Qwen Code v0.27.0 Holds Several Child Questions, Secret Scanning Reads Actions Workflow Logs, and EGM Adds Experimental Adapters

At a glance

• Qwen Code managed agent sessions can hold several child questions at once.
• The GitHub channel editor gains repository allowlists and blocklists.
• Secret scanning can now alert on secrets found in Actions workflow logs.
• A design review plugin adds experimental adapters for Cursor, OpenCode, and Copilot.

A four day old pull request overview preview was dropped after a primary source check found no Nov 7 to 9 development. Today's replacement is GitHub's Nov 9 secret scanning post. Qwen Code remains the lead stable release, with EGM kept as the third story and its Friday date labeled.

Treat today as a upgrade and security check day: move Qwen Code if you already run its managed agents, have an enterprise admin decide whether to enable Actions workflow log scanning, and read the EGM adapter notes before installing outside Claude Code or Codex.

Top Stories

1. Qwen Code v0.27.0 lets managed agent sessions hold several questions

Qwen Code v0.27.0 posted on GitHub on Saturday 7 November 2026 at about 3:45 PM ET, and npm latest for @qwen-code/qwen-code points to it. The release notes say managed agent sessions can now keep several child questions pending at once, answer them in any order, and keep drafts and errors separate for each child.

The GitHub channel editor gains repository allowlists and blocklists, and pull request delivery becomes more reliable. Shell tool edits now handle CRLF and Unicode safely in sed substitutions, and a cancelled command reports as interrupted while keeping its partial output. Upgrade refusals and Advisor start up errors no longer expose embedded credentials. The release lists no known breaking changes.

Practical dev impact: If a Qwen Code agent comments on your repositories, set the new repository filter first so it only reaches the repositories you intend, then move to v0.27.0, since the release says nothing needs migrating.

2. Secret scanning now detects secrets in Actions workflow logs

GitHub posted on 9 November 2026 that secret scanning now detects secrets in GitHub Actions workflow logs, in addition to issues, wikis, discussions, and pull requests. Actions workflow log scanning is in public preview. When a workflow run completes, GitHub scans its logs for provider patterns. Findings appear in the repository secret scanning alert list with a link back to the workflow log. Validity checks run for supported secret types, and alerts remain available even after the logs are deleted.

The preview is available to enterprises on GitHub Enterprise Cloud with GitHub Secret Protection or GitHub Advanced Security, including data residency on GHE.com. Enterprise owners enable it under enterprise Policies, then Advanced Security, by selecting Enabled in the All repositories dropdown. The policy is disabled by default and applies only to repositories that already have secret scanning enabled under those licenses.

Only workflow runs that complete after you enable the feature are scanned. Existing logs are not backfilled. Generic patterns, custom patterns, AI detected secrets, and secrets already masked by Actions are not detected. Alerts from Actions workflow logs do not generate notifications during the preview, so check the repository alert list directly.

Practical dev impact: Our read: if your org already pays for Secret Protection or Advanced Security, have an enterprise owner enable the policy on a pilot set of repositories first, then watch the alert list after the next CI runs, because there is no backfill and no alert email during the preview.

3. Google's EGM plugin v0.1.1 adds experimental adapters for Cursor, OpenCode, and Copilot

The Elephant Goldfish Model plugin from Google, announced on the Google Open Source Blog on 22 October 2026, tagged v0.1.1 on Friday 6 November 2026 at about 4:50 PM ET, three days ago. The idea is that one context rich agent session drafts a design document with you, and then fresh reviewer sessions with none of that conversation read the draft and probe it for gaps before any code is written.

The v0.1.1 notes add experimental adapters for Cursor, OpenCode V1, and GitHub Copilot, which have their own installation and support guidance. They also add a TRIZ inventive catalyst reviewer, improve how review context and severity are kept, and package the current Claude and OpenAI runtimes. Skill names and prompt files are unchanged, so no migration is needed. The notes say checksums and build attestations were verified, but native testing of the exact release archives on each host is still open. The README says it is not an officially supported Google product.

Practical dev impact: Our read: try it on one real feature in Claude Code or the Codex CLI, where the README documents the install, and treat the new Cursor and Copilot adapters as experiments until their own guides and the open testing issue settle.

Practical Impact Analysis

Our read: today mixes a Saturday agent CLI upgrade with a same day security surface. Qwen Code changes how managed agents juggle several open questions. Actions workflow log scanning closes a gap where secrets could print in CI output without landing in the secret scanning alert list. EGM still forces a design review before code, with new experimental surfaces outside Claude Code and Codex.

The rest of the board is unchanged. Claude Code latest is v2.1.319 with stable at v2.1.311. Copilot CLI latest is v1.0.107 and its prerelease tag is still v1.0.108-1. Codex latest is v0.167.0, Gemini CLI latest is v0.67.0, and the Cursor main changelog still leads with Friday's Voice Chat with Agents post. If you have one hour, move Qwen Code to v0.27.0 where you already use it, ask whether Actions log scanning should be enabled for your enterprise, and try one EGM design review on a side project.

Tutorial

1. Open a test shell. The active commands below only print registry tags and installed versions.
2. Run step 1 to print the Qwen Code and Claude Code registry tags and your local Claude Code version.
3. Uncomment a line in step 2 only if you want to install the pinned Qwen Code build or add the EGM plugin to Claude Code.
4. Read step 3 for the Actions workflow log scanning preview, which is an enterprise policy change, not a CLI bump.

# We have not run this script end to end on every platform. It prints and checks, and changes no files.
# Run it in a test shell. Nothing is written to your shell profile.

# 1. Snapshot at 5:50 AM ET Mon 9 Nov 2026, npm registry channel:
#    @qwen-code/qwen-code latest v0.27.0
#    @anthropic-ai/claude-code latest v2.1.319, stable v2.1.311
npm view @qwen-code/qwen-code dist-tags.latest
npm view @anthropic-ai/claude-code dist-tags.latest dist-tags.stable
if command -v claude >/dev/null; then claude --version; else echo "no claude CLI on PATH"; fi

# 2. Optional installs only. Pinned at 5:50 AM ET Mon 9 Nov 2026, npm registry channel:
# npm install -g @qwen-code/qwen-code@0.27.0
#    EGM plugin for Claude Code, from the project README:
# claude plugin marketplace add google/elephant-goldfish-model
# claude plugin install elephant-goldfish-model@google-egm

# 3. Actions workflow log scanning public preview (GitHub, 9 Nov 2026):
#    Enterprise Cloud with Secret Protection or Advanced Security.
#    Enterprise owner path: Policies -> Advanced Security -> All repositories Enabled.
#    Disabled by default. No backfill of older logs. No alert notifications in preview.
#    Changelog: https://github.blog/changelog/2026-11-09-secret-scanning-detects-secrets-in-github-actions-workflow-logs/
#    Docs: https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/secret-security/secret-scanning

echo "Done. Nothing was installed or changed on disk."

If npm view shows newer tags, refresh before you pin.

Sources:

• Qwen Code v0.27.0 release
• Secret scanning detects secrets in GitHub Actions workflow logs
• About secret scanning, GitHub Docs
• Elephant Goldfish Model plugin v0.1.1
• Introducing the Elephant Goldfish Model plugin
• Cursor changelog
• Cursor CLI changelog
• GitHub Changelog

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.