@qwen-code/qwen-code 0.23.3 → 0.23.4

package/chunks/{chunk-3I7W2POO.js → chunk-FGROOEKM.js}

@@ -4,9 +4,6 @@ import {
   isDocumentNavigation,
   require_express
 } from "./chunk-SVWWF5TZ.js";
-import {
-  isLoopbackAddress
-} from "./chunk-DMEUXLSS.js";
 import {
   writeStderrLine
 } from "./chunk-7FA2II6K.js";
@@ -39,6 +36,7 @@ var WEB_SHELL_CSP_DIRECTIVES = [
   "style-src 'self' 'unsafe-inline'",
   "font-src 'self' data:",
   "img-src 'self' data: blob:",
+  "media-src 'self' data:",
   "connect-src 'self'",
   "worker-src 'self' blob:",
   // base-uri does NOT fall back to default-src; lock it so an injected <base>
@@ -46,36 +44,6 @@ var WEB_SHELL_CSP_DIRECTIVES = [
   // attacker origin.
   "base-uri 'none'"
 ];
-function loopbackSandboxOrigins(hostHeader) {
-  const port = portFromHostHeader(hostHeader);
-  const suffix = port ? `:${port}` : "";
-  const hosts = ["localhost", "127.0.0.1"];
-  try {
-    const requestHostname = new URL(`http://${hostHeader}`).hostname;
-    if (isLoopbackAddress(requestHostname) && !requestHostname.includes(":") && !hosts.includes(requestHostname)) {
-      hosts.push(requestHostname);
-    }
-  } catch {
-  }
-  return ["http", "https"].flatMap(
-    (scheme) => hosts.map((host) => `${scheme}://${host}${suffix}`)
-  );
-}
-__name(loopbackSandboxOrigins, "loopbackSandboxOrigins");
-function portFromHostHeader(hostHeader) {
-  if (!hostHeader) return void 0;
-  if (hostHeader.startsWith("[")) {
-    const end = hostHeader.indexOf("]");
-    if (end === -1) return void 0;
-    const rest = hostHeader.slice(end + 1);
-    return rest.startsWith(":") && /^\d+$/u.test(rest.slice(1)) ? rest.slice(1) : void 0;
-  }
-  const colon = hostHeader.lastIndexOf(":");
-  if (colon === -1) return void 0;
-  const port = hostHeader.slice(colon + 1);
-  return /^\d+$/u.test(port) ? port : void 0;
-}
-__name(portFromHostHeader, "portFromHostHeader");
 function buildWebShellPermissionsPolicy() {
   return [
     "camera=()",
@@ -86,18 +54,17 @@ function buildWebShellPermissionsPolicy() {
   ].join(", ");
 }
 __name(buildWebShellPermissionsPolicy, "buildWebShellPermissionsPolicy");
-function buildWebShellCsp(frameAncestors = [], frameSrcOrigins = loopbackSandboxOrigins(void 0)) {
+function buildWebShellCsp(frameAncestors = []) {
   const fa = frameAncestors.length ? `frame-ancestors ${frameAncestors.join(" ")}` : "frame-ancestors 'none'";
-  const frameSrc = `frame-src blob: ${frameSrcOrigins.join(" ")}`;
+  const frameSrc = "frame-src http: https: blob:";
   return [...WEB_SHELL_CSP_DIRECTIVES, frameSrc, fa].join("; ");
 }
 __name(buildWebShellCsp, "buildWebShellCsp");
 var WEB_SHELL_CSP = buildWebShellCsp();
 function createSendIndex(webShellDir, frameAncestors = []) {
   const indexPath = path.join(webShellDir, "index.html");
-  return (req, res) => {
-    const sandboxOrigins = loopbackSandboxOrigins(req.get("host"));
-    const csp = buildWebShellCsp(frameAncestors, sandboxOrigins);
+  return (_req, res) => {
+    const csp = buildWebShellCsp(frameAncestors);
     res.status(200).set("Content-Security-Policy", csp).set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "no-referrer").set(
       // `microphone=(self)` lets the same-origin Web Shell document request
       // the mic for voice dictation (the prompt won't even appear under an
@@ -171,8 +138,6 @@ __name(mountWebShellSpaFallback, "mountWebShellSpaFallback");
 
 export {
   isServeDebugMode,
-  loopbackSandboxOrigins,
-  portFromHostHeader,
   buildWebShellPermissionsPolicy,
   buildWebShellCsp,
   WEB_SHELL_CSP,

package/chunks/{chunk-HNLMYDQE.js → chunk-FMLBBXHB.js}

@@ -7,8 +7,11 @@ import {
   getRetryDelayMs,
   isQuotaExhaustedError,
   isQwenQuotaExceededError,
-  isRateLimitError
-} from "./chunk-4ALNJDHL.js";
+  isRetryableUpstreamError
+} from "./chunk-ZKIAGIGH.js";
+import {
+  ResponsesHttpError
+} from "./chunk-VGY2RGXL.js";
 import {
   createDebugLogger,
   getErrorStatus
@@ -20,15 +23,13 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
-// packages/core/src/utils/retry.ts
-init_esbuild_shims();
-
 // packages/core/src/utils/retryContext.ts
 init_esbuild_shims();
 import { AsyncLocalStorage } from "node:async_hooks";
 var retryContext = new AsyncLocalStorage();
 
 // packages/core/src/utils/retry.ts
+init_esbuild_shims();
 var debugLogger = createDebugLogger("RETRY");
 var PERSISTENT_MAX_BACKOFF_MS = 5 * 60 * 1e3;
 var PERSISTENT_CAP_MS = 6 * 60 * 60 * 1e3;
@@ -41,11 +42,14 @@ var DEFAULT_RETRY_OPTIONS = {
   shouldRetryOnError: defaultShouldRetry
 };
 function defaultShouldRetry(error, extraRetryErrorCodes) {
+  if (error instanceof ResponsesHttpError) {
+    return error.shouldRetry(extraRetryErrorCodes);
+  }
   const status = getErrorStatus(error);
-  if (isRateLimitError(error, extraRetryErrorCodes) || status !== void 0 && status >= 500 && status < 600) {
+  if (status !== void 0 && status >= 500 && status < 600) {
     return true;
   }
-  return classifyRetryError(error, { extraRetryErrorCodes }).kind === "transport";
+  return isRetryableUpstreamError(error, extraRetryErrorCodes);
 }
 __name(defaultShouldRetry, "defaultShouldRetry");
 function hasRetryAfterStatus(status) {
@@ -220,7 +224,7 @@ After setting up your API key, run /auth to configure your provider.`
       let delayMs;
       if (shouldPersist) {
         persistentAttempt++;
-        const retryAfterMs = hasRetryAfterStatus(errorStatus) ? getRetryAfterDelayMs(error) : null;
+        const retryAfterMs = hasRetryAfterStatus(errorStatus) || error instanceof ResponsesHttpError ? getRetryAfterDelayMs(error) : null;
         if (retryAfterMs !== null && retryAfterMs > 0) {
           delayMs = Math.min(retryAfterMs, capMs);
         } else {
@@ -263,7 +267,7 @@ After setting up your API key, run /auth to configure your provider.`
           attempt = maxAttempts - 1;
         }
       } else {
-        const retryAfterMs = hasRetryAfterStatus(errorStatus) ? getRetryAfterDelayMs(error) : null;
+        const retryAfterMs = hasRetryAfterStatus(errorStatus) || error instanceof ResponsesHttpError ? getRetryAfterDelayMs(error) : null;
         let actualDelayMs;
         if (retryAfterMs !== null && retryAfterMs > 0) {
           actualDelayMs = retryAfterMs;

package/chunks/{chunk-Z3GF56ME.js → chunk-FRISMWG3.js}

@@ -2,18 +2,18 @@
 "use strict";
 import {
   SCHEDULED_TASK_RUN_SOURCE_ID_PREFIX
-} from "./chunk-3KQBQ6FM.js";
+} from "./chunk-SYDMM6IX.js";
 import {
   ChannelDeliveryError,
   MAX_CHANNEL_DELIVERY_TEXT_LENGTH
 } from "./chunk-RKFGE7JH.js";
 import {
   stripTerminalControlSequences
-} from "./chunk-N7VWZDWW.js";
+} from "./chunk-DCRVSIK6.js";
 import {
   MAX_CHANNEL_DELIVERY_NAME_LENGTH,
   MAX_CHANNEL_DELIVERY_TARGET_ID_LENGTH
-} from "./chunk-F53KKZUD.js";
+} from "./chunk-3LMDSCLU.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-ALMR3E6Q.js → chunk-GDWE23OR.js}

@@ -13,7 +13,7 @@ function isAllChannelSelectionName(name) {
   return name.trim() === "all";
 }
 __name(isAllChannelSelectionName, "isAllChannelSelectionName");
-function normalizeServeChannelSelection(rawChannels) {
+function normalizeServeChannelSelection(rawChannels, label = "--channel") {
   if (rawChannels === void 0 || rawChannels.length === 0) {
     return void 0;
   }
@@ -22,7 +22,7 @@ function normalizeServeChannelSelection(rawChannels) {
   for (const raw of rawChannels) {
     const name = raw.trim();
     if (!name) {
-      throw new Error("--channel requires a non-empty channel name.");
+      throw new Error(`${label} requires a non-empty channel name.`);
     }
     if (seen.has(name)) continue;
     seen.add(name);
@@ -30,7 +30,7 @@ function normalizeServeChannelSelection(rawChannels) {
   }
   if (names.some(isAllChannelSelectionName)) {
     if (names.length > 1) {
-      throw new Error("--channel all cannot be combined with channel names.");
+      throw new Error(`${label} all cannot be combined with channel names.`);
     }
     return { mode: "all" };
   }

package/chunks/{chunk-IAEXTMED.js → chunk-GNV2SFO7.js}

@@ -4,7 +4,7 @@ import {
   matches,
   nextFireTime,
   parseCron
-} from "./chunk-IRH27ZC2.js";
+} from "./chunk-5EZRLTLQ.js";
 import {
   humanReadableCron
 } from "./chunk-QHWCP53L.js";
@@ -13,6 +13,7 @@ import {
   addCronTask,
   annotateCronRunSession,
   appendCronRun,
+  cronTaskSessionDeletionId,
   generateCronTaskId,
   getCronFilePath,
   readCronTasks,
@@ -20,10 +21,10 @@ import {
   taskHasLegacyCondition,
   taskHasLegacyRunMode,
   updateCronTasks
-} from "./chunk-F53KKZUD.js";
+} from "./chunk-3LMDSCLU.js";
 import {
   ToolNames
-} from "./chunk-TP6FYVQT.js";
+} from "./chunk-RSWBT7AZ.js";
 import {
   Storage,
   createDebugLogger,
@@ -301,6 +302,15 @@ var CronScheduler = class {
   // eligible to fire them. Cleared on stop so a later enable still treats
   // genuinely overdue work as missed.
   armedDurableOneShots = /* @__PURE__ */ new Set();
+  // Exact persisted snapshots for active per-run one-shots. The tick removes
+  // such a task before its async fresh-session dispatch finishes; retain the
+  // original so a rejected dispatch can put the unexecuted task back without
+  // dropping route-only fields such as session ownership.
+  restorablePerRunOneShots = /* @__PURE__ */ new Map();
+  consumedPerRunOneShots = /* @__PURE__ */ new Set();
+  // The durable deletion generation observed by the task-file mutation that
+  // removed each consumed one-shot.
+  consumedPerRunRemovalGenerations = /* @__PURE__ */ new Map();
   // Ids of legacy tasks (a pre-removal `isolated` task with a `condition`
   // precondition) already reported as skipped, so the fail-closed remediation
   // breadcrumb is logged once per task rather than on every file reload.
@@ -504,7 +514,12 @@ var CronScheduler = class {
    */
   async delete(id) {
     const job = this.jobs.get(id);
-    if (!job) return this.cancelWakeup(id);
+    if (!job) {
+      this.restorablePerRunOneShots.delete(id);
+      this.consumedPerRunOneShots.delete(id);
+      this.consumedPerRunRemovalGenerations.delete(id);
+      return this.cancelWakeup(id);
+    }
     this.jobs.delete(id);
     if (job.durable && this.projectRoot) {
       this.pendingRemoval.add(id);
@@ -516,6 +531,9 @@ var CronScheduler = class {
         throw error;
       }
     }
+    this.restorablePerRunOneShots.delete(id);
+    this.consumedPerRunOneShots.delete(id);
+    this.consumedPerRunRemovalGenerations.delete(id);
     this.armedDurableOneShots.delete(id);
     return true;
   }
@@ -705,6 +723,11 @@ var CronScheduler = class {
     }
     const diskIds = new Set(tasks.map((t) => t.id));
     for (const id of this.pendingAdd) diskIds.add(id);
+    for (const id of this.restorablePerRunOneShots.keys()) {
+      if (!diskIds.has(id) && !this.consumedPerRunOneShots.has(id)) {
+        this.restorablePerRunOneShots.delete(id);
+      }
+    }
     for (const job of this.jobs.values()) {
       if (job.durable && !diskIds.has(job.id)) {
         this.jobs.delete(job.id);
@@ -730,6 +753,15 @@ var CronScheduler = class {
         job.lastFiredAt = Math.max(existing.lastFiredAt, job.lastFiredAt ?? 0);
       }
       this.jobs.set(task.id, job);
+      if (!task.recurring && task.sessionMode === "per_run") {
+        this.restorablePerRunOneShots.set(task.id, {
+          task,
+          index: read.findIndex((candidate) => candidate.id === task.id)
+        });
+      } else {
+        this.restorablePerRunOneShots.delete(task.id);
+        this.consumedPerRunOneShots.delete(task.id);
+      }
       if (!task.recurring && this.#shouldFireDurable(job)) {
         this.armedDurableOneShots.add(task.id);
       } else {
@@ -958,6 +990,10 @@ var CronScheduler = class {
   /** Attributes an already-persisted per-run fire to the session it ran in,
    * and/or marks its fresh-session creation as failed. */
   async annotateRunSession(taskId, firedAt, outcome) {
+    if (outcome.sessionId && this.consumedPerRunOneShots.delete(taskId)) {
+      this.restorablePerRunOneShots.delete(taskId);
+      this.consumedPerRunRemovalGenerations.delete(taskId);
+    }
     if (!this.projectRoot) return;
     await Promise.resolve();
     await this.pendingPersist;
@@ -968,6 +1004,84 @@ var CronScheduler = class {
       )
     );
   }
+  /** Pauses and records a durable per-run one-shot that never dispatched. */
+  async restoreConsumedOneShot(taskId) {
+    const projectRoot = this.projectRoot;
+    const snapshot = this.restorablePerRunOneShots.get(taskId);
+    const firedAt = snapshot?.task.lastFiredAt;
+    if (!projectRoot || !snapshot || firedAt == null || !this.consumedPerRunOneShots.has(taskId)) {
+      return false;
+    }
+    await Promise.resolve();
+    await this.pendingPersist;
+    const removalGeneration = this.consumedPerRunRemovalGenerations.get(taskId);
+    if (!this.consumedPerRunOneShots.has(taskId) || removalGeneration === void 0) {
+      this.restorablePerRunOneShots.delete(taskId);
+      this.consumedPerRunOneShots.delete(taskId);
+      this.consumedPerRunRemovalGenerations.delete(taskId);
+      return false;
+    }
+    this.armedDurableOneShots.delete(taskId);
+    let restoreGenerations = /* @__PURE__ */ new Map();
+    let restored = false;
+    try {
+      await updateCronTasks(
+        projectRoot,
+        (tasks) => {
+          if ([...removalGeneration].some(
+            ([id, generation]) => restoreGenerations.get(id) !== generation
+          ))
+            return tasks;
+          const existing = tasks.findIndex((task) => task.id === taskId);
+          const current = tasks[existing] ?? snapshot.task;
+          const failed = {
+            ...current,
+            enabled: false,
+            lastFiredAt: firedAt,
+            runs: appendCronRun(current.runs, {
+              at: firedAt,
+              kind: "scheduled",
+              sessionDispatchFailed: true
+            })
+          };
+          restored = true;
+          if (existing !== -1) {
+            return tasks.map(
+              (task, index) => index === existing ? failed : task
+            );
+          }
+          const next = [...tasks];
+          next.splice(Math.min(snapshot.index, next.length), 0, failed);
+          return next;
+        },
+        {
+          observeDeletionIds: [...removalGeneration.keys()],
+          onDeletionGenerations: /* @__PURE__ */ __name((generations) => {
+            restoreGenerations = generations;
+          }, "onDeletionGenerations")
+        }
+      );
+    } catch (error) {
+      this.restorablePerRunOneShots.delete(taskId);
+      this.consumedPerRunOneShots.delete(taskId);
+      this.consumedPerRunRemovalGenerations.delete(taskId);
+      console.warn(
+        `CronScheduler: could not restore scheduled one-shot task ${taskId} after its run failed to dispatch \u2014 the task may be gone from disk with no recorded run.`
+      );
+      throw error;
+    }
+    if (!restored) {
+      this.restorablePerRunOneShots.delete(taskId);
+      this.consumedPerRunOneShots.delete(taskId);
+      this.consumedPerRunRemovalGenerations.delete(taskId);
+      return false;
+    }
+    this.pendingRemoval.delete(taskId);
+    this.jobs.delete(taskId);
+    this.consumedPerRunOneShots.delete(taskId);
+    this.consumedPerRunRemovalGenerations.delete(taskId);
+    return true;
+  }
   /**
    * Starts the scheduler tick. Calls `onFire` when a job is due.
    * Only fires when called — does not auto-fire missed intervals.
@@ -1122,12 +1236,41 @@ var CronScheduler = class {
         this.armedDurableOneShots.delete(id);
       }
       const removed = new Set(removedIds);
+      const removedByFire = /* @__PURE__ */ new Set();
+      let removalGenerations = /* @__PURE__ */ new Map();
       const guarded = [...firedAt.keys()];
       this.markFirePersistPending(guarded);
+      const recordRemovalGenerations = /* @__PURE__ */ __name(() => {
+        for (const id of removedByFire) {
+          const generation = removalGenerations.get(id);
+          if (generation !== void 0 && this.consumedPerRunOneShots.has(id)) {
+            const observed = /* @__PURE__ */ new Map([[id, generation]]);
+            const sessionId = this.restorablePerRunOneShots.get(id)?.task.sessionId;
+            if (sessionId) {
+              const key = cronTaskSessionDeletionId(sessionId);
+              const sessionGeneration = removalGenerations.get(key);
+              if (sessionGeneration === void 0) continue;
+              observed.set(key, sessionGeneration);
+            }
+            this.consumedPerRunRemovalGenerations.set(id, observed);
+          }
+        }
+      }, "recordRemovalGenerations");
       this.trackPersist(
         updateCronTasks(
           this.projectRoot,
-          (tasks) => tasks.filter((t) => !removed.has(t.id)).map((t) => {
+          (tasks) => tasks.filter((t) => {
+            if (!removed.has(t.id)) return true;
+            removedByFire.add(t.id);
+            const snapshot = this.restorablePerRunOneShots.get(t.id);
+            if (snapshot) {
+              snapshot.task = {
+                ...t,
+                lastFiredAt: snapshot.task.lastFiredAt
+              };
+            }
+            return false;
+          }).map((t) => {
             const stamp = firedAt.get(t.id);
             if (stamp === void 0 || (t.lastFiredAt ?? 0) >= stamp)
               return t;
@@ -1142,8 +1285,22 @@ var CronScheduler = class {
                 ...t.sessionMode !== "per_run" && this.sessionId ? { sessionId: this.sessionId } : {}
               })
             };
-          })
-        ).finally(() => {
+          }),
+          {
+            observeDeletionIds: /* @__PURE__ */ __name((tasks) => [
+              ...removedIds,
+              ...tasks.flatMap(
+                (task) => removed.has(task.id) && task.sessionId ? [cronTaskSessionDeletionId(task.sessionId)] : []
+              )
+            ], "observeDeletionIds"),
+            onDeletionGenerations: /* @__PURE__ */ __name((generations) => {
+              removalGenerations = generations;
+            }, "onDeletionGenerations")
+          }
+        ).then(recordRemovalGenerations, (error) => {
+          recordRemovalGenerations();
+          throw error;
+        }).finally(() => {
           this.clearFirePersistPending(guarded);
         })
       );
@@ -1186,6 +1343,13 @@ var CronScheduler = class {
     if (!job.recurring || expired) {
       this.jobs.delete(job.id);
     }
+    if (!job.recurring && job.durable && job.sessionMode === "per_run") {
+      this.consumedPerRunOneShots.add(job.id);
+      const snapshot = this.restorablePerRunOneShots.get(job.id);
+      if (snapshot) {
+        snapshot.task = { ...snapshot.task, lastFiredAt: matchedMinuteMs };
+      }
+    }
     if (this.onFire) {
       this.onFire(job);
     }
@@ -1274,6 +1438,8 @@ function durableTaskToJob(task, recurringMaxAgeMs, existing) {
     durable: true,
     ...task.sessionId ? { boundSessionId: task.sessionId } : {},
     ...task.sessionMode ? { sessionMode: task.sessionMode } : {},
+    ...task.modelServiceId ? { modelServiceId: task.modelServiceId } : {},
+    ...task.groupId ? { groupId: task.groupId } : {},
     ...task.name ? { name: task.name } : {},
     ...task.delivery && task.sessionId ? { delivery: task.delivery } : {}
   };