@qwen-code/qwen-code 0.26.9

Release v0.26.9

on Node.js NPM

Highlights

See the complete change list below.

Breaking Changes

No known breaking changes.

Skill installation and activation

Skill ZIP uploads, daemon APIs, TypeScript SDK support, bulk activation, and recovery protections make installing and managing Skills more reliable.

• Adds PUT /skills/activation and setUserSkillsActivation to enable or disable 1-100 user Skills in one request, with saved preferences and propagation status. (#16186)
• Prepares Skill installation for larger archives by adding disk-based ZIP handling and recovery-backup protection to the installer. (#16421)
• Adds daemon API routes for installing large Skill ZIPs by upload or host file path and querying installation receipts after failures. (#16422)
• Adds TypeScript SDK support for installing Skill ZIPs from File, Blob, bytes, or host path, with attempt IDs and receipt lookup. (#16423)
• WebShell can now upload Skill ZIP archives from the Skills page, show daemon limits, and check uncertain installation results. (#16424)

Web Shell sessions and composer

Web Shell session titles, Add menu polish, draft preservation, batch deletion, and listSessions pagination fixes improve everyday session management.

• Keeps Web Shell sidebar session titles visible when a transcript is rebuilt, preventing session names from disappearing. (#16299)
• Polishes the Web Shell composer Add menu with consistent icons, labels, descriptions, spacing, and improved accessibility for actions and Plan state. (#16181)
  
  
• WebShell now preserves unsent drafts when ArrowUp or ArrowDown moves through wrapped prompt lines before history navigation. (#14909)
• web-shell: batch session deletions at the route limit (#14637)
  
  
• listSessions pagination no longer skips sessions when multiple session files share the same modification time. (#16024)

Managed agents and sessions

Managed agent automation, durable questions, activation renewals, writer recovery, and history caching improve hosted session reliability and speed.

• managed-agent: support durable structured user questions (#16433)
• managed-agent: enable automation by default (#16448)
• Managed agent activation renewals now locate the activation lease more efficiently, reducing renewal lookup overhead. (#16336)
• Improves managed-agent performance by removing tenant guard locks from native journal snapshot publication. (#16410)
• Managed Session history rebuilds now cache message bodies per process, reducing repeated reads and improving performance for hosted turns. (#16337)
• HTTP Managed Session writer recovery now keeps a live in-flight renewal grant instead of unnecessarily re-acquiring the writer. (#16287)

GitHub PR automation

Sandboxed /verify can read PR review threads, /autofix-pr refusals expose machine-readable codes, and GitHub inbound recovery retries failed reads.

• The sandboxed /verify round can now see PR review threads, including resolved and outdated threads, so reviewer findings are available during verification. (#16300)
• /autofix-pr helper refusals now include a machine-readable refused code and next step on stderr, making failures easier to handle. (#16238)
• GitHub inbound recovery now retries after a failed read instead of stopping, so recovered tasks run once the task store becomes readable. (#16402)

Model and provider support

Image input fixes for Llama, LLaVA, Pixtral, Mistral Small, and Qwen VL models plus OCI Generative AI documentation broaden provider coverage.

• Enables image input for Llama 3.2 Vision, Llama 4, LLaVA, Pixtral, and Mistral Small 3.1 and 3.2 models. (#16311)
• core: accept images for Qwen VL models under their Ollama names (#16309)
• providers: document OCI Generative AI under OpenAI-compatible providers (#16345)

Channels and messaging

QQ proactive delivery and richer Channel event timeline recording improve active group messaging, delivery tracking, and scan health visibility.

• Enables QQ proactive delivery so loop messages, webhook tasks, background responses, and daemon sends can be sent as active group messages. (#15635)
• Channel event timeline now records private bound-session deliveries, undelivered events, and scan health outcomes. (#16237)

CLI and terminal status

Interactive CLI reports working, blocked, done, or error status via OSC 7501, while experimental.unifiedAgentLoop helps Ink TUI finish tool batches.

• The interactive CLI now reports working, blocked, done, or error status to terminals using OSC 7501 with app=qwen-code. (#16407)
• With experimental.unifiedAgentLoop enabled, Ink TUI turns await their shared tool batch so tool continuations complete within the turn. (#16385)

Daemon, runtime, and account recovery

Faster SSH registration and MCP startup, reduced tool-execution locking, bounded daemon replay memory, and subscription recovery improve platform stability.

• SSH registration settlement and Session worktree preparation are less serialized, allowing more concurrent Runtime work and faster workspace preparation. (#16386)
• Loads MCP client Google auth providers on demand to reduce startup load while keeping configured server behavior unchanged. (#16242)
• Improves ordinary session tool execution performance by reducing unnecessary locking during admission and dispatch. (#16415)
• Daemon command and skill replay now limits snapshot memory with an 8 MiB per-session ring, configurable via --event-ring-max-bytes. (#16413)
• subscription: isolate activation and restore sign-in recovery (#16453)

Other Changes

• Internal test coverage for renewal recovery and writer seal handling was hardened without changing production behavior. (#14482)
• Consolidates Web Shell sidebar test scaffolding onto a shared sidebarHarness without changing user-visible behavior. (#16016)
• Adds a design proposal for moving PR state transition detection from GitHub channel polling to the daemon PR refresh timer. (#16246)
• Shortens the stale PR policy to mark pull requests stale after 30 inactive days and close them after 14 more days, with a larger sweep budget. (#16435)
• Fixes release Docker integration builds to use the same apt-mirror probe as E2E builds, improving mirror selection and cache reliability. (#16278)
• The no-AK integration gate now runs on the self-hosted ECS pool for every pull request, including untrusted forks. (#16132)
• test(managed-agent): cover pending sibling approval holds (#15994)
• ci: build the PR tree once and shorten the required path (#16450)
  
  

中文摘要

Skill 安装与激活

Skill ZIP 上传、daemon API、TypeScript SDK 支持、批量激活与恢复备份保护，让 Skill 安装和管理更可靠。

• 新增 PUT /skills/activation 与 setUserSkillsActivation，可一次启用或禁用 1-100 个用户 Skill，并返回保存与传播状态。 (#16186)
• 为大型 Skill 压缩包安装做准备，在安装器中加入从磁盘读取 ZIP 的能力与恢复备份保护。 (#16421)
• 新增守护进程 API，可通过上传或主机文件路径安装大型 Skill ZIP，并在失败后查询安装回执。 (#16422)
• TypeScript SDK 支持通过 File、Blob、字节或主机路径安装 Skill ZIP，并提供尝试 ID 与回执查询。 (#16423)
• WebShell 现在可从 Skills 页面上传 Skill ZIP，显示守护进程限制，并查询不确定的安装结果。 (#16424)

Web Shell 会话与输入

Web Shell 会话标题、Add 菜单细节、草稿保留、批量删除与 listSessions 分页修复改进日常会话管理。

• 当 transcript 重建时保留 Web Shell 会话列表标题，避免会话名称丢失。 (#16299)
• 优化 Web Shell 作曲器 Add 菜单的图标、标签、描述、间距，并改进无障碍展示与 Plan 状态指示。 (#16181)
• WebShell 现在在 ArrowUp 或 ArrowDown 浏览换行提示行时保留未发送草稿。 (#14909)
• web-shell: batch session deletions at the route limit (#14637)
• listSessions 分页在多个会话文件修改时间相同时不再跳过会话。 (#16024)

Managed agent 与会话

Managed agent 自动化、持久用户问题、activation 续期、writer 恢复与历史缓存提升托管会话的可靠性与性能。

• managed-agent: support durable structured user questions (#16433)
• managed-agent: enable automation by default (#16448)
• Managed agent 激活续期现在能更高效定位 activation lease，降低查询开销。 (#16336)
• 通过移除 native journal 快照发布中的 tenant 守卫锁，提升 managed-agent 性能。 (#16410)
• Managed Session 历史重建现在按进程缓存消息正文，减少重复读取并提升性能。 (#16337)
• HTTP Managed Session 写入方恢复现在会保留有效的在途续期授权，避免不必要重新获取。 (#16287)

GitHub PR 自动化

沙箱 /verify 可读取 PR review threads，/autofix-pr 拒绝输出机器可读代码，GitHub 入站恢复在读取失败后重试。

• 沙箱 /verify 轮次现在可读取 PR review threads，包括已解决和过期讨论，便于验证时参考评审意见。 (#16300)
• /autofix-pr 助手拒绝时会在 stderr 输出 refused 代码和 next 步骤，便于自动处理。 (#16238)
• GitHub 入站恢复在读取失败后会继续重试，任务存储可读后已恢复任务将运行。 (#16402)

模型与 Provider 支持

Llama、LLaVA、Pixtral、Mistral Small 与 Qwen VL 图像输入修复，以及 OCI Generative AI 文档扩展 provider 覆盖。

• Llama 3.2 Vision、Llama 4、LLaVA、Pixtral 及 Mistral Small 3.1/3.2 支持图像输入。 (#16311)
• core: accept images for Qwen VL models under their Ollama names (#16309)
• providers: document OCI Generative AI under OpenAI-compatible providers (#16345)

Channel 与消息

QQ 主动消息投递与更完整的 Channel 事件时间线记录改进群消息、投递跟踪和扫描健康可见性。

• QQ 支持主动消息投递，循环、webhook、后台任务和 daemon 发送可作为主动群消息发出。 (#15635)
• Channel 事件时间线现在记录私有绑定会话投递、未投递事件和扫描健康结果。 (#16237)

CLI 与终端状态

交互式 CLI 通过 OSC 7501 报告 working、blocked、done 或 error 状态，experimental.unifiedAgentLoop 帮助 Ink TUI 完成工具批处理。

• 交互式 CLI 现在通过 OSC 7501 向终端报告 working、blocked、done 或 error 状态，并标记 app=qwen-code。 (#16407)
• 启用 experimental.unifiedAgentLoop 后，Ink TUI 回合会等待共享工具批处理完成。 (#16385)

Daemon、Runtime 与账户恢复

SSH 注册、MCP 启动、工具执行锁与 daemon 回放内存限制优化，以及 subscription 恢复改进平台稳定性。

• SSH 注册结算与 Session worktree 准备减少串行限制，支持更多并发 Runtime 工作。 (#16386)
• 按需加载 MCP 客户端的 Google auth providers，降低启动负载且配置服务器行为不变。 (#16242)
• 通过减少普通会话工具执行准入与调度中的不必要锁，提高执行性能。 (#16415)
• 守护进程命令和技能回放限制快照内存，默认每会话 8 MiB，可用 --event-ring-max-bytes 配置。 (#16413)
• subscription: isolate activation and restore sign-in recovery (#16453)

其他变更

• 增强续期恢复与 writer seal 的测试覆盖，不改变生产行为。 (#14482)
• 将 Web Shell 侧边栏测试脚手架合并到共享 sidebarHarness，不影响用户可见行为。 (#16016)
• 新增设计提案，将 PR 状态变化检测从 GitHub 频道轮询迁移到 daemon 的 PR 刷新定时器。 (#16246)
• 将 stale PR 策略缩短为 30 天无活动标记、再过 14 天关闭，并提高单次清理预算。 (#16435)
• 修复 release Docker 集成构建，使其与 E2E 一样使用 apt-mirror 探测，提升镜像选择与缓存可靠性。 (#16278)
• no-AK 集成门禁现在对所有 pull request 路由到自托管 ECS 池，包括不受信任分支。 (#16132)
• test(managed-agent): cover pending sibling approval holds (#15994)
• ci: build the PR tree once and shorten the required path (#16450)

New Contributors

• @xxwtiancai made their first contribution in #14482
• @fede-kamel made their first contribution in #16345

Full Changelog: v0.26.8...v0.26.9