Qwen Code Desktop 0.26.3

<!-- Release notes generated using configuration in .github/release.yml at eeee1443a7e36ab22b2f1dcded8dec64b621a7ee -->

What's Changed

• feat(managed): add session permission rules and Auto approval by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/15448

• fix(cli): harden serve token resolution against project env injection by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15228

• feat(core): add an experimental shared agent loop and run headless on it by @qqqys in https://github.com/QwenLM/qwen-code/pull/15369

• fix(cli): align OpenTUI cancellation and retry with Ink by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15283

• test(managed-agent): assert web_fetch in the Hosted workspace gate fixture by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15451

• fix(vscode): leave edit mode after a refused edit by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15439

• fix(rewind): resolve legacy turns by source identity by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/13737

• test(cli): cover remaining Managed Workspace activation refusals by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/15460

• fix(managed-agent): retire registered zombies before startup waits by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/15459

• feat(core): attribute 千问AI平台 / QwenCloud requests with the source-config header by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15041

• fix(cli): preserve arrival order of direct-mode stream-json startup messages by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15378

• fix(managed-agent): restore the module and cli lanes after #15448 by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15455

• test(managed-agent): correct the CSI inventory column count after #15448 by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15469

• docs(design): fix first-run scheduled-task gate examples by @sxl-lucky7 in https://github.com/QwenLM/qwen-code/pull/15452

• test(managed-agent): retry the team-lead boot past the harness port race by @qwen-code-dev-bot in https://github.com/QwenLM/qwen-code/pull/15224

• feat(cli): preserve OpenTUI session replay and rewind by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15384

• fix(cli): preserve checkpoint restore ownership and cold continuation by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15386

• feat(cli): capture and restore complete OpenTUI checkpoints by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15389

• fix(cli): run OpenTUI on private Bun 1.4.4 by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15387

• test(ci): pin the disk-pressure collector revision and FULL_PAYLOAD run bodies by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15475

• fix(ci): file main CI failures whose successor has not settled by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15471

• test(integration): pin removeScratchDir retry budget with a mutation witness by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15488

• test: capture expected disk-full logs by @EthDing in https://github.com/QwenLM/qwen-code/pull/8549

• fix(web-shell): keep permission rule declarations self-contained by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15501

• fix(cli): preserve OpenTUI clipboard source across draft recovery by @chiga0 in https://github.com/QwenLM/qwen-code/pull/15396

• fix(hosted): preserve primary MySQL isolation failures by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15505

• fix(cli): stop double-counting reasoning tokens in cost estimates by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15464

• fix(release): bound summary concurrency and refresh release PRs by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15500

• fix(web-shell): Prevent duplicate Managed composers by @doudouOUC in https://github.com/QwenLM/qwen-code/pull/15496

• fix(serve): probe X11 display reachability before advertising the native directory picker by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15434

• test(managed-agent): wait for worker exit visibility by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15503

• ci(sdk-java): preserve failure reports and SQL causes by @Aling33 in https://github.com/QwenLM/qwen-code/pull/14910

• test(ci): pin JUnit report upload paths by @barry166 in https://github.com/QwenLM/qwen-code/pull/15502

• fix(test): budget the standalone runtime suite for the release pool by @qwen-code-dev-bot in https://github.com/QwenLM/qwen-code/pull/15102

• feat(managed-agent): pool the automation scanner's rows and lease from the claim time by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15442

• test(cli): budget hosted approval waits for slow runners (#15176) by @qwen-code-dev-bot in https://github.com/QwenLM/qwen-code/pull/15183

• fix(cli): refuse an autofix watch a daemon cannot run by @wenshao in https://github.com/QwenLM/qwen-code/pull/15506

• feat(generated-ui): continue analysis with reviewed parameters by @qqqys in https://github.com/QwenLM/qwen-code/pull/15333

• fix(web-shell): simplify status when loading phrases are hidden by @deggs7 in https://github.com/QwenLM/qwen-code/pull/15423

• fix(ci): keep the incremental lint history fetch blobless and visible by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15511

• test(cli): budget the hosted approval wait for loaded runners (#15093) by @qwen-code-dev-bot in https://github.com/QwenLM/qwen-code/pull/15101

• feat(runtime-broker): add HTTP-backed external scratch workers by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15261

• fix(ci): preserve independent validation for main push SHAs by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15508

• fix(release): authenticate managed OSS preflight by @yiliang114 in https://github.com/QwenLM/qwen-code/pull/15504

• feat(verify-pr): declare an argument hint for the command prompt by @wenshao in https://github.com/QwenLM/qwen-code/pull/15463