Qwen Code 0.22.0

Original release notes

Highlights

Web Shell prevents out-of-memory crashes by bounding transcript retention and trimming oversized replays. (#9303)
Review loops now explain instability by citing specific files with recurring findings or non-shrinking comment volumes. (#9461)
Autofix now audits PR approach for simplicity instead of stopping automation immediately upon a growth-budget breach. (#9262)
Web Shell keeps conversation turns expanded while background shells run, collapsing them only after completion. (#9632)
Created GitHub PRs are now bound to originating sessions with a searchable list and sidebar badge. (#9543)
Non-blocking slash commands now include eleven built-ins like /theme and /tools for immediate execution during streaming. (#9495)

Breaking Changes

No known breaking changes.

Web Shell Experience

Improves Web Shell stability, UI responsiveness, streaming performance, and conversation handling during active sessions.

Web Shell now bounds daemon transcript retention and trims oversized replays to prevent renderer out-of-memory crashes. (#9303)
Web Shell now keeps conversation turns expanded while their background shells are running, collapsing them only after completion. (#9632)
Fixes web-shell UI so subagent prompts scroll correctly and parallel-agent groups collapse immediately upon completion. (#9640)
Adds a hover tooltip to the create-group icon in Web Shell to clarify its function for mouse users. (#9400)
Updates the conversation loading indicator to use the daemon's hasActivePrompt state, ensuring it remains visible during long tool calls even when streaming is idle. (#9631)
Prevents the Web Shell tool-approval dialog from stealing keyboard focus when it appears while the user is actively typing in an editable element. (#9609)
Optimizes Web Shell streaming performance by reducing main-thread work and reloading oversized transcripts after 15 seconds of inactivity. (#9672)
Routes ordinary Web Shell messages based on session activity rather than Goal status to improve turn handling and insertion logic. (#9667)

Review & Autofix Logic

Enhances review loop explanations, Autofix auditing, convergence observations, and PR detection to reduce noise and improve automation reliability.

Review loops now explain why they are not settling by citing specific files with recurring findings or comment volumes that are not shrinking. (#9461)
Autofix now audits the PR approach for simplicity and minimal change instead of stopping automation immediately upon a growth-budget breach. (#9262)
Fixed autofix busy-PR detection to include pending workflow runs, preventing duplicate dispatches caused by GitHub status reporting delays. (#9662)
Adds machine-readable convergence observation codes like root-cause-triage and batch-fixes to enable automated review actions. (#9623)
Assigns review agents a dedicated subagent type with only six required tools to reduce token usage and improve performance. (#9678)
Adjusts review body trimming priority to preserve convergence observations about finding rates until all other advisory content is dropped. (#9715)
Extends the /review skill cleanup audit to Aone Code targets, flagging comments or edits made within the review window that were not submitted via the sanctioned path. (#9633)

Aone & GitHub Integration

Fixes Aone AGit-Flow caching, presubmit checks, and comment handling while binding GitHub PRs to sessions for better traceability.

Fixed incremental review caching for Aone AGit-Flow CRs by computing diffs between local heads instead of relying on ancestry tests that fail after amendments. (#9630)
Enabled /review presubmit on Aone targets to detect self-MRs and head drift by routing through the a1 CLI and comparing author identity. (#9629)
Updated /review --comment output on Aone targets to explicitly disclose that posted comments are unmarked and only join the generic discussion gate. (#9625)
Binds created GitHub PRs to their originating sessions with a searchable list and sidebar badge, supporting up to 10 PRs per session with latest-first ordering. (#9543)
Fixes Aone review support by generating canonical PR links directly from the platform and updating test-plan routing and version floors. (#9624)
Clears deferred Round-5 findings on the Aone write path, ensuring empty --host arguments fail distinctly and test pins correctly guard regressions. (#9604)
Adds a secure fallback path for installing public GitHub extensions on older Git versions by resolving commits via GitHub's anonymous API and downloading archives directly. (#9680)

Slash Commands & Tools

Expands non-blocking slash commands, stabilizes menu selection during streaming, and restores interactive HITL prompts on session resume.

Extends non-blocking slash commands to eleven built-ins like /theme and /tools, allowing immediate execution during streaming. (#9495)
Stabilizes slash-command menu selection while a response streams by preventing unnecessary re-runs of the suggestion search due to unrelated context updates. (#9508)
serve: restore ask_user_question HITL on session load/resume (#9665)
Integrates import widening logic into fetch-pr --since to streamline incremental scope calculation and reduce token usage. (#9332)

Security & Dependencies

Patches high-severity CVEs, secures sandbox images against tampering, and enforces stricter dependency and workflow security gates.

The sandbox image is now bound to its specific pulled digest to prevent tampering via mutable tags between resolve and consumption steps. (#9527)
Upgraded dependencies including OpenTelemetry 0.221.x and markdown-it 15 to resolve high-severity CVEs and enforced the security gate as a hard block. (#9584)
Bumps vulnerable dependencies including tar, protobufjs, dompurify, and echarts to patched versions to resolve CVE audits without changing code or package ranges. (#9703)
core: make list_directory opt-in (disabled by default) (#9424)

SDKs & Permissions

Updates Python and Java SDKs to support auto permission mode, aligning tool call approval behavior across all client libraries.

Updates Python and Java SDKs to support the auto permission mode, aligning them with the CLI and TypeScript SDK for LLM-based tool call approval. (#9003)

CI & Artifact Handling

Corrects CI fallback comments, fixes artifact download logic for Office files, and stabilizes verification gates with proper environment variables.

The CI fallback comment no longer incorrectly claims a review failed when the same run successfully posted a review earlier. (#9462)
Fixed artifact handling to expand recorded directories into per-file downloads while skipping hidden or junk files, and ensured Office documents download directly. (#9395)
Restores CI=true to autofix verification-gate launches to prevent test flakiness caused by missing environment variables in clean child processes. (#9649)
Excludes idle watchdog timeouts from the cumulative timeout cap so they no longer block PRs while remaining visible in logs. (#9673)

General Fixes

Addresses miscellaneous bugs including session recovery races, review body trimming, and daemon state synchronization issues.

Fixes session recovery across archive races by prioritizing active storage copies for REST, daemon ACP, and embedded ACP load operations. (#9513)
Removes root barrel self-imports in packages/core and adds an ESLint rule to prevent circular dependencies and enforce architecture boundaries. (#9635)
Refactors acp-integration and serve internals to enforce dependency boundaries with no intended behavior change for users. (#9144)
Moves the push-and-report workflow logic to a separate shell script to reduce YAML size while maintaining execution security. (#9653)
Adds translated Unset entries to all nine CLI locale dictionaries for consistent settings dialog display across languages. (#9714)
review: report the address a drive's service actually bound (#9655)

Other Changes

Release CI now disables install scripts during dependency installation and requires core maintainer approval for security-checks workflow changes. (#9577)
Corrected workflow comments to accurately state that the self-hosted ECS pool supports container runtime execution. (#9575)
Documents a new design for autofix that isolates trusted publishing steps from untrusted code execution to enhance security. (#9525)
Documents how inline terminal image previews render, including limits, fallbacks, and session-resume behavior. (#8656)
Documents the experimental Session Workflow setting, covering its default state, live updates, and Web Shell presentation. (#8554)
Documentation updated to clarify that autofix checks are derived strictly from patch text and to outline sequencing constraints for issue-autofix. (#9652)
autofix: add an operator guide for /takeover from N (#9622)
Corrects the autofix round-seed guide to clarify that any leading whitespace, including spaces, tabs, or newlines, prevents command recognition. (#9663)
Documents architectural invariants classified by enforcement mechanism including ESLint rules, tests, and tsconfig settings. (#9689)

Web Shell (#9303)
(#9461)
Autofix PR , (#9262)
Web Shell shell , (#9632)
GitHub PR , (#9543)
/theme /tools , (#9495)

Web Shell

Web Shell UI

Web Shell , (<a href="https://github.com/QwenLM/qwen-code/pull/9303" data-hovercard-type="pull_requ