Qwen Code v0.27.4: Managed Sessions Get Granted Directories and a Web Terminal, and Auto Mode Demands Explicit Authorization

Qwen Code v0.27.4 landed on GitHub on 15 November 2026 at 07:04 UTC. On the surface it is a maintenance release: no known breaking changes, 18 commits on the release branch, the usual sweep of dependency security bumps. Two changes inside it are not maintenance. Managed Agent sessions can now reach directories the browser user grants them and open an interactive Managed Web Terminal, and Auto Mode now asks whether you explicitly authorized a risky action rather than whether it merely looked related to what you asked for. The overview still describes a terminal-first, scriptable agent that runs headlessly for CI. What moved is the boundary: how far a managed lane may reach, and what it may do unattended.

What shipped

The release notes group the work into six headline bullets, and the GitHub API record confirms a full, non-prerelease build published at 2026-11-15T07:04:40Z with cli.js, native archives and a SHA256SUMS file.

Change	Who it affects	Consequence
Local directory grants for managed sessions (#16844)	Managed-agent operators	A session edits the granted working tree, no stored paths
Managed Web Terminal (#16866)	Managed-agent operators	A terminal attaches to a live session over a short-lived ticket
Auto Mode authorization and timeouts (#16858, #17146, #17127, #17100)	Auto Mode users	Risky means authorized, not merely relevant; a timeout earns one review
Feishu and WeCom webhook delivery (#17012, #17013, #17223, #17224, #17002)	IM routing teams	Long replies arrive as ordered segments, not truncated

The managed-session half: granted directories and a live terminal

Two pull requests carry it. The first registers the browser user’s filesystem into managed sessions through temporary directory grants, with no persisted credentials or paths. The second adds an interactive Managed Web Terminal that authenticates a WebSocket connection with a short-lived ticket and keeps the runtime alive while attached.

The consequence: a managed session no longer needs a copy of your repository to touch your working tree. Nothing durable is written back to the grantor.

Both features were visible before the stable tag: the same two pull requests appear in the nightly pre-release v0.27.2-nightly.20261113.6f754be654 on the releases page, published 14 November. v0.27.4 is the first stable tag that carries them.

The caveat is deployment shape. The Managed Agent reference deployment guide calls the distribution experimental. Its Tier 2, which adds local-process tools, requires a registered Workspace, native storage registration and mount-identity verification before file or Shell work is admitted, so this is not a default on a fresh install.

The Auto Mode half: relevance becomes authorization

Auto Mode sits between Auto-Edit and YOLO. The Auto Mode reference documents three layers, in order: an acceptEdits fast path for workspace edits, a safe-tool allowlist for read-only built-ins, and a two-stage LLM classifier for everything else. Stage 1 is a fast model returning a block flag in roughly 300 milliseconds; Stage 2 is a thinking review that runs only when Stage 1 blocks.

Auto Mode permission checks now judge explicit user authorization, especially for destructive, discarding, shared-history or bulk actions, rather than mere relevance. In an unattended lane that matters: judging relevance can clear something nobody asked for; judging whether the user asked for this exact thing asks a stricter question.

It lines up with a hint category the docs already describe. A softDeny entry blocks destructive or irreversible actions unless the user’s most recent explicit request asked for that exact action and scope; a generic yes-do-whatever does not count. The v0.27.4 change makes the default path behave more like a soft deny than a relevance test.

{
  "permissions": {
    "autoMode": {
      "hints": {
        "allow": ["Running pytest against the local test suite"],
        "softDeny": ["Deleting files or dropping a branch unless I ask for that exact removal"],
        "hardDeny": ["Reading anything under ~/.ssh or ~/.aws"],
        "environment": ["This is a private monorepo with signed commits"]
      },
      "classifyAllShell": true
    }
  }
}

Three smaller entries carry their own cost. A fast-classifier timeout now earns one complete session-model review before the action falls back to manual approval, but only when the fast and session model identifiers differ; with the default budgets that can add 30 seconds to a single tool call. Auto Mode also stopped resolving HTTP(S) URLs as filesystem paths, removing Windows lookup delays that could kill a session before a request started. And when Full Access (yolo) is active, the Web Shell composer renders the mode trigger in the destructive color.

Hard rules still apply underneath. permissions.deny blocks before the classifier runs, permissions.ask forces manual confirmation even in Auto Mode, and over-broad allow rules such as Bash(*) are stripped while Auto Mode is active. After three consecutive blocks, or two consecutive classifier outages, the call falls back to the manual prompt.

What to do this week

If you run managed sessions, grant a directory per task instead of mounting a repository permanently, and put the reference deployment’s storage registration and mount-identity verification ahead of your first tool-enabled session. If you run Auto Mode, treat the authorization change as a policy edit: write softDeny entries for the destructive operations your lanes attempt, expect a possible 30-second stall on classifier timeouts, and check that your fast and session model identifiers differ if you want the session-model review to fire.

We covered the v0.27.2 channel and Mods release earlier, and the 1.0 Preview that merges Qoder and Qwen Code is the bigger structural story behind this patch line. The same operator question appears elsewhere: Claude Code’s sandboxed Bash default, GitHub Copilot’s assisted permissions at GA and Managed Permissions Users Cannot Override.