fix(ci): cover release integration regressions

integration-tests/cli/qwen-serve-client-mcp.test.ts

@@ -58,7 +58,12 @@ const REPO_ROOT = path.resolve(__dirname, '../..');
 // platform-agnostic, but daemon SIGTERM teardown is cleaner on POSIX. Keep it
 // running everywhere `ws` works.
 const SKIP = process.platform === 'win32';
+const SANDBOX_MODE = process.env['QWEN_SANDBOX']?.toLowerCase().trim();
+const SKIP_PROMPTED_MODEL_TEST = Boolean(
+  SANDBOX_MODE && SANDBOX_MODE !== 'false' && SANDBOX_MODE !== '0',
+);
 const describeMaybe = SKIP ? describe.skip : describe;
+const itPromptedModelMaybe = SKIP_PROMPTED_MODEL_TEST ? it.skip : it;
 
 let daemon: ChildProcess;
 let port = 0;
@@ -417,7 +422,9 @@ describeMaybe('qwen serve — reverse tool channel (client-hosted MCP over WS)',
   //
   // This test does session/new THEN mcp_register (the "register after a session
   // already exists" timing), exercising the fan-out path specifically.
-  it('drives a model→agent tools/call of chrome_read_page over the reverse WS channel and consumes the result', async () => {
+  // Under container sandboxing, the ACP child cannot reach the host-loopback
+  // fake model server used below; keep the discovery-only test running there.
+  itPromptedModelMaybe('drives a model→agent tools/call of chrome_read_page over the reverse WS channel and consumes the result', async () => {
     const ws = new WebSocket(`ws://127.0.0.1:${port}/acp`, {
       headers: { Authorization: `Bearer ${TOKEN}` },
     });

packages/chrome-extension/package.json

@@ -24,12 +24,12 @@
     "README.md"
   ],
   "scripts": {
-    "dev": "EXTENSION_OUT_DIR=dist/extension node scripts/dev-watch.js",
+    "dev": "node scripts/dev-watch.js",
     "debug:mac": "./scripts/debug.sh",
     "sync:extension": "node scripts/sync-extension.js",
     "build:bg": "node scripts/sync-extension.js && node config/esbuild.background.config.js",
     "build:bg:watch": "node scripts/sync-extension.js && node config/esbuild.background.config.js --watch",
-    "build": "EXTENSION_OUT_DIR=dist/extension npm run clean && EXTENSION_OUT_DIR=dist/extension node scripts/sync-extension.js && EXTENSION_OUT_DIR=dist/extension node config/esbuild.background.config.js --production",
+    "build": "node scripts/sync-extension.js && node config/esbuild.background.config.js --production",
     "test": "vitest run --config vitest.config.ts",
     "test:ci": "vitest run --config vitest.config.ts",
     "dev:chrome": "open -a 'Google Chrome' --args --load-extension=$PWD/dist/extension --auto-open-devtools-for-tabs",

scripts/tests/chrome-extension-package.test.js

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '../..');
+
+describe('chrome extension package scripts', () => {
+  it('keeps the build script portable for Windows npm lifecycle runs', () => {
+    const packageJson = JSON.parse(
+      readFileSync(
+        path.join(root, 'packages/chrome-extension/package.json'),
+        'utf8',
+      ),
+    );
+
+    expect(packageJson.scripts.build).not.toMatch(
+      /(?:^|\s&&\s)[A-Za-z_][A-Za-z0-9_]*=/,
+    );
+  });
+});