@qwen-code/qwen-code 0.21.7 → 0.21.8-nightly.20260810.55e20db328

package/chunks/{chunk-NLREQJFK.js → chunk-DA4HRSBW.js}

@@ -26,6 +26,19 @@ var BridgeTimeoutError = class extends Error {
     this.timeoutMs = timeoutMs;
   }
 };
+var SessionRestoreTimeoutError = class extends BridgeTimeoutError {
+  static {
+    __name(this, "SessionRestoreTimeoutError");
+  }
+  sessionId;
+  action;
+  constructor(sessionId, action, timeoutMs) {
+    super(`session/${action}`, timeoutMs);
+    this.name = "SessionRestoreTimeoutError";
+    this.sessionId = sessionId;
+    this.action = action;
+  }
+};
 var BridgeChannelClosedError = class extends Error {
   static {
     __name(this, "BridgeChannelClosedError");
@@ -335,6 +348,7 @@ var MODEL_CONFIG_ERROR_NAMES = /* @__PURE__ */ new Set([
   "MissingAnthropicBaseUrlEnvError"
 ]);
 function mapDomainErrorToErrorKind(err) {
+  if (err instanceof SessionRestoreTimeoutError) return "restore_timeout";
   if (err instanceof BridgeTimeoutError) return "init_timeout";
   if (err instanceof BridgeChannelClosedError) return "protocol_error";
   if (err instanceof MissingCliEntryError) return "missing_binary";
@@ -359,6 +373,7 @@ __name(mapDomainErrorToErrorKind, "mapDomainErrorToErrorKind");
 export {
   STATUS_SCHEMA_VERSION,
   BridgeTimeoutError,
+  SessionRestoreTimeoutError,
   BridgeChannelClosedError,
   MissingCliEntryError,
   SERVE_STATUS_EXT_METHODS,

package/chunks/{chunk-RNVQB725.js → chunk-DPMJLKUP.js}

@@ -5,12 +5,12 @@ import {
 } from "./chunk-4NFY2S7N.js";
 import {
   t
-} from "./chunk-DBOFL3LQ.js";
+} from "./chunk-BL65MO72.js";
 import {
   fetchGitDiff,
   findProviderByCredentials,
   resolveMetadataKey
-} from "./chunk-Y7E5LNLO.js";
+} from "./chunk-47ZUMGGY.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-DIEFUBV6.js → chunk-DX3RGJMS.js}

@@ -71,6 +71,7 @@ var PairingStore = class {
   dir;
   pendingPath;
   allowlistPath;
+  groupAllowlistPath;
   migratedSentinelPath;
   /**
    * @param channelName Channel name the state is keyed by.
@@ -88,6 +89,7 @@ var PairingStore = class {
     const safeChannelName = encodeURIComponent(channelName);
     this.pendingPath = path2.join(this.dir, `${safeChannelName}-pairing.json`);
     this.allowlistPath = path2.join(this.dir, `${safeChannelName}-allowlist.json`);
+    this.groupAllowlistPath = path2.join(this.dir, `${safeChannelName}-groups.json`);
     this.migratedSentinelPath = path2.join(this.dir, `${safeChannelName}.migrated`);
     if (workspaceCwd) {
       this.migrateLegacyState(channelsRoot, channelName);
@@ -131,6 +133,10 @@ var PairingStore = class {
         [
           path2.join(channelsRoot, `${channelName}-allowlist.json`),
           this.allowlistPath
+        ],
+        [
+          path2.join(channelsRoot, `${channelName}-groups.json`),
+          this.groupAllowlistPath
         ]
       ];
       this.ensureDir();
@@ -164,30 +170,44 @@ var PairingStore = class {
     const list = this.readAllowlist();
     return list.includes(senderId);
   }
+  isGroupApproved(groupId) {
+    return this.readGroupAllowlist().includes(groupId);
+  }
   /**
    * Create a pairing request for an unknown sender.
-   * Returns the code if created, or null if the pending cap is reached.
-   * If the sender already has a non-expired pending request, returns that code.
+   * Returns the code if created; if the subject already has a non-expired
+   * pending request, returns that code. Rejects with `sender_pending` when
+   * the sender already holds a request for another subject, or
+   * `cap_reached` when the pending cap is reached.
    */
   createRequest(senderId, senderName) {
+    return this.createSubjectRequest({ type: "user", id: senderId, name: senderName }, senderId, senderName);
+  }
+  createGroupRequest(groupId, groupName, senderId, senderName) {
+    return this.createSubjectRequest({ type: "group", id: groupId, name: groupName }, senderId, senderName);
+  }
+  createSubjectRequest(subject, senderId, senderName) {
     const pending = this.readPending();
     const now = Date.now();
     const active = pending.filter((r) => now - r.createdAt < EXPIRY_MS);
-    const existing = active.find((r) => r.senderId === senderId);
+    const existing = active.find((request) => request.subject.type === subject.type && request.subject.id === subject.id);
     if (existing) {
-      return existing.code;
+      return { code: existing.code };
+    }
+    if (active.some((request) => request.senderId === senderId)) {
+      return { rejected: "sender_pending" };
     }
     if (active.length >= MAX_PENDING) {
-      return null;
+      return { rejected: "cap_reached" };
     }
     const code = generateCode();
-    active.push({ senderId, senderName, code, createdAt: now });
+    active.push({ senderId, senderName, subject, code, createdAt: now });
     this.writePending(active);
-    return code;
+    return { code };
   }
   /**
    * Approve a pairing request by code.
-   * Returns the sender ID if found, or null if not found / expired.
+   * Returns the request if found, or null if not found / expired.
    */
   approve(code) {
     const pending = this.readPending();
@@ -196,13 +216,21 @@ var PairingStore = class {
     if (idx === -1)
       return null;
     const request = pending[idx];
+    if (request.subject.type === "group") {
+      const groups = this.readGroupAllowlist(true);
+      if (!groups.includes(request.subject.id)) {
+        groups.push(request.subject.id);
+        this.writeGroupAllowlist(groups);
+      }
+    } else {
+      const users = this.readAllowlist();
+      if (!users.includes(request.subject.id)) {
+        users.push(request.subject.id);
+        this.writeAllowlist(users);
+      }
+    }
     pending.splice(idx, 1);
     this.writePending(pending);
-    const list = this.readAllowlist();
-    if (!list.includes(request.senderId)) {
-      list.push(request.senderId);
-      this.writeAllowlist(list);
-    }
     return request;
   }
   listPending() {
@@ -213,6 +241,9 @@ var PairingStore = class {
   getAllowlist() {
     return this.readAllowlist();
   }
+  getGroupAllowlist() {
+    return this.readGroupAllowlist();
+  }
   revoke(senderId) {
     const list = this.readAllowlist();
     const next = list.filter((id) => id !== senderId);
@@ -222,6 +253,15 @@ var PairingStore = class {
     this.writeAllowlist(next);
     return true;
   }
+  revokeGroup(groupId) {
+    const list = this.readGroupAllowlist();
+    const next = list.filter((id) => id !== groupId);
+    if (next.length === list.length) {
+      return false;
+    }
+    this.writeGroupAllowlist(next);
+    return true;
+  }
   ensureDir() {
     if (!fs2.existsSync(this.dir)) {
       fs2.mkdirSync(this.dir, { recursive: true });
@@ -230,7 +270,15 @@ var PairingStore = class {
   readPending() {
     try {
       const data = fs2.readFileSync(this.pendingPath, "utf-8");
-      return JSON.parse(data);
+      const requests = JSON.parse(data);
+      return requests.map((request) => ({
+        ...request,
+        subject: request.subject ?? {
+          type: "user",
+          id: request.senderId,
+          name: request.senderName
+        }
+      }));
     } catch {
       return [];
     }
@@ -251,6 +299,28 @@ var PairingStore = class {
     this.ensureDir();
     fs2.writeFileSync(this.allowlistPath, JSON.stringify(list, null, 2));
   }
+  readGroupAllowlist(strict = false) {
+    try {
+      const data = fs2.readFileSync(this.groupAllowlistPath, "utf-8");
+      return JSON.parse(data);
+    } catch (err) {
+      const exists = fs2.existsSync(this.groupAllowlistPath);
+      if (strict && exists) {
+        throw new Error(`refusing to rewrite unreadable group allowlist "${path2.basename(this.groupAllowlistPath)}": ${err?.message}`);
+      }
+      if (exists) {
+        process.stderr.write(`[PairingStore] group allowlist "${path2.basename(this.groupAllowlistPath)}" is unreadable (${err?.message}); treating as empty \u2014 stored group approvals are not in effect and will be lost on the next approve
+`);
+      }
+      return [];
+    }
+  }
+  writeGroupAllowlist(list) {
+    this.ensureDir();
+    const tmpPath = `${this.groupAllowlistPath}.${process.pid}.tmp`;
+    fs2.writeFileSync(tmpPath, JSON.stringify(list, null, 2));
+    fs2.renameSync(tmpPath, this.groupAllowlistPath);
+  }
 };
 function generateCode() {
   let code = "";
@@ -457,6 +527,12 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { Readable, Writable } from "node:stream";
 import { EventEmitter } from "node:events";
+
+// packages/channels/base/dist/ChannelAgentBridge.js
+init_esbuild_shims();
+var CHANNEL_PROMPT_META_KEY = "qwen.channel.prompt";
+
+// packages/channels/base/dist/AcpBridge.js
 var MID_TURN_QUEUE_DRAIN_METHOD = "craft/drainMidTurnQueue";
 var TODO_STOP_GUARD_CONTINUATION_CLAIM_METHOD = "craft/claimTodoStopGuardContinuation";
 var ACP_EVENT_LOOP_STALL_RESTART_MS = 5 * 60 * 1e3;
@@ -624,7 +700,8 @@ var AcpBridge = class extends EventEmitter {
     try {
       await conn.prompt({
         sessionId,
-        prompt
+        prompt,
+        _meta: { [CHANNEL_PROMPT_META_KEY]: true }
       });
     } finally {
       this.off("textChunk", onChunk);
@@ -1066,21 +1143,28 @@ var GroupGate = class {
   }
   policy;
   groups;
-  constructor(policy = "disabled", groups = {}) {
+  pairingStore;
+  constructor(policy = "disabled", groups = {}, pairingStore) {
     this.policy = policy;
     this.groups = groups;
+    this.pairingStore = pairingStore ?? null;
   }
   /**
-   * Full group check: policy + allowlist + mention gating.
+   * Full group check: policy + allowlist + pairing + mention gating.
    * Evaluation order:
    *   1. groupPolicy (disabled → drop)
    *   2. group allowlist (allowlist mode, no match → drop)
-   *   3. mention gating (requireMention + not mentioned → drop silently)
+   *   3. group pairing (pairing mode, group not approved → drop; an explicit
+   *      mention or reply creates or returns a pending pairing request unless
+   *      `options.createPairingRequest` is false)
+   *   4. mention gating (requireMention + not mentioned → drop silently)
    *
-   * Mention gating runs before sender gate so that unmentioned messages
-   * in groups don't trigger pairing flows.
+   * Under the pairing policy the pairing step itself drops ambient
+   * (unmentioned, non-reply) messages before any request is created. Mention
+   * gating then runs before the sender gate so unmentioned messages in
+   * approved groups don't trigger sender pairing flows.
    */
-  check(envelope) {
+  check(envelope, options = {}) {
     if (!envelope.isGroup) {
       return { allowed: true };
     }
@@ -1092,6 +1176,17 @@ var GroupGate = class {
         return { allowed: false, reason: "not_allowlisted" };
       }
     }
+    if (this.policy === "pairing" && !this.pairingStore?.isGroupApproved(envelope.chatId)) {
+      if (options.createPairingRequest === false || !envelope.isMentioned && !envelope.isReplyToBot) {
+        return { allowed: false, reason: "pairing_trigger_required" };
+      }
+      const result = this.pairingStore?.createGroupRequest(envelope.chatId, envelope.chatName || envelope.chatId, envelope.senderId, envelope.senderName);
+      return {
+        allowed: false,
+        reason: "pairing_required",
+        pairing: result ?? { rejected: "cap_reached" }
+      };
+    }
     const groupConfig = this.groups[envelope.chatId] || this.groups["*"] || {};
     const requireMention = groupConfig.requireMention ?? true;
     if (requireMention && !envelope.isMentioned && !envelope.isReplyToBot) {
@@ -1099,6 +1194,9 @@ var GroupGate = class {
     }
     return { allowed: true };
   }
+  isGroupApproved(groupId) {
+    return this.pairingStore?.isGroupApproved(groupId) ?? false;
+  }
 };
 
 // packages/channels/base/dist/DmGate.js
@@ -1410,8 +1508,11 @@ var SenderGate = class {
         if (this.pairingStore?.isApproved(senderId)) {
           return { allowed: true };
         }
-        const code = this.pairingStore?.createRequest(senderId, senderName || senderId);
-        return { allowed: false, pairingCode: code ?? null };
+        const result = this.pairingStore?.createRequest(senderId, senderName || senderId);
+        return {
+          allowed: false,
+          pairing: result ?? { rejected: "cap_reached" }
+        };
       }
       default:
         throw new Error(`Unknown sender policy: ${this.policy}`);
@@ -2766,6 +2867,11 @@ var ChannelBase = class {
   memoryIntentClassifier;
   channelMemoryRecallObserver;
   groupHistory;
+  // Tracks the pairing code already announced per group so repeated triggers
+  // of the same pending request (extra mentions, parallel notification lanes)
+  // post the public notification once. In-memory by design: a restart can
+  // re-post once per still-pending request, but never per trigger.
+  groupPairingNotified = /* @__PURE__ */ new Map();
   loopController;
   observedContacts;
   observedContactEnvelopes = /* @__PURE__ */ new WeakSet();
@@ -3068,9 +3174,9 @@ var ChannelBase = class {
     this.loopController = options?.loopController;
     this.observedContacts = options?.observedContacts;
     this.bridgeRecovery = options?.bridgeRecovery;
-    this.groupGate = new GroupGate(config.groupPolicy, config.groups);
+    const pairingStore = config.senderPolicy === "pairing" || config.groupPolicy === "pairing" ? new PairingStore(name, config.cwd) : void 0;
+    this.groupGate = new GroupGate(config.groupPolicy, config.groups, pairingStore);
     this.dmGate = new DmGate(config.dmPolicy);
-    const pairingStore = config.senderPolicy === "pairing" ? new PairingStore(name, config.cwd) : void 0;
     this.gate = new SenderGate(config.senderPolicy, config.allowedUsers, pairingStore);
     this.router = options?.router || new SessionRouter(bridge, config.cwd, config.sessionScope);
     this.registerSharedCommands();
@@ -3457,6 +3563,7 @@ var ChannelBase = class {
       text: coalesced,
       alreadyPrefixed: true,
       referencedText: void 0,
+      mentionedMemberIds: void 0,
       attachments: void 0,
       metadata: void 0,
       imageBase64: void 0,
@@ -4841,7 +4948,7 @@ ${requestList}`);
       isMentioned: true,
       isReplyToBot: true
     };
-    return this.groupGate.check(envelope).allowed && this.dmGate.check(envelope).allowed && this.gate.isAllowed(normalizedTarget.senderId) && this.isAuthorizedForSharedSession(envelope);
+    return this.groupGate.check(envelope, { createPairingRequest: false }).allowed && this.dmGate.check(envelope).allowed && (normalizedTarget.isGroup && this.config.groupPolicy === "pairing" ? true : this.gate.isAllowed(normalizedTarget.senderId)) && this.isAuthorizedForSharedSession(envelope);
   }
   /** Check if a message text matches a registered local command. */
   isLocalCommand(text) {
@@ -5511,7 +5618,7 @@ ${sanitizePromptText(entry.text).trim()}` : `No channel memory entry ${intent.id
       return;
     }
     const senderId = truncateGroupHistoryField(envelope.senderId);
-    if (!this.gate.isAllowed(senderId)) {
+    if (this.config.groupPolicy !== "pairing" && !this.gate.isAllowed(senderId)) {
       return;
     }
     const entry = {
@@ -5534,7 +5641,11 @@ ${sanitizePromptText(entry.text).trim()}` : `No channel memory entry ${intent.id
       return [];
     }
     try {
-      return this.groupHistory.drain(this.groupHistoryKey(envelope), limit);
+      const entries = this.groupHistory.drain(this.groupHistoryKey(envelope), limit);
+      if (this.config.groupPolicy === "pairing" && !this.groupGate.isGroupApproved(envelope.chatId)) {
+        return [];
+      }
+      return entries;
     } catch (err) {
       process.stderr.write(`[${this.name}] failed to drain group history for chat ${sanitizeLogText(envelope.chatId, 64)}: ${err instanceof Error ? err.message : err}
 `);
@@ -5560,7 +5671,7 @@ ${sanitizePromptText(entry.text).trim()}` : `No channel memory entry ${intent.id
     if (entries.length === 0) {
       return promptText;
     }
-    const lines = entries.filter((entry) => this.gate.isAllowed(entry.senderId));
+    const lines = this.config.groupPolicy === "pairing" ? entries : entries.filter((entry) => this.gate.isAllowed(entry.senderId));
     if (lines.length === 0) {
       return promptText;
     }
@@ -5578,8 +5689,18 @@ ${promptText}`;
   preflightInbound(envelope) {
     const groupResult = this.groupGate.check(envelope);
     if (!groupResult.allowed) {
+      if (groupResult.pairing !== void 0) {
+        this.logPreflightRejected("group_pairing_required");
+        return this.onGroupPairingRequired(envelope.chatId, groupResult.pairing, envelope.threadId).then(() => false).catch((err) => {
+          process.stderr.write(`[Channel:${this.name}] group pairing notification failed: ${sanitizeLogText(err instanceof Error ? err.message : String(err), 200)}
+`);
+          return false;
+        });
+      }
       if (groupResult.reason === "mention_required") {
         this.recordPendingGroupHistory(envelope);
+      } else if (groupResult.reason === "pairing_trigger_required") {
+        return false;
       } else {
         this.logPreflightRejected(`group_${groupResult.reason ?? "denied"}`);
       }
@@ -5590,11 +5711,15 @@ ${promptText}`;
       this.logPreflightRejected(`dm_${dmResult.reason ?? "denied"}`);
       return false;
     }
+    if (envelope.isGroup && this.config.groupPolicy === "pairing") {
+      this.markPreflighted(envelope);
+      return true;
+    }
     const result = this.gate.check(envelope.senderId, envelope.senderName);
     if (!result.allowed) {
-      if (result.pairingCode !== void 0) {
+      if (result.pairing !== void 0) {
         this.logPreflightRejected("sender_pairing_required");
-        return this.onPairingRequired(envelope.chatId, result.pairingCode, envelope.threadId).then(() => false).catch((err) => {
+        return this.onPairingRequired(envelope.chatId, result.pairing, envelope.threadId).then(() => false).catch((err) => {
           process.stderr.write(`[Channel:${this.name}] pairing notification failed: ${sanitizeLogText(err instanceof Error ? err.message : String(err), 200)}
 `);
           return false;
@@ -5654,6 +5779,27 @@ ${promptText}`;
 `);
     }
   }
+  onObservedContact(_envelope) {
+  }
+  /**
+   * Observations persisted for this channel, when a read path is configured.
+   * Adapters hydrate label caches from it after a restart so known labels are
+   * not reverted to raw IDs by the next initial write.
+   */
+  persistedObservedContacts() {
+    const list = this.observedContacts?.list;
+    if (!list)
+      return void 0;
+    try {
+      const graph = list();
+      return {
+        users: graph.users.filter((user) => user.channelName === this.name),
+        groups: graph.groups.filter((group) => group.channelName === this.name)
+      };
+    } catch {
+      return void 0;
+    }
+  }
   markPreflighted(envelope) {
     this.preflightedEnvelopes.add(envelope);
   }
@@ -5683,6 +5829,7 @@ ${promptText}`;
     if (this.observedContacts && !this.observedContactEnvelopes.has(envelope)) {
       this.observedContactEnvelopes.add(envelope);
       await this.recordObservedContact(envelope);
+      this.onObservedContact(envelope);
     }
     let memoryIntent = parseChannelMemoryIntent(envelope.text);
     let memoryIntentFromClassifier = false;
@@ -5755,6 +5902,15 @@ ${output}${exitLine}`);
     if ((envelope.isGroup || this.config.sessionScope === "single") && !envelope.alreadyPrefixed && !recognizedSlashCommand) {
       const who = sanitizeSenderName(envelope.senderName || envelope.senderId || "unknown");
       promptText = `[${who}] ${sanitizePromptText(promptText)}`;
+      if (envelope.mentionedMemberIds?.length) {
+        const ids = envelope.mentionedMemberIds.map((id) => sanitizeQuotedText(id, 64).trim()).filter((id) => id.length > 0 && id !== "\u2026");
+        if (ids.length > 0) {
+          const memberLabel = ids.length === 1 ? "member" : "members";
+          promptText = `[Mentioned ${ids.length} other group ${memberLabel}: ${ids.join(", ")}]
+
+${promptText}`;
+        }
+      }
     }
     if (envelope.referencedText) {
       const quoted = sanitizeQuotedText(envelope.referencedText, 500);
@@ -6081,6 +6237,7 @@ ${promptToSend}`;
             alreadyPrefixed: true,
             // Clear attachments/references — already resolved in original text
             referencedText: void 0,
+            mentionedMemberIds: void 0,
             attachments: void 0,
             metadata: void 0,
             imageBase64: void 0,
@@ -6098,14 +6255,34 @@ ${promptToSend}`;
     }));
     await current;
   }
-  async onPairingRequired(chatId, code, threadId) {
-    if (code) {
-      await this.sendThreadMessage(chatId, threadId, `Your pairing code is: ${code}
+  pairingRejectionMessage(rejected) {
+    return rejected === "sender_pending" ? "You already have a pending pairing request. It must be approved or expire before another can be created." : "Too many pending pairing requests. Please try again later.";
+  }
+  groupPairingRejectionMessage(rejected) {
+    return rejected === "sender_pending" ? "A pairing request cannot be created right now. Another member can mention the bot to start group approval, or try again later." : "Too many pending pairing requests. Please try again later.";
+  }
+  async onPairingRequired(chatId, result, threadId) {
+    if ("code" in result) {
+      await this.sendThreadMessage(chatId, threadId, `Your pairing code is: ${result.code}
 
 Ask the bot operator to approve you with:
-  qwen channel pairing approve ${this.name} ${code}`);
+  qwen channel pairing approve ${this.name} ${result.code}`);
     } else {
-      await this.sendThreadMessage(chatId, threadId, "Too many pending pairing requests. Please try again later.");
+      await this.sendThreadMessage(chatId, threadId, this.pairingRejectionMessage(result.rejected));
+    }
+  }
+  async onGroupPairingRequired(chatId, result, threadId) {
+    if ("code" in result) {
+      if (this.groupPairingNotified.get(chatId) === result.code) {
+        return;
+      }
+      await this.sendThreadMessage(chatId, threadId, `This group requires approval. Its pairing code is: ${result.code}
+
+Ask the bot operator to approve the group with:
+  qwen channel pairing approve ${this.name} ${result.code}`);
+      this.groupPairingNotified.set(chatId, result.code);
+    } else {
+      await this.sendThreadMessage(chatId, threadId, this.groupPairingRejectionMessage(result.rejected));
     }
   }
 };
@@ -6470,7 +6647,10 @@ var DaemonChannelBridge = class extends EventEmitter2 {
     }
     prompt.push({ type: "text", text });
     try {
-      const result = await session.prompt({ prompt }, controller.signal);
+      const result = await session.prompt({
+        prompt,
+        _meta: { [CHANNEL_PROMPT_META_KEY]: true }
+      }, controller.signal);
       await Promise.race([
         turnBarrier,
         new Promise((resolve3) => setTimeout(resolve3, 0))
@@ -7141,6 +7321,7 @@ export {
   ChannelLoopScheduler,
   ChannelBase,
   PollingChannelBase,
+  CHANNEL_PROMPT_META_KEY,
   CHANNEL_LOOP_MCP_SERVER_NAME,
   ACP_EVENT_LOOP_STALL_RESTART_MS,
   AcpBridge,

package/chunks/{chunk-33ACCIIY.js → chunk-DZUO626D.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-M6HMMKVG.js";
 import {
   isInternalPromptId
-} from "./chunk-2U3WZGZG.js";
+} from "./chunk-YGT2AUJ7.js";
 import {
   createDebugLogger
 } from "./chunk-OIVKILPI.js";