qwen-code/scripts
易良 11e629b3a1
perf(export): split the transcript renderer's embedded CSS into a versioned asset (#11485)
* perf(export): split the transcript renderer's embedded CSS into a versioned asset

The export renderer carried the web-shell component stylesheet as a ~2.3 MB
string literal, so every reader parsed and compiled 4.1 MB of JS (56% of it dead
CSS) before a transcript could render. Lift that literal out at export build
time into a version-pinned, SRI-protected export-transcript-document.css served
from unpkg and loaded via a nonce-bearing <link>, dropping the renderer JS to
~1.83 MB.

The transform is an esbuild onLoad plugin in the web-templates export build that
strips the injected CSS constant from web-shell's dist/transcript.js; web-shell
source and runtime behavior are untouched. The document's fail-closed load-error
path is extended to the stylesheet so a missing CSS asset fails the same way as
a missing renderer.

* fix(export): match the transcript CSS entry on Windows paths too

esbuild hands plugin callbacks the platform-native absolute path, so the
extract-transcript-css `onLoad` filter never matched on Windows: the callback
did not run, `extractedTranscriptCss.css` stayed undefined, and the mandatory
extraction guard below aborted the build. That build is not platform-gated —
`scripts/prepare.js` runs it from `prepare`, so `npm ci` itself would fail on
every Windows contributor and on the windows-latest legs of test_windows and
desktop-release.

Widen the separator to `[\\/]`, keeping the `transcript\.js$` tail so the
barred `web-shell/dist/index.js` package root still does not match. The filter
moves to transcript-css-entry.mjs because build.mjs is a top-level-await script
with no harness — the same reason scripts/sdk-node-exporter-stub.js exists — so
scripts/tests/transcript-css-entry-filter.test.js can pin both separators.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Patrol-Run: qwen-pr-closeout/jmtufhms2u4

* fix(export): latch a stylesheet failure ahead of the parser block

The `<link id="transcript-stylesheet">` sits in `<head>` while the `window`
error listener that catches its failure is registered by an inline script in
`<body>`. Chromium parser-blocks that script on the pending stylesheet, so when
the CSS failure settles first the error event is dispatched with no listener to
receive it: nothing marks the render as failed, both renderComplete guards in
document-main.tsx pass, React mounts the transcript without any of the
component CSS, and the requestAnimationFrame stamps
`data-render-complete="true"`. The reviewer measured this fail-open above
roughly 2.1 MB of document HTML (272 of the 1,000 permitted blocks) for a 404,
an SRI rejection, a truncated body and a destroyed socket alike, and fail-closed
for a *late* failure — so size, not failure kind, decides it.

Latch the failure in `<head>` before the `<link>` is parsed and act on the latch
from the existing body IIFE. The head script only records: `showLoadError()`
writes `document.body.dataset` and `#app`, neither of which exists while the
parser is still in `<head>`. It carries `nonce="__EXPORT_NONCE__"` because the
document CSP allows no inline script, which is safe — `formatters/html.ts:53`
replaces every occurrence. The listener is capture-phase because resource error
events do not bubble.

Not the `link.sheet === null` variant: the reviewer measured `sheet` non-null
for a 404, a truncated body and a destroyed socket, so it only detects SRI
rejection.

scripts/tests/export-transcript-document-template.test.js pins the position,
the nonce, the capture phase and the record-only shape; all five cases go red
against the unpatched template. The behavioural witness (real Chromium, large
document, instant CSS abort) belongs to the playwright transcript gate, which
is out of budget on this host.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Patrol-Run: qwen-pr-closeout/jmtufhms2u4

* fix(scripts): name the missing export renderer assets, pin the CSS gate

The bundle copy became all-or-nothing over two artifacts but its `else` warning
still named only the renderer, so the one new way to reach that branch — a tree
built before the split, then `npm run bundle`d without rebuilding web-templates,
which has the JS and no CSS — told the operator to go looking for a
`export-transcript-document.js` that was sitting right there, and silently
discarded it. List the paths that are actually absent, matching the sibling Web
Shell warning twenty lines above. Stays warn-and-skip: prepare-package.js is the
release gate.

Also pin that release gate. Every fixture that reached `preparePackage` staged
`dist/export-transcript-document.css` unconditionally, so deleting the new
required-path entry left the whole test:scripts lane green; a release built with
`npm ci --ignore-scripts` would then publish documents whose stylesheet 404s on
unpkg for that version. `verifyBundleArtifacts` reports through console.error +
process.exit(1) rather than a throw, so the new case stubs exit instead of
copying the audio-capture sibling's `toThrow` idiom.

Both cases were flip-checked: restoring the old warning text, and deleting the
CSS line from prepare-package.js, each turn their case red.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Patrol-Run: qwen-pr-closeout/jmtufhms2u4

* fix(export): pin the stylesheet-failure id contract and sync the design docs

The <head> latch, the body listener and the <link> each spell
'transcript-stylesheet' independently and nothing compared them, so renaming
either listener's id left the whole suite green while the latch recorded
nothing - reinstating the fail-open the latch was added to close. Derive the id
from the <link> and assert both listeners compare against it. Verified red under
both mutations: latch id -> 'transcript-renderer' (1 failed | 5 passed), and the
mirror with the body listener's id wrong and the latch intact (same).

Both design docs still specified the two shapes the previous round replaced: the
forward-slash-only onLoad filter that never matches on Windows, and the
body-listener-only fail-closed extension. Section 1 now quotes the shipped
TRANSCRIPT_CSS_ENTRY_FILTER and names transcript-css-entry.mjs, section 2
describes the <head> latch (position, nonce, capture phase, record-only),
section 3 names the module-level render guard, and "Files affected" lists the
three omitted files. EN and zh-CN are updated in the same commit.

Also correct the shape-guard comment in build.mjs: the document nonces every
<style> created through document.createElement, so the CSP would not block an
un-stripped duplicate, and a 367-byte regrowth stays inside both byte budgets.
That throw is the only guard on the duplicate-injection path.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Patrol-Run: qwen-pr-closeout/jmtuo29vduf

* fix(export): close out transcript CSS review comments

* fix(export): tighten transcript CSS closeout

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

---------

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
2026-09-10 07:15:32 +00:00
..
codemod feat(opentui): bundle assets, CI matrix and parity tooling (Batch 7) (#10770) 2026-09-02 08:36:20 +00:00
installation feat(release): add gated bun/OpenTUI preview flavor to standalone releases (#10814) 2026-09-02 12:01:56 +00:00
lib refactor(ci): extract release workflow scripts (#11165) 2026-09-08 07:09:09 +00:00
tests perf(export): split the transcript renderer's embedded CSS into a versioned asset (#11485) 2026-09-10 07:15:32 +00:00
tui-parity fix(cli): Align OpenTUI mid-turn submit and exit with ink (#10883) 2026-09-03 09:31:05 +00:00
acp-http-smoke.mjs feat(daemon): merge daemon-mode feature batch into main (#4490) 2026-06-12 00:34:49 +08:00
assert-release-version.mjs refactor(ci): extract release workflow scripts (#11165) 2026-09-08 07:09:09 +00:00
audit-runtime-critical.js ci: keep the critical-audit gate honest when npm cannot answer (#7743) 2026-07-26 06:59:13 +00:00
benchmark-api-latency.mjs ci: make the Prettier lane a real gate (#11117) 2026-09-07 00:44:01 +00:00
build-hosted-installation-assets.js fix(installer): auto-detect SYSTEM account and default PATH scope to machine (#4903) 2026-06-10 21:02:10 +08:00
build-standalone-release.js feat(release): add gated bun/OpenTUI preview flavor to standalone releases (#10814) 2026-09-02 12:01:56 +00:00
build.js refactor!: retire @qwen-code/webui (#9812) 2026-09-05 09:13:54 +00:00
build_package.js fix(build): clean stale outputs before tsc --build to prevent TS5055 (#4453) 2026-05-23 23:06:31 +08:00
build_sandbox.js fix(release): stop hiding sandbox build failures and check the prepared package early (#10784) 2026-09-02 11:38:33 +00:00
build_vscode_companion.js Sync upstream Gemini-CLI v0.8.2 (#838) 2025-10-23 09:27:04 +08:00
check-build-status.js fix(cli): scope startup warnings to dev sessions (#8456) 2026-08-29 13:22:34 +00:00
check-core-subpath-exports.mjs perf(cli): import core modules directly instead of the package root (#10957) 2026-09-06 11:21:50 +00:00
check-desktop-isolation.js fix(live): restore Live Host after desktop removal (#9994) 2026-08-25 12:32:31 +00:00
check-i18n.ts fix(cli): localize approval mode UI labels (#6592) 2026-07-11 00:07:03 +00:00
check-lockfile.js perf(dev): add pnpm worktree bootstrap foundation (#10449) 2026-09-08 03:07:40 +00:00
check-serve-fast-path-bundle.js refactor(core,cli): rename generic Gemini identifiers to Llm (#10124) 2026-08-28 03:05:49 +00:00
check-tui-dep-direction.mjs feat(cli): OpenTUI migration infra batch — locked deps, dependency-direction arch check, framework-neutral streaming model (#10134) 2026-08-28 02:44:46 +00:00
clean-package-build-artifacts.js feat(channels): add DingTalk Workspace channel (#9394) 2026-08-25 06:40:47 +00:00
clean.js feat(desktop): Add desktop app package with Qwen ACP SDK integration (#3778) 2026-06-11 21:57:20 +08:00
cli-entry.js fix(cli): preserve Qwen Review startup version in footers (#8431) 2026-08-04 14:58:56 +00:00
copy_bundle_assets.js perf(export): split the transcript renderer's embedded CSS into a versioned asset (#11485) 2026-09-10 07:15:32 +00:00
copy_files.js refactor(core): move review skill incident narratives to DESIGN.md (#8499) 2026-08-04 12:41:18 +00:00
create-standalone-package.js perf(export): split the transcript renderer's embedded CSS into a versioned asset (#11485) 2026-09-10 07:15:32 +00:00
create_alias.sh fix: ambiguous literals (#461) 2025-08-27 15:23:21 +08:00
daemon-dev.js feat(serve): add workspace-scoped Skills runtime (#10697) 2026-09-05 08:03:24 +00:00
dev.js perf(cli): import core modules directly instead of the package root (#10957) 2026-09-06 11:21:50 +00:00
esbuild-shims.js perf(cli): code-split lowlight to cut startup V8 parse cost (#4070) 2026-05-15 17:26:18 +08:00
generate-changelog.js feat(release): user-facing bilingual digest for release notes (#9216) 2026-08-17 00:12:04 +00:00
generate-git-commit-info.js # 🚀 Sync Gemini CLI v0.2.1 - Major Feature Update (#483) 2025-09-01 14:48:55 +08:00
generate-release-notes.js feat(release): user-facing bilingual digest for release notes (#9216) 2026-08-17 00:12:04 +00:00
generate-settings-schema.ts revert: remove local PR verification gate (#7031) 2026-07-16 11:24:38 +00:00
get-release-version.js refactor(ci): extract release workflow scripts (#11165) 2026-09-08 07:09:09 +00:00
lint.js ci: make the Prettier lane a real gate (#11117) 2026-09-07 00:44:01 +00:00
local_telemetry.js Merge tag 'v0.3.0' into chore/sync-gemini-cli-v0.3.0 2025-09-11 16:26:56 +08:00
measure-flicker.mjs ci: make the Prettier lane a real gate (#11117) 2026-09-07 00:44:01 +00:00
pnpm-package.js perf(dev): add pnpm worktree bootstrap foundation (#10449) 2026-09-08 03:07:40 +00:00
pre-commit.js Sync upstream Gemini-CLI v0.8.2 (#838) 2025-10-23 09:27:04 +08:00
prepare-package.js perf(export): split the transcript renderer's embedded CSS into a versioned asset (#11485) 2026-09-10 07:15:32 +00:00
prepare.js feat(web-shell): git status chip, visual working-tree diff, and sidebar git status (#7054) 2026-07-18 10:06:07 +00:00
pty-e2e.sh feat(opentui): bundle assets, CI matrix and parity tooling (Batch 7) (#10770) 2026-09-02 08:36:20 +00:00
release-script-utils.js feat(installer): add standalone hosted install and uninstall flow (#3828) 2026-05-21 11:57:10 +08:00
review-audit-layers.mts feat(review): cover modeled-system defect layers in the reverse audit (#8956) 2026-08-12 18:15:11 +00:00
run-java-daemon-sdk-e2e.ts ci: reduce SDK Java runner queueing (#8441) 2026-08-03 16:21:05 +00:00
sandbox_command.js fix(scripts): avoid shell injection in sandbox command detection (#6108) 2026-07-01 16:20:40 +08:00
sdk-node-exporter-stub.js chore(deps): Clear high-severity CVE baseline and harden the security gate (#9584) 2026-08-21 07:43:32 +00:00
setup-worktree.js perf(dev): add pnpm worktree bootstrap foundation (#10449) 2026-09-08 03:07:40 +00:00
sign-release.sh feat(cli): add standalone auto-update support (#4629) 2026-06-04 22:53:12 +08:00
start.js fix(cli): scope startup warnings to dev sessions (#8456) 2026-08-29 13:22:34 +00:00
telemetry.js feat(core): support QWEN_HOME env var to customize config directory (#2953) 2026-05-09 15:51:52 +08:00
telemetry_gcp.js fix(mcp): update OAuth client names and improve MCP commands 2026-02-08 10:46:48 +08:00
telemetry_utils.js feat(core): support QWEN_HOME env var to customize config directory (#2953) 2026-05-09 15:51:52 +08:00
test-rewind-e2e.sh fix(test): update rewind E2E Test 1 assertion after isRealUserTurn fix (#3622) 2026-04-26 06:49:42 +08:00
test-windows-paths.js chore: consistently import node modules with prefix (#3013) 2025-08-25 20:11:27 +00:00
tmux-compare.sh feat(opentui): bundle assets, CI matrix and parity tooling (Batch 7) (#10770) 2026-09-02 08:36:20 +00:00
unused-keys-only-in-locales.json feat: add /diff command and git diff statistics utility (#3491) 2026-05-10 11:15:59 +08:00
upload-aliyun-oss-assets.js ci: host PR evidence outside Git (#9985) 2026-08-29 04:36:57 +00:00
verify-capture.mjs refactor!: retire @qwen-code/webui (#9812) 2026-09-05 09:13:54 +00:00
verify-installation-release.js feat(release): add gated bun/OpenTUI preview flavor to standalone releases (#10814) 2026-09-02 12:01:56 +00:00
version.js feat(external-context): Publish the Mem0 Extension package (#10653) 2026-09-01 22:12:00 +00:00
vitest-global-setup.js feat(channels): add DingTalk Workspace channel (#9394) 2026-08-25 06:40:47 +00:00
workspaces.js ci: give every workspace the shared-pool test timeout, not just five (#10915) 2026-09-07 09:02:39 +00:00