@qwen-code/qwen-code 0.23.5-dev.codemode-responses.20260915.f024b37689 → 0.23.5-preview.0

package/chunks/{llm-ZZ2WNQMC.js → llm-LSUBOJAR.js}

@@ -1,12 +1,12 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  startEarlyStartupPrefetches
-} from "./chunk-ZUKC5J6Q.js";
 import {
   registerMcpHotReload,
   registerModelProvidersHotReload
-} from "./chunk-WATHOB6X.js";
+} from "./chunk-ZFHKUQZ4.js";
+import {
+  startEarlyStartupPrefetches
+} from "./chunk-IKBEIDOH.js";
 import {
   ExtensionRefreshState,
   appEvents,
@@ -14,21 +14,27 @@ import {
   buildEnabledSkillNamesProvider,
   isDebugMode,
   loadCliConfig,
-  loadSandboxConfig,
   parseArguments,
   validateAuthMethod
-} from "./chunk-TYBRGFYL.js";
+} from "./chunk-CXY6BICQ.js";
+import "./chunk-FBY32737.js";
+import "./chunk-B6RMK4ED.js";
+import {
+  loadSandboxConfig
+} from "./chunk-QT6Z2IBF.js";
+import {
+  start_sandbox
+} from "./chunk-QMENOK5T.js";
 import {
   CUSTOM_SANDBOX_IMAGE_ENV_VAR,
   HOST_UPDATE_RELAUNCH_ENV_VAR,
   RELAUNCH_EXIT_CODE,
-  SKIP_UPDATE_CHECK_ENV_VAR,
   UPDATE_COMPLETE_EXIT_CODE,
   UPDATE_ON_EXIT_MESSAGE,
   UPDATE_RELAUNCH_EXIT_CODE
-} from "./chunk-QLX4D55R.js";
+} from "./chunk-B5TJK7B3.js";
 import "./chunk-24FVUD5P.js";
-import "./chunk-R5OA3ONY.js";
+import "./chunk-ZMYKNKET.js";
 import {
   getHeadlessYoloSafetyWarning
 } from "./chunk-6H67XLET.js";
@@ -36,9 +42,7 @@ import {
   isAcpStartupProfilerEnabled,
   markAcpStartup,
   recordAcpConfigStartupEvent
-} from "./chunk-DOTF2PF2.js";
-import "./chunk-6YUS5JCV.js";
-import "./chunk-HXMDDII6.js";
+} from "./chunk-DRD6VBNH.js";
 import "./chunk-M3JGHRMQ.js";
 import {
   sanitizeTerminalText
@@ -53,30 +57,31 @@ import {
   isValidSessionId
 } from "./chunk-ZEZKIS2K.js";
 import "./chunk-Y53DG2HA.js";
-import "./chunk-LMJSPC55.js";
-import "./chunk-QS5Q5F42.js";
-import "./chunk-7U5G6JXI.js";
+import "./chunk-3LLEB5CU.js";
+import "./chunk-UZSB57EV.js";
+import "./chunk-4FLUQWJ4.js";
+import "./chunk-D7JMO2GP.js";
+import "./chunk-WZWTY7SG.js";
+import "./chunk-E2VSBAFA.js";
+import "./chunk-57OAHC2Y.js";
+import "./chunk-SYMXYRM5.js";
+import "./chunk-U4AASWUQ.js";
+import "./chunk-LFKXIOGC.js";
+import "./chunk-KWYTSSTJ.js";
 import "./chunk-WCCLLK7X.js";
 import "./chunk-LYD3T3H7.js";
-import "./chunk-JO67LVXW.js";
-import "./chunk-INGBUYL6.js";
-import "./chunk-3CKAOJ4L.js";
-import "./chunk-MNRK6MIH.js";
-import "./chunk-57OAHC2Y.js";
-import "./chunk-IAS753HG.js";
-import "./chunk-5ODRE7E5.js";
-import "./chunk-ABNX6E6K.js";
 import "./chunk-V6WHFGST.js";
-import "./chunk-TBSCTWKF.js";
+import "./chunk-RN6A53UJ.js";
 import "./chunk-6PLDPT2C.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-STUJ7IMZ.js";
+import "./chunk-L3SNMEDW.js";
 import "./chunk-GYTKQYDB.js";
-import "./chunk-WD6YQI5M.js";
 import "./chunk-GDWE23OR.js";
-import "./chunk-RKFGE7JH.js";
 import "./chunk-CJ3DHN5I.js";
+import "./chunk-RKFGE7JH.js";
 import "./chunk-UDG5EZJI.js";
+import "./chunk-M5GB774H.js";
 import {
   EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE,
   EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
@@ -84,131 +89,129 @@ import {
   PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
   PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV
 } from "./chunk-3VUENPWF.js";
-import "./chunk-M5GB774H.js";
 import "./chunk-NFXXBWSE.js";
-import "./chunk-LWWRJRCD.js";
-import "./chunk-EPVEPTI3.js";
+import "./chunk-ESBYWATJ.js";
+import "./chunk-PZRXWQUA.js";
 import "./chunk-IJOS26LH.js";
-import "./chunk-A2UYI473.js";
+import "./chunk-WL36KHUQ.js";
 import {
   createMinimalSettings,
   getFlattenedSchema,
   getSettingsWarnings,
-  getUserSettingsDir,
   initializeLlmOutputLanguage,
   loadSettings
-} from "./chunk-E7ZTAOJZ.js";
-import "./chunk-EQWKIA72.js";
+} from "./chunk-RRI764F7.js";
 import "./chunk-RKUWKYED.js";
+import "./chunk-AUX2FL5T.js";
+import "./chunk-BW4333PP.js";
+import "./chunk-IDS7MSUP.js";
 import {
   initializeI18n,
   resolveLanguageSetting
-} from "./chunk-I6YJZGHS.js";
+} from "./chunk-GSAOVDTH.js";
 import "./chunk-5EJZE3FP.js";
 import {
-  SETTINGS_DIRECTORY_NAME,
   preResolveHomeEnvOverrides
-} from "./chunk-NJ4ZNDVP.js";
-import {
-  getInstallationInfo
-} from "./chunk-SFL6U7U7.js";
-import "./chunk-BW4333PP.js";
-import "./chunk-IDS7MSUP.js";
+} from "./chunk-NKTMUPHJ.js";
 import {
   ENV_CORRUPTED_PATH,
   ENV_WAS_RECOVERED,
-  QWEN_CODE_DESKTOP_ENV,
   QWEN_CODE_SERVE_ENV,
   scrubAndReportInheritedLoaderEnv
-} from "./chunk-XX5HQLCZ.js";
-import "./chunk-XFSFZCM5.js";
-import "./chunk-2EAZ43JQ.js";
-import "./chunk-NF5J2WFA.js";
-import "./chunk-54YUXX7X.js";
-import "./chunk-W3N5XAZ6.js";
-import "./chunk-4DTFTPTU.js";
+} from "./chunk-6OTF7TTE.js";
+import {
+  getInstallationInfo
+} from "./chunk-SFL6U7U7.js";
+import "./chunk-NQ272MQG.js";
 import "./chunk-NPQ5ZKRP.js";
 import "./chunk-MR3PXB6E.js";
-import "./chunk-RN6BU77T.js";
+import "./chunk-347O2YZJ.js";
 import "./chunk-GELRJXE2.js";
 import {
   PRIVATE_CONVERSATIONS_RUNTIME_ENABLE,
   PRIVATE_CONVERSATIONS_RUNTIME_ENV
 } from "./chunk-32CM56LO.js";
+import "./chunk-XFSFZCM5.js";
+import "./chunk-2EAZ43JQ.js";
+import "./chunk-NF5J2WFA.js";
+import "./chunk-AQP3H22J.js";
+import "./chunk-W3N5XAZ6.js";
 import "./chunk-6WXVEDT2.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-JIJ65YKA.js";
-import "./chunk-FHSOZSBO.js";
-import "./chunk-EKMJR7M3.js";
-import "./chunk-EDB556X7.js";
+import "./chunk-VEXUA6DX.js";
+import "./chunk-TXTCM3TC.js";
+import "./chunk-X7AYIXC7.js";
+import "./chunk-TRZ22SG5.js";
 import {
   isSessionRuntimeActive,
   readWorktreeSession,
   writeWorktreeSession
-} from "./chunk-QR4Q425T.js";
-import "./chunk-GNKSR3FU.js";
+} from "./chunk-3BZI5GDP.js";
+import "./chunk-ZPJWUGCS.js";
+import "./chunk-YM6KUQ2S.js";
+import "./chunk-IXO2OCIP.js";
 import "./chunk-DJXSOEFB.js";
+import "./chunk-SFHX5G2S.js";
 import "./chunk-5VQR2DD7.js";
 import "./chunk-BUQN5LTI.js";
-import "./chunk-ZPJWUGCS.js";
-import "./chunk-YM6KUQ2S.js";
-import "./chunk-SGXJQP5Q.js";
-import "./chunk-GFAK6DYU.js";
+import "./chunk-LO2UWNO5.js";
 import {
-  QWEN_CODE_SIMPLE_ENV_VAR,
   SessionService,
   computeInitialTurnFromHistory,
-  isBareMode,
   persistSessionUsage,
   setStartupEventSink,
   watch
-} from "./chunk-WBP64MZR.js";
+} from "./chunk-KAYC5FBN.js";
 import "./chunk-GOFAQQZA.js";
+import "./chunk-65I7S4Z3.js";
 import "./chunk-HEOH7JZY.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-65I7S4Z3.js";
+import {
+  closeFileWatcher,
+  prepareFileWatchersForProcessExit
+} from "./chunk-IVFTLUZD.js";
 import "./chunk-7CLLH5TI.js";
 import "./chunk-WK6DEH3Q.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-4OQSG35W.js";
-import "./chunk-ME4JBHSB.js";
-import "./chunk-GNV2SFO7.js";
+import "./chunk-DX6JTDMR.js";
+import "./chunk-VQDWCQOE.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
 import "./chunk-3LMDSCLU.js";
+import "./chunk-QJNDUTOL.js";
 import "./chunk-O6GEWCJA.js";
 import {
   GitWorktreeService,
   readWorktreeSessionMarker,
   worktreeBranchForSlug,
   writeWorktreeSessionMarker
-} from "./chunk-WKVZES7O.js";
-import "./chunk-NJ2OFVUX.js";
+} from "./chunk-CXONOVBN.js";
+import "./chunk-OWUAZXXN.js";
+import "./chunk-CH2YDT6X.js";
+import "./chunk-P42KMMU6.js";
 import {
   canUseRipgrep
-} from "./chunk-HFJSQ4GL.js";
-import "./chunk-QJNDUTOL.js";
-import {
-  require_shell_quote
-} from "./chunk-V545KI73.js";
-import "./chunk-MQRLLBMQ.js";
+} from "./chunk-BTICBRPL.js";
+import "./chunk-V545KI73.js";
+import "./chunk-ADN5KESB.js";
+import "./chunk-PPJSG2PU.js";
 import "./chunk-ELRMZTPF.js";
 import "./chunk-U6H3XTFA.js";
-import {
-  resolveBundleDir
-} from "./chunk-ACHCT36C.js";
+import "./chunk-ACHCT36C.js";
 import "./chunk-CHEIIBT3.js";
 import "./chunk-AEWCOE64.js";
-import "./chunk-OWUAZXXN.js";
-import "./chunk-CH2YDT6X.js";
 import "./chunk-JX6XHPTX.js";
 import "./chunk-ZSTCM3MX.js";
+import {
+  QWEN_CODE_SIMPLE_ENV_VAR,
+  isBareMode
+} from "./chunk-SK3RZOPS.js";
 import "./chunk-MLXTMF7H.js";
-import "./chunk-AXZMWAJV.js";
+import "./chunk-36SDZ2Q4.js";
 import "./chunk-NXUZFW3G.js";
 import "./chunk-WFNEY5G7.js";
-import "./chunk-GSS4SZNG.js";
+import "./chunk-YP2K3WOS.js";
 import "./chunk-BW2SMO6L.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-VVI7MK3V.js";
@@ -217,48 +220,42 @@ import "./chunk-G6UUOCUT.js";
 import "./chunk-IZ2U57NY.js";
 import "./chunk-Z72PLR74.js";
 import "./chunk-NUQ4GK5I.js";
-import "./chunk-CXXAZ2LZ.js";
+import "./chunk-DC4ZNGH4.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-66N6C4EH.js";
-import "./chunk-FMLBBXHB.js";
+import "./chunk-3WILPKTJ.js";
+import "./chunk-DRAX5YAI.js";
 import "./chunk-VNOVK4I7.js";
 import "./chunk-S7UQ3V2H.js";
-import "./chunk-JL6APGBX.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-ZKIAGIGH.js";
-import "./chunk-VGY2RGXL.js";
-import "./chunk-C75BXMPM.js";
+import "./chunk-3XBUCOWS.js";
+import "./chunk-M4U2LTD2.js";
 import "./chunk-KFFCDLKV.js";
 import "./chunk-KP2FHIFR.js";
-import "./chunk-L6DIANLD.js";
+import "./chunk-KEM7MWS7.js";
+import "./chunk-G45B3INR.js";
 import {
   logUserPrompt,
   uiTelemetryService
-} from "./chunk-FCLMJS6N.js";
+} from "./chunk-CDDP4ONL.js";
 import {
   PRIVATE_ACP_CAPABILITY_ENV
 } from "./chunk-5ETULJLP.js";
-import "./chunk-7MIBD3LG.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-QZW6WRB7.js";
+import "./chunk-5NUKK2DT.js";
 import "./chunk-EDIDYZBT.js";
 import "./chunk-HD7O6WLV.js";
 import "./chunk-CFMZLE3L.js";
 import "./chunk-WZAD4ZNJ.js";
-import "./chunk-ARDHE6MM.js";
-import "./chunk-FPGTNKCP.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-TPEV2QHG.js";
 import "./chunk-XFFRI3WM.js";
-import "./chunk-ERU3SDXT.js";
-import "./chunk-EWJTAP3Y.js";
+import "./chunk-GJKP6XOB.js";
+import "./chunk-7O5PYQ3M.js";
 import "./chunk-HHJLM3WQ.js";
-import "./chunk-4Y2I3CI3.js";
+import "./chunk-6USYH3EU.js";
 import "./chunk-74TONY4F.js";
 import "./chunk-SYROIHU7.js";
 import "./chunk-RSWBT7AZ.js";
 import {
-  FatalSandboxError,
   Storage,
   createDebugLogger,
   getErrorMessage,
@@ -275,6 +272,11 @@ import {
   clearInheritedPeerMessagingEnv
 } from "./chunk-V5U2NZNJ.js";
 import "./chunk-BSIOCNDK.js";
+import {
+  cleanupCheckpoints,
+  registerCleanup,
+  runExitCleanup
+} from "./chunk-H6L4NEAT.js";
 import {
   finalizeStartupProfile,
   isStartupProfilerEnabled,
@@ -283,11 +285,6 @@ import {
   setInteractiveMode
 } from "./chunk-QILD6R27.js";
 import "./chunk-JVEGA3MM.js";
-import {
-  cleanupCheckpoints,
-  registerCleanup,
-  runExitCleanup
-} from "./chunk-XK4UQSIR.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -301,16 +298,15 @@ import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
 import {
-  __name,
-  __toESM
+  __name
 } from "./chunk-J2S4EL5Y.js";
 
 // packages/cli/src/llm.tsx
 init_esbuild_shims();
 import dns from "node:dns";
-import fs7 from "node:fs";
-import os3 from "node:os";
-import path8 from "node:path";
+import fs6 from "node:fs";
+import os from "node:os";
+import path6 from "node:path";
 import v8 from "node:v8";
 
 // packages/cli/src/config/settingsWatcher.ts
@@ -493,7 +489,7 @@ var SettingsWatcher = class _SettingsWatcher {
     this.watchStage.delete(scope);
     if (watcher) {
       try {
-        await watcher.close();
+        await closeFileWatcher(watcher);
       } catch (err) {
         debugLogger.warn("Settings watcher close error:", err);
       }
@@ -508,7 +504,7 @@ var SettingsWatcher = class _SettingsWatcher {
     if (!this.started) return;
     this.started = false;
     for (const [, watcher] of this.watchers) {
-      watcher.close().catch((err) => {
+      closeFileWatcher(watcher).catch((err) => {
         debugLogger.warn("Settings watcher close error:", err);
       });
     }
@@ -696,7 +692,7 @@ var LspConfigWatcher = class _LspConfigWatcher {
     await this.activeDrain;
     this.listener = void 0;
     try {
-      await this.watcher?.close();
+      await closeFileWatcher(this.watcher);
     } catch (error) {
       debugLogger2.warn("LSP config watcher close error:", error);
     }
@@ -870,7 +866,12 @@ var EXTENSION_FILES = /* @__PURE__ */ new Set([
   "qwen-extension.json",
   ".qwen-extension-install.json"
 ]);
-var AUTO_REFRESH_DIRS = /* @__PURE__ */ new Set(["commands", "skills", "agents"]);
+var AUTO_REFRESH_DIRS = /* @__PURE__ */ new Set([
+  "commands",
+  "skills",
+  "agents",
+  "workflows"
+]);
 var STALE_DIRS = /* @__PURE__ */ new Set(["hooks"]);
 var ExtensionFileWatcher = class {
   constructor(config, extensionsDir = Storage.getUserExtensionsDir(), refreshState = new ExtensionRefreshState(), storeStatePath) {
@@ -957,10 +958,10 @@ var ExtensionFileWatcher = class {
     this.mutationListenerDisposer?.();
     this.mutationListenerDisposer = void 0;
     this.endPendingMutationSuppressions();
-    watcher?.close().catch((error) => {
+    closeFileWatcher(watcher).catch((error) => {
       debugLogger3.warn("Extension file watcher close error:", error);
     });
-    bootstrapWatcher?.close().catch((error) => {
+    closeFileWatcher(bootstrapWatcher).catch((error) => {
       debugLogger3.warn("Extension bootstrap watcher close error:", error);
     });
   }
@@ -1148,7 +1149,7 @@ var ExtensionFileWatcher = class {
   closeBootstrapWatcher() {
     const bootstrapWatcher = this.bootstrapWatcher;
     this.bootstrapWatcher = void 0;
-    bootstrapWatcher?.close().catch((error) => {
+    closeFileWatcher(bootstrapWatcher).catch((error) => {
       debugLogger3.warn("Extension bootstrap watcher close error:", error);
     });
   }
@@ -1578,841 +1579,18 @@ async function relaunchAppInChildProcess(additionalNodeArgs, additionalScriptArg
 }
 __name(relaunchAppInChildProcess, "relaunchAppInChildProcess");
 
-// packages/cli/src/serve/sandbox.ts
-init_esbuild_shims();
-var import_shell_quote = __toESM(require_shell_quote(), 1);
-import { exec, execSync, spawn as spawn2 } from "node:child_process";
-import os2 from "node:os";
-import path6 from "node:path";
-import fs4 from "node:fs";
-import { promisify } from "node:util";
-import { randomBytes } from "node:crypto";
-
-// packages/cli/src/utils/sandboxImageName.ts
-init_esbuild_shims();
-function parseSandboxImageName(image) {
-  const imageWithoutDigest = image.split("@")[0] ?? image;
-  const lastSlash = imageWithoutDigest.lastIndexOf("/");
-  const lastColon = imageWithoutDigest.lastIndexOf(":");
-  const hasTag = lastColon > lastSlash;
-  const fullName = hasTag ? imageWithoutDigest.slice(0, lastColon) : imageWithoutDigest;
-  const tag = hasTag ? imageWithoutDigest.slice(lastColon + 1) : void 0;
-  const name = fullName.split("/").at(-1) || "unknown-image";
-  return tag ? `${name}-${tag}` : name;
-}
-__name(parseSandboxImageName, "parseSandboxImageName");
-
-// packages/cli/src/utils/sandbox-path.ts
-init_esbuild_shims();
-import path5 from "node:path";
-function isContainerPathWithinWorkdir(containerWorkdir, containerPath) {
-  const normalize = /* @__PURE__ */ __name((value) => {
-    const normalized = path5.posix.normalize(value.replace(/\\/g, "/")).replace(/\/+$/, "").toLowerCase();
-    return normalized || "/";
-  }, "normalize");
-  const normalizedWorkdir = normalize(containerWorkdir);
-  const normalizedPath = normalize(containerPath);
-  if (normalizedWorkdir === "/") {
-    return normalizedPath.startsWith("/");
-  }
-  return normalizedPath === normalizedWorkdir || normalizedPath.startsWith(`${normalizedWorkdir}/`);
-}
-__name(isContainerPathWithinWorkdir, "isContainerPathWithinWorkdir");
-
-// packages/cli/src/utils/sandboxMounts.ts
-init_esbuild_shims();
-import os from "node:os";
-function parseSandboxMountSpec(rawMount, platform = os.platform()) {
-  const mount = rawMount.trim();
-  const mountSeparator = platform === "win32" && /^[A-Za-z]:[\\/]/.test(mount) ? mount.indexOf(":", 2) : mount.indexOf(":");
-  const from = mountSeparator === -1 ? mount : mount.slice(0, mountSeparator);
-  const rest = mountSeparator === -1 ? "" : mount.slice(mountSeparator + 1);
-  const [toPart, optsPart] = rest.split(":");
-  return {
-    from,
-    to: toPart || from,
-    opts: optsPart || "ro"
-  };
-}
-__name(parseSandboxMountSpec, "parseSandboxMountSpec");
-
-// packages/cli/src/serve/sandbox.ts
-var execAsync = promisify(exec);
-function getContainerPath(hostPath) {
-  if (os2.platform() !== "win32") {
-    return hostPath;
-  }
-  const withForwardSlashes = hostPath.replace(/\\/g, "/");
-  const match = withForwardSlashes.match(/^([A-Z]):\/(.*)/i);
-  if (match) {
-    return `/${match[1].toLowerCase()}/${match[2]}`;
-  }
-  return hostPath;
-}
-__name(getContainerPath, "getContainerPath");
-function ensureDirectoryAndGetRealPath(dir) {
-  if (!fs4.existsSync(dir)) {
-    fs4.mkdirSync(dir, { recursive: true });
-  }
-  return fs4.realpathSync(dir);
-}
-__name(ensureDirectoryAndGetRealPath, "ensureDirectoryAndGetRealPath");
-var LOCAL_DEV_SANDBOX_IMAGE_NAME = "qwen-code-sandbox";
-var SANDBOX_NETWORK_NAME = "qwen-code-sandbox";
-var SANDBOX_PROXY_NAME = "qwen-code-sandbox-proxy";
-var BUILTIN_SEATBELT_PROFILES = [
-  "permissive-open",
-  "permissive-closed",
-  "permissive-proxied",
-  "restrictive-open",
-  "restrictive-closed",
-  "restrictive-proxied"
-];
-function getSandboxPassthroughEnvArgs(env = process.env) {
-  return [
-    "QWEN_DEBUG_LOG_FILE",
-    "QWEN_CODE_LEGACY_MCP_BLOCKING",
-    SKIP_UPDATE_CHECK_ENV_VAR,
-    CUSTOM_SANDBOX_IMAGE_ENV_VAR,
-    HOST_UPDATE_RELAUNCH_ENV_VAR,
-    QWEN_CODE_SERVE_ENV,
-    QWEN_CODE_DESKTOP_ENV
-  ].flatMap(
-    (envVar) => env[envVar] === void 0 ? [] : ["--env", `${envVar}=${env[envVar]}`]
-  );
-}
-__name(getSandboxPassthroughEnvArgs, "getSandboxPassthroughEnvArgs");
-function resolveSeatbeltProfileFile(profile, importMetaUrl = import.meta.url) {
-  if (!BUILTIN_SEATBELT_PROFILES.includes(profile)) {
-    return path6.join(SETTINGS_DIRECTORY_NAME, `sandbox-macos-${profile}.sb`);
-  }
-  return path6.join(
-    resolveBundleDir(importMetaUrl),
-    `sandbox-macos-${profile}.sb`
-  );
-}
-__name(resolveSeatbeltProfileFile, "resolveSeatbeltProfileFile");
-async function shouldUseCurrentUserInSandbox() {
-  const envVar = process.env["SANDBOX_SET_UID_GID"]?.toLowerCase().trim();
-  if (envVar === "1" || envVar === "true") {
-    return true;
-  }
-  if (envVar === "0" || envVar === "false") {
-    return false;
-  }
-  if (os2.platform() === "linux") {
-    const debugEnv = [process.env["DEBUG"], process.env["DEBUG_MODE"]].some(
-      (v) => v === "true" || v === "1"
-    );
-    if (debugEnv) {
-      writeStderrLine(
-        "INFO: Using current user UID/GID in Linux sandbox. Set SANDBOX_SET_UID_GID=false to disable."
-      );
-    }
-    return true;
-  }
-  return false;
-}
-__name(shouldUseCurrentUserInSandbox, "shouldUseCurrentUserInSandbox");
-function ports() {
-  return (process.env["SANDBOX_PORTS"] ?? "").split(",").filter((p) => p.trim()).map((p) => p.trim());
-}
-__name(ports, "ports");
-function entrypoint(workdir, cliArgs) {
-  const isWindows = os2.platform() === "win32";
-  const containerWorkdir = getContainerPath(workdir);
-  const shellCmds = [];
-  const pathSeparator = isWindows ? ";" : ":";
-  let pathSuffix = "";
-  if (process.env["PATH"]) {
-    const paths = process.env["PATH"].split(pathSeparator);
-    for (const p of paths) {
-      const containerPath = getContainerPath(p);
-      if (isContainerPathWithinWorkdir(containerWorkdir, containerPath)) {
-        pathSuffix += `:${containerPath}`;
-      }
-    }
-  }
-  if (pathSuffix) {
-    shellCmds.push(`export PATH="$PATH${pathSuffix}";`);
-  }
-  let pythonPathSuffix = "";
-  if (process.env["PYTHONPATH"]) {
-    const paths = process.env["PYTHONPATH"].split(pathSeparator);
-    for (const p of paths) {
-      const containerPath = getContainerPath(p);
-      if (isContainerPathWithinWorkdir(containerWorkdir, containerPath)) {
-        pythonPathSuffix += `:${containerPath}`;
-      }
-    }
-  }
-  if (pythonPathSuffix) {
-    shellCmds.push(`export PYTHONPATH="$PYTHONPATH${pythonPathSuffix}";`);
-  }
-  const projectSandboxBashrc = path6.join(
-    SETTINGS_DIRECTORY_NAME,
-    "sandbox.bashrc"
-  );
-  if (fs4.existsSync(projectSandboxBashrc)) {
-    shellCmds.push(`source ${getContainerPath(projectSandboxBashrc)};`);
-  }
-  ports().forEach(
-    (p) => shellCmds.push(
-      `socat TCP4-LISTEN:${p},bind=$(hostname -i),fork,reuseaddr TCP4:127.0.0.1:${p} 2> /dev/null &`
-    )
-  );
-  const quotedCliArgs = cliArgs.slice(2).map((arg) => (0, import_shell_quote.quote)([arg]));
-  const cliCmd = false ? process.env["DEBUG"] ? "npm run debug --" : "npm rebuild && npm run start --" : process.env["DEBUG"] ? `node --inspect-brk=0.0.0.0:${process.env["DEBUG_PORT"] || "9229"} $(which qwen)` : "qwen";
-  const args = [...shellCmds, cliCmd, ...quotedCliArgs];
-  return ["bash", "-c", args.join(" ")];
-}
-__name(entrypoint, "entrypoint");
-async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = [], childEnv) {
-  if (config.command === "sandbox-exec") {
-    if (process.env["BUILD_SANDBOX"]) {
-      throw new FatalSandboxError(
-        "Cannot BUILD_SANDBOX when using macOS Seatbelt"
-      );
-    }
-    const profile = process.env["SEATBELT_PROFILE"] ??= "permissive-open";
-    const profileFile = resolveSeatbeltProfileFile(profile);
-    if (!fs4.existsSync(profileFile)) {
-      throw new FatalSandboxError(
-        `Missing macos seatbelt profile file '${profileFile}'`
-      );
-    }
-    writeStderrLine(`using macos seatbelt (profile: ${profile}) ...`);
-    const nodeOptions = [
-      ...process.env["DEBUG"] ? ["--inspect-brk"] : [],
-      ...nodeArgs
-    ].join(" ");
-    const qwenDir = Storage.getGlobalQwenDir();
-    const runtimeDir = Storage.getRuntimeBaseDir();
-    fs4.mkdirSync(qwenDir, { recursive: true });
-    fs4.mkdirSync(runtimeDir, { recursive: true });
-    const args2 = [
-      "-D",
-      `TARGET_DIR=${fs4.realpathSync(process.cwd())}`,
-      "-D",
-      `TMP_DIR=${fs4.realpathSync(os2.tmpdir())}`,
-      "-D",
-      `HOME_DIR=${fs4.realpathSync(os2.homedir())}`,
-      "-D",
-      `CACHE_DIR=${fs4.realpathSync(execSync(`getconf DARWIN_USER_CACHE_DIR`).toString().trim())}`,
-      "-D",
-      `QWEN_DIR=${fs4.realpathSync(qwenDir)}`,
-      "-D",
-      `RUNTIME_DIR=${fs4.realpathSync(runtimeDir)}`
-    ];
-    const MAX_INCLUDE_DIRS = 5;
-    const targetDir = fs4.realpathSync(cliConfig?.getTargetDir() || "");
-    const includedDirs = [];
-    if (cliConfig) {
-      const workspaceContext = cliConfig.getWorkspaceContext();
-      const directories = workspaceContext.getDirectories();
-      for (const dir of directories) {
-        const realDir = fs4.realpathSync(dir);
-        if (realDir !== targetDir) {
-          includedDirs.push(realDir);
-        }
-      }
-    }
-    for (let i = 0; i < MAX_INCLUDE_DIRS; i++) {
-      let dirPath = "/dev/null";
-      if (i < includedDirs.length) {
-        dirPath = includedDirs[i];
-      }
-      args2.push("-D", `INCLUDE_DIR_${i}=${dirPath}`);
-    }
-    const finalArgv = cliArgs;
-    args2.push(
-      "-f",
-      profileFile,
-      "sh",
-      "-c",
-      [
-        ...process.env["QWEN_CODE_SCRUB_ELECTRON_RUN_AS_NODE"] === "1" ? ["ELECTRON_RUN_AS_NODE=1"] : [],
-        `SANDBOX=sandbox-exec`,
-        `NODE_OPTIONS="${nodeOptions}"`,
-        ...finalArgv.map((arg) => (0, import_shell_quote.quote)([arg]))
-      ].join(" ")
-    );
-    const proxyCommand2 = process.env["QWEN_SANDBOX_PROXY_COMMAND"];
-    let proxyProcess2 = void 0;
-    let sandboxProcess2 = void 0;
-    const sandboxEnv = { ...process.env };
-    if (proxyCommand2) {
-      const proxy = process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env["http_proxy"] || "http://localhost:8877";
-      sandboxEnv["HTTPS_PROXY"] = proxy;
-      sandboxEnv["https_proxy"] = proxy;
-      sandboxEnv["HTTP_PROXY"] = proxy;
-      sandboxEnv["http_proxy"] = proxy;
-      const noProxy = process.env["NO_PROXY"] || process.env["no_proxy"];
-      if (noProxy) {
-        sandboxEnv["NO_PROXY"] = noProxy;
-        sandboxEnv["no_proxy"] = noProxy;
-      }
-      proxyProcess2 = spawn2("bash", ["-c", proxyCommand2], {
-        stdio: ["ignore", "pipe", "pipe"],
-        detached: true
-      });
-      const stopProxy = /* @__PURE__ */ __name(() => {
-        writeStderrLine("stopping proxy ...");
-        if (proxyProcess2?.pid) {
-          process.kill(-proxyProcess2.pid, "SIGTERM");
-        }
-      }, "stopProxy");
-      process.on("exit", stopProxy);
-      process.on("SIGINT", stopProxy);
-      process.on("SIGTERM", stopProxy);
-      proxyProcess2.stderr?.on("data", (data) => {
-        writeStderrLine(data.toString());
-      });
-      proxyProcess2.on("close", (code, signal) => {
-        if (sandboxProcess2?.pid) {
-          process.kill(-sandboxProcess2.pid, "SIGTERM");
-        }
-        throw new FatalSandboxError(
-          `Proxy command '${proxyCommand2}' exited with code ${code}, signal ${signal}`
-        );
-      });
-      writeStderrLine("waiting for proxy to start ...");
-      await execAsync(
-        `until timeout 0.25 curl -s http://localhost:8877; do sleep 0.25; done`
-      );
-    }
-    process.stdin.pause();
-    sandboxProcess2 = spawn2(config.command, args2, {
-      stdio: "inherit",
-      ...childEnv ? { env: { ...process.env, ...childEnv } } : {}
-    });
-    return new Promise((resolve3, reject) => {
-      sandboxProcess2?.on("error", reject);
-      sandboxProcess2?.on("close", (code) => {
-        process.stdin.resume();
-        resolve3(code ?? 1);
-      });
-    });
-  }
-  writeStderrLine(`hopping into sandbox (command: ${config.command}) ...`);
-  const gcPath = fs4.realpathSync(process.argv[1]);
-  const projectSandboxDockerfile = path6.join(
-    SETTINGS_DIRECTORY_NAME,
-    "sandbox.Dockerfile"
-  );
-  const isCustomProjectSandbox = fs4.existsSync(projectSandboxDockerfile);
-  const image = config.image;
-  const workdir = path6.resolve(process.cwd());
-  const containerWorkdir = getContainerPath(workdir);
-  if (process.env["BUILD_SANDBOX"]) {
-    if (!gcPath.includes("qwen-code/packages/")) {
-      throw new FatalSandboxError(
-        "Cannot build sandbox using installed Qwen Code binary; run `npm link ./packages/cli` under QwenCode-cli repo to switch to linked binary."
-      );
-    } else {
-      writeStderrLine("building sandbox ...");
-      const gcRoot = gcPath.split("/packages/")[0];
-      let buildArgs = "";
-      const projectSandboxDockerfile2 = path6.join(
-        SETTINGS_DIRECTORY_NAME,
-        "sandbox.Dockerfile"
-      );
-      if (isCustomProjectSandbox) {
-        writeStderrLine(`using ${projectSandboxDockerfile2} for sandbox`);
-        buildArgs += `-f ${path6.resolve(projectSandboxDockerfile2)} -i ${image}`;
-      }
-      execSync(
-        `cd ${gcRoot} && node scripts/build_sandbox.js -s ${buildArgs}`,
-        {
-          stdio: "inherit",
-          env: {
-            ...process.env,
-            QWEN_SANDBOX: config.command
-            // in case sandbox is enabled via flags (see config.ts under cli package)
-          }
-        }
-      );
-    }
-  }
-  if (!await ensureSandboxImageIsPresent(config.command, image)) {
-    const remedy = image === LOCAL_DEV_SANDBOX_IMAGE_NAME ? "Try running `npm run build:all` or `npm run build:sandbox` under the qwen-code repo to build it locally, or check the image name and your network connection." : "Please check the image name, your network connection, or notify qwen-code-dev@service.alibaba.com if the issue persists.";
-    throw new FatalSandboxError(
-      `Sandbox image '${image}' is missing or could not be pulled. ${remedy}`
-    );
-  }
-  const args = ["run", "-i", "--rm", "--init", "--workdir", containerWorkdir];
-  if (process.env["SANDBOX_FLAGS"]) {
-    const flags = (0, import_shell_quote.parse)(process.env["SANDBOX_FLAGS"], process.env).filter(
-      (f) => typeof f === "string"
-    );
-    args.push(...flags);
-  }
-  if (process.stdin.isTTY) {
-    args.push("-t");
-  }
-  args.push("--add-host", "host.docker.internal:host-gateway");
-  args.push("--volume", `${workdir}:${containerWorkdir}`);
-  const userSettingsDirOnHost = getUserSettingsDir();
-  const runtimeBaseDirOnHost = Storage.getRuntimeBaseDir();
-  const userSettingsDirRealPath = ensureDirectoryAndGetRealPath(
-    userSettingsDirOnHost
-  );
-  const runtimeBaseDirRealPath = ensureDirectoryAndGetRealPath(runtimeBaseDirOnHost);
-  const userSettingsDirInSandbox = getContainerPath(
-    `/home/node/${SETTINGS_DIRECTORY_NAME}`
-  );
-  const userSettingsDirContainerPath = getContainerPath(
-    userSettingsDirRealPath
-  );
-  const runtimeBaseDirContainerPath = getContainerPath(runtimeBaseDirRealPath);
-  const runtimeCoveredByUserSettings = isSubpath(
-    userSettingsDirRealPath,
-    runtimeBaseDirRealPath
-  );
-  const userSettingsCoveredByRuntime = isSubpath(
-    runtimeBaseDirRealPath,
-    userSettingsDirRealPath
-  );
-  const runtimeSameAsUserSettings = runtimeCoveredByUserSettings && userSettingsCoveredByRuntime;
-  args.push(
-    "--volume",
-    `${userSettingsDirRealPath}:${userSettingsDirInSandbox}`
-  );
-  if ((!userSettingsCoveredByRuntime || runtimeSameAsUserSettings) && userSettingsDirInSandbox !== userSettingsDirContainerPath) {
-    args.push(
-      "--volume",
-      `${userSettingsDirRealPath}:${userSettingsDirContainerPath}`
-    );
-  }
-  args.push("--env", `QWEN_HOME=${userSettingsDirContainerPath}`);
-  if (!runtimeCoveredByUserSettings) {
-    args.push(
-      "--volume",
-      `${runtimeBaseDirRealPath}:${runtimeBaseDirContainerPath}`
-    );
-  }
-  if (!runtimeSameAsUserSettings) {
-    args.push("--env", `QWEN_RUNTIME_DIR=${runtimeBaseDirContainerPath}`);
-  }
-  args.push("--volume", `${os2.tmpdir()}:${getContainerPath(os2.tmpdir())}`);
-  const gcloudConfigDir = path6.join(os2.homedir(), ".config", "gcloud");
-  if (fs4.existsSync(gcloudConfigDir)) {
-    args.push(
-      "--volume",
-      `${gcloudConfigDir}:${getContainerPath(gcloudConfigDir)}:ro`
-    );
-  }
-  if (process.env["GOOGLE_APPLICATION_CREDENTIALS"]) {
-    const adcFile = process.env["GOOGLE_APPLICATION_CREDENTIALS"];
-    if (fs4.existsSync(adcFile)) {
-      args.push("--volume", `${adcFile}:${getContainerPath(adcFile)}:ro`);
-      args.push(
-        "--env",
-        `GOOGLE_APPLICATION_CREDENTIALS=${getContainerPath(adcFile)}`
-      );
-    }
-  }
-  if (process.env["SANDBOX_MOUNTS"]) {
-    for (let mount of process.env["SANDBOX_MOUNTS"].split(",")) {
-      if (mount.trim()) {
-        const { from, to, opts } = parseSandboxMountSpec(mount);
-        mount = `${from}:${to}:${opts}`;
-        if (!path6.isAbsolute(from)) {
-          throw new FatalSandboxError(
-            `Path '${from}' listed in SANDBOX_MOUNTS must be absolute`
-          );
-        }
-        if (!fs4.existsSync(from)) {
-          throw new FatalSandboxError(
-            `Missing mount path '${from}' listed in SANDBOX_MOUNTS`
-          );
-        }
-        writeStderrLine(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);
-        args.push("--volume", mount);
-      }
-    }
-  }
-  ports().forEach((p) => args.push("--publish", `${p}:${p}`));
-  if (process.env["DEBUG"]) {
-    const debugPort = process.env["DEBUG_PORT"] || "9229";
-    args.push(`--publish`, `${debugPort}:${debugPort}`);
-  }
-  const proxyCommand = process.env["QWEN_SANDBOX_PROXY_COMMAND"];
-  if (proxyCommand) {
-    let proxy = process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env["http_proxy"] || "http://localhost:8877";
-    proxy = proxy.replace("localhost", SANDBOX_PROXY_NAME);
-    if (proxy) {
-      args.push("--env", `HTTPS_PROXY=${proxy}`);
-      args.push("--env", `https_proxy=${proxy}`);
-      args.push("--env", `HTTP_PROXY=${proxy}`);
-      args.push("--env", `http_proxy=${proxy}`);
-    }
-    const noProxy = process.env["NO_PROXY"] || process.env["no_proxy"];
-    if (noProxy) {
-      args.push("--env", `NO_PROXY=${noProxy}`);
-      args.push("--env", `no_proxy=${noProxy}`);
-    }
-    if (proxy) {
-      execSync(
-        `${config.command} network inspect ${SANDBOX_NETWORK_NAME} || ${config.command} network create --internal ${SANDBOX_NETWORK_NAME}`
-      );
-      args.push("--network", SANDBOX_NETWORK_NAME);
-      if (proxyCommand) {
-        execSync(
-          `${config.command} network inspect ${SANDBOX_PROXY_NAME} || ${config.command} network create ${SANDBOX_PROXY_NAME}`
-        );
-      }
-    }
-  }
-  const imageName = parseSandboxImageName(image);
-  const isIntegrationTest = process.env["QWEN_CODE_INTEGRATION_TEST"] === "true";
-  let containerName;
-  if (isIntegrationTest) {
-    containerName = `qwen-code-integration-test-${randomBytes(4).toString(
-      "hex"
-    )}`;
-    writeStderrLine(`ContainerName: ${containerName}`);
-  } else {
-    containerName = `${imageName}-${randomBytes(4).toString("hex")}`;
-    writeStderrLine(`ContainerName (regular): ${containerName}`);
-  }
-  args.push("--name", containerName);
-  if (containerName.length <= 64) {
-    args.push("--hostname", containerName);
-  }
-  if (process.env["QWEN_CODE_TEST_VAR"]) {
-    args.push(
-      "--env",
-      `QWEN_CODE_TEST_VAR=${process.env["QWEN_CODE_TEST_VAR"]}`
-    );
-  }
-  args.push(...getSandboxPassthroughEnvArgs());
-  if (process.env["QWEN_CODE_MCP_APPROVALS_PATH"]) {
-    args.push(
-      "--env",
-      `QWEN_CODE_MCP_APPROVALS_PATH=${getContainerPath(
-        process.env["QWEN_CODE_MCP_APPROVALS_PATH"]
-      )}`
-    );
-  }
-  if (process.env["QWEN_CODE_WARNINGS_FILE"]) {
-    args.push(
-      "--env",
-      `QWEN_CODE_WARNINGS_FILE=${getContainerPath(
-        process.env["QWEN_CODE_WARNINGS_FILE"]
-      )}`
-    );
-  }
-  if (process.env["GEMINI_API_KEY"]) {
-    args.push("--env", `GEMINI_API_KEY=${process.env["GEMINI_API_KEY"]}`);
-  }
-  if (process.env["GOOGLE_API_KEY"]) {
-    args.push("--env", `GOOGLE_API_KEY=${process.env["GOOGLE_API_KEY"]}`);
-  }
-  if (process.env["OPENAI_API_KEY"]) {
-    args.push("--env", `OPENAI_API_KEY=${process.env["OPENAI_API_KEY"]}`);
-  }
-  if (process.env["OPENAI_BASE_URL"]) {
-    args.push("--env", `OPENAI_BASE_URL=${process.env["OPENAI_BASE_URL"]}`);
-  }
-  if (process.env["OPENAI_MODEL"]) {
-    args.push("--env", `OPENAI_MODEL=${process.env["OPENAI_MODEL"]}`);
-  }
-  if (process.env["GOOGLE_GENAI_USE_VERTEXAI"]) {
-    args.push(
-      "--env",
-      `GOOGLE_GENAI_USE_VERTEXAI=${process.env["GOOGLE_GENAI_USE_VERTEXAI"]}`
-    );
-  }
-  if (process.env["GOOGLE_GENAI_USE_GCA"]) {
-    args.push(
-      "--env",
-      `GOOGLE_GENAI_USE_GCA=${process.env["GOOGLE_GENAI_USE_GCA"]}`
-    );
-  }
-  if (process.env["GOOGLE_CLOUD_PROJECT"]) {
-    args.push(
-      "--env",
-      `GOOGLE_CLOUD_PROJECT=${process.env["GOOGLE_CLOUD_PROJECT"]}`
-    );
-  }
-  if (process.env["GOOGLE_CLOUD_LOCATION"]) {
-    args.push(
-      "--env",
-      `GOOGLE_CLOUD_LOCATION=${process.env["GOOGLE_CLOUD_LOCATION"]}`
-    );
-  }
-  if (process.env["GEMINI_MODEL"]) {
-    args.push("--env", `GEMINI_MODEL=${process.env["GEMINI_MODEL"]}`);
-  }
-  if (process.env["TERM"]) {
-    args.push("--env", `TERM=${process.env["TERM"]}`);
-  }
-  if (process.env["COLORTERM"]) {
-    args.push("--env", `COLORTERM=${process.env["COLORTERM"]}`);
-  }
-  for (const envVar of [
-    "QWEN_CODE_IDE_SERVER_PORT",
-    "QWEN_CODE_IDE_WORKSPACE_PATH",
-    "TERM_PROGRAM"
-  ]) {
-    if (process.env[envVar]) {
-      args.push("--env", `${envVar}=${process.env[envVar]}`);
-    }
-  }
-  const virtualEnv = process.env["VIRTUAL_ENV"];
-  if (virtualEnv && isContainerPathWithinWorkdir(
-    getContainerPath(workdir),
-    getContainerPath(virtualEnv)
-  )) {
-    const sandboxVenvPath = path6.resolve(
-      SETTINGS_DIRECTORY_NAME,
-      "sandbox.venv"
-    );
-    if (!fs4.existsSync(sandboxVenvPath)) {
-      fs4.mkdirSync(sandboxVenvPath, { recursive: true });
-    }
-    args.push("--volume", `${sandboxVenvPath}:${getContainerPath(virtualEnv)}`);
-    args.push("--env", `VIRTUAL_ENV=${getContainerPath(virtualEnv)}`);
-  }
-  if (process.env["SANDBOX_ENV"]) {
-    for (let env of process.env["SANDBOX_ENV"].split(",")) {
-      if (env = env.trim()) {
-        if (env.includes("=")) {
-          writeStderrLine(`SANDBOX_ENV: ${env}`);
-          args.push("--env", env);
-        } else {
-          throw new FatalSandboxError(
-            "SANDBOX_ENV must be a comma-separated list of key=value pairs"
-          );
-        }
-      }
-    }
-  }
-  for (const name of Object.keys(childEnv ?? {})) {
-    args.push("--env", name);
-  }
-  const existingNodeOptions = process.env["NODE_OPTIONS"] || "";
-  const allNodeOptions = [
-    ...existingNodeOptions ? [existingNodeOptions] : [],
-    ...nodeArgs
-  ].join(" ");
-  if (allNodeOptions.length > 0) {
-    args.push("--env", `NODE_OPTIONS="${allNodeOptions}"`);
-  }
-  args.push("--env", `SANDBOX=${containerName}`);
-  if (config.command === "podman") {
-    const emptyAuthFilePath = path6.join(os2.tmpdir(), "empty_auth.json");
-    fs4.writeFileSync(emptyAuthFilePath, "{}", "utf-8");
-    args.push("--authfile", emptyAuthFilePath);
-  }
-  let userFlag = "";
-  const finalEntrypoint = entrypoint(workdir, cliArgs);
-  const useCurrentUser = await shouldUseCurrentUserInSandbox();
-  if (useCurrentUser) {
-    args.push("--user", "root");
-    const uid = execSync("id -u").toString().trim();
-    const gid = execSync("id -g").toString().trim();
-    const username = "qwen";
-    const homeDir = getContainerPath(os2.homedir());
-    const setupUserCommands = [
-      // Use -f with groupadd to avoid errors if the group already exists.
-      `groupadd -f -g ${gid} ${username}`,
-      // Create user only if it doesn't exist. Use -o for non-unique UID.
-      `id -u ${username} &>/dev/null || useradd -o -u ${uid} -g ${gid} -d ${homeDir} -s /bin/bash ${username}`
-    ].join(" && ");
-    const originalCommand = finalEntrypoint[2];
-    const escapedOriginalCommand = originalCommand.replace(/'/g, "'\\''");
-    const suCommand = `su -p ${username} -c '${escapedOriginalCommand}'`;
-    finalEntrypoint[2] = `${setupUserCommands} && ${suCommand}`;
-    userFlag = `--user ${uid}:${gid}`;
-    args.push("--env", `HOME=${os2.homedir()}`);
-  } else if (isIntegrationTest) {
-    args.push("--user", "root");
-    userFlag = "--user root";
-  }
-  args.push(image);
-  args.push(...finalEntrypoint);
-  let proxyProcess = void 0;
-  let sandboxProcess = void 0;
-  if (proxyCommand) {
-    const proxyContainerCommand = `${config.command} run --rm --init ${userFlag} --name ${SANDBOX_PROXY_NAME} --network ${SANDBOX_PROXY_NAME} -p 8877:8877 -v ${process.cwd()}:${workdir} --workdir ${workdir} ${image} ${proxyCommand}`;
-    const isWindows = os2.platform() === "win32";
-    const proxyShell = isWindows ? "cmd.exe" : "bash";
-    const proxyShellArgs = isWindows ? ["/c", proxyContainerCommand] : ["-c", proxyContainerCommand];
-    proxyProcess = spawn2(proxyShell, proxyShellArgs, {
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: true
-    });
-    const stopProxy = /* @__PURE__ */ __name(() => {
-      writeStderrLine("stopping proxy container ...");
-      execSync(`${config.command} rm -f ${SANDBOX_PROXY_NAME}`);
-    }, "stopProxy");
-    process.on("exit", stopProxy);
-    process.on("SIGINT", stopProxy);
-    process.on("SIGTERM", stopProxy);
-    proxyProcess.stderr?.on("data", (data) => {
-      writeStderrLine(data.toString().trim());
-    });
-    proxyProcess.on("close", (code, signal) => {
-      if (sandboxProcess?.pid) {
-        process.kill(-sandboxProcess.pid, "SIGTERM");
-      }
-      throw new FatalSandboxError(
-        `Proxy container command '${proxyContainerCommand}' exited with code ${code}, signal ${signal}`
-      );
-    });
-    writeStderrLine("waiting for proxy to start ...");
-    await execAsync(
-      `until timeout 0.25 curl -s http://localhost:8877; do sleep 0.25; done`
-    );
-    await execAsync(
-      `${config.command} network connect ${SANDBOX_NETWORK_NAME} ${SANDBOX_PROXY_NAME}`
-    );
-  }
-  process.stdin.pause();
-  sandboxProcess = spawn2(config.command, args, {
-    stdio: "inherit",
-    ...childEnv ? { env: { ...process.env, ...childEnv } } : {}
-  });
-  return new Promise((resolve3, reject) => {
-    sandboxProcess.on("error", (err) => {
-      writeStderrLine(`Sandbox process error: ${err}`);
-      reject(err);
-    });
-    sandboxProcess?.on("close", (code, signal) => {
-      process.stdin.resume();
-      if (code !== 0 && code !== null) {
-        writeStderrLine(
-          `Sandbox process exited with code: ${code}, signal: ${signal}`
-        );
-      }
-      resolve3(code ?? 1);
-    });
-  });
-}
-__name(start_sandbox, "start_sandbox");
-async function imageExists(sandbox, image) {
-  return new Promise((resolve3) => {
-    const args = ["image", "inspect", "--format", "{{.Id}}", image];
-    const checkProcess = spawn2(sandbox, args);
-    let stdoutData = "";
-    if (checkProcess.stdout) {
-      checkProcess.stdout.on("data", (data) => {
-        stdoutData += data.toString();
-      });
-    }
-    checkProcess.on("error", (err) => {
-      writeStderrLine(
-        `Failed to start '${sandbox}' command for image check: ${err.message}`
-      );
-      resolve3(false);
-    });
-    checkProcess.on("close", () => {
-      resolve3(stdoutData.trim() !== "");
-    });
-  });
-}
-__name(imageExists, "imageExists");
-async function pullImage(sandbox, image) {
-  writeStderrLine(`Attempting to pull image ${image} using ${sandbox}...`);
-  return new Promise((resolve3) => {
-    const args = ["pull", image];
-    const pullProcess = spawn2(sandbox, args, { stdio: "pipe" });
-    let stderrData = "";
-    const onStdoutData = /* @__PURE__ */ __name((data) => {
-      writeStderrLine(data.toString().trim());
-    }, "onStdoutData");
-    const onStderrData = /* @__PURE__ */ __name((data) => {
-      stderrData += data.toString();
-      writeStderrLine(data.toString().trim());
-    }, "onStderrData");
-    const onError = /* @__PURE__ */ __name((err) => {
-      writeStderrLine(
-        `Failed to start '${sandbox} pull ${image}' command: ${err.message}`
-      );
-      cleanup();
-      resolve3(false);
-    }, "onError");
-    const onClose = /* @__PURE__ */ __name((code) => {
-      if (code === 0) {
-        writeStderrLine(`Successfully pulled image ${image}.`);
-        cleanup();
-        resolve3(true);
-      } else {
-        writeStderrLine(
-          `Failed to pull image ${image}. '${sandbox} pull ${image}' exited with code ${code}.`
-        );
-        if (stderrData.trim()) {
-        }
-        cleanup();
-        resolve3(false);
-      }
-    }, "onClose");
-    const cleanup = /* @__PURE__ */ __name(() => {
-      if (pullProcess.stdout) {
-        pullProcess.stdout.removeListener("data", onStdoutData);
-      }
-      if (pullProcess.stderr) {
-        pullProcess.stderr.removeListener("data", onStderrData);
-      }
-      pullProcess.removeListener("error", onError);
-      pullProcess.removeListener("close", onClose);
-      if (pullProcess.connected) {
-        pullProcess.disconnect();
-      }
-    }, "cleanup");
-    if (pullProcess.stdout) {
-      pullProcess.stdout.on("data", onStdoutData);
-    }
-    if (pullProcess.stderr) {
-      pullProcess.stderr.on("data", onStderrData);
-    }
-    pullProcess.on("error", onError);
-    pullProcess.on("close", onClose);
-  });
-}
-__name(pullImage, "pullImage");
-async function ensureSandboxImageIsPresent(sandbox, image) {
-  writeStderrLine(`Checking for sandbox image: ${image}`);
-  if (await imageExists(sandbox, image)) {
-    writeStderrLine(`Sandbox image ${image} found locally.`);
-    return true;
-  }
-  writeStderrLine(`Sandbox image ${image} not found locally.`);
-  if (image === LOCAL_DEV_SANDBOX_IMAGE_NAME) {
-    return false;
-  }
-  if (await pullImage(sandbox, image)) {
-    if (await imageExists(sandbox, image)) {
-      writeStderrLine(`Sandbox image ${image} is now available after pulling.`);
-      return true;
-    } else {
-      writeStderrLine(
-        `Sandbox image ${image} still not found after a pull attempt. This might indicate an issue with the image name or registry, or the pull command reported success but failed to make the image available.`
-      );
-      return false;
-    }
-  }
-  writeStderrLine(
-    `Failed to obtain sandbox image ${image} after check and pull attempt.`
-  );
-  return false;
-}
-__name(ensureSandboxImageIsPresent, "ensureSandboxImageIsPresent");
-
 // packages/cli/src/utils/startupWarnings.ts
 init_esbuild_shims();
-import fs5 from "node:fs/promises";
+import fs4 from "node:fs/promises";
 async function getStartupWarnings() {
   const warningsFilePath = process.env["QWEN_CODE_WARNINGS_FILE"];
   if (!warningsFilePath) return [];
   try {
-    await fs5.access(warningsFilePath);
-    const warningsContent = await fs5.readFile(warningsFilePath, "utf-8");
+    await fs4.access(warningsFilePath);
+    const warningsContent = await fs4.readFile(warningsFilePath, "utf-8");
     const warnings = warningsContent.split("\n").filter((line) => line.trim() !== "");
     try {
-      await fs5.unlink(warningsFilePath);
+      await fs4.unlink(warningsFilePath);
     } catch {
       warnings.push("Warning: Could not delete temporary warnings file.");
     }
@@ -2428,15 +1606,15 @@ __name(getStartupWarnings, "getStartupWarnings");
 
 // packages/cli/src/utils/userStartupWarnings.ts
 init_esbuild_shims();
-import fs6 from "node:fs/promises";
-import path7 from "node:path";
+import fs5 from "node:fs/promises";
+import path5 from "node:path";
 var rootDirectoryCheck = {
   id: "root-directory",
   check: /* @__PURE__ */ __name(async (options) => {
     try {
-      const workspaceRealPath = await fs6.realpath(options.workspaceRoot);
+      const workspaceRealPath = await fs5.realpath(options.workspaceRoot);
       const errorMessage = "Warning: You are running Qwen Code in the root directory. Your entire folder structure will be used for context. It is strongly recommended to run in a project-specific directory.";
-      if (path7.dirname(workspaceRealPath) === workspaceRealPath) {
+      if (path5.dirname(workspaceRealPath) === workspaceRealPath) {
         return errorMessage;
       }
       return null;
@@ -2533,7 +1711,7 @@ function getNodeMemoryArgs(isDebugMode3) {
   if ("bun" in process.versions) {
     return [];
   }
-  const totalMemoryMB = os3.totalmem() / (1024 * 1024);
+  const totalMemoryMB = os.totalmem() / (1024 * 1024);
   const heapStats = v8.getHeapStatistics();
   const currentMaxOldSpaceSizeMb = Math.floor(
     heapStats.heap_size_limit / 1024 / 1024
@@ -2577,8 +1755,8 @@ ${error.stack ?? ""}
     let logPath;
     try {
       logPath = Storage.getDebugLogPath(config.getSessionId());
-      fs7.mkdirSync(path8.dirname(logPath), { recursive: true });
-      fs7.appendFileSync(logPath, line, "utf8");
+      fs6.mkdirSync(path6.dirname(logPath), { recursive: true });
+      fs6.appendFileSync(logPath, line, "utf8");
       logged = true;
     } catch {
     }
@@ -2600,7 +1778,7 @@ ${sanitizeTerminalText(error.stack ?? error.message)}`
       monitorRegistry.abortAll({ notify: false });
       try {
         if (logPath) {
-          fs7.appendFileSync(
+          fs6.appendFileSync(
             logPath,
             `${(/* @__PURE__ */ new Date()).toISOString()} [ERROR] [STARTUP] [MONITOR_REAP] reaped=${reapCount}
 `,
@@ -2613,7 +1791,7 @@ ${sanitizeTerminalText(error.stack ?? error.message)}`
       try {
         if (logPath) {
           const detail = reapError instanceof Error ? reapError.stack : String(reapError);
-          fs7.appendFileSync(
+          fs6.appendFileSync(
             logPath,
             `${(/* @__PURE__ */ new Date()).toISOString()} [ERROR] [STARTUP] [MONITOR_REAP_FAILED] ${detail ?? ""}
 `,
@@ -2783,7 +1961,7 @@ async function main() {
     await initializeI18n(
       resolveLanguageSetting(settings.merged.general?.language)
     );
-    const { handleList: handleListExtensions } = await import("./list-YOE25QUI.js");
+    const { handleList: handleListExtensions } = await import("./list-KQSQ4A5G.js");
     await handleListExtensions();
     process.exit(0);
   }
@@ -2797,7 +1975,7 @@ async function main() {
   dns.setDefaultResultOrder(
     validateDnsResolutionOrder(settings.merged.advanced?.dnsResolutionOrder)
   );
-  const { themeManager, AUTO_THEME_NAME } = await import("./theme-manager-HDS4YFPW.js");
+  const { themeManager, AUTO_THEME_NAME } = await import("./theme-manager-SK57EKMO.js");
   themeManager.loadCustomThemes(settings.merged.ui?.customThemes);
   const configuredTheme = settings.merged.ui?.theme;
   if (configuredTheme && configuredTheme !== AUTO_THEME_NAME) {
@@ -2814,7 +1992,7 @@ async function main() {
       await initializeI18n(
         resolveLanguageSetting(settings.merged.general?.language)
       );
-      const { updateBeforeRelaunch } = await import("./update-relaunch-MTJ32SLF.js");
+      const { updateBeforeRelaunch } = await import("./update-relaunch-LI7GRP36.js");
       const shouldRelaunch = await updateBeforeRelaunch(
         settings,
         updateProjectRoot,
@@ -2824,9 +2002,10 @@ async function main() {
     }, "onUpdateRelaunch");
     const sandboxConfig = await loadSandboxConfig(settings.merged, argv);
     const customSandboxImage = argv.sandboxImage ?? process.env["QWEN_SANDBOX_IMAGE"] ?? settings.merged.tools?.sandboxImage;
-    if (sandboxConfig && sandboxConfig.command !== "sandbox-exec" && customSandboxImage) {
-      process.env[CUSTOM_SANDBOX_IMAGE_ENV_VAR] = sandboxConfig.image;
-    } else if (sandboxConfig && sandboxConfig.command !== "sandbox-exec") {
+    const containerSandbox = sandboxConfig?.command === "docker" || sandboxConfig?.command === "podman" ? sandboxConfig : void 0;
+    if (containerSandbox?.image && customSandboxImage) {
+      process.env[CUSTOM_SANDBOX_IMAGE_ENV_VAR] = containerSandbox.image;
+    } else if (containerSandbox) {
       const hostInstallationInfo = getInstallationInfo(updateProjectRoot, true);
       process.env[HOST_UPDATE_RELAUNCH_ENV_VAR] = String(
         Boolean(
@@ -2943,7 +2122,7 @@ ${finalArgs[promptIndex + 1]}`;
     const resolveIfPath = /* @__PURE__ */ __name((v) => {
       if (typeof v !== "string" || v.length === 0) return v;
       if (looksLikeInlineJson(v)) return v;
-      return path8.resolve(launchCwdForPaths, v);
+      return path6.resolve(launchCwdForPaths, v);
     }, "resolveIfPath");
     argv.mcpConfig = resolveIfPath(argv.mcpConfig);
     argv.openaiLoggingDir = resolveIfPath(argv.openaiLoggingDir);
@@ -2952,15 +2131,15 @@ ${finalArgs[promptIndex + 1]}`;
     argv.telemetryOutfile = resolveIfPath(argv.telemetryOutfile);
     if (Array.isArray(argv.includeDirectories)) {
       argv.includeDirectories = argv.includeDirectories.map(
-        (d) => typeof d === "string" && d.length > 0 ? path8.resolve(launchCwdForPaths, d) : d
+        (d) => typeof d === "string" && d.length > 0 ? path6.resolve(launchCwdForPaths, d) : d
       );
     }
     if (typeof argv.jsonSchema === "string") {
       const trimmedSchema = argv.jsonSchema.trim();
       if (trimmedSchema.startsWith("@")) {
         const rel = trimmedSchema.slice(1);
-        if (rel.length > 0 && !path8.isAbsolute(rel)) {
-          argv.jsonSchema = "@" + path8.resolve(launchCwdForPaths, rel);
+        if (rel.length > 0 && !path6.isAbsolute(rel)) {
+          argv.jsonSchema = "@" + path6.resolve(launchCwdForPaths, rel);
         }
       }
     }
@@ -2991,7 +2170,7 @@ ${finalArgs[promptIndex + 1]}`;
     );
     let resolvedSessionId;
     if (argv.resume === "") {
-      const { showResumeSessionPicker } = await import("./StandaloneSessionPicker-4ZH7MOVG.js");
+      const { showResumeSessionPicker } = await import("./StandaloneSessionPicker-V635V72I.js");
       resolvedSessionId = await showResumeSessionPicker();
     } else if (!isValidSessionId(argv.resume)) {
       const sessionService = new SessionService(process.cwd());
@@ -3002,7 +2181,7 @@ ${finalArgs[promptIndex + 1]}`;
         writeStderrLine(
           `Multiple sessions found with title "${argv.resume}". Please select one:`
         );
-        const { showResumeSessionPicker } = await import("./StandaloneSessionPicker-4ZH7MOVG.js");
+        const { showResumeSessionPicker } = await import("./StandaloneSessionPicker-V635V72I.js");
         resolvedSessionId = await showResumeSessionPicker(
           process.cwd(),
           matches
@@ -3047,7 +2226,7 @@ ${finalArgs[promptIndex + 1]}`;
     );
     markAcpStartup("configConstructionEnd");
     profileCheckpoint("after_load_cli_config");
-    const nonInteractiveHousekeeping = !config.isInteractive() || config.getExperimentalZedIntegration() ? await import("./scheduler-6MDJX2ZK.js") : void 0;
+    const nonInteractiveHousekeeping = !config.isInteractive() || config.getExperimentalZedIntegration() ? await import("./scheduler-GCZYLZ2P.js") : void 0;
     if (nonInteractiveHousekeeping) {
       registerCleanup(
         () => nonInteractiveHousekeeping.stopNonInteractiveOpenAILogHousekeeping()
@@ -3152,11 +2331,11 @@ ${finalArgs[promptIndex + 1]}`;
       }
     }
     if (config.isInteractive()) {
-      const { setMaxSizedBoxDebugging } = await import("./MaxSizedBox-BFMIFJWT.js");
+      const { setMaxSizedBoxDebugging } = await import("./MaxSizedBox-FCF6M53W.js");
       setMaxSizedBoxDebugging(isDebugMode3);
     }
     const inputFormat = process.stdin.isTTY ? "text" /* TEXT */ : typeof config.getInputFormat === "function" ? config.getInputFormat() : "text" /* TEXT */;
-    const { initializeApp } = await import("./initializer-MPXTKQA4.js");
+    const { initializeApp } = await import("./initializer-4JXZEC4B.js");
     let input = config.getQuestion();
     const hasRemoteInput = Boolean(config.getInputFile?.());
     const deferIdeConnection = config.isInteractive() && !config.getExperimentalZedIntegration() && !input && !hasRemoteInput;
@@ -3168,7 +2347,7 @@ ${finalArgs[promptIndex + 1]}`;
     profileCheckpoint("after_initialize_app");
     if (config.getExperimentalZedIntegration()) {
       markAcpStartup("acpImportStart");
-      const { runAcpAgent } = await import("./acpAgent-UMAJ3XR3.js");
+      const { runAcpAgent } = await import("./acpAgent-3DPWZTNC.js");
       markAcpStartup("acpImportEnd");
       try {
         await runAcpAgent(config, settings, argv, {
@@ -3178,6 +2357,7 @@ ${finalArgs[promptIndex + 1]}`;
           externalToolGuardProviderAttached: isAcpMode && privateAcpParentCapability !== void 0 && privateExternalToolGuardProvider === EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE
         });
       } finally {
+        prepareFileWatchersForProcessExit();
         await runExitCleanup();
       }
       process.exit(0);
@@ -3220,7 +2400,7 @@ ${finalArgs[promptIndex + 1]}`;
       const selection = selectTuiRenderer();
       if (selection.renderer === "opentui") {
         try {
-          const { startOpenTuiUI } = await import("./start-opentui-ui-YGJOUE2H.js");
+          const { startOpenTuiUI } = await import("./start-opentui-ui-JKAIWGF7.js");
           const started = await startOpenTuiUI(
             config,
             settings,
@@ -3253,7 +2433,7 @@ ${finalArgs[promptIndex + 1]}`;
       } else {
         debugLogger5.debug(`TUI renderer: ${selection.reason}`);
       }
-      const { startInteractiveUI } = await import("./startInteractiveUI-5ZEVKSFF.js");
+      const { startInteractiveUI } = await import("./startInteractiveUI-YRPOT6GH.js");
       await startInteractiveUI(
         config,
         settings,
@@ -3314,7 +2494,7 @@ ${finalArgs[promptIndex + 1]}`;
 ${input}`;
       }
     }
-    const { validateNonInteractiveAuth } = await import("./validateNonInterActiveAuth-HUFQKCGG.js");
+    const { validateNonInteractiveAuth } = await import("./validateNonInterActiveAuth-YFPCYYNL.js");
     const nonInteractiveConfig = await validateNonInteractiveAuth(
       settings.merged.security?.auth?.useExternal,
       config,
@@ -3326,7 +2506,7 @@ ${input}`;
     );
     if (inputFormat === "stream-json" /* STREAM_JSON */) {
       const trimmedInput = (input ?? "").trim();
-      const { runNonInteractiveStreamJson } = await import("./session-5YK2BXH4.js");
+      const { runNonInteractiveStreamJson } = await import("./session-ZLUK7E4P.js");
       nonInteractiveHousekeeping?.startNonInteractiveOpenAILogHousekeeping(
         nonInteractiveConfig,
         settings
@@ -3357,7 +2537,7 @@ ${input}`;
       prompt_length: input.length
     });
     debugLogger5.debug(`Session ID: ${config.getSessionId()}`);
-    const { runNonInteractive } = await import("./nonInteractiveCli-6TW2XYP5.js");
+    const { runNonInteractive } = await import("./nonInteractiveCli-GPT3TVOK.js");
     nonInteractiveHousekeeping?.startNonInteractiveOpenAILogHousekeeping(
       nonInteractiveConfig,
       settings