feat(voice): support trusted private ASR base URLs - #8350

Code Review

Overview

Adds security.allowedInsecureVoiceBaseUrls, an empty-by-default exact-match allowlist that lets trusted (User/System/SystemDefaults) configuration opt a voice provider base URL into HTTP and/or private-network egress. The resolved allowInsecureBaseUrl flag travels with the voice config and is enforced at every guard call site (CLI batch transcribeVoiceAudio, daemon streaming voice-ws.ts, Desktop batch/streaming via assertVoiceConfigNetworkAllowed). Workspace-scoped values are stripped before merge (extending the existing allowPrivateNetworkHooks mechanism) and surfaced as a settings warning. Metadata, link-local, unspecified, and mapped/compat loopback addresses stay blocked even when allowlisted.

What looks good

• The trust model is right: workspace stripping reuses the proven stripWorkspacePrivateNetworkHooks path (now stripWorkspaceSecurityBypasses), with tests for user-scope honor, workspace-scope strip + warning, and user-over-workspace precedence.
• I verified the new allowInsecureBaseUrl field is consumed at every guard call site on both surfaces — not a dead switch.
• Always-blocked classes (loopback aliases, ::ffff: mapped forms, 0.0.0.0/::, 169.254/16, 100.100.100.200, AWS IMDSv6 fd00:ec2::254, fe80::/10) are enforced both on IP-literal base URLs and on DNS results, with thorough tests including compact IPv4-compatible IPv6 forms.
• Desktop test DI (readNoJson when readQwenJson is injected) correctly prevents tests from bleeding into the host machine's real system settings, and the desktop system/system-defaults paths + env overrides match the CLI's storage-paths-lite.ts exactly.
• Docs, CLI settings schema, and the VS Code companion JSON schema are all updated consistently.

Findings

1. Allowlist entry normalization diverges between CLI and Desktop (Suggestion, cross-surface correctness)

Desktop's normalizeAllowedVoiceBaseUrl (resolve-voice-config.ts) runs entries through normalizeBaseUrl(raw), which defaults the scheme to https:// and appends /v1. The CLI's normalizeAllowedVoiceBaseUrl (services/voice-transcriber.ts) only URL-parses and trims trailing slashes — a scheme-less entry throws in new URL() and is silently dropped, and /v1 is never appended. So the same settings.json entry voice.internal.example/v1 or http://voice.internal.example is honored on Desktop but ignored by the CLI, and the failure mode is a generic "must use an https baseUrl" error with no hint that the allowlist entry didn't match. Suggest: (a) document that entries must be complete URLs with explicit scheme and full path (the docs table currently says "exact normalized" without defining normalization), and (b) emit a settings warning for entries that fail to parse instead of dropping them silently. Aligning the two normalizers would be even better.

2. Desktop credential resolution now hard-fails configs that previously worked (Suggestion, behavior change)

fromQwenSettings previously scanned for any DashScope-compatible provider with a resolvable key and fell back to env credentials otherwise. It now throws for an id-matching provider that is incomplete (missing baseUrl/envKey, or unresolved key) and for duplicate ids, and the throw short-circuits the ?? fromEnv(...) fallback. An existing user with a provider entry whose id happens to equal the selected voice model but who relies on DASHSCOPE_API_KEY from the environment regresses from working → error. The fail-closed behavior is stated in the PR description, so this may be intended — but consider limiting the hard fail to non-DashScope/allowlisted endpoints, or at least calling the break out in release notes.

3. Desktop requires allowlisting even for public HTTPS custom providers; CLI does not (Suggestion, consistency/naming)

On Desktop, any non-DashScope provider — including a public https:// endpoint — must appear in security.allowedInsecureVoiceBaseUrls ("uses a custom baseUrl that is not listed…"), while the CLI accepts a public HTTPS custom baseUrl without any listing. Besides the cross-surface inconsistency, gating a perfectly secure endpoint behind a setting named allowedInsecureVoiceBaseUrls is confusing for operators. Worth either aligning the surfaces or documenting the Desktop-only rule explicitly.

4. Security-guard logic is duplicated with non-identical implementations (Suggestion, maintainability)

isAlwaysBlockedVoiceAddress, isAwsIpv6MetadataAddress, and readIpv4CompatibleIpv6 now exist in two hand-maintained copies (CLI services/voice-transcriber.ts vs desktop net-guard.ts) that already differ: desktop's trailing dotted-quad regex catches embedded-IPv4 forms like 64:ff9b::169.254.169.254 (NAT64-prefixed metadata), while the CLI's ^::ffff:/^::-anchored patterns do not; the hex NAT64 form (64:ff9b::a9fe:a9fe) is missed by both. The link-local checks are written differently (>= 0xfe80 && <= 0xfebf vs (h & 0xffc0) === 0xfe80) even though currently equivalent. For a security guard this duplication is a drift hazard — consider extracting a shared module, or at minimum mirroring the two test suites so a divergence fails CI. Blocking 64:ff9b::/96-embedded always-blocked addresses on both surfaces would close the remaining niche gap.

Verdict

No Critical findings. The security posture is sound: default deny is preserved, the opt-in is exact-match and trusted-scope only, and the always-blocked classes are enforced on both literal and resolved addresses with good test coverage. Findings 1–2 are the ones I'd most like addressed (or explicitly acknowledged) before merge, since both produce silent or surprising failures for operators; 3–4 can be follow-ups.

@qwen-code /takeover

🚫 Takeover not engaged: fork takeover requires the PR author to hold write access on this repository (author rockybot2026 currently: read). A maintainer can adopt the PR instead: snapshot the head into an in-repo branch, open a new PR (commit authorship is preserved), and take that over.

Addressed the review feedback in 797499a:

1. CLI and Desktop now use the same strict allowlist contract: entries and exact model-provider URLs must include an explicit scheme and full path; only URL serialization and trailing slashes are normalized. The docs/schema and rejection messages now spell this out and point operators to security.allowedInsecureVoiceBaseUrls.
2. Desktop exact-ID provider failures remain intentionally fail-closed. Falling back to unrelated environment credentials can cross a provider or regional boundary, so duplicate/incomplete entries and missing keys now require the operator to complete or remove the exact entry. The PR description and design doc now call out this migration behavior explicitly.
3. Desktop now accepts public HTTPS custom providers without an insecure allowlist entry, matching CLI behavior. HTTP/private endpoints still require an exact trusted entry and the runtime network guard.
4. Both guards now decode dotted and hexadecimal IPv4-mapped IPv6 forms. Trusted RFC1918 mapped addresses work; mapped loopback/metadata stay blocked; mapped public addresses are not misclassified. I opened refactor(voice): keep CLI and Desktop address guards in sync #8361 for shared policy vectors/NAT64 and ci(desktop): gate voice security tests on pull requests #8360 for a repository-owned Desktop voice CI gate.

Final local verification: CLI focused suites 246/246, Desktop voice suites 103/103, Desktop server-core TypeScript check, root lint/typecheck/build, and pre-commit formatting/lint all pass. I also iterated three completed Qwen local /review quick passes; the latest report has no findings.

@qwen-code /review

@qwen-code /takeover

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This is a fork PR, so the first round comes from the next scheduled scan (usually within minutes). Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

🔀 Base updated: red check(s) [ubuntu-latest / Java 11] pass on current main — merged current main via update-branch; CI will re-run.

✅ AutoFix round 16 finished — view run. See this round's report below.

@qwen-code /triage

🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下：

Round summary

Addressed the two remaining automated-reviewer suggestions (round 2) about the duplicated IPv6-transition unwrapping ladder in the voice network guards.

Feedback points

All earlier findings (rc:3697507205 through rc:3698686266) were already resolved in prior commits (797499a, 0692403, 46c9b1a, 0741498) and re-verified as holding.

Changed files

• packages/cli/src/services/voice-transcriber.ts — extracted unwrapIpv6TransitionStep, refactored both predicates (+31/−32)
• packages/desktop/packages/server-core/src/voice/net-guard.ts — mirrored extraction (+30/−31)

Conflict notes

No conflicts (--conflict false).

Verification

• npm run build — passed
• npm run typecheck — passed
• npm run lint — passed
• npx prettier --check (both touched files) — passed
• vitest run src/ui/voice/voice-transcriber.test.ts (CLI, touched) — 51 passed
• vitest run src/config/settings.test.ts — 12 failed / 146 passed (pre-existing failures, confirmed identical on HEAD without this change; unrelated to voice guards)
• Desktop voice suites — not runnable via npm (bun tests outside npm workspaces, tracked in ci(desktop): gate voice security tests on pull requests #8360); verified statically

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max-preview

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix review round — no action needed

The latest review round on PR #8350 contains no actionable feedback:

• Automated review: COMMENTED with zero findings. The reviewer noted the desktop bun test suites could not be executed in its harness (tracked in ci(desktop): gate voice security tests on pull requests #8360) and reviewed that half statically only — informational, not a defect.
• Inline comments: none.
• Sandboxed verification: passed — 62/62 scripted assertions, 247/247 targeted gate tests, verdict merge-ready.
• Failed checks: none.
• Still-red checks: none.

No code changes were made this round.

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max-preview

🔀 Base updated: red check(s) [Test (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run.

🤖 AutoFix ran out of time before finishing (timeout (7200000ms)) (attempt 13/100) — it will retry on the next scan.

What I found before stopping:
Qwen failed during address-review: timeout (7200000ms).

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/31020135934

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

Overview

Adds security.allowedInsecureVoiceBaseUrls — an empty-by-default, exact-match allowlist that lets trusted scopes (User/System/SystemDefaults) opt a voice provider base URL into cleartext HTTP and/or private-network egress. The decision is computed once in each surface's config resolver and threaded as allowInsecureBaseUrl into the shared network guard, so CLI batch, CLI/daemon streaming, and Desktop batch/streaming all apply the same verdict.

The security core is genuinely good work:

• Fail-closed default is preserved. Empty list, workspace scope stripped before merge (stripWorkspaceSecurityBypasses) plus a settings warning, exact normalized-URL match with no wildcards or suffix matching.
• The always-blocked floor survives the opt-in. Metadata (169.254.169.254, 100.100.100.200, fd00:ec2::254), link-local, unspecified, and loopback stay blocked even when listed — and the IPv6 transition-address handling (::ffff:, IPv4-compatible, 64:ff9b::/96 NAT64, with 64:ff9b:1::/48 / 2001::/23 / 2002::/16 blocked outright) is more thorough than what it replaces. I spot-checked the decoders against WHATWG URL canonicalization (0177.0.0.1, 2130706433, 0:0:0:0:0:ffff:a9fe:a9fe, 64:ff9b::10.0.0.8, ::ffff:0:7f00:1) and they classify correctly, with the ::ffff:-prefix catch-all failing closed on shapes the decoders don't recognize.
• Rejecting embedded credentials instead of stripping them (https://[email protected]/...) is a real fix, not just cleanup.
• check:voice-guard-sync is the right instinct: a comment is not a mechanism, and the CLI/desktop guards must not drift.

Below are the things I'd want addressed.

1. Desktop: the ambiguity check fires before the public-HTTPS fall-through, breaking dictation for configs that work today

packages/desktop/packages/server-core/src/voice/resolve-voice-config.ts:532

if (distinct.length > 1) {
  throw new Error(`Voice model '${voiceModel}' is ambiguous. ${PROVIDER_ENTRY_REMEDY}`);
}
...
if (isPublicHttps && !allowInsecureBaseUrl) {
  return undefined;   // legacy fall-through
}

The throw is unconditional on classification, so it runs before the entry is ever classified. That contradicts the design doc's own contract:

Public HTTPS entries keep the legacy fall-through (OAuth, then the shared DashScope provider, then environment credentials), preserving the pre-allowlist credential precedence for existing installs.

That guarantee only holds for the single-entry case. Concrete break — an OAuth-signed-in desktop user with two public HTTPS entries sharing the voice model id:

"modelProviders": {
  "openai":    [{ "id": "qwen3-asr-flash", "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",      "envKey": "DASHSCOPE_API_KEY" }],
  "dashscope": [{ "id": "qwen3-asr-flash", "baseUrl": "https://dashscope-intl.aliyuncs.com/compatible-mode/v1", "envKey": "DASHSCOPE_API_KEY" }]
}

Before this PR desktop ignored id-matching entirely and OAuth resolved. After it, dictation dies with Voice model 'qwen3-asr-flash' is ambiguous. — and the remedy text asks the user to delete a provider entry that has nothing to do with voice network policy. Neither entry needs a policy decision, so nothing is gained by failing.

The design doc widens this further and acknowledges it: because desktop scans provider groups protocol-agnostically while the CLI only sees groups whose id resolves to a protocol, a duplicate in a custom group with no providerProtocol mapping hard-fails desktop while the CLI resolves the model normally. Documenting a break isn't the same as bounding it — this one takes out dictation entirely on the credential path, not just the policy path.

Suggested fix: classify first, then decide. Only raise ambiguity when at least one distinct entry actually needs a policy decision (allowlisted / cleartext / private / loopback); otherwise return undefined and let the legacy chain run, exactly as the single-entry public-HTTPS case does.

The same ordering applies to the baseUrl must be a string (:539), embedded-credentials (:560), and envKey must be a string (:619) throws. Those are more defensible (genuinely malformed entries), but they're equally invisible to the fall-through contract and deserve a deliberate call either way.

Test gap: the only ambiguity test (resolve-voice-config.test.ts:1390) uses two private, allowlisted URLs — precisely the case where failing closed is correct. There's no test pinning what happens with two public HTTPS duplicates plus valid OAuth, which is why this slipped through.

2. None of the desktop changes run in CI

voice-ws-handler.test.ts → voice-ws-handler.isolated.ts is a legitimate rename (packages/desktop/package.json:43 already has the .isolated.ts runner loop, and mock.module('ws', ...) genuinely needs process isolation). But I checked every workflow under .github/workflows/ and none invokes bun test or bun run test — CI covers packages/desktop-shell (Rust/Tauri) and check:desktop-isolation, not the bun workspace.

That means the desktop half of this PR — the 235-line net-guard.ts rewrite, the 200→809-line resolver, and 1,761 lines of new tests — is verified only by local runs. Note also that the PR's own verification command, bun test packages/server-core/src/voice, does not pick up .isolated.ts (bun's default pattern is *.test.ts); only bun run test from the desktop root does. Worth confirming that file was actually exercised.

The new check:voice-guard-sync step is the one desktop-touching thing that does run in CI, which makes item 3 more load-bearing than it looks.

3. normalizeMirroredCode strips braces, so the drift guard is semantics-blind

scripts/check-voice-guard-sync.js:271

return stripComments(text).replace(/\s+/g, '').replace(/^export/, '').replace(/[{}]/g, '');

Dropping every { and } means block structure is erased: if (x) { a(); b(); } and if (x) a(); b(); normalize identically, as do f({a:1},{b:2}) and f({a:1,b:2}), and `${a}${b}` and `${ab}`. For a guard whose stated job is "the classification decides whether voice audio may use an insecure or private endpoint," normalizing away control flow is the wrong trade.

I understand why it's there — desktop writes if (isIP(host) !== 6) return host; where the CLI writes the braced form. Two cleaner options: format both extracted units with prettier before comparing, or just make the two files agree on brace style and drop the strip.

Two more gaps in the same script:

• The units list is hand-maintained, so a new helper added to only one guard is invisible. Consider asserting that every top-level function declaration in net-guard.ts appears in units — that way adding a classifier forces a list update instead of silently escaping the check.
• extractTopLevelUnit (:244) keys on a column-0 } terminator, so it's coupled to prettier's exact output. Fine in practice, but worth a comment noting the dependency.

The stripComments tokenizer itself (regex-literal detection via preceding-token heuristics) is nicely done and correctly avoids eating http:// inside strings.

4. A hand-copied dotenv@17 grammar with no drift guard

resolve-voice-config.ts:159 copies dotenv's LINE regex verbatim so ~/.qwen/.env yields identical values on both surfaces. The reasoning is sound and the comment is honest, but this is explicitly excluded from check-voice-guard-sync.js — and it feeds both credential lookup and $VAR interpolation of allowlist entries. A dotenv bump in the npm workspace silently diverges desktop.

dotenv is already present in the npm workspace; a fixture-corpus parity test (same input → same output as the real parser) would close this the same way check:voice-guard-sync closes the net-guard mirror.

Related, and correctly documented in the design doc but worth restating for whoever operates this: because settings pass through env interpolation, anything that controls the process environment or ~/.qwen/.env can supply an allowlist entry. That is a meaningfully wider trusted surface than "root-owned /etc/qwen-code/settings.json," and it's the one line in the threat model I'd want a managed-deployment operator to read.

5. Scope

27 files, ~5,000 added lines, for a feature the title describes as an allowlist. The desktop resolver alone grew 200 → 809 lines and picked up System/SystemDefaults settings reading, JSONC parsing (new strip-json-comments dep), .env parsing, env-var interpolation, prototype-key filtering, provider-group merge mirroring, and platform-specific system-path resolution — all CLI-parity work that is adjacent to the allowlist rather than required by it.

The PR body's justification (splitting would leave egress paths with inconsistent policy) is fair for the guard changes, which genuinely must land together. It doesn't extend to the desktop trusted-settings/parity layer, which could ship separately and get its own review attention. Given item 2, that layer is both the largest and the least-verified part of the diff.

Smaller items

• packages/desktop/bun.lock: only the dependency line changed — verified [email protected] already resolves at :3164, so the lockfile is consistent. No action.
• Docs overstate the path requirement. settings.md and the schema say each entry "must include ... the full path (for example, /v1)", but the code only requires an exact match — a root-path entry legitimately matches a root-path provider. "Must match the provider's complete path exactly" would be accurate.
• resolveDesktopVoiceConfig:771 does new URL(creds.baseUrl) unguarded. normalizeBaseUrl's parse-failure branch (:76) can return an unparseable string, which would surface as a raw TypeError instead of one of the file's careful operator-facing messages. Narrow, but cheap to wrap.
• Behavior change worth a release note: the CLI now rejects https://user:pass@host/... rather than stripping userinfo. Correct call, but anyone relying on the old stripping gets a hard failure. It's in the design doc; make sure it reaches the changelog.
• Nice touch: the Object.hasOwn guard on envKey (voice-transcriber.ts:1107, resolve-voice-config.ts:479) preventing constructor/toString from reaching .trim() as a function — with a test that loops the three prototype members. Good instinct.
• Test hygiene: vi.stubEnv('DASHSCOPE_API_KEY', '') in voice-transcriber.test.ts fixes a real local-vs-CI divergence (CI already clears it at ci.yml:449). Good catch, and the comment explains why.

Verdict

The network-policy core is careful, well-reasoned, and better tested than what it replaces — the address classification in particular is a clear improvement, and the mechanical drift guard is the right shape even if its normalization needs tightening.

Blocking on item 1: the unconditional ambiguity throw breaks a plausible existing desktop config that has nothing to do with this feature, and it contradicts the PR's own stated fall-through contract. It needs the check moved after classification plus a test covering public-HTTPS duplicates with valid OAuth.

Items 2–4 are about how this stays correct after merge rather than whether it's correct now, but item 2 (no desktop CI) makes them harder to defer — right now a desktop-side regression in this security path would ship silently.

🔀 Base updated: red check(s) [Test (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run.

🤖 Addressed the latest review feedback (round 14/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 14/100 轮）。改动内容与我反驳保留之处如下：

Autofix review round — PR #8350

This round triaged @wenshao's issue-level review. Critical-only mode is active, and the previous round exhausted the time budget, so per the budget rule this round fixed the smallest blocking subset (item 1) and deferred the rest with recorded reasons. There were no inline comments this round, so there are no thread resolutions or reply comments; every disposition is recorded here.

Item 1 (blocking) — ambiguity throw fires before classification — FIXED

Commit 59e1315dd restructures the desktop resolver exactly as suggested: classify first, then decide.

• Per-entry validation + classification was extracted from fromExactModelProvider into classifyVoiceProviderEntry. The Voice model '...' is ambiguous error now fires only when at least one classified entry actually needs a policy decision (allowlisted / cleartext / private / loopback). Duplicate matches that all keep the legacy fall-through (public HTTPS, unallowlisted) now return control to the legacy chain (OAuth → DashScope provider → environment), exactly like the single-entry public-HTTPS case — including the reviewer's concrete scenario of two cross-group public HTTPS entries sharing the voice model id for an OAuth-signed-in user.
• Deliberate call on the malformed-entry throws the reviewer flagged: baseUrl must be a string and embedded-credentials entries still fail closed regardless of what other entries exist — a corrupt or credential-bearing entry must never silently reroute where audio goes. Missing/unparseable baseUrls keep their per-entry warn-and-ignore fall-through, and the envKey must be a string check stays behind the policy gate, so public-HTTPS fall-through never validates envKey (same as the single-entry path today).
• Test gap closed with two new tests: the reviewer's exact case (two public HTTPS duplicates + valid OAuth → OAuth resolves, no ambiguity error) and the boundary (a public HTTPS entry plus an allowlisted private duplicate still fails closed with the ambiguity error).
• The design doc's ambiguity contract was updated to match: duplicates are ambiguous only when a matching entry needs a policy decision; otherwise the whole set keeps the legacy fall-through.
• Verification surfaced a latent bug in the PR's own new test file: it used spyOn without importing it from bun:test (bun does not provide spyOn as a global), so the "falls through and warns" test failed on any real bun test run. The import is fixed; this is further evidence for item 2.

Item 2 — desktop changes run in no CI — deferred (follow-up)

Adding a CI workflow for the bun workspace is infrastructure needing maintainer decisions (runner capacity, bun toolchain), not a Critical fix, and is out of scope for a Critical-only round under the budget warning. Evidence gathered this round confirms the gap: (a) the spyOn global bug above shipped despite the PR's stated local verification; (b) the combined bun test packages/server-core/src/voice run has 6 failures that reproduce identically on the pre-change tree — 5 in voice-stream-session.test.ts caused by its un-restored mock.module('../runtime/platform') leaking across files in bun's single-process run (the same hazard that made this PR rename voice-ws-handler.test.ts to .isolated.ts), plus the resolve-config warn-capture test that only fails under that leakage; (c) .isolated.ts files run only via bun run test from the desktop root, not the PR's bun test packages/server-core/src/voice command. Suggested follow-up issue: desktop bun-test CI step + rename voice-stream-session.test.ts to .isolated.ts.

Item 3 — normalizeMirroredCode strips braces — deferred (follow-up)

Hardening of the drift guard, not a current-behavior defect (the guard passes and neither mirrored file changed this round). Deferred under the budget warning; the reviewer's suggested fixes (prettier-both-sides, or align brace style and drop the strip; plus asserting every top-level function appears in units) are recorded for the follow-up.

Item 4 — hand-copied dotenv grammar without drift guard — deferred (follow-up)

Same reasoning: a fixture-corpus parity test against the real dotenv parser is valuable post-merge insurance, not a Critical fix this round.

Item 5 — scope — deferred to maintainer

Whether to split the desktop trusted-settings/parity layer into a separate PR is a scope call for the maintainer; it cannot be decided here, and at this stage of the PR the guard changes must land together regardless.

Smaller items

• bun.lock: reviewer verified it is consistent — no action.
• Docs "full path" wording: deferred. The wording lives in both settings.md and the settings-schema description, so a fix requires touching settingsSchema.ts and regenerating the committed schema artifact — a separate small change, not this round's blocking subset.
• Unguarded new URL(creds.baseUrl) at the end of resolveDesktopVoiceConfig: deferred (error-message quality on an edge path, not Critical).
• Release note for the embedded-credentials rejection behavior change: noted for the release process.
• Object.hasOwn guards and the vi.stubEnv test hygiene: no action needed (positive remarks).

Verification

Commands actually run and their results:

• bun test packages/server-core/src/voice/resolve-voice-config.test.ts (desktop, focused) — 70 pass / 0 fail (baseline before this round: 67 pass / 1 fail on the missing-spyOn ReferenceError). bun 1.3.14 was installed via npm i -g bun; desktop workspace deps are not installed on this runner, and [email protected] resolves from the root node_modules at the exact locked version.
• bun test ./packages/server-core/src/voice/voice-ws-handler.isolated.ts — 15 pass / 0 fail (confirming the renamed isolated file runs and passes).
• bun test packages/server-core/src/voice (combined directory run) — 129 pass / 6 fail; the same 6 failures reproduce identically on the pre-change tree (verified against a git archive baseline), 5 from the pre-existing mock.module cross-file interference in voice-stream-session.test.ts and 1 that passes solo — see item 2.
• Focused tsc on packages/desktop/packages/server-core (surrogate; desktop workspace deps unavailable): diffed error sets between this tree and the pre-change baseline — no new errors; the baseline's Cannot find name 'spyOn' is removed by the import fix; resolve-voice-config.ts itself has zero errors in both trees. Remaining errors are identical missing-desktop-dependency noise.
• node scripts/check-voice-guard-sync.js — pass.
• npm run build (root) — pass.
• npm run typecheck (root, after build; a first run before build failed with stale packages/core/dist TS6305 project-reference errors unrelated to this diff) — pass.
• npm run lint (root) — pass (packages/desktop/** is eslint-ignored and prettier-ignored at root, so the root gate does not reach the changed files; the desktop-side checks above cover them).
• Settings schema regeneration: not applicable (no settings source changed this round).

Deferred non-Critical feedback

Critical-only mode is active after 10 change-producing rounds. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

Review: feat(voice): support trusted private ASR base URLs (#8350)

Reviewed at 59e1315. Scope: the PR diff only (27 files, +5142/-219).

Overview

Adds security.allowedInsecureVoiceBaseUrls — an empty-by-default, exact-full-URL allowlist that lets a voice provider endpoint use cleartext HTTP or a private-network address. The exception is stripped from Workspace scope (with a settings warning), threaded as allowInsecureBaseUrl through the resolved voice config, and enforced identically on CLI batch, CLI/daemon streaming, and Desktop batch/streaming. The address classifier is rewritten on both surfaces (IPv4-mapped / IPv4-compatible / NAT64 decoding, 6to4 + Teredo + local-use-NAT64 blocking, AWS IPv6 IMDS), a mechanical drift guard (scripts/check-voice-guard-sync.js) is wired into CI, and the Desktop resolver grows a mini CLI-settings loader (System/SystemDefaults paths, JSONC, env interpolation, scope merge).

No Critical findings. CI is green, the drift guard passes against the head files (I ran checkMirrorSet on the fetched 59e1315 sources — 0 drift in both mirror sets), and I spot-checked the address classifier by loading net-guard.ts directly: ::ffff:127.0.0.1, ::ffff:7f00:1, ::127.0.0.1, 64:ff9b::7f00:1 all classify as always-blocked/loopback; ::ffff:192.168.1.1 and 64:ff9b::a00:5 as private-but-allowlistable; 169.254.169.254, fd00:ec2::254, 2001::1, 2002:c0a8:101::1, 64:ff9b:1::a00:5, ::, 0.0.0.0 as always-blocked. That matches the documented contract.

Things done well

• Trusted-scope stripping is at the merge boundary (stripWorkspaceSecurityBypasses), not at the read site, so every consumer of settings.merged inherits it — and the untrusted-workspace path drops the whole object anyway.
• The decision is computed once in resolveVoiceTranscriptionConfig / resolveDesktopVoiceConfig and carried on the config object, so the four egress paths cannot disagree.
• isAlwaysBlockedVoiceAddress is deliberately not gated on the allowlist — metadata/link-local/unspecified/transition ranges stay blocked even for a listed URL, on both the literal and the DNS path.
• Rejecting embedded credentials rather than stripping them is the right call; the comment explaining why (https://[email protected]/… already resolved evil.com) is exactly the kind of why that earns a comment.
• Adding a mechanical drift check instead of relying on a "keep in sync" comment.

Suggestions

1. The drift guard is brace-blind, so real control-flow drift passes silently.
normalizeMirroredCode does .replace(/\s+/g,'').replace(/^export/,'').replace(/[{}]/g,''). Stripping every brace makes

if (x) { a(); b(); }   //  vs.   if (x) a(); b();

compare equal — I confirmed this against the script's own exports. It also strips braces inside string/template/regex literals, so `${a}${b}` ≡ `$a$b` and x{2}y ≡ x2y.

The brace strip is currently load-bearing: four units (normalizeIpAddress, isAwsIpv6MetadataAddress, isAlwaysBlockedVoiceAddress, isLoopbackVoiceAddress) differ only in single-statement brace style between the two files. The cheap fix is to brace the desktop side (if (isIP(host) !== 6) return host; → braced) so the strip can be dropped entirely; prettier won't undo that. Otherwise, emit {/} as tokens from the tokenizer stripComments already contains and compare token streams.

2. Desktop tests don't run in PR CI. bun test for packages/desktop only appears in desktop-release.yml — ci.yml runs check:desktop-isolation and now check:voice-guard-sync, but never the 109 desktop voice tests this PR adds. The drift guard catches copy drift; it doesn't catch a regression in resolve-voice-config.ts, which is where most of the new security logic lives (ambiguity resolution, scope merge, env interpolation, fail-closed paths). Given this is network-egress policy, a CI step running at least bun test packages/server-core/src/voice would be worth the minute. Related: voice-ws-handler.test.ts → .isolated.ts is a legitimate use of the existing convention (the find-loop in packages/desktop test), but it inherits the same gap.

3. The hand-copied dotenv grammar should be the real dependency. DOTENV_LINE + parseEnvFileContent copy dotenv@17's regex verbatim and are guarded only by a comment — not by check-voice-guard-sync.js. The PR already adds an npm dep to server-core (strip-json-comments), so adding dotenv and calling dotenv.parse() costs the same and removes a permanent drift liability against an upstream package the CLI upgrades independently.

4. Malformed allowlist entries fail silently. normalizeAllowedVoiceBaseUrl returns undefined for an entry missing a scheme or carrying userinfo, on both surfaces, with no diagnostic. The operator's outcome is the generic "add its exact complete normalized URL (X) to security.allowedInsecureVoiceBaseUrls" error — while the entry they already added sits there unmatched. Since the docs make "explicit scheme, full path, no wildcards" a hard requirement, a warning naming the unparseable entries (like the existing workspace-scope warning) would turn the most likely misconfiguration into a one-line fix.

5. Desktop dedups same-ID providers on the raw baseUrl, before normalization. In fromExactModelProvider, distinct is keyed on match.baseUrl || '', so http://gw/v1 and http://gw/v1/ survive as two entries, classify to the same normalized baseUrl, and then trip classified.length > 1 && classified.some(needsVoicePolicyDecision) → hard "is ambiguous" failure for what is one endpoint. Deduping on the classified entry.baseUrl instead would fix it without touching the ambiguity semantics.

6. settings.md table cell. The new security row is a ~1,100-character description in a single markdown cell, which pushes the source line past 1,400 columns and renders as an unusably wide table. Consider a one-line summary in the cell plus a short prose subsection below the table for the matching rules, blocked ranges, and the WebSocket-derivation caveat.

Risks worth flagging in release notes

• CLI: hostnames that resolve to loopback are now always blocked, with no allowlist escape hatch. Previously isPrivateNetworkIp returned false for loopback, so a DNS alias for a local ASR server (asr.localtest.me, an /etc/hosts entry) worked. It now fails closed. The design doc calls this out and the error message names the accepted spellings, so the behavior is deliberate — but it's the one break here that an operator cannot configure around, and it's the case most likely to hit an existing local-dev setup. Worth a release note, and arguably worth letting an exactly-allowlisted URL resolve to loopback.
• Desktop: a provider whose id matches the selected voice model is now authoritative and fails closed on duplicates, unsupported scheme, missing allowlist match, or unresolved envKey — previously such an entry was ignored unless DashScope-compatible and voice fell back to OAuth. Documented in the PR body; belongs in the changelog too.
• CLI: embedded credentials in a voice baseUrl now throw instead of being stripped.
• Scope. The Desktop resolver has effectively grown a second implementation of the CLI settings loader — system-path resolution, JSONC, env interpolation, deep-merge, prototype-key filtering, legacy v5 provider unwrapping — and mergeModelProviders mirrors customDeepMerge's actual behavior, which contradicts the mergeStrategy: REPLACE declared in settingsSchema. The comment acknowledges this, but it means the mirror is pinned to a CLI implementation detail that a future fix will silently break, and none of it is covered by the mechanical drift check. If this lands as-is, an issue tracking "extract a shared trusted-voice-policy reader" would keep it from rotting.

🤖 Addressed the latest review feedback (round 15/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 15/100 轮）。改动内容与我反驳保留之处如下：

Review round 11 — summary

Critical-only mode is active after 10 change-producing rounds. Per the repository's review policy, this round lands only the two Critical fixes and defers the 13 Suggestions to follow-up issues/PRs; every deferral is recorded as a reply on its own thread so nothing is dropped silently.

Feedback points and decisions

Critical — fixed

1. R10-1 (scripts/check-voice-guard-sync.js) — normalizeMirroredCode stripped every {/} including inside string/template/regex literal content, so semantically different mirrored units normalized identically (probe-verified in the finding: mutating ${prefix} → $prefix in desktop deriveWebSocketBase passed the guard; block-structure drift also normalized equal).
   Fixed with the fix the finding suggested — comparing parse trees instead of brace-stripped text: each unit is parsed with the TypeScript parser and re-printed with removeComments: true; single-statement blocks are unwrapped (keeping the documented brace-style tolerance); source positions are stripped so the printer emits canonical layout. Literal contents and statement structure are now compared exactly. Verified against the finding's exact scenarios: the ${prefix} → $prefix mutation is detected, block-structure drift is detected, the brace-free control mutation is still detected, and the unmutated real mirrors still pass.
2. R10-2 (scripts/check-voice-guard-sync.js) — the whitespace collapse erased whitespace inside preserved literal content and ASI-significant newlines (probe-verified in the finding: '/compatible-mode/v1' → '/compatible-mode/ v1' masked; a newline inserted after return masked, flipping the drifted side's classification).
   Fixed by the same parse-tree comparison: literals are printed verbatim from the AST (inner whitespace preserved), and the parser itself models ASI (return + newline parses as return;), so both holes are closed structurally rather than patched. Verified against the finding's exact scenarios on the real mirrored units.

The fix removes the entire ~200-line hand-rolled scanner (stripComments, REGEX_PRECEDING_KEYWORDS, the regex-vs-division heuristic) in favor of ~90 lines built on the project's own TypeScript compiler (a devDependency of every workspace, hoisted to the root node_modules; CI runs the guard after npm ci). Net diff: +144/−185 lines. Five tests pin the previously masked drift classes and the unmangled normalization; the existing "passes on the real mirrored sources" test keeps pinning the whole mirror set.

Suggestions — deferred to follow-up issue/PR (Critical-only mode)

• R10-3 scanner/normalizer spurious-drift edge cases — partially overtaken: the parse-tree rewrite replaces the scanner (the TypeScript parser handles regex literals and ${} natively); the remaining export const extraction and arrow-body style edges stay known loud, safe-direction gaps. Deferred.
• R10-4 guard test-suite gaps — items 1–2 overtaken (the scanner no longer exists; the new tests pin unmangled normalization and the drift mutations); items 3–4 (spawnSync failure-path test, pinned MIRROR_SETS inventory) deferred.
• R10-5 two policy-unit groups without a sync mechanism — deferred (touches production code on both runtimes).
• R10-6 IP-literal-path always-blocked message — deferred (blocking is correct on every path; diagnostic polish).
• R10-7 streaming-negative default-wiring coverage — deferred (additive test coverage).
• R10-8 CLI no-/v1-inference pin — deferred (additive test coverage).
• R10-9 desktop top-level scheme recheck test — deferred (additive test coverage).
• R10-10 non-string allowlist entry tests — deferred (additive test coverage).
• R10-11 parent ~/.env fallback content tests — deferred (additive test coverage).
• R10-12 reversed-ordering dedup test — deferred (additive test coverage).
• R10-13 derived-WebSocket-URL docs rewording — deferred (docs accuracy, not a behavior defect).
• R10-14 CGNAT/ULA trusted-permission pins — deferred (additive test coverage).
• R10-15 dotenv parity corpus / version pin — deferred (needs a dependency-placement decision).

Each deferral is posted as a reply on its own thread (comment-replies.json) with the thread left open.

Review body (CHANGES_REQUESTED)

The review's "Not reviewed" notes (the desktop bun suites not running in CI — tracked by the author in #8360; the CLI integration suite skipped in CI; the reverse audit stopped by the time budget; the actionlint embedded-shell limitation; the Test Plan count observation) are coverage statements about the review itself, not code findings, and request no code change.

Conflicts

None (--conflict false; no merge performed).

Verification

• npm run build — passed (exit 0). Also required to bring this checkout to a built state: two script tests (check-i18n, install-script standalone packaging) failed only while the checkout was unbuilt and pass after the build; neither imports the guard script.
• npm run typecheck — passed (exit 0, all workspaces)
• npm run lint — passed (exit 0)
• npm run test:scripts — 47/47 test files passed, 948 tests passed | 14 skipped
• npx vitest run --config ./scripts/tests/vitest.config.ts check-voice-guard-sync — 11/11 passed (focused suite for the touched script)
• node scripts/check-voice-guard-sync.js — "Voice guard mirror check passed.", exit 0
• Mutation harness on the finding's probe-verified scenarios (throwaway script outside the repo): all four previously masked drift classes (template-brace stripping, string whitespace, ASI newline, block structure) are now detected; the unmutated mirrors report no drift
• npx prettier --check on both touched files — clean
• Not run: npm run bundle + integration tests — the change touches only the CI guard script and its unit tests, not the bundled CLI surface; no settings source changed, so generate:settings-schema is not applicable.

Commit: fix(scripts): compare voice guard mirrors as parse trees (#8350)

Deferred non-Critical feedback

Critical-only mode is active after 10 change-producing rounds. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

• PR comment by @wenshao: feat(voice): support trusted private ASR base URLs #8350 (comment)

• @wenshao is at this window's regular-feedback budget — to continue: tag [Critical], submit a Request changes review, or comment @qwen-code /retry for a fresh window. / @wenshao 本窗口常规反馈预算已用完——继续请标 [Critical]、提交 Request changes、或评论 @qwen-code /retry 开新窗口。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

🔀 Base updated: red check(s) [Test (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run.

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix review round: no action taken

PR: #8350 · Base: main · Conflict: none

This round had no actionable feedback:

• Reviews: none newer than the last evaluation.
• Inline comments: none in scope.
• Issue-level comments: none.
• Failed checks: none, and no still-red checks persisting from earlier rounds.

Critical-only mode is active (after 10 change-producing rounds). The non-Critical findings listed in the deferred section of this round's feedback remain open for human follow-up, per the ratchet policy; this round did not modify code, resolve threads, or post replies for them.

No commits were made; the branch head is unchanged.

Deferred non-Critical feedback

Critical-only mode is active after 10 change-producing rounds. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

• Review by @qwen-code-ci-bot: feat(voice): support trusted private ASR base URLs #8350 (review)

• Inline rc:3727316876 scripts/check-voice-guard-sync.js:171: feat(voice): support trusted private ASR base URLs #8350 (comment)

• Inline rc:3727316887 packages/desktop/packages/server-core/src/voice/voice.test.ts:257: feat(voice): support trusted private ASR base URLs #8350 (comment)

• Inline rc:3727316898 packages/cli/src/ui/voice/voice-transcriber.test.ts:666: feat(voice): support trusted private ASR base URLs #8350 (comment)

• Inline rc:3727316905 packages/desktop/packages/server-core/src/voice/resolve-voice-config.test.ts:685: feat(voice): support trusted private ASR base URLs #8350 (comment)

• Inline rc:3727316916 packages/desktop/packages/server-core/src/voice/resolve-voice-config.ts:210: feat(voice): support trusted private ASR base URLs #8350 (comment)

• Inline rc:3727316927 packages/desktop/packages/server-core/src/voice/voice.test.ts:275: feat(voice): support trusted private ASR base URLs #8350 (comment)

• @wenshao is at this window's regular-feedback budget — to continue: tag [Critical], submit a Request changes review, or comment @qwen-code /retry for a fresh window. / @wenshao 本窗口常规反馈预算已用完——继续请标 [Critical]、提交 Request changes、或评论 @qwen-code /retry 开新窗口。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

@qwen-code /triage

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix review round — no action taken

This round found no actionable feedback on PR #8350:

• Reviews: none newer than the last evaluation
• Inline comments: none
• Issue-level comments: none
• Failed checks: none — all 44 reported check runs completed as SUCCESS or SKIPPED
• Still-red checks: none

The PR is in Critical-only mode after 10 change-producing rounds. The deferred non-Critical feedback listed for this round (one automated-reviewer PR comment) was intentionally left untouched per the Critical-only rules: no code change, no thread resolution, and no reply for it. It remains open for human follow-up.

No code changes were made and no commits were created in this round.

Deferred non-Critical feedback

Critical-only mode is active after 10 change-producing rounds. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

• PR comment by @qwen-code-ci-bot: feat(voice): support trusted private ASR base URLs #8350 (comment)

• @wenshao is at this window's regular-feedback budget — to continue: tag [Critical], submit a Request changes review, or comment @qwen-code /retry for a fresh window. / @wenshao 本窗口常规反馈预算已用完——继续请标 [Critical]、提交 Request changes、或评论 @qwen-code /retry 开新窗口。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

Maintainer verification — real local environment, real network egress

I built this PR from source and exercised the policy against a real cleartext-HTTP ASR gateway bound to this machine's actual private LAN address (10.177.107.157:8791), driven by the real qwen serve daemon with real 16 kHz WAV audio — no mocked fetch, no injected lookup. The decisive evidence is the gateway's own request log: whether the audio and the Authorization header physically left the process.

Verdict: the contract in the PR description holds on every case I could construct. LGTM to merge, with three small notes below (one worth a follow-up line of code, two worth a sentence in the description).

1. Batch path — before vs. after, same machine, same gateway

Full matrix. ALLOW = the daemon returned a transcript that came back from the private gateway; DENY = the URL policy rejected it; gw+1 = the gateway actually received the request. Every DENY row produced zero gateway requests — the policy fails closed before egress, not after.

* S14 passed the URL policy on both builds and then failed at the TLS handshake (deliberately: the hostname resolves to a public IP whose certificate does not match, so the audio body is never transmitted). This confirms public HTTPS still needs no allowlist entry — the change is scoped to cleartext/private endpoints.

Notable details from the gateway log on the ALLOW rows:

host=10.177.107.157:8791  auth=Bearer sk-regional-gateway-secret-8350
model=qwen3-asr-flash  format=wav  base64AudioChars=110950

The provider key really is on the wire in cleartext — the risk the settings description warns about is accurate, and it is worth keeping that wording prominent.

S11 also exercises normalization end-to-end: the entry http://[::ffff:10.177.107.157]:8791/v1 and the request both normalize to http://[::ffff:ab1:6b9d]:8791/v1, and that is the Host header the gateway observed.

2. Streaming path — daemon /voice/stream WebSocket

I implemented the qwen-asr-realtime protocol on the same private gateway (session.created → session.update/updated → input_audio_buffer.append/commit → session.finish/finished) and pushed real PCM through the daemon's client WebSocket.

Without the allowlist entry, no upstream connection is attempted at all — the gateway sees no upgrade request. With it, 26 realtime frames / 83 150 bytes of PCM arrive and a transcript comes back. The batch and streaming legs agree on the same resolved decision, as claimed.

3. Trust boundary — Workspace scope is ignored and surfaced

An untrusted repo dropping security.allowedInsecureVoiceBaseUrls in .qwen/settings.json cannot self-grant (S6 above), and the user is told why on CLI startup:

4. Test suites, gates, and mutation testing

Passing tests only prove the tests run, so I broke the implementation three ways to check the tests and the new CI gate actually bind the contract:

• Removed the 100.100.100.200 metadata check from the desktop mirror only → check:voice-guard-sync failed with isAlwaysBlockedVoiceAddress: bodies differ. The new drift gate is real, not decorative — this is the most valuable thing the PR adds beyond the feature itself.
• Made the allowlist match on origin instead of the full normalized URL → 5 tests failed. Path/port/scheme exactness is pinned.
• Stopped stripping the setting from workspace settings → 2 tests failed. The trust boundary is pinned.

Notes (none blocking)

a) The remediation hint is truncated exactly where it matters, on the daemon path. The new message is 363 chars; sanitizeVoiceErrorMessage cuts at MAX_TRANSCRIPTION_ERROR_LENGTH = 200 (pre-existing). The fixed prefix before the URL is 177 chars, so only ~23 characters of URL survive. What an operator actually sees in the daemon log is:

… add its exact complete normalized URL (http://10.177.107.157:...

The HTTP client always gets the generic voice_transcription_failed, so this log line is the only place the actionable URL appears — and any realistic managed hostname is longer than 23 chars. The TUI path is unaffected (the message reaches the history item unmodified). Cheapest fix: shorten the sentence, or log the URL as its own field. Worth one follow-up commit; not a reason to hold the merge.

b) Embedded credentials in baseUrl now hard-fail (behavior change, verified A/B). main silently stripped user:pass@; this PR throws Voice model '…' baseUrl must not contain embedded credentials. I confirmed both builds on the same input. Failing loudly is the right call, but it belongs in Breaking changes / migration notes next to the Desktop credential change.

c) providerProtocol is now honored for voice model discovery — a real functional change beyond the allowlist. On main, a custom provider id mapped through providerProtocol yields availableVoiceModels: [] and 400 unknown_voice_model; with the two added providerProtocolConfig: lines it resolves normally. That is a genuine (welcome) fix, but it is invisible in the PR description and untestable from the stated test plan — worth a sentence so reviewers know it is intentional.

Not covered by this run

Desktop was verified by its unit suites and typecheck only — I did not launch the Electron app, so the ambiguous-duplicate-provider fail-closed behavior is unit-verified, not runtime-verified. Windows and Linux untested. No real vendor ASR service was contacted; the gateway is a local stand-in that speaks both wire protocols.

host=10.177.107.157:8791  auth=Bearer sk-regional-gateway-secret-8350
model=qwen3-asr-flash  format=wav  base64AudioChars=110950

… add its exact complete normalized URL (http://10.177.107.157:...

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix review round — no action taken

This round found no actionable feedback on PR #8350:

• Reviews: none newer than the last evaluation (2026-08-06T12:26:11Z)
• Inline comments: none
• Issue-level comments: none actionable — the only newer items are an informational triage re-run summary and this bot's own previous round summary
• Failed checks: none — all reported check runs completed as SUCCESS or SKIPPED
• Still-red checks: none
• Base conflict: none reported; no merge performed

The PR is in Critical-only mode after 10 change-producing rounds. The deferred non-Critical feedback listed for this round (one maintainer PR comment — a local verification report concluding "LGTM to merge" with non-blocking notes) was intentionally left untouched per the Critical-only rules: no code change, no thread resolution, and no reply for it. It remains open for human follow-up.

No code changes were made and no commits were created in this round.

Deferred non-Critical feedback

Critical-only mode is active after 10 change-producing rounds. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

• PR comment by @wenshao: feat(voice): support trusted private ASR base URLs #8350 (comment)

• @wenshao is at this window's regular-feedback budget — to continue: tag [Critical], submit a Request changes review, or comment @qwen-code /retry for a fresh window. / @wenshao 本窗口常规反馈预算已用完——继续请标 [Critical]、提交 Request changes、或评论 @qwen-code /retry 开新窗口。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

@qwen-code /triage