feat(web-shell): inspect session tool calls by prompt - #12466

Post-merge E2E report

Commit: d10c76801c30a743674ac5b53e2833e16b1a9648. Chromium frontend E2E: 2/2 passed, light and dark, no page errors.

• Verified entry, localized descriptions, statuses including cancelled 0ms, recorded start/end tooltip, MCP filtering and 11px badge, separate JSON arguments/results, explicit Refresh and browser reload restoring the open panel and durable prompt identity.
• Explicit Refresh added exactly one tool-calls read in each theme. This capture pass did not test a live-running clock.
• Actual merged Web Shell rendered synthetic events and deterministic history responses from a mock daemon. This does not validate real tool execution, real daemon persistence, MCP authentication or Git backend operations.
• Screenshots were visually inspected and stored separately from the implementation on ytahdn/qwen-code:assets/web-shell-turn-calls-panel, fixed commit 16b4d185237849a2438054e0d50cf45f2695f8b2.

Full browser report

Build and unit validation

• Frozen-lockfile install, full build/bundle, root typecheck and commit-hook formatting/ESLint passed.
• 4,510 scoped checks passed: Core 586; ACP replay 136; SDK 878; Web Shell 1,676; CLI Session/replay/telemetry/read helpers 1,231; new tool-calls route cases 3. Duplicate reruns are not included in this total.
• The first broad server run was invalidated by sandbox restrictions on binding local ports. Outside that sandbox, full-file runs completed with 1,321/1,322 and 1,319/1,322 passing respectively. Failures moved between a legacy resume status assertion, a socket hang-up, an unarchive authentication assertion and a request-rejection status assertion. The original legacy load/resume cases passed 2/2 in isolation, and the original failing resume case passed on the second full run.
• A single comparison using the original origin/main (c83265ff36) server test and session route in a temporary import-preserving overlay passed 1,319/1,319. It reused current built dependencies; this was not a clean checkout build. Therefore this does not establish an existing main failure, nor does it establish a deterministic regression in this feature. The full server suite is explicitly not reported as consistently green; this broader HTTP-test instability remains unresolved. No unrelated source changes were made to silence it.

Maintainer verification: real daemon, real tool execution, Linux (d10c768)

Verdict: I'd merge after one small client fix, or with it as an immediate follow-up. The new server read is correct end to end. Against a real qwen serve daemon, its results match the raw JSONL call-for-call across 217 real tool calls, including after a daemon restart. The recorded timings check out against wall-clock. The panel works in the production Web Shell build. I found one defect, on the path users hit most often: the client that sent the prompt. If you open Tool calls from your own message, the tab has no durable identity. That prompt appears twice in the prompt selector, the tab is never persisted, so a page reload closes the panel, and no history read happens after the turn settles. The root cause is below, along with a 12-line fix and two tests. I verified the fix in the same browser rig.

What holds (verified by execution)

Defect: a tab opened from your own message has no durable identity

Repro: send a prompt from the composer, then click View tool calls on that message, either while it runs or after.

A second client watching the same session behaves correctly on head: it gets promptId from the bridge echo. So this only affects the sender, which is the common case.

Root cause. The sender's own user echo is suppressed (suppressOwnUserEcho). As DaemonSessionProvider.tsx:362-364 notes, that local block never gets a recordId, and the tab that App.openTurnCalls builds from it ends up with neither recordId nor promptId. The persisted state proves this: serializeArtifactPanelTabs drops exactly such tabs. The backfill effect in App.tsx waits for sourceRecordIds that never arrive on this block. In TurnCallsPanel, the selector falls back to a synthetic block:<turnId> entry next to the provisional prompt:<id> one, and the history effect is gated on the recordId/promptId props. The provisional navigation turn already knows blockId → promptId (from recordPromptAdmitted), so the panel can adopt it.

--- a/packages/web-shell/client/components/artifacts/TurnCallsPanel.tsx
+++ b/packages/web-shell/client/components/artifacts/TurnCallsPanel.tsx
@@ -492,6 +492,18 @@ export function TurnCallsPanel({
   const idle = usePromptStatus() === 'idle';
   const navigation = useTurnNavigationState();
   const blocks = useTranscriptBlocks();
+  // The sender's own live user block never carries a record or prompt id: its
+  // daemon echo is suppressed. Adopt the prompt id from the provisional turn
+  // bound to this block so the tab can persist, resolve and dedupe.
+  const provisionalPromptId =
+    !recordId && !promptId
+      ? navigation.provisionalTurns.find((turn) => turn.blockId === turnId)
+          ?.promptId
+      : undefined;
+  useEffect(() => {
+    if (provisionalPromptId)
+      onSelectPrompt?.(turnId, undefined, provisionalPromptId, promptLabel);
+  }, [provisionalPromptId, onSelectPrompt, turnId, promptLabel]);

Non-blocking notes

1. The wrapped MCP call (tool_search → tool_call): the row name resolves to mcp__inventory__lookup_sku, but the description line reads tool_call and Arguments show the {name, arguments} envelope. The design doc says wrappers resolve their actual name and arguments. See the right pane of figure 3.
2. English count grammar: 1 tool calls.
3. The tooltip's "Start time" is when scheduling started, so it includes the approval wait (design-stated). On an approved call it reads earlier than the command actually began. A wording hint could help.
4. Test coverage of session-tool-calls.ts: 18 targeted mutants run against its own test file, 11 killed. The one real gap is "never finalize dangling calls of a settled turn". The unit tests don't pin it, but the real-daemon crash case above shows the behaviour is correct. The other survivors are defense in depth: the reader already rejects bad anchors (400 on the real daemon), ownership closes at the next navigation record anyway, and the pagination loop ends through another bound.
5. The triage bot left two questions for a maintainer. The Test result is now green, and server.test.ts passes locally as a full file. For the unvirtualized selector question, I measured a real long session: on a 4,227-turn session, opening the selector issues 17 turn-index page reads and renders all 4,227 options: about 18.7k DOM nodes and a ~104 MB page heap, usable after ~1.3 s. So it is reachable and still tolerable at that size, but it grows linearly. The 25k ceiling would be about 6× this.

Not covered: Windows/macOS, the agent detail tab contents, MCP auth, and an embedded host with showToolCalls=false restoring a persisted tab (triage finding 4).

Evidence (harness, raw ground-truth diffs, logs, figures): wenshao/qwen-code@823ef47/pr-12466

🤖 Generated with Claude Code — Claude Opus 5 (1M context)

Review follow-up

Fixes pushed in 0ad95657ea and 6f68391f00. Verified the findings against d10c76801c and reproduced the functional defects before fixing them. Duplicate review comments are grouped below.

R1-4 is not established as a regression of this PR. The actual Linux test job for the reviewed SHA passed (360 Web Shell files / 9,536 tests, no unhandled exception in that log). A strict local TrajectoryPanel run also passed 21/21. An isolated probe confirms an existing virtual-core debounce cleanup gap, but that dependency, virtualizer and triggering test are unchanged from the base. No unhandled-error suppression was added; the dependency cleanup issue should be tracked separately.

R1-25’s proposed early stop is not safe: records after the navigation ownership boundary can contain late results/timing for calls that started before it. The replay must continue to the next ordinary prompt boundary, within the existing explicit scan limits.

Fixed discussions are replied to and resolved; partially addressed and deferred discussions remain open.

Remaining suggestions are deferred to avoid further broadening this already extensively reviewed feature: nested-emitter timing coverage/wiring (R1-16/18), SDK cancellation/timeout options (R1-28), additional coverage-only cases (R1-13/17/19–24/26/27/29–32/38–41/50/56), and cleanup/polish (R1-34/35/37/49/55/57). In particular, the file action remains available on collapsed rows as explicitly requested; per-file availability-check coalescing is a follow-up. Fresh real-daemon verification of the originally reported large sessions is still pending, not claimed here.

Validation this round: 1,663 scoped unit tests passed across the most recent focused runs (Web Shell/App 1,491; ACP replay 138; persisted-reader/SSH tests 34). Independent reproductions retain failing snapshots of the original head and passing probes of the fixes. Full build/typecheck/bundle passed during the fixes; final Web Shell build/typecheck and changed-file ESLint/Prettier checks passed. Chromium mock-daemon E2E passed in light/dark themes (2/2); screenshots were visually checked and updated on the separate assets branch. These screenshots do not claim real daemon execution or Git backend validation. Updated E2E report. The final storage-only follow-up also passed its red/green App regression, Web Shell build/typecheck and commit hooks.

中文：已修复确认的功能、计时、数据保真、归属和性能问题，并补充回归验证。未证实的 CI 归因没有用忽略异常绕过；必须读取的跨边界迟到结果仍然保留。其余覆盖率、重构、嵌套计时扩展与界面微调建议按上表留作后续，避免继续扩大本 PR。截图使用模拟 daemon，真实大会话的新一轮执行验证仍未宣称完成。

Maintainer verification, round 2: real daemon, Linux (6f68391)

Follow-up to my round 1 report at d10c768. Only the delta is covered here.

Verdict: the same as round 1. I'd merge after one small client fix, or with it as an immediate follow-up. The follow-up commits hold up against a real daemon. The server read is byte-identical to round 1 across 4,262 turns. The new prompt selector cuts the cost on a 4,227-turn session from 18.5k DOM nodes / 104 MB to 1.6k / 38 MB. Persisted dock state no longer carries prompt text. But the round-1 finding is only half fixed. The duplicate selector entry is gone, because entries are now keyed by ordinal. When the sender opens View tool calls on their own message, the tab still has no durable identity. It is never persisted, so a reload closes the panel. No history read happens after the turn settles. The selector shows no check mark. That finding wasn't in the author follow-up table (that table maps /review findings), so it may simply have been missed. Below is an 18-line fix against the new code, with three tests. I verified it in the same browser rig.

What I checked

The remaining defect: the sender's tab has no identity

Repro: send a prompt from the composer, then click View tool calls on that message, either while it runs or after it finishes.

Why round 1's root cause still applies: the sender's own user echo is suppressed, so that local block never gets sourceRecordIds or promptId. App.openTurnCalls therefore creates a tab with neither id. serializeArtifactPanelTabs drops it, the history effect is gated on selectedRecordId || promptId, and TurnCallPromptSelect receives recordId/promptId both undefined, so it never matches its selected row. The navigation store already knows this block's identity. While the turn runs, it is provisionalTurns[].blockId → promptId. After the turn settles, it is a live locations entry, blockId → turnId. The fix adopts that identity through the existing onSelectPrompt:

   const selectedPromptId = promptId ?? user?.promptId ?? indexedTurn?.promptId;
+  // The sender's own live user block never carries a record or prompt id: its
+  // daemon echo is suppressed. Adopt the identity navigation already tracks
+  // for that block so the tab can persist and read history once settled.
+  const adoptedPromptId =
+    recordId || promptId
+      ? undefined
+      : navigation.provisionalTurns.find((turn) => turn.blockId === turnId)
+          ?.promptId;
+  const adoptedRecordId =
+    recordId || promptId || adoptedPromptId
+      ? undefined
+      : [...navigation.locations.values()].find(
+          (location) => location.view === 'live' && location.blockId === turnId,
+        )?.turnId;
+  useEffect(() => {
+    if (adoptedPromptId || adoptedRecordId)
+      onSelectPrompt?.(turnId, adoptedRecordId, adoptedPromptId, promptLabel);
+  }, [adoptedPromptId, adoptedRecordId, onSelectPrompt, turnId, promptLabel]);

There are three tests: the running block adopts promptId, the settled block adopts recordId, and a tab that already has an identity is not retargeted. The test mock also gains locations. On 6f68391 the first two fail. With the fix all pass. TurnCallsPanel + App: 1,107/1,107. ESLint --max-warnings 0, Prettier, and web-shell tsc --noEmit are clean. Full patch: fix-sender-identity-r2.patch.

Selector on the real 4,227-turn session

Non-blocking notes

1. R1-2 doesn't reach the real failure path. A real foreground subagent failure (the model returns 400) is recorded as a successful tool result carrying resultDisplay.status: "failed" and terminateReason: "Failed to run subagent: 400 …". On the wire it is tool_call_update with status: "completed", so the new status === 'completed' guard still strips its content. Both heads return identical bytes here. No diagnostic is lost: terminateReason survives in rawOutput. But the panel shows a green Completed with no reason (fig. 3). The chat transcript doesn't flag it either, so this is pre-existing ACP status behaviour. The new panel makes it look more authoritative, though. Reading rawOutput.status === 'failed' for task_execution rows would fix the badge.
2. The selector re-requests a page while it is still in flight. In 2/2 runs, the mid-list scroll fetched start=2000 twice. missingPages goes from "1800,2000" to "2000" when the first page lands, the effect reruns, and loadOrdinal doesn't dedupe in-flight loads.
3. Keyboard focus doesn't follow wheel scrolling. After scrolling the list with the mouse, aria-activedescendant is null and PageDown→Enter re-selects the old off-screen item (Upgrade @agentclientprotocol/sdk from 0.14.1 to 0.21.0 to unlock 3 session lifecycle methods (resumeSession / closeSession / unstable_forkSession) #4227). Clicking works.
4. Still open from round 1 (the author deferred these as polish): the wrapped-MCP Arguments envelope and 1 tool calls.

Not covered: the SSH-workspace GET allowlist (R1-1) and goal-runtime replay marking (R1-7) were checked by unit tests only, and so was the diff truncation (R1-51/52). Windows/macOS were not covered.

Evidence (harness, per-turn diffs, API dumps, images): wenshao/qwen-code@d7b8cc9/pr-12466-round2

🤖 Generated with Claude Code — Claude Opus 5.5 (1M context)

Sender identity and new inline review follow-up

Fixed in 5aad27e6db. The sender-path defect was missed in the previous follow-up. A locally sent user message has no echoed promptId/record UUID, so checking only the transcript block was insufficient. The panel now adopts the identity already tracked by navigation: the admitted prompt while running, or the live record after settlement. This uses the existing selection callback so the dock persists the identity and the picker/history reader receive the same selection. Existing identities and foreign-session tabs are not retargeted.

The three new inline comments were also addressed:

• Losing the workspace client clears the pending loading flag, so Refresh is not stranded disabled; stale completion remains ignored.
• Approved starts go through the shared emitter. Prepared calls get updates; unprepared calls get creating frames with title/kind/locations/provenance/server metadata. Delivery failures remain non-fatal and the post-notification cancellation check remains. The permission request already carries the call ID, so the claim that the client could never have seen the ID was too broad; the metadata and consistent-emitter issue was valid.
• Prompt-ID recovery uses the shared 200-entry index page size, including backward offsets and the short final page.

Regression checks failed before the fixes. Sender App tests cover both running and settled opening, stable identity persistence, checked selection, one history read at settlement, and restored content after reload. Panel tests also cover retained live rows, identity/owner guards, loss of client, and index page boundaries. Session tests exercise prepared/unprepared approved MCP metadata before execution and preserve notification-failure execution behavior.

Browser E2E

Verified the actual sender path in Chromium against the locally built real daemon and bundled Web Shell, with a local scripted OpenAI-compatible model and real shell/glob execution in an isolated temporary workspace. No intercepted browser responses or mock daemon. Running: persisted prompt ID, checked selector, no history polling. After settlement: one tool-calls request returning 200 and two rows. Reload: panel and both rows restored. Screenshots were visually checked. This does not claim a production-model run or repeat the maintainer's large-session survey.

Validation: 2,234 scoped tests passed (App 1,035; panel 77; Session 1,052; emitter 70); full build/typecheck/bundle, lint/format and commit hooks passed. Real-daemon browser report and screenshots.

Observed separately: a new empty session returned index 404s before prompt admission. The notice recovered after a successful index read; the light screenshot follows a manual index-only refresh while running, with history reads still zero. This initialization behavior is not claimed fixed. Before reload we also closed/reopened from the original sender message and verified record-ID persistence.

中文：上一轮漏掉了发送端回显被压制后的身份衔接，本次已从导航 store 补齐，并验证运行中/结束后打开、持久化、选中、结算读取和刷新恢复。新增三条评论均已修复：清除卡住的加载状态、统一审批后的起始通知、复用索引分页常量。浏览器使用真实 daemon、打包页面和真实工具执行，模型为本地脚本模型；没有用模拟 daemon 或拦截响应替代发送链路。维护者报告中的其他非阻塞建议不列为本次已修复。

Merged origin/main b9840886b8 in 8fce4a3914 and resolved all nine conflicting files. Timing writers now use upstream startTime / started_at_ms; replay retains compatibility with earlier development records and preserves measured zero durations. Existing sender identity and panel restoration fixes remain intact.

Validation: 3,395 scoped tests passed; full build, typecheck and bundle passed; commit hooks passed. Two automatically merged stale timing assertions were corrected and the 51-test trajectory suite passed on rerun. Chromium against the real built daemon and a local scripted model verified running selection, one historical read on settlement, canonical recorded timing, reopening the original sender and restoring the panel after reload. Updated screenshots and bilingual evidence are in the PR summary. The initial empty-session index notice is documented as pre-existing, not fixed here.

已在 8fce4a3914 合并主分支并解决 9 处文件冲突。计时写入统一采用主分支字段，兼容旧开发记录并保留真实零耗时；发送端身份及面板恢复修复均保留。3,395 项相关单测、完整构建/类型检查/打包及提交钩子通过。真实 daemon 浏览器验证覆盖运行中选择、结算后历史读取、计时回放、原消息重新打开及刷新恢复；中英文截图证据已更新。

Merged origin/main 40ef07ab35 in 20a5809053. Resolved the sole conflict in the trajectory panel by retaining the upstream overview implementation; the resolved component and its tests match main. GitHub now reports MERGEABLE.

Validation: 1,210 scoped Web Shell tests, full build/typecheck/bundle and commit hooks passed. Real-daemon Chromium verification passed for sender selection, timing replay, reopening and reload restoration, plus rendering/selecting the upstream tool timeline spans. Screenshots and bilingual evidence are updated in the summary. The browser harness needed one correction to reopen the right panel before the new overview check; no product change was needed.

已合并最新主分支，唯一冲突保留上游时间轴实现，GitHub 确认无冲突。1,210 项相关单测及完整构建/类型检查/打包通过；真实 daemon 浏览器验证覆盖工具面板恢复和时间轴点击，截图证据已更新。

@qwen-code /resolve

Qwen Code attempted to resolve merge conflicts but the run did not complete successfully.

Check the workflow run for full logs.

Merged origin/main 906418aa9b in 2e424efa8e. Resolved the three conflicts by preserving upstream conversation search alongside the existing durable-record Tool calls mapping, keeping both sets of regression tests and the embedding options documentation.

Validation: 1,379 scoped Web Shell tests passed; full build, typecheck, bundle and commit hooks passed. Real-daemon Chromium verification passed for sender identity, timing replay, reopening, reload restoration and trajectory tool-span selection. Updated screenshots and bilingual evidence are in the summary. Search behavior is covered by unit tests, not claimed as browser-tested in this run.

已合并最新主分支并解决三个文件冲突，保留会话搜索、历史工具调用定位和双方测试。1,379 项相关测试、完整构建/类型检查/打包及提交钩子通过；真实 daemon 浏览器验证也通过，截图证据已更新。

Maintainer verification, round 3: real daemon, macOS (2e424ef)

Follow-up to round 1 (d10c768) and round 2 (6f68391). This round covers what changed since 6f68391: the sender-identity fix (5aad27e), the three origin/main merges (8fce4a3, 20a5809, 2e424ef), and one shared-code change that came with the fix. Earlier rounds ran on Linux. This one runs on macOS.

Verdict: the round-2 blocker is fixed, and I'd merge. When the sender opens View tool calls on their own message, the tab now gets a durable identity. I tested three timings: right after sending, while the turn is running, and after it settles. In all three, the identity is persisted and the selector shows a check mark. Live updates cause 0 history reads, the settled turn causes exactly 1, and a page reload restores the panel. After the merges, recorded timing still matches the raw JSONL call-for-call. That holds for sessions recorded by this PR and by main, and for a legacy copy with no start timestamps (0 fabricated). Nothing below blocks the merge.

What I checked

Approved-call wire A/B

5aad27e removes the didRequestPermission gate. Every non-todo call now goes through emitStart after approval, so the change reaches every ACP client, not just the Web Shell. What each daemon sent for the same call:

The streamed call was prepared, so the start goes out as an update, not as a second creating frame. The Web Shell renders a single card. ChannelBase consumers now see an in_progress transition after approval. Before, they saw only pending → completed. That is a real status change. I think it's correct, and I'm flagging it only because it affects the channels as well. I did not exercise the unprepared-call path (a provider that doesn't stream tool calls).

Non-blocking notes

1. A rejected call shows its approval wait as elapsed time. The row reads Cancelled · 2s, and its tooltip gives start/end times for a command that never ran (fig. 2, last panel). The data is honest: the JSONL ui_telemetry record already stores this duration on main (1,523 ms for the same rejection on the main arm; 1,513 ms on the PR arm, equal to its live frame), and the PR's risk section documents that approval wait is part of the scope. Hiding the elapsed badge for rejected or never-executed calls would avoid implying that the command ran for 2 s.
2. Carried over from round 2, unchanged: TurnCallPromptSelect.tsx and the server read path are byte-identical to 6f68391. So the in-flight page re-fetch, the missing focus follow after wheel scrolling, the green Completed badge on a failed foreground subagent, and the wrapped-MCP {name, arguments} envelope all still apply. So does 1 tool calls: the panel header still says it, while the message area already says "1 tool call" (visible in both figures).
3. Small test gap: no test fails when location.view === 'live' is removed from the recordId adoption. A test with a historical location sharing the same blockId would pin it.

Not covered this round: Windows and Linux (rounds 1–2 were Linux), a production model, SSH workspaces, and the large-session selector survey (unchanged since round 2).

@qwen-code /triage

@qqqys Follow-up to review 5301167259, at head 2e424efa8ee875995edf0c363db85a262c0f3e76:

R1-4: The current Linux test job, Web Shell E2E Smoke, and Lint & Static pass. Passing CI does not rule out an intermittent timer leak, but no PR-specific cause has been isolated and the reported failure is not demonstrated by CI at this head. I have replied on the original thread requesting closure as an unconfirmed PR regression, rather than retaining it as a Critical blocker. This is not a claim that the dependency cleanup gap was fixed; a reproducible current-head environment and complete logs would justify reopening it.

Correction to the verification summary: The statement that current browser evidence uses only a mock daemon is outdated. Subsequent runs, including this exact head, used the built real local daemon and bundled Web Shell in Chromium, with a local scripted OpenAI-compatible model and actual shell/glob execution, without browser response interception. They verified persistence of the sender prompt identity while running, no tool-history polling during execution, a historical read on settlement, recorded tool timing, reopening from the original sender message, and restoration after reload. The current run also verified trajectory tool-span selection. Bilingual report and limitations, restored panel screenshot. These are real-daemon persistence checks, not production-model or large-session validation.

Still outstanding: Fresh verification of the original 57-call/139-call turns and the proposed many-call, multi-page server-reader fixture remain outstanding. The two-call browser scenario does not replace them. Independent verification of the twenty resolved findings and the daemon route/SSH ownership boundaries also remains useful; a resolved thread or author reply is not a substitute for that review. Your review explicitly did not perform that pass, so I understand this as remaining review work rather than a new demonstrated defect.

Please update the assessment to reflect the newer real-daemon evidence and reconsider R1-4's blocker classification on the current-head evidence. We are not asking that missing verification be treated as completed, or that an approval be based solely on green CI.

中文补充：R1-4 已在原讨论附上当前提交的绿色 CI，并请求按“尚未证实为本 PR 回归”关闭阻塞项，不声称依赖清理缺口已修复。整体 review 中“目前只有 mock daemon 验证”的信息已过时：当前提交已通过真实本地 daemon、实际 shell/glob 执行的发送端身份、历史计时、重新打开及刷新恢复验证，证据见上方报告。原始 57/139 次调用轮次、多调用跨页服务端用例，以及已修复项和接口归属边界的独立复核仍明确保留为待完成项，不以两次调用的浏览器场景替代。请据此更新验证描述并重新考虑 R1-4 的阻塞级别。