@qwen-code/qwen-code 0.22.3 → 0.23.0

package/chunks/channel-settings-store-BVKWAI2T.js

@@ -0,0 +1,121 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  ChannelSettingsError,
+  WorkspaceChannelSettingsStore,
+  assertValidChannelSecretUpdates
+} from "./chunk-7RB56BRJ.js";
+import "./chunk-PCRBLMIN.js";
+import "./chunk-NXKOVOM5.js";
+import "./chunk-TSZSGQ3N.js";
+import "./chunk-V6WHFGST.js";
+import "./chunk-U4DJ5XB3.js";
+import "./chunk-IW6RQPQB.js";
+import "./chunk-VWTSRH6C.js";
+import "./chunk-NQ4L2CMD.js";
+import "./chunk-RKUWKYED.js";
+import "./chunk-O5CD7T4T.js";
+import "./chunk-IDS7MSUP.js";
+import "./chunk-I4NRYS6A.js";
+import "./chunk-5EJZE3FP.js";
+import "./chunk-C4TIXFDZ.js";
+import "./chunk-2M3EWQNG.js";
+import "./chunk-65HWLGA7.js";
+import "./chunk-NPQ5ZKRP.js";
+import "./chunk-MR3PXB6E.js";
+import "./chunk-JUARRUMA.js";
+import "./chunk-I2TMJPCV.js";
+import "./chunk-JR42V4UY.js";
+import "./chunk-LJZSMWOH.js";
+import "./chunk-RAFQIHN2.js";
+import "./chunk-L26ONV2Y.js";
+import "./chunk-47RYEQW5.js";
+import "./chunk-IG4W5SJR.js";
+import "./chunk-ZPJWUGCS.js";
+import "./chunk-4UANMABT.js";
+import "./chunk-ZKFTS3OV.js";
+import "./chunk-ENYUKMFK.js";
+import "./chunk-UKYXYWI2.js";
+import "./chunk-3AKCBZVW.js";
+import "./chunk-SULZPKTA.js";
+import "./chunk-VNOVK4I7.js";
+import "./chunk-4F7GQGXB.js";
+import "./chunk-GOFAQQZA.js";
+import "./chunk-5M6IDOMF.js";
+import "./chunk-6HUXPLB5.js";
+import "./chunk-TWPJO254.js";
+import "./chunk-CQ35AJ4Z.js";
+import "./chunk-NSUKQ4DN.js";
+import "./chunk-DQCKVAF5.js";
+import "./chunk-AI35S34R.js";
+import "./chunk-KM3XVTMO.js";
+import "./chunk-6PVPNMXU.js";
+import "./chunk-OKTNXDVO.js";
+import "./chunk-EFTPIZIC.js";
+import "./chunk-IRH27ZC2.js";
+import "./chunk-QHWCP53L.js";
+import "./chunk-UJ4DUYIH.js";
+import "./chunk-QJNDUTOL.js";
+import "./chunk-O6GEWCJA.js";
+import "./chunk-OSSTATJF.js";
+import "./chunk-ZHO2CW6D.js";
+import "./chunk-CVX63TFJ.js";
+import "./chunk-373DQUVA.js";
+import "./chunk-H43PSPYS.js";
+import "./chunk-U6D2PPMN.js";
+import "./chunk-VYIUNFEA.js";
+import "./chunk-KGV55H53.js";
+import "./chunk-7TBU7PU2.js";
+import "./chunk-E4JNFXNI.js";
+import "./chunk-CHEIIBT3.js";
+import "./chunk-TJYRTS4S.js";
+import "./chunk-JX6XHPTX.js";
+import "./chunk-MLXTMF7H.js";
+import "./chunk-PQEISIKS.js";
+import "./chunk-FD5SJOWT.js";
+import "./chunk-4LIFGNI4.js";
+import "./chunk-S6LOFUVP.js";
+import "./chunk-NAVJD2PQ.js";
+import "./chunk-KFN2IZYR.js";
+import "./chunk-GB4UKWY5.js";
+import "./chunk-QHMLYMMS.js";
+import "./chunk-CFKIH3D3.js";
+import "./chunk-2LD5U7Q3.js";
+import "./chunk-DJ2GSRLV.js";
+import "./chunk-S2T7H5MI.js";
+import "./chunk-LKODFJRD.js";
+import "./chunk-LB3WQQJK.js";
+import "./chunk-GH2S4GD5.js";
+import "./chunk-XBVNNDPK.js";
+import "./chunk-VGC4I5JJ.js";
+import "./chunk-DYTW3QVG.js";
+import "./chunk-HT5S5TRQ.js";
+import "./chunk-WZAD4ZNJ.js";
+import "./chunk-FPGTNKCP.js";
+import "./chunk-EIJT2PQ6.js";
+import "./chunk-BFY33IB4.js";
+import "./chunk-KHP66DFN.js";
+import "./chunk-22UH7VTP.js";
+import "./chunk-HHJLM3WQ.js";
+import "./chunk-QKDNS6FU.js";
+import "./chunk-74TONY4F.js";
+import "./chunk-ZDFQGHZH.js";
+import "./chunk-G7HBEEX7.js";
+import "./chunk-QQD2GART.js";
+import "./chunk-AQ37AY7B.js";
+import "./chunk-ODZF64DM.js";
+import "./chunk-7JMGTOH7.js";
+import "./chunk-EAHOJF6V.js";
+import "./chunk-7FA2II6K.js";
+import "./chunk-75DOP5OR.js";
+import "./chunk-DMTGGOSA.js";
+import "./chunk-YQ3U5MUC.js";
+import "./chunk-AMDSOFFV.js";
+import "./chunk-TBWQLLFO.js";
+import "./chunk-5O2XNYP6.js";
+import "./chunk-J2S4EL5Y.js";
+export {
+  ChannelSettingsError,
+  WorkspaceChannelSettingsStore,
+  assertValidChannelSecretUpdates
+};

package/chunks/{channel-worker-group-6NA6BBZV.js → channel-worker-group-47F4ISUZ.js}

@@ -3,24 +3,24 @@
 import {
   ChannelWorkerReconcileError,
   createChannelWorkerGroup
-} from "./chunk-G6FECKTJ.js";
-import "./chunk-OZ6KS6KW.js";
-import "./chunk-ERFDKH32.js";
+} from "./chunk-G5PBOQWI.js";
+import "./chunk-ZGCKTAL5.js";
+import "./chunk-F47DITLZ.js";
 import "./chunk-6PLDPT2C.js";
-import "./chunk-ISKH4QX3.js";
+import "./chunk-TQHPVKO6.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import "./chunk-STUJ7IMZ.js";
 import "./chunk-GYTKQYDB.js";
-import "./chunk-RFIDDFAL.js";
+import "./chunk-M4KFODIP.js";
 import "./chunk-ALMR3E6Q.js";
 import "./chunk-RKFGE7JH.js";
 import "./chunk-UDG5EZJI.js";
 import "./chunk-3VUENPWF.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-5HBA2Z7V.js";
-import "./chunk-ICURCKIU.js";
+import "./chunk-U4DJ5XB3.js";
 import "./chunk-IW6RQPQB.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-LJZSMWOH.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";

package/chunks/{channel-worker-manager-NEZ2J6RK.js → channel-worker-manager-I5Y44GYR.js}

@@ -2,21 +2,21 @@
 "use strict";
 import {
   ChannelWorkerReconcileError
-} from "./chunk-G6FECKTJ.js";
-import "./chunk-OZ6KS6KW.js";
-import "./chunk-ERFDKH32.js";
+} from "./chunk-G5PBOQWI.js";
+import "./chunk-ZGCKTAL5.js";
+import "./chunk-F47DITLZ.js";
 import "./chunk-6PLDPT2C.js";
 import {
   ChannelWorkerStartupError,
   ChannelWorkerStopError
-} from "./chunk-ISKH4QX3.js";
+} from "./chunk-TQHPVKO6.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
   ChannelWebhookEnqueueError
 } from "./chunk-STUJ7IMZ.js";
 import "./chunk-GYTKQYDB.js";
-import "./chunk-RFIDDFAL.js";
+import "./chunk-M4KFODIP.js";
 import "./chunk-ALMR3E6Q.js";
 import {
   ChannelDeliveryError
@@ -24,9 +24,9 @@ import {
 import "./chunk-UDG5EZJI.js";
 import "./chunk-3VUENPWF.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-5HBA2Z7V.js";
-import "./chunk-ICURCKIU.js";
+import "./chunk-U4DJ5XB3.js";
 import "./chunk-IW6RQPQB.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-LJZSMWOH.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
@@ -535,11 +535,52 @@ function createChannelWorkerManager(opts) {
     workspaceActivity(workspaceCwd) {
       return group?.workspaceActivity(workspaceCwd) ?? 0;
     },
-    removeWorkspace(workspaceCwd) {
+    removeWorkspace(workspaceCwd, options) {
       return enqueue(async () => {
         try {
-          await group?.removeWorkspace(workspaceCwd);
-          notify();
+          let removalError;
+          try {
+            await group?.removeWorkspace(workspaceCwd, options);
+          } catch (error) {
+            removalError = error;
+          }
+          try {
+            if (!options?.permanent) {
+              notify();
+            } else {
+              const removedNames = /* @__PURE__ */ new Set();
+              const nextGroups = committedGroups.filter((committedGroup) => {
+                if (committedGroup.workspaceCwd !== workspaceCwd) return true;
+                if (committedGroup.selection.mode === "names") {
+                  for (const name of committedGroup.selection.names) {
+                    removedNames.add(name);
+                  }
+                }
+                return false;
+              });
+              if (!committedSelection || committedSelection.mode === "all") {
+                commit(committedSelection, nextGroups);
+              } else {
+                const names = committedSelection.names.filter(
+                  (name) => !removedNames.has(name)
+                );
+                if (names.length > 0) {
+                  commit({ mode: "names", names }, nextGroups);
+                } else {
+                  await stopSelectionNow();
+                }
+              }
+            }
+          } catch (error) {
+            if (removalError) {
+              throw new AggregateError(
+                [removalError, error],
+                "Failed to remove channel workspace and converge manager state."
+              );
+            }
+            throw error;
+          }
+          if (removalError) throw removalError;
         } finally {
           workspaceDrains.delete(workspaceCwd);
         }

package/chunks/{channel-worker-supervisor-FKU7DIHJ.js → channel-worker-supervisor-6VCLUXFE.js}

@@ -6,20 +6,20 @@ import {
   cleanupMintedWorkerCaBundleDirs,
   createChannelWorkerSupervisor,
   resolveWorkerCaCertPath
-} from "./chunk-ISKH4QX3.js";
+} from "./chunk-TQHPVKO6.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import "./chunk-STUJ7IMZ.js";
 import "./chunk-GYTKQYDB.js";
-import "./chunk-RFIDDFAL.js";
+import "./chunk-M4KFODIP.js";
 import "./chunk-ALMR3E6Q.js";
 import "./chunk-RKFGE7JH.js";
 import "./chunk-UDG5EZJI.js";
 import "./chunk-3VUENPWF.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-5HBA2Z7V.js";
-import "./chunk-ICURCKIU.js";
+import "./chunk-U4DJ5XB3.js";
 import "./chunk-IW6RQPQB.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-LJZSMWOH.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";

package/chunks/{chunk-PPKZ7JOE.js → chunk-22UH7VTP.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createDebugLogger
-} from "./chunk-UHQFIS7N.js";
+} from "./chunk-EAHOJF6V.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-24FVUD5P.js

@@ -0,0 +1,49 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/local-bind-addresses.ts
+init_esbuild_shims();
+import { networkInterfaces } from "node:os";
+function bareAddress(hostname) {
+  const unbracketed = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  const decoded = unbracketed.replace(/%25/gi, "%");
+  const zoneAt = decoded.indexOf("%");
+  return (zoneAt === -1 ? decoded : decoded.slice(0, zoneAt)).toLowerCase();
+}
+__name(bareAddress, "bareAddress");
+function isOwnInterfaceAddress(hostname) {
+  const target = bareAddress(hostname);
+  if (target === "") return false;
+  for (const entries of Object.values(networkInterfaces())) {
+    for (const entry of entries ?? []) {
+      if (entry.address.toLowerCase() === target) return true;
+    }
+  }
+  return false;
+}
+__name(isOwnInterfaceAddress, "isOwnInterfaceAddress");
+function hostAssignsIpv6Loopback(interfaces = networkInterfaces()) {
+  for (const entries of Object.values(interfaces)) {
+    for (const entry of entries ?? []) {
+      if (entry.family === "IPv6" && entry.address === "::1") return true;
+    }
+  }
+  return false;
+}
+__name(hostAssignsIpv6Loopback, "hostAssignsIpv6Loopback");
+
+export {
+  isOwnInterfaceAddress,
+  hostAssignsIpv6Loopback
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-MZCJWS5Y.js → chunk-2M3EWQNG.js}

@@ -36,6 +36,9 @@ var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
   "QWEN_RUNTIME_DIR",
   "QWEN_CODE_MCP_APPROVALS_PATH",
   "QWEN_CODE_TRUSTED_FOLDERS_PATH",
+  // This points to a host temp file that carries build warnings. A project
+  // `.env` must not redirect it to an arbitrary file to read or delete.
+  "QWEN_CODE_WARNINGS_FILE",
   // Runtime attribution markers are stamped by trusted launchers. A project
   // `.env` must not spoof client channel telemetry.
   QWEN_CODE_SERVE_ENV,
@@ -52,6 +55,15 @@ var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
   // it or override a user opt-in through settings.env or a project .env.
   "QWEN_CODE_ENABLE_WORKFLOWS",
   "QWEN_CODE_DISABLE_WORKFLOWS",
+  // The review prebuild (commands/review/lib/prebuild.ts) is an operator
+  // decision: CI welds it as real step env, a local operator exports it. A
+  // project `.env` must not opt its own review into the blocking
+  // install+build prefix — and the read-time provenance check there cannot
+  // see file-sourcing across a process boundary (a child inherits the value
+  // with an empty registry), so the key must never enter the environment
+  // from repository content at all. prebuild.test.ts pins the membership
+  // with both real symbols.
+  "QWEN_REVIEW_PREBUILD",
   // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)
   // disable TLS certificate verification for all outbound API connections. A
   // project `.env` must never enable either — that would let an untrusted repo
@@ -201,6 +213,14 @@ var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
   // (documented as a per-daemon opt-in), so only the daemon's launch
   // environment or a home `.env` may set it.
   "QWEN_SERVE_NEW_FILE_MODE",
+  // QWEN_SERVE_SESSION_ATTACHMENTS_ROOT decides where the daemon stores
+  // every workspace's session attachments. A project `.env` redirecting it
+  // would capture uploads for ALL workspaces the daemon serves — and reads
+  // consult the configured root first, so attacker-modified bytes would be
+  // served back — with no recovery after unsetting the variable. The
+  // location is an operator decision (documented as a per-daemon opt-in), so
+  // only the daemon's launch environment or a home `.env` may set it.
+  "QWEN_SERVE_SESSION_ATTACHMENTS_ROOT",
   // DEV gates the daemon's inherited-loader-env scrub (run-qwen-serve.ts);
   // only the dev harness (scripts/dev.js) stamps it into the launch env. A
   // project file setting it would silently keep loader vars in the base env

package/chunks/{chunk-7T52W4SW.js → chunk-32LU3APX.js}

@@ -6,7 +6,7 @@ import {
   getNestedProperty,
   getPersistScopeForModelSelection,
   restoreSettingsFromBackup
-} from "./chunk-AIAOIFY4.js";
+} from "./chunk-VWTSRH6C.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-42IDLQWS.js → chunk-373DQUVA.js}

@@ -1,20 +1,12 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  INBOXES_DIR,
-  LEADER_NAME,
-  TASKS_DIR,
-  TEAMMATE_COLORS,
-  TEAMS_DIR,
-  TEAM_CONFIG_FILENAME
-} from "./chunk-CPBF7KYF.js";
 import {
   atomicWriteJSON
-} from "./chunk-23RFD54N.js";
+} from "./chunk-KHP66DFN.js";
 import {
   Storage,
   isNodeError
-} from "./chunk-UHQFIS7N.js";
+} from "./chunk-EAHOJF6V.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -22,6 +14,37 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
+// packages/core/src/agents/team/types.ts
+init_esbuild_shims();
+var MAX_TEAMMATES = 10;
+var LEADER_NAME = "leader";
+var TEAMS_DIR = "teams";
+var TASKS_DIR = "tasks";
+var TEAM_CONFIG_FILENAME = "config.json";
+var INBOXES_DIR = "inboxes";
+var TEAMMATE_COLORS = [
+  "#FF6B6B",
+  // red
+  "#4ECDC4",
+  // teal
+  "#45B7D1",
+  // blue
+  "#FFA07A",
+  // salmon
+  "#98D8C8",
+  // mint
+  "#DDA0DD",
+  // plum
+  "#F0E68C",
+  // khaki
+  "#87CEEB",
+  // sky blue
+  "#FFB347",
+  // orange
+  "#B0E0E6"
+  // powder blue
+];
+
 // packages/core/src/agents/team/teamHelpers.ts
 init_esbuild_shims();
 import * as fs2 from "node:fs/promises";
@@ -236,14 +259,26 @@ __name(tryReclaimStaleTeam, "tryReclaimStaleTeam");
 async function deleteTeamDirs(teamName) {
   const teamDir = getTeamDir(teamName);
   const tasksDir = getTasksDir(teamName);
-  await Promise.allSettled([
+  const results = await Promise.allSettled([
     fs2.rm(teamDir, { recursive: true, force: true }),
     fs2.rm(tasksDir, { recursive: true, force: true })
   ]);
+  const errors = results.filter((r) => r.status === "rejected").map((r) => r.reason);
+  if (errors.length === 1) {
+    throw errors[0];
+  }
+  if (errors.length > 1) {
+    throw new AggregateError(
+      errors,
+      `Failed to delete team directories for "${teamName}": ${errors.map((e) => e instanceof Error ? e.message : String(e)).join("; ")}`
+    );
+  }
 }
 __name(deleteTeamDirs, "deleteTeamDirs");
 
 export {
+  MAX_TEAMMATES,
+  LEADER_NAME,
   readProcStartToken,
   readLocalBootId,
   readPidNamespaceId,
@@ -264,11 +299,11 @@ export {
 };
 /**
  * @license
- * Copyright 2026 Qwen
+ * Copyright 2025 Qwen
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
  * @license
- * Copyright 2025 Qwen
+ * Copyright 2026 Qwen
  * SPDX-License-Identifier: Apache-2.0
  */

package/chunks/{chunk-MSBO7X2W.js → chunk-37JFWFCD.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   runExitCleanup
-} from "./chunk-MO3FC2WT.js";
+} from "./chunk-RJUVTJEZ.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-3JXM2CVW.js → chunk-3AKCBZVW.js}

@@ -5,17 +5,17 @@ import {
 } from "./chunk-NAVJD2PQ.js";
 import {
   formatFetchErrorForUser
-} from "./chunk-B466ZSHZ.js";
+} from "./chunk-KFN2IZYR.js";
 import {
   combineAbortSignals
 } from "./chunk-DJ2GSRLV.js";
 import {
   atomicWriteFile
-} from "./chunk-23RFD54N.js";
+} from "./chunk-KHP66DFN.js";
 import {
   Storage,
   createDebugLogger
-} from "./chunk-UHQFIS7N.js";
+} from "./chunk-EAHOJF6V.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-TVC6HQ2U.js → chunk-3JQZVCBI.js}

@@ -6,8 +6,8 @@ import {
 
 // packages/cli/src/generated/git-commit.ts
 init_esbuild_shims();
-var GIT_COMMIT_INFO = "09825973e7";
-var CLI_VERSION = "0.22.3";
+var GIT_COMMIT_INFO = "98a9c96415";
+var CLI_VERSION = "0.23.0";
 
 export {
   GIT_COMMIT_INFO,