@qwen-code/qwen-code 0.22.3 → 0.23.0

package/chunks/{chunk-T26EAKDL.js → chunk-N2TNM3QB.js}

@@ -4,10 +4,6 @@ import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
 
-// packages/core/src/output/types.ts
+// packages/cli/node_modules/@opentui/react/chunk-2mx7fq49.js
 init_esbuild_shims();
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
+var __require = import.meta.require;

package/chunks/{chunk-2TNL5KPM.js → chunk-N4QWUPDM.js}

@@ -18,6 +18,12 @@ function isReservedStandaloneSessionSourceType(sourceType) {
   return sourceType === STANDALONE_SESSION_SOURCE_TYPE;
 }
 __name(isReservedStandaloneSessionSourceType, "isReservedStandaloneSessionSourceType");
+var SCHEDULED_TASK_RUN_SOURCE_TYPE = "default";
+var SCHEDULED_TASK_RUN_SOURCE_ID_PREFIX = "scheduled_task_run:";
+function isScheduledTaskRunSource(source) {
+  return source.sourceType === SCHEDULED_TASK_RUN_SOURCE_TYPE && source.sourceId?.startsWith(SCHEDULED_TASK_RUN_SOURCE_ID_PREFIX) === true;
+}
+__name(isScheduledTaskRunSource, "isScheduledTaskRunSource");
 function parseSessionSource(sourceType, sourceId) {
   if (sourceType === void 0 && sourceId === void 0)
     return {};
@@ -45,5 +51,6 @@ export {
   STANDALONE_SESSION_SOURCE_TYPE,
   DAEMON_OWNED_STANDALONE_CREATION_KEY,
   isReservedStandaloneSessionSourceType,
+  isScheduledTaskRunSource,
   parseSessionSource
 };

package/chunks/{chunk-7S226YTK.js → chunk-NFIDVZND.js}

@@ -2,7 +2,10 @@
 "use strict";
 import {
   require_express
-} from "./chunk-AYHQZBJ4.js";
+} from "./chunk-IRKQ4YYX.js";
+import {
+  isLoopbackAddress
+} from "./chunk-DMEUXLSS.js";
 import {
   writeStderrLine
 } from "./chunk-7FA2II6K.js";
@@ -46,6 +49,13 @@ function loopbackSandboxOrigins(hostHeader) {
   const port = portFromHostHeader(hostHeader);
   const suffix = port ? `:${port}` : "";
   const hosts = ["localhost", "127.0.0.1"];
+  try {
+    const requestHostname = new URL(`http://${hostHeader}`).hostname;
+    if (isLoopbackAddress(requestHostname) && !requestHostname.includes(":") && !hosts.includes(requestHostname)) {
+      hosts.push(requestHostname);
+    }
+  } catch {
+  }
   return ["http", "https"].flatMap(
     (scheme) => hosts.map((host) => `${scheme}://${host}${suffix}`)
   );

package/chunks/{chunk-ZEYFMJQA.js → chunk-NQ4L2CMD.js}

@@ -11,14 +11,17 @@ import {
   DEFAULT_TOOL_RESULTS_TOTAL_CHARS_THRESHOLD,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_LINES,
   DEFAULT_TRUNCATE_TOOL_OUTPUT_THRESHOLD
-} from "./chunk-PZ66FRIC.js";
+} from "./chunk-4F7GQGXB.js";
+import {
+  REASONING_EFFORT_TIERS
+} from "./chunk-2LD5U7Q3.js";
 import {
   DEFAULT_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH,
   SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH_LIMIT
-} from "./chunk-B5PHIJGI.js";
+} from "./chunk-QKDNS6FU.js";
 import {
   DEFAULT_QWEN_CUSTOM_IGNORE_FILE_NAMES
-} from "./chunk-PDQGMSZK.js";
+} from "./chunk-ODZF64DM.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -323,6 +326,19 @@ var SETTINGS_SCHEMA = {
         description: "The preferred editor to open files in.",
         showInDialog: true
       },
+      outputStyle: {
+        type: "string",
+        label: "Output Style",
+        category: "General",
+        // Generic settings edits do not rebuild the running system instruction;
+        // `/output-style` owns the separate live-update path.
+        requiresRestart: true,
+        default: void 0,
+        description: 'Name of the output style that shapes how responses are written, for example "Concise" or "Explanatory". Leave unset for the default style. Change it with /output-style.',
+        // The style list will grow user/project-defined entries; the dedicated
+        // /output-style picker owns selection rather than a static enum here.
+        showInDialog: false
+      },
       vimMode: {
         type: "boolean",
         label: "Vim Mode",
@@ -505,15 +521,6 @@ var SETTINGS_SCHEMA = {
         description: 'The language for LLM output. Use "auto" to follow the user input language, or set a specific language.',
         showInDialog: true
       },
-      dynamicCommandTranslation: {
-        type: "boolean",
-        label: "Language: Dynamic Command Translation",
-        category: "General",
-        requiresRestart: false,
-        default: false,
-        description: "Enable AI translation for dynamic slash command descriptions. When disabled, dynamic commands use their original descriptions and do not trigger translation model calls.",
-        showInDialog: true
-      },
       terminalBell: {
         type: "boolean",
         label: "Terminal Bell Notification",
@@ -1355,7 +1362,12 @@ var SETTINGS_SCHEMA = {
           { value: "high", label: "High" },
           { value: "xhigh", label: "Extra High" },
           { value: "max", label: "Max" }
-        ]
+        ],
+        // WebShell persists none; the TUI keeps its existing tier-only control.
+        jsonSchemaOverride: {
+          type: "string",
+          enum: ["none", ...REASONING_EFFORT_TIERS]
+        }
       },
       maxSessionTurns: {
         type: "integer",
@@ -1375,6 +1387,15 @@ var SETTINGS_SCHEMA = {
         description: "Run-level wall-clock budget for headless / unattended runs, in seconds. -1 means unlimited; otherwise must be in [1, ~2,147,483] (sub-second values and values above ~24 days are rejected as typos). Overridable per-invocation via --max-wall-time (which also accepts duration suffixes like 5m, 1.5h).",
         showInDialog: false
       },
+      goalTokenBudget: {
+        type: "integer",
+        label: "Goal Token Budget",
+        category: "Model",
+        requiresRestart: false,
+        default: void 0,
+        description: "Autonomous spend window armed on each new Goal, in tokens as counted by the Goal meter (totalTokenCount summed over every model call the Goal makes in its own turns; side queries and checkpoint verification are not metered). When a Goal spends its window it gets one wind-down turn to hand off, then stops until you resume it, which arms another window. Unset uses the built-in default of 30,000,000; -1 means unlimited. Zero, values above 300,000,000 (10x the default, a typo guard), other negative, fractional, or non-number values are rejected at startup.",
+        showInDialog: false
+      },
       maxToolCalls: {
         type: "number",
         label: "Max Tool Calls",
@@ -1511,7 +1532,7 @@ var SETTINGS_SCHEMA = {
             category: "Generation Configuration",
             requiresRestart: false,
             default: void 0,
-            description: "Maximum inactivity between streamed chunks for OpenAI-compatible models, in milliseconds. Set to 0 to disable the idle guard. For provider-backed models, configure this field in the selected modelProviders entry.",
+            description: "Maximum inactivity between streamed chunks for OpenAI-compatible and Anthropic models, in milliseconds. Set to 0 to disable the idle guard. For provider-backed models, configure this field in the selected modelProviders entry.",
             minimum: 0,
             maximum: 2147483647,
             parentKey: "generationConfig",
@@ -2183,6 +2204,26 @@ var SETTINGS_SCHEMA = {
             default: false,
             description: "Route ALL shell commands through the auto-mode classifier, including read-only commands that would otherwise be auto-approved. Provides defense-in-depth for production environments.",
             showInDialog: false
+          },
+          mcp: {
+            type: "object",
+            label: "Auto Mode MCP Tools",
+            category: "Tools",
+            requiresRestart: true,
+            default: {},
+            description: "AUTO classifier controls for third-party MCP tools.",
+            showInDialog: false,
+            properties: {
+              forwardArguments: {
+                type: "boolean",
+                label: "Forward MCP Arguments To Classifier",
+                category: "Tools",
+                requiresRestart: true,
+                default: true,
+                description: "Forward MCP tool arguments (bounded and truncated) to the AUTO classifier so it can judge what the agent is about to send to the server. When false the classifier sees only the tool name, which usually results in a conservative block.",
+                showInDialog: false
+              }
+            }
           }
         }
       }
@@ -2430,7 +2471,7 @@ var SETTINGS_SCHEMA = {
         category: "Tools",
         requiresRestart: true,
         default: void 0,
-        description: "Allowlist of eager-by-default built-in tool names whose schemas remain eligible for the initial model request. Unlisted non-exempt tools are deferred but stay registered, listed in /tools, callable, and discoverable via tool_search. Tools already deferred by default stay on demand even when listed; use tools.visible to surface one at startup. tool_search, structured_output, plan-mode lifecycle tools, task_stop, MCP tools, and computer_use__* tools are unaffected. An explicitly empty list ([]) defers every non-exempt eager-by-default tool; omit the setting for no restriction. Pairs with tool_search: when ToolSearch is not registered (tools.toolSearch.enabled false, a tool_search deny rule, or the automatic opt-out for DeepSeek models) the schemas are still withheld but nothing can load them back, so the demoted tools are out of reach for that session and a warning is logged. Differs from tools.disabled, which removes tools entirely, and from permissions.allow, which only auto-approves calls.",
+        description: "Allowlist of eager-by-default built-in tool names whose schemas remain eligible for the initial model request. Unlisted non-exempt tools are deferred but stay registered, listed in /tools, callable, and discoverable via tool_search. Tools already deferred by default stay on demand even when listed; use tools.visible to surface one at startup. tool_search, structured_output, plan-mode lifecycle tools, task_stop, MCP tools, and computer_use__* tools are unaffected. An explicitly empty list ([]) defers every non-exempt eager-by-default tool; omit the setting for no restriction. Pairs with tool_search: when ToolSearch is not registered (tools.toolSearch.enabled false, a tool_search deny rule, or the automatic opt-out for DeepSeek models) the schemas are still withheld but nothing can load them back, so the demoted tools are out of reach for that session and a warning is logged. Two carve-outs: demoted tools referenced in resumed session history get their schemas re-sent without a warning, and demoted tools listed in tools.visible are declared up front. Differs from tools.disabled, which removes tools entirely, and from permissions.allow, which only auto-approves calls.",
         showInDialog: false
       },
       approvalMode: {
@@ -2730,7 +2771,7 @@ var SETTINGS_SCHEMA = {
         category: "Security",
         requiresRestart: false,
         default: [],
-        description: "Whitelist of URL patterns for HTTP hooks. Supports * wildcard. If empty, all URLs are allowed (subject to SSRF protection).",
+        description: "Whitelist of URL patterns for HTTP hooks. Supports * wildcard. If empty, all URLs are allowed (subject to SSRF protection). A value in Workspace settings is honored only when no User, System, or SystemDefaults scope sets one, so a cloned repository can narrow but never replace your whitelist.",
         showInDialog: false,
         items: {
           type: "string",
@@ -2822,6 +2863,30 @@ var SETTINGS_SCHEMA = {
       }
     }
   },
+  goals: {
+    type: "object",
+    label: "Goals",
+    category: "Advanced",
+    requiresRestart: true,
+    default: {},
+    description: "Settings for session Goals (/goal).",
+    showInDialog: false,
+    properties: {
+      modelProposed: {
+        type: "enum",
+        label: "Model-Proposed Goals",
+        category: "Advanced",
+        requiresRestart: true,
+        default: "alwaysAsk",
+        description: 'Controls the propose_goal tool, which lets the model propose a session Goal for you to approve. "alwaysAsk" (default) shows every proposal in an approval dialog and nothing is set until you accept it; "disabled" removes the tool. A typed /goal is unaffected. Consent-affecting, so this setting is only honored from User, System, or SystemDefaults scope; workspace values are ignored.',
+        showInDialog: true,
+        options: [
+          { value: "alwaysAsk", label: "Always ask" },
+          { value: "disabled", label: "Disabled" }
+        ]
+      }
+    }
+  },
   agents: {
     type: "object",
     label: "Agents",
@@ -2857,7 +2922,7 @@ var SETTINGS_SCHEMA = {
         category: "Advanced",
         requiresRestart: true,
         default: false,
-        description: "Experimental. Let Qwen Code sessions on this machine send each other messages over a per-session local socket. Off by default; turning it on both opens this session to peer messages and makes it discoverable to others.",
+        description: "Experimental. Let Qwen Code sessions on this machine send each other messages over a per-session local socket. Off by default; turning it on opens this session to peer messages, makes it discoverable to others, and lets its model address them from send_message.",
         showInDialog: false
       },
       crossSessionInbound: {
@@ -3314,7 +3379,7 @@ var SETTINGS_SCHEMA = {
         category: "Experimental",
         requiresRestart: false,
         default: false,
-        description: "Enable the daemon Web Shell Session Workflow DAG and present Plan mode as Plan & Review. Disabled by default and does not change ordinary Todo or execution behavior.",
+        description: "Enable the daemon Web Shell Session Workflow DAG and present Plan mode as Plan & Review. Disabled by default; Workflow markers, approval gates, and visualization stay off until enabled. Todo updates preserve omitted active dependencies in every mode.",
         showInDialog: true
       },
       cron: {

package/chunks/{chunk-ZZUKP7HV.js → chunk-NRL5CUZT.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   t
-} from "./chunk-CLWO3B77.js";
+} from "./chunk-I4NRYS6A.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-WXEA74YB.js → chunk-NSUKQ4DN.js}

@@ -3,7 +3,7 @@
 import {
   getTasksDir,
   sanitizeName
-} from "./chunk-42IDLQWS.js";
+} from "./chunk-373DQUVA.js";
 import {
   require_proper_lockfile
 } from "./chunk-MLXTMF7H.js";
@@ -12,11 +12,11 @@ import {
 } from "./chunk-VGC4I5JJ.js";
 import {
   atomicWriteJSON
-} from "./chunk-23RFD54N.js";
+} from "./chunk-KHP66DFN.js";
 import {
   createDebugLogger,
   isNodeError
-} from "./chunk-UHQFIS7N.js";
+} from "./chunk-EAHOJF6V.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -112,6 +112,11 @@ function assertValidTaskId(taskId) {
   }
 }
 __name(assertValidTaskId, "assertValidTaskId");
+function normalizeTaskId(raw) {
+  const id = raw.trim().replace(/^#/, "");
+  return id === "" ? void 0 : id;
+}
+__name(normalizeTaskId, "normalizeTaskId");
 function getTaskPath(teamName, taskId) {
   assertValidTaskId(taskId);
   return path.join(getTasksDir(teamName), `${taskId}.json`);
@@ -570,6 +575,7 @@ __name(getNextTaskId, "getNextTaskId");
 export {
   RECIPROCAL_CALLER,
   assertValidTaskId,
+  normalizeTaskId,
   onTasksUpdated,
   createTask,
   getTask,

package/chunks/chunk-NUHOLAQ6.js

@@ -0,0 +1,59 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  Storage
+} from "./chunk-EAHOJF6V.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/session-attachments-root.ts
+init_esbuild_shims();
+import { homedir } from "node:os";
+import * as path from "node:path";
+var SESSION_ATTACHMENTS_ROOT_ENV = "QWEN_SERVE_SESSION_ATTACHMENTS_ROOT";
+function defaultSessionAttachmentsRoot(workspace, runtimeBaseDir) {
+  return path.join(
+    new Storage(workspace, runtimeBaseDir).getProjectTempDir(),
+    "attachments"
+  );
+}
+__name(defaultSessionAttachmentsRoot, "defaultSessionAttachmentsRoot");
+function resolveConfiguredSessionAttachmentsRoot(configured) {
+  const expanded = configured === "~" ? homedir() : configured.startsWith("~/") || configured.startsWith("~\\") ? path.join(
+    homedir(),
+    ...configured.slice(2).split(/[/\\]+/).filter(Boolean)
+  ) : configured;
+  return path.resolve(process.cwd(), expanded);
+}
+__name(resolveConfiguredSessionAttachmentsRoot, "resolveConfiguredSessionAttachmentsRoot");
+function sessionAttachmentsRoots(workspace, runtimeBaseDir) {
+  const defaultRoot = defaultSessionAttachmentsRoot(workspace, runtimeBaseDir);
+  const configured = process.env[SESSION_ATTACHMENTS_ROOT_ENV]?.trim();
+  if (!configured) return { root: defaultRoot };
+  const projectHash = path.basename(path.dirname(defaultRoot));
+  return {
+    root: path.join(
+      resolveConfiguredSessionAttachmentsRoot(configured),
+      projectHash,
+      "attachments"
+    ),
+    fallback: defaultRoot
+  };
+}
+__name(sessionAttachmentsRoots, "sessionAttachmentsRoots");
+
+export {
+  SESSION_ATTACHMENTS_ROOT_ENV,
+  defaultSessionAttachmentsRoot,
+  resolveConfiguredSessionAttachmentsRoot,
+  sessionAttachmentsRoots
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */