@qwen-code/web-shell 0.25.1-preview.2 → 0.25.2-nightly.20261015.c24e99e9cb

package/dist/types/components/managed/generated/managed-agent-api.d.ts

@@ -57,7 +57,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description POST SSE consumed through fetch response.body. An afterSequence below the replay floor ends the stream with one agent.session.resync_required frame instead of a 409 only while the Snapshot backs the floor (replay_floor_sequence <= snapshot_through_sequence); a stream reconciliation discards the Snapshot without lowering the floor, and during that rebuild such a cursor is served from the retained events. On the resync frame, reload the transcript and resume after its lastSequence. */
+        /** @description POST SSE consumed through fetch response.body. An afterSequence strictly below the durable replay floor ends the stream with one agent.session.resync_required frame. Projection rebuilds preserve that floor and the current immutable Snapshot. On the resync frame, reload the transcript and resume after its lastSequence. */
         post: operations["webShellStreamEvents"];
         delete?: never;
         options?: never;
@@ -74,7 +74,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission and fixed server-owned profile with public Session creation. Any caller holding the OPERATOR role may submit later Turns and rename the Session under the same opt-in, while the Workspace registry row stays ACTIVE and still backs the binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is an active, undeleted qwen-code Session on the frozen execution profile; Workspace close follows its separate close capability and lifecycle admission; the same caller may cancel a running Turn (its delivery re-checks no grants); archive and unarchive follow their separate retention capabilities after reliable Workspace close; delete supports either L3 idle ACTIVE files Sessions or L2 CLOSED/ARCHIVED Sessions; controlled same-Workspace cwd changes ship through the durable cwd_change operations (v1.32). The per-caller workspaceTurns capability on this surface advertises the same submit/rename admission rule; it does not gate cancellation. Freeze selection with the original idempotency key; admission does not prove physical directory readiness. */
+        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission with public Session creation: the server-selected profile for the built-in qwen-code agent, and the profile selected by a stored definition's single allowlisted hosted_profile tools entry for a definition-pinned Session. Newly bound qwen-code Sessions, including empty creation, persist hosted-workspace-shell/1 with mandatory default/auto-edit approval when the Shell deployment opt-in is enabled; otherwise they persist hosted-workspace-files/1 with the configured file approval mode. The switch does not override a stored AgentDefinition's compiled profile or approval mode. Public callers cannot select the built-in profile. Any caller holding the OPERATOR role may submit later Turns and rename the Session under the same opt-in, while the Workspace registry row stays ACTIVE and still backs the binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is active and undeleted and is either a qwen-code Session on the frozen execution profile or pinned to a stored definition; Workspace close follows its separate close capability and lifecycle admission; the same caller may cancel a running Turn (its delivery re-checks no grant it needs survives the cancellation), and the Session's own liveness keeps OPERATOR access even when its Workspace's background-exit observation closes some other bound Session; cancel is always allowed for its own running Turn even outside the Workspace files opt-in. A definition-pinned Session keeps its pinned revision's tool profile, model and instructions for its whole life, and a replay of the create command reuses the original pin; a WebShell Session inherits its Workspace's default Workspace selection when the request omits one. Shell Sessions additionally require the Shell opt-in and valid persisted approval for fresh Turns; disabling only Shell admission preserves original-key replay and accepted approvals and cancellation while Workspace files remain enabled and persisted approval remains valid. The public Shell tool list does not include the child agent tool. Invalid approval or files-off can refuse attachment. Public Shell close, archive, unarchive and delete stay unavailable, including protocol-0. Fresh Shell sending also requires foregroundShell=true; workspaceTurns advertises submit/rename permission and is not sufficient Shell Turn admission. */
         post: operations["webShellCreateSession"];
         delete?: never;
         options?: never;
@@ -173,7 +173,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond; a Shell Session's Actions may be answered only by its recorded owner (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["queryWebShellActions"];
         delete?: never;
         options?: never;
@@ -190,7 +190,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond; a Shell Session's Actions may be answered only by its recorded owner (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["getWebShellAction"];
         delete?: never;
         options?: never;
@@ -207,7 +207,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
+        /** @description D6 serves Hosted permission Actions. Question Actions and vote_recorded remain planned. Reads follow Session authorization; the Session's recorded owner or any caller holding OPERATOR on the bound Workspace may respond; a Shell Session's Actions may be answered only by its recorded owner (an unbound Session with no recorded creator and no recorded create command answers to any caller in its tenant, matching its read ACL; a bound Session without an owner record answers through the create-command actor recorded for it, or through the Workspace role arm). Responses are durable operations, reconciled against the original journal decision. */
         post: operations["respondWebShellAction"];
         delete?: never;
         options?: never;
@@ -404,7 +404,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Synchronously restores an archived Session to closed. Workspace-bound Sessions require completed reliable-close evidence and the Session's recorded owner with current read access (404 unreadable, 403 readable non-owner). Bound keys are tenant/Session/actor scoped. Replay returns the current visible Session without repeating the mutation; a deleted Session returns 404. The permanent close fence is preserved and no Harness or Runtime call is made. */
+        /** @description Synchronously restores an archived Session to closed. Workspace-bound Sessions require completed reliable-close evidence and the Session's recorded owner with current read access (404 unreadable, 403 readable non-owner). Bound keys are tenant/Session/actor scoped. Replay returns the recorded outcome without repeating the mutation; a replay after delete answers with the Session as last visible — its pre-delete status — rather than 404. The permanent close fence is preserved and no Harness or Runtime call is made. */
         post: operations["unarchiveWebShellSession"];
         delete?: never;
         options?: never;
@@ -474,7 +474,9 @@ export interface components {
             agentId: string;
             /** @description Planned; phase one rejects non-blank values. */
             environmentId?: string | null;
+            /** @description The server enforces the bound in UTF-16 code units (Java String.length()), so an astral character counts as two: a title this schema's code-point maxLength accepts can still exceed the server's 256-unit bound and answer 400 invalid_title. */
             title?: string | null;
+            /** @description Each block adds to a 4,000,000-character aggregate admission budget per command (per-block 1,000,000-character cap applies). Admission ceiling only: a command whose serialized prompt or durable Session-store record exceeds the Hosted Harness's 64 KiB durable-record limit is accepted and then fails the Turn with hosted_harness_rejected. */
             input?: components["schemas"]["InputBlock"][];
             metadata?: components["schemas"]["WebShellMetadata"];
             workspace?: components["schemas"]["WebShellWorkspaceSelection"];
@@ -485,6 +487,7 @@ export interface components {
             idempotencyKey: string;
             /** Format: uuid */
             sessionId: string;
+            /** @description Each block adds to a 4,000,000-character aggregate admission budget per command (per-block 1,000,000-character cap applies). Admission ceiling only: a command whose serialized prompt or durable Session-store record exceeds the Hosted Harness's 64 KiB durable-record limit is accepted and then fails the Turn with hosted_harness_rejected. */
             input?: components["schemas"]["InputBlock"][];
             metadata?: components["schemas"]["WebShellMetadata"];
         };
@@ -496,8 +499,9 @@ export interface components {
             sessionId: string;
             turnId: string;
         };
+        /** @description Arbitrary caller metadata, as a JSON object (or null). Accepted and ignored in Phase 1: nothing from it is persisted. On WebShellCreateRequest the Session title travels in that request's own `title` field; WebShellSubmitRequest has no title surface. Any keys are valid. */
         WebShellMetadata: {
-            clientId?: string;
+            [key: string]: unknown;
         } | null;
         /** @description With durable_operations enabled, all three target fields are returned. accepted means Java durable delivery responsibility, not model execution. Missing fields retain the deployed legacy response semantics. */
         WebShellAdmission: {
@@ -517,9 +521,6 @@ export interface components {
             /** Format: int64 */
             completedAt?: number | null;
             errorCode?: string | null;
-            usage?: {
-                [key: string]: unknown;
-            } | null;
         };
         WebShellSession: {
             /** Format: uuid */
@@ -541,10 +542,15 @@ export interface components {
             capabilities: components["schemas"]["WebShellSessionCapabilities"];
         };
         WebShellSessionCapabilities: {
+            /**
+             * @description True when Workspace files are enabled, the bound Session is active and undeleted, the caller holds OPERATOR or above on the Workspace and the exact ACTIVE Registry generation/storage and create-command-actor OPERATOR/OWNER grant still hold, matching cwd admission. This does not promise an idle Session and is independent of workspaceTurns execution-profile gates. Missing means false. Existing operations remain queryable under read authorization even when this capability is false.
+             * @default false
+             */
+            cwdChange?: boolean;
             /** @default false */
             actions: boolean;
             /**
-             * @description True when the caller may submit later Turns of this Workspace-bound Session or rename it: the deployment enables Workspace files, the caller holds the OPERATOR role on a Workspace registry row whose state is ACTIVE and still backs the Session's binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is an active qwen-code Session on the frozen execution profile. Cancelling only aborts work already running, so an OPERATOR caller may cancel a running Turn even when this is false; the capability does not gate cancellation. False for every other caller and for unbound Sessions, which do not use it.
+             * @description True when the caller may submit later Turns of this Workspace-bound Session or rename it: the deployment enables Workspace files, the caller holds the OPERATOR role on a Workspace registry row whose state is ACTIVE and still backs the Session's binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is active and undeleted and is either a qwen-code Session or a Session pinned to a stored definition (both on the Workspace's frozen execution profile). Cancelling only aborts work already running, so an OPERATOR caller may cancel a running Turn even when this is false; the capability does not gate cancellation. False for every other caller and for unbound Sessions, which do not use it. Shell Sessions also require foregroundShell=true for fresh sending; workspaceTurns may remain true with Shell admission disabled and is not sufficient Shell Turn admission.
              * @default false
              */
             workspaceTurns: boolean;
@@ -570,6 +576,8 @@ export interface components {
              * @default false
              */
             sessionDelete?: boolean;
+            /** @description Present only for persisted Shell Sessions, with no schema default; files and unbound Sessions omit it. True when Workspace files, Shell deployment admission and persisted default/auto-edit approval are valid. False prevents fresh sending. Disabling only the Shell flag preserves accepted cancellation and approval while Workspace files remain enabled and persisted approval remains valid; files-off or invalid approval can refuse attachment. This capability does not override authorization or recovery refusals. */
+            foregroundShell?: boolean;
         };
         WebShellSessionPage: {
             data: components["schemas"]["WebShellSession"][];
@@ -662,6 +670,8 @@ export interface components {
                 replay_floor_sequence?: number | null;
                 /** Format: int64 */
                 snapshot_through_sequence?: number | null;
+                /** @description Names the definition field that cannot take effect on 409 agent_definition_unsupported; other errors may omit this field. */
+                field?: string;
             };
         };
         /**
@@ -703,7 +713,7 @@ export interface components {
                  * @default false
                  */
                 workspaceContext: boolean;
-                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Read/Write/Edit Turn at creation; callers holding the OPERATOR role may submit later Turns or rename under the same opt-in while the registry row stays ACTIVE and still backs the Session's binding and the actor recorded by the Workspace create command keeps OPERATOR or above, and may cancel a running Turn (its delivery re-checks no grants), while close follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
+                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Turn at creation: Read/Write/Edit under hosted-workspace-files/1, or file tools plus mandatory-approval foreground Shell under hosted-workspace-shell/1 when the Shell opt-in is enabled. The public Shell tool list does not include the child agent tool. Callers holding the OPERATOR role may submit later Turns or rename under the same opt-in while the registry row stays ACTIVE and still backs the Session's binding and the actor recorded by the Workspace create command keeps OPERATOR or above, and may cancel a running Turn (its delivery re-checks no grants). Shell fresh sending also requires foregroundShell=true. Public Shell close, archive, unarchive and delete stay unavailable, including protocol-0, while close of other profiles follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
                 workspaceBinding: boolean;
             };
             /** @description Same authorized explicit default as default_workspace, including when outside this page; null if absent or not creatable. A non-null default is active and has canCreateSession=true. */
@@ -912,7 +922,7 @@ export interface components {
          */
         TaskRuntimeState: "unbound" | "provisioning" | "ready" | "draining" | "lost";
         /**
-         * @description Actions the task supports now, the same for every caller. cancel: the cancel route accepts a new command for this task (since 1.40, child_agent tasks in pending, running, waiting or degraded, in an active Session); whether a caller may use it is an authorization check (403 on the cancel route). send_input: reserved for a later capability route. read_output: the task events route returns output events for this task to any caller that can read it. read_output does not change during the task's life, and a task without it produces no output events: its output goes only to Artifacts, so the events route never filters out events that exist.
+         * @description Actions the task supports now, the same for every caller. cancel: the cancel route accepts a new command for this task (since 1.40 for child_agent and 1.46 for workflow, tasks of those kinds in pending, running, waiting or degraded, in an active Session); whether a caller may use it is an authorization check (403 on the cancel route). send_input: reserved for a later capability route. read_output: the task events route returns output events for this task to any caller that can read it. read_output does not change during the task's life, and a task without it produces no output events: its output goes only to Artifacts, so the events route never filters out events that exist.
          * @enum {string}
          */
         TaskActionCapability: "cancel" | "send_input" | "read_output";
@@ -1165,7 +1175,7 @@ export interface components {
     parameters: never;
     requestBodies: never;
     headers: {
-        /** @description True when an accepted command or operation was replayed for the same idempotency key and digest without repeating its mutation. Session mutation responses represent the current visible Session; operation responses represent the original operation at its current state. */
+        /** @description True when an accepted command or operation was replayed for the same idempotency key and digest without repeating its mutation. Session mutation responses represent the recorded outcome on the Session as last visible — a rename or unarchive replay after delete answers with the Session's pre-delete status rather than 404, while a create replay after delete answers 404 on the public create route, which re-reads the Session before responding, and answers the recorded 202 admission carrying the tombstoned sessionId on the WebShell create route, which does not re-read it; operation responses represent the original operation at its current state. */
         IdempotentReplay: boolean;
         /** @description Trace-only correlation identifier; never an idempotency key. */
         RequestId: string;
@@ -1558,7 +1568,7 @@ export interface operations {
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            /** @description Responding requires the Session's recorded owner or a Workspace OPERATOR (action_forbidden). An unbound Session with no recorded creator and no recorded create command (anonymous open-mode creation, or an unbound Session created before the V40 migration that also has no Workspace creation record) answers to any caller in its tenant, matching its read ACL; a bound Session with no recorded owner answers through the create-command actor recorded for it, or through the Workspace role arm. The tenant filter's 403 actor_scope_mismatch also applies on this route. */
+            /** @description Responding requires the Session's recorded owner or a Workspace OPERATOR (action_forbidden); a Shell Session's Actions may be answered only by its recorded owner. An unbound Session with no recorded creator and no recorded create command (anonymous open-mode creation, or an unbound Session created before the V40 migration that also has no Workspace creation record) answers to any caller in its tenant, matching its read ACL; a bound Session with no recorded owner answers through the create-command actor recorded for it, or through the Workspace role arm. The tenant filter's 403 actor_scope_mismatch also applies on this route. */
             403: components["responses"]["Forbidden"];
             /** @description Unknown or unreadable Session (session_not_found), or unknown Action (action_not_found). */
             404: components["responses"]["NotFound"];

package/dist/types/components/managed/java-managed-agent-client.d.ts

@@ -57,9 +57,47 @@ export declare class JavaManagedAgentClient {
     submitTurn(request: Schemas['WebShellSubmitRequest'], signal?: AbortSignal): Promise<JavaAgentCommandAdmission>;
     cancelTurn(request: Schemas['WebShellCancelRequest'], signal?: AbortSignal): Promise<JavaAgentCommandAdmission>;
     queryActions(request: Schemas['WebShellActionQueryRequest'], signal?: AbortSignal): Promise<JavaAgentActionPage>;
+    listTasks(request: Schemas['WebShellTaskQueryRequest'], signal?: AbortSignal): Promise<{
+        data: components["schemas"]["WebShellTask"][];
+        hasMore: boolean;
+        nextCursor?: string | null;
+    }>;
+    getTask(request: Schemas['WebShellTaskGetRequest'], signal?: AbortSignal): Promise<{
+        taskId: string;
+        sessionId: string;
+        kind: components["schemas"]["TaskKind"];
+        state: components["schemas"]["TaskState"];
+        definitionRevision?: number;
+        runtimeState?: components["schemas"]["TaskRuntimeState"];
+        createdAt: number;
+        startedAt?: number;
+        settledAt?: number;
+        outputCursor?: string;
+        artifactRefs: string[];
+        actionCapabilities: components["schemas"]["TaskActionCapability"][];
+    }>;
+    listTaskEvents(request: Schemas['WebShellTaskEventQueryRequest'], signal?: AbortSignal): Promise<{
+        data: components["schemas"]["WebShellTaskEvent"][];
+        hasMore: boolean;
+        nextCursor: string;
+    }>;
+    cancelTask(request: Schemas['WebShellTaskCancelRequest'], signal?: AbortSignal): Promise<{
+        operationId: string;
+        sessionId: string;
+        type: "create_session" | "submit_input" | "cancel" | "action_response" | "close" | "archive" | "delete" | "task_cancel";
+        taskId?: string;
+        status: "pending" | "running" | "completed" | "failed" | "cancelled" | "recovery_blocked";
+        admissionStage: "java_durable" | "harness_confirmed";
+        deliveryState: "pending" | "leased" | "confirmed" | "blocked";
+        receiptId?: string;
+        actionResolution?: components["schemas"]["WebShellActionResolution"];
+        failureCode?: string;
+        replayed: boolean;
+    }>;
     respondAction(request: Schemas['WebShellActionRespondRequest'], signal?: AbortSignal): Promise<Schemas['WebShellCommandOperation']>;
     /** Reads an operation's latest durable status; polling is not a replay. */
     queryOperation(request: Schemas['WebShellOperationRequest'], signal?: AbortSignal): Promise<Schemas['WebShellOperation']>;
+    changeCwd(request: Schemas['WebShellChangeCwdRequest'], signal?: AbortSignal): Promise<Schemas['WebShellCwdOperation']>;
     getToolResult(sessionId: string, itemId: string, signal?: AbortSignal): Promise<{
         result: components["schemas"]["PublicToolResult"];
         access: components["schemas"]["ArtifactAccess"];
@@ -80,7 +118,7 @@ export declare class JavaManagedAgentClient {
     readArtifactRange(artifact: ManagedArtifact, offset: number, length: number, signal?: AbortSignal): Promise<Uint8Array>;
     openArtifactStream(artifact: ManagedArtifact, signal?: AbortSignal): Promise<ReadableStream<Uint8Array>>;
     private artifactContent;
-    streamEvents(request: Schemas['WebShellStreamRequest'], signal?: AbortSignal, onOpen?: () => void): AsyncGenerator<JavaAgentEvent | JavaAgentResyncRequired>;
+    streamEvents(request: Schemas['WebShellStreamRequest'], signal?: AbortSignal, onOpen?: () => void, onAlive?: () => void): AsyncGenerator<JavaAgentEvent | JavaAgentResyncRequired>;
     private post;
     private request;
 }

package/dist/types/components/managed/java-managed-agent-provider.d.ts

@@ -7,6 +7,10 @@ export interface JavaManagedAgentProviderOptions extends JavaManagedAgentClientO
     /** Include tenant and actor identity; replace this scope/provider when either changes. Token refresh alone can use getHeaders. */
     productScope?: string;
     enableWorkspaceBinding?: boolean;
+    modelPresets?: readonly {
+        agentId: string;
+        label: string;
+    }[];
     /** Acquire a streaming save target during the user gesture, then call openStream. */
     saveArtifact?: ManagedArtifactSave;
 }

package/dist/types/components/managed/managed-agent-provider.d.ts

@@ -4,12 +4,15 @@ export type ManagedAgentSessionPhase = 'created' | 'admitted' | 'runtime_startin
 export type ManagedAgentRuntimeState = 'unknown' | 'starting' | 'ready' | 'failed';
 export interface ManagedAgentSessionSummary {
     sessionId: string;
+    agentId?: string;
     activeTurnId?: string;
     title: string;
     workspaceCwd?: string;
     workspace?: {
         workspaceId: string;
         cwdRelative: string;
+        contextRevision?: number;
+        state?: 'ready' | 'changing' | 'recovery_blocked';
     };
     createdAt: number;
     admittedAt: number;
@@ -21,16 +24,18 @@ export interface ManagedAgentSessionSummary {
         canSend: boolean;
         canCancel: boolean;
         actions?: boolean;
+        tasks?: boolean;
         artifacts?: boolean;
         /** The caller may submit later Turns to this Workspace-bound Session. */
         workspaceTurns?: boolean;
+        cwdChange?: boolean;
     };
     failure?: {
         code: string;
         message: string;
     };
 }
-export type ManagedAgentSessionEventType = 'accepted' | 'runtime_starting' | 'runtime_ready' | 'runtime_failed' | 'runtime_released' | 'agent_started' | 'assistant_thought' | 'assistant_delta' | 'tool_requested' | 'tool_started' | 'tool_completed' | 'tool_result_updated' | 'completed' | 'failed' | 'cancelling' | 'cancelled' | 'action_updated' | 'stream_gap';
+export type ManagedAgentSessionEventType = 'accepted' | 'runtime_starting' | 'runtime_ready' | 'runtime_failed' | 'runtime_released' | 'agent_started' | 'assistant_thought' | 'assistant_delta' | 'tool_requested' | 'tool_started' | 'tool_completed' | 'tool_result_updated' | 'completed' | 'failed' | 'cancelling' | 'cancelled' | 'action_updated' | 'context_changed' | 'stream_gap';
 export interface ManagedAgentSessionEvent {
     id: number;
     at: number;
@@ -61,6 +66,14 @@ export interface ManagedAgentRequestOptions {
 export interface ManagedAgentCommandOptions extends ManagedAgentRequestOptions {
     idempotencyKey: string;
 }
+export type ManagedCwdOperation = components['schemas']['WebShellCwdOperation'];
+export type ManagedTask = components['schemas']['WebShellTask'];
+export type ManagedTaskPage = components['schemas']['WebShellTaskPage'];
+export type ManagedTaskEvent = components['schemas']['WebShellTaskEvent'];
+export type ManagedTaskEventPage = components['schemas']['WebShellTaskEventPage'];
+export type ManagedTaskCancelOperation = components['schemas']['WebShellCommandOperation'] & {
+    type: 'task_cancel';
+};
 /** A Hosted tool approval waiting for the Session owner's answer. */
 export interface ManagedAgentPendingAction {
     actionId: string;
@@ -89,8 +102,35 @@ export interface ManagedAgentProvider {
         respond(action: ManagedAgentPendingAction, optionId: string, options: ManagedAgentCommandOptions): Promise<void>;
     };
     readonly toolResults?: ManagedToolResultReader;
+    readonly tasks?: {
+        list(sessionId: string, options: ManagedAgentRequestOptions & {
+            cursor?: string;
+            limit?: number;
+        }): Promise<ManagedTaskPage>;
+        get(sessionId: string, taskId: string, options: ManagedAgentRequestOptions): Promise<ManagedTask>;
+        listEvents(sessionId: string, taskId: string, options: ManagedAgentRequestOptions & {
+            after?: string;
+            limit?: number;
+        }): Promise<ManagedTaskEventPage>;
+        readonly cancel?: {
+            submit(sessionId: string, taskId: string, options: ManagedAgentCommandOptions): Promise<ManagedTaskCancelOperation>;
+            query(sessionId: string, taskId: string, operationId: string, options: ManagedAgentRequestOptions): Promise<ManagedTaskCancelOperation>;
+        };
+    };
+    readonly cwdChange?: {
+        submit(sessionId: string, request: {
+            cwdRelative: string;
+            expectedContextRevision: number;
+        }, options: ManagedAgentCommandOptions): Promise<ManagedCwdOperation>;
+        query(sessionId: string, operationId: string, options: ManagedAgentRequestOptions): Promise<ManagedCwdOperation>;
+    };
     readonly workspaceBinding?: {
         readonly agentId: string;
+        /** Host-published model-specific AgentDefinitions available for new Sessions. */
+        readonly modelPresets?: readonly {
+            agentId: string;
+            label: string;
+        }[];
         list(options: ManagedAgentRequestOptions & {
             cursor?: string;
             limit?: number;
@@ -108,6 +148,14 @@ export interface ManagedAgentProvider {
         }, options: ManagedAgentCommandOptions): Promise<{
             sessionId: string;
         }>;
+        createSession?(request: {
+            agentId: string;
+            workspaceId: string;
+            cwdRelative: string;
+            text: string;
+        }, options: ManagedAgentCommandOptions): Promise<{
+            sessionId: string;
+        }>;
     };
     listSessions(options: ManagedAgentRequestOptions & {
         workspaceCwd?: string;
@@ -139,6 +187,12 @@ export interface ManagedAgentProvider {
          * depend on stream activity.
          */
         onEstablished?(): void;
+        /**
+         * Called for each complete heartbeat or comment frame the stream
+         * delivers. Heartbeats never decode into events, so on an idle
+         * Session this is the only sign of life an established stream gives.
+         */
+        onAlive?(): void;
     }): AsyncIterable<ManagedAgentSessionEvent>;
 }
 export interface ManagedAgentWorkspace {

package/dist/types/components/managed/managed-development-options.d.ts

@@ -0,0 +1,7 @@
+import type { JavaManagedAgentProviderOptions } from './java-managed-agent-provider';
+/** Local Vite configuration; the production host supplies these provider options directly. */
+export declare function managedDevelopmentOptions(params: URLSearchParams, env: {
+    VITE_MANAGED_AGENT_ACTOR_ID?: string;
+    VITE_MANAGED_AGENT_MODEL_PRESETS?: string;
+    VITE_MANAGED_AGENT_WORKSPACE_BINDING?: string;
+}): Pick<JavaManagedAgentProviderOptions, 'productScope' | 'getHeaders' | 'enableWorkspaceBinding' | 'modelPresets'>;

package/dist/types/components/managed/managed-request-error.d.ts

@@ -12,3 +12,9 @@
  * are worth another attempt.
  */
 export declare function isNonRetryableClientError(error: unknown): boolean;
+/**
+ * A 401/403. This client re-derives its credentials on every request, so an
+ * expired short-lived token gets a fresh answer on the very next attempt
+ * once the host refreshes — never a terminal condition.
+ */
+export declare function isAuthFailure(error: unknown): boolean;

package/dist/types/components/managed/managed-task-messages.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+type ManagedTaskMessage = string | ((vars?: Record<string, string | number>) => string);
+export declare const MANAGED_TASK_MESSAGES_EN: Record<string, ManagedTaskMessage>;
+export declare const MANAGED_TASK_MESSAGES_ZH: Record<string, ManagedTaskMessage>;
+export {};

package/dist/types/components/managed/managed-task-messages.transcript-stub.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare const MANAGED_TASK_MESSAGES_EN: {};
+export declare const MANAGED_TASK_MESSAGES_ZH: {};

package/dist/types/components/managed/managed-task.test-fixtures.d.ts

@@ -0,0 +1,4 @@
+import type { ManagedTask, ManagedTaskCancelOperation, ManagedTaskEvent } from './managed-agent-provider';
+export declare const task: ManagedTask;
+export declare const taskOperation: ManagedTaskCancelOperation;
+export declare function taskEvent(cursor: string, type?: string): ManagedTaskEvent;

package/dist/types/components/managed/use-managed-cwd-change.d.ts

@@ -0,0 +1,21 @@
+import type { ManagedAgentProvider, ManagedAgentSessionSummary } from './managed-agent-provider';
+interface CwdIntent {
+    sessionId: string;
+    workspaceId: string;
+    cwdRelative: string;
+    expectedContextRevision: number;
+    idempotencyKey: string;
+    operationId?: string;
+}
+export declare function useManagedCwdChange(provider: ManagedAgentProvider, clientId: string, sessionId: string | undefined, summary: ManagedAgentSessionSummary | undefined, refreshSummary: (signal?: AbortSignal) => Promise<ManagedAgentSessionSummary | undefined>): {
+    blocked: boolean;
+    submit: (cwdRelative: string, expectedContextRevision: number) => Promise<true | undefined>;
+    confirm: () => Promise<void>;
+    isBlocked: () => boolean;
+    key: string;
+    pending?: CwdIntent;
+    busy: boolean;
+    errorCode?: string;
+    target?: string;
+};
+export {};

package/dist/types/components/managed/use-managed-session.d.ts

@@ -1,12 +1,26 @@
 import type { ManagedAgentProvider, ManagedAgentSessionEvent, ManagedAgentSessionSummary } from './managed-agent-provider';
+type SignalLeg = 'session' | 'transcript' | 'stream';
+interface SignalEntry {
+    readonly message: string;
+    readonly final: boolean;
+    readonly seq: number;
+    readonly leg: SignalLeg;
+    readonly stall?: boolean;
+}
+export declare function failureRetryDelayMs(failures: number): number;
 export declare function useManagedSession(provider: ManagedAgentProvider, clientId: string, sessionId: string | undefined): {
+    stoppedReason: string | undefined;
+    stoppedLeg: SignalLeg | undefined;
+    error: string | undefined;
     loadingOlder: boolean;
     loadOlder: () => Promise<void>;
     reload: () => void;
+    refreshSummary: (signal?: AbortSignal) => Promise<ManagedAgentSessionSummary | undefined>;
     sessionId?: string;
     summary?: ManagedAgentSessionSummary;
     events: ManagedAgentSessionEvent[];
     olderCursor?: string;
     loading: boolean;
-    error?: string;
+    signals?: Partial<Record<SignalLeg, SignalEntry>>;
 };
+export {};

package/dist/types/components/managed/use-managed-task-cancel.d.ts

@@ -0,0 +1,12 @@
+import type { ManagedAgentProvider, ManagedTask } from './managed-agent-provider';
+export interface ManagedTaskCancelState {
+    status: 'submitting' | 'stopping' | 'unconfirmed' | 'failed';
+    busy: boolean;
+    code?: string;
+}
+export declare function useManagedTaskCancel(provider: ManagedAgentProvider, clientId: string, sessionId: string | undefined, snapshots: readonly ManagedTask[], refreshTasks: () => void, applySnapshot: (task: ManagedTask) => void): {
+    states: Record<string, ManagedTaskCancelState>;
+    pendingTaskIds: string[];
+    submit(task: ManagedTask): Promise<void>;
+    resume(taskId: string): Promise<void>;
+};

package/dist/types/components/managed/use-managed-tasks.d.ts

@@ -0,0 +1,49 @@
+import type { ManagedAgentProvider, ManagedTask } from './managed-agent-provider';
+export declare function isManagedTaskTerminal(task: ManagedTask): boolean;
+export declare function useManagedTasks(provider: ManagedAgentProvider, clientId: string, sessionId: string | undefined, open: boolean): {
+    page: {
+        data: import("./generated/managed-agent-api").components["schemas"]["WebShellTask"][];
+        hasMore: boolean;
+        nextCursor?: string | null;
+    };
+    task: {
+        taskId: string;
+        sessionId: string;
+        kind: import("./generated/managed-agent-api").components["schemas"]["TaskKind"];
+        state: import("./generated/managed-agent-api").components["schemas"]["TaskState"];
+        definitionRevision?: number;
+        runtimeState?: import("./generated/managed-agent-api").components["schemas"]["TaskRuntimeState"];
+        createdAt: number;
+        startedAt?: number;
+        settledAt?: number;
+        outputCursor?: string;
+        artifactRefs: string[];
+        actionCapabilities: import("./generated/managed-agent-api").components["schemas"]["TaskActionCapability"][];
+    } | undefined;
+    selectedId: string | undefined;
+    events: {
+        schemaVersion: number;
+        projectionVersion: number;
+        taskId: string;
+        sessionId: string;
+        type: import("./generated/managed-agent-api").components["schemas"]["TaskEventType"];
+        cursor: string;
+        createdAt: number;
+        state?: import("./generated/managed-agent-api").components["schemas"]["TaskState"];
+        runtimeState?: import("./generated/managed-agent-api").components["schemas"]["TaskRuntimeState"];
+        text?: string;
+        truncated?: boolean;
+        artifactId?: string;
+    }[];
+    moreEvents: boolean;
+    historyGap: boolean;
+    loading: boolean;
+    error: unknown;
+    hasPrevious: boolean;
+    refresh: () => void;
+    apply: (task: ManagedTask) => void;
+    select: (taskId?: string) => void;
+    next: () => void;
+    previous: () => void;
+    loadMoreEvents: () => void;
+};

package/dist/types/components/messages/BrowserNotificationControl.d.ts

@@ -0,0 +1 @@
+export declare function BrowserNotificationControl(): import("react/jsx-runtime").JSX.Element | null;

package/dist/types/components/messages/SelectionCopyMenu.d.ts

@@ -0,0 +1,8 @@
+import { type ReactNode } from 'react';
+export interface SelectionCopyMenuProps {
+    children: ReactNode;
+    className: string;
+    content: string;
+    enabled: boolean;
+}
+export declare function SelectionCopyMenu({ children, className, content, enabled, }: SelectionCopyMenuProps): import("react/jsx-runtime").JSX.Element;

package/dist/types/components/messages/SelectionCopyMenu.transcript-stub.d.ts

@@ -0,0 +1,2 @@
+import type { SelectionCopyMenuProps } from './SelectionCopyMenu';
+export declare function SelectionCopyMenu({ children, className, }: SelectionCopyMenuProps): import("react/jsx-runtime").JSX.Element;

package/dist/types/components/messages/TasksStatusMessage.d.ts

@@ -1,6 +1,7 @@
 import type { DaemonSessionMonitorTaskStatus, DaemonSessionShellTaskStatus, DaemonSessionWorkflowTasksStatus } from '@qwen-code/sdk/daemon';
 import { type DaemonSessionActions } from '@qwen-code/web-shell/daemon-react-sdk';
 import type { ACPToolCall, TodoItem } from '../../adapters/types';
+import type { OpenSubagentDetails } from '../../subagentDetailsContext';
 declare const ACTIVE_EVENT = "web-shell:tasks-panel-active";
 type DaemonSessionTasksStatus = DaemonSessionWorkflowTasksStatus;
 export interface SerializedTasksMessage {
@@ -24,7 +25,7 @@ export declare function TasksStatusMessage({ message, embedded, manageActiveEven
     onClose?: () => void;
     planTodos?: readonly TodoItem[];
     agentTools?: readonly ACPToolCall[];
-    onOpenSubagent?: (tool: ACPToolCall) => void;
+    onOpenSubagent?: OpenSubagentDetails;
     onOpenMonitor?: (task: DaemonSessionMonitorTaskStatus) => void;
 }): import("react/jsx-runtime").JSX.Element | null;
 export declare function MonitorTaskDetail({ task, actions: providedActions, }: {

package/dist/types/components/messages/ToolApproval.d.ts

@@ -5,6 +5,7 @@ interface ToolApprovalProps {
     onConfirm: (id: string, selectedOption: string) => void | Promise<void>;
     variant?: 'inline' | 'floating';
     disabled?: boolean;
+    showBrowserNotifications?: boolean;
     /**
      * Whether this approval should pull keyboard focus to its safe-default option
      * when it becomes the topmost (visible) one — on appearance, or when a panel/
@@ -32,5 +33,5 @@ export declare function parseTitle(title?: string): {
     toolName: string;
     description: string;
 };
-export declare function ToolApproval({ request, onConfirm, variant, disabled, keyboardActive, extraDescriptionId, planTodos, planExecutionMode, generateContent, }: ToolApprovalProps): import("react/jsx-runtime").JSX.Element;
+export declare function ToolApproval({ request, onConfirm, variant, disabled, showBrowserNotifications, keyboardActive, extraDescriptionId, planTodos, planExecutionMode, generateContent, }: ToolApprovalProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/types/components/messages/WorkflowExecutionView.d.ts

@@ -1,5 +1,6 @@
 import { type ReactNode } from 'react';
 import type { DaemonSessionWorkflowTaskStatus, DaemonWorkflowDispatchStatus, DaemonWorkflowDispatchStatusEntry } from '@qwen-code/sdk/daemon';
+import type { OpenSubagentDetails } from '../../subagentDetailsContext';
 export declare const WORKFLOW_GRAPH_RENDER_LIMITS: {
     readonly lanes: 64;
     readonly nodes: 240;
@@ -36,7 +37,7 @@ export interface WorkflowGraphLayout {
 export declare function buildWorkflowGraphLayout(task: DaemonSessionWorkflowTaskStatus, options?: {
     laneWidth?: number;
 }): WorkflowGraphLayout;
-export declare function WorkflowExecutionView({ task, sourceTask, historyTasks, historyActionBusy, onDeleteHistory, actions, }: {
+export declare function WorkflowExecutionView({ task, sourceTask, historyTasks, historyActionBusy, onDeleteHistory, actions, onOpenSubagent, }: {
     task: DaemonSessionWorkflowTaskStatus;
     sourceTask?: DaemonSessionWorkflowTaskStatus;
     historyTasks?: readonly DaemonSessionWorkflowTaskStatus[];
@@ -44,5 +45,6 @@ export declare function WorkflowExecutionView({ task, sourceTask, historyTasks,
     onDeleteHistory?: (runId: string) => void;
     /** Run controls (pause / stop / rerun …) shown at the end of the metrics strip. */
     actions?: ReactNode;
+    onOpenSubagent?: OpenSubagentDetails;
 }): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/types/components/messages/toolFormatting.d.ts

@@ -1,5 +1,6 @@
-import type { ACPToolCall } from '../../adapters/types';
-export { isActiveToolStatus } from '../../adapters/toolClassification';
+import type { ACPToolCall } from '../../adapters/types.js';
+export { isAskUserQuestionToolName } from '../../constants/toolNames.js';
+export { isActiveToolStatus } from '../../adapters/toolClassification.js';
 /**
  * Internal-tool-name → display-name lookup. This is a standalone copy of
  * core's `ToolDisplayNames` (mapped to wire names, as the CLI's shared
@@ -19,7 +20,6 @@ export declare function formatToolDisplayName(toolName: string): string;
  * English {@link formatToolDisplayName}. Pass the `t` from `useI18n()`.
  */
 export declare function localizeToolDisplayName(toolName: string, t: (key: string, vars?: Record<string, string | number>) => string): string;
-export declare function isAskUserQuestionToolName(toolName: string): boolean;
 export declare function isAdvisorToolName(toolName: string): boolean;
 export declare function isCompletedAskUserQuestion(tool: ACPToolCall): boolean;
 export declare function getQuestionAnswerResult(tool: ACPToolCall): {

package/dist/types/components/messages/workflow-agent-details.d.ts

@@ -0,0 +1,3 @@
+import type { DaemonSessionWorkflowTaskStatus, DaemonWorkflowDispatchStatusEntry } from '@qwen-code/sdk/daemon';
+import { type OpenSubagentDetails } from '../../subagentDetailsContext';
+export declare function useWorkflowAgentDetails(task: DaemonSessionWorkflowTaskStatus, onOpenSubagent?: OpenSubagentDetails): (dispatch: DaemonWorkflowDispatchStatusEntry) => void;