@qwen-code/qwen-code 0.23.2-preview.0 → 0.23.2

package/chunks/{chunk-QLM7D7W3.js → chunk-QFJZAY7W.js}

@@ -27,10 +27,10 @@ import {
 } from "./chunk-3VUENPWF.js";
 import {
   loadSettings
-} from "./chunk-Q2F43WTJ.js";
+} from "./chunk-WBU2PIZ5.js";
 import {
   MCP_BUDGET_WARN_FRACTION
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -151,10 +151,10 @@ var serveCommand = {
   }).option("hostname", {
     type: "string",
     default: DEFAULT_SERVE_HOSTNAME,
-    description: "Interface to bind. Loopback (127.0.0.0/8, localhost, ::1, [::1]) is auth-free; anything else requires a token."
+    description: "Interface to bind. Loopback (127.0.0.0/8, localhost, ::1, [::1]) is auth-free; anything else requires a token (one is generated and printed when neither --token nor QWEN_SERVER_TOKEN supplies one). A localhost bind that resolves off-loopback never generates, and still refuses when no token source resolved; an empty value is rejected as operator error."
   }).option("token", {
     type: "string",
-    description: "Bearer token required on every request. Falls back to the QWEN_SERVER_TOKEN env var."
+    description: "Bearer token required on every request. Falls back to the QWEN_SERVER_TOKEN env var; a non-loopback bind with neither generates an ephemeral token at startup, while loopback keeps the trusted tokenless mode unless --require-auth is set."
   }).option("max-sessions", {
     type: "number",
     default: 32,
@@ -182,7 +182,7 @@ var serveCommand = {
   }).option("require-auth", {
     type: "boolean",
     default: false,
-    description: "Refuse to start without a bearer token, even on loopback. Hardens the loopback developer default for shared dev hosts / CI runners / multi-tenant workstations where any local user can hit 127.0.0.1. Requires --token or QWEN_SERVER_TOKEN. /health also requires Authorization when enabled (no loopback exemption \u2014 k8s/Compose probes must pass the bearer too)."
+    description: "Refuse to start without a bearer token, even on loopback. Hardens the loopback developer default for shared dev hosts / CI runners / multi-tenant workstations where any local user can hit 127.0.0.1. Requires --token, QWEN_SERVER_TOKEN, or --open-with-auth (which installs its own generated loopback token); on non-loopback binds the generated ephemeral token also satisfies it, so the no-configured-secret fail-fast is loopback-only. /health also requires Authorization when enabled (no loopback exemption \u2014 k8s/Compose probes must pass the bearer too)."
   }).option("enable-session-shell", {
     type: "boolean",
     default: false,
@@ -447,7 +447,7 @@ var serveCommand = {
     delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
     const openWithAuth = argv["open-with-auth"];
     const open = argv.open || openWithAuth;
-    const { runQwenServe } = await import("./run-qwen-serve-OJYVH7N6.js");
+    const { runQwenServe } = await import("./run-qwen-serve-WBSWWIRV.js");
     try {
       const serveOptions = {
         port: argv.port,
@@ -513,7 +513,7 @@ var serveCommand = {
         ...channelSelection !== void 0 ? { channelSelection } : {}
       };
       if (openWithAuth) {
-        const { applyOpenWithAuth } = await import("./open-with-auth-D6JD6LDS.js");
+        const { applyOpenWithAuth } = await import("./open-with-auth-6MVIHMXB.js");
         applyOpenWithAuth(serveOptions);
       }
       const handle = await runQwenServe(serveOptions);

package/chunks/{chunk-NVS4Z6GT.js → chunk-QHLHE2OT.js}

@@ -6,7 +6,7 @@ import {
   getNestedProperty,
   getPersistScopeForModelSelection,
   restoreSettingsFromBackup
-} from "./chunk-Q2F43WTJ.js";
+} from "./chunk-WBU2PIZ5.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-B44JBZBB.js → chunk-QQK4L3UU.js}

@@ -5,7 +5,7 @@ import {
   readLocalBootId,
   readPidNamespaceId,
   readProcStartToken
-} from "./chunk-BF3RUIVP.js";
+} from "./chunk-CH2YDT6X.js";
 import {
   atomicWriteJSON
 } from "./chunk-XFFRI3WM.js";

package/chunks/{chunk-63ACHB2H.js → chunk-QTB4VP4K.js}

@@ -148,7 +148,7 @@ import {
   canonicalSessionPrUrl,
   normalizeTurnResultError,
   toSessionPrInfo
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   isUnverifiableIdentityError,
   openNoFollow
@@ -165,7 +165,7 @@ import {
   metadataBudgetBytes,
   normalizeSnapshotPayload,
   stableSessionArtifactId
-} from "./chunk-FDOGGKAA.js";
+} from "./chunk-GSFV5RQW.js";
 import {
   APPROVAL_MODES
 } from "./chunk-JX6XHPTX.js";
@@ -4702,6 +4702,8 @@ var BridgeClient = class {
       );
       return;
     }
+    const selected = params["planExecutionMode"];
+    const planExecutionMode = currentModeId === "plan" && typeof selected === "string" && selected !== "plan" && KNOWN_APPROVAL_MODES.has(selected) ? selected : void 0;
     const entry = this.resolveEntry(sessionId);
     if (!entry) {
       writeStderrLine(
@@ -4719,7 +4721,8 @@ var BridgeClient = class {
       this.onModePromoted(
         entry,
         currentModeId,
-        entry.activePromptOriginatorClientId
+        entry.activePromptOriginatorClientId,
+        planExecutionMode
       );
     } else {
       entry.events.publish({
@@ -4729,7 +4732,8 @@ var BridgeClient = class {
           sessionId,
           previous: "default",
           next: currentModeId,
-          persisted: false
+          persisted: false,
+          ...planExecutionMode ? { planExecutionMode } : {}
         },
         ...entry.activePromptOriginatorClientId ? { originatorClientId: entry.activePromptOriginatorClientId } : {}
       });
@@ -8241,14 +8245,19 @@ var MAX_DISPLAY_NAME_LENGTH = 256;
 var MAX_ECHO_CONTENT_BLOCKS = 256;
 function extractPermissionResponseMetadata(response) {
   if (response === null || typeof response !== "object") return void 0;
+  const metadata = {};
   const answers = response.answers;
   if (answers !== null && typeof answers === "object" && !Array.isArray(answers)) {
     const entries = Object.entries(answers);
     if (entries.every(([, v]) => typeof v === "string")) {
-      return { answers };
+      metadata["answers"] = answers;
     }
   }
-  return void 0;
+  const expectedPlanExecutionMode = response.expectedPlanExecutionMode;
+  if (typeof expectedPlanExecutionMode === "string") {
+    metadata["expectedPlanExecutionMode"] = expectedPlanExecutionMode;
+  }
+  return Object.keys(metadata).length > 0 ? metadata : void 0;
 }
 __name(extractPermissionResponseMetadata, "extractPermissionResponseMetadata");
 function parseWorkspaceMemoryRememberResult(response) {
@@ -10001,14 +10010,15 @@ function createAcpSessionBridge(opts) {
           (entry, modelId, originator) => publishModelSwitched(entry, modelId, originator),
           // A2: centralised approval_mode_changed publish on in-session mode
           // promotion. `previous` is read from the bridge state cache.
-          (entry, modeId, originator) => {
+          (entry, modeId, originator, planExecutionMode) => {
             const se = entry;
             publishApprovalModeChanged(
               se,
               {
                 previous: se.currentApprovalMode ?? "default",
                 next: modeId,
-                persisted: false
+                persisted: false,
+                planExecutionMode
               },
               originator
             );
@@ -10924,7 +10934,7 @@ function createAcpSessionBridge(opts) {
     return work;
   }
   __name(applyModelServiceId, "applyModelServiceId");
-  async function applyApprovalMode(entry, mode, persist, originatorClientId) {
+  async function applyApprovalMode(entry, mode, persist, originatorClientId, planMode) {
     if (persist && !persistApprovalMode) {
       throw new Error(
         "setSessionApprovalMode called with `persist: true` but no `persistApprovalMode` callback wired in BridgeOptions. runQwenServe wires the production callback; direct embeds and tests must opt in or omit `persist`."
@@ -10938,7 +10948,11 @@ function createAcpSessionBridge(opts) {
           withTimeout(
             entry.connection.extMethod(
               SERVE_CONTROL_EXT_METHODS.sessionApprovalMode,
-              { sessionId: entry.sessionId, mode }
+              {
+                sessionId: entry.sessionId,
+                mode,
+                ...planMode !== void 0 ? { planMode } : {}
+              }
             ),
             initTimeoutMs,
             SERVE_CONTROL_EXT_METHODS.sessionApprovalMode
@@ -10950,6 +10964,10 @@ function createAcpSessionBridge(opts) {
             `Agent returned unknown approval mode: ${JSON.stringify(response.current)}`
           );
         }
+        if (response.planExecutionMode !== void 0 && (response.planExecutionMode === "plan" || !KNOWN_APPROVAL_MODES.has(response.planExecutionMode))) {
+          throw new Error("Agent returned an invalid plan execution mode");
+        }
+        const planExecutionMode = response.current === "plan" ? response.planExecutionMode : void 0;
         let persisted = false;
         if (persist) {
           try {
@@ -10970,11 +10988,12 @@ function createAcpSessionBridge(opts) {
           {
             previous: response.previous,
             next: response.current,
-            persisted
+            persisted,
+            planExecutionMode
           },
           originatorClientId
         );
-        if (persisted) {
+        if (persisted && planMode === void 0) {
           broadcastWorkspaceEvent(
             {
               type: "approval_mode_changed",
@@ -10993,6 +11012,7 @@ function createAcpSessionBridge(opts) {
               continue;
             }
             peer.currentApprovalMode = response.current;
+            peer.planExecutionMode = void 0;
           }
         }
         succeeded = true;
@@ -11000,7 +11020,8 @@ function createAcpSessionBridge(opts) {
           sessionId: entry.sessionId,
           mode: response.current,
           previous: response.previous,
-          persisted
+          persisted,
+          ...planExecutionMode ? { planExecutionMode } : {}
         };
       } finally {
         entry.approvalModeRoundtripInFlight = false;
@@ -11552,6 +11573,7 @@ function createAcpSessionBridge(opts) {
   }, "publishModelSwitched");
   const publishApprovalModeChanged = /* @__PURE__ */ __name((entry, payload, originatorClientId) => {
     entry.currentApprovalMode = payload.next;
+    entry.planExecutionMode = payload.next === "plan" ? payload.planExecutionMode : void 0;
     entry.approvalModePublishGeneration++;
     entry.events.publish({
       type: "approval_mode_changed",
@@ -11560,7 +11582,8 @@ function createAcpSessionBridge(opts) {
         sessionId: entry.sessionId,
         previous: payload.previous,
         next: payload.next,
-        persisted: payload.persisted
+        persisted: payload.persisted,
+        ...entry.planExecutionMode ? { planExecutionMode: entry.planExecutionMode } : {}
       },
       ...originatorClientId ? { originatorClientId } : {}
     });
@@ -11593,12 +11616,15 @@ function createAcpSessionBridge(opts) {
           publishModelSwitched(entry, actual, void 0);
         }
       } else {
-        const actual = status?.state?.modes?.currentModeId;
+        const modes = status?.state?.modes;
+        const actual = modes?.currentModeId;
+        const selected = modes?._meta?.["planExecutionMode"];
+        const planExecutionMode = actual === "plan" && typeof selected === "string" && selected !== "plan" && KNOWN_APPROVAL_MODES.has(selected) ? selected : void 0;
         if (actual && !KNOWN_APPROVAL_MODES.has(actual)) {
           writeStderrLine(
             `[reconcile] session=${entry.sessionId} target=approvalMode action=dropped reason=unknown_mode mode=${actual}`
           );
-        } else if (actual && actual !== entry.currentApprovalMode) {
+        } else if (actual && (actual !== entry.currentApprovalMode || planExecutionMode !== entry.planExecutionMode)) {
           writeStderrLine(
             `[reconcile] session=${entry.sessionId} target=approvalMode action=corrected cached=${entry.currentApprovalMode ?? "<unset>"} actual=${actual}`
           );
@@ -11607,7 +11633,8 @@ function createAcpSessionBridge(opts) {
             {
               previous: entry.currentApprovalMode ?? "default",
               next: actual,
-              persisted: false
+              persisted: false,
+              planExecutionMode
             },
             void 0
           );
@@ -11886,6 +11913,8 @@ function createAcpSessionBridge(opts) {
     const mode = resp.modes?.currentModeId;
     if (typeof mode === "string" && KNOWN_APPROVAL_MODES.has(mode)) {
       entry.currentApprovalMode = mode;
+      const selected = resp.modes?._meta?.["planExecutionMode"];
+      entry.planExecutionMode = mode === "plan" && typeof selected === "string" && selected !== "plan" && KNOWN_APPROVAL_MODES.has(selected) ? selected : void 0;
     } else if (mode != null) {
       writeStderrLine(
         `[seed] session=${entry.sessionId} target=approvalMode action=dropped value=${JSON.stringify(mode)} reason=${typeof mode !== "string" ? "invalid_type" : "unknown_mode"}`
@@ -13320,6 +13349,7 @@ function createAcpSessionBridge(opts) {
             ...entry.sessionLastSeenAt !== void 0 ? { lastSeenAt: entry.sessionLastSeenAt } : {},
             ...entry.currentModelId ? { currentModelId: entry.currentModelId } : {},
             ...entry.currentApprovalMode ? { currentApprovalMode: entry.currentApprovalMode } : {},
+            ...entry.planExecutionMode ? { planExecutionMode: entry.planExecutionMode } : {},
             maxJournalEvents: journalLimits?.maxEvents ?? maxJournalEvents,
             maxJournalBytes: journalLimits?.maxBytes ?? maxJournalBytes
           };
@@ -14252,6 +14282,7 @@ function createAcpSessionBridge(opts) {
           sessionId: entry.sessionId,
           currentModelId: entry.currentModelId ?? null,
           currentApprovalMode: entry.currentApprovalMode ?? null,
+          ...entry.planExecutionMode ? { planExecutionMode: entry.planExecutionMode } : {},
           recordingDegraded: entry.recordingDegraded
         }
       }), "snapshotFrame");
@@ -15818,7 +15849,8 @@ function createAcpSessionBridge(opts) {
         entry,
         mode,
         opts2.persist,
-        originatorClientId
+        originatorClientId,
+        opts2.planMode
       );
     },
     async generateSessionRecap(sessionId, _context) {

package/chunks/{chunk-4BLTSTF6.js → chunk-R3JIDRUL.js}

@@ -2,21 +2,21 @@
 "use strict";
 import {
   functionResponsePartsToString
-} from "./chunk-ODBNTMZW.js";
+} from "./chunk-FAJPLSYF.js";
 import {
   observeHeadlessToolResultProjection,
   observeHeadlessToolResultWire,
   projectJsonStringToByteBudget
-} from "./chunk-UULHYZ4W.js";
+} from "./chunk-WDN64MVT.js";
 import {
   createNotStartedToolErrorResponse,
   parseAndFormatApiError,
   toolResultBoundaryArtifact
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   formatVisionBridgeNoticeDisplay,
   isVisionBridgeNoticeDisplay
-} from "./chunk-OIPUQE3S.js";
+} from "./chunk-F2NYVASI.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-VEQBVJYH.js → chunk-R457KFV7.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   JsonFormatter
-} from "./chunk-BL6B2QS2.js";
+} from "./chunk-GOEVQADN.js";
 import {
   parseAndFormatApiError
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   FatalBudgetExceededError,
   FatalCancellationError,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-ZAFYHRVY.js";
 import {
   runExitCleanup
-} from "./chunk-JDPBJIKI.js";
+} from "./chunk-DAI65CMX.js";
 import {
   writeStderrLine
 } from "./chunk-7FA2II6K.js";

package/chunks/{chunk-CG2PDIGD.js → chunk-RM244SCQ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   runExitCleanup
-} from "./chunk-JDPBJIKI.js";
+} from "./chunk-DAI65CMX.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-W7PXLIZJ.js → chunk-RNAJVXUG.js}

@@ -2,19 +2,19 @@
 "use strict";
 import {
   loadSettings
-} from "./chunk-Q2F43WTJ.js";
+} from "./chunk-WBU2PIZ5.js";
 import {
   getCurrentLanguage
 } from "./chunk-CRZBDVP2.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-7RXOEUFF.js";
+} from "./chunk-NX7ZTXFF.js";
 import {
   require_strip_json_comments
 } from "./chunk-NPQ5ZKRP.js";
 import {
   hashMcpServerConfig
-} from "./chunk-BL6B2QS2.js";
+} from "./chunk-GOEVQADN.js";
 import {
   Config,
   ExtensionManager,
@@ -25,11 +25,11 @@ import {
   isGatedMcpScope,
   normalizeClaudeMcpServer,
   runWithTimeout
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   getMCPServerLastError,
   getMCPServerStatus
-} from "./chunk-OIPUQE3S.js";
+} from "./chunk-F2NYVASI.js";
 import {
   atomicWriteFile
 } from "./chunk-XFFRI3WM.js";

package/chunks/{chunk-VF6D6EGV.js → chunk-S5QR6CB5.js}

@@ -6,8 +6,11 @@ import {
   DEFAULT_MAX_RETRIES,
   REASONING_EFFORT_TIERS,
   clampReasoningEffort,
+  getGptReasoningCapabilities,
+  isReasoningEffortPlaceholder,
+  parseModelReasoningCapabilities,
   resolveRequestTimeout
-} from "./chunk-6YEOCHSE.js";
+} from "./chunk-VBLAI2HA.js";
 import {
   buildSessionAwareFetch
 } from "./chunk-NOO4QFXM.js";
@@ -6886,6 +6889,22 @@ init_esbuild_shims();
 
 // packages/core/src/core/openaiContentGenerator/provider/default.ts
 init_esbuild_shims();
+
+// packages/core/src/core/openaiContentGenerator/provider/openrouter.ts
+init_esbuild_shims();
+function isOpenRouterHostname(contentGeneratorConfig) {
+  const baseUrl = contentGeneratorConfig.baseUrl ?? "";
+  if (!baseUrl) return false;
+  try {
+    const hostname = new URL(baseUrl).hostname.toLowerCase();
+    return hostname === "openrouter.ai" || hostname.endsWith(".openrouter.ai");
+  } catch {
+    return false;
+  }
+}
+__name(isOpenRouterHostname, "isOpenRouterHostname");
+
+// packages/core/src/core/openaiContentGenerator/provider/default.ts
 var debugLogger = createDebugLogger("DefaultOpenAICompatibleProvider");
 var OPENAI_COMPATIBLE_EFFORTS = [
   "low",
@@ -6971,8 +6990,14 @@ var DefaultOpenAICompatibleProvider = class {
    * clamp calls it through `this`, so a subclass answer applies even on the
    * `super.buildRequest` path.
    */
-  supportedReasoningEffortsFor(_model) {
-    return OPENAI_COMPATIBLE_EFFORTS;
+  supportedReasoningEffortsFor(model) {
+    const gpt = getGptReasoningCapabilities(model);
+    if (!gpt) return OPENAI_COMPATIBLE_EFFORTS;
+    const { authType, baseUrl } = this.contentGeneratorConfig;
+    const configured = authType && model ? parseModelReasoningCapabilities(
+      this.cliConfig.getResolvedModelConfig?.(authType, model, baseUrl)?.capabilities.reasoning
+    ) : void 0;
+    return configured && !configured.toggleOnly ? configured.efforts : gpt.efforts;
   }
   /**
    * Cap the pipeline-injected `reasoning.effort` at what this endpoint accepts.
@@ -6981,8 +7006,8 @@ var DefaultOpenAICompatibleProvider = class {
    * session too.
    *
    * Only the pipeline-injected tier is capped. A `reasoning` object the user
-   * put in `samplingParams` ships verbatim (the pipeline hands those keys
-   * straight to the wire and skips the injection entirely), and `extra_body`
+   * put in `samplingParams` ships verbatim. Unrelated GPT sampling options
+   * still receive the configured effort and need clamping. `extra_body`
    * merges after this, so both explicit overrides survive unchanged.
    */
   clampConfiguredReasoningEffort(request) {
@@ -7021,11 +7046,25 @@ var DefaultOpenAICompatibleProvider = class {
       this.applyOutputTokenLimit(request)
     );
     const messages = isQwen3Model(request.model) ? requestWithTokenLimits.messages.map(mirrorReasoningContentToReasoning) : requestWithTokenLimits.messages;
-    return {
+    const result = {
       ...requestWithTokenLimits,
       messages,
       ...extraBody ? extraBody : {}
     };
+    this.flattenGptReasoningEffort(result);
+    return result;
+  }
+  flattenGptReasoningEffort(body) {
+    if (!getGptReasoningCapabilities(body["model"]) || isOpenRouterHostname(this.contentGeneratorConfig) || this.contentGeneratorConfig.samplingParams?.["reasoning"] !== void 0 || this.contentGeneratorConfig.extra_body?.["reasoning"] !== void 0)
+      return;
+    const reasoning = body["reasoning"];
+    if (typeof reasoning?.effort !== "string" || !reasoning.effort) return;
+    if (isReasoningEffortPlaceholder(body["reasoning_effort"])) {
+      body["reasoning_effort"] = reasoning.effort;
+    }
+    const { effort: _drop, ...rest } = reasoning;
+    if (Object.keys(rest).length > 0) body["reasoning"] = rest;
+    else delete body["reasoning"];
   }
   getDefaultGenerationConfig() {
     return {};
@@ -7405,6 +7444,7 @@ var DashScopeOpenAICompatibleProvider = class _DashScopeOpenAICompatibleProvider
       dropped.add(key);
     }
     this.warnConflictingKnobDrop(model, reasoningEffort, [...dropped]);
+    this.flattenGptReasoningEffort(merged);
     return merged;
   }
   resolveWireModel(model) {
@@ -7719,8 +7759,14 @@ var DashScopeOpenAICompatibleProvider = class _DashScopeOpenAICompatibleProvider
 
 export {
   OpenAI,
+  isOpenRouterHostname,
   DefaultOpenAICompatibleProvider,
   selectDashScopeThinkingKnob,
   DASHSCOPE_REGIONAL_HOSTS,
   DashScopeOpenAICompatibleProvider
 };
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-IRKQ4YYX.js → chunk-SVWWF5TZ.js}

@@ -15374,9 +15374,37 @@ var require_express2 = __commonJS({
   }
 });
 
+// packages/cli/src/serve/web-shell-preauth.ts
+init_esbuild_shims();
+function isDocumentNavigation(req) {
+  const fetchMode = req.headers["sec-fetch-mode"];
+  const fetchDest = req.headers["sec-fetch-dest"];
+  const accept = req.headers.accept ?? "";
+  return fetchMode === "navigate" || fetchDest === "document" || accept.trim().toLowerCase().startsWith("text/html");
+}
+__name(isDocumentNavigation, "isDocumentNavigation");
+var SESSION_DEEP_LINK_PATH = /^\/session\/[^/]+\/?$/u;
+function isPreAuthWebShellRequest(req) {
+  if (req.method !== "GET" && req.method !== "HEAD") return false;
+  const reqPath = req.path.toLowerCase();
+  if (reqPath === "/" || // Express non-strict routing compiles `/` to `/^(?:\/)(?:\/$)?$/i`, so
+  // a raw `//` also matches `app.get('/')` pre-auth (but `///` does not).
+  reqPath === "//" || reqPath === "/assets" || reqPath.startsWith("/assets/") || reqPath === "/mcp-app-sandbox")
+    return true;
+  return SESSION_DEEP_LINK_PATH.test(reqPath) && isDocumentNavigation(req);
+}
+__name(isPreAuthWebShellRequest, "isPreAuthWebShellRequest");
+
 export {
-  require_express2 as require_express
+  require_express2 as require_express,
+  isDocumentNavigation,
+  isPreAuthWebShellRequest
 };
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /*! Bundled license information:
 
 depd/index.js:

package/chunks/{chunk-5HBA2Z7V.js → chunk-TGNNLRC3.js}

@@ -6,16 +6,15 @@ import {
 
 // packages/acp-bridge/dist/channel-control-timeouts.js
 init_esbuild_shims();
-var MAX_DAEMON_WORKSPACES = 25;
 var CHANNEL_WORKER_STARTUP_TIMEOUT_MS = 3e4;
 var CHANNEL_WORKER_STOP_GRACE_MS = 1e4;
 var CHANNEL_WORKER_KILL_GRACE_MS = 2e3;
 var CHANNEL_CONTROL_CLIENT_HEADROOM_MS = 3e4;
+var MAX_CHANNEL_CONTROL_WORKSPACES = 25;
 var CHANNEL_WORKER_STOP_TIMEOUT_MS = CHANNEL_WORKER_STOP_GRACE_MS + CHANNEL_WORKER_KILL_GRACE_MS;
-var CHANNEL_CONTROL_DEFAULT_TIMEOUT_MS = 2 * MAX_DAEMON_WORKSPACES * (CHANNEL_WORKER_STOP_TIMEOUT_MS + CHANNEL_WORKER_STARTUP_TIMEOUT_MS) + CHANNEL_CONTROL_CLIENT_HEADROOM_MS;
+var CHANNEL_CONTROL_DEFAULT_TIMEOUT_MS = 2 * MAX_CHANNEL_CONTROL_WORKSPACES * (CHANNEL_WORKER_STOP_TIMEOUT_MS + CHANNEL_WORKER_STARTUP_TIMEOUT_MS) + CHANNEL_CONTROL_CLIENT_HEADROOM_MS;
 
 export {
-  MAX_DAEMON_WORKSPACES,
   CHANNEL_WORKER_STARTUP_TIMEOUT_MS,
   CHANNEL_WORKER_STOP_GRACE_MS,
   CHANNEL_WORKER_KILL_GRACE_MS,

package/chunks/{chunk-ORREXWOM.js → chunk-TODNHE76.js}

@@ -5,20 +5,20 @@ import {
 } from "./chunk-57OAHC2Y.js";
 import {
   loadSettings
-} from "./chunk-Q2F43WTJ.js";
+} from "./chunk-WBU2PIZ5.js";
 import {
   getCurrentLanguage,
   t
 } from "./chunk-CRZBDVP2.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-7RXOEUFF.js";
+} from "./chunk-NX7ZTXFF.js";
 import {
   ExtensionManager,
   getExtensionDescription,
   getExtensionDisplayName,
   require_prompts
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   stripAnsi
 } from "./chunk-TWPJO254.js";

package/chunks/{chunk-W3ONSAYO.js → chunk-TOOOLHVS.js}

@@ -9,11 +9,11 @@ import {
 import {
   findProviderByCredentials,
   resolveMetadataKey
-} from "./chunk-BL6B2QS2.js";
+} from "./chunk-2WC3Y7YY.js";
 import {
   fetchGitDiff,
   isCompressionFailureStatus
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-EHTKOO6W.js → chunk-TRQNRP2H.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-FAWTMDX7.js";
 import {
   ChannelWorkerStartupError
-} from "./chunk-CABDNUJ4.js";
+} from "./chunk-KEPC5BOL.js";
 import {
   ChannelWebhookEnqueueError
 } from "./chunk-STUJ7IMZ.js";
@@ -17,7 +17,7 @@ import {
 } from "./chunk-RKFGE7JH.js";
 import {
   CHANNEL_LOOP_MCP_SERVER_NAME
-} from "./chunk-XVTCSVBK.js";
+} from "./chunk-WDVV3LRM.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-PQWM4SX2.js → chunk-U6REWGVR.js}

@@ -3,11 +3,11 @@
 import {
   TURN_INTERRUPTION_HISTORY_TAIL_COUNT,
   detectTurnInterruption
-} from "./chunk-BL6B2QS2.js";
+} from "./chunk-GOEVQADN.js";
 import {
   SessionService,
   buildApiHistoryFromConversation
-} from "./chunk-43CI6YWJ.js";
+} from "./chunk-HJ5UJQQL.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-UXDVUFKU.js → chunk-ULZECEIP.js}

@@ -3,10 +3,10 @@
 import {
   getPlugin,
   supportedTypes
-} from "./chunk-UHUT4IDM.js";
+} from "./chunk-PFKGV6PO.js";
 import {
   resolveChannelCwd
-} from "./chunk-3BTHHXXE.js";
+} from "./chunk-AUTUFD5X.js";
 import {
   isInternalSecretEnvVar
 } from "./chunk-65I7S4Z3.js";