@qwen-code/qwen-code 0.22.2 → 0.22.3-nightly.20260829.e5cb60ad48

package/chunks/chunk-SEONHUS3.js

@@ -0,0 +1,275 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  normalizeSessionIdForLookup
+} from "./chunk-ZEZKIS2K.js";
+import {
+  MAX_WORKSPACE_PATH_LENGTH,
+  translateAndCheckAbsoluteWorkspacePath
+} from "./chunk-6PLDPT2C.js";
+import {
+  writeStderrLine
+} from "./chunk-7FA2II6K.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/server/request-helpers.ts
+init_esbuild_shims();
+function sendJsonBodyParserError(res, err) {
+  if (err instanceof SyntaxError && "status" in err && err.status === 400) {
+    res.status(400).json({ error: "Invalid JSON in request body" });
+    return true;
+  }
+  if (err && typeof err === "object" && "status" in err && err.status === 413) {
+    res.status(413).json({ error: "Request body too large (max 10 MB)" });
+    return true;
+  }
+  return false;
+}
+__name(sendJsonBodyParserError, "sendJsonBodyParserError");
+var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var CLIENT_ID_HEADER = "x-qwen-client-id";
+var MAX_CLIENT_ID_LENGTH = 128;
+var MAX_TOOL_NAME_LENGTH = 256;
+var MAX_SERVER_NAME_LENGTH = 256;
+var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
+var INVALID_PERMISSION_OUTCOME_ERROR = '`outcome` must be `{ outcome: "cancelled" }` or `{ outcome: "selected", optionId: string }`';
+var deferredRuntimeTimingKey = Symbol(
+  "deferredRuntimeRequestTiming"
+);
+function setDeferredRuntimeRequestTiming(req, timing) {
+  req[deferredRuntimeTimingKey] = timing;
+}
+__name(setDeferredRuntimeRequestTiming, "setDeferredRuntimeRequestTiming");
+function getDeferredRuntimeRequestTiming(req) {
+  return req[deferredRuntimeTimingKey];
+}
+__name(getDeferredRuntimeRequestTiming, "getDeferredRuntimeRequestTiming");
+function safeBody(req) {
+  const raw = req.body;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return /* @__PURE__ */ Object.create(null);
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(raw)) {
+    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+__name(safeBody, "safeBody");
+function parseOptionalWorkspaceCwd(body, boundWorkspace, res) {
+  const hasCwd = "cwd" in body;
+  if (hasCwd && typeof body["cwd"] !== "string") {
+    res.status(400).json({ error: "`cwd` must be a string absolute path when provided" });
+    return void 0;
+  }
+  if (hasCwd && body["cwd"].length > MAX_WORKSPACE_PATH_LENGTH) {
+    res.status(400).json({
+      error: `\`cwd\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`
+    });
+    return void 0;
+  }
+  const cwd = translateAndCheckAbsoluteWorkspacePath(
+    hasCwd ? body["cwd"] : boundWorkspace
+  );
+  if (cwd === null) {
+    res.status(400).json({ error: "`cwd` must be an absolute path when provided" });
+    return void 0;
+  }
+  return cwd;
+}
+__name(parseOptionalWorkspaceCwd, "parseOptionalWorkspaceCwd");
+function requireSessionId(req, res) {
+  const sessionId = req.params["id"];
+  if (!sessionId) {
+    res.status(400).json({ error: "`sessionId` route parameter is required" });
+    return null;
+  }
+  return normalizeSessionIdForLookup(sessionId);
+}
+__name(requireSessionId, "requireSessionId");
+function parseClientIdHeader(req, res) {
+  const raw = req.get(CLIENT_ID_HEADER);
+  if (raw === void 0 || raw === "") return void 0;
+  if (raw.length > MAX_CLIENT_ID_LENGTH || !CLIENT_ID_RE.test(raw)) {
+    res.status(400).json({
+      error: "`X-Qwen-Client-Id` must be a non-empty token of 128 characters or fewer",
+      code: "invalid_client_id"
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseClientIdHeader, "parseClientIdHeader");
+function detectFromLoopback(req) {
+  const addr = req.socket?.remoteAddress;
+  if (typeof addr !== "string") return false;
+  if (addr === "::1") return true;
+  if (addr.startsWith("127.")) return true;
+  if (addr.startsWith("::ffff:127.")) return true;
+  return false;
+}
+__name(detectFromLoopback, "detectFromLoopback");
+function validateMcpRuntimeServerName(name, res) {
+  if (typeof name !== "string" || name.length === 0) {
+    res.status(400).json({
+      error: "Server name is required and must be a non-empty string",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name.length > MAX_SERVER_NAME_LENGTH) {
+    res.status(400).json({
+      error: `Server name exceeds ${MAX_SERVER_NAME_LENGTH}-character limit`,
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+    res.status(400).json({
+      error: "Server name must contain only alphanumeric characters, underscores, and hyphens",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name === "__proto__" || name === "constructor" || name === "prototype") {
+    res.status(400).json({
+      error: "Server name must not be a reserved JS property name",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  return true;
+}
+__name(validateMcpRuntimeServerName, "validateMcpRuntimeServerName");
+function parseAndValidateWorkspaceClientId(req, res, bridge) {
+  const raw = parseClientIdHeader(req, res);
+  if (raw === null || raw === void 0) return raw;
+  const bridges = Array.isArray(bridge) ? bridge : [bridge];
+  if (!bridges.some((candidate) => candidate.knownClientIds().has(raw))) {
+    res.status(400).json({
+      error: `Client id "${raw}" is not registered for this workspace`,
+      code: "invalid_client_id",
+      clientId: raw
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseAndValidateWorkspaceClientId, "parseAndValidateWorkspaceClientId");
+function createBuildWorkspaceCtx(boundWorkspace) {
+  return (route, clientId) => ({
+    originatorClientId: clientId,
+    route,
+    workspaceCwd: boundWorkspace
+  });
+}
+__name(createBuildWorkspaceCtx, "createBuildWorkspaceCtx");
+function parsePermissionVoteBody(req, res) {
+  const body = safeBody(req);
+  const outcome = body["outcome"];
+  if (!isValidOutcome(outcome)) {
+    res.status(400).json({ error: INVALID_PERMISSION_OUTCOME_ERROR });
+    return void 0;
+  }
+  return {
+    ...body,
+    outcome
+  };
+}
+__name(parsePermissionVoteBody, "parsePermissionVoteBody");
+function isValidOutcome(raw) {
+  if (typeof raw !== "object" || raw === null) return false;
+  const obj = raw;
+  if (obj["outcome"] === "cancelled") return true;
+  return obj["outcome"] === "selected" && typeof obj["optionId"] === "string" && obj["optionId"].length > 0;
+}
+__name(isValidOutcome, "isValidOutcome");
+var MIN_QUERY_MAX_QUEUED = 16;
+var MAX_QUERY_MAX_QUEUED = 2048;
+function parseMaxQueuedQuery(raw, res) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (not a decimal integer)`
+    );
+    res.status(400).json({
+      error: "`maxQueued` must be a decimal integer",
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < MIN_QUERY_MAX_QUEUED || n > MAX_QUERY_MAX_QUEUED) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (outside [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}])`
+    );
+    res.status(400).json({
+      error: `\`maxQueued\` must be in [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}]`,
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  return n;
+}
+__name(parseMaxQueuedQuery, "parseMaxQueuedQuery");
+function safeLogValue(raw) {
+  return JSON.stringify(String(raw)).slice(0, 82);
+}
+__name(safeLogValue, "safeLogValue");
+function parseLastEventId(raw) {
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    if (typeof raw === "string" && raw.length > 0) {
+      writeStderrLine(
+        `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (not a decimal integer)`
+      );
+    }
+    return void 0;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n > Number.MAX_SAFE_INTEGER) {
+    writeStderrLine(
+      `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (exceeds Number.MAX_SAFE_INTEGER)`
+    );
+    return void 0;
+  }
+  return n;
+}
+__name(parseLastEventId, "parseLastEventId");
+
+export {
+  sendJsonBodyParserError,
+  CLIENT_ID_HEADER,
+  MAX_CLIENT_ID_LENGTH,
+  MAX_TOOL_NAME_LENGTH,
+  MAX_SERVER_NAME_LENGTH,
+  CLIENT_ID_RE,
+  setDeferredRuntimeRequestTiming,
+  getDeferredRuntimeRequestTiming,
+  safeBody,
+  parseOptionalWorkspaceCwd,
+  requireSessionId,
+  parseClientIdHeader,
+  detectFromLoopback,
+  validateMcpRuntimeServerName,
+  parseAndValidateWorkspaceClientId,
+  createBuildWorkspaceCtx,
+  parsePermissionVoteBody,
+  parseMaxQueuedQuery,
+  safeLogValue,
+  parseLastEventId
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-ZGXYO7DY.js → chunk-SS4MRMKE.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   SERVE_CONTROL_EXT_METHODS
-} from "./chunk-JHS74YAB.js";
+} from "./chunk-KID24ZFN.js";
 import {
   ACTIVE_WORK_HEARTBEAT_VERSION,
   ACTIVE_WORK_HOLD_CATEGORIES,
@@ -39,7 +39,7 @@ import {
 } from "./chunk-V5J4J5TP.js";
 import {
   getSpecificMimeType
-} from "./chunk-3I6UTTDX.js";
+} from "./chunk-BKWNKLZB.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -741,8 +741,7 @@ __name(writeStderrLine, "writeStderrLine");
 
 // packages/acp-bridge/src/sessionAttachments.ts
 init_esbuild_shims();
-import { randomUUID } from "node:crypto";
-import { promises as fs, statSync } from "node:fs";
+import { constants as fsConstants, promises as fs, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 var SESSION_ATTACHMENT_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -754,6 +753,74 @@ var SUPPORTED_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/webp"
 ]);
+function hasVerifiableInode(ino) {
+  return Number.isSafeInteger(ino) && ino > 0;
+}
+__name(hasVerifiableInode, "hasVerifiableInode");
+async function openDurableAttachmentDirectory(directory, openedHandle) {
+  const handle = openedHandle ?? await fs.open(
+    directory,
+    fsConstants.O_RDONLY | (process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW ?? 0)
+  );
+  try {
+    const opened = await handle.stat();
+    const current = await fs.stat(directory);
+    const openedInodeVerifiable = hasVerifiableInode(opened.ino);
+    const currentInodeVerifiable = hasVerifiableInode(current.ino);
+    if (!opened.isDirectory() || !current.isDirectory() || opened.dev !== current.dev || openedInodeVerifiable !== currentInodeVerifiable || openedInodeVerifiable && opened.ino !== current.ino) {
+      throw new Error("Session attachment parent directory changed.");
+    }
+    return {
+      path: directory,
+      handle,
+      dev: opened.dev,
+      ino: opened.ino,
+      inodeVerifiable: openedInodeVerifiable
+    };
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    throw error;
+  }
+}
+__name(openDurableAttachmentDirectory, "openDurableAttachmentDirectory");
+async function openDurableAttachmentDirectoryIfPresent(directory) {
+  let handle;
+  try {
+    handle = await fs.open(
+      directory,
+      fsConstants.O_RDONLY | (process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW ?? 0)
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  return openDurableAttachmentDirectory(directory, handle);
+}
+__name(openDurableAttachmentDirectoryIfPresent, "openDurableAttachmentDirectoryIfPresent");
+async function syncDurableAttachmentDirectory(expected) {
+  const opened = await expected.handle.stat();
+  const openedInodeVerifiable = hasVerifiableInode(opened.ino);
+  const current = await fs.stat(expected.path);
+  const currentInodeVerifiable = hasVerifiableInode(current.ino);
+  if (!opened.isDirectory() || !current.isDirectory() || opened.dev !== expected.dev || openedInodeVerifiable !== expected.inodeVerifiable || expected.inodeVerifiable && opened.ino !== expected.ino || current.dev !== expected.dev || currentInodeVerifiable !== expected.inodeVerifiable || expected.inodeVerifiable && current.ino !== expected.ino) {
+    throw new Error("Session attachment parent directory changed.");
+  }
+  try {
+    await expected.handle.sync();
+  } catch (error) {
+    if (process.platform !== "win32" || !["EACCES", "EINVAL", "EPERM"].includes(
+      error.code ?? ""
+    )) {
+      throw error;
+    }
+  }
+  const after = await fs.stat(expected.path);
+  const afterInodeVerifiable = hasVerifiableInode(after.ino);
+  if (!after.isDirectory() || after.dev !== expected.dev || afterInodeVerifiable !== expected.inodeVerifiable || expected.inodeVerifiable && after.ino !== expected.ino) {
+    throw new Error("Session attachment parent directory changed.");
+  }
+}
+__name(syncDurableAttachmentDirectory, "syncDurableAttachmentDirectory");
 var SESSION_ATTACHMENT_UNAVAILABLE_TEXT = "[Attachment is no longer available]";
 var SessionAttachmentReferenceError = class extends Error {
   constructor(message, code) {
@@ -1169,17 +1236,59 @@ var SessionAttachmentStore = class {
     const directory = this.persistentDirectory ?? await this.directoryPromise?.catch(() => void 0);
     if (directory) {
       options.assertCanCommit?.();
+      const parent = await openDurableAttachmentDirectoryIfPresent(
+        path.dirname(directory)
+      );
+      if (!parent) return;
       const tombstone = path.join(
         path.dirname(directory),
-        `.${path.basename(directory)}.deleting-${randomUUID()}`
+        `.${path.basename(directory)}.deleting`
       );
       try {
-        await fs.rename(directory, tombstone);
-      } catch (error) {
-        if (error.code === "ENOENT") return;
-        throw error;
+        options.assertCanCommit?.();
+        let tombstoneExists = false;
+        try {
+          const stats = await fs.lstat(tombstone);
+          if (!stats.isDirectory() || stats.isSymbolicLink()) {
+            throw new Error("Session attachment tombstone is not a directory.");
+          }
+          tombstoneExists = true;
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        if (tombstoneExists) {
+          options.assertCanCommit?.();
+          await fs.rm(tombstone, { recursive: true, force: true });
+          await syncDurableAttachmentDirectory(parent);
+          return;
+        }
+        options.assertCanCommit?.();
+        try {
+          await fs.rename(directory, tombstone);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          try {
+            const stats = await fs.lstat(tombstone);
+            if (!stats.isDirectory() || stats.isSymbolicLink()) {
+              throw new Error(
+                "Session attachment tombstone is not a directory."
+              );
+            }
+            options.assertCanCommit?.();
+            await fs.rm(tombstone, { recursive: true, force: true });
+          } catch (tombstoneError) {
+            if (tombstoneError.code !== "ENOENT") {
+              throw tombstoneError;
+            }
+          }
+          await syncDurableAttachmentDirectory(parent);
+          return;
+        }
+        await fs.rm(tombstone, { recursive: true, force: true });
+        await syncDurableAttachmentDirectory(parent);
+      } finally {
+        await parent.handle.close().catch(() => void 0);
       }
-      await fs.rm(tombstone, { recursive: true, force: true });
     }
   }
   assertStored(reference) {
@@ -1274,7 +1383,7 @@ var SessionAttachmentStore = class {
 
 // packages/acp-bridge/src/bridgeClient.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { promises as fs2 } from "node:fs";
 import * as path2 from "node:path";
 
@@ -1643,7 +1752,7 @@ var BridgeClient = class {
       options.map((o) => String(o.optionId ?? ""))
     );
     allowedOptionIds.delete("");
-    const requestId = randomUUID2();
+    const requestId = randomUUID();
     if (allowedOptionIds.has(CANCEL_VOTE_SENTINEL)) {
       throw new CancelSentinelCollisionError(requestId, CANCEL_VOTE_SENTINEL);
     }
@@ -3200,7 +3309,7 @@ var BridgeClient = class {
       } catch {
       }
     }
-    const tmp = `${realTarget}.${process.pid}.${Date.now()}.${randomUUID2()}.tmp`;
+    const tmp = `${realTarget}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
     let preserveMode;
     try {
       const targetStat = await fs2.stat(realTarget);

package/chunks/{chunk-T32W2JHI.js → chunk-SS5SDCD3.js}

@@ -16,7 +16,7 @@ import {
   MODIFIER_SHIFT_BIT,
   MODIFIER_SUPER_BIT,
   clipboardHasImage
-} from "./chunk-FDY5RMGH.js";
+} from "./chunk-CFJY4DGX.js";
 import {
   require_jsx_runtime
 } from "./chunk-SV5PQVQE.js";
@@ -33,7 +33,7 @@ import {
 import {
   KittySequenceOverflowEvent,
   logKittySequenceOverflow
-} from "./chunk-L2M46FP5.js";
+} from "./chunk-QYMAKPY5.js";
 import {
   createDebugLogger
 } from "./chunk-UHQFIS7N.js";

package/chunks/{chunk-MIIVI25Q.js → chunk-ST5V3ZOC.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   getRateLimitErrorDetails
-} from "./chunk-4FTKQNWJ.js";
+} from "./chunk-DYXFD5RO.js";
 import {
   isInternalPromptId
-} from "./chunk-L2M46FP5.js";
+} from "./chunk-QYMAKPY5.js";
 import {
   createDebugLogger
 } from "./chunk-UHQFIS7N.js";

package/chunks/{chunk-4K7NQDCG.js → chunk-T4EFG2P5.js}

@@ -49,7 +49,8 @@ __name(getModelConfiguration, "getModelConfiguration");
 function buildModelReasoningConfigOption(modelId, state = {}) {
   const reasoning = getModelConfiguration(modelId)?.reasoning;
   if (!reasoning?.thinking) return void 0;
-  const currentValue = state.enabled === false ? REASONING_EFFORT_NONE : reasoning.toggleOnly ? REASONING_EFFORT_DEFAULT : reasoning.efforts.find((effort) => effort === state.effort) ?? reasoning.defaultEffort;
+  const thinkingMandatory = state.thinkingMandatory === true;
+  const currentValue = state.enabled === false && !thinkingMandatory ? REASONING_EFFORT_NONE : reasoning.toggleOnly ? REASONING_EFFORT_DEFAULT : reasoning.efforts.find((effort) => effort === state.effort) ?? reasoning.defaultEffort;
   return {
     id: "reasoning_effort",
     name: "Reasoning effort",
@@ -58,11 +59,13 @@ function buildModelReasoningConfigOption(modelId, state = {}) {
     type: "select",
     currentValue,
     options: [
-      {
-        value: REASONING_EFFORT_NONE,
-        name: "Thinking off",
-        description: "Disable thinking for this session"
-      },
+      ...thinkingMandatory ? [] : [
+        {
+          value: REASONING_EFFORT_NONE,
+          name: "Thinking off",
+          description: "Disable thinking for this session"
+        }
+      ],
       ...reasoning.toggleOnly ? [
         {
           value: REASONING_EFFORT_DEFAULT,
@@ -76,15 +79,21 @@ function buildModelReasoningConfigOption(modelId, state = {}) {
       }))
     ],
     _meta: {
-      "qwenCode/reasoning": reasoning.toggleOnly ? { toggleOnly: true } : { defaultEffort: reasoning.defaultEffort }
+      "qwenCode/reasoning": reasoning.toggleOnly ? {
+        toggleOnly: true,
+        ...thinkingMandatory ? { thinkingMandatory: true } : {}
+      } : {
+        defaultEffort: reasoning.defaultEffort,
+        ...thinkingMandatory ? { thinkingMandatory: true } : {}
+      }
     }
   };
 }
 __name(buildModelReasoningConfigOption, "buildModelReasoningConfigOption");
-function buildModelReasoningConfigPreview(modelId) {
+function buildModelReasoningConfigPreview(modelId, state = {}) {
   const reasoning = getModelConfiguration(modelId)?.reasoning;
   if (!reasoning?.thinking || reasoning.toggleOnly) return void 0;
-  const option = buildModelReasoningConfigOption(modelId);
+  const option = buildModelReasoningConfigOption(modelId, state);
   return option ? [option] : void 0;
 }
 __name(buildModelReasoningConfigPreview, "buildModelReasoningConfigPreview");

package/chunks/{chunk-TWSKM647.js → chunk-T7KMERIX.js}

@@ -17,7 +17,7 @@ import {
   isLoaderEnvKey,
   publishPendingCompileCache,
   reportRejectedLoaderKeys
-} from "./chunk-5PA6UEYA.js";
+} from "./chunk-MZCJWS5Y.js";
 import {
   buildTrustPrecedenceRules,
   require_strip_json_comments,