Qwen Code v0.25.3 Ships Snapshot-Isolated Child Agents and Persistent Kubernetes Workspaces
Qwen Code v0.25.3 goes stable with snapshot-isolated read-only child agents, CSI-backed Kubernetes workspaces that persist across sessions, and in-session approval-mode switching that keeps history and drafts.
Qwen Code v0.25.3 shipped as the new stable on October 19, 2026, cutting the managed-agent work that rode the v0.25.2 nightly train into a release the release bot marks Latest on the project’s releases index. The headline is not the version bump — it is that three operator problems in hosted agent fleets got concrete answers: children that cannot wreck the workspace, workspaces that survive session death, and approval modes that can be changed mid-flight.
Snapshot-isolated child agents
The marquee feature (#14265, by wenshao) lets hosted parent agents launch child agents against a frozen, read-only snapshot of the workspace. The child can read everything, but cannot change files, cannot run commands, and cannot affect the parent’s session. That is a different trust tier from a normal subagent: it is safe to fan out exploration — “summarize this module,” “check which callers break” — on a workspace that is mid-edit, because the child physically lacks the write and execute path.
For operators, this is the primitive that makes cheap-model research fan-out defensible inside a live workspace. You get the cost profile of a fleet of small readers without the blast radius. Paired fixes tighten the lifecycle around it: closing a parent session now stops each child’s running Turn (#14218), merges recorded on a snapshot run as discards (#14432), and hooks stay attached to snapshot children per the design docs (#14440). The pattern matches what we recommended in subagent orchestration guidance: read-only lanes for research, one owned write lane.
Workspaces that persist across sessions
The second pillar is durability. v0.25.3 adds resident Kubernetes Workspace file sessions (#14340) that retain an original Pod and a fixed CSI persistent volume claim, so a configured Workspace preserves its files across sessions instead of evaporating when the session ends. A workspace-resident Tool Runtime (#14435) serves bound sessions, and private CSI sessions attach to Hosted text turns (#14081). The direction continues the experimental Kubernetes CSI runtime previewed in v0.25.1-preview.0 — state lives in the cluster, not in the process.
The practical consequence: an overnight agent can be interrupted, restarted, or moved and still find its checkout, artifacts, and drafts where it left them. Supporting fixes target exactly the failure modes you would worry about — session close after a Harness restart now releases held Shell/Monitor runtimes (#13986), cancellation recovers after process restarts (#14377), and tenant-wide InnoDB locks no longer wedge unrelated sessions (#13918).
| Capability | What it gives operators | PR |
|---|---|---|
| Read-only snapshot children | Zero-blast-radius research fan-out | #14265 |
| CSI-resident Kubernetes Workspaces | Files survive session restarts | #14340 |
| Shell Full Access + mode switching | default/auto-edit/yolo without losing state | #14323 |
| AgentDefinition-managed sessions | Pinned Skills, MCP servers, Hooks | #14319 |
| Native macOS workspace runtime | Local parity beyond Linux/K8s | #14442 |
Managed sessions become first-class
Managed sessions created from published AgentDefinitions now load static Skills and pass pinned MCP server and Hook catalog selections to Hosted Runtimes (#14319), with the composer wired to those pinned Skills (#14602). The Web Shell’s home and sidebar support workspace creation, approval-policy and model selection, and per-session context usage (#14316). Approval changes are allowed in stored agent sessions (#14484), Plan mode and inline attachments work in managed sessions (#14531), and per-run automation cancellation landed (#14526).
The approval-mode change is the sleeper feature. Built-in Workspace-bound sessions can now switch between default, auto-edit, and yolo (plus a Shell Full Access tier) mid-session without losing history, workspace, or drafts (#14323). Previously, changing trust level effectively meant a fresh session; now an operator can run conservative, escalate for one trusted step, and drop back — a workflow permission-mode policy guides have been pushing harnesses toward.
Runtime breadth and onboarding
Two smaller changes matter for adoption. QwenCloud becomes the first /auth entry (#14073), matching the docs, which now steer first-launch users to QwenCloud as the recommended setup on a terminal-native tool with standalone installers for Linux, macOS, and Windows. And a native macOS workspace runtime (#14442) plus an SSH Tool Runtime (#14318) mean managed workspaces are no longer effectively Linux-and-Kubernetes-only.
The release reports no known breaking changes, and ships 14 release assets, including prebuilt archives for Linux, macOS and Windows (plus source bundles and the CLI loader script). Much of the changelog is fault-gate test infrastructure — dozens of FG-labeled gates covering MCP reply loss, Hook restarts, store failures, and crash recovery — which is the unglamorous evidence that the durability claims above are being tested, not just asserted.
Who should act
If you run Qwen Code fleets, v0.25.3 is the release where the managed-agent track becomes operationally interesting: snapshot children give you safe parallelism, CSI workspaces give you restart survival, and in-session mode switching removes the restart tax on escalating trust. Teams already on the 0.25.1 stable covered in our earlier report can upgrade in place; the Chinese CLI wave keeps compounding.
