@qwen-code/qwen-code 0.19.3 → 0.19.4-nightly.20260702.46814e4f1

package/chunks/chunk-MX2YXRER.js

@@ -0,0 +1,44 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-A4BMJM77.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/channel-selection.ts
+init_esbuild_shims();
+function normalizeServeChannelSelection(rawChannels) {
+  if (rawChannels === void 0 || rawChannels.length === 0) {
+    return void 0;
+  }
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of rawChannels) {
+    const name = raw.trim();
+    if (!name) {
+      throw new Error("--channel requires a non-empty channel name.");
+    }
+    if (seen.has(name)) continue;
+    seen.add(name);
+    names.push(name);
+  }
+  if (seen.has("all")) {
+    if (names.length > 1) {
+      throw new Error("--channel all cannot be combined with channel names.");
+    }
+    return { mode: "all" };
+  }
+  return { mode: "names", names };
+}
+__name(normalizeServeChannelSelection, "normalizeServeChannelSelection");
+function channelSelectionNames(selection) {
+  return selection.mode === "all" ? ["all"] : [...selection.names];
+}
+__name(channelSelectionNames, "channelSelectionNames");
+
+export {
+  normalizeServeChannelSelection,
+  channelSelectionNames
+};

package/chunks/chunk-NIOPRZNN.js

@@ -0,0 +1,27 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  expandHomeDir
+} from "./chunk-AVQDCKNF.js";
+import {
+  init_esbuild_shims
+} from "./chunk-A4BMJM77.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/utils/resolvePath.ts
+init_esbuild_shims();
+function resolvePath(p) {
+  return expandHomeDir(p);
+}
+__name(resolvePath, "resolvePath");
+
+export {
+  resolvePath
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-SMYQZVZ3.js → chunk-NOGSPTLJ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   registerCleanup
-} from "./chunk-I2LYBGNI.js";
+} from "./chunk-7IOMIYOE.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-DDMOU62Q.js → chunk-NPQWQYU6.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-UX4SGCGN.js";
+} from "./chunk-AVQDCKNF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-MNF6S5PR.js → chunk-P5THQV6A.js}

@@ -5,13 +5,13 @@ import {
 } from "./chunk-KHDZHZMH.js";
 import {
   getCliVersion
-} from "./chunk-GT2FGICD.js";
+} from "./chunk-DE7YXUR7.js";
 import {
   IdeClient
-} from "./chunk-YAINVQ3Q.js";
+} from "./chunk-A5OPLHFM.js";
 import {
   createDebugLogger
-} from "./chunk-UX4SGCGN.js";
+} from "./chunk-AVQDCKNF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";
@@ -27,7 +27,7 @@ import { execFile } from "node:child_process";
 
 // packages/cli/src/generated/git-commit.ts
 init_esbuild_shims();
-var GIT_COMMIT_INFO = "cd515cf11";
+var GIT_COMMIT_INFO = "8d40e7803";
 
 // packages/cli/src/utils/systemInfo.ts
 var debugLogger = createDebugLogger("STATUS");

package/chunks/{chunk-6V4NZFUS.js → chunk-PCYOT4PK.js}

@@ -3,24 +3,24 @@
 import {
   AUTO_THEME_NAME,
   themeManager
-} from "./chunk-I4H7PRWQ.js";
+} from "./chunk-HTWHAN44.js";
 import {
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-R5OP2ATH.js";
+} from "./chunk-JZG7VB6C.js";
 import {
   IdeClient
-} from "./chunk-YAINVQ3Q.js";
+} from "./chunk-A5OPLHFM.js";
 import {
   AuthEvent,
   IdeConnectionEvent,
   logAuth,
   logIdeConnection
-} from "./chunk-QNKBEJO2.js";
+} from "./chunk-UA6XBZT7.js";
 import {
   getErrorMessage
-} from "./chunk-UX4SGCGN.js";
+} from "./chunk-AVQDCKNF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-CF6BB3LT.js → chunk-PPFWEV7G.js}

@@ -172,7 +172,16 @@ var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
   "QWEN_CODE_MCP_APPROVALS_PATH",
   "QWEN_CODE_TRUSTED_FOLDERS_PATH",
   ENV_CORRUPTED_PATH,
-  ENV_WAS_RECOVERED
+  ENV_WAS_RECOVERED,
+  // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)
+  // disable TLS certificate verification for all outbound API connections. A
+  // project `.env` must never enable either — that would let an untrusted repo
+  // silently turn off MITM protection. Opt-in stays with the user via the
+  // `--insecure` flag, the shell environment, or a home `.env`. The initial
+  // `.env` load only consults this list, so both keys must be here (not just
+  // RELOAD_EXCLUDED_KEYS, which only applies on reload).
+  "QWEN_TLS_INSECURE",
+  "NODE_TLS_REJECT_UNAUTHORIZED"
 ];
 var HOME_ENV_BOOTSTRAP_KEYS = [
   "QWEN_HOME",

package/chunks/{chunk-FXKVLFFY.js → chunk-PSFDB5FZ.js}

@@ -1,11 +1,11 @@
 // Force strict mode and setup for ESM
 "use strict";
+import {
+  MissingCliEntryError
+} from "./chunk-M7BLWURA.js";
 import {
   ndJsonStream
 } from "./chunk-UFC57OYT.js";
-import {
-  MissingCliEntryError
-} from "./chunk-L7OKCI7T.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-XJYUPHRC.js → chunk-QOMAHFYI.js}

@@ -3,17 +3,17 @@
 import {
   getInboxesDir,
   require_proper_lockfile
-} from "./chunk-BVSVIN45.js";
+} from "./chunk-LKWAVAB5.js";
 import {
   Mutex
 } from "./chunk-OMX7CUOE.js";
 import {
   atomicWriteJSON
-} from "./chunk-3227DZO4.js";
+} from "./chunk-T42ACHFI.js";
 import {
   createDebugLogger,
   isNodeError
-} from "./chunk-UX4SGCGN.js";
+} from "./chunk-AVQDCKNF.js";
 import {
   init_esbuild_shims
 } from "./chunk-A4BMJM77.js";

package/chunks/{chunk-J37FGIOA.js → chunk-QXPI7FEC.js}

@@ -7,6 +7,7 @@ import {
   require_type
 } from "./chunk-7RYW5LQV.js";
 import {
+  require_function_bind,
   require_hasown
 } from "./chunk-UWCTAVOD.js";
 import {
@@ -658,6 +659,18 @@ var require_es_set_tostringtag = __commonJS({
   }
 });
 
+// node_modules/form-data/node_modules/hasown/index.js
+var require_hasown2 = __commonJS({
+  "node_modules/form-data/node_modules/hasown/index.js"(exports, module) {
+    "use strict";
+    init_esbuild_shims();
+    var call = Function.prototype.call;
+    var $hasOwn = Object.prototype.hasOwnProperty;
+    var bind = require_function_bind();
+    module.exports = bind.call(call, $hasOwn);
+  }
+});
+
 // node_modules/form-data/lib/populate.js
 var require_populate = __commonJS({
   "node_modules/form-data/lib/populate.js"(exports, module) {
@@ -689,8 +702,12 @@ var require_form_data = __commonJS({
     var mime = require_mime_types();
     var asynckit = require_asynckit();
     var setToStringTag = require_es_set_tostringtag();
-    var hasOwn = require_hasown();
+    var hasOwn = require_hasown2();
     var populate = require_populate();
+    function escapeHeaderParam(str) {
+      return String(str).replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/"/g, "%22");
+    }
+    __name(escapeHeaderParam, "escapeHeaderParam");
     function FormData(options) {
       if (!(this instanceof FormData)) {
         return new FormData(options);
@@ -781,7 +798,7 @@ var require_form_data = __commonJS({
       var contents = "";
       var headers = {
         // add custom disposition as third element or keep it two elements if not
-        "Content-Disposition": ["form-data", 'name="' + field + '"'].concat(contentDisposition || []),
+        "Content-Disposition": ["form-data", 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
         // if no content type. allow it to be empty array
         "Content-Type": [].concat(contentType || [])
       };
@@ -815,7 +832,7 @@ var require_form_data = __commonJS({
         filename = path.basename(value.client._httpMessage.path || "");
       }
       if (filename) {
-        return 'filename="' + filename + '"';
+        return 'filename="' + escapeHeaderParam(filename) + '"';
       }
     };
     FormData.prototype._getContentType = function(value, options) {
@@ -1113,6 +1130,11 @@ var require_follow_redirects = __commonJS({
     } catch (error) {
       useNativeURL = error.code === "ERR_INVALID_URL";
     }
+    var sensitiveHeaders = [
+      "Authorization",
+      "Proxy-Authorization",
+      "Cookie"
+    ];
     var preservedUrlFields = [
       "auth",
       "host",
@@ -1177,6 +1199,7 @@ var require_follow_redirects = __commonJS({
           self.emit("error", cause instanceof RedirectionError ? cause : new RedirectionError({ cause }));
         }
       };
+      this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i");
       this._performRequest();
     }
     __name(RedirectableRequest, "RedirectableRequest");
@@ -1318,6 +1341,9 @@ var require_follow_redirects = __commonJS({
       if (!options.headers) {
         options.headers = {};
       }
+      if (!isArray(options.sensitiveHeaders)) {
+        options.sensitiveHeaders = [];
+      }
       if (options.host) {
         if (!options.hostname) {
           options.hostname = options.host;
@@ -1423,7 +1449,7 @@ var require_follow_redirects = __commonJS({
       this._isRedirect = true;
       spreadUrlObject(redirectUrl, this._options);
       if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) {
-        removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+        removeMatchingHeaders(this._headerFilter, this._options.headers);
       }
       if (isFunction(beforeRedirect)) {
         var responseDetails = {
@@ -1585,6 +1611,10 @@ var require_follow_redirects = __commonJS({
       return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
     }
     __name(isSubdomain, "isSubdomain");
+    function isArray(value) {
+      return value instanceof Array;
+    }
+    __name(isArray, "isArray");
     function isString(value) {
       return typeof value === "string" || value instanceof String;
     }
@@ -1601,6 +1631,10 @@ var require_follow_redirects = __commonJS({
       return URL && value instanceof URL;
     }
     __name(isURL, "isURL");
+    function escapeRegex(regex) {
+      return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+    }
+    __name(escapeRegex, "escapeRegex");
     module.exports = wrap({ http, https });
     module.exports.wrap = wrap;
   }