@qwen-code/qwen-code 0.21.3-nightly.20260803.e1e5b42ce → 0.21.4

package/chunks/{chunk-H2EDCJIM.js → chunk-2T3RYG4L.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   serveCommand
-} from "./chunk-QFIYH5KR.js";
+} from "./chunk-2ON2O4MD.js";
 import {
   listCommand
-} from "./chunk-FBDRTW3I.js";
+} from "./chunk-P5UJMCVS.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-YTSN63PD.js";
+} from "./chunk-EJXATV5R.js";
 import {
   ObservedChannelContactStore
 } from "./chunk-DYA25Y7U.js";
@@ -46,19 +46,19 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-BBXSRVSN.js";
+} from "./chunk-5XGI4IPK.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-NXDJEZCI.js";
+} from "./chunk-O4IWFYUW.js";
 import {
   collectProviderModelsForProtocol,
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-ZX6RZZFB.js";
+} from "./chunk-IMGNGOGC.js";
 import {
   parseChannelConfig
 } from "./chunk-LEZFUYPM.js";
@@ -128,29 +128,29 @@ import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-4JP34TZ6.js";
+} from "./chunk-6ME3PVMM.js";
 import {
   loadSettings
-} from "./chunk-GU5B6IF3.js";
+} from "./chunk-KB6VSG2U.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-CFVFQWFB.js";
+} from "./chunk-FV4TUUDE.js";
 import {
   loadEnvironment
-} from "./chunk-IV7QPMC2.js";
+} from "./chunk-4PZ7SPD5.js";
 import {
   getCliVersion
-} from "./chunk-C4IUDGPI.js";
+} from "./chunk-HBCKZF2A.js";
 import {
   getPackageJson
 } from "./chunk-VJNBRRZG.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-3GALLNII.js";
+} from "./chunk-URVJ4AZC.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -191,7 +191,7 @@ import {
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-MVMBE5EH.js";
+} from "./chunk-E2SYUEIA.js";
 import {
   nextFireTime,
   parseCron
@@ -206,14 +206,14 @@ import {
 import {
   getAllGeminiMdFilenames,
   setGeminiMdFilename
-} from "./chunk-KZXSAQYV.js";
+} from "./chunk-JDJ7SC4E.js";
 import {
   SchemaValidator,
   ToolNames
 } from "./chunk-CFDR3GNL.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
-} from "./chunk-UO7AWUZJ.js";
+} from "./chunk-TXZDRD36.js";
 import {
   isTlsVerificationDisabled
 } from "./chunk-BFHXDAR7.js";
@@ -11655,14 +11655,85 @@ var GITHUB_ACTIONS = {
 
 **Favour precision over recall here.** A false alarm on a workflow costs more reviewer trust than a missed minor nit, because a YAML finding is the easiest kind for an author to dismiss. Every finding needs the concrete trigger and the concrete outcome, like any other.`
 };
-var PATH_RULES = [GITHUB_ACTIONS];
+var JAVA = {
+  title: "Java / JVM performance",
+  matches: /* @__PURE__ */ __name((p) => /\.java$/i.test(p), "matches"),
+  checklist: `A Java change's most expensive regressions are decided by the JVM, not by anything a reader can see in the source: HotSpot chooses what to inline, what to scalar-replace, and what to compile at all \u2014 and a one-line change can flip each of those on a hot path. The general performance lens (N+1, repeated work, data structures) sees none of it.
+
+**You are reviewing this diff, not auditing this file.** A JVM-cost weakness the code already had, on a line this change does not touch, is out of scope \u2014 the same rule as everywhere else. What is in scope: a line this diff **adds or changes**, and a cheap path this diff **makes hot** (a new caller in a request loop, a call moved inside a loop). Test sources (\`src/test/**\`), \`package-info\`/\`module-info\`, and generated sources are out of scope for the hot-path items \u2014 nothing there is hot.
+
+**Correctness traps dressed as concurrency or performance code (Critical):**
+
+- **A \`SimpleDateFormat\` shared across threads.** It is not thread-safe: concurrent \`parse\`/\`format\` corrupts its calendar state and returns silently wrong values or throws. If the diff adds a shared (static or instance field) \`SimpleDateFormat\`, or makes an existing one reachable from more than one thread, that is wrong, not slow. The fix is \`java.time.format.DateTimeFormatter\` (immutable) or a \`ThreadLocal\`.
+- **A compound action on \`ConcurrentHashMap\` built from two calls.** \`get\`-then-\`put\`, \`containsKey\`-then-\`put\`, check-then-act of any shape: the map's thread safety covers each call, not the pair, and the race loses an update or runs the guarded work twice. Say what the race corrupts \u2014 that is the finding. Fix with \`putIfAbsent\`, \`computeIfAbsent\`, or \`merge\`.
+- **Double-checked locking without \`volatile\` on the field.** The reading thread can observe a partially constructed object. If the diff adds or touches the idiom, the field must be \`volatile\` (or replaced with the holder idiom).
+
+**JVM-cost defects provable from the source (Suggestion \u2014 a cost, not a wrongness):**
+
+- **A regex compiled per call.** \`Pattern.compile(...)\` in a method body or loop, and the \`String\` conveniences that hide it \u2014 \`matches\`, \`replaceAll\`, \`replaceFirst\`, and \`split\` with a real regex (a one- or two-character \`split\` argument takes a fast path only when it is not a regex construct \u2014 \`split(".")\` does not, since \`.\` is a metacharacter; the escaped two-character form \`split("\\\\.")\` does) \u2014 recompile the pattern on every invocation. On a per-request or per-record path that is real CPU. Fix: \`private static final Pattern\`.
+- **\`+=\` on a \`String\` inside a loop.** Each iteration rebuilds and copies the whole accumulated prefix; the loop is O(n\xB2) in the final length. Fix: one \`StringBuilder\` outside the loop.
+- **Boxing on a hot path.** A \`Long\`/\`Integer\` loop accumulator, a \`Map<Long, \u2026>\` over dense \`int\` keys, \`.boxed()\` in a counted stream: every box past the small-integer cache is an allocation plus a pointer chase per iteration. Fix: primitives, or the primitive streams/collections.
+- **A capturing lambda or method reference inside a hot loop.** A non-capturing lambda is a singleton; one that closes over a local allocates per iteration. If the diff moves a capturing lambda into a loop, hoist it or restructure it to capture nothing.
+- **A log message built whether or not it is logged.** \`log.debug("result: " + value)\` pays the concatenation with the level off, and even \`log.debug("{}", expensive())\` still pays \`expensive()\`. Fix: parameterized messages, and guard expensive arguments with \`isDebugEnabled()\` or a supplier-based logging API.
+- **A collection sized after the fact.** A \`HashMap\`/\`ArrayList\` the code then fills with a known N pays repeated rehash/grow-copy chains; presize it (a \`HashMap\` needs \`N/0.75 + 1\` to avoid rehashing at all \u2014 \`HashMap.newHashMap(n)\`, JDK 19+, does that arithmetic for you).
+- **Legacy synchronized types in new code.** \`Vector\`, \`Hashtable\`, \`StringBuffer\` put a monitor on every call; the unsynchronized equivalents are the default for a reason.
+- **An exception used as control flow.** Validating by catching \`NumberFormatException\`, looping until \`EOFException\`: \`fillInStackTrace\` costs more than the work being guarded. Validate instead.
+- **Reflection rediscovered per call.** \`getMethod\`/\`getField\` on every invocation of a hot path; cache the \`Method\`/\`Field\` \u2014 or a \`MethodHandle\` \u2014 once.
+
+**JIT inlining \u2014 the regression no dimension can see, and you cannot prove from source:**
+
+HotSpot's C2 compiler gates inlining on the **bytecode size of the callee** among other criteria. These are the size caps in its normal policy (a project's own \`-XX:\` flags, or a different JVM, change them \u2014 check before citing):
+
+| callee bytecode size | C2 normal-policy size cap |
+| --- | --- |
+| \u2264 6 (\`MaxTrivialSize\`) | under the trivial cap \u2014 size alone does not block it |
+| \u2264 35 (\`MaxInlineSize\`) | under the normal cap \u2014 size alone does not block it |
+| \u2264 325 (\`FreqInlineSize\`) | under the hot cap \u2014 size blocks it unless the call site is hot |
+| > 325 | over the hot cap \u2014 size blocks it at every call site |
+| > 8000 (\`HugeMethodLimit\`, a develop flag gated by the product \`DontCompileHugeMethods\`) | over the huge-method limit \u2014 size blocks even JIT compilation |
+
+A size cap is a gate, not an outcome: passing one is necessary but not sufficient. Independent of size, C2 also declines a call site that was **never executed**, has **low call site frequency**, exceeds the inlining **depth or recursion limits**, or hits the **node-count** cutoff \u2014 so a method under a cap can still be left un-inlined, and a static size measurement proves only that a threshold was crossed, not that the method *was* inlined before and *is not* now.
+
+Two more ways a diff can flip it: an already-compiled callee whose **native** size passes \`InlineSmallCode\` (x86_64 default: 2500 on JDK 17+, 2000 on JDK 8\u201316; 1000 only with \`-XX:-TieredCompilation\`) stops being inlined to protect the code cache, and a call site that gains a **third** receiver implementation goes megamorphic \u2014 vtable dispatch, and no inlining **unless one receiver still dominates the profile** (\`TypeProfileMajorReceiverPercent\`, 90% by default), in which case C2 inlines that receiver behind a guard with an uncommon trap for the rest. So the diff-shapes that matter: a small method on a hot path the change **grows** (added validation, logging, a branch), a new layer in a hot call chain, a new implementation registered for an interface invoked in a hot loop. A cold method over 325 bytes is **not** a finding \u2014 inlining only matters where the call is hot.
+
+**Measure it; do not estimate bytecode from source.** Two tiers, in order of cost:
+
+1. **Static \u2014 available when the class compiles, which for a leaf class is always and for a connected one needs its dependencies.** Allocate a private scratch dir first \u2014 \`SCRATCH=$(mktemp -d)\`, never a fixed path like \`/tmp/scratch\`: other agents are compiling concurrently, and two of them writing different revisions of the same class into one directory read each other's \`.class\` files and measure the wrong bytecode (on Windows, \`mkdir %TEMP%\\review-%RANDOM%\` gives the same uniqueness). Then \`javac -proc:none -nowarn -d "$SCRATCH" X.java\` \u2014 \`-proc:none\` is not optional: annotation processors on the classpath (Lombok, Dagger, one the PR itself added) run at compile time with your privileges, so a \`javac\` without it is itself an untrusted-code execution. It is also a fidelity flag: on a project whose processor contributes code to the measured class (Lombok's generated members, Dagger's injected fields), the compiled class is missing those members and \`javap\` reports a size that is simply wrong \u2014 if the project runs a processor that touches this class, the static tier is **void**; go to \`Confidence: low\` with the mechanism. Give the compiler what it needs to resolve imports: \`-sourcepath\` at the module source root, plus \`-cp\` against an already-built \`target/classes\` / \`build/classes\` if one exists. Pass \`--release <N>\` at the project's target level (read it from \`maven.compiler.release\`, \`<release>\`, or Gradle's \`release\`/\`targetCompatibility\`): the same source compiles to different bytecode at different levels \u2014 a five-\`+\` concatenation is 37 bytes at release 8 and 14 at 9+ \u2014 and measuring the wrong level produces a threshold verdict on bytecode the shipped artifact does not contain; if the target level cannot be determined, say so in the finding. Then \`javap -c -p\` the class and read the method's size: the offset of its last instruction plus that instruction's width. Compare against 35 and 325. For the **crossing** claim \u2014 "this diff pushed it over the threshold" \u2014 get the base side **without touching the tree**: \`git show <merge-base>:<path> > "$SCRATCH/X.java"\`, compile that too, and measure both; a method already over on the base side is pre-existing, not a finding. A file the PR **adds** has no base side \u2014 \`git show\` fails, and there is no crossing to claim; report the size without a before/after. The base side compiles against the same \`target/classes\` the head side used; on a PR that changes more than the measured file the conditions are not perfectly equivalent \u2014 note that caveat when it applies. If the class will not compile (no pre-built classpath, no source path that resolves its imports), go straight to the mechanism-at-\`Confidence: low\` form below \u2014 **never \`git checkout\`, \`git stash\`, build in place, or run \`mvn\`/\`gradle\` to force a compile.** In a PR review the worktree is shared with agents running concurrently and the branch's build logic is contributor-controlled \u2014 the attack surface, not a cost; in a local review it is the user's own checkout. Mutating either corrupts work you cannot see.
+2. **Dynamic \u2014 when the code is runnable.** Run the workload with \`-XX:+UnlockDiagnosticVMOptions -XX:+PrintInlining\` and grep for the method: \`callee is too large\` / \`hot method too big\` is the JVM itself declining to inline. JMH gives the before/after throughput; JITWatch visualizes the same decision logs.
+
+A finding that a method "can no longer be inlined" needs the **dynamic** tier \u2014 only \`PrintInlining\` or equivalent runtime evidence shows the JVM actually declined to inline. The static tier proves a **size-gate crossing**, which is the mechanism: report it at \`Confidence: low\` \u2014 the threshold crossed, what the diff added to the method, and the runtime measurement still to run. A "can no longer be inlined" claim with neither tier is a guess stated as fact. And if the diff *claims* this path got faster while the mechanism above says it cannot have, the finding is the unsubstantiated claim.
+
+**When the finding IS a grown hot method, the fix to suggest is hot/cold splitting \u2014 not reverting the change, and not a JVM tuning flag** (\`-XX:FreqInlineSize\`, \`-XX:CompileCommand=inline\`): those are runtime knobs the PR's author cannot ship in a code change, and raising an inline threshold to fit one method pays for it at every other call site. (The JDK-internal \`@ForceInline\` is not available to application code at all.) Move the cold paths \u2014 error handling, rare branches, defensive validation, the \`switch\` arms that almost never fire \u2014 into a small private helper, leaving the common path under the threshold; the helper, now called from one site, is itself inlinable. Name the bytecode range to extract and the size it leaves behind, the way the measurement names them: "extract bytecodes 212\u2013311 (~100 bytes) into \`applyRounding\`, leaving \`parseAmount\` at ~238 bytes" is a finding an author can act on; "consider splitting the method" is not.
+
+**Favour precision over recall here.** A guessed JVM finding is the easiest kind for an author to dismiss, and one dismissal teaches them to skip the rest of the review. Every finding needs the concrete hot path and the concrete cost, like any other. Performance findings are **Suggestions** \u2014 slow is a cost, not incorrect behaviour \u2014 **except where the cost is itself the wrongness**: unbounded allocation, quadratic work, or unbounded cache growth on attacker-reachable input is a denial-of-service hole, which the severity ladder grades Critical, not a Suggestion. Name the reachable input that triggers it; "this loop is slow" with no attacker-reachable trigger stays a Suggestion.`
+};
+var PATH_RULES = [GITHUB_ACTIONS, JAVA];
+function isOutOfScope(p) {
+  return /src\/(test|integrationTest|integTest|androidTest|testFixtures)\//i.test(
+    p
+  ) || /(?:^|\/)(?:package-info|module-info)\.java$/i.test(p) || /(?:^|\/)(?:target|build)\/(?:generated-sources|generated-test-sources|generated)\//i.test(
+    p
+  );
+}
+__name(isOutOfScope, "isOutOfScope");
+function describePaths(which) {
+  const CAP = 10;
+  const prod = which.filter((p) => !isOutOfScope(p));
+  const rest = which.filter((p) => isOutOfScope(p));
+  const ordered = [...prod, ...rest];
+  if (ordered.length <= CAP) {
+    return ordered.join(", ");
+  }
+  return `${ordered.slice(0, CAP).join(", ")}, \u2026and ${ordered.length - CAP} more`;
+}
+__name(describePaths, "describePaths");
 function pathRulesFor(paths) {
   const hit = PATH_RULES.filter((r) => paths.some((p) => r.matches(p)));
   if (hit.length === 0) return "";
   const parts = ["## Rules for the files in front of you", ""];
   for (const r of hit) {
     const which = paths.filter((p) => r.matches(p));
-    parts.push(`### ${r.title} \u2014 ${which.join(", ")}`, "", r.checklist, "");
+    parts.push(`### ${r.title} \u2014 ${describePaths(which)}`, "", r.checklist, "");
   }
   return parts.join("\n").trimEnd();
 }
@@ -17467,10 +17538,10 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-77MDDUSX.js"),
-      import("./updateCheck-ZKFGBDTG.js"),
-      import("./installationInfo-XC3HXLTX.js"),
-      import("./standalone-update-F6ZWABD7.js"),
+      import("./settings-ILWAOKA4.js"),
+      import("./updateCheck-42SPCLH7.js"),
+      import("./installationInfo-IWMM6DPV.js"),
+      import("./standalone-update-Y5JB4S2K.js"),
       import("./stdioHelpers-HGIYTWAY.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
@@ -18637,7 +18708,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     disabledSlashCommands: disabledSlashCommands.length > 0 ? disabledSlashCommands : void 0,
     disabledSkillNamesProvider: bareMode || safeMode ? void 0 : disabledSkillNamesProvider,
     terminalImageRenderSupportProvider: interactive ? async () => {
-      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-33GSM55L.js");
+      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-NWC2RALG.js");
       return getTerminalImageRenderSupport();
     } : void 0,
     disabledSkillLevels: bareMode || safeMode || !Array.isArray(settings.skills?.disabledLevels) ? void 0 : settings.skills.disabledLevels.filter(isSkillLevel),
@@ -18791,6 +18862,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     enableAutoSkill: bareMode || safeMode ? false : settings.memory?.enableAutoSkill ?? false,
     autoSkillConfirm: bareMode || safeMode ? false : settings.memory?.autoSkillConfirm ?? true,
     memoryAgentTimeoutMinutes: settings.memory?.agentTimeoutMinutes,
+    memoryAgentMaxTurns: settings.memory?.agentMaxTurns,
     fastModel: settings.fastModel || void 0,
     webSearch: bareMode || safeMode ? void 0 : resolveWebSearchSettings(settings),
     visionModel: settings.visionModel || void 0,

package/chunks/{chunk-MNTXIO6T.js → chunk-3PHUGFPH.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   t
-} from "./chunk-CFVFQWFB.js";
+} from "./chunk-FV4TUUDE.js";
 import {
   createDebugLogger
 } from "./chunk-3RXUYQJI.js";