@qwen-code/qwen-code 0.21.6 → 0.21.7

package/chunks/{chunk-WNU7TZTO.js → chunk-P3LEG54R.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-Z4X5MTRT.js";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-UGTWD35F.js";
+} from "./chunk-NLREQJFK.js";
 import {
   loadSettings
-} from "./chunk-PPUOYL77.js";
+} from "./chunk-PQBHU2IA.js";
 import {
   SkillManager,
   isSafeModeEnv
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-Y7E5LNLO.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";

package/chunks/{chunk-VSALQLT7.js → chunk-PJOBIWUG.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   registerCleanup
-} from "./chunk-RHTTKJTP.js";
+} from "./chunk-EORNAQDT.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-PPUOYL77.js → chunk-PQBHU2IA.js}

@@ -21,12 +21,12 @@ import {
   getLanguageNameFromLocale,
   getLanguageSettingsOptions,
   t
-} from "./chunk-KHUA3NQV.js";
+} from "./chunk-DBOFL3LQ.js";
 import {
   getHomeEnvFallbackVars,
   loadEnvironment,
   preResolveHomeEnvOverrides
-} from "./chunk-RK2EE3T7.js";
+} from "./chunk-VOARQPTA.js";
 import {
   ENV_CORRUPTED_PATH,
   ENV_WAS_RECOVERED
@@ -34,7 +34,7 @@ import {
 import {
   isWorkspaceTrusted,
   updateSettingsFilePreservingFormat
-} from "./chunk-ACZRB7AD.js";
+} from "./chunk-6XU3PH66.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -46,13 +46,13 @@ import {
   DEFAULT_TOOL_RESULTS_TOTAL_CHARS_THRESHOLD,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-Y7E5LNLO.js";
 import {
   stripRuntimeSnapshotPrefix
-} from "./chunk-DIT4V3XH.js";
+} from "./chunk-RMH5OWLD.js";
 import {
   DEFAULT_QWEN_CUSTOM_IGNORE_FILE_NAMES
-} from "./chunk-432XCUHF.js";
+} from "./chunk-EQL65XGA.js";
 import {
   DEFAULT_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH,
   SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH_LIMIT
@@ -62,7 +62,7 @@ import {
   Storage,
   createDebugLogger,
   getErrorMessage
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -2636,6 +2636,19 @@ var SETTINGS_SCHEMA = {
         default: false,
         description: "When true, HTTP hooks may target private/link-local IP ranges (the SSRF IP-range checks are skipped). Cloud metadata hostnames (e.g. 169.254.169.254, metadata.google.internal) remain blocked. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored so a cloned repository cannot self-grant this bypass. Enable only in trusted, managed environments, and pair with security.allowedHttpHookUrls.",
         showInDialog: false
+      },
+      allowedInsecureVoiceBaseUrls: {
+        type: "array",
+        label: "Allowed Insecure Voice Base URLs",
+        category: "Security",
+        requiresRestart: false,
+        default: [],
+        description: "Complete voice base URLs that may use HTTP or private-network addresses. Entries must include an explicit http:// or https:// scheme and the full provider path; only URL serialization and trailing slashes are normalized. Wildcards are not supported; metadata, link-local, local-use NAT64, 6to4, and Teredo addresses remain blocked even when listed, as do hostnames that resolve to loopback; IPv4-mapped, IPv4-compatible, and well-known NAT64 (64:ff9b::/96) literals are classified by their embedded IPv4 address. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored. Enable only for trusted endpoints in managed private networks. Cleartext HTTP also exposes the provider API key transmitted in the Authorization header. An allowlisted hostname is only as trustworthy as its DNS; prefer IP-literal entries when the gateway address is stable.",
+        showInDialog: false,
+        items: {
+          type: "string",
+          description: "Complete voice provider base URL with explicit scheme and full path (no wildcards)"
+        }
       }
     }
   },
@@ -4695,6 +4708,11 @@ function getSettingsWarnings(loadedSettings) {
       `Warning: security.allowPrivateNetworkHooks in workspace settings (${workspaceFile.path}) is ignored. This setting is only honored from User, System, or SystemDefaults scope settings.`
     );
   }
+  if (workspaceFile.rawJson !== void 0 && workspaceFile.originalSettings.security?.allowedInsecureVoiceBaseUrls !== void 0) {
+    warningSet.add(
+      `Warning: security.allowedInsecureVoiceBaseUrls in workspace settings (${workspaceFile.path}) is ignored. This setting is only honored from User, System, or SystemDefaults scope settings.`
+    );
+  }
   return [...warningSet];
 }
 __name(getSettingsWarnings, "getSettingsWarnings");
@@ -4710,19 +4728,20 @@ function tagMcpServerScope(settings, scope) {
   return { ...settings, mcpServers: tagged };
 }
 __name(tagMcpServerScope, "tagMcpServerScope");
-function stripWorkspacePrivateNetworkHooks(settings) {
-  if (settings.security?.allowPrivateNetworkHooks === void 0) {
+function stripWorkspaceSecurityBypasses(settings) {
+  if (settings.security?.allowPrivateNetworkHooks === void 0 && settings.security?.allowedInsecureVoiceBaseUrls === void 0) {
     return settings;
   }
-  const { allowPrivateNetworkHooks: _stripped, ...restSecurity } = settings.security;
+  const {
+    allowPrivateNetworkHooks: _privateHooks,
+    allowedInsecureVoiceBaseUrls: _insecureVoice,
+    ...restSecurity
+  } = settings.security;
   return { ...settings, security: restSecurity };
 }
-__name(stripWorkspacePrivateNetworkHooks, "stripWorkspacePrivateNetworkHooks");
+__name(stripWorkspaceSecurityBypasses, "stripWorkspaceSecurityBypasses");
 function mergeSettings(system, systemDefaults, user, workspace, isTrusted) {
-  const safeWorkspace = isTrusted ? tagMcpServerScope(
-    stripWorkspacePrivateNetworkHooks(workspace),
-    "workspace"
-  ) : {};
+  const safeWorkspace = isTrusted ? tagMcpServerScope(stripWorkspaceSecurityBypasses(workspace), "workspace") : {};
   return customDeepMerge(
     getMergeStrategyForPath,
     {},
@@ -4789,17 +4808,29 @@ var LoadedSettings = class {
         throw new Error(`Invalid scope: ${scope}`);
     }
   }
-  setValue(scope, key, value, assertCanCommit) {
+  setValue(scope, key, value, assertCanCommit, opts = {}) {
     if (key === "model.name" && typeof value === "string") {
       value = stripRuntimeSnapshotPrefix(value);
     }
     assertCanCommit?.();
     const settingsFile = this.forScope(scope);
+    const replacePath = key === "mcpServers" ? key.split(".") : [];
+    if (opts.throwOnWriteFailure) {
+      saveSettings(
+        settingsFile,
+        createSettingsUpdate(key, value),
+        replacePath,
+        {
+          throwOnWriteFailure: true
+        }
+      );
+    }
     setNestedPropertySafe(settingsFile.settings, key, value);
     setNestedPropertySafe(settingsFile.originalSettings, key, value);
     this._merged = this.computeMergedSettings();
-    const replacePath = key === "mcpServers" ? key.split(".") : [];
-    saveSettings(settingsFile, createSettingsUpdate(key, value), replacePath);
+    if (!opts.throwOnWriteFailure) {
+      saveSettings(settingsFile, createSettingsUpdate(key, value), replacePath);
+    }
   }
   setValues(writes, onScopeCommitted, assertCanCommit) {
     const scopes = /* @__PURE__ */ new Set();

package/chunks/{chunk-WO2B5E5B.js → chunk-Q3JQ7OSU.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-4NFY2S7N.js";
 import {
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   wrapper_default
 } from "./chunk-TYAMGABM.js";

package/chunks/{chunk-IMOQO6YL.js → chunk-QETYKPMG.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   getEffectiveSupportedModes
-} from "./chunk-TOGZTG4X.js";
+} from "./chunk-RNVQB725.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-DVBEGGLG.js → chunk-RERATVSK.js}

@@ -2,12 +2,12 @@
 "use strict";
 import {
   buildPermissionSettings
-} from "./chunk-CA4UIDFU.js";
+} from "./chunk-6GONZVLS.js";
 import {
   resolveVoiceStreamConfig,
   resolveVoiceTranscriptionConfig,
   transcribeVoiceAudio
-} from "./chunk-O7V7N4G7.js";
+} from "./chunk-AE77C5ZU.js";
 import {
   getVoiceSettingsScope,
   isSelectableVoiceModel,
@@ -16,7 +16,7 @@ import {
   readVoiceMode,
   readVoiceModel,
   resolveVoiceTransport
-} from "./chunk-C4CBJQKY.js";
+} from "./chunk-55LYDVPU.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
@@ -42,7 +42,7 @@ import {
   createIdleWorkspaceProvidersStatus,
   createIdleWorkspaceSkillsStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-UGTWD35F.js";
+} from "./chunk-NLREQJFK.js";
 import {
   McpServerNotFoundError,
   McpServerRestartFailedError,
@@ -55,19 +55,19 @@ import {
 import {
   getPersistScopeForModelSelection,
   loadSettings
-} from "./chunk-PPUOYL77.js";
+} from "./chunk-PQBHU2IA.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-ACZRB7AD.js";
+} from "./chunk-6XU3PH66.js";
 import {
   ModelsConfig,
   SkillManager,
   require_yauzl
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-Y7E5LNLO.js";
 import {
   Storage,
   createDebugLogger
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -142,7 +142,8 @@ function buildWorkspaceVoiceSettingsWrites(settings, update, opts = {}) {
 __name(buildWorkspaceVoiceSettingsWrites, "buildWorkspaceVoiceSettingsWrites");
 function createVoiceModelSource(settings) {
   return new ModelsConfig({
-    modelProvidersConfig: settings.merged.modelProviders
+    modelProvidersConfig: settings.merged.modelProviders,
+    providerProtocolConfig: settings.merged.providerProtocol
   });
 }
 __name(createVoiceModelSource, "createVoiceModelSource");