* feat(cli): add daemon-owned Local Control service Local Control is implemented twice today — once in the CLI, once as an 830-line Rust TCP proxy in the Tauri shell — with two divergent security models. This adds the daemon-side service both can collapse onto. The Rust proxy exists only because `qwen serve` fixes its bind address at startup and cannot add a listener later; everything it does (Host/Origin rewriting, CRLF rejection, connection caps) is compensation for that one fact. `LocalControlService` attaches a second `http.Server` over the same Express app at runtime, so there is no hop to rewrite. Phases 1-3 of docs/plans/2026-08-13-local-control-consolidation.md: - Listener identity tagged on the `http.Server`, resolved per request, so credentials scope to the listener a request arrived on. - `CredentialStore` replaces `bearerAuth`'s single pre-hashed token. The runtime token is rejected on the LAN listener and the pairing token on loopback — the invariant the Rust proxy enforced by rejecting requests carrying the runtime token. Fixes the CLI path handing the LAN the full-strength daemon token with no revocation short of restart. - `hostAllowlist` now gates the LAN listener against its advertised authority. Previously it opted out entirely off loopback, leaving the CLI path with no DNS-rebinding defense. - `MutableOriginAllowlist` lets the LAN origin be added and removed at runtime; the middleware is still installed once. Empty-allowlist behavior is identical to the `denyBrowserOriginCors` wall it replaces. - ACP WS upgrade tracks a set of servers instead of one, and scopes the subprotocol credential the same way as the REST gate. - LAN selection advertises private/link-local IPv4 only, and surfaces ambiguity to the caller instead of failing (Rust) or emitting a QR per interface (CLI). Refs #9075 * feat(cli): wire Local Control into the daemon boot sequence Constructs the service in `createServeApp`, where the credential store and the CORS allowlist it mutates already live, and publishes it on `app.locals` alongside `acpHandle` — the channel `runQwenServe` already uses to reach into the built app for lifecycle work. - `bearerAuth` now takes the listener-scoped `CredentialStore`, and the ACP WS mount takes the same one so the `qwen-bearer.*` subprotocol cannot sidestep the scoping the REST gate enforces. - The CORS middleware is installed unconditionally over a `MutableOriginAllowlist`. With no `--allow-origin` this returns the same 403 envelope as the `denyBrowserOriginCors` wall it replaces, so the default posture is unchanged. - Daemon teardown disables Local Control before disposing the ACP handle, since detaching the LAN listener's upgrade registration goes through it. Token revocation and origin removal are synchronous, so they complete even though the enclosing dispose scope cannot await the socket close. - The LAN listener honors `--tls-cert` / `--tls-key`, reading them at enable time so a renewed certificate is picked up. Serving plaintext off a daemon deliberately put behind TLS would downgrade the more exposed of the two surfaces; `status.encrypted` reports which it is. Refs #9075 * feat(cli): repoint --local-control at the daemon service The flag stops being a second implementation and becomes a caller. Previously `--local-control` commandeered the daemon: it bound to `0.0.0.0`, generated a token that WAS the daemon token, and rewrote the origin allowlist — which is why it conflicted with `--token`, `--hostname`, `--allow-origin`, and an ephemeral port. The daemon now owns a separate LAN listener with a separate revocable credential, so none of those are in tension. A daemon can serve authenticated loopback and run a Local Control session at the same time, and `--no-web` is the only remaining conflict. - `localControlUrls` is deleted. Its "every non-internal IPv4" policy is the bug the service's private/link-local selection replaces; it would put a VPN or public address in a QR code. - Ambiguous multi-network hosts get `--local-control-address <ip>` instead of a QR per interface. - Sleep inhibition moves into the service, so it is held while the LAN listener is up and released when it goes down rather than for the lifetime of the process. - The pairing line now reports actual sleep-inhibition and encryption state instead of asserting the common case. - `RunHandle.getLocalControl()` reaches the service; a getter because the runtime app is mounted after the listener is up. Refs #9075 * fix(cli): harden daemon-owned Local Control * fix(cli): flush Local Control disable response * feat(desktop): move Local Control into Settings * fix(local-control): close listener lifecycle gaps * fix(cli): resolve local control review comments * fix(local-control): align route lifecycle * fix(serve): close local control review gaps * fix(serve): close Local Control QR and bridge-filter review blockers QR rendering in the Local Control routes is now best-effort: an over-capacity pairing URL (the target deep-link is caller-influenced) no longer turns enable/status into a 500 while the LAN listener stays live, which wedged the Web Shell card with no disable path. The interface denylist also stops rejecting physical LAN bridges (br0, Windows "Network Bridge") and only filters the virtual bridge shapes (Docker br-<hex>, macOS bridge<N>), matching the deleted Rust filter's per-platform behavior. Adds regression tests for both. * fix(serve): close round-5 Local Control review findings - Card: reconcile the selected LAN address on every status update, so a stale selection cannot survive a network change when only one candidate remains (the selector is hidden in that case and gave no affordance). - Interface filter: fold the hex run into the Docker bridge token (br-[0-9a-f]+) so bridge IDs starting with a letter stop escaping the shared boundary check. - LAN listener: drop the whole-request timeout budget; Node never resets it on body chunks, so it 408'd phones trickling large uploads through the shared Express app. Header and keep-alive timeouts stay. - Copy: Ctrl+C ends the whole daemon, not just Local Control (design doc, terminal banner, --local-control description). - Accessibility: aria-live on the card, role=alert on its error line. - Tests: QR happy path, listen-error handler cleanup, strict error-handler count after enable, letter-starting Docker bridge. * fix(web-shell): preserve local control base paths * fix(local-control): close round-7 review findings - card: keep the 409 candidate list on the error path — requestLocalControl attaches the parsed payload to the thrown error and toggle reconciles status/selection from it, so a stale address after a DHCP change recovers without a page remount (R7-3) - lan-interfaces: match `vpn` as a substring and add a `wintun` token, closing the OpenVPN Wintun escape (boundary semantics let `vpn` sit inside "openvpn" unmatched) plus mid-word names like vpnkit; regression test covers the adapter family (R7-1 demonstrated entrance; structural per-platform classification stays a follow-up) - drop the orphaned strictPort ServeOptions field, the EADDRINUSE-bump condition reading it, and its test — no production entry point sets it anymore (R7-5) - docs: refresh 12-auth-security.md / 02-serve-runtime.md for the new middleware topology — unconditional allowOriginCors over the mutable allowlist on the runtime app, deny wall only in the bootstrap app, listener-scoped pairing credential on the LAN listener, and the new mutation-gate row (R7-2) - remove the dead selectLanAddress barrel re-export * fix(local-control): enforce the loopback-bind precondition on runtime enable The LAN listener binds the primary listener's port on the selected LAN address, so a wildcard or LAN primary bind already owns it — the `--local-control` CLI flag refuses that configuration at boot, but the runtime enable route (driven by the Web Shell Settings card) skipped the check and surfaced a 500 `listen EADDRINUSE` with no remediation, silently unusable for the whole class of non-loopback deployments. Return 409 `local_control_non_loopback_bind` with the actionable restart hint instead; loopback binds (127.0.0.1/localhost/::1) stay enabled via the shared `isLoopbackBind` helper. * fix(local-control): close round-8 demonstrated escapes + doc/test gaps R7-1 (demonstrated false negatives): Docker veth peer IDs are veth<hex> and may be letter-led (vethd4a1b2c), which the bare token's digit boundary let escape — the token takes the same shape as br-<hex>. Corporate SSL-VPN adapters (Cisco AnyConnect, GlobalProtect, Pulse Secure, FortiClient, Cloudflare WARP) carry no `vpn` substring, so their vendor names are listed explicitly; a sole-candidate VPN address is no longer silently auto-advertised in the QR. Regression tests cover all six shapes. The vEthernet-external false positive and the class fix (structural classification instead of name matching) remain under #9158. Also: the settings card's status-fetch effect clears a stale error on re-run and ignores superseded responses; the detach test now connects a primary-listener client and asserts it survives detachServer (the per-server filter previously survived a mutation probe); the flags table gains the --local-control-address row; the design doc states that --allow-origin origins stay admitted alongside the LAN origin; the three Host-gate doc surfaces note that the LAN listener always enforces its advertised-authority Host check. * fix(local-control): bound slow-body slots + close round-7 adapter escapes (#9106) - service: replace requestTimeout=0 with a bounded 30-minute whole-request budget; an unlimited budget let an unauthenticated LAN client trickle bodies and hold every pre-auth connection slot open indefinitely (headersTimeout covers only headers, keepAliveTimeout only idle sockets) - lan-interfaces: add interim vendor tokens for post-rename SSL-VPN successors (ivanti, cisco secure, citrix, sonicwall); Ivanti Connect Secure (Pulse Secure renamed) escaped the enumerated list and was auto-advertised in the QR. Class fix stays tracked in #9158 - auth: document the MutationGateOptions caveat that on a no-token daemon the Local Control pairing credential admits loopback callers to the strict surface (round-7 design decision still open) * fix(local-control): stop serving the pairing secret to unauthenticated callers (#9106) Probe-verified hole: on a tokenless daemon any local process could POST /workspace/local-control/enable (or GET the unguarded status route) and read status.url — the pairing token in the fragment — then present it on the LAN listener, where the strictDenier passthrough admitted it to the whole strict mutation surface (file writes, memory CRUD, git push/pull, extension/MCP control) without the operator ever scanning anything. Close the acquisition step: - GET status / POST enable / POST disable now return url + qrText only to requests bearerAuth actually authenticated (requestWasAuthenticated); unauthenticated callers get the status with the secret stripped and urlRedacted: true while active - on an unauthenticated enable the pairing URL is printed to the daemon's own terminal instead — the one channel a local attacker cannot read over HTTP - web-shell Settings card renders a terminal hint when urlRedacted (en/zh) - MutationGateOptions caveat rewritten to the resolved state Authenticated callers (daemon token) are unchanged. Route tests: redaction for unauthenticated GET/enable, full payload for authenticated callers, terminal print on enable; suites 42/42, eslint/prettier clean, Codex security review CLEAN. * fix(local-control): close round-9/10/11 review findings (#9106) - write the pairing URL with writeStdoutLineSafe so a dead/full stdout cannot wedge enable into a false 500 - reject an empty --local-control-address instead of silently dropping it - pin --token/--allow-origin composition through to runQwenServe - drop stale serve.ts file:line references in credentials/lan-interfaces - correct the CORS caveat and the design doc's flag/origin claims * test(serve): drop stale strict-port assertion * fix(local-control): close round-12 review findings (#9106) - give the composition test a full enable payload and a handle.close so the detached handler cannot leak a real process.exit(1) - wrap the QR dynamic import + setErrorLevel in withUiData's fault isolation so a broken qrcode-terminal degrades to the raw URL instead of 500ing every status/enable - fix the ZH urlRedacted copy (it prints a URL, not a QR) - finish the denyBrowserOriginCors -> allowOriginCors doc sweep in 01-architecture.md and 18-error-taxonomy.md --------- Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| client | ||
| components.json | ||
| package.json | ||
| playwright.config.ts | ||
| playwright.visuals.config.ts | ||
| README.md | ||
| tsconfig.build.json | ||
| tsconfig.json | ||
| tsconfig.lib.json | ||
| vite.config.ts | ||
| vite.lib.config.ts | ||
| vitest.config.ts | ||
@qwen-code/web-shell
Qwen Code Web Shell 是面向浏览器的 daemon 会话终端 UI,可以作为 React 组件嵌入到其他项目中。
环境要求
- React:
^18.0.0 || ^19.0.0 - React DOM:
^18.0.0 || ^19.0.0 @qwen-code/webui:>=0.0.1@qwen-code/sdk:>=0.1.8- 浏览器环境需要能访问 Qwen Code daemon serve 的 HTTP 接口。
组件包会自动注入自身的 CSS(包括 Tailwind 编译产物),接入方不需要配置 Tailwind 或额外引入全局 CSS。
Tailwind 与 shadcn/ui
Web Shell 已配置 Tailwind CSS v4 和 shadcn/ui。shadcn 的 token 仅用于新增的 Tailwind/shadcn 组件;现有 CSS Modules 的主题色值保持不变。组件代码在仓库内, 可直接修改。
新增 UI 的约定
- 新增通用 UI 或交互组件时,优先使用 shadcn/ui 已提供的组件,再根据 Web Shell 的需求修改生成到仓库中的源码。已有且稳定的 CSS Modules 组件不要求为了统一而 重写。
- Tailwind class 使用标准的无前缀写法,例如
flex gap-2。发布构建会通过 PostCSS 将生成的选择器限制在 Web Shell root 和 portal root,并为全局动画、CSS property 注册增加 Web Shell 前缀,避免与接入方样式冲突。 - shadcn 颜色必须使用
background、primary、muted等语义 token,不要直接 引用 Web Shell 原有颜色变量。原有 CSS Modules 继续使用原来的 token,两套色值 各自维护。 - Dialog、Popover、DropdownMenu、Tooltip 等包含 Portal 的组件,必须将内容挂载到
Web Shell 的 portal root。新增 shadcn 组件后,应参考现有
dialog.tsx,使用useWebShellPortalRoot()向 Radix Portal 传入container。这样主题、旧 CSS 变量以及外部配置的 z-index 才能正确继承。 - 保留组件上的
data-web-shell-*属性和公开 CSS 变量。接入方可能通过这些属性或--web-shell-dialog-backdrop-z-index、--web-shell-popover-z-index、--web-shell-tooltip-z-index等变量定制样式和层级。
在 packages/web-shell 目录添加后续组件,例如:
npx shadcn@latest add button
生成后需要检查 diff。shadcn CLI 可能更新 globals.css、依赖或生成默认 Portal
实现,不应覆盖现有的 CSS scope、语义 token 和 portal root 适配。组件默认仅供
Web Shell 内部使用;没有明确的公共 API 需求时,不要从包入口导出。
Tailwind 会在发布前编译并内联到 npm 包,接入方不需要安装或配置 Tailwind,也不
需要额外引入 globals.css。
可选 Shadow DOM 隔离
宿主页面存在 *、h2、button 等全局规则时,可以按场景开启 Shadow DOM:
import customShadowStyles from './web-shell-shadow.css?inline';
<WebShellWithProviders
shadowDom={{
plugins: true,
portals: true,
styles: customShadowStyles,
}}
/>;
plugins隔离所有插件管理页面主体,包括统一的 Plugins 页面,以及/extensions、/mcp、/skills等兼容入口打开的页面。portals统一隔离 Web Shell 的所有弹窗层,包括 Dialog、Drawer、Popover、 DropdownMenu、Select 和 Tooltip;插件页面发起的弹窗也由这个开关管理。styles会追加到每个启用的 ShadowRoot,供 render props 等业务自定义内容继续 使用 class 样式。内联样式和通过 Web Shellstyle设置的 CSS 变量不需要迁移。--web-shell-portal-root-z-index控制 Shadow portal host 的整体层级,默认1000。需要与宿主自己的全局浮层协调时,可以通过 Web Shellstyle覆盖。shadowDom={true}是同时开启plugins和portals的简写。
默认不开启,现有 Light DOM 接入行为不变。两个场景相互独立,例如
{ plugins: true, portals: false } 会隔离插件页面主体,但所有弹窗仍挂载到原来的
Light DOM portal root。
Shadow 内部仍由原 React 树通过 portal 渲染,不会创建第二个 React root;props、
context、事件、ref 和状态语义保持不变。开启后,宿主普通选择器不会匹配 Shadow
内部节点,但宿主也无法再用普通选择器直接覆盖这些节点,所需定制样式应通过
shadowDom.styles 传入。
Web Shell 会在挂载 Shadow 内容前安装样式,并在浏览器支持时让多个 ShadowRoot 复用已经解析的 constructable stylesheet,以避免页面首次进入时的无样式闪烁和 重复解析 CSS。
图标约定
- 新增图标统一优先使用
lucide-react,不要为已有的常见图标重复编写 SVG。 - 使用具名静态导入,确保 Vite/Rollup 可以按需打包:
import { CheckIcon, XIcon } from 'lucide-react';
- 不要使用
import * as Icons后按名称动态取图标,这可能把整个图标库打入产物。 - 图标默认使用
currentColor,尺寸优先交给 shadcn 组件或 Tailwind class 控制, 避免在每个调用处重复添加颜色、margin 和 padding。 - 只有 Lucide 没有对应图标或需要产品专属图形时,才新增自定义 SVG。
安装
npm install @qwen-code/web-shell
Peer dependencies 需要同时安装:
npm install react react-dom @qwen-code/webui @qwen-code/sdk
接入方式
WebShell 提供两种接入形态:
1. 独立接入(自带 Provider)
适合只需要嵌入一个终端视图的场景。组件内部自建
DaemonWorkspaceProvider + DaemonSessionProvider。
import { WebShellWithProviders } from '@qwen-code/web-shell';
export function QwenCodePanel() {
return (
<WebShellWithProviders
baseUrl="http://127.0.0.1:4170"
token="your-bearer-token"
sessionId="838e1811-9f84-4848-9915-d9a7f01ff5c6"
onSessionIdChange={(sessionId) => {
console.log('current session:', sessionId);
}}
onSessionCreated={async (sessionId) => {
await registerSession(sessionId);
}}
theme="dark"
language="zh-CN"
/>
);
}
2. 共享 Provider 接入(纯消费者)
适合同一个 React 应用中多个视图共享同一个 daemon session 的场景(如 chat + terminal)。宿主自行提供 Provider,WebShell 只消费 hooks。
import {
DaemonWorkspaceProvider,
DaemonSessionProvider,
} from '@qwen-code/webui/daemon-react-sdk';
import { WebShell } from '@qwen-code/web-shell';
export function App() {
return (
<DaemonWorkspaceProvider baseUrl="http://127.0.0.1:4170" token="...">
<DaemonSessionProvider sessionId="...">
<ChatPanel />
<WebShell theme="dark" language="zh-CN" />
</DaemonSessionProvider>
</DaemonWorkspaceProvider>
);
}
注意:不要在已有
DaemonSessionProvider下使用WebShellWithProviders,否则会创建嵌套的重复 Provider。
3. 只读 ChatRecord JSONL
WebShellTranscript 只接收已经投影完成的 blocks,不连接 daemon,也不提供 composer、
审批或 session mutation。浏览器宿主可以逐行解析 JSONL,再通过 SDK 的 opt-in facade
投影:
import { projectChatRecordsToDaemonTranscript } from '@qwen-code/sdk/daemon/transcript';
import { WebShellTranscript } from '@qwen-code/web-shell';
const records = jsonl
.split(/\r?\n/)
.filter((line) => line.trim())
.map((line) => JSON.parse(line) as unknown);
const projection = projectChatRecordsToDaemonTranscript(records);
<WebShellTranscript
blocks={projection.blocks}
theme="dark"
language="zh-CN"
style={{ height: 640 }}
/>;
宿主应显示 projection.diagnostics,并在 complete=false 或 truncated=true 时提示
历史可能不完整。组件需要一个可用高度;自定义 renderer 的副作用仍由宿主负责。
Props
WebShellWithProviders
包含 WebShell 的所有 Props,加上 Provider 配置:
| 属性 | 类型 | 说明 |
|---|---|---|
baseUrl |
string |
daemon API 地址,未传时使用 window.location.origin |
token |
string |
daemon API Bearer token |
sessionId |
string |
要连接的 session id;未传或 undefined 时保持空页面 |
workspaceId |
string |
已注册工作区 id,主要用于定位已有 session;不会注册或锁定工作区 |
workspaceCwd |
string |
已注册工作区路径,语义同 workspaceId;不会注册或锁定工作区,且优先于 workspaceId |
lockWorkspaceCwd |
string |
锁定到指定工作区路径;未注册时自动持久注册,并隐藏其他工作区及添加、移除和选择入口 |
restartSseOnPrompt |
boolean |
每次 prompt 被 daemon 接收后重建存活 SSE 流;流断开时提交 prompt 总会立即重建(与此开关无关);默认关闭 |
WebShell
| 属性 | 类型 | 说明 |
|---|---|---|
onSessionIdChange |
(sessionId: string | undefined, workspaceId?: string, workspaceCwd?: string) => void |
当前 session 或工作区变化时触发 |
onSessionCreated |
(sessionId: string) => Promise<void> | void |
新 session 创建后触发;完成前会阻塞 session 初始化和 prompt 提交,最长等待 30 秒 |
theme |
'dark' | 'light' |
UI 主题,默认 dark |
onThemeChange |
(theme: WebShellTheme) => void |
/theme 命令切换主题后触发 |
language |
'en' | 'zh-CN' | 'zh' | 'zh-cn' |
UI 语言 |
onLanguageChange |
(language: WebShellLanguage) => void |
/language ui 切换 UI 语言后触发 |
onSlashCommand |
(command: WebShellSlashCommand) => boolean | void |
斜杠命令进入默认处理前触发;返回 true 时由宿主接管并跳过默认行为 |
宿主可以监听命令,也可以返回 true 接管对应操作:
<WebShell
onSlashCommand={({ command, args, input }) => {
if (command !== 'deploy') return;
openDeployDialog({ environment: args, source: input });
return true;
}}
/>
回调在主聊天和分屏聊天中都会触发,也可以在 daemon 断连时处理纯宿主操作。
命令名后必须是空白或输入结束,因此 /usr/local/bin/tool 等绝对路径不会触发
回调。如果回调抛出异常,Web Shell 会报告错误并继续执行默认命令流程。
锁定工作区时,可以自定义 Sidebar 文件夹行的内容:
<WebShellWithProviders
lockWorkspaceCwd="/path/to/workspace"
sidebar={{
lockedWorkspace: {
render: (workspace, { expanded }) => (
<span>
{expanded ? '📂' : '📁'} {workspace.cwd}
</span>
),
},
}}
/>
自定义内容仍使用内置的展开、收起行为,expanded 会随状态更新;文件夹行右侧的内置操作不会渲染。
未提供 lockWorkspaceCwd 时,该 renderer 不会执行。
Markdown 图表接入
WebShell 已内置 markdown-chart renderer 和 ECharts 运行时。宿主只需将
markdown-chart skill
安装到 Qwen Code 的项目级或用户级 skills 目录;例如项目级安装结果为:
.qwen/skills/markdown-chart/SKILL.md
安装 skill 后按原方式使用 WebShell,不需要额外安装或导入 ECharts,也不需要传入 图表配置:
<WebShellWithProviders baseUrl="http://127.0.0.1:4170" />
skill 默认输出 data.kind="inline" 的 canonical markdown-chart block。
WebShell 负责严格 JSON 校验、流式渲染、ECharts 生命周期以及 Chart/Data
切换;已经闭合的图表会立即渲染,只有末尾尚未闭合的 fence 显示 loading。
只有需要支持 skill 输出 data.kind="ref" 时,宿主才需要提供受控的
resolveDataRef:
import {
createMarkdownChartRegistry,
WebShellWithProviders,
} from '@qwen-code/web-shell';
const chartRegistry = createMarkdownChartRegistry({
resolveDataRef: async (ref, context) =>
loadControlledChartDataset(ref, context),
});
const markdown = { chart: { registry: chartRegistry } };
<WebShellWithProviders baseUrl="http://127.0.0.1:4170" markdown={markdown} />;
resolveDataRef 是 ref 数据的唯一读取入口;WebShell 不会自行读取 URL 或本地
路径。默认只接受规范化的 artifact:// 和 session-file:// ref,将 ref
规范化后交给 resolver,并在 30 秒后终止等待。markdown 及其中的 chart
对象应在图表挂载期间保持引用稳定。
Chart/Data 控件、无数据提示和错误提示默认跟随 WebShell 语言;需要覆盖个别
文案时可在稳定的 chart 对象上提供 labels。
协议和数据格式见
markdown-chart。
架构说明
@qwen-code/sdk/daemon ← 协议层(SSE, REST, normalizer)
@qwen-code/webui/daemon-react-sdk ← React adapter(Provider, hooks, store)
@qwen-code/web-shell ← 终端 UI 组件
WebShell必须在DaemonWorkspaceProvider和DaemonSessionProvider之下使用。WebShellWithProviders是内置 Provider 的便捷 wrapper。- 同一个 React 树共享一个
DaemonSessionProvider时只开一条 SSE。
已支持的斜杠命令
下面列出当前 web-shell 已支持的命令。支持方式分为两类:
- 本地实现:web-shell 前端直接打开弹窗、调用 daemon REST API,或切换本地状态。
- ACP 透传:web-shell 将命令发送给 daemon,由 daemon/ACP 执行。
| 命令 | 支持方式 | 说明 |
|---|---|---|
/help |
本地实现 | 打开帮助弹窗,支持键盘浏览命令和快捷键。 |
/theme |
本地实现 | 打开主题选择弹窗;支持 /theme light、/theme dark。 |
/settings |
本地实现 | 打开设置面板,管理工作区与用户级(~/.qwen/settings.json)配置;两个作用域均可编辑并写回对应的 settings.json。 |
/language |
本地实现 + ACP 透传 | /language ui <lang> 会切换 web-shell UI 语言并同步给 daemon;其他语言能力由 daemon 执行。包含 ui、output 子命令。 |
/model |
本地实现 + 部分透传 | 无参数打开模型弹窗;普通参数直接切换模型;/model --fast <model> 透传给 daemon。 |
/plan |
本地实现 | 切换到 plan approval mode,并可继续发送后续 prompt。 |
/approval-mode |
本地实现 | 打开审批模式弹窗或直接切换审批模式。 |
/mode |
本地实现 | web-shell 本地别名,用于切换审批模式。 |
/mcp |
本地实现 | 打开 MCP 管理弹窗。 |
/skills |
本地实现 + ACP 透传 | 无参数或 detail/details 打开 skills 弹窗;其他参数转换为直接 skill 命令(/skills review → /review)。 |
/tools |
本地实现 | 打开 tools 弹窗,列表展示工具名称、启用状态和 description。 |
/memory |
本地实现 | 打开 memory 弹窗,支持 show、refresh、add user、add project 等分支。 |
/agents |
本地实现 | 打开 agents 弹窗,支持 manage、create user、create project 等分支。 |
/copy |
本地实现 | 复制最后一条 assistant 输出;支持 code、语言名、LaTeX、inline LaTeX 等选择器。 |
/release |
本地实现 | 释放 live session 连接,不删除历史会话记录。 |
/clear |
本地实现 | 清空当前 web-shell transcript store。 |
/new |
本地实现 | 创建新的 daemon session。 |
/reset |
本地实现 | 与 /new 一样创建新的 daemon session。 |
/rename <name> |
本地实现 | 修改当前 daemon session 的展示名称。 |
/resume |
本地实现 | 无参数打开恢复会话弹窗;带 session id 时直接加载。 |
/status |
ACP 透传 | daemon 支持,包含 paths 子命令。 |
/auth |
ACP 透传 | 连接 LLM provider。 |
/bug |
ACP 透传 | 提交错误报告。 |
/compress |
ACP 透传 | 通过摘要替换来压缩上下文。 |
/context |
ACP 透传 | 显示上下文窗口使用情况,包含 detail 子命令。 |
/diff |
ACP 透传 | 显示工作区相对 HEAD 的变更统计。 |
/docs |
ACP 透传 | 打开 Qwen Code 文档。 |
/doctor |
ACP 透传 | 执行安装与环境诊断,包含 memory 子命令。 |
/export |
ACP 透传 | 导出当前会话记录,包含 html、md、json、jsonl 子命令。 |
/goal |
ACP 透传 | 设置目标,并持续工作直到条件满足。 |
/init |
ACP 透传 | 分析项目并创建定制的 QWEN.md。 |
/stats |
ACP 透传 | 显示统计信息,包含 model、tools 子命令。 |
/summary |
ACP 透传 | 生成当前会话摘要。 |
/tasks |
本地实现 | 打开环境信息面板并刷新后台任务。 |
/btw |
本地实现 + ACP 透传 | daemon 支持侧边任务时新建侧边任务;否则发送一个不影响主对话的侧边问题。 |
/fork |
本地实现 + ACP 透传 | 启动共享当前上下文的后台智能体。 |
/insight |
ACP 透传 | 查看 insight 相关信息。 |