@qwen-code/qwen-code 0.21.0 → 0.21.1-nightly.20260730.1643a6c9a

package/chunks/chunk-Z4X5MTRT.js

@@ -0,0 +1,133 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/config/skill-settings.ts
+init_esbuild_shims();
+function normalizeSkillNames(value) {
+  if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+  return new Set(
+    value.filter((name) => typeof name === "string").map((name) => name.trim().toLowerCase()).filter(Boolean)
+  );
+}
+__name(normalizeSkillNames, "normalizeSkillNames");
+function skillSettingStrings(settings, scope, key) {
+  const value = settings.forScope(scope).settings.skills?.[key];
+  return Array.isArray(value) ? value.filter((name) => typeof name === "string") : [];
+}
+__name(skillSettingStrings, "skillSettingStrings");
+function resolveSkillSettings(settings) {
+  const hardDisabled = normalizeSkillNames(settings.merged.skills?.disabled);
+  const defaultDisabled = normalizeSkillNames(
+    settings.merged.skills?.defaultDisabled
+  );
+  const enabled = normalizeSkillNames(settings.merged.skills?.enabled);
+  const disablements = /* @__PURE__ */ new Map();
+  for (const name of defaultDisabled) {
+    if (!enabled.has(name)) disablements.set(name, { reason: "default" });
+  }
+  const lockedScopes = [
+    ["SystemDefaults" /* SystemDefaults */, "systemDefaults"],
+    ["User" /* User */, "user"],
+    ["System" /* System */, "system"]
+  ];
+  const lockedByName = /* @__PURE__ */ new Map();
+  for (const [scope, label] of lockedScopes) {
+    for (const name of normalizeSkillNames(
+      skillSettingStrings(settings, scope, "disabled")
+    )) {
+      lockedByName.set(name, label);
+    }
+  }
+  for (const name of hardDisabled) {
+    const lockedScope = lockedByName.get(name);
+    disablements.set(name, {
+      reason: "hard",
+      ...lockedScope ? { lockedScope } : {}
+    });
+  }
+  return {
+    disabledNames: new Set(disablements.keys()),
+    defaultDisabledNames: defaultDisabled,
+    enabledNames: enabled,
+    disablements
+  };
+}
+__name(resolveSkillSettings, "resolveSkillSettings");
+function updateTarget(names, skillName, include) {
+  const normalizedName = skillName.trim().toLowerCase();
+  const next = [];
+  let found = false;
+  for (const name of names) {
+    if (name.trim().toLowerCase() !== normalizedName) {
+      next.push(name);
+    } else if (include && !found) {
+      next.push(skillName);
+      found = true;
+    }
+  }
+  if (include && !found) next.push(skillName);
+  return next;
+}
+__name(updateTarget, "updateTarget");
+function updateWorkspaceSkillSettingLists(lists, skillName, enabled, defaultDisabled) {
+  const normalizedName = skillName.trim().toLowerCase();
+  const hadExplicitEnable = lists.enabled.some(
+    (name) => name.trim().toLowerCase() === normalizedName
+  );
+  if (enabled) {
+    return {
+      disabled: updateTarget(lists.disabled, skillName, false),
+      enabled: defaultDisabled || hadExplicitEnable ? updateTarget(lists.enabled, skillName, true) : lists.enabled
+    };
+  }
+  return {
+    disabled: updateTarget(lists.disabled, skillName, true),
+    enabled: updateTarget(lists.enabled, skillName, false)
+  };
+}
+__name(updateWorkspaceSkillSettingLists, "updateWorkspaceSkillSettingLists");
+function computeWorkspaceSkillListUpdates(workspaceDisabled, lockedNames, workspaceEnabled, toggles) {
+  const previousDisabled = workspaceDisabled.filter(
+    (name) => !lockedNames.has(name.trim().toLowerCase())
+  );
+  const previousEnabled = [...workspaceEnabled];
+  let next = {
+    disabled: previousDisabled,
+    enabled: previousEnabled
+  };
+  for (const toggle of toggles) {
+    if (toggle.wasEnabled === toggle.isEnabled) continue;
+    next = updateWorkspaceSkillSettingLists(
+      next,
+      toggle.name,
+      toggle.isEnabled,
+      toggle.defaultDisabled
+    );
+  }
+  return {
+    disabled: next.disabled,
+    enabled: next.enabled,
+    disabledChanged: JSON.stringify(previousDisabled) !== JSON.stringify(next.disabled),
+    enabledChanged: JSON.stringify(previousEnabled) !== JSON.stringify(next.enabled)
+  };
+}
+__name(computeWorkspaceSkillListUpdates, "computeWorkspaceSkillListUpdates");
+
+export {
+  normalizeSkillNames,
+  skillSettingStrings,
+  resolveSkillSettings,
+  updateWorkspaceSkillSettingLists,
+  computeWorkspaceSkillListUpdates
+};
+/**
+ * @license
+ * Copyright 2026 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-UW5EOVUN.js → chunk-ZBVS26BY.js}

@@ -58,6 +58,10 @@ function normalize(model) {
   let s = (model ?? "").toLowerCase().trim();
   s = s.replace(/^.*\//, "");
   s = s.split("|").pop() ?? s;
+  s = s.replace(
+    /:(?:free|beta|extended|thinking|online|nitro|floor|latest|\d+(?:\.\d+)?(?:x\d+)?b(?:-[\w.]+)*)$/,
+    ""
+  );
   s = s.split(":").pop() ?? s;
   s = s.replace(/\s+/g, "-");
   s = s.replace(/-preview/g, "");
@@ -233,11 +237,7 @@ __name(reconcileMaxTokens, "reconcileMaxTokens");
 
 export {
   DEFAULT_TOKEN_LIMIT,
-  DEFAULT_OUTPUT_TOKEN_LIMIT,
-  ESCALATED_MAX_TOKENS,
   OUTPUT_TOKEN_CEILING,
-  MIN_CLAMPED_OUTPUT_TOKENS,
-  outputClampMargin,
   clampOutputTokensToWindow,
   parsePositiveIntegerEnvValue,
   normalize,

package/chunks/{chunk-ZD6UTE4A.js → chunk-ZHBO7WVX.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   expandHomeDir
-} from "./chunk-NL7LTRLR.js";
+} from "./chunk-UHUSJ6X7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-7JURR4JT.js → chunk-ZM63TFJH.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   MissingCliEntryError
-} from "./chunk-VIA5XA4U.js";
+} from "./chunk-MKQOXP2O.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
@@ -125,6 +125,144 @@ function callHook(hook, value) {
 }
 __name(callHook, "callHook");
 
+// packages/acp-bridge/src/process-registry.ts
+init_esbuild_shims();
+var TERM_GRACE_MS = 5e3;
+var EXIT_DEADLINE_MS = 1e4;
+var ProcessRegistry = class {
+  static {
+    __name(this, "ProcessRegistry");
+  }
+  reservations = /* @__PURE__ */ new Set();
+  children = /* @__PURE__ */ new Set();
+  draining = false;
+  shutdownPromise;
+  reserve() {
+    if (this.draining) {
+      throw new Error("ACP process registry is draining");
+    }
+    const token = Symbol("acp-child");
+    this.reservations.add(token);
+    let settled = false;
+    return {
+      attach: /* @__PURE__ */ __name((child) => {
+        if (settled || !this.reservations.delete(token)) {
+          throw new Error("ACP process reservation is no longer active");
+        }
+        settled = true;
+        const tracked = new TrackedChild(child, () => {
+          this.children.delete(tracked);
+        });
+        this.children.add(tracked);
+        if (this.draining) void tracked.terminate().catch(() => {
+        });
+        return tracked;
+      }, "attach"),
+      cancel: /* @__PURE__ */ __name(() => {
+        if (settled) return;
+        settled = true;
+        this.reservations.delete(token);
+      }, "cancel")
+    };
+  }
+  shutdown() {
+    if (this.shutdownPromise) return this.shutdownPromise;
+    this.draining = true;
+    this.shutdownPromise = Promise.allSettled(
+      [...this.children].map((child) => child.terminate())
+    ).then((results) => {
+      const failures = results.flatMap(
+        (result) => result.status === "rejected" ? [result.reason] : []
+      );
+      if (failures.length > 0) {
+        throw new AggregateError(failures, "ACP child process shutdown failed");
+      }
+    });
+    return this.shutdownPromise;
+  }
+  killAllSync() {
+    this.draining = true;
+    for (const child of this.children) child.killSync();
+  }
+  get activeProcessCount() {
+    return this.children.size;
+  }
+};
+var TrackedChild = class {
+  constructor(child, onExit) {
+    this.child = child;
+    this.onExit = onExit;
+    this.exited = new Promise((resolve) => {
+      const finish = /* @__PURE__ */ __name((info) => {
+        if (this.exitedSettled) return;
+        this.exitedSettled = true;
+        this.onExit();
+        resolve(info);
+      }, "finish");
+      child.once("exit", (exitCode, signalCode) => {
+        finish({ exitCode, signalCode });
+      });
+      child.once("spawn", () => {
+        this.spawnConfirmed = true;
+      });
+      child.once("error", () => {
+        if (!this.spawnConfirmed) finish(void 0);
+      });
+    });
+  }
+  static {
+    __name(this, "TrackedChild");
+  }
+  exited;
+  exitedSettled = false;
+  spawnConfirmed = false;
+  terminatePromise;
+  terminate() {
+    this.terminatePromise ??= this.terminateOnce();
+    return this.terminatePromise;
+  }
+  killSync() {
+    if (this.exitedSettled) return;
+    try {
+      this.child.kill("SIGKILL");
+    } catch {
+    }
+  }
+  async terminateOnce() {
+    if (this.exitedSettled) return;
+    try {
+      this.child.kill("SIGTERM");
+    } catch {
+      if (this.exitedSettled) return;
+    }
+    let hardKillTimer;
+    let deadlineTimer;
+    const deadline = new Promise((_, reject) => {
+      hardKillTimer = setTimeout(() => this.killSync(), TERM_GRACE_MS);
+      hardKillTimer.unref();
+      deadlineTimer = setTimeout(() => {
+        reject(
+          new Error(
+            `ACP child pid=${this.child.pid ?? "unknown"} did not exit within ${EXIT_DEADLINE_MS}ms`
+          )
+        );
+      }, EXIT_DEADLINE_MS);
+      deadlineTimer.unref();
+    });
+    try {
+      const exitInfo = await Promise.race([this.exited, deadline]);
+      if (exitInfo && (exitInfo.exitCode !== 0 || exitInfo.signalCode !== null)) {
+        throw new Error(
+          `ACP child pid=${this.child.pid ?? "unknown"} exited uncleanly during shutdown (code=${exitInfo.exitCode ?? "none"}, signal=${exitInfo.signalCode ?? "none"})`
+        );
+      }
+    } finally {
+      if (hardKillTimer) clearTimeout(hardKillTimer);
+      if (deadlineTimer) clearTimeout(deadlineTimer);
+    }
+  }
+};
+
 // packages/acp-bridge/src/spawnChannel.ts
 var cachedMemoryArgs;
 function getAcpMemoryArgs() {
@@ -178,6 +316,7 @@ function createStderrForwarder(opts) {
 }
 __name(createStderrForwarder, "createStderrForwarder");
 function createSpawnChannelFactory(options = {}) {
+  const processRegistry = options.processRegistry ?? new ProcessRegistry();
   return async (workspaceCwd, childEnvOverrides) => {
     const sourceEnv = options.sourceEnv ?? process.env;
     const cliEntry = sourceEnv["QWEN_CLI_ENTRY"] || process.argv[1];
@@ -194,21 +333,29 @@ function createSpawnChannelFactory(options = {}) {
     const execArgs = process.execArgv.filter(
       (a) => !/^--inspect(-brk)?($|=)/.test(a)
     );
-    const child = spawn(
-      process.execPath,
-      [
-        ...execArgs,
-        ...memoryArgs,
-        cliEntry,
-        "--acp",
-        ...options.extraArgs ?? []
-      ],
-      {
-        cwd: workspaceCwd,
-        stdio: ["pipe", "pipe", "pipe"],
-        env: childEnv
-      }
-    );
+    const reservation = processRegistry.reserve();
+    let child;
+    try {
+      child = spawn(
+        process.execPath,
+        [
+          ...execArgs,
+          ...memoryArgs,
+          cliEntry,
+          "--acp",
+          ...options.extraArgs ?? []
+        ],
+        {
+          cwd: workspaceCwd,
+          stdio: ["pipe", "pipe", "pipe"],
+          env: childEnv
+        }
+      );
+    } catch (error) {
+      reservation.cancel();
+      throw error;
+    }
+    const trackedChild = reservation.attach(child);
     if (child.stderr) {
       const prefix = `[serve pid=${child.pid} cwd=${workspaceCwd}] `;
       const forwarder = createStderrForwarder({
@@ -221,21 +368,8 @@ function createSpawnChannelFactory(options = {}) {
       child.stderr.on("error", () => {
       });
     }
-    const exited = new Promise((resolve) => {
-      let resolved = false;
-      const finish = /* @__PURE__ */ __name((info) => {
-        if (resolved) return;
-        resolved = true;
-        resolve(info);
-      }, "finish");
-      child.once(
-        "exit",
-        (code, signal) => finish({ exitCode: code, signalCode: signal })
-      );
-      child.once("error", () => finish(void 0));
-    });
     if (!child.stdin || !child.stdout) {
-      child.kill("SIGKILL");
+      trackedChild.killSync();
       throw new Error(
         "Spawned ACP child has no stdin/stdout \u2014 cannot establish NDJSON channel."
       );
@@ -245,22 +379,14 @@ function createSpawnChannelFactory(options = {}) {
     const stream = ndJsonStream(writable, readable, options.pipeHooks);
     return {
       stream,
-      kill: /* @__PURE__ */ __name(() => killChild(child), "kill"),
-      killSync: /* @__PURE__ */ __name(() => {
-        if (child.exitCode === null && child.signalCode === null) {
-          try {
-            child.kill("SIGKILL");
-          } catch {
-          }
-        }
-      }, "killSync"),
-      exited
+      kill: /* @__PURE__ */ __name(() => trackedChild.terminate(), "kill"),
+      killSync: /* @__PURE__ */ __name(() => trackedChild.killSync(), "killSync"),
+      exited: trackedChild.exited
     };
   };
 }
 __name(createSpawnChannelFactory, "createSpawnChannelFactory");
 var defaultSpawnChannelFactory = createSpawnChannelFactory();
-var KILL_HARD_DEADLINE_MS = 1e4;
 var SCRUBBED_CHILD_ENV_KEYS = /* @__PURE__ */ new Set([
   "QWEN_SERVER_TOKEN",
   "QWEN_CODE_SIMPLE"
@@ -283,46 +409,6 @@ function scrubChildEnv(source, scrubbed, overrides) {
   return childEnv;
 }
 __name(scrubChildEnv, "scrubChildEnv");
-function killChild(child) {
-  return new Promise((resolve) => {
-    if (child.exitCode !== null || child.signalCode !== null) {
-      resolve();
-      return;
-    }
-    let resolved = false;
-    const finish = /* @__PURE__ */ __name(() => {
-      if (resolved) return;
-      resolved = true;
-      child.removeListener("exit", finish);
-      resolve();
-    }, "finish");
-    child.once("exit", finish);
-    try {
-      child.kill("SIGTERM");
-    } catch {
-      finish();
-      return;
-    }
-    setTimeout(() => {
-      if (!resolved && child.exitCode === null && child.signalCode === null) {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
-      }
-    }, 5e3).unref();
-    setTimeout(() => {
-      if (!resolved) {
-        process.stderr.write(
-          `qwen serve: killChild hard deadline (${KILL_HARD_DEADLINE_MS}ms) reached; child pid=${child.pid} still alive (uninterruptible sleep?) \u2014 abandoning. Operator should check for zombie qwen --acp processes holding workspace resources.
-`
-        );
-        finish();
-      }
-    }, KILL_HARD_DEADLINE_MS).unref();
-  });
-}
-__name(killChild, "killChild");
 
 export {
   ndJsonStream,

package/chunks/{chunk-HTO4JFDZ.js → chunk-ZPJWUGCS.js}

@@ -89,7 +89,6 @@ function summarizeMcpResource(formatted) {
 __name(summarizeMcpResource, "summarizeMcpResource");
 
 export {
-  MAX_MCP_RESOURCE_TEXT_CHARS,
   MAX_MCP_RESOURCE_BLOB_CHARS,
   formatMcpResourceContents,
   emptyMcpResourceText,

package/chunks/{chunk-X5XDDSSH.js → chunk-ZPZ7ZJEE.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   getGlobalQwenDir
-} from "./chunk-RWTEFFPU.js";
+} from "./chunk-JCJ7LKNA.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -12,7 +12,8 @@ import {
 
 // packages/channels/weixin/dist/accounts.js
 init_esbuild_shims();
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, unlinkSync, renameSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { join } from "node:path";
 var DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
 function getStateDir() {
@@ -40,15 +41,37 @@ function loadAccount() {
 __name(loadAccount, "loadAccount");
 function saveAccount(data) {
   const p = accountPath();
-  writeFileSync(p, JSON.stringify(data, null, 2), "utf-8");
-  chmodSync(p, 384);
+  const tmp = `${p}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(data, null, 2), {
+      encoding: "utf-8",
+      mode: 384,
+      flag: "wx"
+    });
+    renameSync(tmp, p);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
 }
 __name(saveAccount, "saveAccount");
 function clearAccount() {
-  const p = accountPath();
+  const dir = getStateDir();
+  const p = join(dir, "account.json");
   if (existsSync(p)) {
     unlinkSync(p);
   }
+  for (const f of readdirSync(dir)) {
+    if (f.startsWith("account.json.") && f.endsWith(".tmp")) {
+      try {
+        unlinkSync(join(dir, f));
+      } catch {
+      }
+    }
+  }
 }
 __name(clearAccount, "clearAccount");
 

package/chunks/{chunk-ACY3A37B.js → chunk-ZS6Q44DY.js}

@@ -2,20 +2,23 @@
 "use strict";
 import {
   mapSkillConfigToStatus
-} from "./chunk-2W3OOD4W.js";
+} from "./chunk-L55JWS76.js";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-VIA5XA4U.js";
+} from "./chunk-MKQOXP2O.js";
+import {
+  resolveSkillSettings
+} from "./chunk-Z4X5MTRT.js";
 import {
   loadSettings
-} from "./chunk-TEHGS6UP.js";
+} from "./chunk-7A4V5CJY.js";
 import {
   writeStderrLine
 } from "./chunk-OWAK7LMW.js";
 import {
   SkillManager,
   isSafeModeEnv
-} from "./chunk-PHOF65IG.js";
+} from "./chunk-EYGWU66Z.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -25,17 +28,18 @@ import {
 
 // packages/cli/src/serve/workspace-skills-status.ts
 init_esbuild_shims();
-function createWorkspaceSkillsStatusProvider() {
+function createWorkspaceSkillsStatusProvider(options = {}) {
   const managers = /* @__PURE__ */ new Map();
   const provider = /* @__PURE__ */ __name((workspaceCwd) => buildWorkspaceSkillsStatus(
     workspaceCwd,
-    managers
+    managers,
+    options.workspaceTrusted ?? true
   ), "provider");
   provider.invalidate = (workspaceCwd) => managers.delete(workspaceCwd);
   return provider;
 }
 __name(createWorkspaceSkillsStatusProvider, "createWorkspaceSkillsStatusProvider");
-async function buildWorkspaceSkillsStatus(workspaceCwd, managers) {
+async function buildWorkspaceSkillsStatus(workspaceCwd, managers, workspaceTrusted) {
   try {
     let skillManager = managers.get(workspaceCwd);
     if (!skillManager) {
@@ -43,7 +47,7 @@ async function buildWorkspaceSkillsStatus(workspaceCwd, managers) {
         // Honor the safe-mode env the same way `Config` does when no explicit
         // flag is passed, so an operator running in safe mode gets the same
         // bundled-only listing the child would produce.
-        isSafeMode: /* @__PURE__ */ __name(() => isSafeModeEnv(), "isSafeMode"),
+        isSafeMode: /* @__PURE__ */ __name(() => !workspaceTrusted || isSafeModeEnv(), "isSafeMode"),
         // Bare mode is the interactive `--bare` CLI flag; the daemon never runs
         // bare, so it is always off here.
         getBareMode: /* @__PURE__ */ __name(() => false, "getBareMode"),
@@ -55,13 +59,22 @@ async function buildWorkspaceSkillsStatus(workspaceCwd, managers) {
       skillManager = new SkillManager(shim);
       managers.set(workspaceCwd, skillManager);
     }
-    const disabled = readDisabledSkillNames(workspaceCwd);
+    const disablements = resolveSkillSettings(
+      loadSettings(workspaceCwd, {
+        consumeCorruptionEnvVars: false,
+        skipLoadEnvironment: !workspaceTrusted,
+        skipWorkspaceSettings: !workspaceTrusted,
+        workspaceTrusted
+      })
+    ).disablements;
     const skills = await skillManager.listSkills();
     return {
       v: STATUS_SCHEMA_VERSION,
       workspaceCwd,
       initialized: true,
-      skills: skills.map((skill) => mapSkillConfigToStatus(skill, disabled))
+      skills: skills.map(
+        (skill) => mapSkillConfigToStatus(skill, disablements)
+      )
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -84,14 +97,6 @@ async function buildWorkspaceSkillsStatus(workspaceCwd, managers) {
   }
 }
 __name(buildWorkspaceSkillsStatus, "buildWorkspaceSkillsStatus");
-function readDisabledSkillNames(workspaceCwd) {
-  const raw = loadSettings(workspaceCwd, false).merged.skills?.disabled;
-  if (!Array.isArray(raw)) return /* @__PURE__ */ new Set();
-  return new Set(
-    raw.filter((name) => typeof name === "string").map((name) => name.trim().toLowerCase()).filter(Boolean)
-  );
-}
-__name(readDisabledSkillNames, "readDisabledSkillNames");
 
 export {
   createWorkspaceSkillsStatusProvider

package/chunks/{chunk-ZJHVAS7M.js → chunk-ZWUDSQBD.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   getRateLimitErrorDetails
-} from "./chunk-6FGBXPWM.js";
+} from "./chunk-RPLGZJV2.js";
 import {
   isInternalPromptId
-} from "./chunk-CIKQ7KKO.js";
+} from "./chunk-2Q4CZ3V6.js";
 import {
   createDebugLogger
-} from "./chunk-NL7LTRLR.js";
+} from "./chunk-UHUSJ6X7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -279,8 +279,7 @@ var openaiLogger = new OpenAILogger();
 
 export {
   resolveOpenAILogDir,
-  OpenAILogger,
-  openaiLogger
+  OpenAILogger
 };
 /**
  * @license