@qwen-code/qwen-code 0.19.2 → 0.19.3-nightly.20260701.a974594d7

package/chunks/chunk-VXGPYF7U.js

@@ -0,0 +1,37 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  themeManager
+} from "./chunk-HTWHAN44.js";
+import {
+  init_esbuild_shims
+} from "./chunk-A4BMJM77.js";
+
+// packages/cli/src/ui/semantic-colors.ts
+init_esbuild_shims();
+var theme = {
+  get text() {
+    return themeManager.getSemanticColors().text;
+  },
+  get background() {
+    return themeManager.getSemanticColors().background;
+  },
+  get border() {
+    return themeManager.getSemanticColors().border;
+  },
+  get ui() {
+    return themeManager.getSemanticColors().ui;
+  },
+  get status() {
+    return themeManager.getSemanticColors().status;
+  }
+};
+
+export {
+  theme
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-UAARVVBI.js → chunk-WGY3GIPP.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   runExitCleanup
-} from "./chunk-GYZQA2FO.js";
+} from "./chunk-WJAY4WXR.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-GYZQA2FO.js → chunk-WJAY4WXR.js}

@@ -60,7 +60,7 @@ async function runExitCleanup(options = {}) {
 }
 __name(runExitCleanup, "runExitCleanup");
 async function cleanupCheckpoints() {
-  const { Storage } = await import("./src-4F6FBZFI.js");
+  const { Storage } = await import("./src-PNZYGM3R.js");
   const storage = new Storage(process.cwd());
   const tempDir = storage.getProjectTempDir();
   const checkpointsDir = join(tempDir, "checkpoints");

package/chunks/chunk-XKSCTXPK.js

@@ -0,0 +1,167 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  isTeamAutoMemPath
+} from "./chunk-MOUXUCXQ.js";
+import {
+  createDebugLogger
+} from "./chunk-AVQDCKNF.js";
+import {
+  init_esbuild_shims
+} from "./chunk-A4BMJM77.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/memory/team-memory-secret-guard.ts
+init_esbuild_shims();
+
+// packages/core/src/memory/secret-scanner.ts
+init_esbuild_shims();
+var SECRET_RULES = [
+  // Cloud providers
+  {
+    id: "aws-access-token",
+    // Suffix is base62 ([A-Z0-9]) per gitleaks; base32 [A-Z2-7] missed 0/1/8/9.
+    source: "\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16})\\b"
+  },
+  {
+    id: "alibaba-cloud-access-key",
+    source: "\\b(LTAI[a-zA-Z0-9]{12,20})\\b"
+  },
+  // A distinctive prefix + a high-entropy length is enough to identify these;
+  // no trailing delimiter is required (requiring one missed secrets followed by
+  // `.` `,` `)` `}` — common in prose and code samples).
+  {
+    id: "gcp-api-key",
+    source: "AIza[\\w-]{35}"
+  },
+  {
+    // Google OAuth client secret (GOCSPX- prefix + 24 base64url chars).
+    id: "gcp-oauth-client-secret",
+    source: "GOCSPX-[\\w-]{24}"
+  },
+  {
+    id: "digitalocean-pat",
+    source: "dop_v1_[a-f0-9]{64}"
+  },
+  // AI APIs
+  {
+    id: "anthropic-api-key",
+    source: "sk-ant-[a-zA-Z0-9_-]{20,}"
+  },
+  {
+    // New project/service/admin prefixes, the T3BlbkFJ-marker format, and the
+    // retired bare `sk-` + 48 base62 chars (archived legacy keys).
+    // Both classes around the T3BlbkFJ literal are upper-bounded ({20,512}, like
+    // `private-key`): two unbounded {20,} quantifiers around a literal that may
+    // be absent backtrack in O(n²) on crafted `sk-…` input (ReDoS). Real keys
+    // are far shorter than the bound, so genuine matches are unaffected.
+    id: "openai-api-key",
+    source: "sk-(?:proj|svcacct|admin)-[a-zA-Z0-9_-]{20,}|sk-[a-zA-Z0-9_-]{20,512}T3BlbkFJ[a-zA-Z0-9_-]{20,512}|sk-[a-zA-Z0-9]{48}"
+  },
+  {
+    id: "huggingface-access-token",
+    source: "hf_[a-zA-Z0-9]{34,}"
+  },
+  // Version control
+  { id: "github-pat", source: "ghp_[0-9a-zA-Z]{36}" },
+  { id: "github-fine-grained-pat", source: "github_pat_\\w{82}" },
+  { id: "github-app-token", source: "(?:ghu|ghs)_[0-9a-zA-Z]{36}" },
+  { id: "github-oauth", source: "gho_[0-9a-zA-Z]{36}" },
+  { id: "gitlab-pat", source: "glpat-[\\w-]{20}" },
+  // Communication
+  {
+    id: "slack-bot-token",
+    source: "xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*"
+  },
+  {
+    id: "slack-app-token",
+    source: "xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+",
+    flags: "i"
+  },
+  {
+    // SendGrid API key: SG. + 22-char id . + 43-char secret (gitleaks).
+    id: "sendgrid-api-token",
+    source: "SG\\.[\\w-]{22}\\.[\\w-]{43}"
+  },
+  // Dev tooling
+  { id: "npm-access-token", source: "npm_[a-zA-Z0-9]{36}" },
+  {
+    id: "stripe-access-token",
+    source: "(?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99}"
+  },
+  // Crypto
+  {
+    id: "private-key",
+    source: "-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,16384}?-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----",
+    flags: "i"
+  }
+];
+var compiledRules = null;
+function getCompiledRules() {
+  compiledRules ??= SECRET_RULES.map((r) => ({
+    id: r.id,
+    re: new RegExp(r.source, r.flags)
+  }));
+  return compiledRules;
+}
+__name(getCompiledRules, "getCompiledRules");
+var LABEL_SPECIAL_CASE = {
+  aws: "AWS",
+  gcp: "GCP",
+  api: "API",
+  pat: "PAT",
+  oauth: "OAuth",
+  npm: "NPM",
+  github: "GitHub",
+  gitlab: "GitLab",
+  openai: "OpenAI",
+  digitalocean: "DigitalOcean",
+  huggingface: "HuggingFace",
+  alibaba: "Alibaba",
+  sendgrid: "SendGrid"
+};
+function ruleIdToLabel(ruleId) {
+  return ruleId.split("-").map(
+    (part) => LABEL_SPECIAL_CASE[part] ?? part.charAt(0).toUpperCase() + part.slice(1)
+  ).join(" ");
+}
+__name(ruleIdToLabel, "ruleIdToLabel");
+function scanForSecrets(content) {
+  const matches = [];
+  for (const rule of getCompiledRules()) {
+    if (rule.re.test(content)) {
+      matches.push({ ruleId: rule.id, label: ruleIdToLabel(rule.id) });
+    }
+  }
+  return matches;
+}
+__name(scanForSecrets, "scanForSecrets");
+
+// packages/core/src/memory/team-memory-secret-guard.ts
+var debugLogger = createDebugLogger("TEAM_MEMORY_SECRET_GUARD");
+function checkTeamMemorySecrets(filePath, content, projectRoot) {
+  if (!isTeamAutoMemPath(filePath, projectRoot)) {
+    return null;
+  }
+  const matches = scanForSecrets(content);
+  if (matches.length === 0) {
+    return null;
+  }
+  debugLogger.debug(
+    `Blocked team-memory write; matched rules: ${matches.map((m) => m.ruleId).join(", ")}`
+  );
+  const labels = matches.map((m) => m.label).join(", ");
+  return `Content contains potential secrets (${labels}) and cannot be written to team memory. Team memory is shared with all repository collaborators. Remove the sensitive content and try again.`;
+}
+__name(checkTeamMemorySecrets, "checkTeamMemorySecrets");
+
+export {
+  checkTeamMemorySecrets
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */