mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-14 19:24:54 +00:00
e9db70a072
* feat(cli): add TUI image display tool * fix(cli): report terminal image rendering failures * fix(cli): disable Kitty placeholders in Warp * fix(cli): constrain terminal image previews * fix(core): preserve fork image tool cache prefix * fix(cli): address display_image review feedback (#8217) Add the missing DisplayImage zh/zh-TW locale entries (and en for parity) that broke the i18n guard test, detect chafa via a PATH lookup instead of a synchronous probe render during display_image execution, and reject truncated PNGs by reading the full 24-byte header before reporting success. * fix(web-shell): add display_image to tool display contract (#8217) * test(cli): cover display image validation edges * fix(cli): harden chafa executable lookup (#8217) Resolve chafa through the mermaid renderer's hardened findExecutable and spawn the resolved path, so a project-local node_modules/.bin/chafa is never executed unless the user opted in. display_image is a non-prompting Read tool, so the previous bare-name PATH resolution allowed arbitrary code execution from a malicious repository. Also add review-requested coverage: isTerminalImageDisplay routing, the truncated-PNG rejection branch, the chafa stderr fallback, and the Kitty re-emit dedup guard. * fix(cli): address TUI image display review feedback (#8217) - Cache rendered terminal images (bounded LRU keyed on path, mtime, size, shape, and renderer) so a terminal resize or a restored session no longer re-reads the file or re-spawns chafa for every visible image. - Reject cmd.exe metacharacters in the model-supplied path before spawning chafa through a shell, closing a command-injection surface on Windows .cmd/.bat shims. - Bound a failing chafa's stderr to a capped first line before rendering it into permanent scrollback. - Enforce the main-agent-only display_image ban inside the tool execution (isInForkExecution) and fail resolveForkExecutionAllowedTools closed when display_image is advertised without a concrete allowlist. - Move the fileName computation to its use site, drop misleading awaits on the synchronous renderer, and add Kitty/Ghostty detection plus renderer cache, truncation, and shell-metacharacter tests. * fix(cli): preserve color in chafa image fallback * feat(cli): render images directly in Warp * fix(cli): disable native images in Warp * test(cli): cover chafa shell path guard * fix(cli): skip re-transmitting Kitty image payload on remount (#8217) --------- Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen Code Bot <qwen-code-bot@users.noreply.github.com> Co-authored-by: Qwen Code Autofix <qwen-code-autofix@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ink+7.0.3.patch | ||