@qwen-code/qwen-code 0.22.0 → 0.22.2-preview.0

package/chunks/{chunk-4F5WV4RF.js → chunk-PAJGKZAA.js}

@@ -12,10 +12,8 @@ import {
   revokeChannelWorkerPromptAuthorization
 } from "./chunk-Z7B6SRPM.js";
 import {
-  CHANNEL_DAEMON_WORKER_SENTINEL,
   CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
   CHANNEL_WEBHOOK_TASK_IPC_TIMEOUT_MS,
-  CHANNEL_WORKER_HEARTBEAT_INTERVAL_MS,
   ChannelDeliveryError,
   ChannelWebhookEnqueueError,
   MAX_CHANNEL_DELIVERIES_IN_FLIGHT,
@@ -23,10 +21,6 @@ import {
   MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
-  QWEN_DAEMON_TOKEN_ENV,
-  QWEN_DAEMON_URL_ENV,
-  QWEN_DAEMON_WORKSPACE_ENV,
-  QWEN_SERVER_TOKEN_ENV,
   createChannelDeliveryMessage,
   createChannelWebhookTaskMessage,
   isChannelDeliveryResultMessage,
@@ -34,12 +28,20 @@ import {
   isChannelStartupReportType,
   isChannelWebhookEnqueueErrorCode,
   isChannelWebhookTaskResultMessage
-} from "./chunk-ND7NOI4P.js";
+} from "./chunk-7CWEZQ6T.js";
 import {
   createWorkerDiagnosticRedactor,
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-A6NRNRKE.js";
+} from "./chunk-JVPFTDBK.js";
+import {
+  CHANNEL_DAEMON_WORKER_SENTINEL,
+  CHANNEL_WORKER_HEARTBEAT_INTERVAL_MS,
+  QWEN_DAEMON_TOKEN_ENV,
+  QWEN_DAEMON_URL_ENV,
+  QWEN_DAEMON_WORKSPACE_ENV,
+  QWEN_SERVER_TOKEN_ENV
+} from "./chunk-GYTKQYDB.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
@@ -53,7 +55,7 @@ import {
 } from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-AW27A43Y.js";
+} from "./chunk-E55H6BZ7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -65,6 +67,124 @@ import {
 init_esbuild_shims();
 import { fork } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+// packages/cli/src/serve/pem-certificate-blocks.ts
+init_esbuild_shims();
+import { spawnSync } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var NODE_EXTRA_CA_CERTS_ENV = "NODE_EXTRA_CA_CERTS";
+var ORACLE_TIMEOUT_MS = 1e4;
+var ORACLE_MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+var ORACLE_SOURCE = `
+const tls = require('node:tls');
+if (typeof tls.getCACertificates === 'function') {
+  process.stdout.write(JSON.stringify({
+    certificates: tls.getCACertificates('extra'),
+  }));
+} else {
+  tls.createSecureContext();
+  process.stdout.write(JSON.stringify({ legacy: true }));
+}
+`;
+var ExtraCaInspectionError = class extends Error {
+  static {
+    __name(this, "ExtraCaInspectionError");
+  }
+};
+var LegacyExtraCaInspectionError = class extends ExtraCaInspectionError {
+  static {
+    __name(this, "LegacyExtraCaInspectionError");
+  }
+  constructor() {
+    super("Inspecting NODE_EXTRA_CA_CERTS requires Node.js 22.15.0 or newer.");
+  }
+};
+var FailedExtraCaInspectionError = class extends ExtraCaInspectionError {
+  static {
+    __name(this, "FailedExtraCaInspectionError");
+  }
+  constructor() {
+    super(
+      "Inspecting NODE_EXTRA_CA_CERTS failed before its contents could be judged."
+    );
+  }
+};
+function scanCertificateBlocks(contents, sourcePath) {
+  let dir;
+  try {
+    dir = sourcePath ? void 0 : mkdtempSync(join(tmpdir(), "qwen-ca-oracle-"));
+    const certPath = sourcePath ?? join(dir, "extra-ca.pem");
+    if (dir) writeFileSync(certPath, contents, { mode: 384 });
+    const oracleEnv = {
+      ...process.env,
+      [NODE_EXTRA_CA_CERTS_ENV]: certPath
+    };
+    for (const key of Object.keys(oracleEnv)) {
+      if (key.toUpperCase() === "NODE_OPTIONS") delete oracleEnv[key];
+    }
+    const result = spawnSync(
+      process.execPath,
+      ["--no-deprecation", "--input-type=commonjs", "-e", ORACLE_SOURCE],
+      {
+        encoding: "utf8",
+        env: oracleEnv,
+        maxBuffer: ORACLE_MAX_BUFFER_BYTES,
+        timeout: ORACLE_TIMEOUT_MS,
+        windowsHide: true
+      }
+    );
+    if (result.error || result.status !== 0) {
+      throw new FailedExtraCaInspectionError();
+    }
+    const parsed = JSON.parse(result.stdout);
+    if (typeof parsed !== "object" || parsed === null) {
+      throw new FailedExtraCaInspectionError();
+    }
+    const certificates = Reflect.get(parsed, "certificates");
+    if (certificates !== void 0) {
+      if (!Array.isArray(certificates) || !certificates.every((item) => typeof item === "string")) {
+        throw new FailedExtraCaInspectionError();
+      }
+      return certificates.map((block) => ({
+        block: block.trimEnd(),
+        certificate: new X509Certificate(block)
+      }));
+    }
+    if (Reflect.get(parsed, "legacy") !== true) {
+      throw new FailedExtraCaInspectionError();
+    }
+    throw new LegacyExtraCaInspectionError();
+  } catch (error) {
+    if (error instanceof ExtraCaInspectionError) throw error;
+    throw new FailedExtraCaInspectionError();
+  } finally {
+    if (dir) {
+      try {
+        rmSync(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+__name(scanCertificateBlocks, "scanCertificateBlocks");
+function extractCertificateBlocks(contents, sourcePath) {
+  const scanned = scanCertificateBlocks(contents, sourcePath);
+  return scanned.length > 0 ? scanned.map((entry) => entry.block) : void 0;
+}
+__name(extractCertificateBlocks, "extractCertificateBlocks");
+function loadableCertificates(contents, sourcePath) {
+  const scanned = scanCertificateBlocks(contents, sourcePath);
+  return scanned.length > 0 ? scanned.map((entry) => entry.certificate) : void 0;
+}
+__name(loadableCertificates, "loadableCertificates");
+
+// packages/cli/src/serve/channel-worker-supervisor.ts
 var DEFAULT_CHANNEL_WORKER_HEARTBEAT_TIMEOUT_MS = 45e3;
 var MAX_WORKER_LOG_LINE_LENGTH = 4096;
 var MAX_WORKER_LOG_BUFFER_LENGTH = 64 * 1024;
@@ -181,10 +301,151 @@ function hasObservedExit(snapshot) {
   return snapshot.exitCode !== void 0 || snapshot.signal !== void 0;
 }
 __name(hasObservedExit, "hasObservedExit");
+var NODE_EXTRA_CA_CERTS_ENV2 = "NODE_EXTRA_CA_CERTS";
+var mergedWorkerCaBundles = /* @__PURE__ */ new Map();
+function sourceStamp(filePath) {
+  const stat = fs.statSync(filePath);
+  return `${stat.mtimeMs}:${stat.size}`;
+}
+__name(sourceStamp, "sourceStamp");
+var warnedWorkerCaMergeFallbacks = /* @__PURE__ */ new Set();
+var WORKER_CA_MERGE_FALLBACK_FAMILIES = [
+  "read-error",
+  "inspection-failed",
+  "no-operator-blocks",
+  "no-daemon-blocks"
+];
+function workerCaMergeFallbackKey(operatorCaPath, daemonCertPath, family) {
+  return `${operatorCaPath}\0${daemonCertPath}\0${family}`;
+}
+__name(workerCaMergeFallbackKey, "workerCaMergeFallbackKey");
+function warnWorkerCaMergeFallback(operatorCaPath, daemonCertPath, family, reason) {
+  const key = workerCaMergeFallbackKey(operatorCaPath, daemonCertPath, family);
+  if (warnedWorkerCaMergeFallbacks.has(key)) return;
+  warnedWorkerCaMergeFallbacks.add(key);
+  process.emitWarning(
+    `qwen: failed to merge ${NODE_EXTRA_CA_CERTS_ENV2} "${operatorCaPath}" with the daemon cert "${daemonCertPath}": ${reason}; channel workers will trust only the daemon cert`
+  );
+}
+__name(warnWorkerCaMergeFallback, "warnWorkerCaMergeFallback");
+var mintedWorkerCaBundleDirs = /* @__PURE__ */ new Set();
+var workerCaBundleExitHookRegistered = false;
+function cleanupWorkerCaBundleDir(dir) {
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
+__name(cleanupWorkerCaBundleDir, "cleanupWorkerCaBundleDir");
+function writeMergedWorkerCaBundle(contents) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "qwen-worker-ca-"));
+  mintedWorkerCaBundleDirs.add(dir);
+  if (!workerCaBundleExitHookRegistered) {
+    workerCaBundleExitHookRegistered = true;
+    process.once("exit", cleanupMintedWorkerCaBundleDirs);
+  }
+  const bundlePath = path.join(dir, "ca-bundle.pem");
+  fs.writeFileSync(bundlePath, contents, { mode: 384 });
+  return bundlePath;
+}
+__name(writeMergedWorkerCaBundle, "writeMergedWorkerCaBundle");
+function cleanupMintedWorkerCaBundleDirs() {
+  const swept = [...mintedWorkerCaBundleDirs];
+  for (const minted of swept) {
+    cleanupWorkerCaBundleDir(minted);
+  }
+  mintedWorkerCaBundleDirs.clear();
+  return swept;
+}
+__name(cleanupMintedWorkerCaBundleDirs, "cleanupMintedWorkerCaBundleDirs");
+function resolveWorkerCaCertPath(daemonCertPath, existing) {
+  if (!existing || existing === daemonCertPath) return daemonCertPath;
+  const cacheKey = `${existing}\0${daemonCertPath}`;
+  const sources = [existing, daemonCertPath];
+  const cached = mergedWorkerCaBundles.get(cacheKey);
+  if (cached) {
+    try {
+      fs.statSync(cached.bundlePath);
+      if (sources.every((src, i) => sourceStamp(src) === cached.sourceStamps[i])) {
+        return cached.bundlePath;
+      }
+    } catch {
+    }
+  }
+  try {
+    const sourceStamps = sources.map(sourceStamp);
+    const operatorBlocks = extractCertificateBlocks(
+      fs.readFileSync(existing, "utf8"),
+      existing
+    );
+    if (!operatorBlocks) {
+      warnWorkerCaMergeFallback(
+        existing,
+        daemonCertPath,
+        "no-operator-blocks",
+        // Three causes reject a file, not one: markers, decoding, and DER.
+        // Blaming markers alone tells an operator whose CA is truncated or
+        // hand-edited to fix lines that are already correct — and after boot
+        // this warning is the only diagnostic they get, so it has to name the
+        // same three the boot-time check does.
+        "it holds no PEM certificate block Node can load (every -----BEGIN/END CERTIFICATE----- marker must sit alone on its own line and every block must decode, and a DER file is never read at all)"
+      );
+      return daemonCertPath;
+    }
+    const daemonBlocks = extractCertificateBlocks(
+      fs.readFileSync(daemonCertPath, "utf8"),
+      daemonCertPath
+    );
+    if (!daemonBlocks) {
+      warnWorkerCaMergeFallback(
+        existing,
+        daemonCertPath,
+        "no-daemon-blocks",
+        "the daemon cert holds no PEM certificate block to merge into"
+      );
+      return daemonCertPath;
+    }
+    const bundlePath = writeMergedWorkerCaBundle(
+      `${[...operatorBlocks, ...daemonBlocks].join("\n")}
+`
+    );
+    const superseded = mergedWorkerCaBundles.get(cacheKey);
+    mergedWorkerCaBundles.set(cacheKey, { bundlePath, sourceStamps });
+    if (superseded) {
+      const dir = path.dirname(superseded.bundlePath);
+      mintedWorkerCaBundleDirs.delete(dir);
+      cleanupWorkerCaBundleDir(dir);
+    }
+    for (const family of WORKER_CA_MERGE_FALLBACK_FAMILIES) {
+      warnedWorkerCaMergeFallbacks.delete(
+        workerCaMergeFallbackKey(existing, daemonCertPath, family)
+      );
+    }
+    return bundlePath;
+  } catch (err) {
+    warnWorkerCaMergeFallback(
+      existing,
+      daemonCertPath,
+      // An inspection that could not run blames nothing about the file's
+      // contents; sharing the read-error family would let a first ENOENT
+      // silence the later, now-accurate inspection-failure diagnosis.
+      err instanceof ExtraCaInspectionError ? "inspection-failed" : "read-error",
+      err instanceof Error ? err.message : String(err)
+    );
+    return daemonCertPath;
+  }
+}
+__name(resolveWorkerCaCertPath, "resolveWorkerCaCertPath");
 function createWorkerEnv(opts) {
   const env = { ...opts.baseEnv ?? process.env };
   env["QWEN_CODE_NO_RELAUNCH"] = "true";
   env["QWEN_CODE_SERVE"] = "1";
+  if (opts.tlsCaCertPath) {
+    env[NODE_EXTRA_CA_CERTS_ENV2] = resolveWorkerCaCertPath(
+      opts.tlsCaCertPath,
+      env[NODE_EXTRA_CA_CERTS_ENV2]
+    );
+  }
   env[CHANNEL_DAEMON_WORKER_SENTINEL] = randomUUID();
   env[QWEN_DAEMON_URL_ENV] = opts.daemonUrl;
   env[QWEN_DAEMON_WORKSPACE_ENV] = opts.workspace;
@@ -505,7 +766,8 @@ function createChannelWorkerSupervisor(opts) {
       daemonUrl: opts.daemonUrl,
       workspace: opts.workspace,
       ...opts.daemonToken ? { daemonToken: opts.daemonToken } : {},
-      ...opts.workerBaseEnv ? { baseEnv: opts.workerBaseEnv } : {}
+      ...opts.workerBaseEnv ? { baseEnv: opts.workerBaseEnv } : {},
+      ...opts.tlsCaCertPath ? { tlsCaCertPath: opts.tlsCaCertPath } : {}
     });
     const promptAuthorization = env[CHANNEL_DAEMON_WORKER_SENTINEL];
     registerChannelWorkerPromptAuthorization(
@@ -1205,7 +1467,16 @@ function createChannelWorkerSupervisor(opts) {
 __name(createChannelWorkerSupervisor, "createChannelWorkerSupervisor");
 
 export {
+  ExtraCaInspectionError,
+  loadableCertificates,
   ChannelWorkerStopError,
   ChannelWorkerStartupError,
+  cleanupMintedWorkerCaBundleDirs,
+  resolveWorkerCaCertPath,
   createChannelWorkerSupervisor
 };
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-HIK2OF33.js → chunk-PVBT5QPD.js}

@@ -6,7 +6,7 @@ import {
   realpathNearestExisting,
   resolvePath,
   sanitizeCwd
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-MPHLIJYL.js → chunk-QB5DD75E.js}

@@ -1,34 +1,38 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
+  buildModelReasoningConfigPreview
+} from "./chunk-4K7NQDCG.js";
+import {
+  ACP_ROUTE_ID_PREFIX,
   buildAcpModelOptions,
   getAuthTypeFromEnv,
   getCurrentAcpModelId,
   parseAcpBaseModelId,
   resolveCliGenerationConfig,
   sanitizeProviderBaseUrl
-} from "./chunk-FVBVJEBG.js";
+} from "./chunk-HOANA6GC.js";
 import {
   snapshotProcessEnv
-} from "./chunk-U2UYQMM6.js";
+} from "./chunk-5NV2AN56.js";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-URN2JIAQ.js";
+} from "./chunk-CITGRGCM.js";
 import {
   loadSettings
-} from "./chunk-6UQSU7CQ.js";
+} from "./chunk-C2BAEV64.js";
 import {
   ModelsConfig
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-D6XO27Z5.js";
 import {
   APPROVAL_MODES
-} from "./chunk-VLRBJ24J.js";
+} from "./chunk-BVE5EMIG.js";
 import {
   tokenLimit
 } from "./chunk-FPGTNKCP.js";
 import {
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -116,6 +120,7 @@ function buildWorkspaceProvidersStatus(workspaceCwd, acpChannelLive, options) {
         providers.set(authType, provider);
       }
       const isCurrent = currentAuth === model.authType && currentAcpModelId === modelId;
+      const configOptions = modelId.startsWith(ACP_ROUTE_ID_PREFIX) ? void 0 : buildModelReasoningConfigPreview(model.id);
       const providerModel = {
         modelId,
         baseModelId: parseAcpBaseModelId(effectiveModelId),
@@ -126,7 +131,8 @@ function buildWorkspaceProvidersStatus(workspaceCwd, acpChannelLive, options) {
         ...model.baseUrl !== void 0 ? { baseUrl: sanitizeProviderBaseUrl(model.baseUrl) } : {},
         ...model.envKey !== void 0 ? { envKey: model.envKey } : {},
         isCurrent,
-        isRuntime: false
+        isRuntime: false,
+        ...configOptions ? { configOptions } : {}
       };
       provider.models.push(providerModel);
       if (isCurrent) provider.current = true;

package/chunks/chunk-QHMLYMMS.js

@@ -0,0 +1,32 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/core/stream-transport-retry.ts
+init_esbuild_shims();
+var RETRYABLE_STREAM_TRANSPORT_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function isRetryableStreamTransportError(classification) {
+  return classification.kind === "transport" && classification.transportCode !== void 0 && RETRYABLE_STREAM_TRANSPORT_CODES.has(classification.transportCode);
+}
+__name(isRetryableStreamTransportError, "isRetryableStreamTransportError");
+
+export {
+  isRetryableStreamTransportError
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-4CWDWDL6.js → chunk-RCDXSEJ5.js}

@@ -64,7 +64,7 @@ async function runExitCleanup(options = {}) {
 }
 __name(runExitCleanup, "runExitCleanup");
 async function cleanupCheckpoints() {
-  const { Storage } = await import("./deferred-core-runtime-WFEPUXZR.js");
+  const { Storage } = await import("./deferred-core-runtime-MGCCR6LA.js");
   const storage = new Storage(process.cwd());
   const tempDir = storage.getProjectTempDir();
   const checkpointsDir = join(tempDir, "checkpoints");

package/chunks/{chunk-L4HVF7LM.js → chunk-RQ5ASDFQ.js}

@@ -12,19 +12,19 @@ import {
 } from "./chunk-MR3PXB6E.js";
 import {
   ideContextStore
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-D6XO27Z5.js";
 import {
   require_proper_lockfile
 } from "./chunk-MLXTMF7H.js";
 import {
   atomicWriteFileSync
-} from "./chunk-HDKCKCYO.js";
+} from "./chunk-7QGEJI7M.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   getErrorMessage
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";