mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-11 04:02:45 -10:00
feat/btw-qodercli-alignment
68
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
7fd185883f |
docs(tools): add You.com free MCP to the web search MCP services (#14000)
Adds You.com to "Supported MCP Web Search Services" in docs/developers/tools/web-search.md, after the SerpApi entry, in the same format as Firecrawl/SerpApi: description, Documentation/Cost/Get API Key/Best for bullets, Available Tools, and setup (CLI, settings.json without a key, settings.json with a key). One new section; nothing else on the page changes. Links use bare URLs (no UTM parameters) to match every other entry on the page. Rebased onto current main so it applies cleanly after the SerpApi entry. Fixes #13987. Co-authored-by: valueadd-lgtm <[email protected]> Co-authored-by: 易良 <[email protected]> Co-authored-by: Brian Sparker <[email protected]> |
||
|
ZedingZhang
|
edaa4e3826 |
feat(agents): make default background execution configurable (#15178)
* feat(agents): add configurable default background execution Signed-off-by: ZedingZhang <[email protected]> * fix(agents): clarify configurable background guidance * docs(agents): align execution guidance with configurable defaults --------- Signed-off-by: ZedingZhang <[email protected]> |
||
|
|
1853b1505f |
fix(subscription): isolate activation and restore sign-in recovery (#16453)
* fix(web-shell): wait for session before checking subscription commands * fix(cli): keep signed-out subscription startup in the composer * fix(subscription): preserve model selection across sign-in * fix(subscription): align sign-in with model selection scope * fix(subscription): apply reasoning defaults across models * fix(subscription): tag Qwen web links by client * fix(subscription): prefix Qwen web client tags * fix(subscription): attribute Qwen web links by paywall scene * fix(subscription): recover historical sessions with saved API models * fix(cli): remove the signed-out subscription startup notice * fix(subscription): support standalone desktop activation and expose errors * fix(subscription): isolate activation and session model selection * fix(subscription): enforce auth policy and restore home login * test(cli): preserve the default initializer mock on restore --------- Co-authored-by: luoyun <[email protected]> Co-authored-by: 易良 <[email protected]> |
||
|
liuxuely0626andluoyun
|
0cc37bf444 |
feat: add Qwen subscription support across CLI, VS Code, and Desktop (#16378)
* feat(subscription): add development login, models and web search * feat(subscription): refine account flows and host integration Align desktop and VS Code subscription UI, add account logout and confirmed plan display, and map subscription thinking parameters. Remove simulation code and obsolete native authentication paths, consolidate design documentation, and cover cancellation and recovery boundaries. * fix(subscription): preserve request errors and remove unused compatibility * fix(subscription): refine command visibility and client logout flows * fix(subscription): simplify account actions and desktop sign-in feedback * docs(subscription): clarify sign-in and provider guidance * feat(subscription): support switching accounts across clients * fix(subscription): align account actions and open plans on demand * fix(subscription): restore model selection after logout Filter subscription-only commands consistently across terminal renderers, preserve model catalog error classification, and display the subscription authentication name consistently. * fix(subscription): unify status authentication labels across clients * fix(subscription): preserve provider connections across client logout Restore configured providers after subscription logout across CLI, Desktop, and VS Code. Keep unrelated connections and conversation history, synchronize model state silently, and return to an unconfigured chat when no provider remains. * fix(subscription): correct native client logout state * feat(subscription): enable sign-in without development mode * refactor(ui): 优化会员登录成功提示和界面交互体验 - 移除订阅欢迎提示相关状态和行为，简化 UI 状态管理 - 替换登录成功提示为四行摘要，包含邮箱、套餐、模型及常用命令提示 - 更新国际化文本，支持新的登录成功摘要内容 - 取消订阅模式下输入框下方的命令提示行，改为在登录成功摘要中展示 - 移除多余的测试用例，新增登录成功消息的单元测试校验 - 优化 AppHeader 组件，不再显示订阅启动重复提示 - 调整 Composer 组件逻辑，删除订阅提示相关副作用及渲染条件 - 修改历史消息显示组件以适应新的成功提示格式 * fix(subscription): enable Flash reasoning controls in shared UI * fix(subscription): prioritize authorized models and simplify login dialogs * fix(subscription): preserve gateway errors and request IDs * fix(subscription): synchronize account state across clients Preserve model selections after sign-out, synchronize account commands and model catalogs, and retain explicit browser sign-in flows across CLI, Web Shell, and VS Code. Cancel subscription background agents on logout and normalize expired refresh credentials without SDK error wrapping. * fix(subscription): reset default model on explicit sign-in Choose the default served model when explicitly signing in to Qwen Subscription, preferring Max over a previously saved Flash selection. Preserve normal startup behavior and other provider flows, and cover CLI and workspace activation with regression tests. * fix(vscode): refresh models after successful sign-in * fix(web-shell): hide account actions during automatic sign-in * fix(web-shell): align model details and auth keyboard navigation * docs(subscription): revert previous guide changes * fix(core): reuse subscription catalog for same-login model switches * docs(subscription): document Qwen membership sign-in * fix(subscription): unify quota notices and preserve provider switching Carry structured subscription quota details through chat and search errors for localized CLI, Desktop, and VS Code display. Keep other providers available when subscription discovery fails and refine sidebar account actions. * fix(web-shell): align Chinese subscription entry title with CLI * fix(subscription): open plans for saved non-member accounts * fix(web-shell): show subscription commands after desktop sign-in * fix(subscription): reauthorize explicit account sign-ins * fix(auth): add model switching hint to subscription success * docs(auth): list Qwen OAuth as the first option * docs(models): simplify subscription sign-in guidance * docs(models): remove legacy OAuth from supported auth types * docs(subscription): link membership references and remove obsolete allowance note * fix(subscription): preserve session until reauthorization succeeds * fix(subscription): use pre for browser authorization and plans * fix(subscription): use production endpoints * test(vscode): fix editor message test formatting * fix(subscription): preserve unauthenticated session startup * fix(cli): classify subscription auth during ACP preflight * fix(subscription): scope activation to the current project --------- Co-authored-by: luoyun <[email protected]> |
||
|
易良
|
7b69fccd74 |
feat(tools): let an explicitly configured search backend name its host (#15638)
`classifyDashScopeBaseUrl` accepted a fixed list of DashScope-family suffixes, so an organization that routes model traffic through its own gateway had no configuration-only way to point the built-in `web_search` backend at that gateway: the tool stayed off with an `unknown-host` notice, and the alternatives were patching the source or dropping the built-in tool for an MCP search provider (#15299). Add `tools.webSearch.allowedHosts` / `WEB_SEARCH_ALLOWED_HOSTS`: extra suffixes matched exactly like the built-in ones (exact host, or any subdomain of a listed suffix). Empty by default, so behaviour is unchanged for anyone who does not set it, and the `https:` requirement still runs first because the side request carries a bearer key. The list reaches only the two places where the user named the backend: the `WEB_SEARCH_BASE_URL` path and the `modelProviders` path. Automatic derivation keeps the built-in list in both of its host tests — the entry usability check and the auto-eligible host check — so a host nobody declared is never adopted implicitly and never receives the main provider's key. Entries are trimmed, lower-cased, de-duplicated, and entries without a dot are ignored, so a typo narrows the list instead of widening it (a bare `com` would otherwise accept every `.com` host). Both rejection notices now name the setting, which is what a user hitting the gate needs. |
||
|
易良andQwen-Coder
|
a84dbff23e |
feat(providers): add QwenCloud as the first /auth entry (#14073)
* feat(providers): add 千问AI平台 / QwenCloud as the first /auth entry Adds QwenCloud as a new top-level provider group ahead of Alibaba ModelStudio, following the product ruling in #14025: the two entries coexist rather than one replacing the other, so saved ModelStudio credentials, endpoints and model selections keep resolving to their existing presets and no migration is needed. Two new presets share the ModelStudio wizard shape (Access Method -> Platform -> API Key -> models): - qwencloud-standard (pay-as-you-go, `sk-` / `sk-ws-` keys) - qwencloud-token-plan (Credit subscription, `sk-sp-` keys) Each offers China (千问AI平台) and International (QwenCloud) as an explicit platform choice, so the UI language never decides the endpoint. Coding Plan is not offered here — it is a ModelStudio product. Endpoints were taken from the platform's own documentation and probed before landing (all four return the DashScope `invalid_api_key` error envelope): - https://maas.qianwenaiapi.com/compatible-mode/v1 - https://token-plan.maas.qianwenaiapi.com/compatible-mode/v1 - https://maas.qwencloudapi.com/compatible-mode/v1 - https://token-plan.maas.qwencloudapi.com/compatible-mode/v1 The new hosts are added to the DashScope provider detection and the web-search endpoint allowlist so the built-in `web_search` backend keeps working; both new env keys are added to the no-AK CI gate's cleared-env list. Group wiring is mirrored across the ink and OpenTUI dialogs, the VS Code provider picker, and the serve catalog consumed by Web Shell. Closes #14025 Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): add QwenCloud auth strings to en and zh-TW locales The new auth entries introduced in the previous commit were only added to zh.js. Since en.js is the source of translation keys and both zh and zh-TW enforce strict key parity, the i18n check failed with "Extra key in zh.js" for all eight strings. Add the same keys to en.js as identity mappings and to zh-TW.js with Traditional Chinese values, so all three locale files have an identical key set. * test(cli): follow the QwenCloud row in the OpenTUI auth menu tests The new first /auth entry shifts the main menu by one row, but the tests addressed the sub-menus by position, so most flows landed a row early and the region-height assertions still named the old first row. * feat(providers): localize the QwenCloud /auth entry label per locale The top-level /auth entry was the only mixed CJK/Latin label in the menu ("千问AI平台 / QwenCloud"), and because en/zh mapped that key to itself it was effectively hardcoded mixed in every locale. Route it through i18n instead: en and other locales show "QwenCloud", zh shows "千问AI平台", zh-TW shows "千問AI平台". Locale-neutral surfaces (serve catalog, VS Code provider picker) carry the single Latin brand; the Chinese brand stays visible in the explicit platform step ("China — 千问AI平台") and the docs. The step-title flowTitle now goes through t() so the localized brand also appears in "… · Step 1/3 · …". Co-authored-by: Qwen-Coder <[email protected]> * fix(providers): register QwenCloud hosts in telemetry and reasoning classifiers The QwenCloud MaaS hosts and env keys were registered in the two host gates this PR edits, but two further independent classifiers of the same hosts did not learn about them, and both misclassify the entry this PR makes the first-position default: - telemetry/gen-ai-provider.ts had no providerFromHostname match for maas.qianwenaiapi.com / maas.qwencloudapi.com and no PROVIDER_BY_ENV_KEY entry for QWENCLOUD_API_KEY / QWENCLOUD_TOKEN_PLAN_API_KEY, so resolveGenAiProviderName fell through to its `default: return 'openai'` arm. Every span and log record for a QwenCloud install was attributed to OpenAI, while the identical ModelStudio path resolved to 'dashscope'. - core/reasoning-overrides.ts keeps its own inline hostname regex without the new hosts, so a user-authored partial reasoning override on a qwen* model behind a QwenCloud baseUrl selected 'qwen-chat-template' -> toggleOnly -> invalidReasoning, which captureLatestReasoning catches and warns. The override was silently discarded; the same declaration on dashscope.aliyuncs.com resolves to 'dashscope-effort'. Also widen the SDK-side mirror DaemonAuthProviderCatalog.groups[].id to include 'qwencloud', which packages/cli/src/serve/types.ts and auth-provider-helpers.ts already emit as the first group, and derive web-shell's AuthGroupId from that union instead of re-declaring it, so the SDK type is the single source of truth. A second literal union in web-shell is why nothing reddened in-repo while the daemon emitted a group id its own published wire type declared impossible. The new suffixes go inside the existing anchored (^|\.)...$ group, so a forged maas.qianwenaiapi.com.evil.com cannot match while the legitimate token-plan. subscription subdomains still do. Both env keys map to the existing 'dashscope' provider value rather than a new one. The hosts stay literals in gen-ai-provider.ts rather than importing QWENCLOUD_MAAS_HOSTS: that module is a zero-import telemetry leaf, and dashscope.ts already imports core/reasoning-overrides at runtime, so importing back would cycle. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmv8fwg2z5f * test(providers): pin QwenCloud host classification and registry membership Cover behaviour this PR added that no test observed: - dashscope.test.ts: the QwenCloud MaaS pay-as-you-go and token-plan hosts are DashScope origins, plus dot-boundary lookalike negatives. - web-search.test.ts: the same four hosts pass the web-search gate. - qwencloud-standard/token-plan.test.ts: both presets are registered in ALL_PROVIDERS and QWENCLOUD_PROVIDERS, and the qwencloud access-method group excludes Coding Plan (replaces a constant-true id/label check). Each new assertion is mutation-verified: dropping isQwenCloudOrigin from the dashscope return, weakening its host match, dropping the QWENCLOUD_MAAS_HOSTS spread, removing the two registry entries, or flipping codingPlanProvider uiGroup each turns exactly the intended test red. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmv8mbxgn5t * test(providers,cli): pin QwenCloud preset separation and the auth catalog group Coverage for lines this PR itself added (review round 1: R1-21, R1-26, R1-15): - qwencloudStandardProvider.ownsModel is cross-checked against its QwenCloud Token Plan sibling and against a foreign envKey on its own endpoint. The two presets share uiGroup, catalog and protocol bucket, so that envKey gate is the only discriminator; dropping it kept the suite green while applyModelProvidersPatch would claim a Token Plan install. - buildAuthProviderCatalog gets its first test: the QwenCloud group is first and carries both access methods. A misspelled group filter stayed green. - The zero-row main-menu paint test now names row 0, which this PR re-pointed from Alibaba ModelStudio to QwenCloud while only rows 1 and 2 stayed pinned. Each assertion was confirmed load-bearing by one mutation that the pre-existing tests did not catch. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmv8oh38g5y * docs(users): sweep the /auth menu enumeration in overview and quickstart This PR re-numbered the /auth menu to four options in auth.md and model-providers.md, but overview.md and quickstart.md still described three entries with Alibaba ModelStudio as the recommended one (review round 1: R1-4). The doc set contradicted itself, and a quickstart reader holding a QwenCloud key was routed to the ModelStudio entry, whose endpoints reject it. Both pages now list QwenCloud first and reserve the "recommended setup" claim for it, matching auth.md. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmv8oh38g5y * fix(providers): validate daemon credentials and close QwenCloud follow-ups (#14302) * fix(serve): validate API key format before persisting in daemon install path The CLI, ACP and VS Code surfaces each call provider.validateApiKey before persisting credentials. The daemon route (POST /workspace/auth/provider) did not, because validateApiKey is a function on ProviderConfig and cannot be serialized to the wire — so no client of this route can apply the check either. Without this guard a key the provider's own entry rejects (e.g. a Token Plan sk-sp- key aimed at the Standard API Key entry) gets persisted silently, and the user only discovers the mismatch at the first authenticated call. Fix: call validateApiKey in the route after protocol validation and before invoking installAuthProvider. Return 400 with code 'invalid_api_key' on failure, matching the other three surfaces. Closes #14257 (item S3 / R2-13). * fix(providers): address #14257 deferred Suggestions (D1/D2, T1/T3-T9, I1, P5, S6/S7) Batch fix for actionable items from #14257: Docs: - D1: Add settings.json example to QwenCloud headless setup section - D2: Add QwenCloud rows to web-search.md auto-activation table Tests: - T1: Pin flowTitle locale resolution in both dialog suites - T3/T4: Assert QwenCloud sub-menu contents (Token Plan + Standard, no Coding Plan) - T5: Add missing token-plan.maas.qwencloudapi.com endpoint to dashscope.test.ts - T6: Add QwenCloud host tests to reasoning-overrides.test.ts - T7: Assert providerState in qwencloud-standard preset test - T8: Test ownsModel baseUrl conjunct independently of envKey - T9: Test providerMatchesCredentials URL gate independently of envKey - S7: Assert QwenCloud group in VS Code AuthMessageHandler picker i18n: - I1: Add validateApiKey messages to all 9 locale files Product: - P5: Fix qwen3.7-plus modalities to include video (matches alibaba-token-plan) Code: - S6: Update docstring enumerations in dashscope.ts and web-search.ts Remaining items need human decisions: P1-P4 (wording/labels), S1-S5 (API surface), T2 (ink suite gating is a pre-existing harness pattern). * fix(auth): translate provider titles at render time Co-authored-by: Qwen-Coder <[email protected]> * test(providers): handle optional preset models Co-authored-by: Qwen-Coder <[email protected]> * test(providers): pin Token Plan providerState and ownsModel baseUrl leg Addresses four review Suggestions on this PR: - R1-10 (#14257 T7): the providerState stamp was asserted for the Standard preset only. Token Plan has two baseUrl options and a baseUrl-dependent modelNamePrefix, so stamp both routes. - R1-11 (#14257 T8): the deciding baseUrl negative for ownsModel was added to the Standard suite only. The Token Plan negatives added here differ in envKey, so the baseUrl conjunct was never the deciding factor. - R1-1: the web-search host note contradicted the two QwenCloud rows this PR adds to the table on the same page. Name the Model Studio and QwenCloud MaaS families the code actually accepts. - R1-4: the daemon route comment claimed parity with the CLI/ACP/VS Code copies. Those resolve the endpoint first and validate the resolved URL; this route validates the client-supplied baseUrl. Comment only. Both new Token Plan rows were mutation-checked one mutant at a time: dropping baseUrl from resolveProviderState, stamping the provider default endpoint instead of the requested one, and relaxing ownsModel to envKey-only each turn exactly the intended row red. An additional cross-route "versions must differ" row stayed green under all of them (model configs already embed baseUrl), so it was dropped rather than shipped inert. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmv9zmmcj86 * test: make the QwenCloud witnesses discriminating; trim daemon key once R1-9: the two Token Plan cases and the four lookalike cases never reached the dashscope host regex - both blocks short-circuited in validateReasoningDeclaration/validateReasoningCapabilities before route.baseUrl was parsed, and the block comment misstated the Token Plan endpoints as unregistered. Fold the Token Plan hosts into the QwenCloud host table with a declaration that omits `thinking`/`profile`, so all four registered endpoints now pin the anchored suffixes. R1-5/R1-6: the Ink VIEW_TITLES fix had no CI-executed guard (every keystroke case is skipped under CI=true) and its T1 case asserted only the already-lazy flowTitle path. Add one ungated, keystroke-free render assertion and assert the sub-menu heading between the two keystrokes. R1-3: validate and forward the same trimmed key rather than validating the trimmed value while forwarding the raw one. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmva623ox8i * fix(auth): guard zh locale test cleanup, note hand-written provider caveat R1-7: wrap the QwenCloud zh flow-title test body in try/finally so unmount() and the locale reset still run when an assertion rejects, matching the shape of the opentui twin added in the same change. R1-2: note in the settings.json alternative that a hand-written provider entry carries no capabilities stamp, so /effort offers the generic tiers rather than the QwenCloud curated set. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvaacf8g8p * fix(providers): address #14073 round-3 deferred Suggestions - docs/design/auth/motivation.md: QwenCloud-first /auth enumeration (S1) - docs/users/quickstart.md: name QwenCloud credentials in Before you begin (S3) - docs/users/configuration/auth.md: scope the Token Plan prefix rule to ModelStudio vs QwenCloud so Option 1 and Option 4 no longer read as contradictory (S4) - qwencloud-standard.test.ts: correct the ownsModel comment — envKey and baseUrl conjuncts each exclude the sibling independently (S5) - auth-provider-helpers.test.ts + alibaba-standard.test.ts: pin every catalog group's providerIds and the alibaba uiGroup (S6) - web-search.test.ts: forged-suffix boundary cases for the QwenCloud host gate (S7) S2 (6-latin-locale backfill) and S8 (web-shell group dict) verified as no-ops: the sibling ModelStudio strings rely on the identical raw-key fallback in the same locales/dictionary. * fix(auth): localize provider API key errors * fix(providers): seed Token Plan only with models its endpoint serves A live GET /models on the China Token Plan route (real subscription key, 2026-10-16) serves neither kimi-k3 nor deepseek-v4-pro-0813 — the endpoint offers kimi-k2.x and deepseek-v4-pro instead, matching the platform doc's personal-edition table. The shared QWENCLOUD_MODELS seed list therefore pre-filled two ids the wizard would install as dead entries whenever discovery succeeded, and offered them in the offline fallback. Filter the shared catalog down to the five confirmed-served models for the Token Plan preset instead of duplicating stamps; the Standard (pay-as-you-go) catalog keeps the full list, which no live data has falsified. Pinned by a new preset test asserting the exact seed ids. --------- Co-authored-by: Qwen-Coder <[email protected]> * fix(auth): preserve explicit models during provider discovery --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Boulanouar Walidand易良
|
87de74860b |
docs(tools): add looot to the web search MCP services (#13999)
Co-authored-by: 易良 <[email protected]> |
||
|
Long Jin
|
1ce7d71633 |
fix(core): preserve fuzzy edit line boundaries (#13484)
* fix(core): preserve blank lines after fuzzy edits * test(core): cover repeated fuzzy edit matches * fix(core): keep fuzzy edits within whole-line matches |
||
|
Pulkit Chowdry
|
7326ac6e0b |
Add SerpApi to web search MCP services list (#13104)
* Add SerpApi to web search MCP services list * Updated best for, added a information that is sent to SerpApi. * Moved the information sent to SerpApi part in the description to align with the format followed by other listings. |
||
|
Long Jin
|
f8c99414b2 |
fix(core): report monitor startup failures as tool errors (#13460)
* fix(core): report monitor startup failures as tool errors * fix(core): classify monitor startup failures consistently |
||
|
易良andQwen-Coder
|
5deddb722b |
docs(tools): sync shell.md with the shipped run_shell_command contract (#12841)
* docs(tools): sync shell.md with the shipped run_shell_command contract Four statements in this file contradict the tool as shipped. is_background was documented as required -- twice in the arguments list and the Usage note, plus a "Required Background Parameter" section whose rationale was backwards. The schema is required: [command] (shell.ts:5762) and the parameter description says "Optional: ... If not specified, defaults to false (foreground execution)" (shell.ts:5743), so foreground is the fallback, not what the parameter exists to avoid. The foreground bullet list recommended cat and grep as one-time foreground commands, which the same tool description forbids in favour of the dedicated tools. #12532 replaced that list in the shipped description with one line; this mirrors it and states why the file tools are not candidates, so the list does not come back. "or by explicitly adding & to commands" offered & as a second control for backgrounding. On the managed background path a bare trailing & is stripped as redundant (stripTrailingBackgroundAmp, shell.ts:143, called at :4125). The sentence is now scoped to that path instead of claiming & never works: the example further down uses it with is_background=false, which is the unmanaged path, and is left alone deliberately. Verified against origin/main at |
||
|
JuampiandJuampi
|
f1361498ad |
docs(tools): add Firecrawl to the web search MCP services (#12646)
Co-authored-by: Juampi <[email protected]> |
||
|
易良andQwen-Coder
|
3dc9778dea |
perf(cli): optimize one-shot headless execution (#12340)
* perf(cli): optimize one-shot headless execution
* fix(cli): preserve unset shell schema default
* fix(cli): fall back when process replacement fails
* fix(cli): keep relaunch supervisor for headless slash-command prompts
Process replacement leaves no supervisor to consume exit code 43, so a
headless `/update` would exit having installed nothing. Keep the parent
process when the one-shot prompt dispatches as a slash command, and pin
both directions in llm.test.tsx.
Co-authored-by: Qwen-Coder <[email protected]>
* test(cli): update settings dialog snapshots for mode-based PTY default
With no fixed schema default the dialog now renders "(not set)" for
Interactive Shell (PTY) instead of true; refresh the ten snapshots.
Co-authored-by: Qwen-Coder <[email protected]>
* docs(cli): document process-replacement supervisor and reset semantics
Explain at the execve call why afterSpawn has nothing to protect there,
and record in the design doc that onUpdateRelaunch intentionally never
fires on the replacement path and that "reset to default" now clears the
interactive-shell key instead of writing true.
Co-authored-by: Qwen-Coder <[email protected]>
* Revert "fix(cli): keep relaunch supervisor for headless slash-command prompts"
The guarded path is unreachable: both relaunchForUpdate() call sites sit
inside `if (context.executionMode === 'interactive' && projectRoot)`
(update-command.ts:89), and a one-shot prompt resolves executionMode to
'non_interactive' (config.ts:1837-1839 -> nonInteractiveCliCommands.ts:431),
so a headless `/update` updates standalone installs in-process or prints
manual instructions and never exits 43. Per review correction, drop the
guard and its test rather than pin a non-bug.
Co-authored-by: Qwen-Coder <[email protected]>
* test(cli): pin stream-json shell default; document schema default contract
Add the missing --input-format stream-json leg to the shell-default
matrix, and note at the SettingDefinition declaration that `default` is
required for type inference even when its runtime value is undefined.
Co-authored-by: Qwen-Coder <[email protected]>
* test(cli): pin the full replaceProcess predicate for one-shot launches
The verify lane's mutation run left M7 (jsonFd term) surviving and the broader predicate shape unpinned after the slash-command guard was reverted. Assert the replaceProcess value relaunchAppInChildProcess receives across the launch modes: plain and slash-command one-shot prompts replace the process; ACP, -i, file, json-fd, stream-json, and dual-output file inputs keep the supervisor. Mutation-checked: deleting the jsonFd term fails the json-fd row, forcing the expression true fails all six supervisor rows.
Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmuakc4l1ae
* style(cli): prettier-format the replaceProcess predicate test
The Lint & Static lane's Run Prettier step failed on the test file
pushed in
|
||
|
qqqys
|
50e157a35e |
feat(core): cap web_search calls per session (#11852)
* feat(core): cap web_search calls per session
Since the built-in web search turned on by default for ModelStudio users, nothing bounded how many searches one session could issue: every call is a full side request plus search and page-read charges on the user's key, and the default Auto approval mode approves them without prompting. Count web_search calls on a mutable object on the root Config, so subagents running on derived Configs share it, and reset it when startNewSession() changes the session.
At tools.webSearch.maxPerSession (WEB_SEARCH_MAX_PER_SESSION, default 200, max 10000) further calls are skipped with a non-error result telling the model to continue with what it has and to ask the user to raise the cap if it needs more. The check and the increment sit in one synchronous block after the last await, so calls batched in one turn cannot all pass it; a search that fails still counts because its request was sent, while a call the gate turns away does not.
* fix(core): keep sub-second web_search budgets and truncation labels exact
The timeout message rounded any budget under 50 ms to "0s", contradicting its own comment; format it to the millisecond instead ("0.04s"). The salvaged-page label always claimed the 6000-character bound, but a cut that lands after a high surrogate backs off one unit and delivers 5999; state the length actually delivered. Both were found by the sandbox verification of #11692.
* fix(cli): edit integer settings as numbers in the settings dialogs
An integer setting shown in the settings UI could not be edited anywhere: the Ink and OpenTUI dialogs only started an edit for 'number', so Enter did nothing, and the Web Shell rendered it as a text input whose string value fails integer validation. No integer setting was shown in a dialog until tools.webSearch.maxPerSession, so this went unnoticed. Treat 'integer' like 'number' in all three editors through one isNumericSettingType helper, and declare tools.webSearch.timeoutMs and maxPerSession as integers so the write-time check matches their integer-only runtime resolvers instead of accepting fractions the runtime silently replaces with the default.
|
||
|
|
c26a8fd004 |
feat(core): make the web_search budget configurable and bound the extractor fallback (#11692)
* feat(core): make the web_search budget configurable and bound the extractor fallback The side request ran under a fixed 60s budget set when the tool was opt-in and rarely opened pages. With web_extractor on and the tool on by default, live searches take 13-107s, so the budget is hit routinely and the partial path hands the model a raw page dump instead of an answer. Add tools.webSearch.timeoutMs (WEB_SEARCH_TIMEOUT_MS), default 120s and at most 600s, and drive the client timeout, the abort signal and the timeout message from it. Salvaged extractor text now carries a label saying it is raw page content rather than the agent's narration, and is cut to 6000 characters. Also pin two properties the citation policy relies on: evidence bullets are bare URLs and nothing else, and the tool description and the per-result footer derive from one rule list so they cannot drift. The docs and settings schema named qwen3.6-plus as the automatic search model after it changed to qwen3.8-flash. * docs(cli): state per-tool execution cap precedence over the web search budget (#11692) Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): reject out-of-range tools.webSearch.timeoutMs at write time (#11692) Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): qualify the web search timeout partial-result promise (#11692) Co-authored-by: Qwen-Coder <[email protected]> * test(cli): add web search timeout constants to exhaustive core mocks (#11692) Co-authored-by: Qwen-Coder <[email protected]> * test(core): cover cancellation winning over partial-result salvage (#11692) Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: qwen-code-ci-bot <[email protected]> |
||
|
qqqysandqqqys
|
eb383fd3bb |
feat(core): enable the built-in web_search by default on ModelStudio Standard/Token Plan (#11348)
* feat(core): enable the built-in web_search by default on ModelStudio Standard/Token Plan
web_search was opt-in and needed enabled=true, a search model selector, and a modelProviders entry with an envKey even though a ModelStudio user's primary entry already satisfies every condition. Declare a dashscope search backend on the Standard API Key and Token Plan presets and let the registry derive the search side channel from the primary model's entry when nothing is configured explicitly. Entries matching no preset are adopted when their host is a DashScope endpoint, covering hand-written entries and the workspace-specific Token Plan hosts; Coding Plan endpoints stay out until they are verified.
Explicit model/env configuration keeps working for any DashScope-compatible entry. Auto derivation fails silently so users on other providers see no notice, enabled=false (or ENABLE_WEB_SEARCH=false) turns the tool off, and bare/safe mode always does.
* fix(core): derive the env-only web_search backend from the resolved generation config
The auto path read the runtime model snapshot, which is empty when the tool registry is built — detectAndCaptureRuntimeModel() runs after createToolRegistry() — and which only carries apiKeyEnvKey when a modelProviders entry supplied it, so a pure OPENAI_BASE_URL / OPENAI_API_KEY setup never registered web_search. Read the resolved generation config instead, which the ModelsConfig constructor already has, and fall back to the auth type's default key variable when no entry named one.
Also correct the docs: the default Auto approval mode lets the classifier approve searches without prompting, and a Custom Provider entry on a DashScope host is adopted like a hand-written one.
* fix(core): keep a failed web_search backend derivation from breaking the tool registry
Reading the generation config to derive the search backend assumed a complete Config surface, so a test double that stubs getModelsConfig() without getGenerationConfig() threw while the registry was being built and took every other tool down with it. Derivation is opportunistic: an unexpected Config shape should cost web search alone, so catch and fall back to the silent no-backend result. Give the subagent-manager double the accessor it was missing.
* chore: re-trigger CI
The Qwen Code CI workflow was not scheduled for
|
||
|
Dragonandqwen-code-dev-bot
|
e36a536cab |
feat(core): make todo_write opt-in (#10645)
* feat(core): make todo_write opt-in * fix: address todo_write review feedback * fix: harden opt-in tool lookup * test(integration): verify todo_write tool results * fix(core): complete prompt test config mock --------- Co-authored-by: qwen-code-dev-bot <[email protected]> |
||
|
tao943andtao943
|
3a9d2d37f8 |
docs(agent): clarify parameter preconditions (#9580)
* docs(agent): clarify parameter preconditions * test(agent): cover read-only preconditions * docs(agent): clarify nested background downgrade * docs(agent): align working-dir background guidance * docs(agent): clarify teammate worktree execution --------- Co-authored-by: tao943 <[email protected]> |
||
|
|
4ddbf227e8 |
feat(mcp): add MCP 2026 core and WebShell Apps host (#8992)
* feat(mcp): add 2026 protocol negotiation
* feat(mcp): render MCP Apps in WebShell
* fix(mcp): keep legacy tool discovery lenient
* fix(mcp): keep Apps HTML out of TUI and honor tool visibility
TUI and history compaction dumped mcp_app HTML as JSON, and discoverTools registered app-only tools for the model.
Co-authored-by: Cursor <[email protected]>
* fix(mcp): stabilize AppBridge lifetime and close sandbox CSP gaps
Theme toggles and transcript reseeds were tearing down MCP Apps; the host CSP also allowed any loopback port and form posts bypassed connect-src.
Co-authored-by: Cursor <[email protected]>
* fix(mcp): list under-declared modern MCP capabilities over the wire
v2 typed helpers return [] without a request when a capability is omitted.
Use them only when the server declared the capability, and keep Apps
unmounted in collapsed tool rows.
Co-authored-by: Cursor <[email protected]>
* fix(mcp): keep Apps sandbox reachable and list past 64 pages
Co-authored-by: Cursor <[email protected]>
* fix(mcp): reject empty compacted html and keep MCP Apps expanded in multi-tool groups
Fixes R3-1 and R3-2 review comments:
R3-1: getMcpAppDisplay now rejects empty html strings (from compaction)
so session replay shows fallbackText instead of mounting an empty iframe.
R3-2: ToolGroup now checks for MCP apps across all tools (not just
singleTool), auto-expands when any tool has an MCP app, and keeps
MCP app rows expanded (summaryOnly=false, forceExpanded=true) even
when adjacent tool calls are merged into the group.
* feat(web-shell): fold thinking into the compact-mode tool summary (#9148)
Compact mode used to drop thinking messages entirely, so a running turn
gave no indication of the thinking step. Keep the thoughts and aggregate
them with the adjacent tools into one summary: a streaming thought reads
"Thinking…" with the running shimmer, and a completed thought settles into
a click-to-expand row in its original interleaved position. The translate
action is preserved on both the thinking block and the folded thought
rows, and the merged group gets a synthetic id so its expanded state never
leaks into non-compact mode.
Co-authored-by: 钉萁 <[email protected]>
* fix(mcp): address app discovery and sandbox regressions
* fix(web-shell): keep MCP apps expanded in compact summaries
* Revert "feat(web-shell): fold thinking into the compact-mode tool summary (#9148)"
This reverts commit
|
||
|
Dragon
|
e09399e0fb |
feat(core): make list_directory opt-in (disabled by default) (#9424)
* feat(core): make list_directory opt-in (disabled by default) glob covers directory listing in most cases, so list_directory is now disabled by default to keep the tool surface lean. Enable it with tools.listDirectory.enabled=true or by listing it in the coreTools allowlist (--core-tools / tools.core). The plan-mode reminder no longer steers the model toward the tool. * fix(core): align list_directory opt-in gate with prompts and allowlist parsing Round-1 review findings on the opt-in gate: - Normalise coreTools entries with parseRule so specifier forms such as list_directory(/src) still re-enable the tool. isLsToolEnabled used resolveToolName, which does not strip specifiers, while PermissionManager admits the same entry via parseRule — so the allowlist accepted the tool and the registry never got it (R1-1). - Drop list_directory from the plan-mode block error. That message is returned to the model as the tool result of every blocked call, so it kept steering the model at an unregistered tool even after the system prompt stopped doing so (R1-2). - Remove the now-inert ToolNames.LS entries and the prompt text that advertised the tool to built-in agents. The gate also guards the forked-registry rebuild path, so these agents were silently stripped of a tool their own prompts told them to use (R1-3). - Say why the tool is missing and how to enable it in the tool-not-found message, instead of offering unrelated Levenshtein suggestions (R1-6). - Cover the alias and specifier forms in the registration tests (R1-4), and drop the stale examples from the sub-agents and Java SDK docs, where the listed entry can no longer register the tool (R1-5, R1-7). * fix(core): address list_directory opt-in round-2 review findings - Reword the skill-review agent task prompt so the inspection guidance only references read_file; the run's tool filter has no list_directory, glob, or shell, so the old `ls` instruction was unsatisfiable for the turn-budgeted background agent. - Resolve tool-name aliases (ListFiles, ListFilesTool, ReadFolder) in the list_directory not-found message so aliased calls get the enablement explanation instead of a Levenshtein suggestion. - Attribute a missing list_directory to the workspace tools toggle when the workspace disabledTools set blocks it, since the opt-in setting cannot lift that state. - Drop the coreTools allowlist advice from the enablement message: setting tools.core to ["list_directory"] alone would exclude every other tool. - Switch the two remaining sdk-java runTransportOptionsExample copies from list_directory to glob; setAllowedTools only adds auto-approve rules and never registers a tool. - Extract the shared fake-server scaffolding in the list_directory integration tests into a local helper, keeping the load-bearing CLI-flag comment. - Pin the skill-review agent tools array and assert the learn-skill prompt steers to read_file / glob, matching the sibling planners. * fix(core): only claim list_directory is opt-in-disabled when it is unregistered The not-found explanation resolved aliases (ListFiles, ReadFolder) before checking whether the tool was actually absent. The registry is keyed by canonical names while the lookup that reaches this path resolves legacy migrations only, so an alias call missed even when list_directory was enabled — and the message then told the user to switch on a setting that was already on, hiding the generic path's "Did you mean list_directory" self-correction. Gate the branch on the canonical name being absent from the registry, and pin the two alias combinations that were unpinned: an alias against a non-empty workspace disabledTools set, and an alias against a registered tool. |
||
|
jinyeandQwen-Coder
|
0cb109f513 |
fix(core): Avoid replaying unsafe MCP tool calls (#8387)
* fix(core): Avoid replaying unsafe MCP tool calls Co-authored-by: Qwen-Coder <[email protected]> * fix(core): Revalidate MCP replay after reconnect Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
destire-mioanddestire-mio
|
412eae24b4 |
feat(core): add project-level fork profiles (#8148)
* feat(core): add project-level fork profiles * fix(core): harden fork profile loading --------- Co-authored-by: destire-mio <[email protected]> |
||
|
Dragon
|
c50137cf86 | fix(core): prevent subagents from asking users (#8219) | ||
|
|
079ce5346a |
feat(agent): add fork tool execution allowlist (#8066)
* feat(agent): add fork tool execution allowlist * fix(agent): address fork allowlist review feedback --------- Co-authored-by: destire-mio <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Gaurav
|
f4e333c580 | fix(mcp): harden OAuth callback handling (#7510) | ||
|
Shaojin WenandQwen-Coder
|
45c8d8f8cc |
docs: refresh subagent lifecycle guidance (#7624)
Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Wu JiaCheng
|
1832a45ab8 | fix(core): reject nested background requests (#7593) | ||
|
tanzhenxinandQwen Code Bot
|
443b81e180 |
feat(core): add opt-in built-in web_search backed by the DashScope Responses API (#7215)
* feat(core): add opt-in built-in web_search backed by the DashScope Responses API
Claude-Session: https://claude.ai/code/session_01KwsYFzWZ6VLCxVN8MbeFXb
* fix(core): require HTTPS for the web_search backend; fail closed on unresolved agent allow-lists
Review follow-ups on #7215: the endpoint gate now rejects plaintext
endpoints (the side request carries a bearer key), and an agent allow-list
whose names resolve to no registered tool keeps its dead entries instead of
widening to the inherited toolset — an agent restricted to the unavailable
WebSearch now runs tool-less rather than gaining shell/write.
Claude-Session: https://claude.ai/code/session_01KwsYFzWZ6VLCxVN8MbeFXb
* chore(cli): remove test-leaked debug artifacts; gitignore the leaked dirs
The CLI unit-test suites write debug logs relative to the package dir
(custom/, first/, from-env/, workspace/); a merge-commit git add swept
them in. Remove them and ignore the directories until the tests are
pointed at temp dirs.
Claude-Session: https://claude.ai/code/session_01KwsYFzWZ6VLCxVN8MbeFXb
* fix(core): honor web_search's own result budget and salvage in-stream-error partials
- Override maxOutputChars (result limit + envelope headroom) so the
scheduler's global 25k threshold no longer slices results before the
tool's section-aware truncation can protect URL evidence sections.
- Route in-stream backend errors through the shared terminal-failure
tail so results streamed (and billed) before the error surface as a
partial result, matching the transport-error path.
- Strengthen gate tests: assert gate.ok before webExtractor, exercise
the https-only endpoint guard, and make the config mock disambiguate
same-id entries by baseUrl like the real Config.
* fix(cli): treat whitespace-only WEB_SEARCH_API_KEY as unset
Apply the function's set-but-empty-is-unset rule to the API key env
var like every sibling env read, and add loadCliConfig coverage for
the web search settings resolution (env precedence, empty-env
fallthrough, base-URL key selection).
* fix(core): salvage failed-terminal web_search results and name the exact endpoint disqualifier
- Route the failed/cancelled terminal paths through the shared
terminal-failure tail so search evidence streamed (and billed) before
the backend gave up is salvaged, consistent with the in-stream-error
and transport-error paths; regression test included.
- Classify base-URL gate rejections so the startup notice blames the
actual disqualifier: a plaintext-HTTP endpoint now gets an "use
https://" notice at both the env-declared and modelProviders sites
instead of the misleading "non-DashScope endpoint" text.
- Cover WEB_SEARCH in the speculation boundary-tools test and the US
regional host in the DashScope provider test — both behavioral
changes this PR introduced without direct test coverage.
* test(cli): cover web search suppression in safe and bare modes
The bareMode/safeMode guard is the escape hatch that keeps web search
(external, billed API calls) off in troubleshooting modes; assert that
an enabled settings config resolves to no web search settings under
--safe-mode and --bare.
* fix(core): parse the search model selector once for both gate paths
A selector written for the modelProviders path ("openai:<model-id>", as
the gate's own OAuth notice suggests) was sent verbatim to DashScope
when WEB_SEARCH_BASE_URL overrode the backend, failing with
InvalidParameter. Hoist the resolveModelId parse above the env branch
so both paths share one interpretation of the selector.
Also cover two review gaps: the Claude extension WebSearch tool mapping
and the ACP startup-warning emission that surfaces WebSearch
misconfiguration notices in the client log.
* fix(core): handle response.cancelled in the web_search terminal-event switch and trim gate env keys
- Add response.cancelled to the terminal-event switch so the
status === 'cancelled' handler is reachable instead of dead code
- Trim API key env vars in the gate (all three check sites), matching
the CLI-side whitespace rule from
|
||
|
DragonandClaude
|
22963d5777 |
feat(core): add fork_turns to fork subagents (#7346)
* feat(core): add fork_turns to subagents * fix(core): preserve nested agent context inheritance * fix(core): isolate inherited subagent history * refactor(core): scope fork_turns to fork agents * test(core): cover zero-real-turns branch in selectForkHistory Add a regression guard asserting selectForkHistory returns [] when a numeric fork window finds no real user turns after the synthetic prefix (e.g. only startup context present). This pins the realUserTurnIndexes.length === 0 branch so a future refactor cannot silently return the full history instead of an empty selection. * docs(core): address fork_turns review feedback - Explain the curated vs uncurated history split between the fork_turns 'all' and numeric paths in createForkSubagent. - Document why includeCompressed is load-bearing in selectForkHistory. - Gate the 'forks inherit ...' prose in the Writing-the-prompt section behind isForkSubagentEnabled so non-interactive sessions no longer advertise fork behavior, and lock it with description assertions. * test(core): cover fork_turns 'all' and getHistoryForForkWindow fallback Add two integration tests for prepareForkConfig fork-history selection: - 'all' path: verify getHistoryShallow(true) sources the curated history and selectForkHistory(history, 'all') seeds the fork with the full history verbatim. - numeric path: verify the getHistoryForForkWindow?.() ?? getHistory(true) fallback still produces a correct bounded window (startup + latest real turn) when getHistoryForForkWindow is unavailable. * fix(core): use uncurated history for fork bounded-window fallback The numeric fork_turns path falls back to geminiClient.getHistory(true) when getHistoryForForkWindow is unavailable. Curated history coalesces the leading startup reminder into the first real user turn, so getStartupContextLength can no longer detect it as a pure prefix. selectForkHistory then leaves the startup text embedded in the first selected turn while the startupContext prefix is prepended separately, duplicating startup context in the fork's initial messages. Fall back to uncurated getHistory() instead, which keeps the startup reminder as its own pure entry that selectForkHistory strips cleanly. Update the fallback-path test to assert the uncurated call and document why curated history is unsafe here. --------- Co-authored-by: Claude <[email protected]> |
||
|
DragonandClaude
|
d4db5fcfab |
feat(core): improve subagent delegation defaults and guardrails (#7048)
* docs(design): define default background subagents * feat(core): improve subagent delegation defaults * docs(core): cross-reference the three background-classification sites Add pointer comments linking the core dispatch source of truth (AgentTool.execute) and its two UI mirrors (web-shell isBackgroundSubAgentToolCall, desktop detectBackgroundEvents) so the replicated top-level-agent background heuristic is not changed in isolation. Addresses PR review feedback. * fix(core): align background classification for fork and named-teammate launches Address review feedback on the background-classification rule so core dispatch and the two UI classifiers stay consistent: - core: exclude a name-without-active-team launch from the default-background path so it stays foreground, matching both UI classifiers (which exclude name). Previously such a launch was backgrounded by core but tracked as foreground by the UIs. - web-shell and desktop classifiers: exclude subagent_type "fork" from the default-background heuristic, mirroring core's !isForkRequested guard. A top-level fork request with an omitted flag runs foreground in core but was classified as background by the UIs. - add a core dispatch test asserting a working_dir launch with an omitted run_in_background flag stays in the foreground. * test: cover fork/background classification and precedence per review feedback Address unresolved review threads on PR #7048: - Add web-shell and desktop UI classifier tests asserting an omitted-flag `subagent_type: "fork"` launch stays in the foreground, verifying the documented `!isForkRequested` parity with core dispatch. - Add a core AgentTool test asserting an explicit `run_in_background: false` overrides a subagent config with `background: true`, locking in the `run_in_background ?? config` precedence against a `||` regression. - Harden the Explore read-only prompt: pipelines must not send data to a network endpoint (no curl/wget/nc), closing the `cat file | curl` exfiltration gap. * fix(core): restore general no-unnecessary-files guard in general-purpose prompt Address review feedback: the rewritten general-purpose prompt dropped the broad guard against creating unrequested files, keeping only the documentation-specific line. Restore a general 'do not create files unless necessary' guard so speculative utility/config files are not created. * test(desktop): cover named-teammate foreground guard in detectBackgroundEvents Add a desktop tool-matching test asserting a top-level Agent with a `name` set (named teammate) stays foreground and emits no task_backgrounded event, mirroring the web-shell classifier's named-teammate coverage and the existing fork-exclusion test. * test(core): cover named-teammate foreground dispatch when flag omitted Add a core-dispatch test asserting a top-level Agent launch with `name` set and `run_in_background` omitted stays foreground when no team is active, guarding the `this.params.name === undefined` exclusion in backgroundRequested directly (previously only covered by the UI classifiers). --------- Co-authored-by: Claude <[email protected]> |
||
|
jinyeandQwen-Coder
|
b84ad89614 |
fix(core): Require explicit approval to exit Plan mode (#6967)
* fix(core): require explicit approval to exit plan mode Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6967) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6967) Co-authored-by: Qwen-Coder <[email protected]> * test(core): cover plan exit denial guards Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6967) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6967) Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
jinyeandQwen-Coder
|
4f4387cf57 |
feat(core): add PDF vision bridge fallback (#6846)
* feat(core): add PDF vision bridge fallback Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6846) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6846) Co-authored-by: Qwen-Coder <[email protected]> * codex: fix CI failure on PR #6846 Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6846) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#6846) Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): harden vision bridge output handling Co-authored-by: Qwen-Coder <[email protected]> * fix(cli): correct export sanitizer test typing Co-authored-by: Qwen-Coder <[email protected]> * fix(core): disclose selected vision endpoint before egress Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
han
|
9ee8546a60 |
fix(shell): avoid Unix pager default on Windows (#6390)
* fix(shell): avoid Unix pager default on Windows * fix(shell): clear inherited pager env on Windows * docs(shell): clarify platform-specific pager default * fix(shell): normalize pager env handling * fix(shell): preserve git pager fallback behavior * test(shell): stabilize pager env coverage |
||
|
tt-a1i
|
a4eab3d39c | fix(core): allow web_fetch JSON fallback (#5660) | ||
|
jinyeandQwen-Coder
|
a234860a4a |
fix(core): Align MCP OAuth guidance and docs (#5589)
* docs: Align docs with current CLI behavior Update stale documentation and user-facing MCP OAuth guidance to match the current dialog-based flows, SDK permission semantics, current links, and Qwen OAuth status. Also replace Ink internal imports with public Ink APIs for the shared text input so the workspace builds against Ink 7. Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: fix BaseTextInput Ink import (#5589) Co-authored-by: Qwen-Coder <[email protected]> * codex: address PR review feedback (#5589) Co-authored-by: Qwen-Coder <[email protected]> * fix(core): surface MCP OAuth credential read failures Fix SSE OAuth credential pre-check failures by reporting token storage read errors before connecting. Update SDK coreTools docs and extension release link text from the follow-up review. Co-authored-by: Qwen-Coder <[email protected]> * fix(core): harden MCP OAuth error handling Handle stderr warning failures as best-effort and keep SSE 401 OAuth guidance when credential re-read fails. Co-authored-by: Qwen-Coder <[email protected]> * fix(core): keep SSE OAuth pre-read best effort Avoid blocking SSE MCP connections when the diagnostic credential pre-read fails, and cover BaseTextInput absolute-position edge cases. Co-authored-by: Qwen-Coder <[email protected]> * fix(core): handle SSE OAuth validation errors Co-authored-by: Qwen-Coder <[email protected]> * fix(core): surface MCP OAuth recovery guidance Co-authored-by: Qwen-Coder <[email protected]> * fix(core): cover MCP OAuth retry paths Co-authored-by: Qwen-Coder <[email protected]> * fix(core): address OAuth guidance review Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Yan Shen
|
9b20c47f46 |
feat(core): respect configurable agent ignore files (#4653)
* Respect agent ignore conventions through configurable filtering Constraint: Issue #1746 requests .agentignore/.aiignore compatibility and maintainer feedback asks for a custom ignore-file configuration path. Rejected: Hardcode only .agentignore/.aiignore | would not satisfy the maintainer's configurable-ignore direction. Confidence: high Scope-risk: moderate Directive: Keep .qwenignore always included when respectQwenIgnore is enabled; route extra filenames through customIgnoreFiles. Tested: Core targeted vitest suite; CLI targeted vitest plus config integration; npm run build && npm run typecheck; targeted eslint; git diff --check. Not-tested: Full repository test suite and model-driven end-to-end CLI integration tests. * fix(cli): keep custom ignore settings type-safe and honest The schema default otherwise narrows customIgnoreFiles to the built-in tuple and the UI text implies additive behavior that the implementation does not provide. Constraint: Address wenshao's two review comments without changing replacement semantics. Rejected: Merge user values with defaults | Larger behavior change was not requested for this follow-up. Confidence: high Scope-risk: narrow Directive: Preserve replacement semantics unless a future change intentionally updates config merging and docs together. Tested: cd packages/cli && npx vitest run src/config/config.test.ts src/config/settingsSchema.test.ts; npm run build; npm run typecheck; npm run lint; git diff --check Not-tested: Full integration suite. * fix(core): keep custom ignore settings consistent Ensure review-sensitive file discovery paths, grep ignore resolution, and user-facing ignore names preserve the configured custom ignore behavior instead of falling back to defaults or search-directory-local files. Constraint: PR #4653 review feedback requires customIgnoreFiles to behave consistently across secondary discovery and grep paths. Rejected: Merge custom ignore files with defaults | The current PR documents replacement semantics and prior review feedback accepted that contract. Confidence: high Scope-risk: narrow Directive: Keep .qwenignore always included, but treat customIgnoreFiles as the replacement list for additional AI ignore files. Tested: packages/core targeted vitest for qwenIgnoreParser, fileDiscoveryService, ripGrep, config, read-file; packages/cli config vitest; targeted workspaceFileSystem custom-ignore vitest; Prettier check; ESLint on touched files; git diff --check. Not-tested: Full workspace typecheck/build because current branch fails before this change on environmentContext.test.ts syntax and unrelated CLI type errors; full workspaceFileSystem suite on Windows because existing symlink tests fail with EPERM. * test(core): cover subagent custom ignore inheritance Keep the in-process backend tests aligned with the new per-agent file filtering contract so CI catches missing custom-ignore propagation. Constraint: PR review fixes require subagents to inherit parent custom ignore settings. Confidence: high Scope-risk: narrow Tested: npx vitest run src/agents/backends/InProcessBackend.test.ts Tested: npx vitest run src/utils/qwenIgnoreParser.test.ts src/services/fileDiscoveryService.test.ts src/tools/ripGrep.test.ts src/config/config.test.ts src/tools/read-file.test.ts src/agents/backends/InProcessBackend.test.ts src/tools/agent/agent.test.ts Tested: npx vitest run src/serve/fs/workspaceFileSystem.test.ts -t "uses configured custom ignore files" Tested: npx prettier --check packages/core/src/agents/backends/InProcessBackend.test.ts Tested: npx eslint packages/core/src/agents/backends/InProcessBackend.test.ts Tested: git diff --check Not-tested: full npm run typecheck remains blocked by existing branch-wide TypeScript errors outside this test change * test(core): fix subagent custom ignore test typing Keep the custom-ignore regression test type-checkable under the repo build, where createMockConfig is intentionally cast to never. Constraint: CI runs package build during dependency installation and type-checks test files. Confidence: high Scope-risk: narrow Tested: npx vitest run src/agents/backends/InProcessBackend.test.ts Tested: npx prettier --check packages/core/src/agents/backends/InProcessBackend.test.ts Tested: npx eslint packages/core/src/agents/backends/InProcessBackend.test.ts Tested: git diff --check Not-tested: npm run build --workspace=packages/core is still blocked locally by src/utils/environmentContext.test.ts(599,1): error TS1005: '}' expected * test(core): align notebook ignore message expectation Keep notebook ignore validation tests in sync with the comma-separated ignore file display used by the review fix. Constraint: PR review fixes changed ignore file display text from slash-separated to comma-separated. Confidence: high Scope-risk: narrow Tested: npx vitest run src/tools/notebook-edit.test.ts Tested: npx vitest run src/utils/qwenIgnoreParser.test.ts src/services/fileDiscoveryService.test.ts src/tools/ripGrep.test.ts src/tools/read-file.test.ts src/tools/notebook-edit.test.ts src/config/config.test.ts src/agents/backends/InProcessBackend.test.ts src/tools/agent/agent.test.ts Tested: npx prettier --check packages/core/src/tools/notebook-edit.test.ts Tested: npx eslint packages/core/src/tools/notebook-edit.test.ts Tested: git diff --check Not-tested: full npm run build --workspace=packages/core remains blocked locally by src/utils/environmentContext.test.ts(599,1): error TS1005: '}' expected * fix(core): keep ripgrep ignore roots canonical Constraint: PR #4653 review 4453010590 requested absolute ignore-root fallback behavior. Rejected: Broader customIgnoreFiles semantic changes | outside the review scope and replacement semantics stay unchanged. Confidence: high Scope-risk: narrow Directive: Keep customIgnoreFiles as replacement for compatibility defaults while always including .qwenignore. Tested: cd packages/core && npx vitest run src/tools/ripGrep.test.ts; npx prettier --check src/tools/ripGrep.ts src/tools/ripGrep.test.ts; git diff --check Not-tested: npm run typecheck --workspace=packages/core fails on existing src/utils/environmentContext.test.ts parse error. * test(core): align ripgrep ignore path expectation Constraint: macOS canonicalizes temporary paths through /private/var after process.chdir. Rejected: Changing ripgrep ignore-root behavior | implementation already uses path.resolve correctly. Confidence: high Scope-risk: narrow Directive: Keep the regression test tied to path.resolve behavior rather than raw temp-dir spelling. Tested: cd packages/core && npx vitest run src/tools/ripGrep.test.ts; npx prettier --check src/tools/ripGrep.test.ts src/tools/ripGrep.ts; git diff --check Not-tested: Full CI rerun is remote-only after push. * fix(core): make custom ignore feedback actionable Review feedback for PR #4653 showed users could not tell which ignore file blocked a path, and worktree isolation lacked coverage for inherited custom ignore files. This also closes the existing environmentContext.test describe block so build can progress to the current unrelated converter type blocker. Constraint: PR #4653 keeps replacement semantics for customIgnoreFiles and always includes .qwenignore. Rejected: Exposing matching pattern text | merged ignore and negation semantics can make pattern-level attribution misleading. Confidence: high Scope-risk: moderate Directive: Keep customIgnoreFiles as replacement semantics unless the config contract changes deliberately. Tested: core targeted Vitest suite; ripGrep regression test; cli settingsSchema test; Prettier check. Not-tested: npm run build && npm run typecheck blocked by existing FinishReason type errors in converter.ts. * fix(core): isolate qwen ignore sources * test(cli): mock qwen ignore defaults in acp test * test(scripts): make dev launcher test path portable * fix(core): prevent ripgrep ignore negation bypass * fix(core): post-filter ripgrep qwenignore matches * fix(core): preserve ignore negations in grep - Preserve non-.qwenignore negation semantics for grep searches - Skip workspace-external ignore-file discovery - Add coverage for ignore diagnostics and addSource behavior * test(core): update yaml nested parser expectations * chore: remove unrelated formatting churn |
||
|
tt-a1iandShaojin Wen
|
3cecd667d5 |
fix(core): validate grep result limits (#5389)
Co-authored-by: Shaojin Wen <[email protected]> |
||
|
Dragon
|
3408c32110 |
docs: fix MCP token path, daemon UI event count, add Feishu channel (#5172)
* docs: fix MCP token path, daemon UI event count, add Feishu channel - mcp.md: update OAuth token storage path to v2 encrypted file (mcp-oauth-tokens-v2.json with AES-256-GCM, keychain preferred) - daemon/00-index.md: fix UI event type count (36 → 37) - daemon/01-architecture.md: add Feishu to channel bots diagram - daemon/15-channel-adapters.md: add Feishu adapter (WebSocket/webhook, config keys, permission UX, reverse-call caveat) * docs: correct Feishu config keys and permission UX caveat Address review feedback on 15-channel-adapters.md: - Feishu config keys are clientId/clientSecret (not appId/appSecret), per FeishuAdapter.ts:116-118; add encryptKey (required for webhook mode, enforced at FeishuAdapter.ts:165-168). - Note that channel permission UX currently auto-approves via AcpBridge (AcpBridge.ts:111); interactive approval is planned. * docs: fix missed sibling references for audit consistency Address review feedback (wenshao) — apply the same corrections to other doc locations that referenced the stale values: - MCP token path: also fix docs/developers/tools/mcp-server.md (was still ~/.qwen/mcp-oauth-tokens.json). - UI event type count 36 -> 37: also fix 14-cli-tui-adapter.md (3 spots), 13-sdk-daemon-client.md. - Feishu channel: add Feishu rows to both tables in 15-channel-adapters.md (Per-channel adapters + Adapter matrix) and the package-level Adapters subgraph in 01-architecture.md, so prose/tables/diagrams all agree. - Add a note under the Adapter matrix clarifying that Permission UX / approvalMode are not wired yet (all channels auto-approve via AcpBridge). |
||
|
Dragon
|
ad6368b3ae |
docs: fix stale defaults, CLI syntax, and tool naming drift (#5158)
- common-workflow.md: fix --p flag syntax (→ -p) and --print (→ -p/--prompt) - settings.md: fix ui.theme default (undefined → "Qwen Dark"), skipNextSpeakerCheck (false → true), enableInteractiveShell (false → true), add auto approval mode to settings and CLI flag tables - keyboard-shortcuts.md: fix Shift+Tab cycling (add auto mode), correct newline keybinding (Ctrl+Enter/Cmd+Enter/Shift+Enter/Ctrl+J) - model-providers.md: fix stale codingPlan.region reference → modelProviders - developers/tools: rename task → agent tool, remove stale save_memory and read_many_files references, fix todo_write activeForm → id field |
||
|
Dragon
|
35e6963285 | docs(tools): document monitor tool (#4356) | ||
|
zhangxy-zju
|
ed14a33064 |
feat(core): add NotebookEdit tool for Jupyter notebooks
Adds NotebookEdit as the structured write counterpart to existing notebook read support. Summary: - Add `notebook_edit` for safe cell-level `.ipynb` replace/insert/delete operations. - Integrate notebook editing with tool registration, permissions, Claude conversion, prior-read enforcement, IDE/inline modify flow, commit attribution, docs, and SDK permission docs. - Harden notebook read/edit behavior for truncated notebook renders, ambiguous fallback cell IDs, internal modify metadata, compact JSON, UTF-8 BOM notebooks, and cache behavior after structural edits. - Add unit and integration coverage for notebook read/edit behavior. Follow-up work remains for tab-indented notebook formatting preservation, a few low-risk unit-test additions, and non-blocking hardening suggestions from review. |
||
|
顾盼
|
aeeb2976d6 |
feat(web-search): remove built-in web_search tool, replace with MCP-based approach (#3502)
* feat(web-search): add GLM (ZhipuAI) web search provider - Add GlmProvider class implementing BaseWebSearchProvider using the ZhipuAI Web Search API (https://open.bigmodel.cn/api/paas/v4/web_search) - Support multiple search engines: search_std, search_pro, search_pro_sogou, search_pro_quark - Support optional config: maxResults, searchIntent, searchRecencyFilter, contentSize, searchDomainFilter - Truncate query to 70 characters per API limit - Register 'glm' in the provider discriminated union (types.ts) and createProvider() switch (index.ts) - Add GlmProviderConfig to settingsSchema, ConfigParams, and Config class - Add --glm-api-key CLI flag and GLM_API_KEY env var support in webSearch.ts - Forward GLM_API_KEY in sandbox environment - Update provider priority list: Tavily > Google > GLM > DashScope - Add 17 unit tests for GlmProvider and 4 integration tests in index.test.ts - Update docs/developers/tools/web-search.md with GLM configuration, env vars, CLI args, pricing, and corrected DashScope billing info - Fix stale OAuth/free-tier references in web-search.md Closes #3496 * docs(web-search): fix DashScope note and add GLM server-side limitations * fix(web-search): make DashScope provider work with standard API key, remove qwen-oauth dependency - DashScopeProvider.isAvailable() now checks config.apiKey instead of authType - Remove OAuth credential file reading and resource_url requirement - Use standard DashScope endpoint: dashscope.aliyuncs.com/api/v1/indices/plugin/web_search - Read DASHSCOPE_API_KEY env var and --dashscope-api-key CLI flag - Forward DASHSCOPE_API_KEY into sandbox environment - Update integration test to detect DASHSCOPE_API_KEY - Update docs to reflect new API key based configuration * feat(web-search): remove built-in web search tool The web_search tool and all related provider implementations are removed. Web search functionality will be provided via MCP integrations instead, which is the direction the broader agent ecosystem is moving. Removed: - packages/core/src/tools/web-search/ (entire directory) - packages/cli/src/config/webSearch.ts - integration-tests/cli/web_search.test.ts - ToolNames.WEB_SEARCH, ToolErrorCode.WEB_SEARCH_FAILED - webSearch config in ConfigParams, Config class, settingsSchema - CLI options: --tavily-api-key, --google-api-key, --google-search-engine-id, --glm-api-key, --dashscope-api-key, --web-search-default - Sandbox env forwarding for TAVILY/GLM/DASHSCOPE/GOOGLE search keys - web_search from rule-parser, permission-manager, speculation gate, microcompact tool set, and builtin-agents tool list * fix: remove websearch reference * docs: remove websearch tool * docs: add break change guide * fix review |
||
|
Shaojin Wen
|
c74d7678cb |
Revert "feat(core): add dynamic swarm worker tool (#3433)" (#3468)
This reverts commit
|
||
|
EdenmanandQwen-Coder
|
6c999fe29f |
feat(cli): add OAuth configuration flags to mcp add (#3442)
* feat(cli): Add OAuth redirect URI support to command - Add --oauth-redirect-uri, --oauth-client-id, --oauth-client-secret, --oauth-authorization-url, --oauth-token-url, and --oauth-scopes flags to the command - Enable configuration of custom OAuth redirect URIs for remote/cloud server deployments (fixes hardcoded localhost issue) - Document auth.redirectUri in both developer and user-facing MCP docs - Add comprehensive tests for OAuth configuration via CLI - Update documentation with examples and guidance for remote deployments Fixes #3336 Co-authored-by: Qwen-Coder <[email protected]> * refactor(cli): harden OAuth flag handling in mcp add - Reject combining --oauth-* flags with --transport stdio to surface the mistake instead of silently persisting an unused oauth config - Rebuild OAuth config via single spread expression; drop the prior mutate-then-check pattern and the post-hoc enabled assignment - Trim each scope token after comma split so "read, write" no longer stores leading/trailing whitespace - Cover both new behaviors with tests; add missing --oauth-client-secret row and stdio-incompatibility note to the user MCP docs * test(cli): use explicit Vitest/Yargs type imports in mcp add tests Switch from namespace-style 'vi.Mock' and 'yargs.Argv' references to explicit 'Mock' and 'Argv' imports, and replace the narrow '(code?: number) => never' cast on the process.exit mock with 'typeof process.exit' so it tracks the current Node signature. --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
gin-lsl
|
a02c115445 |
feat(tools): add Markdown for Agents support to WebFetch tool (#2734)
Closes #2025 |
||
|
Reid
|
f7ebc372f1 |
feat(core): add dynamic swarm worker tool (#3433)
* feat(core): add dynamic swarm worker tool Add a swarm tool for ad-hoc parallel worker execution with bounded concurrency, wait-all and first-success modes, per-worker failure isolation, and aggregated results. Register the tool in core, prevent nested worker recursion, and document the new workflow. * fix(core): harden swarm worker execution Prevent swarm calls from bypassing the outer scheduler concurrency budget. Disallow interactive question prompts in swarm workers by default, and avoid incomplete Markdown table escaping by using an HTML entity for pipe characters. Add focused tests for the scheduler behavior, worker tool restrictions, and result formatting. |
||
|
顾盼
|
9e2f63a1ca |
feat(memory): managed auto-memory and auto-dream system (#3087)
* docs: add auto-memory implementation log
* feat(core): add managed auto-memory storage scaffold
* feat(core): load managed auto-memory index
* feat(core): add managed auto-memory recall
* feat(core): add managed auto-memory extraction
* feat(cli): add managed auto-memory dream commands
* feat(core): add auxiliary side-query foundation
* feat(memory): add model-driven recall selection
* feat(memory): add model-driven extraction planner
* feat(core): add background task runtime foundation
* feat(memory): schedule auto dream in background
* feat(core): add background agent runner foundation
* feat(memory): add extraction agent planner
* feat(core): add dream agent planner
* feat(core): rebuild managed memory index
* feat(memory): add governance status commands
* feat(memory): add managed forget flow
* feat(core): harden background agent planning
* feat(memory): complete managed parity closure
* test(memory): add managed lifecycle integration coverage
* feat: same to cc
* feat(memory-ui): add memory saved notification and memory count badge
Feature 3 - Memory Saved Notification:
- Add HistoryItemMemorySaved type to types.ts
- Create MemorySavedMessage component for rendering '● Saved/Updated N memories'
- In useGeminiStream: detect in-turn memory writes via mapToDisplay's
memoryWriteCount field and emit 'memory_saved' history item after turn
- In client.ts: capture background dream/extract promises and expose
via consumePendingMemoryTaskPromises(); useGeminiStream listens
post-turn and emits 'Updated N memories' notification for background tasks
Feature 4 - Memory Count Badge:
- Add isMemoryOp field to IndividualToolCallDisplay
- Add memoryWriteCount/memoryReadCount to HistoryItemToolGroup
- Add detectMemoryOp() in useReactToolScheduler using isAutoMemPath
- ToolGroupMessage renders '● Recalled N memories, Wrote N memories' badge
at the top of tool groups that touch memory files
Fix: process.env bracket-access in paths.ts (noPropertyAccessFromIndexSignature)
Fix: MemoryDialog.test.tsx mock useSettings to satisfy SettingsProvider requirement
* fix(memory-ui): auto-approve memory writes, collapse memory tool groups, fix MEMORY.md path
Problem 1 - Auto-approve memory file operations:
- write-file.ts: getDefaultPermission() checks isAutoMemPath; returns 'allow'
for managed auto-memory files, 'ask' for all other files
- edit.ts: same pattern
Problem 2 - Feature 4 UX: collapse memory-only tool groups:
- ToolGroupMessage: detect when all tool calls have isMemoryOp set (pure memory
group) and all are complete; render compact '● Recalled/Wrote N memories
(ctrl+o to expand)' instead of individual tool call rows
- ctrl+o toggles expand/collapse when isFocused and group is memory-only
- Mixed groups (memory + other tools) keep badge-at-top behaviour
- Expanded state shows individual tool calls with '● Memory operations
(ctrl+o to collapse)' header
Problem 3 - MEMORY.md path mismatch:
- prompt.ts: Step 2 now references full absolute path ${memoryDir}/MEMORY.md
so the model writes to the correct location inside the memory directory,
not to the parent project directory
Fix tests:
- write-file.test.ts: add getProjectRoot to mockConfigInternal
- prompt.test.ts: update assertion to match full-path section header
* fix(memory-ui): fix duplicate notification, broken ctrl+o, and Edit tool detection
- Remove duplicate 'Saved N memories' notification: the tool group badge already
shows 'Wrote N memories'; the separate HistoryItemMemorySaved addItem after
onComplete was double-counting. Keep only the background-task path
(consumePendingMemoryTaskPromises).
- Remove ctrl+o expand: Ink's Static area freezes items on first render and
cannot respond to user input. useInput/useState(isExpanded) in a Static item
is a no-op. Removed the dead code; memory-only groups now always render as
the compact summary (no fake interactive hint).
- Fix Edit tool detection: detectMemoryOp was checking for 'edit_file' but the
real tool name constant is 'edit'. Also removed non-existent 'create_file'
(write_file covers all writes). Now editing MEMORY.md is correctly identified
as a memory write op, collapses to 'Wrote N memories', and is auto-approved.
* fix(dream): run /dream as a visible submit_prompt turn, not a silent background agent
The previous implementation ran an AgentHeadless background agent that could
take 5+ minutes with zero UI feedback — user saw a blank screen for the entire
duration and then at most one line of text.
Fix: /dream now returns submit_prompt with the consolidation task prompt so it
runs as a regular AI conversation turn. Tool calls (read_file, write_file, edit,
grep_search, list_directory, glob) are immediately visible as collapsed tool
groups as the model works through the memory files — identical UX to Claude Code.
Also export buildConsolidationTaskPrompt from dreamAgentPlanner so dreamCommand
can reuse the same detailed consolidation prompt that was already written.
* fix(memory): auto-allow ls/glob/grep on memory base directory
Add getMemoryBaseDir() to getDefaultPermission() allow list in ls.ts,
glob.ts, and grep.ts — mirrors the existing pattern in read-file.ts.
Without this, ListFiles/Glob/Grep on ~/.qwen/* would trigger an
approval dialog, blocking /dream at its very first step.
* fix(background): prevent permission prompt hangs in background agents
Match Claude Code's headless-agent intent: background memory agents must never
block on interactive permission prompts.
Wrap background runtime config so getApprovalMode() returns YOLO, ensuring any
ask decision is auto-approved instead of hanging forever. Add regression test
covering the wrapped approval mode.
* fix(memory): run auto extract through forked agent
Make managed auto-memory extraction follow the Claude Code architecture:
background extraction now uses a forked agent to read/write memory files
directly, instead of planning patches and applying them with a separate
filesystem pipeline.
Keep the old patch/model path only as fallback if the forked agent fails.
Add regression tests covering the new execution path and tool whitelist.
* refactor(memory): remove legacy extract fallback pipeline
Delete the old patch/model/heuristic extraction path entirely.
Managed auto-memory extract now runs only through the forked-agent
execution flow, with no planner/apply fallback stages remaining.
Also remove obsolete exports/tests and update scheduler/integration
coverage to use the forked-agent-only architecture.
* refactor(memory): move auxiliary files out of memory/ directory
meta.json, extract-cursor.json, and consolidation.lock are internal
bookkeeping files, not user-visible memories. Move them one level up
to the project state dir (parent of memory/) so that the memory/
directory contains only MEMORY.md and topic files, matching the
clean layout of the upstream reference implementation.
Add getAutoMemoryProjectStateDir() helper in paths.ts and update the
three path accessors + store.test.ts path assertions accordingly.
* fix(memory): record lastDreamAt after manual /dream run
The /dream command submits a prompt to the main agent (submit_prompt),
which writes memory files directly. Because it bypasses dreamScheduler,
meta.json was never updated and /memory always showed 'never'.
Fix by:
- Exporting writeDreamManualRunToMetadata() from dream.ts
- Adding optional onComplete callback to SubmitPromptActionReturn and
SubmitPromptResult (types.ts / commands/types.ts)
- Propagating onComplete through slashCommandProcessor.ts
- Firing onComplete after turn completion in useGeminiStream.ts
- Providing the callback in dreamCommand.ts to write lastDreamAt
* fix(memory): remove scope params from /remember in managed auto-memory mode
--global/--project are legacy save_memory tool concepts. In managed
auto-memory mode the forked agent decides the appropriate type
(user/feedback/project/reference) based on the content of the fact.
Also improve the prompt wording to explicitly ask the agent to choose
the correct type, reducing the tendency to default to 'project'.
* feat(ui): show '✦ dreaming' indicator in footer during background dream
Subscribe to getManagedAutoMemoryDreamTaskRegistry() in Footer via a
useDreamRunning() hook. While any dream task for the current project is
pending or running, display '✦ dreaming' in the right section of the
footer bar, between Debug Mode and context usage.
* refactor(memory): align dream/extract infrastructure with Claude Code patterns
Five improvements based on Claude Code parity audit:
1. Memoize getAutoMemoryRoot (paths.ts)
- Add _autoMemoryRootCache Map, keyed by projectRoot
- findCanonicalGitRoot() walks the filesystem per call; memoize avoids
repeated git-tree traversal on hot-path schedulers/scanners
- Expose clearAutoMemoryRootCache() for test teardown
2. Lock file stores PID + isProcessRunning reclaim (dreamScheduler.ts)
- acquireDreamLock() writes process.pid to the lock file body
- lockExists() reads PID and calls process.kill(pid, 0); dead/missing
PID reclaims the lock immediately instead of waiting 2h
- Stale threshold reduced to 1h (PID-reuse guard, same as CC)
3. Session scan throttle (dreamScheduler.ts)
- Add SESSION_SCAN_INTERVAL_MS = 10min (same as CC)
- Add lastSessionScanAt Map<projectRoot, number> to ManagedAutoMemoryDreamRuntime
- When time-gate passes but session-gate doesn't, throttle prevents
re-scanning the filesystem on every user turn
4. mtime-based session counting (dreamScheduler.ts)
- Replace fragile recentSessionIdsSinceDream Set in meta.json with
filesystem mtime scan (listSessionsTouchedSince)
- Mirrors Claude Code's listSessionsTouchedSince: reads session JSONL
files from Storage.getProjectDir()/chats/, filters by mtime > lastDreamAt
- Immune to meta.json corruption/loss; no per-turn metadata write
- ManagedAutoMemoryDreamRuntime accepts injectable SessionScannerFn
for clean unit testing without real session files
5. Extraction mutual exclusion extended to write_file/edit (extractScheduler.ts)
- historySliceUsesMemoryTool() now checks write_file/edit/replace/create_file
tool calls whose file_path is within isAutoMemPath()
- Previously only detected save_memory; missed direct file writes by
the main agent, causing redundant background extraction
* docs(memory): add user-facing memory docs, i18n for all locales, simplify /forget
- Add docs/users/features/memory.md: comprehensive user-facing guide covering
QWEN.md instructions, auto-memory behaviour, all memory commands, and
troubleshooting; replaces the placeholder auto-memory.md
- Update docs/users/features/_meta.ts: rename entry auto-memory → memory
- Update docs/users/features/commands.md: add /init, /remember, /forget,
/dream rows; fix /memory description; remove /init duplicate
- Update docs/users/configuration/settings.md: add memory.* settings section
(enableManagedAutoMemory, enableManagedAutoDream) between tools and permissions
- Remove /forget --apply flag: preview-then-apply flow replaced with direct
deletion; update forgetCommand.ts, en.js, zh.js accordingly
- Add all auto-memory i18n keys to de, ja, pt, ru locales (18 keys each):
Open auto-memory folder, Auto-memory/Auto-dream status lines, never/on/off,
✦ dreaming, /forget and /remember usage strings, all managed-memory messages
- Remove dead save_memory branch from extractScheduler.partWritesToMemory()
- Add ✦ dreaming indicator to Footer.tsx with i18n; fix Footer.test.tsx mocks
- Refactor MemoryDialog.tsx auto-dream status line to use i18n
- Remove save_memory tool (memoryTool.ts/test); clean up webui references
- Add extractionPlanner.ts, const.ts and associated tests
- Delete stale docs/users/configuration/memory.md and
docs/developers/tools/memory.md (content superseded)
* refactor(memory): remove all Claude Code references from comments and test names
* test(memory): remove empty placeholder test files that cause vitest to fail
* fix eslint
* fix test in windows
* fix test
* fix(memory): address critical review findings from PR #3087
- fix(read-file): narrow auto-allow from getMemoryBaseDir() (~/.qwen) to
isAutoMemPath(projectRoot) to prevent exposing settings.json / OAuth
credentials without user approval (wenshao review)
- fix(forget): per-entry deletion instead of whole-file unlink
- assign stable per-entry IDs (relativePath:index for multi-entry files)
so the model can target individual entries without removing siblings
- rewrite file keeping unmatched entries; only unlink when file becomes
empty (wenshao review)
- fix(entries): round-trip correctness for multi-entry new-format bodies
- parseAutoMemoryEntries: plain-text line closes current entry and opens
a new one (was silently ignored when current was already set)
- renderAutoMemoryBody: emit blank line between adjacent entries so the
parser can detect entry boundaries on re-read (wenshao review)
- fix(entries): resolve two CodeQL polynomial-regex alerts
- indentedMatch: \s{2,}(?:[-*]\s+)? → [\t ]{2,}(?:[-*][\t ]+)?
- topLevelMatch: :\s*(.+)$ → :[ \t]*(\S.*)$
(github-advanced-security review)
- fix(scan.test): use forward-slash literal for relativePath expectation
since listMarkdownFiles() normalises all separators to '/' on all
platforms including Windows
* fix(memory): replace isAutoMemPath startsWith with path.relative()
Using path.relative() instead of string startsWith() is more robust
across platforms — it correctly handles Windows path-separator
differences and avoids potential edge cases where a path prefix match
could succeed on non-separator boundaries.
Addresses github-actions review item 3 (PR #3087).
* feat(telemetry): add auto-memory telemetry instrumentation
Add OpenTelemetry logs + metrics for the five auto-memory lifecycle
events: extract, dream, recall, forget, and remember.
Telemetry layer (packages/core/src/telemetry/):
- constants.ts: 5 new event-name constants
(qwen-code.memory.{extract,dream,recall,forget,remember})
- types.ts: 5 new event classes with typed constructor params
(MemoryExtractEvent, MemoryDreamEvent, MemoryRecallEvent,
MemoryForgetEvent, MemoryRememberEvent)
- metrics.ts: 8 new OTel instruments (5 Counters + 3 Histograms)
with recordMemoryXxx() helpers; registered inside initializeMetrics()
- loggers.ts: logMemoryExtract/Dream/Recall/Forget/Remember() — each
emits a structured log record and calls its recordXxx() counterpart
- index.ts: re-exports all new symbols
Instrumentation call-sites:
- extractScheduler.ts ManagedAutoMemoryExtractRuntime.runTask():
emits extract event with trigger=auto, completed/failed status,
patches_count, touched_topics, and wall-clock duration
- dream.ts runManagedAutoMemoryDream():
emits dream event with trigger=auto, updated/noop status,
deduped_entries, touched_topics, and duration; covers both
agent-planner and mechanical fallback paths
- recall.ts resolveRelevantAutoMemoryPromptForQuery():
emits recall event with strategy, docs_scanned/selected, and
duration; covers model, heuristic, and none paths
- forget.ts forgetManagedAutoMemoryEntries():
emits forget event with removed_entries_count, touched_topics,
and selection_strategy (model/heuristic/none)
- rememberCommand.ts action():
emits remember event with topic=managed|legacy at command
invocation time (before agent decides the actual memory type)
* refactor(telemetry): remove memory forget/remember telemetry events
Remove EVENT_MEMORY_FORGET and EVENT_MEMORY_REMEMBER along with all
associated infrastructure that is no longer needed:
- constants.ts: remove EVENT_MEMORY_FORGET, EVENT_MEMORY_REMEMBER
- types.ts: remove MemoryForgetEvent, MemoryRememberEvent classes
- metrics.ts: remove MEMORY_FORGET_COUNT, MEMORY_REMEMBER_COUNT constants,
memoryForgetCounter, memoryRememberCounter module vars,
their initialization in initializeMetrics(), and
recordMemoryForgetMetrics(), recordMemoryRememberMetrics() functions
- loggers.ts: remove logMemoryForget(), logMemoryRemember() functions
and their imports
- index.ts: remove all re-exports for the above symbols
- memory/forget.ts: remove logMemoryForget call-site and import
- cli/rememberCommand.ts: remove logMemoryRemember call-sites and import
* change default value
* fix forked agent
* refactor(background): unify fork primitives into runForkedAgent + cleanup
- Merge runForkedQuery into runForkedAgent via TypeScript overloads:
with cacheSafeParams → GeminiChat single-turn path (ForkedQueryResult)
without cacheSafeParams → AgentHeadless multi-turn path (ForkedAgentResult)
- Delete forkedQuery.ts; move its test to background/forkedAgent.cache.test.ts
- Remove forkedQuery export from followup/index.ts
- Migrate all callers (suggestionGenerator, speculation, btwCommand, client)
to import from background/forkedAgent
- Add getFastModel() / setFastModel() to Config; expose in CLI config init
and ModelDialog / modelCommand
- Remove resolveFastModel() from AppContainer — now delegated to config.getFastModel()
- Strip Claude Code references from code comments
* fix(memory): address wenshao's critical review findings
- dream.ts: writeDreamManualRunToMetadata now persists lastDreamSessionId
and resets recentSessionIdsSinceDream, preventing auto-dream from firing
again in the same session after a manual /dream
- config.ts: gate managed auto-memory injection on getManagedAutoMemoryEnabled();
when disabled, previously saved memories are no longer injected into new sessions
- rememberCommand.ts: remove legacy save_memory branch (tool was removed);
fall back to submit_prompt directing agent to write to QWEN.md instead
- BuiltinCommandLoader.ts: only register /dream and /forget when managed
auto-memory is enabled, matching the feature's runtime availability
- forget.ts: return early in forgetManagedAutoMemoryMatches when matches is
empty, avoiding unnecessary directory scaffolding as a side effect
* fix test
* fix ci test
* feat(memory): align extract/dream agents to Claude Code patterns
- fix(client): move saveCacheSafeParams before early-return paths so
extract agents always have cache params available (fixes extract never
triggering in skipNextSpeakerCheck mode)
- feat(extract): add read-only shell tool + memory-scoped write
permissions; create inline createMemoryScopedAgentConfig() with
PermissionManager wrapper (isToolEnabled + evaluate) that allows only
read-only shell commands and write/edit within the auto-memory dir
- feat(extract): align prompt to Claude Code patterns — manifest block
listing existing files, parallel read-then-write strategy, two-step
save (memory file then index)
- feat(dream): remove mechanical fallback; runManagedAutoMemoryDream is
now agent-only and throws without config
- feat(dream): align prompt to Claude Code 4-phase structure
(Orient/Gather/Consolidate/Prune+Index); add narrow transcript grep,
relative→absolute date conversion, stale index pruning, index size cap
- fix(permissions): add isToolEnabled() to MemoryScopedPermissionManager
to prevent TypeError crash in CoreToolScheduler._schedule
- test: update dreamScheduler tests to mock dream.js; replace removed
mechanical-dedup test with scheduler infrastructure verification
* move doc to design
* refactor(memory): unify extract+dream background task management into MemoryBackgroundTaskHub
- Add memoryTaskHub.ts: single BackgroundTaskRegistry + BackgroundTaskDrainer shared
by all memory background tasks; exposes listExtractTasks() / listDreamTasks()
typed query helpers and a unified drain() method
- extractScheduler: ManagedAutoMemoryExtractRuntime accepts hub via constructor
(defaults to defaultMemoryTaskHub); test factory gets isolated fresh hub
- dreamScheduler: same pattern — sessionScanner + hub injection; BackgroundTask-
Scheduler initialized from injected hub; test factory gets isolated hub
- status.ts: replace two separate getRegistry() calls with defaultMemoryTaskHub
typed query methods
- Footer.tsx (useDreamRunning): subscribe to shared registry, filter by
DREAM_TASK_TYPE so extract tasks do not trigger the dream spinner
- index.ts: re-export memoryTaskHub.ts so defaultMemoryTaskHub/DREAM_TASK_TYPE/
EXTRACT_TASK_TYPE are available as top-level package exports
* refactor(background): introduce general-purpose BackgroundTaskHub
Replace memory-specific MemoryBackgroundTaskHub with a domain-agnostic
BackgroundTaskHub in the background/ layer. Any future background task
runtime (3rd, 4th, …) plugs in by accepting a hub via constructor
injection — no new infrastructure required.
Changes:
- Add background/taskHub.ts: BackgroundTaskHub (registry + drainer +
createScheduler() + listByType(taskType, projectRoot?)) and the
globalBackgroundTaskHub singleton. Zero knowledge of any task type.
- Delete memory/memoryTaskHub.ts: its narrow listExtractTasks /
listDreamTasks helpers are replaced by the generic listByType() call.
- Move EXTRACT_TASK_TYPE to extractScheduler.ts (owned by the runtime
that defines it); replace 3 hardcoded string literals with the const.
- Move DREAM_TASK_TYPE to dreamScheduler.ts; use hub.createScheduler()
instead of manually wiring new BackgroundTaskScheduler(reg, drain).
- status.ts: globalBackgroundTaskHub.listByType(EXTRACT_TASK_TYPE, ...)
- Footer.tsx: globalBackgroundTaskHub.registry (shared, filtered by type)
- index.ts: export background/taskHub.js; drop memory/memoryTaskHub.js
* test(background): add BackgroundTaskHub unit tests and hub isolation checks
- background/taskHub.test.ts (11 tests):
- createScheduler(): tasks registered via scheduler appear in hub registry;
multiple calls return distinct scheduler instances
- listByType(): filters by taskType, filters by projectRoot, returns []
for unknown types, two types co-exist in registry but stay separated
- drain(): resolves false on timeout, resolves true when tasks complete,
resolves true immediately when no tasks in flight
- isolation: tasks in hubA do not appear in hubB
- globalBackgroundTaskHub: is a BackgroundTaskHub instance with registry/drainer
- extractScheduler.test.ts (+1 test):
- factory-created runtimes have isolated registries; tasks in runtimeA
are invisible to runtimeB; all tasks carry EXTRACT_TASK_TYPE
- dreamScheduler.test.ts (+1 test):
- factory-created runtimes have isolated registries; tasks in runtimeA
are invisible to runtimeB; all tasks carry DREAM_TASK_TYPE
* refactor(memory): consolidate all memory state into MemoryManager
Replace BackgroundTaskRegistry/Drainer/Scheduler/Hub helper classes and
module-level globals with a single MemoryManager class owned by Config.
## Changes
### New
- packages/core/src/memory/manager.ts — MemoryManager with:
- scheduleExtract / scheduleDream (inline queuing + deduplication logic)
- recall / forget / selectForgetCandidates / forgetMatches
- getStatus / drain / appendToUserMemory
- subscribe(listener) compatible with useSyncExternalStore
- storeWith() atomic record registration (no double-notify)
- Distinct skippedReason 'scan_throttled' vs 'min_sessions' for dream
- packages/core/src/utils/forkedAgent.ts — pure cache util (moved from background/)
- packages/core/src/utils/sideQuery.ts — pure util (moved from auxiliary/)
### Deleted
- background/taskRegistry, taskDrainer, taskScheduler, taskHub and all tests
- background/forkedAgent (moved to utils/)
- auxiliary/sideQuery (moved to utils/)
- memory/extractScheduler, dreamScheduler, state and all tests
### Modified
- config/config.ts — Config owns MemoryManager instance; getMemoryManager()
- core/client.ts — all memory ops via config.getMemoryManager()
- core/client.test.ts — mock MemoryManager instead of individual modules
- memory/status.ts — accepts MemoryManager param, drops globalBackgroundTaskHub
- index.ts — memory exports reduced from 14 modules to 5 (manager/types/paths/store/const)
- cli/commands/dreamCommand.ts — via config.getMemoryManager()
- cli/commands/forgetCommand.ts — via config.getMemoryManager()
- cli/components/Footer.tsx — useSyncExternalStore replacing setInterval polling
- cli/components/Footer.test.tsx — add getMemoryManager mock
|
||
|
tanzhenxin
|
f6271c61b6 |
feat(auth): discontinue Qwen OAuth free tier (2026-04-15 cutoff) (#3291)
* feat(auth): discontinue Qwen OAuth free tier (2026-04-15 cutoff) The Qwen OAuth free tier has reached its end-of-life date. This updates all client-side messaging, blocks new OAuth signups, and guides existing users to alternative providers. * fix(test): add getModelsConfig mock and update QWEN_OAUTH test expectations - Add getModelsConfig() to Config mocks in gemini.test.tsx (3 failures) - Update validateNonInterActiveAuth test to expect exit for QWEN_OAUTH since validateAuthMethod now returns an error for discontinued free tier |
||
|
|
e90abf4c35 |
docs: update quota exceeded alternatives to OpenRouter and Fireworks (#3217)
* docs: update quota exceeded alternatives to OpenRouter and Fireworks - Update README.md news section to recommend OpenRouter and Fireworks as primary alternatives, with ModelStudio as third option - Update retry.ts quota error message to include OpenRouter and Fireworks URLs for users whose OAuth quota has been exhausted Co-authored-by: Qwen-Coder <[email protected]> * fix(test): update retry test assertions to match new quota error message * docs: update free tier quota to 100 req/day with sunset notice and alternatives Update all references to reflect the Qwen OAuth free tier policy change: - 1,000 → 100 requests/day across code, i18n, and docs - Add 2026-04-15 sunset date everywhere - Guide users to OpenRouter, Fireworks AI, or ModelStudio in docs - Remove CHANGELOG.md --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: tanzhenxin <[email protected]> |
||
|
tanzhenxinandQwen-Coder
|
c3f5dd353d |
docs(tools): document file encoding and platform-specific behavior
Add documentation for encoding detection, default encoding settings, CRLF handling for batch files, and UTF-8 BOM for PowerShell scripts on Windows. Co-authored-by: Qwen-Coder <[email protected]> |