Find a file
Edenman 6556adcdba
Some checks are pending
Qwen Code CI / Lint (push) Waiting to run
Qwen Code CI / Test (macos-latest, Node 22.x) (push) Waiting to run
Qwen Code CI / Test (ubuntu-latest, Node 22.x) (push) Waiting to run
Qwen Code CI / Test (windows-latest, Node 22.x) (push) Waiting to run
Qwen Code CI / Post Coverage Comment (push) Blocked by required conditions
Qwen Code CI / CodeQL (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:docker (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none (push) Waiting to run
E2E Tests / E2E Test - macOS (push) Waiting to run
feat: add /diff command and git diff statistics utility (#3491)
* feat(core): add git diff statistics utility

Port numstat + unified-diff parsing into `packages/core/src/utils/gitDiff.ts`
to surface structured working-tree change summaries (files changed, lines
added/removed, per-file hunks) against HEAD. Caps mirror issue #2997:
50 files, 1MB per file, 400 lines per file, with a 500-file short-circuit
via `git diff --shortstat` to avoid expensive work on massive diffs.

- `fetchGitDiff(cwd)` returns stats + per-file summaries (tracked + untracked).
- `fetchGitDiffHunks(cwd)` returns structured hunks on demand.
- `resolveGitDir(cwd)` follows `.git` file indirection so linked worktrees
  and submodules report the correct gitdir.
- Transient-state short-circuit covers merge, cherry-pick, revert, and both
  `rebase-merge` / `rebase-apply` layouts.
- `core.quotepath=false` is forced so non-ASCII filenames stay as UTF-8.

Refs #2997

* feat(cli): add /diff slash command

Surface the `fetchGitDiff` utility through an interactive `/diff` command.
Prints a header (`N files changed, +A / -R`) followed by per-file rows with
padded add/remove counts. Untracked files are marked `?`, binary files are
marked `~`. When the change set exceeds the per-file cap, a trailing
`…and N more` note tells the user how many entries are hidden.

Returns a `MessageActionReturn` so it renders the same way in interactive
and non-interactive modes.

* fix(cli): harden /diff command after adversarial audit

- Wrap `fetchGitDiff` in try/catch so permission errors on `.git` surface
  as a friendly error message instead of crashing the action.
- Declare `supportedModes: ['interactive', 'non_interactive', 'acp']` so
  the command is reachable outside the interactive Ink UI — the default
  for `commandType: 'local'` is interactive-only.
- Align `?` (untracked) and `~` (binary) markers with the `+X -Y` stat
  column via a padded prefix, so filenames line up regardless of row kind.
- Drop the "…and N more" hint when no rows are shown (shortstat fast-path
  with >500 files) — the count alone is sufficient and "showing first 0"
  is noise.
- Switch header to full-phrase i18n templates (separate singular/plural
  variants) instead of word-by-word `t()` calls that don't survive
  non-English locales.
- Extend tests to 12 scenarios: empty cwd, fetch rejection, singular
  "file" form, mixed untracked/binary/tracked alignment, 4-digit padding,
  shortstat fast-path, and supportedModes declaration. Mocks carry a
  `satisfies GitDiffResult` annotation so shape drift in core breaks the
  test at compile time.

* fix(cli): clean up /diff feature review issues

- Remove invalid `commandType` field from diffCommand (SlashCommand has
  no such property; caused a TS build failure).
- Drop duplicate `NumstatResult` interface in gitDiff.ts — it is
  structurally identical to `GitDiffResult`.
- Register the 9 missing `/diff` i18n strings in en.js / zh.js so the
  command is translatable (previously only `Configuration not available.`
  had entries).

* fix(core): harden git diff stats after multi-round review

- fetchUntrackedPaths now uses `ls-files -z` so filenames containing
  newlines, tabs, or non-ASCII bytes round-trip cleanly instead of
  being C-style quoted and split into phantom entries.
- fetchGitDiff runs the `--shortstat` probe and the untracked-paths
  lookup in parallel, since both are needed regardless of which path
  the function takes.
- parseGitDiff measures per-file diff size via Buffer.byteLength so
  MAX_DIFF_SIZE_BYTES matches its documented meaning on non-ASCII diffs.
- Adds a regression test for an untracked file whose name contains a
  literal newline.

* fix(core): address /diff PR review comments

Addresses the five open review threads on #3491:

- parseShortstat: anchored and bounded the regex (`^...$` with `\d{1,10}`)
  so adversarial inputs can no longer drive polynomial backtracking. Closes
  CodeQL alert #137.
- fetchGitDiff: only parse the untracked-path list when we actually need
  it; the fast path now counts NUL bytes in the raw `ls-files -z` stdout
  (wenshao P1).
- fetchGitDiff: base the `MAX_FILES_FOR_DETAILS` short-circuit on
  `tracked + untracked`, so repos with few edits but many untracked files
  still take the summary-only path (wenshao P2).
- fetchGitDiff: count newlines in each untracked text file (binary sniff +
  1 MB read cap) and fold that into both the header `+N` and the per-file
  row, so a brand-new file no longer renders as `+0 / -0` (BZ-D P2).
- parseGitNumstat: switch to `git diff --numstat -z`. The parser now uses
  index-based slicing and a rename-pair state machine, so tracked
  filenames containing tabs/newlines/non-ASCII keep their real bytes
  (BZ-D P3). Renames collapse into a single `old => new` entry.

UI: untracked rows render as `+N filename (new)` (or
`~ filename (binary, new)`) instead of the placeholder `?` marker;
`/diff` now shows real additions for fresh files.

* fix(core): surface truncated untracked counts and decouple totals from display

Two issues surfaced during a directionless multi-round audit of the /diff
feature:

1. `countUntrackedLines` reads at most `UNTRACKED_READ_CAP_BYTES` (1 MB)
   per file, so a 10 MB new log was silently reported as `+~20k` when the
   real count is ~10×. The helper now `fstat`s the file and returns a
   `truncated: true` flag when size exceeds the read window; `/diff`
   surfaces it as `(new, partial)` so the `+N` isn't read as exact.

2. Line-count aggregation was coupled to the per-file display cap: when
   tracked changes filled the `MAX_FILES` slot, untracked line counts
   beyond the remaining slots were dropped from `stats.linesAdded`
   entirely (header under-reported additions). Decoupled: we now read up
   to `MAX_FILES` untracked files for their line counts regardless of
   display slots, and only restrict the visible rows to `remainingSlots`.

Added regression tests for both: a 1.5 MB new file asserts `truncated:
true` and a lower-bound line count, and a `MAX_FILES`-saturated tracked
set + 5 untracked files asserts that untracked additions still appear in
the header totals even though none of them get displayed.

* fix(core): parse filenames from +++/--- lines to handle paths with ' b/'

`diff --git a/X b/Y` is ambiguous when X contains ` b/` — a file literally
named `a b/c.txt` produces `diff --git a/a b/c.txt b/a b/c.txt` with no
escape or quoting, and the previous regex `^a\/(.+?) b\/(.+)$` keyed the
hunks under the wrong path. Consumers of the exported `fetchGitDiffHunks`
API would then fail to correlate hunks with stats or editor paths.

Introduces `extractFilePath(lines)` which walks the block for the
unambiguous markers (`rename to` / `copy to` / `+++ b/<path>` with a
`/dev/null` fallback to `--- a/<path>`) and strips the trailing TAB git
appends to paths containing whitespace. Adds unit tests for the
`a b/c.txt`, rename, delete, and new-file cases plus an end-to-end test
that creates a real `a b/c.txt` file and asserts `fetchGitDiffHunks`
keys the hunks correctly.

Addresses wenshao review comment #3136657141 on #3491.

* feat(cli): colorize /diff output via a themed Ink component

The /diff stats used to come back as a plain-text MessageActionReturn.
Pipes and ACP still get that, but in interactive terminals we now dispatch
a structured history item so the numbers can carry theme colors.

- packages/cli/src/ui/types.ts — new DiffRenderRow / DiffRenderModel /
  HistoryItemDiffStats, MessageType.DIFF_STATS.
- packages/cli/src/ui/components/messages/DiffStatsDisplay.tsx — renders
  +N in theme.status.success (green), -M in theme.status.error (red), and
  the (new) / (binary) / (new, partial) markers in theme.text.secondary
  (dim). Column alignment matches the plain-text fallback.
- packages/cli/src/ui/components/HistoryItemDisplay.tsx — routes the new
  item type.
- packages/cli/src/ui/commands/diffCommand.ts — builds a DiffRenderModel
  once and fans out: interactive calls context.ui.addItem; other modes
  fall through to renderDiffModelText() for the plain-text path. Error
  and "clean tree" branches keep the existing info/error
  MessageActionReturn in every mode.
- Tests: existing diffCommand suite moved to an explicit non_interactive
  context (it was asserting text content); new interactive suite covers
  addItem dispatch and model shape; DiffStatsDisplay component tests
  cover the four row variants and the "…and N more" note.

* refactor(cli): factor /diff column widths into a shared helper

Audit of the colorize commit found one real DRY hazard: DiffStatsDisplay
and renderDiffModelText each independently re-derived addWidth /
remWidth / statColumnWidth from the same row list. If anyone later
changed one formula, the interactive Ink output and the non-interactive
plain text would silently fall out of column alignment.

Extract the computation into computeDiffColumnWidths() exported from
diffCommand.ts; both renderers now call it. Adds a focused unit test of
the contract (empty rows, widest non-binary row wins, binary rows are
ignored, untracked text rows count). Drop a redundant
`Omit<HistoryItemDiffStats, 'id'>` annotation since the type already has
no id field.

* fix(core): pin /diff git ops to repo root and lstat untracked entries

Two Critical findings on PR #3491:

1. (line 63) When /diff is invoked from a subdirectory of the worktree,
   `git diff` emits repo-root-relative paths but `git ls-files --others`
   is scoped to cwd and emits cwd-relative paths. Result: mixed path
   bases in `perFileStats` and silent omission of untracked files in
   sibling directories. Resolve `findGitRoot(cwd)` once and run every
   git invocation (and `path.join(...)` for line counting) from there,
   so all keys are repo-root-relative and the listing is repo-wide.

2. (line 455) `countUntrackedLines` opened every untracked path with
   `open(absPath, 'r')`. Git's `ls-files --others` can list FIFOs
   (whose `open()` blocks indefinitely waiting on a writer) and
   symlinks (which `open()` dereferences, potentially reading outside
   the worktree). Add an `lstat` gate: only regular files are counted;
   symlinks and other special files render as binary `~` rows.

Two new integration tests cover both regressions: one creates a
sibling untracked file at the repo root and invokes fetchGitDiff from
a subdir asserting all three changes (root + sub) come back keyed by
repo-root-relative paths; the other creates a symlink pointing at
content outside the worktree and asserts it lands as a binary row
with no contribution to linesAdded.

* chore: revert stray .npmrc/README.md test edits swept into bb0164d99

The previous fix(core) commit accidentally bundled two unrelated
working-tree edits (a test comment in .npmrc and a TODO in README.md)
that I had used while sanity-testing /diff. They have nothing to do
with the fix; restore them to their pre-bb0164d99 state.

* perf(core): stream untracked-file line counts in 64 KB chunks

`countUntrackedLines` allocated a fresh `UNTRACKED_READ_CAP_BYTES`
(1 MB) buffer per file. With up to MAX_FILES (=50) line-counts
running concurrently via `Promise.all`, the worst-case heap
footprint of a single `/diff` invocation was ~50 MB of transient
buffers — avoidable spike on small containers / low-memory hosts
flagged by wenshao on PR #3491.

Switch to a fixed 64 KB chunk buffer and read in a loop, accumulating
line counts and tracking the last byte across iterations. Peak
footprint is now ~3.2 MB (50 × 64 KB). Behavior is identical: same
binary sniff over the first 8 KB, same truncation flag when the read
hits the cap with bytes still on disk, same trailing-partial-line
rule. All 44 gitDiff tests pass unchanged, including the 1.5 MB
truncation test which now crosses chunk boundaries.

* refactor(core): collapse redundant ancestor walks; harden untracked open

Multi-round audit of the recent /diff fixes turned up two real issues:

1. `fetchGitDiff` and `fetchGitDiffHunks` walked worktree ancestors
   three times each — `isGitRepository(cwd)`, then
   `isInTransientGitState → resolveGitDir → findGitRoot`, then
   `findGitRoot(cwd)` to pin git ops to the root. Resolve once at the
   top, then thread `gitRoot` everywhere. Removes the now-dead
   `isGitRepository` import and adds a private
   `resolveGitDirFromRoot(gitRoot)` so the public `resolveGitDir(cwd)`
   contract stays untouched for the test suite and external callers.

2. `countUntrackedLines` had a TOCTOU window between `lstat` (which
   gates on regular files) and `open(absPath, 'r')` — if the path was
   replaced by a symlink in that gap, `open` would silently follow it
   and read the target. Open with `O_RDONLY | O_NOFOLLOW` (falling
   back to `O_RDONLY` on platforms that don't expose the flag, e.g.
   Windows) so the open rejects with `ELOOP` instead. Also unified the
   five "couldn't read this file" branches (lstat throws / non-regular
   / open throws / binary sniff / mid-read failure) to all return
   `{isBinary:true, added:0}` — the row appears in the listing as an
   opaque `~ (binary, new)` marker rather than masquerading as an
   empty text file with `+0 (new)`.

44 gitDiff tests pass unchanged.

* docs(cli): clarify row-order contract; simplify DiffRow key

Two non-blocking suggestions from qqqys's CR on PR #3491:

- `buildDiffRenderModel`: expand the JSDoc to call out the implicit
  row-ordering contract that both renderers depend on (tracked entries
  first in numstat order, then untracked appended in ls-files order).
  Future replacements of the underlying Map need to preserve this
  sequence.

- `DiffStatsDisplay`: drop the `${i}-${filename}` React key in favor of
  bare `filename`. Filenames are unique within a single
  `DiffRenderModel` (perFileStats is a Map keyed by filename), so the
  index prefix added no information.

* feat(cli): add (deleted) marker for files removed in the worktree

Symmetrical to the (new) marker for untracked files: tracked files that
were removed from the worktree relative to HEAD now render with a
(deleted) suffix (or (binary, deleted) for binary deletes), so users
can tell a delete apart from a heavy edit.

Implementation:
- core: `fetchGitDiff` now runs `git diff HEAD --name-status -z` in
  parallel with the existing numstat call. `parseDeletedFromNameStatus`
  extracts the set of D-status paths (skipping R/C rename and copy
  pairs, both halves of which still exist on disk under one name or
  the other). Each `perFileStats` entry whose key is in that set gets
  `isDeleted: true`. Numstat alone could not distinguish a delete
  (`0\t10\tpath`) from a heavy edit; the name-status pass disambiguates.
- cli: `DiffRenderRow` carries `isDeleted: boolean`; both the plain-text
  renderer and the Ink component append the new suffix in
  `theme.text.secondary` (dim).
- i18n: new `(deleted)` and `(binary, deleted)` keys in en/zh/zh-TW.

Tests:
- Unit: `parseDeletedFromNameStatus` covers D-only extraction, R/C pair
  skipping, NUL-safe paths (tabs / non-ASCII), and empty input.
- Integration: real repo deletes a tracked text + a tracked binary plus
  edits another file; asserts the deleted entries get `isDeleted: true`
  but the heavy edit does not. Second test verifies neither half of a
  `git mv` rename gets flagged as deleted.
- CLI / component: `(deleted)` and `(binary, deleted)` rendering
  variants with column alignment intact.

* fix(core): pin --no-ext-diff on every git diff invocation

Plain `git diff HEAD` honors `GIT_EXTERNAL_DIFF` and configured
`diff.<name>.command` drivers, so the exported `fetchGitDiffHunks`
utility could execute arbitrary commands when invoked inside a
worktree whose user-global or repo-local config registers an
external driver.

Add `--no-ext-diff` to every `git diff` call:
- `fetchGitDiffHunks`'s plain `git diff HEAD` — the actual
  vulnerability surface.
- `fetchGitDiff`'s `--shortstat`, `--numstat`, `--name-status`
  variants — defense-in-depth. Empirically these stats modes
  already bypass external drivers in current git, but git's
  behavior here has shifted between versions before, and
  pinning the flag everywhere is a zero-cost hardening that
  keeps the policy uniform across every `git diff` we run.

Regression test plants `GIT_EXTERNAL_DIFF=evil.sh` (a driver that
writes a sentinel file as its side effect) before calling
`fetchGitDiffHunks`, then asserts the sentinel never appears —
confirming `--no-ext-diff` actually stops git from spawning the
driver.

Closes wenshao critical comment on PR #3491.

* fix(core): lazy O_NOFOLLOW lookup so vitest fs mocks don't blow up

PR #3491 CI was failing across all 9 platform/Node combos with:

    Error: [vitest] No "constants" export is defined on the "node:fs" mock.
        at gitDiff.ts:70 const UNTRACKED_OPEN_FLAGS =
                                fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0)
        at index.ts:279  export * from './utils/gitDiff.js'

Six unrelated test files (`client.test.ts`, `geminiChat.test.ts`,
`marketplace.test.ts`, `npm.test.ts`, `mcp-client.test.ts`,
`nextSpeakerChecker.test.ts`) `vi.mock('node:fs', ...)` without
returning `constants`, and their transitive import of
`@qwen-code/qwen-code-core` pulls in `gitDiff.ts`, whose
module-load-time `import { constants as fsConstants }` plus the
top-level `UNTRACKED_OPEN_FLAGS` constant tripped vitest's strict
mock proxy.

Two changes:

1. Switch `import { constants }` to `import * as nodeFs from 'node:fs'`.
   Strict-mock no longer rejects the import statement itself.
2. Move the flag computation out of a module-load constant into a
   memoized `getUntrackedOpenFlags()` called from inside
   `countUntrackedLines`. Tests that don't actually invoke
   `fetchGitDiff` / `fetchGitDiffHunks` (i.e. all six broken ones)
   never reach the property access, so vitest's proxy never trips.
   `?? 0` fallback on each constant lookup is preserved so Windows
   (no `O_NOFOLLOW`) and the genuine "constants is undefined" mock
   path both degrade to plain `O_RDONLY` without throwing.

Locally re-ran all six previously-failing files (199 tests) — all
green. Existing 51 gitDiff tests unchanged.

* fix(core): make resolveGitDir worktree assertion platform-agnostic

Windows CI was failing only on:

    resolveGitDir > follows the gitdir pointer for linked worktrees
    AssertionError: expected 'C:/Users/runneradmin/.../main/.git/worktrees/wt'
        to contain '.git\worktrees'

Git writes the linked-worktree pointer in the `.git` *file* using
forward slashes — `gitdir: C:/Users/.../main/.git/worktrees/wt` —
even on Windows. `resolveGitDir` surfaces that string verbatim
(intentional, since fs APIs on Windows accept both separators). But
the assertion used `path.join('.git', 'worktrees')`, which is
`'.git\\worktrees'` on Windows, so the substring-contains check
failed despite the value being correct.

Switch to a regex that matches either separator: `/[/\\]\.git[/\\]worktrees[/\\]/`.
Now the assertion holds on POSIX (where path.join uses `/` anyway)
and Windows (where git's value uses `/` but the host uses `\`).

6285/6289 Windows tests already passed before this; only this one
assertion was platform-dependent.

* fix(core): C-unquote diff path headers and fix untracked-only fast path

Two Critical findings + one suggestion from wenshao on PR #3491:

1. (line 615) `extractFilePath` only accepted unquoted `+++ b/...` /
   `--- a/...` headers. Git wraps a path in `"..."` and applies
   C-style escaping (`\t`, `\n`, `\r`, `\"`, `\\`, plus octal `\NNN`
   for non-ASCII bytes) whenever the raw path contains a character
   that breaks space-delimited parsing. `core.quotepath=false` only
   disables the octal form for non-ASCII bytes — control chars and
   quotes are still escaped — so `fetchGitDiffHunks` silently dropped
   hunks for any tracked file whose name contained a tab, newline,
   or quote.

   Add `unquoteCStylePath()`: detects the surrounding quotes, decodes
   `\t`/`\n`/`\r`/`\"`/`\\` plus octal `\NNN` to raw bytes, then
   UTF-8-decodes the byte sequence so multi-byte octal sequences like
   `\346\226\207` (= `文`) round-trip correctly. `extractFilePath`
   pipes every candidate through `stripTab` -> `unquoteCStylePath`
   before checking the `a/` / `b/` prefix.

   Two unit tests cover the tab and octal cases; one integration test
   creates a real `tab\there.txt` tracked file, modifies it, and asserts
   `fetchGitDiffHunks` keys hunks under the real name. The integration
   test no-ops on filesystems that reject tab-in-name (NTFS).

2. (line 146) The >MAX_FILES_FOR_DETAILS fast path was guarded by
   `quickStats &&`, which short-circuited to false when shortstat
   returned an empty string. A workspace with 0 tracked changes plus
   501 untracked files therefore slipped past the guardrail and ran
   the slow path, line-counting only the first MAX_FILES untracked
   files — header reported `filesCount: 501` but `linesAdded` missed
   the other 451.

   Treat empty/null/unparseable shortstat as `EMPTY_STATS` and apply
   the threshold on `tracked + untracked` uniformly. Integration test
   plants 501 untracked files + 0 tracked and asserts the result has
   `filesCount: 501` with an empty perFileStats Map (summary-only).

3. (line 263) `fetchGitDiffHunks` reads the full `git diff HEAD`
   stdout before parser caps apply. Documented in the JSDoc as a
   known limitation: streaming the parser to terminate git early at
   MAX_FILES is a reasonable follow-up but a non-trivial refactor
   (spawn + incremental parse + UTF-8 boundary handling) and out of
   scope for this PR. The existing `runGit` 64 MB maxBuffer keeps
   pathological cases from runaway-allocating.

55 gitDiff tests pass (51 + 4 new).

* fix(core): also pass --no-textconv to block .gitattributes textconv drivers

Builds on the earlier `--no-ext-diff` hardening. wenshao pointed out
that `--no-ext-diff` covers `GIT_EXTERNAL_DIFF` and
`diff.<name>.command`, but it does NOT block textconv filters
registered via `.gitattributes` + `diff.<name>.textconv` — those run
on a separate code path inside `git diff`.

Verified locally:

    git config diff.evil.textconv /tmp/evil.sh
    echo '*.pdf diff=evil' > .gitattributes
    # ... commit + modify doc.pdf ...

    git diff HEAD --no-ext-diff               -> /tmp/evil.sh fires
    git diff HEAD --no-ext-diff --no-textconv -> driver does NOT fire

Add `--no-textconv` to all four `git diff` invocations
(shortstat / numstat / name-status / plain hunks). As with
`--no-ext-diff`, only the plain-diff call (`fetchGitDiffHunks`) is
known to invoke textconv in current git, but pinning both flags
uniformly is defense-in-depth and keeps the policy declarative.

Regression test plants a real textconv driver in a worktree's
`.git/config` + `.gitattributes` and asserts the driver's sentinel
file is NOT written when `fetchGitDiffHunks` runs. Without the new
flag the test fails with the sentinel present.

* fix(diff): close untracked-line undercount and ANSI injection in /diff output

Two Critical issues from PR #3491 review:

1. fetchGitDiff slow path only line-counted the first MAX_FILES (50)
   untracked paths via `untrackedPaths.slice(0, MAX_FILES)`. With 51-500
   untracked files in a clean tree the header reported the full file count
   but only ~50 files' worth of additions, materially under-reporting the
   total. Now read every untracked path that survived the
   >MAX_FILES_FOR_DETAILS fast-path filter, with concurrency bounded to
   MAX_FILES so peak heap stays around MAX_FILES *
   UNTRACKED_READ_CHUNK_BYTES (~3.2 MB) regardless of input size.

2. renderDiffModelText interpolated raw filenames into the non-interactive
   / ACP text path. The interactive history is sanitized via
   escapeAnsiCtrlCodes(item) inside HistoryItemDisplay, but the text path
   streams to stdout / logs / transports with no equivalent hop, so a
   tracked or untracked filename containing \x1b[2J etc. could inject
   color resets, cursor moves, or full screen clears into CI logs and
   downstream terminals. Pipe r.filename through escapeAnsiCtrlCodes at
   the rendering boundary on every row variant (binary, untracked,
   deleted, modified).

Tests:
- gitDiff.test.ts: regression that asserts every one of MAX_FILES + 10
  untracked one-line files contributes to stats.linesAdded (would be 50
  pre-fix vs 60 actual).
- diffCommand.test.ts: two new specs covering ANSI escapes in
  modified-file rows and in binary / untracked / deleted suffix rows.
  Verifies raw \x1b never reaches stdout while suffix markers ((binary),
  (new), (deleted)) still render.

* fix(diff): harden quoted-path decoder and filename sanitizer

- unquoteCStylePath now walks Unicode code points so non-BMP characters
  (e.g. emoji) inside a forced-quoted path no longer get split into lone
  surrogates and decoded as replacement characters.
- Add explicit C-escape mappings for \a, \b, \f, \v so paths using those
  control bytes decode to BEL/BS/FF/VT instead of dropping the backslash.
- Replace escapeAnsiCtrlCodes(filename) at the /diff text-rendering
  boundary with a sanitizer that also escapes standalone C0/C1 control
  bytes plus DEL, closing newline / CR / BS / BEL injection vectors that
  ansi-regex does not match.
2026-05-10 11:15:59 +08:00
.github ci: reduce PR test matrix runtime (#3962) 2026-05-08 22:15:20 +08:00
.husky Sync upstream Gemini-CLI v0.8.2 (#838) 2025-10-23 09:27:04 +08:00
.qwen chore: Add bilingual requirement to create-issue command (#3952) 2026-05-08 17:51:22 +08:00
.vscode Merge branch 'main' into feat/sandbox-config-improvements 2026-03-06 14:38:39 +08:00
docs feat(core): support QWEN_HOME env var to customize config directory (#2953) 2026-05-09 15:51:52 +08:00
docs-site feat: update docs 2025-12-15 09:47:03 +08:00
eslint-rules pre-release commit 2025-07-22 23:26:01 +08:00
integration-tests feat(core): support QWEN_HOME env var to customize config directory (#2953) 2026-05-09 15:51:52 +08:00
packages feat: add /diff command and git diff statistics utility (#3491) 2026-05-10 11:15:59 +08:00
scripts feat: add /diff command and git diff statistics utility (#3491) 2026-05-10 11:15:59 +08:00
.dockerignore fix(cli): skip stdin read for ACP mode 2026-03-27 11:47:01 +00:00
.editorconfig pre-release commit 2025-07-22 23:26:01 +08:00
.gitattributes pre-release commit 2025-07-22 23:26:01 +08:00
.gitignore Feat/openrouter auth (#3576) 2026-04-27 14:47:44 +08:00
.npmrc chore: remove google registry 2025-08-08 20:45:54 +08:00
.nvmrc chore: Expand node version test matrix (#2700) 2025-07-21 16:33:54 -07:00
.prettierignore Merge branch 'main' into feat/add-vscode-settings-json-schema 2026-03-03 11:21:57 +08:00
.prettierrc.json pre-release commit 2025-07-22 23:26:01 +08:00
.yamllint.yml Sync upstream Gemini-CLI v0.8.2 (#838) 2025-10-23 09:27:04 +08:00
AGENTS.md feat(vscode): expose /skills as slash command with secondary picker (#2548) 2026-04-24 23:28:53 +08:00
CONTRIBUTING.md docs: add Screenshots/Video Demo section to PR template 2026-03-20 16:59:53 +08:00
Dockerfile refactor: Extract web-templates package and unify build/pack workflow 2026-02-26 21:02:46 +08:00
esbuild.config.js feat: add wasm build config (#2985) 2026-04-09 14:21:00 +08:00
eslint.config.js feat(cli): add API preconnect to reduce first-call latency (#3318) 2026-04-27 06:54:55 +08:00
LICENSE Sync upstream Gemini-CLI v0.8.2 (#838) 2025-10-23 09:27:04 +08:00
Makefile feat: update docs 2025-12-22 21:11:33 +08:00
package-lock.json feat(core): support QWEN_HOME env var to customize config directory (#2953) 2026-05-09 15:51:52 +08:00
package.json chore(release): v0.15.9 [skip ci] 2026-05-08 22:46:11 +08:00
README.md fix(cli): warn on ignored provider generation config (#3883) 2026-05-07 14:46:23 +08:00
SECURITY.md fix: update security vulnerability reporting channel 2026-02-24 14:22:47 +08:00
tsconfig.json # 🚀 Sync Gemini CLI v0.2.1 - Major Feature Update (#483) 2025-09-01 14:48:55 +08:00
vitest.config.ts test(channels): add comprehensive test suites for channel adapters 2026-03-27 15:26:39 +00:00

npm version License Node.js Version Downloads

QwenLM%2Fqwen-code | Trendshift

An open-source AI agent that lives in your terminal.

中文 | Deutsch | français | 日本語 | Русский | Português (Brasil)

🎉 News

  • 2026-04-15: Qwen OAuth free tier has been discontinued. To continue using Qwen Code, switch to Alibaba Cloud Coding Plan, OpenRouter, Fireworks AI, or bring your own API key. Run qwen auth to configure.

  • 2026-04-13: Qwen OAuth free tier policy update: daily quota adjusted to 100 requests/day (from 1,000).

  • 2026-04-02: Qwen3.6-Plus is now live! Get an API key from Alibaba Cloud ModelStudio to access it through the OpenAI-compatible API.

  • 2026-02-16: Qwen3.5-Plus is now live!

Why Qwen Code?

Qwen Code is an open-source AI agent for the terminal, optimized for Qwen series models. It helps you understand large codebases, automate tedious work, and ship faster.

  • Multi-protocol, flexible providers: use OpenAI / Anthropic / Gemini-compatible APIs, Alibaba Cloud Coding Plan, OpenRouter, Fireworks AI, or bring your own API key.
  • Open-source, co-evolving: both the framework and the Qwen3-Coder model are open-source—and they ship and evolve together.
  • Agentic workflow, feature-rich: rich built-in tools (Skills, SubAgents) for a full agentic workflow and a Claude Code-like experience.
  • Terminal-first, IDE-friendly: built for developers who live in the command line, with optional integration for VS Code, Zed, and JetBrains IDEs.

Installation

Linux / macOS

bash -c "$(curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh)"

Windows (Run as Administrator)

Works in both Command Prompt and PowerShell:

powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"

Note

: It's recommended to restart your terminal after installation to ensure environment variables take effect.

Manual Installation

Prerequisites

Make sure you have Node.js 20 or later installed. Download it from nodejs.org.

NPM

npm install -g @qwen-code/qwen-code@latest

Homebrew (macOS, Linux)

brew install qwen-code

Quick Start

# Start Qwen Code (interactive)
qwen

# Then, in the session:
/help
/auth

On first use, you'll be prompted to sign in. You can run /auth anytime to switch authentication methods.

Example prompts:

What does this project do?
Explain the codebase structure.
Help me refactor this function.
Generate unit tests for this module.
Click to watch a demo video

🦞 Use Qwen Code for Coding Tasks in Claw

Copy the prompt below and paste it into your agent:

Use Qwen Code as a coding agent. First, fetch and read this skill reference:
https://raw.githubusercontent.com/QwenLM/qwen-code/refs/heads/main/.qwen/skills/qwen-code-claw/SKILL.md
Then follow the instructions inside to install, authenticate, and use Qwen Code via acpx for all coding tasks.

Authentication

Qwen Code supports the following authentication methods:

  • API Key (recommended): use an API key from Alibaba Cloud Model Studio (Beijing / intl) or any supported provider (OpenAI, Anthropic, Google GenAI, and other compatible endpoints).
  • Coding Plan: subscribe to the Alibaba Cloud Coding Plan (Beijing / intl) for a fixed monthly fee with higher quotas.

⚠️ Qwen OAuth was discontinued on April 15, 2026. If you were previously using Qwen OAuth, please switch to one of the methods above. Run qwen and then /auth to reconfigure.

Use an API key to connect to Alibaba Cloud Model Studio or any supported provider. Supports multiple protocols:

  • OpenAI-compatible: Alibaba Cloud ModelStudio, ModelScope, OpenAI, OpenRouter, and other OpenAI-compatible providers
  • Anthropic: Claude models
  • Google GenAI: Gemini models

The recommended way to configure models and providers is by editing ~/.qwen/settings.json (create it if it doesn't exist). This file lets you define all available models, API keys, and default settings in one place.

Quick Setup in 3 Steps

Step 1: Create or edit ~/.qwen/settings.json

Here is a complete example:

{
  "modelProviders": {
    "openai": [
      {
        "id": "qwen3.6-plus",
        "name": "qwen3.6-plus",
        "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "description": "Qwen3-Coder via Dashscope",
        "envKey": "DASHSCOPE_API_KEY"
      }
    ]
  },
  "env": {
    "DASHSCOPE_API_KEY": "sk-xxxxxxxxxxxxx"
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "qwen3.6-plus"
  }
}

Step 2: Understand each field

Field What it does
modelProviders Declares which models are available and how to connect to them. Keys like openai, anthropic, gemini represent the API protocol.
modelProviders[].id The model ID sent to the API (e.g. qwen3.6-plus, gpt-4o).
modelProviders[].envKey The name of the environment variable that holds your API key.
modelProviders[].baseUrl The API endpoint URL (required for non-default endpoints).
env A fallback place to store API keys (lowest priority; prefer .env files or export for sensitive keys).
security.auth.selectedType The protocol to use on startup (openai, anthropic, gemini, vertex-ai).
model.name The default model to use when Qwen Code starts.

Step 3: Start Qwen Code — your configuration takes effect automatically:

qwen

Use the /model command at any time to switch between all configured models.

More Examples
Coding Plan (Alibaba Cloud ModelStudio) — fixed monthly fee, higher quotas
{
  "modelProviders": {
    "openai": [
      {
        "id": "qwen3.6-plus",
        "name": "qwen3.6-plus (Coding Plan)",
        "baseUrl": "https://coding.dashscope.aliyuncs.com/v1",
        "description": "qwen3.6-plus from ModelStudio Coding Plan",
        "envKey": "BAILIAN_CODING_PLAN_API_KEY"
      },
      {
        "id": "qwen3.5-plus",
        "name": "qwen3.5-plus (Coding Plan)",
        "baseUrl": "https://coding.dashscope.aliyuncs.com/v1",
        "description": "qwen3.5-plus with thinking enabled from ModelStudio Coding Plan",
        "envKey": "BAILIAN_CODING_PLAN_API_KEY",
        "generationConfig": {
          "extra_body": {
            "enable_thinking": true
          }
        }
      },
      {
        "id": "glm-4.7",
        "name": "glm-4.7 (Coding Plan)",
        "baseUrl": "https://coding.dashscope.aliyuncs.com/v1",
        "description": "glm-4.7 with thinking enabled from ModelStudio Coding Plan",
        "envKey": "BAILIAN_CODING_PLAN_API_KEY",
        "generationConfig": {
          "extra_body": {
            "enable_thinking": true
          }
        }
      },
      {
        "id": "kimi-k2.5",
        "name": "kimi-k2.5 (Coding Plan)",
        "baseUrl": "https://coding.dashscope.aliyuncs.com/v1",
        "description": "kimi-k2.5 with thinking enabled from ModelStudio Coding Plan",
        "envKey": "BAILIAN_CODING_PLAN_API_KEY",
        "generationConfig": {
          "extra_body": {
            "enable_thinking": true
          }
        }
      }
    ]
  },
  "env": {
    "BAILIAN_CODING_PLAN_API_KEY": "sk-xxxxxxxxxxxxx"
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "qwen3.6-plus"
  }
}

Subscribe to the Coding Plan and get your API key at Alibaba Cloud ModelStudio(Beijing) or Alibaba Cloud ModelStudio(intl).

Multiple providers (OpenAI + Anthropic + Gemini)
{
  "modelProviders": {
    "openai": [
      {
        "id": "gpt-4o",
        "name": "GPT-4o",
        "envKey": "OPENAI_API_KEY",
        "baseUrl": "https://api.openai.com/v1"
      }
    ],
    "anthropic": [
      {
        "id": "claude-sonnet-4-20250514",
        "name": "Claude Sonnet 4",
        "envKey": "ANTHROPIC_API_KEY"
      }
    ],
    "gemini": [
      {
        "id": "gemini-2.5-pro",
        "name": "Gemini 2.5 Pro",
        "envKey": "GEMINI_API_KEY"
      }
    ]
  },
  "env": {
    "OPENAI_API_KEY": "sk-xxxxxxxxxxxxx",
    "ANTHROPIC_API_KEY": "sk-ant-xxxxxxxxxxxxx",
    "GEMINI_API_KEY": "AIzaxxxxxxxxxxxxx"
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "gpt-4o"
  }
}
Enable thinking mode (for supported models like qwen3.5-plus)
{
  "modelProviders": {
    "openai": [
      {
        "id": "qwen3.5-plus",
        "name": "qwen3.5-plus (thinking)",
        "envKey": "DASHSCOPE_API_KEY",
        "baseUrl": "https://dashscope.aliyuncs.com/compatible-mode/v1",
        "generationConfig": {
          "extra_body": {
            "enable_thinking": true
          }
        }
      }
    ]
  },
  "env": {
    "DASHSCOPE_API_KEY": "sk-xxxxxxxxxxxxx"
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "qwen3.5-plus"
  }
}

Tip: You can also set API keys via export in your shell or .env files, which take higher priority than settings.jsonenv. See the authentication guide for full details.

Security note: Never commit API keys to version control. The ~/.qwen/settings.json file is in your home directory and should stay private.

Local Model Setup (Ollama / vLLM)

You can also run models locally — no API key or cloud account needed. This is not an authentication method; instead, configure your local model endpoint in ~/.qwen/settings.json using the modelProviders field.

Set generationConfig.contextWindowSize inside the matching provider entry and adjust it to the context length configured on your local server.

Ollama setup
  1. Install Ollama from ollama.com
  2. Pull a model: ollama pull qwen3:32b
  3. Configure ~/.qwen/settings.json:
{
  "modelProviders": {
    "openai": [
      {
        "id": "qwen3:32b",
        "name": "Qwen3 32B (Ollama)",
        "baseUrl": "http://localhost:11434/v1",
        "description": "Qwen3 32B running locally via Ollama",
        "generationConfig": {
          "contextWindowSize": 131072
        }
      }
    ]
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "qwen3:32b"
  }
}
vLLM setup
  1. Install vLLM: pip install vllm
  2. Start the server: vllm serve Qwen/Qwen3-32B
  3. Configure ~/.qwen/settings.json:
{
  "modelProviders": {
    "openai": [
      {
        "id": "Qwen/Qwen3-32B",
        "name": "Qwen3 32B (vLLM)",
        "baseUrl": "http://localhost:8000/v1",
        "description": "Qwen3 32B running locally via vLLM",
        "generationConfig": {
          "contextWindowSize": 131072
        }
      }
    ]
  },
  "security": {
    "auth": {
      "selectedType": "openai"
    }
  },
  "model": {
    "name": "Qwen/Qwen3-32B"
  }
}

Usage

As an open-source terminal agent, you can use Qwen Code in four primary ways:

  1. Interactive mode (terminal UI)
  2. Headless mode (scripts, CI)
  3. IDE integration (VS Code, Zed)
  4. SDKs (TypeScript, Python, Java)

Interactive mode

cd your-project/
qwen

Run qwen in your project folder to launch the interactive terminal UI. Use @ to reference local files (for example @src/main.ts).

Headless mode

cd your-project/
qwen -p "your question"

Use -p to run Qwen Code without the interactive UI—ideal for scripts, automation, and CI/CD. Learn more: Headless mode.

IDE integration

Use Qwen Code inside your editor (VS Code, Zed, and JetBrains IDEs):

SDKs

Build on top of Qwen Code with the available SDKs:

Python SDK example:

import asyncio

from qwen_code_sdk import is_sdk_result_message, query


async def main() -> None:
    result = query(
        "Summarize the repository layout.",
        {
            "cwd": "/path/to/project",
            "path_to_qwen_executable": "qwen",
        },
    )

    async for message in result:
        if is_sdk_result_message(message):
            print(message["result"])


asyncio.run(main())

Commands & Shortcuts

Session Commands

  • /help - Display available commands
  • /clear - Clear conversation history
  • /compress - Compress history to save tokens
  • /stats - Show current session information
  • /bug - Submit a bug report
  • /exit or /quit - Exit Qwen Code

Keyboard Shortcuts

  • Ctrl+C - Cancel current operation
  • Ctrl+D - Exit (on empty line)
  • Up/Down - Navigate command history

Learn more about Commands

Tip: In YOLO mode (--yolo), vision switching happens automatically without prompts when images are detected. Learn more about Approval Mode

Configuration

Qwen Code can be configured via settings.json, environment variables, and CLI flags.

File Scope Description
~/.qwen/settings.json User (global) Applies to all your Qwen Code sessions. Recommended for modelProviders and env.
.qwen/settings.json Project Applies only when running Qwen Code in this project. Overrides user settings.

The most commonly used top-level fields in settings.json:

Field Description
modelProviders Define available models per protocol (openai, anthropic, gemini, vertex-ai).
env Fallback environment variables (e.g. API keys). Lower priority than shell export and .env files.
security.auth.selectedType The protocol to use on startup (e.g. openai).
model.name The default model to use when Qwen Code starts.

See the Authentication section above for complete settings.json examples, and the settings reference for all available options.

Benchmark Results

Terminal-Bench Performance

Agent Model Accuracy
Qwen Code Qwen3-Coder-480A35 37.5%
Qwen Code Qwen3-Coder-30BA3B 31.3%

Ecosystem

Looking for a graphical interface?

  • AionUi A modern GUI for command-line AI tools including Qwen Code
  • Gemini CLI Desktop A cross-platform desktop/web/mobile UI for Qwen Code

Troubleshooting

If you encounter issues, check the troubleshooting guide.

Common issues:

  • Qwen OAuth free tier was discontinued on 2026-04-15: Qwen OAuth is no longer available. Run qwen/auth and switch to API Key or Coding Plan. See the Authentication section above for setup instructions.

To report a bug from within the CLI, run /bug and include a short title and repro steps.

Connect with Us

Acknowledgments

This project is based on Google Gemini CLI. We acknowledge and appreciate the excellent work of the Gemini CLI team. Our main contribution focuses on parser-level adaptations to better support Qwen-Coder models.