@qwen-code/qwen-code 0.18.4 → 0.18.5-preview.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (179) hide show
  1. package/bundled/qc-helper/SKILL.md +13 -5
  2. package/bundled/qc-helper/docs/configuration/_meta.ts +1 -0
  3. package/bundled/qc-helper/docs/configuration/auth.md +75 -54
  4. package/bundled/qc-helper/docs/configuration/model-providers.md +221 -185
  5. package/bundled/qc-helper/docs/configuration/qwen-ignore.md +31 -15
  6. package/bundled/qc-helper/docs/configuration/settings.md +70 -53
  7. package/bundled/qc-helper/docs/configuration/themes.md +7 -4
  8. package/bundled/qc-helper/docs/extension/extension-releasing.md +1 -1
  9. package/bundled/qc-helper/docs/extension/introduction.md +27 -21
  10. package/bundled/qc-helper/docs/features/approval-mode.md +2 -0
  11. package/bundled/qc-helper/docs/features/arena.md +3 -3
  12. package/bundled/qc-helper/docs/features/channels/overview.md +1 -1
  13. package/bundled/qc-helper/docs/features/channels/plugins.md +1 -1
  14. package/bundled/qc-helper/docs/features/commands.md +6 -1
  15. package/bundled/qc-helper/docs/features/headless.md +1 -1
  16. package/bundled/qc-helper/docs/features/mcp.md +78 -10
  17. package/bundled/qc-helper/docs/features/sandbox.md +2 -2
  18. package/bundled/qc-helper/docs/features/tool-use-summaries.md +1 -1
  19. package/bundled/qc-helper/docs/integration-github-action.md +2 -2
  20. package/bundled/qc-helper/docs/overview.md +1 -1
  21. package/bundled/qc-helper/docs/quickstart.md +9 -5
  22. package/bundled/qc-helper/docs/qwen-serve.md +14 -2
  23. package/bundled/qc-helper/docs/support/tos-privacy.md +1 -1
  24. package/chunks/{agent-LYTC56HT.js → agent-P4KSTVXX.js} +24 -22
  25. package/chunks/{agent-headless-FPUP5WHP.js → agent-headless-QUAPWF55.js} +24 -22
  26. package/chunks/{anthropicContentGenerator-OLOGBVLP.js → anthropicContentGenerator-7352A7I5.js} +17 -14
  27. package/chunks/artifact-tool-5J4HUZAV.js +675 -0
  28. package/chunks/{askUserQuestion-ANRVSBIJ.js → askUserQuestion-HF7HCWDD.js} +20 -7
  29. package/chunks/{ca-K6MD665I.js → ca-7WC7ELX6.js} +1 -0
  30. package/chunks/chunk-22IFUCVR.js +291 -0
  31. package/chunks/{chunk-M5VYHAHT.js → chunk-2BIF2NVV.js} +2 -2
  32. package/chunks/{chunk-AQDPHFDZ.js → chunk-2QDQTWCI.js} +1 -1
  33. package/chunks/{chunk-2ES3D3TW.js → chunk-3BR4OIOE.js} +3 -3
  34. package/chunks/{chunk-N5QHMPZU.js → chunk-3UALQ56H.js} +1 -1
  35. package/chunks/{chunk-5RVEAAD2.js → chunk-BC5POO46.js} +8 -7
  36. package/chunks/{chunk-DZCZZPCY.js → chunk-BGUDAULQ.js} +11 -290
  37. package/chunks/{chunk-FPZF3BNV.js → chunk-BNXANYLH.js} +1 -1
  38. package/chunks/{chunk-IKOWINH4.js → chunk-C4K3FEQ2.js} +42 -2
  39. package/chunks/{chunk-PTGKSUUJ.js → chunk-CGEGHF2C.js} +2 -207
  40. package/chunks/chunk-EEEZIVFJ.js +908 -0
  41. package/chunks/{chunk-GBTJHKQ6.js → chunk-EIJYMXXX.js} +619 -135
  42. package/chunks/chunk-EJYJYJZ2.js +3703 -0
  43. package/chunks/{chunk-F6FP3URI.js → chunk-EW6C27XX.js} +1 -1
  44. package/chunks/{chunk-HU3RKEK2.js → chunk-F6XNTYNE.js} +216 -1
  45. package/chunks/{chunk-4HMWGHPP.js → chunk-GZCJS5WH.js} +2 -2
  46. package/chunks/{chunk-E5SRTXRG.js → chunk-HGNSRCRB.js} +1 -1
  47. package/chunks/{chunk-IUEQOXOI.js → chunk-KBXLIVWQ.js} +2 -2
  48. package/chunks/{chunk-JJHY7NAD.js → chunk-L7U2RI5O.js} +59 -57
  49. package/chunks/{chunk-JN6FVOPP.js → chunk-NKJ6LRCR.js} +2 -2
  50. package/chunks/{chunk-7OCZ77KA.js → chunk-NWLUISRA.js} +1 -1
  51. package/chunks/{chunk-JIJBNW4A.js → chunk-OTBK43JR.js} +1 -1
  52. package/chunks/{chunk-WWU2KUSR.js → chunk-PRYMDRBV.js} +1 -1
  53. package/chunks/{chunk-KQIKOTQJ.js → chunk-RYLJU2DY.js} +60 -5
  54. package/chunks/{chunk-VWPDSQZY.js → chunk-T2VDEFUU.js} +2 -2
  55. package/chunks/{chunk-LXUQBWQA.js → chunk-T336V435.js} +93 -45
  56. package/chunks/{chunk-4TW2JM5Q.js → chunk-TXVGVZYR.js} +3 -3
  57. package/chunks/{chunk-6Z2MVJIJ.js → chunk-UMRZ7XCR.js} +172 -5017
  58. package/chunks/{chunk-7GX7XYZU.js → chunk-XU5P23GN.js} +3 -3
  59. package/chunks/{chunk-SZWDOOGV.js → chunk-ZC675NGC.js} +11 -11
  60. package/chunks/{chunk-32SSXBMG.js → chunk-ZXNEOCW2.js} +8049 -5520
  61. package/chunks/{computer-use-P4WQBATW.js → computer-use-4TLHI3UR.js} +26 -23
  62. package/chunks/contextCommand-HFEITKSR.js +56 -0
  63. package/chunks/{cron-create-OKGQO6GX.js → cron-create-A5637KCI.js} +12 -9
  64. package/chunks/{cron-delete-DTJP7L6O.js → cron-delete-AADOSEOZ.js} +4 -4
  65. package/chunks/{cron-list-VKZUASFG.js → cron-list-OFCPTT2Y.js} +4 -4
  66. package/chunks/{de-K2F3T3TR.js → de-ACHALDED.js} +1 -0
  67. package/chunks/{dist-OLC6NBSB.js → dist-DZ6AJDX4.js} +1 -1
  68. package/chunks/{dist-QUSDBLAK.js → dist-ZBX7LPJZ.js} +6 -1
  69. package/chunks/{edit-CS7DSS4Z.js → edit-B7H73V6O.js} +24 -22
  70. package/chunks/{en-KGSAKBJP.js → en-7OGNWWME.js} +49 -0
  71. package/chunks/{enter-worktree-PA4HPHJK.js → enter-worktree-GG7ZHYPS.js} +24 -22
  72. package/chunks/{enterPlanMode-SFE5AFKZ.js → enterPlanMode-RHTAKG52.js} +32 -28
  73. package/chunks/{exit-worktree-FR3AZTC6.js → exit-worktree-U7VQZRMG.js} +24 -22
  74. package/chunks/{exitPlanMode-AHOUO44D.js → exitPlanMode-S35A36II.js} +36 -28
  75. package/chunks/{fr-2CAQEOK6.js → fr-GVKZ27MF.js} +1 -0
  76. package/chunks/{geminiContentGenerator-AXCVDKGI.js → geminiContentGenerator-W7KVATBA.js} +4 -4
  77. package/chunks/{glob-BQPAW3IW.js → glob-WOFF7ECI.js} +26 -23
  78. package/chunks/{grep-2F7BL5TQ.js → grep-MWNYWYWQ.js} +24 -22
  79. package/chunks/{ja-QWL7V6OJ.js → ja-FKZ2WZ4D.js} +1 -0
  80. package/chunks/{keychain-token-storage-ALKQXYJQ.js → keychain-token-storage-CSYMNRPP.js} +2 -2
  81. package/chunks/{loop-wakeup-RX6YIUSG.js → loop-wakeup-DGSMT4N6.js} +5 -5
  82. package/chunks/{ls-6PLNWHMU.js → ls-UGRZ4ZOM.js} +6 -6
  83. package/chunks/{lsp-3HFQU4OF.js → lsp-72IJURW3.js} +2 -2
  84. package/chunks/{monitor-YTTMDFW2.js → monitor-AYUINLYN.js} +24 -22
  85. package/chunks/{notebook-edit-7TNZMTBR.js → notebook-edit-EP4D4WFD.js} +25 -23
  86. package/chunks/{openaiContentGenerator-JA6YXXPI.js → openaiContentGenerator-SLYYF7AM.js} +12 -13
  87. package/chunks/{pt-2SPOLMAY.js → pt-SY5NCFGR.js} +1 -0
  88. package/chunks/{qwenContentGenerator-NBOVGW7B.js → qwenContentGenerator-VZ7JYU4A.js} +27 -25
  89. package/chunks/{qwenOAuth2-XWC5SU63.js → qwenOAuth2-K4AASPCV.js} +5 -4
  90. package/chunks/{read-file-RUBU3KUA.js → read-file-65EQ53KS.js} +9 -8
  91. package/chunks/{ripGrep-TPFC7KZF.js → ripGrep-5XLHJDDM.js} +24 -22
  92. package/chunks/{ru-35IVJTEH.js → ru-FWNXJG4F.js} +1 -0
  93. package/chunks/{scheduler-NTVF45LR.js → scheduler-5GLJSA2H.js} +73 -27
  94. package/chunks/{send-message-IIT3SHA7.js → send-message-URUZ7PLA.js} +24 -4
  95. package/chunks/{serve-J6VG37OX.js → serve-MUROZGCG.js} +7575 -6916
  96. package/chunks/{shell-EQQEHEFI.js → shell-ET3BQWKB.js} +24 -22
  97. package/chunks/{skill-QWRWJCQJ.js → skill-YEYABCAF.js} +11 -10
  98. package/chunks/{src-LNADIG5P.js → src-POVOI65Y.js} +165 -66
  99. package/chunks/{syntheticOutput-H67FYXU7.js → syntheticOutput-65FRJGWM.js} +3 -3
  100. package/chunks/{task-create-OVXHSHAI.js → task-create-IH45HOFT.js} +6 -6
  101. package/chunks/{task-list-QUUCQJ3U.js → task-list-FUB6JWSX.js} +5 -5
  102. package/chunks/{task-stop-WA5DMTKK.js → task-stop-P6IOHQM3.js} +2 -2
  103. package/chunks/{task-update-PC5427TI.js → task-update-RTUT7LJV.js} +6 -6
  104. package/chunks/{team-create-TXWQL777.js → team-create-EFZFKQFP.js} +28 -26
  105. package/chunks/{team-delete-ZTEMYRJ3.js → team-delete-RXGYRMHC.js} +5 -5
  106. package/chunks/{todoWrite-J6L6ELD6.js → todoWrite-O6JK24G6.js} +4 -4
  107. package/chunks/{tool-search-JAVM7ABF.js → tool-search-BRJC42TE.js} +9 -8
  108. package/chunks/{web-fetch-6XLPPTP7.js → web-fetch-KUMBROUI.js} +4 -4
  109. package/chunks/{workflow-7LN3L6KK.js → workflow-UDRBNFTT.js} +557 -97
  110. package/chunks/{write-file-DAKE7YKB.js → write-file-F7TAHAHF.js} +24 -22
  111. package/chunks/{zh-X4KM6MTW.js → zh-3RMSEO5M.js} +49 -0
  112. package/chunks/{zh-TW-BSG6BUWK.js → zh-TW-R7WRLTJS.js} +49 -0
  113. package/cli.js +9205 -5426
  114. package/locales/ca.js +2 -1
  115. package/locales/de.js +1 -0
  116. package/locales/en.js +70 -0
  117. package/locales/fr.js +1 -0
  118. package/locales/ja.js +1 -0
  119. package/locales/pt.js +1 -0
  120. package/locales/ru.js +1 -0
  121. package/locales/zh-TW.js +67 -0
  122. package/locales/zh.js +67 -0
  123. package/package.json +3 -2
  124. package/web-shell/assets/{arc-CRFN10gD.js → arc-DHUeMnnj.js} +1 -1
  125. package/web-shell/assets/{architectureDiagram-3BPJPVTR-IRlu1CpH.js → architectureDiagram-3BPJPVTR-DlX12yyj.js} +1 -1
  126. package/web-shell/assets/{blockDiagram-GPEHLZMM-htIZ6iw8.js → blockDiagram-GPEHLZMM-DTFUXMUT.js} +1 -1
  127. package/web-shell/assets/{c4Diagram-AAUBKEIU-A2GoRq3O.js → c4Diagram-AAUBKEIU-CWdB54fk.js} +1 -1
  128. package/web-shell/assets/channel-C3WhMjjP.js +1 -0
  129. package/web-shell/assets/{chunk-2J33WTMH-CdP2AC6u.js → chunk-2J33WTMH-CF5C5jNR.js} +1 -1
  130. package/web-shell/assets/{chunk-4BX2VUAB-DrA07nW2.js → chunk-4BX2VUAB-Cw7Ydfji.js} +1 -1
  131. package/web-shell/assets/{chunk-55IACEB6-CFGnVU2f.js → chunk-55IACEB6-CnbI1ZCw.js} +1 -1
  132. package/web-shell/assets/{chunk-727SXJPM-BTMkq3Tk.js → chunk-727SXJPM-DmSy00Pe.js} +1 -1
  133. package/web-shell/assets/{chunk-AQP2D5EJ-C9sYg04Z.js → chunk-AQP2D5EJ-DgNgXqBu.js} +1 -1
  134. package/web-shell/assets/{chunk-FMBD7UC4-Cag-cj6I.js → chunk-FMBD7UC4-tz2IvOXv.js} +1 -1
  135. package/web-shell/assets/{chunk-ND2GUHAM-CDSTFoR7.js → chunk-ND2GUHAM-DaBLEBPa.js} +1 -1
  136. package/web-shell/assets/{chunk-QZHKN3VN-CN9Z6oOs.js → chunk-QZHKN3VN-DVCQST3O.js} +1 -1
  137. package/web-shell/assets/classDiagram-4FO5ZUOK-CQ6TXPif.js +1 -0
  138. package/web-shell/assets/classDiagram-v2-Q7XG4LA2-CQ6TXPif.js +1 -0
  139. package/web-shell/assets/{cose-bilkent-S5V4N54A-DuN9j8Du.js → cose-bilkent-S5V4N54A-CAKTcdCQ.js} +1 -1
  140. package/web-shell/assets/{dagre-BM42HDAG-ByCWe45f.js → dagre-BM42HDAG-BdkBwlKg.js} +1 -1
  141. package/web-shell/assets/{diagram-2AECGRRQ-eWyU_pKZ.js → diagram-2AECGRRQ-DYt3G65F.js} +1 -1
  142. package/web-shell/assets/{diagram-5GNKFQAL-0Bfu3Fq5.js → diagram-5GNKFQAL-BWvROWjY.js} +1 -1
  143. package/web-shell/assets/{diagram-KO2AKTUF-B6KBKkQP.js → diagram-KO2AKTUF-BvvgwIaQ.js} +1 -1
  144. package/web-shell/assets/{diagram-LMA3HP47-TToDmeA_.js → diagram-LMA3HP47-E7NLSNKg.js} +1 -1
  145. package/web-shell/assets/{diagram-OG6HWLK6-CQCkC2Yx.js → diagram-OG6HWLK6-CYmUBgpE.js} +1 -1
  146. package/web-shell/assets/{erDiagram-TEJ5UH35-Cm9ls1iB.js → erDiagram-TEJ5UH35-BU5gY30h.js} +1 -1
  147. package/web-shell/assets/{flowDiagram-I6XJVG4X-Dyoz80Pv.js → flowDiagram-I6XJVG4X-V_ZssSZ9.js} +1 -1
  148. package/web-shell/assets/{ganttDiagram-6RSMTGT7-Cfut9yaU.js → ganttDiagram-6RSMTGT7-QIShlsdI.js} +1 -1
  149. package/web-shell/assets/{gitGraphDiagram-PVQCEYII-BCuJdlfD.js → gitGraphDiagram-PVQCEYII-DJxdu2YS.js} +1 -1
  150. package/web-shell/assets/index-BPnhI7gl.css +1 -0
  151. package/web-shell/assets/index-De4rqTsW.js +706 -0
  152. package/web-shell/assets/{infoDiagram-5YYISTIA-CXKxF2VL.js → infoDiagram-5YYISTIA-BqjdrFeO.js} +1 -1
  153. package/web-shell/assets/{ishikawaDiagram-YF4QCWOH-DE7HWSU8.js → ishikawaDiagram-YF4QCWOH-BP_a2YZ2.js} +1 -1
  154. package/web-shell/assets/{journeyDiagram-JHISSGLW-D__YUfds.js → journeyDiagram-JHISSGLW-BXg-S3Lk.js} +1 -1
  155. package/web-shell/assets/{kanban-definition-UN3LZRKU-D82R169M.js → kanban-definition-UN3LZRKU-BksAkdEJ.js} +1 -1
  156. package/web-shell/assets/{linear-DpyMbKqT.js → linear-D2m9-ODE.js} +1 -1
  157. package/web-shell/assets/{mermaid.core-D1KEFDhn.js → mermaid.core-dTtkZp2F.js} +5 -5
  158. package/web-shell/assets/{mindmap-definition-RKZ34NQL-BwVUFGFE.js → mindmap-definition-RKZ34NQL-Bft9my8O.js} +1 -1
  159. package/web-shell/assets/{pieDiagram-4H26LBE5-BO_qoEGx.js → pieDiagram-4H26LBE5-Cw8S-alZ.js} +1 -1
  160. package/web-shell/assets/{quadrantDiagram-W4KKPZXB-Cx0ZaWPo.js → quadrantDiagram-W4KKPZXB-DaDoTMts.js} +1 -1
  161. package/web-shell/assets/{requirementDiagram-4Y6WPE33-BJPXejOA.js → requirementDiagram-4Y6WPE33-Cp5kSpwj.js} +1 -1
  162. package/web-shell/assets/{sankeyDiagram-5OEKKPKP-C1xeIL9i.js → sankeyDiagram-5OEKKPKP-CW8RsJJZ.js} +1 -1
  163. package/web-shell/assets/{sequenceDiagram-3UESZ5HK-CSYKQUjf.js → sequenceDiagram-3UESZ5HK-DTfpIiJK.js} +1 -1
  164. package/web-shell/assets/{stateDiagram-AJRCARHV-d9hiHlAW.js → stateDiagram-AJRCARHV-DixFVzEs.js} +1 -1
  165. package/web-shell/assets/stateDiagram-v2-BHNVJYJU-DZgE04s3.js +1 -0
  166. package/web-shell/assets/{timeline-definition-PNZ67QCA-BhCBkq8k.js → timeline-definition-PNZ67QCA-DYsbXn5l.js} +1 -1
  167. package/web-shell/assets/{vennDiagram-CIIHVFJN-DPPFWp_y.js → vennDiagram-CIIHVFJN-HUpRpuUp.js} +1 -1
  168. package/web-shell/assets/{wardley-L42UT6IY-CcOUIgXY.js → wardley-L42UT6IY-cT3nQH_T.js} +1 -1
  169. package/web-shell/assets/{wardleyDiagram-YWT4CUSO-p7oR5X7r.js → wardleyDiagram-YWT4CUSO-Dmm7J6Qc.js} +1 -1
  170. package/web-shell/assets/{xychartDiagram-2RQKCTM6-Dfr7-SEy.js → xychartDiagram-2RQKCTM6-CX0L5p9C.js} +1 -1
  171. package/web-shell/index.html +3 -3
  172. package/chunks/chunk-77WXWU44.js +0 -26
  173. package/chunks/contextCommand-POQ6GYN3.js +0 -54
  174. package/web-shell/assets/channel-WwImfsc7.js +0 -1
  175. package/web-shell/assets/classDiagram-4FO5ZUOK-CJKQYFeJ.js +0 -1
  176. package/web-shell/assets/classDiagram-v2-Q7XG4LA2-CJKQYFeJ.js +0 -1
  177. package/web-shell/assets/index-BDZiTAkl.css +0 -1
  178. package/web-shell/assets/index-DaebdpHq.js +0 -516
  179. package/web-shell/assets/stateDiagram-v2-BHNVJYJU-DgReoybQ.js +0 -1
@@ -2,17 +2,20 @@
2
2
  "use strict";
3
3
  import {
4
4
  formatFetchErrorForUser
5
- } from "./chunk-F6FP3URI.js";
5
+ } from "./chunk-EW6C27XX.js";
6
+ import {
7
+ openBrowserSecurely
8
+ } from "./chunk-22IFUCVR.js";
6
9
  import {
7
10
  combineAbortSignals
8
11
  } from "./chunk-64WXLC72.js";
9
12
  import {
10
13
  atomicWriteFile
11
- } from "./chunk-N5QHMPZU.js";
14
+ } from "./chunk-3UALQ56H.js";
12
15
  import {
13
16
  Storage,
14
17
  createDebugLogger
15
- } from "./chunk-IKOWINH4.js";
18
+ } from "./chunk-C4K3FEQ2.js";
16
19
  import {
17
20
  init_esbuild_shims
18
21
  } from "./chunk-A4BMJM77.js";
@@ -28,279 +31,6 @@ import { promises as fs2 } from "node:fs";
28
31
  import { EventEmitter } from "events";
29
32
  import { randomUUID as randomUUID2 } from "node:crypto";
30
33
 
31
- // packages/core/src/utils/secure-browser-launcher.ts
32
- init_esbuild_shims();
33
- import { execFile, spawn } from "node:child_process";
34
- import { promisify } from "node:util";
35
- import { platform } from "node:os";
36
- import { resolve } from "node:path";
37
- import { URL, fileURLToPath } from "node:url";
38
-
39
- // packages/core/src/utils/browser.ts
40
- init_esbuild_shims();
41
- var browserBlocklist = ["www-browser"];
42
- function isBrowserCommandBlocked(command) {
43
- const commandName = command.replace(/\\/g, "/").split("/").pop();
44
- return !!commandName && browserBlocklist.includes(commandName);
45
- }
46
- __name(isBrowserCommandBlocked, "isBrowserCommandBlocked");
47
- function shouldAttemptBrowserLaunch(options = {}) {
48
- const browserEnv = process.env["BROWSER"]?.trim();
49
- const browserCommand = browserEnv?.match(/^\S+/)?.[0];
50
- if (!options.ignoreBrowserBlocklist && process.platform !== "win32" && browserCommand && isBrowserCommandBlocked(browserCommand)) {
51
- return false;
52
- }
53
- if (process.env["CI"] || process.env["DEBIAN_FRONTEND"] === "noninteractive") {
54
- return false;
55
- }
56
- const isSSH = !!process.env["SSH_CONNECTION"];
57
- if (process.platform === "linux") {
58
- const displayVariables = ["DISPLAY", "WAYLAND_DISPLAY", "MIR_SOCKET"];
59
- const hasDisplay = displayVariables.some((v) => !!process.env[v]);
60
- if (!hasDisplay) {
61
- return false;
62
- }
63
- }
64
- if (isSSH && process.platform !== "linux") {
65
- return false;
66
- }
67
- return true;
68
- }
69
- __name(shouldAttemptBrowserLaunch, "shouldAttemptBrowserLaunch");
70
-
71
- // packages/core/src/utils/secure-browser-launcher.ts
72
- var execFileAsync = promisify(execFile);
73
- function validateUrl(url, { allowFile = false, allowedFilePaths } = {}) {
74
- let parsedUrl;
75
- try {
76
- parsedUrl = new URL(url);
77
- } catch (_error) {
78
- throw new Error(`Invalid URL: ${url}`);
79
- }
80
- const allowedProtocols = allowFile ? ["http:", "https:", "file:"] : ["http:", "https:"];
81
- if (!allowedProtocols.includes(parsedUrl.protocol)) {
82
- throw new Error(
83
- `Unsafe protocol: ${parsedUrl.protocol}. Only ${allowedProtocols.join(
84
- ", "
85
- )} are allowed.`
86
- );
87
- }
88
- if (parsedUrl.protocol === "file:" && allowFile) {
89
- if (!allowedFilePaths?.length) {
90
- throw new Error("allowedFilePaths is required when allowFile is true");
91
- }
92
- const requestedPath = resolve(fileURLToPath(parsedUrl));
93
- const allowed = allowedFilePaths.map((filePath) => resolve(filePath));
94
- if (!allowed.includes(requestedPath)) {
95
- throw new Error("File URL is not in the allowed file set");
96
- }
97
- }
98
- if (/[\r\n\x00-\x1f]/.test(url)) {
99
- throw new Error("URL contains invalid characters");
100
- }
101
- }
102
- __name(validateUrl, "validateUrl");
103
- async function openBrowserSecurely(url, browserOptions = {}) {
104
- validateUrl(url, browserOptions);
105
- const platformName = platform();
106
- let command;
107
- let args;
108
- const browserEnv = process.env["BROWSER"]?.trim();
109
- const browserCommand = platformName === "win32" ? void 0 : buildBrowserCommand(browserEnv, url);
110
- if (browserCommand) {
111
- try {
112
- await launchDetached(browserCommand.command, browserCommand.args);
113
- return;
114
- } catch (_error) {
115
- console.warn(
116
- `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(
117
- _error
118
- )}. Falling back to the platform browser opener.`
119
- );
120
- }
121
- }
122
- if (!shouldAttemptBrowserLaunch({ ignoreBrowserBlocklist: true })) {
123
- console.warn(
124
- `Browser launch is not available in this environment. Please open this URL manually: ${url}`
125
- );
126
- return;
127
- }
128
- {
129
- switch (platformName) {
130
- case "darwin":
131
- command = "open";
132
- args = [url];
133
- break;
134
- case "win32":
135
- command = "powershell.exe";
136
- args = [
137
- "-NoProfile",
138
- "-NonInteractive",
139
- "-WindowStyle",
140
- "Hidden",
141
- "-Command",
142
- `Start-Process '${url.replace(/'/g, "''")}'`
143
- ];
144
- break;
145
- case "linux":
146
- case "freebsd":
147
- case "openbsd":
148
- command = "xdg-open";
149
- args = [url];
150
- break;
151
- default:
152
- throw new Error(`Unsupported platform: ${platformName}`);
153
- }
154
- }
155
- const execOptions = {
156
- // Don't inherit parent's environment to avoid potential issues
157
- env: {
158
- ...process.env,
159
- // Ensure we're not in a shell that might interpret special characters
160
- SHELL: void 0
161
- },
162
- // Detach the browser process so it doesn't block
163
- detached: true,
164
- stdio: "ignore"
165
- };
166
- try {
167
- await execFileAsync(command, args, execOptions);
168
- } catch (_error) {
169
- if ((platformName === "linux" || platformName === "freebsd" || platformName === "openbsd") && command === "xdg-open") {
170
- const fallbackCommands = [
171
- { command: "gnome-open", detached: false },
172
- { command: "kde-open", detached: false },
173
- { command: "firefox", detached: true },
174
- { command: "chromium", detached: true },
175
- { command: "google-chrome", detached: true },
176
- { command: "microsoft-edge", detached: true }
177
- ];
178
- for (const { command: fallbackCommand, detached } of fallbackCommands) {
179
- try {
180
- if (detached) {
181
- await launchDetached(fallbackCommand, [url]);
182
- } else {
183
- await execFileAsync(fallbackCommand, [url], execOptions);
184
- }
185
- return;
186
- } catch {
187
- continue;
188
- }
189
- }
190
- }
191
- console.warn(
192
- `Failed to open browser automatically. Please open this URL manually: ${url}`
193
- );
194
- return;
195
- }
196
- }
197
- __name(openBrowserSecurely, "openBrowserSecurely");
198
- async function launchDetached(command, args) {
199
- const spawnOptions = {
200
- env: {
201
- ...process.env,
202
- SHELL: void 0
203
- },
204
- detached: true,
205
- stdio: "ignore"
206
- };
207
- await new Promise((resolve2, reject) => {
208
- const child = spawn(command, args, spawnOptions);
209
- let settled = false;
210
- child.once("error", (error) => {
211
- if (settled) {
212
- return;
213
- }
214
- settled = true;
215
- reject(error);
216
- });
217
- child.once("spawn", () => {
218
- if (settled) {
219
- return;
220
- }
221
- settled = true;
222
- child.unref();
223
- resolve2();
224
- });
225
- });
226
- }
227
- __name(launchDetached, "launchDetached");
228
- function formatLaunchError(error) {
229
- return error instanceof Error ? error.message : String(error);
230
- }
231
- __name(formatLaunchError, "formatLaunchError");
232
- function buildBrowserCommand(browserEnv, url) {
233
- if (!browserEnv) {
234
- return void 0;
235
- }
236
- const browserCommand = parseBrowserCommand(browserEnv);
237
- if (!browserCommand) {
238
- console.warn(
239
- "Invalid BROWSER environment variable, falling back to platform default."
240
- );
241
- return void 0;
242
- }
243
- if (isBrowserCommandBlocked(browserCommand.command)) {
244
- return void 0;
245
- }
246
- let usedPlaceholder = false;
247
- const args = browserCommand.args.map((arg) => {
248
- if (!arg.includes("%s")) {
249
- return arg;
250
- }
251
- usedPlaceholder = true;
252
- return arg.replace(/%s/g, () => url);
253
- });
254
- if (!usedPlaceholder) {
255
- args.push(url);
256
- }
257
- return { command: browserCommand.command, args };
258
- }
259
- __name(buildBrowserCommand, "buildBrowserCommand");
260
- function parseBrowserCommand(browserEnv) {
261
- const parts = [];
262
- let current = "";
263
- let quote;
264
- for (const char of browserEnv) {
265
- if (quote) {
266
- if (char === quote) {
267
- quote = void 0;
268
- } else {
269
- current += char;
270
- }
271
- continue;
272
- }
273
- if (char === '"' || char === "'") {
274
- quote = char;
275
- continue;
276
- }
277
- if (/\s/.test(char)) {
278
- if (current) {
279
- parts.push(current);
280
- current = "";
281
- }
282
- continue;
283
- }
284
- current += char;
285
- }
286
- if (quote) {
287
- return void 0;
288
- }
289
- if (current) {
290
- parts.push(current);
291
- }
292
- const [command, ...args] = parts;
293
- if (!command) {
294
- return void 0;
295
- }
296
- return { command, args };
297
- }
298
- __name(parseBrowserCommand, "parseBrowserCommand");
299
- function shouldLaunchBrowser() {
300
- return shouldAttemptBrowserLaunch();
301
- }
302
- __name(shouldLaunchBrowser, "shouldLaunchBrowser");
303
-
304
34
  // packages/core/src/qwen/sharedTokenManager.ts
305
35
  init_esbuild_shims();
306
36
  import path from "node:path";
@@ -799,7 +529,7 @@ var SharedTokenManager = class _SharedTokenManager {
799
529
  `Failed to stat lock file ${lockPath}: ${statError instanceof Error ? statError.message : String(statError)}`
800
530
  );
801
531
  }
802
- await new Promise((resolve2) => setTimeout(resolve2, currentInterval));
532
+ await new Promise((resolve) => setTimeout(resolve, currentInterval));
803
533
  currentInterval = Math.min(currentInterval * 1.5, maxInterval);
804
534
  } else {
805
535
  throw new TokenManagerError(
@@ -1434,19 +1164,19 @@ Server requested to slow down, increasing poll interval to ${pollInterval}ms'`
1434
1164
  "polling",
1435
1165
  `Polling... (attempt ${attempt + 1}/${maxAttempts})`
1436
1166
  );
1437
- await new Promise((resolve2) => {
1167
+ await new Promise((resolve) => {
1438
1168
  const checkInterval = 100;
1439
1169
  let elapsedTime = 0;
1440
1170
  const intervalId = setInterval(() => {
1441
1171
  elapsedTime += checkInterval;
1442
1172
  if (isCancelled) {
1443
1173
  clearInterval(intervalId);
1444
- resolve2();
1174
+ resolve();
1445
1175
  return;
1446
1176
  }
1447
1177
  if (elapsedTime >= pollInterval) {
1448
1178
  clearInterval(intervalId);
1449
- resolve2();
1179
+ resolve();
1450
1180
  return;
1451
1181
  }
1452
1182
  }, checkInterval);
@@ -1492,7 +1222,7 @@ Server requested to slow down, increasing poll interval to ${pollInterval}ms'`
1492
1222
  }
1493
1223
  const message = `Error polling for token: ${errorMessage}`;
1494
1224
  emitAuthProgress("error", message);
1495
- await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
1225
+ await new Promise((resolve) => setTimeout(resolve, pollInterval));
1496
1226
  }
1497
1227
  }
1498
1228
  const timeoutMessage = "Authorization timeout, please restart the process.";
@@ -1591,10 +1321,6 @@ __name(getQwenCachedCredentialPath, "getQwenCachedCredentialPath");
1591
1321
  var clearCachedCredentialFile = clearQwenCredentials;
1592
1322
 
1593
1323
  export {
1594
- isBrowserCommandBlocked,
1595
- shouldAttemptBrowserLaunch,
1596
- openBrowserSecurely,
1597
- shouldLaunchBrowser,
1598
1324
  SharedTokenManager,
1599
1325
  generateCodeVerifier,
1600
1326
  generateCodeChallenge,
@@ -1614,11 +1340,6 @@ export {
1614
1340
  clearQwenCredentials,
1615
1341
  clearCachedCredentialFile
1616
1342
  };
1617
- /**
1618
- * @license
1619
- * Copyright 2025 Google LLC
1620
- * SPDX-License-Identifier: Apache-2.0
1621
- */
1622
1343
  /**
1623
1344
  * @license
1624
1345
  * Copyright 2025 Qwen
@@ -5,7 +5,7 @@ import {
5
5
  Storage,
6
6
  resolvePath,
7
7
  sanitizeCwd
8
- } from "./chunk-IKOWINH4.js";
8
+ } from "./chunk-C4K3FEQ2.js";
9
9
  import {
10
10
  init_esbuild_shims
11
11
  } from "./chunk-A4BMJM77.js";
@@ -427,6 +427,11 @@ var IDE_DIR_NAME = "ide";
427
427
  var PLANS_DIR_NAME = "plans";
428
428
  var DEBUG_DIR_NAME = "debug";
429
429
  var ARENA_DIR_NAME = "arena";
430
+ function isResolvedPathWithinDirectory(childPath, parentPath) {
431
+ const relativePath = path2.relative(parentPath, childPath);
432
+ return relativePath === "" || !relativePath.startsWith(`..${path2.sep}`) && relativePath !== ".." && !path2.isAbsolute(relativePath);
433
+ }
434
+ __name(isResolvedPathWithinDirectory, "isResolvedPathWithinDirectory");
430
435
  var Storage = class _Storage {
431
436
  static {
432
437
  __name(this, "Storage");
@@ -584,8 +589,7 @@ var Storage = class _Storage {
584
589
  static isPathWithinDirectory(childPath, parentPath) {
585
590
  const realParent = _Storage.resolvePathThroughExistingAncestor(parentPath);
586
591
  const realChild = _Storage.resolvePathThroughExistingAncestor(childPath);
587
- const relativePath = path2.relative(realParent, realChild);
588
- return relativePath === "" || !relativePath.startsWith("..") && !path2.isAbsolute(relativePath);
592
+ return isResolvedPathWithinDirectory(realChild, realParent);
589
593
  }
590
594
  static assertPathWithinDirectory(childPath, parentPath, errorMessage) {
591
595
  if (!_Storage.isPathWithinDirectory(childPath, parentPath)) {
@@ -661,6 +665,42 @@ var Storage = class _Storage {
661
665
  getProjectCommandsDir() {
662
666
  return path2.join(this.getQwenDir(), "commands");
663
667
  }
668
+ /**
669
+ * Project-level saved-workflow scripts directory: `<targetDir>/.qwen/workflows`.
670
+ * Saved workflow scripts (`<name>.js`) here are surfaced as slash commands
671
+ * and resolvable by `workflow('<name>')` from inside a running workflow.
672
+ */
673
+ getProjectWorkflowsDir() {
674
+ return path2.join(this.getQwenDir(), "workflows");
675
+ }
676
+ /**
677
+ * User-level saved-workflow scripts directory: `~/.qwen/workflows`. User
678
+ * scope is lower-precedence than project scope when the same `<name>.js`
679
+ * exists in both.
680
+ */
681
+ static getUserWorkflowsDir() {
682
+ return path2.join(_Storage.getGlobalQwenDir(), "workflows");
683
+ }
684
+ /**
685
+ * Per-run workflow artifact directory: `<projectDir>/workflows`. Holds
686
+ * completed-run snapshot JSON files (`<runId>.json`) for the `/workflows`
687
+ * recent list, and per-run resume journals (`<runId>/journal.jsonl`).
688
+ */
689
+ getWorkflowRunsDir() {
690
+ return path2.join(this.getProjectDir(), "workflows");
691
+ }
692
+ /**
693
+ * Path to the persisted snapshot of a completed workflow run.
694
+ */
695
+ getWorkflowRunSnapshotPath(runId) {
696
+ return path2.join(this.getWorkflowRunsDir(), `${runId}.json`);
697
+ }
698
+ /**
699
+ * Path to the resume journal for an in-progress / resumable workflow run.
700
+ */
701
+ getWorkflowRunJournalPath(runId) {
702
+ return path2.join(this.getWorkflowRunsDir(), runId, "journal.jsonl");
703
+ }
664
704
  /**
665
705
  * Path to the runtime-status sidecar JSON for this session.
666
706
  *
@@ -2,7 +2,7 @@
2
2
  "use strict";
3
3
  import {
4
4
  createDebugLogger
5
- } from "./chunk-IKOWINH4.js";
5
+ } from "./chunk-C4K3FEQ2.js";
6
6
  import {
7
7
  init_esbuild_shims
8
8
  } from "./chunk-A4BMJM77.js";
@@ -375,198 +375,6 @@ function asOptionalRecord(value) {
375
375
  }
376
376
  __name(asOptionalRecord, "asOptionalRecord");
377
377
 
378
- // packages/core/src/core/tokenLimits.ts
379
- init_esbuild_shims();
380
- var DEFAULT_TOKEN_LIMIT = 131072;
381
- var DEFAULT_OUTPUT_TOKEN_LIMIT = 32e3;
382
- var CAPPED_DEFAULT_MAX_TOKENS = 8e3;
383
- var ESCALATED_MAX_TOKENS = 64e3;
384
- var LIMITS = {
385
- "32k": 32768,
386
- "64k": 65536,
387
- "128k": 131072,
388
- "192k": 196608,
389
- // MiniMax-M2.5 context window
390
- "200k": 2e5,
391
- // vendor-declared decimal, used by OpenAI, Anthropic, etc.
392
- "256k": 262144,
393
- "272k": 272e3,
394
- // vendor-declared decimal, GPT-5.x input (400K total - 128K output)
395
- "384k": 384e3,
396
- // vendor-declared decimal, DeepSeek V4 max output
397
- "400k": 4e5,
398
- // vendor-declared decimal, used by OpenAI GPT-5.x
399
- "512k": 524288,
400
- "1m": 1e6,
401
- // Output token limits (typically much smaller than input limits)
402
- "4k": 4096,
403
- "8k": 8192,
404
- "16k": 16384
405
- };
406
- function normalize(model) {
407
- let s = (model ?? "").toLowerCase().trim();
408
- s = s.replace(/^.*\//, "");
409
- s = s.split("|").pop() ?? s;
410
- s = s.split(":").pop() ?? s;
411
- s = s.replace(/\s+/g, "-");
412
- s = s.replace(/-preview/g, "");
413
- if (!s.match(/^qwen-(?:plus|flash|vl-max)-latest$/) && !s.match(/^kimi-k2-\d{4}$/)) {
414
- s = s.replace(
415
- /-(?:\d{4,}|\d+x\d+b|v\d+(?:\.\d+)*|(?<=-[^-]+-)\d+(?:\.\d+)+|latest|exp)$/g,
416
- ""
417
- );
418
- }
419
- s = s.replace(/-(?:\d?bit|int[48]|bf16|fp16|q[45]|quantized)$/g, "");
420
- return s;
421
- }
422
- __name(normalize, "normalize");
423
- var PATTERNS = [
424
- // -------------------
425
- // Google Gemini
426
- // -------------------
427
- [/^gemini-3/, LIMITS["1m"]],
428
- // Gemini 3.x (Pro, Flash, 3.1, etc.): 1M
429
- [/^gemini-/, LIMITS["1m"]],
430
- // Gemini fallback (1.5, 2.x): 1M
431
- // -------------------
432
- // OpenAI
433
- // -------------------
434
- [/^gpt-5/, LIMITS["272k"]],
435
- // GPT-5.x: 272K input (400K total - 128K output)
436
- [/^gpt-/, LIMITS["128k"]],
437
- // GPT fallback (4o, 4.1, etc.): 128K
438
- [/^o\d/, LIMITS["200k"]],
439
- // o-series (o3, o4-mini, etc.): 200K
440
- // -------------------
441
- // Anthropic Claude
442
- // -------------------
443
- [/^claude-/, LIMITS["200k"]],
444
- // All Claude models: 200K
445
- // -------------------
446
- // Alibaba / Qwen
447
- // -------------------
448
- // Commercial API models (1,000,000 context)
449
- [/^qwen3-coder-plus/, LIMITS["1m"]],
450
- [/^qwen3-coder-flash/, LIMITS["1m"]],
451
- [/^qwen3\.\d/, LIMITS["1m"]],
452
- [/^qwen-plus-latest$/, LIMITS["1m"]],
453
- [/^qwen-flash-latest$/, LIMITS["1m"]],
454
- [/^coder-model$/, LIMITS["1m"]],
455
- // Commercial API models (256K context)
456
- [/^qwen3-max/, LIMITS["256k"]],
457
- // Open-source Qwen3 variants: 256K native
458
- [/^qwen3-coder-/, LIMITS["256k"]],
459
- // Qwen fallback (VL, turbo, plus, 2.5, etc.): 128K
460
- [/^qwen/, LIMITS["256k"]],
461
- // -------------------
462
- // DeepSeek
463
- // -------------------
464
- [/^deepseek-v4/, LIMITS["1m"]],
465
- // DeepSeek V4 (flash, pro): 1M
466
- [/^deepseek/, LIMITS["128k"]],
467
- // -------------------
468
- // Zhipu GLM
469
- // -------------------
470
- // 1M context is the forward default for new GLM releases (GLM-5.2+, GLM-6.x,
471
- // and beyond) so they need no future code change. Confirmed 200K families
472
- // (GLM-5 / 5.0 / 5.1, GLM-4.x and older) are pinned explicitly first.
473
- [/^glm-5(\.[01])?(-|$)/, 202752],
474
- // GLM-5 / 5.0 / 5.1: 200K
475
- [/^glm-(?:[5-9]|\d{2,})/, LIMITS["1m"]],
476
- // GLM-5.2+, 6.x..9.x, 10.x+: 1M
477
- [/^glm-/, 202752],
478
- // GLM <=4.x / non-numeric fallback: 200K
479
- // -------------------
480
- // MiniMax
481
- // -------------------
482
- [/^minimax-m3/i, LIMITS["1m"]],
483
- // MiniMax-M3: 1,000,000
484
- [/^minimax-m2\.5/i, LIMITS["192k"]],
485
- // MiniMax-M2.5: 196,608
486
- [/^minimax-/i, LIMITS["200k"]],
487
- // MiniMax fallback: 200K
488
- // -------------------
489
- // Moonshot / Kimi
490
- // -------------------
491
- [/^kimi-/, LIMITS["256k"]],
492
- // Kimi fallback: 256K
493
- // -------------------
494
- // ByteDance Seed-OSS (512K)
495
- // -------------------
496
- [/^seed-oss/, LIMITS["512k"]]
497
- ];
498
- var OUTPUT_PATTERNS = [
499
- // Google Gemini
500
- [/^gemini-3/, LIMITS["64k"]],
501
- // Gemini 3.x: 64K
502
- [/^gemini-/, LIMITS["8k"]],
503
- // Gemini fallback: 8K
504
- // OpenAI
505
- [/^gpt-5/, LIMITS["128k"]],
506
- // GPT-5.x: 128K
507
- [/^gpt-/, LIMITS["16k"]],
508
- // GPT fallback: 16K
509
- [/^o\d/, LIMITS["128k"]],
510
- // o-series: 128K
511
- // Anthropic Claude
512
- [/^claude-opus-4-6/, LIMITS["128k"]],
513
- // Opus 4.6: 128K
514
- [/^claude-sonnet-4-6/, LIMITS["64k"]],
515
- // Sonnet 4.6: 64K
516
- [/^claude-/, LIMITS["64k"]],
517
- // Claude fallback: 64K
518
- // Alibaba / Qwen
519
- [/^qwen3\.\d/, LIMITS["64k"]],
520
- [/^coder-model$/, LIMITS["64k"]],
521
- [/^qwen/, LIMITS["32k"]],
522
- // Qwen fallback (VL, turbo, plus, etc.): 8K
523
- // DeepSeek
524
- [/^deepseek-v4/, LIMITS["384k"]],
525
- // DeepSeek V4 (flash, pro): 384K
526
- [/^deepseek-reasoner/, LIMITS["64k"]],
527
- [/^deepseek-r1/, LIMITS["64k"]],
528
- [/^deepseek-chat/, LIMITS["8k"]],
529
- // Zhipu GLM
530
- [/^glm-5(?:\.\d+)?(?:-|$)/, LIMITS["128k"]],
531
- [/^glm-4\.7/, LIMITS["16k"]],
532
- // MiniMax
533
- [/^minimax-m2\.5/i, LIMITS["64k"]],
534
- // Kimi
535
- [/^kimi-k2\.5/, LIMITS["32k"]]
536
- ];
537
- function findTokenLimit(model, type = "input") {
538
- const norm = normalize(model);
539
- const patterns = type === "output" ? OUTPUT_PATTERNS : PATTERNS;
540
- for (const [regex, limit] of patterns) {
541
- if (regex.test(norm)) {
542
- return limit;
543
- }
544
- }
545
- return void 0;
546
- }
547
- __name(findTokenLimit, "findTokenLimit");
548
- function hasExplicitOutputLimit(model) {
549
- const norm = normalize(model);
550
- return OUTPUT_PATTERNS.some(([regex]) => regex.test(norm));
551
- }
552
- __name(hasExplicitOutputLimit, "hasExplicitOutputLimit");
553
- function knownTokenLimit(model, type = "input") {
554
- return findTokenLimit(model, type);
555
- }
556
- __name(knownTokenLimit, "knownTokenLimit");
557
- function tokenLimit(model, type = "input") {
558
- return knownTokenLimit(model, type) ?? (type === "output" ? DEFAULT_OUTPUT_TOKEN_LIMIT : DEFAULT_TOKEN_LIMIT);
559
- }
560
- __name(tokenLimit, "tokenLimit");
561
-
562
- // packages/core/src/core/openaiContentGenerator/constants.ts
563
- init_esbuild_shims();
564
- var DEFAULT_TIMEOUT = 12e4;
565
- var DEFAULT_MAX_RETRIES = 3;
566
- var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
567
- var DEFAULT_DASHSCOPE_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1";
568
- var DASHSCOPE_PROXY_BASE_URL = process.env["DASHSCOPE_PROXY_BASE_URL"];
569
-
570
378
  // packages/core/src/utils/safeJsonParse.ts
571
379
  init_esbuild_shims();
572
380
 
@@ -1388,20 +1196,7 @@ export {
1388
1196
  RuntimeDiagnosticsCollector,
1389
1197
  runtimeDiagnostics,
1390
1198
  summarizeOpenAIWireRequest,
1391
- summarizeAnthropicWireRequest,
1392
- DEFAULT_TOKEN_LIMIT,
1393
- DEFAULT_OUTPUT_TOKEN_LIMIT,
1394
- CAPPED_DEFAULT_MAX_TOKENS,
1395
- ESCALATED_MAX_TOKENS,
1396
- normalize,
1397
- hasExplicitOutputLimit,
1398
- knownTokenLimit,
1399
- tokenLimit,
1400
- DEFAULT_TIMEOUT,
1401
- DEFAULT_MAX_RETRIES,
1402
- DEFAULT_OPENAI_BASE_URL,
1403
- DEFAULT_DASHSCOPE_BASE_URL,
1404
- DASHSCOPE_PROXY_BASE_URL
1199
+ summarizeAnthropicWireRequest
1405
1200
  };
1406
1201
  /**
1407
1202
  * @license