Repository navigation
feat: add hybrid code mode - #11854
DragonnZhang wants to merge 68 commits into
Conversation
E2E test report
|
doudouOUC
left a comment
doudouOUC
left a comment
There was a problem hiding this comment.
Read the full diff of the ten production files and audited every non-test getToolMode/getCodeModeOnly/isCodeModeEnabled read site at this head. No new production defect found — and, per the review rules, I re-verified the four open Criticals against the code as it stands rather than against their threads. All four still stand; I am not re-filing them, listing them here only so the record shows they were measured at this commit.
- R1-1 — still stands.
packages/cli/src/config/config.ts:2261-2264passessettings.tools?.modestraight through (? (settings.tools?.mode ?? ToolMode.Direct)), whilepackages/core/src/config/config.ts:10399gates registration with a denylist (if (this.getToolMode() === ToolMode.Direct) return;). An out-of-union value therefore registersexecwhile the other read sites treat the session asdirect. I confirmed there is no value validation on the settings-load path. - R1-22 — still stands.
agent-core.ts:1720-1724:isCodeModeEnabled(...) && this.executionAllowedExactTools?.has(ToolNames.EXEC) && getToolExposure(toolName) === 'code-mode-callable'returns true, i.e. an allowlist containing onlyexecauthorises direct calls to every code-mode-callable tool. In hybrid there is no second wall (the scheduler gate isCodeModeOnly-only, which I verified is correct for hybrid). - R1-2 and R1-3 I did not re-derive line by line; the first needs only that
ToolModeis a value import evaluated at module load insettingsSchema.ts(it is), and the second only thatagent-core.tsnarrowsdeclarationNamesto{exec} ∪ configuredNameswhile the binding plan keeps the widened set (it does).
Verified correct for hybrid, so no change is needed there: the twelve unconverted === CodeModeOnly checks are each semantically right for code_mode (scheduler/ACP direct-call gates, deferred reveal and preload, getDeferredToolSummary, the zoom hint); planCodeModeBindings builds a fresh plan per call, so there is no cache-staleness path; tool_search stays registered and top-level-visible in hybrid with revealed deferred tools receiving augmented declarations through the normal refresh; and no codeModeOnly stragglers remain in any production file, with the regenerated settings.schema.json enum matching the schema source.
|
@qwen-code /takeover from 5 |
qwen-code-dev-bot
added
the
autofix/takeover
|
🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This window's round counter starts at 5 (the rounds this PR spent in review before takeover), so the Critical-only brake engages after 0 more change-producing round(s) instead of a full fresh 5. Remove the 中文说明🤝 已接管：autofix 循环现在管理此 PR —— 将持续处理新的评审反馈与 base 冲突，直到移除标签或达到轮次上限。本窗口轮次计数从 5 起算（即本 PR 托管前已进行的评审轮数），因此再经过 0 个产生改动的轮次即进入 Critical-only，而非重新计满 5 轮。移除 |
- web-shell: call the exported isSettingVisible in the code-mode alias test and sync the mirrored alias table to tools.mode, fixing the ReferenceError and stale-alias failures in the Test job - coreToolScheduler: render only the skill invocation surfaces the session actually has — no exec surface in direct mode where exec is never registered, no top-level Skill surface in code_mode_only where direct skill calls are rejected - agent-core: let MCP tool names fall through to the exact-name and pattern checks before the nested exec gateway admits them, so a server-level executionAllowedTools pattern is honored for nested bindings - docs/settings: sync the threshold bridge-mode wording, the container execution fallback, and the zh-CN withheld-tool translation with the shipped behavior
# Conflicts: # packages/cli/src/config/settingsSchema.ts # packages/core/src/config/config.ts # packages/vscode-ide-companion/schemas/settings.schema.json
|
🤖 Addressed the latest review feedback (round 6/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 6/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #11854Round mode: Critical-only (window seeded at round 5). Scope this round: the failed Commits: Resolved findingsR4-1 (rc:4066711873) — Critical — web-shell test calls nonexistent
|
|
🔀 Base updated: red check(s) [Test (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run. 中文说明🔀 已更新 base：红色检查 [Test (ubuntu-latest, Node 22.x)] 在当前 main 上通过 —— 已通过 update-branch 合入当前 main，CI 将重新运行。 |
|
🤖 Could not produce a passing fix for this feedback (round 7/100). This item now needs a human; the loop stays engaged and still picks up new feedback and base conflicts, but will not retry this item on its own. What I found before stopping: See the Qwen Autofix agent step logs for model/tool output. 中文说明🤖 未能为该反馈产生可通过验证的修复（第 7/100 轮）。此项现在需要人工处理；循环保持在线，仍会拾取新反馈与 base 冲突，但不会自行重试此项。 Run log: https://github.com/QwenLM/qwen-code/actions/runs/38693181081 🧠 Handled by Qwen Code · model/模型 |
|
🔀 Base updated: red check(s) [Test (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run. 中文说明🔀 已更新 base：红色检查 [Test (ubuntu-latest, Node 22.x)] 在当前 main 上通过 —— 已通过 update-branch 合入当前 main，CI 将重新运行。 |
|
Qwen Code review was cancelled before a review could be posted. Nothing failed and nothing is retried automatically: the run was cancelled — by an operator, an upstream event, or the job exceeding its execution time limit. If you still want a review of this PR, request one with |
|
🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下： Autofix round — no action takenWhat arrived this round
Why no code change
VerificationNo build, lint, or test commands were run because the round produced no diff — re-running them would only re-confirm the already-green CI state of the unchanged head commit. Read-only inspection performed:
中文说明Autofix 本轮 — 未做任何改动本轮收到的内容
为何不修改代码
验证情况由于本轮没有产生任何代码改动，未运行构建、lint 或测试命令——重复运行只会再次确认未变更头提交上已有的绿色 CI 状态。已执行的只读检查：
Deferred non-Critical feedbackCritical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. ( 中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 🧠 Handled by Qwen Code · model/模型 |
|
@qwen-code /review |
|
Qwen Code review request accepted. Review is queued for an available runner; follow the workflow run for progress. A command-triggered review is not listed under the checks of this PR; the result is posted here as a review when it finishes. |
|
Qwen Code review timed out. Qwen review timed out after 21600 seconds (of the 360-minute budget). This run already used the maximum 360 minute timeout. See workflow logs. |
|
🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下： Autofix round: no action neededNo changes were made in this round. Here is why:
The branch is left exactly as it was at the start of the round: no commits, no working-tree modifications. 中文说明Autofix 本轮:无需处理本轮未做任何修改,原因如下:
分支保持本轮开始时的状态:没有新提交,工作区没有任何修改。 Deferred non-Critical feedbackCritical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 🧠 Handled by Qwen Code · model/模型 |
# Conflicts: # packages/cli/src/ui/AppContainer.test.tsx
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
🤖 Addressed the latest review feedback (round 8/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 8/100 轮）。改动内容与我反驳保留之处如下： Autofix round summaryFeedback triage
Root cause
Changes
Mutation probe: replacing the scoped implementation with Conflict resolution
Verification
中文说明Autofix 本轮摘要反馈分诊
根因
变更
变异探针：把作用域实现换回 冲突解决
验证
Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: conflicted with main — resolved in this push. · 与 main 有冲突——已在本次推送中解决。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
|
🤖 AutoFix ran out of time before finishing (timeout (3600000ms)) (attempt 9/100) — it will retry on the next scan.
See the Qwen Autofix agent step logs for model/tool output. 中文说明🤖 AutoFix 在完成前耗尽了时间（timeout (3600000ms)）（第 9/100 次尝试）—— 将在下次扫描时重试。 Run log: https://github.com/QwenLM/qwen-code/actions/runs/39356318930 🧠 Handled by Qwen Code · model/模型 |
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
[Critical] Blocking finding(s) follow.
Partially reviewed — gaps disclosed.
Unresolved, please confirm:
- [Critical] R14-2 docs/developers/tools/task.md:17 — the recovered ledger truncated this prior-round Critical's claim; the current task.md text (exec admitted under either code mode, tool_search under code_mode_only) matches the code, but the original …
- [Critical] R1-2 packages/cli/src/config/settingsSchema.ts — asserted still standing by maintainer @doudouOUC at an earlier commit; not independently re-verified at the reviewed commit within the time budget
- [Critical] R1-3 packages/core/src/agents/runtime/agent-core.ts (declarationNames narrowing vs binding plan) — asserted still standing by @doudouOUC at an earlier commit; not independently re-verified at the reviewed commit within the time budget
Not reviewed: build-and-test — 'Integration Tests (CLI, No Sandbox)' was skipped in CI and its suite did not run locally.
Not explored to full depth (tool budget reached): "agent reverse-audit (round 1)": did not read packages/core/src/agents/runtime/subagent-plan-tool-policy.test.ts (lines 229-460) or agent-core.skill-eager-review.test.ts , so I have not conf…; "agent reverse-audit (round 1)": the claim "Hybrid AgentCore surfaces exclude tools hidden by tools.eager from nested bindings; Only retains these deferred targets" ( docs/design/code-mode.md…; "agent reverse-audit (round 1)": "withheld-tool warnings describe the actual available bindings" (acceptance criteria) — I did not locate the withheld-tool warning emitter, so this bullet is un…; "agent reverse-audit (round 2)": did not execute packages/core/src/code-mode/code-mode.test.ts or packages/core/src/code-mode/scheduler.test.ts , and did not mutation-test the canonicalName…; "agent reverse-audit (round 2)": did not enumerate every surface that builds advertised declarations (ACP/daemon session mappers, fork declaration-prefix reuse in agent-core.ts:2196-2205 , cl…, and 25 more.
Not reviewed: reverse audit — stopped before round 3 by the review time budget.
— [unverified] tag when the loop ended — the verifier never ruled on them, and they are not confirmed.
Deferred under the convergence posture (round 15, not a blocker) — recorded, not requested in this round:
docs/design/code-mode-only.zh-CN.md:123 — [review] The newly added Chinese design doc inverts the English source's concurrency rule: it says nested Promise.all batches are handled by the existing read-only concurrency classifier, while c…docs/design/code-mode.md:3 — [review] The new code-mode.md (and its twin code-mode.zh-CN.md:3 ) opens with a byte-identical copy of the banner this PR also adds to docs/design/code-mode-only.md:3 , but its last sentence dangles here: c…docs/design/code-mode.md:43 — [review] The new design doc's mode-resolution paragraph enumerates the forced- direct environments but omits the SSH-workspace fallback this same PR adds, and the unrecognized-value fallback; docs/design/code…docs/developers/sdk-typescript.md:69 — [review] This added sentence scopes the bridge/warning rules to "direct and hybrid **code** modes", but in this codebase "code modes" is a defined term that *excludes* Direct; the authoritative schema …docs/users/configuration/settings.md:403 — [review] This diff adds the same Code Mode Only discovery paragraph to the tools.eager row that it also adds to the new tools.mode row, producing three near-identical copies inside a 32-line sp…packages/cli/src/config/settingsUtils.ts:660 — [review] The else branch of getDisplayValue now evaluates the exact same expression as the else if above it, making the settingExistsInScope(key, settings) condition (and its comment) d…packages/cli/src/ui/commands/contextCommand.test.ts:1088 — [review] The new if (!declaration) continue; removes the only mechanism that could make clampDeficit materially nonzero, but the diff leaves two comments that still name that me…packages/core/src/agents/runtime/agent-core.skill-gate.test.ts:698 — [review] The added block re-inlines the seven-line private-field cast nine times (lines 704, 741, 993, 1042, 1090, 1130, 1176, 1212, 1244) instead of calling the file's ow…packages/core/src/agents/runtime/agent-core.ts:1976 — [review] The new getInheritedToolExecutionAllowlist() turns the policy-frame publish from one O(n) allowlist computation into O(n²), because the per-name filter calls isToolExecutionA…packages/core/src/agents/runtime/agent-core.ts:2026 — [review] The same five-line "split the configured allowlist into exact names and * patterns, then raw-identity match" expression is written out twice inside one return — once for the…packages/core/src/agents/runtime/subagent-plan-tool-policy.ts:175 — [review] toolConfigAllowsSkill now takes four adjacent, same-typed boolean positional parameters, and this diff moved one of them ( codeModeOnly ) from position 2 to posi…packages/core/src/core/client.test.ts:3475 — [review] The test named reports only code-mode-callable withheld tools as reachable through exec uses a substring assertion that also matches the wrong message, so it does not pin the "only" in…packages/core/src/core/coreToolScheduler.ts:6154 — [review] The diff grows an already-duplicated block: the whole "wrap execution in the ambient allowlist + code-mode runtime/source context" decision is now 25 byte-identical lines copy-past…packages/core/src/tools/agent/agent.ts:2021 — [review] The new nestedExecutionAllowedTools is the only fork allowlist that is not passed through resolveForkExecutionAllowedTools() , so display_image — the one tool the fork path deliber…packages/core/src/tools/agent/fork-subagent.ts:428 — [review] The new fork task-prompt sentence asserts exec is callable from toolMode alone, while every other new gate in this PR treats "code mode + exec not registered" as a live state…packages/core/src/tools/skill-utils.ts:280 — [review] Rewording the activation envelope left the two #12235 regression guards building the *old* envelope text, so neither now pins the shape the scheduler actually emits.packages/core/src/tools/tool-registry.ts:281 — [review] The new public ToolRegistry.forSubAgent field is written by one caller and read by no production code — a dead switch on a core-infrastructure class.packages/core/src/utils/fileUtils.ts:1771 — [review] Any ambient code-mode allowlist suppresses the zoom hint outright, even though the *nested* (exec) route can be resolved precisely from that same allowlist via getCodeModeBindingPlan(new…
Mechanism health: this round did not close cleanly, so it withholds the incremental anchor — and the round it recovered had no anchor this round could use either — none at all, one with no certifier, one certified by an identity other than the one this round runs under, or one this round's fetch refused or resolved to the head — so the next review re-reads the whole diff unless recovery grafts an earlier own anchor that the round running it can use onto the complete work list this round leaves behind, and keeps doing so until a round's marker carries an anchor again or a graft lands that the round running it can use. (Stated, not acted on — this changes nothing about what the round posts.)
中文说明
仅完成部分审查，审查缺口已披露。
未决，请确认：共 3 条（原文未翻译，列表见上方英文部分）。
未审查（原文为英文）：build-and-test — 'Integration Tests (CLI, No Sandbox)' was skipped in CI and its suite did not run locally.
未探索到全部深度（达到工具调用预算）："agent reverse-audit (round 1)"：did not read packages/core/src/agents/runtime/subagent-plan-tool-policy.test.ts (lines 229-460) or agent-core.skill-eager-review.test.ts , so I have not conf…；"agent reverse-audit (round 1)"：the claim "Hybrid AgentCore surfaces exclude tools hidden by tools.eager from nested bindings; Only retains these deferred targets" ( docs/design/code-mode.md…；"agent reverse-audit (round 1)"："withheld-tool warnings describe the actual available bindings" (acceptance criteria) — I did not locate the withheld-tool warning emitter, so this bullet is un…；"agent reverse-audit (round 2)"：did not execute packages/core/src/code-mode/code-mode.test.ts or packages/core/src/code-mode/scheduler.test.ts , and did not mutation-test the canonicalName…；"agent reverse-audit (round 2)"：did not enumerate every surface that builds advertised declarations (ACP/daemon session mappers, fork declaration-prefix reuse in agent-core.ts:2196-2205 , cl…，另有 25 条。
未审查：反向审计——评审时间预算不足，未能开始第 3 轮。
— [unverified] 标记——验证者从未对它们作出裁决，它们不算已确认。
收敛姿态下延后（第 15 轮，非阻断）——已记录，本轮不要求修改：共 18 条（原文未翻译，列表见上方英文部分）。
机制健康：本轮未能干净收尾，因而扣留了增量锚点，而它恢复到的那一轮也没有留下本轮可用的锚点——要么完全没有、要么没有认证者、要么由本轮运行身份之外的身份认证、要么被本轮的获取拒绝或解析为头提交——因此下一次评审将重读整个 diff，除非恢复流程把本轮能使用的更早自有锚点嫁接到本轮留下的完整工作清单上；并会一直如此，直到某一轮的标记重新带上锚点，或落地的嫁接能被运行该轮的评审使用。（仅陈述，不据此行动——这不改变本轮发布的任何内容。）
— qwen3.8-max via Qwen Code /review (v0.25.3)
|
🤖 Addressed the latest review feedback (round 10/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 10/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #11854Mode: address-review (Critical-only window, round 15). Commit: Actionable findingsR14-2 —
|
|
📊 Takeover milestone — round 10/100, in the current window. Census: 5 pushed fix(es), 5 no-change review(s), 1 timeout(s), 1 rejected attempt(s), 0 deliberate stop(s) under instruction (deferred to a human), 3 other round(s) (crash / model error / gate error / infra), 6 base update(s). This many rounds deserves a human look. Options: keep going (fine — nothing changes), split or reduce the PR if rounds keep accumulating, or release takeover (remove the 中文说明📊 接管里程碑 —— 第 10/100 轮（当前窗口）。统计：推送修复 5 次、审阅无需改动 5 次、超时 1 次、验证拒绝 1 次、按指示有意停止（移交人工）0 次、其他轮次（崩溃/模型错误/门错误/infra）3 次、base 更新 6 次。 轮次到这个量值得人工看一眼。可选：继续（无需操作）；若轮次持续累积，考虑拆分或缩减 PR；或释放接管（移除 |
qwen-code-review-bot
left a comment
qwen-code-review-bot
left a comment
There was a problem hiding this comment.
[Critical] Blocking finding(s) follow.
Partially reviewed — gaps disclosed.
Unresolved, please confirm:
- [Critical] 4 entries — prior-round Critical; not re-ruled this round: the review time budget was exhausted before the open-blocker walk could run; the round-15 review body holds its latest ruling:
- R12-2
- R1-21
- R7-3
- R10-4
Not explored to full depth (tool budget reached): "agent reverse-audit (round 1)": did not trace isCodeModeToolCallAllowed 's call sites to confirm whether a model-issued direct call to an ordinary tool is actually refused under code_mode_on…; "agent reverse-audit (round 1)": could not execute the two new test files ( bundled-reference.test.ts , subagent-manager.skill-eager-review.test.ts ) — the review worktree has no node_modules…; "agent reverse-audit (round 1)": the three further sentences this diff adds to the tools.eager description — AgentCore excluding still-hidden tools.eager tools from nested bindings in hybri…; "agent reverse-audit (round 1)": did not execute npx vitest run src/tools/agent/agent.code-mode-review.test.ts — all four findings rest on reading the producer ( fork-subagent.ts:417-493 ), t…; "agent reverse-audit (round 1)": toctou layer — did not trace whether the ambient AsyncLocalStorage allowlist installed by coreToolScheduler.ts:6175 / :6234 ( runWithCodeModeAllowedNames ) …, and 25 more.
Not reviewed: reverse audit — stopped before round 3 by the review time budget.
— [unverified] tag when the loop ended — the verifier never ruled on them, and they are not confirmed.
Deferred under the convergence posture (round 16, not a blocker) — recorded, not requested in this round:
docs/design/code-mode-only.zh-CN.md:122 — [review] zh design doc contradicts EN doc and shipped code on nested code-mode concurrency classificationdocs/design/code-mode-only.zh-CN.md:9 — [review] zh Status section omits the EN 'Partly superseded by Lazy Code Mode' paragraphdocs/design/code-mode.md:43 — [review] code-mode.md enumerates two of three forced-direct paths, omitting the SSH-workspace downgrade this PR shipsdocs/design/code-mode.md:3 — [review] code-mode.md opening banner copied verbatim from code-mode-only.md declares this new file's own body supersededdocs/users/configuration/settings.md:403 — [review] Same six-sentence Code Mode semantics block now appears three times on one page and the copies have divergedpackages/cli/src/config/config.test.ts:4564 — [review] No test pins precedence when both tools.mode and legacy tools.codeModeOnly are presentpackages/cli/src/config/settingsUtils.ts:629 — [review] Unconditional tools.mode force-persist writes explicit direct on Workspace Default reset, shadowing an inherited User-scope modepackages/cli/src/config/settingsUtils.ts:657 — [review] getDisplayValue's last two arms are byte-identical; the settingExistsInScope condition is deadpackages/core/src/agents/background-agent-resume.ts:1042 — [review] skillRegistered argument cannot change any outcome at its only call site — dead switch on the resume wrapperpackages/core/src/agents/runtime/agent-core.skill-gate.test.ts:26 — [review] Rewritten header comment overstates the exec requirement: hybrid wildcard/skill entries announce without execpackages/core/src/agents/runtime/agent-core.skill-gate.test.ts:521 — [review] New test replaces CoreToolScheduler.prototype.schedule with a never-restored spypackages/core/src/agents/runtime/agent-core.ts:2026 — [review] MCP allowlist exact/wildcard split written inline twice more — three copies of one classification rule that must agreepackages/core/src/agents/runtime/subagent-plan-tool-policy.ts:177 — [review] toolConfigAllowsSkill takes four adjacent defaulted positional booleans — a transposed argument typechecks and silently inverts the skill gatepackages/core/src/core/coreToolScheduler.ts:6786 — [review] Activation reminder made surface-neutral, but the startup <available_skills> snapshot this PR newly enables for CodeModeOnly still names the undeclared Skill toolpackages/core/src/subagents/subagent-manager.ts:1217 — [review] Recovered skillRegistered mirrors only PermissionManager status, missing the registry's isToolDisabled gate — child can hold a SkillManager with no possible Skill toolpackages/core/src/tools/agent/agent.ts:3900 — [review] nestedExecutionAllowedTools spread inserted between the blocklist-persistence comment and the spread it explains; comment now misdescribes the nested listpackages/core/src/tools/tool-registry.ts:281 — [review] New public ToolRegistry.forSubAgent field is written by production and read by nothing — dead switch on a core classpackages/core/src/utils/fileUtils.ts:1771 — [review] Zoom-hint reachability keyed on ambient-allowlist presence instead of contents — every code-mode agent loses the zoom hint, including when its allowlist contains zoom_imagepackages/core/src/utils/fileUtils.test.ts:1288 — [review] it.each title renders neither toolMode nor allowedNames — several distinct cases share an identical test namepackages/web-shell/client/settings/messages.ts:355 — [review] zh-CN settings string drops the 'In both code modes' scope on the agent-allowlist narrowing clause- …and 24 more (see the run report)
Mechanism health: this round did not close cleanly, so it withholds the incremental anchor — and the round it recovered had no anchor this round could use either — none at all, one with no certifier, one certified by an identity other than the one this round runs under, or one this round's fetch refused or resolved to the head — so the next review re-reads the whole diff unless recovery grafts an earlier own anchor that the round running it can use onto the complete work list this round leaves behind, and keeps doing so until a round's marker carries an anchor again or a graft lands that the round running it can use. (Stated, not acted on — this changes nothing about what the round posts.)
中文说明
仅完成部分审查，审查缺口已披露。
未决，请确认：共 4 条（原文未翻译，列表见上方英文部分）。
未探索到全部深度（达到工具调用预算）："agent reverse-audit (round 1)"：did not trace isCodeModeToolCallAllowed 's call sites to confirm whether a model-issued direct call to an ordinary tool is actually refused under code_mode_on…；"agent reverse-audit (round 1)"：could not execute the two new test files ( bundled-reference.test.ts , subagent-manager.skill-eager-review.test.ts ) — the review worktree has no node_modules…；"agent reverse-audit (round 1)"：the three further sentences this diff adds to the tools.eager description — AgentCore excluding still-hidden tools.eager tools from nested bindings in hybri…；"agent reverse-audit (round 1)"：did not execute npx vitest run src/tools/agent/agent.code-mode-review.test.ts — all four findings rest on reading the producer ( fork-subagent.ts:417-493 ), t…；"agent reverse-audit (round 1)"：toctou layer — did not trace whether the ambient AsyncLocalStorage allowlist installed by coreToolScheduler.ts:6175 / :6234 ( runWithCodeModeAllowedNames ) …，另有 25 条。
未审查：反向审计——评审时间预算不足，未能开始第 3 轮。
— [unverified] 标记——验证者从未对它们作出裁决，它们不算已确认。
收敛姿态下延后（第 16 轮，非阻断）——已记录，本轮不要求修改：共 44 条（原文未翻译，列表见上方英文部分）。
机制健康：本轮未能干净收尾，因而扣留了增量锚点，而它恢复到的那一轮也没有留下本轮可用的锚点——要么完全没有、要么没有认证者、要么由本轮运行身份之外的身份认证、要么被本轮的获取拒绝或解析为头提交——因此下一次评审将重读整个 diff，除非恢复流程把本轮能使用的更早自有锚点嫁接到本轮留下的完整工作清单上；并会一直如此，直到某一轮的标记重新带上锚点，或落地的嫁接能被运行该轮的评审使用。（仅陈述，不据此行动——这不改变本轮发布的任何内容。）
— qwen3.8-max@e6bf8ffe via Qwen Code /review (v0.25.3)
|
🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下： Autofix — no code change for PR #11854 (round 17)The round-16 review completed partially: it added no inline or issue-level comments and did not re-rule the blockers it carries. I checked each carried item against HEAD Carried findings
Notes
Verification
中文说明Autofix —— PR #11854 本轮（第 17 轮）不改代码第 16 轮评审只完成了一部分：没有新增行内评论或 issue 级评论，也没有对携带的阻断项重新裁决。我按当前 HEAD 携带的发现
说明
验证
Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: conflicts with main (no review fix needed, but a rebase/merge is required before merge). · 与 main 有冲突（无需评审修复，但合并前需 rebase/merge）。 🧵 Resolved all 2 selected review thread(s). · 已关闭全部选中的 2 条评审线程。 🧠 Handled by Qwen Code · model/模型 |
|
🤖 Addressed the latest review feedback (round 11/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 11/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #11854Feedback triageNo actionable review feedback arrived this round: the Reviews, Inline comments, The deferred non-Critical section was left untouched per Critical-only mode, Changes
Both sides are load-bearing in the merged file, so the resolution keeps both Verification
中文说明自动修复轮次总结 — PR #11854反馈分诊本轮没有可执行的评审反馈：Reviews、Inline comments、Issue-level comments 和 根据仅处理 Critical 的模式，延后的非 Critical 部分保持原样；没有解决或回复任何行内讨论。 改动
两侧在合并后的文件中都不可或缺，因此解决方案保留两个导入，并保留 验证
Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: conflicted with main — resolved in this push. · 与 main 有冲突——已在本次推送中解决。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
🤖 Addressed the latest review feedback (round 12/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 12/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #11854Feedback triageNo actionable feedback was supplied this round. The PR is in Critical-only mode after five change-producing rounds; the only deferred item is the automated reviewer's exhausted regular-feedback budget notice. There were no reviews, inline comments, issue-level comments, failed checks, or still-red checks to act on, so no inline threads were resolved or replied to. Conflict resolutionThe round was flagged
I kept main's real-function fallback so unrelated Configs retain the module's real behavior, and kept the PR's comment plus the Changes
Verification
中文说明Autofix 本轮总结 — PR #11854反馈分类本轮没有可执行的评审反馈。该 PR 在五个产生改动的轮次后处于仅处理 Critical 的模式；唯一被延后的条目是自动评审器常规反馈预算耗尽的提示。没有评审、行内评论、Issue 级评论、失败检查或持续失败的检查需要处理，因此没有解决或回复任何行内讨论串。 冲突解决本轮带有
我保留了 main 的真实函数回退，以便无关 Config 仍保持模块的真实行为，同时保留了 PR 的注释和 改动
验证
Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: conflicted with main — resolved in this push. · 与 main 有冲突——已在本次推送中解决。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
|
🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下： Autofix — no code change for PR #11854Feedback triageThe actionable sections are empty: no reviews, inline comments, or issue-level comments need a decision this round. The PR is in Critical-only mode after five change-producing rounds. The only recent inline finding ( Failed checksAll three checks listed as failed are
The job API shows cancelled steps with no failing assertion. Both workflows define concurrency cancellation for pull-request runs, and these runs were cancelled mid-step; this is a cancelled run, not a test failure. No source change can make a cancelled run pass: the workflows need a re-run on this head before merge. Branch stateThe working tree is clean and Verification
中文说明Autofix —— PR #11854 本轮不改代码反馈分类本轮可执行区域为空：没有需要裁决的评审、行内评论或 Issue 级评论。该 PR 在五个产生改动的轮次后处于仅处理 Critical 的模式。最近唯一一条行内发现（ 失败的检查列出的三项检查全部是
任务 API 显示的是被取消的步骤，没有失败的断言。两个工作流都为 pull request 运行配置了并发取消，而这些运行是在执行中途被取消的；这是运行被取消，而不是测试失败。源码改动无法让被取消的运行通过：合并前需要在该 head 上重新运行这些工作流。 分支状态工作区干净， 验证
Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (
中文说明已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 🧠 Handled by Qwen Code · model/模型 |
What this PR does
Adds a Codex-aligned
tools.modeenum withdirect,code_mode, andcode_mode_only.code_modekeeps ordinary tools directly callable while also exposing the isolatedexecJavaScript tool; each visible ordinary tool carries its nested JavaScript declaration, whileexecretains compactALL_TOOLSmetadata.code_mode_onlypreserves the strict exec-only ordinary-tool surface, anddirectremains the default.Updates filtered subagent tool surfaces so direct declarations and nested exec bindings honor the same allowlists, exposes the enum in Settings as Default / Code Mode / Code Mode Only, regenerates the settings JSON schema, and removes the former
tools.codeModeOnlyboolean setting entirely.Adds synchronized English and Chinese design documents, and brings the existing CodeModeOnly design up to the repository's bilingual documentation standard (English, Chinese).
Why it's needed
Qwen Code previously offered only the default direct tool surface or the strict CodeModeOnly surface. Models could not combine direct calls for simple operations with
execorchestration for multi-tool workflows. A three-value enum matches Codex'sToolModenaming and gives users one explicit setting for all supported exposure modes.Reviewer Test Plan
How to verify
tools.modeunset or set it todirect, restart Qwen Code, and confirm ordinary tools remain available whileexecis absent.tools.modetocode_mode, restart, and confirm both ordinary tools andexecare available. Confirm ordinary tool descriptions include theirtools.<name>(args)declaration and deferred tools remain discoverable throughtool_search.tools.modetocode_mode_only, restart, and confirm ordinary tools are available throughexecrather than as top-level calls, while direct control tools remain available.tools.codeModeOnlyis no longer present in the settings schema.--safe-modeor--barewhile either code mode is configured and confirm the effective mode isdirect.Automated verification completed: focused Core tests (121 tests), focused CLI tests (585 tests), a repeated settings-schema regression run (60 tests), full build, full typecheck, full lint, and both installed and branch-built CLI version smoke checks.
Evidence (Before & After)
Before: Settings exposed
Code Mode Only (Experimental)as a boolean withfalse/true.After: Settings exposes
Tool Mode (Experimental)as an enum displaying Default / Code Mode / Code Mode Only. Updated TUI snapshots cover the default display.Tested on
Environment (optional)
macOS, Node.js v24.18.0; local source build and package-level Vitest suites.
Risk & Scope
execdescription.tools.codeModeOnlyis removed. Replace{ "tools": { "codeModeOnly": true } }with{ "tools": { "mode": "code_mode_only" } }.Linked Issues
Related to #10377.
中文说明
本 PR 做了什么
新增与 Codex 对齐的
tools.mode枚举，支持direct、code_mode和code_mode_only。code_mode在保留普通工具直接调用能力的同时提供隔离的execJavaScript 工具；每个可见普通工具会携带自己的嵌套 JavaScript 声明，而exec保留精简的ALL_TOOLS元数据。code_mode_only保持严格的普通工具仅经exec调用模式，direct仍为默认值。更新经过过滤的子智能体工具面，使直接声明和
exec嵌套 binding 遵守同一组 allowlist；在设置界面中将该枚举显示为 Default / Code Mode / Code Mode Only；重新生成 settings JSON schema；并彻底移除原来的tools.codeModeOnly布尔设置。新增同步的英文和中文设计文档，并将现有 CodeModeOnly 设计补齐为仓库要求的双语文档（英文、中文）。
为什么需要
Qwen Code 此前只提供默认的直接工具面或严格的 CodeModeOnly 工具面。模型无法在简单操作中使用直接调用，同时在多工具工作流中使用
exec编排。三值枚举与 Codex 的ToolMode命名一致，并为所有支持的暴露模式提供一个明确的统一设置项。Reviewer 测试计划
如何验证
tools.mode或将其设为direct，重启 Qwen Code，确认普通工具仍可用且不存在exec。tools.mode设为code_mode并重启，确认普通工具和exec同时可用；确认普通工具描述包含各自的tools.<name>(args)声明，延迟工具仍可通过tool_search发现。tools.mode设为code_mode_only并重启，确认普通工具通过exec而不是顶层调用使用，同时直接控制工具仍然可用。tools.codeModeOnly。--safe-mode或--bare启动，确认有效模式为direct。已完成自动化验证：Core 相关测试（121 个）、CLI 相关测试（585 个）、再次运行的 settings schema 回归测试（60 个）、完整 build、完整 typecheck、完整 lint，以及已安装版本和分支构建版本的 CLI 版本 smoke 检查。
前后对比证据
之前：设置界面以
false/true布尔值展示Code Mode Only (Experimental)。之后：设置界面以枚举展示
Tool Mode (Experimental)，可选 Default / Code Mode / Code Mode Only。更新后的 TUI snapshot 覆盖默认显示。测试平台
环境（可选）
macOS、Node.js v24.18.0；本地源码构建和 package 级 Vitest 测试套件。
风险与范围
exec描述中重复。tools.codeModeOnly已移除。请将{ "tools": { "codeModeOnly": true } }替换为{ "tools": { "mode": "code_mode_only" } }。关联 Issue
关联 #10377。