feat(web-shell): expose channel sessions in sidebar and settings

docs/design/2026-08-03-web-shell-channel-session-scope.md

@@ -0,0 +1,40 @@
+# Web Shell channel session scope
+
+## Motivation
+
+Channel runtimes already route incoming messages according to `sessionScope`,
+but the Web Shell channel editor only renders platform-specific management
+fields. Users can therefore configure credentials and access policy, but cannot
+choose which conversations share an agent session.
+
+## Design
+
+Add the existing shared `sessionScope` setting to every manageable channel type
+in the daemon channel catalog. Preserve a plugin-provided field when one exists;
+otherwise advertise an enum with the runtime-supported values and the plugin's
+default scope.
+
+Render the field in a dedicated session section of the channel editor. New and
+legacy configurations show their effective default, and saving writes the
+selected value through the existing channel upsert request.
+
+The available scopes are:
+
+- `user`: one session per sender and chat.
+- `thread`: one session per routing thread, falling back to the chat.
+- `chat_thread`: one session per chat and nested thread.
+- `single`: one session shared by the entire channel instance.
+
+## Compatibility
+
+The runtime router and persisted configuration format are unchanged. Existing
+configurations without `sessionScope` retain their current plugin default until
+they are edited and saved. Unmanageable channel types do not advertise the
+field.
+
+## Verification
+
+- Assert catalog defaults for DingTalk and GitHub.
+- Assert the management store accepts every runtime-supported scope.
+- Assert new and legacy editor drafts use the effective default.
+- Verify the Web Shell can select and persist a non-default scope end to end.

docs/design/2026-08-03-web-shell-channel-session-sidebar.md

@@ -0,0 +1,68 @@
+# Web Shell channel sessions in the sidebar
+
+## Motivation
+
+Daemon-managed channels create ordinary workspace sessions with
+`sourceType: "channel"`, but the Web Shell sidebar intentionally requests only
+the `default` session catalog. A session started from DingTalk, Feishu, or
+another channel therefore cannot be opened from the sidebar even though it is
+stored in the selected workspace.
+
+## Design
+
+Add a two-option source switch above the sidebar's project session list:
+
+- **Tasks** lists `sourceType: "default"` and remains the initial selection.
+- **Channels** lists `sourceType: "channel"`.
+
+The switch is shown only when the daemon advertises
+`session_source_metadata`. Older daemons keep the current unfiltered request
+and do not show a control they cannot support.
+
+The selected source is applied consistently to active, pinned, archived, and
+secondary-workspace session requests. Existing session rows, workspace
+sections, grouping, search, polling, and open-session actions are reused.
+Because channel sessions can be created by external messages without a Web
+Shell mutation event, the expanded Channels list uses the active-session poll
+interval instead of the 30-second idle interval.
+
+When the selected workspace also advertises `channel_management`, the Channels
+catalog joins each session's immutable channel instance name (`sourceId`) to
+the current channel configuration and groups sessions by `config.type`. The
+type catalog supplies the platform label, so multiple instances of the same
+platform share one collapsible section. Sessions whose instance no longer
+exists remain visible under Other channels. If the catalog is unavailable, the
+list keeps its existing fallback instead of hiding sessions. Channel type grouping
+overrides user-defined session groups in the Channels view; Tasks keeps its
+existing organization behavior. Secondary workspaces resolve their own
+workspace-scoped channel catalog.
+
+Channel adapters still prepend their model-facing instructions and contextual
+history. The daemon prompt carries the user-authored text separately as
+transcript display metadata, so live and replayed Web Shell messages do not
+expose that hidden context and channel session titles derive from the same
+visible text.
+
+## Boundaries
+
+- Channel configuration and runtime management are unchanged.
+- Session source metadata and daemon list APIs are unchanged.
+- Session Overview and Split View keep their existing default-session scope.
+- The switch is in-memory UI state and resets to Tasks on page reload.
+- Channel type classification reflects the current workspace configuration;
+  sessions do not persist a historical platform type.
+
+## Verification
+
+- Assert the source switch is gated by `session_source_metadata`.
+- Assert Tasks is initially selected and requests `sourceType: "default"`.
+- Assert selecting Channels requests `sourceType: "channel"` for primary and
+  workspace-qualified lists.
+- Assert the Channels list polls on the active-session interval.
+- Assert multiple instances of one platform share a collapsible type section,
+  other platform sessions remain separate, pinned sessions stay in their type
+  section, and unmatched sessions remain under Other channels.
+- Assert channel prompts preserve full model context while recording only the
+  user-authored text for transcript display.
+- Run the sidebar and workspace-section unit tests, Web Shell build, and
+  TypeScript typecheck.

packages/acp-bridge/src/bridge.test.ts

@@ -5717,6 +5717,23 @@ describe('createAcpSessionBridge', () => {
       await bridge.shutdown();
     });
 
+    it('strips channel display metadata from non-channel sessions', async () => {
+      const handle = makeChannel();
+      const bridge = makeBridge({ channelFactory: async () => handle.channel });
+      const session = await bridge.spawnOrAttach({ workspaceCwd: WS_A });
+
+      await bridge.sendPrompt(session.sessionId, {
+        sessionId: session.sessionId,
+        prompt: [{ type: 'text', text: 'model text' }],
+        _meta: { 'qwen.daemon.promptDisplayText': 'hidden transcript text' },
+      } as PromptRequest);
+
+      expect(
+        handle.agent.promptCalls[0]?._meta?.['qwen.daemon.promptDisplayText'],
+      ).toBeUndefined();
+      await bridge.shutdown();
+    });
+
     it('strips spoofed delivery metadata and injects only trusted context', async () => {
       const handle = makeChannel();
       const bridge = makeBridge({ channelFactory: async () => handle.channel });
@@ -6183,6 +6200,53 @@ describe('createAcpSessionBridge', () => {
       await bridge.shutdown();
     });
 
+    it('echoes only channel display text while forwarding full model context', async () => {
+      const handle = makeChannel({
+        promptImpl: () => ({ stopReason: 'end_turn' }),
+      });
+      const bridge = makeBridge({ channelFactory: async () => handle.channel });
+      const session = await bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sourceType: 'channel',
+      });
+      const abort = new AbortController();
+      const events = bridge.subscribeEvents(session.sessionId, {
+        signal: abort.signal,
+      });
+      const userChunk = (async () => {
+        for await (const event of events) {
+          if (event.type !== 'session_update') continue;
+          const update = (
+            event.data as {
+              update?: { sessionUpdate?: string; content?: unknown };
+            }
+          ).update;
+          if (update?.sessionUpdate === 'user_message_chunk') return update;
+        }
+        throw new Error('no user_message_chunk observed');
+      })();
+
+      await bridge.sendPrompt(session.sessionId, {
+        sessionId: session.sessionId,
+        prompt: [
+          { type: 'text', text: 'internal channel instructions\n\nhello' },
+        ],
+        _meta: { 'qwen.daemon.promptDisplayText': 'hello' },
+      } as PromptRequest);
+
+      await expect(userChunk).resolves.toMatchObject({
+        content: { type: 'text', text: 'hello' },
+      });
+      expect(handle.agent.promptCalls[0]).toMatchObject({
+        prompt: [
+          { type: 'text', text: 'internal channel instructions\n\nhello' },
+        ],
+        _meta: { 'qwen.daemon.promptDisplayText': 'hello' },
+      });
+      abort.abort();
+      await bridge.shutdown();
+    });
+
     it('echoes one user_message_chunk per content block (multi-modal)', async () => {
       const factory: ChannelFactory = async () =>
         makeChannel({ promptImpl: () => ({ stopReason: 'end_turn' }) }).channel;
@@ -7173,7 +7237,10 @@ describe('createAcpSessionBridge', () => {
       const bridge = makeBridge({
         channelFactory: async () => handle.channel,
       });
-      const session = await bridge.spawnOrAttach({ workspaceCwd: WS_A });
+      const session = await bridge.spawnOrAttach({
+        workspaceCwd: WS_A,
+        sourceType: 'channel',
+      });
       const sub = (async () => {
         for await (const ev of bridge.subscribeEvents(session.sessionId)) {
           events.push(ev);
@@ -7193,7 +7260,10 @@ describe('createAcpSessionBridge', () => {
         session.sessionId,
         {
           sessionId: session.sessionId,
-          prompt: [{ type: 'text', text: 'queued behind first' }],
+          prompt: [
+            { type: 'text', text: 'hidden context\n\nqueued behind first' },
+          ],
+          _meta: { 'qwen.daemon.promptDisplayText': 'queued behind first' },
         },
         undefined,
         { promptId: 'prompt-second' },
@@ -7239,6 +7309,9 @@ describe('createAcpSessionBridge', () => {
         (startedEvents[0] as BridgeEvent & { data: { text: string } }).data
           .text,
       ).toBe('queued behind first');
+      expect(handle.agent.promptCalls[1]?.prompt).toEqual([
+        { type: 'text', text: 'hidden context\n\nqueued behind first' },
+      ]);
       const completedEvents = events.filter(
         (e) => e.type === 'pending_prompt_completed',
       );

packages/acp-bridge/src/bridge.ts

@@ -102,6 +102,7 @@ import {
   CHANNEL_STARTUP_PROFILE_META_KEY,
   CHANNEL_STARTUP_PROFILE_VERSION,
   DAEMON_CHANNEL_DELIVERY_META_KEY,
+  DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   LOAD_REPLAY_BULK_MODE,
   LOAD_REPLAY_HIDE_INHERITED_META_KEY,
   LOAD_REPLAY_META_KEY,
@@ -234,6 +235,23 @@ function sessionSourceRequestMeta(
     : {};
 }
 
+/**
+ * The daemon's channel adapter carries the user-facing display projection in
+ * prompt meta; only channel sessions may use it — every other source echoes
+ * its prompt content verbatim. Single source of truth for the echo, the
+ * pending-entry text, and the re-arm strip so their `''`/missing-meta
+ * semantics cannot drift apart.
+ */
+function getChannelPromptDisplayText(
+  entry: Pick<SessionEntry, 'sourceType'>,
+  meta: Record<string, unknown> | null | undefined,
+): string | undefined {
+  const displayText = meta?.[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
+  return entry.sourceType === 'channel' && typeof displayText === 'string'
+    ? displayText
+    : undefined;
+}
+
 function isDefinitiveAcpRequestError(error: unknown): boolean {
   if (error instanceof RequestError) return true;
   if (!isRecord(error)) return false;
@@ -930,15 +948,21 @@ function echoPromptToSessionBus(
   // contract — cheaper than a thrown `TypeError` mid-echo.
   const prompt = req.prompt;
   if (!Array.isArray(prompt) || prompt.length === 0) return;
+  const displayText = getChannelPromptDisplayText(entry, req._meta);
+  let displayTextPublished = false;
   const serverTimestamp = Date.now();
   const blockCount = Math.min(prompt.length, MAX_ECHO_CONTENT_BLOCKS);
   for (let i = 0; i < blockCount; i += 1) {
     const part = prompt[i];
     if (!part || typeof part !== 'object' || Array.isArray(part)) continue;
-    // Every `ContentBlock` variant (text, image, audio, resource) is
-    // published to the bus verbatim. The SDK's `normalizeDaemonEvent`
-    // accepts any `content` shape; rich rendering of non-text blocks is
-    // the consumer's responsibility.
+    let displayPart = part;
+    if (displayText !== undefined && part.type === 'text') {
+      if (displayTextPublished) continue;
+      displayTextPublished = true;
+      displayPart = { ...part, text: displayText };
+    }
+    // Non-text blocks are published verbatim. Channel text uses the display
+    // projection so hidden model context never reaches transcript consumers.
     try {
       entry.events.publish({
         type: 'session_update',
@@ -947,7 +971,7 @@ function echoPromptToSessionBus(
           sessionId: req.sessionId,
           update: {
             sessionUpdate: 'user_message_chunk',
-            content: part,
+            content: displayPart,
             // `_meta` lives inside the `update` object rather than at
             // envelope level. `_meta` is a standard JSON-RPC/MCP extension
             // field permitted alongside spec fields, the SDK normalizer
@@ -5471,7 +5495,9 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
         promptId,
         queuedAt,
         ...(originatorClientId !== undefined ? { originatorClientId } : {}),
-        text: extractPromptText(req.prompt),
+        text:
+          getChannelPromptDisplayText(entry, req._meta) ??
+          extractPromptText(req.prompt),
         abortController: pendingAbort,
         state: isQueued ? 'queued' : 'running',
       };
@@ -5655,6 +5681,10 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
                     copy._meta && typeof copy._meta === 'object'
                       ? { ...copy._meta }
                       : {};
+                  const promptDisplayText = getChannelPromptDisplayText(
+                    entry,
+                    meta,
+                  );
                   delete meta[DAEMON_RETRY_META_KEY];
                   delete meta[INVOCATION_CONTEXT_META_KEY];
                   delete meta[PRIVATE_PARENT_CAPABILITY_META_KEY];
@@ -5663,6 +5693,7 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
                   // below) re-arms it after this strip.
                   delete meta[DAEMON_CONTINUE_META_KEY];
                   delete meta[DAEMON_CHANNEL_DELIVERY_META_KEY];
+                  delete meta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
                   if (isRetry) {
                     meta[DAEMON_RETRY_META_KEY] = true;
                   }
@@ -5673,6 +5704,10 @@ export function createAcpSessionBridge(opts: BridgeOptions): AcpSessionBridge {
                     meta[DAEMON_CHANNEL_DELIVERY_META_KEY] =
                       context.channelDelivery;
                   }
+                  if (promptDisplayText !== undefined) {
+                    meta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY] =
+                      promptDisplayText;
+                  }
                   meta[INVOCATION_CONTEXT_META_KEY] = invocationContext;
                   if (Object.keys(meta).length > 0) {
                     copy._meta = meta;

packages/acp-bridge/src/bridgeTypes.ts

@@ -564,6 +564,8 @@ export interface BridgeClientRequestContext {
 }
 
 export const DAEMON_CHANNEL_DELIVERY_META_KEY = 'qwen.daemon.channelDelivery';
+export const DAEMON_PROMPT_DISPLAY_TEXT_META_KEY =
+  'qwen.daemon.promptDisplayText';
 
 /**
  * Returned from `recordHeartbeat`. `lastSeenAt` is the server-side