@qwen-code/qwen-code 0.22.1 → 0.22.2-nightly.20260828.7357136dd1

package/chunks/chunk-RNVFRIOO.js

@@ -0,0 +1,275 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  normalizeSessionIdForLookup
+} from "./chunk-ZEZKIS2K.js";
+import {
+  MAX_WORKSPACE_PATH_LENGTH,
+  translateAndCheckAbsoluteWorkspacePath
+} from "./chunk-6PLDPT2C.js";
+import {
+  writeStderrLine
+} from "./chunk-KGJGEEVR.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/server/request-helpers.ts
+init_esbuild_shims();
+function sendJsonBodyParserError(res, err) {
+  if (err instanceof SyntaxError && "status" in err && err.status === 400) {
+    res.status(400).json({ error: "Invalid JSON in request body" });
+    return true;
+  }
+  if (err && typeof err === "object" && "status" in err && err.status === 413) {
+    res.status(413).json({ error: "Request body too large (max 10 MB)" });
+    return true;
+  }
+  return false;
+}
+__name(sendJsonBodyParserError, "sendJsonBodyParserError");
+var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var CLIENT_ID_HEADER = "x-qwen-client-id";
+var MAX_CLIENT_ID_LENGTH = 128;
+var MAX_TOOL_NAME_LENGTH = 256;
+var MAX_SERVER_NAME_LENGTH = 256;
+var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
+var INVALID_PERMISSION_OUTCOME_ERROR = '`outcome` must be `{ outcome: "cancelled" }` or `{ outcome: "selected", optionId: string }`';
+var deferredRuntimeTimingKey = Symbol(
+  "deferredRuntimeRequestTiming"
+);
+function setDeferredRuntimeRequestTiming(req, timing) {
+  req[deferredRuntimeTimingKey] = timing;
+}
+__name(setDeferredRuntimeRequestTiming, "setDeferredRuntimeRequestTiming");
+function getDeferredRuntimeRequestTiming(req) {
+  return req[deferredRuntimeTimingKey];
+}
+__name(getDeferredRuntimeRequestTiming, "getDeferredRuntimeRequestTiming");
+function safeBody(req) {
+  const raw = req.body;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return /* @__PURE__ */ Object.create(null);
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(raw)) {
+    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+__name(safeBody, "safeBody");
+function parseOptionalWorkspaceCwd(body, boundWorkspace, res) {
+  const hasCwd = "cwd" in body;
+  if (hasCwd && typeof body["cwd"] !== "string") {
+    res.status(400).json({ error: "`cwd` must be a string absolute path when provided" });
+    return void 0;
+  }
+  if (hasCwd && body["cwd"].length > MAX_WORKSPACE_PATH_LENGTH) {
+    res.status(400).json({
+      error: `\`cwd\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`
+    });
+    return void 0;
+  }
+  const cwd = translateAndCheckAbsoluteWorkspacePath(
+    hasCwd ? body["cwd"] : boundWorkspace
+  );
+  if (cwd === null) {
+    res.status(400).json({ error: "`cwd` must be an absolute path when provided" });
+    return void 0;
+  }
+  return cwd;
+}
+__name(parseOptionalWorkspaceCwd, "parseOptionalWorkspaceCwd");
+function requireSessionId(req, res) {
+  const sessionId = req.params["id"];
+  if (!sessionId) {
+    res.status(400).json({ error: "`sessionId` route parameter is required" });
+    return null;
+  }
+  return normalizeSessionIdForLookup(sessionId);
+}
+__name(requireSessionId, "requireSessionId");
+function parseClientIdHeader(req, res) {
+  const raw = req.get(CLIENT_ID_HEADER);
+  if (raw === void 0 || raw === "") return void 0;
+  if (raw.length > MAX_CLIENT_ID_LENGTH || !CLIENT_ID_RE.test(raw)) {
+    res.status(400).json({
+      error: "`X-Qwen-Client-Id` must be a non-empty token of 128 characters or fewer",
+      code: "invalid_client_id"
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseClientIdHeader, "parseClientIdHeader");
+function detectFromLoopback(req) {
+  const addr = req.socket?.remoteAddress;
+  if (typeof addr !== "string") return false;
+  if (addr === "::1") return true;
+  if (addr.startsWith("127.")) return true;
+  if (addr.startsWith("::ffff:127.")) return true;
+  return false;
+}
+__name(detectFromLoopback, "detectFromLoopback");
+function validateMcpRuntimeServerName(name, res) {
+  if (typeof name !== "string" || name.length === 0) {
+    res.status(400).json({
+      error: "Server name is required and must be a non-empty string",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name.length > MAX_SERVER_NAME_LENGTH) {
+    res.status(400).json({
+      error: `Server name exceeds ${MAX_SERVER_NAME_LENGTH}-character limit`,
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+    res.status(400).json({
+      error: "Server name must contain only alphanumeric characters, underscores, and hyphens",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name === "__proto__" || name === "constructor" || name === "prototype") {
+    res.status(400).json({
+      error: "Server name must not be a reserved JS property name",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  return true;
+}
+__name(validateMcpRuntimeServerName, "validateMcpRuntimeServerName");
+function parseAndValidateWorkspaceClientId(req, res, bridge) {
+  const raw = parseClientIdHeader(req, res);
+  if (raw === null || raw === void 0) return raw;
+  const bridges = Array.isArray(bridge) ? bridge : [bridge];
+  if (!bridges.some((candidate) => candidate.knownClientIds().has(raw))) {
+    res.status(400).json({
+      error: `Client id "${raw}" is not registered for this workspace`,
+      code: "invalid_client_id",
+      clientId: raw
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseAndValidateWorkspaceClientId, "parseAndValidateWorkspaceClientId");
+function createBuildWorkspaceCtx(boundWorkspace) {
+  return (route, clientId) => ({
+    originatorClientId: clientId,
+    route,
+    workspaceCwd: boundWorkspace
+  });
+}
+__name(createBuildWorkspaceCtx, "createBuildWorkspaceCtx");
+function parsePermissionVoteBody(req, res) {
+  const body = safeBody(req);
+  const outcome = body["outcome"];
+  if (!isValidOutcome(outcome)) {
+    res.status(400).json({ error: INVALID_PERMISSION_OUTCOME_ERROR });
+    return void 0;
+  }
+  return {
+    ...body,
+    outcome
+  };
+}
+__name(parsePermissionVoteBody, "parsePermissionVoteBody");
+function isValidOutcome(raw) {
+  if (typeof raw !== "object" || raw === null) return false;
+  const obj = raw;
+  if (obj["outcome"] === "cancelled") return true;
+  return obj["outcome"] === "selected" && typeof obj["optionId"] === "string" && obj["optionId"].length > 0;
+}
+__name(isValidOutcome, "isValidOutcome");
+var MIN_QUERY_MAX_QUEUED = 16;
+var MAX_QUERY_MAX_QUEUED = 2048;
+function parseMaxQueuedQuery(raw, res) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (not a decimal integer)`
+    );
+    res.status(400).json({
+      error: "`maxQueued` must be a decimal integer",
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < MIN_QUERY_MAX_QUEUED || n > MAX_QUERY_MAX_QUEUED) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (outside [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}])`
+    );
+    res.status(400).json({
+      error: `\`maxQueued\` must be in [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}]`,
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  return n;
+}
+__name(parseMaxQueuedQuery, "parseMaxQueuedQuery");
+function safeLogValue(raw) {
+  return JSON.stringify(String(raw)).slice(0, 82);
+}
+__name(safeLogValue, "safeLogValue");
+function parseLastEventId(raw) {
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    if (typeof raw === "string" && raw.length > 0) {
+      writeStderrLine(
+        `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (not a decimal integer)`
+      );
+    }
+    return void 0;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n > Number.MAX_SAFE_INTEGER) {
+    writeStderrLine(
+      `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (exceeds Number.MAX_SAFE_INTEGER)`
+    );
+    return void 0;
+  }
+  return n;
+}
+__name(parseLastEventId, "parseLastEventId");
+
+export {
+  sendJsonBodyParserError,
+  CLIENT_ID_HEADER,
+  MAX_CLIENT_ID_LENGTH,
+  MAX_TOOL_NAME_LENGTH,
+  MAX_SERVER_NAME_LENGTH,
+  CLIENT_ID_RE,
+  setDeferredRuntimeRequestTiming,
+  getDeferredRuntimeRequestTiming,
+  safeBody,
+  parseOptionalWorkspaceCwd,
+  requireSessionId,
+  parseClientIdHeader,
+  detectFromLoopback,
+  validateMcpRuntimeServerName,
+  parseAndValidateWorkspaceClientId,
+  createBuildWorkspaceCtx,
+  parsePermissionVoteBody,
+  parseMaxQueuedQuery,
+  safeLogValue,
+  parseLastEventId
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-CPPYZHBN.js → chunk-RU7BK6B3.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-E7REAOTN.js";
 import {
   createDebugLogger
-} from "./chunk-2NNTE2ED.js";
+} from "./chunk-UHQFIS7N.js";
 import {
   wrapper_default
 } from "./chunk-J3NNHTV6.js";

package/chunks/{chunk-OT26ITEY.js → chunk-RVXDXY6I.js}

@@ -5,14 +5,14 @@ import {
 } from "./chunk-E7REAOTN.js";
 import {
   t
-} from "./chunk-W2WRNJKX.js";
+} from "./chunk-RWZB422L.js";
 import {
   findProviderByCredentials,
   resolveMetadataKey
-} from "./chunk-VMDURMFY.js";
+} from "./chunk-W6DUQ5GA.js";
 import {
   fetchGitDiff
-} from "./chunk-XYX474JQ.js";
+} from "./chunk-EWIQ3NAE.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-W2WRNJKX.js → chunk-RWZB422L.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-5EJZE3FP.js";
 import {
   resolveBundleDir
-} from "./chunk-77TOMRBG.js";
+} from "./chunk-4K7KNVWH.js";
 import {
   Storage
-} from "./chunk-2NNTE2ED.js";
+} from "./chunk-UHQFIS7N.js";
 import {
   writeStderrLine
 } from "./chunk-KGJGEEVR.js";
@@ -167,13 +167,13 @@ var MUST_TRANSLATE_KEYS = [
 var globImport_locales_js = __glob({
   "./locales/ca.js": () => import("./ca-7HPYOYSZ.js"),
   "./locales/de.js": () => import("./de-X6HLSIFE.js"),
-  "./locales/en.js": () => import("./en-6MDBWMTG.js"),
+  "./locales/en.js": () => import("./en-YLXBXM4Z.js"),
   "./locales/fr.js": () => import("./fr-FTZWF462.js"),
   "./locales/ja.js": () => import("./ja-2GL5FKYJ.js"),
   "./locales/pt.js": () => import("./pt-XN2YWJVM.js"),
   "./locales/ru.js": () => import("./ru-OLTMFJEW.js"),
-  "./locales/zh-TW.js": () => import("./zh-TW-MV4FWFB6.js"),
-  "./locales/zh.js": () => import("./zh-X3WGU6SI.js")
+  "./locales/zh-TW.js": () => import("./zh-TW-RPTMRTHG.js"),
+  "./locales/zh.js": () => import("./zh-UNY63FR3.js")
 });
 
 // packages/cli/src/i18n/index.ts

package/chunks/{chunk-6YAR6ZU3.js → chunk-RYNZQGXN.js}

@@ -1,13 +1,16 @@
 // Force strict mode and setup for ESM
 "use strict";
+import {
+  multiSessionCompatibilityError
+} from "./chunk-QPTRRPZU.js";
 import {
   UNSAFE_OBJECT_KEYS,
   getPlugin
-} from "./chunk-IKN3IUJP.js";
+} from "./chunk-Y4TPOUEV.js";
 import {
   loadSettings,
   saveSettings
-} from "./chunk-MDZO5V2O.js";
+} from "./chunk-HPXV655A.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -105,6 +108,12 @@ function assertNumberRecord(key, value, allowedKeys) {
 }
 __name(assertNumberRecord, "assertNumberRecord");
 function assertSharedField(key, value, previous) {
+  if (key === "multiSession") {
+    if (typeof value !== "boolean") {
+      throw invalidConfig(`Channel field "${key}" must be a boolean.`);
+    }
+    return true;
+  }
   const enumValues = {
     senderPolicy: /* @__PURE__ */ new Set(["allowlist", "pairing", "open"]),
     dmPolicy: /* @__PURE__ */ new Set(["open", "disabled"]),
@@ -398,6 +407,14 @@ var WorkspaceChannelSettingsStore = class {
       if (value !== void 0) nextConfig[key] = value;
     }
     assertManagedConfig(nextConfig, previous, plugin.management.fields);
+    const multiSessionError = multiSessionCompatibilityError(name, {
+      multiSession: nextConfig["multiSession"] === true,
+      sessionScope: nextConfig["sessionScope"] ?? plugin.defaultSessionScope ?? "user",
+      groupHistoryLimit: nextConfig["groupHistoryLimit"],
+      groups: isRecord(nextConfig["groups"]) ? nextConfig["groups"] : {},
+      webhooks: nextConfig["webhooks"]
+    });
+    if (multiSessionError) throw invalidConfig(multiSessionError);
     let crossFieldError;
     try {
       crossFieldError = plugin.management.validateConfig?.(nextConfig);

package/chunks/{chunk-EKP3M4RF.js → chunk-SJ5ERAW3.js}

@@ -64,7 +64,7 @@ async function runExitCleanup(options = {}) {
 }
 __name(runExitCleanup, "runExitCleanup");
 async function cleanupCheckpoints() {
-  const { Storage } = await import("./deferred-core-runtime-GHT3GDOR.js");
+  const { Storage } = await import("./deferred-core-runtime-LKLGBCGZ.js");
   const storage = new Storage(process.cwd());
   const tempDir = storage.getProjectTempDir();
   const checkpointsDir = join(tempDir, "checkpoints");

package/chunks/{chunk-DEYPMJPD.js → chunk-SMPR7SPO.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-2NNTE2ED.js";
+} from "./chunk-UHQFIS7N.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-3BV7TZNQ.js → chunk-SRZZY4IY.js}

@@ -2,16 +2,16 @@
 "use strict";
 import {
   useKeypress
-} from "./chunk-O5YGAEQS.js";
+} from "./chunk-FALBWZF4.js";
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
 import {
   t
-} from "./chunk-W2WRNJKX.js";
+} from "./chunk-RWZB422L.js";
 import {
   APPROVAL_MODES
-} from "./chunk-BVE5EMIG.js";
+} from "./chunk-V5J4J5TP.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-7CWEZQ6T.js → chunk-STUJ7IMZ.js}

@@ -1,8 +1,5 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  CHANNEL_DELIVERY_ERROR_CODES
-} from "./chunk-UDG5EZJI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -58,72 +55,6 @@ function isChannelWebhookTaskResultMessage(value) {
 }
 __name(isChannelWebhookTaskResultMessage, "isChannelWebhookTaskResultMessage");
 
-// packages/cli/src/runtime/channel-delivery-ipc.ts
-init_esbuild_shims();
-import { randomUUID as randomUUID2 } from "node:crypto";
-var ChannelDeliveryError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "ChannelDeliveryError";
-  }
-  static {
-    __name(this, "ChannelDeliveryError");
-  }
-};
-function isChannelDeliveryErrorCode(value) {
-  return typeof value === "string" && CHANNEL_DELIVERY_ERROR_CODES.has(value);
-}
-__name(isChannelDeliveryErrorCode, "isChannelDeliveryErrorCode");
-function isChannelDeliveryError(value) {
-  return value instanceof ChannelDeliveryError || typeof value === "object" && value !== null && isChannelDeliveryErrorCode(value.code) && typeof value.message === "string";
-}
-__name(isChannelDeliveryError, "isChannelDeliveryError");
-var CHANNEL_DELIVERY_IPC_TIMEOUT_MS = 3e4;
-var MAX_CHANNEL_DELIVERIES_IN_FLIGHT = 16;
-var MAX_CHANNEL_DELIVERY_TEXT_LENGTH = 1e5;
-function createChannelDeliveryMessage(request) {
-  return {
-    type: "channel_delivery",
-    id: randomUUID2(),
-    expiresAt: Date.now() + CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
-    request
-  };
-}
-__name(createChannelDeliveryMessage, "createChannelDeliveryMessage");
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-__name(isNonEmptyString, "isNonEmptyString");
-function isChannelDeliveryTarget(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const target = value;
-  return (target["type"] === "user" || target["type"] === "chat") && isNonEmptyString(target["id"]) && Object.keys(target).every((key) => key === "type" || key === "id");
-}
-__name(isChannelDeliveryTarget, "isChannelDeliveryTarget");
-function isChannelDeliveryRequest(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const request = value;
-  return isNonEmptyString(request["deliveryId"]) && isNonEmptyString(request["channelName"]) && isChannelDeliveryTarget(request["target"]) && isNonEmptyString(request["text"]) && request["text"].length <= MAX_CHANNEL_DELIVERY_TEXT_LENGTH;
-}
-__name(isChannelDeliveryRequest, "isChannelDeliveryRequest");
-function isChannelDeliveryMessage(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const message = value;
-  return message["type"] === "channel_delivery" && isNonEmptyString(message["id"]) && typeof message["expiresAt"] === "number" && Number.isFinite(message["expiresAt"]) && isChannelDeliveryRequest(message["request"]);
-}
-__name(isChannelDeliveryMessage, "isChannelDeliveryMessage");
-function isChannelDeliveryResultMessage(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const message = value;
-  if (message["type"] !== "channel_delivery_result" || !isNonEmptyString(message["id"]) || typeof message["ok"] !== "boolean") {
-    return false;
-  }
-  if (message["ok"]) return true;
-  return isChannelDeliveryErrorCode(message["code"]) && typeof message["error"] === "string";
-}
-__name(isChannelDeliveryResultMessage, "isChannelDeliveryResultMessage");
-
 // packages/cli/src/serve/channel-worker-startup-ipc.ts
 init_esbuild_shims();
 var MAX_CHANNEL_STARTUP_FAILURES = 64;
@@ -205,14 +136,6 @@ export {
   createChannelWebhookTaskMessage,
   isChannelWebhookTaskMessage,
   isChannelWebhookTaskResultMessage,
-  ChannelDeliveryError,
-  isChannelDeliveryError,
-  CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
-  MAX_CHANNEL_DELIVERIES_IN_FLIGHT,
-  MAX_CHANNEL_DELIVERY_TEXT_LENGTH,
-  createChannelDeliveryMessage,
-  isChannelDeliveryMessage,
-  isChannelDeliveryResultMessage,
   MAX_CHANNEL_STARTUP_FAILURES,
   MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,

package/chunks/{chunk-TKO4TLT6.js → chunk-SUX7HDNA.js}

@@ -8,13 +8,13 @@ import {
 } from "./chunk-TXASDT2M.js";
 import {
   t
-} from "./chunk-W2WRNJKX.js";
+} from "./chunk-RWZB422L.js";
 import {
   So
-} from "./chunk-XYX474JQ.js";
+} from "./chunk-EWIQ3NAE.js";
 import {
   createDebugLogger
-} from "./chunk-2NNTE2ED.js";
+} from "./chunk-UHQFIS7N.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-76WGY6LW.js → chunk-SVNO44PF.js}

@@ -5,14 +5,14 @@ import {
   isTranscribableVoiceModel,
   readVoiceLanguage,
   resolveVoiceTransport
-} from "./chunk-2MHGD7EE.js";
+} from "./chunk-HYDJDQGJ.js";
 import {
   resolvePath
-} from "./chunk-2SERYG4T.js";
+} from "./chunk-YTDVNSUQ.js";
 import {
   createDebugLogger,
   isSubpath
-} from "./chunk-2NNTE2ED.js";
+} from "./chunk-UHQFIS7N.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";