* docs(serve): Design workspace session live-state protocol
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* docs(serve): Refine workspace session live-state design
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* feat(serve): Add workspace session live-state endpoint and catalog version
Add GET /workspaces/:workspace/sessions/live-state: a memory-only
volatile snapshot (clientCount, hasActivePrompt, waiting flags) plus an
in-memory catalog version (generation+revision equality token), so
clients stop polling the persisted catalog for volatile state.
The bridge owns the clock: registration/removal marks flow through the
emitSessionLifecycle choke point; rename, automatic title, worktree,
and persisted branch commits mark at exact points; serve-layer REST/ACP
mutations share an invalidate-then-mark helper with exact no-op
semantics (deleted:false group deletes, removeSession:false cleanups,
no-op renames). The route exposes a new version only after
invalidating both persisted catalog scopes, enabling the client
live-A -> full catalog -> live-B reconciliation handshake.
Wire-additive: new unconditional capability
workspace_session_live_state, TypeScript SDK types and
DaemonClient/WorkspaceDaemonClient methods (native REST, no per-poll
capability preflight), telemetry label, and protocol/capability/SDK
docs. Required clock methods on AcpSessionBridge are a source-level
contract change for external structural implementations; in-repo fakes
updated.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(serve): Cover workspace_session_live_state in the serve integration baseline
The capabilities envelope E2E asserts the exact advertised feature list;
the new unconditional live-state capability must appear after the
archived-export tag, matching registry declaration order.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* docs(serve): Close the handshake-vs-single-request argument gap
Separate the two claims the earlier paragraph conflated: the catalog
path cost is irrelevant to carrying a version (it runs anyway on a full
reload), but stamp placement decides consistency. Stamp-after-scan can
silently accept a bundle missing a mid-scan mutation; stamp-first is
safe and self-heals within one poll cycle, which a client may
legitimately choose. The A/B handshake buys provable consistency for
one extra cheap live-state read; the server supports both and the
Web Shell PR picks per product tolerance.
* fix(serve): Mark catalog version on persisted session renames
The metadata route's SessionNotFoundError fallback renamed persisted
sessions without advancing the catalog revision, so version-watching
clients kept the stale display name. Mark after a successful persisted
rename (parity with the live path, which marks on an actual change).
Also reconcile the design doc summary with its Implementation
Boundaries (the implementation ships in this PR, not a follow-up) and
spell out the child-recording persistence mechanism behind the
auto-title catalog mark.
* test(serve): Pin catalog-mark and live-state behaviors from the review round
- Assert markSessionCatalogChanged in the scheduled-task rollback
(including the no-op-removal negative case), the sub-session and
Live coordinator rollback paths, and the never-live orphan
deletion; previously each mark could regress with suites green.
- Cover the live-state route's ?? false projection for both wait
flags, and its first-exposure invalidation arm (revision
unchanged, both organized scopes refilled).
- Cover the side-task generation-closed rollback arm (kill, remove,
catalog mark).
- Compile the SDK live-state type fence via tsconfig.test-fence.json
so shape assertions really pin the wire contract; the default
tsconfig excludes test/.
- Align the design doc's cache-consistency goal with the cache
mechanics (waiters joined before an invalidation may resolve, but
cannot install).
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* feat: support session media references end-to-end
* fix(cli): catalog session media routes and update mid-turn replay meta test
The three new media routes (POST/GET/DELETE /session/:id/media[/:mediaId])
were registered but missing from legacySessionTelemetryRoutes, tripping the
route drift guard; add them as handler_resolved like their sibling routes.
The mid-turn history-replay expectation now carries the replay meta this PR
adds (source: mid_turn_message_injected, qwenDiscreteMessage: true).
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(daemon): harden session media per review feedback
Addresses the Critical review findings on the session-media PR:
- Reject image/svg+xml uploads and serve stored media with
Content-Disposition: attachment and X-Content-Type-Options: nosniff
(same-origin XSS vector on the daemon/Web Shell origin).
- Keep the retained-media TTL sweep running when the session reaper is
disabled (sessionReapIntervalMs <= 0) on the default 60s cadence.
- Record only the inline bytes the media references actually cover:
the gate now counts image blocks only (references are image-only),
and the strip keeps unrelated inline parts (e.g. @-mentioned files).
- Show '[User message with attachments]' on TUI resume for image-only
mid-turn messages recorded with an empty displayText.
- Exempt mid-turn injected echoes from the Web Shell status-noise and
plan-JSON filters.
- Degrade refresh-rebuilt queue rows to summary-only when media
hydration failed, so editing cannot silently discard attachments.
- Retry cross-session media removal without the clientId when the
daemon rejects the stale persisted id (invalid_client_id).
- Register session_media in the integration capabilities baseline.
Each fix carries a regression test that fails on the pre-fix code.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(daemon): bound media content and fix resume/echo edge cases
Addresses the remaining Critical review findings on the session-media PR:
- Cap media content blocks at 256 on the mid-turn and prompt routes and
resolve each distinct mediaId once per resolveContent call — an
unbounded array of duplicate references amplified one small request
into gigabytes of heap at dispatch.
- Record a '[User message with attachments]' placeholder for
inline-media-only mid-turn messages with no references, keeping ''
only for the reference shape that replay projects.
- Restore the same placeholder for image-only ordinary prompts on TUI
resume instead of dropping the message from the restored history.
- Treat a mid-turn injected echo as renderable when its items carry a
non-empty text block, so the degraded-media echo (messages: [''] plus
the placeholder text block) is not discarded as malformed.
- Release session media in killSession's force-kill and closing-session
fallback branches instead of degrading to the crash-path detach
retention.
- Remove the unreachable duplicate return in DaemonSessionClient.load().
Each fix carries a regression test that fails on the pre-fix code.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(daemon): resolve round-4 session media findings
Addresses the round-4 Critical review findings on the session-media PR:
- Move the mid-turn media-reference validation below the idempotent
retry-ack rings so a same-id retry whose media was already removed
(delete racing an in-flight POST, or a refresh re-enqueueing from the
snapshot) settles idempotently instead of failing with
session_media_gone (410).
- Keep image/* (unknown mime type) prompt images inline instead of
uploading them: the media route matches concrete image types only, so
the upload POST 400s and the whole submission hard-failed, regressing
pre-upload behavior for untyped images.
- Project the degraded-media drain echo's placeholder text block when
the echo text is empty, so the Web Shell shows the unavailability
notice instead of rendering an empty bubble.
Each fix carries a regression test that fails on the pre-fix code.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(daemon): resolve round-5 session-media critical findings (#9127)
- Stop deleting a session-media blob when one queued prompt / mid-turn
message referencing it is removed: the store has no reference counting,
so siblings, replay metadata, or other clients may still hold the same
mediaId. Blobs now live until session close / TTL sweep or an explicit
removeSessionMedia.
- Reject duplicate mediaId occurrences in one message at assertReferences
(covers the prompt and mid-turn admission paths); the serializer expands
every reference at dispatch, so repeats amplified one upload into an
unbounded payload even though only one read is needed.
- Align the mid-turn display-text and reference-persistence gates: compute
the same willPersistReferences condition before finalizing displayText, so
a partially-referenced message records the attachments placeholder instead
of an empty displayText with no references.
- Keep the webui mid_turn_message_injected sidechannel alive for degraded
image-only echoes whose items carry only the placeholder text block,
mirroring the SDK normalizer's hasRenderableItemContent.
* fix(daemon): resolve round-6 session-media critical findings (#9127)
* fix(daemon): resolve round-7 session-media critical findings (#9127)
* fix(daemon): resolve round-8 session-media critical findings (#9127)
* fix(daemon): correct session media recovery and queue isolation
* fix(daemon): remove media with deleted queue items
* fix(daemon): bound repeated media in queue drains
---------
Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* feat(web-shell): improve sidebar session management
* feat(web-shell): keep sessions accessible when sidebar is collapsed
* test(web-shell): cover hover session details
* test(web-shell): align workspace sidebar coverage
* fix(web-shell): keep collapsed session actions open
* fix(web-shell): layer collapsed session menus
* fix(web-shell): address sidebar session details review findings (#9122)
- sdk: route workspace session metadata PATCH through direct REST
- collapsed switcher: cancel stale hover-close timers on reopen, keep the
surface open while the group picker or keyboard focus is inside it, and
emit the missing close signal when a tracked menu unmounts open
- suppress the session menu's close focus restore when it started a rename
- migrate the primary workspace expansion preference across the
provisional-to-resolved cwd key change
- honor a persisted workspace collapse over stale one-shot auto-expansion
- drop the inert archived-row tab stop
- align the constrained smoke test with the single-line details title
* fix(web-shell): resolve standing sidebar session details blockers (#9122)
- collapsed switcher: resolve pointer targets through composedPath and
make the close timer's focus guard shadow-DOM aware so hover-open
containment works in shadowDom portal mode
- reset search state when the sidebar collapses so the autofocused
search input no longer mounts inside the hover popover and steals
keyboard focus
- rename: propagate the daemon-resolved displayName (clamped to 256)
instead of the locally typed string and cap both rename inputs at
256 characters
- keep the session list scrollable clear of the fixed footer so rows
stay hoverable, and close the details popover before each
constrained re-hover in the smoke test
- projects section: write the expansion preference outside the state
updater, never lock hideProjectHeader consumers behind a stored
collapse, and reset the one-shot show-all per session source and
primary workspace
- stop a double-click inside a mounted rename input from restarting
the rename and discarding the typed text
* fix: address round-6 review findings in serve metadata and sidebar (#9122)
- serve: reject empty/whitespace displayName on the workspace metadata
route so archived sessions never persist an empty custom_title record
- serve: advertise workspace_session_metadata in the integration
capability baseline to match the registry and unit baselines
- sidebar: end the session scroll port above the fixed footer so rows
can never park under it and block hover (drops stale clearances)
- sidebar: reset search state whenever the collapsed surface closes so
a stale autofocused input cannot steal composer focus on hover-open
- sidebar: keep keyboard-opened collapsed switcher in keyboard
semantics; a pointer graze no longer suppresses focus restoration
- sidebar: busy-guard the archived rename menu item, align the
group-create icon with its siblings, and reset per-section show-all
on session-source change to match the flat list
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix: address round-7 review findings in serve metadata and sidebar (#9122)
* fix: address round-8 review findings in sidebar rename and switcher (#9122)
* fix: address round-9 review findings in sidebar rename and menus (#9122)
* fix: address round-10 review findings in sidebar actions and rename (#9122)
* fix(web-shell): remove unsafe rename unmount cleanup
* fix(web-shell): stabilize sidebar session mutations
* fix(web-shell): polish sidebar session interactions
* feat(web-shell): complete collapsed sidebar navigation
---------
Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(integration-tests): ack daemon tool-guard handshake in the mock ACP child (#9159)
The cross-worktree Git guard made the daemon's built-in tool guard
unconditional, so the bridge now refuses any ACP child that does not
acknowledge the required guard handshake during initialize. The mock
ACP child used by the live-journal recovery E2E tests never acked,
failing every session it served with "ACP child did not acknowledge
the required external tool guard" on all E2E platforms and sandbox
legs.
Mirror the production child contract in the mock: consume the private
guard marker and return the ready acknowledgment in the initialize
response when the daemon requires the guard.
* fix(integration-tests): ack session close ext method in the mock ACP child (#9159)
* fix(integration-tests): keep mock ACP child lightweight and gate its close ack (#9159)
* fix(integration-tests): narrow close-gate comment to what it catches (#9159)
* fix(integration-tests): name the post-merge E2E workflow in the close-gate comment (#9159)
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* feat(web-shell): branch from completed assistant responses
Add durable response checkpoints so Web Shell sessions can branch from
eligible completed Assistant turns without mutating the source history.
- Record and validate checkpoints behind serialized topology fences
- Preserve historical anchors through replay, daemon, SDK, and UI layers
- Publish bounded forks with crash-safe ownership and referenced backups
- Serialize prompt, rewind, branch, automatic turn, and close mutations
- Cover stale anchors, replay pagination, cleanup, and pending UI states
Note: Responses recorded before this change remain non-branchable.
# Conflicts:
# packages/acp-bridge/src/bridge.ts
# packages/acp-bridge/src/bridgeTypes.ts
# packages/cli/src/acp-integration/acpAgent.test.ts
# packages/cli/src/acp-integration/acpAgent.ts
# packages/cli/src/serve/routes/session.ts
# packages/cli/src/serve/server.test.ts
# packages/core/src/services/chatRecordingService.ts
# packages/core/src/services/sessionService.test.ts
# packages/core/src/services/sessionService.ts
# packages/sdk-typescript/src/daemon/DaemonClient.ts
# packages/web-shell/client/components/MessageItem.tsx
# packages/web-shell/client/components/MessageList.tsx
* fix(session): preserve historical branch checkpoints
Keep Assistant-response branching intact across the daemon stack after
rebases, including history serialization and persisted-session ownership.
- Forward durable checkpoint IDs through Bridge, SDK, and UI layers
- Serialize live history mutations and retain valid nested branch anchors
- Preserve persisted branches during generation cleanup
- Add cross-layer regression tests for replay and stale checkpoints
* fix(web-shell): harden response session branching
* chore: remove PR comment evaluation artifact
Keep the PR review report as a local ignored backup instead of
shipping it with the feature branch.
- Remove the generated PR comment evaluation from tracked files
- Preserve the report under the ignored analyze directory
* fix(web-shell): guard historical branch mutations
Historical branch requests could outlive the client timeout during an
active turn, and interactive forks lacked the recorder's cross-process
writer-lease barrier.
- Hide Assistant Branch actions while a turn is active
- Run interactive fork creation inside the recorder write barrier
- Use the concrete checkpoint recorder contract in Session
- Document committed-session ownership and implemented design status
* perf(core): index historical branch points during transcript scan
Build branch catalogs during the frozen index scan so the first history
page no longer reopens and materializes the complete active chain.
- Retain a compact projection for shared branch-point resolution
- Correlate live branch anchors with the completed prompt and final reply
- Complete recorder mocks required by the concrete Session contract
- Update the reviewed design with performance and correlation invariants
* fix(core): address review findings — dead code, boundary remap, promptId guard, stale toast (#8274)
* fix(core): address review findings — dead code, boundary remap, promptId guard, stale toast (#8274)
* fix(core): address review findings — archived GC, subtype registration, UUID validation, dead code (#8274)
* test: strengthen branch-point and fork coverage from review (#8274)
Add focused tests requested in PR review:
- branch catalog resolves checkpoints that fall on a later page
- accept a parallel tool batch closed within a single turn
- exercise the linkSync->copyFileSync fork backup fallback success path
- prove a remapped checkpoint stays usable via a nested fork
- isolate each branch-point validation conjunct across bridge and SDK
* fix: address round-4 review feedback for session branching (#8274)
- Make the directory-fsync durability test platform-aware (skip on win32),
since fsyncDirectoryBestEffort swallows the injected error on Windows and
the rejection path is non-Windows by design.
- Reject atRecordId on the side-task fork path instead of silently discarding
it, so the API surface no longer implies acceptance.
- Correct the design doc: name the real promptQueue FIFO (not the nonexistent
historyMutationQueue) and describe filtered checkpoint boundaries as
remapped to the nearest retained predecessor, not unconditionally null.
- Add focused tests: branch-point assistantRecordUuid mismatch rejection, and
insight-block branchRecordId anchoring (insight-only block must not anchor
onto the previous reply).
* fix: address round-5 review feedback for session branching (#8274)
* fix: address round-6 review feedback for session branching (#8274)
* fix: address round-7 review feedback for session branching (#8274)
* fix(core): harden branch-point resolution against malformed transcript shapes (#8274)
- Filter null/non-object part elements in the shared branch resolver so a
transcript containing null parts no longer makes forkSession throw a
TypeError for every checkpoint.
- Tag tool calls carried in from the pre-boundary prefix so a dangling call
left by a crashed turn no longer permanently disables checkpoint
recording; only calls issued inside the turn must close.
- Merge duplicate-uuid records first-wins for identity fields in the
transcript reader, matching the byUuid index and fork aggregation, so the
reader never advertises a branch marker the fork path must reject.
* fix: address round-8 review feedback for session branching (#8274)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix: address round-9 review feedback for session branching (#8274)
* test(core): pin branch GC isolation from throwing warning callbacks (#8274)
* fix(acp-bridge): reject rewind at admission while a prompt is active (#8274)
* fix(web-shell): harden session branch publication
Preserve direct ACP prompt preemption while fencing branch and rewind history mutations at the Session boundary. Convert branch publication, backup staging, cleanup, and stale-claim GC to asynchronous filesystem APIs, and surface unsupported hard-link commits as typed ACP and HTTP errors. Expand regression coverage and update the reviewed design contract.
* fix(web-shell): harden historical response branching
Reject branches during prompt admission and keep dispatched mutations
owned until their real outcome is known.
- remove detached timeouts across ACP, SDK, and WebUI
- bound branch cleanup and make title scans asynchronous
- avoid full branch-point scans during transcript pagination
- add regression coverage from Core through the real daemon and browser
* fix: address round-11 review feedback for session branching (#8274)
* fix: address round-12 review feedback for session branching (#8274)
* refactor(branching): remove branch-specific overdesign
Simplify historical session branching around the minimum persistence,
recording, and navigation invariants required by the Web Shell flow.
- Replace branch claims and garbage collection with staged publication
- Validate completed turns incrementally instead of reloading transcripts
- Separate persisted branch creation from live session restoration
- Bound SDK waits and prevent late results from replacing navigation
- Remove unused checkpoint prompt IDs while reading legacy records
Note: A pre-commit crash may leave hidden staging or orphan backups.
* chore(sdk): update browser bundle budget
Account for the combined historical branching and transcript projection APIs after merging main while keeping the browser bundle size guard narrowly bounded.
* fix(branching): address review lifecycle gaps
Harden historical session branching against cancellation, observer,
navigation, and shutdown races found during review.
- Normalize cancellation keys and bound close-time mutation waits
- Preserve anchors after observer completion and load persisted forks
- Report success only when the guarded session switch starts
- Cover recorder cursors, fork cleanup, admission, and rollback
- Align daemon events and branch errors with runtime behavior
* refactor(session): simplify branching safeguards
Reduce the session branching surface after review while preserving the
critical concurrency, durability, and ownership guarantees.
- Remove the unused full-chain resolver and test production entry points
- Copy backups from verified open handles instead of using hard links
- Reuse the bounded title scan instead of maintaining an async mirror
- Deduplicate UI branch requests and fail fast for busy automatic turns
- Consolidate repeated mutation tests and retain critical race coverage
- Document the retained invariants and rejected overdesign explicitly
* test(branching): simplify regression coverage
Reduce duplicated branching tests while retaining regression coverage for
the safety, concurrency, and lifecycle fixes introduced by this feature.
- Consolidate symmetric bridge and agent scenarios with table-driven cases
- Remove repeated cross-layer assertions and brittle implementation spies
- Drop redundant UI permutations and branch-only visual snapshots
* fix(serve): handle branch busy admission
* fix(sdk): preserve v1 branch session contract
Keep existing latest-state branch callers source- and wire-compatible while
retaining the persisted-only behavior for historical checkpoint branches.
- Restore no-anchor branches before returning their live client identity
- Add a separate typed result for persisted historical branch requests
- Clean up restored attachments on stale navigation and disconnect races
- Cover immediate continuation and historical persistence independently
* fix(daemon): guard branching history mutations
Prevent branch creation and automatic Goal turns from racing session
teardown or interactive history mutations.
- Reject branch admission while a conditional close is authorized
- Serialize Goal continuations behind the history mutation gate
- Limit branch checkpoints to interactive prompts
- Add regressions for close and Goal scheduling races
* fix(branching): preserve fork and checkpoint semantics
Keep branch checkpoints and file-history snapshots correct across resumed,
forked, and non-interactive session flows.
- Track the restored active-chain base before the first appended turn
- Preserve backup file modes during fork publication
- Exclude authenticated channel prompts from checkpoint recording
- Add regressions for all three review failures
* fix(branching): harden branch and rewind behavior
Handle the remaining branch and rewind review findings without widening
the feature contract.
- Ignore benign concurrent branch rejections in the Web Shell
- Validate rewind prompt IDs before using string operations
- Pin mutation ordering, cleanup, compaction, and checkpoint invariants
- Align sourced-fork fixtures with the canonical side_task value
---------
Co-authored-by: heyang.why <heyang.why@alibaba-inc.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: 易良 <1204183885@qq.com>
Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com>
Co-authored-by: qwen-code-bot <qwen-code-bot@users.noreply.github.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
The transactional cross-session switching from #8882 staged a handoff and
kept the old attachment live until the target load committed. It added a
large transition state machine (intent staging, same-session capture,
watchdog deadlines, controlled rebind) across the daemon session layer
and the web-shell provider, and left the UI pinned to the previous
session while a switch prepared.
Restore the loading-skeleton model: switching a session clears the
transcript, shows the loading skeleton, and waits for the load result.
- Remove sessionTransition state, onSessionTransitionCommit and the
transactional target logic from WorkspaceSessionProvider.
- Strip the transition state machine from DaemonSessionProvider and
restore single-session restores: restore_in_progress retries stay
bounded by the existing watchdog, and the skeleton UI keys on
loadingTranscript.
- Move useDaemonSessionOwnerGuard back under the daemon index export.
- Delete the transactional design docs and both daemon integration
tests; the restored behavior is covered by unit tests.
- Drop the dead desiredSessionTargetPending prop (write gating now keys
on loadingTranscript alone) and stop a failed switch's target
workspace from leaking into the next workspace-less load.
Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* perf(review): extend the convergence pair to 3B (chunked) reviews
The reverse-audit loop is 77-80% of the wall clock on long CI reviews
(measured on two v0.21.9 runs: 291min with 223min in the RA loop, 252min
with ~205min), and on 3B its rounds ran serially because the convergence
pair — rounds 1 and 2 launched together — was 3A-only.
The pair's arithmetic is per-territory, not whole-diff: a chunk dry in
round 1 leaves its slice of the cumulative findings list unchanged, so that
chunk's round-2 auditor re-runs substantively the same audit. Launching
`--all-chunks --round 1` and `--all-chunks --round 2` in one response runs
each chunk's two establishing audits concurrently, saving one round's wall
(~30-56min) off every chunked review — at the same one-round suppression
window the 3A pair and the pipelined loop already accept.
Orchestration-only: the CLI already builds round 2 before round 1's
transcripts exist (round 2 always fans out to every chunk; the retirement
schedule only reads history from round 3), and the deadline gate prices the
paired round-2 admission on its 600s floor exactly as the 3A pair relies on.
A new agent-prompt test pins that mechanism; SKILL.md carries the per-chunk
pair, and DESIGN.md the measurement.
* docs(review): fix the stale 3B parenthetical in the pipelined-loop bullet
The k=0 launch-coupling note still described 3B's first reverse-audit launch
as "round 1's fan-out"; with the convergence pair now applying to 3B it is
rounds 1 and 2 per chunk, matching the same fix already made at Step 4's
verifier-coupling paragraph.
* fix(review): price the 3B pair's wall at the gate and define its reporting transition
The deadline gate priced the concurrent 3B pair's round-2 build off the
seconds-old round-1 stamp — clamped to the observation floor — so both
members were committed at roughly one round's price even though their two
per-chunk fan-outs share the tool-concurrency pool and can take up to two
rounds' wall. Admissions whose predecessor is still in flight now pay both
members' wall in waves of the pool (expectedAdmissionSeconds): one round's
price when the pool holds both fan-outs at once, up to the two-round bound
when it serializes them, and the refusal degrades to round 1 alone as the
skill's budget-stop rule says.
SKILL.md's 3B pair also defined only the dry outcome; its reporting
transition now spells out waiting for both fan-outs, deduping across
rounds and chunks, one `--round 2` verifier batch riding round 3's build,
and the pair's exemption from the pipelined k/k+1 launch rule. DESIGN.md's
"packs tighter than two serial rounds ever could" claim is replaced with
the provable bound, and the gate's wave pricing is recorded beside it.
Tests pin the pair price (deadline.ts and the builder's refusal/admission
shapes) and the skill's same-response pair launch.
* fix(review): cover the both-refused pair shape and document the gate's pricing bounds
- Delegate expectedAdmissionSeconds' solo branch to expectedRoundSeconds,
restoring one production round-cost estimator (R2-3).
- State that the pair price covers the auditor fan-outs only; the
co-launched Step 4 verifier shards' extra wave is the reserve's to
carry (R2-1).
- Document the pair-shaped span ledger's solo over-price as accepted
conservatism, in the estimator doc and DESIGN.md (R2-6).
- Mirror the 3A pair annotation in the Step 5 3B copyable command block
(R2-7).
- Make both pair refusal bullets orientation-symmetric and cover the
both-builds-refused shape, where nothing launches and the first
refusal's marker is the stop (R2-8).
* test(review): pin the 3B pair's reporting transition in the skill test
---------
Co-authored-by: verify <verify@local>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
* test(acp): make exit plan mode test tolerant to LLM timeout
The test sends a prompt asking the LLM to call exit_plan_mode, but LLM
behavior is non-deterministic — it may take too long or never call the
tool. Previously the test failed hard on timeout. Now it catches the
timeout and proceeds to verify whatever notifications were received,
matching the existing permissive stance already documented in the test.
* fix(test): re-throw non-timeout errors in exit plan mode test
The catch-all try/catch was suppressing JSON-RPC errors alongside
intended timeout tolerance. Guard the catch so only the harness
timeout ('Request … timed out') is swallowed; all other errors are
rethrown to surface real failures.
* fix(test): remove dead assert, polling wait, and stderr noise
- Remove stderr dump from the expected timeout path (noise on normal
tolerated path; outer catch still dumps on real failures).
- Replace fixed delay(1000) with bounded polling (5 s) for
mode_update after switch_mode to prevent new flake on slow-LLM
runs.
- Move expect(promptResult).toBeDefined() back into try (the
non-timeout guard now re-throws its AssertionError, so it is
no longer dead code).
* fix(test): address review findings for exit plan mode test
- Expose agent from setupAcpTest so callers can check for crashes
- Detect dead agent in catch block before swallowing timeout
(R1-1: agent crash was indistinguishable from slow LLM)
- Replace hand-rolled polling loop with rig.poll()
(R1-2: duplicate of existing TestRig helper)
* fix(test): tighten timeout discriminator and log swallowed timeouts
- Match the exact harness timeout shape (Request N (session/prompt) timed out)
instead of a substring to avoid swallowing JSON-RPC errors whose message
happens to contain 'timed out' (e.g. MCP request timed out).
- Check for 'response' property to distinguish client-side timeouts from
JSON-RPC error responses.
- Log swallowed timeouts so maintainers can tell which path executed.
* fix(acp-bridge): bound live journal replay chunks
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(core): isolate shell retention sidecars
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(integration): cover aggregated live journal replay
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(core): isolate registry sidecars
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(acp-bridge): keep unmodeled chunk keys out of live journal merges
The merged live-journal entry is rebuilt by spread-merging the first and
last source events, which was only safe because producers happen to emit
exactly {sessionUpdate, content, _meta?} on mergeable chunks. Gate the
merge on that key set so unmodeled data/update fields keep entries
discrete instead of leaking into the aggregate. Also clarify the
live-journal truncation marker: its retained/truncated counts describe
source events, while the limits count replay entries.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(acp-bridge): align replay boundaries for discrete and meta-shaped chunks
Turn compaction folded discrete thought chunks (and non-todo-stop-guard
discrete messages) into one text slot with the last chunk's meta, while
the live journal keeps every discrete chunk separate — resyncing from
compactedReplay mis-attributed text across background tasks. Guard both
chunk paths with the same hasDiscreteMessageMeta predicate the live
journal already uses. Also align the merge gate with the shapes the
shared meta builder emits: tolerate update-level timestamp/
serverTimestamp and qwenTranscript.planToolCallId, and treat an
empty-string parentToolCallId as top-level the way the extractor does.
Document that byte-cap truncation drops whole entries, so the retained
tail can be much smaller than the cap, and tighten the integration
assertion that became vacuous once entries merge source chunks.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(acp-bridge): merge subagent chunks in live journal replay
SubAgentTracker stamps every streamed subagent fragment with
{ parentToolCallId, subagentType }, but the live-journal merge gate
only modeled parentToolCallId, so subagent chunks stayed discrete and
a high-fragment subagent stream could still trip history_truncated.
Model subagentType as a carried label (like the completed-turn path,
which merges by parentToolCallId alone) and cover the producer wire
shape in the merge tests.
* fix(acp-bridge): preserve TextContent metadata in live journal replay (#8801)
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* fix(serve): coordinate caller-supplied session IDs
Complete daemon-wide admission across REST, ACP, workspace generations, SDKs, and MCP.
Closes#8411
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(serve): wire session bridges in hot-reload harness
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(serve): address review round for caller-supplied session IDs (#8415)
Restore the observability and fail-loud guarantees flagged in review:
log every session-id admission routing failure, name the live foreign
owner workspace in restore conflicts, make the ACP dispatcher's
admission dependency required so load/resume cannot run on a mount
without one, and require mountAcpHttp hosts to inject the daemon-wide
admission instead of silently building a weak fallback. Harden the SDK
WS transport against environments without global fetch and against
non-capabilities 200 envelopes, and align the design doc with the
implemented restore-sharing and persistence-failure semantics.
* fix(sdk): harden session ID capability fallback
Preserve REST capability errors, fail closed on malformed envelopes, retain restore routing diagnostics, and align retry documentation.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(serve): normalize restored session IDs
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(session): preserve mixed-case legacy session access
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
* fix(integration-tests): make the project typecheckable and fix what that found
`tsc -p integration-tests/tsconfig.json` could not run at all. The config
carried a `"//"` documentation key inside `compilerOptions.paths`, and every
value there must be an array, so tsc aborted with TS5063 before checking a
single file. Nothing in CI runs it either, so the directory has been
unchecked for its whole life -- which is how PR #8620 shipped an
`integration-tests/cli/qwen-serve-streaming.test.ts` that referenced an
undeclared `REPO_ROOT`, swallowed the ReferenceError in a bare catch, and
reported a green skip for a security regression test.
Moving that note out of `paths` exposed 404 errors. Three more config
defects accounted for 353 of them:
- `composite: true` is inherited from the root config for the packages that
are actually referenced. Composite requires every file in the program to
appear in `include`, and these tests import package sources by relative
path, so it produced 324 TS6307. Nothing references this project and it
emits nothing, so it is now `composite: false`.
- The root `lib` is ES2023 only. The suite drives browser-side code in
`terminal-capture/` and pulls SDK sources that name `WebSocket` and
`HeadersInit`, so 21 identifiers resolved to nothing. Now DOM +
DOM.Iterable + ES2023, matching packages/cli.
- Workspace packages resolved through `packages/core/dist` via a project
reference, so with core unbuilt the checker reported a dozen members as
missing from `Storage` that are right there in the source. They now
resolve from source through `paths`, mirroring packages/cli, and the
reference is gone.
node-pty declares `types` at the top level but its `exports` map is a bare
string with no `types` condition, so nodenext never reached the
declarations and every pty handle degraded to `any` -- which is what
silently untyped the `data` and `exitCode` callbacks in test-helper.ts. It
now resolves through `paths` as well. `@types/jsdom` is added for the one
file that uses it; DefinitelyTyped has no release matching jsdom 26 (it
jumps 21 -> 27), so this pins the current 28.x.
Two real defects fell out of the remaining 51:
- write_file.test.ts built a detailed tool-call failure message and passed
it to `toBeTruthy()`, which takes no arguments. It was discarded on every
failure, leaving only a bare literal.
- Two terminal-capture scenarios set `gif: true` inside `streaming`, where
the runner never reads it. It is a scenario-level switch.
The rest was making an existing `undefined` visible. `readToolLogs()`
promised `name: string` for fields copied straight out of telemetry
attributes that nothing validates; the stdout fallback can promise them,
the telemetry branch cannot, and claiming otherwise just moved the
`undefined` past the type checker into the assertions.
This is type resolution only. `integration-tests/vitest.config.ts` keeps
its own hardcoded aliases onto the built SDK bundle, so the suite still
exercises the published-bundle shape at runtime.
Not wired into CI here, but not for cost reasons: a cold run of
`tsc -p integration-tests/tsconfig.json` takes about 106s on an idle
developer box. The program is 2679 files, of which 103 are integration
tests and roughly 1100 are package sources their own projects already
check, so there is duplicated work available to reclaim by resolving the
packages from their built declarations -- but at ~106s it is already cheap
enough to gate on as-is.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(integration-tests): isolate jsdom types and complete source-resolution paths
Address review round 1:
- external-context: override `types` to ["node"]. The root @types/jsdom
entered its program through vitest's optional jsdom types and injected
lib dom, flipping @types/node's fetch globals to DOM variants whose
ReadableStream is not async-iterable (TS2504 in http-client.ts), which
failed every CI job during the npm ci prepare build.
- integration-tests tsconfig: explicit nodenext paths entries for every
workspace subpath the program imports (sdk/daemon, 19 acp-bridge
subpaths, core goalWire/memoryScopes/userPromptSubmitContext, webui
daemon-react-sdk, channel-base); drop the dead `*` wildcards; include
**/*.tsx. Typechecks green with the source packages' dists removed.
- Relax noPropertyAccessFromIndexSignature in integration-tests and
revert the six bracket-access rewrites it forced in SDK sources.
- channel-plugin: import channels/base from src and map
@qwen-code/channel-base to source so both declarations agree.
- qwen-serve-streaming: asAccepted delegates to the SDK's exported
isNonBlockingAccepted type predicate instead of a drifted copy.
- sleep-interception: tighten blocked predicates to success === false
and fix the comment describing them.
- Declare jsdom at the root next to @types/jsdom.
* fix(integration-tests): complete source-resolution paths and restore single channel-base instance
Address review round 2:
- Map the eight builtin channel adapters and web-templates to source.
channel-registry.ts and html.ts still resolved them through their
exports maps to dist, so the typecheck's build-independence was
incomplete: on a tree without built dists it failed with the exact
9 x TS2307 the maintainer verification measured.
- channel-plugin.test.ts: import @qwen-code/channel-base by bare
specifier instead of a relative src path. At runtime the test and
plugin-example now resolve the same dist/index.js through the
exports map, restoring the single ChannelBase / SessionRouter
instance the relative src import silently split; type resolution
still maps to source through paths, and vitest.config.ts keeps
pointing e2e runs at the built bundles.
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
* fix(tests): avoid blocking integration test cleanup
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(tests): avoid failing fast on telemetry waits for live CLIs (#8688)
* fix(tests): drop dead telemetry-ready return and gate rig tests (#8688)
* fix(tests): pin the gated rig test in the no-AK guard (#8688)
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
* fix(serve): allow same-host daemon text reads
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* docs(serve): address review on same-host text reads
Record what the read capability does not fix: #8618 still reproduces for
the write and edit family, whose delegated writes are refused after the
user has already approved the diff. Give the daemon's pre-approval SSE
fan-out its own bullet in the user-facing security section, restore the
sentence stating that environment isolation is not an OS security
boundary, and make the design doc the single owner of the tradeoff list
so tuning a limit cannot leave stale copies behind.
Test fixtures no longer land in the developer's real home directory, the
assertion pinned to localized rejection copy is dropped, and the combined
capability case is split so deleting the write half cannot silently
remove read coverage.
* fix(test): declare REPO_ROOT and bind the external-read session to the daemon's workspace
The external-read regression test referenced REPO_ROOT twice without
declaring it, which made it unrunnable everywhere:
- On a developer box the ReferenceError was swallowed by the bare catch
in findExternalReadBase(), every candidate was discarded, and the test
reported a green skip -- exactly the silently-disabled security test
the CI loud-fail added last round was meant to prevent. The guard was
defeated three lines above itself.
- On CI that loud-fail branch threw at module scope, so the file failed
to collect and took the four pre-existing tests down with it.
Declare REPO_ROOT the way every other daemon integration test does.
The session also asked for `workspaceCwd: REPO_ROOT` while beforeAll
binds the daemon with `--workspace workspaceDir`, so the create returned
400 Workspace mismatch even once the constant existed. The read under
test is external because externalReadDir sits outside the bound
workspace, not because the session claims a wider one.
Finally, collect each candidate's rejection reason instead of dropping
it, and fold it into both branches: the CI throw names why every
candidate failed and the developer-box skip warns with the same text.
A bare catch cannot tell "no /var/tmp on this image" from a bug in the
function, and the second reads as a green skip.
Reported by @wenshao, who reproduced all three consequences against a
real qwen serve daemon on Linux and supplied the repair.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(web-shell): allow session refresh with daemon auth
* test(web-shell): cover SPA fallback shell branch for non-session navigations
* test(web-shell): retarget sec-fetch SPA fallback test to non-session navigation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(web-shell): serve pre-auth navigations during the deferred runtime window
The deferred-runtime gate applied bearerAuth to every non-bootstrap
request while the runtime was cold, so a browser refresh of
/session/<id> (and / and /assets/*) 401'd on the default
`qwen serve --token ...` start until something else warmed the runtime.
Exempt the same surface mountWebShellAssets registers before auth, via a
shared isPreAuthWebShellRequest predicate, so cold document navigations
start the runtime and load the shell while JSON fetches, API subpaths,
and --no-web daemons stay gated. The predicate is dynamically imported
to respect the serve fast-path import-boundary guards.
* fix(cli): align deferred pre-auth web shell gate with warm routing (#8445)
* fix(cli): report daemon startup failure to pre-auth web shell navigations (#8445)
A pre-auth-exempted Web Shell navigation that hit a failed deferred
runtime startup fell through to the bootstrap app's bearer gate and
received a misleading 401 instead of the 503 daemon_runtime_failed
envelope authenticated requests get for the same failure. Track the
exemption in the deferred dispatch and answer the diagnostic envelope
directly. Also cover the deferred gate's HEAD exemption, which was
previously untested.
* fix(cli): exempt bare /assets from the deferred pre-auth gate (#8445)
* refactor(cli): dedupe runtime failure envelopes and deferred-window test setup (#8445)
* refactor(cli): rename startup envelope helper and pin query-string deep links (#8445)
* fix(cli): serve the // root alias pre-auth and fail-close the deferred predicate (#8445)
* docs(cli): record the pre-auth %2F session deep-link invariant (#8445)
* fix(test): isolate serve streaming suite from stray workspace settings (#8445)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---------
Co-authored-by: 克竟 <dingbingzhi.dbz@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* test(integration): select acp-cron notification by source, not wall-clock (#8333)
* test(integration): remove tautological cron assertions (#8333)
* test(integration): address review — marker-only predicate, post-match assertion (#8333)
- Simplify 3a predicate to _meta.source === 'cron' only (content check
was redundant for selection); assert content post-match so a prompt
text regression fails loudly instead of timing out.
- Drop the residual receivedAt > promptDoneAt wall-clock guard on 3b
and the now-unused promptDoneAt anchor — same race class this PR
fixes, and the ordering is already established by control flow.
- Document 3b's reliance on notification ordering.
---------
Co-authored-by: qwen-code-autofix[bot] <qwen-code-autofix[bot]@users.noreply.github.com>
Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com>
Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com>
* feat(web-shell): support mutable default mid-turn messages
* fix(serve): register mid-turn removal telemetry route
* test(serve): update telemetry route totals
* fix(test): add session_mid_turn_message_mutation to expected features list
* fix(webui): forward clientId on cross-session mid-turn removal (#8229)
- Forward the session clientId in the cross-session removeMidTurnMessage
branch so the bridge's exact-originator match can succeed; without it the
removal resolved to an undefined originator and could never remove the
message stamped at enqueue.
- Strip a misaligned/malformed messageIds from mid_turn_message_injected in
asKnownDaemonEvent instead of rejecting the whole event, mirroring the
sidechannel parser so a buggy daemon can't silently lose the injection
signal.
- Log a mid-turn removal miss in the bridge like the enqueue/pending-removal
siblings, to make removal races diagnosable from daemon logs.
* fix(web-shell): exclude annotations from mid-turn path and harden idle cleanup (#8229)
* fix(web-shell): add container-type to .queuedPrompts so @container query applies (#8229)
* fix(web-shell): harden mid-turn dedupe and capability gate per review (#8229)
- removeInjectedFromQueue now matches by id first (position-independent)
and falls back to text only when no id match exists, so two same-text
sends can't remove the wrong row and double-deliver.
- Thread canMutateMidTurn into useQueuedPrompts and gate the mid-turn
delete/edit mutation on it, so the keyboard path can't hit a DELETE
route the daemon doesn't advertise.
- asMidTurnMessageInjectedData omits a malformed messageIds key instead
of leaving a present undefined, matching the sidechannel parser.
- Narrow MidTurnQueueItem.midTurnState, document the load-bearing effect
order, and make clearQueuedPrompts return false on a no-op clear.
* fix: harden mid-turn removal per review (log escape, cross-session client id) (#8229)
- Escape the caller-controlled messageId (and sessionId) in the mid-turn
removal-miss stderr line to prevent log injection (CWE-117).
- Forward the target session's persisted client id on cross-session mid-turn
removal so the bridge's exact-originator match no longer rejects valid
removals after a session switch with per-session client ids.
- Strengthen tests: distinct-id independence for two queued messages, deferred
removal proving the composer waits for daemon removal, and the active-turn
delete failed-action flag.
---------
Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com>
* fix(integration): use QWEN_CODE_TEST_CRON_FAST in acp-cron test (#8237)
The acp-cron E2E test relied on real minute-boundary cron timing,
waiting up to 75s for the scheduler to fire. This made it flaky in
CI where timing is unpredictable. The interactive cron test already
uses the QWEN_CODE_TEST_CRON_FAST test seam to auto-fire after 5s;
apply the same approach here and reduce the wait timeout to 30s.
* fix(test): pin cron delay and fix stale timeout comment (#8237)
* fix(integration): restore 75s cron-fire fallback timeout in acp-cron (#8237)
---------
Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
* test(e2e): skip two model-flaky SDK E2E cases (#8256)
The async SDK MCP tool-handler case and the subagent-delegation case both
assert that a live model chooses to call a specific tool. That is
nondeterministic: the subagent case reproduces locally as the file-reader
subagent replying without calling read_file (foundSubagentToolCall false),
and the async case fails the same way when the model skips the tool call.
Both already survived three targeted fixes (assert on the deterministic
tool result, force the delegation prompt, inherit the suite timeout) plus
retry: 2 and the 5-minute suite timeout, then recurred on main. Skip them
with FIXME comments matching the existing model-flaky convention
(permission-control.test.ts, save_memory.test.ts). The durable fix is to
drive these turns with the fake OpenAI server harness the interactive
tests use; that is a larger change for a follow-up.
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
* test(e2e): reference tracking issue in skipped-test FIXMEs (#8256)
* test(e2e): correct FIXME failure description for sdk-mcp-server skip (#8256)
---------
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
The two subagent-execution E2E cases capped their timeout at 60s, below the suite's configured real-model E2E budget (TB_TIMEOUT_MINUTES, default 5m) that every other case in the file inherits. A delegated run is multi-turn (main agent delegates, subagent reads and reports, main agent summarizes), so under the slower docker sandbox plus CI load and model rate-limiting it can exceed 60s and fail all retry attempts. The failing main-branch run failed only in sandbox:docker while the same shard passed in sandbox:none, implicating timing rather than model nondeterminism. Drop the per-case 60s overrides so these cases use the same configured timeout as the rest of the suite. No assertions change.
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
* test(integration): migrate acp-cron to fake-openai-server (#8076)
* fix(integration): correct misleading requestIndex comment and remove no-op cleanup (#8076)
* test(integration): harden acp-cron diagnostics and isolation (#8076)
Fail fast when the cron_create tool call is not served to the first user
prompt instead of timing out opaquely 75s later, and dump the fake server
request log on failure so a dispatch shift is quick to diagnose. Close the
fake server even when test setup throws, drop the dead FAKE_SERVER_OPTIONS
(container mode is skipped by IS_SANDBOX), and move QWEN_HOME out of the
agent workspace cwd so workspace scans never see it.
* fix(integration): clear stale qwenHome before acp-cron test setup (#8076)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
---------
Co-authored-by: qwen-code-dev-bot <269191875+qwen-code-dev-bot@users.noreply.github.com>
Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Assert on the deterministic tool result instead of the model's paraphrased final text, which did not reliably echo the value verbatim and caused intermittent failures on main.
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
* fix(test): route setPermissionMode E2E timeouts through TEST_TIMEOUT (#8133)
The 'yolo to plan' and 'auto-edit' setPermissionMode tests hardcoded 10s/15s response timeouts while their passing sibling 'default to yolo' uses the CI-aware TEST_TIMEOUT (60s on CI). A single model round-trip routinely exceeds 30s on shared CI runners, so the tight values made these two tests time out waiting for the first/second response. Route all four hardcoded values through TEST_TIMEOUT to match the established CI-stability pattern.
* fix(test): widen closed-query test timeout to reduce flake risk (#8133)
---------
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
* feat(web-shell): add contextual task panels
* fix(web-shell): harden contextual task panels
* fix(web-shell): preserve side task titles
* fix(web-shell): address review feedback on context panels PR (#7929)
- Add POST /session/:id/side-task to telemetry route catalog (51 routes)
- Increase SDK browser bundle size limit to 184KB
- Fix duplicated data-testid="chat-pane" → "chat-pane-container" on container
- Gate sourceType behind session_source_metadata capability check
- Add removeSession cleanup after killSession in !res.writable path
- Add i18n key sideTask.renameFailed for error fallback
- Add unit tests for selectVisibleHistoryRecords invariant
* fix(cli): update telemetry-catalog route drift guard to 51 routes (#7929)
* fix(web-shell): address review feedback round 2 on context panels PR (#7929)
- Fix /fork sider discarding createSideTask() return value: show toast
when side tasks are unavailable
- Fix layout feedback loop: availableWidth no longer depends on
environmentPanelVisible since the CSS overlay does not change the
chat pane DOM width
- Remove dead environmentPanelSuppressed state (never set to true)
- Restore setArtifactPanelOpen(false) in closeArtifactPanelTab when
the last tab is closed
- Extract agentDisplayName(task) to a local variable to avoid triple
invocation per render
* fix(web-shell): dedupe completed background agents in environment panel (#7929)
getEnvironmentAgentTasks correlated a transcript tool card with the live
/tasks snapshot only on toolUseId, the notification taskId, and a
<subagentType>-<callId> derived id. A completed background agent can lose
that linkage (its live task carries no usable toolUseId and its daemon id
is general-purpose-<internalId>), so the trailing loop appended the live
task as a second entry. Add a conservative content fallback (prompt, or
description+subagentType) mirroring the daemon's legacy resolver.
* feat(web-shell): support side tasks during active turns
* fix(web-shell): deduplicate completed subagents and gate sourceType on capability (#7929)
* fix(web-shell): restore background agent reconciliation and fix agent dedupe (#7929)
Restore the one-shot subagent reconciliation for inline background Agent tool
cards. Persisted notification records do not always retain a toolUseId, so the
SSE discrete-notification path alone can leave a card stuck in Running; the
documented fallback resolves pending cards through the subagent endpoint after
catch-up, reconnect, and terminal notifications.
Also stop the loose description content fallback in getEnvironmentAgentTasks
from claiming a live task that another transcript tool call already links
precisely (by toolUseId, message taskId, or derived id). Two agents sharing a
description previously collapsed into one: the fallback stole the linked task,
its owner re-matched the same task, and the orphan was dropped.
* fix(web-shell): address critical review feedback on context panels (#7929)
* fix(web-shell): reconcile side-task state across sessions and listings (#7929)
* fix(web-shell): preserve contextual panel fallbacks
---------
Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>
Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com>
Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com>
Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com>
