@qwen-code/qwen-code 0.22.0 → 0.22.2-nightly.20260828.7357136dd1

package/chunks/{chunk-UUQFJILB.js → chunk-RFI4YGMR.js}

@@ -2,29 +2,25 @@
 "use strict";
 import {
   parseToolWriteOriginMeta
-} from "./chunk-VGHZT6JR.js";
+} from "./chunk-U54AYGEC.js";
 import {
-  isLoopbackBind,
-  normalizeSessionIdForLookup
-} from "./chunk-TQOF5KBL.js";
+  isLoopbackBind
+} from "./chunk-RXFQM6FQ.js";
 import {
   MAX_CHILD_HEAP_MB,
   MIN_CHILD_HEAP_MB,
   recommendedChildShareMb
 } from "./chunk-UXEO7E3V.js";
+import {
+  CLIENT_ID_RE,
+  MAX_CLIENT_ID_LENGTH
+} from "./chunk-RNVFRIOO.js";
 import {
   isInternalWorkspaceRuntime
 } from "./chunk-NYWWQ437.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-LURJYO2T.js";
-import {
-  MAX_WORKSPACE_PATH_LENGTH,
-  translateAndCheckAbsoluteWorkspacePath
-} from "./chunk-6PLDPT2C.js";
-import {
-  writeStderrLine
-} from "./chunk-KGJGEEVR.js";
+} from "./chunk-OZ6KS6KW.js";
 import {
   ROOT_CONTEXT,
   context,
@@ -1503,15 +1499,18 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_context_usage: { since: "v1" },
   session_supported_commands: { since: "v1" },
   session_tasks: { since: "v1" },
+  scheduled_task_session_reuse: { since: "v1" },
   session_monitor_tool_correlation: { since: "v1" },
   session_stats: { since: "v1" },
   session_lsp: { since: "v1" },
   session_status: { since: "v1" },
   session_close: { since: "v1" },
   session_archive: { since: "v1" },
+  session_storage_conflict_repair: { since: "v1" },
   session_metadata: { since: "v1" },
   session_organization: { since: "v1" },
   session_export: { since: "v1" },
+  standalone_sessions_v1: { since: "v1" },
   session_transcript: { since: "v1" },
   session_transcript_pagination: { since: "v1" },
   // Daemon supports the MCP client guardrail surface: an in-process
@@ -1597,13 +1596,12 @@ var SERVE_CAPABILITY_REGISTRY = {
   // Workspace trust policy changes rebuild the affected runtime generation
   // without restarting the daemon. V2 trust status exposes convergence.
   workspace_trust_hot_reload: { since: "v1" },
-  // `POST /workspace/init` scaffolds an empty
-  // `QWEN.md` (or whatever `getCurrentGeminiMdFilename()` returns) at
-  // the bound workspace root. Body: `{force?: boolean}`. Default
+  // `POST /workspace/init` scaffolds an empty `QWEN.md` (or the
+  // workspace `context.fileName` value injected as `contextFilename`)
+  // at the bound workspace root. Body: `{force?: boolean}`. Default
   // refuses with 409 when the file already exists; `force: true`
-  // overwrites. Mechanical only — does NOT call the LLM. To AI-fill
-  // the file, the caller should follow up with
-  // `POST /session/:id/prompt`.
+  // overwrites. Mechanical only — does NOT call the LLM. To AI-fill the
+  // file, the caller should follow up with `POST /session/:id/prompt`.
   workspace_init: { since: "v1" },
   // `POST /workspace/setup-github` installs the fixed
   // qwen-code-action workflow set into the bound workspace after
@@ -1770,6 +1768,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   // `workspace_extensions` contract.
   extension_management_v2: { since: "v1" },
   extension_git_credentials: { since: "v1" },
+  extension_local_path_install: { since: "v1" },
   // Workspace-qualified, daemon-local persisted transcript paging. The tag is
   // unconditional because the route also serves a trusted single-workspace
   // primary; authorization is evaluated for the selected runtime per request.
@@ -1839,6 +1838,10 @@ var SERVE_CAPABILITY_REGISTRY = {
 };
 var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
   ["require_auth", (toggles) => toggles.requireAuth === true],
+  [
+    "standalone_sessions_v1",
+    (toggles) => toggles.standaloneSessionsAvailable === true
+  ],
   ["mcp_workspace_pool", (toggles) => toggles.mcpPoolActive === true],
   ["mcp_pool_restart", (toggles) => toggles.mcpPoolActive === true],
   [
@@ -1872,6 +1875,10 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
     "session_generation",
     (toggles) => toggles.sessionGenerationAvailable === true
   ],
+  [
+    "scheduled_task_session_reuse",
+    (toggles) => toggles.currentSessionSchedulingAvailable === true
+  ],
   [
     "workspace_generation",
     (toggles) => toggles.workspaceGenerationAvailable === true
@@ -2027,6 +2034,10 @@ function validateRootStats(stats) {
   }
 }
 __name(validateRootStats, "validateRootStats");
+function hasVerifiableInode(ino) {
+  return Number(ino) !== 0;
+}
+__name(hasVerifiableInode, "hasVerifiableInode");
 function prepareManagedScratchRoot(root, startupWorkspaceCwds) {
   mkdirSync(root, { recursive: true, mode: 448 });
   const before = lstatSync(root);
@@ -2034,6 +2045,11 @@ function prepareManagedScratchRoot(root, startupWorkspaceCwds) {
   const canonicalRoot = realpathSync.native(resolve(root));
   const after = lstatSync(canonicalRoot);
   validateRootStats(after);
+  if (!hasVerifiableInode(after.ino)) {
+    throw new Error(
+      "Managed scratch root identity cannot be verified on this volume"
+    );
+  }
   if (before.dev !== after.dev || before.ino !== after.ino) {
     throw new Error("Managed scratch root identity changed during validation");
   }
@@ -2376,235 +2392,6 @@ function installServeAppLifecycle(app, lifecycle = new ServeAppLifecycleControll
 }
 __name(installServeAppLifecycle, "installServeAppLifecycle");
 
-// packages/cli/src/serve/server/request-helpers.ts
-init_esbuild_shims();
-function sendJsonBodyParserError(res, err) {
-  if (err instanceof SyntaxError && "status" in err && err.status === 400) {
-    res.status(400).json({ error: "Invalid JSON in request body" });
-    return true;
-  }
-  if (err && typeof err === "object" && "status" in err && err.status === 413) {
-    res.status(413).json({ error: "Request body too large (max 10 MB)" });
-    return true;
-  }
-  return false;
-}
-__name(sendJsonBodyParserError, "sendJsonBodyParserError");
-var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-var CLIENT_ID_HEADER = "x-qwen-client-id";
-var MAX_CLIENT_ID_LENGTH = 128;
-var MAX_TOOL_NAME_LENGTH = 256;
-var MAX_SERVER_NAME_LENGTH = 256;
-var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
-var INVALID_PERMISSION_OUTCOME_ERROR = '`outcome` must be `{ outcome: "cancelled" }` or `{ outcome: "selected", optionId: string }`';
-var deferredRuntimeTimingKey = Symbol(
-  "deferredRuntimeRequestTiming"
-);
-function setDeferredRuntimeRequestTiming(req, timing) {
-  req[deferredRuntimeTimingKey] = timing;
-}
-__name(setDeferredRuntimeRequestTiming, "setDeferredRuntimeRequestTiming");
-function getDeferredRuntimeRequestTiming(req) {
-  return req[deferredRuntimeTimingKey];
-}
-__name(getDeferredRuntimeRequestTiming, "getDeferredRuntimeRequestTiming");
-function safeBody(req) {
-  const raw = req.body;
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    return /* @__PURE__ */ Object.create(null);
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(raw)) {
-    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-    out[key] = value;
-  }
-  return out;
-}
-__name(safeBody, "safeBody");
-function parseOptionalWorkspaceCwd(body, boundWorkspace, res) {
-  const hasCwd = "cwd" in body;
-  if (hasCwd && typeof body["cwd"] !== "string") {
-    res.status(400).json({ error: "`cwd` must be a string absolute path when provided" });
-    return void 0;
-  }
-  if (hasCwd && body["cwd"].length > MAX_WORKSPACE_PATH_LENGTH) {
-    res.status(400).json({
-      error: `\`cwd\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`
-    });
-    return void 0;
-  }
-  const cwd = translateAndCheckAbsoluteWorkspacePath(
-    hasCwd ? body["cwd"] : boundWorkspace
-  );
-  if (cwd === null) {
-    res.status(400).json({ error: "`cwd` must be an absolute path when provided" });
-    return void 0;
-  }
-  return cwd;
-}
-__name(parseOptionalWorkspaceCwd, "parseOptionalWorkspaceCwd");
-function requireSessionId(req, res) {
-  const sessionId = req.params["id"];
-  if (!sessionId) {
-    res.status(400).json({ error: "`sessionId` route parameter is required" });
-    return null;
-  }
-  return normalizeSessionIdForLookup(sessionId);
-}
-__name(requireSessionId, "requireSessionId");
-function parseClientIdHeader(req, res) {
-  const raw = req.get(CLIENT_ID_HEADER);
-  if (raw === void 0 || raw === "") return void 0;
-  if (raw.length > MAX_CLIENT_ID_LENGTH || !CLIENT_ID_RE.test(raw)) {
-    res.status(400).json({
-      error: "`X-Qwen-Client-Id` must be a non-empty token of 128 characters or fewer",
-      code: "invalid_client_id"
-    });
-    return null;
-  }
-  return raw;
-}
-__name(parseClientIdHeader, "parseClientIdHeader");
-function detectFromLoopback(req) {
-  const addr = req.socket?.remoteAddress;
-  if (typeof addr !== "string") return false;
-  if (addr === "::1") return true;
-  if (addr.startsWith("127.")) return true;
-  if (addr.startsWith("::ffff:127.")) return true;
-  return false;
-}
-__name(detectFromLoopback, "detectFromLoopback");
-function validateMcpRuntimeServerName(name, res) {
-  if (typeof name !== "string" || name.length === 0) {
-    res.status(400).json({
-      error: "Server name is required and must be a non-empty string",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (name.length > MAX_SERVER_NAME_LENGTH) {
-    res.status(400).json({
-      error: `Server name exceeds ${MAX_SERVER_NAME_LENGTH}-character limit`,
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-    res.status(400).json({
-      error: "Server name must contain only alphanumeric characters, underscores, and hyphens",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (name === "__proto__" || name === "constructor" || name === "prototype") {
-    res.status(400).json({
-      error: "Server name must not be a reserved JS property name",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  return true;
-}
-__name(validateMcpRuntimeServerName, "validateMcpRuntimeServerName");
-function parseAndValidateWorkspaceClientId(req, res, bridge) {
-  const raw = parseClientIdHeader(req, res);
-  if (raw === null || raw === void 0) return raw;
-  const bridges = Array.isArray(bridge) ? bridge : [bridge];
-  if (!bridges.some((candidate) => candidate.knownClientIds().has(raw))) {
-    res.status(400).json({
-      error: `Client id "${raw}" is not registered for this workspace`,
-      code: "invalid_client_id",
-      clientId: raw
-    });
-    return null;
-  }
-  return raw;
-}
-__name(parseAndValidateWorkspaceClientId, "parseAndValidateWorkspaceClientId");
-function createBuildWorkspaceCtx(boundWorkspace) {
-  return (route, clientId) => ({
-    originatorClientId: clientId,
-    route,
-    workspaceCwd: boundWorkspace
-  });
-}
-__name(createBuildWorkspaceCtx, "createBuildWorkspaceCtx");
-function parsePermissionVoteBody(req, res) {
-  const body = safeBody(req);
-  const outcome = body["outcome"];
-  if (!isValidOutcome(outcome)) {
-    res.status(400).json({ error: INVALID_PERMISSION_OUTCOME_ERROR });
-    return void 0;
-  }
-  return {
-    ...body,
-    outcome
-  };
-}
-__name(parsePermissionVoteBody, "parsePermissionVoteBody");
-function isValidOutcome(raw) {
-  if (typeof raw !== "object" || raw === null) return false;
-  const obj = raw;
-  if (obj["outcome"] === "cancelled") return true;
-  return obj["outcome"] === "selected" && typeof obj["optionId"] === "string" && obj["optionId"].length > 0;
-}
-__name(isValidOutcome, "isValidOutcome");
-var MIN_QUERY_MAX_QUEUED = 16;
-var MAX_QUERY_MAX_QUEUED = 2048;
-function parseMaxQueuedQuery(raw, res) {
-  if (raw === void 0) return void 0;
-  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
-    writeStderrLine(
-      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (not a decimal integer)`
-    );
-    res.status(400).json({
-      error: "`maxQueued` must be a decimal integer",
-      code: "invalid_max_queued"
-    });
-    return null;
-  }
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n < MIN_QUERY_MAX_QUEUED || n > MAX_QUERY_MAX_QUEUED) {
-    writeStderrLine(
-      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (outside [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}])`
-    );
-    res.status(400).json({
-      error: `\`maxQueued\` must be in [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}]`,
-      code: "invalid_max_queued"
-    });
-    return null;
-  }
-  return n;
-}
-__name(parseMaxQueuedQuery, "parseMaxQueuedQuery");
-function safeLogValue(raw) {
-  return JSON.stringify(String(raw)).slice(0, 82);
-}
-__name(safeLogValue, "safeLogValue");
-function parseLastEventId(raw) {
-  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
-    if (typeof raw === "string" && raw.length > 0) {
-      writeStderrLine(
-        `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (not a decimal integer)`
-      );
-    }
-    return void 0;
-  }
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n > Number.MAX_SAFE_INTEGER) {
-    writeStderrLine(
-      `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (exceeds Number.MAX_SAFE_INTEGER)`
-    );
-    return void 0;
-  }
-  return n;
-}
-__name(parseLastEventId, "parseLastEventId");
-
 // packages/cli/src/serve/rate-limit.ts
 init_esbuild_shims();
 var MAX_BUCKETS = 1e4;
@@ -4159,26 +3946,6 @@ export {
   conversationRootCompromisedError,
   ServeAppLifecycleController,
   installServeAppLifecycle,
-  sendJsonBodyParserError,
-  CLIENT_ID_HEADER,
-  MAX_CLIENT_ID_LENGTH,
-  MAX_TOOL_NAME_LENGTH,
-  MAX_SERVER_NAME_LENGTH,
-  CLIENT_ID_RE,
-  setDeferredRuntimeRequestTiming,
-  getDeferredRuntimeRequestTiming,
-  safeBody,
-  parseOptionalWorkspaceCwd,
-  requireSessionId,
-  parseClientIdHeader,
-  detectFromLoopback,
-  validateMcpRuntimeServerName,
-  parseAndValidateWorkspaceClientId,
-  createBuildWorkspaceCtx,
-  parsePermissionVoteBody,
-  parseMaxQueuedQuery,
-  safeLogValue,
-  parseLastEventId,
   createRateLimiter,
   setRateLimiter,
   getRateLimiter,

package/chunks/{chunk-A6NRNRKE.js → chunk-RFIDDFAL.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-M5GB774H.js";
 import {
   sanitizeLogText
-} from "./chunk-AW27A43Y.js";
+} from "./chunk-ICURCKIU.js";
 import {
   stripAnsi
 } from "./chunk-TWPJO254.js";

package/chunks/chunk-RKFGE7JH.js

@@ -0,0 +1,93 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  CHANNEL_DELIVERY_ERROR_CODES
+} from "./chunk-UDG5EZJI.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/runtime/channel-delivery-ipc.ts
+init_esbuild_shims();
+import { randomUUID } from "node:crypto";
+var ChannelDeliveryError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ChannelDeliveryError";
+  }
+  static {
+    __name(this, "ChannelDeliveryError");
+  }
+};
+function isChannelDeliveryErrorCode(value) {
+  return typeof value === "string" && CHANNEL_DELIVERY_ERROR_CODES.has(value);
+}
+__name(isChannelDeliveryErrorCode, "isChannelDeliveryErrorCode");
+function isChannelDeliveryError(value) {
+  return value instanceof ChannelDeliveryError || typeof value === "object" && value !== null && isChannelDeliveryErrorCode(value.code) && typeof value.message === "string";
+}
+__name(isChannelDeliveryError, "isChannelDeliveryError");
+var CHANNEL_DELIVERY_IPC_TIMEOUT_MS = 3e4;
+var MAX_CHANNEL_DELIVERIES_IN_FLIGHT = 16;
+var MAX_CHANNEL_DELIVERY_TEXT_LENGTH = 1e5;
+function createChannelDeliveryMessage(request) {
+  return {
+    type: "channel_delivery",
+    id: randomUUID(),
+    expiresAt: Date.now() + CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
+    request
+  };
+}
+__name(createChannelDeliveryMessage, "createChannelDeliveryMessage");
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+__name(isNonEmptyString, "isNonEmptyString");
+function isChannelDeliveryTarget(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const target = value;
+  return (target["type"] === "user" || target["type"] === "chat") && isNonEmptyString(target["id"]) && Object.keys(target).every((key) => key === "type" || key === "id");
+}
+__name(isChannelDeliveryTarget, "isChannelDeliveryTarget");
+function isChannelDeliveryRequest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const request = value;
+  return isNonEmptyString(request["deliveryId"]) && isNonEmptyString(request["channelName"]) && isChannelDeliveryTarget(request["target"]) && isNonEmptyString(request["text"]) && request["text"].length <= MAX_CHANNEL_DELIVERY_TEXT_LENGTH;
+}
+__name(isChannelDeliveryRequest, "isChannelDeliveryRequest");
+function isChannelDeliveryMessage(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const message = value;
+  return message["type"] === "channel_delivery" && isNonEmptyString(message["id"]) && typeof message["expiresAt"] === "number" && Number.isFinite(message["expiresAt"]) && isChannelDeliveryRequest(message["request"]);
+}
+__name(isChannelDeliveryMessage, "isChannelDeliveryMessage");
+function isChannelDeliveryResultMessage(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const message = value;
+  if (message["type"] !== "channel_delivery_result" || !isNonEmptyString(message["id"]) || typeof message["ok"] !== "boolean") {
+    return false;
+  }
+  if (message["ok"]) return true;
+  return isChannelDeliveryErrorCode(message["code"]) && typeof message["error"] === "string";
+}
+__name(isChannelDeliveryResultMessage, "isChannelDeliveryResultMessage");
+
+export {
+  ChannelDeliveryError,
+  isChannelDeliveryError,
+  CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
+  MAX_CHANNEL_DELIVERIES_IN_FLIGHT,
+  MAX_CHANNEL_DELIVERY_TEXT_LENGTH,
+  createChannelDeliveryMessage,
+  isChannelDeliveryMessage,
+  isChannelDeliveryResultMessage
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */