<!-- 使用 release/v0.21.12-preview.4 分支上 .github/release.yml 中的配置生成 -->
## 更新内容
* fix(web-shell): 保留独立会话目标 by @ytahdn 在 https://github.com/QwenLM/qwen-code/pull/9038
* feat(web-shell): 支持工作区文件上传 by @ytahdn 在 https://github.com/QwenLM/qwen-code/pull/8874
* chore(deps): 升级 sharp 至 ^0.35.0 以解决 GHSA-f88m-g3jw-g9cj by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/8952
* fix(ci): 允许两个机器人 PAT 审批发布 PR，无需人工介入 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9056
* test(webui): 通过两次定时器触发排空批量转录分发 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9058
* fix(core): 在守护进程中保留 OTel 会话所有权 by @doudouOUC 在 https://github.com/QwenLM/qwen-code/pull/9077
* fix(desktop): 预留滚动条间距以防止侧边栏项目行抖动 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9073
* feat(autofix): 通过为每个窗口设置 src/test 预算来限制审查轮次 diff 增长 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/8981
* feat(serve): 在截断中途回放前自适应增加实时日志上限 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/8905
* fix(review): 修复内联引用漏洞并加固层级门禁 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9020
* fix(ci): 使 autofix 验证门禁对运行器 git 配置保持隔离 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/8961
* feat(review): 要求每个已确认的 Critical 级别问题必须附带已执行的见证 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9065
* feat(review): 在发布的账本标记中携带增量锚点 sha by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9067
* feat(cli): 添加归因、默认工作量和默认评论的审查设置 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/8994
* perf(serve): 选择性恢复大型会话 by @doudouOUC 在 https://github.com/QwenLM/qwen-code/pull/9055
* feat(core): 为 alicloudapi.com 网关注入请求元数据 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9103
* fix(web-shell): 在会话工具栏中渲染单个归档操作 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9066
* fix(desktop): 打开外部 URL 制品和 markdown 链接 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9069
* fix(desktop): 隐藏 Windows 运行时终端并对齐低动画模式启动 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9064
* fix(desktop): 统一 Windows 和 Linux 上的 Electron 用户端 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9079
* feat(cli): 将守护进程日志与 OpenTelemetry span 关联 by @doudouOUC 在 https://github.com/QwenLM/qwen-code/pull/9084
* fix(ci): 减少 ENOSPC 和负载敏感型测试不稳定现象 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/8982
* feat(core): 为工作流调度编写单 agent 转录记录 by @qqqys 在 https://github.com/QwenLM/qwen-code/pull/8971
* fix(cli): 修复 #9027 CI 审查中的三个审查评论漏洞 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9102
* fix(install): 在 Windows 校验和中避免使用 Get-FileHash by @MichaelYochpaz 在 https://github.com/QwenLM/qwen-code/pull/9112
* chore(ci): 增加安全规范：发布工作流的 CODEOWNERS、最小权限、安全检查与 Scorecard by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9008
* feat(review): 关闭无界发现类而非枚举它们 by @wenshao 在 https://github.com/QwenLM/qwen-code/pull/9095
* fix(autofix): 在 review-pr 运行时暂停 autofix 轮次 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/8899
* fix(daemon): 减少子 agent 实时回放日志 by @ytahdn 在 https://github.com/QwenLM/qwen-code/pull/9057
* fix(desktop): 通过 shell 打开器打开剩余的外部链接 by @yiliang114 在 https://github.com/QwenLM/qwen-code/pull/9111
* fix(web-shell): 弱化工具执行失败的提示 by @ytahdn 在 https://github.com/QwenLM/qwen-code/pull/9053
* refactor(cli): 泛化 Conversations 运行时基础 by @doudouOUC 在 https://github.com/QwenLM/qwen-code/pull/8890
## 新贡献者
* @MichaelYochpaz 在 https://github.com/QwenLM/qwen-code/pull/9112 完成了首次贡献
**完整更新日志**: https://github.com/QwenLM/qwen-code/compare/v0.21.11...v0.21.12-preview.4
<!-- Release notes generated using configuration in .github/release.yml at release/v0.21.12-preview.4 -->
## What's Changed
* fix(web-shell): preserve standalone session target by @ytahdn in https://github.com/QwenLM/qwen-code/pull/9038
* feat(web-shell): support workspace file uploads by @ytahdn in https://github.com/QwenLM/qwen-code/pull/8874
* chore(deps): bump sharp to ^0.35.0 to resolve GHSA-f88m-g3jw-g9cj by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/8952
* fix(ci): let both bot PATs approve the release PR, no human needed by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9056
* test(webui): drain the batched transcript dispatch with two timer hops by @wenshao in https://github.com/QwenLM/qwen-code/pull/9058
* fix(core): Preserve OTel session ownership in daemons by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/9077
* fix(desktop): reserve scrollbar gutter so sidebar project rows don't jitter by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9073
* feat(autofix): brake review-round diff growth with per-window src/test budgets by @wenshao in https://github.com/QwenLM/qwen-code/pull/8981
* feat(serve): adaptively grow live-journal caps before truncating mid-turn replay by @wenshao in https://github.com/QwenLM/qwen-code/pull/8905
* fix(review): close the inline-quotation gap and harden the layer gate by @wenshao in https://github.com/QwenLM/qwen-code/pull/9020
* fix(ci): make autofix verification gates hermetic to runner git config by @wenshao in https://github.com/QwenLM/qwen-code/pull/8961
* feat(review): require an executed witness on every confirmed Critical by @wenshao in https://github.com/QwenLM/qwen-code/pull/9065
* feat(review): carry the incremental anchor sha in the posted ledger marker by @wenshao in https://github.com/QwenLM/qwen-code/pull/9067
* feat(cli): Add review settings for attribution, default effort, and default comment by @wenshao in https://github.com/QwenLM/qwen-code/pull/8994
* perf(serve): Restore large sessions selectively by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/9055
* feat(core): inject request metadata for alicloudapi.com gateways by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9103
* fix(web-shell): render a single archive action in the session toolbar by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9066
* fix(desktop): open external URL artifacts and markdown links by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9069
* fix(desktop): hide the Windows runtime terminal and align reduced-motion startup by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9064
* fix(desktop): bridge Electron users on Windows and Linux by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9079
* feat(cli): Correlate daemon logs with OpenTelemetry spans by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/9084
* fix(ci): reduce ENOSPC and load-sensitive test flakes by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/8982
* feat(core): write per-agent transcripts for workflow dispatches by @qqqys in https://github.com/QwenLM/qwen-code/pull/8971
* fix(cli): close three review-comment gaps from the #9027 CI review by @wenshao in https://github.com/QwenLM/qwen-code/pull/9102
* fix(install): avoid Get-FileHash for Windows checksums by @MichaelYochpaz in https://github.com/QwenLM/qwen-code/pull/9112
* chore(ci): Add security hygiene: CODEOWNERS for release workflows, least-privilege permissions, security checks and Scorecard by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9008
* feat(review): close unbounded finding classes instead of enumerating them by @wenshao in https://github.com/QwenLM/qwen-code/pull/9095
* fix(autofix): hold autofix rounds while review-pr is in flight by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/8899
* fix(daemon): reduce subagent live replay journal by @ytahdn in https://github.com/QwenLM/qwen-code/pull/9057
* fix(desktop): open remaining external links through the shell opener by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/9111
* fix(web-shell): soften tool execution failure hints by @ytahdn in https://github.com/QwenLM/qwen-code/pull/9053
* refactor(cli): Generalize the Conversations runtime foundation by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/8890
## New Contributors
* @MichaelYochpaz made their first contribution in https://github.com/QwenLM/qwen-code/pull/9112
**Full Changelog**: https://github.com/QwenLM/qwen-code/compare/v0.21.11...v0.21.12-preview.4