mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-07-26 09:24:35 +00:00
7732554805
Some checks are pending
Qwen Code CI / Classify PR (push) Waiting to run
Qwen Code CI / Lint (push) Blocked by required conditions
Qwen Code CI / Test (macos-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (ubuntu-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (windows-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Post Coverage Comment (push) Blocked by required conditions
Qwen Code CI / CodeQL (push) Blocked by required conditions
E2E Tests / E2E Test (Linux) - sandbox:docker (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none (push) Waiting to run
E2E Tests / E2E Test - macOS (push) Waiting to run
* feat(channels): add Feishu (Lark) channel adapter * fix(channels/feishu): fix webhook stop button, memory leak, spin-wait timeout, and reaction cleanup * fix(channels/feishu): fix security, stability and build issues from PR review * fix(channels/feishu): fix card lifecycle, streaming limits, and download safety from CR round 2 * fix(channels/feishu): harden webhook, card lifecycle, and disconnect cleanup from CR round 3 * fix(feishu): clarify stoppedMessages JSDoc to match actual cleanup behavior * fix(channels/feishu): handle post messages without language key wrapper in quote context * fix(channels/feishu): fix webhook signature bypass, stop-button double-send, and blockStreaming duplicates from CR round 4 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning * fix(channels/feishu): fix HMAC bypass, prompt injection, SSRF, and card lifecycle from CR round 5-6 Security: - Fix webhook HMAC bypass: use defineProperty(non-enumerable) for headers instead of prototype shadowing - Fix cross-user prompt injection: mark quoted content as untrusted with explicit marker - Fix SSRF: validate all Feishu IDs with FEISHU_ID_RE before URL interpolation in 6 endpoints - Fix safeSenderId regex: add hyphen to character class so ou_abc-def-123 is not rejected Card lifecycle: - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Fallback to plain message delivery when cardCreationFailed with accumulated text - Track creationTimer in CardSessionState so cleanupCard/disconnect can cancel orphaned card creation - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Preserve atPrefix in streaming truncation to prevent @mention visual snap - Account for suffix and fence reserve in truncation maxBody calculation - Clean up auxiliary maps after handleInbound when gate rejects the message - Clean up blockStreaming mode Map entries in onPromptEnd - Skip bare @mention without question text Markdown: - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning Defensive guards: - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection Tests: - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Assert cancelSession called in stop-button happy-path test * fix(channels/feishu): add request timeouts, token dedup, and harden file/quote sanitization * fix(channels/feishu): harden card lifecycle, webhook auth, and resource cleanup from CR round 7 * fix(channels/feishu): harden card lifecycle, mention handling, and error recovery |
||
|---|---|---|
| .. | ||
| channels | ||
| _meta.ts | ||
| approval-mode.md | ||
| arena.md | ||
| auto-mode.md | ||
| checkpointing.md | ||
| code-review.md | ||
| commands.md | ||
| dual-output.md | ||
| followup-suggestions.md | ||
| headless.md | ||
| hooks.md | ||
| language.md | ||
| lsp.md | ||
| markdown-rendering.md | ||
| mcp.md | ||
| memory.md | ||
| sandbox.md | ||
| scheduled-tasks.md | ||
| skills.md | ||
| status-line.md | ||
| structured-output.md | ||
| sub-agents.md | ||
| tips.md | ||
| token-caching.md | ||
| tool-use-summaries.md | ||
| worktree.md | ||