19 commits

Author	SHA1	Message	Date
qqqys	b449a9536a	feat(channels): add DingTalk Workspace channel (#9394) ... * feat(channels): add DingTalk Workspace channel Add a DingTalk Workspace (DWS) channel package so a workspace can be driven from DingTalk alongside the existing channels. - packages/channels/dws: new workspace holding the DWS client, event stream, environment resolution and channel implementation, with the event-source fixtures used by its tests. - cli: register DWS in the channel registry and its builtin list. - web-shell: recognise the DWS platform in the channels UI. - docs: document the channel and its configuration under docs/users/features/channels. - build/release: include the new workspace in the build, clean and release-version scripts and the vitest project list. The channel watches native DingTalk todos, routes document and todo replies back to their originating conversation, bounds notification retries, and keeps sender identity authoritative for direct messages. * fix(dws): classify spawn-resource errnos as not sent, and test against base's source Round 1 review, two Critical findings. vitest.config.ts — the new package's config was the only channel config without the `@qwen-code/channel-base` → source alias its five siblings carry, so `cd packages/channels/dws && npx vitest run` (the workflow AGENTS.md prescribes) depended on a prior `tsc --build` of base. Reproduced the reviewer's witness in this worktree with base/dist moved aside: without the alias vitest dies in `packageEntryFailure` and runs zero tests; with it, 63/63 pass. Even when dist exists it may lag base's source — it did here, by four days. dws-client.ts — `DWS_NOT_SENT_ERROR_CODES` listed only the path errnos, so a `dws` process that never started because of fd or memory exhaustion (`EMFILE`/`ENFILE`/`ENOMEM`/`EAGAIN` and family) was classified `unknown`. The todo and document reply paths in dws-channel.ts swallow `unknown` as "the originating task will not be rerun", so a user's final reply was dropped permanently on one log line instead of being retried — and the retry is safe, since the fingerprint is not persisted when delivery fails. The set now carries the whole `uv_spawn` pre-exec family. Everything else the callback reports — a non-zero exit (numeric `code`), a timeout kill (`code === null`), `ABORT_ERR`, a `maxBuffer` overrun — happened with a child already running and stays `unknown`, because a retry there could duplicate a delivery. The classification moved into an exported `classifyDwsCommandFailure` so the table can be driven directly: the resource errnos need real fd or memory exhaustion to reproduce through a spawn, which no unit test can stage safely. The existing missing-executable test still covers the wiring end to end. Verified: packages/channels/dws — 191 passed (5 files). Mutation-verified: reverting the errno set turns exactly the 12 added codes red (12 failed / 51 passed); dropping the vitest alias with base/dist absent turns the suite from 63 passed into a collection failure. eslint and prettier clean. The one tsc error on this branch (`displayText` missing from `Envelope`) is worktree build skew — base/dist was built 2026-08-10, base/src changed 2026-08-14, and the field is present in the source; it reproduces identically with these changes stashed. * fix(dws): stop a denied sender from consuming a document comment's dedup slot Round-2 review, R2-4 (Critical). `notificationKey` is `documentNotificationKey(documentId, commentKey)` — no sender in it — so a `'denied'` outcome falling into the `else` branch marked that (document, comment) pair processed for good. Every later notification for the same comment, live or polled, then hit `processedMessages.includes(notificationKey)` and returned silently, including one from a sender who IS allowed. The cursor persists, so the drop survived restarts. Concretely, with `senderPolicy: 'allowlist'` and `allowedUsers: ['open-bob']`: Alice (not allowlisted) @-mentions the bot in a document comment and is denied; Bob then mentions the bot on the same comment thread — the ordinary multi-reviewer document flow — and is dropped forever, with no dispatch, no pairing and no log. A denied notification is now parked with `rememberPendingDocumentNotification` like a `'pairing'` one rather than consuming the slot. Replay already skips a pending entry whose sender fails `gate.isAllowed`, so a denied sender does not get retried in; and an allowed sender reaching the same comment clears the entry on the way through. The existing `applies sender access policy to document mention notifications` cannot cover this — its denied and allowed notifications are on DIFFERENT comments, so the shared key is never exercised. New test puts both on the same comment. Mutation-checked: restoring the old condition reddens it with `bridge.prompt` called 0 times against an expected 1, reproducing the review's own witness. Verification: `npm run build` and `tsc --noEmit` clean in packages/channels/dws; eslint clean on both changed files; full package suite 192/192 (118 in dws-channel.test.ts, 1 new). * fix(dws): stop a poison message, a full pending queue, and an unreachable replay from pinning the watermark (R2-1, R2-2, R2-4 queue) Three ways history polling could stall forever, each measured: **R2-2, poison message.** A message whose turn threw was never marked processed, so the watermark never advanced and every poll re-ran it as a full agent turn — one model call per iteration, no cap, no backoff — while the pinned watermark grew the query window without bound and the throw starved every newer message behind it. Pending-document replay already had retry accounting; this path had none. Inbound failures are now counted per message and persisted in the cursor: under budget the error still propagates (redelivery retry and the concurrent-duplicate contract depend on that, and their tests pin it), and once the budget is spent the message is marked processed and dropped with a logged reason. **Pending-queue cap.** `rememberPendingDocumentNotification` threw at MAX_PROCESSED_ITEMS, and the throw aborted the direct-message loop before the checkpoint, the watermark and `markProcessedMessage` — so every later poll re-scanned a growing window and re-threw on the same never-marked message, surviving restarts in the cursor. The queue's only drain is an allowed sender later processing the same comment, so entries parked for unapproved senders never leave: one unpaired member @-mentioning the bot in 5,000 distinct comments broke document history polling until manual cursor surgery. It now evicts the oldest instead, which costs at most a pairing prompt nobody approved. **R2-1, the replay the fixture could not recover.** The test fake ignored its `startTime`/`endTime`, so it certified a recovery the production arithmetic cannot perform. Fixed on both sides: the fake now filters by its window like the real client (and `message()` defaults `eventTime` to now, since real messages always carry one — six fixtures were silently relying on epoch 0), and the stale-replay guard now pulls `notificationWatermark` back to the parked notification's event time. It parks document notifications UNMARKED on purpose, "for polling to recover"; on a fresh cursor the watermark started at `connectionStartedAt` and the window opened at `watermark − 5s` — exactly the guard's own drop boundary — so everything it parked was strictly outside every window that watermark would ever produce. Every fix is mutation-verified: reverting the retry budget re-runs the poison turn once per poll (8 polls, 8 turns), restoring the queue throw reproduces the reviewer's stderr and the pinned watermark, and dropping the watermark pull-back leaves the replayed notification unrecovered. Suite 194/194 green; `tsc -p packages/channels/dws` clean. R1-2 (self-identity degradation) is not in this commit — both fixes the review proposes collide with behaviour this suite pins deliberately; see the thread. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(dws): budget every inbound surface, and stop restarting a dead source (R4-1, R4-3) R4-1: round 3 added an inbound failure budget, but wired it into one of the three `handleInbound` call sites — the mention/live-IM path. The other two kept the exact unbounded-retry mode the budget's own doc comment says it exists to close. - Document notifications (`processDocumentNotification`): a throw escapes `pollOnce`'s sorted loop and is swallowed by the outer catch, so nothing is marked processed and `notificationCheckpoint`/`notificationWatermark` — both assigned after the loop — never advance. Every 5s poll re-ran the same full agent turn, forever, starving every newer notification behind it. - Native todos (`pollTodos`): the fingerprint is remembered only on success, so a todo whose turn keeps throwing was re-fetched and re-run every poll, forever. `recordInboundFailure` now takes the drop action as a parameter, because "stop re-running this" differs per surface: marking the key processed is right for a message, a document notification carries its own `notificationKey` (and a pending entry to clear), and a todo is re-fetched by fingerprint. The default keeps the mention path byte-identical. R4-3: `retryable: false` is terminal before ready — `retryLimit` returns 0 — but `scheduleImRestart` never consulted it, and `startImSource` resets `restartAttempts` to 0 every time a subscription becomes ready. The backoff exponent therefore stayed at 0, so a permanently denied consumer (permission revoked, subscription not allowed) was respawned at a constant ~3s forever — one `dws event consume` child every 2-3s per affected source — while the channel reported itself connected and delivered nothing for that source. Post-ready now matches pre-ready: terminal, with a log line saying so. Verification (`cd packages/channels/dws`): - `npx vitest run` — 197 passed (was 194; three new tests). - `npx tsc -p tsconfig.json --noEmit` — clean. - Mutation checks, one per fix, each turning exactly its own test red and leaving the other 122 green: - drop the `retryable === false` guard -> `stops restarting a source that died permanently after becoming ready` fails. - drop the document-path budget -> `drops a document notification whose turn keeps failing, and stops starving newer ones` fails (the newer notification is never reached). - drop the todo-path budget -> `drops a native todo whose turn keeps failing` fails (8 turns instead of 5). - eslint + prettier clean. Not addressed in this commit: R4-2 (checkpoint drain overwriting the stale replay pull-back), R4-4, R1-2, and R4-5..R4-8. * fix(dws): stop an in-flight poll from clobbering the stale-replay pullback (R4-4) `handleImMessage` leaves a replayed document notification UNMARKED on purpose, for history polling to pick up, and pulls `notificationWatermark` back to the replay's `eventTime` so a future window can reach it. `pollOnce` then wrote `checkpoint.endTime` over that watermark unconditionally when its own window finished — and `checkpoint.endTime` is always past the replay's `eventTime`. The race is not hairline: `runLoop` polls immediately on connect and the IM subscriptions start before the poll loop, so a startup replay arrives precisely while poll #1's `listDirectMessages` is awaiting. One clobber puts the parked replay outside every window the watermark will ever produce — no turn, no log, no error, and it survives restarts because `saveCursor()` persists it. `pollOnce` now records whether the watermark was pulled back while its direct-message fetch was in flight, and on that path drops the window instead of finishing it: neither the advance nor the paginated checkpoint resume is safe, because the checkpoint was itself derived from the pre-pullback watermark. The next poll re-derives a window from the pulled-back value. Test: `keeps the stale-replay pullback when a poll was already in flight` emits the replay from inside `listDirectMessages`. Mutation-checked — forcing the guard false reddens it with `inbound` empty, matching the reviewer's witness (`dispatched = 0`). It also asserts the second query window opens at or before the replay's `eventTime`, so a fake that ignored its window could not certify it. * fix(dws): stop three silent, permanent losses of a document mention (R6-1/R6-2/R6-3) All three Criticals round 6 raised share a failure shape: a document comment is consumed by something that had no right to consume it, the user gets no reply, and nothing is logged. Each is fixed at the point that consumes the slot. R6-1 — `handleImMessage` pullback (dws-channel.ts): R4-4 rescued a stale replay by pulling the notification watermark back, but the flag `pollOnce` consults is cleared at the top of every fetch, so it only ever covered a replay that landed DURING one. A pullback arriving in the gap between two polls is reset before it is read; a persisted multi-page `notificationCheckpoint` then resumes a window that starts after the replay and finishes by writing `checkpoint.endTime` back over the pulled-back watermark. The replay was left unmarked on purpose, so after that no window ever reaches it again. The pullback branch now drops the checkpoint as well, which makes the rescue durable regardless of when the replay arrived; the in-flight flag still guards the during-a-fetch case. R6-2 — in-flight awaiter (dws-channel.ts): a pending entry means the in-flight turn PARKED the comment for a sender it would not serve, which says nothing about the caller waiting behind it. Marking unconditionally consumed an ALLOWED sender's mention outright — replay only re-drives a parked entry whose own `senderId` passes the gate (the denied one never will), and the allowed sender's marked message key is skipped by every later history poll. The awaiter now marks only when the comment is genuinely processed, or when this caller is no more entitled to it than the sender already parked. This is what the denied-sender comment further down already claimed happened ("an allowed sender reaching the same comment clears the entry on the way through") — the awaiter was the path that never let them reach it. R6-3 — failure-budget drop closure (dws-channel.ts): the closure marked the sender-agnostic `notificationKey` (`document\0comment`, no sender), so five failed turns — about 25s of transient model or bridge trouble, since each 5s poll re-runs an unmarked notification — dropped every FUTURE mention of that comment from anyone, permanently and across restarts. It now marks only the failing message's own `key`, which is what stops the window re-running it, so the R4-1 starvation this budget closes stays closed. Tests (dws-channel.test.ts), each mutation-verified against the pre-fix code: - `keeps a stale-replay pullback that arrives between two polls` — persists a bounded checkpoint, emits the replay with no poll in flight, asserts the checkpoint is released and the next window reaches back over the replay. Reverting R6-1: `expected { startTime: … } to be undefined`. - `lets an allowed sender through while a denied turn on the same comment is in flight` — the concurrent counterpart to the existing R2-4 test, which lets the denied turn finish first and so cannot reach the awaiter. Reverting R6-2: the allowed sender's prompt is never called. - `lets a later mention of a dropped comment retry with a fresh budget` — five failing polls, then a different reviewer on the same comment after the outage. Reverting R6-3: `expected [] to deeply equal [ ObjectContaining{…} ]`. Verification: `npx vitest run` in packages/channels/dws — 201 passed (5 files); `npx tsc --noEmit -p packages/channels/dws/tsconfig.json` clean; `npm run build` in that package clean; eslint and prettier clean on both changed files. R1-2 is untouched: it still needs a maintainer call on which pinned contract gives, and is not something this commit should decide. * fix(dws): resolve the sender gate before reading a mentioned document (R7-1) `parseDocumentMentionNotification` reconstructs `(documentId, commentKey)` from rendered message text, so a bare alidocs URL in an ordinary DM forges a mention card the channel cannot tell apart from a genuine platform notification. `processDocumentNotification` then called `readDocumentContext` on that attacker-named document BEFORE `handleInbound` resolved the sender gate, so under the documented default `senderPolicy: 'pairing'` an unpaired stranger could force this profile to perform an authenticated read of any document it can reach — a turn the channel would never serve them. Resolve `gate.isAllowed(message.senderId)` first and read only for a sender this channel will actually answer. The envelope already carries a "Document Markdown was unavailable" fallback, the `preflightInbound` document branch still parks the mention exactly as before, and `replayPendingDocumentNotifications` re-enters this path once the sender is approved, so an approved turn still gets its document context — just after the gate instead of before it. BEHAVIOR FLIP: `replays a pairing-pending document mention after approval` pinned `readDocument` being called once for the still-unpaired sender and twice overall. That pinned expectation was the defect: it asserted an authenticated read driven by a sender the gate had already refused. It now expects zero reads before approval and one after. Verified by mutation — reverting the guard turns both this test and the new forged-mention test red. Still open on this class and NOT addressed here: the pairing-code write into the attacker-named comment thread. Closing that needs either fail-closed verification that `commentKey` is a real comment on `documentId` mentioning this profile (no DWS CLI surface exposes it — `listMentionedMessages` covers group IM, not document comments) or structured mention events, so it is a maintainer contract call rather than a local fix. Verification: - packages/channels/dws: 202 passed (5 files), including the new `does not read a forged document mention before the sender gate resolves` - tsc --noEmit -p packages/channels/dws/tsconfig.json: clean - eslint + prettier --check on both changed files: clean * fix(dws): list the dws channel as a cli test build prerequisite `channel-registry.ts` dynamically imports `@qwen-code/channel-dws`, whose package.json resolves the bare specifier to `dist/index.js` and which `packages/cli/vitest.config.ts` does not alias to source. It therefore belongs in `DIST_PREREQUISITES['packages/cli']` alongside every other builtin channel, so a cli test run on an unbuilt checkout reports the actionable "run npm run build" message instead of a raw resolution error. This is what the required `Test (ubuntu-latest, Node 22.x)` check caught on 4bf040766c: scripts/tests/vitest-global-setup.test.js asserts the list stays in sync with the registry, and dws was the one registry import missing from it. Verified: `npx vitest run scripts/tests/vitest-global-setup.test.js` 29 passed; reverting this one line reproduces the CI assertion exactly ("missing prerequisite entry for packages/channels/dws"), 1 failed | 28 passed. prettier --check and eslint clean. * fix(dws): close current review blockers * test(dws): pin fail-closed self identity gate * fix(dws): preserve retryable inbound work * fix(dws): preserve in-flight catch-up mentions * fix(dws): align channel-base on the workspace version so npm ci resolves `Dependency CVE audit` has failed every run with: npm ci can only install packages when your package.json and package-lock.json are in sync. Missing: @qwen-code/channel-base@0.21.11 from lock file The diagnosis of "stale base" was right, but the stale file is this PR's own. `packages/channels/dws` was written when the workspace was at 0.21.11 and pins that version; every sibling channel — dingtalk, feishu, github, gitlab, qqbot, telegram, wecom, weixin — now says 0.21.14, which is what `packages/channels/base` actually publishes. A workspace package cannot satisfy 0.21.11, so npm resolved `@qwen-code/channel-base` for dws from the REGISTRY instead of linking the sibling, leaving a nested `packages/channels/dws/node_modules/@qwen-code/channel-base` entry that `npm ci` refuses. Merging current main cannot fix it: main is not where the pin lives. Bump dws to 0.21.14 for both its own version and its channel-base dependency, matching every sibling, and regenerate the lockfile. The nested registry entry is gone and dws now links the workspace like the others. `npm ci --dry-run` completes, and dws typechecks and passes all 211 tests against the workspace channel-base rather than the published 0.21.11 it was resolving before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VgTjRF91xANQh6SY9YGyCf * fix(dws): replay failed direct messages, and close open review items * fix(deps): bump tar to 7.5.22 to unblock CVE audit (#9394) The 2026-08-21 advisory GHSA-r292-9mhp-454m flags tar <= 7.5.20 as high severity, failing the Dependency CVE audit gate. Main already moved to 7.5.22 in #9703, but that landed after this branch's last merge of main. Bump the lockfile entry in-range (core/cli declare ^7.5.19) to match main, and regenerate the committed NOTICES.txt artifact whose freshness is enforced by CI. * fix(dws): unblock npm ci, add publish metadata, and keep todo fetch failures out of the turn budget (R13-1, R13-2, R14-1) * fix(dws): dedup threaded pairing comments on a persisted marker instead of the rotating code (R15-1) * fix(dws): clear the todo pairing marker when pairing resolves, not on turn success (R16-1) * fix(dws): address current review blockers * fix(dws): satisfy event fixture lint --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: qqqys <266654365+qqqys@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-08-25 06:40:47 +00:00
顾盼	37cedea5b2	feat(computer-use): replace built-in tools with bundled skill (#9856)	2026-08-24 11:05:23 +00:00
Shaojin Wen	2c64ebe980	feat(autofix): audit the approach instead of stopping on growth-budget breach (#9262) ... * feat(autofix): audit the approach instead of stopping on growth-budget breach A growth-budget breach no longer escalates to a maintainer handoff that stops the takeover. The breach now makes the round a growth-audit round: the agent audits the PR's approach on two axes — KISS (name a simpler alternative or prove each piece load-bearing) and minimal change (every hunk traces to the problem, an accepted finding, or a failing check) — and records a machine-readable verdict that the verification gate requires. sound re-arms the counting window at the current size and the loop keeps solving; drift simplifies first, then continues; conflict is the only growth path to a human, parked idempotently until a trusted human responds. The old divergence ladder (over budget for N rounds and not shrinking → stop) terminated takeovers whose remaining work could still fit: the growth it punished was protocol-mandated pinned tests (#9213 stalled at round 5 with two small Criticals left). A size signal now triggers a judgment, never a stop. Design: docs/design/autofix-growth-audit.md * fix(autofix): update the artifact-list pin for the growth-audit.json upload entry * fix(autofix): surface conflict verdicts past the failure.md exits and strip verdict forgery channels (#9262) * fix(autofix): harden the growth-audit verdict pipeline and park wake set (#9262) * fix(autofix): close the verdict-pipeline forgeries and loop-generated wake entrances (#9262) * fix(ci): drop the retired divergence rationale records (af-046/af-047) from qwen-autofix.md --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-08-21 04:54:07 +00:00
易良	a074d3b042	chore(ci): Disable install scripts in release CI and guard security-checks workflow (#9577) ... * chore(ci): Disable install scripts in release CI and guard security-checks workflow * fix(ci): complete release install hardening * test(ci): pin release install step count Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): scope release PAT to push step Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): export GH_TOKEN so the release-branch push uses CI_BOT_PAT * fix(ci): export GH_TOKEN so the credential helper sees it at push time An inline GH_TOKEN prefix only covers the gh auth setup-git call itself; the helper re-resolves the token when git push invokes it, so the push would fall back to the job token with persist-credentials disabled. * fix(test): anchor setup-git ordering check after the export line A comment in the push step mentions gh auth setup-git before the export, so indexOf found the comment first and the ordering assertion inverted. * style(test): wrap long line to satisfy prettier * fix(ci): address review findings on PAT handling and install comments - Pin gh auth setup-git before the git push it authenticates in both release and finalize workflow tests, so moving credential setup after the push no longer passes. - Correct the replay comment: npm run generate is not a lifecycle script and workspace lifecycle scripts stay disabled. - Drop the overstated push-boundary claim and record why the push needs the bot PAT rather than the job token. * test(ci): pin CI_BOT_PAT out of install steps and the publish job header * style(test): apply prettier's exact re-wrap for the two flagged calls * test(ci): pin CI_BOT_PAT out of the workflow-level headers too --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-08-21 03:48:03 +00:00
易良	0baaec2b32	chore(ci): Drop NPM_TOKEN in favor of npm Trusted Publishing (#9552) ... * chore(ci): Drop NPM_TOKEN in favor of npm Trusted Publishing * chore(ci): Pin npm 11 for Trusted Publishing in release jobs * test(ci): Cover Trusted Publishing requirements	2026-08-20 08:31:41 +00:00
易良	b219e3a716	chore(ci): Add --provenance to npm publish and id-token permission (#9532) ... * chore(ci): Add --provenance to npm publish and id-token permission * test(scripts): expect --provenance in npm publish step assertion PR #9532 adds --provenance to every npm publish in the release pipeline. Update the workflow-pinning test to match the new command so the helper test suite stays green.	2026-08-20 05:21:02 +00:00
Shaojin Wen	7942197666	fix(tests): apply integration worker limits to forks (#8689) ... * fix(tests): apply integration worker limits to forks Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(tests): keep no-AK integration gate at two fork workers (#8689) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-ci-bot <25325202+qwen-code-ci-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-08-08 00:53:33 +00:00
易良	c73b5ed887	ci: run Windows merge queue tests on ECS (#8386) ... * ci: run Windows merge queue tests on ECS * test(channels): skip POSIX mode assertion on Windows * ci: expose Git Bash on Windows ECS runner * ci: scope Windows ECS tuning to self-hosted and restore full test:ci Review feedback on the Windows ECS routing: dropping test:scripts removed the only Windows execution of 9 Windows-only install-script tests, and the job-wide PowerShell default plus narrowed test command changed the kill-switch fallback away from the known-good hosted configuration. Restore the full npm run test:ci on both paths (bash is available: pre-installed on hosted runners, exposed via the Git Bash PATH entry on ECS) and gate every ECS-specific adjustment on runner.environment: the PowerShell setup step (now also skip_ci-guarded), TEMP/TMP/LC_ALL env writes, and the Linux-style Node setup split that fails with an actionable error naming MAINTAINER_ECS_RUNNER_DISABLED. The windows-2022 fallback is byte-for-byte the pre-ECS job again. * test: make Windows CI suites platform-aware * ci: add stale-checkout guard to Windows ECS test job * test(core): compare canonical directory identity * ci: add fork guard and review follow-ups to Windows ECS job * test(core): exercise real directory identity change * test(core): wait for killed lease process exit * test(scripts): avoid cmd echo trailing spaces * test(scripts): use unambiguous cmd echo syntax * test(cli): avoid sidecar I/O in truncation test * test: fix Windows script-suite gaps and unify platform gating - Fix missed trailing-space cmd stub in package-scripts.test.js so the 'runs prepare steps in order' assertion passes on Windows. - Add qwen-pr-review-workflow.test.js and pr-self-report-label.test.js to the win32 exclude list (both test Linux-only workflows and are not portable to Windows). - Replace local itPosix/describeOnNonWindows consts with vitest's built-in it.skipIf/it.runIf/describe.skipIf, matching the codebase idiom. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(scripts): restore Windows workflow coverage * test(scripts): re-exclude Windows-incompatible workflow tests on win32 Re-add pr-self-report-label.test.js and qwen-pr-review-workflow.test.js to the win32 exclude list. Both fail on a Windows runner for reasons the code still carries: qwen-pr-review-workflow.test.js calls execFileSync('mkdir'), which has no executable to resolve there, and pr-self-report-label.test.js joins PATH with ':', corrupting the ';'-separated Windows PATH so its gh stub never resolves. Excluding them restores a green Windows gate; Linux CI remains their authoritative coverage. Document the criterion inline. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * ci: extract checkout-head guard into composite action, pin Windows gate (#8386) Address review round 2: move the stale-checkout guard shared by the four CI gates into .github/actions/verify-checkout-head so the copies cannot drift, pin the Windows gate kill-switch routing and guard wiring in the script tests, re-enable lint.test.js on Windows via separator normalization and a lazy linter setup in scripts/lint.js, unify the platform skips on it.skipIf(process.platform === 'win32'), and document the queued-run behavior of the ECS kill switch. * ci: fail fast in Windows gate environment setup (#8386) * ci: dedupe self-hosted runner steps into actions, pin gate mutations (#8386) * fix(ci): checkout before repository-local actions in Windows gates (#8386) * fix(ci): configure Windows runner before bash guard * test(ci): pin remaining shared-action wiring in script tests (#8386) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): skip zip-dependent packaging tests when zip is missing (#8386) * fix(ci): validate full Windows smoke path * fix(ci): match Windows smoke shell to gate and drop dead runs-on guard (#8386) * fix(ci): make SIGTERM escalation test Windows-aware and tighten pins (#8386) The CDP acceptance test asserted a POSIX-only SIGKILL escalation, which fails deterministically on Windows where kill('SIGTERM') terminates the child directly — blocking the Windows merge-queue gate. Assert the platform-appropriate signal instead. Also address review suggestions: probe `unzip` alongside `zip`, pin the integration_cli guard's missing step-level `if:`, stop getWorkflowStep at unnamed steps, pin install-script.test.js out of the win32 excludes, add the stale-checkout guard to windows-runner-smoke.yml, pin the Node preflight warning branch and the guard reject path contiguously, and extend the smoke shell-parity loop to the npm cache step. * docs(ci): clarify Windows runner trust boundary --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: qwen-code-ci-bot <qwen-code-ci@service.alibaba.com>	2026-08-05 12:14:42 +00:00
Shaojin Wen	da37110e60	perf(autofix): build the review CLI bundle once per scan and fan it out to legs (#8548) ... * perf(autofix): build the review CLI bundle once per scan and fan it out to legs Each review-address leg repeated the same trusted-base build: measured 3.5-5 minutes of npm ci + build + bundle per leg (~25 runner-minutes on one 6-leg scan) before the agent could start. A build-cli job now compiles the bundle once per scan, uploads the repo-root dist/ as an artifact, and the legs download it; their checkout is pinned to the compiled SHA so a mid-run base push can never pair a leg's bundle with different sources. The legs keep npm ci (the agent and the verify gate still need node_modules against the PR branch), and the issue phase is untouched — it runs only when no review targets exist, so gating the build on do_issue too would rebuild on every quiet scheduled tick. * fix(autofix): validate fan-out bundle SHA and pin shared CLI recipe contracts (#8548) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code-ci-bot <qwen-code-ci-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-08-05 05:16:49 +00:00
易良	c55e63c42a	fix(release): bump preview base past published stable (#7978) ... * fix(release): bump preview base past published stable When the nightly tag base (e.g. 0.21.0) is already published as stable, getPreviewVersion() now bumps the patch (→ 0.21.1-preview.0) instead of deriving a preview for the released version. This prevents the scheduled Tuesday preview release from hitting npm E403 on channel packages that were already published at that version. Fixes #7969 * fix(release): address preview version review feedback * fix(release): reject divergent preview baseline * fix(release): skip already published packages * test(release): cover publish skip guards * fix(release): bump preview past newer stable * fix(release): address review feedback on preview version guard - Expand doesVersionExist to check all 10 published packages instead of only @qwen-code/qwen-code, so the auto-increment loop detects versions taken on sibling channel packages. - Use the rollback-aware getAndVerifyTags lookup for the latest stable instead of the raw dist-tag, preventing a retrograde preview base when the dist-tag has been rolled back. - Emit :⚠️: in the channel publish loop when every package was already published, making a fully-skipped release visible. - Move preview stable-guard tests to Advanced Scenarios, add npmTag and previousReleaseTag assertions, add a non-bump boundary case, and assert the subshell wrapper and all-skipped warning in the workflow test. * test(release): cover channel package version conflicts --------- Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-07-29 23:21:00 +00:00
qqqys	b1ce0c2087	refactor(autofix): extract review verification runner (#7644) ... * refactor(autofix): extract review verification runner * test(ci): follow extracted autofix verifier * docs(autofix): document the review verification runner env contract (#7644)	2026-07-24 16:46:24 +00:00
Shaojin Wen	eca654f365	fix(autofix): resolve owning package for nested paths; report verify-failed handoffs as not pushed (#7330) ... * fix(autofix): resolve owning package for nested paths; report verify-failed handoffs as not pushed The verify gate mapped each changed file to a flat `packages/<dir>` and read `<dir>/package.json`, which ENOENT-crashed on nested packages such as packages/channels/base — the container packages/channels has no package.json. Walk each changed file up to its nearest package.json in both the issue-fix and review-address verify steps, and skip any candidate that still has none. When such a verify failure follows an agent commit, the review-address handoff rendered the agent's optimistic address-summary.md (which can cite a commit SHA) under a neutral "what I found" heading, so a maintainer chased a commit that was discarded with the runner workspace. An EXIT trap now records any post-commit non-zero exit as outcome=failed, and the handoff states plainly that the change did NOT pass the gate and was NOT pushed. Tests: walk-up detection over a nested package tree, the outcome=failed trap, and the not-pushed handoff wording — each mutation-verified. * refactor(autofix): extract owning-package resolver to a shared staged script Addresses review on #7330. Extract the changed-file → owning-package walk into .github/scripts/resolve-owning-packages.sh, staged to RUNNER_TEMP from the trusted base alongside check-settings-schema.sh and invoked from both verify gates, so the two gates cannot drift into resolving packages differently (the 8-line walk was otherwise duplicated verbatim in each). Updates the package-scripts test that pinned the old inline grep. Narrow the verify-failed handoff lead-in to "This change was NOT pushed": four paths set outcome=failed BEFORE the deterministic gate runs (agent abort via failure.md, dirty tree, unchanged branch, missing address-summary.md), so the previous "did NOT pass the verification gate" claim was factually wrong for them. The specific reason stays in the headline and the quoted summary. * style(autofix): brace variable references in resolve-owning-packages.sh The repo's shellcheck gate runs --enable=all --severity=style, under which bare $f/$d references trip SC2250 (prefer ${var}). Brace them to match the convention already used in check-settings-schema.sh, and update the script content assertions accordingly. Verified with shellcheck 0.11.0 using the exact CI flags: clean. * fix(autofix): resolve owning workspace via npm query; key unpushed-handoff on commit existence Addresses the deeper review on #7330. Blocking issue: the "nearest package.json" resolver mapped a change under a workspace's fixture/example package (e.g. packages/cli/src/commands/extensions/examples/starter) to that fixture, whose test script is not Vitest — silently SKIPPING packages/cli's own tests, a coverage regression invisible in the log. Resolve against the authoritative `npm query .workspace` set instead and take each file's longest-prefix workspace: nested workspaces (packages/channels/base) match exactly, fixtures and non-workspace paths (packages/sdk-python, packages/README.md, the excluded packages/desktop) drop. Also harden the resolver against a final line with no trailing newline and against an unmatched last line, which under `set -o pipefail` would otherwise abort the script. Handoff wording: keying "was NOT pushed / commit discarded" on outcome=failed was wrong for the abort paths (failure.md, dirty tree, unchanged branch, missing address-summary.md), which set outcome=failed before ever making a commit. Record committed=true right after checkout — before any gate can fail — and key the wording on that; the abort/no-op paths keep the neutral framing. This removes the EXIT trap entirely (its only observable effect was that wording), so it no longer mislabels pre-commit failures either. * fix(autofix): expand workspaces on-disk so branch-added packages are tested; harden resolver Addresses the re-review on #7330. The resolver sourced its workspace set from `npm query .workspace`, which reads node_modules — installed from the BASE checkout. A workspace the PR branch ADDS (a new channel adapter, a new sdk — the issue-fix job's whole purpose) was invisible, so its tests were silently skipped, and for a nested new package the ENOENT crash this PR fixes turned into a silent skip. Expand the set from the on-disk root package.json `workspaces` globs instead (shallow `dir/*` + literals, honouring `!` negations, keeping dirs with a package.json): it reflects the branch, matches what `npm run --workspace` accepts downstream, and needs no install. Verified to reproduce `npm query`'s set exactly on the current tree. Also from the review: - Fail the gate loudly on an empty/unreadable workspace set instead of the silent "no package changes" skip, and drop the now-unneeded `|| true` at both resolver call sites (the resolver already exits 0 on legitimate no-match). - Record committed=true at the TOP of the step (ref-only diff), covering an agent that commits then aborts, and count only `git diff --quiet` exit 1 as a commit (128 is a git error, not a discarded commit). - Correct the two call-site comments that still described the superseded nearest-package.json approach. Also hardens the resolver against a final changed-path with no trailing newline and an unmatched last line under `set -o pipefail`. --------- Co-authored-by: wenshao <wenshao@example.com>	2026-07-20 14:39:56 +00:00
Shaojin Wen	582fb49603	feat(web-shell): git status chip, visual working-tree diff, and sidebar git status (#7054) ... * feat(web-shell): git status chip, visual working-tree diff, and sidebar git status Bring working-tree Git awareness to the Web Shell (browser daemon session UI): - Toolbar branch chip becomes a live status indicator: dirty (staged/unstaged/ untracked), ahead/behind upstream, stash count, detached HEAD, in-progress operation (merge/rebase/cherry-pick/revert/bisect), and conflict count, each with a non-color cue. - Read-only "Changes" dialog: working-tree-vs-HEAD file list with per-file, line-level, per-side syntax-highlighted diffs; opens via /diff or a dirty chip; untracked files expand as fully-added and deleted files still diff. - Per-workspace git status in the sidebar: a compact icon-only chip per trusted workspace (status dot + hover tooltip); click opens that workspace's dialog. All git access goes through the daemon REST API with per-workspace trust gating; new SDK status fields are optional and additive (v2). * fix(web-shell): themed tooltips and git-chip review follow-ups Tooltips now render on the themed popover surface (bg-popover / text-popover-foreground / border + fill-popover arrow) instead of the inverted bg-foreground default, so they read dark-on-dark rather than a bright box on the dark theme. Fixing the shared primitive corrects the git branch tooltip in the composer toolbar and sidebar, plus every other tooltip, at once. Also addressing review feedback on the git integration: - Replace the hand-drawn detached/conflict/stash SVG icons with lucide-react (CircleDot / TriangleAlert / Layers) per the web-shell icon convention. - Gate the tooltip "Working tree clean" message on an enriched status (computedAt) so a branch-only status no longer asserts clean. - Include the file path in the diff dialog row aria-label so screen readers can distinguish files. - Reset the toolbar git chip on workspace switch so it never shows the previous repo's branch/counts while the new fetch resolves. - Log a sidebar git poll failure only on the success->failure transition to avoid spamming a long-lived tab. - Correct the SDK doc for DaemonWorkspaceGitDiffFile.added/removed (0, not undefined, for binary files). * fix(web-shell): address git-integration review suggestions Follow-ups from the /review pass on the git integration: - GitBranchIndicator: include the short SHA in the detached-HEAD tooltip title, and add the "Working tree clean" status to the aria-label (gated on an enriched status, matching the tooltip) so the two never drift. - WorkspaceSection: keep the last known git status on a transient poll failure instead of blanking the chip for a whole interval. - App: surface a toast for `/diff` when no workspace is available instead of silently consuming the composer input. - Tests: cover the diff dialog's list-load and per-file load error paths, and detectGitOperation's revert/bisect branches. - Design doc: align the getGitWorkingTreeStatus spec text with the decision (transient states return status with `operation`; null is reserved for non-repo / git failure). * fix(web-shell): focus-visible ring for git chip button; align doc poll interval - Add a :focus-visible outline to .gitBranchChipButton so keyboard users get a visible focus indicator (the chip resets UA button chrome). - Design doc: align the active-workspace poll-interval references at 30s to match the implementation. * fix(web-shell): surface capped diffs, catch row-build failures, cover degradation paths Address the remaining review findings on the git integration: - Truncation is no longer silent: fetchGitDiffHunksForFile now returns { hunks, truncated } — the parser records files that actually lost lines to MAX_LINES_PER_FILE (tracked path), and the untracked synthesis reports its byte/line caps. The route forwards an additive `truncated` flag on the hunks response (absent when not truncated, so older clients and daemons are unaffected), and the Changes dialog renders a "Diff truncated" note under the visible window. - DiffHunks catches an unexpected buildRows rejection (e.g. malformed hunk lines) and shows the per-file error instead of leaving an unhandled rejection and a silently empty diff area. - New tests: untracked and tracked truncation at the core caps, the route's truncated passthrough (and its absence when clean), the branch-only degradation when the working-tree summary throws, the malformed-hunks error path, and the Shiki success path (a fake tokenizer proving add rows pull new-side tokens and del rows pull old-side tokens, not the plain-text fallback). * fix(web-shell): drop dialog backdrop-blur that froze the page on open The dialog and alert-dialog overlays applied `backdrop-blur-xs`, which forces the browser to rasterize and blur the entire content behind the overlay when a dialog opens. With a long transcript behind it, that main-thread paint+blur froze the whole page — e.g. clicking the git branch chip to open the Changes dialog. Keep the bg-black/10 scrim for separation and drop the blur. * fix(core): guard synthesizeUntrackedHunk against non-regular files synthesizeUntrackedHunk opened an untracked path before checking its type, so an untracked FIFO (listed by `ls-files --others`) would block on open() forever waiting on a writer — hanging the daemon's event loop and leaving the Web Shell Changes dialog stuck on a permanent loading state. lstat-gate on regular files before opening, matching the existing guard in countUntrackedLines. Adds a FIFO regression test. * fix(web-shell,core): rename expansion, no-newline marker, chip measurement Round-5 review Criticals: - core: key renamed diff entries by the real (post-rename) path and carry the old path for display, so renamed rows can be expanded — the synthetic `old => new` key was sent to git as a nonexistent literal path. The diff dialog renders the rename as `old → new`. - core: preserve Git's `\ No newline at end of file` marker through the hunk parser so a trailing-newline-only edit isn't shown as identical removed/added lines (the viewer already renders it as a meta row). - web-shell: the toolbar's hidden git-chip measurement replica now renders the full chip content via the extracted GitBranchChipContent, so the expanded width includes the status indicators and the compact/expanded toggle no longer oscillates near the responsive threshold. * fix(build): generate git-commit info even when prepare build is skipped The review tooling runs `npm ci` with QWEN_SKIP_PREPARE=1 (to skip the heavy prepare build) and then builds only the changed workspaces. Because `prepare` exited before generating the gitignored git-commit.ts, a per-workspace build of packages/cli failed at the unchanged systemInfo.ts on the missing `../generated/git-commit.js` module. Generate the git-commit info in the skip path too — it is cheap and never fails hard — so a later per-workspace build or typecheck finds the module. The non-skip path still generates it via `npm run build`. * fix(web-shell,cli): address round-6 review suggestions - cli: carry the pre-rename path (oldPath) through DiffRenderRow and show renamed files as `old → new` in both the Ink and plain-text renderers. The rename-keying fix updated the daemon and web-shell dialog but not the CLI `/diff` renderer, which silently dropped the old path. - web-shell: key DiffFileRow by workspace + path so switching workspace remounts the row instead of reusing another workspace's hunks/open state for a path both workspaces share. - web-shell: show a loading placeholder in DiffHunks while rows are (re)built (e.g. after a theme switch) instead of an empty, jumpily-resized box. - web-shell: cover the /diff local intercept in App.test.tsx (opens the Changes dialog and is not forwarded to the agent). * fix(web-shell,cli,core): address round-7 review suggestions - cli: sanitize the rendered filename (and pre-rename oldPath) in the Ink DiffStatsDisplay via sanitizeFilenameForDisplay, matching the plain-text renderer so a crafted path can't inject into the interactive view. - cli: apply the read headers before awaiting the per-file diff fetch (as handleDiffList does) so error responses also carry no-store/nosniff. - cli + web-shell: strip Unicode bidi embedding/isolate controls (U+202A-202E, U+2066-2069) in the filename/control-char sanitizers so a crafted filename can't visually spoof its extension. - core: guard countStashEntries with an lstat type check before readFile, so a symlink-to-FIFO at logs/refs/stash can't block the event loop (the same hazard already guarded in the untracked-file readers). - core: cover fetchGitDiffHunksForFile's transient-state guard with a test (the sibling helpers already had one). * fix(web-shell,cli,core): address round-8 review suggestions - core: pass --no-optional-locks to the ls-files call in fetchGitDiffHunksForFile, matching the other runGit calls so it doesn't contend for an optional index-refresh lock alongside concurrent git add/commit. - cli: add a route test asserting a rename's oldPath survives serialization end-to-end (keyed by the new path, old path carried alongside). - web-shell: add a GitDiffDialog test for the hiddenCount>0 "N more files not shown" note (every payload previously used hiddenCount: 0). - web-shell: drop the nonexistent primaryLabel prop from the WorkspaceSection test (it is not a WorkspaceSectionProps member). - docs: correct the plan doc — large-diff virtual scrolling was explicitly descoped (core caps + per-file lazy loading), not implemented in Phase 2. * fix(cli,web-shell): address round-9 review findings - cli: propagate the pre-rename oldPath through DiffDialog's perFileToUnified and render renamed files as `old → new` in the interactive diff viewer (the rename-keying fix had updated the daemon, the web-shell dialog, and the /diff stats, but not this viewer). - cli: cover DiffStatsDisplay's rename (`old → new`) rendering and the sanitizeFilenameForDisplay path for hostile filenames carrying control characters. - web-shell: guard the GitBranchIndicator test afterEach against double-unmounting an already-unmounted root (the localization tests assert on getTranslator without calling render()). * fix(core,cli,web-shell): rename-aware single-file diff (old→new) fetchGitDiffHunksForFile pathspec-limited the diff to the new path, which defeats git's rename detection — a renamed file was reported as fully added (every line +) instead of its actual edit. Thread an optional pre-rename path through the single-file endpoint (core → route → SDK → dialog) and diff old→new with -M when it is present, so expanding a renamed file shows its real content change. * fix(cli): address round-10 review suggestions - DiffDialog: split the path-width budget between old and new paths for a rename (reserving the " → " separator) so the combined width stays within maxPathChars instead of overflowing the row layout. - textUtils: extend MULTILINE_CONTROL_CHARS_REGEX with the Unicode bidi ranges (matching FILENAME_CONTROL_CHARS_REGEX) and add a test that sanitizeFilenameForDisplay strips bidi embedding/isolate controls. - workspace-git-diff route: add a test that ?oldPath= is parsed and forwarded to fetchGitDiffHunksForFile. * test(sdk),docs: cover diff client methods; align design doc - sdk: add DaemonClient unit tests for workspaceGitDiff() and workspaceGitDiffFile(path, oldPath?) — URL construction (incl. urlEncode on path/oldPath, with and without oldPath, plus the workspace-qualified route) and response deserialization, mirroring the existing workspaceGit() test. - docs: add the oldPath? param to the workspaceGitDiffFile API spec; record that the diff client methods now have unit tests (correcting the claim that workspaceGit() had none); attribute the bundle-limit bump to packages/sdk-typescript/scripts/build.js; clarify ahead/behind are relative to upstream (0, and ↑N/↓N not shown, without one). * fix(web-shell,core): address round-11 review suggestions - GitBranchIndicator: count conflicted entries as dirty — a merge where every changed file is conflicted (staged=unstaged=untracked=0) is still uncommitted, so the expanded chip's dirty dot / data-dirty now reflect it. - core: split the status branch line at the last "..." (the branch/upstream separator) so a dotted branch name isn't truncated at the first "...". - GitDiffDialog: guard DiffFileRow's in-flight fetch against unmount via a cancelled ref, matching DiffHunks / GitDiffDialog. - tests: forward oldPath when expanding a renamed file in the web-shell dialog; bidi-strip coverage for the web-shell sanitizeControlChars; untrusted-guard coverage on the single-file diff route; conflicted-only dirty; branch-line "..." split. * fix(web-shell,cli): address round-12 review suggestions - DiffDialog: only render the rename "old → new" when there's room for both sides (≥19 cols, so each gets ≥8); otherwise fall back to the new path alone, so a narrow terminal no longer overflows the row (the Math.max(8,…) floor could exceed maxPathChars). - GitBranchIndicator test: guard afterEach container.remove() for non-render tests run in isolation, and make the compact-mode ↑-suppression assertion non-vacuous by giving the fixture an ahead count. - App: compute the active workspace once (useMemo) and share it between the git-status effect and the Changes-dialog entry point, so the chip and the dialog can't drift onto different repos. * fix(core,docs): address round-13 review suggestions - core: add a rebase-apply detection test (git am / an interrupted `rebase --apply` creates rebase-apply, which detectGitOperation also maps to 'rebase'); previously only rebase-merge was exercised. - docs: correct section 5 to describe the actual diff-dialog mechanism (diffWorkspaceCwd state, not the stale activePanel design). * test(core): cover stray no-newline marker before any hunk header parseGitDiff's pre-hunk guard already skips a "\ No newline at end of file" marker that appears before any @@ header, so a malformed/truncated diff can't throw on a null currentHunk and lose subsequent files' hunks; add a regression test pinning that behavior. * fix(web-shell): unstick per-file diff loading and skip non-path git poll - DiffFileRow: reset the cancelled-fetch flag on mount so StrictMode's mount/unmount/mount replay no longer leaves it latched at true, which dropped the fetched hunks and froze the row on "Loading changes…" despite a 200 response. - WorkspaceSection: skip the git status poll when the workspace cwd is not an absolute path. A synthetic fallback workspace carries a display name there, which the cwd-qualified route rejects with a 400. * fix(web-shell,cli): address review suggestions on the git diff surface - GitDiffDialog: highlight each diff side independently so a small side keeps syntax highlighting even when the other side exceeds the size cap (the old guard dropped both as soon as either was too large). - ChatEditor: complete the .gitBranchChipButton reset (font/color/padding/ margin) so the clickable dirty-tree chip matches the read-only output chip instead of picking up UA button styling. - DiffDialog: cover the interactive rename display (old to new on a wide terminal), mirroring the rename tests DiffStatsDisplay and GitDiffDialog already have. * test(web-shell,cli): cover git chip clean/reload/traversal paths, fix doc - GitDiffDialog: add the missing expect(header).not.toBeNull() guard to the three expand-file tests that lacked it, matching the others in the block. - GitBranchIndicator: cover the known-clean aria-label branch (computedAt set and every change counter zero). - WorkspaceSection: verify a reloadToken change re-fetches git status instead of waiting for the next 60s poll. - workspace-git-diff route: verify a traversal oldPath is forwarded to core and surfaced as available:false rather than escaping the workspace. - Design doc: /diff is handled via setDiffWorkspaceCwd, not setActivePanel. * fix(core): allow literal `..foo` paths in diff normalization - toRepoRelativePath: reject only a real climb-out (`..` or `../…`), not a literal `..foo` filename at the repo root, which the bare startsWith('..') over-rejected, leaving the diff viewer unable to render such a file. - parseGitDiff: cover the truncatedPaths output set directly (it was only exercised indirectly through fetchGitDiffHunksForFile). --------- Co-authored-by: wenshao <wenshao@example.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>	2026-07-18 10:06:07 +00:00
callmeYe	3d4601489e	revert: remove local PR verification gate (#7031) ... Reverts QwenLM/qwen-code#6873 and QwenLM/qwen-code#7025.	2026-07-16 11:24:38 +00:00
callmeYe	441006b0e1	feat(scripts): add local PR verification gate (#6873) ... * feat(scripts): add settings schema check mode * feat(scripts): add local PR verification runner * fix(scripts): harden local PR verification * docs: document local PR verification gate * fix(scripts): isolate local verification tools * fix(scripts): scope PR formatting checks * fix(scripts): skip symlinked PR paths * fix(scripts): preserve verification gate integrity * fix(scripts): canonicalize verification temp paths * fix(scripts): stabilize local PR verification * fix(scripts): clear built-in test credentials * fix(scripts): enforce isolated test environment * fix(scripts): serialize local verification tests * fix(scripts): address PR verification review * fix(scripts): preserve review git wrapper environment * refactor(scripts): avoid step helper shadowing * fix(scripts): distinguish forwarded child signals * fix(scripts): preserve relayed signal exit codes	2026-07-15 00:58:17 +00:00
易良	6d966d2917	test(core): stabilize file history eviction test (#6637) ... * test(core): stabilize file history eviction test * ci: clean package build artifacts before fast-path check * ci: preserve web build outputs during fast-path check	2026-07-10 06:39:52 +00:00
易良	e3906392b5	perf(ci): optimize autofix pipeline — fast-track, skip duplicate build, scoped tests (#6315) ... * perf(ci): optimize autofix pipeline — fast-track, skip duplicate build, scoped tests (#6196) Three optimizations to reduce autofix wall-clock from ~48 min to ~28-35 min: 1. Fast-track decision: skip LLM assessment for trusted triggers (workflow_dispatch with explicit issue, issues:labeled event). 2. Skip duplicate build: set QWEN_SKIP_PREPARE=1 so npm ci does not re-run the prepare hook that builds+bundles before the explicit build step. 3. Scoped verification tests: run only changed-file tests via --changed instead of full per-package suites. Full regression is covered by regular CI on the PR. Also hardens live test gating (require QWEN_CODE_RUN_LIVE_TESTS=1) and increases crawler test timeout to 30s. * refactor(ci): simplify verification gate package discovery Replace 30-line inline Node script with the original one-liner `grep -oE '^packages/[^/]+'`. The Node script checked for package.json existence and test scripts, but `--if-present` already handles missing test scripts and all workspace dirs have package.json. Addresses design-review item #7. * fix(ci): tighten autofix changed-test gate	2026-07-05 02:32:04 +00:00
易良	b16baf1ffc	ci(release): optimize validation steps (#6133) ... * ci(release): optimize validation steps * fix(ci): address release validation review comments * fix(ci): document prepare skip contract * test(ci): cover prepare failure exit * fix(ci): prefix prepare error logs * fix(ci): keep release quality build artifacts * fix(ci): address release validation comments * fix(ci): preserve release publish hooks * test(ci): cover prepare failure paths * fix(ci): disable release coverage safely	2026-07-02 23:53:08 +00:00
jinye	ea536d361f	fix(cli): Handle ACP read_file for managed local paths (#6021) ... * fix(cli): handle ACP read_file local roots Allow ACP read_file calls to fall back to local reads for explicitly permitted local roots when the serve workspace boundary rejects them, and preserve useful messages for plain object read errors. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Add the missing getUserAutoMemoryRoot export to the acpAgent test core mock so the updated acpAgent import resolves under Vitest. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(acp): Narrow local read fallback temp roots Remove the broad OS temp directory from default read_file allow roots and ACP local read fallback roots. Keep qwen-managed temp roots readable and reuse the shared isSubpath helper after realpath resolution for ACP fallback containment. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: fix CI failure on PR #6021 Add the serve fast-path bundle check script and root npm script that the current CI workflow invokes. This mirrors the already-merged mainline check without pulling unrelated workflow or test config changes into this PR. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(cli): address ACP read error review feedback Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(cli): harden ACP error normalization Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: fix Windows CI path expectation (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * codex: address PR review feedback (#6021) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-06-30 11:15:49 +00:00