@qwen-code/qwen-code 0.21.8-nightly.20260810.55e20db328 → 0.21.9

package/chunks/{chunk-ZCJBCKL5.js → chunk-UJUM2SRN.js}

@@ -8,7 +8,7 @@ import {
   staleArgsWarning,
   validateAuthMethod,
   writeSkillArgs
-} from "./chunk-V47QNK5W.js";
+} from "./chunk-II6G3EY6.js";
 import {
   calculateCost,
   computeSessionStats,
@@ -17,7 +17,7 @@ import {
   findInlineMathExpressions,
   getSystemInfoFields,
   levelLabel
-} from "./chunk-DPMJLKUP.js";
+} from "./chunk-5RBDAGC6.js";
 import {
   isKittyProtocolEnabled
 } from "./chunk-NYX53SV4.js";
@@ -28,16 +28,16 @@ import {
 } from "./chunk-NV3F44FL.js";
 import {
   contextCommand
-} from "./chunk-TXO5BMR2.js";
+} from "./chunk-DH5YXSIF.js";
 import {
   themeManager
 } from "./chunk-CTJLZLB5.js";
 import {
   rollbackStandaloneUpdate
-} from "./chunk-ZI5IH2HP.js";
+} from "./chunk-RVSTTOJ4.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-P5ULXPK5.js";
+} from "./chunk-P2FK2HBV.js";
 import {
   GITHUB_WORKFLOW_PATHS,
   INSIGHT_CSS,
@@ -51,10 +51,11 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-5WZL724W.js";
+} from "./chunk-P3RBMQ4P.js";
 import {
   stripUnsafeCharacters,
-  toCodePoints
+  toCodePoints,
+  truncateToWidth
 } from "./chunk-4NFY2S7N.js";
 import {
   isValidSessionId
@@ -66,12 +67,12 @@ import {
   isVoiceEnabled,
   readVoiceMode,
   readVoiceModel
-} from "./chunk-HDYQYYWB.js";
+} from "./chunk-GAKGOXTC.js";
 import {
   getExtendedSystemInfo,
   getGitVersion,
   getNpmVersion
-} from "./chunk-2ASQDZSJ.js";
+} from "./chunk-7S4JBJLU.js";
 import {
   formatDuration,
   formatTokenCount
@@ -79,7 +80,7 @@ import {
 import {
   isInlineModelOverrideAllowed,
   parseAcpModelOption
-} from "./chunk-HWXGX534.js";
+} from "./chunk-KTQGGPGV.js";
 import {
   OUTPUT_LANGUAGE_AUTO,
   getAllSettingKeys,
@@ -91,22 +92,24 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   validateSettingValue,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-HKI3KHAO.js";
+} from "./chunk-JUWS2Z5K.js";
 import {
-  SUPPORTED_LANGUAGES,
   getCurrentLanguage,
-  getSupportedLanguageIds,
-  resolveSupportedLanguage,
   setLanguageAsync,
   t
-} from "./chunk-BL65MO72.js";
+} from "./chunk-WP5VOXF7.js";
+import {
+  SUPPORTED_LANGUAGES,
+  getSupportedLanguageIds,
+  resolveSupportedLanguage
+} from "./chunk-5EJZE3FP.js";
 import {
   getInstallationInfo
-} from "./chunk-2545EHZR.js";
+} from "./chunk-BIRWP6LU.js";
 import {
   isFolderTrustEnabled,
   loadTrustedFolders
-} from "./chunk-YR7ZQ4RD.js";
+} from "./chunk-ZOSTTOUJ.js";
 import {
   require_strip_json_comments
 } from "./chunk-NPQ5ZKRP.js";
@@ -180,13 +183,13 @@ import {
   runForkedAgent,
   tryGenerateSessionTitle,
   unregisterGoalHook
-} from "./chunk-47ZUMGGY.js";
+} from "./chunk-XX7QFP34.js";
 import {
   external_exports
 } from "./chunk-H6XPXXMH.js";
 import {
   resolveModelId
-} from "./chunk-F3II4BTZ.js";
+} from "./chunk-K4ADGWHU.js";
 import {
   getAutoSkillCuratorStatus,
   parse,
@@ -259,7 +262,7 @@ import {
   isCpuProfileRecording,
   startCpuProfile,
   stopCpuProfile
-} from "./chunk-WQYWK4DG.js";
+} from "./chunk-OGDIJKHK.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -2049,7 +2052,7 @@ var approvalModeCommand = {
         };
       }
     }
-    const autoModeNotices = mode === "auto" /* AUTO */ && priorMode !== "auto" /* AUTO */ && config ? await import("./useAutoAcceptIndicator-JDMI627A.js") : void 0;
+    const autoModeNotices = mode === "auto" /* AUTO */ && priorMode !== "auto" /* AUTO */ && config ? await import("./useAutoAcceptIndicator-VHLXIA7U.js") : void 0;
     if (config) {
       try {
         config.setApprovalMode(mode);
@@ -2816,6 +2819,88 @@ function resetBackgroundStateForSessionSwitch(config) {
   config.getWorkflowRunRegistry().reset();
 }
 __name(resetBackgroundStateForSessionSwitch, "resetBackgroundStateForSessionSwitch");
+var MAX_LISTED_BLOCKING_ENTRIES = 10;
+var MAX_BLOCKING_LABEL_WIDTH = 80;
+function describeBlockingBackgroundWork(config) {
+  const now = Date.now();
+  const entries = [];
+  for (const entry of config.getBackgroundTaskRegistry().getAll()) {
+    if (!entry.isBackgrounded || entry.status !== "running") continue;
+    entries.push({
+      startTime: entry.startTime,
+      id: entry.agentId,
+      label: buildBackgroundEntryLabel(entry),
+      status: entry.status,
+      isWorkflowRun: false
+    });
+  }
+  for (const entry of config.getMonitorRegistry().getRunning()) {
+    entries.push({
+      startTime: entry.startTime,
+      id: entry.monitorId,
+      label: entry.description,
+      status: entry.status,
+      isWorkflowRun: false
+    });
+  }
+  for (const entry of config.getBackgroundShellRegistry().getAll()) {
+    if (entry.status !== "running") continue;
+    entries.push({
+      startTime: entry.startTime,
+      id: entry.shellId,
+      label: entry.command,
+      status: entry.status,
+      isWorkflowRun: false
+    });
+  }
+  for (const entry of config.getWorkflowRunRegistry().list()) {
+    if (entry.status !== "running" && entry.status !== "pausing") continue;
+    entries.push({
+      startTime: entry.startTime,
+      id: entry.runId,
+      label: entry.meta?.name ?? entry.runId,
+      status: entry.status,
+      isWorkflowRun: true
+    });
+  }
+  if (entries.length === 0) return void 0;
+  entries.sort((a, b) => a.startTime - b.startTime);
+  const listed = entries.slice(0, MAX_LISTED_BLOCKING_ENTRIES);
+  const lines = listed.map((entry) => {
+    const label = truncateToWidth(
+      stripUnsafeCharacters(entry.label).replace(/[\r\n]+/g, " "),
+      MAX_BLOCKING_LABEL_WIDTH
+    );
+    return `  [${entry.id}] ${label} (${entry.status} ${formatDuration(
+      now - entry.startTime,
+      { hideTrailingZeros: true }
+    )})`;
+  });
+  const overflow = entries.length - listed.length;
+  if (overflow > 0) {
+    lines.push(`  \u2026and ${overflow} more`);
+  }
+  return {
+    lines,
+    hasTaskEntries: entries.some((entry) => !entry.isWorkflowRun),
+    hasWorkflowRuns: entries.some((entry) => entry.isWorkflowRun)
+  };
+}
+__name(describeBlockingBackgroundWork, "describeBlockingBackgroundWork");
+function buildBackgroundWorkBlockedMessage(config, baseMessage) {
+  const blocking = describeBlockingBackgroundWork(config);
+  if (!blocking) return baseMessage;
+  const surfaces = [
+    ...blocking.hasTaskEntries ? ["/tasks"] : [],
+    ...blocking.hasWorkflowRuns ? ["/workflows"] : []
+  ].join(" and ");
+  return [
+    baseMessage,
+    ...blocking.lines,
+    `Use ${surfaces} to inspect them, then retry.`
+  ].join("\n");
+}
+__name(buildBackgroundWorkBlockedMessage, "buildBackgroundWorkBlockedMessage");
 
 // packages/cli/src/ui/commands/clearCommand.ts
 import process2 from "node:process";
@@ -2838,12 +2923,12 @@ var clearCommand = {
     }
     if (config) {
       if (hasBlockingBackgroundWork(config)) {
-        const content = "Stop the current session's running background tasks before starting a new session.";
-        context.ui.setDebugMessage(content);
+        const baseMessage = "Stop the current session's running background tasks before starting a new session.";
+        context.ui.setDebugMessage(baseMessage);
         return {
           type: "message",
           messageType: "error",
-          content
+          content: buildBackgroundWorkBlockedMessage(config, baseMessage)
         };
       }
       config.getHookSystem()?.fireSessionEndEvent("clear" /* Clear */).catch((err) => {
@@ -6787,7 +6872,7 @@ var expandNowCommand = {
         content: t("History is already expanded in this session.")
       };
     }
-    const { expandCollapsedHistory } = await import("./resumeHistoryUtils-YUTPLHUH.js");
+    const { expandCollapsedHistory } = await import("./resumeHistoryUtils-UPCGRJUL.js");
     const updated = expandCollapsedHistory(history);
     loadHistory(updated);
     refreshStatic();
@@ -14023,10 +14108,10 @@ var updateCommand = {
       { performStandaloneUpdate },
       installationInfo
     ] = await Promise.all([
-      import("./updateCheck-EZMBTEIR.js"),
-      import("./processUtils-V5VSDIKS.js"),
-      import("./standalone-update-DJN2R3YW.js"),
-      import("./installationInfo-BWFHT7WU.js")
+      import("./updateCheck-AXWSO7KA.js"),
+      import("./processUtils-4YGB4RUZ.js"),
+      import("./standalone-update-2W26SRRO.js"),
+      import("./installationInfo-3YUGIP36.js")
     ]);
     const { formatUpdateInstructions, getInstallationInfo: getInstallationInfo2 } = installationInfo;
     const settings = context.services.settings;
@@ -16280,6 +16365,7 @@ export {
   formatApprovalModeDescription,
   hasBlockingBackgroundWork,
   resetBackgroundStateForSessionSwitch,
+  buildBackgroundWorkBlockedMessage,
   isAtCommand,
   hasSlashCommandPathSeparator,
   isSlashCommand,

package/chunks/{chunk-3KJQZEN3.js → chunk-UYAUA63Q.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   t
-} from "./chunk-BL65MO72.js";
+} from "./chunk-WP5VOXF7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-VFMASYQA.js

@@ -0,0 +1,389 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  writeStderrLineSafe
+} from "./chunk-KGJGEEVR.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/config/acp-channel-fallback.ts
+init_esbuild_shims();
+var QWEN_CODE_SERVE_ENV = "QWEN_CODE_SERVE";
+var QWEN_CODE_DESKTOP_ENV = "QWEN_CODE_DESKTOP";
+function resolveAcpChannelFallback(env = process.env) {
+  if (env[QWEN_CODE_DESKTOP_ENV] === "1") {
+    return "desktop";
+  }
+  if (env[QWEN_CODE_SERVE_ENV] === "1") {
+    return "daemon";
+  }
+  return "ACP";
+}
+__name(resolveAcpChannelFallback, "resolveAcpChannelFallback");
+
+// packages/cli/src/config/shared-env-keys.ts
+init_esbuild_shims();
+var DEFAULT_EXCLUDED_ENV_VARS = ["DEBUG", "DEBUG_MODE"];
+var ENV_CORRUPTED_PATH = "QWEN_CODE_SETTINGS_CORRUPTED_PATH";
+var ENV_WAS_RECOVERED = "QWEN_CODE_SETTINGS_WAS_RECOVERED";
+var ENV_ACP_REPEATED_TOOL_FAILURE_GUARD = "QWEN_CODE_ACP_REPEATED_TOOL_FAILURE_GUARD";
+var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
+  "QWEN_HOME",
+  "QWEN_RUNTIME_DIR",
+  "QWEN_CODE_MCP_APPROVALS_PATH",
+  "QWEN_CODE_TRUSTED_FOLDERS_PATH",
+  // Runtime attribution markers are stamped by trusted launchers. A project
+  // `.env` must not spoof client channel telemetry.
+  QWEN_CODE_SERVE_ENV,
+  QWEN_CODE_DESKTOP_ENV,
+  ENV_CORRUPTED_PATH,
+  ENV_WAS_RECOVERED,
+  // This is an operator rollout policy. A project must not be able to promote
+  // itself from the default shadow cohort into warning or enforcement.
+  ENV_ACP_REPEATED_TOOL_FAILURE_GUARD,
+  // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)
+  // disable TLS certificate verification for all outbound API connections. A
+  // project `.env` must never enable either — that would let an untrusted repo
+  // silently turn off MITM protection. Opt-in stays with the user via the
+  // `--insecure` flag, the shell environment, or a home `.env`. The initial
+  // `.env` load only consults this list, so both keys must be here (not just
+  // RELOAD_EXCLUDED_KEYS, which only applies on reload).
+  "QWEN_TLS_INSECURE",
+  "NODE_TLS_REJECT_UNAUTHORIZED",
+  // NODE_EXTRA_CA_CERTS reaches the same outcome by adding a TLS trust
+  // anchor instead of disabling verification.
+  "NODE_EXTRA_CA_CERTS",
+  // The non-Node TLS trust-anchor vars reach the SAME MITM outcome for the
+  // curl/git/openssl/python tools a session subprocess routinely shells out
+  // to: they are honored unconditionally as a CA bundle/dir, and npm/pip
+  // honor their own equivalents (npm_config_cafile / npm_config_ca / PIP_CERT
+  // as attacker CAs, npm_config_strict_ssl=false disables verification with
+  // no CA at all; GIT_SSL_CAPATH is git's directory-form twin of
+  // GIT_SSL_CAINFO). A project `.env` pointing any of them at an attacker CA
+  // lets an untrusted repo silently intercept token-bearing traffic
+  // (git/npm/pip fetches) for every workspace's sessions — the exact outcome
+  // NODE_EXTRA_CA_CERTS is blocked for. Like NODE_EXTRA_CA_CERTS these stay
+  // reject-from-project-`.env` only: a value the operator set in their own
+  // login shell or home `.env` is their trusted choice and is preserved.
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "CURL_CA_BUNDLE",
+  "REQUESTS_CA_BUNDLE",
+  "GIT_SSL_CAINFO",
+  "GIT_SSL_CAPATH",
+  "npm_config_cafile",
+  "npm_config_ca",
+  // npm treats underscore/hyphen spellings of a config key as the same key
+  // (see canonicalLoaderKey below), so both forms of strict-ssl are listed.
+  "npm_config_strict_ssl",
+  "npm_config_strict-ssl",
+  "PIP_CERT",
+  // CURL_HOME / WGETRC redirect curl/wget at attacker rc files
+  // (`$CURL_HOME/.curlrc`, the file WGETRC names) whose `proxy`, `cacert`, or
+  // `insecure` directives intercept or downgrade the same token-bearing
+  // traffic — the config-file-redirect class this list already blocks for npm
+  // (`npm_config_userconfig`), git (`GIT_CONFIG_GLOBAL`), and OpenSSL
+  // (`OPENSSL_CONF`).
+  "CURL_HOME",
+  "WGETRC",
+  // PIP_CONFIG_FILE redirects all of pip's configuration at the file it
+  // names — index-url, trusted-host, proxy, cert, or client-cert in an
+  // attacker file sends session pip traffic or credentials to attacker
+  // infrastructure — the same config-file-redirect class as
+  // npm_config_userconfig and GIT_CONFIG_GLOBAL.
+  "PIP_CONFIG_FILE",
+  // The git command-execution env family: git runs these on any invocation in
+  // a session subprocess. GIT_SSH_COMMAND / GIT_SSH (its documented legacy
+  // counterpart, still exec'd by git for SSH transports) / GIT_EXTERNAL_DIFF
+  // execute a command directly; GIT_ASKPASS / GIT_PROXY_COMMAND / GIT_EDITOR
+  // / GIT_SEQUENCE_EDITOR are exec'd conditionally (credential prompt, proxy
+  // transport, editor, `git rebase -i` todo-list edit);
+  // GIT_EXEC_PATH redirects git's own remote-helper/subcommand lookup at an
+  // attacker directory and GIT_TEMPLATE_DIR plants hooks that run after the
+  // next clone/init; GIT_CONFIG_* injects arbitrary config (`core.hooksPath`,
+  // `core.fsmonitor`, …) that turns a routine `git commit` into
+  // attacker-code execution as the daemon user — GIT_CONFIG_PARAMETERS
+  // carries the same injection as one quoted string, so it is blocked with
+  // GIT_CONFIG_COUNT and the numbered pairs. core/utils/git-branches.ts
+  // scrubs the config-injection subset from the repo's own git invocations,
+  // so a project `.env` setting this family contradicts that model. Numbered
+  // GIT_CONFIG_KEY_<n>/GIT_CONFIG_VALUE_<n> pairs are matched by numeric
+  // suffix below.
+  "GIT_SSH_COMMAND",
+  "GIT_SSH",
+  "GIT_EXEC_PATH",
+  "GIT_TEMPLATE_DIR",
+  "GIT_ASKPASS",
+  "GIT_PROXY_COMMAND",
+  "GIT_EDITOR",
+  "GIT_SEQUENCE_EDITOR",
+  "GIT_EXTERNAL_DIFF",
+  "GIT_CONFIG_GLOBAL",
+  "GIT_CONFIG_SYSTEM",
+  // git merges `$XDG_CONFIG_HOME/git/config` with `~/.gitconfig`, so a
+  // project `.env` redirecting XDG_CONFIG_HOME plants the same config
+  // injection (`core.hooksPath`, …) the GIT_CONFIG_* keys block — without
+  // naming a git config file at all.
+  "XDG_CONFIG_HOME",
+  "GIT_CONFIG_COUNT",
+  "GIT_CONFIG_PARAMETERS",
+  // git falls back to executing $SSH_ASKPASS for passphrase prompts (its
+  // askpass order is GIT_ASKPASS > core.askPass > SSH_ASKPASS, and ssh runs
+  // it whenever SSH_ASKPASS_REQUIRE=force or no terminal is available), so a
+  // project `.env` pointing it at an attacker script is code execution on
+  // any git/ssh auth challenge. SSH_ASKPASS_REQUIRE stays settable: it only
+  // selects *when* the askpass program runs, and with SSH_ASKPASS
+  // project-blocked it has no program to execute.
+  "SSH_ASKPASS",
+  // less executes $LESSOPEN as an input preprocessor on every file a session
+  // views (and $LESSCLOSE on exit whenever the preprocessor ran), so a
+  // project `.env` setting either is attacker command execution the first
+  // time a session runs `less`.
+  "LESSOPEN",
+  "LESSCLOSE",
+  // node-gyp interpreter selection: node-gyp's find-python.js executes
+  // NODE_GYP_FORCE_PYTHON / npm_config_python / PYTHON as the build Python,
+  // so a project `.env` pointing them at an attacker script is code execution
+  // during any native-addon `npm install` in another workspace's session.
+  // Unlike the pure-injection loader keys these have a legitimate
+  // operator-shell use (selecting a real interpreter), so they are
+  // reject-from-project-`.env` only, not scrubbed from the launch env.
+  "NODE_GYP_FORCE_PYTHON",
+  "npm_config_python",
+  "PYTHON",
+  // CPython executes $PYTHONSTARTUP at interactive startup — the Python
+  // analogue of NODE_REPL_EXTERNAL_MODULE. It stays reject-only (like
+  // PYTHON) because operators legitimately set it in their own shells.
+  "PYTHONSTARTUP",
+  // git's documented editor fallback chain (GIT_EDITOR → core.editor →
+  // $VISUAL → $EDITOR) executes these exactly like the blocked GIT_EDITOR,
+  // and the CLI's own useLaunchEditor spawns them from ordinary interactive
+  // flows.
+  "VISUAL",
+  "EDITOR",
+  // npm runs `$npm_config_git` as the git binary for install-from-git and
+  // similar flows, so a project `.env` pointing it at an attacker script is
+  // the same exec redirect as the interpreter keys above.
+  "npm_config_git",
+  // The CLI itself execs $BROWSER via openBrowserSecurely (core/utils/
+  // secure-browser-launcher.ts) before any CI/DISPLAY gate, so a project
+  // `.env` pointing it at an attacker script runs on any browser-launch
+  // flow.
+  "BROWSER",
+  // QWEN_CLI_ENTRY is the script path daemon-spawned session processes run.
+  // A project `.env` or settings.env fixing it turns
+  // `cd <untrusted repo> && qwen serve` into code execution as the daemon
+  // via an attacker-chosen ACP entrypoint, for every workspace's sessions.
+  "QWEN_CLI_ENTRY",
+  // QWEN_CDP_MCP_COMMAND is the command the daemon spawns as the
+  // browser-automation MCP adapter, and QWEN_SERVE_CDP_TUNNEL_OVER_WS
+  // switches that tunnel surface on. A project `.env` or settings.env fixing
+  // either hijacks the daemon the same way QWEN_CLI_ENTRY does; values the
+  // operator set in the daemon's launch env still apply.
+  "QWEN_CDP_MCP_COMMAND",
+  "QWEN_SERVE_CDP_TUNNEL_OVER_WS",
+  // DEV gates the daemon's inherited-loader-env scrub (run-qwen-serve.ts);
+  // only the dev harness (scripts/dev.js) stamps it into the launch env. A
+  // project file setting it would silently keep loader vars in the base env
+  // distributed to every workspace's session children — reopening the #8653
+  // vector for any repo whose .env happens to carry DEV=true.
+  "DEV"
+];
+var HARDCODED_PROJECT_ENV_EXCLUSIONS = new Set(
+  PROJECT_ENV_HARDCODED_EXCLUSIONS.map((key) => key.toLowerCase())
+);
+var HARDCODED_PROJECT_ENV_EXCLUSION_PATTERNS = [
+  /^git_config_key_\d+$/u,
+  /^git_config_value_\d+$/u
+];
+function isHardcodedProjectEnvExclusion(key) {
+  const lowerKey = key.toLowerCase();
+  return HARDCODED_PROJECT_ENV_EXCLUSIONS.has(lowerKey) || HARDCODED_PROJECT_ENV_EXCLUSION_PATTERNS.some(
+    (pattern) => pattern.test(lowerKey)
+  );
+}
+__name(isHardcodedProjectEnvExclusion, "isHardcodedProjectEnvExclusion");
+var HOME_ENV_BOOTSTRAP_KEYS = [
+  "QWEN_HOME",
+  "QWEN_RUNTIME_DIR",
+  "QWEN_CODE_MCP_APPROVALS_PATH",
+  "QWEN_CODE_TRUSTED_FOLDERS_PATH"
+];
+var INHERITED_LOADER_ENV_KEYS = [
+  "NODE_OPTIONS",
+  // npm maps its `node-options` config onto npm_config_node_options in the
+  // environment, and `npm run` lifecycle scripts apply it like NODE_OPTIONS —
+  // the same hijack through an adjacent key. The config-file keys are the
+  // same hijack one level up: they point npm at an attacker-chosen .npmrc
+  // that can itself set node-options/script-shell/ignore-scripts, and `npm
+  // run` itself exports them into the script environment.
+  "npm_config_node_options",
+  "npm_config_userconfig",
+  "npm_config_globalconfig",
+  "npm_config_script_shell",
+  "npm_config_prefix",
+  "NODE_PATH",
+  // OPENSSL_CONF points Node's startup crypto init at an attacker `.cnf`
+  // whose `nodejs_conf` section can dlopen an arbitrary engine/provider `.so`
+  // before any user code runs — a pure code-injection vector with no benign
+  // cross-workspace inheritance, so it is scrubbed like NODE_OPTIONS.
+  "OPENSSL_CONF",
+  // NODE_REPL_EXTERNAL_MODULE makes a spawned `node` REPL require() an
+  // attacker file at startup. npm_config_node_gyp overrides the node-gyp
+  // *script* npm's shim runs verbatim (`"$npm_config_node_gyp" "$@"`), and
+  // npm_config_init_module is require()d by `npm init` (even `-y`). All three
+  // are executable/module redirects with no legitimate login-shell use, so
+  // they join the scrubbed loader set rather than the reject-only tier.
+  "NODE_REPL_EXTERNAL_MODULE",
+  "npm_config_node_gyp",
+  "npm_config_init_module",
+  "LD_PRELOAD",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "BASH_ENV",
+  // zsh sources $ZDOTDIR/.zshenv on every invocation, including
+  // non-interactive `zsh -c` — the zsh analogue of BASH_ENV.
+  "ZDOTDIR"
+  // BASH_FUNC_* exported-function definitions are bash's other env-driven
+  // code-import channel (non-interactive `bash -c` still imports them);
+  // matched by prefix in isLoaderEnvKey, not listed here.
+];
+var canonicalLoaderKey = /* @__PURE__ */ __name((key) => key.toLowerCase().replace(/_/gu, "-"), "canonicalLoaderKey");
+var LOADER_ENV_KEYS = new Set(
+  INHERITED_LOADER_ENV_KEYS.map(canonicalLoaderKey)
+);
+function isLoaderEnvKey(key) {
+  const canonical = canonicalLoaderKey(key);
+  return canonical.startsWith("bash-func-") || LOADER_ENV_KEYS.has(canonical);
+}
+__name(isLoaderEnvKey, "isLoaderEnvKey");
+function scrubInheritedLoaderEnv(env, snapshotInto) {
+  const removedKeys = [];
+  for (const key of Object.keys(env)) {
+    if (isLoaderEnvKey(key)) {
+      const value = env[key];
+      if (snapshotInto && value !== void 0) snapshotInto.set(key, value);
+      delete env[key];
+      removedKeys.push(key);
+    }
+  }
+  return removedKeys;
+}
+__name(scrubInheritedLoaderEnv, "scrubInheritedLoaderEnv");
+function scrubAndReportInheritedLoaderEnv(env, commandLabel, processLabel, snapshotInto) {
+  const removedKeys = scrubInheritedLoaderEnv(env, snapshotInto);
+  if (removedKeys.length > 0) {
+    writeStderrLineSafe(
+      `${commandLabel}: scrubbed inherited loader env vars from the ${processLabel} process; session subprocesses will not inherit them: ${removedKeys.join(", ")}`
+    );
+  }
+  return removedKeys;
+}
+__name(scrubAndReportInheritedLoaderEnv, "scrubAndReportInheritedLoaderEnv");
+var sharedProcessEnvScrubDepth = 0;
+var sharedProcessEnvScrubOriginals = /* @__PURE__ */ new Map();
+function acquireInheritedLoaderEnvScrub(env, commandLabel, processLabel) {
+  sharedProcessEnvScrubDepth++;
+  const removedKeys = scrubAndReportInheritedLoaderEnv(
+    env,
+    commandLabel,
+    processLabel,
+    sharedProcessEnvScrubOriginals
+  );
+  let released = false;
+  return {
+    removedKeys,
+    release() {
+      if (released) return;
+      released = true;
+      sharedProcessEnvScrubDepth--;
+      if (sharedProcessEnvScrubDepth > 0) return;
+      for (const [key, value] of sharedProcessEnvScrubOriginals) {
+        if (!Object.hasOwn(env, key)) env[key] = value;
+      }
+      sharedProcessEnvScrubOriginals.clear();
+    }
+  };
+}
+__name(acquireInheritedLoaderEnvScrub, "acquireInheritedLoaderEnvScrub");
+var reportedLoaderKeyRejections = /* @__PURE__ */ new Map();
+var loaderKeyRejectionReporter;
+function setLoaderKeyRejectionReporter(reporter) {
+  loaderKeyRejectionReporter = reporter;
+}
+__name(setLoaderKeyRejectionReporter, "setLoaderKeyRejectionReporter");
+function clearLoaderKeyRejectionReporterIfCurrent(reporter) {
+  if (loaderKeyRejectionReporter === reporter) {
+    loaderKeyRejectionReporter = void 0;
+  }
+}
+__name(clearLoaderKeyRejectionReporterIfCurrent, "clearLoaderKeyRejectionReporterIfCurrent");
+function reportRejectedLoaderKeys(source, candidateKeys) {
+  const rejectedKeys = candidateKeys.filter(isLoaderEnvKey);
+  const warnedKeys = reportedLoaderKeyRejections.get(source) ?? /* @__PURE__ */ new Set();
+  const freshKeys = rejectedKeys.filter((key) => !warnedKeys.has(key));
+  if (freshKeys.length === 0) return rejectedKeys;
+  for (const key of freshKeys) warnedKeys.add(key);
+  reportedLoaderKeyRejections.set(source, warnedKeys);
+  if (loaderKeyRejectionReporter) {
+    loaderKeyRejectionReporter(source, freshKeys);
+  } else {
+    writeStderrLineSafe(
+      `qwen: ${source} cannot set loader-affecting env vars; ignored: ` + freshKeys.join(", ")
+    );
+  }
+  return rejectedKeys;
+}
+__name(reportRejectedLoaderKeys, "reportRejectedLoaderKeys");
+function resetLoaderKeyRejectionReportingForTesting() {
+  reportedLoaderKeyRejections.clear();
+}
+__name(resetLoaderKeyRejectionReportingForTesting, "resetLoaderKeyRejectionReportingForTesting");
+
+// packages/cli/src/config/compile-cache.ts
+init_esbuild_shims();
+var PENDING_COMPILE_CACHE_ENV = "QWEN_CODE_PENDING_COMPILE_CACHE";
+function publishPendingCompileCache(env = process.env) {
+  const pendingDirectory = env[PENDING_COMPILE_CACHE_ENV];
+  delete env[PENDING_COMPILE_CACHE_ENV];
+  if (pendingDirectory && !env["NODE_COMPILE_CACHE"] && env["NODE_DISABLE_COMPILE_CACHE"] !== "1") {
+    env["NODE_COMPILE_CACHE"] = pendingDirectory;
+  }
+}
+__name(publishPendingCompileCache, "publishPendingCompileCache");
+
+export {
+  QWEN_CODE_SERVE_ENV,
+  QWEN_CODE_DESKTOP_ENV,
+  resolveAcpChannelFallback,
+  DEFAULT_EXCLUDED_ENV_VARS,
+  ENV_CORRUPTED_PATH,
+  ENV_WAS_RECOVERED,
+  ENV_ACP_REPEATED_TOOL_FAILURE_GUARD,
+  PROJECT_ENV_HARDCODED_EXCLUSIONS,
+  isHardcodedProjectEnvExclusion,
+  HOME_ENV_BOOTSTRAP_KEYS,
+  isLoaderEnvKey,
+  scrubInheritedLoaderEnv,
+  scrubAndReportInheritedLoaderEnv,
+  acquireInheritedLoaderEnvScrub,
+  setLoaderKeyRejectionReporter,
+  clearLoaderKeyRejectionReporterIfCurrent,
+  reportRejectedLoaderKeys,
+  resetLoaderKeyRejectionReportingForTesting,
+  publishPendingCompileCache
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */