Qwen Code v0.26.2: Session Permission Rules, a Durable Mid-Turn Queue and Unattended autofix-pr
Qwen Code v0.26.2 adds per-session permission rules with Auto approval, a durable mid-turn message queue and unattended autofix-pr watches - plus one Web Shell break.
Qwen Code v0.26.2 landed on the stable channel on October 27, and it is not routine patch churn. It changes three things fleet operators actually feel: how permissions are granted in managed sessions, what happens to messages typed while an agent is mid-turn, and whether an /autofix-pr watch needs a human sitting in the loop. It also carries one breaking change. The release notes enumerate roughly 150 changes; the four below are the ones that change how you run the tool.
What is actually new
| Change | What it means for operators | Evidence |
|---|---|---|
| Session permission rules and Auto approval (#15448) | Per-session grant policy instead of one global mode, so a fleet can scope what each managed session may do | v0.26.2 notes |
| Durable mid-turn message queue (#15449) | Text and file references typed during a Managed Turn are queued durably and can be delivered, edited, withdrawn or resumed | v0.26.2 notes |
| Unattended /autofix-pr (#15548, #15578, #15510) | A confirmed watch runs its fix agent in the background; /autofix-pr status lists watches and can resume one in a later session | v0.26.2 notes |
| External-scratch Runtime provider (#15261) | An operator-run HTTP service can place Session workers while attestation and recovery are preserved | v0.26.2 notes |
Permissions stop being all-or-nothing
The headline feature, feat(managed): add session permission rules and Auto approval (#15448), moves managed sessions from a coarse approval mode toward rules attached to the session itself. That is the same direction the industry has taken - GitHub Copilot’s Assisted Permissions and Claude Code’s permission modes, which we covered in one house dialect for permission modes, both converged on scoped, per-context grants - and it is what makes unattended lanes survivable. The release notes also record the plumbing that followed: schema permission-rule columns (#15455, #15469) and self-contained Web Shell permission-rule declarations (#15501), which tells you the rules surface in the Web Shell UI, not just the API.
Auto approval is the half to treat carefully. An auto-approving session is only as safe as the rules constraining it, so the practical move after upgrading is to write the session rules first, then enable Auto approval on a low-risk session and confirm the rule actually blocks what you expect before pointing it at production paths.
Messages typed mid-turn stop disappearing
#15449 adds a durable queue for messages sent during a Managed Turn: queued text and file references can be delivered, edited, withdrawn or resumed safely. Anyone who has typed a correction while an agent was three tools deep into a wrong approach knows the failure mode this fixes - the input either vanished or arrived as an untimely interrupt. Durability here also means the queue survives resume, which pairs with the release’s broader recovery work (native snapshots and HTTP recovery #15569, local journal snapshot recovery #15626).
autofix-pr watches run without a babysitter
Three changes compose into one capability: a confirmed watch’s fixes can run unattended (#15548), an unattended watch’s fix agent runs in the background (#15578), and /autofix-pr status lists all watches in a clone and resumes one in a later session (#15510). Web Shell watches also persist as durable tasks that survive idle session reclamation and appear in Scheduled tasks (#15523). Combined with the new session permission rules, this is the machinery for an overnight CI-fixing lane - but it is exactly the unattended trust tier that deserves an explicit policy, not a default. Note also #15506: the CLI refuses to start a watch from a checkout that cannot run it and reports the required working directory, which is a better failure than a silent hang.
The breaking change
fix(managed-agent)!: simplify Web Shell controls and retire cwd submissions (#15616) is the one flagged break. If you have automation that submits a working directory to the Web Shell, that path is gone in v0.26.2. Audit those integrations before upgrading; the related new surface is a Git URL source in the Add-workspace dialog (#15361) that clones a repository and opens it as a workspace in the browser, plus managed extra workspace directories in Settings (#15393).
Same-day trains: preview and SDK
Two same-day releases bracket the stable one. v0.26.3-preview.0 (Oct 27, 19:08) is small: opt-in memory extraction cadence after a no-op run (#13571), shrinking tool results to the headroom left before auto-compaction (#13599), and Generated UI retention across same-page navigation (#15611). It is preview churn, not a reason to skip the stable release. SDK TypeScript v0.1.24 (Oct 27, 16:08) bundles CLI 0.26.2 built from the same branch, so SDK consumers inherit everything above. The releases index shows the full train back through v0.26.1. For recent context, v0.26.0 added daemon control commands and revocable Web Shell pairing, and v0.25.3 shipped snapshot-isolated child agents and Kubernetes workspaces - both pieces of foundation this release builds on.
Upgrade order
- Find and fix any Web Shell cwd-submission automation (#15616) - it breaks on contact.
- Write session permission rules for your managed sessions; test that a rule blocks what it should (#15448).
- Enable Auto approval on one low-risk session, then expand.
- Convert one human-supervised /autofix-pr watch to unattended (#15548) and verify it resumes in a later session (#15510).
The mid-turn queue needs no configuration - it is the quiet quality-of-life fix you will notice the first time you interrupt a running agent.
