Qwen Code v0.26.7 Gates Repository Hooks, Permissions and LSP Behind Explicit Folder Trust

Qwen Code v0.26.7, published on the project’s GitHub release feed at 04:03 UTC on 4 Nov, is a small version bump with one change that matters to anyone who points a coding agent at a repository they did not write: explicit folder trust is now a precondition before repository-supplied hooks, permission grants and project language servers can run. Before this release, cloning an untrusted repo and opening it in Qwen Code let repo-authored configuration start influencing the agent session. Now that material stays inert until you say otherwise.

What trust gating actually blocks

The release notes describe the mechanism plainly: Qwen Code now “requires explicit folder trust before repository-supplied hooks, permission grants, and project language servers can run, improving safety for untrusted projects” (#16182). A second fix tightens the same boundary for interactive sessions: “project hooks in .qwen/settings.json now require explicit folder or workspace trust … and show a warning when withheld” (#16196).

Three concrete lanes are gated:

Repository-supplied artifact	Behavior before	Behavior in v0.26.7
Hooks in .qwen/settings.json	Loaded with the project	Held until you grant folder or workspace trust; warning shown when withheld
Persistent permission grants	Could apply on open	Do not run without trust
Project language servers (LSP)	Could start for the project	Held until trust is granted

That closes the classic intake attack: a malicious repository ships hooks or permission rules that execute — or auto-approve execution — the moment an agent opens the checkout. The pattern is the same one behind GitHub blocking pull_request_target by default: repository-authored config is attacker-controlled config, and treating a fresh clone as trusted-by-default is the vulnerability. We have covered this intake discipline before — unauthored hooks are persistence, and an untrusted repo is an intake problem, not a browsing problem.

For teams reviewing external PRs, v0.26.7 also adds a sandboxed alternative to trusting anything: a local /verify-pr Docker recipe that runs untrusted PR code inside a container while keeping model credentials on the host, bridged through a chat-completion proxy (#16077). The container never sees your API keys; the host never runs the PR’s code.

GitHub events on bound PRs are likewise now delivered to the associated session “as untrusted prompts,” with replies kept private unless explicitly published (#16117) — consistent inbound handling for untrusted content rather than a special case.

Operator-facing behavior to check after upgrading

Two other changes affect how fleets configure the CLI:

• Telemetry can actually be silenced. A new operator-scoped model.catalogRefresh setting ships, and privacy.usageStatisticsEnabled: false now stops background catalog refreshes while local model metadata stays available (#16066). Previously the setting disabled usage statistics but the CLI still phoned home for catalog data — relevant for airgapped-adjacent and policy-restricted environments.
• Remote access leaks less. Remote-access error handling now hides internal error details from callers and lands several reviewed reliability and security fixes (#16199), which matters because v0.26.0’s daemon mode exposed a qwen serve surface.

A quieter permission fix is worth noting for anyone writing allow rules: shell permission analysis now recognizes grep -n and grep --line-number as flags rather than file arguments, so grep-based file reads are still permission-checked (#14383).

Who should act

If you run Qwen Code across a team, the practical consequences are:

1. Expect a trust prompt on first open. After upgrading, previously “just working” project hooks, repo-scoped permissions and LSP integration in .qwen/settings.json stay dormant until a user grants folder trust. Warn teams before they upgrade so a silent no-op hook is not mistaken for a hook failure — the same caution v0.26.5’s human-handoff changes asked of unattended loops.
2. Move external PR verification into /verify-pr. The Docker recipe plus credential-proxy split gives you a supported way to run PR code without handing it your provider key — a better default than ad-hoc docker run wrappers, and consistent with the guidance in where review bots execute and what they can see.
3. Set privacy.usageStatisticsEnabled: false and model.catalogRefresh deliberately. One now actually stops background refresh traffic; the other scopes catalog refresh per operator instead of per user.

The release notes list no breaking changes, and the project documentation describes Qwen Code as an agentic terminal tool that edits files, runs commands and makes commits — exactly the capability set that makes trust gating worth the friction. The rest of v0.26.7 is performance work on Managed Agent locking and Web Shell polish; the trust boundary is the part that changes how you should onboard an unfamiliar checkout.