* add http/async/function type
* fix url error
* resolve comment
* align cc non blocking error
* fix hookRunner for async
* fix(hooks): update hook type validation to support http and function types
- Change validated hook types from ['command', 'plugin'] to ['command', 'http', 'function']
- Add validation for HTTP hooks requiring url field
- Add validation for function hooks requiring callback field
- Add comprehensive test coverage for all hook type validations
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(hooks): align SSRF protection with Claude Code behavior
- Allow 127.0.0.0/8 (loopback) for local dev hooks
- Allow localhost hostname for local dev hooks
- Allow ::1 (IPv6 loopback) for local dev hooks
- Add 100.64.0.0/10 (CGNAT) to blocked ranges (RFC 6598)
- Update tests to match Claude Code's ssrfGuard.ts behavior
This fixes HTTP hooks failing to connect to local dev servers.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* refactor(hooks): align HTTP hook security with Claude Code behavior
- Add CRLF/NUL sanitization for env var interpolation (header injection)
- Implement combined abort signal (external signal + timeout)
- Upgrade SSRF protection to DNS-level with ssrfGuard
- Allow loopback (127.0.0.0/8, ::1) for local dev hooks
- Block CGNAT (100.64.0.0/10) and IPv6 private ranges
- Increase default HTTP hook timeout to 10 minutes
- Fix VS Code hooks schema to support http type
- Add url, headers, allowedEnvVars, async, once, statusMessage, shell fields
- Note: "function" type is SDK-only (callback cannot be serialized to JSON)
* feat(hooks): enhance Function Hook with messages, skillRoot, shell, and matcher support
- Add MessagesProvider for automatic conversation history passing to function hooks
- Add FunctionHookContext with messages, toolUseID, and signal
- Add skillRoot support for skill-scoped session hooks
- Add shell parameter support for command hooks (bash/powershell)
- Add regex matcher support for hook pattern matching
- Add statusMessage to CommandHookConfig
- Change default function hook timeout from 60s to 5s
- Add comprehensive unit tests for all new features
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* add session hook for skill
* fix function hook parsing
* refactor ui for http hook/async hook/function hook
* update doc and add integration test
* change telemetryn type and refactor SSRF
* fix project level bug
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* feat(auth): discontinue Qwen OAuth free tier (2026-04-15 cutoff)
The Qwen OAuth free tier has reached its end-of-life date. This updates
all client-side messaging, blocks new OAuth signups, and guides existing
users to alternative providers.
* fix(test): add getModelsConfig mock and update QWEN_OAUTH test expectations
- Add getModelsConfig() to Config mocks in gemini.test.tsx (3 failures)
- Update validateNonInterActiveAuth test to expect exit for QWEN_OAUTH
since validateAuthMethod now returns an error for discontinued free tier
feat(cli): add startup performance profiler (#3219)
Add a lightweight startup profiler activated via QWEN_CODE_PROFILE_STARTUP=1.
When enabled, collects performance.now() timestamps at 7 key phases in main()
and writes a JSON report to ~/.qwen/startup-perf/. Also records
process.uptime() at T0 to capture module loading time not covered by
checkpoint-based measurement.
Key design decisions:
- Only profiles inside sandbox child process to avoid duplicate reports
- initStartupProfiler() is idempotent (resets state on each call)
- Filename uses report.sessionId for consistency with JSON content
- Zero overhead when disabled (single env var check)
Initial measurement: module loading ~1342ms (94%), main() ~85ms (6%),
confirming barrel exports and eager dependency loading as primary
optimization targets for #3011.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Merge coder-model and qwen3.5-plus into a single coder-model with vision capability
- Remove vlmSwitchMode CLI argument and experimental.vlmSwitchMode setting
- Remove useVisionAutoSwitch hook and inline image format checking into useGeminiStream
- Remove ModelSwitchDialog and related vision switch UI components
- Update all related tests to reflect the simplified model structure
- Set DEFAULT_QWEN_MODEL to coder-model
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Replace ConsolePatcher with centralized debugLogger utility
- Refactor errorReporting to use debugLogger instead of file-based reporting
- Remove user-facing console message components:
- Delete ConsolePatcher.ts, useConsoleMessages.ts/hook
- Delete ConsoleSummaryDisplay.tsx, DetailedMessagesDisplay.tsx
- Update all tests in packages/core and packages/cli:
- Mock debugLogger where needed
- Remove assertions for console output on non-critical errors
- Keep debugLogger assertions for fatal/network errors
- Use HOME directory mocking for hermetic file system tests
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Remove SmartEditTool and its associated LLM edit fixer utilities
- Remove ClearcutLogger and related telemetry infrastructure
- Remove useSmartEdit configuration option from settings schema
- Add deprecation warning for users with existing useSmartEdit config
- Clean up all related tests and mocks
The Smart Edit tool was designed to provide flexible matching and LLM-based
correction for edit operations. However, current models are now capable
of effectively using the standard Edit tool without these optimizations,
and the Smart Edit tool lacked comprehensive testing coverage.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
