Thanks for the PR, @doudouOUC!

Template looks good ✓

On direction: Straightforward bug fix — ACP serve mode rejects read_file for paths the local tool already allows (skill instructions, subagent transcripts, auto-memory, etc.), and the resulting structured error collapses to [object Object]. Fixes the real user-reported issue #6020. Clearly within the project's core tool system scope.

On approach: The two concerns (ACP local read fallback + error normalization) are tightly coupled — the [object Object] rendering is exactly what made the ACP mismatch undiagnosable. The getErrorMessage() consolidation replaces the same error instanceof Error ? error.message : String(error) pattern across 5+ call sites, which is genuine reuse, not drive-by refactoring. The os.tmpdir() removal from read_file's allowed roots is a behavioral tightening declared in Risk & Scope and covered by tests. The scripts/ CI changes (check:serve-fast-path-bundle in test:ci, npx cross-env → cross-env) are slightly tangential but small enough and self-consistent. The merge conflict resolution (commit 388cd594f) is clean — the resolve bot flagged a potential duplicate test file, but the PR already updated serve-fast-path-bundle-check.test.js to match the cross-env convention, so no actual conflict exists.

Moving on to code review. 🔍

— Qwen Code · qwen3.7-max

Code Review

Independent proposal: catch path_outside_workspace in AcpFileSystemService.readTextFile, verify the path against the same local read roots that read-file.ts allows, and fall back to the local FS service. For [object Object], extend getErrorMessage() to handle plain objects and replace the scattered inline patterns.

The PR's approach matches closely with two good additions: realpath resolution on both roots and files (prevents symlink-escape attacks), and normalizeError() wrapping plain objects into real Error instances with cause (prevents numeric ACP codes from leaking as Node error codes). The getErrorKind() function correctly reads from data.errorKind (structured field), not top-level — closing the injection vector. The localReadRoots passed from acpAgent.ts mirror read-file.ts's allowed roots plus auto-memory roots.

No critical blockers. The security gating is tight: fallback requires both a recognized errorKind AND realpath-verified subpath membership. Empty roots are excluded. Failed fallbacks preserve the original ACP error as cause.

Testing

Unit tests (all pass in PR worktree)

Typecheck: clean ✅

Real-scenario test (tmux)

Test: read /tmp/triage-6021/test-read.md containing triage-test-content-for-pr-6021.

Before (installed qwen 0.19.1)

$ qwen -p 'Read the file /tmp/triage-6021/test-read.md and tell me what it says. Output only the file contents verbatim.' --max-session-turns 3 2>&1 | tee /tmp/triage-6021/before.log
Warning: QWEN_HOME points to "..." but no settings.json was found there. ...
Warning: QWEN_HOME points to "..." but no settings.json was found there. ...
triage-test-content-for-pr-6021

Result: auto-allowed (path under os.tmpdir()), read succeeds.

After (this PR, npm run dev)

$ npm run dev -- -p 'Read the file /tmp/triage-6021/test-read.md and tell me what it says. Output only the file contents verbatim.' --max-session-turns 3 2>&1 | tee /tmp/triage-6021/after.log

> @qwen-code/[email protected] dev
Warning: Tool "read_file" requires user approval but cannot execute in non-interactive mode.
To enable automatic tool execution, use the -y flag (YOLO mode):
...
The `read_file` tool permission was declined in non-interactive mode, and I cannot work around denied tool calls using shell commands. I'm unable to read the file contents.

Result: permission required (os.tmpdir() removed from auto-allowed roots, and this path isn't under any configured qwen-managed root).

After with -y (this PR, npm run dev)

$ npm run dev -- -p 'Read the file /tmp/triage-6021/test-read.md and tell me what it says. Output only the file contents verbatim.' --max-session-turns 3 -y 2>&1 | tee /tmp/triage-6021/after-yolo.log

> @qwen-code/[email protected] dev
Warning: running headless with --yolo / approval-mode=yolo and no sandbox. ...
triage-test-content-for-pr-6021

Result: with YOLO approval, read succeeds.

Interpretation: The behavioral change is exactly what the PR describes — os.tmpdir() is no longer an auto-allowed root. Arbitrary temp paths now require approval unless under a configured local read root. The tool still works with -y. The ACP-specific fallback (the core fix) requires qwen serve to exercise and is covered by 30 unit tests simulating the workspace boundary error.

— Qwen Code · qwen3.7-max

This is a clean, well-scoped bug fix. The author understood the problem precisely: ACP serve mode and read_file had a policy mismatch for managed local paths, and the error rendering pipeline collapsed structured errors into [object Object]. Both issues are addressed with minimal, targeted changes.

The fallback logic is properly gated — requires both a recognized errorKind in data (not a top-level field) AND realpath-verified subpath membership against configured roots. The normalizeError() helper and the getErrorMessage() extension replace 5+ inline instanceof Error ? .message : String() patterns, which is genuine consolidation.

The tmux test confirmed the intentional behavioral change: os.tmpdir() is no longer auto-allowed for read_file. Paths under /tmp that aren't in a configured root now need approval. With -y, the read succeeds — the tool still works, it just asks first.

801 unit tests pass. Typecheck clean. The merge conflict resolution is clean and the resolve bot's duplicate test file warning was a false alarm (the PR already updated the existing test).

Two non-blocking notes for the author:

• The scripts/ CI changes (adding check:serve-fast-path-bundle to test:ci, npx → cross-env removal) ride along with the bug fix. Harmless and self-consistent, but ideally split into their own PR for cleaner history.
• The os.tmpdir() tightening is user-visible — scripts or automations that relied on auto-allowing arbitrary /tmp reads will now see approval prompts. Worth a line in the CHANGELOG when this ships.

Approved. ✅

— Qwen Code · qwen3.7-max

@qwen-code /triage

@qwen-code /triage