@tencent-ai/codebuddy-code 2.127.3 → 2.128.1-dev.42c83b4.202607292236

package/dist/web-ui/docs/cn/cli/env-vars.md

@@ -216,7 +216,7 @@ CodeBuddy Code 支持把内部 traces 通过 OTLP 协议上报到用户自有的
 | `CODEBUDDY_DISABLE_REQUEST_VALIDATION` | 设置为 `1` 关闭 Gateway 自定义请求头校验（`X-CodeBuddy-Request`）。详见 [HTTP API 安全](./http-api.md#安全) |
 | `CODEBUDDY_CODE_CORS_ORIGINS` | 额外的 CORS 允许来源（逗号分隔）。支持精确 origin、`*.domain` 子域通配和 `*` 全开。如 `https://*.example.com,https://specific.com`。未设置时，若服务绑定 `0.0.0.0`（`--host 0.0.0.0`）则自动允许所有来源 |
 | `SERVER__HOST` | `--serve` 模式监听地址（默认：`127.0.0.1`） |
-| `SERVER__PORT` | `--serve` 模式监听端口 |
+| `SERVER__PORT` | `--serve` 模式监听端口；设为 `0` 时由内核自选端口，服务绑定后该变量会被更新为实际监听端口 |
 
 ## 企业微信集成
 

package/dist/web-ui/docs/en/cli/env-vars.md

@@ -216,7 +216,7 @@ CodeBuddy Code supports reporting internal traces to your own Collector via the
 | `CODEBUDDY_DISABLE_REQUEST_VALIDATION` | Set to `1` to disable Gateway custom request header validation (`X-CodeBuddy-Request`). See [HTTP API Security](./http-api.md#security) |
 | `CODEBUDDY_CODE_CORS_ORIGINS` | Additional CORS allowed origins (comma-separated). Supports exact origins, `*.domain` subdomain wildcards, and `*` for all. E.g., `https://*.example.com,https://specific.com`. When unset, if the service is bound to `0.0.0.0` (`--host 0.0.0.0`), all origins are automatically allowed |
 | `SERVER__HOST` | Listen address for `--serve` mode (default: `127.0.0.1`) |
-| `SERVER__PORT` | Listen port for `--serve` mode |
+| `SERVER__PORT` | Listen port for `--serve` mode; set to `0` for a kernel-assigned port — the variable is updated to the actual listening port once the server is bound |
 
 ## WeCom Integration
 

package/dist/web-ui/index.html

@@ -15,7 +15,7 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
     <meta name="mobile-web-app-capable" content="yes">
     <link rel="apple-touch-icon" href="/pwa-icon.svg">
-  <script type="module" crossorigin src="/assets/index-B1eoHSk4.js"></script>
+  <script type="module" crossorigin src="/assets/index-Dl8Dlnne.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/markdown-CP9awqWt.js">
   <link rel="modulepreload" crossorigin href="/assets/vendor-iLJwFVtf.js">
   <link rel="stylesheet" crossorigin href="/assets/index-BmV1Q3hC.css">

package/dist/web-ui/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const o=(o,n)=>(o=new URL(o+".js",n).href,s[o]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=o,e.onload=s,document.head.appendChild(e)}else e=o,importScripts(o),s()}).then(()=>{let e=s[o];if(!e)throw new Error(`Module ${o} didn’t register its module`);return e}));self.define=(n,i)=>{const l=e||("document"in self?document.currentScript.src:"")||location.href;if(s[l])return;let r={};const t=e=>o(e,l),f={module:{uri:l},exports:r,require:t};s[l]=Promise.all(n.map(e=>f[e]||t(e))).then(e=>(i(...e),r))}}define(["./workbox-fed2bdfe"],function(e){"use strict";self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"sandbox_proxy.html",revision:"e54bd087bf8b90d87d84c3cd8f2c22e9"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"index.html",revision:"d7fc2675e07bd95d7b599f2888f36a9d"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/vendor-iLJwFVtf.js",revision:null},{url:"assets/octicons-CaZ_fok2.woff2",revision:null},{url:"assets/mfixx-CpAhKOZz.woff2",revision:null},{url:"assets/markdown-CP9awqWt.js",revision:null},{url:"assets/index-DixJ0kqk.js",revision:null},{url:"assets/index-BmV1Q3hC.css",revision:null},{url:"assets/index-B1eoHSk4.js",revision:null},{url:"assets/fontawesome-B-jkhYfk.woff2",revision:null},{url:"assets/file-icons-C0jOugUK.woff2",revision:null},{url:"assets/devopicons-QN4QXivI.woff2",revision:null},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"manifest.webmanifest",revision:"7a003d0094122eb3e607566c757e9885"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api/,/^\/gateway/,/^\/docs\//]})),e.registerRoute(/^https:\/\/fonts\.googleapis\.com/,new e.StaleWhileRevalidate({cacheName:"google-fonts-stylesheets",plugins:[]}),"GET"),e.registerRoute(/^https:\/\/fonts\.gstatic\.com/,new e.CacheFirst({cacheName:"google-fonts-webfonts",plugins:[new e.ExpirationPlugin({maxEntries:20,maxAgeSeconds:31536e3})]}),"GET")});
+if(!self.define){let e,s={};const n=(n,o)=>(n=new URL(n+".js",o).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(o,i)=>{const l=e||("document"in self?document.currentScript.src:"")||location.href;if(s[l])return;let r={};const t=e=>n(e,l),f={module:{uri:l},exports:r,require:t};s[l]=Promise.all(o.map(e=>f[e]||t(e))).then(e=>(i(...e),r))}}define(["./workbox-fed2bdfe"],function(e){"use strict";self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"sandbox_proxy.html",revision:"e54bd087bf8b90d87d84c3cd8f2c22e9"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"index.html",revision:"384e5ef8d717460fa7e6dd3c9b11493b"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/vendor-iLJwFVtf.js",revision:null},{url:"assets/octicons-CaZ_fok2.woff2",revision:null},{url:"assets/mfixx-CpAhKOZz.woff2",revision:null},{url:"assets/markdown-CP9awqWt.js",revision:null},{url:"assets/index-Dl8Dlnne.js",revision:null},{url:"assets/index-DixJ0kqk.js",revision:null},{url:"assets/index-BmV1Q3hC.css",revision:null},{url:"assets/fontawesome-B-jkhYfk.woff2",revision:null},{url:"assets/file-icons-C0jOugUK.woff2",revision:null},{url:"assets/devopicons-QN4QXivI.woff2",revision:null},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"manifest.webmanifest",revision:"7a003d0094122eb3e607566c757e9885"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api/,/^\/gateway/,/^\/docs\//]})),e.registerRoute(/^https:\/\/fonts\.googleapis\.com/,new e.StaleWhileRevalidate({cacheName:"google-fonts-stylesheets",plugins:[]}),"GET"),e.registerRoute(/^https:\/\/fonts\.gstatic\.com/,new e.CacheFirst({cacheName:"google-fonts-webfonts",plugins:[new e.ExpirationPlugin({maxEntries:20,maxAgeSeconds:31536e3})]}),"GET")});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-ai/codebuddy-code",
-  "version": "2.127.3",
+  "version": "2.128.1-dev.42c83b4.202607292236",
   "description": "Use CodeBuddy, Tencent's AI assistant, right from your terminal. CodeBuddy can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.",
   "main": "lib/node/index.js",
   "typings": "lib/node/index.d.ts",
@@ -19,9 +19,9 @@
     "@lydell/node-pty-linux-x64": "1.2.0-beta.14",
     "@lydell/node-pty-win32-arm64": "1.2.0-beta.14",
     "@lydell/node-pty-win32-x64": "1.2.0-beta.14",
-    "@tencent-ai/sandbox-cli-darwin-arm64": "5.4.0-beta.6",
-    "@tencent-ai/sandbox-cli-darwin-x64": "5.4.0-beta.6",
-    "@tencent-ai/sandbox-cli-win32-x64": "5.4.0-beta.6"
+    "@tencent-ai/sandbox-cli-darwin-arm64": "5.4.0-beta.9",
+    "@tencent-ai/sandbox-cli-darwin-x64": "5.4.0-beta.9",
+    "@tencent-ai/sandbox-cli-win32-x64": "5.4.0-beta.9"
   },
   "keywords": [
     "codebuddy",
@@ -43,7 +43,8 @@
     "url": "https://cnb.cool/codebuddy/codebuddy-code/-/issues"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "dev"
   },
   "scripts": {},
   "devDependencies": {}

package/product.cloudhosted.json

@@ -60,6 +60,8 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
@@ -830,6 +832,6 @@
     "SelectImage": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.324Z"
+  "commit": "42c83b4f21b9c039516b92d106cd70eed83d5c44",
+  "date": "2026-07-29T14:36:13.047Z"
 }

package/product.internal.json

@@ -74,6 +74,8 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
@@ -813,6 +815,6 @@
       }
     }
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.317Z"
+  "commit": "42c83b4f21b9c039516b92d106cd70eed83d5c44",
+  "date": "2026-07-29T14:36:12.982Z"
 }

package/product.ioa.json

@@ -96,6 +96,8 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
@@ -1309,6 +1311,6 @@
       }
     }
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.320Z"
+  "commit": "42c83b4f21b9c039516b92d106cd70eed83d5c44",
+  "date": "2026-07-29T14:36:13.014Z"
 }

package/product.json

@@ -31,7 +31,9 @@
         "copilot.tencent.com",
         "staging-copilot.tencent.com",
         "www.codebuddy.cn",
-        "staging.codebuddy.cn"
+        "staging.codebuddy.cn",
+        "www.workbuddy.cn",
+        "staging.workbuddy.cn"
       ],
       "externalDomain": [
         "www.codebuddy.ai",
@@ -733,7 +735,7 @@
     },
     {
       "name": "tool-websearch-description",
-      "template": "\n- Searches the web and uses the results to inform responses\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n- Use this tool for accessing information beyond the knowledge cutoff\n- Searches are performed automatically within a single API call\n\nUsage notes:\n  - Domain filtering is supported to include or block specific websites\n  - Must use the current date provided in the context for search queries.\n  - Use `query_keyword_groups` when comparisons, explicit multi-topic research, or coverage-improving query variants across phrasings/languages/sub-angles are helpful; keep `query` as the main intent, max 5 groups.\n    Example: \"NVIDIA stock and AI chip market latest news\" → query_keyword_groups: [\"NVIDIA stock latest news\", \"AI chip market latest news\", \"英伟达 股价 AI芯片 最新动态\"]\n  - Use the `topic` parameter to specify the search domain for better relevance. Supported values: general (default), news, programming, documentation, academic, finance, technology, legal, medical.\n"
+      "template": "\n- Searches the web and uses the results to inform responses\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n- Use this tool for accessing information beyond the knowledge cutoff\n- Searches are performed automatically within a single API call\n- You MUST use the current_time provided in the user message when searching for recent information.\n\nWhen to search:\n  - For any factual question about the present-day world, you MUST search before answering; search before EVERY such question.\n  - Your confidence on a topic is NOT an excuse to skip search. Present-day facts — who holds a role, what something costs, whether a law still applies, what's newest in a category — cannot come from training data.\n  - Even seemingly familiar questions — for example asking about the price of a product or who currently leads a country — can be outdated, because prices and officeholders change frequently.\n  - Proactively search instead of answering from your priors and offering to check.\n\nUsage notes:\n  - The query must preserve the meaning of the user's request; keep the entity names, versions, dates and terms the user mentioned, and do not substitute or fill them in from prior knowledge.\n  - Domain filtering is supported to include or block specific websites.\n"
     },
     {
       "name": "tool-enterplanmode-description",
@@ -949,7 +951,7 @@
     },
     {
       "name": "code-review-trigger-reminder",
-      "template": "<system-reminder data-role=\"code-review-trigger\">\nThe user invoked `/code-review`{{target}} to review code for bugs and quality issues.\n{%- if fix %}\nThe user requested --fix: after the review, apply the findings to the working tree.\n{%- endif %}\n{%- if comment %}\nThe user requested --comment: after the review, post findings as inline PR comments.\n{%- endif %}\n\nReview the current diff for correctness bugs and reuse/simplification/efficiency cleanups.\n\n## Steps\n\n1. Run `git diff` (or `git diff HEAD` if there are staged changes) to see what changed. If a specific PR number or target is provided, run `gh pr diff <number>` instead.\n\n2. Analyze the changes thoroughly, looking for:\n   - **Correctness bugs**: logic errors, off-by-one, null/undefined handling, race conditions, missing error handling\n   - **Security issues**: injection vulnerabilities, improper input validation, exposed secrets\n   - **Performance problems**: unnecessary work, N+1 patterns, missing concurrency, hot-path bloat\n   - **Code quality**: duplicated code, leaky abstractions, parameter sprawl, stringly-typed code\n   - **Test coverage gaps**: untested edge cases, missing error path tests\n\n3. For each finding, provide:\n   - File and line number\n   - Severity (critical / warning / suggestion)\n   - One-line summary of the issue\n   - Suggested fix\n\n4. Present findings ranked most-severe first. Group by file when multiple findings are in the same file.\n{%- if fix %}\n\nAfter the review, apply all fixable findings to the working tree directly.\n{%- endif %}\n{%- if comment %}\n\nAfter the review, post each finding as an inline PR comment using `gh api` or `gh pr review`.\n{%- endif %}\n</system-reminder>\n"
+      "template": "<system-reminder data-role=\"code-review-trigger\">\nThe user invoked `/code-review`{{target}} to review code for bugs and quality issues.\n{%- if fix %}\nThe user requested --fix: after the review, apply the findings to the working tree.\n{%- endif %}\n{%- if comment %}\nThe user requested --comment: after the review, post findings as inline PR comments.\n{%- endif %}\n\nReview the current diff for correctness bugs and reuse/simplification/efficiency cleanups.\n\n## Steps\n\n1. Run `git diff` (or `git diff HEAD` if there are staged changes) to see what changed. If a specific PR number or target is provided, run `gh pr diff <number>` instead.\n\n2. Analyze the changes thoroughly, looking for:\n   - **Correctness bugs**: logic errors, off-by-one, null/undefined handling, race conditions, missing error handling\n   - **Security issues**: injection vulnerabilities, improper input validation, exposed secrets\n   - **Performance problems**: unnecessary work, N+1 patterns, missing concurrency, hot-path bloat\n   - **Code quality**: duplicated code, leaky abstractions, parameter sprawl, stringly-typed code\n   - **Test coverage gaps**: untested edge cases, missing error path tests\n\n3. For each finding, determine:\n   - File and line number\n   - Severity (critical / warning / suggestion)\n   - One-line summary of the issue\n   - A concrete failure scenario (how/when this would actually break or cause harm)\n   - Suggested fix\n\n4. Call the `ReportFindings` tool once with all findings (most-severe first), mapping each to\n   `file` (path + line), `summary` (one-line issue + suggested fix), and `failureScenario`\n   (the concrete scenario from step 3). If `ReportFindings` is not available, present findings\n   ranked most-severe first in prose instead, grouped by file when multiple findings share a file.\n{%- if fix %}\n\nAfter the review, apply all fixable findings to the working tree directly.\n{%- endif %}\n{%- if comment %}\n\nAfter the review, post each finding as an inline PR comment using `gh api` or `gh pr review`.\n{%- endif %}\n</system-reminder>\n"
     },
     {
       "name": "verify-trigger-reminder",
@@ -1057,7 +1059,6 @@
         "LSP",
         "ImageGen",
         "ImageEdit",
-        "ShareLink",
         "VideoGen",
         "EnterWorktree",
         "LeaveWorktree",
@@ -1067,6 +1068,8 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
@@ -1493,7 +1496,6 @@
     "DeferToolLoading": true,
     "ImageEdit": false,
     "VideoGen": true,
-    "ShareLink": true,
     "ScheduledTasks": true,
     "SkillManage": false,
     "SkipToolCallSupportCheck": true,
@@ -1770,12 +1772,22 @@
       "name": "WeComReply",
       "description": "Send a reply to a WeCom (企业微信) user. For text: pass text (markdown supported)."
     },
+    {
+      "name": "PushNotification",
+      "description": "tool-pushnotification-description",
+      "deferLoading": true
+    },
+    {
+      "name": "ReportFindings",
+      "description": "tool-reportfindings-description",
+      "deferLoading": true
+    },
     {
       "name": "Workflow",
       "description": "workflow-tool-description",
       "deferLoading": true
     }
   ],
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.331Z"
+  "commit": "42c83b4f21b9c039516b92d106cd70eed83d5c44",
+  "date": "2026-07-29T14:36:13.005Z"
 }

package/product.selfhosted.json

@@ -53,6 +53,8 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
@@ -344,6 +346,6 @@
     "ScheduledTasks": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.318Z"
+  "commit": "42c83b4f21b9c039516b92d106cd70eed83d5c44",
+  "date": "2026-07-29T14:36:13.032Z"
 }