DevAgentRadar → Repo Harness Rule Patch

Goal: update our repository's permanent harness instructions based on this release.

Update the file that tool actually reads. Do not dump everything into one file.

• Claude Code → CLAUDE.md plus .claude/ (skills, hooks, settings, agents, commands). It does not read AGENTS.md natively; start CLAUDE.md with @AGENTS.md.
• Codex, Copilot, Cursor, Factory Droid, Grok Build, Roo Code, Goose, OpenCode, Amp, Zed, Aider → AGENTS.md.
• Gemini CLI / Antigravity → GEMINI.md. AGENTS.md only if context.fileName is set.
• Cursor glob-scoped rules → .cursor/rules/*.mdc (plain .md is ignored), not a second constitution.
• Codex MCP → .codex/config.toml, not .mcp.json.
• Copilot extra instructions → .github/copilot-instructions.md; custom agents → .github/agents/.
• Windsurf → .windsurf/rules (do not assume AGENTS.md).
• Cline → .clinerules.
• Procedures → a skill (SKILL.md). Enforcement the model must not skip → a hook. Isolated roles → subagents.
• Do not fork the same rule into three tool files.

Context

Assistant: Qwen Code Proposal: Require folder trust for project hooks and isolate untrusted PRs with /verify-pr Summary: v0.26.7 blocks repository hooks, permission grants, and language servers until folder trust is explicit, and adds a /verify-pr Docker recipe that runs untrusted PR code in a container while model credentials stay on the host. Stop catalog refresh with privacy.usageStatisticsEnabled: false and pass full model config at managed-agent session creation. Primary source: https://github.com/QwenLM/qwen-code/releases/tag/v0.26.7

Why it matters

Qwen Code v0.26.7 changes default safety and session setup. Interactive sessions now require explicit folder or workspace trust before .qwen/settings.json project hooks, permission grants, and project language servers run, and they warn when trust is withheld. GitHub events for bound PRs arrive as untrusted prompts, with replies private unless published. The local /verify-pr Docker recipe is the supported way to execute untrusted PR code without exposing host model credentials (credentials stay on the host via a chat-completion proxy). Operators can stop background catalog refreshes with privacy.usageStatisticsEnabled: false while local metadata remains available, and can control refresh with the new operator-scoped model.catalogRefresh setting. Managed-agent sessions now accept full model configuration at creation. Enabling experimental.unifiedAgentLoop puts ACP Goal, cron, and background-notification turns on one shared loop with shared rounds, tool batches, and stop points. Teams that still auto-run repo hooks, execute PR code on the host, or configure models after session start will miss these controls.

Suggested actions

1. Before opening this repo in Qwen Code, review .qwen/settings.json and grant explicit folder or workspace trust only after that review; until trust is granted, do not run repository-supplied hooks, permission grants, or project language servers, and surface the withheld-hooks warning.
2. For untrusted pull requests, run the local /verify-pr Docker recipe so PR code executes in a container while model credentials remain on the host through the chat-completion proxy.
3. Set privacy.usageStatisticsEnabled to false so background model catalog refreshes stop while local catalog metadata stays available; if operators still need refresh control, set the operator-scoped model.catalogRefresh setting instead of relying on usage-statistics-driven refresh.
4. Enable experimental.unifiedAgentLoop so ACP Goal, cron, and background-notification turns use the shared agent loop with shared rounds, tool batches, and stop points.
5. When creating a managed-agent session, pass the full model configuration at session creation rather than applying model settings later in the session.

Config surfaces this release may change

• hooks (high confidence) — check your repo before applying
• settings files (high confidence) — check your repo before applying
• background and headless runs — check your repo before applying

After you finish

Do not report this as applied to DevAgentRadar. You cannot write the visitor's loop.

Tell the human: open https://devagentradar.com/proposals/qwen-code-v0-26-7-require-folder-trust-for-project-hooks-and-isolate-unt and mark Applied, Skipped, or Failed. Proposal id: ea7157c0-a042-47c3-9441-90cc24e8f295

Instructions:

1. Read the existing context files and settings for the tools in this repo.
2. Draft an explicit Git diff. Update ONLY agent harness rules or tool configuration.
3. Call out deprecated flags, obsolete habits, or changed permission boundaries.
4. Do not touch application logic.

Start with the proposed diff and say which layer and which tool's file it belongs in.