@qwen-code/web-shell 0.25.1-preview.1 → 0.25.1-preview.2

package/dist/types/components/ChatEditor.d.ts

@@ -10,6 +10,7 @@ import { type ComposerSubmitMetadata, type EditorHandle } from '../hooks/useComp
 import type { ContextUsageControls } from '../hooks/useContextUsageControls';
 import type { VoiceStatusRevision, VoiceWorkspaceTarget } from '../voice/voice-workspace-target';
 import { type SessionGitIntent } from './GitModePopover';
+import { type WorkspaceSelectorOption } from './WorkspaceSelector';
 export type ComposerToolbarAction = 'approvalMode' | 'plan' | 'contextUsage' | 'gitBranch' | 'model' | 'commands' | 'files' | 'widthMode' | 'voice' | 'workspace' | 'addMenu';
 interface ChatEditorProps {
     onSubmit: (text: string, images?: import('../adapters/promptTypes').PromptImage[], files?: import('../adapters/promptTypes').PromptFile[], commitAccepted?: import('../hooks/useComposerCore').ComposerSubmitCommit, metadata?: ComposerSubmitMetadata) => boolean | void;
@@ -101,16 +102,12 @@ interface ChatEditorProps {
     onSelectModel?: (model: string) => void;
     reasoning?: DaemonReasoningControls;
     onSelectReasoningEffort?: (value: ReasoningSelection, source?: 'toggle') => Promise<void> | void;
-    workspaces?: Array<{
-        id: string;
-        cwd: string;
-        label: string;
-        primary: boolean;
-        trusted: boolean;
-    }>;
+    workspaces?: WorkspaceSelectorOption[];
     selectedWorkspaceCwd?: string;
     workspaceSelectionDisabled?: boolean;
     onSelectWorkspace?: (workspaceCwd: string | undefined) => void;
+    /** Host-aware variant; see WorkspaceSelector. */
+    onSelectHostedWorkspace?: (hostOrigin: string, workspaceCwd: string | undefined) => void;
     scratchWorkspaceSupported?: boolean;
     existingFolderWorkspaceSupported?: boolean;
     standaloneTargetSupported?: boolean;

package/dist/types/components/WorkspaceSelector.d.ts

@@ -4,6 +4,8 @@ export interface WorkspaceSelectorOption {
     label: string;
     primary: boolean;
     trusted: boolean;
+    /** Daemon host this workspace lives on; defaults to the page origin. */
+    hostOrigin?: string;
 }
 interface WorkspaceSelectorProps {
     workspaces: WorkspaceSelectorOption[];
@@ -17,6 +19,12 @@ interface WorkspaceSelectorProps {
     selectedStandalone?: boolean;
     className?: string;
     onSelectWorkspace: (cwd: string | undefined) => void;
+    /**
+     * Host-aware selection for multi-daemon pages. When provided it fires
+     * INSTEAD of `onSelectWorkspace`, with the option's host (page origin when
+     * unset); `undefined` cwd keeps marking the host's primary workspace.
+     */
+    onSelectHostedWorkspace?: (hostOrigin: string, cwd: string | undefined) => void;
     onSelectStandalone?: () => void;
     onCreateScratch: () => void;
     onOpenExistingFolder: () => void;
@@ -25,5 +33,5 @@ interface WorkspaceSelectorProps {
  * Composer workspace menu. Capability-gated creation actions and disabled
  * untrusted entries keep presentation aligned with daemon authorization.
  */
-export declare function WorkspaceSelector({ workspaces, selectedWorkspaceCwd, disabled, busy, scratchSupported, existingFolderSupported, standaloneSupported, selectedStandalone, className, onSelectWorkspace, onSelectStandalone, onCreateScratch, onOpenExistingFolder, }: WorkspaceSelectorProps): import("react/jsx-runtime").JSX.Element | null;
+export declare function WorkspaceSelector({ workspaces, selectedWorkspaceCwd, disabled, busy, scratchSupported, existingFolderSupported, standaloneSupported, selectedStandalone, className, onSelectWorkspace, onSelectHostedWorkspace, onSelectStandalone, onCreateScratch, onOpenExistingFolder, }: WorkspaceSelectorProps): import("react/jsx-runtime").JSX.Element | null;
 export {};

package/dist/types/components/artifacts/artifactUtils.d.ts

@@ -30,6 +30,15 @@ export declare function readWorkspaceFileAsBlob(readFileBytes: (filePath: string
 }): Promise<Blob>;
 export declare function downloadWorkspaceFile(workspaceActions: Pick<DaemonWorkspaceActions, 'readFileBytes' | 'stat'>, workspacePath: string, mimeType?: string, isCancelled?: () => boolean): Promise<void>;
 export declare function getArtifactLocation(artifact: DaemonSessionArtifact): string;
+/**
+ * Workspace files are shown by filename. Links and managed artifacts have no
+ * file, so they keep the stored title.
+ */
+export declare function artifactDisplayName(artifact: Pick<DaemonSessionArtifact, 'title'> & {
+    workspacePath?: string;
+}): string;
+/** A backslash stays in the name, matching `path.posix.basename`. */
+export declare function workspaceFileName(workspacePath: string | undefined): string | undefined;
 export declare function normalizePath(value: string | undefined): string;
 export declare function stripWorkspacePath(path: string, workspaceCwd?: string): string;
 export declare function isSamePath(left: string | undefined, right: string | undefined, workspaceCwd?: string): boolean;

package/dist/types/components/managed/generated/managed-agent-api.d.ts

@@ -57,7 +57,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description POST SSE consumed through fetch response.body. An afterSequence below the replay floor ends the stream with one agent.session.resync_required frame instead of a 409; reload the transcript and resume after its lastSequence. */
+        /** @description POST SSE consumed through fetch response.body. An afterSequence below the replay floor ends the stream with one agent.session.resync_required frame instead of a 409 only while the Snapshot backs the floor (replay_floor_sequence <= snapshot_through_sequence); a stream reconciliation discards the Snapshot without lowering the floor, and during that rebuild such a cursor is served from the retained events. On the resync frame, reload the transcript and resume after its lastSequence. */
         post: operations["webShellStreamEvents"];
         delete?: never;
         options?: never;
@@ -74,7 +74,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission and fixed server-owned profile with public Session creation. The Session creator may submit later Turns under the same opt-in with current read and create grants on the bound ACTIVE Workspace generation and storage. Cancellation of running work requires the creator’s read grant and the opt-in, even after create authority is revoked (a live cancel reuses the owner's resident Harness attachment; a cold connector cache passively re-attaches for a persisted cancellation after frozen identity checks, independently of current creation grants, registry state or mount readiness; new work still rechecks execution authority); Workspace close follows its separate close capability and lifecycle admission; archive and unarchive follow retention capabilities after reliable Workspace close; delete supports either L3 idle ACTIVE files Sessions or L2 CLOSED/ARCHIVED Sessions; controlled same-Workspace cwd changes ship through the durable cwd_change operations (v1.32). The per-caller workspaceTurns capability on this surface advertises current submit and rename admission; it does not gate cancellation. Freeze selection with the original idempotency key; admission does not prove physical directory readiness. */
+        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission and fixed server-owned profile with public Session creation. Any caller holding the OPERATOR role may submit later Turns and rename the Session under the same opt-in, while the Workspace registry row stays ACTIVE and still backs the binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is an active, undeleted qwen-code Session on the frozen execution profile; Workspace close follows its separate close capability and lifecycle admission; the same caller may cancel a running Turn (its delivery re-checks no grants); archive and unarchive follow their separate retention capabilities after reliable Workspace close; delete supports either L3 idle ACTIVE files Sessions or L2 CLOSED/ARCHIVED Sessions; controlled same-Workspace cwd changes ship through the durable cwd_change operations (v1.32). The per-caller workspaceTurns capability on this surface advertises the same submit/rename admission rule; it does not gate cancellation. Freeze selection with the original idempotency key; admission does not prove physical directory readiness. */
         post: operations["webShellCreateSession"];
         delete?: never;
         options?: never;
@@ -140,7 +140,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description W2, implemented: the camelCase twin of the public changeSessionCwd with the matched refusal order: 400 invalid_request for a missing or malformed field; 401 actor_required without a trusted actor; 400 invalid_idempotency_key for a malformed idempotencyKey — with two documented divergences: a key over 128 characters is refused during request validation with 400 invalid_request before the service's check, and a blank idempotencyKey is refused there too, while the public header answers 400 invalid_idempotency_key for both shapes; 400 invalid_cwd for a lexical violation and 400 invalid_request for an expectedContextRevision below 1; 404 session_not_found for an unknown Session id; 400 unsupported_feature for an unbound Session; 404 session_not_found for an unreadable Session and 403 session_operation_forbidden when a readable actor is not the creator; 409 idempotency_conflict when one key carries different content; 409 workspace_unavailable when execution is disabled; 404 session_not_found for a deleted Session — a completed change under the same key still replays instead; then 409 session_state_conflict, 409 workspace_unavailable from moved Registry facts, 409 context_revision_conflict and 409 session_context_busy exactly like the public surface. Poll the operation or await session.context.changed; do not treat 202 as activation. */
+        /** @description W2, implemented: the camelCase twin of the public changeSessionCwd with the matched refusal order: 400 invalid_request for a missing or malformed field; 401 actor_required without a trusted actor; 400 invalid_idempotency_key for a malformed idempotencyKey — with two documented divergences: a key over 128 characters is refused during request validation with 400 invalid_request before the service's check, and a blank idempotencyKey is refused there too, while the public header answers 400 invalid_idempotency_key for both shapes; 400 invalid_cwd for a lexical violation and 400 invalid_request for an expectedContextRevision below 1; 404 session_not_found for an unknown Session id; 400 unsupported_feature for an unbound Session; 404 session_not_found for an unreadable Session; 409 idempotency_conflict when one key carries different content, and a completed change under the same key always replays instead, before the role refusal; 403 session_operation_forbidden when a readable actor's Workspace role is below OPERATOR; 409 workspace_unavailable when execution is disabled; 404 session_not_found for a deleted Session; then 409 session_state_conflict, 409 workspace_unavailable from moved Registry facts (the recorded create-command actor's grant included, and the settlement re-checks the V56-persisted initiator the same way, so demoting either actor fails the operation, exactly like the public surface), 409 context_revision_conflict and 409 session_context_busy. Poll the operation or await session.context.changed; do not treat 202 as activation. */
         post: operations["webShellChangeCwd"];
         delete?: never;
         options?: never;
@@ -173,7 +173,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; only the Session creator may respond (a Session with no recorded creator and no recorded create command answers to any caller in its tenant). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["queryWebShellActions"];
         delete?: never;
         options?: never;
@@ -190,7 +190,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; only the Session creator may respond (a Session with no recorded creator and no recorded create command answers to any caller in its tenant). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["getWebShellAction"];
         delete?: never;
         options?: never;
@@ -207,7 +207,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; only the Session creator may respond (a Session with no recorded creator and no recorded create command answers to any caller in its tenant). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["respondWebShellAction"];
         delete?: never;
         options?: never;
@@ -224,7 +224,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Uses the same close admission, creator authorization and durable cleanup semantics as the public close route. sessionClose describes deployment support; it does not grant actor authorization. New L3 Workspace close operations run SessionEnd only, retain data, and finish after durable effects verification and original Runtime stop. SessionDelete is reserved for ACTIVE delete. Missing protocol support rejects new admission; previously admitted operations retain their saved protocol. Unknown outcomes remain recovery_blocked. */
+        /** @description Uses the same close admission, owner authorization and durable cleanup semantics as the public close route. sessionClose describes deployment support; it does not grant actor authorization. New L3 Workspace close operations run SessionEnd only, retain data, and finish after durable effects verification and original Runtime stop. SessionDelete is reserved for ACTIVE delete. Missing protocol support rejects new admission; previously admitted operations retain their saved protocol. Unknown outcomes remain recovery_blocked. */
         post: operations["closeWebShellSession"];
         delete?: never;
         options?: never;
@@ -241,7 +241,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Workspace-bound archive requires a closed Session with completed reliable-close evidence and the creator with current read access. It completes atomically during admission, preserves data and the permanent close fence, and calls neither Harness nor Runtime. A readable non-creator returns 403; missing close evidence returns 409 workspace_unavailable. */
+        /** @description Workspace-bound archive requires a closed Session with completed reliable-close evidence and the Session's recorded owner with current read access. It completes atomically during admission, preserves data and the permanent close fence, and calls neither Harness nor Runtime. A readable non-owner returns 403; missing close evidence returns 409 workspace_unavailable. */
         post: operations["archiveWebShellSession"];
         delete?: never;
         options?: never;
@@ -258,7 +258,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Workspace-bound ACTIVE deletion supports idle hosted-workspace-files/1 Sessions when L3 lifecycle protocol and reliable Runtime stop are available. Only the creator with current read access may admit it; accepted, running, cancelling or approval-waiting Turns return 409 turn_active. Admission persists a lifecycle-only execution fence and a versioned actor-scoped operation. SessionEnd settles before SessionDelete; committed Hook results are verified in Session Store and saved before permanent draining, attachment cleanup and original worker stop. Unknown outcomes or missing original stop evidence remain recovery_blocked and are never replayed on a replacement worker. CLOSED/ARCHIVED deletion retains L2: completed reliable-close evidence is required and no Harness or Hook is invoked. Completion atomically commits retirement, tombstone, receipt and terminal event, retaining shared Workspace files and neighboring holders. Authorized same-actor/key replays return the original operation, including after deletion; readable non-creators return 403. Missing lifecycle capability or close evidence returns 409 workspace_unavailable. */
+        /** @description Workspace-bound ACTIVE deletion supports idle hosted-workspace-files/1 Sessions when L3 lifecycle protocol and reliable Runtime stop are available. Only the Session's recorded owner (owner_actor_key, with the pre-V40 creator fallback) with current read access may admit it; accepted, running, cancelling or approval-waiting Turns return 409 turn_active. Admission persists a lifecycle-only execution fence and a versioned actor-scoped operation. SessionEnd settles before SessionDelete; committed Hook results are verified in Session Store and saved before permanent draining, attachment cleanup and original worker stop. Unknown outcomes or missing original stop evidence remain recovery_blocked and are never replayed on a replacement worker. CLOSED/ARCHIVED deletion retains L2: completed reliable-close evidence is required and no Harness or Hook is invoked. Completion atomically commits retirement, tombstone, receipt and terminal event, retaining shared Workspace files and neighboring holders. Authorized same-actor/key replays return the original operation, including after deletion; a readable non-owner returns 403. Missing lifecycle capability or close evidence returns 409 workspace_unavailable. */
         post: operations["deleteWebShellSession"];
         delete?: never;
         options?: never;
@@ -331,6 +331,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/agent/web-shell/v1/tasks/cancel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post: operations["cancelWebShellTask"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/agent/web-shell/v1/tool-results/get": {
         parameters: {
             query?: never;
@@ -388,7 +404,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Synchronously restores an archived Session to closed. Workspace-bound Sessions require completed reliable-close evidence and the creator with current read access (404 unreadable, 403 readable non-creator). Bound keys are tenant/Session/actor scoped. Replay returns the current visible Session without repeating the mutation; a deleted Session returns 404. The permanent close fence is preserved and no Harness or Runtime call is made. */
+        /** @description Synchronously restores an archived Session to closed. Workspace-bound Sessions require completed reliable-close evidence and the Session's recorded owner with current read access (404 unreadable, 403 readable non-owner). Bound keys are tenant/Session/actor scoped. Replay returns the current visible Session without repeating the mutation; a deleted Session returns 404. The permanent close fence is preserved and no Harness or Runtime call is made. */
         post: operations["unarchiveWebShellSession"];
         delete?: never;
         options?: never;
@@ -528,14 +544,14 @@ export interface components {
             /** @default false */
             actions: boolean;
             /**
-             * @description True when the caller may submit later Turns of this Workspace-bound Session: the deployment enables Workspace files, the caller created the Session and currently holds Workspace read and create grants on a registry row whose state is ACTIVE and still carries the Workspace generation and storage identity the Session was bound to, and the Session is an active, undeleted qwen-code Session on the frozen execution profile. Cancelling only aborts work that is already running, so the creator may cancel a running Turn even when this is false, as long as they can still read the Workspace and the deployment still enables Workspace files. False for every other caller and for unbound Sessions, which do not use it.
+             * @description True when the caller may submit later Turns of this Workspace-bound Session or rename it: the deployment enables Workspace files, the caller holds the OPERATOR role on a Workspace registry row whose state is ACTIVE and still backs the Session's binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is an active qwen-code Session on the frozen execution profile. Cancelling only aborts work already running, so an OPERATOR caller may cancel a running Turn even when this is false; the capability does not gate cancellation. False for every other caller and for unbound Sessions, which do not use it.
              * @default false
              */
             workspaceTurns: boolean;
             tasks: boolean;
             artifacts: boolean;
             /**
-             * @description Deployment support for close independently of archive/delete. Admission also requires creator ownership and current read access for a bound Session.
+             * @description Deployment support for close independently of archive/delete. Admission also requires Session ownership and current read access for a bound Session.
              * @default false
              */
             sessionClose?: boolean;
@@ -687,7 +703,7 @@ export interface components {
                  * @default false
                  */
                 workspaceContext: boolean;
-                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Read/Write/Edit Turn at creation; the Session creator may submit and cancel later Turns under the same opt-in, while close follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
+                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Read/Write/Edit Turn at creation; callers holding the OPERATOR role may submit later Turns or rename under the same opt-in while the registry row stays ACTIVE and still backs the Session's binding and the actor recorded by the Workspace create command keeps OPERATOR or above, and may cancel a running Turn (its delivery re-checks no grants), while close follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
                 workspaceBinding: boolean;
             };
             /** @description Same authorized explicit default as default_workspace, including when outside this page; null if absent or not creatable. A non-null default is active and has canCreateSession=true. */
@@ -759,6 +775,8 @@ export interface components {
             sessionId: string;
             /** @enum {unknown} */
             type: "create_session" | "submit_input" | "cancel" | "action_response" | "close" | "archive" | "delete" | "task_cancel";
+            /** @description Task that a task_cancel operation targets. */
+            taskId?: string;
             /** @enum {unknown} */
             status: "pending" | "running" | "completed" | "failed" | "cancelled" | "recovery_blocked";
             /** @enum {unknown} */
@@ -767,10 +785,10 @@ export interface components {
             deliveryState: "pending" | "leased" | "confirmed" | "blocked";
             receiptId?: string;
             actionResolution?: components["schemas"]["WebShellActionResolution"];
-            /** @description Reason a durable response or task cancellation failed. Action response failures come from the original committed Action, or a definitive invalid response. Workspace close recovery_blocked reports original resource identity or unsettled execution; the Session remains closing. */
+            /** @description Reason a durable response or task cancellation failed. Action response failures come from the original committed Action, or a definitive invalid response. Task cancel failures are task_already_settled (the run ended before the stop request was recorded), task_action_unavailable and task_not_found; a recovery_blocked task cancel reports task_cancel_unconfirmed. Workspace close recovery_blocked reports original resource identity or unsettled execution; the Session remains closing. */
             failureCode?: string;
             replayed: boolean;
-        } & (unknown & unknown & unknown & unknown);
+        } & (unknown & unknown & unknown & unknown & unknown);
         WebShellQuestionAction: {
             actionId: string;
             /** Format: uuid */
@@ -894,7 +912,7 @@ export interface components {
          */
         TaskRuntimeState: "unbound" | "provisioning" | "ready" | "draining" | "lost";
         /**
-         * @description Actions the task supports now, the same for every caller. cancel: the cancel route accepts a new command for this task; whether a caller may use it is an authorization check (403 on the cancel route). send_input: reserved for a later capability route. read_output: the task events route returns output events for this task to any caller that can read it. read_output does not change during the task's life, and a task without it produces no output events: its output goes only to Artifacts, so the events route never filters out events that exist.
+         * @description Actions the task supports now, the same for every caller. cancel: the cancel route accepts a new command for this task (since 1.40, child_agent tasks in pending, running, waiting or degraded, in an active Session); whether a caller may use it is an authorization check (403 on the cancel route). send_input: reserved for a later capability route. read_output: the task events route returns output events for this task to any caller that can read it. read_output does not change during the task's life, and a task without it produces no output events: its output goes only to Artifacts, so the events route never filters out events that exist.
          * @enum {string}
          */
         TaskActionCapability: "cancel" | "send_input" | "read_output";
@@ -983,6 +1001,14 @@ export interface components {
             /** @default 20 */
             limit?: number;
         };
+        WebShellTaskCancelRequest: {
+            /** @description Trace correlation only; excluded from the request digest, so a retry with another requestId still replays. A header-safe value (1 to 128 visible ASCII characters) is echoed as X-Request-Id; any other value is replaced by a server-chosen id. */
+            requestId?: string | null;
+            /** Format: uuid */
+            sessionId: string;
+            taskId: string;
+            idempotencyKey: string;
+        };
         /** @description state_changed, output or artifact. The set is open: a later minor version may add types and optional fields. Clients ignore unknown optional fields and unknown types, while still checkpointing event cursors; strict validation against an older minor response schema is not supported. Existing fields forbidden for a known type cannot be repurposed on that type. */
         TaskEventType: string;
         ToolResultPreview: {
@@ -1532,7 +1558,7 @@ export interface operations {
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            /** @description Responding requires the Session creator (action_forbidden). A Session with no recorded creator and no recorded create command (anonymous open-mode creation, or a Session created before the V40 migration that also has no Workspace creation record) answers to any caller in its tenant, matching its read ACL. The tenant filter's 403 actor_scope_mismatch also applies on this route. */
+            /** @description Responding requires the Session's recorded owner or a Workspace OPERATOR (action_forbidden). An unbound Session with no recorded creator and no recorded create command (anonymous open-mode creation, or an unbound Session created before the V40 migration that also has no Workspace creation record) answers to any caller in its tenant, matching its read ACL; a bound Session with no recorded owner answers through the create-command actor recorded for it, or through the Workspace role arm. The tenant filter's 403 actor_scope_mismatch also applies on this route. */
             403: components["responses"]["Forbidden"];
             /** @description Unknown or unreadable Session (session_not_found), or unknown Action (action_not_found). */
             404: components["responses"]["NotFound"];
@@ -1748,6 +1774,37 @@ export interface operations {
             413: components["responses"]["PayloadTooLarge"];
         };
     };
+    cancelWebShellTask: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellTaskCancelRequest"];
+            };
+        };
+        responses: {
+            /** @description Same authorized task cancellation semantics as the public API: key validation, current access, idempotent replay, then new-request capability, Session, task and storage-migration checks (409 workspace_unavailable under a migration fence). Replay returns the same operation and latest durable state. 202 is durable admission, completed is authority acceptance, and neither proves physical stop. Admission requires no other open operation on the Session (409 session_operation_active), as on the lifecycle routes. A requestId in the body becomes the response's X-Request-Id and stays out of the request digest. */
+            202: {
+                headers: {
+                    "X-Request-Id": components["headers"]["RequestId"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebShellCommandOperation"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+        };
+    };
     getWebShellToolResult: {
         parameters: {
             query?: never;

package/dist/types/components/managed/use-managed-actions.d.ts

@@ -12,11 +12,12 @@ export interface ManagedActionsState {
     /** Sending an answer failed; the approval is shown again. */
     answerError?: unknown;
     /**
-     * The service refused an answer as creator-only. That is a fact about the
-     * viewer and the Session, not about one Action, so it outlives the refused
-     * Action, covers every later approval the same Session raises, and survives
-     * leaving that Session and coming back. It is remembered per mount: a reload
-     * or reopening the panel starts clean.
+     * The service refused an answer under the owner-or-Workspace-operator
+     * rule. That refusal is a fact about the viewer's Workspace role row,
+     * which an operator can raise while the page stays open, so the latch
+     * covers every later approval the same Session raises and survives
+     * leaving that Session and coming back — but `retry()` drops it and
+     * re-probes instead of treating one 403 as permanent for the mount.
      */
     respondForbidden: boolean;
     respond(actionId: string, optionId: string): Promise<void>;

package/dist/types/components/sidebar/WebShellSidebar.d.ts

@@ -89,6 +89,12 @@ interface WebShellSidebarProps {
     onNewSession: (workspaceCwd?: string) => Promise<boolean> | boolean;
     onNewStandaloneSession?: () => Promise<boolean> | boolean;
     onLoadSession: (sessionId: string, workspaceCwd?: string) => Promise<void> | void;
+    /**
+     * Opens a session listed by a fan-out host group (#13727): the caller
+     * focuses that host in-app and loads the session there. When absent, the
+     * groups fall back to full navigation via `openHostedWorkspace`.
+     */
+    onOpenHostSession?: (origin: string, sessionId: string, workspaceCwd?: string) => void;
     onSelectCurrentSession?: () => void;
     onSessionRenameConfirmed?: (workspaceCwd: string | undefined, sessionId: string, displayName: string) => void;
     /**
@@ -156,4 +162,4 @@ interface WebShellSidebarProps {
     onLoadStandaloneSession?: (sessionId: string) => Promise<void> | void;
     onStandaloneNotice?: (message: string) => void;
 }
-export declare function WebShellSidebar({ collapsed, layout, activePage, containerWidth, onOpenHome, onCollapsedChange, onOpenSettings, onOpenAgents, onOpenPlugins, onOpenChannels, onOpenLive, onLiveVoiceSlotChange, onOpenManagedSessions, onOpenDaemonStatus, onOpenScheduledTasks, onOpenWorkflows, onOpenGoals, onOpenSessions, canOpenSessionsOverview, onOpenWorkspacesOverview, onOpenSplitView, canOpenSplitView, onNewSession, onNewStandaloneSession, onLoadSession, onSelectCurrentSession, onSessionRenameConfirmed, onSessionsDeleted, onError, theme, onThemeChange, mobileOpen, onMobileClose, selectedWorkspaceCwd, onSelectWorkspace, onOpenGitDiff, onOpenCommit, onOpenAddWorkspace, workspaces: providedWorkspaces, lockedWorkspaceCwd, lockedWorkspace: lockedWorkspaceOptions, branding, primaryNav: primaryNavOptions, showSessionSourceSwitch, showLive, hideProjectHeader, sessionActions: sessionActionsOptions, footer, workspaceOverview, onOpenWorkspaceManagement, onNewWorktreeSession, projectFeaturesEnabled, onLoadStandaloneSession, onStandaloneNotice, }: WebShellSidebarProps): import("react/jsx-runtime").JSX.Element;
+export declare function WebShellSidebar({ collapsed, layout, activePage, containerWidth, onOpenHome, onCollapsedChange, onOpenSettings, onOpenAgents, onOpenPlugins, onOpenChannels, onOpenLive, onLiveVoiceSlotChange, onOpenManagedSessions, onOpenDaemonStatus, onOpenScheduledTasks, onOpenWorkflows, onOpenGoals, onOpenSessions, canOpenSessionsOverview, onOpenWorkspacesOverview, onOpenSplitView, canOpenSplitView, onNewSession, onNewStandaloneSession, onLoadSession, onOpenHostSession, onSelectCurrentSession, onSessionRenameConfirmed, onSessionsDeleted, onError, theme, onThemeChange, mobileOpen, onMobileClose, selectedWorkspaceCwd, onSelectWorkspace, onOpenGitDiff, onOpenCommit, onOpenAddWorkspace, workspaces: providedWorkspaces, lockedWorkspaceCwd, lockedWorkspace: lockedWorkspaceOptions, branding, primaryNav: primaryNavOptions, showSessionSourceSwitch, showLive, hideProjectHeader, sessionActions: sessionActionsOptions, footer, workspaceOverview, onOpenWorkspaceManagement, onNewWorktreeSession, projectFeaturesEnabled, onLoadStandaloneSession, onStandaloneNotice, }: WebShellSidebarProps): import("react/jsx-runtime").JSX.Element;

package/dist/types/components/sidebar/WorkspaceSection.d.ts

@@ -10,6 +10,14 @@ export interface WorkspaceHeaderActionsContext {
 }
 interface WorkspaceSectionProps {
     workspace: DaemonWorkspaceCapability;
+    /**
+     * localStorage seed for the expansion/collapsed-group preferences,
+     * defaulting to the workspace id. Multi-host renderers pass an
+     * origin-prefixed id so two daemons hosting the same workspace id
+     * never share a preference; single-host callers leave it unset and
+     * keep the keys they always had.
+     */
+    storageKey?: string;
     remote?: boolean;
     renderHeader?: (expanded: boolean) => ReactNode;
     hideHeader?: boolean;
@@ -117,5 +125,5 @@ interface WorkspaceSectionProps {
     /** Commit entry for the same picker; the row still opens without it. */
     onOpenCommit?: (workspaceCwd: string) => void;
 }
-export declare function WorkspaceSection({ workspace, remote, renderHeader, hideHeader, client, reloadToken, untrustedLabel, readOnlyLabel, trustToOpenLabel, noSessionsLabel, loadErrorLabel, organizationEnabled, sessionCatalogRequestsEnabled, sessionGroupCatalog, sessionLiveStateEnabled, sourceType, channelGroupingEnabled, ungroupedLabel, searchQuery, expanded: controlledExpanded, autoExpandKey, forceAutoExpand, onExpandedChange, renderSessions, renderSession, pendingSession, mapSession, showSessionDetails, headerActions, overviewEnabled, overviewMenuOpen, overviewItems, gitBranchWanted, sessionStats, onRenameGroup, onDeleteGroup, renameGroupLabel, deleteGroupLabel, groupActionsDisabled, excludePinned, limitSessions, isPinnedSectionMember, onOpenPathLocally, onOpenTerminalLocally, onOpenGitDiff, onOpenCommit, }: WorkspaceSectionProps): import("react/jsx-runtime").JSX.Element;
+export declare function WorkspaceSection({ workspace, storageKey, remote, renderHeader, hideHeader, client, reloadToken, untrustedLabel, readOnlyLabel, trustToOpenLabel, noSessionsLabel, loadErrorLabel, organizationEnabled, sessionCatalogRequestsEnabled, sessionGroupCatalog, sessionLiveStateEnabled, sourceType, channelGroupingEnabled, ungroupedLabel, searchQuery, expanded: controlledExpanded, autoExpandKey, forceAutoExpand, onExpandedChange, renderSessions, renderSession, pendingSession, mapSession, showSessionDetails, headerActions, overviewEnabled, overviewMenuOpen, overviewItems, gitBranchWanted, sessionStats, onRenameGroup, onDeleteGroup, renameGroupLabel, deleteGroupLabel, groupActionsDisabled, excludePinned, limitSessions, isPinnedSectionMember, onOpenPathLocally, onOpenTerminalLocally, onOpenGitDiff, onOpenCommit, }: WorkspaceSectionProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/types/components/workspaces/HostLabel.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Icon + short name for one daemon host: the page origin reads as "Local",
+ * anything else shows its URL host. Shared by the sidebar host groups and
+ * the composer workspace picker so every surface names hosts identically.
+ */
+export declare function HostLabel({ origin }: {
+    origin: string;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/types/components/workspaces/WorkspaceHostProjects.d.ts

@@ -3,9 +3,16 @@
  * saved there is nothing to tell apart, so the plain list stays unlabeled.
  */
 export declare function WorkspaceHostHeading(): import("react/jsx-runtime").JSX.Element | null;
+export type OpenHostSessionHandler = (origin: string, sessionId: string, workspaceCwd?: string) => void;
 /**
- * Saved projects on the other hosts, grouped by host below the live list.
- * Only the connected host is live; choosing one of these reloads the page
- * against its host.
+ * Live projects on the other hosts, grouped by host among the focused one's
+ * rank (#13727): when `rankOf` is provided, every group carries its own
+ * flex order inside the sidebar's host container, so a focused switch keeps
+ * all groups in place. Each group polls its own daemon; a host that drops
+ * offline or rejects the saved credential keeps its last known projects
+ * with a muted status hint.
  */
-export declare function OtherHostProjects(): import("react/jsx-runtime").JSX.Element | null;
+export declare function OtherHostProjects({ onOpenHostSession, rankOf, }: {
+    onOpenHostSession?: OpenHostSessionHandler;
+    rankOf?: (origin: string) => number;
+}): import("react/jsx-runtime").JSX.Element | null;

package/dist/types/components/workspaces/WorkspaceLocation.d.ts

@@ -1,7 +1,10 @@
 /**
  * Compact label naming the host a chat runs on, with the working directory in
  * its tooltip. Hidden until a project can live on more than one host.
+ * `hostOrigin` names the ACTIVE session's host on multi-daemon pages; without
+ * it the page daemon (the behavior before fan-out) decides.
  */
-export declare function WorkspaceLocation({ cwd }: {
+export declare function WorkspaceLocation({ cwd, hostOrigin, }: {
     cwd?: string;
+    hostOrigin?: string;
 }): import("react/jsx-runtime").JSX.Element | null;

package/dist/types/config/daemon-target.d.ts

@@ -0,0 +1,76 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { ReactNode } from 'react';
+export interface FocusHostTarget {
+    origin: string;
+    /** Preselect this workspace on the new host (by id), or clear otherwise. */
+    workspaceId?: string;
+}
+/**
+ * One-shot intent carried across a focused-host switch: the remounted app
+ * performs it against the NEW host's provider (composer create on a picked
+ * workspace, or open an existing session). Kept here because this provider
+ * sits outside the interactive provider's remount boundary.
+ */
+export interface HostHandoff {
+    kind: 'create' | 'open';
+    /** The focused host this intent belongs to — stale intents are dropped. */
+    origin: string;
+    workspaceCwd?: string;
+    sessionId?: string;
+    /** Composer text to restore on the new host (attachments cannot carry). */
+    draftText?: string;
+}
+export interface DaemonTargetController {
+    /** The focused daemon origin (page origin when no `?daemon=` is active). */
+    activeOrigin: string;
+    /** Origins the current document may open network connections to. */
+    coveredOrigins: ReadonlySet<string>;
+    coversOrigin(origin: string): boolean;
+    /**
+     * Focus another CSP-covered host: remounts the interactive provider at the
+     * new origin and rewrites `?daemon=` (+ optional `?workspace=`) in place.
+     * Never navigates; throws on an uncovered origin — callers must route those
+     * through the navigation-based connect flow instead.
+     */
+    focusHost(target: FocusHostTarget): void;
+    /** Token for the focused host, refreshed when the focused origin (or any
+     * controller dependency) changes; a token edit alone does not re-key it. */
+    activeToken: string | undefined;
+    /**
+     * Focus another host and hand an intent to the remounted app. The app
+     * drains it via `takePendingHandoff` once the new provider is connected
+     * (create a session in that workspace / open that session there).
+     */
+    focusHostWithHandoff(target: FocusHostTarget, handoff: HostHandoff): void;
+    /** Pending intent from the latest focus switch; consumed exactly once. */
+    pendingHandoff: HostHandoff | undefined;
+    takePendingHandoff(): HostHandoff | undefined;
+}
+export declare function DaemonTargetProvider({ children, }: {
+    children: ReactNode;
+}): ReactNode;
+export declare function useDaemonTarget(): DaemonTargetController;
+/** Optional-context variant for components rendered both inside and outside
+ * the standalone tree (tests, embedded shells without the provider). */
+export declare function useDaemonTargetOptional(): DaemonTargetController | undefined;
+/**
+ * Intercept same-origin anchor clicks that point at another connected host
+ * (#13727): a transcript/session link with `?daemon=B` would otherwise
+ * hard-reload the document, losing all sidebar and composer state. When the
+ * target is inside the CSP-covered set the click becomes an in-app focus
+ * switch (open that session there); anything uncovered keeps the default
+ * navigation, which still re-serves the shell widened for the host.
+ */
+export declare function useInterceptHostLinks(): void;
+/**
+ * Keep the URL's `fanout` params equal to the saved-host set minus the
+ * focused daemon (which `?daemon=` already covers). Runs on mount, on host
+ * catalog changes, on focus switches, on cross-tab storage writes, and when
+ * the tab regains focus (settings flows that edited catalogs in place).
+ * `replaceState` only — the current document's CSP is unaffected.
+ */
+export declare function useFanoutUrlSync(): void;

package/dist/types/config/daemon.d.ts

@@ -1,4 +1,20 @@
 export declare function getDaemonBaseUrl(): string;
+/**
+ * Repeated `?fanout=` values validated into daemon origins. Fanout params
+ * name the hosts this page connects to simultaneously (multi-daemon view,
+ * #13727): the served CSP covers exactly the `daemon` + `fanout` set, so a
+ * focused-host switch inside that set never reloads the document. The page
+ * origin is dropped — `'self'` already covers it.
+ */
+export declare function getFanoutOrigins(): string[];
+/**
+ * Point the URL's `fanout` params at exactly `origins`, preserving every
+ * other param. `replaceState` only: this cannot widen the CURRENT document's
+ * CSP (the header is fixed at load) — it keeps the NEXT load in sync, so the
+ * host set stays covered without a reload. A newly-connected host therefore
+ * navigates once before it can be used; every switch after that is in-app.
+ */
+export declare function syncFanoutParams(origins: readonly string[]): void;
 /**
  * Whether host-local affordances are safe to offer here: true only when this
  * page was served from a loopback host AND the shell is not pointed at a

package/dist/types/config/host-fanout.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { DaemonClient } from '@qwen-code/sdk/daemon';
+import type { DaemonCapabilities } from '@qwen-code/sdk/daemon';
+export type HostConnectionStatus = 'connecting' | 'online' | 'offline' | 'unauthorized';
+/**
+ * Stable read-only client for `origin`. Recreated only when the stored
+ * per-origin token changed; a client whose daemon vanished stays online as an
+ * instance (its next request fails) and its entry is dropped when the host
+ * loses its last subscriber.
+ */
+export declare function getHostClient(origin: string): DaemonClient;
+export declare const HOST_FANOUT_POLL_MS = 30000;
+export interface HostCapabilitiesState {
+    workspaces: DaemonCapabilities['workspaces'];
+    status: HostConnectionStatus;
+    /** Bumps on every content-changed refresh so poll consumers resubscribe. */
+    generation: number;
+}
+/**
+ * Live `capabilities().workspaces` + connection status for one fan-out host.
+ * Shares the store's single poll round with every other consumer; the last
+ * successful payload survives later failures (status flips to
+ * offline/unauthorized but the rows keep rendering) and hosts are always
+ * polled with their own per-origin client.
+ */
+export declare function useHostCapabilities(origin: string): HostCapabilitiesState & {
+    refresh: () => void;
+};
+/**
+ * The single ordered host set both the sidebar fan-out and App composers
+ * render from: every saved workspace host and connected remote origin, minus
+ * the focused daemon (its own UI comes from the interactive provider), plus
+ * the page origin when focused remote — the "way back" group. Memoized on
+ * content so consumers can pass it straight into `useHostFanout`.
+ */
+export declare function useFanoutOrigins(): string[];
+/**
+ * Live connection state + a client for every `origins` entry, drawn from the
+ * shared per-origin store: subscribing here never adds a second poller — the
+ * composer picker and the sidebar groups observe the same rounds. Failed
+ * hosts keep their last-known snapshot; hosts that lose their last
+ * subscriber are dropped from the client pool.
+ */
+export declare function useHostFanout(origins: readonly string[]): {
+    clientsByOrigin: ReadonlyMap<string, DaemonClient>;
+    statusByOrigin: ReadonlyMap<string, HostConnectionStatus>;
+    workspacesByOrigin: ReadonlyMap<string, DaemonCapabilities['workspaces'] | undefined>;
+    refreshAll: () => void;
+};

package/dist/types/config/remote-connections.d.ts

@@ -1,7 +1,10 @@
+export declare const REMOTE_CONNECTIONS_CHANGE_EVENT = "qwen-remote-connections";
 export declare function formatOriginHost(origin: string): string;
 export declare function readRemoteConnections(): string[];
 export declare function rememberRemoteConnection(origin: string): void;
 export declare function forgetRemoteConnection(origin: string): string[];
+/** Saved connection origins, kept in sync with catalog updates. */
+export declare function useRemoteConnections(): string[];
 export declare function isRemoteConnectionKnown(origin: string): boolean;
 /**
  * Remote computers offered as a workspace location: the persisted catalog plus