qwen-code/docs/developers/_meta.ts
易良 7c1cad5af5
docs(daemon): publish the REST API reference (#11592)
* docs(daemon): publish REST API reference

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

* docs(daemon): correct the published REST contract against the daemon

Review of the new REST reference found the contract certifying behavior the
daemon does not have. Fix the claims where they are wrong, rather than
widening the surface:

- resume no longer publishes the shared restore schema: it gets its own
  request schema with only the fields the route reads, and the load-side
  history bound is published as maximum 500.
- the events stream drops a 409 it cannot produce; a stale epoch is reported
  in band as an id-less state_resync_required frame on the open 200 stream.
- transcript direction accepts backward only, and the protocol reference
  spells out the paging-parameter exclusivity the handler enforces.
- the jsonl export media type is application/jsonl, not application/x-ndjson.
- /health no longer advertises an unconditional anonymous alternative; the
  loopback-only exemption moves into the operation description.
- an empty displayName is rejected, the model-switch result is the ACP
  passthrough the daemon forwards (with _meta.qwenModelSwitch), the pending
  interaction carries action plus typed questions, and deadlineMs is tagged
  with the capability that gates it.
- the guide quickstart uses one defined base URL instead of an undefined
  host, fails loudly when create returns no sessionId, and the reference
  index describes itself as a curated core contract.

* test(cli): pin the corrected REST contract in the docs guard

The guide/OpenAPI/protocol guard missed the dimensions the review found
wrong, so the corrections could silently regress. Extend it where a plausible
regression fails the assertion:

- the new reference index is read, and its operation set and per-row
  capability, scope, anchor, and SDK method must equal the artifact.
- the resume request schema is pinned to the fields resume reads, and the
  load-side historyPageSize bound to 500.
- security requirements may not include an empty alternative, every 2xx with
  a body must declare content, and the events/export media types are pinned.
- the quickstart's http origin must equal the artifact's published server.

* docs(daemon): align the REST reference with emitted status codes and schemas

The published OpenAPI document still described several wire contracts the
daemon does not implement, so a client generated from it would either miss
reachable failures or reject bodies the daemon accepts.

Response codes:
- GET /file now documents 422 (binary_file) and 503 (io_error); the other
  four workspace read routes document 503, which all five reach through the
  shared filesystem error funnel.
- DELETE /session/:id documents 400 invalid_client_id.
- PATCH /session/:id/metadata documents 401 token_required, the strict-gate
  denial for the only curated operation registered with a strict mutation.
- POST /session/:id/prompt drops the false 504 prompt-deadline description:
  the route settles as 202 before any turn resolves, and its only 504 exits
  are ACP channel initialization timeouts. Deadline expiry is reported
  in-band as a turn_error. A 503 description is unchanged.
- GET /session/:id/events documents the `snapshot` query parameter, and the
  transcript 400 description enumerates it.

Schemas:
- /health 503 now references HealthResponse instead of Error; the daemon
  returns {status: degraded, reason}.
- Session no longer declares eventEpoch, which neither the create nor the
  attach path emits; RestoredSession and PromptAccepted keep their own.
- PromptRequest.delivery documents the single accepted channel-delivery
  shape instead of an unrestricted object.
- CreateSessionRequest.sessionId constrains the caller-supplied id to RFC
  4122 versions 1-5, matching the daemon gate.
- PermissionResponse selected.optionId requires a non-empty string.
- Capabilities documents sessionLiveStatePollIntervalMs and
  supportedLanguages, and WorkspaceCapability documents workflowsEnabled
  and kind, all of which the daemon always or conditionally emits.

* docs(daemon): align the published OpenAPI contract with the daemon

The artifact is the compatibility promise, so every claim that the routes
do not implement is a defect in the defect surface itself:

- Publish ResumeSessionRequest so /resume no longer advertises the
  load-only historyPageSize and liveReplayMode, and bound historyPageSize.
- Correct the ownership scope of load, resume, and export.
- Report the export MIME type as application/jsonl, matching the route.
- Document the events resync contract in band and drop the 409 and 4xx
  claims the SSE route never emits.
- Document the in-band prompt deadline instead of a 504 response.
- Describe only the status codes and fields the handlers actually produce,
  including the permission untrusted_workspace and ambiguous_session_owner
  causes.

* docs(daemon): correct the REST reference, guide, and protocol claims

- State the curated operation set as the published subset of a wider
  registered route surface.
- Correct the ownership vocabulary to the five scopes the artifact uses.
- Replace the http://daemon:4170 examples with the published baseline URL,
  and guard the session id the guide exports.
- Align the protocol transcript, metadata, resume, and export sections with
  the routes, and give the session permission route its error codes.

* test(cli): harden the REST docs contract guard

The guard could pass while the documentation drifted:

- Read route registrations from the AST so a commented example can no
  longer stand in for a real registration.
- Collect a continuation route cell instead of dropping it, and fail when a
  route row names nothing that can be checked.
- Resolve capabilities, scopes, SDK methods, security requirements, and
  every $ref against their real vocabularies, and require a body on every
  2xx that is not 204 or 205.
- Read protocol headings outside code fences when resolving anchors.
- Check the published index against the artifact, and the guide's repo
  links and flow hosts against the tree and the published server.

* docs(daemon): correct the REST contract claims raised in review

- artifact: constrain `X-Qwen-Event-Epoch` to the domain the parser
  accepts, state that the epoch is read only alongside a resume cursor,
  and drop the `SessionSummary` organization properties the status route
  never returns
- guide: split the quickstart fence so the exports are not trapped in the
  foreground daemon's shell, require TLS before a non-loopback base URL,
  point at the internal context-usage route, and replace the promise that
  the permission vote always works with its fail-closed statuses
- protocol: state that the metadata event carries only the changed field
  group and that `displayName` truncation counts UTF-16 code units
- guard: pin the SSE and export media types, tie the paging caps to
  `SESSION_TRANSCRIPT_MAX_LIMIT`, match github-slugger anchors, and stop
  the origin scan at punctuation

* docs(daemon): note that the epoch token is echoed from the handshake response

* docs(daemon): correct remaining REST contract claims

---------

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
2026-09-12 11:34:20 +00:00

29 lines
786 B
TypeScript

export default {
'Contribute to Qwen Code': {
title: 'Contribute to Qwen Code',
type: 'separator',
},
architecture: 'Architecture',
roadmap: 'Roadmap',
contributing: 'Contributing Guide',
'Qwen Code SDK': {
title: 'Agent SDK',
type: 'separator',
},
'sdk-typescript': 'TypeScript SDK',
'sdk-python': 'Python SDK (alpha)',
'sdk-java': 'Java SDK (alpha)',
'Dive Into Qwen Code': {
title: 'Dive Into Qwen Code',
type: 'separator',
},
'channel-plugins': 'Channel Plugin Guide',
tools: 'Tools',
'rest-api-integration': 'REST API integration guide',
'daemon-rest-api-reference': 'Daemon REST API reference',
'qwen-serve-protocol': 'qwen serve HTTP protocol',
daemon: 'Daemon Mode (Developer Deep Dive)',
examples: 'Examples',
};