fix(deps): clear critical runtime audit findings

[gauravyad86]

What this PR does

This PR updates the runtime dependency versions that were responsible for critical npm audit findings in the CLI and core dependency tree. It also adds a small CI check that runs a production-only audit at the critical threshold, so this class of issue is caught before future changes move forward.

Why it's needed

Qwen Code runs local shell, git, archive, and network workflows, so critical advisories in runtime dependencies deserve a fast and focused fix. The old versions of packages such as simple-git and shell-quote could remain in the lockfile while normal build and type checks still passed, because CI installs dependencies with --no-audit.

This PR keeps the scope intentionally narrow. It clears the critical runtime audit path and leaves the larger high/moderate follow-up work, such as diff@9 and OpenTelemetry, for separate PRs because those upgrades require broader compatibility work.

Reviewer Test Plan

How to verify

Run npm run audit:runtime:critical and confirm it exits successfully. The command may still print lower-severity audit entries, but it should not fail while there are no critical runtime advisories.

Run the focused shell, git, archive, and update tests to confirm the updated runtime packages still work in the code paths that use them.

Evidence (Before & After)

Before: npm audit --omit=dev --audit-level=critical failed because critical runtime advisories were present.

After: npm run audit:runtime:critical exits successfully. The dependency tree now resolves simple-git@3.36.0, shell-quote@1.9.0, tar@7.5.19, and undici@6.27.0 for the relevant runtime packages.

Local validation completed:

npm install
npm run check:lockfile
npm run typecheck
npm run audit:runtime:critical
cd packages/core && npx vitest run src/utils/shell-utils.test.ts src/tools/shell.test.ts src/services/gitWorktreeService.test.ts src/extension/github.test.ts
cd packages/cli && npx vitest run src/utils/sandbox.test.ts src/utils/standalone-update.test.ts src/utils/gitUtils.test.ts
npm run lint

Results: build completed through npm install/prepare; lockfile check passed; typecheck passed; critical runtime audit exited successfully; 479 focused core tests passed; 70 focused CLI tests passed; lint passed.

Tested on

OS	Status
🍏 macOS	✅ tested
🪟 Windows	⚠️ not tested locally
🐧 Linux	⚠️ not tested locally

Environment (optional)

Node/npm workspace install on macOS. No UI or TUI behavior changed.

Risk & Scope

• Main risk or tradeoff: dependency updates can expose subtle behavior changes, especially in shell parsing, git, archive extraction, and HTTP handling. The PR uses patched non-major versions for the runtime dependencies and validates the most relevant local test areas.
• Not validated / out of scope: high and moderate audit entries that need breaking upgrades remain out of scope. In particular, diff@9 changes exported types and needs a separate compatibility PR.
• Breaking changes / migration notes: none expected.

Linked Issues

Fixes #6063
Refs #6062

中文说明

这个 PR 做了什么

这个 PR 更新了 CLI 和 core 运行时依赖树中导致 critical 级别 npm audit 报告的依赖版本。同时增加了一个很小的 CI 检查，只审计生产依赖里的 critical 级别问题，这样以后同类问题可以在合入前被发现。

为什么需要这个改动

Qwen Code 会执行本地 shell、git、归档解压和网络相关流程，所以运行时依赖里的 critical 级别安全问题需要优先处理。旧版本的 simple-git、shell-quote 等依赖即使存在安全告警，也可能在正常 build 和 typecheck 通过的情况下继续留在 lockfile 里，因为 CI 安装依赖时使用了 --no-audit。

这个 PR 有意保持很小的范围。它清理 critical 级别的运行时 audit 路径，并把更大的 high/moderate 后续工作留给单独 PR，例如 diff@9 和 OpenTelemetry，因为这些升级需要更多兼容性处理。

Reviewer Test Plan

如何验证

运行 npm run audit:runtime:critical，确认命令成功退出。这个命令可能仍然打印较低级别的 audit 信息，但在没有 critical 运行时告警时不应该失败。

运行聚焦 shell、git、归档和更新逻辑的测试，确认更新后的运行时依赖仍然能正常工作。

Evidence (Before & After)

Before：npm audit --omit=dev --audit-level=critical 会失败，因为存在 critical 级别运行时告警。

After：npm run audit:runtime:critical 可以成功退出。相关运行时依赖树现在解析到 simple-git@3.36.0、shell-quote@1.9.0、tar@7.5.19 和 undici@6.27.0。

本地验证已完成：

npm install
npm run check:lockfile
npm run typecheck
npm run audit:runtime:critical
cd packages/core && npx vitest run src/utils/shell-utils.test.ts src/tools/shell.test.ts src/services/gitWorktreeService.test.ts src/extension/github.test.ts
cd packages/cli && npx vitest run src/utils/sandbox.test.ts src/utils/standalone-update.test.ts src/utils/gitUtils.test.ts
npm run lint

结果：npm install/prepare 完成 build；lockfile 检查通过；typecheck 通过；critical runtime audit 成功退出；479 个 core 聚焦测试通过；70 个 CLI 聚焦测试通过；lint 通过。

Tested on

OS	Status
🍏 macOS	✅ tested
🪟 Windows	⚠️ not tested locally
🐧 Linux	⚠️ not tested locally

Environment (optional)

macOS 上的 Node/npm workspace 安装环境。没有 UI 或 TUI 行为变化。

Risk & Scope

• 主要风险或取舍：依赖升级可能带来细微行为变化，尤其是 shell 解析、git、归档解压和 HTTP 相关路径。这个 PR 使用运行时依赖的非 major 修复版本，并验证了最相关的本地测试范围。
• 未验证 / 不在范围内：仍然保留需要 breaking upgrade 的 high 和 moderate audit 项目。特别是 diff@9 改变了导出的类型，需要单独的兼容性 PR。
• Breaking changes / migration notes：预期没有。

Linked Issues

Fixes #6063
Refs #6062

[DragonnZhang]

Review Summary (automated, high-confidence only)

The dependency audit fix itself (commit 56584333d) is well-scoped and correct: it bumps simple-git, shell-quote, tar, and undici in both packages/cli and packages/core, adds a audit:runtime:critical npm script, and wires it into CI. The lockfile is internally consistent.

However, the PR as a whole has a significant scope issue — see inline comment below.

[DragonnZhang]

PR scope mismatch — bundles 4 unrelated commits from 3 authors

The origin/main...HEAD diff shows 43 files changed (+3,753/-325), but only 6 files belong to the dependency audit fix described in the PR title. The other 37 files come from 3 additional commits by other authors:

• e1ddcdc2a feat(loop): add autonomous mode for a bare /loop (feat(loop): add autonomous mode for a bare /loop #5991) — author: @qqqys — adds autonomous-loop.ts + loop skill changes
• f37c64c7f fix(cli): Keep serve health responsive before runtime load (fix(cli): Keep serve health responsive before runtime load #6013) — author: @jinye — modifies serve fast-path, session, headless safety
• ea536d361 fix(cli): Handle ACP read_file for managed local paths (fix(cli): Handle ACP read_file for managed local paths #6021) — author: @jinye — modifies acpAgent.ts, filesystem.ts, Session.ts, read-file.ts, write-file.ts, errors.ts, fileUtils.ts

None of these commits exist on origin/main. When this PR merges, all 43 files of changes will land on main under a PR titled "fix(deps): clear critical runtime audit findings".

Why this matters: Reviewers looking at the PR title and description will focus on the 6 dependency files and may miss the ~3,500 lines of code changes in ACP integration, serve health, autonomous loop, error handling, and file access control.

Suggestion: Rebase this branch onto origin/main and drop the 3 commits that belong to other PRs. The dependency fix (commit 56584333d) should be the only commit in this PR. The other work should land via its own PRs (or may already have landed via squash merges on main — worth verifying).

[gauravyad86]

@DragonnZhang thanks for catching this. I rebased the branch onto the current main and force-pushed so the PR now contains only the dependency-audit fix commit. GitHub now shows 1 commit, 6 changed files, and the branch is mergeable.

Verified locally after the rebase:

• npm run check:lockfile
• npm run audit:runtime:critical
• npm run typecheck
• npm run lint

[doudouOUC]

No issues found. LGTM! ✅

Well-scoped dependency bump that clears critical runtime audit findings. Lockfile changes are consistent, CI audit step is correctly placed, and the rebase cleaned up the prior scope concern.

— qwen3.7-max via Qwen Code /review

[wenshao]

@qwen-code /triage

[qwen-code-ci-bot]

Thanks for the PR! (Re-run after follow-up commit for simple-git@3.36.0 allowUnsafeHooksPath.)

Template looks good ✓

On direction: clearing critical npm audit findings in runtime dependencies is a clear security win — Qwen Code executes shell, git, archive, and network code, so critical advisories in those paths deserve fast fixes. The CI guard (audit:runtime:critical) prevents regression. Aligned and straightforward.

On approach: scope remains tight — four runtime dep bumps, one CI step, lockfile resolution, NOTICES.txt update, and now a minimal source-code adaptation for simple-git@3.36.0's stricter core.hooksPath behavior. The allowUnsafeHooksPath opt-in in gitWorktreeService.ts is a necessary companion change — without it, the upgraded simple-git would refuse the intentional hooksPath write that Qwen Code's worktree setup requires. The deliberate deferral of diff@9 and OpenTelemetry to separate PRs is still the right call.

Moving on to code review. 🔍

中文说明

感谢贡献！（针对 simple-git@3.36.0 allowUnsafeHooksPath 后续提交的重新审查。）

模板完整 ✓

方向：清理运行时依赖中的 critical 级别 npm audit 告警是明确的安全改进——Qwen Code 会执行 shell、git、归档解压和网络相关代码，这些路径中的 critical 级别告警值得优先修复。CI 守卫（audit:runtime:critical）可以防止回退。方向对齐，目标清晰。

方案：范围仍然紧凑——四个运行时依赖升级、一个 CI 步骤、lockfile 解析、NOTICES.txt 更新，以及现在针对 simple-git@3.36.0 更严格的 core.hooksPath 行为的最小源码适配。gitWorktreeService.ts 中的 allowUnsafeHooksPath 选择加入是必要的配套改动——没有它，升级后的 simple-git 会拒绝 Qwen Code worktree 设置所需的有意 hooksPath 写入。把 diff@9 和 OpenTelemetry 推迟到单独 PR 仍然是正确的决策。

进入代码审查 🔍

— Qwen Code · qwen3.7-max

[qwen-code-ci-bot]

Code Review

(Re-run covering the follow-up commit 8aa0874 — allowUnsafeHooksPath for simple-git@3.36.0.)

The original commit is a clean dependency-bump PR — no source code changes, only package.json range updates, lockfile resolution, CI workflow, and NOTICES.txt. The four targeted runtime dep bumps directly address the 2 critical audit findings (shell-quote 1.8.3→1.9.0, simple-git 3.28.0→3.36.0) plus tar and undici for good measure.

The follow-up commit adds { unsafe: { allowUnsafeHooksPath: true } } to the simpleGit() call in GitWorktreeService.configureHooksPath(). This is the correct and minimal adaptation: simple-git@3.36.0 introduced stricter enforcement that blocks writes to core.hooksPath unless explicitly opted in. The code intentionally sets core.hooksPath on worktrees as part of Qwen Code's hook setup, so the opt-in is required. The option is scoped to just the one simpleGit() instance that needs it — not a global config change.

Lockfile changes are consistent with npm install resolution. Transitive bumps (@grpc/grpc-js 1.13.4→1.14.4, protobufjs 7.6.1→7.6.4, dompurify 3.4.8→3.4.11, follow-redirects 1.15.11→1.16.0, etc.) are all expected from the parent updates.

No correctness bugs, security concerns, or structural violations found.

Real-Scenario Testing

(Run on Linux, Ubuntu CI runner.)

Before (main branch)

$ npm audit --omit=dev --audit-level=critical
Severity: critical
Severity: critical
48 vulnerabilities (1 low, 30 moderate, 15 high, 2 critical)
exit code: 1 (FAIL)

After (this PR)

$ npm run audit:runtime:critical
Severity: moderate
Severity: high
Severity: moderate
28 vulnerabilities (1 low, 23 moderate, 4 high)
exit code: 0 (PASS — 0 critical)

Additional verification on PR branch

Check	Result
npm ci	✅ exit 0 — 1841 packages, build ran
npm run check:lockfile	✅ Lockfile check passed
npm run audit:runtime:critical	✅ exit 0 — 0 critical
npm run typecheck (all workspaces)	✅ exit 0
npm run build	✅ exit 0
Core tests (shell-utils, shell, gitWorktreeService, github)	✅ 479 passed
CLI tests (sandbox, standalone-update, gitUtils)	✅ 70 passed
npm run dev -- -p 'echo hello world'	✅ CLI starts, outputs "hello world", exits cleanly

The 2 criticals on main are exactly cleared by the bumps:

• shell-quote 1.8.3 → 1.9.0 — GHSA-w7jw-789q-3m8p (newline-escaping bypass)
• simple-git 3.28.0 → 3.36.0 — GHSA-jcxm-m3jx-f287 + 2 more (RCE / option-parsing bypass)

Bonus: tar 7.5.2→7.5.19 and undici 6.22.0→6.27.0 (high, not what trips the gate) are also cleared, and transitive re-resolution drops the high count 15 → 4.

中文说明

代码审查

（涵盖后续提交 8aa0874 —— 针对 simple-git@3.36.0 的 allowUnsafeHooksPath。）

原始提交是一个干净的依赖升级 PR——没有源代码改动，只有 package.json 范围更新、lockfile 解析、CI 工作流和 NOTICES.txt。四个运行时依赖升级直接针对 2 个 critical 级别的 audit 告警（shell-quote 1.8.3→1.9.0，simple-git 3.28.0→3.36.0），同时升级了 tar 和 undici。

后续提交在 GitWorktreeService.configureHooksPath() 的 simpleGit() 调用中添加了 { unsafe: { allowUnsafeHooksPath: true } }。这是针对 simple-git@3.36.0 更严格执法的正确且最小化的适配——该版本会阻止对 core.hooksPath 的写入，除非显式选择加入。代码本身有意在 worktree 上设置 core.hooksPath 作为 Qwen Code 钩子设置的一部分，因此选择加入是必需的。该选项仅限定在需要它的那一个 simpleGit() 实例——不是全局配置变更。

Lockfile 改动与 npm install 解析一致。传递依赖升级（@grpc/grpc-js 1.13.4→1.14.4，protobufjs 7.6.1→7.6.4，dompurify 3.4.8→3.4.11，follow-redirects 1.15.11→1.16.0 等）都是父级更新带来的预期变化。

没有发现正确性 bug、安全问题或结构性违规。

真实场景测试

（在 Linux Ubuntu CI runner 上运行。）

Before（main 分支）

$ npm audit --omit=dev --audit-level=critical
Severity: critical
Severity: critical
48 vulnerabilities (1 low, 30 moderate, 15 high, 2 critical)
exit code: 1 (FAIL)

After（此 PR）

$ npm run audit:runtime:critical
Severity: moderate
Severity: high
Severity: moderate
28 vulnerabilities (1 low, 23 moderate, 4 high)
exit code: 0 (PASS — 0 critical)

PR 分支额外验证

检查	结果
npm ci	✅ exit 0 —— 1841 个包，build 已执行
npm run check:lockfile	✅ Lockfile check passed
npm run audit:runtime:critical	✅ exit 0 —— 0 critical
npm run typecheck（全部 workspace）	✅ exit 0
npm run build	✅ exit 0
Core 测试（shell-utils、shell、gitWorktreeService、github）	✅ 479 通过
CLI 测试（sandbox、standalone-update、gitUtils）	✅ 70 通过
npm run dev -- -p 'echo hello world'	✅ CLI 启动，输出 "hello world"，正常退出

main 上的 2 个 critical 正好被这些升级清除：

• shell-quote 1.8.3 → 1.9.0 —— GHSA-w7jw-789q-3m8p（换行转义绕过）
• simple-git 3.28.0 → 3.36.0 —— GHSA-jcxm-m3jx-f287 等 3 条（RCE / 选项解析绕过）

附带收益：tar 7.5.2→7.5.19、undici 6.22.0→6.27.0（high，不触发这个 gate）也被清除；传递依赖重新解析把 high 数量从 15 降到 4。

— Qwen Code · qwen3.7-max

[qwen-code-ci-bot]

(Re-run after follow-up commit.)

This PR does exactly what it says — clears 2 critical runtime audit findings (shell-quote RCE via newline injection, simple-git command execution via option-parsing bypass) with minimal, targeted dependency bumps. The lockfile diff is large but every change traces back to the four parent bumps and their expected transitive resolutions. The only source-code change is a 2-line opt-in for simple-git@3.36.0's new allowUnsafeHooksPath enforcement, scoped precisely to the one simpleGit() instance that writes core.hooksPath on worktrees.

The CI guard (audit:runtime:critical) catches this class of regression before merge. All verification checks pass — audit, typecheck, build, lockfile consistency, 549 focused tests, and a dev-build smoke test.

The follow-up commit was a necessary response to Ubuntu CI catching simple-git@3.36.0's behavior change. The author identified the issue, pushed a minimal fix, and verified it locally. Good turnaround.

All three stages clean. Straightforward ship.

中文说明

（后续提交后的重新审查。）

此 PR 完全如其描述——用最小范围的定向依赖升级清除了 2 个 critical 级别运行时 audit 告警（shell-quote 通过换行注入的 RCE，simple-git 通过选项解析绕过的命令执行）。lockfile diff 较大，但每个改动都可以追溯到四个父级升级及其预期的传递依赖解析。唯一的源代码变更是针对 simple-git@3.36.0 新的 allowUnsafeHooksPath 执法的 2 行选择加入，精确限定在写入 worktree core.hooksPath 的那一个 simpleGit() 实例。

CI 守卫（audit:runtime:critical）在合入前捕获这类回退。所有验证检查通过——audit、typecheck、build、lockfile 一致性、549 个聚焦测试和 dev build 冒烟测试。

后续提交是对 Ubuntu CI 发现 simple-git@3.36.0 行为变化的必要响应。作者识别了问题，推送了最小修复，并本地验证。处理迅速。

三个阶段全部通过。可以合入。

— Qwen Code · qwen3.7-max

[qwen-code-ci-bot]

LGTM, looks ready to ship. ✅

[wenshao]

✅ Local verification report — PR #6065

Verified locally on macOS with real npm ci installs and tmux, against origin/main (not the stale local base). Verdict: the core claim holds and the merge is safe. The one scary-looking line in the diff (-"@qwen-code/sdk") is a stale-branch artifact, not a real removal — details below. A few non-blocking notes at the end.

Environment: Node v22.22.2 · npm 10.9.7 · Darwin 25.5.0 · merge-base f23357d6a

---

1. Core claim — critical runtime audit (independently reproduced)

Ran the real audit off each tree's own lockfile:

Tree	Command	Exit	Vulnerabilities
origin/main	npm audit --omit=dev --audit-level=critical	1 (FAIL)	48 total — 2 critical, 15 high, 30 mod, 1 low
PR head	npm run audit:runtime:critical	0 (PASS)	28 total — 0 critical, 4 high, 23 mod, 1 low

The 2 criticals on main are exactly cleared by the bumps:

• shell-quote 1.8.3 → 1.9.0 — GHSA-w7jw-789q-3m8p (quote() newline-escaping bypass)
• simple-git 3.28.0 → 3.36.0 — GHSA-jcxm-m3jx-f287 + 2 more (RCE / option-parsing bypass)

Bonus: tar 7.5.2→7.5.19 and undici 6.22.0→6.27.0 (both high, not what trips the gate) are also cleared, and transitive re-resolution (fast-uri, path-to-regexp, hono, markdown-it, linkify-it — the NOTICES.txt changes) drops the high count 15 → 4.

---

2. ⚠️→✅ The -"@qwen-code/sdk" in the diff is a red herring (most important for reviewers)

A 2-way git diff origin/main..PR shows packages/cli/package.json removing "@qwen-code/sdk": "file:../sdk-typescript", which daemon-worker.ts still imports (await import('@qwen-code/sdk/daemon')). That looks like a regression — but it isn't:

• The merge-base f23357d6a did not have that line. It was added to main after the PR branched, by cf6323bfb (feat(cli): Add daemon-managed channel worker for serve --channel #6031, daemon channel worker).
• So the PR never touches that line; the 2-way diff only looks like a removal because the branch is ~1 day stale.

Proven by an actual 3-way merge (what every GitHub merge strategy does):

git merge-tree --write-tree origin/main <PR>   → clean (exit 0, no conflicts)
git merge --no-ff <PR> (into origin/main)       → clean (ort strategy)

The merged packages/cli/package.json keeps @qwen-code/sdk and applies the version bumps. The merged lockfile restores the packages/cli → @qwen-code/sdk edge automatically.

---

3. Post-merge tree is installable & consistent

Real merge into origin/main, then a clean npm ci:

Check (on merged tree)	Result
npm ci (hard-errors on lockfile drift)	✅ exit 0 — 1842 packages, build ran
npm run check:lockfile	✅ Lockfile check passed
npm run audit:runtime:critical	✅ exit 0 — 0 critical
npm run typecheck (all workspaces)	✅ exit 0
packages/cli → @qwen-code/sdk edge in lockfile	✅ present

---

4. Regression tests on the upgraded deps

Confirmed the worktree installed the upgraded versions (shell-quote 1.9.0, simple-git 3.36.0, tar 7.5.19, undici 6.27.0), then ran the Reviewer Test Plan:

• packages/core: 479 passed (shell-utils, shell, gitWorktreeService, github)
• packages/cli: 70 passed (sandbox, standalone-update, gitUtils)

Import surface is clean: all four deps are imported only via their main entry (no deep imports), so simple-git@3.36.0's new exports map can't break anything — confirmed by runtime load.

---

Non-blocking notes (for the merge decision, not blockers)

1. The new CI gate is non-hermetic. npm audit queries the live advisory DB, so Audit critical runtime dependencies can turn red with zero code change when a new critical advisory is later published against a currently-clean runtime dep (or flake if the registry is slow). It fails-closed (red, never a silent pass). Scoping to critical + --omit=dev keeps the noise low — reasonable, just worth knowing.
2. Scope is critical-only / runtime-only. 4 high + 23 moderate runtime advisories remain (axios via @larksuiteoapi/node-sdk, OpenTelemetry chain) — explicitly deferred by the PR. The gate won't catch high/moderate or dev-dependency criticals.
3. Desktop is out of coverage. packages/desktop is excluded from the root workspace (!packages/desktop), and packages/desktop/packages/shared still declares shell-quote@^1.8.3 (a critical-range version), plus tar@^7.5.2 / undici@^6.22.0. The root gate does not see it. If the desktop app ships, it needs its own audit — out of this PR's scope, but flagging it.
4. Platform: the gate is a pure npm command with no shell/path specifics, so it behaves identically on Windows/Linux despite only macOS being tested.
5. Stale branch: merge is verified clean & consistent today; the lockfile lands via git's line-merge. If main moves substantially before merge, an "Update branch" / rebase would regenerate the lockfile via npm for extra safety.

Recommendation: ✅ Safe to merge as-is. The @qwen-code/sdk diff line needs no action. Consider follow-up issues for the deferred high/moderate advisories and the desktop workspace.

🇨🇳 中文版（完整对应）

✅ 本地验证报告 —— PR #6065

在 macOS 上用真实 npm ci 安装 + tmux，基于 origin/main（不是陈旧的本地 base）验证。结论：PR 的核心主张成立，合并是安全的。 diff 里那行吓人的 -"@qwen-code/sdk" 是陈旧分支造成的假象，并非真实删除——详见下文。文末列了几条不阻塞合并的说明。

环境： Node v22.22.2 · npm 10.9.7 · Darwin 25.5.0 · merge-base f23357d6a

1. 核心主张 —— critical 运行时 audit（独立复现）

基于每棵树各自的 lockfile 跑真实 audit：

树	命令	退出码	漏洞
origin/main	npm audit --omit=dev --audit-level=critical	1（失败）	共 48 —— 2 个 critical，15 high，30 mod，1 low
PR head	npm run audit:runtime:critical	0（通过）	共 28 —— 0 个 critical，4 high，23 mod，1 low

main 上的 2 个 critical 正好被这些升级清除：

• shell-quote 1.8.3 → 1.9.0 —— GHSA-w7jw-789q-3m8p（quote() 换行转义绕过）
• simple-git 3.28.0 → 3.36.0 —— GHSA-jcxm-m3jx-f287 等 3 条（RCE / 选项解析绕过）

附带收益：tar 7.5.2→7.5.19、undici 6.22.0→6.27.0（都是 high，不触发这个 gate）也被清除；加上传递依赖重新解析（fast-uri、path-to-regexp、hono、markdown-it、linkify-it，即 NOTICES.txt 的改动）把 high 数量从 15 降到 4。

2. ⚠️→✅ diff 里的 -"@qwen-code/sdk" 是假象（对 reviewer 最重要）

2-way 的 git diff origin/main..PR 显示 packages/cli/package.json 删除了 "@qwen-code/sdk": "file:../sdk-typescript"，而 daemon-worker.ts 仍在 await import('@qwen-code/sdk/daemon') 用它。看起来像回归——但其实不是：

• merge-base f23357d6a 本来就没有这一行。它是在 PR 拉分支之后才被 cf6323bfb（feat(cli): Add daemon-managed channel worker for serve --channel #6031，daemon channel worker）加到 main 上的。
• 所以 PR 根本没碰这一行；只因为分支陈旧了约 1 天，2-way diff 才看起来像删除。

用真实的 3-way 合并（GitHub 各种合并策略底层都是这个）证明：

git merge-tree --write-tree origin/main <PR>   → 干净（exit 0，无冲突）
git merge --no-ff <PR>（合入 origin/main）      → 干净（ort 策略）

合并后的 packages/cli/package.json 保留了 @qwen-code/sdk，同时应用了版本升级；合并后的 lockfile 自动恢复了 packages/cli → @qwen-code/sdk 这条依赖边。

3. 合并后的树可安装且一致

真实合入 origin/main 后跑干净的 npm ci：

检查（在合并后的树上）	结果
npm ci（lockfile 不一致会直接报错）	✅ exit 0 —— 1842 个包，build 已执行
npm run check:lockfile	✅ Lockfile check passed
npm run audit:runtime:critical	✅ exit 0 —— 0 critical
npm run typecheck（全部 workspace）	✅ exit 0
lockfile 中 packages/cli → @qwen-code/sdk 边	✅ 存在

4. 针对升级后依赖的回归测试

先确认 worktree 装的是升级版本（shell-quote 1.9.0、simple-git 3.36.0、tar 7.5.19、undici 6.27.0），再跑 Reviewer Test Plan：

• packages/core：479 通过（shell-utils、shell、gitWorktreeService、github）
• packages/cli：70 通过（sandbox、standalone-update、gitUtils）

导入面干净：四个依赖都只从主入口导入（没有深层子路径导入），所以 simple-git@3.36.0 新增的 exports 映射不会破坏任何东西——已用运行时加载验证。

不阻塞合并的说明（供合并决策参考，非阻断项）

1. 新增的 CI gate 非确定性（non-hermetic）。 npm audit 查的是实时公告库，所以 Audit critical runtime dependencies 这一步可能在代码零改动的情况下变红——当以后某个当前干净的运行时依赖被爆出新的 critical 公告时（或 registry 慢时抖动）。它是 fail-closed（变红，绝不会静默通过）。限定在 critical + --omit=dev 已把噪声压到很低——合理，只是需要知道这个性质。
2. 范围仅限 critical / 仅运行时。 仍有 4 个 high + 23 个 moderate 运行时公告（axios 经 @larksuiteoapi/node-sdk、OpenTelemetry 链）——PR 明确留作后续。这个 gate 不会抓 high/moderate，也不抓 dev 依赖里的 critical。
3. desktop 不在覆盖范围内。 packages/desktop 被排除在根 workspace 之外（!packages/desktop），而 packages/desktop/packages/shared 仍声明 shell-quote@^1.8.3（critical 区间），外加 tar@^7.5.2 / undici@^6.22.0。根 gate 看不到它。如果 desktop 应用会发布，它需要单独 audit——不在本 PR 范围内，但提一下。
4. 平台： 这个 gate 是纯 npm 命令，没有 shell/路径相关写法，所以尽管只在 macOS 测过，在 Windows/Linux 上行为一致。
5. 陈旧分支： 当下已验证合并干净且一致；lockfile 是通过 git 的按行合并落地的。如果合并前 main 又大幅前进，用 "Update branch" / rebase 让 npm 重新生成 lockfile 会更保险。

建议： ✅ 可以按现状合并。@qwen-code/sdk 那行无需处理。建议为留下的 high/moderate 公告和 desktop workspace 建后续 issue。

[gauravyad86]

@wenshao @doudouOUC thanks again for the reviews and verification. This looks ready from my side, with the earlier scope issue fixed.

I don’t seem to have merge-queue access here, so please feel free to queue it when convenient. If you want one more rebase first, I’m happy to do that.

[gauravyad86]

Ubuntu CI exposed a simple-git@3.36.0 behavior change: writes to core.hooksPath now require the explicit allowUnsafeHooksPath opt-in.

I pushed a small follow-up that enables that only for the existing intentional worktree hook-path setup. Verified locally with the failing focused test, lockfile check, critical runtime audit, typecheck, and lint.

[wenshao]

@qwen-code /triage

[qwen-code-ci-bot]

LGTM, looks ready to ship. ✅