fix(vscode): restore native diff approval after WebShell cutover

packages/cli/src/acp-integration/session/permissionUtils.test.ts

@@ -158,6 +158,39 @@ describe('permissionUtils', () => {
         }),
       );
     });
+
+    it('keeps one-shot and always-allow options on edit approvals', () => {
+      const options = toPermissionOptions({
+        type: 'edit',
+        title: 'Confirm edit',
+        fileName: 'a.txt',
+        filePath: '/tmp/a.txt',
+        fileDiff: 'diff',
+        originalContent: 'a',
+        newContent: 'b',
+        onConfirm: async () => undefined,
+      });
+
+      // Both kinds must stay present and in this wire order: the web-shell
+      // native Accept path selects by kind preference (allow_once first), so
+      // a missing allow_once would escalate a single Accept into
+      // "Allow All Edits".
+      expect(options).toEqual([
+        expect.objectContaining({
+          optionId: ToolConfirmationOutcome.ProceedAlways,
+          name: 'Allow All Edits',
+          kind: 'allow_always',
+        }),
+        expect.objectContaining({
+          optionId: ToolConfirmationOutcome.ProceedOnce,
+          kind: 'allow_once',
+        }),
+        expect.objectContaining({
+          optionId: ToolConfirmationOutcome.Cancel,
+          kind: 'reject_once',
+        }),
+      ]);
+    });
   });
 
   describe('interactionMetaFields', () => {

packages/vscode-ide-companion/src/commands/index.test.ts

@@ -173,6 +173,7 @@ describe('registerNewCommands', () => {
       '/workspace/src/app.ts',
       'old',
       'new',
+      { readOnly: false, permissionRequestId: undefined },
     );
   });
 
@@ -196,7 +197,11 @@ describe('registerNewCommands', () => {
       { fsPath: '/workspace' },
       'src/foo.ts',
     );
-    expect(closeDiff).toHaveBeenCalledWith('/workspace/src/foo.ts', true);
+    expect(closeDiff).toHaveBeenCalledWith(
+      '/workspace/src/foo.ts',
+      true,
+      undefined,
+    );
   });
 
   it('closeDiff keeps absolute paths unchanged', async () => {
@@ -216,7 +221,11 @@ describe('registerNewCommands', () => {
     await getRegisteredHandler(closeDiffCommand)('/workspace/src/foo.ts');
 
     expect(joinPath).not.toHaveBeenCalled();
-    expect(closeDiff).toHaveBeenCalledWith('/workspace/src/foo.ts', true);
+    expect(closeDiff).toHaveBeenCalledWith(
+      '/workspace/src/foo.ts',
+      true,
+      undefined,
+    );
   });
 
   it('showDiff keeps UNC paths absolute', async () => {
@@ -243,6 +252,35 @@ describe('registerNewCommands', () => {
       '\\\\server\\share\\app.ts',
       'old',
       'new',
+      { readOnly: false, permissionRequestId: undefined },
+    );
+  });
+
+  it('showDiff forwards the readOnly flag', async () => {
+    workspaceMock.workspaceFolders = [
+      { uri: { fsPath: '/workspace' }, name: 'workspace', index: 0 },
+    ];
+
+    registerNewCommands(
+      context as never,
+      log,
+      diffManager as never,
+      () => [],
+      vi.fn() as never,
+    );
+
+    await getRegisteredHandler(showDiffCommand)({
+      path: '/workspace/src/app.ts',
+      oldText: 'old',
+      newText: 'new',
+      readOnly: true,
+    });
+
+    expect(diffManager.showDiff).toHaveBeenCalledWith(
+      '/workspace/src/app.ts',
+      'old',
+      'new',
+      { readOnly: true, permissionRequestId: undefined },
     );
   });
 });

packages/vscode-ide-companion/src/commands/index.ts

@@ -78,11 +78,20 @@ export function registerNewCommands(
   disposables.push(
     vscode.commands.registerCommand(
       showDiffCommand,
-      async (args: { path: string; oldText: string; newText: string }) => {
+      async (args: {
+        path: string;
+        oldText: string;
+        newText: string;
+        readOnly?: boolean;
+        permissionRequestId?: string;
+      }) => {
         try {
           const absolutePath = resolveWorkspaceRelativePath(args.path);
           log(`[Command] Showing diff for ${absolutePath}`);
-          await diffManager.showDiff(absolutePath, args.oldText, args.newText);
+          await diffManager.showDiff(absolutePath, args.oldText, args.newText, {
+            readOnly: args.readOnly === true,
+            permissionRequestId: args.permissionRequestId,
+          });
         } catch (error) {
           const errorMsg = getErrorMessage(error);
           log(`[Command] Error showing diff: ${errorMsg}`);
@@ -95,8 +104,12 @@ export function registerNewCommands(
   disposables.push(
     vscode.commands.registerCommand(
       closeDiffCommand,
-      async (filePath: string) =>
-        diffManager.closeDiff(resolveWorkspaceRelativePath(filePath), true),
+      async (filePath: string, permissionRequestId?: string) =>
+        diffManager.closeDiff(
+          resolveWorkspaceRelativePath(filePath),
+          true,
+          permissionRequestId,
+        ),
     ),
   );
 

packages/vscode-ide-companion/src/diff-manager.test.ts

@@ -0,0 +1,179 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const executeCommand = vi.fn().mockResolvedValue(undefined);
+
+vi.mock('vscode', () => {
+  class EventEmitter<T> {
+    private listeners = new Set<(event: T) => void>();
+    event = (listener: (event: T) => void) => {
+      this.listeners.add(listener);
+      return { dispose: () => this.listeners.delete(listener) };
+    };
+    fire(event: T): void {
+      for (const listener of [...this.listeners]) listener(event);
+    }
+    dispose(): void {
+      this.listeners.clear();
+    }
+  }
+
+  return {
+    EventEmitter,
+    Uri: {
+      file: (filePath: string) => {
+        const uri: {
+          fsPath: string;
+          scheme: string;
+          query: string;
+          with: (change: Record<string, unknown>) => unknown;
+          toString: () => string;
+        } = {
+          fsPath: filePath,
+          scheme: 'file',
+          query: '',
+          with(change: Record<string, unknown>) {
+            return { ...uri, ...change };
+          },
+          toString() {
+            return `${uri.scheme}://${uri.fsPath}?${uri.query}`;
+          },
+        };
+        return uri;
+      },
+    },
+    ViewColumn: { Active: -1, Beside: -2 },
+    commands: { executeCommand },
+    window: {
+      activeTextEditor: undefined,
+      onDidChangeActiveTextEditor: vi.fn(() => ({ dispose: vi.fn() })),
+      tabGroups: { all: [] },
+    },
+  };
+});
+
+// Avoid pulling the full extension module graph; only the scheme constant is
+// needed by the diff manager.
+vi.mock('./extension.js', () => ({ DIFF_SCHEME: 'qwen-diff' }));
+
+vi.mock('@qwen-code/qwen-code-core', () => ({
+  IdeDiffAcceptedNotificationSchema: { parse: (value: unknown) => value },
+  IdeDiffClosedNotificationSchema: { parse: (value: unknown) => value },
+}));
+
+const { DiffContentProvider, DiffManager } = await import('./diff-manager.js');
+
+const WRITABLE_COMMAND =
+  'workbench.action.files.setActiveEditorWriteableInSession';
+
+describe('DiffManager.showDiff writability', () => {
+  beforeEach(() => {
+    executeCommand.mockClear();
+  });
+
+  function createManager(): InstanceType<typeof DiffManager> {
+    return new DiffManager(() => {}, new DiffContentProvider());
+  }
+
+  it('makes regular diffs editable so IDE-mode approvals can round-trip edits', async () => {
+    const manager = createManager();
+
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new');
+
+    expect(executeCommand).toHaveBeenCalledWith(WRITABLE_COMMAND);
+  });
+
+  it('keeps read-only diffs locked for flows that cannot round-trip edits', async () => {
+    const manager = createManager();
+
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new', {
+      readOnly: true,
+    });
+
+    expect(executeCommand).not.toHaveBeenCalledWith(WRITABLE_COMMAND);
+    // The diff itself still opens.
+    expect(executeCommand).toHaveBeenCalledWith(
+      'vscode.diff',
+      expect.anything(),
+      expect.anything(),
+      expect.stringContaining('foo.ts'),
+      expect.anything(),
+    );
+  });
+});
+
+describe('DiffManager.showDiff reuse', () => {
+  beforeEach(() => {
+    executeCommand.mockClear();
+  });
+
+  function createManager(): InstanceType<typeof DiffManager> {
+    return new DiffManager(() => {}, new DiffContentProvider());
+  }
+
+  function diffOpenCount(): number {
+    return executeCommand.mock.calls.filter(
+      ([command]) => command === 'vscode.diff',
+    ).length;
+  }
+
+  it('opens a fresh diff instead of reusing a writable twin for a read-only request', async () => {
+    const manager = createManager();
+
+    // IDE-mode flow opens a writable diff for this (path, old, new) triple.
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new');
+    executeCommand.mockClear();
+
+    // A web-shell approval for the same triple must get its own read-only
+    // diff; reusing the writable one would invite hand-edits that the
+    // approving tool then silently discards (and inside the dedupe window
+    // the request would otherwise be suppressed outright).
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new', {
+      readOnly: true,
+    });
+
+    expect(diffOpenCount()).toBe(1);
+    expect(executeCommand).not.toHaveBeenCalledWith(WRITABLE_COMMAND);
+  });
+
+  it('opens a fresh diff instead of reusing a read-only twin for a writable request', async () => {
+    const manager = createManager();
+
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new', {
+      readOnly: true,
+    });
+    executeCommand.mockClear();
+
+    // The IDE-mode flow needs an editable right side to round-trip edits;
+    // refocusing the locked diff would take that away.
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new');
+
+    expect(diffOpenCount()).toBe(1);
+    expect(executeCommand).toHaveBeenCalledWith(WRITABLE_COMMAND);
+  });
+
+  it('still dedupes repeat requests with matching writability', async () => {
+    const manager = createManager();
+
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new');
+    executeCommand.mockClear();
+
+    // Same writability inside the dedupe window: suppressed entirely.
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new');
+    expect(diffOpenCount()).toBe(0);
+
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new', {
+      readOnly: true,
+    });
+    executeCommand.mockClear();
+    await manager.showDiff('/workspace/foo.ts', 'old', 'new', {
+      readOnly: true,
+    });
+    expect(diffOpenCount()).toBe(0);
+  });
+});