fix(desktop): close release readiness gaps

Author: yiliang114

.github/workflows/desktop-build.yml

@@ -30,6 +30,8 @@ jobs:
     name: '${{ matrix.name }}'
     runs-on: '${{ matrix.os }}'
     timeout-minutes: 120
+    permissions:
+      contents: 'read'
     strategy:
       fail-fast: false
       matrix:

packages/channels/whatsapp/src/WhatsAppAdapter.test.ts

@@ -144,12 +144,15 @@ describe('WhatsApp connection lifecycle', () => {
       lastDisconnect: { error: { output: { statusCode: 401 } } },
     });
 
-    expect(onTerminalDisconnect).toHaveBeenCalledOnce();
+    await vi.waitFor(() => expect(onTerminalDisconnect).toHaveBeenCalledOnce());
     expect(onTerminalDisconnect).toHaveBeenCalledWith(
       expect.objectContaining({
         message: expect.stringContaining('logged out'),
       }),
     );
+    await vi.waitFor(async () => {
+      await expect(stat(stateDir)).rejects.toMatchObject({ code: 'ENOENT' });
+    });
     await adapter.disconnect();
   });
 
@@ -165,6 +168,7 @@ describe('WhatsApp connection lifecycle', () => {
     });
 
     await expect(connecting).rejects.toThrow('logged out');
+    await expect(stat(stateDir)).rejects.toMatchObject({ code: 'ENOENT' });
     expect(onTerminalDisconnect).not.toHaveBeenCalled();
     await adapter.disconnect();
   });

packages/channels/whatsapp/src/WhatsAppAdapter.ts

@@ -1,4 +1,4 @@
-import { chmod, mkdir, readdir } from 'node:fs/promises';
+import { chmod, mkdir, readdir, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import makeWASocket, {
@@ -160,8 +160,14 @@ export class WhatsAppChannel extends ChannelBase {
             const error = new Error(
               'WhatsApp logged out; reconfigure the channel to pair again.',
             );
-            failed(error);
             process.stderr.write(`[WhatsApp:${this.name}] ${error.message}\n`);
+            void rm(authDir, { recursive: true, force: true })
+              .catch((cleanupError) => {
+                process.stderr.write(
+                  `[WhatsApp:${this.name}] Failed to clear logged-out credentials: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}\n`,
+                );
+              })
+              .finally(() => failed(error));
             return;
           }
           this.reconnectAttempts += 1;

packages/cli/src/serve/channel-management-service.test.ts

@@ -10,6 +10,7 @@ import * as path from 'node:path';
 import { PairingStore } from '@qwen-code/channel-base';
 import type { CreatePairingRequestResult } from '@qwen-code/channel-base';
 import { describe, expect, it, vi } from 'vitest';
+import { daemonChannelStateDir } from '../commands/channel/runtime.js';
 import type { ChannelSettingsSnapshot } from './channel-settings-store.js';
 import {
   createChannelManagementService,
@@ -558,6 +559,49 @@ describe('createChannelManagementService', () => {
     expect(persisted().channels['bot']).toBeDefined();
   });
 
+  it('removes adapter state when a channel is deleted', async () => {
+    const previousQwenHome = process.env['QWEN_HOME'];
+    const qwenHome = await fs.mkdtemp(
+      path.join(os.tmpdir(), 'channel-management-remove-'),
+    );
+    process.env['QWEN_HOME'] = qwenHome;
+    try {
+      const stateDir = daemonChannelStateDir(WORKSPACE, 'bot');
+      await fs.mkdir(stateDir, { recursive: true });
+      await fs.writeFile(path.join(stateDir, 'credentials.json'), 'secret');
+      const { service, store } = setup({ committedNames: ['bot'] });
+
+      store.remove.mockRejectedValueOnce(new Error('settings write failed'));
+      await expect(
+        service.remove('bot', { expectedRevision: 'rev-1' }),
+      ).rejects.toThrow('settings write failed');
+      await expect(
+        fs.readFile(path.join(stateDir, 'credentials.json'), 'utf8'),
+      ).resolves.toBe('secret');
+
+      await service.remove('bot', { expectedRevision: 'rev-1' });
+
+      await expect(fs.stat(stateDir)).rejects.toMatchObject({ code: 'ENOENT' });
+      expect(store.remove).toHaveBeenCalledWith('bot', {
+        expectedRevision: 'rev-1',
+      });
+
+      const tombstone = `${stateDir}.deleting-stale`;
+      await fs.mkdir(tombstone, { recursive: true });
+      await fs.writeFile(path.join(tombstone, 'credentials.json'), 'secret');
+      await expect(
+        service.remove('bot', { expectedRevision: 'rev-2' }),
+      ).rejects.toMatchObject({ code: 'channel_instance_not_found' });
+      await expect(fs.stat(tombstone)).rejects.toMatchObject({
+        code: 'ENOENT',
+      });
+    } finally {
+      if (previousQwenHome === undefined) delete process.env['QWEN_HOME'];
+      else process.env['QWEN_HOME'] = previousQwenHome;
+      await fs.rm(qwenHome, { recursive: true, force: true });
+    }
+  });
+
   it('rejects stale removal before changing runtime state', async () => {
     const { service, store, manager } = setup({ committedNames: ['bot'] });
 

packages/cli/src/serve/channel-management-service.ts

@@ -4,6 +4,9 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { randomUUID } from 'node:crypto';
+import { readdir, rename, rm } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
 import { redactLogCredentials } from '@qwen-code/acp-bridge/logRedaction';
 import { canonicalizeWorkspace } from '@qwen-code/acp-bridge/workspacePaths';
 import {
@@ -12,6 +15,7 @@ import {
   type PairingRequest,
 } from '@qwen-code/channel-base';
 import { resolveChannelCwd } from '../commands/channel/channel-cwd.js';
+import { daemonChannelStateDir } from '../commands/channel/runtime.js';
 import { getPlugin } from '../commands/channel/channel-registry.js';
 import type {
   ChannelSecretUpdate,
@@ -73,6 +77,28 @@ export interface ChannelPairingRequestsSnapshot {
   requests: PairingRequest[];
 }
 
+async function removeStagedChannelState(stateDir: string): Promise<void> {
+  const parent = dirname(stateDir);
+  const prefix = `${basename(stateDir)}.deleting-`;
+  const entries = await readdir(parent, { withFileTypes: true }).catch(
+    (error: unknown) => {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+      throw error;
+    },
+  );
+  await Promise.all(
+    entries
+      .filter((entry) => entry.name.startsWith(prefix))
+      .map((entry) =>
+        rm(join(parent, entry.name), {
+          recursive: true,
+          force: true,
+          maxRetries: 3,
+        }),
+      ),
+  );
+}
+
 export interface ChannelPairingApprovalResult
   extends ChannelPairingRequestsSnapshot {
   approved: PairingRequest;
@@ -443,8 +469,10 @@ export function createChannelManagementService(
     },
     async remove(name, request) {
       assertManageableInstanceName(name);
+      const stateDir = daemonChannelStateDir(opts.workspaceCwd, name);
       const current = opts.store.snapshot();
       if (!Object.hasOwn(current.channels, name)) {
+        await removeStagedChannelState(stateDir);
         throw new ChannelManagementError(
           'channel_instance_not_found',
           `Channel "${name}" is not configured in this workspace.`,
@@ -456,7 +484,22 @@ export function createChannelManagementService(
         assertOwnedRuntime(name);
         await stopChannel(name);
       }
-      const persisted = await opts.store.remove(name, request);
+      const stagedStateDir = `${stateDir}.deleting-${randomUUID()}`;
+      let stagedState = false;
+      try {
+        await rename(stateDir, stagedStateDir);
+        stagedState = true;
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      }
+      let persisted: ChannelSettingsSnapshot;
+      try {
+        persisted = await opts.store.remove(name, request);
+      } catch (error) {
+        if (stagedState) await rename(stagedStateDir, stateDir);
+        throw error;
+      }
+      await removeStagedChannelState(stateDir);
       diagnostics.delete(name);
       return resultFor(name, persisted);
     },

packages/cli/src/serve/multi-workspace-sessions.test.ts

@@ -1081,6 +1081,59 @@ describe('multi-workspace session dispatch', () => {
     expect(res.body.features).toContain('multi_workspace_session_shell');
   });
 
+  it('restores an unqualified dormant session through its persisted workspace owner', async () => {
+    await withRuntimeDir(async () => {
+      const sessionId = 'dormant-secondary-session';
+      await writeStoredSession({
+        sessionId,
+        cwd: SECONDARY_CWD,
+        timestamp: '2026-07-08T00:00:00.000Z',
+        prompt: 'secondary owner',
+        mtime: new Date('2026-07-08T00:00:00.000Z'),
+      });
+      const { app, registry, primaryBridge, secondaryBridge } = makeHarness({
+        primarySummaries: [],
+        secondarySummaries: [],
+      });
+      registry.beginReplacement(registry.primaryEntry, 'policy-2');
+
+      const response = await request(app)
+        .post(`/session/${sessionId}/load`)
+        .set('Host', host())
+        .send({});
+
+      expect(response.status).toBe(200);
+      expect(response.body.workspaceCwd).toBe(SECONDARY_CWD);
+      expect(primaryBridge.restoreCalls).toEqual([]);
+      expect(secondaryBridge.restoreCalls).toEqual([
+        {
+          action: 'load',
+          req: expect.objectContaining({
+            sessionId,
+            workspaceCwd: SECONDARY_CWD,
+          }),
+        },
+      ]);
+    });
+  });
+
+  it('does not fall back to primary for an unqualified unknown session', async () => {
+    const { app, primaryBridge, secondaryBridge } = makeHarness({
+      primarySummaries: [],
+      secondarySummaries: [],
+    });
+
+    const response = await request(app)
+      .post('/session/missing-unqualified/load')
+      .set('Host', host())
+      .send({});
+
+    expect(response.status).toBe(404);
+    expect(response.body.code).toBe('session_not_found');
+    expect(primaryBridge.restoreCalls).toEqual([]);
+    expect(secondaryBridge.restoreCalls).toEqual([]);
+  });
+
   it('aggregates daemon status session count and exposes workspace metadata', async () => {
     const { app } = makeHarness();
     const res = await request(app).get('/daemon/status').set('Host', host());