- fix: sanitize remote filenames with basename() and isolate uploads
in UUID subdirs to prevent path traversal and collision (#2-4, #27)
- fix: use crypto.randomInt() for pairing codes instead of Math.random() (#5)
- fix: pass config.sessionScope instead of hardcoded 'user' (#6);
add per-channel scope overrides via setChannelScope() for startAll (#7)
- fix: removeSession now returns removed session IDs and persists
when chatId is provided (#8)
- fix: /clear only removes the cleared session from instructedSessions,
not all sessions (#9)
- fix: DingTalk @mention stripping now removes only the first mention
instead of all mentions (#10)
- fix: remove dead TELEGRAF_COMMANDS Set and its guard (#13)
- fix: WeChat cursor saved after message processing, not before (#14)
- fix: crash recovery uses time-window counting instead of resettable
counter to prevent infinite restart loops (#17)
- fix: call channel.disconnect() before exit on crash exhaustion (#18)
- Add new npm extension installation channel via scoped packages (@scope/name)
- Implement npm.ts module with registry resolution, authentication, and download logic
- Support version pinning, dist-tags (latest, beta), and custom registries
- Handle private registry auth via NPM_TOKEN env var and .npmrc _authToken entries
- Update CLI install command with --registry flag for npm extensions
- Add comprehensive tests for npm package parsing and registry operations
- Update documentation for releasing and installing from npm registries
- Integrate npm updates into extension manager and update checking flow
This enables teams using npm for package distribution to publish Qwen Code extensions through their existing infrastructure, with full support for private registries and access control.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add ExtensionChannelConfig interface for declaring channels in extension manifests
- Add loadChannelsFromExtensions() to discover and register channel plugins from active extensions
- Integrate extension channel loading into channel start commands
This enables extensions to contribute new channel types (e.g., Telegram, Slack) without modifying core code.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Refactor channel system to use a formal plugin interface:
- Add ChannelPlugin interface to @qwen-code/channel-base (channelType,
displayName, requiredConfigFields, createChannel factory)
- Each built-in adapter (Telegram, WeChat, DingTalk) exports a plugin object
- Replace hardcoded if/else factory with a Map-based channel registry
- Config validation now uses plugin's requiredConfigFields dynamically
- ChannelType changed from fixed union to string for extensibility
- Multi-channel mode now picks model from first channel config
This is the foundation for external plugin support — built-in channels
go through the exact same code path that third-party plugins will use.
- Add @qwen-code/channel-dingtalk package with stream-based bot integration
- Support clientId/clientSecret authentication for DingTalk
- Add message deduplication and group chat mention handling
- Update ChannelConfig type to include dingtalk channel type
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add `qwen channel status` to check running service info
- Add `qwen channel stop` to gracefully stop the service
- Add PID file tracking to prevent duplicate service instances
- Update documentation with new commands and usage
This enables users to manage the channel service from another terminal
without needing to use Ctrl+C on the foreground process.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add session persistence to SessionRouter for crash recovery
- Add loadSession method to AcpBridge for restoring sessions
- Add ChannelBaseOptions to support external router injection
- Refactor start.ts to support both standalone and gateway modes
- Extract config utilities into separate module
This enables channels to recover sessions after bridge crashes and
supports running multiple channels under a gateway process.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add model configuration option for channel-specific model selection
- Support base64-encoded images in prompts via AcpBridge
- Add media utilities for WeChat/Weixin channel
- Update settings schema for model configuration
Enables channels to process images and use custom models.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add GroupGate class for group access control with three policies:
disabled (default), allowlist, and open
- Implement mention gating: bot only responds when @mentioned or replied to
in groups (configurable per-group)
- Extend Envelope type with isGroup, isMentioned, isReplyToBot fields
- Update TelegramAdapter to detect group context and mentions
- Add comprehensive documentation for group chat setup and troubleshooting
This enables using Qwen Code bots in Telegram groups with fine-grained
access control and mention-based activation to prevent noise.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add PairingStore for managing pending requests and approved users
- Update SenderGate to support pairing policy with code generation
- Add CLI commands: `qwen channel pairing list/approve`
- Document pairing flow with rules and usage examples
This allows unknown senders to request access via a pairing code
that the bot operator approves through the CLI.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Validate required fields (type, token) with clear error messages
- Prepend channel instructions to first prompt of each session
- SessionRouter respects sessionScope (user/thread/single) for routing keys
Implements the channels infrastructure for connecting external messaging
platforms to Qwen Code via ACP. Phase 1 supports plain text round-trip:
Telegram user sends message -> AcpBridge -> qwen-code --acp -> response
back to Telegram.
New packages:
- @qwen-code/channel-base: AcpBridge, SessionRouter, SenderGate, ChannelBase
- @qwen-code/channel-telegram: TelegramAdapter using telegraf
CLI: `qwen channel start <name>` reads from settings.json channels config,
spawns ACP agent, connects to Telegram via polling.
- Added a new reconnect command to the MCP CLI.
- Implemented auto-reconnect functionality in DiscoveredMCPToolInvocation to handle connection errors with retry logic.
- Enhanced tests to cover reconnect scenarios and ensure reliability during connection failures.
- Automatically detect 'http' transport when commandOrUrl starts with http:// or https://
- Default to 'stdio' transport for non-URL commands
- Explicit --transport flag still takes precedence over auto-detection
- Update help text to indicate auto-detection capability
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Replace ConsolePatcher with centralized debugLogger utility
- Refactor errorReporting to use debugLogger instead of file-based reporting
- Remove user-facing console message components:
- Delete ConsolePatcher.ts, useConsoleMessages.ts/hook
- Delete ConsoleSummaryDisplay.tsx, DetailedMessagesDisplay.tsx
- Update all tests in packages/core and packages/cli:
- Mock debugLogger where needed
- Remove assertions for console output on non-critical errors
- Keep debugLogger assertions for fatal/network errors
- Use HOME directory mocking for hermetic file system tests
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Shows warning when installing Gemini CLI extensions to set user expectations
about potential compatibility differences.
- Keeps isGeminiExtensionConfig validation intact (no skipped checks)
- Zero UI in core package (warning only in CLI layer via consent.ts)
- Uses t() for internationalization
- Warning appears in consent prompt before installation
Fixes: #1621
- Add skills and agents sections to extensionToOutputString() output
- Implement full i18n support for all extension info labels
- Add translations for en, zh, de, ru languages
- Display skill names and agent names in extension list command
- Add /extensions detail command to show extension details
- Allow underscores and dots in extension names
- Fix contextFileName empty array handling to use default QWEN.md
- Fix marketplace extension clone to use correct source URL
- Add inline parameter to extensionToOutputString
- Add comprehensive tests for all changes
