…n PRs (#5211)

* fix(e2e): add daemon_status to serve capabilities baseline; run E2E on PRs

The `qwen serve — capabilities envelope` integration test hard-codes the
expected advertised-feature list. PR #5174 added the `daemon_status`
capability to SERVE_CAPABILITY_REGISTRY (and the server.test.ts unit
baseline) but did not update this integration test, so the list drifted
by one entry and the E2E job began failing on main.

Root cause it slipped through: E2E only triggered on push to main /
merge_group, never on PRs, so this stale assertion was never exercised
before merge. Add a pull_request trigger (targeting main) so capability/
contract regressions surface at PR time, and key concurrency on the PR
number so superseded PR runs cancel.

* fix(e2e): guard fork PRs from secretless runs; dedupe push/PR triggers

Addresses review feedback on #5211:

- Skip the e2e matrix on fork PRs. Forks have no access to repository
  secrets (OPENAI_*, DOCKERHUB_*), so without a guard every fork PR
  produces 3 guaranteed red jobs and wastes CI minutes. A head-repo
  guard runs the jobs for same-repo PRs (and push / merge_group) but
  skips them for forks.

- Key concurrency on the head ref (github.head_ref || github.ref_name)
  so a push to a feat/e2e/** branch and a pull_request from that same
  branch share one group and cancel each other, instead of running the
  full matrix twice for the same change. Keeps the feat/e2e/** push
  trigger (the no-PR e2e iteration escape hatch) intact.

- Stop cancelling in-progress main runs so every main commit produces a
  complete e2e result (matching ci.yml's policy and the very signal that
  surfaced this bug); still cancel superseded PR / feature-branch runs.

---------

Co-authored-by: jinye <[email protected]>

QwenLM#6272)

* feat(web-shell): add a daemon status page backed by GET /daemon/status

Surface the consolidated daemon status API (QwenLM#5174) in the Web Shell as a
dashboard dialog opened from a sidebar footer button.

- @qwen-code/sdk: DaemonClient.daemonStatus(detail) plus DaemonStatusReport*
  wire types for the /daemon/status envelope (summary and full detail).
- @qwen-code/webui: loadDaemonStatus workspace action and a
  useDaemonStatusReport hook (exported as useDaemonStatus from
  daemon-react-sdk).
- web-shell: DaemonStatusDialog rendering one dashboard — overall status
  badge, issues list, daemon/runtime/transport/security/limits/capabilities
  cards, plus per-session, workspace-diagnostics, and auth sections. The
  daemon's summary/full cost split is hidden from the operator rather than
  exposed as a toggle: the cheap summary rides a 5s auto-refresh while the
  expensive full report (which may spawn the ACP child and aggregate
  workspace diagnostics) is fetched only on open and on manual refresh, so
  parking the dialog open never rehits that path. Capabilities are sorted,
  counted, and height-capped; the long workspace path stays on one line,
  front-truncated so the tail remains visible. New pulse-icon sidebar entry;
  EN/zh-CN strings.
- vite dev proxy: forward /daemon to the daemon; without it the SPA fallback
  answered /daemon/status with index.html and the dialog failed JSON parsing
  under npm run dev:daemon.

* fix(web-shell): address review on the daemon status dashboard

- Drive the status badge and issues list off the full report when it is
  available, not the summary. The daemon only rolls workspace/preflight/MCP
  problems into status+issues for detail=full, so the summary can read "ok"
  with no issues while a loaded full report is degraded — the dashboard now
  reflects the full rollup (live counters still come from the summary).
- Guard the 5s poll with an in-flight ref so a slow/degraded daemon cannot
  accumulate overlapping status calls (useDaemonResource discards stale
  completions but does not abort; the client timeout is 30s).
- Fix the public DaemonStatusReport wire type: runtime.channelWorker.channels
  is string[] (ChannelWorkerSnapshot), not an array of objects; mirror the
  remaining optional snapshot fields.

* fix(web-shell): translate workspace section status badges

WorkspaceSectionRow rendered the raw wire status (`ok`/`warning`/`error`/
`unavailable`) while every other badge in the dialog goes through `t()`, so
under a Chinese UI these badges showed lowercase English. Route the badge
through `t('daemon.level.<status>')` and add the missing `daemon.level.unavailable`
key to both dictionaries.

* fix(web-shell): scope toolbar error to summary; broaden dashboard test coverage

- The toolbar "failed to load" banner now keys on the summary fetch only. A
  failed full fetch is already surfaced in the diagnostics section, so it no
  longer makes an otherwise-healthy summary (fresh cards + timestamp) read as
  broken.
- Use the ASCII "..." ellipsis in the diagnostics-loading string to match the
  rest of the i18n dictionary.
- Add tests: summary-healthy/full-failed degraded state, the ACP-disabled
  transport branch, uptime/memory/duration formatting across unit boundaries
  (day, GB, sub-second, fractional-second), and sidebar Daemon Status button
  click (expanded + collapsed) — the feature's only entry point.

* fix(web-shell): pause polling on hidden tab; scope dev proxy; fix test mock

- Skip the 5s status poll while document.hidden, matching the sidebar poll —
  a backgrounded tab no longer hits the daemon every 5s.
- Narrow the vite dev proxy to the exact /daemon/status route instead of a
  bare /daemon prefix, mirroring the scoped /voice/stream entry; verified the
  dashboard still proxies (summary + detail=full) in dev.
- Add a message field to the DaemonStatusReport issue mock in the webui
  provider test so it matches the required DaemonStatusReportIssue shape.

* feat(web-shell): surface runtime/channel-worker diagnostics; a11y + polish

Address the daemon-status review round:
- Render the runtime startup/failure state (runtime.loading / runtime.error)
  in the Runtime card so the plausible-looking zero counters during startup
  are not mistaken for a healthy idle daemon.
- Surface channel-worker diagnostics (state, exit code/signal, error, restart
  count) when the worker is enabled — these fields were fetched and typed but
  never shown, leaving a bare "down" with no context.
- Include full.error.message in the diagnostics-failure line (matching the
  summary error path) so a failed detail fetch is actionable.
- Show "N/A" instead of a literal "null" chip for null workspace summary
  values (the wire type allows null).
- Add role="status" + aria-label to the health badge for screen readers.
- Rename the public hook alias useDaemonStatus -> useStatusReport, matching
  the Daemon-prefix-stripping convention of the other re-exports.
- Add tests: runtime startup/failure, channel-worker diagnostics, and the
  empty/disabled placeholders (sessions, rate limit, capabilities, ACP),
  toolbar-banner-with-data, and pure-loading branches.

* fix(web-shell): contain daemon status crashes; workspace empty-state

- Wrap the dashboard in a local ErrorBoundary so a malformed/partial daemon
  response (e.g. an older daemon omitting an additive field like
  channelWorker) — most likely exactly when the daemon is sick and the
  dashboard is most needed — shows a contained fallback instead of throwing
  to the root boundary and white-screening the whole web shell.
- Add an empty-state to the Workspace Diagnostics card (parity with the
  Sessions card) for when full.workspace is empty.
- Tests: error-boundary containment on a malformed report, and the workspace
  empty-state.

* fix(web-shell): fix error-boundary recovery; contain detail crashes

Address the review round (one Critical):
- ErrorBoundary recovery was broken: the comment claimed resetKeys cleared the
  fallback, but none was passed. Switch to a function-form fallback that
  surfaces the actual render error (distinct from a network failure) and fix
  the comment — recovery happens on re-open, since the parent only mounts the
  dialog while open.
- Wrap FullDetail in its own ErrorBoundary so a malformed detail=full payload
  is contained to the detail region instead of taking down the healthy summary
  cards with it; add a catch-all branch so a fetch that resolves without a
  `full` section shows a failed state instead of hanging on "Loading...".
- Toolbar failure banner now shows only when the summary errored AND still has
  data on screen (`summary.error && summary.report`), so it no longer
  misrepresents a dashboard that is rendering from the full fallback.
- SDK type: drop `& Record<string, unknown>` on DaemonStatusReport.daemon and
  add the typed optional `startup` field, matching the DaemonCapabilities
  convention the interface JSDoc claims.
- Add a real useDaemonStatusReport hook test asserting the `report` alias maps
  from `data` — the dialog test mocks the whole hook, so nothing else guarded
  it.

* feat(web-shell): surface runtime.activity in the daemon status dashboard

PR QwenLM#6270 added a runtime.activity sub-object to GET /daemon/status
(activePrompts, lastActivityAt, idleSinceMs). Type it as an additive optional
on the SDK DaemonStatusReport and render it in the Runtime card: active-prompt
count and an idle duration ("no activity yet" when the daemon has seen none).
Gated on the field's presence so older daemons that omit it still render.
Verified end-to-end against a real qwen serve --web that emits the field.

* fix(web-shell): daemon status polish — i18n count, negative clamp, coverage

Address the review round (all minor):
- Move the capabilities count into the i18n string (daemon.capabilities.titleCount
  with a {count} placeholder) so locales can reorder it.
- Clamp negative durations in formatDurationMs (clock-skew defense).
- Re-export the hook options type as StatusReportOptions for consumers wrapping
  useStatusReport.
- Tests: use the real rate-limit tier keys (prompt/mutation/read) in the fixture,
  and cover the session-id display fallback, the channel-worker signal branch,
  and a healthy workspace section's chip/status rendering.

* feat(web-shell): name the failing checks behind a workspace section status

A "warning"/"error" workspace-diagnostics section only showed a rollup badge
plus count chips, so e.g. a warning preflight was opaque — the operator
couldn't tell it was the auth check without curling the API. Extract the
individual warning/error cells from the section's raw data (across cells /
servers / skills / tools / providers / hooks / extensions) and render each with
its label and message (e.g. "auth: No auth method configured."). OK and other
non-problem cells stay hidden. Verified end-to-end: a real daemon with no
credentials now shows the auth warning inline under preflight.