feat(cli): wrap markdown links in OSC 8 so wrapped URLs stay clickable

docs/users/configuration/settings.md

@@ -583,6 +583,8 @@ For authentication-related variables (like `OPENAI_*`) and the recommended `.qwe
 | `SEATBELT_PROFILE`                                 | (macOS specific) Switches the Seatbelt (`sandbox-exec`) profile on macOS.                                                                                                                                                                                                         | `permissive-open`: (Default) Restricts writes to the project folder (and a few other folders, see `packages/cli/src/utils/sandbox-macos-permissive-open.sb`) but allows other operations. `strict`: Uses a strict profile that declines operations by default. `<profile_name>`: Uses a custom profile. To define a custom profile, create a file named `sandbox-macos-<profile_name>.sb` in your project's `.qwen/` directory (e.g., `my-project/.qwen/sandbox-macos-custom.sb`). |
 | `DEBUG` or `DEBUG_MODE`                            | (often used by underlying libraries or the CLI itself) Set to `true` or `1` to enable verbose debug logging, which can be helpful for troubleshooting.                                                                                                                            | **Note:** These variables are automatically excluded from project `.env` files by default to prevent interference with the CLI behavior. Use `.qwen/.env` files if you need to set these for Qwen Code specifically.                                                                                                                                                                                                                                                               |
 | `NO_COLOR`                                         | Set to any value to disable all color output in the CLI.                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `FORCE_HYPERLINK`                                  | Override the OSC 8 clickable-link detection in the markdown renderer. Set to `1` (or any non-zero value, or empty string) to force-enable, `0` to force-disable. Honors `NO_COLOR` / `QWEN_DISABLE_HYPERLINKS` opt-outs above it.                                                 | Use this to opt into OSC 8 inside `tmux` / GNU `screen` (auto-detection refuses by default because the host terminal's capabilities are hidden behind the multiplexer). Requires `set -g allow-passthrough on` on tmux 3.3+. Also enables Hyper, which isn't auto-detected.                                                                                                                                                                                                        |
+| `QWEN_DISABLE_HYPERLINKS`                          | Set to `1` to hard-disable OSC 8 clickable hyperlinks in the markdown renderer even on terminals that auto-detect as capable.                                                                                                                                                     | Useful when a terminal advertises support but breaks on long URLs, or when piping output through an intermediary that mangles escape sequences. The renderer falls back to plain `label (url)` rendering.                                                                                                                                                                                                                                                                          |
 | `CLI_TITLE`                                        | Set to a string to customize the title of the CLI.                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `CODE_ASSIST_ENDPOINT`                             | Specifies the endpoint for the code assist server.                                                                                                                                                                                                                                | This is useful for development and testing.                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `QWEN_CODE_MAX_OUTPUT_TOKENS`                      | Overrides the default maximum output tokens per response. When not set, Qwen Code uses an adaptive strategy: starts with 8K tokens and automatically retries with 64K if the response is truncated. Set this to a specific value (e.g., `16000`) to use a fixed limit instead.    | Takes precedence over the capped default (8K) but is overridden by `samplingParams.max_tokens` in settings. Disables automatic escalation when set. Example: `export QWEN_CODE_MAX_OUTPUT_TOKENS=16000`                                                                                                                                                                                                                                                                            |

packages/cli/src/ui/components/mcp/steps/AuthenticateStep.tsx

@@ -18,57 +18,17 @@ import {
 } from '@qwen-code/qwen-code-core';
 import type { OAuthDisplayPayload } from '@qwen-code/qwen-code-core';
 import { appEvents, AppEvent } from '../../../../utils/events.js';
+import {
+  osc8Hyperlink,
+  supportsHyperlinks,
+  wrapForMultiplexer,
+} from '../../../utils/osc8.js';
 
 type AuthState = 'idle' | 'authenticating' | 'success' | 'error';
 
 const AUTO_BACK_DELAY_MS = 2000;
 const COPY_FEEDBACK_MS = 2000;
 
-/**
- * Wrap an OSC sequence for terminal multiplexers so the host terminal
- * receives it. tmux requires a DCS passthrough with inner ESCs doubled;
- * GNU screen uses a plain DCS envelope. Note: tmux 3.3+ defaults
- * `allow-passthrough` to off — users on default configs will not see
- * the hyperlink until they set `set -g allow-passthrough on`.
- */
-function wrapForMultiplexer(osc: string): string {
-  if (process.env['TMUX']) {
-    return `\x1bPtmux;${osc.split('\x1b').join('\x1b\x1b')}\x1b\\`;
-  }
-  if (process.env['STY']) {
-    return `\x1bP${osc}\x1b\\`;
-  }
-  return osc;
-}
-
-/**
- * Strip C0 control characters and DEL so an untrusted string can be safely
- * embedded inside an OSC escape. Without this a `\x07` (BEL) or `\x1b` (ESC)
- * in the input would prematurely terminate the OSC sequence and leak the
- * tail bytes to the terminal as interpretable escape codes.
- */
-function sanitizeForOsc(s: string): string {
-  // eslint-disable-next-line no-control-regex
-  return s.replace(/[\x00-\x1f\x7f]/g, '');
-}
-
-/**
- * Wrap a URL in an OSC 8 hyperlink escape sequence. Supported terminals
- * (iTerm2, WezTerm, Kitty, Windows Terminal, VS Code, GNOME Terminal, …)
- * render it as a clickable link; terminals without OSC 8 support ignore
- * the escapes and print the raw text. BEL (\x07) terminates the OSC
- * sequence — more broadly supported than ST (ESC \\).
- *
- * Inside tmux / screen the OSC sequence is wrapped in a DCS passthrough
- * envelope (see `wrapForMultiplexer`) so the multiplexer forwards it to
- * the host terminal instead of eating it.
- */
-function osc8Hyperlink(url: string, label = url): string {
-  const safeUrl = sanitizeForOsc(url);
-  const safeLabel = sanitizeForOsc(label);
-  return wrapForMultiplexer(`\x1b]8;;${safeUrl}\x07${safeLabel}\x1b]8;;\x07`);
-}
-
 /**
  * Copy a string to the user's clipboard using the OSC 52 terminal escape
  * sequence. Works through SSH and most web terminals (iTerm2, Windows
@@ -292,7 +252,9 @@ export const AuthenticateStep: React.FC<AuthenticateStepProps> = ({
 
       {authUrl && (
         <Box>
-          <Text color={theme.text.accent}>{osc8Hyperlink(authUrl)}</Text>
+          <Text color={theme.text.accent}>
+            {supportsHyperlinks() ? osc8Hyperlink(authUrl) : authUrl}
+          </Text>
         </Box>
       )}