npm - @qwen-code/qwen-code - Versions diffs - 0.19.6 → 0.19.7-nightly.20260708.394c1a289 - Mend

@qwen-code/qwen-code 0.19.6 → 0.19.7-nightly.20260708.394c1a289

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (267) hide show

package/bundled/qc-helper/docs/configuration/model-providers.md CHANGED Viewed

@@ -430,13 +430,17 @@ The effective auth/model/credential values are chosen per field using the follow
 | -------------------------- | ----------------------------------- | ----------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------ | ---------------------- | --------------------------------- |
 | Programmatic overrides     | `/auth`                             | `/auth` input                                   | `/auth` input                                         | `/auth` input                                          | —                      | —                                 |
 | Model provider selection   | —                                   | `modelProvider.id`                              | `env[modelProvider.envKey]`                           | `modelProvider.baseUrl`                                | `modelProvider.envKey` | —                                 |
-| CLI arguments              | `--auth-type`                       | `--model`                                       | `--openai-api-key` (or provider-specific equivalents) | `--openai-base-url` (or provider-specific equivalents) | —                      | —                                 |
+| CLI arguments              | `--auth-type`                       | `--model`                                       | `--openai-api-key`                                    | `--openai-base-url`                                    | —                      | —                                 |
 | Environment variables      | —                                   | Provider-specific mapping (e.g. `OPENAI_MODEL`) | Provider-specific mapping (e.g. `OPENAI_API_KEY`)     | Provider-specific mapping (e.g. `OPENAI_BASE_URL`)     | —                      | —                                 |
 | Settings (`settings.json`) | `security.auth.selectedType`        | `model.name`                                    | `security.auth.apiKey`                                | `security.auth.baseUrl`                                | —                      | —                                 |
 | Default / computed         | Falls back to `AuthType.QWEN_OAUTH` | Built-in default (OpenAI ⇒ `qwen3.5-plus`)      | —                                                     | —                                                      | —                      | `Config.getProxy()` if configured |
 \*When present, CLI auth flags override settings. Otherwise, `security.auth.selectedType` or the implicit default determine the auth type. Qwen OAuth and OpenAI are the only auth types surfaced without extra configuration.
+> [!note]
+>
+> `--openai-api-key` and `--openai-base-url` are the only credential CLI flags. They apply to the active OpenAI-compatible provider regardless of its name — there are no `--anthropic-*` / `--gemini-*` credential flags. Provider-specific credentials that aren't passed on the CLI are resolved from environment variables (see the row below).
 > [!warning]
 >
 > **Deprecation of `security.auth.apiKey` and `security.auth.baseUrl`:** Directly configuring API credentials via `security.auth.apiKey` and `security.auth.baseUrl` in `settings.json` is deprecated. These settings were used in historical versions for credentials entered through the UI, but the credential input flow was removed in version 0.10.1. These fields will be fully removed in a future release. **It is strongly recommended to migrate to `modelProviders`** for all model and credential configurations. Use `envKey` in `modelProviders` to reference environment variables for secure credential management instead of hardcoding credentials in settings files.

package/bundled/qc-helper/docs/configuration/settings.md CHANGED Viewed

@@ -86,7 +86,12 @@ Settings are organized into categories. Most settings should be placed within th
 | `general.sessionRecapAwayThresholdMinutes` | number  | Minutes the terminal must be blurred before an auto-recap fires on focus-in. Only used when `showSessionRecap` is enabled.                                                                                                                                                                                      | `5`         |
 | `general.gitCoAuthor.commit`               | boolean | Add a Co-authored-by trailer to git commit messages AND attach a per-file AI-attribution git note (`refs/notes/ai-attribution`) for commits made through Qwen Code. Disabling skips both.                                                                                                                       | `true`      |
 | `general.gitCoAuthor.pr`                   | boolean | Append a Qwen Code attribution line to pull request descriptions when running `gh pr create`.                                                                                                                                                                                                                   | `true`      |
-| `general.defaultFileEncoding`              | string  | Default encoding for new files. Use `"utf-8"` (default) for UTF-8 without BOM, or `"utf-8-bom"` for UTF-8 with BOM. Only change this if your project specifically requires BOM.                                                                                                                                 | `"utf-8"`   |
+| `general.defaultFileEncoding`              | enum    | Default encoding for new files. Use `"utf-8"` (default) for UTF-8 without BOM, or `"utf-8-bom"` for UTF-8 with BOM. Only change this if your project specifically requires BOM.                                                                                                                                 | `"utf-8"`   |
+| `general.voice.enabled`                    | boolean | Enable voice dictation in the prompt input. Also togglable with the `/voice` command. Requires a transcription model (`voiceModel`) to be configured.                                                                                                                                                          | `false`     |
+| `general.voice.mode`                       | enum    | How push-to-talk behaves: `"hold"` to talk while the key is held, or `"tap"` to start and tap (or pause) to stop and submit.                                                                                                                                                                                   | `"hold"`    |
+| `general.voice.language`                   | string  | Preferred spoken language for voice transcription (e.g. `"english"`, `"chinese"`). Leave empty to auto-detect.                                                                                                                                                                                                 | `""`        |
+| `general.voice.keytermsFile`               | string  | Path to a custom keyterms file (one term per line, `#` for comments) that biases voice transcription toward domain-specific terms. Relative paths resolve from the workspace root; defaults to `.qwen/voice-keyterms.txt` when present. Read only in trusted workspaces. Only applies to Qwen ASR models (`qwen3-asr-*`). | `""`        |
+| `general.voice.refineTranscript`           | boolean | Clean up voice transcripts with the fast model before inserting them — removes filler words and fixes recognition errors while preserving meaning. Falls back to the raw transcript on failure, and is skipped when no fast model is configured.                                                                | `true`      |
 | `general.cleanupPeriodDays`                | number  | Days to retain `~/.qwen/file-history/` session backups used by `/rewind`. Backups older than this are removed by a background pass that runs at most once per day. `0` = minimum retention (~1 hour): keeps sessions touched in the last hour plus the currently active one. Changes take effect after restart. | `30`        |
 | `general.language`                         | enum    | Language for the user interface. Use `"auto"` to detect from system settings, or a language code (e.g. `"zh-CN"`, `"fr"`). Custom codes can be added by placing JS locale files in `~/.qwen/locales/`. See [i18n](../features/language). Requires restart.                                                      | `"auto"`    |
 | `general.outputLanguage`                   | string  | Language for model output. Use `"auto"` to detect from system settings, or set a specific language. Requires restart.                                                                                                                                                                                           | `"auto"`    |
@@ -170,6 +175,7 @@ Settings are organized into categories. Most settings should be placed within th
 | `model.chatCompression.screenshotTriggerThreshold` | number  | Tool-returned image count at or above which the screenshot trigger fires (only when `enableScreenshotTrigger`). Compaction resets the count — surviving images are re-embedded as top-level parts, which the trigger doesn't count — so it won't immediately re-fire. Env override: `QWEN_COMPACT_SCREENSHOT_THRESHOLD`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `50`        |
 | `model.skipNextSpeakerCheck`                       | boolean | Skip the next speaker check.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `true`      |
 | `model.skipLoopDetection`                          | boolean | Disables streaming loop detection checks. Defaults to `true` (loop detection is skipped) to avoid false positives interrupting legitimate workflows. Set to `false` to re-enable streaming loop detection — useful as a guardrail in headless / non-interactive runs where stuck repetition can otherwise waste budget.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `true`      |
+| `model.maxToolCallsPerTurn`                        | number  | Hard cap on tool calls within a single turn (one model turn plus its tool-result continuations; blocking Stop-hook continuations such as `/goal` iterations start a fresh budget). Always-on circuit breaker against runaway turns, independent of `model.skipLoopDetection`; the pattern-based loop detectors fire long before this cap, which only bounds total volume. Set to `0` or a negative value to disable the cap. Choosing "Disable loop detection for this session" in the loop-detected dialog also suppresses it for the rest of the session.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `100`       |
 | `model.skipStartupContext`                         | boolean | Skips sending the startup workspace context (environment summary and acknowledgement) at the beginning of each session. Enable this if you prefer to provide context manually or want to save tokens on startup.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `false`     |
 | `model.enableOpenAILogging`                        | boolean | Enables logging of OpenAI API calls for debugging and analysis. When enabled, API requests and responses are logged to JSON files.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `false`     |
 | `model.openAILoggingDir`                           | string  | Custom directory path for OpenAI API logs. If not specified, defaults to `logs/openai` in the current working directory. Supports absolute paths, relative paths (resolved from current working directory), and `~` expansion (home directory).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `undefined` |
@@ -203,6 +209,10 @@ Settings are organized into categories. Most settings should be placed within th
 }
 ```
+**timeout (request timeout):**
+`timeout` is the per-request timeout in milliseconds (default `120000`). Set it to `0` to disable the request timeout — matching the `QWEN_STREAM_IDLE_TIMEOUT_MS=0` convention — rather than aborting the request. It can also be set via the `QWEN_CODE_API_TIMEOUT_MS` environment variable. This is distinct from `QWEN_STREAM_IDLE_TIMEOUT_MS`, which bounds inactivity _between_ streamed chunks.
 **max_tokens (output token limit):**
 When neither `samplingParams.max_tokens` nor `QWEN_CODE_MAX_OUTPUT_TOKENS` is set, Qwen Code generally uses the selected model's declared output limit as the request's default output limit. If the response still hits that limit, Qwen Code may retry with an escalated limit (using a 64K floor) and then recover across continuation turns.
@@ -258,6 +268,18 @@ The `extra_body` field allows you to add custom parameters to the request body s
 | ------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
 | `voiceModel` | string | Model used for voice transcription. Leave empty to keep voice dictation disabled until a voice model is selected. Can also be set via `/model --voice`. | `""`    |
+#### modelFallbacks
+| Setting          | Type   | Description                                                                                                                                                                                                                            | Default |
+| ---------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `modelFallbacks` | string | Ordered list of fallback model IDs (comma-separated, max 3) to try when the primary model hits capacity errors (429/503/529). Example: `"qwen-plus,qwen-turbo"`. Can also be set via the `--fallback-model` CLI flag. Requires restart. | `""`    |
+#### modelPricing
+| Setting        | Type   | Description                                                                                                                                                                | Default     |
+| -------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| `modelPricing` | object | Optional per-model pricing for cost estimation in `/stats model`. Example: `{ "qwen3-coder": { "inputPerMillionTokens": 0.30, "outputPerMillionTokens": 1.20 } }`. | `undefined` |
 #### context
 | Setting                                                     | Type                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                       | Default                         |
@@ -303,6 +325,7 @@ If you are experiencing performance issues with file searching (e.g., with `@` c
 | `tools.truncateToolOutputLines`       | number            | Maximum lines or entries kept when truncating tool output. Applies to Shell, Grep, Glob, ReadFile and ReadManyFiles tools.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `1000`      | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 | `tools.computerUse.enabled`           | boolean           | Enable the built-in Computer Use tools (cua-driver native desktop automation). When `true` (default), the `computer_use__*` tools are registered as deferred built-ins; the first invocation downloads the pinned, signed cua-driver binary into `~/.qwen/computer-use/` and walks through macOS Accessibility / Screen Recording permissions.                                                                                                                                                                                                                                                                                                                                                                                                       | `true`      | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 | `tools.computerUse.maxImageDimension` | number            | Longest-edge pixel cap applied to cua-driver screenshots (via `set_config`'s `max_image_dimension`). `-1` (default) keeps cua-driver's built-in default (1568); `0` disables resizing (full resolution); a positive value caps the longest edge. Lower caps cut vision-token cost at the expense of fine detail.                                                                                                                                                                                                                                                                                                                                                                                                                                     | `-1`        | Requires restart: Yes. Env override: `QWEN_COMPUTER_USE_MAX_IMAGE_DIMENSION` (a non-negative integer; takes precedence over this setting)                                                                                                                                                                                   |
+| `tools.computerUse.idleTimeoutMs`     | number            | Milliseconds to keep the cua-driver process alive after the last `computer_use__*` call. The default is `300000` (5 minutes). Set to `0` to keep it running until Qwen Code exits.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `300000`    | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 | `tools.toolSearch.enabled`            | boolean           | Load MCP tools on demand via ToolSearch to reduce prompt size. Disable this for models that rely on prefix-based KV caching (e.g. DeepSeek) to keep the prompt prefix stable and maximize cache hit rates.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `true`      | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 > [!note]
@@ -450,6 +473,14 @@ execute when typed.
 > affect tool permissions — see `permissions.deny` for that. It also does not
 > intercept keyboard shortcuts such as `Ctrl+C` or `Esc`.
+#### skills
+Controls which [Skills](../features/skills) are exposed to the model.
+| Setting          | Type             | Description                                                                                                                                                                                                                                                                                    | Default     |
+| ---------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| `skills.disabled` | array of strings | Skill names to hide. Matched case-insensitively against the skill name. Hidden skills do not appear in `<available_skills>` or as `/<name>` slash commands. **Merged as a union** across user/project/system scopes, so a project cannot remove entries defined in user or system settings. | `undefined` |
 #### mcp
 | Setting             | Type             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                 | Default     |
@@ -457,6 +488,7 @@ execute when typed.
 | `mcp.serverCommand` | string           | Command to start an MCP server.                                                                                                                                                                                                                                                                                                                                                                                                             | `undefined` |
 | `mcp.allowed`       | array of strings | An allowlist of MCP servers to allow. Allows you to specify a list of MCP server names that should be made available to the model. This can be used to restrict the set of MCP servers to connect to. Supports glob patterns (`*` matches any sequence, `?` matches a single character — e.g. `"*puppeteer*"`); entries without glob characters are matched exactly. Note that this will be ignored if `--allowed-mcp-server-names` is set. | `undefined` |
 | `mcp.excluded`      | array of strings | A denylist of MCP servers to exclude. A server listed in both `mcp.excluded` and `mcp.allowed` is excluded. Supports glob patterns (`*`, `?`) the same way as `mcp.allowed`. Note that this will be ignored if `--allowed-mcp-server-names` is set.                                                                                                                                                                                         | `undefined` |
+| `mcp.toolIdleTimeoutMs` | number       | Idle timeout in milliseconds for MCP tool calls. If the MCP server does not produce any response or progress update within this time, the call is aborted. Must be between `10000` and `3600000`. Can be overridden via the `QWEN_CODE_MCP_TOOL_IDLE_TIMEOUT_MS` environment variable.                                                                                                                                                     | `300000`    |
 > [!note]
 >

package/bundled/qc-helper/docs/features/channels/_meta.ts CHANGED Viewed

@@ -3,6 +3,7 @@ export default {
   telegram: 'Telegram',
   weixin: 'WeChat',
   dingtalk: 'DingTalk',
+  wecom: 'WeCom',
   feishu: 'Feishu',
   qqbot: 'QQ Bot',
   plugins: 'Plugins',

package/bundled/qc-helper/docs/features/channels/overview.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # Channels
-Channels let you interact with a Qwen Code agent from messaging platforms like Telegram, WeChat, QQ, or DingTalk, instead of the terminal. You send messages from your phone or desktop chat app, and the agent responds just like it would in the CLI.
+Channels let you interact with a Qwen Code agent from messaging platforms like Telegram, WeChat, QQ, DingTalk, WeCom, or Feishu, instead of the terminal. You send messages from your phone or desktop chat app, and the agent responds just like it would in the CLI.
 ## How It Works
@@ -15,7 +15,7 @@ All channels share one agent process with isolated sessions per user. Each chann
 ## Quick Start
-1. Set up a bot on your messaging platform (see channel-specific guides: [Telegram](./telegram), [WeChat](./weixin), [QQ Bot](./qqbot), [DingTalk](./dingtalk))
+1. Set up a bot on your messaging platform (see channel-specific guides: [Telegram](./telegram), [WeChat](./weixin), [QQ Bot](./qqbot), [DingTalk](./dingtalk), [WeCom](./wecom), [Feishu](./feishu))
 2. Add the channel configuration to `~/.qwen/settings.json`
 3. Run `qwen channel start` to start all channels, or `qwen channel start <name>` for a single channel
@@ -47,25 +47,27 @@ Channels are configured under the `channels` key in `settings.json`. Each channe
 ### Options
-| Option                   | Required | Description                                                                                                                                                            |
-| ------------------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `type`                   | Yes      | Channel type: `telegram`, `weixin`, `qq`, `dingtalk`, `feishu`, or a custom type from an extension (see [Plugins](./plugins))                                          |
-| `token`                  | Telegram | Bot token. Supports `$ENV_VAR` syntax to read from environment variables. Not needed for WeChat or DingTalk                                                            |
-| `clientId`               | DingTalk | DingTalk AppKey. Supports `$ENV_VAR` syntax                                                                                                                            |
-| `clientSecret`           | DingTalk | DingTalk AppSecret. Supports `$ENV_VAR` syntax                                                                                                                         |
-| `model`                  | No       | Model to use for this channel (e.g., `qwen3.5-plus`). Overrides the default model. Useful for multimodal models that support image input                               |
-| `senderPolicy`           | No       | Who can talk to the bot: `allowlist` (default), `open`, or `pairing`                                                                                                   |
-| `allowedUsers`           | No       | List of user IDs allowed to use the bot (used by `allowlist` and `pairing` policies)                                                                                   |
-| `sessionScope`           | No       | How sessions are scoped: `user` (default), `thread`, or `single`                                                                                                       |
-| `cwd`                    | No       | Working directory for the agent. Defaults to the current directory                                                                                                     |
-| `instructions`           | No       | Custom instructions prepended to the first message of each session                                                                                                     |
-| `groupPolicy`            | No       | Group chat access: `disabled` (default), `allowlist`, or `open`. See [Group Chats](#group-chats)                                                                       |
-| `groupHistoryLimit`      | No       | Opt-in group history backfill. `0` or omitted disables it. A positive number persists that many authorized, unmentioned group messages for the next bot mention/reply. |
-| `groups`                 | No       | Per-group settings. Keys are group chat IDs or `"*"` for defaults. See [Group Chats](#group-chats)                                                                     |
-| `dispatchMode`           | No       | What happens when you send a message while the bot is busy: `steer` (default), `collect`, or `followup`. See [Dispatch Modes](#dispatch-modes)                         |
-| `blockStreaming`         | No       | Progressive response delivery: `on` or `off` (default). See [Block Streaming](#block-streaming)                                                                        |
-| `blockStreamingChunk`    | No       | Chunk size bounds: `{ "minChars": 400, "maxChars": 1000 }`. See [Block Streaming](#block-streaming)                                                                    |
-| `blockStreamingCoalesce` | No       | Idle flush: `{ "idleMs": 1500 }`. See [Block Streaming](#block-streaming)                                                                                              |
+| Option                   | Required         | Description                                                                                                                                                            |
+| ------------------------ | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `type`                   | Yes              | Channel type: `telegram`, `weixin`, `qq`, `dingtalk`, `wecom`, `feishu`, or a custom type from an extension (see [Plugins](./plugins))                                 |
+| `token`                  | Telegram         | Bot token. Supports `$ENV_VAR` syntax to read from environment variables. Not needed for WeChat, DingTalk, WeCom, or Feishu                                            |
+| `clientId`               | DingTalk, Feishu | DingTalk AppKey or Feishu App ID. Supports `$ENV_VAR` syntax                                                                                                           |
+| `clientSecret`           | DingTalk, Feishu | DingTalk AppSecret or Feishu App Secret. Supports `$ENV_VAR` syntax                                                                                                    |
+| `botId`                  | WeCom            | WeCom intelligent robot Bot ID. Supports `$ENV_VAR` syntax. See [WeCom](./wecom)                                                                                       |
+| `secret`                 | WeCom            | WeCom intelligent robot Secret. Supports `$ENV_VAR` syntax. See [WeCom](./wecom)                                                                                       |
+| `model`                  | No               | Model to use for this channel (e.g., `qwen3.5-plus`). Overrides the default model. Useful for multimodal models that support image input                               |
+| `senderPolicy`           | No               | Who can talk to the bot: `allowlist` (default), `open`, or `pairing`                                                                                                   |
+| `allowedUsers`           | No               | List of user IDs allowed to use the bot (used by `allowlist` and `pairing` policies)                                                                                   |
+| `sessionScope`           | No               | How sessions are scoped: `user` (default), `thread`, or `single`                                                                                                       |
+| `cwd`                    | No               | Working directory for the agent. Defaults to the current directory                                                                                                     |
+| `instructions`           | No               | Custom instructions prepended to the first message of each session                                                                                                     |
+| `groupPolicy`            | No               | Group chat access: `disabled` (default), `allowlist`, or `open`. See [Group Chats](#group-chats)                                                                       |
+| `groupHistoryLimit`      | No               | Opt-in group history backfill. `0` or omitted disables it. A positive number persists that many authorized, unmentioned group messages for the next bot mention/reply. |
+| `groups`                 | No               | Per-group settings. Keys are group chat IDs or `"*"` for defaults. See [Group Chats](#group-chats)                                                                     |
+| `dispatchMode`           | No               | What happens when you send a message while the bot is busy: `steer` (default), `collect`, or `followup`. See [Dispatch Modes](#dispatch-modes)                         |
+| `blockStreaming`         | No               | Progressive response delivery: `on` or `off` (default). See [Block Streaming](#block-streaming)                                                                        |
+| `blockStreamingChunk`    | No               | Chunk size bounds: `{ "minChars": 400, "maxChars": 1000 }`. See [Block Streaming](#block-streaming)                                                                    |
+| `blockStreamingCoalesce` | No               | Idle flush: `{ "idleMs": 1500 }`. See [Block Streaming](#block-streaming)                                                                                              |
 ### Sender Policy
@@ -87,11 +89,15 @@ Controls how conversation sessions are managed:
 Channel memory lets an authorized channel member save stable context for one chat or thread. Qwen Code injects that memory when a fresh channel session starts, including after `/clear`.
-Commands:
+Natural-language examples:
-- `/remember-channel <text>` saves a memory line for the current chat or thread.
-- `/channel-memory` shows saved memory for the current chat or thread.
-- `/forget-channel confirm` clears saved memory for the current chat or thread.
+- `记住：默认使用 staging 环境` saves memory for the current chat or thread.
+- `你记一下以后回复前要说 1122` saves the extracted durable memory.
+- `你现在都记住了什么` shows saved memory for the current chat or thread.
+- `把这个聊天的记忆清空` starts the clear flow; `确认清空记忆` confirms it.
+Group chats can show saved memory, but writes and clears are blocked to avoid
+turning shared memory into a prompt-injection path for other participants.
 Only users listed in `allowedUsers` can read, write, or clear channel memory. If `allowedUsers` is empty, channel memory commands are disabled for everyone.
@@ -262,11 +268,15 @@ Files work with any model — no multimodal support required.
 ### Platform differences
-| Feature  | Telegram                                     | WeChat                           | DingTalk                                      |
-| -------- | -------------------------------------------- | -------------------------------- | --------------------------------------------- |
-| Images   | Direct download via Bot API                  | CDN download with AES decryption | downloadCode API (two-step)                   |
-| Files    | Direct download via Bot API (20MB limit)     | CDN download with AES decryption | downloadCode API (two-step)                   |
-| Captions | Photo/file captions included as message text | Not applicable                   | Rich text: mixed text + images in one message |
+| Feature  | Telegram                                     | WeChat                           | DingTalk                                      | Feishu                                                      |
+| -------- | -------------------------------------------- | -------------------------------- | --------------------------------------------- | ----------------------------------------------------------- |
+| Images   | Direct download via Bot API                  | CDN download with AES decryption | downloadCode API (two-step)                   | Open API resources endpoint (authenticated GET, 50MB limit) |
+| Files    | Direct download via Bot API (20MB limit)     | CDN download with AES decryption | downloadCode API (two-step)                   | Open API resources endpoint (50MB limit)                    |
+| Captions | Photo/file captions included as message text | Not applicable                   | Rich text: mixed text + images in one message | Rich text (`post`): text extracted; embedded images ignored |
+> QQ Bot does not process incoming media — image and sticker messages are ignored, so it has no media-handling row above.
+>
+> WeCom accepts text, images, mixed text plus images, files, videos, and voice messages (transcribed). Images are passed to the agent as attachments; files and videos are downloaded to temporary local paths. See [WeCom](./wecom#images-and-files) for details.
 ## Dispatch Modes
@@ -337,7 +347,7 @@ Channels support slash commands. These are handled locally (no agent round-trip)
 All other slash commands (e.g., `/compress`, `/summary`) are forwarded to the agent.
-These commands work on all channel types (Telegram, WeChat, QQ, DingTalk).
+These commands work on all channel types (Telegram, WeChat, QQ, DingTalk, WeCom, Feishu).
 ## Running

package/bundled/qc-helper/docs/features/channels/wecom.md ADDED Viewed

@@ -0,0 +1,111 @@
+# WeCom (Enterprise WeChat)
+This guide covers setting up Qwen Code with a WeCom intelligent robot (企业微信智能机器人).
+## Prerequisites
+- A WeCom organization account
+- A WeCom intelligent robot created in API mode
+- The robot's Bot ID and Secret
+## Creating the Robot
+1. Open the WeCom admin console and create an intelligent robot.
+2. Choose API mode.
+3. Copy the Bot ID and Secret.
+4. Add the robot to the direct chats or groups where it should be available.
+The intelligent robot uses a WebSocket connection from Qwen Code to WeCom. You do not need a public callback URL, Token, EncodingAESKey, Corp ID, or Agent ID.
+## Configuration
+Add the channel to `~/.qwen/settings.json`:
+```json
+{
+  "channels": {
+    "my-wecom": {
+      "type": "wecom",
+      "botId": "$WECOM_BOT_ID",
+      "secret": "$WECOM_SECRET",
+      "senderPolicy": "allowlist",
+      "allowedUsers": ["zhangsan"],
+      "sessionScope": "user",
+      "cwd": "/path/to/your/project",
+      "instructions": "You are a concise coding assistant responding via WeCom.",
+      "groupPolicy": "open",
+      "groups": {
+        "*": { "requireMention": true }
+      }
+    }
+  }
+}
+```
+Set the credentials as environment variables:
+```bash
+export WECOM_BOT_ID=<your-bot-id>
+export WECOM_SECRET=<your-secret>
+```
+Or define them in the `env` section of `settings.json`:
+```json
+{
+  "env": {
+    "WECOM_BOT_ID": "your-bot-id",
+    "WECOM_SECRET": "your-secret"
+  }
+}
+```
+## Running
+```bash
+qwen channel start my-wecom
+```
+Open WeCom and send a message to the intelligent robot.
+## Access Control
+`senderPolicy` works the same way as other IM channels:
+- `allowlist`: only users in `allowedUsers` can use the bot. This is the recommended enterprise default.
+- `pairing`: users must pair before using the bot.
+- `open`: anyone who can message the robot can use it.
+For groups, set `groupPolicy` to `"allowlist"` or `"open"`. By default, group messages require a mention through `"requireMention": true`.
+When the WeCom SDK includes explicit mention metadata, Qwen Code uses it for this gate. If no mention metadata is present, the channel treats delivered group messages as unmentioned. Set `"requireMention": false` only if you want to rely on WeCom-side delivery scoping instead.
+## Images and Files
+Users can send text, voice messages with transcription, images, mixed text plus images, files, and videos. Images are passed to the agent as image attachments. Files and videos are downloaded to temporary local paths so the agent can read them with file tools.
+Assistant responses are sent as WeCom markdown. To send a local image generated by the agent, include one marker outside code blocks:
+```text
+[IMAGE: /absolute/path/to/image.png]
+```
+For safety, local image paths must be inside the channel file directory under the system temporary directory, such as `/tmp/channel-files/...` on Linux. Generic file, video, and voice upload markers are ignored because model-produced file paths could otherwise upload arbitrary workspace files.
+## Troubleshooting
+### Bot does not connect
+- Verify the Bot ID and Secret.
+- Make sure the robot is created in API mode.
+- Check that the environment variables are available in the shell running `qwen channel start`.
+### Bot does not respond in groups
+- Check `groupPolicy`.
+- Mention the bot unless the group config sets `"requireMention": false`.
+- Confirm the robot has been added to the group.
+### Self-built application credentials do not work
+This channel is for WeCom intelligent robots. Self-built application callback credentials such as Corp ID, Agent ID, Token, and EncodingAESKey are not used by this channel.

package/bundled/qc-helper/docs/features/code-review.md CHANGED Viewed

@@ -28,7 +28,8 @@ The `/review` command runs a multi-stage pipeline:
 ```
 Step 1:  Determine scope (local diff / PR worktree / file)
 Step 2:  Load project review rules
-Step 3:  9 parallel review agents                          [9 LLM calls]
+Step 3:  10 parallel review agents                         [10 LLM calls]
+           |-- Agent 0: Issue Fidelity & Root-Cause Ownership
            |-- Agent 1: Correctness
            |-- Agent 2: Security
            |-- Agent 3: Code Quality
@@ -48,6 +49,7 @@ Step 9:  Clean up (remove worktree + temp files)
 | Agent                             | Focus                                                                                       |
 | --------------------------------- | ------------------------------------------------------------------------------------------- |
+| Agent 0: Issue Fidelity           | Linked issue evidence, root-cause ownership, and whether the PR solves the reported problem |
 | Agent 1: Correctness              | Logic errors, edge cases, null handling, race conditions, type safety                       |
 | Agent 2: Security                 | Injection, XSS, SSRF, auth bypass, sensitive data exposure                                  |
 | Agent 3: Code Quality             | Style consistency, naming, duplication, dead code                                           |
@@ -56,7 +58,7 @@ Step 9:  Clean up (remove worktree + temp files)
 | Agent 6: Undirected Audit         | 3 parallel personas (attacker / 3am-oncall / maintainer) — catches cross-dimensional issues |
 | Agent 7: Build & Test             | Runs build and test commands, reports failures                                              |
-All agents run in parallel (Agent 6 launches 3 persona variants concurrently, totaling 9 parallel tasks for same-repo reviews). Findings from Agents 1-6 are verified in a **single batch verification pass** (one agent reviews all findings at once, keeping verification cost fixed regardless of finding count). After verification, **iterative reverse audit** runs 1-3 rounds of gap-finding — each round receives the cumulative finding list from prior rounds, so successive rounds focus on whatever's left undiscovered. The loop stops as soon as a round returns "No issues found", or after 3 rounds (hard cap). Reverse audit findings skip verification (the agent already has full context) and are included as high-confidence results.
+All agents run in parallel (Agent 6 launches 3 persona variants concurrently, totaling 10 parallel tasks for same-repo PR reviews; Agent 0 is skipped for local-diff and file-path reviews, which run 9). Findings from Agents 0-6 are verified in a **single batch verification pass** (one agent reviews all findings at once, keeping verification cost fixed regardless of finding count). After verification, **iterative reverse audit** runs 1-3 rounds of gap-finding — each round receives the cumulative finding list from prior rounds, so successive rounds focus on whatever's left undiscovered. The loop stops as soon as a round returns "No issues found", or after 3 rounds (hard cap). Reverse audit findings skip verification (the agent already has full context) and are included as high-confidence results.
 ## Severity Levels
@@ -92,7 +94,7 @@ This runs in **lightweight mode** — no worktree, no build/test. The review is
 | Capability                                                 | Same-repo | Cross-repo                    |
 | ---------------------------------------------------------- | --------- | ----------------------------- |
-| LLM review (Agents 1-6 + verify + iterative reverse audit) | ✅        | ✅                            |
+| LLM review (Agents 0-6 + verify + iterative reverse audit) | ✅        | ✅                            |
 | Agent 7: Build & test                                      | ✅        | ❌ (no local codebase)        |
 | Cross-file impact analysis                                 | ✅        | ❌                            |
 | PR inline comments                                         | ✅        | ✅ (if you have write access) |
@@ -148,7 +150,15 @@ You can customize review criteria per project. `/review` reads rules from these
 3. `AGENTS.md` — `## Code Review` section
 4. `QWEN.md` — `## Code Review` section
-Rules are injected into the LLM review agents (1-6) as additional criteria. For PR reviews, rules are read from the **base branch** to prevent a malicious PR from injecting bypass rules.
+Rules are injected into the LLM review agents (0-6) as additional criteria. For PR reviews, rules are read from the **base branch** to prevent a malicious PR from injecting bypass rules.
+## Issue Fidelity
+For bugfix PRs, the Issue Fidelity agent fetches issue evidence directly instead of relying on PR description text. It uses `gh pr view <pr> --repo <owner/repo> --json closingIssuesReferences` for GitHub's strong closing-issue metadata, then `gh issue view <number> --repo <issue_owner>/<issue_repo> --json title,body,comments` for the original report and discussion — the `--json` form includes the issue **body** (the reporter's original repro), which `--comments` alone omits, and the issue's own repository is read from each reference (a PR can close an issue in a different repo). This agent runs only for PR targets; local-diff and file-path reviews skip it.
+`closingIssuesReferences` is a discovery hint rather than proof the author linked the right issue: if it is empty but the PR references an apparent target issue, the agent still fetches it after judging relevance. Fetched issue text is treated as untrusted data (facts extracted, embedded instructions ignored). For relevant issues, the original reproduction, observed payload, expected behavior, and maintainer comments are treated as the highest-priority evidence for whether the PR fixes the right problem.
+If the issue evidence shows an upstream service or provider returned malformed data outside the client contract, client-side parser or sanitizer changes are not treated as a valid root-cause fix unless a maintainer explicitly requested a defensive workaround. A test that replays malformed upstream output proves only that the workaround handles that shape; it does not prove the workaround is architecturally appropriate.
 Example `.qwen/review-rules.md`:
@@ -219,10 +229,10 @@ The review pipeline uses a bounded number of LLM calls regardless of how many fi
 | Stage                            | LLM calls         | Notes                                               |
 | -------------------------------- | ----------------- | --------------------------------------------------- |
-| Review agents (Step 3)           | 9 (or 8)          | Run in parallel; Agent 7 skipped in cross-repo mode |
+| Review agents (Step 3)           | 10 (or 9)         | Run in parallel; Agent 7 skipped in cross-repo mode |
 | Batch verification (Step 4)      | 1                 | Single agent verifies all findings at once          |
 | Iterative reverse audit (Step 5) | 1-3               | Loops until "No issues found" or 3-round cap        |
-| **Total**                        | **11-13 (10-12)** | Same-repo: 11-13; cross-repo: 10-12 (no Agent 7)    |
+| **Total**                        | **12-14 (11-13)** | Same-repo: 12-14; cross-repo: 11-13 (no Agent 7)    |
 Most PRs converge to the lower end of the range (1 reverse audit round); the cap prevents runaway cost on pathological cases.

package/bundled/qc-helper/docs/features/commands.md CHANGED Viewed

@@ -81,7 +81,7 @@ Commands for managing AI tools and models.
 | `/mcp`            | List configured MCP servers and tools                                            | `/mcp`, `/mcp desc`, `/mcp nodesc`, `/mcp schema`                                                         |
 | `/import-config`  | Import MCP servers from Claude configs                                           | `/import-config all`, `/import-config claude-code`, `/import-config claude-desktop --scope user\|project` |
 | `/tools`          | Display currently available tool list                                            | `/tools`, `/tools desc`                                                                                   |
-| `/skills`         | List and run available skills                                                    | `/skills`, `/skills <name>`                                                                               |
+| `/skills`         | Open the Skills panel to browse, search, toggle, and launch skills               | `/skills`, `/<skill-name>`                                                                                |
 | `/plan`           | Switch to plan mode or exit plan mode                                            | `/plan`, `/plan <task>`, `/plan exit`                                                                     |
 | `/approval-mode`  | Change the tool-approval mode (current session only)                             | `/approval-mode`, `/approval-mode auto-edit`                                                              |
 | → `plan`          | Analysis only, no execution (secure review)                                      | `/approval-mode plan`                                                                                     |

package/bundled/qc-helper/docs/features/hooks.md CHANGED Viewed

@@ -396,6 +396,12 @@ Hook output supports three categories of fields:
 - `hookSpecificOutput.updatedInput`: modified tool input parameters to use instead of original
 - `hookSpecificOutput.additionalContext`: additional context information
+The `permissionDecision` value controls whether the tool runs:
+- `"allow"` — run the tool without the usual approval prompt.
+- `"deny"` — block the tool; it does not execute and an error is returned to the model.
+- `"ask"` — pause and ask the user to confirm the tool call in the TUI before it runs. Confirming runs the tool once; declining cancels it. In contexts that cannot prompt for confirmation — headless (`--prompt`) runs and background subagents — `"ask"` falls back to `"deny"`.
 **Note**: While standard hook output fields like `decision` and `reason` are technically supported by the underlying class, the official interface expects the `hookSpecificOutput` with `permissionDecision` and `permissionDecisionReason`.
 **Example Output**:

package/bundled/qc-helper/docs/features/skills.md CHANGED Viewed

@@ -17,13 +17,15 @@ Agent Skills package expertise into discoverable capabilities. Each Skill consis
 Skills are **model-invoked** — the model autonomously decides when to use them based on your request and the Skill's description. This is different from slash commands, which are **user-invoked** (you explicitly type `/command`).
-If you want to invoke a Skill explicitly, use the `/skills` slash command:
+If you want to invoke a Skill explicitly, type it as a slash command using the Skill's name:
 ```bash
-/skills <skill-name>
+/<skill-name>
 ```
-Use autocomplete to browse available Skills and descriptions.
+Start typing `/` to autocomplete and browse available Skills alongside their descriptions. The `/skills` command opens the Skills panel, where you can browse, search, toggle, and launch Skills interactively.
+> **Note:** If you previously ran a Skill with `/skills <skill-name>`, that syntax now just opens the Skills panel and ignores the trailing argument. Use `/<skill-name>` to run a Skill directly.
 ### Benefits

package/bundled/qc-helper/docs/integration-github-action.md CHANGED Viewed

@@ -1,4 +1,4 @@
-# Github Actions：qwen-code-action
+# GitHub Actions：qwen-code-action
 ## Overview