@qwen-code/web-shell 0.26.0 → 0.26.1

package/dist/types/components/managed/generated/managed-agent-api.d.ts

@@ -91,7 +91,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission with public Session creation: the server-selected profile for the built-in qwen-code agent, and the profile selected by a stored definition's single allowlisted hosted_profile tools entry for a definition-pinned Session. Newly bound qwen-code Sessions, including empty creation, persist hosted-workspace-shell/1 with mandatory default/auto-edit approval when the Shell deployment opt-in is enabled; otherwise they persist hosted-workspace-files/1 with the configured file approval mode. The switch does not override a stored AgentDefinition's compiled profile or approval mode. Public callers cannot select the built-in profile. Any caller holding the OPERATOR role may submit later Turns and rename the Session under the same opt-in, while the Workspace registry row stays ACTIVE and still backs the binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is active and undeleted and is either a qwen-code Session on the frozen execution profile or pinned to a stored definition; Workspace close follows its separate close capability and lifecycle admission; the same caller may cancel a running Turn (its delivery re-checks no grant it needs survives the cancellation), and the Session's own liveness keeps OPERATOR access even when its Workspace's background-exit observation closes some other bound Session; cancel is always allowed for its own running Turn even outside the Workspace files opt-in. A definition-pinned Session keeps its pinned revision's tool profile, model and instructions for its whole life, and a replay of the create command reuses the original pin; a WebShell Session inherits its Workspace's default Workspace selection when the request omits one. Shell Sessions additionally require the Shell opt-in and valid persisted approval for fresh Turns; disabling only Shell admission preserves original-key replay and accepted approvals and cancellation while Workspace files remain enabled and persisted approval remains valid. The public Shell tool list does not include the child agent tool. Invalid approval or files-off can refuse attachment. Public Shell close, archive, unarchive and delete stay unavailable, including protocol-0. Fresh Shell sending also requires foregroundShell=true; workspaceTurns alone is not sufficient Shell Turn admission. Manual rename uses the independent rename capability. */
+        /** @description Maps workspaceId/cwdRelative to public Workspace selection without using environmentId or absolute cwd. Shares G0's opt-in initial file-tool Turn admission with public Session creation: the server-selected profile for the built-in qwen-code agent, and the profile selected by a stored definition's single allowlisted hosted_profile tools entry for a definition-pinned Session. Newly bound qwen-code Sessions, including empty creation, persist hosted-workspace-shell/1 with mandatory default/auto-edit approval when the Shell deployment opt-in is enabled; otherwise they persist hosted-workspace-files/1 with the configured file approval mode. The switch does not override a stored AgentDefinition's compiled profile or approval mode. Public callers cannot select the built-in profile. Any caller holding the OPERATOR role may submit later Turns and rename the Session under the same opt-in, while the Workspace registry row stays ACTIVE and still backs the binding, the actor recorded by the Workspace create command keeps OPERATOR or above, and the Session is active and undeleted and is either a qwen-code Session on the frozen execution profile or pinned to a stored definition; Workspace close follows its separate close capability and lifecycle admission; the same caller may cancel a running Turn (its delivery re-checks no grant it needs survives the cancellation), and the Session's own liveness keeps OPERATOR access even when its Workspace's background-exit observation closes some other bound Session; cancel is always allowed for its own running Turn even outside the Workspace files opt-in. A definition-pinned Session keeps its pinned revision's tool profile, model and instructions for its whole life, and a replay of the create command reuses the original pin; a WebShell Session inherits its Workspace's default Workspace selection when the request omits one. Shell Sessions additionally require the Shell opt-in and valid persisted approval for fresh Turns; disabling only Shell admission preserves original-key replay and accepted approvals and cancellation while Workspace files remain enabled and persisted approval remains valid. Qualified new public Shell Sessions expose agent by default under the public-child deployment switch and runtime/Harness admission; existing Sessions retain their original tool scope. Invalid approval or files-off can refuse attachment. Public Shell close and active delete require lifecycle v2 and reliable original-Worker stop support; archive and unarchive require completed close proof. Fresh Shell sending also requires foregroundShell=true; workspaceTurns alone is not sufficient Shell Turn admission. Manual rename uses the independent rename capability. */
         post: operations["webShellCreateSession"];
         delete?: never;
         options?: never;
@@ -108,6 +108,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
+        /** @description Admits the command durably and returns its operation identity, admission stage and delivery state. Replaying the same idempotency key returns the original command operation. Existing Session and actor authorization checks apply. */
         post: operations["webShellSubmitTurn"];
         delete?: never;
         options?: never;
@@ -124,6 +125,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
+        /** @description Admits the command durably and returns its operation identity, admission stage and delivery state. Replaying the same idempotency key returns the original command operation. Existing Session and actor authorization checks apply. */
         post: operations["webShellCancelTurn"];
         delete?: never;
         options?: never;
@@ -523,7 +525,7 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** @description Change the execution approval policy of an eligible Workspace Session: built-in qwen-code or a stored AgentDefinition on exactly hosted-workspace-files/1 or hosted-workspace-shell/1,/2. With liveSupported, execution policy changes affect subsequent current-Turn permission checks and permit eligible pending ordinary tool approvals. Otherwise the Session must be idle. Plan changes remain idle-only. Requires its recorded owner, current OPERATOR or OWNER access and Session-specific Harness feature support. Changes are revision-checked and actor/session-scoped idempotent. Definition creation policy and pins remain immutable. */
+        /** @description Change the execution approval policy of an eligible Workspace Session: built-in qwen-code or a stored AgentDefinition on exactly hosted-workspace-files/1, hosted-workspace-files/3 or hosted-workspace-shell/1. With liveSupported, execution policy changes affect subsequent current-Turn permission checks and permit eligible pending ordinary tool approvals. Otherwise the Session must be idle. Plan changes remain idle-only. Requires its recorded owner, current OPERATOR or OWNER access and Session-specific Harness feature support. Changes are revision-checked and actor/session-scoped idempotent. Definition creation policy and pins remain immutable. */
         post: operations["changeWebShellSessionApproval"];
         delete?: never;
         options?: never;
@@ -706,6 +708,128 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/agent/web-shell/v1/sessions/compress": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Admits idle-only context compression without creating a Turn. A trusted Workspace OPERATOR or OWNER is required. Read authorization precedes actor-scoped idempotency replay; replay precedes mutable role, capability, revision and busy checks. Expected compaction revision begins at zero. Returns 409 session_context_busy for active or queued Turns, approvals, unsettled Hooks, recovery or conflicting context operations; 409 compaction_revision_conflict for a stale revision; 409 idempotency_conflict for key reuse with different content. A 202 is durable admission; query the original operation for completion. Unknown acceptance is reconciled from native evidence without blind redelivery. A compressed outcome invalidates the prior context usage until a new main-model observation; noop and failure preserve history and revision. */
+        post: operations["webShellCompressContext"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/session-mcp/management/query": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Requires a trusted Workspace operator and the Session creator execution grants. Manage only the selected active public Session; commands retain immutable definition pins, serialize while idle, and select only deployed Runtime definitions. Status reads persisted receipts without restarting or replaying the original effect. Management reattachment never drives recovery, cleanup, or wake dispatch. After a Harness restart, continue or recover the Session through its normal execution flow first; otherwise management returns 409 hosted_mcp_session_load_required. A fresh empty Session can initialize without a Turn; command status never creates one. Unsupported management queries return supported=false. Responses never include private executable recipes or credentials. */
+        post: operations["queryWebShellSessionMcpManagement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/session-mcp/management/submit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Requires a trusted Workspace operator and the Session creator execution grants. Manage only the selected active public Session; commands retain immutable definition pins, serialize while idle, and select only deployed Runtime definitions. Status reads persisted receipts without restarting or replaying the original effect. Management reattachment never drives recovery, cleanup, or wake dispatch. After a Harness restart, continue or recover the Session through its normal execution flow first; otherwise management returns 409 hosted_mcp_session_load_required. A fresh empty Session can initialize without a Turn; command status never creates one. Unsupported management queries return supported=false. Responses never include private executable recipes or credentials. */
+        post: operations["submitWebShellSessionMcpManagement"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/session-mcp/management/operations/query": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Requires a trusted Workspace operator and the Session creator execution grants. Manage only the selected active public Session; commands retain immutable definition pins, serialize while idle, and select only deployed Runtime definitions. Status reads persisted receipts without restarting or replaying the original effect. Management reattachment never drives recovery, cleanup, or wake dispatch. After a Harness restart, continue or recover the Session through its normal execution flow first; otherwise management returns 409 hosted_mcp_session_load_required. A fresh empty Session can initialize without a Turn; command status never creates one. Unsupported management queries return supported=false. Responses never include private executable recipes or credentials. */
+        post: operations["queryWebShellSessionMcpManagementOperation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/session-recovery/query": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Read authorized durable recovery facts and only already attached Harness evidence without loading a Session, acquiring a Runtime, invoking tools or models, stopping work or clearing a block. Missing or unreadable native readiness evidence never proves ready. This is Session-scoped; ordinary Workspace admission and concurrent unrelated Sessions remain independent. */
+        post: operations["queryWebShellSessionRecovery"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/session-recovery/recheck": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** @description Recheck only the latest original Turn under the existing cancellation/cleanup authorization. Repeated requests coalesce and may only advance existing cancellation/reconciliation or retry settled cleanup; they never resubmit input, replay effects, reset retry budgets or change claim generations. A stale Turn returns recovery_target_changed and ineligible work returns recovery_recheck_unavailable. 202 means requested, not cancelled or ready. For a terminal Java Turn whose Harness attachment is cold or whose status cannot be read, this POST may attempt a narrow cleanup-only load. It must verify the original prompt has a durable native terminal, covered continuation checkpoint or lawful initial state, and no pending input before retrying only its existing cleanup. It never resumes models, tools, MCP or Hooks, clears a permanent journal block, or treats a historical SQL failure as native settlement. */
+        post: operations["recheckWebShellSessionRecovery"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/agent/web-shell/v1/sessions/export/query": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Read one immutable public Session snapshot page for reading exports
+         * @description Requires current Session read authorization on every page. Reuses the public item snapshot cursor, whose subsequent pages retain the original snapshot version and watermark. No private journal, Runtime or storage credentials are returned. The client waits for a snapshot covering its captured Session watermark before using its first page.
+         */
+        post: operations["webShellExportSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -784,6 +908,14 @@ export interface components {
             cursor?: string | null;
             /** @default 20 */
             limit?: number | null;
+            /**
+             * @description Filter before pagination. Omission preserves all readable, undeleted Sessions. Cursors are bound to the normalized archive state and title query.
+             * @default all
+             * @enum {string}
+             */
+            archiveState?: "unarchived" | "archived" | "all";
+            /** @description Case-insensitive literal title substring, with surrounding whitespace stripped. Empty means no title filter; %, _ and backslash are literal. Applied before pagination. Cursors are bound to the stripped query and archiveState; listing is not a snapshot across title or archive changes. */
+            titleQuery?: string | null;
         };
         WebShellSessionRequest: {
             /** Format: uuid */
@@ -810,8 +942,8 @@ export interface components {
             requestId?: string | null;
             idempotencyKey: string;
             agentId: string;
-            /** @description Planned; phase one rejects non-blank values. */
-            environmentId?: string | null;
+            /** @description Optional host-catalog model for a bound built-in qwen-code Session. Requires modelSelectionSupported. Persisted atomically before the first Turn and included in creation idempotency; omission preserves the default model and old digest. */
+            modelId?: string;
             /** @description The server enforces the bound in UTF-16 code units (Java String.length()), so an astral character counts as two: a title this schema's code-point maxLength accepts can still exceed the server's 256-unit bound and answer 400 invalid_title. */
             title?: string | null;
             /** @description Text has a 4,000,000-character aggregate budget and per-block 1,000,000-character cap, counted in code points. Hosted also enforces its 64 KiB durable-record limit for text-only inputs and a 32 MiB prepared-snapshot ceiling. A complete canonical input containing file/image attachments must fit within 8 MiB and requires input-attachments/1. */
@@ -837,12 +969,6 @@ export interface components {
             /** @description Text has a 4,000,000-character aggregate budget and per-block 1,000,000-character cap, counted in code points. Hosted also enforces its 64 KiB durable-record limit for text-only inputs and a 32 MiB prepared-snapshot ceiling. A complete canonical input containing file/image attachments must fit within 8 MiB and requires input-attachments/1. */
             input?: components["schemas"]["InputBlock"][];
             metadata?: components["schemas"]["WebShellMetadata"];
-            /**
-             * @description D7-3. java_durable asks for the java_durable admission view: the 202 then names the command's operation (operationId, admissionStage, deliveryState), so a lost response resolves through that operation. Only a deployment whose Sessions advertise durableOperations admits it; elsewhere it answers 400 unsupported_feature before anything is read or written. Absent or harness_confirmed keeps today's response. harness_confirmed is the pinned reference design's qwen_confirmed. The request digest leaves this field out, so a retry under the same idempotencyKey replays the same command in either view.
-             * @default harness_confirmed
-             * @enum {string}
-             */
-            admissionProfile?: "harness_confirmed" | "java_durable";
         };
         WebShellCancelRequest: {
             /** @description Trace correlation only. */
@@ -851,34 +977,36 @@ export interface components {
             /** Format: uuid */
             sessionId: string;
             turnId: string;
-            /**
-             * @description D7-3. java_durable asks for the java_durable admission view: the 202 then names the command's operation (operationId, admissionStage, deliveryState), so a lost response resolves through that operation. Only a deployment whose Sessions advertise durableOperations admits it; elsewhere it answers 400 unsupported_feature before anything is read or written. Absent or harness_confirmed keeps today's response. harness_confirmed is the pinned reference design's qwen_confirmed. The request digest leaves this field out, so a retry under the same idempotencyKey replays the same command in either view.
-             * @default harness_confirmed
-             * @enum {string}
-             */
-            admissionProfile?: "harness_confirmed" | "java_durable";
         };
         /** @description Arbitrary caller metadata, as a JSON object (or null). Accepted and ignored in Phase 1: nothing from it is persisted. On WebShellCreateRequest the Session title travels in that request's own `title` field; WebShellSubmitRequest has no title surface. Any keys are valid. */
         WebShellMetadata: {
             [key: string]: unknown;
         } | null;
-        /** @description accepted means Java durable delivery responsibility, not model execution. The three operation fields come together, and only on a Turn input or cancel admission that asked for admissionProfile java_durable on a deployment advertising durableOperations (D7-3): operationId names the command's original submit_input or cancel operation, readable through the operation query, and admissionStage and deliveryState are that operation's latest durable values. A fresh input reads java_durable and pending; a cancel of a Turn that already ended reads its settled values. A retry under the same key answers the same operation with replayed true. Missing fields keep the legacy harness_confirmed response semantics, also for Session creation and for a replayed command recorded before v1.58. */
+        /** @description Command admission. Session creation and internal commands may omit operation fields. */
         WebShellAdmission: {
             /** Format: uuid */
             sessionId: string;
             turnId?: string | null;
             status: string;
             replayed: boolean;
+            /** @description Durable operation identifier for turn submission or cancellation. */
             operationId?: string;
-            /** @enum {string} */
+            /**
+             * @description Persisted admission stage of the operation.
+             * @enum {string}
+             */
             admissionStage?: "java_durable" | "harness_confirmed";
-            /** @enum {string} */
+            /**
+             * @description Current delivery state of the operation.
+             * @enum {string}
+             */
             deliveryState?: "pending" | "leased" | "confirmed" | "blocked";
         };
         WebShellTurn: {
             turnId: string;
             /** Format: uuid */
             sessionId: string;
+            /** @description recovery_blocked with hosted_harness_recovery_blocked means the Harness stopped without a safely settled Turn. The input remains active internally. Execution redispatch is parked, while bounded read-only observation of the original Harness journal may settle a later terminal result. Policy changes and lifecycle close wait for settlement; explicit cancellation remains available. */
             status: string;
             /** Format: int64 */
             submittedAt: number;
@@ -922,6 +1050,17 @@ export interface components {
             planMode?: boolean;
             /** @description Optional deployment capability; missing means false. */
             planModeSupported?: boolean;
+            /**
+             * Format: int64
+             * @description Sequence of the most recent native context.compacted event; independent of Workspace context revision. Omitted when retained pre-upgrade evidence cannot establish the revision, and context compression is unavailable.
+             * @default 0
+             */
+            compactionRevision?: number | null;
+            /** @description Current durable context compression operation, including recovery_blocked; absent when none is active. */
+            contextCompressionOperationId?: string | null;
+            /** @description Current unsettled lifecycle operation, queried in batch under Session read authorization. A failed close/delete may leave the Session closing/deleting; only explicit retry starts a new operation. Settled Sessions omit this projection. */
+            lifecycleOperation?: components["schemas"]["WebShellLifecycleOperation"];
+            recovery?: components["schemas"]["SessionRecovery"];
         };
         WebShellSessionCapabilities: {
             /**
@@ -929,11 +1068,6 @@ export interface components {
              * @default false
              */
             cwdChange?: boolean;
-            /**
-             * @description D7-3. Present only on a deployment that enables the java_durable admission profile, where it is true while the Session is readable: a Turn input or cancel may then ask for admissionProfile java_durable. Omitted elsewhere, where asking for it answers 400 unsupported_feature.
-             * @default false
-             */
-            durableOperations?: boolean;
             /** @default false */
             actions: boolean;
             /**
@@ -944,22 +1078,22 @@ export interface components {
             tasks: boolean;
             artifacts: boolean;
             /**
-             * @description Deployment support for close independently of archive/delete. Admission also requires Session ownership and current read access for a bound Session.
+             * @description Close support including current actor authority. Workspace-bound Sessions require the recorded Session owner and current read access. Source-state and idle admission remain authoritative on the server.
              * @default false
              */
             sessionClose?: boolean;
             /**
-             * @description Optional support for this retention operation. For a Workspace-bound Session requires completed reliable-close evidence; authorization and source-state validation still apply.
+             * @description Archive support including current actor authority. Workspace-bound Sessions require completed reliable-close evidence, the recorded Session owner and current read access. Source-state and idle admission remain authoritative on the server.
              * @default false
              */
             sessionArchive?: boolean;
             /**
-             * @description Optional support for this retention operation. For a Workspace-bound Session requires completed reliable-close evidence; authorization and source-state validation still apply.
+             * @description Unarchive support including current actor authority. Workspace-bound Sessions require completed reliable-close evidence, the recorded Session owner and current read access. Source-state and idle admission remain authoritative on the server.
              * @default false
              */
             sessionUnarchive?: boolean;
             /**
-             * @description Optional support capability. ACTIVE Workspace files Sessions require L3 lifecycle protocol and reliable original Runtime stop; CLOSED/ARCHIVED Sessions use independent L2 close evidence. Current creator/read authorization and idle/source-state admission checks still apply. The aggregate session lifecycle capability is unchanged.
+             * @description Delete support including current actor authority. ACTIVE Workspace Sessions require a supported reliable-close protocol; CLOSED/ARCHIVED Sessions use completed close evidence. Workspace-bound Sessions require the recorded Session owner and current read access. Source-state and idle admission remain authoritative on the server. The aggregate session lifecycle capability is unchanged.
              * @default false
              */
             sessionDelete?: boolean;
@@ -967,7 +1101,7 @@ export interface components {
             foregroundShell?: boolean;
             /** @description The caller may request an idle Session model change using the server model catalog. Missing means unsupported; authorization and revision admission still apply. */
             modelChange?: boolean;
-            /** @description The caller owns this eligible Workspace Session with current OPERATOR or OWNER access. Built-in qwen-code requires approval-selection/1; stored AgentDefinitions on exactly hosted-workspace-files/1 or hosted-workspace-shell/1,/2 also require agent-definition-approval-selection/1. Idle-state admission is checked separately. Missing means false. */
+            /** @description The caller owns this eligible Workspace Session with current OPERATOR or OWNER access. Built-in qwen-code requires approval-selection/1; stored AgentDefinitions on exactly hosted-workspace-files/1, hosted-workspace-files/3 or hosted-workspace-shell/1 also require agent-definition-approval-selection/1. Idle-state admission is checked separately. Missing means false. */
             approvalModeChange?: boolean;
             /** @description Optional deployment capability; missing means false. */
             inputAttachments?: boolean;
@@ -976,6 +1110,16 @@ export interface components {
              * @default false
              */
             rename?: boolean;
+            /**
+             * @description Requires a compatible Hosted Harness and an active Workspace Session. WebShell also reflects the current caller OPERATOR or OWNER grant; admission separately checks idle state.
+             * @default false
+             */
+            contextCompression?: boolean;
+            /**
+             * @description Public child orchestration support for this persisted Session; launch and caller authorization are checked separately.
+             * @default false
+             */
+            childAgents?: boolean;
         };
         WebShellSessionPage: {
             data: components["schemas"]["WebShellSession"][];
@@ -1115,7 +1259,7 @@ export interface components {
                  * @default false
                  */
                 workspaceContext: boolean;
-                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Turn at creation: Read/Write/Edit under hosted-workspace-files/1, or file tools plus mandatory-approval foreground Shell under hosted-workspace-shell/1 when the Shell opt-in is enabled. The public Shell tool list does not include the child agent tool. Callers holding the OPERATOR role may submit later Turns or rename under the same opt-in while the registry row stays ACTIVE and still backs the Session's binding and the actor recorded by the Workspace create command keeps OPERATOR or above, and may cancel a running Turn (its delivery re-checks no grants). Shell fresh sending also requires foregroundShell=true. Public Shell close, archive, unarchive and delete stay unavailable, including protocol-0, while close of other profiles follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
+                /** @description Supports authorized Workspace discovery, Session creation, and saved binding read-back. This capability does not advertise execution readiness. Deployments may separately opt in to an initial Workspace Turn at creation: Read/Write/Edit under hosted-workspace-files/1, or file tools plus mandatory-approval foreground Shell under hosted-workspace-shell/1 when the Shell opt-in is enabled. Qualified new public Shell Sessions expose agent by default under the public-child deployment switch and runtime/Harness admission; existing Sessions retain their original tool scope. Callers holding the OPERATOR role may submit later Turns or rename under the same opt-in while the registry row stays ACTIVE and still backs the Session's binding and the actor recorded by the Workspace create command keeps OPERATOR or above, and may cancel a running Turn (its delivery re-checks no grants). Shell fresh sending also requires foregroundShell=true. Public Shell close and active delete require lifecycle v2 and reliable original-Worker stop support; archive and unarchive require completed close proof, while close of other profiles follows its separate capability and lifecycle admission; archive, delete and unarchive follow their separate retention capabilities after reliable Workspace close. */
                 workspaceBinding: boolean;
                 /** @description Supports creating empty Workspaces under the operator-controlled root. Missing or false means unsupported; current actor and server admission checks still apply. */
                 workspaceCreation?: boolean;
@@ -1285,13 +1429,18 @@ export interface components {
             policyRevision: string;
             answers: components["schemas"]["WebShellQuestionAnswer"][];
         };
-        WebShellOperation: components["schemas"]["WebShellCwdOperation"] | components["schemas"]["WebShellCommandOperation"];
+        WebShellOperation: components["schemas"]["WebShellCwdOperation"] | components["schemas"]["WebShellCommandOperation"] | components["schemas"]["WebShellContextCompressionOperation"];
         WebShellActionQueryRequest: {
             /** Format: uuid */
             sessionId: string;
             cursor?: string;
             /** @default 20 */
             limit?: number;
+            /**
+             * @description Include pending permission Actions of this public root Session and its direct children; each Action retains its actual owning sessionId.
+             * @default false
+             */
+            includeChildren?: boolean;
         };
         WebShellActionGetRequest: {
             /** Format: uuid */
@@ -1310,6 +1459,8 @@ export interface components {
             /** Format: uuid */
             sessionId: string;
             idempotencyKey: string;
+            /** @description Trace-only client request identity, excluded from idempotency digests. */
+            requestId?: string | null;
         };
         WebShellWorkspaceQueryRequest: {
             cursor?: string | null;
@@ -1374,11 +1525,20 @@ export interface components {
             /** @description The newest Artifacts that hold durable task output, at most 100, oldest first. Entries must not rotate out until older Artifacts can be enumerated and attributed to the task: an evicted Artifact stays readable by id through the Session artifact routes but is no longer discoverable from the task. */
             artifactRefs: string[];
             actionCapabilities: components["schemas"]["TaskActionCapability"][];
+            /** @description A durable stop request has been recorded. This does not prove that the task has terminated. */
+            stopRequested?: boolean;
+            /**
+             * @description The actual immutable approval mode of this public child Session.
+             * @enum {string}
+             */
+            approvalMode?: "default" | "auto-edit" | "yolo";
         } & (unknown & unknown & unknown & unknown & unknown);
         WebShellTaskPage: {
             data: components["schemas"]["WebShellTask"][];
             hasMore: boolean;
             nextCursor?: string | null;
+            /** @description The total number of nonterminal child Agent tasks in this Session, independent of pagination. */
+            activeChildCount?: number;
         } & unknown;
         /** @description One task event: a logical state change, a bounded output chunk, or an Artifact reference. High-volume output goes to Artifacts or bounded chunks in this paged stream, never one Session event per raw line. The closed schema validates the server's own version; clients ignore unknown optional fields and unknown types and checkpoint their cursors. Strict response validation against an older minor version is not supported. Event identity, position, payload and accepted schema/projection versions are immutable across restart, projection rebuild and archival. */
         WebShellTaskEvent: {
@@ -1533,6 +1693,8 @@ export interface components {
             planModeSupported?: boolean;
             /** @description Optional deployment capability; missing means false. */
             inputAttachments?: boolean;
+            /** @description Optional capability for modelId on Workspace creation. Missing means false. */
+            modelSelectionSupported?: boolean;
             /** @description Optional deployment capability; missing means false. Requires a compatible Harness and durable Session Store. */
             skillsSupported?: boolean;
         };
@@ -1777,7 +1939,7 @@ export interface components {
         };
         WebShellRenameResult: {
             sessionId: string;
-            /** @description Current persisted title from the confirmed mutation or completed replay. Existing legacy titles can exceed the fresh-title input bound. */
+            /** @description Current persisted title from the confirmed mutation or completed replay. */
             title: string;
             replayed: boolean;
         };
@@ -1795,6 +1957,156 @@ export interface components {
             /** @description Whether the user may invoke this Skill; defaults to true. */
             user_invocable?: boolean;
         };
+        WebShellContextCompressionRequest: {
+            requestId?: string;
+            sessionId: string;
+            idempotencyKey: string;
+            /** Format: int64 */
+            expectedCompactionRevision: number;
+        };
+        WebShellContextCompressionOperation: {
+            operationId: string;
+            /** Format: uuid */
+            sessionId: string;
+            /** @constant */
+            type: "context_compression";
+            /** @enum {string} */
+            status: "pending" | "running" | "recovery_blocked" | "completed" | "failed";
+            /** Format: int64 */
+            expectedCompactionRevision: number;
+            /** Format: int64 */
+            compactionRevision?: number | null;
+            /** @enum {string|null} */
+            outcome?: "compressed" | "noop" | null;
+            failureCode?: string | null;
+            replayed: boolean;
+        };
+        ManagedMcpServerPin: {
+            serverId: string;
+            serverRevision: number;
+            definitionDigest: string;
+        };
+        ManagedMcpPublishedServer: {
+            serverId: string;
+            serverRevision: number;
+            definitionDigest: string;
+            /** @enum {string} */
+            transport: "stdio" | "streamable-http" | "sse";
+        };
+        ManagedMcpManagementServer: {
+            serverId: string;
+            serverRevision: number;
+            definitionDigest: string;
+            /** @enum {string} */
+            state: "enabled" | "disabled" | "removed";
+        };
+        ManagedMcpManagementOperation: {
+            /** Format: uuid */
+            operationId: string;
+            /** @enum {string} */
+            action: "add" | "edit" | "remove" | "enable" | "disable" | "reload" | "restart";
+            serverId: string;
+            revision: number;
+            /** @enum {string} */
+            state: "pending" | "settled" | "failed" | "recovery_required";
+            error?: {
+                code: string;
+            };
+        };
+        ManagedMcpManagementSnapshot: {
+            sessionId: string;
+            revision: number;
+            supported: boolean;
+            availableServers: components["schemas"]["ManagedMcpPublishedServer"][];
+            servers: components["schemas"]["ManagedMcpManagementServer"][];
+            operation?: components["schemas"]["ManagedMcpManagementOperation"];
+        };
+        WebShellMcpManagementQuery: {
+            sessionId: string;
+            requestId?: string;
+        };
+        WebShellMcpManagementSubmit: {
+            sessionId: string;
+            requestId?: string;
+            idempotencyKey: string;
+            /** @enum {string} */
+            action: "add" | "edit" | "remove" | "enable" | "disable" | "reload" | "restart";
+            serverId: string;
+            expectedRevision: number;
+            server?: components["schemas"]["ManagedMcpServerPin"];
+        };
+        WebShellMcpManagementOperationQuery: {
+            sessionId: string;
+            /** Format: uuid */
+            operationId: string;
+            requestId?: string;
+        };
+        SessionRecoveryActions: {
+            recheck: boolean;
+            cancel: boolean;
+            continueInNewSession: boolean;
+        };
+        /** @description Separate from Session lifecycle and Turn outcome. ready requires affirmative native input settlement and an admissible continuation boundary with no active Java Turn or blocking debt. Actions are authorization-scoped hints, checked again by their mutations. A new-Session action opens an editable text handoff and grants no additional Workspace permission. A cold or unreadable terminal Turn may advertise a proof-checked cleanup recheck while remaining operator_required with nextTurnAllowed=false; only affirmative native evidence after that mutation can establish readiness. */
+        SessionRecovery: {
+            /** @enum {string} */
+            state: "recovering" | "awaiting_evidence" | "cleanup_pending" | "ready" | "operator_required";
+            reasonCode: string;
+            /** @description Public Turn identity; never an internal prompt, checkpoint or execution reference. */
+            turnId?: string;
+            nextTurnAllowed: boolean;
+            actions: components["schemas"]["SessionRecoveryActions"];
+            /**
+             * Format: int64
+             * @description Known next reconciliation time in Unix epoch milliseconds.
+             */
+            nextRecheckAt?: number;
+        };
+        WebShellRecoveryRecheckRequest: {
+            sessionId: string;
+            turnId: string;
+        };
+        WebShellLifecycleOperation: {
+            operationId: string;
+            /** @enum {string} */
+            type: "close" | "archive" | "delete";
+            /** @enum {string} */
+            status: "pending" | "running" | "completed" | "failed" | "recovery_blocked";
+            failureCode?: string | null;
+        };
+        WebShellExportPage: {
+            items: components["schemas"]["WebShellItem"][];
+            nextCursor?: string | null;
+            hasMore: boolean;
+            /** Format: int64 */
+            snapshotThroughSequence: number;
+        };
+        WebShellExportRequest: {
+            /** Format: uuid */
+            sessionId: string;
+            cursor?: string | null;
+            /** @default 100 */
+            limit?: number | null;
+        };
+        /** @description Durable Turn input or cancellation admission. The operation identifies the saved command and remains stable across idempotent retries. */
+        WebShellTurnAdmission: {
+            /** Format: uuid */
+            sessionId: string;
+            turnId: string;
+            status: string;
+            replayed: boolean;
+            /** @description Durable operation identifier for turn submission or cancellation. */
+            operationId: string;
+            /**
+             * @description Persisted admission stage of the operation.
+             * @enum {string}
+             */
+            admissionStage: "java_durable" | "harness_confirmed";
+            /**
+             * @description Current delivery state of the operation.
+             * @enum {string}
+             */
+            deliveryState: "pending" | "leased" | "confirmed" | "blocked";
+        };
     };
     responses: {
         /** @description The authenticated actor belongs to another tenant than X-Qwen-Tenant-Id or has an invalid ID (actor_scope_mismatch, which the tenant filter answers on every /v1/agents/ and WebShell route), or the resource is readable but the actor lacks this operation or the original Action responder permission. Artifact content reads may also return artifact_content_forbidden when the actor cannot read the original bytes. */
@@ -1851,6 +2163,15 @@ export interface components {
                 "application/json": components["schemas"]["ErrorEnvelope"];
             };
         };
+        /** @description Replay cursor is older than the retained replay floor. */
+        CursorExpired: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorEnvelope"];
+            };
+        };
         /** @description Task event cursor is strictly below the task's durable retention floor, which survives an empty retained set; equality is valid. The envelope's replay_floor_sequence and snapshot_through_sequence stay absent because task cursors are opaque. */
         TaskCursorExpired: {
             headers: {
@@ -2082,7 +2403,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebShellAdmission"];
+                    "application/json": components["schemas"]["WebShellTurnAdmission"];
                 };
             };
             400: components["responses"]["BadRequest"];
@@ -2113,7 +2434,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebShellAdmission"];
+                    "application/json": components["schemas"]["WebShellTurnAdmission"];
                 };
             };
             400: components["responses"]["BadRequest"];
@@ -3288,4 +3609,243 @@ export interface operations {
             };
         };
     };
+    webShellCompressContext: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellContextCompressionRequest"];
+            };
+        };
+        responses: {
+            /** @description Durable context compression operation. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebShellContextCompressionOperation"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+        };
+    };
+    queryWebShellSessionMcpManagement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellMcpManagementQuery"];
+            };
+        };
+        responses: {
+            /** @description Session-local MCP settings and operation snapshot. Inventory describes published pins rather than live connection health; operation status omits inventory. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedMcpManagementSnapshot"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+            /** @description The original MCP Runtime or management operation cannot be confirmed. Retry the same operation identity. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    submitWebShellSessionMcpManagement: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellMcpManagementSubmit"];
+            };
+        };
+        responses: {
+            /** @description Session-local MCP settings and operation snapshot. Inventory describes published pins rather than live connection health; operation status omits inventory. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedMcpManagementSnapshot"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+            /** @description The original MCP Runtime or management operation cannot be confirmed. Retry the same operation identity. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    queryWebShellSessionMcpManagementOperation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellMcpManagementOperationQuery"];
+            };
+        };
+        responses: {
+            /** @description Session-local MCP settings and operation snapshot. Inventory describes published pins rather than live connection health; operation status omits inventory. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedMcpManagementSnapshot"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+            /** @description The original MCP Runtime or management operation cannot be confirmed. Retry the same operation identity. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorEnvelope"];
+                };
+            };
+        };
+    };
+    queryWebShellSessionRecovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellSessionRequest"];
+            };
+        };
+        responses: {
+            /** @description Current recovery evidence. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionRecovery"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+            503: components["responses"]["Unavailable"];
+        };
+    };
+    recheckWebShellSessionRecovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellRecoveryRecheckRequest"];
+            };
+        };
+        responses: {
+            /** @description Current recovery evidence; recheck admission is not settlement. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionRecovery"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            413: components["responses"]["PayloadTooLarge"];
+            503: components["responses"]["Unavailable"];
+        };
+    };
+    webShellExportSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["WebShellExportRequest"];
+            };
+        };
+        responses: {
+            /** @description Immutable public item snapshot page. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebShellExportPage"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["CursorExpired"];
+            413: components["responses"]["PayloadTooLarge"];
+        };
+    };
 }