@qwen-code/qwen-code 0.19.2 → 0.19.3-nightly.20260630.e00fe6a27

package/chunks/{chunk-TMBPDHXD.js → chunk-I4H7PRWQ.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-TLRYABYP.js";
 import {
   createDebugLogger
-} from "./chunk-C4K3FEQ2.js";
+} from "./chunk-UX4SGCGN.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-EEEZIVFJ.js → chunk-JOLIREYR.js}

@@ -3,7 +3,7 @@
 import {
   createDebugLogger,
   isNodeError
-} from "./chunk-C4K3FEQ2.js";
+} from "./chunk-UX4SGCGN.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-TZM5JIAX.js → chunk-JYPQTRA3.js}

@@ -2,24 +2,24 @@
 "use strict";
 import {
   t
-} from "./chunk-5JZLXFPD.js";
+} from "./chunk-MTHMXSNT.js";
 import {
   computeThresholds,
   getCoreSystemPrompt
-} from "./chunk-PXFFKNCO.js";
+} from "./chunk-RIP623NO.js";
 import {
   buildSkillLlmContent
-} from "./chunk-OTBK43JR.js";
+} from "./chunk-HYCC3XM3.js";
 import {
   DiscoveredMCPTool,
   uiTelemetryService
-} from "./chunk-WA5OJGFL.js";
+} from "./chunk-SS6WJMQK.js";
 import {
   ToolNames
-} from "./chunk-TOEGRAVX.js";
+} from "./chunk-BX5YO7UW.js";
 import {
   DEFAULT_TOKEN_LIMIT
-} from "./chunk-F6XNTYNE.js";
+} from "./chunk-YTFBURQD.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -145,7 +145,10 @@ ${skill.level}
     };
   });
   const skillsTokens = skillToolDefinitionTokens + loadedBodiesTokens;
-  const thresholds = computeThresholds(contextWindowSize);
+  const thresholds = computeThresholds(
+    contextWindowSize,
+    config.getAutoCompactThreshold()
+  );
   const autocompactBuffer = Math.max(
     0,
     Math.round(contextWindowSize - thresholds.auto)

package/chunks/chunk-K5XU6E4T.js

@@ -0,0 +1,167 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  isTeamAutoMemPath
+} from "./chunk-RD6YJJJ6.js";
+import {
+  createDebugLogger
+} from "./chunk-UX4SGCGN.js";
+import {
+  init_esbuild_shims
+} from "./chunk-A4BMJM77.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/memory/team-memory-secret-guard.ts
+init_esbuild_shims();
+
+// packages/core/src/memory/secret-scanner.ts
+init_esbuild_shims();
+var SECRET_RULES = [
+  // Cloud providers
+  {
+    id: "aws-access-token",
+    // Suffix is base62 ([A-Z0-9]) per gitleaks; base32 [A-Z2-7] missed 0/1/8/9.
+    source: "\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16})\\b"
+  },
+  {
+    id: "alibaba-cloud-access-key",
+    source: "\\b(LTAI[a-zA-Z0-9]{12,20})\\b"
+  },
+  // A distinctive prefix + a high-entropy length is enough to identify these;
+  // no trailing delimiter is required (requiring one missed secrets followed by
+  // `.` `,` `)` `}` — common in prose and code samples).
+  {
+    id: "gcp-api-key",
+    source: "AIza[\\w-]{35}"
+  },
+  {
+    // Google OAuth client secret (GOCSPX- prefix + 24 base64url chars).
+    id: "gcp-oauth-client-secret",
+    source: "GOCSPX-[\\w-]{24}"
+  },
+  {
+    id: "digitalocean-pat",
+    source: "dop_v1_[a-f0-9]{64}"
+  },
+  // AI APIs
+  {
+    id: "anthropic-api-key",
+    source: "sk-ant-[a-zA-Z0-9_-]{20,}"
+  },
+  {
+    // New project/service/admin prefixes, the T3BlbkFJ-marker format, and the
+    // retired bare `sk-` + 48 base62 chars (archived legacy keys).
+    // Both classes around the T3BlbkFJ literal are upper-bounded ({20,512}, like
+    // `private-key`): two unbounded {20,} quantifiers around a literal that may
+    // be absent backtrack in O(n²) on crafted `sk-…` input (ReDoS). Real keys
+    // are far shorter than the bound, so genuine matches are unaffected.
+    id: "openai-api-key",
+    source: "sk-(?:proj|svcacct|admin)-[a-zA-Z0-9_-]{20,}|sk-[a-zA-Z0-9_-]{20,512}T3BlbkFJ[a-zA-Z0-9_-]{20,512}|sk-[a-zA-Z0-9]{48}"
+  },
+  {
+    id: "huggingface-access-token",
+    source: "hf_[a-zA-Z0-9]{34,}"
+  },
+  // Version control
+  { id: "github-pat", source: "ghp_[0-9a-zA-Z]{36}" },
+  { id: "github-fine-grained-pat", source: "github_pat_\\w{82}" },
+  { id: "github-app-token", source: "(?:ghu|ghs)_[0-9a-zA-Z]{36}" },
+  { id: "github-oauth", source: "gho_[0-9a-zA-Z]{36}" },
+  { id: "gitlab-pat", source: "glpat-[\\w-]{20}" },
+  // Communication
+  {
+    id: "slack-bot-token",
+    source: "xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*"
+  },
+  {
+    id: "slack-app-token",
+    source: "xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+",
+    flags: "i"
+  },
+  {
+    // SendGrid API key: SG. + 22-char id . + 43-char secret (gitleaks).
+    id: "sendgrid-api-token",
+    source: "SG\\.[\\w-]{22}\\.[\\w-]{43}"
+  },
+  // Dev tooling
+  { id: "npm-access-token", source: "npm_[a-zA-Z0-9]{36}" },
+  {
+    id: "stripe-access-token",
+    source: "(?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99}"
+  },
+  // Crypto
+  {
+    id: "private-key",
+    source: "-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,16384}?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----",
+    flags: "i"
+  }
+];
+var compiledRules = null;
+function getCompiledRules() {
+  compiledRules ??= SECRET_RULES.map((r) => ({
+    id: r.id,
+    re: new RegExp(r.source, r.flags)
+  }));
+  return compiledRules;
+}
+__name(getCompiledRules, "getCompiledRules");
+var LABEL_SPECIAL_CASE = {
+  aws: "AWS",
+  gcp: "GCP",
+  api: "API",
+  pat: "PAT",
+  oauth: "OAuth",
+  npm: "NPM",
+  github: "GitHub",
+  gitlab: "GitLab",
+  openai: "OpenAI",
+  digitalocean: "DigitalOcean",
+  huggingface: "HuggingFace",
+  alibaba: "Alibaba",
+  sendgrid: "SendGrid"
+};
+function ruleIdToLabel(ruleId) {
+  return ruleId.split("-").map(
+    (part) => LABEL_SPECIAL_CASE[part] ?? part.charAt(0).toUpperCase() + part.slice(1)
+  ).join(" ");
+}
+__name(ruleIdToLabel, "ruleIdToLabel");
+function scanForSecrets(content) {
+  const matches = [];
+  for (const rule of getCompiledRules()) {
+    if (rule.re.test(content)) {
+      matches.push({ ruleId: rule.id, label: ruleIdToLabel(rule.id) });
+    }
+  }
+  return matches;
+}
+__name(scanForSecrets, "scanForSecrets");
+
+// packages/core/src/memory/team-memory-secret-guard.ts
+var debugLogger = createDebugLogger("TEAM_MEMORY_SECRET_GUARD");
+function checkTeamMemorySecrets(filePath, content, projectRoot) {
+  if (!isTeamAutoMemPath(filePath, projectRoot)) {
+    return null;
+  }
+  const matches = scanForSecrets(content);
+  if (matches.length === 0) {
+    return null;
+  }
+  debugLogger.debug(
+    `Blocked team-memory write; matched rules: ${matches.map((m) => m.ruleId).join(", ")}`
+  );
+  const labels = matches.map((m) => m.label).join(", ");
+  return `Content contains potential secrets (${labels}) and cannot be written to team memory. Team memory is shared with all repository collaborators. Remove the sensitive content and try again.`;
+}
+__name(checkTeamMemorySecrets, "checkTeamMemorySecrets");
+
+export {
+  checkTeamMemorySecrets
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-BS64PXY3.js → chunk-KFVU7ODN.js}

@@ -34,7 +34,7 @@ __name(getPackageJson, "getPackageJson");
 // packages/cli/src/utils/version.ts
 async function getCliVersion() {
   const pkgJson = await getPackageJson();
-  return "0.19.2";
+  return "0.19.3-nightly.20260630.e00fe6a27";
 }
 __name(getCliVersion, "getCliVersion");
 

package/chunks/{chunk-3RJ3ZPPR.js → chunk-KKQWC6WS.js}

@@ -7,13 +7,15 @@ import {
   SETTINGS_DIRECTORY_NAME,
   V1_INDICATOR_KEYS,
   getGlobalQwenDirLite,
-  getPathComparisonVariants,
   getSystemDefaultsPath,
   getSystemSettingsPath,
-  isWithinRoot,
-  require_strip_json_comments,
   resolveEnvVarsInObject
-} from "./chunk-UN3C6GOR.js";
+} from "./chunk-PPFWEV7G.js";
+import {
+  getPathComparisonVariants,
+  isWithinRoot,
+  require_strip_json_comments
+} from "./chunk-QYUE6W3T.js";
 import {
   require_main
 } from "./chunk-SKAZWEV5.js";
@@ -272,9 +274,7 @@ function readTrustedFolderRulesFastPath() {
 __name(readTrustedFolderRulesFastPath, "readTrustedFolderRulesFastPath");
 function buildTrustedFolderRules(trustedFolders) {
   const rules = [];
-  for (const [rulePath, trustLevel] of Object.entries(
-    trustedFolders
-  )) {
+  for (const [rulePath, trustLevel] of Object.entries(trustedFolders)) {
     if (trustLevel === TRUST_FOLDER) {
       rules.push({
         level: "trusted",

package/chunks/{chunk-3QFE4OTE.js → chunk-LBW7NW7X.js}

@@ -3,18 +3,18 @@
 import {
   getGitVersion,
   getNpmVersion
-} from "./chunk-CI5O6SQL.js";
+} from "./chunk-6FKEVYCD.js";
 import {
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-D5E5TMYH.js";
+} from "./chunk-3M4W4U5G.js";
 import {
   canUseRipgrep
-} from "./chunk-PXFFKNCO.js";
+} from "./chunk-RIP623NO.js";
 import {
   detectRuntime,
   redactProxyCredentials
-} from "./chunk-F6XNTYNE.js";
+} from "./chunk-E6XQPQXW.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-Z7XXFPGP.js → chunk-LDWTYE33.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   getGlobalQwenDir
-} from "./chunk-JXQ23SNT.js";
+} from "./chunk-2JKEQWDZ.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-EXMX5YHG.js → chunk-LP5E4YIH.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-UFC57OYT.js";
 import {
   MissingCliEntryError
-} from "./chunk-D5E5TMYH.js";
+} from "./chunk-3M4W4U5G.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";