mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-07-10 01:29:17 +00:00
Some checks are pending
Qwen Code CI / Classify PR (push) Waiting to run
Qwen Code CI / Lint (push) Blocked by required conditions
Qwen Code CI / Test (macos-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (ubuntu-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Test (windows-latest, Node 22.x) (push) Blocked by required conditions
Qwen Code CI / Post Coverage Comment (push) Blocked by required conditions
Qwen Code CI / CodeQL (push) Blocked by required conditions
E2E Tests / E2E Test (Linux) - sandbox:docker (push) Waiting to run
E2E Tests / E2E Test (Linux) - sandbox:none (push) Waiting to run
E2E Tests / E2E Test - macOS (push) Waiting to run
* feat(channels): add Feishu (Lark) channel adapter * fix(channels/feishu): fix webhook stop button, memory leak, spin-wait timeout, and reaction cleanup * fix(channels/feishu): fix security, stability and build issues from PR review * fix(channels/feishu): fix card lifecycle, streaming limits, and download safety from CR round 2 * fix(channels/feishu): harden webhook, card lifecycle, and disconnect cleanup from CR round 3 * fix(feishu): clarify stoppedMessages JSDoc to match actual cleanup behavior * fix(channels/feishu): handle post messages without language key wrapper in quote context * fix(channels/feishu): fix webhook signature bypass, stop-button double-send, and blockStreaming duplicates from CR round 4 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 * fix(channels/feishu): harden card lifecycle, markdown splitting, and defensive guards from CR round 5 - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning * fix(channels/feishu): fix HMAC bypass, prompt injection, SSRF, and card lifecycle from CR round 5-6 Security: - Fix webhook HMAC bypass: use defineProperty(non-enumerable) for headers instead of prototype shadowing - Fix cross-user prompt injection: mark quoted content as untrusted with explicit marker - Fix SSRF: validate all Feishu IDs with FEISHU_ID_RE before URL interpolation in 6 endpoints - Fix safeSenderId regex: add hyphen to character class so ou_abc-def-123 is not rejected Card lifecycle: - Set cardCreationFailed on onPromptStart failure to prevent retry spiral - Skip throttle updates when card creation permanently failed - Fallback to plain message delivery when cardCreationFailed with accumulated text - Track creationTimer in CardSessionState so cleanupCard/disconnect can cancel orphaned card creation - Add cs.stopped and else branch in onPromptEnd to prevent timer race and state leak - Mark cardState.stopped after busy-wait timeout to abandon orphaned in-flight creation - Apply MAX_CARD_CHARS truncation with fence parity in onResponseComplete - Preserve atPrefix in streaming truncation to prevent @mention visual snap - Account for suffix and fence reserve in truncation maxBody calculation - Clean up auxiliary maps after handleInbound when gate rejects the message - Clean up blockStreaming mode Map entries in onPromptEnd - Skip bare @mention without question text Markdown: - Handle code fences in hard-split and table-stripping fallbacks - Use parity-based fence detection in splitByTables (align with splitChunks) - Replace spanning regex in table-stripping with line-by-line stripTables() to resolve CodeQL ReDoS warning Defensive guards: - Sanitize senderId before <at> tag interpolation - Use replaceAll + callback form for mention replacement - Floor token expiry to prevent thundering herd on expire:0 - Add log for stop-button auth rejection Tests: - Fix stoppedMessages JSDoc to match actual cleanup lifecycle - Fix test fixture to match "still creating" scenario - Fix typecheck errors in test file (TS2571, TS4111) - Add stop-button auth negative path tests (operator mismatch, missing operator, missing sender) - Assert cancelSession called in stop-button happy-path test * fix(channels/feishu): add request timeouts, token dedup, and harden file/quote sanitization * fix(channels/feishu): harden card lifecycle, webhook auth, and resource cleanup from CR round 7 * fix(channels/feishu): harden card lifecycle, mention handling, and error recovery
96 lines
3 KiB
JavaScript
96 lines
3 KiB
JavaScript
/**
|
|
* @license
|
|
* Copyright 2025 Google LLC
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
import { execSync } from 'node:child_process';
|
|
import { existsSync } from 'node:fs';
|
|
import { dirname, join } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
const root = join(__dirname, '..');
|
|
|
|
// npm install if node_modules was removed (e.g. via npm run clean or scripts/clean.js)
|
|
if (!existsSync(join(root, 'node_modules'))) {
|
|
execSync('npm install', { stdio: 'inherit', cwd: root });
|
|
}
|
|
|
|
// build all workspaces/packages in dependency order
|
|
execSync('npm run generate', { stdio: 'inherit', cwd: root });
|
|
|
|
// Build in dependency order:
|
|
// 1. core (foundation package, includes test-utils)
|
|
// 2. web-templates (embeddable web templates - used by cli)
|
|
// 3. channel-base (base channel infrastructure - used by channel adapters and cli)
|
|
// 4. channel adapters (depend on channel-base)
|
|
// 5. acp-bridge (depends on core - used by cli)
|
|
// 6. cli (depends on core, acp-bridge, web-templates, channel packages)
|
|
// 7. webui (shared UI components - used by vscode companion)
|
|
// 8. sdk (no internal dependencies)
|
|
// 9. vscode-ide-companion (depends on webui)
|
|
const buildOrder = [
|
|
'packages/core',
|
|
'packages/web-templates',
|
|
'packages/channels/base',
|
|
'packages/channels/telegram',
|
|
'packages/channels/weixin',
|
|
'packages/channels/dingtalk',
|
|
'packages/channels/feishu',
|
|
'packages/channels/plugin-example',
|
|
'packages/acp-bridge',
|
|
'packages/cli',
|
|
'packages/webui',
|
|
'packages/sdk-typescript',
|
|
'packages/vscode-ide-companion',
|
|
];
|
|
|
|
for (const workspace of buildOrder) {
|
|
execSync(`npm run build --workspace=${workspace}`, {
|
|
stdio: 'inherit',
|
|
cwd: root,
|
|
});
|
|
|
|
// After cli is built, generate the JSON Schema for settings
|
|
// so the vscode-ide-companion extension can provide IntelliSense
|
|
if (workspace === 'packages/cli') {
|
|
execSync('node --import tsx/esm scripts/generate-settings-schema.ts', {
|
|
stdio: 'inherit',
|
|
cwd: root,
|
|
});
|
|
}
|
|
}
|
|
|
|
// also build container image if sandboxing is enabled
|
|
// skip (-s) npm install + build since we did that above
|
|
try {
|
|
execSync('node scripts/sandbox_command.js -q', {
|
|
stdio: 'inherit',
|
|
cwd: root,
|
|
});
|
|
if (
|
|
process.env.BUILD_SANDBOX === '1' ||
|
|
process.env.BUILD_SANDBOX === 'true'
|
|
) {
|
|
execSync('node scripts/build_sandbox.js -s', {
|
|
stdio: 'inherit',
|
|
cwd: root,
|
|
});
|
|
}
|
|
} catch {
|
|
// ignore
|
|
}
|