feat(core): accept cross-session messages behind an inbound gate

packages/cli/src/config/settings.test.ts

@@ -3493,6 +3493,93 @@ describe('Settings Loading and Merging', () => {
     });
   });
 
+  describe('cross-session settings scope handling', () => {
+    it('should honor the cross-session keys from user scope', () => {
+      (mockFsExistsSync as Mock).mockReturnValue(true);
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === USER_SETTINGS_PATH)
+            return JSON.stringify({
+              agents: {
+                crossSessionMessaging: true,
+                crossSessionInbound: 'hold',
+              },
+            });
+          return '{}';
+        },
+      );
+
+      const settings = loadSettings(MOCK_WORKSPACE_DIR);
+      expect(settings.merged.agents?.crossSessionMessaging).toBe(true);
+      expect(settings.merged.agents?.crossSessionInbound).toBe('hold');
+    });
+
+    it('should strip the cross-session keys from workspace scope even when trusted', () => {
+      // A trusted repository must not be able to self-grant the peer
+      // channel or force the inbound policy: the parity hold is the
+      // feature's own protection, and workspace scope uniquely defeats it.
+      (mockFsExistsSync as Mock).mockReturnValue(true);
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === MOCK_WORKSPACE_SETTINGS_PATH)
+            return JSON.stringify({
+              agents: {
+                crossSessionMessaging: true,
+                crossSessionInbound: 'accept',
+                maxParallelAgents: 4,
+              },
+            });
+          return '{}';
+        },
+      );
+
+      const settings = loadSettings(MOCK_WORKSPACE_DIR);
+      expect(settings.merged.agents?.crossSessionMessaging).toBeUndefined();
+      expect(settings.merged.agents?.crossSessionInbound).toBeUndefined();
+      // ...while other workspace agent settings still merge.
+      expect(settings.merged.agents?.maxParallelAgents).toBe(4);
+    });
+
+    it('should warn when workspace settings define agents.crossSessionInbound', () => {
+      (mockFsExistsSync as Mock).mockReturnValue(true);
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === MOCK_WORKSPACE_SETTINGS_PATH)
+            return JSON.stringify({
+              agents: { crossSessionInbound: 'accept' },
+            });
+          return '{}';
+        },
+      );
+
+      const settings = loadSettings(MOCK_WORKSPACE_DIR);
+      const warnings = getSettingsWarnings(settings);
+      expect(
+        warnings.some((w) => w.includes('agents.crossSessionInbound')),
+      ).toBe(true);
+    });
+
+    it('should let user scope win over a stripped workspace value', () => {
+      (mockFsExistsSync as Mock).mockReturnValue(true);
+      (fs.readFileSync as Mock).mockImplementation(
+        (p: fs.PathOrFileDescriptor) => {
+          if (p === USER_SETTINGS_PATH)
+            return JSON.stringify({
+              agents: { crossSessionInbound: 'hold' },
+            });
+          if (p === MOCK_WORKSPACE_SETTINGS_PATH)
+            return JSON.stringify({
+              agents: { crossSessionInbound: 'accept' },
+            });
+          return '{}';
+        },
+      );
+
+      const settings = loadSettings(MOCK_WORKSPACE_DIR);
+      expect(settings.merged.agents?.crossSessionInbound).toBe('hold');
+    });
+  });
+
   describe('allowedInsecureVoiceBaseUrls scope handling', () => {
     it('should honor the allowlist from user scope', () => {
       (mockFsExistsSync as Mock).mockReturnValue(true);

packages/cli/src/config/settings.ts

@@ -376,7 +376,6 @@ export function getSettingsWarnings(loadedSettings: LoadedSettings): string[] {
       );
     }
   }
-
   return [...warningSet];
 }
 

packages/cli/src/config/settingsSchema.test.ts

@@ -261,6 +261,33 @@ describe('SettingsSchema', () => {
       expect(exploreModel.showInDialog).toBe(false);
     });
 
+    it('should keep cross-session messaging off by default', () => {
+      // The default is the entire security posture of the feature: shipping
+      // it flipped on would open every session on the box to peer messages.
+      const crossSessionMessaging =
+        getSettingsSchema().agents.properties.crossSessionMessaging;
+
+      expect(crossSessionMessaging.type).toBe('boolean');
+      expect(crossSessionMessaging.default).toBe(false);
+      expect(crossSessionMessaging.requiresRestart).toBe(true);
+      expect(crossSessionMessaging.showInDialog).toBe(false);
+    });
+
+    it('should define the inbound cross-session policy as accept/hold/refuse', () => {
+      const crossSessionInbound =
+        getSettingsSchema().agents.properties.crossSessionInbound;
+
+      expect(crossSessionInbound.type).toBe('enum');
+      // Unset is not a fourth policy: it means approval-mode parity, which
+      // the gate derives. A concrete default here would silence that.
+      expect(crossSessionInbound.default).toBeUndefined();
+      expect(crossSessionInbound.options).toEqual([
+        { value: 'accept', label: 'Accept' },
+        { value: 'hold', label: 'Hold for review' },
+        { value: 'refuse', label: 'Refuse' },
+      ]);
+    });
+
     it('should define model grade settings', () => {
       const agents = getSettingsSchema().agents.properties;
 

packages/cli/src/config/settingsSchema.ts

@@ -3263,6 +3263,31 @@ const SETTINGS_SCHEMA = {
           },
         },
       },
+      crossSessionMessaging: {
+        type: 'boolean',
+        label: 'Cross-Session Messaging',
+        category: 'Advanced',
+        requiresRestart: true,
+        default: false,
+        description:
+          'Experimental. Let Qwen Code sessions on this machine send each other messages over a per-session local socket. Off by default; turning it on both opens this session to peer messages and makes it discoverable to others.',
+        showInDialog: false,
+      },
+      crossSessionInbound: {
+        type: 'enum',
+        label: 'Inbound Cross-Session Messages',
+        category: 'Advanced',
+        requiresRestart: false,
+        default: undefined as string | undefined,
+        description:
+          'What happens to messages other sessions send this one. "accept" delivers them; "hold" parks them for your review without letting the model act; "refuse" opts this session out. Unset means approval-mode parity: a message auto-delivers only when this session reviews every action, or when both sessions declare a mode that can apply actions without per-action review. Other messages are held for you to review.',
+        showInDialog: false,
+        options: [
+          { value: 'accept', label: 'Accept' },
+          { value: 'hold', label: 'Hold for review' },
+          { value: 'refuse', label: 'Refuse' },
+        ],
+      },
       modelGrades: {
         type: 'object',
         label: 'Model Grades',

packages/cli/src/config/settingsUtils.ts

@@ -268,6 +268,8 @@ export const WORKSPACE_RESTRICTED_SETTINGS = [
   { section: 'tools', key: 'workflowsEnabled' },
   { section: 'security', key: 'allowPrivateNetworkHooks' },
   { section: 'security', key: 'allowedInsecureVoiceBaseUrls' },
+  { section: 'agents', key: 'crossSessionMessaging' },
+  { section: 'agents', key: 'crossSessionInbound' },
 ] as const satisfies ReadonlyArray<{
   readonly section: keyof Settings;
   readonly key: string;

packages/cli/src/i18n/locales/en.js

@@ -2843,4 +2843,6 @@ export default {
   'Auto-skill curator changes are only available in trusted workspaces. Trust this folder via `/trust` and try again.':
     'Auto-skill curator changes are only available in trusted workspaces. Trust this folder via `/trust` and try again.',
   'Kept model as {{model}}': 'Kept model as {{model}}',
+  'Review messages held from other Qwen Code sessions (accept | deny)':
+    'Review messages held from other Qwen Code sessions (accept | deny)',
 };

packages/cli/src/i18n/locales/zh-TW.js

@@ -2422,4 +2422,6 @@ export default {
   'Auto-skill curator changes are only available in trusted workspaces. Trust this folder via `/trust` and try again.':
     '只有受信任的工作區可以變更自動技能管理器。請透過 `/trust` 信任此資料夾後再試一次。',
   'Kept model as {{model}}': '模型保持為 {{model}}',
+  'Review messages held from other Qwen Code sessions (accept | deny)':
+    '檢視其他 Qwen Code 工作階段傳來的待處理訊息（accept | deny）',
 };

packages/cli/src/i18n/locales/zh.js

@@ -2624,4 +2624,6 @@ export default {
   'Auto-skill curator changes are only available in trusted workspaces. Trust this folder via `/trust` and try again.':
     '仅受信任的工作区可以更改自动技能管理器。请通过 `/trust` 信任此文件夹后重试。',
   'Kept model as {{model}}': '模型保持为 {{model}}',
+  'Review messages held from other Qwen Code sessions (accept | deny)':
+    '查看其他 Qwen Code 会话发来的待处理消息（accept | deny）',
 };

packages/cli/src/peerMessaging/PeerMessagingContext.tsx

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2026 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { createContext, useContext } from 'react';
+import type { PeerMessaging } from './peer-messaging.js';
+
+export const PeerMessagingContext = createContext<PeerMessaging | null>(null);
+export const usePeerMessaging = () => useContext(PeerMessagingContext);