@qwen-code/qwen-code 0.21.13 → 0.21.14-nightly.20260822.7a4566cb3b

package/chunks/{chunk-UKMR3CKV.js → chunk-D7QQ6RUB.js}

@@ -2,29 +2,35 @@
 "use strict";
 import {
   performStandaloneUpdate
-} from "./chunk-NEFOOD54.js";
+} from "./chunk-J7VPB2HF.js";
 import {
   updateEventEmitter
 } from "./chunk-YAF2MQZ6.js";
 import {
+  t
+} from "./chunk-45UD2TU4.js";
+import {
+  require_semver
+} from "./chunk-2AUM35J5.js";
+import {
+  getHomebrewLatestVersion,
   getInstallationInfo,
   resolveUpdateCommand
-} from "./chunk-BKPPWD33.js";
-import {
-  t
-} from "./chunk-HUTNYWBG.js";
+} from "./chunk-M2IL2RTA.js";
 import {
   createDebugLogger
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
 import {
-  __name
+  __name,
+  __toESM
 } from "./chunk-J2S4EL5Y.js";
 
 // packages/cli/src/utils/handleAutoUpdate.ts
 init_esbuild_shims();
+var import_semver = __toESM(require_semver(), 1);
 
 // packages/cli/src/utils/spawnWrapper.ts
 init_esbuild_shims();
@@ -36,7 +42,7 @@ import os from "node:os";
 var debugLogger = createDebugLogger("AUTO_UPDATE");
 var UPDATE_SUCCESS_MESSAGE = "Update successful! The new version will be used on your next run.";
 var UPDATE_FAILED_MESSAGE = "Automatic update failed. Please try updating manually.";
-function handleAutoUpdate(info, settings, projectRoot, spawnFn = spawnWrapper) {
+async function handleAutoUpdate(info, settings, projectRoot, spawnFn = spawnWrapper) {
   if (!info) {
     return;
   }
@@ -45,10 +51,19 @@ function handleAutoUpdate(info, settings, projectRoot, spawnFn = spawnWrapper) {
     projectRoot,
     isAutoUpdateEnabled
   );
+  if (installationInfo.packageManager === "homebrew" /* HOMEBREW */) {
+    const installedVersion = import_semver.default.coerce(info.update.current)?.version;
+    const brewLatestVersion = import_semver.default.coerce(
+      await getHomebrewLatestVersion() ?? void 0
+    )?.version;
+    if (installedVersion && brewLatestVersion && !import_semver.default.gt(brewLatestVersion, installedVersion)) {
+      return;
+    }
+  }
   let combinedMessage = info.message;
   if (installationInfo.updateMessage) {
     combinedMessage += `
-${installationInfo.updateMessage}`;
+${t(installationInfo.updateMessage)}`;
   }
   updateEventEmitter.emit("update-received", {
     message: combinedMessage

package/chunks/{chunk-DXIBNLBZ.js → chunk-DB2OKNTU.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   wrapForMultiplexer
-} from "./chunk-GMIEIY3Y.js";
+} from "./chunk-O5BDEWBC.js";
 import {
   createDebugLogger
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-DGZEMW5R.js → chunk-DJEHYM4H.js}

@@ -19,15 +19,15 @@ import {
   taskHasLegacyCondition,
   taskHasLegacyRunMode,
   updateCronTasks
-} from "./chunk-Y3YCSWG5.js";
+} from "./chunk-AZF6SME3.js";
 import {
   ToolNames
-} from "./chunk-6HY6IF3Z.js";
+} from "./chunk-6NFAEG54.js";
 import {
   Storage,
   createDebugLogger,
   getProjectHash
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-O565M6A4.js → chunk-DRVS6K7A.js}

@@ -17,7 +17,7 @@ import {
 } from "./chunk-NYWWQ437.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-S5DWMTHO.js";
+} from "./chunk-QQUVPMMZ.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   translateAndCheckAbsoluteWorkspacePath
@@ -29,7 +29,7 @@ import {
   ROOT_CONTEXT,
   context,
   init_esm
-} from "./chunk-QUGAUQGJ.js";
+} from "./chunk-TBWQLLFO.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -923,9 +923,107 @@ function isDeepHealthQuery(raw) {
 }
 __name(isDeepHealthQuery, "isDeepHealthQuery");
 
-// packages/cli/src/serve/auth.ts
+// packages/cli/src/serve/local-control/credentials.ts
 init_esbuild_shims();
 import { createHash, timingSafeEqual } from "node:crypto";
+var CredentialStore = class {
+  static {
+    __name(this, "CredentialStore");
+  }
+  #runtime;
+  /** Pairing id → sha256 of the pairing secret. */
+  #pairing = /* @__PURE__ */ new Map();
+  constructor(runtimeToken) {
+    this.#runtime = hashToken(runtimeToken);
+  }
+  addPairingToken(id, token) {
+    this.#pairing.set(id, createHash("sha256").update(token, "utf8").digest());
+  }
+  revokePairingToken(id) {
+    return this.#pairing.delete(id);
+  }
+  /**
+   * Is the gate open — i.e. may an unauthenticated request through?
+   *
+   * Only ever true on the primary listener of a no-token loopback daemon,
+   * preserving today's developer default. The LAN listener is never open: it
+   * exists only while a pairing token does, and it must not inherit the
+   * "operator chose the surface area" reasoning that governs `--hostname`.
+   */
+  isOpen(listener) {
+    if (listener.kind === "local-control") return false;
+    return this.#runtime === void 0;
+  }
+  /**
+   * Constant-time check of a presented credential against those valid for
+   * `listener`. Every candidate in scope is compared even after a match so the
+   * work is independent of which credential matched — with a handful of
+   * pairing tokens the cost is negligible and the timing signal is not worth
+   * reasoning about separately.
+   */
+  verify(credentials, listener) {
+    const candidate = createHash("sha256").update(credentials, "utf8").digest();
+    let matched = false;
+    if (listener.kind === "local-control") {
+      for (const expected of this.#pairing.values()) {
+        if (equalDigest(candidate, expected)) matched = true;
+      }
+      return matched;
+    }
+    return this.#runtime !== void 0 && equalDigest(candidate, this.#runtime);
+  }
+};
+function singleTokenCredentials(token) {
+  const expected = hashToken(token);
+  return {
+    isOpen: /* @__PURE__ */ __name((listener) => expected === void 0 && listener.kind !== "local-control", "isOpen"),
+    verify: /* @__PURE__ */ __name((candidate, listener) => {
+      if (expected === void 0 || listener.kind === "local-control") {
+        return false;
+      }
+      return equalDigest(
+        createHash("sha256").update(candidate, "utf8").digest(),
+        expected
+      );
+    }, "verify")
+  };
+}
+__name(singleTokenCredentials, "singleTokenCredentials");
+function hashToken(token) {
+  return token === void 0 || token === "" ? void 0 : createHash("sha256").update(token, "utf8").digest();
+}
+__name(hashToken, "hashToken");
+function equalDigest(a, b) {
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+__name(equalDigest, "equalDigest");
+
+// packages/cli/src/serve/local-control/listener-identity.ts
+init_esbuild_shims();
+var LISTENER_TAG = Symbol.for("qwen.serve.listenerIdentity");
+function tagListener(server, identity) {
+  server[LISTENER_TAG] = identity;
+}
+__name(tagListener, "tagListener");
+var PRIMARY = { kind: "primary" };
+function fromServer(server) {
+  if (!server || typeof server !== "object") return void 0;
+  return server[LISTENER_TAG];
+}
+__name(fromServer, "fromServer");
+function listenerIdentityOf(req) {
+  const socket = req.socket;
+  return fromServer(socket?.server) ?? PRIMARY;
+}
+__name(listenerIdentityOf, "listenerIdentityOf");
+function listenerIdentityOfSocket(socket) {
+  const withServer = socket;
+  return fromServer(withServer?.server) ?? PRIMARY;
+}
+__name(listenerIdentityOfSocket, "listenerIdentityOfSocket");
+
+// packages/cli/src/serve/auth.ts
+init_esbuild_shims();
 var denyBrowserOriginCors = /* @__PURE__ */ __name((req, res, next) => {
   if (req.headers.origin) {
     res.setHeader("Vary", "Origin");
@@ -973,7 +1071,42 @@ function parseAllowOriginPatterns(raw) {
   return { allowAny, origins };
 }
 __name(parseAllowOriginPatterns, "parseAllowOriginPatterns");
+var MutableOriginAllowlist = class {
+  static {
+    __name(this, "MutableOriginAllowlist");
+  }
+  #allowAny;
+  #static;
+  #dynamic = /* @__PURE__ */ new Map();
+  constructor(base) {
+    this.#allowAny = base.allowAny;
+    this.#static = new Set(base.origins);
+  }
+  allows(origin) {
+    if (this.#allowAny) return true;
+    const normalized = origin.toLowerCase();
+    if (this.#static.has(normalized)) return true;
+    for (const value of this.#dynamic.values()) {
+      if (value === normalized) return true;
+    }
+    return false;
+  }
+  /** Add a runtime origin under `key`; re-adding the same key replaces it. */
+  add(key, origin) {
+    this.#dynamic.set(key, origin.toLowerCase());
+  }
+  remove(key) {
+    this.#dynamic.delete(key);
+  }
+};
+function toMatcher(patterns) {
+  return "allows" in patterns ? patterns : {
+    allows: /* @__PURE__ */ __name((origin) => patterns.allowAny || patterns.origins.has(origin.toLowerCase()), "allows")
+  };
+}
+__name(toMatcher, "toMatcher");
 function allowOriginCors(patterns) {
+  const matcher = toMatcher(patterns);
   const allowedMethods = "GET, POST, PATCH, DELETE, OPTIONS";
   const allowedHeaders = "Authorization, Content-Type, X-Qwen-Client-Id, Last-Event-ID, X-Qwen-Event-Epoch";
   const maxAgeSeconds = "86400";
@@ -989,7 +1122,7 @@ function allowOriginCors(patterns) {
       res.status(403).json({ error: "Request denied by CORS policy" });
       return;
     }
-    const matched = patterns.allowAny || patterns.origins.has(origin.toLowerCase());
+    const matched = matcher.allows(origin);
     if (matched) {
       res.setHeader("Access-Control-Allow-Origin", origin);
       res.setHeader("Vary", "Origin");
@@ -1010,6 +1143,24 @@ function allowOriginCors(patterns) {
 }
 __name(allowOriginCors, "allowOriginCors");
 function hostAllowlist(bind, getPort) {
+  const primaryGate = buildPrimaryHostGate(bind, getPort);
+  return (req, res, next) => {
+    const listener = listenerIdentityOf(req);
+    if (listener.kind !== "local-control") {
+      primaryGate(req, res, next);
+      return;
+    }
+    const host = (req.headers.host || "").toLowerCase();
+    const browserHost = listener.origin === void 0 ? void 0 : new URL(listener.origin).host.toLowerCase();
+    if (listener.authority === void 0 || host !== listener.authority && host !== browserHost) {
+      res.status(403).json({ error: "Invalid Host header" });
+      return;
+    }
+    next();
+  };
+}
+__name(hostAllowlist, "hostAllowlist");
+function buildPrimaryHostGate(bind, getPort) {
   if (!isLoopbackBind(bind)) {
     return (_req, _res, next) => next();
   }
@@ -1042,13 +1193,15 @@ function hostAllowlist(bind, getPort) {
     next();
   };
 }
-__name(hostAllowlist, "hostAllowlist");
-function bearerAuth(token) {
-  if (!token) {
-    return (_req, _res, next) => next();
-  }
-  const expected = createHash("sha256").update(token, "utf8").digest();
+__name(buildPrimaryHostGate, "buildPrimaryHostGate");
+function bearerAuth(source) {
+  const credentials = typeof source === "object" && source !== null ? source : singleTokenCredentials(source);
   return (req, res, next) => {
+    const listener = listenerIdentityOf(req);
+    if (credentials.isOpen(listener)) {
+      next();
+      return;
+    }
     const header = req.headers.authorization;
     if (!header) {
       res.status(401).json({ error: "Unauthorized" });
@@ -1068,26 +1221,35 @@ function bearerAuth(token) {
     while (credStart < header.length && (header.charCodeAt(credStart) === 32 || header.charCodeAt(credStart) === 9)) {
       credStart++;
     }
-    const credentials = header.slice(credStart);
-    if (credentials.length === 0) {
+    const presented = header.slice(credStart);
+    if (presented.length === 0) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
-    const candidate = createHash("sha256").update(credentials, "utf8").digest();
-    if (!timingSafeEqual(candidate, expected)) {
+    if (!credentials.verify(presented, listener)) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
+    req[AUTHENTICATED_REQUEST] = true;
     next();
   };
 }
 __name(bearerAuth, "bearerAuth");
+var AUTHENTICATED_REQUEST = Symbol("qwen.serve.authenticatedRequest");
+function requestWasAuthenticated(req) {
+  return req[AUTHENTICATED_REQUEST] === true;
+}
+__name(requestWasAuthenticated, "requestWasAuthenticated");
 function createMutationGate(deps) {
   const passthrough = /* @__PURE__ */ __name((_req, _res, next) => next(), "passthrough");
   if (deps.requireAuth || deps.tokenConfigured) {
     return () => passthrough;
   }
-  const strictDenier = /* @__PURE__ */ __name((_req, res) => {
+  const strictDenier = /* @__PURE__ */ __name((req, res, next) => {
+    if (requestWasAuthenticated(req)) {
+      next();
+      return;
+    }
     res.status(401).json({
       error: "This route requires the daemon to be configured with a bearer token. Set QWEN_SERVER_TOKEN or pass --token to enable bearer auth.",
       code: "token_required"
@@ -1270,6 +1432,10 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_source_metadata: { since: "v1" },
   session_side_task: { since: "v1" },
   session_prompt: { since: "v1" },
+  session_turn_status: { since: "v1" },
+  // Prompts and mid-turn messages reference session-scoped image and file
+  // attachments by their stored filename.
+  session_attachments: { since: "v1" },
   session_mid_turn_message_mutation: { since: "v1" },
   // Daemon-owned reconciliation surface for mid-turn messages:
   // `GET /session/:id/mid-turn-messages` returns the messages still waiting
@@ -1403,6 +1569,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   workspace_tool_toggle: { since: "v1" },
   workspace_skill_toggle: { since: "v1" },
   workspace_skill_batch_toggle: { since: "v1" },
+  extension_batch_activation_v2: { since: "v1" },
   workspace_skill_manage: { since: "v1" },
   workspace_settings: { since: "v1" },
   // `GET /workspace/permissions` is always available when this tag is
@@ -1591,6 +1758,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   // projections. This is additive to the legacy primary-workspace
   // `workspace_extensions` contract.
   extension_management_v2: { since: "v1" },
+  extension_git_credentials: { since: "v1" },
   // Workspace-qualified, daemon-local persisted transcript paging. The tag is
   // unconditional because the route also serves a trusted single-workspace
   // primary; authorization is evaluated for the selected runtime per request.
@@ -1603,6 +1771,17 @@ var SERVE_CAPABILITY_REGISTRY = {
   // This remains independent from active export so older daemons cannot ignore
   // archive intent and return an active transcript with the same session id.
   workspace_archived_session_export: { since: "v1" },
+  // Workspace-qualified, memory-only session live-state snapshot plus the
+  // in-memory catalog version token
+  // (`GET /workspaces/:workspace/sessions/live-state`). Independent from
+  // `workspace_qualified_rest_core`: released daemons can advertise that tag
+  // without implementing this route, so clients must pre-flight it directly.
+  // The route stays subject to the per-workspace trust check even when the
+  // tag is advertised.
+  workspace_session_live_state: { since: "v1" },
+  // Workspace-qualified metadata updates for active, inactive, and archived
+  // persisted sessions.
+  workspace_session_metadata: { since: "v1" },
   // Workspace-qualified ACP transport (issue #6378 Phase 4):
   // `/workspaces/:workspace/acp` mounts a per-runtime ACP dispatcher (HTTP +
   // WebSocket) for each registered workspace, with per-runtime device-flow and
@@ -2861,6 +3040,13 @@ async function buildDaemonStatusResponse(detail, input) {
     let childRssBytesTotal = 0;
     let childRssSampled = 0;
     let oldestChildReadingAgeMs = null;
+    let heapReported = 0;
+    let peakOldGenerationBytes = 0;
+    let peakLiveSetBytes = 0;
+    let peakTotalHeapBytes = 0;
+    let heapMajorGcCount = 0;
+    let heapMajorGcMs = 0;
+    const heapUnclassified = /* @__PURE__ */ new Set();
     for (const runtime of managedRuntimes ?? []) {
       if (!runtime.bridge.isChannelLive()) continue;
       const snapshot = runtime.bridge.getChildResourceSnapshot?.();
@@ -2873,6 +3059,23 @@ async function buildDaemonStatusResponse(detail, input) {
           snapshot.ageMs
         );
       }
+      const heap = snapshot.heap;
+      if (!heap) continue;
+      heapReported += 1;
+      peakOldGenerationBytes = Math.max(
+        peakOldGenerationBytes,
+        heap.peakOldGenerationBytes
+      );
+      peakLiveSetBytes = Math.max(peakLiveSetBytes, heap.peakLiveSetBytes);
+      peakTotalHeapBytes = Math.max(
+        peakTotalHeapBytes,
+        heap.peakTotalHeapBytes
+      );
+      heapMajorGcCount = Math.max(heapMajorGcCount, heap.majorGcCount);
+      heapMajorGcMs = Math.max(heapMajorGcMs, heap.majorGcMs);
+      for (const name of heap.unclassifiedSpaceNames) {
+        heapUnclassified.add(name);
+      }
     }
     const pressureMode = input.opts.memoryPressureMode ?? "observe";
     const pressureMemory = process.memoryUsage();
@@ -2883,7 +3086,18 @@ async function buildDaemonStatusResponse(detail, input) {
       children: {
         rssBytes: childRssBytesTotal,
         sampled: childRssSampled,
-        oldestReadingAgeMs: oldestChildReadingAgeMs
+        oldestReadingAgeMs: oldestChildReadingAgeMs,
+        // `null` on zero reporters, so an unmeasured daemon never publishes a
+        // zeroed object that reads as "no child needs any heap".
+        heap: heapReported > 0 ? {
+          peakOldGenerationBytes,
+          peakLiveSetBytes,
+          peakTotalHeapBytes,
+          majorGcCount: heapMajorGcCount,
+          majorGcMs: heapMajorGcMs,
+          unclassifiedSpaceNames: [...heapUnclassified],
+          reported: heapReported
+        } : null
       },
       modeled: {
         recommendedShareAtRegisteredMb: registeredWorkspaceCount > 0 ? recommendedChildShareMb(memoryBudget, registeredWorkspaceCount) : null,
@@ -3738,6 +3952,25 @@ var WorkspaceVoiceCoordinator = class {
 init_esbuild_shims();
 init_esm();
 import { performance } from "node:perf_hooks";
+
+// packages/cli/src/serve/server/telemetry-context.ts
+init_esbuild_shims();
+var daemonTelemetryResponseContext = Symbol(
+  "daemonTelemetryResponseContext"
+);
+var daemonInboundTraceIdContext = Symbol(
+  "daemonInboundTraceIdContext"
+);
+function getDaemonTelemetryInboundTraceId(res) {
+  try {
+    return res[daemonInboundTraceIdContext];
+  } catch {
+    return void 0;
+  }
+}
+__name(getDaemonTelemetryInboundTraceId, "getDaemonTelemetryInboundTraceId");
+
+// packages/cli/src/serve/server/access-log.ts
 var SESSION_ID_RE = /\/session\/([^/]+)/;
 var ACCESS_LOG_BURST = 60;
 var ACCESS_LOG_REFILL_PER_SECOND = 2;
@@ -3844,6 +4077,7 @@ function installAccessLogMiddleware(app, daemonLog, monotonicNow = () => perform
         const sessionId = sessionMatch?.[1] ? truncateUtf8(sessionMatch[1], SESSION_ID_MAX_BYTES) : void 0;
         const rawClientId = firstRawHeader(req.rawHeaders, "x-qwen-client-id");
         const clientId = rawClientId ? truncateUtf8(rawClientId, CLIENT_ID_MAX_BYTES) : void 0;
+        const inboundTraceId = getDaemonTelemetryInboundTraceId(res);
         const ctx = {
           route: route.value,
           ...route.originalBytes ? { routeOriginalBytes: route.originalBytes } : {},
@@ -3855,6 +4089,7 @@ function installAccessLogMiddleware(app, daemonLog, monotonicNow = () => perform
             clientId: clientId.value,
             ...clientId.originalBytes ? { clientIdOriginalBytes: clientId.originalBytes } : {}
           } : {},
+          ...inboundTraceId ? { traceId: inboundTraceId } : {},
           status,
           durationMs: Math.max(0, Math.round(monotonicNow() - startMs))
         };
@@ -3882,11 +4117,18 @@ export {
   createBridgeFileSystemAdapter,
   PathMutexRegistry,
   isDeepHealthQuery,
+  CredentialStore,
+  singleTokenCredentials,
+  tagListener,
+  listenerIdentityOf,
+  listenerIdentityOfSocket,
   denyBrowserOriginCors,
   parseAllowOriginPatterns,
+  MutableOriginAllowlist,
   allowOriginCors,
   hostAllowlist,
   bearerAuth,
+  requestWasAuthenticated,
   createMutationGate,
   ClientMcpSenderRegistry,
   createClientMcpServerProvider,
@@ -3947,6 +4189,8 @@ export {
   MAX_CONCURRENT_VOICE_SESSIONS,
   VoiceLeaseAbortError,
   WorkspaceVoiceCoordinator,
+  daemonTelemetryResponseContext,
+  daemonInboundTraceIdContext,
   ACCESS_LOG_CONTROLLER_LOCAL,
   installAccessLogMiddleware
 };

package/chunks/{chunk-U3VNBPUO.js → chunk-DV4375RD.js}

@@ -1,20 +1,20 @@
 // Force strict mode and setup for ESM
 "use strict";
+import {
+  t
+} from "./chunk-45UD2TU4.js";
 import {
   require_semver
 } from "./chunk-2AUM35J5.js";
 import {
   getNpmCliPath
-} from "./chunk-BKPPWD33.js";
-import {
-  t
-} from "./chunk-HUTNYWBG.js";
+} from "./chunk-M2IL2RTA.js";
 import {
   getPackageJson
 } from "./chunk-WZMH7II3.js";
 import {
   createDebugLogger
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-OXCMMLED.js → chunk-E63A23D7.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   getRateLimitErrorDetails
-} from "./chunk-FAAUPSY2.js";
+} from "./chunk-LI4YHTQK.js";
 import {
   isInternalPromptId
-} from "./chunk-RVOJ2FBP.js";
+} from "./chunk-RPJOOK6N.js";
 import {
   createDebugLogger
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-4NFY2S7N.js → chunk-E7REAOTN.js}

@@ -26,6 +26,16 @@ var getAsciiArtWidth = /* @__PURE__ */ __name((asciiArt) => {
 }, "getAsciiArtWidth");
 var codePointsCache = /* @__PURE__ */ new Map();
 var MAX_STRING_LENGTH_TO_CACHE = 1e3;
+var TEXT_CACHE_MAX_ENTRIES = 500;
+function evictOldestTextCacheEntry(cache) {
+  if (cache.size >= TEXT_CACHE_MAX_ENTRIES) {
+    const firstKey = cache.keys().next().value;
+    if (firstKey !== void 0) {
+      cache.delete(firstKey);
+    }
+  }
+}
+__name(evictOldestTextCacheEntry, "evictOldestTextCacheEntry");
 function toCodePoints(str) {
   let isAscii = true;
   for (let i = 0; i < str.length; i++) {
@@ -45,6 +55,7 @@ function toCodePoints(str) {
   }
   const result = Array.from(str);
   if (str.length <= MAX_STRING_LENGTH_TO_CACHE) {
+    evictOldestTextCacheEntry(codePointsCache);
     codePointsCache.set(str, result);
   }
   return result;
@@ -77,10 +88,14 @@ var getCachedStringWidth = /* @__PURE__ */ __name((str) => {
   if (/^[\x20-\x7E]*$/.test(str)) {
     return str.length;
   }
+  if (str.length > MAX_STRING_LENGTH_TO_CACHE) {
+    return stringWidth(str);
+  }
   if (stringWidthCache.has(str)) {
     return stringWidthCache.get(str);
   }
   const width = stringWidth(str);
+  evictOldestTextCacheEntry(stringWidthCache);
   stringWidthCache.set(str, width);
   return width;
 }, "getCachedStringWidth");

package/chunks/{chunk-6ORZ2EDC.js → chunk-EW2IQ3ID.js}

@@ -5,14 +5,14 @@ import {
   isTranscribableVoiceModel,
   readVoiceLanguage,
   resolveVoiceTransport
-} from "./chunk-QIH2HAEN.js";
+} from "./chunk-GXG4PYQB.js";
 import {
   resolvePath
-} from "./chunk-WGHHA7ZH.js";
+} from "./chunk-Z3JMO2CH.js";
 import {
   createDebugLogger,
   isSubpath
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-A5F2YNO6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";