@qwen-code/qwen-code 0.15.12-preview.2 → 0.16.0-nightly.20260522.48b0a8bfc

package/chunks/{chunk-AEJ2DKLP.js → chunk-C6WMLUNB.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   getGlobalQwenDir
-} from "./chunk-YHEAJFCI.js";
+} from "./chunk-USE2VQ5P.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-FSYKVGER.js → chunk-C7PY32RJ.js}

@@ -2,16 +2,16 @@
 "use strict";
 import {
   RequestTokenizer
-} from "./chunk-BXNCPI75.js";
+} from "./chunk-DMIMF3CG.js";
 import {
   buildRuntimeFetchOptions,
   redactProxyError
-} from "./chunk-CAWKL3UC.js";
+} from "./chunk-CSWBPY3P.js";
 import {
   OpenAIContentConverter,
   TaggedThinkingParser,
   openaiRequestCaptureContext
-} from "./chunk-PCL3EJGY.js";
+} from "./chunk-4U3O4VDA.js";
 import {
   CAPPED_DEFAULT_MAX_TOKENS,
   DASHSCOPE_PROXY_BASE_URL,
@@ -19,16 +19,17 @@ import {
   DEFAULT_MAX_RETRIES,
   DEFAULT_TIMEOUT,
   hasExplicitOutputLimit,
+  runtimeDiagnostics,
   safeJsonParse,
   tokenLimit
-} from "./chunk-UXW7MYAW.js";
+} from "./chunk-MAY32HXD.js";
 import {
   GenerateContentResponse
 } from "./chunk-T4VD6OJ4.js";
 import {
   createDebugLogger,
   isAbortError
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -6902,6 +6903,24 @@ OpenAI.Containers = Containers;
 init_esbuild_shims();
 
 // packages/core/src/core/openaiContentGenerator/provider/default.ts
+function shouldMirrorReasoningContentForQwen3(model) {
+  return model.toLowerCase().includes("qwen3");
+}
+__name(shouldMirrorReasoningContentForQwen3, "shouldMirrorReasoningContentForQwen3");
+function mirrorReasoningContentToReasoning(message) {
+  if (message.role !== "assistant") {
+    return message;
+  }
+  const assistant = message;
+  if (typeof assistant.reasoning_content !== "string" || assistant.reasoning_content.length === 0 || typeof assistant.reasoning === "string") {
+    return message;
+  }
+  return {
+    ...assistant,
+    reasoning: assistant.reasoning_content
+  };
+}
+__name(mirrorReasoningContentToReasoning, "mirrorReasoningContentToReasoning");
 var DefaultOpenAICompatibleProvider = class {
   static {
     __name(this, "DefaultOpenAICompatibleProvider");
@@ -6945,8 +6964,10 @@ var DefaultOpenAICompatibleProvider = class {
   buildRequest(request, _userPromptId) {
     const extraBody = this.contentGeneratorConfig.extra_body;
     const requestWithTokenLimits = this.applyOutputTokenLimit(request);
+    const messages = shouldMirrorReasoningContentForQwen3(request.model) ? requestWithTokenLimits.messages.map(mirrorReasoningContentToReasoning) : requestWithTokenLimits.messages;
     return {
       ...requestWithTokenLimits,
+      messages,
       ...extraBody ? extraBody : {}
     };
   }
@@ -7050,6 +7071,16 @@ var DashScopeOpenAICompatibleProvider = class _DashScopeOpenAICompatibleProvider
   constructor(contentGeneratorConfig, cliConfig) {
     super(contentGeneratorConfig, cliConfig);
   }
+  /**
+   * Determines whether to use the DashScope-compatible provider.
+   * Covers dashscope.aliyuncs.com, dashscope-intl.aliyuncs.com,
+   * internal Alibaba domains (*.alibaba-inc.com, *.aliyun-inc.com),
+   * and proxy matches.
+   *
+   * Note: any *.alibaba-inc.com / *.aliyun-inc.com host is treated as a
+   * DashScope-compatible endpoint by design. Keep this generic and avoid
+   * embedding individual private gateway hostnames in provider detection.
+   */
   static isDashScopeProvider(contentGeneratorConfig) {
     const { authType, baseUrl } = contentGeneratorConfig;
     if (authType === "qwen-oauth" /* QWEN_OAUTH */) return true;
@@ -7062,16 +7093,22 @@ var DashScopeOpenAICompatibleProvider = class _DashScopeOpenAICompatibleProvider
       hostname = null;
     }
     const isDashscopeOrigin = hostname !== null && (hostname === "dashscope.aliyuncs.com" || hostname === "dashscope-intl.aliyuncs.com" || hostname.endsWith(".dashscope.aliyuncs.com") || hostname.endsWith(".dashscope-intl.aliyuncs.com"));
+    const isInternalOrigin = hostname !== null && (hostname.endsWith(".alibaba-inc.com") || hostname.endsWith(".aliyun-inc.com"));
     const normalizedProxyUrl = DASHSCOPE_PROXY_BASE_URL?.endsWith("/") ? DASHSCOPE_PROXY_BASE_URL.slice(0, -1) : DASHSCOPE_PROXY_BASE_URL;
     const isProxyMatch = Boolean(
       normalizedProxyUrl && normalizedBaseUrl.toLowerCase() === normalizedProxyUrl.toLowerCase()
     );
-    if (normalizedProxyUrl && !isDashscopeOrigin && !isProxyMatch) {
+    if (normalizedProxyUrl && !isDashscopeOrigin && !isInternalOrigin && !isProxyMatch) {
       debugLogger.debug(
         `DASHSCOPE_PROXY_BASE_URL is configured but the request baseUrl does not match. DashScope headers/cache control will be skipped.`
       );
     }
-    return isDashscopeOrigin || isProxyMatch;
+    if (isInternalOrigin) {
+      debugLogger.debug(
+        `DashScope provider activated via internal origin: ${hostname}`
+      );
+    }
+    return isDashscopeOrigin || isInternalOrigin || isProxyMatch;
   }
   buildHeaders() {
     const version = this.cliConfig.getCliVersion() || "unknown";
@@ -7280,6 +7317,25 @@ var DashScopeOpenAICompatibleProvider = class _DashScopeOpenAICompatibleProvider
 
 // packages/core/src/core/openaiContentGenerator/provider/deepseek.ts
 init_esbuild_shims();
+
+// packages/core/src/core/openaiContentGenerator/provider/utils.ts
+init_esbuild_shims();
+function ensureReasoningContentOnAssistantMessage(message) {
+  if (message.role !== "assistant") {
+    return message;
+  }
+  const assistant = message;
+  if (typeof assistant.reasoning_content === "string") {
+    return message;
+  }
+  return {
+    ...assistant,
+    reasoning_content: ""
+  };
+}
+__name(ensureReasoningContentOnAssistantMessage, "ensureReasoningContentOnAssistantMessage");
+
+// packages/core/src/core/openaiContentGenerator/provider/deepseek.ts
 function isDeepSeekHostname(contentGeneratorConfig) {
   const baseUrl = contentGeneratorConfig.baseUrl ?? "";
   if (!baseUrl) return false;
@@ -7331,7 +7387,7 @@ var DeepSeekOpenAICompatibleProvider = class extends DefaultOpenAICompatibleProv
     }
     const messages = reshaped.messages.map((message) => {
       const flattened = flattenContentParts(message);
-      return ensureReasoningContentOnToolCalls(flattened);
+      return ensureReasoningContentOnAssistantMessage(flattened);
     });
     return {
       ...reshaped,
@@ -7393,20 +7449,6 @@ function translateReasoningEffort(request) {
   return next;
 }
 __name(translateReasoningEffort, "translateReasoningEffort");
-function ensureReasoningContentOnToolCalls(message) {
-  if (message.role !== "assistant") {
-    return message;
-  }
-  const extended = message;
-  if (typeof extended.reasoning_content === "string" && extended.reasoning_content.length > 0) {
-    return message;
-  }
-  return {
-    ...extended,
-    reasoning_content: ""
-  };
-}
-__name(ensureReasoningContentOnToolCalls, "ensureReasoningContentOnToolCalls");
 
 // packages/core/src/core/openaiContentGenerator/provider/openrouter.ts
 init_esbuild_shims();
@@ -7508,6 +7550,50 @@ function stripReasoningContent(message) {
 }
 __name(stripReasoningContent, "stripReasoningContent");
 
+// packages/core/src/core/openaiContentGenerator/provider/mimo.ts
+init_esbuild_shims();
+function isMiMoProvider(contentGeneratorConfig) {
+  const baseUrl = contentGeneratorConfig.baseUrl ?? "";
+  if (baseUrl) {
+    try {
+      const hostname = new URL(baseUrl).hostname.toLowerCase();
+      if (hostname === "xiaomimimo.com" || hostname.endsWith(".xiaomimimo.com")) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  const model = contentGeneratorConfig.model ?? "";
+  return model.toLowerCase().startsWith("mimo-");
+}
+__name(isMiMoProvider, "isMiMoProvider");
+var MiMoOpenAICompatibleProvider = class extends DefaultOpenAICompatibleProvider {
+  static {
+    __name(this, "MiMoOpenAICompatibleProvider");
+  }
+  constructor(contentGeneratorConfig, cliConfig) {
+    super(contentGeneratorConfig, cliConfig);
+  }
+  static isMiMoProvider = isMiMoProvider;
+  buildRequest(request, userPromptId) {
+    const baseRequest = super.buildRequest(request, userPromptId);
+    if (!baseRequest.messages?.length) {
+      return baseRequest;
+    }
+    return {
+      ...baseRequest,
+      messages: baseRequest.messages.map(
+        ensureReasoningContentOnAssistantMessage
+      )
+    };
+  }
+  getRequestContextOverrides() {
+    return {
+      splitToolMedia: this.contentGeneratorConfig.splitToolMedia ?? true
+    };
+  }
+};
+
 // packages/core/src/core/openaiContentGenerator/pipeline.ts
 init_esbuild_shims();
 import { setMaxListeners } from "node:events";
@@ -8104,6 +8190,7 @@ var ContentGenerationPipeline = class {
         isStreaming
       );
       openaiRequestCaptureContext.getStore()?.(openaiRequest);
+      runtimeDiagnostics.recordOpenAIWireRequest(openaiRequest);
       const result = await executor(openaiRequest, context);
       return result;
     } catch (error) {
@@ -8122,6 +8209,7 @@ var ContentGenerationPipeline = class {
    */
   createRequestContext(request, isStreaming) {
     const effectiveModel = request.model || this.contentGeneratorConfig.model;
+    const providerOverrides = this.config.provider.getRequestContextOverrides?.() ?? {};
     const toolCallParser = isStreaming ? new StreamingToolCallParser() : void 0;
     const responseParsingOptions = this.config.provider.getResponseParsingOptions?.();
     const taggedThinkingParser = isStreaming && responseParsingOptions?.taggedThinkingTags ? new TaggedThinkingParser() : void 0;
@@ -8129,7 +8217,7 @@ var ContentGenerationPipeline = class {
       model: effectiveModel,
       modalities: this.contentGeneratorConfig.modalities ?? {},
       startTime: Date.now(),
-      splitToolMedia: this.contentGeneratorConfig.splitToolMedia ?? false,
+      splitToolMedia: providerOverrides.splitToolMedia ?? this.contentGeneratorConfig.splitToolMedia ?? false,
       ...toolCallParser ? { toolCallParser } : {},
       ...responseParsingOptions ? { responseParsingOptions } : {},
       ...taggedThinkingParser ? { taggedThinkingParser } : {}
@@ -8321,6 +8409,9 @@ function determineProvider(contentGeneratorConfig, cliConfig) {
       cliConfig
     );
   }
+  if (MiMoOpenAICompatibleProvider.isMiMoProvider(config)) {
+    return new MiMoOpenAICompatibleProvider(contentGeneratorConfig, cliConfig);
+  }
   if (OpenRouterOpenAICompatibleProvider.isOpenRouterProvider(config)) {
     return new OpenRouterOpenAICompatibleProvider(
       contentGeneratorConfig,
@@ -8355,6 +8446,7 @@ export {
   OpenRouterOpenAICompatibleProvider,
   MiniMaxOpenAICompatibleProvider,
   MistralOpenAICompatibleProvider,
+  MiMoOpenAICompatibleProvider,
   ContentGenerationPipeline,
   EnhancedErrorHandler,
   OpenAIContentGenerator,

package/chunks/{chunk-JMZQICAL.js → chunk-CAVZVZX6.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-OFEVLU4C.js";
 import {
   SchemaValidator
-} from "./chunk-FYMSCRHM.js";
+} from "./chunk-PVVL5Q3W.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -20,7 +20,7 @@ function buildDefaultPromptId(purpose) {
 }
 __name(buildDefaultPromptId, "buildDefaultPromptId");
 function resolveDefaultModel(config, override) {
-  return override ?? config.getFastModelForSideQuery?.() ?? config.getFastModel?.() ?? config.getModel() ?? DEFAULT_QWEN_MODEL;
+  return override ?? config.getFastModel?.() ?? config.getModel() ?? DEFAULT_QWEN_MODEL;
 }
 __name(resolveDefaultModel, "resolveDefaultModel");
 function applyThinkingDefault(callerConfig) {

package/chunks/{chunk-CAWKL3UC.js → chunk-CSWBPY3P.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   require_undici
 } from "./chunk-E7E2MFYM.js";
@@ -323,7 +323,7 @@ function buildFetchOptionsWithDispatcher(sdkType, proxyUrl) {
   }
   try {
     const dispatcher = getOrCreateSharedDispatcher(proxyUrl);
-    return { fetchOptions: { dispatcher } };
+    return { fetchOptions: { dispatcher }, fetch: import_undici.fetch };
   } catch (error) {
     const hostname = extractHostnameFromProxyUrl(proxyUrl);
     const failureCount = recordProxyFailure(hostname);

package/chunks/{chunk-G27O2LD2.js → chunk-D5NTAHYL.js}

@@ -3,7 +3,7 @@
 import {
   Storage,
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-BXNCPI75.js → chunk-DMIMF3CG.js}

@@ -3,10 +3,10 @@
 import {
   TextTokenizer,
   isSupportedImageMimeType
-} from "./chunk-CAWKL3UC.js";
+} from "./chunk-CSWBPY3P.js";
 import {
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-OCC4MZRS.js → chunk-F23NCRJ2.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-SOIEFHIK.js → chunk-G7YTSRES.js}

@@ -1,15 +1,8 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
-  init_esm as init_esm2
-} from "./chunk-PCL3EJGY.js";
-import {
-  FatalConfigError,
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
-import {
-  init_esm
-} from "./chunk-QWSRH265.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -17,87 +10,6 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
-// packages/core/src/telemetry/config.ts
-init_esbuild_shims();
-
-// packages/core/src/telemetry/index.ts
-init_esbuild_shims();
-init_esm();
-init_esm2();
-var TelemetryTarget = /* @__PURE__ */ ((TelemetryTarget2) => {
-  TelemetryTarget2["GCP"] = "gcp";
-  TelemetryTarget2["LOCAL"] = "local";
-  return TelemetryTarget2;
-})(TelemetryTarget || {});
-var DEFAULT_TELEMETRY_TARGET = "local" /* LOCAL */;
-var DEFAULT_OTLP_ENDPOINT = "http://localhost:4317";
-
-// packages/core/src/telemetry/config.ts
-function parseBooleanEnvFlag(value) {
-  if (value === void 0) return void 0;
-  return value === "true" || value === "1";
-}
-__name(parseBooleanEnvFlag, "parseBooleanEnvFlag");
-function parseTelemetryTargetValue(value) {
-  if (value === void 0) return void 0;
-  if (value === "local" /* LOCAL */ || value === "local") {
-    return "local" /* LOCAL */;
-  }
-  if (value === "gcp" /* GCP */ || value === "gcp") {
-    return "gcp" /* GCP */;
-  }
-  return void 0;
-}
-__name(parseTelemetryTargetValue, "parseTelemetryTargetValue");
-async function resolveTelemetrySettings(options) {
-  const argv = options.argv ?? {};
-  const env = options.env ?? {};
-  const settings = options.settings ?? {};
-  const enabled = argv.telemetry ?? parseBooleanEnvFlag(env["QWEN_TELEMETRY_ENABLED"]) ?? settings.enabled;
-  const rawTarget = argv.telemetryTarget ?? env["QWEN_TELEMETRY_TARGET"] ?? settings.target;
-  const target = parseTelemetryTargetValue(rawTarget);
-  if (rawTarget !== void 0 && target === void 0) {
-    throw new FatalConfigError(
-      `Invalid telemetry target: ${String(
-        rawTarget
-      )}. Valid values are: local, gcp`
-    );
-  }
-  const otlpEndpoint = argv.telemetryOtlpEndpoint ?? env["QWEN_TELEMETRY_OTLP_ENDPOINT"] ?? env["OTEL_EXPORTER_OTLP_ENDPOINT"] ?? settings.otlpEndpoint;
-  const rawProtocol = argv.telemetryOtlpProtocol ?? env["QWEN_TELEMETRY_OTLP_PROTOCOL"] ?? settings.otlpProtocol;
-  const otlpProtocol = ["grpc", "http"].find(
-    (p) => p === rawProtocol
-  );
-  if (rawProtocol !== void 0 && otlpProtocol === void 0) {
-    throw new FatalConfigError(
-      `Invalid telemetry OTLP protocol: ${String(
-        rawProtocol
-      )}. Valid values are: grpc, http`
-    );
-  }
-  const logPrompts = argv.telemetryLogPrompts ?? parseBooleanEnvFlag(env["QWEN_TELEMETRY_LOG_PROMPTS"]) ?? settings.logPrompts;
-  const includeSensitiveSpanAttributes = parseBooleanEnvFlag(
-    env["QWEN_TELEMETRY_INCLUDE_SENSITIVE_SPAN_ATTRIBUTES"]
-  ) ?? settings.includeSensitiveSpanAttributes ?? false;
-  const outfile = argv.telemetryOutfile ?? env["QWEN_TELEMETRY_OUTFILE"] ?? settings.outfile;
-  const otlpTracesEndpoint = env["QWEN_TELEMETRY_OTLP_TRACES_ENDPOINT"] ?? env["OTEL_EXPORTER_OTLP_TRACES_ENDPOINT"] ?? settings.otlpTracesEndpoint;
-  const otlpLogsEndpoint = env["QWEN_TELEMETRY_OTLP_LOGS_ENDPOINT"] ?? env["OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"] ?? settings.otlpLogsEndpoint;
-  const otlpMetricsEndpoint = env["QWEN_TELEMETRY_OTLP_METRICS_ENDPOINT"] ?? env["OTEL_EXPORTER_OTLP_METRICS_ENDPOINT"] ?? settings.otlpMetricsEndpoint;
-  return {
-    enabled,
-    target,
-    otlpEndpoint,
-    otlpProtocol,
-    otlpTracesEndpoint,
-    otlpLogsEndpoint,
-    otlpMetricsEndpoint,
-    logPrompts,
-    includeSensitiveSpanAttributes,
-    outfile
-  };
-}
-__name(resolveTelemetrySettings, "resolveTelemetrySettings");
-
 // packages/core/src/utils/xml.ts
 init_esbuild_shims();
 function escapeXml(text) {
@@ -221,22 +133,11 @@ ${body}
 __name(buildSkillLlmContent, "buildSkillLlmContent");
 
 export {
-  parseBooleanEnvFlag,
-  parseTelemetryTargetValue,
-  resolveTelemetrySettings,
-  TelemetryTarget,
-  DEFAULT_TELEMETRY_TARGET,
-  DEFAULT_OTLP_ENDPOINT,
   escapeXml,
   escapeSystemReminderTags,
   registerSkillHooks,
   buildSkillLlmContent
 };
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
 /**
  * @license
  * Copyright 2025 Qwen

package/chunks/{chunk-SQNQIOD5.js → chunk-GGNTZ2NH.js}

@@ -2,11 +2,11 @@
 "use strict";
 import {
   formatFetchErrorForUser
-} from "./chunk-FKVKVE6N.js";
+} from "./chunk-KXZ4TJB4.js";
 import {
   Storage,
   createDebugLogger
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -1202,6 +1202,23 @@ var CredentialsClearRequiredError = class extends Error {
     __name(this, "CredentialsClearRequiredError");
   }
 };
+var QwenOAuthPollError = class extends Error {
+  static {
+    __name(this, "QwenOAuthPollError");
+  }
+  status;
+  oauthError;
+  description;
+  constructor(opts) {
+    super(
+      `Device token poll failed: ${opts.oauthError ?? "Unknown error"} - ${opts.description ?? "(no description)"}`
+    );
+    this.name = "QwenOAuthPollError";
+    this.oauthError = opts.oauthError;
+    this.description = opts.description;
+    this.status = opts.status;
+  }
+};
 function isDeviceAuthorizationSuccess(response) {
   return "device_code" in response;
 }
@@ -1245,7 +1262,7 @@ var QwenOAuth2Client = class {
       return { token: void 0 };
     }
   }
-  async requestDeviceAuthorization(options) {
+  async requestDeviceAuthorization(options, fetchOpts) {
     const bodyData = {
       client_id: QWEN_OAUTH_CLIENT_ID,
       scope: options.scope,
@@ -1259,7 +1276,13 @@ var QwenOAuth2Client = class {
         Accept: "application/json",
         "x-request-id": randomUUID2()
       },
-      body: objectToUrlEncoded(bodyData)
+      body: objectToUrlEncoded(bodyData),
+      // PR #4255 — daemon device-flow registry passes its
+      // `cancelController.signal` so dispose / cancel during a slow
+      // device-authorization request actually aborts the in-flight
+      // socket immediately. Pre-existing CLI callers omit it; the
+      // optional shape preserves backward compatibility.
+      ...fetchOpts?.signal ? { signal: fetchOpts.signal } : {}
     });
     if (!response.ok) {
       const errorData = await response.text();
@@ -1268,7 +1291,18 @@ var QwenOAuth2Client = class {
       );
     }
     const result = await response.json();
-    debugLogger2.debug("Device authorization result:", result);
+    if (isDeviceAuthorizationSuccess(result)) {
+      debugLogger2.debug("Device authorization result (sanitized):", {
+        ok: true,
+        expires_in: result.expires_in
+      });
+    } else {
+      const errorData = result;
+      debugLogger2.debug("Device authorization result (sanitized):", {
+        ok: false,
+        error: errorData?.error
+      });
+    }
     if (!isDeviceAuthorizationSuccess(result)) {
       const errorData = result;
       throw new Error(
@@ -1277,7 +1311,7 @@ var QwenOAuth2Client = class {
     }
     return result;
   }
-  async pollDeviceToken(options) {
+  async pollDeviceToken(options, fetchOpts) {
     const bodyData = {
       grant_type: QWEN_OAUTH_GRANT_TYPE,
       client_id: QWEN_OAUTH_CLIENT_ID,
@@ -1290,7 +1324,12 @@ var QwenOAuth2Client = class {
         "Content-Type": "application/x-www-form-urlencoded",
         Accept: "application/json"
       },
-      body: objectToUrlEncoded(bodyData)
+      body: objectToUrlEncoded(bodyData),
+      // PR #4255 — daemon device-flow registry passes its per-entry
+      // `cancelController.signal` so cancel() / dispose() during a
+      // slow IdP response actually aborts the in-flight socket
+      // instead of waiting for the upstream timeout.
+      ...fetchOpts?.signal ? { signal: fetchOpts.signal } : {}
     });
     if (!response.ok) {
       const responseText = await response.text();
@@ -1298,11 +1337,11 @@ var QwenOAuth2Client = class {
       try {
         errorData = JSON.parse(responseText);
       } catch (_parseError) {
-        const error2 = new Error(
+        const error = new Error(
           `Device token poll failed: ${response.status} ${response.statusText}. Response: ${responseText}`
         );
-        error2.status = response.status;
-        throw error2;
+        error.status = response.status;
+        throw error;
       }
       if (response.status === 400 && errorData.error === "authorization_pending") {
         return { status: "pending" };
@@ -1313,11 +1352,11 @@ var QwenOAuth2Client = class {
           slowDown: true
         };
       }
-      const error = new Error(
-        `Device token poll failed: ${errorData.error || "Unknown error"} - ${errorData.error_description}`
-      );
-      error.status = response.status;
-      throw error;
+      throw new QwenOAuthPollError({
+        oauthError: errorData.error,
+        description: errorData.error_description,
+        status: response.status
+      });
     }
     return await response.json();
   }
@@ -1608,10 +1647,6 @@ async function authWithQwenDeviceFlow(client, config) {
           };
           client.setCredentials(credentials);
           await cacheQwenCredentials(credentials);
-          try {
-            SharedTokenManager.getInstance().clearCache();
-          } catch {
-          }
           emitAuthProgress(
             "success",
             "Authentication successful! Access token obtained."
@@ -1712,12 +1747,45 @@ Server requested to slow down, increasing poll interval to ${pollInterval}ms'`
   }
 }
 __name(authWithQwenDeviceFlow, "authWithQwenDeviceFlow");
-async function cacheQwenCredentials(credentials) {
+var QWEN_CREDENTIAL_FILE_MODE = 384;
+async function cacheQwenCredentials(credentials, opts) {
   const filePath = getQwenCachedCredentialPath();
   try {
     await fs7.mkdir(path3.dirname(filePath), { recursive: true });
     const credString = JSON.stringify(credentials, null, 2);
-    await fs7.writeFile(filePath, credString);
+    const tempPath = `${filePath}.tmp.${process.pid}.${randomUUID2()}`;
+    try {
+      await fs7.writeFile(tempPath, credString, {
+        mode: QWEN_CREDENTIAL_FILE_MODE,
+        ...opts?.signal ? { signal: opts.signal } : {}
+      });
+      try {
+        await fs7.chmod(tempPath, QWEN_CREDENTIAL_FILE_MODE);
+      } catch (chmodErr) {
+        if (process.platform !== "win32") {
+          throw new Error(
+            `cacheQwenCredentials: refusing to publish credentials \u2014 chmod 0o${QWEN_CREDENTIAL_FILE_MODE.toString(8)} on temp file failed: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}`
+          );
+        }
+        debugLogger2.warn(
+          `cacheQwenCredentials: chmod 0o${QWEN_CREDENTIAL_FILE_MODE.toString(8)} on Windows temp file ${tempPath} failed; relying on NTFS ACL: ${chmodErr instanceof Error ? chmodErr.message : String(chmodErr)}`
+        );
+      }
+      await fs7.rename(tempPath, filePath);
+    } catch (writeErr) {
+      try {
+        await fs7.unlink(tempPath);
+      } catch {
+      }
+      throw writeErr;
+    }
+    try {
+      SharedTokenManager.getInstance().clearCache();
+    } catch (clearErr) {
+      debugLogger2.warn(
+        `cacheQwenCredentials: SharedTokenManager.clearCache failed; in-process callers may serve stale credentials until the next mtime poll: ${clearErr instanceof Error ? clearErr.message : String(clearErr)}`
+      );
+    }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     const errorCode = error instanceof Error && "code" in error ? error.code : void 0;
@@ -1766,6 +1834,7 @@ export {
   generateCodeChallenge,
   generatePKCEPair,
   CredentialsClearRequiredError,
+  QwenOAuthPollError,
   isDeviceAuthorizationSuccess,
   isDeviceTokenSuccess,
   isDeviceTokenPending,
@@ -1774,6 +1843,8 @@ export {
   QwenOAuth2Event,
   qwenOAuth2Events,
   getQwenOAuthClient,
+  QWEN_CREDENTIAL_FILE_MODE,
+  cacheQwenCredentials,
   clearQwenCredentials,
   clearCachedCredentialFile
 };

package/chunks/{chunk-FKVKVE6N.js → chunk-KXZ4TJB4.js}

@@ -3,7 +3,7 @@
 import {
   getErrorMessage,
   isNodeError
-} from "./chunk-GJXIKCKL.js";
+} from "./chunk-XP27SJMH.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";