feat(channels): support webhook-triggered channel tasks

docs/developers/daemon/15-channel-adapters.md

@@ -11,6 +11,12 @@ There are two current host modes:
 
 In daemon-managed mode, each channel maps inbound chat traffic to daemon sessions under a configurable `SessionScope` (`user`, `thread`, or `single`). The adapter delegates to `DaemonChannelBridge`, which delegates to the SDK's `DaemonSessionClient` (see [`13-sdk-daemon-client.md`](./13-sdk-daemon-client.md)). Channel workers remain primary-workspace only in Phase 2a, so every selected channel's `cwd` must resolve to the daemon primary workspace.
 
+### Webhook-triggered channel tasks
+
+Webhook-triggered tasks are hosted by `qwen serve` and executed inside the daemon-managed channel worker. The HTTP route validates the source and forwards a `ChannelWebhookTask` to the worker over IPC. The worker calls `ChannelBase.runWebhookTask()`, so adapters do not implement webhook parsing.
+
+Adapters still participate through proactive send support: `supportsProactiveSend()` tells the host whether a channel can send without an inbound message, `supportsProactiveTarget()` handles delivery limits for specific target shapes, and `pushProactive()` carries the outbound content.
+
 ## Responsibilities
 
 - Receive inbound messages from the channel's native transport (DingTalk WebSocket stream, WeChat HTTP long-poll, Telegram Bot long-poll, Feishu WebSocket or HTTP webhook).

docs/users/features/channels/overview.md

@@ -389,6 +389,72 @@ This mode starts one channel worker process owned by `qwen serve`. The worker co
 
 When channels are serve-managed, `qwen channel status` shows the owner as `qwen serve`, and `qwen channel stop` tells you to stop the daemon instead of signaling the worker directly. If a ready worker exits unexpectedly, the daemon continues running and reports a channel-worker warning in `/daemon/status`.
 
+## Webhook-triggered tasks
+
+Daemon-managed channels can also accept authenticated webhook events. Qwen receives the event as context, summarizes and decides what matters, and then delivers the final response to the configured chat target. This is not a raw notification relay.
+Webhook tasks require `approvalMode: "yolo"` because they run without interactive approval. That setting applies to the whole channel, not only webhook turns, so use a dedicated webhook channel or tightly restrict normal chat senders for that channel.
+
+Example channel config:
+
+```json
+{
+  "channels": {
+    "dingtalk-main": {
+      "type": "dingtalk",
+      "clientId": "$DINGTALK_CLIENT_ID",
+      "clientSecret": "$DINGTALK_CLIENT_SECRET",
+      "cwd": "/repo",
+      "senderPolicy": "allowlist",
+      "allowedUsers": ["12345"],
+      "approvalMode": "yolo",
+      "sessionScope": "user",
+      "webhooks": {
+        "sources": {
+          "github-ci": {
+            "secretEnv": "QWEN_CHANNEL_GITHUB_CI_SECRET",
+            "targets": {
+              "default": {
+                "chatId": "OPEN_CONVERSATION_ID",
+                "senderId": "webhook:github-ci",
+                "isGroup": true
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+For DingTalk, `chatId` must be the group `openConversationId`; other adapters may require their own proactive target shape.
+
+Start `qwen serve` with the channel worker enabled:
+
+```bash
+QWEN_SERVER_TOKEN="$QWEN_SERVER_TOKEN" qwen serve --require-auth --channel dingtalk-main
+```
+
+Example request:
+
+```bash
+curl -X POST "http://127.0.0.1:4170/channels/dingtalk-main/webhooks/github-ci" \
+  -H "x-qwen-webhook-secret: $QWEN_CHANNEL_GITHUB_CI_SECRET" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "eventType": "push",
+    "targetRef": "default",
+    "title": "CI pipeline finished",
+    "payload": {
+      "targetRef": "refs/heads/main",
+      "repository": "qwen-code",
+      "status": "success"
+    }
+  }'
+```
+
+Webhook routes authenticate with the webhook secret header, even when `qwen serve` is running with bearer auth enabled. Do not share the daemon bearer token with webhook providers. Webhook config and `secretEnv` values are loaded when the daemon starts; restart `qwen serve` after changing webhook sources or rotating secrets. A `202 {"accepted": true}` response means the channel worker accepted ownership of the task, not that the final response has already been delivered to chat. Check daemon and channel worker logs, plus `/daemon/status`, when troubleshooting delivery failures.
+
 ### Multi-Channel Mode
 
 When you run `qwen channel start` without a name, all channels defined in `settings.json` start together sharing a single agent process. Each channel maintains its own sessions — a Telegram user and a WeChat user get separate conversations, even though they share the same agent.

packages/acp-bridge/src/bridge.test.ts

@@ -7978,6 +7978,226 @@ describe('createAcpSessionBridge', () => {
       return { factory, getCalls: () => calls };
     }
 
+    function rejectingApprovalModeFactory(): ChannelFactory {
+      return async () => {
+        const { clientStream, agentStream } = createInMemoryChannel();
+        const agent = new FakeAgent({
+          extMethodImpl: (method) => {
+            if (method === 'qwen/control/session/approval_mode') {
+              return Promise.reject(
+                Object.assign(new Error('trust gate rejected'), {
+                  data: { errorKind: 'trust_gate' },
+                }),
+              );
+            }
+            return Promise.resolve({});
+          },
+        });
+        new AgentSideConnection(() => agent as Agent, agentStream);
+        return {
+          stream: clientStream,
+          exited: new Promise<
+            | { exitCode: number | null; signalCode: NodeJS.Signals | null }
+            | undefined
+          >(() => {}),
+          kill: async () => {},
+          killSync: () => {},
+        };
+      };
+    }
+
+    function deferredApprovalModeFactory(): {
+      factory: ChannelFactory;
+      waitForApprovalMode: () => Promise<void>;
+      rejectApprovalMode: (error?: Error) => void;
+    } {
+      let started!: () => void;
+      let rejectApprovalMode: ((error: Error) => void) | undefined;
+      const startedPromise = new Promise<void>((resolve) => {
+        started = resolve;
+      });
+      return {
+        factory: async () => {
+          const { clientStream, agentStream } = createInMemoryChannel();
+          const agent = new FakeAgent({
+            extMethodImpl: (method) => {
+              if (method !== 'qwen/control/session/approval_mode') {
+                return Promise.resolve({});
+              }
+              return new Promise((_resolve, reject) => {
+                rejectApprovalMode = reject;
+                started();
+              });
+            },
+          });
+          new AgentSideConnection(() => agent as Agent, agentStream);
+          return {
+            stream: clientStream,
+            exited: new Promise<
+              | { exitCode: number | null; signalCode: NodeJS.Signals | null }
+              | undefined
+            >(() => {}),
+            kill: async () => {},
+            killSync: () => {},
+          };
+        },
+        waitForApprovalMode: () => startedPromise,
+        rejectApprovalMode: (error = new Error('trust gate rejected')) => {
+          if (!rejectApprovalMode) {
+            throw new Error('approval mode was not requested');
+          }
+          rejectApprovalMode(
+            Object.assign(error, { data: { errorKind: 'trust_gate' } }),
+          );
+        },
+      };
+    }
+
+    it('reaps a fresh session when approval-mode initialization fails', async () => {
+      const bridge = makeBridge({
+        channelFactory: rejectingApprovalModeFactory(),
+        maxSessions: 1,
+      });
+
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'thread',
+          approvalMode: ApprovalMode.YOLO,
+        }),
+      ).rejects.toThrow();
+
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'thread',
+        }),
+      ).resolves.toMatchObject({ attached: false });
+      await bridge.shutdown();
+    });
+
+    it('does not publish a failing approval-mode spawn as the default session', async () => {
+      const { factory, waitForApprovalMode, rejectApprovalMode } =
+        deferredApprovalModeFactory();
+      const bridge = makeBridge({
+        channelFactory: factory,
+        sessionScope: 'single',
+      });
+
+      const first = bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sessionScope: 'single',
+        approvalMode: ApprovalMode.YOLO,
+      });
+      await waitForApprovalMode();
+
+      const second = bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sessionScope: 'single',
+      });
+      let secondSettled = false;
+      void second.then(
+        () => {
+          secondSettled = true;
+        },
+        () => {
+          secondSettled = true;
+        },
+      );
+      await Promise.resolve();
+      expect(secondSettled).toBe(false);
+
+      rejectApprovalMode();
+      await expect(first).rejects.toThrow();
+      await expect(second).rejects.toThrow();
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'thread',
+        }),
+      ).resolves.toMatchObject({ attached: false });
+      await bridge.shutdown();
+    });
+
+    it('rolls back attach bookkeeping when approval-mode initialization fails', async () => {
+      const bridge = makeBridge({
+        channelFactory: rejectingApprovalModeFactory(),
+        maxSessions: 1,
+      });
+      const first = await bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sessionScope: 'single',
+      });
+
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'single',
+          approvalMode: ApprovalMode.YOLO,
+        }),
+      ).rejects.toThrow();
+
+      await bridge.detachClient(first.sessionId, first.clientId);
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'thread',
+        }),
+      ).resolves.toMatchObject({ attached: false });
+      await bridge.shutdown();
+    });
+
+    it('rolls back restored sessions when approval-mode initialization fails', async () => {
+      const bridge = makeBridge({
+        channelFactory: rejectingApprovalModeFactory(),
+        maxSessions: 1,
+      });
+
+      await expect(
+        bridge.loadSession({
+          sessionId: 'restore-with-mode',
+          workspaceCwd: WS_A,
+          approvalMode: ApprovalMode.YOLO,
+        }),
+      ).rejects.toThrow();
+
+      expect(bridge.sessionCount).toBe(0);
+      await expect(
+        bridge.spawnOrAttach({
+          workspaceCwd: WS_A,
+          sessionScope: 'thread',
+        }),
+      ).resolves.toMatchObject({ attached: false });
+      await bridge.shutdown();
+    });
+
+    it('reaps a tombstoned session when approval-mode attach rollback removes the last attach', async () => {
+      const { factory, waitForApprovalMode, rejectApprovalMode } =
+        deferredApprovalModeFactory();
+      const bridge = makeBridge({
+        channelFactory: factory,
+        sessionScope: 'single',
+      });
+      const first = await bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sessionScope: 'single',
+      });
+
+      const attach = bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sessionScope: 'single',
+        approvalMode: ApprovalMode.YOLO,
+      });
+      await waitForApprovalMode();
+      await bridge.killSession(first.sessionId, { requireZeroAttaches: true });
+      expect(bridge.sessionCount).toBe(1);
+
+      rejectApprovalMode();
+      await expect(attach).rejects.toThrow();
+      expect(bridge.sessionCount).toBe(0);
+      await bridge.shutdown();
+    });
+
     it('throws BEFORE the ACP roundtrip when persist:true but no callback wired', async () => {
       // The previous post-ACP placement of the persist guard meant a
       // missing callback produced a 500 *after* the ACP child had