fix(desktop): open Local Control on the active session - #8806
Merged
Conversation
Collaborator
Collaborator
Author
Validation reportValidated commit: ResultThe code-level checks for the session handoff and LAN boundary pass.
The focused tests verify that the generated phone URL keeps the active session path and workspace, drops the old runtime token and unrelated query parameters, installs only the pairing token in the fragment, prefers a private physical LAN over a VPN route, rejects a public-only route, preserves the pairing authorization boundary, and continues relaying delayed proxy responses. Not yet validated end to end
No screenshot is attached because the QR, pairing URL, token, and local IP are credentials/private network data, and this pass did not run a redacted real-phone UI scenario. |
Collaborator
|
Thanks for the PR! Template looks good ✓ Problem: observed, not theoretical. This is a follow-up to the Local Control feature merged in #8727 (from feature request #8595): the QR opened the Web Shell root instead of the session visible on the desktop, and — confirmed against the pre-PR code — Direction: aligned — this fixes the Local Control surface shipped in #8727, which serves the desktop-app initiative in #8092. Claude Code's changelog shows continued investment in cross-device Remote Control (phone/mobile session handoff), so the area is relevant; the direction itself was already established by the merged feature PR. Size: not applicable — desktop-shell only, +64/−14 across two Rust files, no core-package paths. Approach: scope feels right. Capture the main window URL when Local Control is enabled, rewrite host/port to the LAN gateway, drop the whole query (removing the runtime credential), keep only Risk: no elevated risk signals (none of the revert-correlated paths are touched). The network-listener and credential-handling surface deserves the careful code review it gets next. Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 问题：已观测到，不是理论问题。这是 #8727 合入的 Local Control 功能（源自 feature request #8595）的后续修复：二维码打开的是 Web Shell 根页面而不是 Desktop 当前会话；并且对照改动前的代码确认， 方向：对齐——修复的是 #8727 已上线的 Local Control 界面，服务于 #8092 的桌面端计划。claude-code 的 changelog 显示跨设备 Remote Control（手机/移动端会话接入）在持续投入，该领域是相关的；方向本身已由合入的 feature PR 确立。 规模：不适用——仅 desktop-shell，两个 Rust 文件 +64/−14，未触及核心包路径。 方案：范围合理。启用 Local Control 时捕获主窗口 URL，将 host/port 重写为 LAN 网关，清空整个 query（去掉 runtime 凭证），只保留 风险：无升级风险信号（未触及 revert 相关的高风险路径）。网络监听与凭证处理面值得下一步的仔细代码审查。 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Collaborator
Code reviewBefore reading the diff, my independent proposal was: capture the active window URL when Local Control is enabled, rebase it onto the LAN gateway origin keeping the session path and workspace, replace the runtime credential with the pairing token (kept in the fragment so it never goes over the wire), fall back to the root when the window URL is unusable, and make address selection fail closed by narrowing candidates to private/link-local before the default-route shortcut can win. The PR lands exactly there, and I verified the contract on both ends:
No blockers found, no convention violations, and every hunk maps to one of the two stated defects — nothing drive-by. Test evidenceCI on the reviewed commit — single fetch, no polling;
Not verified: real-phone QR scanning and mobile-browser behavior — the author scoped these out explicitly. No sandboxed lane can settle that remainder: 中文说明代码审查读 diff 之前我的独立方案：启用 Local Control 时捕获当前窗口 URL，在 LAN 网关 origin 上重建它，保留会话路径与 workspace，用配对 token 替换 runtime 凭证（留在 fragment 中，不会走网络传输），窗口 URL 不可用时回退到根地址；地址选择改为 fail-closed——先把候选过滤为私网/link-local，再让默认路由捷径生效。 PR 的实现与此完全一致，且两端的契约我都核实过：
未发现阻塞问题，无规范违规，每个 hunk 都对应两个已声明缺陷之一，没有夹带改动。 测试证据审查 commit 上的 CI——单次抓取，不轮询；审查时 （CI 表格见上方英文区） 未验证：真实手机扫码与移动端浏览器行为——作者已明确划出范围。两个沙箱通道都无法覆盖这一剩余部分： — Qwen Code · qwen3.8-max Reviewed at |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not explored to full depth (tool budget reached): PR #8806 changes the Rust desktop-shell Local Control to ...: run cargo test for local_control::tests (blocked: no Rust toolchain on this machine — environmental, not budget); PR #8806 changes the Rust desktop-shell Local Control to ...: cargo check / cargo test for packages/desktop-shell/src-tauri not run (cold worktree, empty cargo registry cache on this runner; full tauri dependency build…; PR #8806 changes the Rust desktop-shell Local Control to ...: run cargo test for the desktop-shell crate to execute the two new/renamed tests — cargo is not installed on this runner ( cargo: command not found ). I hand….
中文说明
已审查。 建议见行内评论。 未探索到全部深度（达到工具调用预算）：PR #8806 changes the Rust desktop-shell Local Control to ...：run cargo test for local_control::tests (blocked: no Rust toolchain on this machine — environmental, not budget)；PR #8806 changes the Rust desktop-shell Local Control to ...：cargo check / cargo test for packages/desktop-shell/src-tauri not run (cold worktree, empty cargo registry cache on this runner; full tauri dependency build…；PR #8806 changes the Rust desktop-shell Local Control to ...：run cargo test for the desktop-shell crate to execute the two new/renamed tests — cargo is not installed on this runner ( cargo: command not found ). I hand…。
— qwen3.8-max via Qwen Code /review (v0.21.8)
Collaborator
Author
|
Followed up on the two Critical findings reported after #8727 merged:
Verification:
The repository-wide format check still reports pre-existing formatting differences in |
Collaborator
Author
|
Added the three load-bearing Local Control regressions at the existing boundary: fail-closed interface enumeration, routed private-address preference, and URL token/root-fallback behavior. The maintenance-only documentation suggestion was intentionally not added. Verified 5 Rust tests, all-target Clippy with warnings denied, rustfmt check, and diff check; exact-head CI is green and automatic review is still in progress. 中文摘要在现有 Local Control 边界补了三项关键回归：网卡枚举失败时 fail closed、优先 routed 私网地址、URL token 与根路径 fallback。未采纳纯维护型文档建议。已通过 5 项 Rust 测试、全目标 Clippy（warnings denied）、rustfmt 与 diff check；exact-head CI 已绿，自动 review 仍在运行。 |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not explored to full depth (tool budget reached): PR #8806 changes the Rust desktop-shell Local Control to ...: full cargo check / cargo test on the actual qwen-code-desktop crate could not run — this Linux runner lacks the Tauri system dependencies (no webkit2gtk/gli…; PR #8806 changes the Rust desktop-shell Local Control to ...: couldn't run cargo test / cargo clippy locally (no pkg-config/dbus system libraries in this environment).; PR #8806 changes the Rust desktop-shell Local Control to ...: cargo test / cargo clippy for packages/desktop-shell/src-tauri could not be run in this environment (build fails in libdbus-sys : no pkg-config / libdbu…; PR #8806 changes the Rust desktop-shell Local Control to ...: full cargo check / cargo test against the real crate including main.rs (tauri) — blocked by missing Linux system dependencies (pkg-config/GTK/dbus); mitigated…; PR #8806 changes the Rust desktop-shell Local Control to ...: cargo check / cargo test of the actual crate including main.rs (tauri-dependent) — blocked by missing Linux system libraries; mitigated by verifying the tau…, and 1 more. Not reviewed: reverse audit — stopped before round 2 by the review time budget.
中文说明
已审查。 建议见行内评论。 未探索到全部深度（达到工具调用预算）：PR #8806 changes the Rust desktop-shell Local Control to ...：full cargo check / cargo test on the actual qwen-code-desktop crate could not run — this Linux runner lacks the Tauri system dependencies (no webkit2gtk/gli…；PR #8806 changes the Rust desktop-shell Local Control to ...：couldn't run cargo test / cargo clippy locally (no pkg-config/dbus system libraries in this environment).；PR #8806 changes the Rust desktop-shell Local Control to ...：cargo test / cargo clippy for packages/desktop-shell/src-tauri could not be run in this environment (build fails in libdbus-sys : no pkg-config / libdbu…；PR #8806 changes the Rust desktop-shell Local Control to ...：full cargo check / cargo test against the real crate including main.rs (tauri) — blocked by missing Linux system dependencies (pkg-config/GTK/dbus); mitigated…；PR #8806 changes the Rust desktop-shell Local Control to ...：cargo check / cargo test of the actual crate including main.rs (tauri-dependent) — blocked by missing Linux system libraries; mitigated by verifying the tau…，另有 1 条。 未审查：反向审计——评审时间预算不足，未能开始第 2 轮。
— qwen3.8-max via Qwen Code /review (v0.21.8)
Collaborator
Author
|
@qwen-code /review |
Contributor
|
Qwen Code review request accepted. Review is queued in workflow run. |
Collaborator
Author
|
Closeout for exact head
中文摘要两个剩余 thread 已由当前 head 的测试向量和 28/28 Rust 测试结果覆盖，且 reviewer 未再回复，因此按已处理状态 resolve；本轮未重复修改代码，自动评审仍在运行。 |
wenshao
reviewed
Aug 9, 2026
wenshao
left a comment
wenshao
left a comment
Collaborator
There was a problem hiding this comment.
中文说明
— glm-5.2 via Qwen Code /review (v0.21.8)
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not explored to full depth (tool budget reached): PR #8806: Desktop Local Control now captures the active s...: did not execute the Rust unit tests** ( cargo test for local_control.rs ). I verified the renamed/new test assertions statically against the new code paths; I…; PR #8806: Desktop Local Control now captures the active s...: did not trace the serve-side SPA fallback serving a live /session/... request end-to-end**; I confirmed mountWebShellSpaFallback is mounted after API routes…; PR #8806: Desktop Local Control now captures the active s...: did not execute cargo test for the src-tauri crate (Tauri/GTK system dependencies make a headless build impractical here); test correctness was verified by re…; PR #8806: Desktop Local Control now captures the active s...: did not verify how the runtime web UI handles the workspace query parameter on the phone side (frontend code, a different package) — assumed correct per the P…; PR #8806: Desktop Local Control now captures the active s...: did not trace the web-shell frontend to confirm it consumes the rebased ?workspace= param on the phone side (separate package; assumed per PR description)., and 1 more.
中文说明
已审查。 建议见行内评论。 未探索到全部深度（达到工具调用预算）：PR #8806: Desktop Local Control now captures the active s...：did not execute the Rust unit tests** ( cargo test for local_control.rs ). I verified the renamed/new test assertions statically against the new code paths; I…；PR #8806: Desktop Local Control now captures the active s...：did not trace the serve-side SPA fallback serving a live /session/... request end-to-end**; I confirmed mountWebShellSpaFallback is mounted after API routes…；PR #8806: Desktop Local Control now captures the active s...：did not execute cargo test for the src-tauri crate (Tauri/GTK system dependencies make a headless build impractical here); test correctness was verified by re…；PR #8806: Desktop Local Control now captures the active s...：did not verify how the runtime web UI handles the workspace query parameter on the phone side (frontend code, a different package) — assumed correct per the P…；PR #8806: Desktop Local Control now captures the active s...：did not trace the web-shell frontend to confirm it consumes the rebased ?workspace= param on the phone side (separate package; assumed per PR description).，另有 1 条。
— qwen3.8-max via Qwen Code /review (v0.21.8)
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not explored to full depth (tool budget reached): PR #8806 changes the Rust desktop-shell Local Control to ...: could not compile/run the crate's Rust unit tests — cargo / rustc are not installed on this runner ( command -v cargo failed). The diff's tests were audited …; PR #8806 changes the Rust desktop-shell Local Control to ...: did not run cargo check / cargo test on packages/desktop-shell/src-tauri (Tauri/webkit system-dep build is heavyweight here); signature compatibility is com…; PR #8806 changes the Rust desktop-shell Local Control to ...: could not execute cargo test to confirm the new tests compile and pass — no Rust toolchain ( cargo ) is installed on this runner; verification is by static an…; PR #8806 changes the Rust desktop-shell Local Control to ...: could not run cargo test for packages/desktop-shell — no Rust toolchain in this review environment.. Not reviewed: reverse audit — stopped before round 3 by the review time budget.
中文说明
已审查。 建议见行内评论。 未探索到全部深度（达到工具调用预算）：PR #8806 changes the Rust desktop-shell Local Control to ...：could not compile/run the crate's Rust unit tests — cargo / rustc are not installed on this runner ( command -v cargo failed). The diff's tests were audited …；PR #8806 changes the Rust desktop-shell Local Control to ...：did not run cargo check / cargo test on packages/desktop-shell/src-tauri (Tauri/webkit system-dep build is heavyweight here); signature compatibility is com…；PR #8806 changes the Rust desktop-shell Local Control to ...：could not execute cargo test to confirm the new tests compile and pass — no Rust toolchain ( cargo ) is installed on this runner; verification is by static an…；PR #8806 changes the Rust desktop-shell Local Control to ...：could not run cargo test for packages/desktop-shell — no Rust toolchain in this review environment.。 未审查：反向审计——评审时间预算不足，未能开始第 3 轮。
— qwen3.8-max via Qwen Code /review (v0.21.8)
Collaborator
|
Qwen Code review timed out. Qwen review timed out after 10800 seconds (of the 180-minute budget). For large PRs, retry with a longer timeout by commenting: |
Collaborator
Author
|
No code changed. Four active Suggestions were closed as mutation-only test expansion or new observability responsibilities outside the promised Local Control behavior. The timed-out exact-head review was rerun with failed jobs only and is now in progress. 中文摘要未修改代码。4 条 Suggestion 属于 mutation-only 测试扩展或新增可观测性职责，已说明并关闭。超时的 exact-head review 已 failed-only rerun，当前运行中。 |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not explored to full depth (tool budget reached): About the change: PR #8806 makes Desktop Local Control ca...: run cargo test / cargo check for packages/desktop-shell/src-tauri — cargo is not installed on this runner ( cargo: command not found ); new tests verifi…; About the change: PR #8806 makes Desktop Local Control ca...: could not execute the Rust test suite ( cargo is not installed in this review environment; the Tauri crate also needs native webkit/gtk system libs), so the ne….
中文说明
已审查。 建议见行内评论。 未探索到全部深度（达到工具调用预算）：About the change: PR #8806 makes Desktop Local Control ca...：run cargo test / cargo check for packages/desktop-shell/src-tauri — cargo is not installed on this runner ( cargo: command not found ); new tests verifi…；About the change: PR #8806 makes Desktop Local Control ca...：could not execute the Rust test suite ( cargo is not installed in this review environment; the Tauri crate also needs native webkit/gtk system libs), so the ne…。
— qwen3.8-max via Qwen Code /review (v0.21.8)
Collaborator
Author
|
Closeout for this feedback pass:
中文摘要两条晚期 review 意见均已核验、回复并 resolve；未增加 mutation-only 测试或扩大系统错误诊断。当前产品检查通过。 |
yiliang114
enabled auto-merge
August 10, 2026 02:19
doudouOUC
approved these changes
Aug 10, 2026
doudouOUC
left a comment
doudouOUC
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the exact head (912910f), including every changed production branch and its downstream consumers. I traced the live main-window URL through the same-origin fallback, URL rebasing, workspace/session parsing in Web Shell, pairing-token substitution in the HTTP/WebSocket proxy, malformed-header rejection, and private/link-local interface selection. The added start parameter is populated by its sole caller, the URL drops unrelated credentials/query state, public routed addresses can no longer bypass the LAN filter, all 12 review threads are resolved, and current CI is green. I found no blocking correctness or security issue. Local Rust execution was unavailable because this environment has no cargo binary; the PR’s macOS Rust test/clippy evidence and repository checks cover the build path.
chiga0
approved these changes
Aug 10, 2026
chiga0
left a comment
chiga0
left a comment
Collaborator
There was a problem hiding this comment.
已审阅 HEAD 912910f。交叉核对了已有 review：所有建议要么已在后续 commit 中补齐（URL 边界用例、bare-CR/LF header 校验、routed 优先与 fail-closed 枚举测试），要么被作者明确列为超出本 PR 范围的覆盖度/可观测性增强项。未发现新的阻塞性正确性或安全问题：Local Control 会话交接、凭证清理、同源回退、私网/link-local 地址过滤、畸形 header 拒绝均到位。CI 全绿。APPROVE。
Collaborator
|
Released in v0.21.9. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Local Control now captures the active Desktop session when it is enabled, so the QR code opens that same session on the phone instead of always opening a blank Web Shell. The handoff keeps only the session path and its workspace identifier, replaces the private runtime credential with the pairing token, and falls back to the Web Shell root if the main window has not finished navigating yet.
The Desktop gateway also fails closed unless it can verify a private or link-local physical IPv4 address. A public default-route address can no longer win before the LAN filter, and interface enumeration failure no longer exposes an unverified routed address.
Why it's needed
The first Local Control implementation authenticated the phone but did not take it into the session visible on the Mac, leaving users to find that session manually. Its address selection also accepted a routed physical address before checking whether it belonged to a private network, which could make a LAN-only gateway listen on a publicly routed interface.
Reviewer Test Plan
How to verify
Evidence (Before & After)
Before: the QR always encoded the Web Shell root, and a public routed physical IPv4 was accepted before private-network filtering.
After: the focused Rust checks cover the session/workspace handoff, credential stripping, private address selection, pairing boundary, and proxy relay.
cargo clippy --manifest-path packages/desktop-shell/src-tauri/Cargo.toml -- -D warningsandcargo test --manifest-path packages/desktop-shell/src-tauri/Cargo.toml local_control::testspass (5 passed, 0 failed).Tested on
Environment (optional)
macOS arm64, Rust desktop-shell unit and Clippy checks.
Risk & Scope
Linked Issues
Follow-up to #8595. Refs #8092.
中文说明
本 PR 做了什么
开启 Local Control 时会记录 Desktop 当前会话，二维码在手机上直接打开同一个会话，不再总是进入空白 Web Shell。交接链接只保留会话路径和对应的 workspace 标识，将内部 runtime 凭证替换成配对 token；如果主窗口仍在导航，则安全回退到 Web Shell 根页面。
Desktop 网关现在还会严格校验可用地址，只允许私网或 link-local 的物理 IPv4。公网默认路由不能再绕过 LAN 过滤，接口枚举失败时也不会回退到未经验证的路由地址。
为什么需要
第一版 Local Control 虽然可以让手机完成认证，但不会进入 Mac 当前显示的会话，用户仍需手动查找。地址选择逻辑也会在私网过滤前接受默认路由对应的物理地址，可能让声明为 LAN-only 的网关监听公网接口。
Reviewer Test Plan
如何验证
修复前后证据
修复前：二维码始终指向 Web Shell 根页面；公网路由对应的物理 IPv4 会在私网过滤前被接受。
修复后：聚焦的 Rust 检查覆盖会话/workspace 交接、旧凭证清理、私网地址选择、配对边界和代理转发。
cargo clippy --manifest-path packages/desktop-shell/src-tauri/Cargo.toml -- -D warnings与cargo test --manifest-path packages/desktop-shell/src-tauri/Cargo.toml local_control::tests均通过（5 passed, 0 failed）。测试平台
环境
macOS arm64，Rust desktop-shell 单元测试与 Clippy 检查。
风险与范围
关联 Issue
#8595 的后续修复。关联 #8092。