Qwen Code v0.22.0 shipped with a significant security-by-default improvement that changes how developers interact with one of its built-in tools. The list_directory capability is no longer automatically registered or exposed to the model unless explicitly enabled through configuration, marking a shift toward more conservative default behavior in AI coding assistants.

What Changed With Directory Listing Access

Previously, directory listing functionality was available out-of-the-box, but v0.22 flips this model. Developers must now explicitly opt-in by setting tools.listDirectory.enabled or manually including list_directory in their coreTools configuration. This means existing projects will see a reduced tool surface unless they intentionally expand itโ€”which is exactly the point.

SDK Permission Workflows Get Cleaner

Beyond the directory listing change, this release simplifies how approval modes can be accessed from within SDK implementations. The streamlined path makes it easier for developers building custom integrations to manage permissions programmatically without wrestling with verbose configuration boilerplate.

Why This Matters for Production Deployments

Security-conscious teams have long advocated for opt-in tooling in AI coding assistants, especially when these tools interact with filesystem operations. By moving list_directory behind a deliberate flag, Qwen Code aligns itself more closely with the principle of least privilegeโ€”a design philosophy that should give enterprise users fewer reasons to hesitate.

Migration Considerations

Teams upgrading from earlier versions will need to audit their tool configurations if they rely on directory listing capabilities. The opt-in requirement is straightforward to satisfy: add tools.listDirectory.enabled or include the capability in coreTools, but do it intentionally rather than by accident.

Key Takeaways

  • list_directory is now disabled by defaultโ€”explicit configuration required
  • Enable via tools.listDirectory.enabled flag or coreTools inclusion
  • Approval mode access from SDKs has been streamlined
  • Default security posture improved for production environments

The Bottom Line

Qwen Code's move toward safer defaults is the right call, even if it means some friction during upgrades. When your tooling touches the filesystem by default, conservative is the only sane starting pointโ€”and developers who need directory access know exactly where to find the switch.