Release v0.22.0

Highlights

• Web Shell prevents out-of-memory crashes by bounding transcript retention and trimming oversized replays. (#9303)
• Review loops now explain instability by citing specific files with recurring findings or non-shrinking comment volumes. (#9461)
• Autofix now audits PR approach for simplicity instead of stopping automation immediately upon a growth-budget breach. (#9262)
• Web Shell keeps conversation turns expanded while background shells run, collapsing them only after completion. (#9632)
• Created GitHub PRs are now bound to originating sessions with a searchable list and sidebar badge. (#9543)
• Non-blocking slash commands now include eleven built-ins like /theme and /tools for immediate execution during streaming. (#9495)

Breaking Changes

No known breaking changes.

Web Shell Experience

Improves Web Shell stability, UI responsiveness, streaming performance, and conversation handling during active sessions.

• Web Shell now bounds daemon transcript retention and trims oversized replays to prevent renderer out-of-memory crashes. (#9303)
• Web Shell now keeps conversation turns expanded while their background shells are running, collapsing them only after completion. (#9632)
• Fixes web-shell UI so subagent prompts scroll correctly and parallel-agent groups collapse immediately upon completion. (#9640)
• Adds a hover tooltip to the create-group icon in Web Shell to clarify its function for mouse users. (#9400)
• Updates the conversation loading indicator to use the daemon's hasActivePrompt state, ensuring it remains visible during long tool calls even when streaming is idle. (#9631)
• Prevents the Web Shell tool-approval dialog from stealing keyboard focus when it appears while the user is actively typing in an editable element. (#9609)
• Optimizes Web Shell streaming performance by reducing main-thread work and reloading oversized transcripts after 15 seconds of inactivity. (#9672)
• Routes ordinary Web Shell messages based on session activity rather than Goal status to improve turn handling and insertion logic. (#9667)

Review & Autofix Logic

Enhances review loop explanations, Autofix auditing, convergence observations, and PR detection to reduce noise and improve automation reliability.

• Review loops now explain why they are not settling by citing specific files with recurring findings or comment volumes that are not shrinking. (#9461)
• Autofix now audits the PR approach for simplicity and minimal change instead of stopping automation immediately upon a growth-budget breach. (#9262)
• Fixed autofix busy-PR detection to include pending workflow runs, preventing duplicate dispatches caused by GitHub status reporting delays. (#9662)
• Adds machine-readable convergence observation codes like root-cause-triage and batch-fixes to enable automated review actions. (#9623)
• Assigns review agents a dedicated subagent type with only six required tools to reduce token usage and improve performance. (#9678)
• Adjusts review body trimming priority to preserve convergence observations about finding rates until all other advisory content is dropped. (#9715)
• Extends the /review skill cleanup audit to Aone Code targets, flagging comments or edits made within the review window that were not submitted via the sanctioned path. (#9633)

Aone & GitHub Integration

Fixes Aone AGit-Flow caching, presubmit checks, and comment handling while binding GitHub PRs to sessions for better traceability.

• Fixed incremental review caching for Aone AGit-Flow CRs by computing diffs between local heads instead of relying on ancestry tests that fail after amendments. (#9630)
• Enabled /review presubmit on Aone targets to detect self-MRs and head drift by routing through the a1 CLI and comparing author identity. (#9629)
• Updated /review --comment output on Aone targets to explicitly disclose that posted comments are unmarked and only join the generic discussion gate. (#9625)
• Binds created GitHub PRs to their originating sessions with a searchable list and sidebar badge, supporting up to 10 PRs per session with latest-first ordering. (#9543)
• Fixes Aone review support by generating canonical PR links directly from the platform and updating test-plan routing and version floors. (#9624)
• Clears deferred Round-5 findings on the Aone write path, ensuring empty --host arguments fail distinctly and test pins correctly guard regressions. (#9604)
• Adds a secure fallback path for installing public GitHub extensions on older Git versions by resolving commits via GitHub's anonymous API and downloading archives directly. (#9680)

Slash Commands & Tools

Expands non-blocking slash commands, stabilizes menu selection during streaming, and restores interactive HITL prompts on session resume.

• Extends non-blocking slash commands to eleven built-ins like /theme and /tools, allowing immediate execution during streaming. (#9495)
• Stabilizes slash-command menu selection while a response streams by preventing unnecessary re-runs of the suggestion search due to unrelated context updates. (#9508)
• serve: restore ask_user_question HITL on session load/resume (#9665)
• Integrates import widening logic into fetch-pr --since to streamline incremental scope calculation and reduce token usage. (#9332)

Security & Dependencies

Patches high-severity CVEs, secures sandbox images against tampering, and enforces stricter dependency and workflow security gates.

• The sandbox image is now bound to its specific pulled digest to prevent tampering via mutable tags between resolve and consumption steps. (#9527)
• Upgraded dependencies including OpenTelemetry 0.221.x and markdown-it 15 to resolve high-severity CVEs and enforced the security gate as a hard block. (#9584)
• Bumps vulnerable dependencies including tar, protobufjs, dompurify, and echarts to patched versions to resolve CVE audits without changing code or package ranges. (#9703)
• core: make list_directory opt-in (disabled by default) (#9424)

SDKs & Permissions

Updates Python and Java SDKs to support auto permission mode, aligning tool call approval behavior across all client libraries.

• Updates Python and Java SDKs to support the auto permission mode, aligning them with the CLI and TypeScript SDK for LLM-based tool call approval. (#9003)

CI & Artifact Handling

Corrects CI fallback comments, fixes artifact download logic for Office files, and stabilizes verification gates with proper environment variables.

• The CI fallback comment no longer incorrectly claims a review failed when the same run successfully posted a review earlier. (#9462)
• Fixed artifact handling to expand recorded directories into per-file downloads while skipping hidden or junk files, and ensured Office documents download directly. (#9395)
• Restores CI=true to autofix verification-gate launches to prevent test flakiness caused by missing environment variables in clean child processes. (#9649)
• Excludes idle watchdog timeouts from the cumulative timeout cap so they no longer block PRs while remaining visible in logs. (#9673)

General Fixes

Addresses miscellaneous bugs including session recovery races, review body trimming, and daemon state synchronization issues.

• Fixes session recovery across archive races by prioritizing active storage copies for REST, daemon ACP, and embedded ACP load operations. (#9513)
• Removes root barrel self-imports in packages/core and adds an ESLint rule to prevent circular dependencies and enforce architecture boundaries. (#9635)
• Refactors acp-integration and serve internals to enforce dependency boundaries with no intended behavior change for users. (#9144)
• Moves the push-and-report workflow logic to a separate shell script to reduce YAML size while maintaining execution security. ([#9653](https://...

Release v0.21.14-nightly.20260822.7a4566cb3b

What's Changed

• feat(review): tell the author why a review loop is not settling by @wenshao in #9461
• fix(ci): stop the fallback comment from denying a review it already posted by @wenshao in #9462
• fix(web-shell): bound daemon transcript retention to stop renderer OOM crashes by @wenshao in #9303
• chore(ci): Disable install scripts in release CI and guard security-checks workflow by @yiliang114 in #9577
• feat(web-shell): keep a turn expanded while its background shell runs by @ytahdn in #9632
• feat(autofix): audit the approach instead of stopping on growth-budget breach by @wenshao in #9262
• docs(ci): the ECS pool does run containers — correct two comments that say it does not by @wenshao in #9575
• fix(autofix): bind the sandbox image to its pulled digest by @wenshao in #9527
• docs(autofix): design runner-level isolation for PAT-bearing steps by @wenshao in #9525
• fix(web-shell): settle parallel-agents collapse and unify agent detail transcript by @ytahdn in #9640
• fix(web-shell): show create-group tooltip by @deggs7 in #9400
• feat(review): fold the one-hop import widening into fetch-pr --since by @wenshao in #9332
• docs: document inline terminal image previews by @DragonnZhang in #8656
• feat(core): make list_directory opt-in (disabled by default) by @DragonnZhang in #9424
• docs: document the Session Workflow setting by @DragonnZhang in #8554
• feat(cli): extend non-blocking slash commands to more builtins by @DragonnZhang in #9495
• docs(autofix): pin the publish-side checks to the patch text by @wenshao in #9652
• chore(deps): Clear high-severity CVE baseline and harden the security gate by @yiliang114 in #9584
• docs(autofix): add an operator guide for /takeover from N by @wenshao in #9622
• fix(artifacts): expand recorded directories into per-file artifacts by @zjgzx1988 in #9395
• feat(review): disclose that Aone posts join the discussion gate only by @wenshao in #9625
• fix(review): make the incremental cache work for Aone AGit-Flow CRs by @wenshao in #9630
• feat(review): detect self-MR on Aone targets in presubmit by @wenshao in #9629
• fix(autofix): include pending runs in the busy-PR enumeration by @wenshao in #9662
• docs(autofix): correct the round-seed guide on leading whitespace by @wenshao in #9663
• fix(web-shell): use daemon live-state hasActivePrompt for loading indicator (#9487) by @yiliang114 in #9631
• fix(cli): keep slash menu selection stable while a response streams by @yiliang114 in #9508
• fix(web-shell): don't steal approval focus while the user is typing by @yiliang114 in #9609
• fix(core): support public GitHub extensions with older Git by @yiliang114 in #9680

New Contributors

• @deggs7 made their first contribution in #9400

Full Changelog: v0.21.15...v0.21.14-nightly.20260822.7a4566cb3b

Release v0.21.14-nightly.20260821.9f2342d323

What's Changed

• feat(review): tell the author why a review loop is not settling by @wenshao in #9461
• fix(ci): stop the fallback comment from denying a review it already posted by @wenshao in #9462

Full Changelog: v0.21.15...v0.21.14-nightly.20260821.9f2342d323

Release v0.21.15

Highlights

• Web Shell now supports inserting file attachments via composer or @ selection, with improved streaming performance and immediate sidebar synchronization. (#9405, #9477, #9570, #9533)
• Qwen hybrid models now expose a simple Thinking toggle for reasoning control, and the stable qwen3.8-max model is available via /model. (#9574, #9383)
• The --resume flag is now supported in /review and CI retries to continue interrupted reviews when the PR head has not moved. (#9153)
• Added support for authenticated HTTPS Git extension installs with configurable credential persistence for secure private repository cloning. (#9458)
• Tool approval and ask-user dialogs now appear as in-flow bottom sheets aligned to chat width for a more integrated experience. (#9351)
• Fixed issues where /rewind incorrectly dropped conversation history and duplicate tool-call IDs caused execution errors. (#9331, #9436)

Breaking Changes

No known breaking changes.

Web Shell Experience

Web Shell now features improved streaming performance, unified file uploads, Goal v3 controls, and real-time sidebar synchronization.

• Web Shell streaming output is now more responsive during long tasks by batching transcript delivery and avoiding expensive Markdown parsing on growing content. (#9405)
• Improved Web Shell performance by using live-state activity timestamps to refresh session recency and sort active lists without triggering rate-limited full catalog rescans. (#9476)
• Unifies file uploads in Web Shell to offer reference or upload options, storing attachments persistently with duplicate name handling. (#9477)
• Web Shell sidebar now immediately synchronizes session changes like renaming or deleting, while improving loading indicator spacing. (#9533)
• Web Shell now stops redundant session title catalog refreshes after resolving a display name, reducing unnecessary network requests. (#9563)
• Web Shell now supports inserting file attachments into active turns via the composer or @ selection, with preview and queue management. (#9570)
• WebShell adopts Goal v3 controls, allowing goals to be managed independently of chat messages with a compact composer row. (#9393)
• web-shell: fall back to execCommand copy in non-secure contexts (#9540)
• ui: collapse duplicate in-flight tool_group rendered from history + pending (#9421)

Review & Verification

Enhanced review workflows with resume support, Aone Code integration, stricter verification disciplines, and accurate volume tracking.

• The --resume flag is now supported in /review, review run, and CI retries to continue interrupted reviews when the PR head has not moved. (#9153)
• Review ledger markers now record the posted inline comment count for the current and previous rounds to track posting volume trends. (#9413)
• Review verifiers now enforce four run disciplines from live two-arm verification, including starting stateful targets from fresh state for each row. (#9447)
• review: clamp the posting volume at its origin, not only where it is written (#9460)
• review: keep the blocker in a COMMENT body every softening path reaches (#9416)
• review: add runtime-axis, table-sweep and isolation witness forms (#9445)
• Review verifier probes now run in private scratch worktrees to prevent race conditions with auditors reading the shared tree. (#9221)
• The review system now validates that consumer-facing contract documentation accurately matches the implemented code behavior. (#9448)
• The /review skill now supports posting comments and approvals to Aone Code via the a1 CLI when using the --comment flag. (#9491)

Autofix & CI Reliability

Resolved GitHub Actions bottlenecks, fixed workflow queuing deadlocks, and enforced test coverage for automated code fixes.

• Fixed a CI failure in the flakiness gate by diffing against a pinned base OID instead of resolving HEAD^1, preventing intermittent access errors on the persistent pool. (#9464)
• Fixes the flake-gate CI step by computing git diffs before environment scrubbing to prevent access errors on shallow merge-ref objects. (#9468)
• Clones the autonomous-fix workflow into a new entity to bypass a GitHub Actions backend issue causing runs to stick in queued state. (#9482)
• Added a comment to the autofix workflow file to force GitHub Actions to re-register triggers that had silently stopped executing scheduled and event-based runs. (#9479)
• Reduced the size of the qwen-autofix.yml workflow file to stay under GitHub's 500 KB limit, restoring silent-failing automated fix runs that had stopped executing. (#9517)
• The shepherd no longer counts permanently queued workflow runs with zero jobs as in-flight, preventing deadlocks that blocked autofix loops for hours. (#9518)
• Autofix now requires mutation probes to verify that new guards or branches added in a round are covered by tests before committing changes. (#9578)
• Autofix finding replies are now idempotent, skipping duplicate posts when the thread already contains an identical comment from the bot. (#9463)
• Release pull requests are now authored by a dedicated bot account instead of the GitHub Actions token, enabling finalization in organizations that restrict Actions-created PRs. (#9592)

Session & Conversation Management

Introduced conversation isolation primitives, privacy-preserving ledgers, and fixed history retention issues during compression.

• Introduces primitives for standalone conversation isolation, enabling deterministic session identity and validated lineage checks. (#9341)
• Sessions now persist a privacy-preserving ledger of prompt outcomes to enable accurate cold-load reconciliation without storing user content. (#9426)
• Fixed an issue where /rewind would incorrectly drop conversation history after /compress-fast by properly distinguishing rule-based compression markers from summarizing boundaries. (#9331)
• Standalone conversation primitives now safely adopt concurrently created directories and enforce strict integrity budgets for JSONL readers. (#9512)
• Skipped duplicate tool results during ACP loop detection are now persisted as terminal errors, preventing missing tool results in transcript replays after session resumes. (#9593)

Agent Capabilities & Models

Added stable qwen3.8-max model, simplified Thinking toggles, enabled DingTalk media access, and improved tool-call handling.

• Added the stable qwen3.8-max model to the Token Plan model list, allowing users to select it via /model alongside the existing preview version. (#9383)
• Qwen hybrid models now expose a simple Thinking toggle for reasoning control, removing complex effort tiers for supported versions. (#9574)
• Enables DingTalk to download and attach media from quoted messages, allowing agents to inspect referenced images and files. (#9347)
• Treats duplicate provider tool-call IDs as replays only when arguments match, allowing ID collisions with different arguments to execute normally. (#9436)
• Prevents upstream fail-fast placeholder responses like '(request timeout)' from appearing in chat by retrying them internally. (#8938)
• cli: surface the daemon duplicate tool-call breaker as a visible loop-detected stop (#9435)
• core: reject run_in_background: false for named teammates (#9433)
• core: clarify list_agents excludes Agent Team teammates (#9432)

Extensions & Git Integration

Enabled authenticated HTTPS Git installs, batch Extension state updates, and PTY worker support for managed termi...

Release v0.21.11-nightly.20260820.b414f135fa

What's Changed

• feat(web-shell): approval and ask-user dialogs as in-flow sheets; fix background-agent false failure by @ytahdn in #9351
• feat(serve): Add live-state session activity watermark by @doudouOUC in #9396
• perf(web-shell): keep streaming output responsive by @ytahdn in #9405
• feat(serve): measure ACP child peak old-generation heap by @doudouOUC in #9380
• feat(review): wire --resume through /review, review run and the CI retry by @wenshao in #9153
• feat(review): record each round's posting volume in the ledger marker by @wenshao in #9413
• feat(review): teach verifiers four run disciplines from a live two-arm verification by @wenshao in #9447
• feat(daemon): add batch extension activation APIs by @callmeYe in #8788
• fix(triage): diff the flake-gate file list against the pinned base OID by @yiliang114 in #9464
• fix(cli): surface the daemon duplicate tool-call breaker as a visible loop-detected stop by @doudouOUC in #9435
• feat(providers): add qwen3.8-max to Token Plan model list by @qqqys in #9383
• fix(cli): prevent /rewind from dropping conversation history after /compress-fast by @yiliang114 in #9331
• fix(core): reject run_in_background: false for named teammates by @yiliang114 in #9433
• fix(review): clamp the posting volume at its origin, not only where it is written by @wenshao in #9460
• feat(extensions): support authenticated HTTPS Git installs by @callmeYe in #9458
• fix(core): clarify list_agents excludes Agent Team teammates by @yiliang114 in #9432
• fix(core): reject upstream fail-fast placeholder responses by @yiliang114 in #8938
• fix(core): isolate image payload eviction state by @yiliang114 in #9423
• fix(core): treat duplicate provider tool-call ids as replays only when arguments match by @doudouOUC in #9436
• feat(telemetry): link daemon HTTP request spans to inbound W3C traceparent by @chiga0 in #9391
• feat(web-shell): add transcript contract prevalidation by @water-in-stone in #9388
• fix(triage): compute the flake-gate diff before the env -i re-exec by @yiliang114 in #9468
• fix(sdk): route unrecognized diagnostics onto a bounded transcript sidechannel by @yiliang114 in #9202
• fix(ci): clone qwen-autofix into a recovery workflow entity by @wenshao in #9482
• refactor(cli): consolidate shared helpers ahead of the legacy audit skill by @wenshao in #9345
• fix(ci): no-op touch to re-register the autofix workflow triggers by @wenshao in #9479
• fix(review): keep the blocker in a COMMENT body every softening path reaches by @wenshao in #9416
• feat(web-shell): Consume live-state session activity timestamps by @doudouOUC in #9476
• refactor(review): define each certification-bar atom exactly once by @wenshao in #9473
• feat(cli): show loaded context files alongside the first prompt by @ZijianZhang989 in #8855
• feat(review): add runtime-axis, table-sweep and isolation witness forms by @wenshao in #9445
• fix(ci): keep qwen-autofix.yml under GitHub's 500 KB start-runs limit by @wenshao in #9517
• feat(cli): Add agent view PTY workers by @ZijianZhang989 in #7800
• fix(dingtalk): attach media from quoted messages by @qqqys in #9347
• feat(core): expose workflow execution state by @qqqys in #9034
• refactor(review): route the certification path atoms through one needle by @wenshao in #9484
• chore(ci): Add --provenance to npm publish and id-token permission by @yiliang114 in #9532

Full Changelog: v0.21.14...v0.21.11-nightly.20260820.b414f135fa

DSW EAS SWE + TB smoke 2026-08-21 r1

Benchmark-Qwen-Ref: v0.21.15

End-to-end 1 SWE + 1 Terminal-Bench smoke for release-trigger, DSW Harbor execution, and GitHub Release result writeback validation.

SWE-bench Verified

• Status: SUCCEEDED
• Dataset: swe-bench/swe-bench-verified@2; 1/1 completed
• Results: 1 resolved, 0 unresolved, 0 execution errors, 0 infrastructure failures
• Score: 100.00%
• Score denominator: valid grader results (1 + 0 = 1)
• Qwen Code: v0.21.15 (5dce2515a778); model qwen3.7-plus
• Run: pool-c4930429cc6a43ab; dispatch workflow: https://github.com/QwenLM/qwen-code/actions/runs/32440537429
• Case trajectories: swe-bench-verified-dsw-eas-tb-smoke-20260821-r1-trajectories.tar.gz (1 cases)

Terminal-Bench 2.0

• Status: SUCCEEDED
• Dataset: terminal-bench@2.0; 1/1 completed
• Results: 1 resolved, 0 unresolved, 0 execution errors, 0 infrastructure failures
• Score: 100.00%
• Score denominator: valid grader results (1 + 0 = 1)
• Qwen Code: v0.21.15 (5dce2515a778); model qwen3.7-plus
• Run: pool-4a4de70d009f494e; dispatch workflow: https://github.com/QwenLM/qwen-code/actions/runs/32440537429
• Case trajectories: terminal-bench-2.0-dsw-eas-tb-smoke-20260821-r1-trajectories.tar.gz (1 cases)

DSW EAS SWE 500 + Terminal-Bench 89 full 2026-08-21 r1

Benchmark-Qwen-Ref: v0.21.15

End-to-end full benchmark: SWE-bench Verified 500 followed by Terminal-Bench 2.0 89, including verifier-backed result and trajectory writeback.

SWE-bench Verified

• Status: SUCCEEDED
• Dataset: swe-bench/swe-bench-verified@2; 500/500 completed
• Results: 377 resolved, 118 unresolved, 2 execution errors, 3 infrastructure failures
• Score: 76.16%
• Score denominator: valid grader results (377 + 118 = 495)
• Qwen Code: v0.21.15 (5dce2515a778); model qwen3.7-plus
• Run: pool-82e3a6633a264530; dispatch workflow: https://github.com/QwenLM/qwen-code/actions/runs/32444619153
• Case trajectories: swe-bench-verified-dsw-eas-full-20260821-r1-trajectories.tar.gz (498 cases)

Terminal-Bench 2.0

• Status: QUARANTINED
• Dataset: terminal-bench@2.0; 89/89 completed
• Results: 43 resolved, 29 unresolved, 11 execution errors, 6 infrastructure failures
• Score: not published (non-scoreable or quarantined run)
• Score denominator: valid grader results (43 + 29 = 72)
• Qwen Code: v0.21.15 (5dce2515a778); model qwen3.7-plus
• Run: pool-3abc82f27dca44a7; dispatch workflow: https://github.com/QwenLM/qwen-code/actions/runs/32444619153
• Case trajectories: terminal-bench-2.0-dsw-eas-full-20260821-r1-trajectories.tar.gz (78 cases)

Release v0.21.14

Highlights

• Added qwen sessions ps command and live-state API to list and monitor running interactive sessions with JSON output. (#8969, #9261, #9366)
• Introduced /advisor slash command for independent read-only opinions and enhanced review skills for GitLab and CI script analysis. (#7567, #9226, #9263)
• Improved Web Shell resilience by allowing prompt submission during disconnection and preventing session crashes on render errors. (#9323, #9292)
• Minimized spam visibility gaps by checking new comments against blocklists immediately upon creation. (#9266)
• Added end-to-end support for session-scoped media references ensuring image previews persist across refreshes. (#9310)
• Enabled workflow agents to pin to specific working directories using the workingDir parameter to extend their lifecycle. (#8972)

Breaking Changes

No known breaking changes.

Session Management & Web Shell

Enhanced live session tracking, media persistence, and file handling in Web Shell with improved state synchronization and UI controls.

• Adds a live-session registry and the qwen sessions ps command to list running interactive sessions with optional JSON output. (#8969)
• Improves Web Shell sidebar session management with consistent hover details, compact status indicators, and persistent workspace expansion. (#9311)
• Added end-to-end support for session-scoped media references, ensuring image previews persist across refreshes and reconcile consistently. (#9310)
• Adds a trusted-only GET /workspaces/:workspace/sessions/live-state endpoint returning volatile session snapshots and a catalog version token to reduce polling. (#9261)
• WebShell now consumes workspace-scoped session live-state to reduce polling overhead and only refresh the session catalog when necessary. (#9366)
• Web Shell now fully disables file drag-and-drop when fileUploadEnabled is false and adds support for uploading directories via fileUploadDirectory. (#9382)
• The exported HTML viewer now includes a global Expand all/Collapse all toolbar to simultaneously toggle thinking blocks, tool outputs, and file references. (#9367)
• revert(web-shell): restore pre-#8098 composer animations at 50% opacity (#9349)

Review Pipeline & Automation

Improved review accuracy with better anchor handling, multi-model support, and automated workflows for SWE-bench and Terminal-Bench.

• Chains Terminal-Bench release evaluation by submitting SWE-bench runs first and dispatching TB runs only after SWE results are published. (#9120)
• Repairs seven review pipeline defects found in live runs, including fixing incremental anchor withholding and enabling multi-call build-and-test dimensions. (#9175)
• Enhanced the review skill to analyze shell and CI scripts against the specific lanes and environments that execute them. (#9263)
• Updated review skill documentation and tests to reflect the settled 3-round cap state and improve coverage for chunk gating logic. (#9258)
• Incremental review anchors now record the certifying model, preventing incorrect skip behavior when re-running with a different model. (#9184)
• Added Aone Code read path support to /review, enabling meta, issue-context, and fetch-pr commands for GitLab-based repositories. (#9226)
• The compose-review command now enforces GitHub's 65,536-character review limit by trimming Chinese translations and deferral notes before truncating essential blockers. (#9247)
• Review comments posted via --comment now use plain reviewer prose instead of templated scaffolding, while severity markers continue to follow review.attribution rules. (#9027)
• Sandboxed verification now includes a deterministic flakiness gate that re-runs modified unit tests multiple times to detect and report non-deterministic failures. (#9130)
• Added --resume flag to fetch-pr to resume interrupted reviews by validating on-disk state and reusing the worktree. (#9092)
• Enabled pagination for review thread fetching to ensure all threads are resolved instead of only the oldest 100. (#9390)
• Simplified the review checkout self-heal logic by removing complex guard layers and retaining the core wipe-and-retry mechanism. (#9327)

Agent Capabilities & Orchestration

Expanded agent functionality with directory pinning, team task routing, and robust error handling for foreground processes.

• daemon: attach skill-toggle mutation metadata to settings_changed (#9051)
• Enabled workflow agents to pin to a specific working directory using the workingDir parameter, allowing them to outlive default bounds. (#8972)
• Fixed an issue where foreground agents were incorrectly marked as failed due to missing routing fields in SSE events. (#9330)
• Updated agent-team prompts and TeamCreate descriptions to accurately reflect automatic final answer delivery when teammates go idle. (#9284)
• core: dispatch manually assigned team tasks to their owner (#9289)
• autofix: seed the takeover round counter with /takeover from N (#9321)
• The autofix convergence brake now correctly instructs the agent to write handoff details to failure.md instead of restricted wrapper files. (#9371)
• The autofix fleet scan now fails closed on API enumeration errors to prevent dispatching jobs to busy PRs and marks dispatched PRs clearly. (#9329)
• Certification bars in the reverse-audit path now report specific failure names like 'receipt lead contradicts the phrase' to improve diagnostic clarity for retirement causes. (#9272)

System Reliability & Performance

Strengthened system stability with retry logic for I/O errors, memory cache bounds, and graceful degradation for render failures.

• Makes transient resource-exhaustion and read I/O errors retryable while keeping malformed record errors terminal to prevent false corruption flags. (#9362)
• Bounds text utility caches to 500 entries with oldest-entry eviction to prevent unbounded memory growth in long sessions. (#9185)
• Clamps compression output budget to the remaining context window size to ensure valid requests when prompt estimates exhaust available tokens. (#9109)
• Wraps the agent-tab view in a non-fatal ErrorBoundary so render errors degrade gracefully instead of exiting the entire session. (#9292)
• Images with unsupported MIME types or decoding errors are now omitted with a text notice instead of causing the entire session to abort. (#9295)
• Memory recall now waits up to 100ms for results before injecting deterministic candidates, improving reliability and non-ASCII coverage. (#8716)
• The web-shell now uses backend-authoritative queue states to prevent duplicate messages and ensure draft payloads are only restored after proven delivery failures. (#9407)
• Cleared a backlog of nineteen deferred suggestions and fixed behavior issues including persistRecoveredLedger flag handling. (#9342)

Daemon & Local Control

Consolidated Local Control architecture and added configurable modes and pollable routes for daemon status and answers.

• Consolidates Local Control into a single daemon-owned implementation with a secondary listener, unified security model, and revocable pairing credentials. (#9106)
• daemon: make serve new-file mode configurable (QWEN_SERVE_NEW_FILE_MODE) (#9364)
• Added pollable HTTP routes to check daemon turn status and retrieve final model answers without requiring an SSE subscription. (#9080)

Security & Spam Prevention

Reduced spam visibility gaps with instant blocklist checks and added workspace wipe guards to prevent...

Release v0.21.14-preview.0

What's Changed

• feat(core): add a live-session registry and qwen sessions ps by @qqqys in #8969
• feat(daemon): attach skill-toggle mutation metadata to settings_changed by @samuelhsin in #9051
• fix(ci): minimize new spam comments on creation by @yiliang114 in #9266
• fix(ci): drop pull_request_review events on closed PRs at the route gate by @wenshao in #9299
• feat: chain Terminal-Bench release evaluation by @DennisYu07 in #9120
• feat(web-shell): improve sidebar session management by @ytahdn in #9311
• feat(web-shell): decouple composer from catch-up and rebuild SSE on disconnected submit by @ytahdn in #9323
• fix(review): repair seven pipeline defects found by live runs by @wenshao in #9175
• fix(web-shell): keep foreground agent status on SSE by @ytahdn in #9330
• feat: support session media references end-to-end by @ytahdn in #9310
• feat(core): let a workflow agent pin a directory and outlive the default bounds by @qqqys in #8972
• feat(review): review shell and CI scripts against the lanes that run them by @wenshao in #9263
• feat(cli): add /advisor command for second-opinion conversation review by @yiliang114 in #7567
• feat(core): Add privacy-safe tool-result boundary diagnostics by @doudouOUC in #9039
• fix(cli): exclude disabled skills from context usage details by @callmeYe in #9346
• fix(core): align agent-team prompts and TeamCreate description with actual delivery by @yiliang114 in #9284
• feat(serve): Add workspace session live-state endpoint and catalog version by @doudouOUC in #9261
• feat: consolidate Local Control into one daemon-owned implementation by @yiliang114 in #9106
• fix(cli): Keep transient runtime record I/O retryable by @doudouOUC in #9362
• fix(cli): contain agent-tab render errors instead of exiting the session by @yiliang114 in #9292
• fix(cli): bound string width and code point caches (#2128) by @yiliang114 in #9185
• feat(autofix): seed the takeover round counter with /takeover from N by @wenshao in #9321
• fix(core): Clamp compression output budget to remaining context window by @ZijianZhang989 in #9109
• revert(web-shell): restore pre-#8098 composer animations at 50% opacity by @ytahdn in #9349
• fix(weixin): keep typing indicator alive during long turns by @yiliang114 in #9358
• feat(daemon): make serve new-file mode configurable (QWEN_SERVE_NEW_FILE_MODE) by @yiliang114 in #9364
• fix(ci): route the autofix convergence-brake handoff through failure.md by @wenshao in #9371
• fix(ci): make autofix busy detection fail closed and mark dispatched PRs by @wenshao in #9329
• feat(web-shell): support upload directory and hard-disable drag-in when fileUploadEnabled=false by @ytahdn in #9382
• feat(serve): add pollable daemon turn status by @BenGuanRan in #9080
• fix(cli): honour the declared enableCacheSharing default in both suggestion gates by @yiliang114 in #9233
• test(review): sync round-cap prose and pin the deferred coverage gaps (#9256) by @yiliang114 in #9258
• fix(core): dispatch manually assigned team tasks to their owner by @yiliang114 in #9289
• fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes by @yiliang114 in #9277
• feat(web-shell): Consume workspace session live-state by @doudouOUC in #9366
• fix(review): gate the recovered incremental anchor on the model that certified it by @wenshao in #9184
• fix(artifacts): verify and canonicalize record_artifact workspace paths by @zjgzx1988 in #9142
• fix(core): omit image media the model endpoint cannot safely consume (#9291) by @yiliang114 in #9295
• fix(memory): improve recall reliability and candidate coverage by @yiliang114 in #8716
• feat(review): Aone Code read path (second review-platform provider) by @wenshao in #9226
• fix(review): budget the composed body against GitHub's review limit by @wenshao in #9247
• fix(web-shell): use backend-authoritative queue state by @ytahdn in #9407
• fix(review): name each certification bar and defer degrade notes past admission (#9259) by @wenshao in #9272
• fix(devx): fail with actionable message when unit-test build prerequisites are missing (#9149) by @yiliang114 in #9171
• feat(webui): add global expand/collapse control to exported HTML viewer by @yiliang114 in #9367
• feat(review): enforce the resolved severity floor at the posting boundary by @wenshao in #9279
• feat(cli): plain-prose /review comments; severity markers follow review.attribution by @wenshao in #9027
• feat(triage): add a deterministic flakiness gate to sandboxed verification by @wenshao in #9130
• refactor(cli): remove superseded settings dialog helpers by @qqqys in #9379
• feat(review): resume an interrupted PR review from its on-disk state by @wenshao in #9092

Full Changelog: v0.21.13...v0.21.14-preview.0

Release v0.21.11-nightly.20260819.d87b272aec

What's Changed

• feat(core): add a live-session registry and qwen sessions ps by @qqqys in #8969
• feat(daemon): attach skill-toggle mutation metadata to settings_changed by @samuelhsin in #9051
• fix(ci): minimize new spam comments on creation by @yiliang114 in #9266
• fix(ci): drop pull_request_review events on closed PRs at the route gate by @wenshao in #9299
• feat: chain Terminal-Bench release evaluation by @DennisYu07 in #9120
• feat(web-shell): improve sidebar session management by @ytahdn in #9311
• feat(web-shell): decouple composer from catch-up and rebuild SSE on disconnected submit by @ytahdn in #9323
• fix(review): repair seven pipeline defects found by live runs by @wenshao in #9175
• fix(web-shell): keep foreground agent status on SSE by @ytahdn in #9330
• feat: support session media references end-to-end by @ytahdn in #9310
• feat(core): let a workflow agent pin a directory and outlive the default bounds by @qqqys in #8972
• feat(review): review shell and CI scripts against the lanes that run them by @wenshao in #9263
• feat(cli): add /advisor command for second-opinion conversation review by @yiliang114 in #7567
• feat(core): Add privacy-safe tool-result boundary diagnostics by @doudouOUC in #9039
• fix(cli): exclude disabled skills from context usage details by @callmeYe in #9346
• fix(core): align agent-team prompts and TeamCreate description with actual delivery by @yiliang114 in #9284
• feat(serve): Add workspace session live-state endpoint and catalog version by @doudouOUC in #9261
• feat: consolidate Local Control into one daemon-owned implementation by @yiliang114 in #9106
• fix(cli): Keep transient runtime record I/O retryable by @doudouOUC in #9362
• fix(cli): contain agent-tab render errors instead of exiting the session by @yiliang114 in #9292
• fix(cli): bound string width and code point caches (#2128) by @yiliang114 in #9185
• feat(autofix): seed the takeover round counter with /takeover from N by @wenshao in #9321
• fix(core): Clamp compression output budget to remaining context window by @ZijianZhang989 in #9109
• revert(web-shell): restore pre-#8098 composer animations at 50% opacity by @ytahdn in #9349
• fix(weixin): keep typing indicator alive during long turns by @yiliang114 in #9358
• feat(daemon): make serve new-file mode configurable (QWEN_SERVE_NEW_FILE_MODE) by @yiliang114 in #9364
• fix(ci): route the autofix convergence-brake handoff through failure.md by @wenshao in #9371
• fix(ci): make autofix busy detection fail closed and mark dispatched PRs by @wenshao in #9329
• feat(web-shell): support upload directory and hard-disable drag-in when fileUploadEnabled=false by @ytahdn in #9382
• feat(serve): add pollable daemon turn status by @BenGuanRan in #9080
• fix(cli): honour the declared enableCacheSharing default in both suggestion gates by @yiliang114 in #9233
• test(review): sync round-cap prose and pin the deferred coverage gaps (#9256) by @yiliang114 in #9258
• fix(core): dispatch manually assigned team tasks to their owner by @yiliang114 in #9289
• fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes by @yiliang114 in #9277
• feat(web-shell): Consume workspace session live-state by @doudouOUC in #9366
• fix(review): gate the recovered incremental anchor on the model that certified it by @wenshao in #9184
• fix(artifacts): verify and canonicalize record_artifact workspace paths by @zjgzx1988 in #9142
• fix(core): omit image media the model endpoint cannot safely consume (#9291) by @yiliang114 in #9295
• fix(memory): improve recall reliability and candidate coverage by @yiliang114 in #8716
• feat(review): Aone Code read path (second review-platform provider) by @wenshao in #9226
• fix(review): budget the composed body against GitHub's review limit by @wenshao in #9247
• fix(web-shell): use backend-authoritative queue state by @ytahdn in #9407
• fix(review): name each certification bar and defer degrade notes past admission (#9259) by @wenshao in #9272
• fix(devx): fail with actionable message when unit-test build prerequisites are missing (#9149) by @yiliang114 in #9171
• feat(webui): add global expand/collapse control to exported HTML viewer by @yiliang114 in #9367
• feat(review): enforce the resolved severity floor at the posting boundary by @wenshao in #9279
• feat(cli): plain-prose /review comments; severity markers follow review.attribution by @wenshao in #9027
• feat(triage): add a deterministic flakiness gate to sandboxed verification by @wenshao in #9130
• refactor(cli): remove superseded settings dialog helpers by @qqqys in #9379
• feat(review): resume an interrupted PR review from its on-disk state by @wenshao in #9092
• fix(review): clear the deferred-suggestion backlog from #9175's review rounds by @wenshao in #9342
• feat(ci): post autofix failure-path handoff comments bilingually by @wenshao in #9386

Full Changelog: v0.21.13...v0.21.11-nightly.20260819.d87b272aec