@qwen-code/qwen-code 0.23.1 → 0.23.2-nightly.20260909.2e212144d3

package/chunks/{chunk-2YS3NU4A.js → chunk-BDP3NTWD.js}

@@ -2,15 +2,15 @@
 "use strict";
 import {
   appEvents
-} from "./chunk-DXQ6Z7AH.js";
+} from "./chunk-3O77M472.js";
 import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   getPromptableMcpServers
-} from "./chunk-TGC4264Q.js";
+} from "./chunk-OVTPETDL.js";
 import {
   getMCPServerStatus
-} from "./chunk-6QV7Z74P.js";
+} from "./chunk-FRS3P7MQ.js";
 import {
   require_fast_deep_equal
 } from "./chunk-MWIO7MF6.js";

package/chunks/{chunk-IKG2YVRZ.js → chunk-BZUHZCUO.js}

@@ -3,11 +3,11 @@
 import {
   TURN_INTERRUPTION_HISTORY_TAIL_COUNT,
   detectTurnInterruption
-} from "./chunk-ZU2T5JIS.js";
+} from "./chunk-ZEFWBG2C.js";
 import {
   SessionService,
   buildApiHistoryFromConversation
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-USN6VNTO.js → chunk-C24ZDDNY.js}

@@ -64,7 +64,7 @@ async function runExitCleanup(options = {}) {
 }
 __name(runExitCleanup, "runExitCleanup");
 async function cleanupCheckpoints() {
-  const { Storage } = await import("./deferred-core-runtime-LO5NTQQ4.js");
+  const { Storage } = await import("./deferred-core-runtime-D2RF35BL.js");
   const storage = new Storage(process.cwd());
   const tempDir = storage.getProjectTempDir();
   const checkpointsDir = join(tempDir, "checkpoints");

package/chunks/{chunk-RPFJJ33Z.js → chunk-CALTQWTZ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   createTask
-} from "./chunk-YHDGABDC.js";
+} from "./chunk-XKBFYTCD.js";
 import {
   getPlanRequiredTeammatePreApprovalMessage,
   isPlanRequiredTeammateAwaitingApproval

package/chunks/{chunk-BF3RUIVP.js → chunk-CH2YDT6X.js}

@@ -14,42 +14,6 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
-// packages/core/src/agents/team/types.ts
-init_esbuild_shims();
-var MAX_TEAMMATES = 10;
-var LEADER_NAME = "leader";
-var TEAMS_DIR = "teams";
-var TASKS_DIR = "tasks";
-var TEAM_CONFIG_FILENAME = "config.json";
-var INBOXES_DIR = "inboxes";
-var TEAMMATE_COLORS = [
-  "#FF6B6B",
-  // red
-  "#4ECDC4",
-  // teal
-  "#45B7D1",
-  // blue
-  "#FFA07A",
-  // salmon
-  "#98D8C8",
-  // mint
-  "#DDA0DD",
-  // plum
-  "#F0E68C",
-  // khaki
-  "#87CEEB",
-  // sky blue
-  "#FFB347",
-  // orange
-  "#B0E0E6"
-  // powder blue
-];
-
-// packages/core/src/agents/team/teamHelpers.ts
-init_esbuild_shims();
-import * as fs2 from "node:fs/promises";
-import * as path from "node:path";
-
 // packages/core/src/utils/process-liveness.ts
 init_esbuild_shims();
 import * as fs from "node:fs";
@@ -126,7 +90,41 @@ function isSameProcess(pid, procStart) {
 }
 __name(isSameProcess, "isSameProcess");
 
+// packages/core/src/agents/team/types.ts
+init_esbuild_shims();
+var MAX_TEAMMATES = 10;
+var LEADER_NAME = "leader";
+var TEAMS_DIR = "teams";
+var TASKS_DIR = "tasks";
+var TEAM_CONFIG_FILENAME = "config.json";
+var INBOXES_DIR = "inboxes";
+var TEAMMATE_COLORS = [
+  "#FF6B6B",
+  // red
+  "#4ECDC4",
+  // teal
+  "#45B7D1",
+  // blue
+  "#FFA07A",
+  // salmon
+  "#98D8C8",
+  // mint
+  "#DDA0DD",
+  // plum
+  "#F0E68C",
+  // khaki
+  "#87CEEB",
+  // sky blue
+  "#FFB347",
+  // orange
+  "#B0E0E6"
+  // powder blue
+];
+
 // packages/core/src/agents/team/teamHelpers.ts
+init_esbuild_shims();
+import * as fs2 from "node:fs/promises";
+import * as path from "node:path";
 function getTeamsRootDir() {
   return path.join(Storage.getGlobalQwenDir(), TEAMS_DIR);
 }
@@ -300,11 +298,11 @@ export {
 };
 /**
  * @license
- * Copyright 2025 Qwen
+ * Copyright 2026 Qwen
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
  * @license
- * Copyright 2026 Qwen
+ * Copyright 2025 Qwen
  * SPDX-License-Identifier: Apache-2.0
  */

package/chunks/{chunk-3VDLQUR2.js → chunk-D6AGS266.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-MR3PXB6E.js";
 import {
   ideContextStore
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   require_proper_lockfile
 } from "./chunk-MLXTMF7H.js";

package/chunks/{chunk-DO5SMV52.js → chunk-D7DFZAK2.js}

@@ -3,7 +3,7 @@
 import {
   buildModelReasoningConfigPreview,
   resolvePersistedReasoningConfigState
-} from "./chunk-JGDRB4FP.js";
+} from "./chunk-N3Z6Q7KC.js";
 import {
   ACP_ROUTE_ID_PREFIX,
   buildAcpModelOptions,
@@ -12,7 +12,7 @@ import {
   parseAcpBaseModelId,
   resolveCliGenerationConfig,
   sanitizeProviderBaseUrl
-} from "./chunk-ARYNBBBM.js";
+} from "./chunk-6GAYNM3F.js";
 import {
   snapshotProcessEnv
 } from "./chunk-6RZX2HIH.js";
@@ -21,16 +21,16 @@ import {
 } from "./chunk-FETY36NQ.js";
 import {
   loadSettings
-} from "./chunk-66JBCTJF.js";
+} from "./chunk-Y7YHAY32.js";
 import {
   ModelsConfig
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   APPROVAL_MODES
 } from "./chunk-JX6XHPTX.js";
 import {
   tokenLimit
-} from "./chunk-FPGTNKCP.js";
+} from "./chunk-F3M6P6IQ.js";
 import {
   createDebugLogger
 } from "./chunk-ZAFYHRVY.js";
@@ -121,19 +121,25 @@ function buildWorkspaceProvidersStatus(workspaceCwd, acpChannelLive, options) {
         providers.set(authType, provider);
       }
       const isCurrent = currentAuth === model.authType && currentAcpModelId === modelId;
+      const resolved = modelId.startsWith(ACP_ROUTE_ID_PREFIX) ? void 0 : modelsConfig.getResolvedModel(
+        model.authType,
+        model.id,
+        model.registryBaseUrl ?? model.baseUrl
+      );
       const configOptions = modelId.startsWith(ACP_ROUTE_ID_PREFIX) ? void 0 : buildModelReasoningConfigPreview(
         model.id,
         resolvePersistedReasoningConfigState(
           model.id,
           settings.model?.reasoningEffort,
-          modelsConfig.getResolvedModel(
-            model.authType,
-            model.id,
-            model.registryBaseUrl ?? model.baseUrl
-          )?.generationConfig.thinkingMandatory === true,
+          resolved?.generationConfig.thinkingMandatory === true,
           model.capabilities?.reasoning
         ),
-        model.capabilities?.reasoning
+        model.capabilities?.reasoning,
+        resolved ? {
+          ...resolved.generationConfig,
+          model: model.id,
+          baseUrl: resolved.baseUrl
+        } : void 0
       );
       const providerModel = {
         modelId,

package/chunks/{chunk-GM44O6F7.js → chunk-DARWOZY6.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-M5GB774H.js";
 import {
   sanitizeLogText
-} from "./chunk-XVTCSVBK.js";
+} from "./chunk-WDVV3LRM.js";
 import {
   stripAnsi
 } from "./chunk-TWPJO254.js";

package/chunks/{chunk-HUX2DOTF.js → chunk-DGNRLJ6S.js}

@@ -8,14 +8,14 @@ import {
   estimateContextTextTokens,
   formatContextFileDisplayPath,
   getMainSessionBaseSystemPrompt
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   DiscoveredMCPTool,
   uiTelemetryService
-} from "./chunk-6QV7Z74P.js";
+} from "./chunk-FRS3P7MQ.js";
 import {
   DEFAULT_TOKEN_LIMIT
-} from "./chunk-FPGTNKCP.js";
+} from "./chunk-F3M6P6IQ.js";
 import {
   buildSkillLlmContent
 } from "./chunk-O2FEO2CB.js";

package/chunks/{chunk-FW4E4QPG.js → chunk-DVOCOIS5.js}

@@ -6,7 +6,7 @@ import {
   getNestedProperty,
   getPersistScopeForModelSelection,
   restoreSettingsFromBackup
-} from "./chunk-66JBCTJF.js";
+} from "./chunk-Y7YHAY32.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-OESZTXTG.js → chunk-E4LXNQAK.js}

@@ -3,7 +3,7 @@
 import {
   getGitVersion,
   getNpmVersion
-} from "./chunk-5IL2BZHW.js";
+} from "./chunk-O6BFERWN.js";
 import {
   buildEnvStatusFromEnv,
   snapshotProcessEnv

package/chunks/{chunk-TWAMIEQ2.js → chunk-EATP5QCN.js}

@@ -6,16 +6,16 @@ import {
 } from "./chunk-CALNF3Z3.js";
 import {
   JsonOutputAdapter
-} from "./chunk-WNISCNTA.js";
+} from "./chunk-L5VHJYHH.js";
 import {
   StreamJsonOutputAdapter
-} from "./chunk-3VWPPK5Q.js";
+} from "./chunk-PWR6BQ3U.js";
 import {
   normalizePartList
 } from "./chunk-5IENVM7Z.js";
 import {
   handleAtCommand
-} from "./chunk-ENZDGHGJ.js";
+} from "./chunk-76I36BEM.js";
 import {
   buildInitialSystemReminders,
   buildSystemMessage,
@@ -26,11 +26,11 @@ import {
   handleSlashCommand,
   insertAfterFunctionResponses,
   isSlashCommand
-} from "./chunk-ZNO5BUAD.js";
+} from "./chunk-4DIMJKWU.js";
 import {
   RunBudgetEnforcer,
   cleanupReviewWorktreeLeases
-} from "./chunk-DXQ6Z7AH.js";
+} from "./chunk-3O77M472.js";
 import {
   AlreadyReportedError,
   handleBudgetExceededError,
@@ -38,17 +38,17 @@ import {
   handleError,
   handleMaxTurnsExceededError,
   handleToolError
-} from "./chunk-6JXHO7LG.js";
+} from "./chunk-SYKPMH2X.js";
 import {
   isInlineModelOverrideAllowed
-} from "./chunk-ARYNBBBM.js";
+} from "./chunk-6GAYNM3F.js";
 import {
   buildGoalContinuationParts,
   buildSessionRecoveryPlanFromApiHistory,
   detectAutonomousSentinel,
   detectLoopSentinel,
   executeToolCall
-} from "./chunk-ZU2T5JIS.js";
+} from "./chunk-ZEFWBG2C.js";
 import {
   restoreWorktreeContext
 } from "./chunk-YZTGGCEE.js";
@@ -72,7 +72,7 @@ import {
   parseAndFormatApiError,
   partitionByConcurrencySafety,
   recordHandledToolCall
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -91,7 +91,7 @@ import {
   shouldRunVisionBridge,
   splitImageParts,
   uiTelemetryService
-} from "./chunk-6QV7Z74P.js";
+} from "./chunk-FRS3P7MQ.js";
 import {
   endInteractionSpan,
   getActiveInteractionSpan,
@@ -112,7 +112,7 @@ import {
 } from "./chunk-ZAFYHRVY.js";
 import {
   registerCleanup
-} from "./chunk-USN6VNTO.js";
+} from "./chunk-C24ZDDNY.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -407,19 +407,17 @@ async function runNonInteractive(config, settings, input, prompt_id, options = {
     const goalHost = {
       startGoalTurn: /* @__PURE__ */ __name(async (input2) => {
         if (queuedGoalTurns.some(
-          ({ permit }) => permit.turnId === input2.permit.turnId
+          ({ permit: permit2 }) => permit2.turnId === input2.permit.turnId
         )) {
           return;
         }
+        const { permit, ...continuation } = input2;
         queuedGoalTurns.push({
-          permit: { ...input2.permit },
-          turnKey: `goal-runtime:${input2.permit.turnId}`,
+          permit: { ...permit },
+          turnKey: `goal-runtime:${permit.turnId}`,
           controller: new AbortController(),
           origin: "runtime",
-          continuationContext: input2.continuationContext,
-          ...input2.objectiveUpdated ? { objectiveUpdated: input2.objectiveUpdated } : {},
-          ...input2.windDown ? { windDown: true } : {},
-          ...input2.verifierFeedback ? { verifierFeedback: input2.verifierFeedback } : {}
+          ...continuation
         });
       }, "startGoalTurn"),
       preemptGoalTurn: /* @__PURE__ */ __name((reason) => {

package/chunks/{chunk-DZ6D4B3K.js → chunk-EDSU3VUG.js}

@@ -2,20 +2,20 @@
 "use strict";
 import {
   getExtensionManager
-} from "./chunk-EEKU6COG.js";
+} from "./chunk-6S7YYUUH.js";
 import {
   parseChannelConfig
-} from "./chunk-UXDVUFKU.js";
+} from "./chunk-JFAGT5YG.js";
 import {
   getPlugin,
   registerPlugin
-} from "./chunk-UHUT4IDM.js";
+} from "./chunk-7IDZFJAV.js";
 import {
   sanitizeLogText
-} from "./chunk-XVTCSVBK.js";
+} from "./chunk-WDVV3LRM.js";
 import {
   loadSettings
-} from "./chunk-66JBCTJF.js";
+} from "./chunk-Y7YHAY32.js";
 import {
   hashDaemonWorkspace
 } from "./chunk-7OCIQNKX.js";
@@ -38,6 +38,12 @@ init_esbuild_shims();
 import { createHash } from "node:crypto";
 import * as path from "node:path";
 import { pathToFileURL } from "node:url";
+function resolveChannelLocale(value) {
+  if (typeof value !== "string") return "en";
+  const language = value.trim().replaceAll("_", "-").toLowerCase();
+  return language === "zh" || language.startsWith("zh-") || language === "chinese" || language === "\u4E2D\u6587" ? "zh" : "en";
+}
+__name(resolveChannelLocale, "resolveChannelLocale");
 function sessionsPath() {
   return path.join(Storage.getGlobalQwenDir(), "channels", "sessions.json");
 }
@@ -289,6 +295,7 @@ async function parseConfiguredChannels(channelsConfig, selectedNames, opts = {})
 __name(parseConfiguredChannels, "parseConfiguredChannels");
 
 export {
+  resolveChannelLocale,
   sessionsPath,
   daemonSessionRoutesPath,
   daemonObservedContactsPath,

package/chunks/{chunk-EOET4H7C.js → chunk-EE5ZD4XU.js}

@@ -3,7 +3,7 @@
 import {
   getUserSettingsPath,
   v1ToV2Migration
-} from "./chunk-66JBCTJF.js";
+} from "./chunk-Y7YHAY32.js";
 import {
   getSystemDefaultsPath,
   getSystemSettingsPath
@@ -13,7 +13,7 @@ import {
   TrustLevel,
   getExplicitTrustLevel,
   getTrustedFoldersPath
-} from "./chunk-3VDLQUR2.js";
+} from "./chunk-D6AGS266.js";
 import {
   require_strip_json_comments
 } from "./chunk-NPQ5ZKRP.js";
@@ -22,7 +22,7 @@ import {
 } from "./chunk-MR3PXB6E.js";
 import {
   ideContextStore
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-B3EL44K3.js → chunk-EN3Q2S3J.js}

@@ -5,7 +5,7 @@ import {
   parseChannelDelivery,
   scheduledTaskRunSessionName,
   scheduledTaskRunSourceId
-} from "./chunk-WAASYFPK.js";
+} from "./chunk-VJWJOKOQ.js";
 import {
   parseCallerSuppliedSessionId
 } from "./chunk-ZEZKIS2K.js";
@@ -14,7 +14,7 @@ import {
 } from "./chunk-NYWWQ437.js";
 import {
   SCHEDULED_TASK_RUN_SOURCE_TYPE
-} from "./chunk-2TMJRF46.js";
+} from "./chunk-ZZ7RVOTU.js";
 import {
   SessionNotFoundError
 } from "./chunk-FAWTMDX7.js";
@@ -30,7 +30,7 @@ import {
 import {
   SessionService,
   stripTerminalControlSequences
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   MAX_JOBS,
   nextDurableFireMs

package/chunks/{chunk-N7YQEKGX.js → chunk-EOLGAQ25.js}

@@ -14,14 +14,6 @@ import {
 init_esbuild_shims();
 var DEFAULT_QWEN_MODEL = "coder-model";
 
-// packages/core/src/config/models.ts
-init_esbuild_shims();
-var DEFAULT_QWEN_EMBEDDING_MODEL = "text-embedding-v4";
-var MAINLINE_CODER_MODEL = "qwen3.7-max";
-
-// packages/core/src/core/contentGenerator.ts
-init_esbuild_shims();
-
 // packages/core/src/models/modelConfigErrors.ts
 init_esbuild_shims();
 function getDefaultApiKeyEnvVar(authType) {
@@ -136,6 +128,14 @@ var MissingAnthropicBaseUrlEnvError = class extends ModelConfigError {
   }
 };
 
+// packages/core/src/config/models.ts
+init_esbuild_shims();
+var DEFAULT_QWEN_EMBEDDING_MODEL = "text-embedding-v4";
+var MAINLINE_CODER_MODEL = "qwen3.7-max";
+
+// packages/core/src/core/contentGenerator.ts
+init_esbuild_shims();
+
 // packages/core/src/models/constants.ts
 init_esbuild_shims();
 var MODEL_GENERATION_CONFIG_FIELDS = [
@@ -411,7 +411,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
   try {
     if (authType === "openai" /* USE_OPENAI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-NSU3ERBH.js");
+        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-FHKDWNI2.js");
         return createOpenAIContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "qwen-oauth" /* QWEN_OAUTH */) {
@@ -422,7 +422,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
           isInitialAuth ? { requireCachedCredentials: true } : void 0
         );
         loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-          const { QwenContentGenerator } = await import("./qwenContentGenerator-HTA57WFC.js");
+          const { QwenContentGenerator } = await import("./qwenContentGenerator-KFJ77JP6.js");
           return new QwenContentGenerator(qwenClient, generatorConfig, config);
         }, "loadBaseGenerator");
       } catch (error) {
@@ -433,12 +433,12 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       }
     } else if (authType === "anthropic" /* USE_ANTHROPIC */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-I7LQZH26.js");
+        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-VIW2FG7G.js");
         return createAnthropicContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "gemini" /* USE_GEMINI */ || authType === "vertex-ai" /* USE_VERTEX_AI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createLlmContentGenerator } = await import("./llm-content-generator-VLMZ2A7A.js");
+        const { createLlmContentGenerator } = await import("./llm-content-generator-GOV3A23T.js");
         return createLlmContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else {
@@ -453,7 +453,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
     try {
       const [baseGenerator, { LoggingContentGenerator }] = await Promise.all([
         loadBaseGenerator(),
-        import("./loggingContentGenerator-RGVUMUVX.js")
+        import("./loggingContentGenerator-SSHNN5YW.js")
       ]);
       return new LoggingContentGenerator(
         baseGenerator,
@@ -469,6 +469,7 @@ __name(createContentGenerator, "createContentGenerator");
 
 export {
   DEFAULT_QWEN_MODEL,
+  getDefaultApiKeyEnvVar,
   VERTEX_ADC_HINT,
   DEFAULT_QWEN_EMBEDDING_MODEL,
   MAINLINE_CODER_MODEL,
@@ -492,11 +493,11 @@ export {
  */
 /**
  * @license
- * Copyright 2025 Google LLC
+ * Copyright 2025 Qwen Team
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
  * @license
- * Copyright 2025 Qwen Team
+ * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */

package/chunks/{chunk-3YQMUBTS.js → chunk-EYCW6UF2.js}

@@ -27,10 +27,10 @@ import {
 } from "./chunk-3VUENPWF.js";
 import {
   loadSettings
-} from "./chunk-66JBCTJF.js";
+} from "./chunk-Y7YHAY32.js";
 import {
   MCP_BUDGET_WARN_FRACTION
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -151,10 +151,10 @@ var serveCommand = {
   }).option("hostname", {
     type: "string",
     default: DEFAULT_SERVE_HOSTNAME,
-    description: "Interface to bind. Loopback (127.0.0.0/8, localhost, ::1, [::1]) is auth-free; anything else requires a token."
+    description: "Interface to bind. Loopback (127.0.0.0/8, localhost, ::1, [::1]) is auth-free; anything else requires a token (one is generated and printed when neither --token nor QWEN_SERVER_TOKEN supplies one). A localhost bind that resolves off-loopback never generates, and still refuses when no token source resolved; an empty value is rejected as operator error."
   }).option("token", {
     type: "string",
-    description: "Bearer token required on every request. Falls back to the QWEN_SERVER_TOKEN env var."
+    description: "Bearer token required on every request. Falls back to the QWEN_SERVER_TOKEN env var; a non-loopback bind with neither generates an ephemeral token at startup, while loopback keeps the trusted tokenless mode unless --require-auth is set."
   }).option("max-sessions", {
     type: "number",
     default: 32,
@@ -182,7 +182,7 @@ var serveCommand = {
   }).option("require-auth", {
     type: "boolean",
     default: false,
-    description: "Refuse to start without a bearer token, even on loopback. Hardens the loopback developer default for shared dev hosts / CI runners / multi-tenant workstations where any local user can hit 127.0.0.1. Requires --token or QWEN_SERVER_TOKEN. /health also requires Authorization when enabled (no loopback exemption \u2014 k8s/Compose probes must pass the bearer too)."
+    description: "Refuse to start without a bearer token, even on loopback. Hardens the loopback developer default for shared dev hosts / CI runners / multi-tenant workstations where any local user can hit 127.0.0.1. Requires --token, QWEN_SERVER_TOKEN, or --open-with-auth (which installs its own generated loopback token); on non-loopback binds the generated ephemeral token also satisfies it, so the no-configured-secret fail-fast is loopback-only. /health also requires Authorization when enabled (no loopback exemption \u2014 k8s/Compose probes must pass the bearer too)."
   }).option("enable-session-shell", {
     type: "boolean",
     default: false,
@@ -447,7 +447,7 @@ var serveCommand = {
     delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
     const openWithAuth = argv["open-with-auth"];
     const open = argv.open || openWithAuth;
-    const { runQwenServe } = await import("./run-qwen-serve-A3JBOZCM.js");
+    const { runQwenServe } = await import("./run-qwen-serve-KYBDQRDD.js");
     try {
       const serveOptions = {
         port: argv.port,
@@ -513,7 +513,7 @@ var serveCommand = {
         ...channelSelection !== void 0 ? { channelSelection } : {}
       };
       if (openWithAuth) {
-        const { applyOpenWithAuth } = await import("./open-with-auth-D6JD6LDS.js");
+        const { applyOpenWithAuth } = await import("./open-with-auth-6MVIHMXB.js");
         applyOpenWithAuth(serveOptions);
       }
       const handle = await runQwenServe(serveOptions);

package/chunks/{chunk-ZELCTN6Y.js → chunk-F23YN37B.js}

@@ -12,6 +12,15 @@ import {
 
 // packages/cli/src/serve/serve-token.ts
 init_esbuild_shims();
+import { randomBytes } from "node:crypto";
+function resolveRemoteServeToken(optionToken, loopback, environmentToken = process.env[QWEN_SERVER_TOKEN_ENV]) {
+  const generated = !loopback && optionToken === void 0 && environmentToken === void 0;
+  return {
+    token: generated ? randomBytes(16).toString("base64url") : resolveServeToken(optionToken, environmentToken),
+    generated
+  };
+}
+__name(resolveRemoteServeToken, "resolveRemoteServeToken");
 function resolveServeToken(optionToken, environmentToken = process.env[QWEN_SERVER_TOKEN_ENV]) {
   const selected = optionToken ?? environmentToken;
   const trimmed = selected?.trim();
@@ -20,6 +29,7 @@ function resolveServeToken(optionToken, environmentToken = process.env[QWEN_SERV
 __name(resolveServeToken, "resolveServeToken");
 
 export {
+  resolveRemoteServeToken,
   resolveServeToken
 };
 /**