@qwen-code/qwen-code 0.21.6-preview.0 → 0.21.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (309) hide show
  1. package/bundled/qc-helper/docs/configuration/settings.md +19 -9
  2. package/bundled/qc-helper/docs/features/channels/dingtalk.md +1 -1
  3. package/bundled/qc-helper/docs/features/channels/github.md +31 -19
  4. package/bundled/qc-helper/docs/features/code-review.md +30 -1
  5. package/bundled/qc-helper/docs/qwen-serve.md +1 -1
  6. package/bundled/review/SKILL.md +59 -22
  7. package/chunks/{MaxSizedBox-A3UYJS6B.js → MaxSizedBox-ANWZBPTS.js} +38 -38
  8. package/chunks/{StandaloneSessionPicker-NGLY26I4.js → StandaloneSessionPicker-XKS3VU3A.js} +56 -55
  9. package/chunks/{acp-startup-profiler-3RICG2YW.js → acp-startup-profiler-ORIQ2CCQ.js} +2 -2
  10. package/chunks/{acpAgent-V54T2EEL.js → acpAgent-KUAZ3GCZ.js} +1091 -150
  11. package/chunks/{agent-2P53VL2L.js → agent-T6PTGX5R.js} +35 -35
  12. package/chunks/{agent-headless-6X4GCFRD.js → agent-headless-PR7YCB7S.js} +35 -35
  13. package/chunks/{anthropicContentGenerator-3CAHEZBM.js → anthropicContentGenerator-DTMVEL5M.js} +7 -7
  14. package/chunks/{artifact-tool-RROCCJDA.js → artifact-tool-U4VOZIK5.js} +2 -2
  15. package/chunks/{askUserQuestion-2EPPBPUZ.js → askUserQuestion-XOBQLPFA.js} +2 -2
  16. package/chunks/{bridge-TCFMLKHR.js → bridge-NU6YEEHK.js} +41 -41
  17. package/chunks/{channel-management-service-5XPPTWUQ.js → channel-management-service-FSQ7SHYI.js} +1 -1
  18. package/chunks/{channel-settings-store-B4HNMNQV.js → channel-settings-store-35VQVUVV.js} +42 -42
  19. package/chunks/{channel-worker-group-SVGPDH2C.js → channel-worker-group-JWQK224X.js} +5 -5
  20. package/chunks/{channel-worker-manager-72ZK2GTS.js → channel-worker-manager-77E3OXRQ.js} +5 -5
  21. package/chunks/{channel-worker-supervisor-NUEDVHX4.js → channel-worker-supervisor-62YWUGP2.js} +3 -3
  22. package/chunks/{chunk-XC656O42.js → chunk-22NBYCPD.js} +3 -3
  23. package/chunks/{chunk-WXS647W5.js → chunk-23RZCH76.js} +3 -3
  24. package/chunks/{chunk-O656RSMC.js → chunk-2U3WZGZG.js} +18 -10
  25. package/chunks/chunk-2VSTGY6M.js +107 -0
  26. package/chunks/{chunk-AU3XNTMV.js → chunk-33ACCIIY.js} +3 -3
  27. package/chunks/{chunk-MBEMTXQT.js → chunk-3K7FH2KQ.js} +1 -32
  28. package/chunks/{chunk-CJBRIJ7W.js → chunk-3NB7TSE2.js} +3 -3
  29. package/chunks/{chunk-QYPT3QUD.js → chunk-3ULCB3NE.js} +3 -3
  30. package/chunks/{chunk-7FUVSN4D.js → chunk-55LYDVPU.js} +1 -1
  31. package/chunks/{chunk-3ZRS2XNY.js → chunk-5KH532V7.js} +1 -1
  32. package/chunks/{chunk-P7LKADIT.js → chunk-6EOI4HOK.js} +7 -7
  33. package/chunks/{chunk-X6DV3WKN.js → chunk-6GONZVLS.js} +1 -1
  34. package/chunks/{chunk-T4XY5CT4.js → chunk-6HVUFDS2.js} +7 -7
  35. package/chunks/{chunk-5L6CQ4ZU.js → chunk-6M26GBKX.js} +2 -2
  36. package/chunks/{chunk-SPUDIAHX.js → chunk-6UWFTUQL.js} +530 -388
  37. package/chunks/{chunk-EKWNNQQD.js → chunk-6XJMFJ4D.js} +16 -10
  38. package/chunks/{chunk-72DZPDH4.js → chunk-6XU3PH66.js} +10 -5
  39. package/chunks/{chunk-WIPQR44Y.js → chunk-72LNFGUY.js} +3 -3
  40. package/chunks/{chunk-33FNCQSY.js → chunk-7MH4J33A.js} +2 -2
  41. package/chunks/{chunk-2AGOQ7QO.js → chunk-7UFKAV7Y.js} +118 -6
  42. package/chunks/{chunk-HKNSU4WX.js → chunk-AE77C5ZU.js} +198 -35
  43. package/chunks/{chunk-JELIWHXD.js → chunk-AOHJKPKL.js} +1 -1
  44. package/chunks/{chunk-GLNBDYUX.js → chunk-AXMWHKXA.js} +6 -2
  45. package/chunks/{chunk-H36SETQS.js → chunk-B2GJNDTV.js} +1 -1
  46. package/chunks/{chunk-QMBEW7EW.js → chunk-BGG4MBYD.js} +2 -2
  47. package/chunks/{chunk-QL4TN4HS.js → chunk-BRVWYMKV.js} +1 -1
  48. package/chunks/{chunk-6WBWIPBF.js → chunk-BVWVWGLE.js} +2 -2
  49. package/chunks/{chunk-WPKIU4PA.js → chunk-CB2464BK.js} +6 -6
  50. package/chunks/{chunk-2UISUFHQ.js → chunk-CJXIIILK.js} +3 -3
  51. package/chunks/{chunk-WK4TJUEA.js → chunk-CKASRHZI.js} +1 -1
  52. package/chunks/{chunk-Z7JILXGX.js → chunk-CNIID3TV.js} +3 -3
  53. package/chunks/{chunk-6KEN3RIC.js → chunk-CSZEXZBE.js} +3 -3
  54. package/chunks/{chunk-KKN2IE7Q.js → chunk-CTJLZLB5.js} +1 -1
  55. package/chunks/{chunk-5CDI4UOY.js → chunk-CXE7E23H.js} +131 -48
  56. package/chunks/{chunk-URJHXOSO.js → chunk-CYR3HI5X.js} +3 -3
  57. package/chunks/{chunk-546CDN6D.js → chunk-DBOFL3LQ.js} +3 -3
  58. package/chunks/{chunk-4LKVQFHM.js → chunk-DREZZAZM.js} +2 -2
  59. package/chunks/{chunk-2U7GPHA6.js → chunk-E33LOKRA.js} +1 -1
  60. package/chunks/{chunk-2DNKEBXY.js → chunk-EI3HZX6C.js} +1 -1
  61. package/chunks/{chunk-U25CMJYY.js → chunk-EKPKKXY2.js} +1 -1
  62. package/chunks/{chunk-QG2ACINA.js → chunk-EORNAQDT.js} +1 -1
  63. package/chunks/{chunk-432XCUHF.js → chunk-EQL65XGA.js} +1 -1
  64. package/chunks/{chunk-TYERNYH4.js → chunk-EUNWC2VS.js} +2 -2
  65. package/chunks/{chunk-CDHNGCJI.js → chunk-EUQTXRKZ.js} +7 -7
  66. package/chunks/{chunk-UH7Z7Y45.js → chunk-FOGU3LJX.js} +1 -1
  67. package/chunks/{chunk-BU4BRCPX.js → chunk-FPM27XN4.js} +5 -5
  68. package/chunks/{chunk-E4WHKETF.js → chunk-FVKHVJZQ.js} +2 -49
  69. package/chunks/{chunk-NKST54XA.js → chunk-FZBZSYKU.js} +1 -1
  70. package/chunks/{chunk-XZCMQUOF.js → chunk-GDXET5XU.js} +31 -3387
  71. package/chunks/{chunk-A5YZ3FA2.js → chunk-GM463R2B.js} +1 -1
  72. package/chunks/{chunk-MOHAWIAW.js → chunk-GNPNYXJB.js} +2 -2
  73. package/chunks/{chunk-AFZTZLFB.js → chunk-GSS34377.js} +3 -3
  74. package/chunks/{chunk-MVLM6PJK.js → chunk-H2UQ2M5Z.js} +6 -2
  75. package/chunks/{chunk-BK2UNYWD.js → chunk-HIBNSEJE.js} +12 -0
  76. package/chunks/{chunk-CXYBX4AL.js → chunk-HQB2KUAN.js} +1 -1
  77. package/chunks/{chunk-ZQL73PPE.js → chunk-HYRDKNUY.js} +2 -2
  78. package/chunks/{chunk-D7D7RXIJ.js → chunk-IC4Z6LX6.js} +1 -1
  79. package/chunks/{chunk-HU5TUALO.js → chunk-IIJEYBNH.js} +3 -3
  80. package/chunks/{chunk-DTAPI453.js → chunk-IUFV6FYU.js} +2 -2
  81. package/chunks/{chunk-MISUEWB4.js → chunk-J6SZID63.js} +12 -8
  82. package/chunks/{chunk-OWAK7LMW.js → chunk-KGJGEEVR.js} +7 -0
  83. package/chunks/{chunk-BFHXDAR7.js → chunk-KKBPOU75.js} +1 -1
  84. package/chunks/{chunk-XOZ2R6XI.js → chunk-KKJJB5X6.js} +3578 -1487
  85. package/chunks/{chunk-PQTK2FVO.js → chunk-KR4ZSC7K.js} +4 -4
  86. package/chunks/{chunk-NAYPZ72V.js → chunk-KXSDEOFU.js} +1 -1
  87. package/chunks/{chunk-MGSSJT27.js → chunk-L4N6TIP7.js} +5 -3
  88. package/chunks/{chunk-4T6QMNX2.js → chunk-LA7YLSR6.js} +185 -12
  89. package/chunks/{chunk-4E5PO6R7.js → chunk-LEMXGVEP.js} +4 -4
  90. package/chunks/{chunk-WVAESIM6.js → chunk-LZC3B5N2.js} +4 -4
  91. package/chunks/{chunk-6O5DVH27.js → chunk-M6HMMKVG.js} +1 -1
  92. package/chunks/{chunk-Z5S6KH2B.js → chunk-MAJS7AT4.js} +6 -6
  93. package/chunks/{chunk-XNZBXQCG.js → chunk-MKVZE4ZJ.js} +1 -1
  94. package/chunks/{chunk-I7JDGNG6.js → chunk-MVUQRLOH.js} +9 -5
  95. package/chunks/{chunk-GLWP3FDB.js → chunk-MZSJ43WV.js} +31 -2
  96. package/chunks/{chunk-ZPPP6VCL.js → chunk-NG2R4N5O.js} +1 -1
  97. package/chunks/chunk-NKLP3DCK.js +22 -0
  98. package/chunks/{chunk-WIRAPZ62.js → chunk-NLREQJFK.js} +7 -1
  99. package/chunks/{chunk-N47ZM2KI.js → chunk-OFI7IGST.js} +12 -12
  100. package/chunks/{chunk-DBIEZC7T.js → chunk-OH2VKQXH.js} +42 -16
  101. package/chunks/{chunk-C4GRKMUL.js → chunk-OHJLEW5J.js} +5 -5
  102. package/chunks/{chunk-3RXUYQJI.js → chunk-OIVKILPI.js} +49 -0
  103. package/chunks/{chunk-VDLXPEI5.js → chunk-OMKQH5C5.js} +3 -3
  104. package/chunks/{chunk-LBWNSLJK.js → chunk-ONSZH6VM.js} +2 -2
  105. package/chunks/{chunk-DYA25Y7U.js → chunk-OWMAZHIX.js} +1 -1
  106. package/chunks/{chunk-WAOLM6SQ.js → chunk-P2AJ7FTI.js} +1 -1
  107. package/chunks/{chunk-MFBUJMQ3.js → chunk-P3LEG54R.js} +4 -4
  108. package/chunks/{chunk-WVRJKSIG.js → chunk-PJOBIWUG.js} +1 -1
  109. package/chunks/{chunk-YUVTZ4UH.js → chunk-PQBHU2IA.js} +114 -18
  110. package/chunks/{chunk-GTM6IHBB.js → chunk-Q3JQ7OSU.js} +2 -1
  111. package/chunks/{chunk-IISDPZ5X.js → chunk-QETYKPMG.js} +1 -1
  112. package/chunks/{chunk-UKZEXS6K.js → chunk-R574ATRM.js} +11 -0
  113. package/chunks/{chunk-DOICUTPO.js → chunk-RERATVSK.js} +11 -10
  114. package/chunks/chunk-RGSBTHSU.js +3381 -0
  115. package/chunks/{chunk-6D6V55ZQ.js → chunk-RMH5OWLD.js} +1 -1
  116. package/chunks/{chunk-AVDEBBMI.js → chunk-RNVQB725.js} +2 -2
  117. package/chunks/{chunk-QWUYFMAR.js → chunk-RUL4S3K3.js} +87 -67
  118. package/chunks/{chunk-RTWF7FF7.js → chunk-RZHU3ILK.js} +5 -5
  119. package/chunks/{chunk-3DTM3RPU.js → chunk-S7CV4KO6.js} +3 -3
  120. package/chunks/{chunk-ZH7G3A4U.js → chunk-SCI7K3GM.js} +4 -4
  121. package/chunks/{chunk-YAVY33G4.js → chunk-SEZ556DZ.js} +1 -1
  122. package/chunks/{chunk-6KZP75GT.js → chunk-SHZYHGQH.js} +1 -1
  123. package/chunks/chunk-SOORFWKY.js +155 -0
  124. package/chunks/{chunk-NYZAL2W2.js → chunk-SPMY6CX6.js} +4 -4
  125. package/chunks/{chunk-EHMN6SEG.js → chunk-TDXGKHDN.js} +4 -4
  126. package/chunks/{chunk-XKTCA6BW.js → chunk-TLV2IMHR.js} +5 -5
  127. package/chunks/{chunk-XSGQKR37.js → chunk-TRLYP7OF.js} +358 -20
  128. package/chunks/{chunk-DG563ZCS.js → chunk-TYKC75AX.js} +3 -3
  129. package/chunks/{chunk-KVUBYJDM.js → chunk-TZEZYNYD.js} +1 -1
  130. package/chunks/{chunk-XC2VAFVZ.js → chunk-UVX4Y6IN.js} +1 -1
  131. package/chunks/{chunk-IKXE3AAC.js → chunk-VOARQPTA.js} +2 -2
  132. package/chunks/{chunk-TVFC3XF5.js → chunk-W4B7UBUS.js} +7 -7
  133. package/chunks/{chunk-M744OFVE.js → chunk-W7U4ESW2.js} +1 -1
  134. package/chunks/{chunk-URN76TKR.js → chunk-WCG5O7IP.js} +2 -2
  135. package/chunks/{chunk-A6SX5TAH.js → chunk-XCWO3SMQ.js} +9 -5
  136. package/chunks/{chunk-FDV3CXTD.js → chunk-Y4EWSQF7.js} +3 -3
  137. package/chunks/{chunk-3PRJYMXC.js → chunk-Y4NGLFGJ.js} +1 -1
  138. package/chunks/{chunk-DOA7MCDY.js → chunk-Y7E5LNLO.js} +973 -892
  139. package/chunks/{chunk-3LGZEYOF.js → chunk-YHEEE624.js} +2 -2
  140. package/chunks/{chunk-Y5HIDFKZ.js → chunk-YJQCUTT2.js} +4 -4
  141. package/chunks/{chunk-QONSRAEV.js → chunk-YP5KH5Y7.js} +1 -1
  142. package/chunks/{chunk-SQ3ZJOYL.js → chunk-ZJ3VGYHK.js} +20 -20
  143. package/chunks/{chunk-7GYP5COR.js → chunk-ZXU5UHMI.js} +1 -1
  144. package/chunks/{computer-use-GTOP2CVH.js → computer-use-KEAPATUY.js} +35 -35
  145. package/chunks/{config-utils-LIRO7NSU.js → config-utils-K7SCOWHD.js} +2 -2
  146. package/chunks/{contextCommand-K6T6RRF3.js → contextCommand-ZJA6A5K5.js} +38 -38
  147. package/chunks/{core-runtime-D2626QQU.js → core-runtime-QMJPWHCI.js} +35 -35
  148. package/chunks/create-sub-session-DJE6XICH.js +772 -0
  149. package/chunks/{create-sub-session-6EWLAZD5.js → create-sub-session-E4PBYXV5.js} +2 -2
  150. package/chunks/{cron-create-CCRIULJE.js → cron-create-GRBWYMIJ.js} +4 -4
  151. package/chunks/{cron-delete-FCFW6BGP.js → cron-delete-4CMKBR2M.js} +4 -4
  152. package/chunks/{cron-list-QDBVCHRF.js → cron-list-W7K4ASOA.js} +4 -4
  153. package/chunks/{daemon-CCIX4BMG.js → daemon-SCTQMM7Z.js} +165 -5
  154. package/chunks/{daemon-status-provider-2EHRZZVF.js → daemon-status-provider-FSWDPE2G.js} +45 -45
  155. package/chunks/{daemon-trust-policy-B3EPDJDR.js → daemon-trust-policy-P5L5VFAY.js} +41 -41
  156. package/chunks/{daemon-trust-policy-monitor-MFM5X26G.js → daemon-trust-policy-monitor-73JYN6ET.js} +41 -41
  157. package/chunks/{deferred-core-runtime-KXN7HLN7.js → deferred-core-runtime-BWRCCFTE.js} +35 -35
  158. package/chunks/discovery-XLHITE74.js +220 -0
  159. package/chunks/{display-image-GUJA352B.js → display-image-O2XFPQTC.js} +4 -4
  160. package/chunks/{dist-A7H2KKUC.js → dist-K4WWQBHS.js} +277 -98
  161. package/chunks/{dist-IKGVITP3.js → dist-KS4O2NKE.js} +99 -6
  162. package/chunks/{earlyInputCapture-WUNYYFOS.js → earlyInputCapture-L5ST23A6.js} +36 -36
  163. package/chunks/{edit-DMFCBP2D.js → edit-LHHRFNFK.js} +35 -35
  164. package/chunks/{enter-worktree-5SVBCXFC.js → enter-worktree-6NXCRZPF.js} +35 -35
  165. package/chunks/{enterPlanMode-QUIZFQ4M.js → enterPlanMode-ZVQT4U7D.js} +35 -35
  166. package/chunks/{environment-U6QP23VJ.js → environment-GJ2HWJOS.js} +38 -38
  167. package/chunks/{errors-GZWFA6ON.js → errors-6RLH3XXC.js} +38 -38
  168. package/chunks/{exit-worktree-FUB44KAF.js → exit-worktree-I2YLUHHY.js} +35 -35
  169. package/chunks/{exitPlanMode-XSHHYR73.js → exitPlanMode-7CCWKO7I.js} +35 -35
  170. package/chunks/{fast-path-JHQJSIMZ.js → fast-path-DVFD4HQD.js} +2 -2
  171. package/chunks/{gemini-O44ETOKT.js → gemini-7FWGOYD4.js} +78 -78
  172. package/chunks/{geminiContentGenerator-TTM4TZJM.js → geminiContentGenerator-V2WVLIXU.js} +6 -6
  173. package/chunks/{glob-YECOWTRW.js → glob-3N6GGI75.js} +35 -35
  174. package/chunks/{goal-tools-3AZKX5WQ.js → goal-tools-APOW6UXL.js} +3 -3
  175. package/chunks/{grep-BZO4LOTA.js → grep-V43ILZVX.js} +35 -35
  176. package/chunks/{handleAutoUpdate-TOO52D6H.js → handleAutoUpdate-A5WFVWIA.js} +40 -40
  177. package/chunks/{i18n-ARJYXZQ5.js → i18n-PLVQ4FBZ.js} +37 -37
  178. package/chunks/{image-gen-J6Q2YBEU.js → image-gen-7C6IK6DC.js} +9 -9
  179. package/chunks/{initializer-CEZ4RPQV.js → initializer-CVAIKZYL.js} +42 -42
  180. package/chunks/{installationInfo-AEGIIQAT.js → installationInfo-J6QDHNTK.js} +36 -36
  181. package/chunks/{keychain-token-storage-7BT4TQ2A.js → keychain-token-storage-TVAMTNP7.js} +2 -2
  182. package/chunks/{list-7XLPV5GC.js → list-ZZ4OUUWV.js} +44 -44
  183. package/chunks/{list-agents-GC4BRET7.js → list-agents-KFFIIS2G.js} +2 -2
  184. package/chunks/{loadedSettingsAdapter-YK5SBHOT.js → loadedSettingsAdapter-QRYRJSWL.js} +41 -41
  185. package/chunks/{loggingContentGenerator-I7QDXS43.js → loggingContentGenerator-OJCO75HM.js} +17 -17
  186. package/chunks/{loop-wakeup-SQQSBMEY.js → loop-wakeup-TLMJPMMP.js} +5 -5
  187. package/chunks/{ls-63CC3NNX.js → ls-UVVE2XGE.js} +4 -4
  188. package/chunks/{lsp-P6NVJVNT.js → lsp-QMEA2VLB.js} +2 -2
  189. package/chunks/{managed-npm-update-YSL7PA7G.js → managed-npm-update-PCOSCP2N.js} +48 -39
  190. package/chunks/{mcp-RKFQZXP6.js → mcp-M3WKKWKY.js} +41 -41
  191. package/chunks/{monitor-QHHJIKGL.js → monitor-GN24FH6C.js} +35 -35
  192. package/chunks/{nonInteractiveCli-XEBIE7MG.js → nonInteractiveCli-KPTU3VSQ.js} +75 -75
  193. package/chunks/{notebook-edit-SG7X2EQA.js → notebook-edit-4YM65BBO.js} +35 -35
  194. package/chunks/{openaiContentGenerator-63CVR33K.js → openaiContentGenerator-EDQT6GTV.js} +19 -19
  195. package/chunks/{pidfile-I3CXJGQD.js → pidfile-JOIIRN2C.js} +36 -36
  196. package/chunks/{processUtils-LJ3DSANX.js → processUtils-5SV4MX3Q.js} +2 -2
  197. package/chunks/{qwenContentGenerator-JINBVCH6.js → qwenContentGenerator-ODRJSUGR.js} +40 -40
  198. package/chunks/{qwenOAuth2-SY2O3NRR.js → qwenOAuth2-NESCMZ47.js} +8 -8
  199. package/chunks/{read-file-PGTXF25I.js → read-file-HPSODLPK.js} +10 -10
  200. package/chunks/{read-mcp-resource-RTSSEER5.js → read-mcp-resource-2TNSJTC3.js} +2 -2
  201. package/chunks/{record-artifact-E6AWQU2Z.js → record-artifact-RAON52FC.js} +3 -3
  202. package/chunks/{resumeHistoryUtils-FB2NFVZ2.js → resumeHistoryUtils-TXCOFFMQ.js} +42 -41
  203. package/chunks/{ripGrep-IY3KGPM6.js → ripGrep-ZKQGTQAO.js} +35 -35
  204. package/chunks/{run-qwen-serve-UYEMGPKA.js → run-qwen-serve-ZPKPKECF.js} +516 -87
  205. package/chunks/{runtime-CG3BKRFE.js → runtime-2FLNNM36.js} +44 -44
  206. package/chunks/{scheduler-VFUVGDE5.js → scheduler-365PJHNR.js} +35 -35
  207. package/chunks/{sdk-exporters-http-IL2346MJ.js → sdk-exporters-http-KHAB5JSD.js} +2 -2
  208. package/chunks/{sdk-impl-SYKGVWOZ.js → sdk-impl-KD7FSTC3.js} +2 -2
  209. package/chunks/{send-message-TL6FIMMN.js → send-message-ZM7MRUGP.js} +5 -5
  210. package/chunks/{serve-ZCCQ2G2L.js → serve-QD2RNLKJ.js} +42 -42
  211. package/chunks/{server-WS7LWXPP.js → server-XLJVLTYM.js} +7952 -611
  212. package/chunks/{session-IQLCT32T.js → session-3VTUHH4Q.js} +78 -78
  213. package/chunks/{settings-NX4EUIE6.js → settings-KULVPCQC.js} +40 -40
  214. package/chunks/{shell-THDYM4CS.js → shell-3SWW22MH.js} +35 -35
  215. package/chunks/{skill-OXXZBNQB.js → skill-KDHWYS7W.js} +14 -14
  216. package/chunks/{skill-settings-T3JZ33T2.js → skill-settings-NMY4JEJC.js} +40 -40
  217. package/chunks/{spawnChannel-COLJMSA7.js → spawnChannel-ZKS4Q5OU.js} +37 -37
  218. package/chunks/{standalone-update-ICW7H5IF.js → standalone-update-7CXPGAQ4.js} +38 -38
  219. package/chunks/{startInteractiveUI-6BDRXSMF.js → startInteractiveUI-2QQLEKM6.js} +473 -233
  220. package/chunks/{stdioHelpers-HGIYTWAY.js → stdioHelpers-7A2EE64Z.js} +5 -3
  221. package/chunks/{syntheticOutput-BN7E626U.js → syntheticOutput-ZLCUTKO2.js} +3 -3
  222. package/chunks/{task-create-2X4UP4F3.js → task-create-CQP5UEA3.js} +9 -9
  223. package/chunks/{task-list-WOLJPZ64.js → task-list-XLEZOJXP.js} +5 -5
  224. package/chunks/{task-stop-TNXRNAL2.js → task-stop-7ZQM5CFF.js} +2 -2
  225. package/chunks/{task-update-VDUSN36E.js → task-update-JA75U2SN.js} +9 -9
  226. package/chunks/{team-create-BCSMDK4Z.js → team-create-2WTNGAOX.js} +35 -35
  227. package/chunks/{team-delete-D2VMSDOT.js → team-delete-MHY3UZGY.js} +5 -5
  228. package/chunks/{team-plan-approval-B5YRLJFV.js → team-plan-approval-LZTYLEG4.js} +35 -35
  229. package/chunks/{terminal-image-renderer-PW6Z6VFY.js → terminal-image-renderer-R5HHAFJN.js} +41 -36
  230. package/chunks/{theme-manager-CMVKD2JH.js → theme-manager-PAUCSJFF.js} +36 -36
  231. package/chunks/{todoWrite-MHWHO5UO.js → todoWrite-UPVOHYGD.js} +4 -4
  232. package/chunks/{tool-search-SQTUSG6P.js → tool-search-2BFCGLI6.js} +13 -13
  233. package/chunks/{total-session-admission-XAXOSE46.js → total-session-admission-MK4SINFK.js} +41 -41
  234. package/chunks/{trustedFolders-Z2UAEG2V.js → trustedFolders-TJ5S26N7.js} +37 -37
  235. package/chunks/{update-relaunch-JBLI6LJF.js → update-relaunch-N7AYLARF.js} +6 -6
  236. package/chunks/{updateCheck-FDAVGOFT.js → updateCheck-QRZ3DVT5.js} +39 -39
  237. package/chunks/{useAutoAcceptIndicator-PDZFIYRM.js → useAutoAcceptIndicator-DBJ7Y5AF.js} +44 -44
  238. package/chunks/{validateNonInterActiveAuth-Q4763ONQ.js → validateNonInterActiveAuth-6ZQWUDS3.js} +72 -72
  239. package/chunks/{version-C7MPCGWD.js → version-AJQGQWXC.js} +1 -1
  240. package/chunks/{web-fetch-L7RAPOJB.js → web-fetch-QWJYRXFL.js} +13 -13
  241. package/chunks/{web-search-IDOYUOWX.js → web-search-2AOXJGHU.js} +9 -9
  242. package/chunks/web-shell-static-O73YPVVC.js +33 -0
  243. package/chunks/{workflow-HXURUJB5.js → workflow-ERH3SJG2.js} +36 -36
  244. package/chunks/{workspace-providers-status-JZ3GPWNU.js → workspace-providers-status-HZ474RA4.js} +44 -44
  245. package/chunks/{workspace-registration-store-SM2PWB6L.js → workspace-registration-store-6EUP4JXG.js} +1 -1
  246. package/chunks/{workspace-registry-6W4ES7BJ.js → workspace-registry-R4APRRNC.js} +41 -41
  247. package/chunks/{workspace-service-V47ZFJRX.js → workspace-service-HFIFDMU7.js} +46 -46
  248. package/chunks/{workspace-skills-status-6ZQ45XKA.js → workspace-skills-status-HAHEIHGK.js} +42 -42
  249. package/chunks/{workspace-trust-reconciler-6V25LMCN.js → workspace-trust-reconciler-65GTAGDK.js} +50 -50
  250. package/chunks/{write-file-H2QOF25K.js → write-file-B34CDELV.js} +35 -35
  251. package/chunks/{zoom-image-JTUSS43N.js → zoom-image-HPRBZHSS.js} +10 -10
  252. package/cli.js +15 -15
  253. package/package.json +3 -3
  254. package/web-shell/assets/{arc-DtI1rZcQ.js → arc-Ip-FFDJ0.js} +1 -1
  255. package/web-shell/assets/{architectureDiagram-3BPJPVTR-BPZwSVct.js → architectureDiagram-3BPJPVTR-CChqgwIb.js} +1 -1
  256. package/web-shell/assets/{blockDiagram-GPEHLZMM-BIQ03j4C.js → blockDiagram-GPEHLZMM-BHN-Tfss.js} +1 -1
  257. package/web-shell/assets/{c4Diagram-AAUBKEIU-CB0RyFGm.js → c4Diagram-AAUBKEIU-BhyjzDjN.js} +1 -1
  258. package/web-shell/assets/channel-Cu8qd6OB.js +1 -0
  259. package/web-shell/assets/{chunk-2J33WTMH-B3WoS-4H.js → chunk-2J33WTMH-BB9eyHrx.js} +1 -1
  260. package/web-shell/assets/{chunk-4BX2VUAB-C98xYZ1X.js → chunk-4BX2VUAB-BeV7ce_J.js} +1 -1
  261. package/web-shell/assets/{chunk-55IACEB6-CbTIWRwQ.js → chunk-55IACEB6-DO7kXDiV.js} +1 -1
  262. package/web-shell/assets/{chunk-727SXJPM-DWGnKTPu.js → chunk-727SXJPM-B27MPznD.js} +1 -1
  263. package/web-shell/assets/{chunk-AQP2D5EJ-4__QyCEX.js → chunk-AQP2D5EJ-DHIjqjD_.js} +1 -1
  264. package/web-shell/assets/{chunk-FMBD7UC4-DFtG1YCW.js → chunk-FMBD7UC4-DabMqyN2.js} +1 -1
  265. package/web-shell/assets/{chunk-ND2GUHAM-rvAhW51N.js → chunk-ND2GUHAM-Dw7Nnnxc.js} +1 -1
  266. package/web-shell/assets/{chunk-QZHKN3VN-DfiU9pwZ.js → chunk-QZHKN3VN-DdaZew1Q.js} +1 -1
  267. package/web-shell/assets/classDiagram-4FO5ZUOK-BI3KrXhq.js +1 -0
  268. package/web-shell/assets/classDiagram-v2-Q7XG4LA2-BI3KrXhq.js +1 -0
  269. package/web-shell/assets/{cose-bilkent-S5V4N54A-Cc4EIdxu.js → cose-bilkent-S5V4N54A-CgBpCYH5.js} +1 -1
  270. package/web-shell/assets/{dagre-BM42HDAG-CZNj4dGW.js → dagre-BM42HDAG-BB4IU8G0.js} +1 -1
  271. package/web-shell/assets/{diagram-2AECGRRQ-D5tiqQCr.js → diagram-2AECGRRQ-BcUTHU37.js} +1 -1
  272. package/web-shell/assets/{diagram-5GNKFQAL-pwzw0jVO.js → diagram-5GNKFQAL-B6Lyihyv.js} +1 -1
  273. package/web-shell/assets/{diagram-KO2AKTUF-4CWiM00x.js → diagram-KO2AKTUF-CRIJOjpG.js} +1 -1
  274. package/web-shell/assets/{diagram-LMA3HP47-Dd7rc7Qf.js → diagram-LMA3HP47-DdNiwWWT.js} +1 -1
  275. package/web-shell/assets/{diagram-OG6HWLK6-_vzV52ml.js → diagram-OG6HWLK6-Dz4b32Do.js} +1 -1
  276. package/web-shell/assets/{erDiagram-TEJ5UH35-CqbE2bx_.js → erDiagram-TEJ5UH35-D-8NGw77.js} +1 -1
  277. package/web-shell/assets/{flowDiagram-I6XJVG4X-CaxNr7w4.js → flowDiagram-I6XJVG4X-Dun26LyM.js} +1 -1
  278. package/web-shell/assets/{ganttDiagram-6RSMTGT7-AGjrtfUA.js → ganttDiagram-6RSMTGT7-F10Hu1Gc.js} +1 -1
  279. package/web-shell/assets/{gitGraphDiagram-PVQCEYII-ADG2zSkc.js → gitGraphDiagram-PVQCEYII-Bf8Ez6-D.js} +1 -1
  280. package/web-shell/assets/{index-BOryKCqt.js → index-BXqw-nGq.js} +1 -1
  281. package/web-shell/assets/index-QQlUCJGg.css +5 -0
  282. package/web-shell/assets/index-hcgjV7vS.js +1768 -0
  283. package/web-shell/assets/{infoDiagram-5YYISTIA-CE3B_IoZ.js → infoDiagram-5YYISTIA-DVgTMLvj.js} +1 -1
  284. package/web-shell/assets/{ishikawaDiagram-YF4QCWOH-CN-Frhoi.js → ishikawaDiagram-YF4QCWOH-uT-KepvK.js} +1 -1
  285. package/web-shell/assets/{journeyDiagram-JHISSGLW-CGgezS93.js → journeyDiagram-JHISSGLW-Vg_XadQf.js} +1 -1
  286. package/web-shell/assets/{kanban-definition-UN3LZRKU-BqWijky5.js → kanban-definition-UN3LZRKU-Dyv1ESBE.js} +1 -1
  287. package/web-shell/assets/{linear-D8sfpZf6.js → linear-BMIepYX3.js} +1 -1
  288. package/web-shell/assets/{mermaid.core-3PA4QrzM.js → mermaid.core-zA8pJ9ag.js} +5 -5
  289. package/web-shell/assets/{mindmap-definition-RKZ34NQL-D9QxwiCY.js → mindmap-definition-RKZ34NQL-BCW_BZ_5.js} +1 -1
  290. package/web-shell/assets/{pieDiagram-4H26LBE5-Bioaf6uE.js → pieDiagram-4H26LBE5-DseNEGp2.js} +1 -1
  291. package/web-shell/assets/{quadrantDiagram-W4KKPZXB-DBb2AS73.js → quadrantDiagram-W4KKPZXB-6Z7wr1Fi.js} +1 -1
  292. package/web-shell/assets/{requirementDiagram-4Y6WPE33-DXOvZ3KB.js → requirementDiagram-4Y6WPE33-CVOlCRPf.js} +1 -1
  293. package/web-shell/assets/{sankeyDiagram-5OEKKPKP-D9qg09Dm.js → sankeyDiagram-5OEKKPKP-CGhgrUJZ.js} +1 -1
  294. package/web-shell/assets/{sequenceDiagram-3UESZ5HK-DSAUIfpw.js → sequenceDiagram-3UESZ5HK-dlqmpLuQ.js} +1 -1
  295. package/web-shell/assets/{stateDiagram-AJRCARHV-BPZkzfQ3.js → stateDiagram-AJRCARHV-B9EW10Xb.js} +1 -1
  296. package/web-shell/assets/stateDiagram-v2-BHNVJYJU-CJTZJJ5X.js +1 -0
  297. package/web-shell/assets/{timeline-definition-PNZ67QCA-UDaQp9sP.js → timeline-definition-PNZ67QCA-BBRh0mgZ.js} +1 -1
  298. package/web-shell/assets/{vennDiagram-CIIHVFJN-2ouhAnHO.js → vennDiagram-CIIHVFJN-B8Gs-REP.js} +1 -1
  299. package/web-shell/assets/{wardley-L42UT6IY-Cq_WEvTK.js → wardley-L42UT6IY-D_y80Ur7.js} +1 -1
  300. package/web-shell/assets/{wardleyDiagram-YWT4CUSO-Dt24aXOM.js → wardleyDiagram-YWT4CUSO-D-CNfHJ-.js} +1 -1
  301. package/web-shell/assets/{xychartDiagram-2RQKCTM6-A5Xk2WCH.js → xychartDiagram-2RQKCTM6-DQ5CvELo.js} +1 -1
  302. package/web-shell/index.html +2 -2
  303. package/chunks/create-sub-session-MWUWNBM6.js +0 -401
  304. package/web-shell/assets/channel-vfbVFuM1.js +0 -1
  305. package/web-shell/assets/classDiagram-4FO5ZUOK-Cvr8atq3.js +0 -1
  306. package/web-shell/assets/classDiagram-v2-Q7XG4LA2-Cvr8atq3.js +0 -1
  307. package/web-shell/assets/index-Cb1LjsCv.css +0 -5
  308. package/web-shell/assets/index-CvJDaIy8.js +0 -1756
  309. package/web-shell/assets/stateDiagram-v2-BHNVJYJU-DInOqnhZ.js +0 -1
@@ -5,14 +5,14 @@ import {
5
5
  isTranscribableVoiceModel,
6
6
  readVoiceLanguage,
7
7
  resolveVoiceTransport
8
- } from "./chunk-7FUVSN4D.js";
8
+ } from "./chunk-55LYDVPU.js";
9
9
  import {
10
10
  resolvePath
11
- } from "./chunk-JELIWHXD.js";
11
+ } from "./chunk-AOHJKPKL.js";
12
12
  import {
13
13
  createDebugLogger,
14
14
  isSubpath
15
- } from "./chunk-3RXUYQJI.js";
15
+ } from "./chunk-OIVKILPI.js";
16
16
  import {
17
17
  init_esbuild_shims
18
18
  } from "./chunk-5O2XNYP6.js";
@@ -24,7 +24,7 @@ import {
24
24
  init_esbuild_shims();
25
25
  import process from "node:process";
26
26
  import { lookup as dnsLookup } from "node:dns/promises";
27
- import { isIP } from "node:net";
27
+ import { BlockList, isIP } from "node:net";
28
28
 
29
29
  // packages/cli/src/services/voice-keyterms.ts
30
30
  init_esbuild_shims();
@@ -238,6 +238,14 @@ var MIN_KEYTERM_ECHO_TOKENS = 8;
238
238
  var MIN_ABSOLUTE_KEYTERM_ECHO_TOKENS = 10;
239
239
  var MIN_KEYTERM_SET_ECHO_RATIO = 0.3;
240
240
  var debugLogger = createDebugLogger("VOICE_TRANSCRIBER");
241
+ var BLOCKED_TRANSITION_IPV6_ADDRESSES = new BlockList();
242
+ for (const [address, prefix] of [
243
+ ["64:ff9b:1::", 48],
244
+ ["2001::", 23],
245
+ ["2002::", 16]
246
+ ]) {
247
+ BLOCKED_TRANSITION_IPV6_ADDRESSES.addSubnet(address, prefix, "ipv6");
248
+ }
241
249
  function trimTrailingSlashes(value) {
242
250
  return value.replace(/\/+$/, "");
243
251
  }
@@ -264,35 +272,78 @@ function normalizeBaseUrl(baseUrl, modelName) {
264
272
  } catch {
265
273
  throw new Error(`Voice model '${modelName}' has an invalid baseUrl.`);
266
274
  }
267
- url.username = "";
268
- url.password = "";
275
+ if (url.username || url.password) {
276
+ throw new Error(
277
+ `Voice model '${modelName}' baseUrl must not contain embedded credentials.`
278
+ );
279
+ }
269
280
  return trimTrailingSlashes(url.toString());
270
281
  }
271
282
  __name(normalizeBaseUrl, "normalizeBaseUrl");
283
+ function normalizeAllowedVoiceBaseUrl(baseUrl) {
284
+ try {
285
+ const url = new URL(baseUrl.trim());
286
+ if (url.username || url.password) {
287
+ return void 0;
288
+ }
289
+ return trimTrailingSlashes(url.toString());
290
+ } catch {
291
+ return void 0;
292
+ }
293
+ }
294
+ __name(normalizeAllowedVoiceBaseUrl, "normalizeAllowedVoiceBaseUrl");
295
+ function isInsecureVoiceBaseUrlAllowed(settings, normalizedBaseUrl) {
296
+ const allowed = settings.merged.security?.allowedInsecureVoiceBaseUrls;
297
+ return Array.isArray(allowed) && allowed.some(
298
+ (candidate) => typeof candidate === "string" && normalizeAllowedVoiceBaseUrl(candidate) === normalizedBaseUrl
299
+ );
300
+ }
301
+ __name(isInsecureVoiceBaseUrlAllowed, "isInsecureVoiceBaseUrlAllowed");
272
302
  function normalizeHostname(hostname) {
273
303
  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
274
304
  }
275
305
  __name(normalizeHostname, "normalizeHostname");
306
+ function normalizeIpAddress(address) {
307
+ const host = normalizeHostname(address);
308
+ if (isIP(host) !== 6) {
309
+ return host;
310
+ }
311
+ try {
312
+ return normalizeHostname(new URL(`http://[${host}]/`).hostname);
313
+ } catch {
314
+ return host;
315
+ }
316
+ }
317
+ __name(normalizeIpAddress, "normalizeIpAddress");
276
318
  function isLoopbackHost(hostname) {
277
319
  const host = normalizeHostname(hostname);
278
320
  return host === "localhost" || host === "127.0.0.1" || host === "::1";
279
321
  }
280
322
  __name(isLoopbackHost, "isLoopbackHost");
323
+ function isAwsIpv6MetadataAddress(hostname) {
324
+ const host = normalizeHostname(hostname);
325
+ if (isIP(host) !== 6) {
326
+ return false;
327
+ }
328
+ try {
329
+ return normalizeHostname(new URL(`http://[${host}]/`).hostname) === "fd00:ec2::254";
330
+ } catch {
331
+ return false;
332
+ }
333
+ }
334
+ __name(isAwsIpv6MetadataAddress, "isAwsIpv6MetadataAddress");
281
335
  function readIpv4CompatibleIpv6(host) {
282
336
  if (!host.startsWith("::") || host.startsWith("::ffff:")) {
283
337
  return void 0;
284
338
  }
285
339
  const parts = host.slice(2).split(":");
286
- if (parts.length === 0 || parts.length > 2 || parts.some((p) => !p)) {
340
+ if (parts.length === 0 || parts.length > 2 || parts.some((part) => !part)) {
287
341
  return void 0;
288
342
  }
289
343
  if (parts.some((part) => !/^[0-9a-f]{1,4}$/i.test(part))) {
290
344
  return void 0;
291
345
  }
292
346
  const hextets = parts.map((part) => Number.parseInt(part, 16));
293
- if (hextets.some((part) => !Number.isInteger(part) || part < 0 || part > 65535)) {
294
- return void 0;
295
- }
296
347
  const value = hextets.length === 1 ? hextets[0] : hextets[0] << 16 | hextets[1];
297
348
  return [
298
349
  value >>> 24 & 255,
@@ -302,39 +353,130 @@ function readIpv4CompatibleIpv6(host) {
302
353
  ].join(".");
303
354
  }
304
355
  __name(readIpv4CompatibleIpv6, "readIpv4CompatibleIpv6");
305
- function isPrivateNetworkIp(hostname) {
306
- const host = normalizeHostname(hostname);
307
- if (isLoopbackHost(host)) {
308
- return false;
356
+ function readIpv4MappedIpv6(host) {
357
+ const dotted = host.match(/^::ffff:(\d+(?:\.\d+){3})$/i);
358
+ if (dotted && isIP(dotted[1]) === 4) {
359
+ return dotted[1];
309
360
  }
310
- const ipv4Mapped = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
361
+ const hex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
362
+ if (!hex) {
363
+ return void 0;
364
+ }
365
+ return readIpv4HexPair(hex[1], hex[2]);
366
+ }
367
+ __name(readIpv4MappedIpv6, "readIpv4MappedIpv6");
368
+ function readIpv4HexPair(highHex, lowHex) {
369
+ const high = Number.parseInt(highHex, 16);
370
+ const low = Number.parseInt(lowHex, 16);
371
+ return [high >>> 8, high & 255, low >>> 8, low & 255].join(".");
372
+ }
373
+ __name(readIpv4HexPair, "readIpv4HexPair");
374
+ function readWellKnownNat64Ipv6(host) {
375
+ const prefix = "64:ff9b::";
376
+ if (!host.startsWith(prefix)) {
377
+ return void 0;
378
+ }
379
+ const suffix = host.slice(prefix.length);
380
+ if (!suffix) {
381
+ return "0.0.0.0";
382
+ }
383
+ const groups = suffix.split(":");
384
+ if (groups.length > 2 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) {
385
+ return void 0;
386
+ }
387
+ return groups.length === 1 ? readIpv4HexPair("0", groups[0]) : readIpv4HexPair(groups[0], groups[1]);
388
+ }
389
+ __name(readWellKnownNat64Ipv6, "readWellKnownNat64Ipv6");
390
+ function isBlockedTransitionIpv6Address(host) {
391
+ return isIP(host) === 6 && BLOCKED_TRANSITION_IPV6_ADDRESSES.check(host, "ipv6");
392
+ }
393
+ __name(isBlockedTransitionIpv6Address, "isBlockedTransitionIpv6Address");
394
+ function unwrapIpv6TransitionStep(host) {
395
+ const ipv4Mapped = readIpv4MappedIpv6(host);
311
396
  if (ipv4Mapped) {
312
- return isPrivateNetworkIp(ipv4Mapped[1]);
397
+ return { address: ipv4Mapped };
313
398
  }
314
- const ipv4Compatible = host.match(/^::(\d+\.\d+\.\d+\.\d+)$/);
399
+ const ipv4Compatible = readIpv4CompatibleIpv6(host);
315
400
  if (ipv4Compatible) {
316
- return isPrivateNetworkIp(ipv4Compatible[1]);
401
+ return { address: ipv4Compatible };
317
402
  }
318
- const normalizedIpv4Compatible = readIpv4CompatibleIpv6(host);
319
- if (normalizedIpv4Compatible) {
320
- return isPrivateNetworkIp(normalizedIpv4Compatible);
403
+ const nat64 = readWellKnownNat64Ipv6(host);
404
+ if (nat64) {
405
+ return { address: nat64 };
321
406
  }
322
407
  if (host.startsWith("::ffff:")) {
408
+ return "blocked";
409
+ }
410
+ return void 0;
411
+ }
412
+ __name(unwrapIpv6TransitionStep, "unwrapIpv6TransitionStep");
413
+ function isPrivateNetworkIp(hostname) {
414
+ const host = normalizeIpAddress(hostname);
415
+ if (isBlockedTransitionIpv6Address(host)) {
323
416
  return true;
324
417
  }
418
+ if (isLoopbackHost(host)) {
419
+ return false;
420
+ }
421
+ const step = unwrapIpv6TransitionStep(host);
422
+ if (step === "blocked") {
423
+ return true;
424
+ }
425
+ if (step) {
426
+ return isPrivateNetworkIp(step.address);
427
+ }
325
428
  if (isIP(host) === 4) {
326
429
  const [first = 0, second = 0] = host.split(".").map(Number);
327
430
  return first === 0 || first === 10 || first === 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 100 && second >= 64 && second <= 127;
328
431
  }
329
432
  if (isIP(host) === 6) {
330
- const firstHextet = Number.parseInt(host.split(":", 1)[0] || "", 16);
331
- const isLinkLocal = firstHextet >= 65152 && firstHextet <= 65215;
332
- const isUniqueLocal = (firstHextet & 65024) === 64512;
333
- return host === "::" || isLinkLocal || isUniqueLocal;
433
+ const firstHextet = Number.parseInt(host.split(":", 1)[0] || "0", 16);
434
+ return host === "::" || (firstHextet & 65472) === 65152 || (firstHextet & 65024) === 64512;
334
435
  }
335
436
  return false;
336
437
  }
337
438
  __name(isPrivateNetworkIp, "isPrivateNetworkIp");
439
+ function isAlwaysBlockedVoiceAddress(address) {
440
+ const host = normalizeIpAddress(address);
441
+ if (isBlockedTransitionIpv6Address(host)) {
442
+ return true;
443
+ }
444
+ if (isLoopbackHost(host)) {
445
+ return true;
446
+ }
447
+ const step = unwrapIpv6TransitionStep(host);
448
+ if (step === "blocked") {
449
+ return true;
450
+ }
451
+ if (step) {
452
+ return isAlwaysBlockedVoiceAddress(step.address);
453
+ }
454
+ if (isIP(host) === 4) {
455
+ const [first = 0, second = 0] = host.split(".").map(Number);
456
+ return first === 0 || first === 127 || first === 169 && second === 254 || host === "100.100.100.200";
457
+ }
458
+ if (isIP(host) === 6) {
459
+ const firstHextet = Number.parseInt(host.split(":", 1)[0] || "0", 16);
460
+ return host === "::" || isAwsIpv6MetadataAddress(host) || (firstHextet & 65472) === 65152;
461
+ }
462
+ return false;
463
+ }
464
+ __name(isAlwaysBlockedVoiceAddress, "isAlwaysBlockedVoiceAddress");
465
+ function isLoopbackVoiceAddress(address) {
466
+ const host = normalizeIpAddress(address);
467
+ if (isLoopbackHost(host)) {
468
+ return true;
469
+ }
470
+ const step = unwrapIpv6TransitionStep(host);
471
+ if (step && step !== "blocked") {
472
+ return isLoopbackVoiceAddress(step.address);
473
+ }
474
+ if (isIP(host) === 4) {
475
+ return host.startsWith("127.");
476
+ }
477
+ return false;
478
+ }
479
+ __name(isLoopbackVoiceAddress, "isLoopbackVoiceAddress");
338
480
  async function defaultLookupHost(hostname) {
339
481
  return dnsLookup(hostname, { all: true });
340
482
  }
@@ -345,9 +487,9 @@ async function assertVoiceBaseUrlNetworkAllowed(voiceConfig, lookupHost, abortSi
345
487
  return;
346
488
  }
347
489
  if (isIP(hostname) !== 0) {
348
- if (isPrivateNetworkIp(hostname)) {
490
+ if (isAlwaysBlockedVoiceAddress(hostname) || !voiceConfig.allowInsecureBaseUrl && isPrivateNetworkIp(hostname)) {
349
491
  throw new Error(
350
- `Voice model '${voiceConfig.model}' resolved to a private-network address.`
492
+ isLoopbackVoiceAddress(hostname) ? `Voice model '${voiceConfig.model}' uses a loopback address outside the accepted spellings. To use a local ASR endpoint, set the baseUrl to http://localhost, http://127.0.0.1, or http://[::1].` : `Voice model '${voiceConfig.model}' resolved to a private-network address.`
351
493
  );
352
494
  }
353
495
  return;
@@ -378,9 +520,13 @@ async function assertVoiceBaseUrlNetworkAllowed(voiceConfig, lookupHost, abortSi
378
520
  if (onAbort) abortSignal?.removeEventListener("abort", onAbort);
379
521
  }
380
522
  const records = Array.isArray(result) ? result : [result];
381
- if (records.some((record) => isPrivateNetworkIp(record.address))) {
523
+ if (records.some(
524
+ (record) => isAlwaysBlockedVoiceAddress(record.address) || !voiceConfig.allowInsecureBaseUrl && isPrivateNetworkIp(record.address)
525
+ )) {
382
526
  throw new Error(
383
- `Voice model '${voiceConfig.model}' resolved to a private-network address.`
527
+ records.some((record) => isLoopbackVoiceAddress(record.address)) ? `Voice model '${voiceConfig.model}' resolved to a loopback address. Loopback DNS results are always blocked; to use a local ASR endpoint, configure an explicit loopback baseUrl: http://localhost, http://127.0.0.1, or http://[::1].` : voiceConfig.allowInsecureBaseUrl && records.some(
528
+ (record) => isAlwaysBlockedVoiceAddress(record.address)
529
+ ) ? `Voice model '${voiceConfig.model}' resolved to an address that is always blocked (metadata, link-local, or transition range), even when the baseUrl is listed in security.allowedInsecureVoiceBaseUrls.` : `Voice model '${voiceConfig.model}' resolved to a private-network address.`
384
530
  );
385
531
  }
386
532
  }
@@ -390,7 +536,8 @@ function readApiKey(settings, model, baseUrl, env) {
390
536
  return void 0;
391
537
  }
392
538
  const envKey = model.envKey ?? DEFAULT_OPENAI_API_KEY;
393
- const envValue = (env ?? process.env)[envKey];
539
+ const envSource = env ?? process.env;
540
+ const envValue = Object.hasOwn(envSource, envKey) ? envSource[envKey] : void 0;
394
541
  if (envValue && envValue.trim().length > 0) {
395
542
  return envValue.trim();
396
543
  }
@@ -431,14 +578,28 @@ function resolveVoiceTranscriptionConfig({
431
578
  const normalizedBaseUrl = normalizeBaseUrl(baseUrl, voiceModel);
432
579
  const parsedBaseUrl = new URL(normalizedBaseUrl);
433
580
  const isLocalhost = isLoopbackHost(parsedBaseUrl.hostname);
434
- if (parsedBaseUrl.protocol !== "https:" && !isLocalhost) {
581
+ const allowInsecureBaseUrl = isInsecureVoiceBaseUrlAllowed(
582
+ settings,
583
+ normalizedBaseUrl
584
+ );
585
+ if (parsedBaseUrl.protocol !== "http:" && parsedBaseUrl.protocol !== "https:") {
586
+ throw new Error(
587
+ `Voice model '${voiceModel}' must use an http or https baseUrl.`
588
+ );
589
+ }
590
+ if (!isLocalhost && isAlwaysBlockedVoiceAddress(parsedBaseUrl.hostname)) {
591
+ throw new Error(
592
+ isLoopbackVoiceAddress(parsedBaseUrl.hostname) ? `Voice model '${voiceModel}' uses a loopback address outside the accepted spellings. To use a local ASR endpoint, set the baseUrl to http://localhost, http://127.0.0.1, or http://[::1].` : `Voice model '${voiceModel}' must not use a private-network baseUrl.`
593
+ );
594
+ }
595
+ if (parsedBaseUrl.protocol !== "https:" && !isLocalhost && !allowInsecureBaseUrl) {
435
596
  throw new Error(
436
- `Voice model '${voiceModel}' must use an https baseUrl. Voice audio must not be transmitted in cleartext.`
597
+ `Voice model '${voiceModel}' must use an https baseUrl. Voice audio must not be transmitted in cleartext. To trust this managed endpoint, add its exact complete normalized URL (${normalizedBaseUrl}) to security.allowedInsecureVoiceBaseUrls. This setting is only honored from User, System, or SystemDefaults scope settings; Workspace entries are ignored.`
437
598
  );
438
599
  }
439
- if (isPrivateNetworkIp(parsedBaseUrl.hostname)) {
600
+ if (!isLocalhost && !allowInsecureBaseUrl && isPrivateNetworkIp(parsedBaseUrl.hostname)) {
440
601
  throw new Error(
441
- `Voice model '${voiceModel}' must not use a private-network baseUrl.`
602
+ `Voice model '${voiceModel}' must not use a private-network baseUrl. To trust this managed endpoint, add its exact complete normalized URL (${normalizedBaseUrl}) to security.allowedInsecureVoiceBaseUrls. This setting is only honored from User, System, or SystemDefaults scope settings; Workspace entries are ignored.`
442
603
  );
443
604
  }
444
605
  const apiKey = readApiKey(settings, model, normalizedBaseUrl, env);
@@ -448,7 +609,8 @@ function resolveVoiceTranscriptionConfig({
448
609
  return {
449
610
  model: voiceModel,
450
611
  baseUrl: normalizedBaseUrl,
451
- ...apiKey ? { apiKey } : {}
612
+ ...apiKey ? { apiKey } : {},
613
+ ...allowInsecureBaseUrl ? { allowInsecureBaseUrl: true } : {}
452
614
  };
453
615
  }
454
616
  __name(resolveVoiceTranscriptionConfig, "resolveVoiceTranscriptionConfig");
@@ -472,6 +634,7 @@ function resolveVoiceStreamConfig(args) {
472
634
  baseUrl: base.baseUrl,
473
635
  model: base.model,
474
636
  ...base.apiKey ? { apiKey: base.apiKey } : {},
637
+ ...base.allowInsecureBaseUrl ? { allowInsecureBaseUrl: true } : {},
475
638
  ...language ? { language } : {},
476
639
  ...keytermsContext ? { keytermsContext } : {}
477
640
  };
@@ -2,7 +2,7 @@
2
2
  "use strict";
3
3
  import {
4
4
  expandHomeDir
5
- } from "./chunk-3RXUYQJI.js";
5
+ } from "./chunk-OIVKILPI.js";
6
6
  import {
7
7
  init_esbuild_shims
8
8
  } from "./chunk-5O2XNYP6.js";
@@ -20,7 +20,9 @@ function resolveRequestTimeout(timeout) {
20
20
  __name(resolveRequestTimeout, "resolveRequestTimeout");
21
21
  var DEFAULT_STREAM_IDLE_TIMEOUT_MS = 24e4;
22
22
  var QWEN_STREAM_IDLE_TIMEOUT_MS_ENV = "QWEN_STREAM_IDLE_TIMEOUT_MS";
23
- var MAX_STREAM_IDLE_TIMEOUT_MS = 2147483647;
23
+ var MAX_STREAM_GUARD_TIMEOUT_MS = 2147483647;
24
+ var DEFAULT_STREAM_MAX_LIFETIME_MS = 9e5;
25
+ var QWEN_STREAM_MAX_LIFETIME_MS_ENV = "QWEN_STREAM_MAX_LIFETIME_MS";
24
26
  var DEFAULT_MAX_RETRIES = 3;
25
27
  var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
26
28
  var DEFAULT_DASHSCOPE_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1";
@@ -30,7 +32,9 @@ export {
30
32
  resolveRequestTimeout,
31
33
  DEFAULT_STREAM_IDLE_TIMEOUT_MS,
32
34
  QWEN_STREAM_IDLE_TIMEOUT_MS_ENV,
33
- MAX_STREAM_IDLE_TIMEOUT_MS,
35
+ MAX_STREAM_GUARD_TIMEOUT_MS,
36
+ DEFAULT_STREAM_MAX_LIFETIME_MS,
37
+ QWEN_STREAM_MAX_LIFETIME_MS_ENV,
34
38
  DEFAULT_MAX_RETRIES,
35
39
  DEFAULT_OPENAI_BASE_URL,
36
40
  DEFAULT_DASHSCOPE_BASE_URL,
@@ -8,7 +8,7 @@ import {
8
8
  } from "./chunk-46UV252V.js";
9
9
  import {
10
10
  createDebugLogger
11
- } from "./chunk-3RXUYQJI.js";
11
+ } from "./chunk-OIVKILPI.js";
12
12
  import {
13
13
  init_esbuild_shims
14
14
  } from "./chunk-5O2XNYP6.js";
@@ -11,12 +11,12 @@ import {
11
11
  isQuotaExhaustedError,
12
12
  isQwenQuotaExceededError,
13
13
  isRateLimitError
14
- } from "./chunk-6O5DVH27.js";
14
+ } from "./chunk-M6HMMKVG.js";
15
15
  import {
16
16
  createDebugLogger,
17
17
  getErrorStatus,
18
18
  isAbortError
19
- } from "./chunk-3RXUYQJI.js";
19
+ } from "./chunk-OIVKILPI.js";
20
20
  import {
21
21
  init_esbuild_shims
22
22
  } from "./chunk-5O2XNYP6.js";
@@ -2,7 +2,7 @@
2
2
  "use strict";
3
3
  import {
4
4
  writeStderrLine
5
- } from "./chunk-OWAK7LMW.js";
5
+ } from "./chunk-KGJGEEVR.js";
6
6
  import {
7
7
  init_esbuild_shims
8
8
  } from "./chunk-5O2XNYP6.js";
@@ -6,10 +6,10 @@ import {
6
6
  } from "./chunk-S6LOFUVP.js";
7
7
  import {
8
8
  isInForkExecution
9
- } from "./chunk-WVAESIM6.js";
9
+ } from "./chunk-LZC3B5N2.js";
10
10
  import {
11
11
  ToolNames
12
- } from "./chunk-D7D7RXIJ.js";
12
+ } from "./chunk-IC4Z6LX6.js";
13
13
  import {
14
14
  init_esbuild_shims
15
15
  } from "./chunk-5O2XNYP6.js";
@@ -9,7 +9,7 @@ import {
9
9
  } from "./chunk-HGCQ5SE7.js";
10
10
  import {
11
11
  DEFAULT_RING_SIZE
12
- } from "./chunk-GLWP3FDB.js";
12
+ } from "./chunk-MZSJ43WV.js";
13
13
  import {
14
14
  DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
15
15
  DEFAULT_MAX_JOURNAL_BYTES,
@@ -23,10 +23,10 @@ import {
23
23
  } from "./chunk-BKHCW2BI.js";
24
24
  import {
25
25
  loadSettings
26
- } from "./chunk-YUVTZ4UH.js";
26
+ } from "./chunk-PQBHU2IA.js";
27
27
  import {
28
28
  MCP_BUDGET_WARN_FRACTION
29
- } from "./chunk-DOA7MCDY.js";
29
+ } from "./chunk-Y7E5LNLO.js";
30
30
  import {
31
31
  parsePositiveIntegerEnv
32
32
  } from "./chunk-6PVPNMXU.js";
@@ -36,10 +36,10 @@ import {
36
36
  } from "./chunk-NAVJD2PQ.js";
37
37
  import {
38
38
  MEMORY_PROJECT_SCOPES
39
- } from "./chunk-E4WHKETF.js";
39
+ } from "./chunk-FVKHVJZQ.js";
40
40
  import {
41
41
  writeStderrLine
42
- } from "./chunk-OWAK7LMW.js";
42
+ } from "./chunk-KGJGEEVR.js";
43
43
  import {
44
44
  init_esbuild_shims
45
45
  } from "./chunk-5O2XNYP6.js";
@@ -346,7 +346,7 @@ var serveCommand = {
346
346
  }
347
347
  const externalToolGuardToken = process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV] ?? "";
348
348
  delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
349
- const { runQwenServe } = await import("./run-qwen-serve-UYEMGPKA.js");
349
+ const { runQwenServe } = await import("./run-qwen-serve-ZPKPKECF.js");
350
350
  try {
351
351
  const handle = await runQwenServe({
352
352
  port: argv.port,
@@ -2,13 +2,13 @@
2
2
  "use strict";
3
3
  import {
4
4
  isPrivateHost
5
- } from "./chunk-QYPT3QUD.js";
5
+ } from "./chunk-3ULCB3NE.js";
6
6
  import {
7
7
  loadUndici
8
- } from "./chunk-BFHXDAR7.js";
8
+ } from "./chunk-KKBPOU75.js";
9
9
  import {
10
10
  getErrorMessage
11
- } from "./chunk-3RXUYQJI.js";
11
+ } from "./chunk-OIVKILPI.js";
12
12
  import {
13
13
  init_esbuild_shims
14
14
  } from "./chunk-5O2XNYP6.js";
@@ -2,7 +2,7 @@
2
2
  "use strict";
3
3
  import {
4
4
  createDebugLogger
5
- } from "./chunk-3RXUYQJI.js";
5
+ } from "./chunk-OIVKILPI.js";
6
6
  import {
7
7
  init_esbuild_shims
8
8
  } from "./chunk-5O2XNYP6.js";
@@ -19,15 +19,15 @@ import {
19
19
  taskHasLegacyCondition,
20
20
  taskHasLegacyRunMode,
21
21
  updateCronTasks
22
- } from "./chunk-MOHAWIAW.js";
22
+ } from "./chunk-GNPNYXJB.js";
23
23
  import {
24
24
  ToolNames
25
- } from "./chunk-D7D7RXIJ.js";
25
+ } from "./chunk-IC4Z6LX6.js";
26
26
  import {
27
27
  Storage,
28
28
  createDebugLogger,
29
29
  getProjectHash
30
- } from "./chunk-3RXUYQJI.js";
30
+ } from "./chunk-OIVKILPI.js";
31
31
  import {
32
32
  init_esbuild_shims
33
33
  } from "./chunk-5O2XNYP6.js";
@@ -3,13 +3,13 @@
3
3
  import {
4
4
  resolveModelConfig,
5
5
  resolveProviderProtocol
6
- } from "./chunk-DOA7MCDY.js";
6
+ } from "./chunk-Y7E5LNLO.js";
7
7
  import {
8
8
  external_exports
9
9
  } from "./chunk-H6XPXXMH.js";
10
10
  import {
11
11
  stripRuntimeSnapshotPrefix
12
- } from "./chunk-6D6V55ZQ.js";
12
+ } from "./chunk-RMH5OWLD.js";
13
13
  import {
14
14
  REASONING_EFFORT_TIERS,
15
15
  normalizeReasoningEffort
@@ -17,7 +17,7 @@ import {
17
17
  import {
18
18
  AuthType,
19
19
  MODEL_GENERATION_CONFIG_FIELDS
20
- } from "./chunk-P7LKADIT.js";
20
+ } from "./chunk-6EOI4HOK.js";
21
21
  import {
22
22
  init_esbuild_shims
23
23
  } from "./chunk-5O2XNYP6.js";
@@ -6,7 +6,7 @@ import {
6
6
  } from "./chunk-RKUWKYED.js";
7
7
  import {
8
8
  createDebugLogger
9
- } from "./chunk-3RXUYQJI.js";
9
+ } from "./chunk-OIVKILPI.js";
10
10
  import {
11
11
  init_esbuild_shims
12
12
  } from "./chunk-5O2XNYP6.js";