk-TSERKWCX.js";
-import "./chunk-33FNCQSY.js";
+import "./chunk-CNIID3TV.js";
+import "./chunk-MVUQRLOH.js";
+import "./chunk-XCWO3SMQ.js";
+import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DIT4V3XH.js";
+import "./chunk-RMH5OWLD.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-MOHAWIAW.js";
-import "./chunk-3PRJYMXC.js";
+import "./chunk-GNPNYXJB.js";
+import "./chunk-Y4NGLFGJ.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-4S4OEQ6U.js";
+import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-A5YZ3FA2.js";
-import "./chunk-YAVY33G4.js";
-import "./chunk-2UISUFHQ.js";
-import "./chunk-MBEMTXQT.js";
-import "./chunk-6WBWIPBF.js";
+import "./chunk-GM463R2B.js";
+import "./chunk-SEZ556DZ.js";
+import "./chunk-CJXIIILK.js";
+import "./chunk-3K7FH2KQ.js";
+import "./chunk-BVWVWGLE.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-WVAESIM6.js";
+import "./chunk-LZC3B5N2.js";
 import "./chunk-K623ENWT.js";
 import "./chunk-AQ37AY7B.js";
-import "./chunk-432XCUHF.js";
-import "./chunk-HU5TUALO.js";
-import "./chunk-XC656O42.js";
+import "./chunk-EQL65XGA.js";
+import "./chunk-IIJEYBNH.js";
+import "./chunk-22NBYCPD.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-QYPT3QUD.js";
-import "./chunk-QMBEW7EW.js";
+import "./chunk-3ULCB3NE.js";
+import "./chunk-BGG4MBYD.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
-import "./chunk-GLNBDYUX.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-QZKYZCN3.js";
-import "./chunk-MGSSJT27.js";
+import "./chunk-33ACCIIY.js";
+import "./chunk-L4N6TIP7.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-6O5DVH27.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-2DNKEBXY.js";
-import "./chunk-PX5DNLSA.js";
+import "./chunk-EI3HZX6C.js";
+import "./chunk-2U3WZGZG.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-E4WHKETF.js";
-import "./chunk-ZPPP6VCL.js";
-import "./chunk-D7D7RXIJ.js";
-import "./chunk-BOGOR4HB.js";
+import "./chunk-FVKHVJZQ.js";
+import "./chunk-NG2R4N5O.js";
+import "./chunk-IC4Z6LX6.js";
+import "./chunk-6EOI4HOK.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-BFHXDAR7.js";
-import "./chunk-TYERNYH4.js";
-import "./chunk-UH7Z7Y45.js";
-import "./chunk-5L6CQ4ZU.js";
+import "./chunk-KKBPOU75.js";
+import "./chunk-EUNWC2VS.js";
+import "./chunk-FOGU3LJX.js";
+import "./chunk-6M26GBKX.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-LKRMNRSN.js";
-import "./chunk-3RXUYQJI.js";
+import "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";

package/chunks/{channel-management-service-IGEUOVRT.js → channel-management-service-FSQ7SHYI.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-VWOVHOTT.js";
 import {
   getPlugin
-} from "./chunk-EMYZIABH.js";
+} from "./chunk-IUFV6FYU.js";
 import {
   canonicalizeWorkspace
 } from "./chunk-6PLDPT2C.js";

package/chunks/{channel-settings-store-ON64MF7G.js → channel-settings-store-35VQVUVV.js}

@@ -4,81 +4,81 @@ import {
   ChannelSettingsError,
   WorkspaceChannelSettingsStore,
   assertValidChannelSecretUpdates
-} from "./chunk-CJ5WLD5Y.js";
-import "./chunk-EMYZIABH.js";
-import "./chunk-PPUOYL77.js";
+} from "./chunk-H2UQ2M5Z.js";
+import "./chunk-IUFV6FYU.js";
+import "./chunk-PQBHU2IA.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
-import "./chunk-KHUA3NQV.js";
-import "./chunk-RK2EE3T7.js";
+import "./chunk-DBOFL3LQ.js";
+import "./chunk-VOARQPTA.js";
 import "./chunk-6PEXNQTX.js";
-import "./chunk-ACZRB7AD.js";
+import "./chunk-6XU3PH66.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
-import "./chunk-A4VTILZT.js";
+import "./chunk-Y7E5LNLO.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
-import "./chunk-Z7JILXGX.js";
-import "./chunk-T5U6IM4C.js";
-import "./chunk-TSERKWCX.js";
-import "./chunk-33FNCQSY.js";
+import "./chunk-CNIID3TV.js";
+import "./chunk-MVUQRLOH.js";
+import "./chunk-XCWO3SMQ.js";
+import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DIT4V3XH.js";
+import "./chunk-RMH5OWLD.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-MOHAWIAW.js";
-import "./chunk-3PRJYMXC.js";
+import "./chunk-GNPNYXJB.js";
+import "./chunk-Y4NGLFGJ.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-4S4OEQ6U.js";
+import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-A5YZ3FA2.js";
-import "./chunk-YAVY33G4.js";
-import "./chunk-2UISUFHQ.js";
-import "./chunk-MBEMTXQT.js";
-import "./chunk-6WBWIPBF.js";
+import "./chunk-GM463R2B.js";
+import "./chunk-SEZ556DZ.js";
+import "./chunk-CJXIIILK.js";
+import "./chunk-3K7FH2KQ.js";
+import "./chunk-BVWVWGLE.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-WVAESIM6.js";
+import "./chunk-LZC3B5N2.js";
 import "./chunk-K623ENWT.js";
 import "./chunk-AQ37AY7B.js";
-import "./chunk-432XCUHF.js";
-import "./chunk-HU5TUALO.js";
-import "./chunk-XC656O42.js";
+import "./chunk-EQL65XGA.js";
+import "./chunk-IIJEYBNH.js";
+import "./chunk-22NBYCPD.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-QYPT3QUD.js";
-import "./chunk-QMBEW7EW.js";
+import "./chunk-3ULCB3NE.js";
+import "./chunk-BGG4MBYD.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
-import "./chunk-GLNBDYUX.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-QZKYZCN3.js";
-import "./chunk-MGSSJT27.js";
+import "./chunk-33ACCIIY.js";
+import "./chunk-L4N6TIP7.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-6O5DVH27.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-2DNKEBXY.js";
-import "./chunk-PX5DNLSA.js";
+import "./chunk-EI3HZX6C.js";
+import "./chunk-2U3WZGZG.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-E4WHKETF.js";
-import "./chunk-ZPPP6VCL.js";
-import "./chunk-D7D7RXIJ.js";
-import "./chunk-BOGOR4HB.js";
+import "./chunk-FVKHVJZQ.js";
+import "./chunk-NG2R4N5O.js";
+import "./chunk-IC4Z6LX6.js";
+import "./chunk-6EOI4HOK.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-BFHXDAR7.js";
-import "./chunk-TYERNYH4.js";
-import "./chunk-UH7Z7Y45.js";
-import "./chunk-5L6CQ4ZU.js";
+import "./chunk-KKBPOU75.js";
+import "./chunk-EUNWC2VS.js";
+import "./chunk-FOGU3LJX.js";
+import "./chunk-6M26GBKX.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-LKRMNRSN.js";
-import "./chunk-3RXUYQJI.js";
+import "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-KGJGEEVR.js";
 import "./chunk-75DOP5OR.js";

package/chunks/{chunk-XC656O42.js → chunk-22NBYCPD.js}

@@ -5,17 +5,17 @@ import {
 } from "./chunk-NAVJD2PQ.js";
 import {
   formatFetchErrorForUser
-} from "./chunk-QYPT3QUD.js";
+} from "./chunk-3ULCB3NE.js";
 import {
   combineAbortSignals
 } from "./chunk-DJ2GSRLV.js";
 import {
   atomicWriteFile
-} from "./chunk-UH7Z7Y45.js";
+} from "./chunk-FOGU3LJX.js";
 import {
   Storage,
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-T4JSA7KU.js → chunk-23RZCH76.js}

@@ -2,16 +2,16 @@
 "use strict";
 import {
   useKeypress
-} from "./chunk-75QMRMO7.js";
+} from "./chunk-MAJS7AT4.js";
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
 import {
   t
-} from "./chunk-KHUA3NQV.js";
+} from "./chunk-DBOFL3LQ.js";
 import {
   APPROVAL_MODES
-} from "./chunk-6WBWIPBF.js";
+} from "./chunk-BVWVWGLE.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-PX5DNLSA.js → chunk-2U3WZGZG.js}

@@ -8,10 +8,10 @@ import {
 } from "./chunk-VGC4I5JJ.js";
 import {
   isAnyAutoMemPath
-} from "./chunk-E4WHKETF.js";
+} from "./chunk-FVKHVJZQ.js";
 import {
   STRUCTURED_OUTPUT_REDACTED_ARGS
-} from "./chunk-ZPPP6VCL.js";
+} from "./chunk-NG2R4N5O.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
@@ -19,10 +19,10 @@ import {
   StructuredToolError,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-D7D7RXIJ.js";
+} from "./chunk-IC4Z6LX6.js";
 import {
   DEFAULT_QWEN_MODEL
-} from "./chunk-BOGOR4HB.js";
+} from "./chunk-6EOI4HOK.js";
 import {
   estimateTextTokens,
   generateLegacyMcpToolName,
@@ -30,10 +30,10 @@ import {
 } from "./chunk-46UV252V.js";
 import {
   InstallationManager
-} from "./chunk-TYERNYH4.js";
+} from "./chunk-EUNWC2VS.js";
 import {
   atomicWriteFile
-} from "./chunk-UH7Z7Y45.js";
+} from "./chunk-FOGU3LJX.js";
 import {
   isTelemetrySdkInitialized,
   recordApiErrorMetrics,
@@ -55,7 +55,7 @@ import {
   recordTokenUsageMetrics,
   recordToolCallMetrics,
   recordToolExecutionMetrics
-} from "./chunk-5L6CQ4ZU.js";
+} from "./chunk-6M26GBKX.js";
 import {
   require_src,
   safeJsonStringify
@@ -113,9 +113,10 @@ import {
   isNodeError,
   isSubpaths,
   makeRelative,
+  realpathNearestExisting,
   shortenPath,
   unescapePath
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   SemanticAttributes,
   init_esm
@@ -16069,7 +16070,7 @@ __name(memoryFreshnessNote, "memoryFreshnessNote");
 init_esbuild_shims();
 import path8 from "node:path";
 function getFileReadDefaultPermission(config, requestedPath) {
-  const filePath = path8.resolve(requestedPath);
+  const filePath = realpathNearestExisting(path8.resolve(requestedPath));
   const workspaceContext = config.getWorkspaceContext();
   const allowedRoots = [
     config.storage.getProjectTempDir(),
@@ -16085,11 +16086,18 @@ function getFileReadDefaultPermission(config, requestedPath) {
     // back must not stall on a confirmation prompt. The dir holds only
     // session plan files, never credentials or settings.
     config.getPlansDir()
-  ];
+  ].map(realpathNearestExisting);
   if (workspaceContext.isPathWithinWorkspace(filePath) || isSubpaths(allowedRoots, filePath) || // isAnyAutoMemPath narrows to the managed auto-memory roots
   // (per-project + user-level under ~/.qwen/memories/) — never the
   // broad getMemoryBaseDir() — to avoid exposing sensitive ~/.qwen
   // files such as settings.json or OAuth credentials.
+  //
+  // Asymmetric with allowedRoots on purpose: the candidate is canonicalized
+  // but the memory roots stay lexical. In local-memory mode that root sits
+  // under a repo-tracked `.qwen/`, so canonicalizing it would let a checked-in
+  // `.qwen -> /outside` relocate the allowed root — see
+  // getAutoMemoryTrustedAnchor. Candidate-only is fail-closed and still
+  // refuses a link planted inside the root.
   isAnyAutoMemPath(filePath, config.getTargetDir())) {
     return "allow";
   }