@qwen-code/qwen-code 0.21.6 → 0.21.7-nightly.20260808.4ec0371e6

package/chunks/{chunk-T4JSA7KU.js → chunk-64YLXLMY.js}

@@ -2,16 +2,16 @@
 "use strict";
 import {
   useKeypress
-} from "./chunk-75QMRMO7.js";
+} from "./chunk-APNNM3JC.js";
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
 import {
   t
-} from "./chunk-KHUA3NQV.js";
+} from "./chunk-TAOSTUHI.js";
 import {
   APPROVAL_MODES
-} from "./chunk-6WBWIPBF.js";
+} from "./chunk-WAUGQKUU.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-5L6CQ4ZU.js → chunk-6M26GBKX.js}

@@ -18,7 +18,7 @@ import {
   getCurrentSessionId,
   setSessionContext,
   setShellTracePropagation
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   DiagLogLevel,
   ROOT_CONTEXT,
@@ -863,7 +863,7 @@ function initializeTelemetry(config) {
   telemetryInitPromise ??= (async () => {
     const debugLogger3 = createDebugLogger("OTEL");
     try {
-      const { startTelemetrySdk } = await import("./sdk-impl-SYKGVWOZ.js");
+      const { startTelemetrySdk } = await import("./sdk-impl-KD7FSTC3.js");
       if (telemetryInitialized) return;
       const started = await startTelemetrySdk(config);
       if (!started) return;

package/chunks/{chunk-ZPPP6VCL.js → chunk-6ZRFAKXK.js}

@@ -5,7 +5,7 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-D7D7RXIJ.js";
+} from "./chunk-PYQADEFD.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-OP2OHZ7K.js → chunk-764F335K.js}

@@ -6,7 +6,7 @@ import {
   EventBus,
   logEventSizingFailed,
   serializedBridgeEventByteLength
-} from "./chunk-GLWP3FDB.js";
+} from "./chunk-MZSJ43WV.js";
 import {
   normalizeCompactedReplayMaxBytes,
   normalizeMaxJournalBytes,
@@ -17,7 +17,7 @@ import {
 } from "./chunk-OCPBI7J5.js";
 import {
   defaultSpawnChannelFactory
-} from "./chunk-SQC6K5HI.js";
+} from "./chunk-RPWVIXDB.js";
 import {
   BridgeChannelClosedError,
   BridgeTimeoutError,
@@ -26,7 +26,7 @@ import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceExtensionsStatus,
   createIdleWorkspaceHooksStatus
-} from "./chunk-UGTWD35F.js";
+} from "./chunk-NLREQJFK.js";
 import {
   CHANNEL_STARTUP_PROFILE_META_KEY,
   CHANNEL_STARTUP_PROFILE_VERSION,
@@ -100,16 +100,16 @@ import {
   metadataBudgetBytes,
   normalizeSnapshotPayload,
   stableSessionArtifactId
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import {
   DAEMON_TRACEPARENT_META_KEY,
   DAEMON_TRACESTATE_META_KEY
-} from "./chunk-MGSSJT27.js";
+} from "./chunk-L4N6TIP7.js";
 import {
   INVOCATION_CONTEXT_META_KEY,
   PRIVATE_ACP_CAPABILITY_ENV,
   PRIVATE_PARENT_CAPABILITY_META_KEY
-} from "./chunk-PX5DNLSA.js";
+} from "./chunk-XCG76UE6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -6094,6 +6094,7 @@ function createAcpSessionBridge(opts) {
   let liveTaskToolRequestHandler;
   let liveSpeakToUserHandler;
   const defaultSessionScope = opts.sessionScope ?? "single";
+  const delegateReadTextFileToClient = opts.delegateReadTextFileToClient ?? true;
   let maxSessions;
   if (opts.maxSessions === void 0) {
     maxSessions = DEFAULT_MAX_SESSIONS;
@@ -6794,7 +6795,10 @@ function createAcpSessionBridge(opts) {
                   [PRIVATE_PARENT_CAPABILITY_META_KEY]: privateParentCapability
                 },
                 clientCapabilities: {
-                  fs: { readTextFile: true, writeTextFile: true }
+                  fs: {
+                    readTextFile: delegateReadTextFileToClient,
+                    writeTextFile: true
+                  }
                 },
                 clientInfo: { name: "qwen-serve-bridge", version: "0" }
               }),
@@ -7457,12 +7461,17 @@ function createAcpSessionBridge(opts) {
   const getChildResourceSnapshot = /* @__PURE__ */ __name(() => {
     const info = liveChannelInfo();
     if (!info || info.childResourceAt === void 0) return void 0;
-    if (Date.now() - info.childResourceAt > STALE_CHILD_RESOURCE_MS) {
+    const ageMs = Date.now() - info.childResourceAt;
+    if (ageMs > STALE_CHILD_RESOURCE_MS) {
       return void 0;
     }
     return {
       rssBytes: info.childRssBytes ?? 0,
-      cpuPercent: info.childCpuPercent ?? 0
+      cpuPercent: info.childCpuPercent ?? 0,
+      // Bounded by the guard above, so a caller summing several children's
+      // readings can say how far apart they were taken. Without it a sum of
+      // readings up to `STALE_CHILD_RESOURCE_MS` apart looks instantaneous.
+      ageMs
     };
   }, "getChildResourceSnapshot");
   const requestSessionStatus = /* @__PURE__ */ __name(async (sessionId, method, params = {}, timeoutMs = initTimeoutMs) => {

package/chunks/{chunk-PPUOYL77.js → chunk-77WOUGCA.js}

@@ -21,20 +21,20 @@ import {
   getLanguageNameFromLocale,
   getLanguageSettingsOptions,
   t
-} from "./chunk-KHUA3NQV.js";
+} from "./chunk-TAOSTUHI.js";
 import {
   getHomeEnvFallbackVars,
   loadEnvironment,
   preResolveHomeEnvOverrides
-} from "./chunk-RK2EE3T7.js";
+} from "./chunk-KPMB4JEZ.js";
 import {
   ENV_CORRUPTED_PATH,
   ENV_WAS_RECOVERED
-} from "./chunk-6PEXNQTX.js";
+} from "./chunk-ALFTV7GA.js";
 import {
   isWorkspaceTrusted,
   updateSettingsFilePreservingFormat
-} from "./chunk-ACZRB7AD.js";
+} from "./chunk-3ARO4N5G.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -46,13 +46,13 @@ import {
   DEFAULT_TOOL_RESULTS_TOTAL_CHARS_THRESHOLD,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import {
   stripRuntimeSnapshotPrefix
-} from "./chunk-DIT4V3XH.js";
+} from "./chunk-RGTB44BO.js";
 import {
   DEFAULT_QWEN_CUSTOM_IGNORE_FILE_NAMES
-} from "./chunk-432XCUHF.js";
+} from "./chunk-EQL65XGA.js";
 import {
   DEFAULT_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH,
   SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH_LIMIT
@@ -62,7 +62,7 @@ import {
   Storage,
   createDebugLogger,
   getErrorMessage
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -1352,7 +1352,7 @@ var SETTINGS_SCHEMA = {
         category: "Model",
         requiresRestart: false,
         default: true,
-        description: "Skip the opt-in streaming loop-detection heuristics (content/thought repetition, read-file and action stagnation, global-duplicate and alternating tool-call patterns). Defaults to true to avoid false-positive interruptions; set to false to re-enable them as an unattended-run guardrail. A minimal always-on guard (consecutive identical tool calls plus a per-turn tool-call cap, see model.maxToolCallsPerTurn) still runs regardless of this setting.",
+        description: "Skip the opt-in streaming loop-detection heuristics (content/thought repetition, read-file and action stagnation, global-duplicate and alternating tool-call patterns). Defaults to true to avoid false-positive interruptions; set to false to re-enable them as an unattended-run guardrail. Daemon/ACP sessions run none of the other detectors; setting this to false also enables a global-duplicate tool-call halt there. Core-client sessions keep a minimal always-on guard regardless of this setting (consecutive identical tool calls, shell inspection-command stagnation, and a per-turn tool-call cap, see model.maxToolCallsPerTurn); daemon/ACP sessions keep the per-turn tool-call cap and an invalid-tool-params stagnation guard.",
         showInDialog: false
       },
       maxToolCallsPerTurn: {
@@ -1361,7 +1361,7 @@ var SETTINGS_SCHEMA = {
         category: "Model",
         requiresRestart: false,
         default: DEFAULT_MAX_TOOL_CALLS_PER_TURN,
-        description: "Per-turn tool-call cap (one model turn plus its tool-result continuations; blocking Stop-hook continuations such as /goal iterations start a fresh budget). When set explicitly, this value is a hard cap: the turn halts on the next tool call after it is reached (the released behavior). When left unset (default 100), the cap is adaptive: once the turn exceeds 100 it halts only when the model keeps repeating the same call (a stuck loop); a productive turn (diverse calls) continues up to a hard backstop of 1000, which always halts. The adaptive default applies to both the interactive TUI and non-interactive (-p / JSON / stream-JSON) core-client runs; the daemon/ACP path always treats the value as a hard cap. An always-on circuit breaker against runaway turns, independent of model.skipLoopDetection. Set to 0 or a negative value to disable the cap.",
+        description: "Per-turn tool-call cap (one model turn plus its tool-result continuations; blocking Stop-hook continuations such as /goal iterations start a fresh budget). When set explicitly, this value is a hard cap: the turn halts on the next tool call after it is reached (the released behavior). When left unset (default 100), the cap is adaptive: once the turn exceeds 100 it halts only when the model keeps repeating the same call (a stuck loop); a productive turn (diverse calls) continues up to a hard backstop of 1000, which always halts. The adaptive default applies to the interactive TUI, non-interactive (-p / JSON / stream-JSON) core-client runs, and daemon/ACP sessions alike. Daemon/ACP sessions evaluate the cap once per tool batch, before execution: a batch that would cross an explicit cap or the hard backstop is skipped whole, so a turn never executes past either (it can halt up to one batch short), while the adaptive soft cap is exceeded by design, up to the backstop. They also have no in-session disable. An always-on circuit breaker against runaway turns, independent of model.skipLoopDetection. Set to 0 or a negative value to disable the cap.",
         showInDialog: false
       },
       skipStartupContext: {
@@ -1448,7 +1448,7 @@ var SETTINGS_SCHEMA = {
             category: "Generation Configuration",
             requiresRestart: false,
             default: true,
-            description: "Enable cache control for DashScope providers.",
+            description: "Enable provider prompt-cache controls.",
             parentKey: "generationConfig",
             showInDialog: false
           },
@@ -2636,6 +2636,19 @@ var SETTINGS_SCHEMA = {
         default: false,
         description: "When true, HTTP hooks may target private/link-local IP ranges (the SSRF IP-range checks are skipped). Cloud metadata hostnames (e.g. 169.254.169.254, metadata.google.internal) remain blocked. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored so a cloned repository cannot self-grant this bypass. Enable only in trusted, managed environments, and pair with security.allowedHttpHookUrls.",
         showInDialog: false
+      },
+      allowedInsecureVoiceBaseUrls: {
+        type: "array",
+        label: "Allowed Insecure Voice Base URLs",
+        category: "Security",
+        requiresRestart: false,
+        default: [],
+        description: "Complete voice base URLs that may use HTTP or private-network addresses. Entries must include an explicit http:// or https:// scheme and the full provider path; only URL serialization and trailing slashes are normalized. Wildcards are not supported; metadata, link-local, local-use NAT64, 6to4, and Teredo addresses remain blocked even when listed, as do hostnames that resolve to loopback; IPv4-mapped, IPv4-compatible, and well-known NAT64 (64:ff9b::/96) literals are classified by their embedded IPv4 address. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored. Enable only for trusted endpoints in managed private networks. Cleartext HTTP also exposes the provider API key transmitted in the Authorization header. An allowlisted hostname is only as trustworthy as its DNS; prefer IP-literal entries when the gateway address is stable.",
+        showInDialog: false,
+        items: {
+          type: "string",
+          description: "Complete voice provider base URL with explicit scheme and full path (no wildcards)"
+        }
       }
     }
   },
@@ -4695,6 +4708,11 @@ function getSettingsWarnings(loadedSettings) {
       `Warning: security.allowPrivateNetworkHooks in workspace settings (${workspaceFile.path}) is ignored. This setting is only honored from User, System, or SystemDefaults scope settings.`
     );
   }
+  if (workspaceFile.rawJson !== void 0 && workspaceFile.originalSettings.security?.allowedInsecureVoiceBaseUrls !== void 0) {
+    warningSet.add(
+      `Warning: security.allowedInsecureVoiceBaseUrls in workspace settings (${workspaceFile.path}) is ignored. This setting is only honored from User, System, or SystemDefaults scope settings.`
+    );
+  }
   return [...warningSet];
 }
 __name(getSettingsWarnings, "getSettingsWarnings");
@@ -4710,19 +4728,20 @@ function tagMcpServerScope(settings, scope) {
   return { ...settings, mcpServers: tagged };
 }
 __name(tagMcpServerScope, "tagMcpServerScope");
-function stripWorkspacePrivateNetworkHooks(settings) {
-  if (settings.security?.allowPrivateNetworkHooks === void 0) {
+function stripWorkspaceSecurityBypasses(settings) {
+  if (settings.security?.allowPrivateNetworkHooks === void 0 && settings.security?.allowedInsecureVoiceBaseUrls === void 0) {
     return settings;
   }
-  const { allowPrivateNetworkHooks: _stripped, ...restSecurity } = settings.security;
+  const {
+    allowPrivateNetworkHooks: _privateHooks,
+    allowedInsecureVoiceBaseUrls: _insecureVoice,
+    ...restSecurity
+  } = settings.security;
   return { ...settings, security: restSecurity };
 }
-__name(stripWorkspacePrivateNetworkHooks, "stripWorkspacePrivateNetworkHooks");
+__name(stripWorkspaceSecurityBypasses, "stripWorkspaceSecurityBypasses");
 function mergeSettings(system, systemDefaults, user, workspace, isTrusted) {
-  const safeWorkspace = isTrusted ? tagMcpServerScope(
-    stripWorkspacePrivateNetworkHooks(workspace),
-    "workspace"
-  ) : {};
+  const safeWorkspace = isTrusted ? tagMcpServerScope(stripWorkspaceSecurityBypasses(workspace), "workspace") : {};
   return customDeepMerge(
     getMergeStrategyForPath,
     {},
@@ -4789,17 +4808,29 @@ var LoadedSettings = class {
         throw new Error(`Invalid scope: ${scope}`);
     }
   }
-  setValue(scope, key, value, assertCanCommit) {
+  setValue(scope, key, value, assertCanCommit, opts = {}) {
     if (key === "model.name" && typeof value === "string") {
       value = stripRuntimeSnapshotPrefix(value);
     }
     assertCanCommit?.();
     const settingsFile = this.forScope(scope);
+    const replacePath = key === "mcpServers" ? key.split(".") : [];
+    if (opts.throwOnWriteFailure) {
+      saveSettings(
+        settingsFile,
+        createSettingsUpdate(key, value),
+        replacePath,
+        {
+          throwOnWriteFailure: true
+        }
+      );
+    }
     setNestedPropertySafe(settingsFile.settings, key, value);
     setNestedPropertySafe(settingsFile.originalSettings, key, value);
     this._merged = this.computeMergedSettings();
-    const replacePath = key === "mcpServers" ? key.split(".") : [];
-    saveSettings(settingsFile, createSettingsUpdate(key, value), replacePath);
+    if (!opts.throwOnWriteFailure) {
+      saveSettings(settingsFile, createSettingsUpdate(key, value), replacePath);
+    }
   }
   setValues(writes, onScopeCommitted, assertCanCommit) {
     const scopes = /* @__PURE__ */ new Set();

package/chunks/{chunk-33FNCQSY.js → chunk-7MH4J33A.js}

@@ -10,11 +10,11 @@ import {
 } from "./chunk-CPBF7KYF.js";
 import {
   atomicWriteJSON
-} from "./chunk-UH7Z7Y45.js";
+} from "./chunk-FOGU3LJX.js";
 import {
   Storage,
   isNodeError
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-S7CV4KO6.js → chunk-AB4A73VL.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-J26HHFI5.js";
 import {
   ChannelWorkerStartupError
-} from "./chunk-MKVZE4ZJ.js";
+} from "./chunk-KTJFU7RT.js";
 import {
   ChannelDeliveryError,
   ChannelWebhookEnqueueError
 } from "./chunk-YP5KH5Y7.js";
 import {
   CHANNEL_LOOP_MCP_SERVER_NAME
-} from "./chunk-DIEFUBV6.js";
+} from "./chunk-DIWZNWZT.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";