fix(ci): make the managed-host bundle assertions able to fail

R2-3: the portal wrapper ships in its own chunk, and every occurrence of
`data-web-shell-portal-root` in the entry sits inside the injected
stylesheet, so the entry grep passed on a bundle whose wrapper was deleted.
Search the whole output for the quoted JSX prop instead, which the scoped
CSS cannot produce.

R5-1: a job-level `permissions:` block replaces the workflow default, so pin
the job's effective scope rather than the workflow-level block.

R5-2: match any expression that reads `secrets`; `${{ toJSON(secrets) }}` is
as much a read as `secrets.TOKEN`. The workflow's own `${{ github.* }}`
expressions are the control against over-broadening the guard.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmw29pur5d6

.github/workflows/web-shell-managed-host.yml

@@ -117,7 +117,12 @@ jobs:
           grep -q 'renderManagedAgentWebShell' "$entry"
           grep -q '__qwenWebShellCss' "$entry"
           grep -qF 'data-qwen-web-shell-entry="managed-host"' "$entry"
-          grep -q 'data-web-shell-portal-root' "$entry"
+          # The portal wrapper ships in its own chunk, and every
+          # `data-web-shell-portal-root` in the entry sits inside the injected
+          # stylesheet, so grepping the entry passes on a bundle whose wrapper
+          # was deleted. Search the whole output for the quoted JSX prop, which
+          # the scoped CSS cannot produce.
+          grep -rqF 'data-web-shell-portal-root":' 'packages/web-shell/dist-managed-host'
           echo "Managed host entry emitted: $(wc -c < "$entry") bytes"
 
       # The output must stay outside `dist/`: the app build empties that

scripts/tests/web-shell-managed-host-workflow.test.js

@@ -64,12 +64,19 @@ describe('managed host build lane', () => {
   });
 
   it('builds untrusted PR code with a read-only token and no secrets', () => {
-    expect(workflow.permissions).toEqual({ contents: 'read' });
+    // A job-level `permissions:` block replaces the workflow default, so the
+    // job's effective scope is the one the untrusted build actually runs with.
+    expect(job.permissions ?? workflow.permissions).toEqual({
+      contents: 'read',
+    });
     expect(workflowSource).not.toContain('pull_request_target');
-    // Match an actual expression, not the prose in the security comment, and
-    // cover bracket access too: `secrets['TOKEN']` is the same read as
-    // `secrets.TOKEN`, so a dot-only guard would let it through.
-    expect(workflowSource).not.toMatch(/\$\{\{[^}]*\bsecrets\s*[.[]/);
+    // Match any expression that reads the context: `${{ toJSON(secrets) }}` is
+    // as much a read as `secrets.TOKEN`. The conflict check below is the
+    // control — the workflow's own `${{ github.* }}` expressions, which a guard
+    // broadened to every expression would red on instead of passing silently.
+    const secretRef = /\$\{\{[^}]*\bsecrets\b/;
+    expect(workflowSource).not.toMatch(secretRef);
+    expect(workflowSource).toMatch(/\$\{\{\s*github\./);
     expect(job['runs-on']).toBe('ubuntu-latest');
     expect(job.if).toContain("github.repository == 'QwenLM/qwen-code'");
     const checkout = job.steps.find((step) =>
@@ -137,6 +144,12 @@ describe('managed host build lane', () => {
     expect(verify.run).toContain(
       'grep -qF \'data-qwen-web-shell-entry="managed-host"\'',
     );
+    // The portal wrapper ships in its own chunk, and every occurrence in the
+    // entry sits inside the injected stylesheet, so the check must search the
+    // whole output for the quoted JSX prop a CSS scope cannot produce.
+    expect(verify.run).toContain(
+      `grep -rqF 'data-web-shell-portal-root":' 'packages/web-shell/dist-managed-host'`,
+    );
     expect(verify.run).not.toContain("grep -q 'data-managed-empty'");
   });