@qwen-code/qwen-code 0.21.6 → 0.21.7-nightly.20260808.4ec0371e6

package/chunks/chunk-SAH4BD2J.js

@@ -0,0 +1,92 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/core/openaiContentGenerator/prefix-caching.ts
+init_esbuild_shims();
+var CACHE_KEY_PREFIX = "qwen-code:";
+var EXPLICIT_BREAKPOINT_COUNT = 2;
+function supportsOpenAIPrefixCaching(contentGeneratorConfig) {
+  return contentGeneratorConfig.authType === "openai" /* USE_OPENAI */ || contentGeneratorConfig.authType === "qwen-oauth" /* QWEN_OAUTH */;
+}
+__name(supportsOpenAIPrefixCaching, "supportsOpenAIPrefixCaching");
+function isOfficialOpenAIEndpoint(contentGeneratorConfig) {
+  if (contentGeneratorConfig.authType !== "openai" /* USE_OPENAI */) return false;
+  const { baseUrl } = contentGeneratorConfig;
+  if (!baseUrl) return false;
+  try {
+    return new URL(baseUrl).hostname.toLowerCase() === "api.openai.com";
+  } catch {
+    return false;
+  }
+}
+__name(isOfficialOpenAIEndpoint, "isOfficialOpenAIEndpoint");
+function supportsExplicitOpenAIPromptCaching(model) {
+  const match = /^gpt-(\d+)(?:\.(\d+))?(?:[-.]|$)/i.exec(model);
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2] ?? 0);
+  return major > 5 || major === 5 && minor >= 6;
+}
+__name(supportsExplicitOpenAIPromptCaching, "supportsExplicitOpenAIPromptCaching");
+function withCacheBreakpoint(message) {
+  if (message.role !== "user" && message.role !== "tool") return void 0;
+  const marker = { prompt_cache_breakpoint: { mode: "explicit" } };
+  if (typeof message.content === "string") {
+    return {
+      ...message,
+      content: [{ type: "text", text: message.content, ...marker }]
+    };
+  }
+  if (!Array.isArray(message.content) || message.content.length === 0) {
+    return void 0;
+  }
+  const content = [...message.content];
+  const lastIndex = content.length - 1;
+  content[lastIndex] = { ...content[lastIndex], ...marker };
+  return { ...message, content };
+}
+__name(withCacheBreakpoint, "withCacheBreakpoint");
+function applyOfficialOpenAIPromptCaching(request, sessionId, cacheSharing, cacheKeyPartition) {
+  const result = { ...request };
+  if (sessionId && !result.prompt_cache_key) {
+    const partition = cacheKeyPartition ? `:${cacheKeyPartition}` : "";
+    result.prompt_cache_key = `${CACHE_KEY_PREFIX}${sessionId}${partition}`;
+  }
+  if (!cacheSharing || !supportsExplicitOpenAIPromptCaching(request.model)) {
+    return result;
+  }
+  const messages = [...request.messages];
+  let marked = 0;
+  for (let index = messages.length - 2; index >= 0 && marked < EXPLICIT_BREAKPOINT_COUNT; index -= 1) {
+    const message = messages[index];
+    const updated = message ? withCacheBreakpoint(message) : void 0;
+    if (!updated) continue;
+    messages[index] = updated;
+    marked += 1;
+  }
+  if (marked === 0) return result;
+  result.messages = messages;
+  result.prompt_cache_options = {
+    ...result.prompt_cache_options,
+    mode: "explicit"
+  };
+  return result;
+}
+__name(applyOfficialOpenAIPromptCaching, "applyOfficialOpenAIPromptCaching");
+
+export {
+  supportsOpenAIPrefixCaching,
+  isOfficialOpenAIEndpoint,
+  applyOfficialOpenAIPromptCaching
+};
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-JE44IPH6.js → chunk-SDUDZNF4.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   isGitRepository
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-YAVY33G4.js → chunk-SEZ556DZ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-SOORFWKY.js

@@ -0,0 +1,155 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  require_express
+} from "./chunk-GDXET5XU.js";
+import {
+  writeStderrLine
+} from "./chunk-KGJGEEVR.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name,
+  __toESM
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/web-shell-static.ts
+init_esbuild_shims();
+var import_express = __toESM(require_express(), 1);
+import * as path from "node:path";
+
+// packages/cli/src/serve/debug-mode.ts
+init_esbuild_shims();
+function isServeDebugMode() {
+  const value = process.env["QWEN_SERVE_DEBUG"];
+  if (!value) return false;
+  return !["0", "false", "off", "no"].includes(value.trim().toLowerCase());
+}
+__name(isServeDebugMode, "isServeDebugMode");
+
+// packages/cli/src/serve/web-shell-static.ts
+var WEB_SHELL_CSP_DIRECTIVES = [
+  "default-src 'self'",
+  "script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",
+  "style-src 'self' 'unsafe-inline'",
+  "font-src 'self' data:",
+  "img-src 'self' data: blob:",
+  "connect-src 'self'",
+  "worker-src 'self' blob:",
+  // base-uri does NOT fall back to default-src; lock it so an injected <base>
+  // (the SPA renders AI-generated markdown) cannot repoint relative URLs to an
+  // attacker origin.
+  "base-uri 'none'"
+];
+function buildWebShellCsp(frameAncestors = []) {
+  const fa = frameAncestors.length ? `frame-ancestors ${frameAncestors.join(" ")}` : "frame-ancestors 'none'";
+  return [...WEB_SHELL_CSP_DIRECTIVES, fa].join("; ");
+}
+__name(buildWebShellCsp, "buildWebShellCsp");
+var WEB_SHELL_CSP = buildWebShellCsp();
+function isDocumentNavigation(req) {
+  const fetchMode = req.headers["sec-fetch-mode"];
+  const fetchDest = req.headers["sec-fetch-dest"];
+  const accept = req.headers.accept ?? "";
+  return fetchMode === "navigate" || fetchDest === "document" || accept.trim().toLowerCase().startsWith("text/html");
+}
+__name(isDocumentNavigation, "isDocumentNavigation");
+var SESSION_DEEP_LINK_PATH = /^\/session\/[^/]+\/?$/u;
+function isPreAuthWebShellRequest(req) {
+  if (req.method !== "GET" && req.method !== "HEAD") return false;
+  const reqPath = req.path.toLowerCase();
+  if (reqPath === "/" || // Express non-strict routing compiles `/` to `/^(?:\/)(?:\/$)?$/i`, so
+  // a raw `//` also matches `app.get('/')` pre-auth (but `///` does not).
+  reqPath === "//" || reqPath === "/assets" || reqPath.startsWith("/assets/"))
+    return true;
+  return SESSION_DEEP_LINK_PATH.test(reqPath) && isDocumentNavigation(req);
+}
+__name(isPreAuthWebShellRequest, "isPreAuthWebShellRequest");
+function createSendIndex(webShellDir, frameAncestors = []) {
+  const indexPath = path.join(webShellDir, "index.html");
+  const csp = buildWebShellCsp(frameAncestors);
+  return (res) => {
+    res.status(200).set("Content-Security-Policy", csp).set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "no-referrer").set(
+      // `microphone=(self)` lets the same-origin Web Shell document request
+      // the mic for voice dictation (the prompt won't even appear under an
+      // empty `microphone=()` allowlist). Still blocks cross-origin iframes;
+      // camera/geolocation/payment stay disabled (unused).
+      "Permissions-Policy",
+      "camera=(), microphone=(self), geolocation=(), payment=()"
+    ).set("Cache-Control", "no-cache");
+    if (frameAncestors.length === 0) {
+      res.set("X-Frame-Options", "DENY");
+    }
+    res.sendFile(
+      indexPath,
+      { cacheControl: false, dotfiles: "allow" },
+      (err) => {
+        if (!err) return;
+        writeStderrLine(
+          `qwen serve: Web Shell index send failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+        if (!res.headersSent) {
+          res.status(500).type("text/plain").send("Failed to load Web Shell");
+        } else {
+          res.end();
+        }
+      }
+    );
+  };
+}
+__name(createSendIndex, "createSendIndex");
+function mountWebShellAssets(app, webShellDir, frameAncestors = []) {
+  const sendIndex = createSendIndex(webShellDir, frameAncestors);
+  app.use(
+    "/assets",
+    import_express.default.static(path.join(webShellDir, "assets"), {
+      index: false,
+      immutable: true,
+      maxAge: "1y"
+    })
+  );
+  app.use("/assets", (req, res) => {
+    if (isServeDebugMode()) {
+      writeStderrLine(
+        `qwen serve: Web Shell asset not found: ${req.originalUrl}`
+      );
+    }
+    res.status(404).type("text/plain").send("Not found");
+  });
+  app.get("/", (_req, res) => sendIndex(res));
+  app.get("/session/:id", (req, res, next) => {
+    if (!isDocumentNavigation(req)) return next();
+    sendIndex(res);
+  });
+}
+__name(mountWebShellAssets, "mountWebShellAssets");
+function mountWebShellSpaFallback(app, webShellDir, frameAncestors = []) {
+  const sendIndex = createSendIndex(webShellDir, frameAncestors);
+  app.use((req, res, next) => {
+    if (req.method !== "GET" && req.method !== "HEAD") return next();
+    if (!isDocumentNavigation(req)) return next();
+    if (isServeDebugMode()) {
+      writeStderrLine(
+        `qwen serve: Web Shell SPA fallback served for ${req.method} ${req.originalUrl}`
+      );
+    }
+    sendIndex(res);
+  });
+}
+__name(mountWebShellSpaFallback, "mountWebShellSpaFallback");
+
+export {
+  isServeDebugMode,
+  buildWebShellCsp,
+  WEB_SHELL_CSP,
+  isDocumentNavigation,
+  isPreAuthWebShellRequest,
+  mountWebShellAssets,
+  mountWebShellSpaFallback
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-KHUA3NQV.js → chunk-TAOSTUHI.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   resolveBundleDir
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import {
   Storage
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";

package/chunks/{chunk-VSALQLT7.js → chunk-TSYIQDG7.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   registerCleanup
-} from "./chunk-RHTTKJTP.js";
+} from "./chunk-ZQGHESAS.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-ULPQQSDN.js → chunk-TX3KSSDN.js}

@@ -2,14 +2,14 @@
 "use strict";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-UGTWD35F.js";
+} from "./chunk-NLREQJFK.js";
 import {
   formatMemoryUsage
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import {
   detectRuntime,
   redactProxyCredentials
-} from "./chunk-BFHXDAR7.js";
+} from "./chunk-KKBPOU75.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-KVUBYJDM.js → chunk-TZEZYNYD.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-24ER7UV4.js → chunk-UFALT4LK.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-M5GB774H.js";
 import {
   sanitizeLogText
-} from "./chunk-DIEFUBV6.js";
+} from "./chunk-DIWZNWZT.js";
 import {
   stripAnsi
 } from "./chunk-TWPJO254.js";