@qwen-code/qwen-code 0.19.0 → 0.19.1

package/bundled/qc-helper/docs/features/mcp.md

@@ -190,8 +190,12 @@ syntax — type `@`, then the server name, a colon, and the resource URI:
 summarize @myserver:file:///docs/spec.md and list the open questions
 ```
 
-Typing `@myserver:` shows an autocomplete list of that server's resource
-URIs. On submit, the referenced resource is read and its contents are
+Typing `@myserver:` shows an autocomplete list of that server's resources;
+keep typing to filter, matching (case-insensitively) either the resource URI
+or its friendly name/title. You don't have to know a URI by heart — before
+you reach the colon, typing part of a server name also suggests matching
+servers that expose resources, so you can pick one and drill straight into
+its resource list. On submit, the referenced resource is read and its contents are
 appended to your message (text inline, binary blobs as attachments); the
 `@server:uri` reference is preserved in the prompt so the model knows what
 it is looking at. The `server` prefix must match a configured MCP server —

package/bundled/qc-helper/docs/qwen-serve.md

@@ -234,7 +234,7 @@ The token comparison is constant-time (SHA-256 + `crypto.timingSafeEqual`); 401
 | `--http-bridge`                         | `true`          | Stage 1 mode: one `qwen --acp` child per daemon (bound to one workspace at boot, per [#3803](https://github.com/QwenLM/qwen-code/issues/3803) §02); N sessions multiplex onto that child via ACP `newSession()`. Stage 2 native in-process becomes available later.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `--allow-origin <pat>`                  | —               | T2.4 ([#4514](https://github.com/QwenLM/qwen-code/issues/4514)). Cross-origin allowlist for browser webui clients. Repeatable. Each value is `*` (any origin — boot refuses if no bearer token is configured; `--require-auth` on loopback is recommended so `/health` and `/demo` are also bearer-gated, since both are pre-auth on loopback by default) or a canonical URL origin (`<scheme>://<host>[:<port>]`, no trailing slash / path / userinfo / query). **Subdomain wildcards (`https://*.example.com`) are intentionally unsupported** — list each subdomain explicitly, or use `*` with a configured token (and `--require-auth` for full hardening). Matched origins receive CORS response headers (`Access-Control-Allow-Origin`, `Vary: Origin`, methods, headers, max-age, and exposed `Retry-After`); unmatched origins still get a 403 with the same envelope as today's wall. `Origin: null` (sandboxed iframes, file:// docs) is always rejected, even under `*`. Pre-flight via `caps.features.allow_origin`. Loopback self-origin hits are unaffected. |
 | `--web` / `--no-web`                    | `true`          | Serve the built Web Shell SPA at the daemon root (`GET /`, `/assets/*`, and SPA deep-link fallback). The static shell is registered **before** the bearer-auth gate — a browser can't attach a token to a `<script>` subresource or an address-bar navigation, the shell carries no secrets, and every API route stays token-gated regardless. On non-loopback binds a one-line stderr warning notes the UI is reachable without auth. Use `--no-web` for an API-only daemon. No effect when the build omits the Web Shell assets (the daemon logs a breadcrumb and runs API-only).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `--open`                                | `false`         | After the listener is up, open the Web Shell in your default browser at the daemon URL (with `#token=` appended as a URL fragment when a token is configured — a fragment is never sent to the server, keeping the token out of access logs and Referer headers). No-op with `--no-web`, or in headless / CI / SSH environments where no browser is available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `--open`                                | `false`         | After the listener is up, open the Web Shell in your default browser at the daemon URL (with `#token=` appended as a URL fragment when a token is configured — a fragment is never sent to the server, keeping the token out of access logs and Referer headers). No-op with `--no-web`, or in headless / CI / SSH environments where no browser is available.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 > **Sizing the load knobs.** `--max-sessions` is the **new-child** cap.
 > Three other layers also limit load — when sizing for a high-concurrency

package/chunks/{agent-IPSDEZNB.js → agent-7CZOLKXM.js}

@@ -7,7 +7,7 @@ import {
   hasRebuiltToolRegistry,
   rebuildToolRegistryOnOverride,
   resolveSubagentApprovalMode
-} from "./chunk-YF3ORUIU.js";
+} from "./chunk-2X2WXY6L.js";
 import "./chunk-K5PGHDBN.js";
 import "./chunk-TXVGVZYR.js";
 import "./chunk-XU5P23GN.js";
@@ -23,7 +23,7 @@ import "./chunk-OTBK43JR.js";
 import "./chunk-HGNSRCRB.js";
 import "./chunk-EEEZIVFJ.js";
 import "./chunk-PRYMDRBV.js";
-import "./chunk-CICUTYTF.js";
+import "./chunk-YMBWB67C.js";
 import "./chunk-3PJXIDKI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";

package/chunks/{agent-headless-ZMTUWMZJ.js → agent-headless-K37PBQK5.js}

@@ -4,7 +4,7 @@ import {
   AgentHeadless,
   ContextState,
   templateString
-} from "./chunk-YF3ORUIU.js";
+} from "./chunk-2X2WXY6L.js";
 import "./chunk-K5PGHDBN.js";
 import "./chunk-TXVGVZYR.js";
 import "./chunk-XU5P23GN.js";
@@ -20,7 +20,7 @@ import "./chunk-OTBK43JR.js";
 import "./chunk-HGNSRCRB.js";
 import "./chunk-EEEZIVFJ.js";
 import "./chunk-PRYMDRBV.js";
-import "./chunk-CICUTYTF.js";
+import "./chunk-YMBWB67C.js";
 import "./chunk-3PJXIDKI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";