mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-07-10 01:29:17 +00:00
7732554805
Some checks are pending
Qwen Code CI / Classify PR (push) Waiting to run
Qwen Code CI / Lint (push) Blocked by required conditions
Qwen Code CI / Test (macos-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (ubuntu-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (windows-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Post Coverage Comment (push) Blocked by required conditions
Qwen Code CI / CodeQL (push) Blocked by required conditions
E2E Tests / E2E Test (Linux) - sandbox:docker (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none (push) Waiting to run
E2E Tests / E2E Test - macOS (push) Waiting to run
* feat(channels): add Feishu (Lark) channel adapter * fix(channels/feishu): fix webhook stop button, memory leak, spin-wait timeout, and reaction cleanup * fix(channels/feishu): fix security, stability and build issues from PR review * fix(channels/feishu): fix card lifecycle, streaming limits, and download safety from CR round 2 * fix(channels/feishu): harden webhook, card lifecycle, and disconnect cleanup from CR round 3 * fix(feishu): clarify stoppedMessages JSDoc to match actual cleanup behavior * fix(channels/feishu): handle post messages without language key wrapper in quote context * fix(channels/feishu): fix webhook signature bypass, stop-button double-send, and blockStreaming duplicates from CR round 4 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning * fix(channels/feishu): fix HMAC bypass, prompt injection, SSRF, and card lifecycle from CR round 5-6 Security: - Fix webhook HMAC bypass: use defineProperty(non-enumerable) for headers instead of prototype shadowing - Fix cross-user prompt injection: mark quoted content as untrusted with explicit marker - Fix SSRF: validate all Feishu IDs with FEISHU_ID_RE before URL interpolation in 6 endpoints - Fix safeSenderId regex: add hyphen to character class so ou_abc-def-123 is not rejected Card lifecycle: - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Fallback to plain message delivery when cardCreationFailed with accumulated text - Track creationTimer in CardSessionState so cleanupCard/disconnect can cancel orphaned card creation - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Preserve atPrefix in streaming truncation to prevent @mention visual snap - Account for suffix and fence reserve in truncation maxBody calculation - Clean up auxiliary maps after handleInbound when gate rejects the message - Clean up blockStreaming mode Map entries in onPromptEnd - Skip bare @mention without question text Markdown: - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning Defensive guards: - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection Tests: - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Assert cancelSession called in stop-button happy-path test * fix(channels/feishu): add request timeouts, token dedup, and harden file/quote sanitization * fix(channels/feishu): harden card lifecycle, webhook auth, and resource cleanup from CR round 7 * fix(channels/feishu): harden card lifecycle, mention handling, and error recovery
160 lines
7.6 KiB
JSON
160 lines
7.6 KiB
JSON
{
|
|
"name": "@qwen-code/qwen-code",
|
|
"version": "0.16.1",
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
},
|
|
"type": "module",
|
|
"workspaces": [
|
|
"packages/*",
|
|
"packages/channels/base",
|
|
"packages/channels/telegram",
|
|
"packages/channels/weixin",
|
|
"packages/channels/dingtalk",
|
|
"packages/channels/feishu",
|
|
"packages/channels/plugin-example"
|
|
],
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/QwenLM/qwen-code.git"
|
|
},
|
|
"config": {
|
|
"sandboxImageUri": "ghcr.io/qwenlm/qwen-code:0.16.1"
|
|
},
|
|
"scripts": {
|
|
"start": "cross-env node scripts/start.js",
|
|
"dev": "node scripts/dev.js",
|
|
"debug": "cross-env DEBUG=1 node --inspect-brk scripts/start.js",
|
|
"generate": "node scripts/generate-git-commit-info.js",
|
|
"generate:settings-schema": "node --import tsx/esm scripts/generate-settings-schema.ts",
|
|
"build": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" node scripts/build.js",
|
|
"build-and-start": "npm run build && npm run start",
|
|
"build:vscode": "node scripts/build_vscode_companion.js",
|
|
"build:all": "npm run build && npm run build:sandbox && npm run build:vscode",
|
|
"build:packages": "npm run build --workspaces",
|
|
"build:sandbox": "node scripts/build_sandbox.js",
|
|
"bundle": "npm run generate && node esbuild.config.js && node scripts/copy_bundle_assets.js",
|
|
"test": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test --workspaces --if-present --parallel",
|
|
"test:ci": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" npm run test:ci --workspaces --if-present --parallel && npm run test:scripts",
|
|
"test:scripts": "vitest run --config ./scripts/tests/vitest.config.ts",
|
|
"test:e2e": "cross-env VERBOSE=true KEEP_OUTPUT=true npm run test:integration:sandbox:none",
|
|
"test:integration:all": "npm run test:integration:sandbox:none && npm run test:integration:sandbox:docker && npm run test:integration:sandbox:podman",
|
|
"test:integration:sandbox:none": "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests",
|
|
"test:integration:sandbox:docker": "cross-env QWEN_SANDBOX=docker npm run build:sandbox && QWEN_SANDBOX=docker vitest run --root ./integration-tests",
|
|
"test:integration:sandbox:podman": "cross-env QWEN_SANDBOX=podman vitest run --root ./integration-tests",
|
|
"test:integration:sdk:sandbox:none": "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests --poolOptions.threads.maxThreads 2 sdk-typescript",
|
|
"test:integration:sdk:sandbox:docker": "cross-env QWEN_SANDBOX=docker npm run build:sandbox && QWEN_SANDBOX=docker vitest run --root ./integration-tests --poolOptions.threads.maxThreads 2 sdk-typescript",
|
|
"test:sdk:python": "python3 -m pytest -c packages/sdk-python/pyproject.toml packages/sdk-python/tests -q",
|
|
"test:integration:cli:sandbox:none": "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests cli",
|
|
"test:integration:cli:sandbox:docker": "cross-env QWEN_SANDBOX=docker npm run build:sandbox && QWEN_SANDBOX=docker vitest run --root ./integration-tests cli",
|
|
"test:integration:interactive:sandbox:none": "cross-env QWEN_SANDBOX=false vitest run --root ./integration-tests interactive",
|
|
"test:integration:interactive:sandbox:docker": "cross-env QWEN_SANDBOX=docker npm run build:sandbox && QWEN_SANDBOX=docker vitest run --root ./integration-tests interactive",
|
|
"test:terminal-bench": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests",
|
|
"test:terminal-bench:oracle": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t 'oracle'",
|
|
"test:terminal-bench:qwen": "cross-env VERBOSE=true KEEP_OUTPUT=true vitest run --config ./vitest.terminal-bench.config.ts --root ./integration-tests -t 'qwen'",
|
|
"lint": "eslint . --ext .ts,.tsx && eslint integration-tests",
|
|
"lint:fix": "eslint . --fix && eslint integration-tests --fix",
|
|
"lint:ci": "eslint . --ext .ts,.tsx --max-warnings 0 && eslint integration-tests --max-warnings 0",
|
|
"lint:sdk:python": "python3 -m ruff check --config packages/sdk-python/pyproject.toml packages/sdk-python",
|
|
"lint:all": "node scripts/lint.js",
|
|
"format": "prettier --experimental-cli --write .",
|
|
"typecheck": "npm run typecheck --workspaces --if-present",
|
|
"typecheck:sdk:python": "python3 -m mypy --config-file packages/sdk-python/pyproject.toml packages/sdk-python/src",
|
|
"smoke:sdk:python": "python3 packages/sdk-python/scripts/smoke_real.py",
|
|
"build:sdk:python": "python3 -m build packages/sdk-python",
|
|
"check-i18n": "npm run check-i18n --workspace=packages/cli",
|
|
"preflight": "npm run clean && npm ci && npm run format && npm run lint:ci && npm run build && npm run typecheck && npm run test:ci",
|
|
"prepare": "husky && npm run build && npm run bundle",
|
|
"prepare:package": "node scripts/prepare-package.js",
|
|
"package:hosted-installation": "node scripts/build-hosted-installation-assets.js",
|
|
"package:standalone": "node scripts/create-standalone-package.js",
|
|
"package:standalone:release": "node scripts/build-standalone-release.js",
|
|
"verify:installation-release": "node scripts/verify-installation-release.js",
|
|
"release:version": "node scripts/version.js",
|
|
"telemetry": "node scripts/telemetry.js",
|
|
"check:lockfile": "node scripts/check-lockfile.js",
|
|
"clean": "node scripts/clean.js",
|
|
"pre-commit": "node scripts/pre-commit.js"
|
|
},
|
|
"overrides": {
|
|
"ansi-regex": "6.2.2",
|
|
"cliui": {
|
|
"wrap-ansi": "7.0.0"
|
|
},
|
|
"baseline-browser-mapping": "^2.9.19",
|
|
"normalize-package-data": "^7.0.1",
|
|
"react": "^19.2.4",
|
|
"react-dom": "^19.2.4",
|
|
"@types/react": "^19.2.0",
|
|
"@types/react-dom": "^19.2.0"
|
|
},
|
|
"bin": {
|
|
"qwen": "dist/cli.js"
|
|
},
|
|
"files": [
|
|
"dist/",
|
|
"README.md",
|
|
"LICENSE"
|
|
],
|
|
"devDependencies": {
|
|
"@types/marked": "^5.0.2",
|
|
"@types/mime-types": "^3.0.1",
|
|
"@types/minimatch": "^5.1.2",
|
|
"@types/mock-fs": "^4.13.4",
|
|
"@types/shell-quote": "^1.7.5",
|
|
"@types/uuid": "^10.0.0",
|
|
"@vitest/coverage-v8": "^3.1.1",
|
|
"@vitest/eslint-plugin": "^1.3.4",
|
|
"@xterm/headless": "^5.5.0",
|
|
"@xterm/xterm": "^6.0.0",
|
|
"cross-env": "^7.0.3",
|
|
"esbuild": "^0.25.0",
|
|
"esbuild-plugin-wasm": "^1.1.0",
|
|
"eslint": "^9.24.0",
|
|
"eslint-config-prettier": "^10.1.2",
|
|
"eslint-plugin-import": "^2.31.0",
|
|
"eslint-plugin-license-header": "^0.8.0",
|
|
"eslint-plugin-react": "^7.37.5",
|
|
"eslint-plugin-react-hooks": "^5.2.0",
|
|
"glob": "^10.5.0",
|
|
"globals": "^16.0.0",
|
|
"husky": "^9.1.7",
|
|
"json": "^11.0.0",
|
|
"lint-staged": "^16.1.6",
|
|
"memfs": "^4.42.0",
|
|
"mnemonist": "^0.40.3",
|
|
"mock-fs": "^5.5.0",
|
|
"msw": "^2.10.4",
|
|
"npm-run-all": "^4.1.5",
|
|
"prettier": "^3.5.3",
|
|
"react-devtools-core": "^6.1.5",
|
|
"semver": "^7.7.2",
|
|
"strip-ansi": "^7.1.2",
|
|
"tsx": "^4.20.3",
|
|
"typescript-eslint": "^8.30.1",
|
|
"vitest": "^3.2.4",
|
|
"yargs": "^17.7.2"
|
|
},
|
|
"dependencies": {
|
|
"@testing-library/dom": "^10.4.1",
|
|
"ink": "^7.0.3",
|
|
"simple-git": "^3.28.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"@lydell/node-pty": "1.2.0-beta.10",
|
|
"@lydell/node-pty-darwin-arm64": "1.2.0-beta.10",
|
|
"@lydell/node-pty-darwin-x64": "1.2.0-beta.10",
|
|
"@lydell/node-pty-linux-x64": "1.2.0-beta.10",
|
|
"@lydell/node-pty-win32-arm64": "1.2.0-beta.10",
|
|
"@lydell/node-pty-win32-x64": "1.2.0-beta.10"
|
|
},
|
|
"lint-staged": {
|
|
"*.{js,jsx,ts,tsx}": [
|
|
"prettier --write",
|
|
"eslint --fix --max-warnings 0 --no-warn-ignored"
|
|
],
|
|
"*.{json,md}": [
|
|
"prettier --write"
|
|
]
|
|
}
|
|
}
|