@qwen-code/qwen-code 0.21.8 → 0.21.9

package/chunks/chunk-UA5H3DS2.js

@@ -1,203 +0,0 @@
-// Force strict mode and setup for ESM
-"use strict";
-import {
-  writeStderrLineSafe
-} from "./chunk-KGJGEEVR.js";
-import {
-  init_esbuild_shims
-} from "./chunk-5O2XNYP6.js";
-import {
-  __name
-} from "./chunk-J2S4EL5Y.js";
-
-// packages/cli/src/config/acp-channel-fallback.ts
-init_esbuild_shims();
-var QWEN_CODE_SERVE_ENV = "QWEN_CODE_SERVE";
-var QWEN_CODE_DESKTOP_ENV = "QWEN_CODE_DESKTOP";
-function resolveAcpChannelFallback(env = process.env) {
-  if (env[QWEN_CODE_DESKTOP_ENV]) {
-    return "desktop";
-  }
-  if (env[QWEN_CODE_SERVE_ENV]) {
-    return "daemon";
-  }
-  return "ACP";
-}
-__name(resolveAcpChannelFallback, "resolveAcpChannelFallback");
-
-// packages/cli/src/config/shared-env-keys.ts
-init_esbuild_shims();
-var DEFAULT_EXCLUDED_ENV_VARS = ["DEBUG", "DEBUG_MODE"];
-var ENV_CORRUPTED_PATH = "QWEN_CODE_SETTINGS_CORRUPTED_PATH";
-var ENV_WAS_RECOVERED = "QWEN_CODE_SETTINGS_WAS_RECOVERED";
-var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
-  "QWEN_HOME",
-  "QWEN_RUNTIME_DIR",
-  "QWEN_CODE_MCP_APPROVALS_PATH",
-  "QWEN_CODE_TRUSTED_FOLDERS_PATH",
-  // Runtime attribution markers are stamped by trusted launchers. A project
-  // `.env` must not spoof client channel telemetry.
-  QWEN_CODE_SERVE_ENV,
-  QWEN_CODE_DESKTOP_ENV,
-  ENV_CORRUPTED_PATH,
-  ENV_WAS_RECOVERED,
-  // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)
-  // disable TLS certificate verification for all outbound API connections. A
-  // project `.env` must never enable either — that would let an untrusted repo
-  // silently turn off MITM protection. Opt-in stays with the user via the
-  // `--insecure` flag, the shell environment, or a home `.env`. The initial
-  // `.env` load only consults this list, so both keys must be here (not just
-  // RELOAD_EXCLUDED_KEYS, which only applies on reload).
-  "QWEN_TLS_INSECURE",
-  "NODE_TLS_REJECT_UNAUTHORIZED",
-  // NODE_EXTRA_CA_CERTS reaches the same outcome by adding a TLS trust
-  // anchor instead of disabling verification.
-  "NODE_EXTRA_CA_CERTS",
-  // QWEN_CLI_ENTRY is the script path daemon-spawned session processes run.
-  // A project `.env` or settings.env fixing it turns
-  // `cd <untrusted repo> && qwen serve` into code execution as the daemon
-  // via an attacker-chosen ACP entrypoint, for every workspace's sessions.
-  "QWEN_CLI_ENTRY",
-  // DEV gates the daemon's inherited-loader-env scrub (run-qwen-serve.ts);
-  // only the dev harness (scripts/dev.js) stamps it into the launch env. A
-  // project file setting it would silently keep loader vars in the base env
-  // distributed to every workspace's session children — reopening the #8653
-  // vector for any repo whose .env happens to carry DEV=true.
-  "DEV"
-];
-var HARDCODED_PROJECT_ENV_EXCLUSIONS = new Set(
-  PROJECT_ENV_HARDCODED_EXCLUSIONS.map((key) => key.toLowerCase())
-);
-function isHardcodedProjectEnvExclusion(key) {
-  return HARDCODED_PROJECT_ENV_EXCLUSIONS.has(key.toLowerCase());
-}
-__name(isHardcodedProjectEnvExclusion, "isHardcodedProjectEnvExclusion");
-var HOME_ENV_BOOTSTRAP_KEYS = [
-  "QWEN_HOME",
-  "QWEN_RUNTIME_DIR",
-  "QWEN_CODE_MCP_APPROVALS_PATH",
-  "QWEN_CODE_TRUSTED_FOLDERS_PATH"
-];
-var INHERITED_LOADER_ENV_KEYS = [
-  "NODE_OPTIONS",
-  // npm maps its `node-options` config onto npm_config_node_options in the
-  // environment, and `npm run` lifecycle scripts apply it like NODE_OPTIONS —
-  // the same hijack through an adjacent key. The config-file keys are the
-  // same hijack one level up: they point npm at an attacker-chosen .npmrc
-  // that can itself set node-options/script-shell/ignore-scripts, and `npm
-  // run` itself exports them into the script environment.
-  "npm_config_node_options",
-  "npm_config_userconfig",
-  "npm_config_globalconfig",
-  "npm_config_script_shell",
-  "npm_config_prefix",
-  "NODE_PATH",
-  "LD_PRELOAD",
-  "LD_AUDIT",
-  "DYLD_INSERT_LIBRARIES",
-  "BASH_ENV",
-  // zsh sources $ZDOTDIR/.zshenv on every invocation, including
-  // non-interactive `zsh -c` — the zsh analogue of BASH_ENV.
-  "ZDOTDIR"
-  // BASH_FUNC_* exported-function definitions are bash's other env-driven
-  // code-import channel (non-interactive `bash -c` still imports them);
-  // matched by prefix in isLoaderEnvKey, not listed here.
-];
-var canonicalLoaderKey = /* @__PURE__ */ __name((key) => key.toLowerCase().replace(/_/gu, "-"), "canonicalLoaderKey");
-var LOADER_ENV_KEYS = new Set(
-  INHERITED_LOADER_ENV_KEYS.map(canonicalLoaderKey)
-);
-function isLoaderEnvKey(key) {
-  const canonical = canonicalLoaderKey(key);
-  return canonical.startsWith("bash-func-") || LOADER_ENV_KEYS.has(canonical);
-}
-__name(isLoaderEnvKey, "isLoaderEnvKey");
-function scrubInheritedLoaderEnv(env) {
-  const removedKeys = [];
-  for (const key of Object.keys(env)) {
-    if (isLoaderEnvKey(key)) {
-      delete env[key];
-      removedKeys.push(key);
-    }
-  }
-  return removedKeys;
-}
-__name(scrubInheritedLoaderEnv, "scrubInheritedLoaderEnv");
-function scrubAndReportInheritedLoaderEnv(env, commandLabel, processLabel) {
-  const removedKeys = scrubInheritedLoaderEnv(env);
-  if (removedKeys.length > 0) {
-    writeStderrLineSafe(
-      `${commandLabel}: scrubbed inherited loader env vars from the ${processLabel} process; session subprocesses will not inherit them: ${removedKeys.join(", ")}`
-    );
-  }
-  return removedKeys;
-}
-__name(scrubAndReportInheritedLoaderEnv, "scrubAndReportInheritedLoaderEnv");
-var reportedLoaderKeyRejections = /* @__PURE__ */ new Map();
-var loaderKeyRejectionReporter;
-function setLoaderKeyRejectionReporter(reporter) {
-  loaderKeyRejectionReporter = reporter;
-}
-__name(setLoaderKeyRejectionReporter, "setLoaderKeyRejectionReporter");
-function reportRejectedLoaderKeys(source, candidateKeys) {
-  const rejectedKeys = candidateKeys.filter(isLoaderEnvKey);
-  const warnedKeys = reportedLoaderKeyRejections.get(source) ?? /* @__PURE__ */ new Set();
-  const freshKeys = rejectedKeys.filter((key) => !warnedKeys.has(key));
-  if (freshKeys.length === 0) return rejectedKeys;
-  for (const key of freshKeys) warnedKeys.add(key);
-  reportedLoaderKeyRejections.set(source, warnedKeys);
-  if (loaderKeyRejectionReporter) {
-    loaderKeyRejectionReporter(source, freshKeys);
-  } else {
-    writeStderrLineSafe(
-      `qwen: ${source} cannot set loader-affecting env vars; ignored: ` + freshKeys.join(", ")
-    );
-  }
-  return rejectedKeys;
-}
-__name(reportRejectedLoaderKeys, "reportRejectedLoaderKeys");
-function resetLoaderKeyRejectionReportingForTesting() {
-  reportedLoaderKeyRejections.clear();
-}
-__name(resetLoaderKeyRejectionReportingForTesting, "resetLoaderKeyRejectionReportingForTesting");
-
-// packages/cli/src/config/compile-cache.ts
-init_esbuild_shims();
-var PENDING_COMPILE_CACHE_ENV = "QWEN_CODE_PENDING_COMPILE_CACHE";
-function publishPendingCompileCache(env = process.env) {
-  const pendingDirectory = env[PENDING_COMPILE_CACHE_ENV];
-  delete env[PENDING_COMPILE_CACHE_ENV];
-  if (pendingDirectory && !env["NODE_COMPILE_CACHE"] && env["NODE_DISABLE_COMPILE_CACHE"] !== "1") {
-    env["NODE_COMPILE_CACHE"] = pendingDirectory;
-  }
-}
-__name(publishPendingCompileCache, "publishPendingCompileCache");
-
-export {
-  QWEN_CODE_SERVE_ENV,
-  QWEN_CODE_DESKTOP_ENV,
-  resolveAcpChannelFallback,
-  DEFAULT_EXCLUDED_ENV_VARS,
-  ENV_CORRUPTED_PATH,
-  ENV_WAS_RECOVERED,
-  PROJECT_ENV_HARDCODED_EXCLUSIONS,
-  isHardcodedProjectEnvExclusion,
-  HOME_ENV_BOOTSTRAP_KEYS,
-  isLoaderEnvKey,
-  scrubInheritedLoaderEnv,
-  scrubAndReportInheritedLoaderEnv,
-  setLoaderKeyRejectionReporter,
-  reportRejectedLoaderKeys,
-  resetLoaderKeyRejectionReportingForTesting,
-  publishPendingCompileCache
-};
-/**
- * @license
- * Copyright 2026 Qwen Team
- * SPDX-License-Identifier: Apache-2.0
- */
-/**
- * @license
- * Copyright 2025 Qwen Team
- * SPDX-License-Identifier: Apache-2.0
- */

package/web-shell/assets/channel-BMwLrwLW.js

@@ -1 +0,0 @@
-import{U as a,D as n}from"./mermaid.core-Z4HVqrKY.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/web-shell/assets/classDiagram-4FO5ZUOK-BGDv98jY.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-727SXJPM-B83uTOjm.js";import{_ as i}from"./mermaid.core-Z4HVqrKY.js";import"./chunk-FMBD7UC4-CSQ5hgyb.js";import"./chunk-ND2GUHAM-BWOF4SxX.js";import"./chunk-55IACEB6-BnDBLX6A.js";import"./chunk-2J33WTMH-CuV8n90B.js";import"./index-DwEr9HEW.js";var n={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{n as diagram};

package/web-shell/assets/classDiagram-v2-Q7XG4LA2-BGDv98jY.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-727SXJPM-B83uTOjm.js";import{_ as i}from"./mermaid.core-Z4HVqrKY.js";import"./chunk-FMBD7UC4-CSQ5hgyb.js";import"./chunk-ND2GUHAM-BWOF4SxX.js";import"./chunk-55IACEB6-BnDBLX6A.js";import"./chunk-2J33WTMH-CuV8n90B.js";import"./index-DwEr9HEW.js";var n={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{n as diagram};