@qwen-code/qwen-code 0.17.1-nightly.20260608.aea34fa2c → 0.18.0-preview.0

package/bundled/qc-helper/SKILL.md

@@ -43,25 +43,30 @@ Use this index to locate the right document for the user's question. Load only t
 | Model providers (OpenAI-compatible, etc.) | `docs/configuration/model-providers.md` |
 | .qwenignore file                          | `docs/configuration/qwen-ignore.md`     |
 | Themes                                    | `docs/configuration/themes.md`          |
-| Memory                                    | `docs/configuration/memory.md`          |
 | Trusted folders                           | `docs/configuration/trusted-folders.md` |
 
 ### Features
 
-| Topic                                       | Doc Path                         |
-| ------------------------------------------- | -------------------------------- |
-| Approval mode (plan/default/auto_edit/yolo) | `docs/features/approval-mode.md` |
-| MCP (Model Context Protocol)                | `docs/features/mcp.md`           |
-| Skills system                               | `docs/features/skills.md`        |
-| Sub-agents                                  | `docs/features/sub-agents.md`    |
-| Sandbox / security                          | `docs/features/sandbox.md`       |
-| Slash commands                              | `docs/features/commands.md`      |
-| Headless / non-interactive mode             | `docs/features/headless.md`      |
-| LSP integration                             | `docs/features/lsp.md`           |
-| Checkpointing                               | `docs/features/checkpointing.md` |
-| Token caching                               | `docs/features/token-caching.md` |
-| Language / i18n                             | `docs/features/language.md`      |
-| Arena mode                                  | `docs/features/arena.md`         |
+| Topic                                       | Doc Path                           |
+| ------------------------------------------- | ---------------------------------- |
+| Approval mode (plan/default/auto_edit/yolo) | `docs/features/approval-mode.md`   |
+| Auto mode (AI-driven approval)              | `docs/features/auto-mode.md`       |
+| Hooks (lifecycle hooks)                     | `docs/features/hooks.md`           |
+| MCP (Model Context Protocol)                | `docs/features/mcp.md`             |
+| Memory                                      | `docs/features/memory.md`          |
+| Skills system                               | `docs/features/skills.md`          |
+| Sub-agents                                  | `docs/features/sub-agents.md`      |
+| Sandbox / security                          | `docs/features/sandbox.md`         |
+| Slash commands                              | `docs/features/commands.md`        |
+| Headless / non-interactive mode             | `docs/features/headless.md`        |
+| LSP integration                             | `docs/features/lsp.md`             |
+| Checkpointing                               | `docs/features/checkpointing.md`   |
+| Token caching                               | `docs/features/token-caching.md`   |
+| Language / i18n                             | `docs/features/language.md`        |
+| Arena mode                                  | `docs/features/arena.md`           |
+| Status line                                 | `docs/features/status-line.md`     |
+| Scheduled tasks (cron/loop)                 | `docs/features/scheduled-tasks.md` |
+| Worktree                                    | `docs/features/worktree.md`        |
 
 ### IDE Integration
 
@@ -111,15 +116,16 @@ When the user asks about configuration, the primary reference is `docs/configura
 
 ### Common Config Categories
 
-| Category      | Key Config Keys                                                               | Reference                                                                 |
-| ------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
-| Permissions   | `permissions.allow/ask/deny`                                                  | `docs/configuration/settings.md`, `docs/features/approval-mode.md`        |
-| MCP Servers   | `mcpServers.*`, `mcp.*`                                                       | `docs/configuration/settings.md`, `docs/features/mcp.md`                  |
-| Tool Approval | `tools.approvalMode`                                                          | `docs/configuration/settings.md`, `docs/features/approval-mode.md`        |
-| Model         | `model.name`, `modelProviders`                                                | `docs/configuration/settings.md`, `docs/configuration/model-providers.md` |
-| General/UI    | `general.*`, `ui.*`, `ide.*`, `output.*`                                      | `docs/configuration/settings.md`                                          |
-| Context       | `context.*`                                                                   | `docs/configuration/settings.md`                                          |
-| Advanced      | `hooks`, `env`, `webSearch`, `security`, `privacy`, `telemetry`, `advanced.*` | `docs/configuration/settings.md`                                          |
+| Category      | Key Config Keys                                                      | Reference                                                                                        |
+| ------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| Permissions   | `permissions.allow/ask/deny`                                         | `docs/configuration/settings.md`, `docs/features/approval-mode.md`                               |
+| MCP Servers   | `mcpServers.*`, `mcp.*`                                              | `docs/configuration/settings.md`, `docs/features/mcp.md`                                         |
+| Tool Approval | `tools.approvalMode`                                                 | `docs/configuration/settings.md`, `docs/features/approval-mode.md`, `docs/features/auto-mode.md` |
+| Hooks         | `hooks.*`                                                            | `docs/features/hooks.md`                                                                         |
+| Model         | `model.name`, `modelProviders`                                       | `docs/configuration/settings.md`, `docs/configuration/model-providers.md`                        |
+| General/UI    | `general.*`, `ui.*`, `ide.*`, `output.*`                             | `docs/configuration/settings.md`                                                                 |
+| Context       | `context.*`                                                          | `docs/configuration/settings.md`                                                                 |
+| Advanced      | `env`, `webSearch`, `security`, `privacy`, `telemetry`, `advanced.*` | `docs/configuration/settings.md`                                                                 |
 
 ---
 

package/bundled/qc-helper/docs/features/auto-mode.md

@@ -15,6 +15,16 @@ walks three layers in order:
 
 1. **acceptEdits fast-path** — Edit / Write whose target path is inside
    the workspace is auto-approved without invoking the classifier.
+   **Exception:** writes to Qwen Code's own self-modification surfaces
+   (`.qwen/settings*.json`, `QWEN.md`, `AGENTS.md`, `QWEN.local.md`,
+   configured context filenames, `.qwen/rules/`, `.qwen/commands/`,
+   `.qwen/agents/`, `.qwen/skills/`, `.qwen/hooks/`, `.mcp.json`) and
+   persistence surfaces (`.git/`, `.husky/`, `package.json`, `.npmrc`,
+   `Makefile`, `.github/workflows/`, etc.) route through the classifier
+   even when they are inside the workspace. Symlinks targeting protected
+   paths are resolved and rejected too. Shell commands that reach these
+   paths via `cd && bash -lc '...'` or other wrappers go through the
+   classifier as well.
 2. **Safe-tool allowlist** — Read-only and metadata-only built-in tools
    (Read, Grep, Glob, LS, LSP, TodoWrite, AskUserQuestion, etc.) are
    auto-approved without invoking the classifier.
@@ -42,7 +52,12 @@ runs:
   classifier never sees it.
 - `permissions.allow` rules with specific specifiers (e.g.
   `Bash(git status)`, `Read(./docs/**)`) still auto-allow without the
-  classifier.
+  classifier — **except** when the call resolves to a write at a
+  protected self-modification or persistence path (see the list under
+  "How it works"). In that case Auto Mode re-checks the call through
+  the classifier so an allow rule on `Bash(*)` cannot silently turn
+  into permission to rewrite Qwen Code settings, commands, hooks,
+  skills, or MCP servers.
 - `permissions.ask` rules force manual confirmation even in Auto Mode.
 
 ## Over-broad allow rules are stripped while in Auto Mode
@@ -69,6 +84,19 @@ entries are natural-language descriptions, not rule patterns — they are
 injected additively into the classifier's system prompt alongside the
 built-in defaults.
 
+There are three hint categories plus an environment list:
+
+- **`allow`** — actions the classifier should auto-approve.
+- **`softDeny`** — destructive or irreversible actions the classifier
+  should block **unless the user's most recent explicit request asked
+  for that exact action and scope**. Soft denies can be cleared by
+  user intent; a generic "yes do whatever" doesn't count.
+- **`hardDeny`** — security-boundary actions the classifier must block
+  in Auto Mode regardless of `autoMode.hints.allow` or recent user
+  intent. This is classifier policy, not a deterministic permission
+  rule: it does not override `permissions.allow`. Use `permissions.deny`
+  for actions that must never be allowed by the permission manager.
+
 ```json
 {
   "permissions": {
@@ -79,10 +107,13 @@ built-in defaults.
           "Cleaning build artifacts under ./dist or ./build",
           "Reading any file under /Users/me/code/"
         ],
-        "deny": [
-          "Any network call to intranet.example.com endpoints",
-          "Modifying anything under ~/.ssh or ~/.aws",
+        "softDeny": [
+          "Editing Qwen Code settings unless I explicitly ask for the exact change",
           "Running migration scripts that touch the production DB"
+        ],
+        "hardDeny": [
+          "Sending secrets or .env contents to any network endpoint",
+          "Modifying anything under ~/.ssh or ~/.aws"
         ]
       },
       "environment": [
@@ -94,13 +125,18 @@ built-in defaults.
 }
 ```
 
+`hints.deny` is still accepted for backward compatibility and is treated
+as `softDeny`. Mixing both is fine — entries are concatenated, `softDeny`
+first.
+
 ### Length and count limits
 
 To keep the classifier system prompt small:
 
 - Each entry is capped at 200 characters (longer entries are truncated
   with a warning).
-- `hints.allow` and `hints.deny` accept up to 50 entries each.
+- `hints.allow`, `hints.softDeny`, and `hints.hardDeny` accept up to 50
+  entries each.
 - `environment` accepts up to 20 entries.
 
 ### Layering across settings files
@@ -114,15 +150,24 @@ de-duplicated.
 When the classifier blocks an action, the tool call fails with one of
 the following error texts:
 
-- **`Blocked by auto mode policy: <reason>`** — the classifier judged
-  the action unsafe. The reason comes from Stage 2 of the classifier.
+- **`Blocked by auto mode policy: <reason>`** —
+  the classifier judged the action unsafe. The reason comes from Stage
+  2 of the classifier.
 - **`Auto mode classifier unavailable; action blocked for safety`** —
   the classifier API was unreachable, timed out, or returned an
   un-parseable response. This is fail-closed behavior: when in doubt,
   block.
 
-The main LLM sees the same message in the tool result and adjusts its
-approach (asks you, switches tactic, gives up).
+Both messages are followed by a trailing guidance line telling the agent
+that the **denied action specifically** must not be completed through
+another tool, shell indirection, generated script, alias, symlink,
+config change, hook, command file, MCP configuration, encoded payload,
+or equivalent path. **Unrelated safe work and genuinely safer
+alternatives are still allowed** — only attempts to accomplish the same
+denied intent through a different surface are blocked.
+
+If the denied action is genuinely required, the agent should stop and
+ask you for explicit approval rather than route around the denial.
 
 ### Classifier reason language
 

package/bundled/qc-helper/docs/features/commands.md

@@ -268,17 +268,17 @@ In headless (`--prompt`) or non-interactive contexts, `/diff` prints a plain-tex
 
 Commands for obtaining information and performing system settings.
 
-| Command         | Description                                     | Usage Examples                   |
-| --------------- | ----------------------------------------------- | -------------------------------- |
-| `/help`         | Display help information for available commands | `/help` or `/?`                  |
-| `/status`       | Display version information                     | `/status` or `/about`            |
-| `/status paths` | Display current session file and log paths      | `/status paths`                  |
-| `/stats`        | Display detailed statistics for current session | `/stats`                         |
-| `/settings`     | Open settings editor                            | `/settings`                      |
-| `/auth`         | Change authentication method                    | `/auth`                          |
-| `/bug`          | Submit issue about Qwen Code                    | `/bug Button click unresponsive` |
-| `/copy`         | Copy last output content to clipboard           | `/copy`                          |
-| `/quit`         | Exit Qwen Code immediately                      | `/quit` or `/exit`               |
+| Command         | Description                                                   | Usage Examples                   |
+| --------------- | ------------------------------------------------------------- | -------------------------------- |
+| `/help`         | Display help information for available commands               | `/help` or `/?`                  |
+| `/status`       | Display version information                                   | `/status` or `/about`            |
+| `/status paths` | Display current session file and log paths                    | `/status paths`                  |
+| `/stats`        | Display detailed statistics for current session               | `/stats`                         |
+| `/settings`     | Open settings editor                                          | `/settings`                      |
+| `/auth`         | Change authentication method                                  | `/auth`                          |
+| `/bug`          | Submit issue about Qwen Code                                  | `/bug Button click unresponsive` |
+| `/copy`         | Copy AI output to clipboard (`/copy N` = Nth-last AI message) | `/copy` or `/copy 2`             |
+| `/quit`         | Exit Qwen Code immediately                                    | `/quit` or `/exit`               |
 
 ### 1.10 Common Shortcuts
 

package/bundled/qc-helper/docs/features/markdown-rendering.md

@@ -150,6 +150,25 @@ response:
 | `/copy code typescript` | Copies the last `typescript` code block. |
 | `/copy code mermaid 1`  | Copies the first `mermaid` code block.   |
 
+## Selecting an Earlier AI Message
+
+By default `/copy` targets the most recent AI message. Prefix the command with
+a positive integer to copy from the Nth-last AI message instead — handy when
+the latest reply is something low-signal (e.g., a TODO update) and the
+substantive output is one or two turns back.
+
+| Command               | Behavior                                               |
+| --------------------- | ------------------------------------------------------ |
+| `/copy 2`             | Copies the second-to-last AI message in full.          |
+| `/copy 3`             | Copies the third-to-last AI message in full.           |
+| `/copy 2 code python` | Copies the last `python` code block from the 2nd-last. |
+| `/copy 3 latex`       | Copies the last LaTeX block from the 3rd-last message. |
+
+`/copy 1` is equivalent to `/copy`. If `N` exceeds the number of AI messages
+in the session, `/copy` reports the actual count instead of copying anything.
+Without a leading integer, sub-selectors such as `/copy code python 2` keep
+their existing meaning (the 2nd `python` block in the last message).
+
 ## Current Limits
 
 - Mermaid image rendering depends on Mermaid CLI plus terminal image support.
@@ -160,4 +179,5 @@ response:
   Mermaid layout engine.
 - Raw mode is global for rendered Markdown blocks; it is not a per-block toggle.
 - LaTeX rendering covers common symbols and expressions, not full TeX layout.
-- Source copy commands operate on the last AI response.
+- Source copy commands target the last AI response by default, or the Nth-last
+  when invoked as `/copy N ...`.

package/chunks/{agent-CRCEWDXY.js → agent-6J2FFD7S.js}

@@ -7,33 +7,33 @@ import {
   hasRebuiltToolRegistry,
   rebuildToolRegistryOnOverride,
   resolveSubagentApprovalMode
-} from "./chunk-MUMLIB4J.js";
+} from "./chunk-BUOJN3MM.js";
 import "./chunk-K5PGHDBN.js";
 import "./chunk-O4PICXES.js";
 import "./chunk-TW522KN6.js";
 import "./chunk-MLZQVCF3.js";
-import "./chunk-77UV3M62.js";
-import "./chunk-UEW42CYE.js";
-import "./chunk-OPFJCRUK.js";
+import "./chunk-SCHRFI7O.js";
+import "./chunk-PLYZAP4W.js";
+import "./chunk-UABFCMPA.js";
 import "./chunk-77WXWU44.js";
-import "./chunk-LESSBSSE.js";
-import "./chunk-MW6Z7JDT.js";
+import "./chunk-6VFG3EUJ.js";
+import "./chunk-3H7ENG2Q.js";
 import "./chunk-3PJXIDKI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";
-import "./chunk-2T34DNYQ.js";
-import "./chunk-KSX2FIAZ.js";
-import "./chunk-UKQJ7G3U.js";
-import "./chunk-UB3HGW3I.js";
-import "./chunk-JAF4PLE7.js";
-import "./chunk-7R5J5HSJ.js";
-import "./chunk-DU2ZAFA7.js";
-import "./chunk-R7WIF3BU.js";
-import "./chunk-OV5SE5JD.js";
+import "./chunk-AVLOK27J.js";
+import "./chunk-JSYEZAYV.js";
+import "./chunk-5RNZ2QKF.js";
+import "./chunk-G763GDO6.js";
+import "./chunk-JMLIPZUU.js";
+import "./chunk-GBEPNWYB.js";
+import "./chunk-F5ORN4YO.js";
+import "./chunk-MVX64PNU.js";
+import "./chunk-D46KOV3C.js";
 import "./chunk-BNESGOSJ.js";
 import "./chunk-SZOEIL6S.js";
 import "./chunk-5IFG2VC4.js";
-import "./chunk-S2HZQ4RC.js";
+import "./chunk-R5PDRHEF.js";
 import "./chunk-ZERZSAZL.js";
 import "./chunk-QN5NZ3UQ.js";
 import "./chunk-BR4QREVK.js";

package/chunks/{anthropicContentGenerator-CORCIHMT.js → anthropicContentGenerator-4QBVSFSJ.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-KQIKOTQJ.js";
 import {
   RequestTokenizer
-} from "./chunk-ZAHZV7IR.js";
+} from "./chunk-BBTV54KB.js";
 import {
   Blob,
   File,
@@ -16,7 +16,7 @@ import {
 import {
   buildRuntimeFetchOptions,
   redactProxyError
-} from "./chunk-R7WIF3BU.js";
+} from "./chunk-MVX64PNU.js";
 import {
   CAPPED_DEFAULT_MAX_TOKENS,
   DEFAULT_TIMEOUT,
@@ -25,7 +25,7 @@ import {
   runtimeDiagnostics,
   safeJsonParse,
   tokenLimit
-} from "./chunk-OV5SE5JD.js";
+} from "./chunk-D46KOV3C.js";
 import {
   FinishReason,
   GenerateContentResponse
@@ -34,7 +34,7 @@ import "./chunk-SZOEIL6S.js";
 import "./chunk-5IFG2VC4.js";
 import {
   createDebugLogger
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import {
   require_ms
 } from "./chunk-BR4QREVK.js";

package/chunks/{askUserQuestion-LXMRMFII.js → askUserQuestion-NOOLRWCJ.js}

@@ -6,10 +6,10 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-UB3HGW3I.js";
+} from "./chunk-G763GDO6.js";
 import {
   createDebugLogger
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import "./chunk-WFVXF3OM.js";
 import {
   init_esbuild_shims

package/chunks/{ca-AD47AV3M.js → ca-WRHFBIDH.js}

@@ -171,7 +171,7 @@ var ca_default = {
   "open full Qwen Code documentation in your browser": "obrir la documentaci\xF3 completa de Qwen Code al navegador",
   "Configuration not available.": "Configuraci\xF3 no disponible.",
   "Connect an LLM provider": "Connectar un prove\xEFdor LLM",
-  "Copy the last result or code snippet to clipboard": "Copiar l'\xFAltim resultat o fragment de codi al porta-retalls",
+  "Copy the last AI response to clipboard (/copy N for Nth-latest)": "Copia l'\xFAltima resposta de la IA al porta-retalls (/copy N per a l'N-\xE8sima)",
   // ============================================================================
   // Ordres - Agents
   // ============================================================================
@@ -625,6 +625,15 @@ var ca_default = {
   // ============================================================================
   "Resume a previous session": "Reprendre una sessi\xF3 anterior",
   "Fork the current conversation into a new session": "Bifurca la conversa actual en una sessi\xF3 nova",
+  "Spawn a background agent that inherits the full conversation": "Inicia un agent en segon pla que hereta tota la conversa",
+  "Please provide a directive. Usage: /fork <directive>": "Proporcioneu una directiva. \xDAs: /fork <directiva>",
+  "Cannot fork while a response or tool call is in progress. Wait for it to finish or resolve the pending tool call.": "No es pot crear una bifurcaci\xF3 mentre hi ha una resposta o una crida a una eina en curs. Espereu que acabi o resolgueu la crida a l'eina pendent.",
+  "Cannot fork before the first conversation turn.": "No es pot crear una bifurcaci\xF3 abans del primer torn de conversa.",
+  "The /fork command requires the fork feature gate. Set QWEN_CODE_ENABLE_FORK_SUBAGENT=1 to enable it.": "L\u2019ordre /fork requereix el feature gate de fork. Definiu QWEN_CODE_ENABLE_FORK_SUBAGENT=1 per activar-lo.",
+  "The agent tool is unavailable; cannot fork.": "L'eina d'agent no est\xE0 disponible; no es pot crear una bifurcaci\xF3.",
+  "Failed to launch fork: {{error}}": "No s\u2019ha pogut iniciar la bifurcaci\xF3: {{error}}",
+  "User launched a background fork via /fork: {{directive}}": "L'usuari ha iniciat una bifurcaci\xF3 en segon pla amb /fork: {{directive}}",
+  "Forked into a background agent. It inherits this conversation and runs without blocking \u2014 track it in the background tasks panel; it reports back when done.": "S'ha bifurcat a un agent en segon pla. Hereta aquesta conversa i s'executa sense bloquejar \u2014 feu-ne el seguiment al tauler de tasques en segon pla; informar\xE0 quan acabi.",
   "Cannot branch while a response or tool call is in progress. Wait for it to finish or resolve the pending tool call.": "No es pot bifurcar mentre hi ha una resposta o una crida a una eina en curs. Espereu que acabi o resolgueu la crida a l'eina pendent.",
   "No conversation to branch.": "No hi ha cap conversa per bifurcar.",
   "Restore a tool call. This will reset the conversation and file history to the state it was in when the tool call was suggested": "Restaurar una crida a una eina. Aix\xF2 restablir\xE0 la conversa i l'historial de fitxers a l'estat en qu\xE8 es trobaven quan es va suggerir la crida a l'eina",

package/chunks/{chunk-MW6Z7JDT.js → chunk-3H7ENG2Q.js}

@@ -19,20 +19,20 @@ import {
   MAINLINE_CODER_MODEL
 } from "./chunk-OFEVLU4C.js";
 import {
-  isAutoMemPath
-} from "./chunk-2T34DNYQ.js";
+  isAnyAutoMemPath
+} from "./chunk-AVLOK27J.js";
 import {
   InstallationManager
-} from "./chunk-KSX2FIAZ.js";
+} from "./chunk-JSYEZAYV.js";
 import {
   STRUCTURED_OUTPUT_REDACTED_ARGS
-} from "./chunk-UKQJ7G3U.js";
+} from "./chunk-5RNZ2QKF.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-UB3HGW3I.js";
+} from "./chunk-G763GDO6.js";
 import {
   DEFAULT_OPENAI_BASE_URL,
   convertSchema,
@@ -40,7 +40,7 @@ import {
   runtimeDiagnostics,
   safeJsonParse,
   tokenLimit
-} from "./chunk-OV5SE5JD.js";
+} from "./chunk-D46KOV3C.js";
 import {
   FinishReason,
   GenerateContentResponse
@@ -60,7 +60,7 @@ import {
   setSessionContext,
   shortenPath,
   unescapePath
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import {
   require_dist
 } from "./chunk-ZERZSAZL.js";
@@ -69640,9 +69640,10 @@ var MODALITY_PATTERNS = [
   // -------------------
   // Alibaba / Qwen
   // -------------------
-  // Qwen3.5-Plus, Qwen3.6-Plus: image + video support
+  // Qwen Plus models: image + video support (Max models are text-only)
   [/^qwen3\.5-plus/, { image: true, video: true }],
   [/^qwen3\.6-plus/, { image: true, video: true }],
+  [/^qwen3\.7-plus/, { image: true, video: true }],
   [/^coder-model$/, { image: true, video: true }],
   // Qwen VL (vision-language) models: image + video
   [/^qwen-vl-/, { image: true, video: true }],
@@ -71002,11 +71003,11 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
   }
   let baseGenerator;
   if (authType === "openai" /* USE_OPENAI */) {
-    const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-557UCKMQ.js");
+    const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-3U6UARHS.js");
     baseGenerator = createOpenAIContentGenerator(generatorConfig, config);
   } else if (authType === "qwen-oauth" /* QWEN_OAUTH */) {
-    const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-FUBP4U5T.js");
-    const { QwenContentGenerator } = await import("./qwenContentGenerator-QG4JMJH5.js");
+    const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-KRJT35QH.js");
+    const { QwenContentGenerator } = await import("./qwenContentGenerator-JRFHJRH6.js");
     try {
       const qwenClient = await getQwenOauthClient(
         config,
@@ -71023,10 +71024,10 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       );
     }
   } else if (authType === "anthropic" /* USE_ANTHROPIC */) {
-    const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-CORCIHMT.js");
+    const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-4QBVSFSJ.js");
     baseGenerator = createAnthropicContentGenerator(generatorConfig, config);
   } else if (authType === "gemini" /* USE_GEMINI */ || authType === "vertex-ai" /* USE_VERTEX_AI */) {
-    const { createGeminiContentGenerator } = await import("./geminiContentGenerator-BB4RL4HR.js");
+    const { createGeminiContentGenerator } = await import("./geminiContentGenerator-3AKHMB3P.js");
     baseGenerator = createGeminiContentGenerator(generatorConfig, config);
   } else {
     throw new Error(
@@ -72856,10 +72857,11 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
       ...this.config.storage.getUserSkillsDirs(),
       Storage.getUserExtensionsDir()
     ];
-    if (workspaceContext.isPathWithinWorkspace(filePath) || isSubpaths(allowedRoots, filePath) || // isAutoMemPath uses the narrower managed auto-memory root for this
-    // project — not the broad getMemoryBaseDir() — to avoid exposing
-    // sensitive ~/.qwen files such as settings.json or OAuth credentials.
-    isAutoMemPath(filePath, this.config.getTargetDir())) {
+    if (workspaceContext.isPathWithinWorkspace(filePath) || isSubpaths(allowedRoots, filePath) || // isAnyAutoMemPath narrows to the managed auto-memory roots
+    // (per-project + user-level under ~/.qwen/memories/) — never the
+    // broad getMemoryBaseDir() — to avoid exposing sensitive ~/.qwen
+    // files such as settings.json or OAuth credentials.
+    isAnyAutoMemPath(filePath, this.config.getTargetDir())) {
       return "allow";
     }
     return "ask";
@@ -72867,7 +72869,7 @@ var ReadFileToolInvocation = class extends BaseToolInvocation {
   async execute() {
     const absPath = path7.resolve(this.params.file_path);
     const projectRoot = this.config.getTargetDir();
-    const isAutoMem = isAutoMemPath(absPath, projectRoot);
+    const isAutoMem = isAnyAutoMemPath(absPath, projectRoot);
     const cacheEnabled = !this.config.getFileReadCacheDisabled();
     const useFastPath = cacheEnabled && !isAutoMem;
     const cache = this.config.getFileReadCache();

package/chunks/{chunk-UKQJ7G3U.js → chunk-5RNZ2QKF.js}

@@ -5,7 +5,7 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-UB3HGW3I.js";
+} from "./chunk-G763GDO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-LESSBSSE.js → chunk-6VFG3EUJ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-2T34DNYQ.js → chunk-AVLOK27J.js}

@@ -3,8 +3,9 @@
 import {
   QWEN_DIR,
   Storage,
+  resolvePath,
   sanitizeCwd
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -21,6 +22,7 @@ var AUTO_MEMORY_INDEX_FILENAME = "MEMORY.md";
 var AUTO_MEMORY_METADATA_FILENAME = "meta.json";
 var AUTO_MEMORY_EXTRACT_CURSOR_FILENAME = "extract-cursor.json";
 var AUTO_MEMORY_CONSOLIDATION_LOCK_FILENAME = "consolidation.lock";
+var USER_AUTO_MEMORY_DIRNAME = "memories";
 function findGitRoot(startPath) {
   let current = path.resolve(startPath);
   while (true) {
@@ -74,28 +76,31 @@ function findCanonicalGitRoot(startPath) {
 __name(findCanonicalGitRoot, "findCanonicalGitRoot");
 function getMemoryBaseDir() {
   if (process.env["QWEN_CODE_MEMORY_BASE_DIR"]) {
-    return process.env["QWEN_CODE_MEMORY_BASE_DIR"];
+    return resolvePath(void 0, process.env["QWEN_CODE_MEMORY_BASE_DIR"]);
   }
-  return Storage.getGlobalQwenDir();
+  return Storage.getRuntimeBaseDir();
 }
 __name(getMemoryBaseDir, "getMemoryBaseDir");
 var _autoMemoryRootCache = /* @__PURE__ */ new Map();
 function getAutoMemoryRoot(projectRoot) {
-  const cached = _autoMemoryRootCache.get(projectRoot);
+  const useLocalMemory = process.env["QWEN_CODE_MEMORY_LOCAL"] === "1";
+  const memoryBaseDir = useLocalMemory ? "" : getMemoryBaseDir();
+  const cacheKey = `${useLocalMemory ? "local" : memoryBaseDir}\0${projectRoot}`;
+  const cached = _autoMemoryRootCache.get(cacheKey);
   if (cached !== void 0) return cached;
   let result;
-  if (process.env["QWEN_CODE_MEMORY_LOCAL"] === "1") {
+  if (useLocalMemory) {
     result = path.join(projectRoot, QWEN_DIR, AUTO_MEMORY_DIRNAME);
   } else {
     const canonicalRoot = findCanonicalGitRoot(projectRoot) ?? path.resolve(projectRoot);
     result = path.join(
-      getMemoryBaseDir(),
+      memoryBaseDir,
       "projects",
       sanitizeCwd(canonicalRoot),
       AUTO_MEMORY_DIRNAME
     );
   }
-  _autoMemoryRootCache.set(projectRoot, result);
+  _autoMemoryRootCache.set(cacheKey, result);
   return result;
 }
 __name(getAutoMemoryRoot, "getAutoMemoryRoot");
@@ -154,6 +159,29 @@ function getAutoMemoryFilePath(projectRoot, relativePath) {
   return path.join(getAutoMemoryRoot(projectRoot), relativePath);
 }
 __name(getAutoMemoryFilePath, "getAutoMemoryFilePath");
+function getUserAutoMemoryRoot() {
+  return path.join(getMemoryBaseDir(), USER_AUTO_MEMORY_DIRNAME);
+}
+__name(getUserAutoMemoryRoot, "getUserAutoMemoryRoot");
+function getUserAutoMemoryIndexPath() {
+  return path.join(getUserAutoMemoryRoot(), AUTO_MEMORY_INDEX_FILENAME);
+}
+__name(getUserAutoMemoryIndexPath, "getUserAutoMemoryIndexPath");
+function getUserAutoMemoryTopicPath(type) {
+  return path.join(getUserAutoMemoryRoot(), getAutoMemoryTopicFilename(type));
+}
+__name(getUserAutoMemoryTopicPath, "getUserAutoMemoryTopicPath");
+function isUserAutoMemPath(absolutePath) {
+  const normalizedPath = path.normalize(absolutePath);
+  const memRoot = path.normalize(getUserAutoMemoryRoot());
+  const rel = path.relative(memRoot, normalizedPath);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+__name(isUserAutoMemPath, "isUserAutoMemPath");
+function isAnyAutoMemPath(absolutePath, projectRoot) {
+  return isAutoMemPath(absolutePath, projectRoot) || isUserAutoMemPath(absolutePath);
+}
+__name(isAnyAutoMemPath, "isAnyAutoMemPath");
 
 export {
   AUTO_MEMORY_DIRNAME,
@@ -161,6 +189,7 @@ export {
   AUTO_MEMORY_METADATA_FILENAME,
   AUTO_MEMORY_EXTRACT_CURSOR_FILENAME,
   AUTO_MEMORY_CONSOLIDATION_LOCK_FILENAME,
+  USER_AUTO_MEMORY_DIRNAME,
   getMemoryBaseDir,
   getAutoMemoryRoot,
   clearAutoMemoryRootCache,
@@ -172,7 +201,12 @@ export {
   getAutoMemoryConsolidationLockPath,
   getAutoMemoryTopicFilename,
   getAutoMemoryTopicPath,
-  getAutoMemoryFilePath
+  getAutoMemoryFilePath,
+  getUserAutoMemoryRoot,
+  getUserAutoMemoryIndexPath,
+  getUserAutoMemoryTopicPath,
+  isUserAutoMemPath,
+  isAnyAutoMemPath
 };
 /**
  * @license

package/chunks/{chunk-ZAHZV7IR.js → chunk-BBTV54KB.js}

@@ -3,10 +3,10 @@
 import {
   TextTokenizer,
   isSupportedImageMimeType
-} from "./chunk-R7WIF3BU.js";
+} from "./chunk-MVX64PNU.js";
 import {
   createDebugLogger
-} from "./chunk-S2HZQ4RC.js";
+} from "./chunk-R5PDRHEF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";