@qwen-code/qwen-code 0.22.0 → 0.22.1

package/chunks/{chunk-7DYNJFES.js → chunk-AYVIGUUK.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   AuthType
-} from "./chunk-2E3V7G6Y.js";
+} from "./chunk-GTUKW3I6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -13,6 +13,10 @@ import {
 // packages/core/src/utils/runtimeModelPrefix.ts
 init_esbuild_shims();
 var RUNTIME_SNAPSHOT_PREFIX = "$runtime|";
+function buildRuntimeSnapshotId(authType, modelId) {
+  return `${RUNTIME_SNAPSHOT_PREFIX}${authType}|${modelId}`;
+}
+__name(buildRuntimeSnapshotId, "buildRuntimeSnapshotId");
 function stripRuntimeSnapshotPrefix(modelId) {
   let id = modelId;
   while (id.startsWith(RUNTIME_SNAPSHOT_PREFIX)) {
@@ -110,6 +114,7 @@ __name(resolveModelIdSelector, "resolveModelIdSelector");
 
 export {
   RUNTIME_SNAPSHOT_PREFIX,
+  buildRuntimeSnapshotId,
   stripRuntimeSnapshotPrefix,
   resolveModelId,
   buildModelIdContext

package/chunks/{chunk-7DMTAQJ6.js → chunk-BDHLBR46.js}

@@ -11,14 +11,14 @@ import {
   DEFAULT_TOOL_RESULTS_TOTAL_CHARS_THRESHOLD,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-XYX474JQ.js";
 import {
   DEFAULT_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH,
   SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH_LIMIT
-} from "./chunk-GAHYKJPV.js";
+} from "./chunk-6US7BF3G.js";
 import {
   DEFAULT_QWEN_CUSTOM_IGNORE_FILE_NAMES
-} from "./chunk-K52PZNU4.js";
+} from "./chunk-RRKNX553.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -26,6 +26,66 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
+// packages/cli/src/utils/deepMerge.ts
+init_esbuild_shims();
+function isPlainObject(item) {
+  return !!item && typeof item === "object" && !Array.isArray(item);
+}
+__name(isPlainObject, "isPlainObject");
+function mergeRecursively(target, source, getMergeStrategyForPath, path = []) {
+  for (const key of Object.keys(source)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      continue;
+    }
+    const newPath = [...path, key];
+    const srcValue = source[key];
+    const objValue = target[key];
+    const mergeStrategy = getMergeStrategyForPath(newPath);
+    if (mergeStrategy === "shallow_merge" /* SHALLOW_MERGE */ && objValue && srcValue) {
+      const obj1 = typeof objValue === "object" && objValue !== null ? objValue : {};
+      const obj2 = typeof srcValue === "object" && srcValue !== null ? srcValue : {};
+      target[key] = { ...obj1, ...obj2 };
+      continue;
+    }
+    if (Array.isArray(objValue)) {
+      const srcArray = Array.isArray(srcValue) ? srcValue : [srcValue];
+      if (mergeStrategy === "concat" /* CONCAT */) {
+        target[key] = objValue.concat(srcArray);
+        continue;
+      }
+      if (mergeStrategy === "union" /* UNION */) {
+        target[key] = [...new Set(objValue.concat(srcArray))];
+        continue;
+      }
+    }
+    if (isPlainObject(objValue) && isPlainObject(srcValue)) {
+      mergeRecursively(objValue, srcValue, getMergeStrategyForPath, newPath);
+    } else if (isPlainObject(srcValue)) {
+      target[key] = {};
+      mergeRecursively(
+        target[key],
+        srcValue,
+        getMergeStrategyForPath,
+        newPath
+      );
+    } else {
+      target[key] = srcValue;
+    }
+  }
+  return target;
+}
+__name(mergeRecursively, "mergeRecursively");
+function customDeepMerge(getMergeStrategyForPath, ...sources) {
+  const result = {};
+  for (const source of sources) {
+    if (source) {
+      mergeRecursively(result, source, getMergeStrategyForPath);
+    }
+  }
+  return result;
+}
+__name(customDeepMerge, "customDeepMerge");
+
 // packages/cli/src/config/settingsSchema.ts
 init_esbuild_shims();
 var DEFAULT_OPENAI_LOG_RETENTION_DAYS = 7;
@@ -56,7 +116,7 @@ var HOOK_DEFINITION_ITEMS = {
           type: {
             type: "string",
             description: 'The type of hook. Note: "function" type is only available via SDK registration, not settings.json.',
-            enum: ["command", "http"],
+            enum: ["command", "http", "prompt"],
             required: true
           },
           command: {
@@ -67,6 +127,14 @@ var HOOK_DEFINITION_ITEMS = {
             type: "string",
             description: 'The URL to send the POST request to. Required for "http" type.'
           },
+          prompt: {
+            type: "string",
+            description: 'The prompt to send to the model. Required for "prompt" type.'
+          },
+          model: {
+            type: "string",
+            description: 'The optional model to use for a "prompt" hook.'
+          },
           headers: {
             type: "object",
             description: "HTTP headers to include in the request. Supports env var interpolation ($VAR, ${VAR}).",
@@ -522,6 +590,20 @@ var SETTINGS_SCHEMA = {
         description: `Append the attribution footer naming the model and CLI version (e.g. "_\u2014 qwen3-coder via Qwen Code /review (v0.21.2)_") to review bodies and inline comments posted to GitHub. Disable to post reviews without VISIBLE AI attribution: no footer, and no "**[Critical]**"/"**[Suggestion]**" severity markers on posted comments and body lists. Unattributed posts stay identifiable in the raw source: each posted comment carries an invisible severity marker ("<!-- qwen-review critical -->") and the review body carries a ledger marker ("<!-- qwen-review-ledger ... -->") \u2014 anything reading comment bodies (GitHub API automation, the workflows this setting couples to) still recognizes a /review artifact, and presubmit duplicate detection recognizes the reviewing account's earlier posts by the severity marker, though unattributed posts from other accounts escape it. Another consequence: qwen-autofix's Critical-only mode (engaged after round 5, or earlier when a counting window's diff-growth budget trips) no longer recognizes the posted findings as Critical and defers them. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored, so a repository cannot set review policy for its reviewers.`,
         showInDialog: true
       },
+      sandbox: {
+        type: "enum",
+        label: "Sandbox the reviewed code: review",
+        category: "General",
+        requiresRestart: false,
+        default: "off",
+        description: 'Run the REVIEWED repository\'s own commands \u2014 `npm ci` with its install scripts, the build, the test suite, and every mutation probe \u2014 inside a container instead of directly as you. A review executes the code it is reviewing, and today those commands inherit the review process\'s whole environment (on CI that includes the model and GitHub credentials). "auto" uses a container when docker or podman answers and runs directly when neither does; "required" refuses to run them unsandboxed, which makes the evidence that depends on execution (build/test findings, mutation verdicts, `Source: [probe]`) unavailable for that run rather than ending the review; "off" is today\'s behaviour and stays the default, because containerising a build by surprise changes what native modules compile against. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored, so a repository cannot switch off the containment that exists to contain it.',
+        showInDialog: true,
+        options: [
+          { value: "off", label: "Off (run the reviewed code directly)" },
+          { value: "auto", label: "Auto (container when one is available)" },
+          { value: "required", label: "Required (never run it unsandboxed)" }
+        ]
+      },
       effort: {
         type: "enum",
         label: "Default effort: review",
@@ -568,6 +650,15 @@ var SETTINGS_SCHEMA = {
         default: 0,
         description: `Lower the reverse-audit loop's round cap for every high-effort review. The cap is normally chosen from the diff topology (10 small / 5 chunked; a huge diff is 3 when the run has a review deadline and 5 when it does not, because that reduction answers a CI ceiling and applies only where one exists) because a round costs one agent on a small diff and ~90 minutes on a huge one; this setting can only LOWER whichever tier applies, never raise it \u2014 a value that is not a whole number above zero, or that is out of range (below 3, or above the plan's own tier), is ignored and leaves the tier alone \u2014 JSON Schema has no integer type here, so a fraction validates in an editor and is then discarded at runtime. Understand what it buys before enabling: the loop ends on two consecutive dry rounds, so cutting the cap does not make reviews converge sooner, it makes them stop before converging more often \u2014 and every such stop is disclosed as unreviewed scope and caps the verdict at Comment, so a cheaper review is also one that can no longer Approve. To spend LESS on reviews generally, prefer "effort". Nothing here makes a loop run LONGER: a review deadline bounds a run rather than extending it, and on a huge diff setting one lowers the cap from 5 to 3 rather than raising it. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored, so a repository cannot set review policy for its reviewers.`,
         showInDialog: true
+      },
+      approachRounds: {
+        type: "number",
+        label: "Approach-signal round threshold: review",
+        category: "General",
+        requiresRestart: false,
+        default: 0,
+        description: "How many rounds a pull request must reach before the review may add one advisory paragraph saying the shape of the change, rather than the current patch, looks like the open question. It appears only when the diff has also grown several times over since the review first measured it, and never on an Approve. It is disclosure only: it adds no finding, changes no verdict, and blocks nothing \u2014 it exists because every finding is anchored to a line in the current diff, so the review can report where an approach leaks but never that a different approach would retire all of the leaks at once. Leave at 0 to keep the built-in threshold of 5 rounds; raise it to make the paragraph appear later, and set it very high to silence it. A value that is not a whole number above zero is ignored. Only honored from User, System, and SystemDefaults settings scopes; values set in Workspace settings are ignored, so a repository cannot set review policy for its reviewers.",
+        showInDialog: true
       }
     }
   },
@@ -586,11 +677,16 @@ var SETTINGS_SCHEMA = {
         category: "General",
         requiresRestart: false,
         default: "text",
-        description: "The format of the CLI output.",
+        description: "The format of the CLI output. With `stream-json`, runs started with a prompt behave as non-interactive (headless), matching `--output-format stream-json`. Flags validated at argv parse time (`--include-partial-messages`, `--input-format stream-json`) still require the explicit `--output-format stream-json` flag.",
         showInDialog: false,
+        // The values are the runtime's `OutputFormat` enum members, and the
+        // settingsSchema test pins these options against
+        // `Object.values(OutputFormat)`, so a format added in core fails
+        // that test until this list and the regenerated JSON follow.
         options: [
-          { value: "text", label: "Text" },
-          { value: "json", label: "JSON" }
+          { value: "text" /* TEXT */, label: "Text" },
+          { value: "json" /* JSON */, label: "JSON" },
+          { value: "stream-json" /* STREAM_JSON */, label: "Stream JSON" }
         ]
       },
       showTimestamps: {
@@ -1184,7 +1280,7 @@ var SETTINGS_SCHEMA = {
     category: "Model",
     requiresRestart: false,
     default: "",
-    description: "Model used by the built-in image_gen tool. Set with /model --image. The selected model must be marked imageOnly in modelProviders.",
+    description: "Model used by the built-in image_gen tool. Set with /model --image. The selected route must set supportsImageGeneration: true (or legacy imageOnly: true) in modelProviders.",
     showInDialog: false
   },
   visionBridgeTimeoutMs: {
@@ -1409,6 +1505,18 @@ var SETTINGS_SCHEMA = {
             parentKey: "generationConfig",
             showInDialog: false
           },
+          streamIdleTimeoutMs: {
+            type: "integer",
+            label: "Stream Idle Timeout",
+            category: "Generation Configuration",
+            requiresRestart: false,
+            default: void 0,
+            description: "Maximum inactivity between streamed chunks for OpenAI-compatible models, in milliseconds. Set to 0 to disable the idle guard. For provider-backed models, configure this field in the selected modelProviders entry.",
+            minimum: 0,
+            maximum: 2147483647,
+            parentKey: "generationConfig",
+            showInDialog: false
+          },
           maxRetries: {
             type: "number",
             label: "Max Retries",
@@ -2378,6 +2486,20 @@ var SETTINGS_SCHEMA = {
         description: 'Use the bundled ripgrep binary. When set to false, the system-level "rg" command will be used instead. This setting is only effective when useRipgrep is true.',
         showInDialog: false
       },
+      workflowsEnabled: {
+        type: "boolean",
+        label: "Dynamic Workflows",
+        category: "Tools",
+        // The Workflow tool is registered once while building the tool
+        // registry and /workflows is gated when commands load. Keyword
+        // steering reads the same startup-built Config on each submission,
+        // so changing the settings file mid-session cannot update any of the
+        // three surfaces until the next launch.
+        requiresRestart: true,
+        default: false,
+        description: 'Enable the Workflow tool, which lets the model author and run a script that orchestrates subagents in parallel. Off by default; a run can dispatch many subagents and spend tokens accordingly. The QWEN_CODE_ENABLE_WORKFLOWS=1 and QWEN_CODE_DISABLE_WORKFLOWS=1 environment variables override this setting (disable wins). Unrelated to the Session Workflow plan-and-review view; to stop the "workflow" keyword from steering a turn, see Disable Workflow Keyword Trigger.',
+        showInDialog: true
+      },
       truncateToolOutputThreshold: {
         type: "number",
         label: "Tool Output Truncation Threshold",
@@ -2404,46 +2526,6 @@ var SETTINGS_SCHEMA = {
         default: DEFAULT_TOOL_OUTPUT_BATCH_BUDGET,
         description: "Per-message character budget for the combined text output of one batch of tool calls. Oversized batches are reduced deterministically and recoverable output is persisted when possible. Set to -1 to disable.",
         showInDialog: false
-      },
-      computerUse: {
-        type: "object",
-        label: "Computer Use",
-        category: "Tools",
-        requiresRestart: true,
-        default: {},
-        description: "Cross-platform desktop automation via the cua-driver native driver (trycua/cua). On first invocation a pinned, signed + notarized binary (~20MB) is downloaded into ~/.qwen/computer-use/ and the user is walked through macOS Accessibility / Screen Recording permissions if needed. Exposes cua-driver's full tool surface (click, type_text, scroll, drag, press_key, get_window_state, page, launch_app, and more).",
-        showInDialog: false,
-        properties: {
-          enabled: {
-            type: "boolean",
-            label: "Enable Computer Use",
-            category: "Tools",
-            requiresRestart: true,
-            default: true,
-            description: "When enabled (default), the cua-driver computer_use__* tools are registered as deferred built-ins. Set to false to prevent the driver from being downloaded or spawned.",
-            showInDialog: true
-          },
-          idleTimeoutMs: {
-            type: "number",
-            label: "Idle Timeout",
-            category: "Tools",
-            requiresRestart: true,
-            default: 3e5,
-            minimum: 0,
-            maximum: 2147483647,
-            description: "Milliseconds to keep the cua-driver process alive after the last computer_use__* call. The default is 300000 (5 minutes). Set to 0 to keep it running until qwen-code exits.",
-            showInDialog: false
-          },
-          maxImageDimension: {
-            type: "number",
-            label: "Max Screenshot Dimension",
-            category: "Tools",
-            requiresRestart: true,
-            default: -1,
-            description: "Longest-edge pixel cap applied to cua-driver screenshots (via set_config's max_image_dimension). -1 (default) keeps cua-driver's built-in default (1568); 0 disables resizing (full resolution); a positive value caps the longest edge. Lower caps cut vision-token cost at the expense of fine detail. Overridable via the QWEN_COMPUTER_USE_MAX_IMAGE_DIMENSION env var.",
-            showInDialog: false
-          }
-        }
       }
     }
   },
@@ -2462,7 +2544,7 @@ var SETTINGS_SCHEMA = {
         category: "Daemon",
         requiresRestart: true,
         default: "first-responder",
-        description: 'How permission requests resolve when multiple clients are attached. `first-responder` (default) = any client decides, first wins. `designated` = only the prompt originator decides; falls back to first-responder if originator is anonymous. NOTE: client identity comes from self-declared X-Qwen-Client-Id with no proof-of-possession (pair-token identity is not implemented yet), so any client observing originatorClientId on SSE frames can register with the same id and impersonate the originator. `consensus` = N-of-M voters must agree. Default N=floor(M/2)+1, which means UNANIMITY for M=2 (quorum=2, both must agree) and supermajority for larger even M (M=4 \u2192 quorum=3; M=6 \u2192 quorum=4). For M=2 specifically, split votes resolve only via permissionTimeoutMs. `local-only` = only loopback clients can RESOLVE; remote clients can still ABORT a pending permission via the cancel sentinel ({outcome:"cancelled"}) \u2014 cancel stays cross-policy for consistency. Strict-cancel-too deployments need a dedicated loopback-bound daemon. Requires daemon restart \u2014 read once at boot.',
+        description: 'How permission requests resolve when multiple clients are attached. `first-responder` (default) = any client decides, first wins. `designated` = only the prompt originator decides; falls back to first-responder if originator is anonymous. NOTE: client identity comes from self-declared X-Qwen-Client-Id with no proof-of-possession (pair-token identity is not implemented yet), so any client observing originatorClientId on SSE frames can register with the same id and impersonate the originator. `consensus` = N-of-M voters must agree. Default N=floor(M/2)+1, which means UNANIMITY for M=2 (quorum=2, both must agree) and supermajority for larger even M (M=4 \u2192 quorum=3; M=6 \u2192 quorum=4). For M=2 specifically, split votes resolve only via the configured permission timeout, voter cancellation, or session cancellation. `local-only` = only loopback clients can RESOLVE; remote clients can still ABORT a pending permission via the cancel sentinel ({outcome:"cancelled"}) \u2014 cancel stays cross-policy for consistency. Strict-cancel-too deployments need a dedicated loopback-bound daemon. Requires daemon restart \u2014 read once at boot.',
         showInDialog: true,
         options: [
           { value: "first-responder", label: "First Responder" },
@@ -3435,6 +3517,7 @@ function getSettingsSchema() {
 __name(getSettingsSchema, "getSettingsSchema");
 
 export {
+  customDeepMerge,
   DEFAULT_OPENAI_LOG_RETENTION_DAYS,
   TOGGLE_TYPES,
   getSettingsSchema

package/chunks/{chunk-43T5WDQ7.js → chunk-BFSFJR3D.js}

@@ -7,7 +7,7 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
-// packages/cli/src/utils/permission-suggestions.ts
+// packages/cli/src/nonInteractive/permission-suggestions.ts
 init_esbuild_shims();
 function withWarnings(description, details) {
   const warnings = Array.isArray(details["warnings"]) ? details["warnings"].filter(

package/chunks/{chunk-AP3B7LKD.js → chunk-BKDAF7ES.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   MAX_INLINE_IMAGE_ENCODED_LENGTH
-} from "./chunk-JOLJTKIG.js";
+} from "./chunk-EC5BONC3.js";
 import {
   MAX_TERMINAL_IMAGE_BYTES
-} from "./chunk-6NFAEG54.js";
+} from "./chunk-KOJ6MHD5.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-B6UBOIFE.js → chunk-BQBUZDDH.js}

@@ -5,25 +5,25 @@ import {
   relaxSchemaForFunctionCalling,
   safeJsonParse,
   setGenAiUsageProvenance
-} from "./chunk-36OF5PRW.js";
+} from "./chunk-E4I5MVBR.js";
 import {
-  InvalidStreamError,
   createOpenAIReasoningThoughtPart
-} from "./chunk-2J3OJGTL.js";
+} from "./chunk-K2OJUPOE.js";
 import {
+  InvalidStreamError,
   setToolCallPreparations
-} from "./chunk-QKBYFU2Q.js";
-import {
-  normalizeMcpToolName
-} from "./chunk-WZAD4ZNJ.js";
+} from "./chunk-CFKIH3D3.js";
 import {
   TOKEN_ESTIMATE_UNITS_PER_TOKEN,
   estimateTextTokenUnits,
   estimateTextTokens
-} from "./chunk-YHC2EYYG.js";
+} from "./chunk-WBT3STGU.js";
+import {
+  normalizeMcpToolName
+} from "./chunk-WZAD4ZNJ.js";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   FinishReason,
   GenerateContentResponse
@@ -1236,15 +1236,18 @@ function convertOpenAIChunkToGemini(chunk, requestContext) {
 }
 __name(convertOpenAIChunkToGemini, "convertOpenAIChunkToGemini");
 function mapOpenAIFinishReasonToGemini(openaiReason) {
-  if (!openaiReason) return FinishReason.FINISH_REASON_UNSPECIFIED;
+  if (typeof openaiReason !== "string") {
+    return FinishReason.FINISH_REASON_UNSPECIFIED;
+  }
   const mapping = {
     stop: FinishReason.STOP,
     length: FinishReason.MAX_TOKENS,
+    max_tokens: FinishReason.MAX_TOKENS,
     content_filter: FinishReason.SAFETY,
     function_call: FinishReason.STOP,
     tool_calls: FinishReason.STOP
   };
-  return mapping[openaiReason] || FinishReason.FINISH_REASON_UNSPECIFIED;
+  return mapping[openaiReason.toLowerCase()] || FinishReason.FINISH_REASON_UNSPECIFIED;
 }
 __name(mapOpenAIFinishReasonToGemini, "mapOpenAIFinishReasonToGemini");
 function mapGeminiFinishReasonToOpenAI(geminiReason) {

package/chunks/{chunk-VLRBJ24J.js → chunk-BVE5EMIG.js}

@@ -2,14 +2,14 @@
 "use strict";
 import {
   getCurrentAgentId
-} from "./chunk-I432KXWD.js";
+} from "./chunk-DP7LABIB.js";
 import {
   getTeammateContext,
   isTeammate
 } from "./chunk-S6LOFUVP.js";
 import {
   ToolNames
-} from "./chunk-6NFAEG54.js";
+} from "./chunk-KOJ6MHD5.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-P47E4SJC.js → chunk-BX2BZPFJ.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-Z4X5MTRT.js";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-URN2JIAQ.js";
+} from "./chunk-CITGRGCM.js";
 import {
   loadSettings
-} from "./chunk-6UQSU7CQ.js";
+} from "./chunk-MDZO5V2O.js";
 import {
   SkillManager,
   isSafeModeEnv
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-XYX474JQ.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";

package/chunks/{chunk-OARZJFZX.js → chunk-C4WBKZJT.js}

@@ -2,19 +2,19 @@
 "use strict";
 import {
   JsonFormatter
-} from "./chunk-62JOGZL5.js";
+} from "./chunk-VMDURMFY.js";
 import {
   parseAndFormatApiError
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-XYX474JQ.js";
 import {
   FatalBudgetExceededError,
   FatalCancellationError,
   FatalTurnLimitedError,
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   runExitCleanup
-} from "./chunk-4CWDWDL6.js";
+} from "./chunk-EKP3M4RF.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";

package/chunks/{chunk-QKBYFU2Q.js → chunk-CFKIH3D3.js}

@@ -19,12 +19,32 @@ function getToolCallPreparations(response) {
 }
 __name(getToolCallPreparations, "getToolCallPreparations");
 
+// packages/core/src/core/invalid-stream-error.ts
+init_esbuild_shims();
+var InvalidStreamError = class extends Error {
+  static {
+    __name(this, "InvalidStreamError");
+  }
+  type;
+  constructor(message, type) {
+    super(message);
+    this.name = "InvalidStreamError";
+    this.type = type;
+  }
+};
+
 export {
   setToolCallPreparations,
-  getToolCallPreparations
+  getToolCallPreparations,
+  InvalidStreamError
 };
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-URN2JIAQ.js → chunk-CITGRGCM.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   SkillError
-} from "./chunk-VUMLT7E5.js";
+} from "./chunk-5Y2JCJAH.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -62,6 +62,7 @@ var MissingCliEntryError = class extends Error {
   }
 };
 var SERVE_STATUS_EXT_METHODS = {
+  channelPing: "qwen/status/channel/ping",
   workspaceMcp: "qwen/status/workspace/mcp",
   workspaceMcpTools: "qwen/status/workspace/mcp/tools",
   workspaceMcpResources: "qwen/status/workspace/mcp/resources",

package/chunks/{chunk-WU5E4HMO.js → chunk-CPPYZHBN.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-E7REAOTN.js";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   wrapper_default
 } from "./chunk-J3NNHTV6.js";

package/chunks/chunk-DCSAVGDJ.js

@@ -0,0 +1,20 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+
+// packages/cli/src/generated/git-commit.ts
+init_esbuild_shims();
+var GIT_COMMIT_INFO = "2755dbe139";
+var CLI_VERSION = "0.22.1";
+
+export {
+  GIT_COMMIT_INFO,
+  CLI_VERSION
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-Q54XG7IX.js → chunk-DEYPMJPD.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-KSPRQSB4.js → chunk-DIMEPKCW.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   require_express
-} from "./chunk-O5Z7EB6Y.js";
+} from "./chunk-AYHQZBJ4.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";
@@ -42,9 +42,43 @@ var WEB_SHELL_CSP_DIRECTIVES = [
   // attacker origin.
   "base-uri 'none'"
 ];
-function buildWebShellCsp(frameAncestors = []) {
+function loopbackSandboxOrigins(hostHeader) {
+  const port = portFromHostHeader(hostHeader);
+  const suffix = port ? `:${port}` : "";
+  const hosts = ["localhost", "127.0.0.1"];
+  return ["http", "https"].flatMap(
+    (scheme) => hosts.map((host) => `${scheme}://${host}${suffix}`)
+  );
+}
+__name(loopbackSandboxOrigins, "loopbackSandboxOrigins");
+function portFromHostHeader(hostHeader) {
+  if (!hostHeader) return void 0;
+  if (hostHeader.startsWith("[")) {
+    const end = hostHeader.indexOf("]");
+    if (end === -1) return void 0;
+    const rest = hostHeader.slice(end + 1);
+    return rest.startsWith(":") && /^\d+$/u.test(rest.slice(1)) ? rest.slice(1) : void 0;
+  }
+  const colon = hostHeader.lastIndexOf(":");
+  if (colon === -1) return void 0;
+  const port = hostHeader.slice(colon + 1);
+  return /^\d+$/u.test(port) ? port : void 0;
+}
+__name(portFromHostHeader, "portFromHostHeader");
+function buildWebShellPermissionsPolicy() {
+  return [
+    "camera=()",
+    "microphone=(self)",
+    "geolocation=()",
+    "payment=()",
+    "clipboard-write=(self)"
+  ].join(", ");
+}
+__name(buildWebShellPermissionsPolicy, "buildWebShellPermissionsPolicy");
+function buildWebShellCsp(frameAncestors = [], frameSrcOrigins = loopbackSandboxOrigins(void 0)) {
   const fa = frameAncestors.length ? `frame-ancestors ${frameAncestors.join(" ")}` : "frame-ancestors 'none'";
-  return [...WEB_SHELL_CSP_DIRECTIVES, fa].join("; ");
+  const frameSrc = `frame-src ${frameSrcOrigins.join(" ")}`;
+  return [...WEB_SHELL_CSP_DIRECTIVES, frameSrc, fa].join("; ");
 }
 __name(buildWebShellCsp, "buildWebShellCsp");
 var WEB_SHELL_CSP = buildWebShellCsp();
@@ -61,22 +95,25 @@ function isPreAuthWebShellRequest(req) {
   const reqPath = req.path.toLowerCase();
   if (reqPath === "/" || // Express non-strict routing compiles `/` to `/^(?:\/)(?:\/$)?$/i`, so
   // a raw `//` also matches `app.get('/')` pre-auth (but `///` does not).
-  reqPath === "//" || reqPath === "/assets" || reqPath.startsWith("/assets/"))
+  reqPath === "//" || reqPath === "/assets" || reqPath.startsWith("/assets/") || reqPath === "/mcp-app-sandbox")
     return true;
   return SESSION_DEEP_LINK_PATH.test(reqPath) && isDocumentNavigation(req);
 }
 __name(isPreAuthWebShellRequest, "isPreAuthWebShellRequest");
 function createSendIndex(webShellDir, frameAncestors = []) {
   const indexPath = path.join(webShellDir, "index.html");
-  const csp = buildWebShellCsp(frameAncestors);
-  return (res) => {
+  return (req, res) => {
+    const sandboxOrigins = loopbackSandboxOrigins(req.get("host"));
+    const csp = buildWebShellCsp(frameAncestors, sandboxOrigins);
     res.status(200).set("Content-Security-Policy", csp).set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "no-referrer").set(
       // `microphone=(self)` lets the same-origin Web Shell document request
       // the mic for voice dictation (the prompt won't even appear under an
-      // empty `microphone=()` allowlist). Still blocks cross-origin iframes;
-      // camera/geolocation/payment stay disabled (unused).
+      // empty `microphone=()` allowlist). Camera/geolocation stay disabled:
+      // the MCP App inner iframe is opaque-origin, so those grants cannot
+      // work there, and this header also blocks delegating them to the
+      // cross-origin sandbox.
       "Permissions-Policy",
-      "camera=(), microphone=(self), geolocation=(), payment=()"
+      buildWebShellPermissionsPolicy()
     ).set("Cache-Control", "no-cache");
     if (frameAncestors.length === 0) {
       res.set("X-Frame-Options", "DENY");
@@ -117,10 +154,10 @@ function mountWebShellAssets(app, webShellDir, frameAncestors = []) {
     }
     res.status(404).type("text/plain").send("Not found");
   });
-  app.get("/", (_req, res) => sendIndex(res));
+  app.get("/", (req, res) => sendIndex(req, res));
   app.get("/session/:id", (req, res, next) => {
     if (!isDocumentNavigation(req)) return next();
-    sendIndex(res);
+    sendIndex(req, res);
   });
 }
 __name(mountWebShellAssets, "mountWebShellAssets");
@@ -134,13 +171,16 @@ function mountWebShellSpaFallback(app, webShellDir, frameAncestors = []) {
         `qwen serve: Web Shell SPA fallback served for ${req.method} ${req.originalUrl}`
       );
     }
-    sendIndex(res);
+    sendIndex(req, res);
   });
 }
 __name(mountWebShellSpaFallback, "mountWebShellSpaFallback");
 
 export {
   isServeDebugMode,
+  loopbackSandboxOrigins,
+  portFromHostHeader,
+  buildWebShellPermissionsPolicy,
   buildWebShellCsp,
   WEB_SHELL_CSP,
   isDocumentNavigation,