Skip to content

feat(desktop): Add desktop app package with Qwen ACP SDK integration - #3778

Merged
DragonnZhang merged 447 commits into
mainfrom
dragon/feat-unstable-desktop-app
Jun 11, 2026
Merged

feat(desktop): Add desktop app package with Qwen ACP SDK integration#3778
DragonnZhang merged 447 commits into
mainfrom
dragon/feat-unstable-desktop-app

fix(ci): address desktop CI failures

9f2d508
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL succeeded Jun 10, 2026 in 5s

No new alerts in code changed by this pull request

View all branch alerts.

Annotations

Check failure on line 4271 in packages/desktop/packages/shared/src/agent/qwen-agent.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '#"-' and with many repetitions of '"-'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '#"-' and with many repetitions of '"-'.

Check failure on line 40 in packages/desktop/packages/shared/src/automations/utils.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '${' and with many repetitions of '${|'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '${' and with many repetitions of '${|'.

Check failure on line 788 in packages/desktop/packages/shared/src/config/validators.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '-'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '-'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '-'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '-'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '-'.

Check failure on line 49 in packages/desktop/packages/shared/src/labels/auto/normalize.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '0' and with many repetitions of '00'.

Check failure on line 54 in packages/desktop/packages/shared/src/labels/auto/validation.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '(' and with many repetitions of '('.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '(' and with many repetitions of '('.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '(*' and with many repetitions of '*'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '(*' and with many repetitions of '*'.

Check failure on line 89 in packages/desktop/packages/shared/src/mentions/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[skill:' and with many repetitions of '[skill:\'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[skill:' and with many repetitions of '[skill:\'.

Check failure on line 106 in packages/desktop/packages/shared/src/mentions/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[file:' and with many repetitions of '[file:\'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[file:' and with many repetitions of '[file:\'.

Check failure on line 115 in packages/desktop/packages/shared/src/mentions/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[folder:' and with many repetitions of '[folder:\'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[folder:' and with many repetitions of '[folder:\'.

Check failure on line 204 in packages/desktop/packages/shared/src/mentions/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[file:' and with many repetitions of '[file:\'.

Check failure on line 303 in packages/desktop/packages/shared/src/sessions/jsonl.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.

Check failure on line 302 in packages/desktop/packages/shared/src/sessions/jsonl.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<edit_request>' and with many repetitions of '<edit_request>'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<edit_request>' and with many repetitions of '<edit_request>'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<edit_request>' and with many repetitions of '<edit_request>'.

Check failure on line 30 in packages/desktop/packages/shared/src/sessions/slug-generator.ts

See this annotation in the file changed.

Code scanning / CodeQL

Creating biased random numbers from a cryptographically secure source High

Using modulo on a
cryptographically secure random number
Loading
produces biased results.

Check failure on line 341 in packages/desktop/packages/shared/src/sources/server-builder.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '/'.

Check failure on line 174 in packages/desktop/packages/shared/src/sources/storage.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'json\n' and with many repetitions of 'json\na'.

Check failure on line 439 in packages/desktop/packages/ui/src/components/chat/TurnCard.tsx

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '\n' and with many repetitions of '\n'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '\n' and with many repetitions of '\n'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '\n' and with many repetitions of '\n'.

Check failure on line 24 in packages/desktop/packages/ui/src/components/markdown/linkify.ts

See this annotation in the file changed.

Code scanning / CodeQL

Useless regular-expression character escape High

The escape sequence '.' is equivalent to just '.', so the sequence may still represent a meta-character when it is used in a
regular expression
Loading
.

Check failure on line 24 in packages/desktop/packages/ui/src/components/markdown/linkify.ts

See this annotation in the file changed.

Code scanning / CodeQL

Useless regular-expression character escape High

The escape sequence '.' is equivalent to just '.', so the sequence may still represent a meta-character when it is used in a
regular expression
Loading
.

Check failure on line 24 in packages/desktop/packages/ui/src/components/markdown/linkify.ts

See this annotation in the file changed.

Code scanning / CodeQL

Useless regular-expression character escape High

The escape sequence '.' is equivalent to just '.', so the sequence may still represent a meta-character when it is used in a
regular expression
Loading
.

Check failure on line 221 in packages/desktop/packages/ui/src/components/markdown/linkify.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[](' and with many repetitions of '[](('.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '[](' and with many repetitions of '[](('.

Check failure on line 27 in packages/desktop/packages/ui/src/components/markdown/table-export.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 169 in packages/desktop/packages/ui/src/lib/tool-parsers.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'Links: [' and with many repetitions of 'Links: ['.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'Links: [' and with many repetitions of 'Links: ['.

Check failure on line 369 in packages/desktop/apps/cli/src/client.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Disabling certificate validation High

Disabling certificate validation is strongly discouraged.

Check failure on line 713 in packages/desktop/apps/electron/src/renderer/lib/icon-cache.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
on
Loading
, which may cause an HTML attribute injection vulnerability.

Check failure on line 712 in packages/desktop/apps/electron/src/renderer/lib/icon-cache.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
on
Loading
, which may cause an HTML attribute injection vulnerability.

Check failure on line 711 in packages/desktop/apps/electron/src/renderer/lib/icon-cache.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.