chore(sync): sync qwen-code desktop updates

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,

.agents/skills/desktop-brand-builder/scripts/brand-create.ts

@@ -3,10 +3,12 @@ import {
  copyFileSync,
  existsSync,
  mkdirSync,
+ mkdtempSync,
  readFileSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { extname, join, resolve } from 'node:path';
 
 interface BrandInput {
@@ -130,10 +132,15 @@ async function run(cmd: string[], cwd: string): Promise<void> {
  }
 }
 
+interface BrandAssetsResult {
+ macIcon: string;
+ hasAssetsCar: boolean;
+}
+
 async function writeBrandAssets(
  config: BrandConfig,
  desktopRoot: string,
-): Promise<string> {
+): Promise<BrandAssetsResult> {
  const requireFromDesktop = createRequire(join(desktopRoot, 'package.json'));
  const sharp = requireFromDesktop('sharp') as typeof import('sharp');
  const electronDir = join(desktopRoot, 'apps', 'electron');
@@ -157,7 +164,7 @@ async function writeBrandAssets(
  await writePng(join(brandDir, 'dock.png'), 512);
  await writePng(join(brandDir, 'symbol.png'), 512);
 
- if (process.platform !== 'darwin') return 'icon.png';
+ if (process.platform !== 'darwin') return { macIcon: 'icon.png', hasAssetsCar: false };
 
  const iconset = join(brandDir, 'icon.iconset');
  rmSync(iconset, { recursive: true, force: true });
@@ -184,7 +191,91 @@ async function writeBrandAssets(
  ['iconutil', '-c', 'icns', iconset, '-o', join(brandDir, 'icon.icns')],
  brandDir,
  );
- return 'icon.icns';
+
+ const hasAssetsCar = await compileAssetsCar(config, brandDir, writePng);
+ return { macIcon: 'icon.icns', hasAssetsCar };
+}
+
+async function compileAssetsCar(
+ config: BrandConfig,
+ brandDir: string,
+ writePng: (output: string, size: number) => Promise<void>,
+): Promise<boolean> {
+ const xcassets = join(brandDir, 'Assets.xcassets');
+ const appiconset = join(xcassets, 'AppIcon.appiconset');
+ rmSync(xcassets, { recursive: true, force: true });
+ mkdirSync(appiconset, { recursive: true });
+
+ writeFileSync(
+ join(xcassets, 'Contents.json'),
+ JSON.stringify({ info: { author: 'xcode', version: 1 } }),
+ );
+
+ const entries = [
+ { file: 'icon_16.png', size: 16, scale: '1x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '2x', dims: '16x16' },
+ { file: 'icon_32.png', size: 32, scale: '1x', dims: '32x32' },
+ { file: 'icon_64.png', size: 64, scale: '2x', dims: '32x32' },
+ { file: 'icon_128.png', size: 128, scale: '1x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '2x', dims: '128x128' },
+ { file: 'icon_256.png', size: 256, scale: '1x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '2x', dims: '256x256' },
+ { file: 'icon_512.png', size: 512, scale: '1x', dims: '512x512' },
+ { file: 'icon_1024.png', size: 1024, scale: '2x', dims: '512x512' },
+ ];
+
+ const uniqueSizes = new Set(entries.map((e) => e.size));
+ for (const size of uniqueSizes) {
+ await writePng(join(appiconset, `icon_${size}.png`), size);
+ }
+
+ writeFileSync(
+ join(appiconset, 'Contents.json'),
+ JSON.stringify({
+ images: entries.map((e) => ({
+ filename: e.file,
+ idiom: 'mac',
+ scale: e.scale,
+ size: e.dims,
+ })),
+ info: { author: 'xcode', version: 1 },
+ }),
+ );
+
+ const outDir = mkdtempSync(join(tmpdir(), 'assets-car-'));
+ const partialPlist = join(outDir, 'partial-info.plist');
+ const proc = Bun.spawn({
+ cmd: [
+ 'xcrun', 'actool', xcassets,
+ '--compile', outDir,
+ '--app-icon', 'AppIcon',
+ '--platform', 'macosx',
+ '--minimum-deployment-target', '14.0',
+ '--output-partial-info-plist', partialPlist,
+ ],
+ cwd: brandDir,
+ stdout: 'pipe',
+ stderr: 'pipe',
+ });
+ const exitCode = await proc.exited;
+ if (exitCode !== 0) {
+ console.log('Warning: actool compilation failed, skipping Assets.car');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ const compiledCar = join(outDir, 'Assets.car');
+ if (!existsSync(compiledCar)) {
+ console.log('Warning: actool produced no Assets.car, skipping');
+ rmSync(xcassets, { recursive: true, force: true });
+ return false;
+ }
+
+ copyFileSync(compiledCar, join(brandDir, 'Assets.car'));
+ rmSync(xcassets, { recursive: true, force: true });
+ rmSync(outDir, { recursive: true, force: true });
+ console.log('Assets.car compiled successfully');
+ return true;
 }
 
 function tsString(value: string): string {
@@ -203,8 +294,11 @@ function helpMenuLinks(config: BrandConfig): string {
  ]`;
 }
 
-function brandBlock(config: BrandConfig, macIcon: string): string {
+function brandBlock(config: BrandConfig, macIcon: string, hasAssetsCar: boolean): string {
  const resourceDir = `resources/brands/${config.brandId}`;
+ const liquidGlassLine = hasAssetsCar
+ ? `\n liquidGlassAssetsCar: ${tsString(`${resourceDir}/Assets.car`)},`
+ : '';
 
  return ` ${tsString(config.brandId)}: {
  id: ${tsString(config.brandId)},
@@ -223,7 +317,7 @@ function brandBlock(config: BrandConfig, macIcon: string): string {
  macIcon: ${tsString(`${resourceDir}/${macIcon}`)},
  winIcon: ${tsString(`${resourceDir}/icon.png`)},
  linuxIcon: ${tsString(`${resourceDir}/icon.png`)},
- devDockIcon: ${tsString(`${resourceDir}/dock.png`)},
+ devDockIcon: ${tsString(`${resourceDir}/dock.png`)},${liquidGlassLine}
  },
  credits: '',
  creditsShort: '',
@@ -236,6 +330,7 @@ function registerBrand(
  config: BrandConfig,
  desktopRoot: string,
  macIcon: string,
+ hasAssetsCar: boolean,
 ): void {
  const brandingPath = join(
  desktopRoot,
@@ -259,22 +354,25 @@ function registerBrand(
 
  writeFileSync(
  brandingPath,
- source.replace(marker, `\n${brandBlock(config, macIcon)}${marker}`),
+ source.replace(marker, `\n${brandBlock(config, macIcon, hasAssetsCar)}${marker}`),
  );
 }
 
 async function main(): Promise<void> {
  const desktopRoot = desktopRootFromArgs();
  const config = loadConfig(configPathFromArgs());
- const macIcon = await writeBrandAssets(config, desktopRoot);
- registerBrand(config, desktopRoot, macIcon);
+ const { macIcon, hasAssetsCar } = await writeBrandAssets(config, desktopRoot);
+ registerBrand(config, desktopRoot, macIcon, hasAssetsCar);
 
  console.log(`Created brand ${config.brandId}`);
  console.log(`App name: ${config.appName}`);
  console.log(`App ID: ${config.appId}`);
  console.log(
  `Assets: ${join(desktopRoot, 'apps', 'electron', 'resources', 'brands', config.brandId)}`,
  );
+ if (hasAssetsCar) {
+ console.log('Assets.car: generated (macOS 26+ Liquid Glass icon)');
+ }
 }
 
 main().catch((error: unknown) => {

apps/electron/build/entitlements.mac.plist

@@ -10,5 +10,8 @@
  <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
+ <!-- Voice dictation: microphone access under the hardened runtime. -->
+ <key>com.apple.security.device.audio-input</key>
+ <true/>
  </dict>
 </plist>

apps/electron/electron-builder.yml

@@ -72,6 +72,8 @@ mac:
  # The value must match --app-icon used in actool (see afterPack.js)
  extendInfo:
  CFBundleIconName: AppIcon
+ # Voice dictation: shown in the macOS microphone permission prompt.
+ NSMicrophoneUsageDescription: Qwen Code uses the microphone for voice dictation in the prompt composer.
  target:
  - target: dmg
  arch:

apps/electron/src/main/__tests__/network-proxy.test.ts

@@ -30,7 +30,18 @@ describe('parseNoProxyRules', () => {
 
  it('parses host:port', () => {
  const rules = parseNoProxyRules('example.com:8080');
- expect(rules).toEqual([{ host: 'example.com', port: 8080, wildcard: false }]);
+ expect(rules).toEqual([
+ { host: 'example.com', port: 8080, wildcard: false },
+ ]);
+ });
+
+ it('does not parse malformed port suffixes', () => {
+ expect(parseNoProxyRules('example.com:443abc')).toEqual([
+ { host: 'example.com:443abc', wildcard: false },
+ ]);
+ expect(parseNoProxyRules('[::1]:abc')).toEqual([
+ { host: '[::1]:abc', wildcard: false },
+ ]);
  });
 });
 
@@ -55,7 +66,9 @@ describe('shouldBypassProxy', () => {
  it('respects port-scoped rules', () => {
  const rules = parseNoProxyRules('example.com:8080');
  expect(shouldBypassProxy('http://example.com:8080/path', rules)).toBe(true);
- expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(false);
+ expect(shouldBypassProxy('http://example.com:9090/path', rules)).toBe(
+ false,
+ );
  });
 
  it('matches implicit default ports', () => {
@@ -71,7 +84,9 @@ describe('shouldBypassProxy', () => {
 
  // Explicit port that differs from rule should not match
  const rules8080 = parseNoProxyRules('example.com:8080');
- expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(false);
+ expect(shouldBypassProxy('https://example.com/path', rules8080)).toBe(
+ false,
+ );
  });
 
  it('wildcard bypasses everything', () => {
@@ -84,6 +99,27 @@ describe('shouldBypassProxy', () => {
  expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
  });
 
+ it('respects IPv6 port-scoped rules', () => {
+ const rules = parseNoProxyRules('[::1]:3000');
+ expect(shouldBypassProxy('http://[::1]:3000/path', rules)).toBe(true);
+ expect(shouldBypassProxy('http://[::1]:3001/path', rules)).toBe(false);
+ });
+
+ it('does not bypass for malformed port suffixes', () => {
+ expect(
+ shouldBypassProxy(
+ 'https://example.com/path',
+ parseNoProxyRules('example.com:443abc'),
+ ),
+ ).toBe(false);
+ expect(
+ shouldBypassProxy(
+ 'http://[::1]:3000/path',
+ parseNoProxyRules('[::1]:abc'),
+ ),
+ ).toBe(false);
+ });
+
  it('matches exact IP literal', () => {
  const rules = parseNoProxyRules('192.168.1.1');
  expect(shouldBypassProxy('http://192.168.1.1/', rules)).toBe(true);

apps/electron/src/main/handlers/__tests__/settings-default-thinking.test.ts

@@ -11,6 +11,7 @@ const requestContext = {
 
 const getDefaultThinkingLevelMock = mock(() => 'think');
 const setDefaultThinkingLevelMock = mock((_level: string) => true);
+const setVoiceModelMock = mock((_model: string) => {});
 let mockedWorkspace: Record<string, unknown> | null = null;
 let mockedWorkspaceConfig: Record<string, unknown> | null = null;
 const getWorkspaceByNameOrIdMock = mock(
@@ -64,9 +65,14 @@ mock.module('@craft-agent/shared/config', () => ({
  getWorkspaceByNameOrId: getWorkspaceByNameOrIdMock,
  getDefaultThinkingLevel: getDefaultThinkingLevelMock,
  setDefaultThinkingLevel: setDefaultThinkingLevelMock,
+ setVoiceModel: setVoiceModelMock,
  isProtectedWorkspace: () => false,
 }));
 
+mock.module('@craft-agent/shared/config/storage', () => ({
+ setVoiceModel: setVoiceModelMock,
+}));
+
 mock.module('@craft-agent/shared/workspaces', () => ({
  loadWorkspaceConfig: loadWorkspaceConfigMock,
 }));
@@ -94,6 +100,7 @@ describe('settings default thinking RPC handlers', () => {
  handlers.clear();
  getDefaultThinkingLevelMock.mockClear();
  setDefaultThinkingLevelMock.mockClear();
+ setVoiceModelMock.mockClear();
  mockedWorkspace = null;
  mockedWorkspaceConfig = null;
  getWorkspaceByNameOrIdMock.mockClear();
@@ -189,6 +196,17 @@ describe('settings default thinking RPC handlers', () => {
  expect(setDefaultThinkingLevelMock).not.toHaveBeenCalled();
  });
 
+ it('accepts dated voice model variants supported by the transport resolver', async () => {
+ const setHandler = handlers.get(RPC_CHANNELS.input.SET_VOICE_MODEL);
+ expect(setHandler).toBeTruthy();
+
+ await setHandler!(requestContext, 'qwen3-asr-flash-2025-06-01');
+
+ expect(setVoiceModelMock).toHaveBeenCalledWith(
+ 'qwen3-asr-flash-2025-06-01',
+ );
+ });
+
  it('returns global permission mode through Qwen ACP', async () => {
  const getHandler = handlers.get(
  RPC_CHANNELS.settings.GET_GLOBAL_PERMISSION_MODE,