qwen-code v0.23.0 hard-codes manual approval for out-of-workspace writes.

Released September 3, the release refuses to let its AUTO-mode permission classifier decide on any out-of-workspace write, and separately forwards bounded MCP tool arguments and server annotations to that classifier so decisions rest on more than tool names. It authenticates cross-session inbox connections with per-session tokens and gives a session's own processes a child token the inbound gate recognizes. It also adds scoped workspace memory with enforced filesystem boundaries between project and user stores during remember and forget (#9895), which is a concrete answer to agent memory leaking across project scopes.