Verification report

Verified head: 46a0b6cfb4d3ffdc2fb1a910d2405ae9785ae85f

Failure-first evidence

The original ownership probes failed 3 cases while 29 passed: an ownerless artifact tab read the primary sentinel, a secondary artifact download never called the qualified secondary client, and a secondary durable-task list omitted its workspaceId.

The follow-up visual regression was independently reproduced with real Playwright Chromium. Both dark and light scenarios failed at screenshots.spec.ts:848; the JSON file request returned successfully, but the post-read authority check rejected it and the panel displayed Unable to display code review — Workspace artifact owner is no longer available. The same failure is visible in visual workflow run 30879548937.

Automated checks at this head

• StrictMode regression plus equivalent-refresh/remove-re-add authority coverage: 31/31 ArtifactPanel tests passed
• Related ownership suites (resolver, turn outputs, artifact panel): 3 files, 47/47 tests passed
• Complete Web Shell suite: 167 files, 2,780/2,780 tests passed
• Real Chromium code-review visual scenario: 2/2 passed (dark and light)
• npm run build, npm run typecheck, and npm run lint in packages/web-shell: passed
• git diff --check and explicit Prettier checks for every changed file: passed
• Pre-commit formatter/linter: passed

The package-wide format check still reports only five unchanged baseline files: BranchPickerPopover.module.css, GitModePopover.module.css, GitDialog.module.css, PlanExecutionView.module.css, and packages/web-shell/client/index.html.

One intermediate full-suite run produced 10 build-artifact.test.ts failures because I incorrectly ran the production build concurrently with the suite, causing dist to change while the artifact assertions were reading it. I then ran the build and suite sequentially: the build exited 0 and all 2,780 tests passed.

Production two-workspace validation

The built CLI/Web Shell was run with two registered local workspaces containing the same relative sentinel path but different contents. /capabilities advertised primary ID 35f375e336aa5962 and secondary ID 2162ccb7ea97c9ec.

• Root GET /file?path=artifact-owner.txt returned PRIMARY_WORKSPACE_SENTINEL_8494 (SHA-256 818d5f4f1fb9c7e3f9bdfd9a3ad39361c93a23ca3f3d0ba5e4a7c889b33b9127).
• Secondary GET /workspaces/2162ccb7ea97c9ec/file?path=artifact-owner.txt returned SECONDARY_WORKSPACE_SENTINEL_8494 (SHA-256 0e9fac7909b16ff8b17014ea103ed5018c8b4e9ad21d2f95e128fef3a3544a12).
• The secondary bytes route returned only secondary bytes.
• Secondary scheduled-task POST/GET/PATCH/DELETE requests all used /workspaces/2162ccb7ea97c9ec/scheduled-tasks...; update/delete affected only the secondary fixture, and both test fixtures were cleaned up.

Visual evidence

After the fix, Playwright generated genuine 1366×768 dark and light screenshots. I inspected both images: the right panel renders the full Authoritative verdict, metrics, caps, filters, and finding content. This runtime still has no authenticated interactive browser session with which to upload local PNG attachments to GitHub; I did not substitute synthetic images. The push triggers the repository's visual-preview workflow, which is the shareable screenshot source for reviewers.

@qwen-code /triage

Review follow-up verification report

Verified head: ac1ad61b4b3663e6a424a37df9e92c071e185687

Failure-first evidence

The Critical loading bug was independently reproduced on the reviewed head for all three mutation paths: save, enable/disable, and delete. In each case, a mutation superseded an in-flight reload through the shared request counter and left the panel permanently rendering Loading…. A separate runtime probe confirmed that a non-durable task with an unavailable workspace owner was incorrectly hidden behind the workspace-unavailable alert.

Review fixes

• Separated load lifecycle ownership from mutation/data invalidation, so an orphaned reload can settle its own loading/error state without overwriting newer task data.
• Kept stale mutation results scoped to their original task/owner and verified the replacement task remains usable.
• Allowed non-durable scheduled-task tabs to render their local snapshot without workspace access.
• Added fail-closed coverage for durable scheduled-task, file, and artifact tabs with missing owners.
• Added legacy single-workspace coverage for list/update/delete with workspaceId: undefined.
• Added post-await authority-revocation coverage for text, bytes, and stat reads.
• Strengthened split-pane dedup/session-switch assertions and added the unknown-workspace download guard regression.

Automated verification

ArtifactPanel DOM suite                         PASS (40/40)
TurnOutputs DOM suite                           PASS (8/8)
Complete App suite                              PASS (303/303)
Web Shell TypeScript typecheck                  PASS
Changed-file ESLint                             PASS
Changed-file Prettier                           PASS
Web Shell production build + library build      PASS
git diff --check                                PASS
Pre-commit formatter/linter                      PASS

The full App run emits existing test-harness act(...) warnings and intentional error-path logs; all 303 tests pass. The browser connector exposed no browser instance in this runtime, so no new trustworthy screenshot could be captured or uploaded. I did not substitute a synthetic image; the original PR report retains its real Chromium visual evidence, while this follow-up is pinned by the DOM interaction suites and production build above.

ArtifactPanel DOM 套件                         通过（40/40）
TurnOutputs DOM 套件                           通过（8/8）
完整 App 套件                                  通过（303/303）
Web Shell TypeScript 类型检查                  通过
变更文件 ESLint                                通过
变更文件 Prettier                              通过
Web Shell 生产构建与 library 构建              通过
git diff --check                               通过
Pre-commit 格式化与 lint                       通过

@qwen-code /takeover

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This is a fork PR, so the first round comes from the next scheduled scan (usually within minutes). Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

⚠️ AutoFix round 4 ended without publishing a report — view run.

🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下：

Address-review summary — PR #8510 (round 2)

Commit: dd489502e — fix(web-shell): keep open artifact tabs alive across pane and list gaps (on fix/issue-8494-workspace-artifact-actions, additive; no conflicts, --conflict false).

Triage gate: PR body template (stage 1a, CHANGES_REQUESTED)

The triage review asks to restructure the PR body around the repository template (What this PR does / Why it's needed / Reviewer Test Plan with How to verify / Evidence (Before & After) / Tested on / Risk & Scope / Linked Issues), keeping the paragraph-for-paragraph 中文说明 block. It implies no code changes. This environment has no GitHub credentials and cannot edit the PR body, so the restructured body was prepared per the prepare-pr skill and written to <workdir>/pr-title.txt and <workdir>/pr-body.md (template headings, long unwrapped lines, full Chinese translation retained). The workflow or a maintainer needs to apply those files to the PR; the content incorporates the original verification reports plus this round's changes.

Round-2 findings

• [Critical] R2-1 — open artifact tabs orphaned when the producing pane closes (rc:3714673743): FIXED. The extra-artifact purge in the pane-report handler now keeps extras referenced by open artifact tabs, so a tab's open-time row survives the pane closing or its snapshot clearing; the pre-PR behavior let tabs survive pane close, and the design doc ties tab invalidation to workspace removal/trust loss/runtime replacement only. Because a retained extra would otherwise shadow newer pane reports in the merged artifact list, the merge now prefers pane snapshots over open-time extras, preserving the update-propagation behavior added earlier in this PR (the pane-report test asserts 10 B → 20 B → changed while the pane is alive, and continued rendering after the pane clears; it was renamed to updates an open artifact tab from pane snapshots and keeps it after the pane clears).
• [Suggestion] R2-2 — actions={activeWorkspaceActions!} unsound for non-durable scheduled-task tabs (rc:3714673746): FIXED. ScheduledTaskDetail's actions prop is widened to ArtifactWorkspaceActions | undefined, the call site drops the assertion, and the four actions dereferences are guarded (loadTask treats missing actions like the non-durable snapshot path; the three mutation handlers return early). No behavior change for reachable states; the type now matches the fail-closed guard's exemption.
• [Suggestion] R2-3 — no test drives scheduled_task/review opens through App's handleTurnOutputOpen (rc:3714673750): COVERED. The App SplitView mock gains split-open-scheduled-task and split-open-review buttons carrying stamped workspaceCwd/workspaceId/sourceSessionId. New tests assert a durable scheduled-task panel lists through listScheduledTasks('pane-ws') and renders the task (dropping or transposing the stamped identity fails closed and turns the test red), and a review-tab download routes fileStat/readWorkspaceFileBytes through client.workspaceByCwd('/tmp/pane').
• [Suggestion] R2-4 — handleSave's workspaceId never asserted (rc:3714673751): COVERED. The save branch of settles a pending reload after a %s mutation now asserts updateScheduledTask is called with ('cron-secondary', objectContaining({ prompt }), 'secondary-id').
• [Suggestion] R2-5 — ChatPane.handleRightPanelOpen had zero coverage (rc:3714673755): COVERED. The ChatPane MessageList mock exposes a turn-output open trigger; a new test asserts the forwarded request equals the emitted request plus sourceSessionId: 'sess-1' with no workspaceActions key (exact-equality assertion mirrors the SubagentDetail integration test).
• [Suggestion] R2-6 — main-session opens no longer cached in extras (rc:3714673760): FIXED. The open-time row is cached unconditionally again (restoring the pre-PR !request.workspaceActions arm of the gate). The suggested fix alone was insufficient: the live-list reconcile purged a main-session extra as soon as the live list covered the artifact, so the reconcile's exemption was also extended from pane-owned tabs to all open artifact tabs; retained extras stay inert because live rows and pane snapshots merge first. New App test opens a main-session artifact, flips the connection to disconnected (live list empties), asserts the tab still renders, then reconnects and asserts the live list takes over.

Round-1 findings (re-verified, already fixed by earlier commits)

All eleven round-1 inline findings were re-verified against this head and remain resolved by fd1f53e4e / ac1ad61b4:

• rc:3712736510 (R1-1 Critical, loading-flag race) — load-only request counter plus settles a pending reload after a %s mutation for save/toggle/delete.
• rc:3712736518 (R1-3) — discards a pending mutation when the task scope changes.
• rc:3712736525 (R1-4) — keeps legacy single-workspace scheduled-task routes unqualified.
• rc:3712736533 + rc:3712736542 (R1-7 1/2 and 2/2) — fail-closed cases for durable scheduled-task and file tabs with missing owners, asserting zero workspace calls.
• rc:3712736553 (R1-8) — revokes every pending file read when its owner is removed covers text, bytes, and stat wrappers.
• rc:3712736559 (R1-9) — fail-closed guard exempts non-durable scheduled tasks; shows a session-scoped task snapshot without a workspace owner.
• rc:3712736594 (R1-10) — session-switch test installs resolvable capabilities and asserts rendered content plus absence of the workspace alert.
• rc:3712736598 (R1-11) — re-add recovery asserts the target is defined before comparing actions.
• rc:3711796884 (doudouOUC, dedup) — same-ID extra vs pane snapshot is covered by the pane-snapshot test; note the semantics intentionally evolved with the R2-1 fix: while the tab is open the extra is retained but inert (the pane snapshot merges first), so no duplicate rows appear and updates still propagate.
• rc:3711796892 (doudouOUC, download guard) — hides Download when the artifact workspace cannot be resolved in TurnOutputs.dom.

Verification

Commands actually run this round (all at the final working tree, before the commit; the repository's pre-commit hook also passed during the commit):

• cd packages/web-shell && npx tsc --noEmit — passed (no output)
• cd packages/web-shell && npx eslint client/App.tsx client/App.test.tsx client/components/ChatPane.test.tsx client/components/artifacts/ArtifactPanel.tsx client/components/artifacts/ArtifactPanel.test.tsx — passed (no findings)
• npx prettier --check on the five changed files — passed
• cd packages/web-shell && npx vitest run client/components/artifacts/ArtifactPanel.test.tsx client/components/ChatPane.test.tsx — 2 files, 106/106 passed
• cd packages/web-shell && npx vitest run client/App.test.tsx — 306/306 passed
• cd packages/web-shell && npx vitest run (complete Web Shell suite) — 167 files, 2794/2794 passed
• npm run build (all packages) — passed
• npm run typecheck — passed
• npm run lint — passed
• npm run generate:settings-schema — not needed (no settings source changed); integration tests not needed (changed behavior is exercised by the web-shell DOM suites, not the bundled CLI harness)

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

🤖 AutoFix ran out of time before finishing (timeout (1080000ms)) (attempt 2/100) — it will retry on the next scan.

What I found before stopping:
Qwen failed during address-review: timeout (1080000ms).

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/30978469269

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

🤖 AutoFix ran out of time before finishing (timeout (1080000ms)) (attempt 3/100) — it will retry on the next scan.

What I found before stopping:
Qwen failed during address-review: timeout (1080000ms).

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/30992285682

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

🤖 AutoFix stopped: this counting window now contains 3 time-budget exhaustions (pushed rounds in between included; this round itself may have failed differently). That is 3 full agent runs that pushed nothing. A human should split or reduce the PR (or raise the agent time budget AND its step backstop together), then comment @qwen-code /retry to re-arm. Until then future scans will skip this PR.

What I found before stopping:
Qwen failed during address-review: timeout (1080000ms).

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/30992591926

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

⏸️ Takeover paused: this PR reached its round cap (100/100). Comment @qwen-code /takeover to re-arm a fresh window and continue management, or @qwen-code /takeover stop to release.

@qwen-code /triage

Independent local verification (real two-workspace daemon + real browser)

I rebuilt this scenario locally instead of re-reading the tests: a real qwen serve daemon with two registered workspaces, a real model turn that records a real artifact, and the actual Web Shell driven in headless Chromium — once with the client from PR head dd489502, once with the client from merge-base 06cc41ee, once from PR commit 1 8aadba34. Same daemon, same flow, only the client code differs.

1. The vulnerability is real, and the fix closes it

Note the card in both runs reads HTML · 34 B (secondary metadata) while the old client renders the 32-byte primary file — the mismatch users would never notice.

Control: on PR head, a primary-workspace session still uses the unqualified /file route and renders the primary file, so the qualified route is not applied indiscriminately.

2. The StrictMode follow-up is load-bearing (and effective)

• PR commit 1 (8aadba34) in the same live flow: right panel stuck on "Loading preview… / Workspace artifact owner is no longer available".
• The repository's own visual scenario reproduces it: screenshots.spec.ts:848 → 2 failed at commit 1, 2 passed at PR head, 2 passed at merge-base. So the regression was introduced and fixed inside this PR.
• Bonus coverage: that harness advertises capabilities without a workspaces array, so the passing run also exercises the resolver's legacy single-workspace branch.

3. Finding — fail-closed also removes preview/download in untrusted workspaces

resolveArtifactWorkspaceOwner requires match.trusted === true. With security.folderTrust.enabled: true and the folder not yet trusted, the daemon reports trusted: false but still serves the file (GET /file → 200, verified by curl). Result:

This is not limited to multi-workspace setups: a single-workspace daemon also advertises the array, so an ordinary untrusted single-workspace deployment loses artifact/review/file previews entirely (verified: workspaces: [{id: 48177a5afd42bbd7, primary: true, trusted: false}], /file → 200). The trust bit does not change which workspace a read targets, so it isn't part of the ownership ambiguity this PR is fixing.

One more wrinkle: trusted in /capabilities is entry.state === 'active' && entry.current?.runtime.trusted === true (packages/cli/src/serve/routes/capabilities.ts:92) — it also encodes runtime liveness, so any window where the runtime is not active flips an open panel to the "may have been removed" alert.

Suggestion (either is fine, but please pick one before merge):

1. Accept an unambiguous single-cwd match regardless of trusted, leaving the daemon as the trust authority for its own routes; or
2. Keep failing closed on untrusted, but use a distinct message (e.g. "workspace is untrusted") instead of "may have been removed", and call the behavior change out in the PR description / release notes.

Severity: medium — security.folderTrust.enabled defaults to false, so most deployments are unaffected.

4. Ownership loss

With the secondary artifact tab open on PR head, I restarted the daemon without the secondary workspace. No request was retried against the primary route (the recorded network log contains no unqualified /file after the restart); the session view reset and the tab closed with the reconnect. The finer-grained states (duplicate id, replaced runtime, remove-and-re-add) are covered by the PR's own unit tests, which I ran — I did not reproduce each one live.

5. Gates I ran on PR head

npm run build could not be completed in this environment (the shared install lacks vite-plugin-dts / comment-json, and the sibling packages/webui/dist is stale) — that is an environment issue, not the PR; CI covers it.

6. Smaller notes

1. ArtifactPanel resolves ownership from activeTab.workspaceCwd only (no fallback to the panel's own workspaceCwd prop), and then requires activeWorkspaceTarget?.workspaceId === activeTab.workspaceId. A tab opened before capabilities land carries a cwd but no id, so the equality never holds afterwards and that tab shows the unavailable alert permanently. Treating "tab has cwd, no id" as a match when the resolved owner's cwd is equal would remove that trap.
2. useArtifactWorkspaceTarget writes authorityRef during render and revokes it from an effect cleanup via queueMicrotask. Ref mutation during render is not safe under concurrent rendering — an abandoned render can rewrite the authority the committed tree is using. It behaves correctly today (verified above), but given this PR already had one StrictMode incident here, an effect/state-driven authority would be sturdier.
3. artifactPanelExtraArtifacts now caches every opened artifact and only drops entries the live list covers; entries for artifacts that vanish from every list are held until the panel/session resets. Bounded by user clicks — noting for completeness.

Verdict

The core security fix is real and verified end-to-end against a real daemon: opening or downloading a secondary-workspace artifact no longer reads the primary repository. Item 3 (untrusted workspaces losing preview/download, with a misleading message) is what I'd like resolved or explicitly accepted before merge; 6.1 is a cheap robustness win. Everything else looks good.

Not verified here: the durable scheduled-task workspaceId path (unit tests + code reading only, no live CRUD run), and code-review/file-review previews (same resolver and action surface as the artifact path verified above).