@qwen-code/qwen-code 0.24.4 → 0.24.5-nightly.20260924.ffea2d024e

package/chunks/managed-runtime-attestation-worker-G23AEEMF.js

@@ -0,0 +1,367 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  require_express
+} from "./chunk-WZCVB2ER.js";
+import "./chunk-CKXUWR6I.js";
+import "./chunk-TZBFVXNX.js";
+import "./chunk-GOFAQQZA.js";
+import "./chunk-XWRJCPHC.js";
+import "./chunk-MU2WLMYD.js";
+import "./chunk-YQ3U5MUC.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name,
+  __toESM
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/managed-runtime-attestation-worker.ts
+init_esbuild_shims();
+var import_express2 = __toESM(require_express(), 1);
+import { createServer } from "node:http";
+
+// packages/cli/src/serve/managed-runtime-attestation-contract.ts
+init_esbuild_shims();
+var import_express = __toESM(require_express(), 1);
+import { timingSafeEqual } from "node:crypto";
+var MANAGED_RUNTIME_ATTESTATION_BODY_LIMIT_BYTES = 16 * 1024;
+var OWNED_MANAGED_RUNTIME_ROUTES = Object.freeze([
+  Object.freeze({
+    key: "attest",
+    method: "POST",
+    path: "/internal/managed-runtime/v2/attest",
+    protocolVersion: 2,
+    requestBodyLimitBytes: MANAGED_RUNTIME_ATTESTATION_BODY_LIMIT_BYTES,
+    responseBodyLimitBytes: MANAGED_RUNTIME_ATTESTATION_BODY_LIMIT_BYTES,
+    cacheControl: "no-store"
+  })
+]);
+var ATTEST_ROUTE = OWNED_MANAGED_RUNTIME_ROUTES[0];
+var CAPABILITY_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+var REQUEST_KEYS = Object.freeze([
+  "capabilityDigest",
+  "isolationClass",
+  "protocolVersion",
+  "provisionRequestId",
+  "tenantId",
+  "workspaceCwd",
+  "workspaceGeneration",
+  "workspaceId"
+]);
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+__name(isNonEmptyString, "isNonEmptyString");
+function snapshotAttestationIdentity(identity) {
+  if (!isNonEmptyString(identity.token) || !isNonEmptyString(identity.runtimeInstanceId) || !isNonEmptyString(identity.runtimeIncarnation) || !isNonEmptyString(identity.leaseId) || !Number.isSafeInteger(identity.epoch) || identity.epoch < 1 || !isNonEmptyString(identity.provisionRequestId) || !isNonEmptyString(identity.tenantId) || !isNonEmptyString(identity.workspaceId) || !isNonEmptyString(identity.workspaceGeneration) || !isNonEmptyString(identity.workspaceCwd) || !CAPABILITY_DIGEST_PATTERN.test(identity.capabilityDigest) || identity.isolationClass !== "session" && identity.isolationClass !== "workspace") {
+    throw new Error("Managed Runtime attestation identity is invalid.");
+  }
+  return Object.freeze({ ...identity });
+}
+__name(snapshotAttestationIdentity, "snapshotAttestationIdentity");
+function createAttestationResponseJson(identity) {
+  const response = {
+    protocolVersion: ATTEST_ROUTE.protocolVersion,
+    runtimeInstanceId: identity.runtimeInstanceId,
+    runtimeIncarnation: identity.runtimeIncarnation,
+    leaseId: identity.leaseId,
+    epoch: identity.epoch,
+    provisionRequestId: identity.provisionRequestId,
+    tenantId: identity.tenantId,
+    workspaceId: identity.workspaceId,
+    workspaceGeneration: identity.workspaceGeneration,
+    workspaceCwd: identity.workspaceCwd,
+    capabilityDigest: identity.capabilityDigest,
+    isolationClass: identity.isolationClass
+  };
+  const responseJson = JSON.stringify(response);
+  if (Buffer.byteLength(responseJson) > ATTEST_ROUTE.responseBodyLimitBytes) {
+    throw new Error("Managed Runtime attestation response exceeds 16 KiB.");
+  }
+  return responseJson;
+}
+__name(createAttestationResponseJson, "createAttestationResponseJson");
+function equalSecret(actual, expected) {
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes);
+}
+__name(equalSecret, "equalSecret");
+function isClosedAttestationRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const keys = Object.keys(value).sort();
+  return keys.length === REQUEST_KEYS.length && keys.every((key, index) => key === REQUEST_KEYS[index]);
+}
+__name(isClosedAttestationRequest, "isClosedAttestationRequest");
+var noStore = /* @__PURE__ */ __name((_req, res, next) => {
+  res.setHeader("Cache-Control", ATTEST_ROUTE.cacheControl);
+  next();
+}, "noStore");
+function authorize(identity) {
+  return (req, res, next) => {
+    const authorization = req.get("Authorization");
+    if (!authorization?.startsWith("Bearer ") || !equalSecret(authorization.slice("Bearer ".length), identity.token)) {
+      res.status(401).json({
+        code: "managed_runtime_unauthorized",
+        error: "Managed Runtime credentials are invalid."
+      });
+      return;
+    }
+    if (req.get("Cache-Control") !== "no-store") {
+      res.status(400).json({
+        code: "managed_runtime_attestation_invalid",
+        error: "Managed Runtime attestation request is invalid."
+      });
+      return;
+    }
+    if (req.get("X-Qwen-Managed-Lease-Id") !== identity.leaseId || req.get("X-Qwen-Managed-Lease-Epoch") !== String(identity.epoch)) {
+      res.status(409).json({
+        code: "managed_runtime_identity_conflict",
+        error: "Managed Runtime lease identity conflicts."
+      });
+      return;
+    }
+    next();
+  };
+}
+__name(authorize, "authorize");
+function handleAttestation(identity, responseJson) {
+  return (req, res) => {
+    const body = req.body;
+    if (!isClosedAttestationRequest(body) || body.protocolVersion !== ATTEST_ROUTE.protocolVersion || !isNonEmptyString(body.provisionRequestId) || !isNonEmptyString(body.tenantId) || !isNonEmptyString(body.workspaceId) || !isNonEmptyString(body.workspaceGeneration) || !isNonEmptyString(body.workspaceCwd) || typeof body.capabilityDigest !== "string" || !CAPABILITY_DIGEST_PATTERN.test(body.capabilityDigest) || body.isolationClass !== "session" && body.isolationClass !== "workspace") {
+      res.status(400).json({
+        code: "managed_runtime_attestation_invalid",
+        error: "Managed Runtime attestation request is invalid."
+      });
+      return;
+    }
+    if (body.provisionRequestId !== identity.provisionRequestId || body.tenantId !== identity.tenantId || body.workspaceId !== identity.workspaceId || body.workspaceGeneration !== identity.workspaceGeneration || body.workspaceCwd !== identity.workspaceCwd || body.capabilityDigest !== identity.capabilityDigest || body.isolationClass !== identity.isolationClass) {
+      res.status(409).json({
+        code: "managed_runtime_identity_conflict",
+        error: "Managed Runtime immutable identity conflicts."
+      });
+      return;
+    }
+    res.status(200).type("application/json").send(responseJson);
+  };
+}
+__name(handleAttestation, "handleAttestation");
+var handleJsonError = /* @__PURE__ */ __name((error, _req, res, next) => {
+  if (res.headersSent) {
+    next(error);
+    return;
+  }
+  if (error && typeof error === "object" && "type" in error && error.type === "entity.too.large") {
+    res.status(413).json({
+      code: "managed_runtime_attestation_too_large",
+      error: "Managed Runtime attestation request exceeds 16 KiB."
+    });
+    return;
+  }
+  if (error instanceof SyntaxError || error && typeof error === "object" && "type" in error && (error.type === "charset.unsupported" || error.type === "encoding.unsupported")) {
+    res.status(400).json({
+      code: "managed_runtime_attestation_invalid",
+      error: "Managed Runtime attestation request is invalid."
+    });
+    return;
+  }
+  next(error);
+}, "handleJsonError");
+function registerManagedRuntimeAttestationRoute(app, identity) {
+  const identitySnapshot = snapshotAttestationIdentity(identity);
+  const responseJson = createAttestationResponseJson(identitySnapshot);
+  const method = ATTEST_ROUTE.method.toLowerCase();
+  app[method](
+    ATTEST_ROUTE.path,
+    noStore,
+    authorize(identitySnapshot),
+    import_express.default.json({
+      // Compressed private requests add no value at 16 KiB. Refusing them
+      // keeps the limit on wire bytes and makes corrupt streams use the JSON
+      // protocol error instead of Express' HTML error handler.
+      inflate: false,
+      limit: ATTEST_ROUTE.requestBodyLimitBytes,
+      strict: true,
+      type: "application/json"
+    }),
+    handleAttestation(identitySnapshot, responseJson),
+    handleJsonError
+  );
+}
+__name(registerManagedRuntimeAttestationRoute, "registerManagedRuntimeAttestationRoute");
+function isOwnedManagedRuntimeRoute(method, url) {
+  return OWNED_MANAGED_RUNTIME_ROUTES.some(
+    (route) => method === route.method && url === route.path
+  );
+}
+__name(isOwnedManagedRuntimeRoute, "isOwnedManagedRuntimeRoute");
+function ownedManagedRuntimeRouteGate(next) {
+  return (req, res) => {
+    res.setHeader("Cache-Control", ATTEST_ROUTE.cacheControl);
+    if (!isOwnedManagedRuntimeRoute(req.method, req.url)) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    next(req, res);
+  };
+}
+__name(ownedManagedRuntimeRouteGate, "ownedManagedRuntimeRouteGate");
+
+// packages/cli/src/serve/managed-runtime-attestation-worker.ts
+var MANAGED_RUNTIME_WORKER_BOOT_LIMIT_BYTES = 32 * 1024;
+var MANAGED_RUNTIME_WORKER_BOOT_TIMEOUT_MS = 3e4;
+var INVALID_BOOT_MESSAGE = "Managed Runtime worker boot payload is invalid.";
+var BOOT_KEYS = Object.freeze([
+  "capabilityDigest",
+  "epoch",
+  "isolationClass",
+  "leaseId",
+  "provisionRequestId",
+  "runtimeIncarnation",
+  "runtimeInstanceId",
+  "tenantId",
+  "token",
+  "type",
+  "version",
+  "workspaceCwd",
+  "workspaceGeneration",
+  "workspaceId"
+]);
+function isExactBoot(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const keys = Object.keys(value).sort();
+  if (keys.length !== BOOT_KEYS.length || !keys.every((key, index) => key === BOOT_KEYS[index])) {
+    return false;
+  }
+  const boot = value;
+  return boot["type"] === "boot" && boot["version"] === 1;
+}
+__name(isExactBoot, "isExactBoot");
+async function collectManagedRuntimeWorkerBoot(input) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of input) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += bytes.byteLength;
+    if (size > MANAGED_RUNTIME_WORKER_BOOT_LIMIT_BYTES) {
+      throw new Error(INVALID_BOOT_MESSAGE);
+    }
+    chunks.push(bytes);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new Error(INVALID_BOOT_MESSAGE);
+  }
+  if (!isExactBoot(parsed)) {
+    throw new Error(INVALID_BOOT_MESSAGE);
+  }
+  return parsed;
+}
+__name(collectManagedRuntimeWorkerBoot, "collectManagedRuntimeWorkerBoot");
+async function readManagedRuntimeWorkerBoot(input) {
+  let timeout;
+  const timedOut = new Promise((_, reject) => {
+    timeout = setTimeout(() => {
+      input.destroy();
+      reject(new Error(INVALID_BOOT_MESSAGE));
+    }, MANAGED_RUNTIME_WORKER_BOOT_TIMEOUT_MS);
+    timeout.unref();
+  });
+  try {
+    return await Promise.race([
+      collectManagedRuntimeWorkerBoot(input),
+      timedOut
+    ]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+__name(readManagedRuntimeWorkerBoot, "readManagedRuntimeWorkerBoot");
+async function startManagedRuntimeAttestationWorker(boot) {
+  const app = (0, import_express2.default)();
+  app.disable("x-powered-by");
+  registerManagedRuntimeAttestationRoute(app, boot);
+  const server = createServer(ownedManagedRuntimeRouteGate(app));
+  server.maxHeadersCount = 32;
+  server.headersTimeout = 5e3;
+  server.requestTimeout = 5e3;
+  server.keepAliveTimeout = 1e3;
+  await new Promise((resolve, reject) => {
+    const onError = /* @__PURE__ */ __name((error) => {
+      server.off("listening", onListening);
+      reject(error);
+    }, "onError");
+    const onListening = /* @__PURE__ */ __name(() => {
+      server.off("error", onError);
+      resolve();
+    }, "onListening");
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(0, "127.0.0.1");
+  });
+  const address = server.address();
+  if (!address) {
+    await new Promise((resolve) => server.close(() => resolve()));
+    throw new Error("Managed Runtime worker listener is unavailable.");
+  }
+  const ready = Object.freeze({
+    type: "ready",
+    version: 1,
+    runtimeInstanceId: boot.runtimeInstanceId,
+    runtimeIncarnation: boot.runtimeIncarnation,
+    leaseId: boot.leaseId,
+    epoch: boot.epoch,
+    url: `http://127.0.0.1:${address.port}`
+  });
+  let closing;
+  return {
+    ready,
+    close: /* @__PURE__ */ __name(() => {
+      closing ??= new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+        server.closeAllConnections();
+      });
+      return closing;
+    }, "close")
+  };
+}
+__name(startManagedRuntimeAttestationWorker, "startManagedRuntimeAttestationWorker");
+async function runManagedRuntimeAttestationWorker() {
+  const boot = await readManagedRuntimeWorkerBoot(process.stdin);
+  const worker = await startManagedRuntimeAttestationWorker(boot);
+  await new Promise((resolve, reject) => {
+    let closing = false;
+    const close = /* @__PURE__ */ __name(() => {
+      if (closing) return;
+      closing = true;
+      void worker.close().then(resolve, reject);
+    }, "close");
+    const closeAfterOutputFailure = /* @__PURE__ */ __name(() => {
+      process.exitCode = 1;
+      close();
+    }, "closeAfterOutputFailure");
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+    process.stdout.once("error", closeAfterOutputFailure);
+    process.stdout.write(`${JSON.stringify(worker.ready)}
+`, (error) => {
+      if (error) closeAfterOutputFailure();
+    });
+  });
+}
+__name(runManagedRuntimeAttestationWorker, "runManagedRuntimeAttestationWorker");
+export {
+  readManagedRuntimeWorkerBoot,
+  runManagedRuntimeAttestationWorker,
+  startManagedRuntimeAttestationWorker
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{mcp-7ZE6BR36.js → mcp-2LXAQFBW.js}

@@ -2,52 +2,52 @@
 "use strict";
 import {
   mcpCommand
-} from "./chunk-OQMLQJEX.js";
-import "./chunk-LYEINKJD.js";
+} from "./chunk-TENLV7C6.js";
+import "./chunk-BCW42UYG.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-D2H63VR2.js";
+import "./chunk-JYOYZTGR.js";
 import "./chunk-LDNRKF24.js";
 import "./chunk-5EJZE3FP.js";
-import "./chunk-DYLGEL4Y.js";
+import "./chunk-YID5BOAE.js";
 import "./chunk-BW4333PP.js";
 import "./chunk-CCGFXABG.js";
-import "./chunk-KY4HZXLV.js";
+import "./chunk-GLPNIOEV.js";
 import "./chunk-IDS7MSUP.js";
-import "./chunk-RIQQLEYE.js";
+import "./chunk-DVQCM4OJ.js";
 import "./chunk-756HBF3F.js";
 import "./chunk-MR3PXB6E.js";
-import "./chunk-CK5HUN74.js";
+import "./chunk-BAV7Z5KE.js";
 import "./chunk-GELRJXE2.js";
 import "./chunk-32CM56LO.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-A45QOTO4.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-H4W6TJFJ.js";
+import "./chunk-RONRTFAQ.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-DZJK32EE.js";
-import "./chunk-QROZDIMB.js";
-import "./chunk-NXZD3VNX.js";
-import "./chunk-SNMYJZZG.js";
-import "./chunk-GGUOO2XC.js";
-import "./chunk-7I63HEBQ.js";
-import "./chunk-I46MJUYS.js";
+import "./chunk-HJUAP436.js";
+import "./chunk-TL7DSR47.js";
+import "./chunk-TKEDWZ44.js";
+import "./chunk-7RCAMBLN.js";
+import "./chunk-YCWU2MD3.js";
+import "./chunk-AT4FRIF6.js";
 import "./chunk-6URMIIZO.js";
 import "./chunk-BCTEBRTF.js";
-import "./chunk-U2BS2NNZ.js";
-import "./chunk-TS4Y2MHO.js";
-import "./chunk-J5C5SQQJ.js";
+import "./chunk-4UGMA2PY.js";
+import "./chunk-CGREZDGO.js";
+import "./chunk-TTHRVIPY.js";
 import "./chunk-WKLD4E5L.js";
-import "./chunk-TX5DMDUG.js";
+import "./chunk-FAXPWBVN.js";
 import "./chunk-V2XJJTAB.js";
-import "./chunk-IFWXQC7B.js";
+import "./chunk-ZKZTUR7U.js";
 import "./chunk-MFWTREVT.js";
 import "./chunk-VCJNMND5.js";
 import "./chunk-YDERQ7ZV.js";
-import "./chunk-6IGW6HIV.js";
+import "./chunk-GXLCL2SC.js";
 import "./chunk-PPDPLILM.js";
 import "./chunk-FTKXJMQV.js";
 import "./chunk-S5BHLTHK.js";
-import "./chunk-DPEB6S2R.js";
+import "./chunk-5QEJKW7V.js";
 import "./chunk-27CVFKVI.js";
 import "./chunk-VU6JX6MN.js";
 import "./chunk-GOFAQQZA.js";
@@ -58,15 +58,15 @@ import "./chunk-7TK2HU3T.js";
 import "./chunk-YNURCIW7.js";
 import "./chunk-KNMT4XIN.js";
 import "./chunk-HORVWHWX.js";
-import "./chunk-6N2PJAZG.js";
+import "./chunk-PX2ZOOGQ.js";
 import "./chunk-JBUMBQAO.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
 import "./chunk-E4YH24E6.js";
 import "./chunk-FDOMQENS.js";
 import "./chunk-SLQ4C6GN.js";
-import "./chunk-DXXCNZW4.js";
-import "./chunk-N4VKU36J.js";
+import "./chunk-GDOTFZKX.js";
+import "./chunk-465XOJLQ.js";
 import "./chunk-U6H3XTFA.js";
 import "./chunk-6PVPNMXU.js";
 import "./chunk-NLHFXAC4.js";
@@ -76,7 +76,7 @@ import "./chunk-SK3RZOPS.js";
 import "./chunk-YVD6XEO3.js";
 import "./chunk-ELRMZTPF.js";
 import "./chunk-6C3D7BKK.js";
-import "./chunk-A5QPMBRL.js";
+import "./chunk-USEHQ5O2.js";
 import "./chunk-MNU36NGH.js";
 import "./chunk-QXQMBRGL.js";
 import "./chunk-TWPJO254.js";
@@ -86,22 +86,21 @@ import "./chunk-O6GEWCJA.js";
 import "./chunk-I3K2QRZ5.js";
 import "./chunk-5ZPFMX67.js";
 import "./chunk-RSKMN2JH.js";
-import "./chunk-ADPNUPK3.js";
+import "./chunk-2JY2LCUU.js";
 import "./chunk-VNTJJ4WQ.js";
 import "./chunk-BQMSZSG6.js";
-import "./chunk-LNUQA3OE.js";
-import "./chunk-47C3HPMW.js";
+import "./chunk-CVRZNFXO.js";
+import "./chunk-O5YL6KSX.js";
 import "./chunk-JX6XHPTX.js";
 import "./chunk-QCG3JVIW.js";
-import "./chunk-JE3J5HFM.js";
+import "./chunk-KAOHUUM7.js";
 import "./chunk-P6OZD6V2.js";
-import "./chunk-QKXZOHHQ.js";
+import "./chunk-LDURD6EP.js";
 import "./chunk-BKVPLSEI.js";
-import "./chunk-XWCLIEJ2.js";
+import "./chunk-UDXFQTUI.js";
 import "./chunk-H7VK3YDS.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-Z72PLR74.js";
-import "./chunk-GC3J5W2O.js";
 import "./chunk-OK6PQW7O.js";
 import "./chunk-NAVJD2PQ.js";
 import "./chunk-Z27N2QYZ.js";
@@ -113,20 +112,23 @@ import "./chunk-DJ2GSRLV.js";
 import "./chunk-U6673AVW.js";
 import "./chunk-VXQQCZPP.js";
 import "./chunk-KP2FHIFR.js";
-import "./chunk-VOHPPFJI.js";
+import "./chunk-MHAVM3RF.js";
 import "./chunk-KBVGO6H4.js";
-import "./chunk-2VS5EEXU.js";
+import "./chunk-WFHS3WCK.js";
 import "./chunk-VBT4BMCQ.js";
-import "./chunk-NNN2PKPV.js";
+import "./chunk-PYYPSK6Q.js";
 import "./chunk-CFMZLE3L.js";
 import "./chunk-OJSU46VD.js";
 import "./chunk-HD7O6WLV.js";
 import "./chunk-GHKVBSBY.js";
+import "./chunk-Q4FJVWI4.js";
+import "./chunk-CLNDQINM.js";
 import "./chunk-GMTJ3YQW.js";
 import "./chunk-5ETULJLP.js";
+import "./chunk-GC3J5W2O.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-XASQGHGO.js";
-import "./chunk-P5OXAI4R.js";
+import "./chunk-7ELTXG6G.js";
 import "./chunk-XZA32HII.js";
 import "./chunk-DYPTD5P5.js";
 import "./chunk-HHJLM3WQ.js";

package/chunks/{model-call-collection-W2WDYVH7.js → model-call-collection-JLUMVNCT.js}

@@ -4,7 +4,7 @@ import {
   assertRequiredOutputsPresent,
   computePolicyFingerprint,
   validateArtifact
-} from "./chunk-IFWXQC7B.js";
+} from "./chunk-ZKZTUR7U.js";
 import "./chunk-MFWTREVT.js";
 import {
   MEDIA_DETECTOR_VERSION,