v5.2.2

What's Changed

• fix: align local MCP config with current qwen-web-mcp entrypoint by @rakaarwaky in #151
• fix: align local MCP config with current qwen-web-mcp entrypoint by @rakaarwaky in #152
• chore(deps-ci): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group by @dependabot[bot] in #154
• chore(release): v5.2.2 by @github-actions[bot] in #153

Full Changelog: v5.2.1...v5.2.2

What's Changed

• fix: align local MCP config with current qwen-web-mcp entrypoint by @rakaarwaky in #151
• fix: align local MCP config with current qwen-web-mcp entrypoint by @rakaarwaky in #152
• chore(deps-ci): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group by @dependabot[bot] in #154
• chore(release): v5.2.2 by @github-actions[bot] in #153

Full Changelog: v5.2.1...v5.2.2

v5.2.1

What's Changed

• fix: verify self-update reaches latest release by @rakaarwaky in #149
• chore(release): v5.2.1 by @github-actions[bot] in #150

Full Changelog: v5.2.0...v5.2.1

v5.2.0

What's Changed

• fix: make prompt-file pipeline reliable by @rakaarwaky in #147
• chore(release): v5.2.0 by @rakaarwaky in #148

Full Changelog: v5.1.0...v5.2.0

v5.1.0

Release 5.1.0

This release packages the event-driven response lifecycle and the safety improvements delivered after v5.0.0.

Highlights

The response monitor now completes from terminal lifecycle events rather than normal duration cutoffs. Successful output is gated by verified EVENT_OUTPUT_COPIED after the target file is readable and non-empty. Long-running Qwen generations continue with periodic browser recovery.

A four-hour safety circuit breaker is included as a resource-protection guard. It raises ResponseDetectionTimeoutError only when no terminal generation event arrives for four hours; it does not interrupt normal responses that complete earlier through the event-driven path.

The release also includes regression coverage for delayed responses, transient browser timeout recovery, output verification, and the safety circuit breaker.

Version files

The release version is 5.1.0 in the root package manifest, core package manifest, MCP package manifest, shared package manifest, and embedded skill metadata. CHANGELOG.md includes the 5.1.0 release notes.

Validation

• ruff format passed.
• ruff check passed.
• mypy modules passed.
• pytest tests/ -q -m 'not slow and not e2e' passed.
• git diff --check passed.

What's Changed

• fix: make response lifecycle event driven by @rakaarwaky in #144
• fix: add response safety circuit breaker by @rakaarwaky in #145
• chore(release): bump version to v5.1.0 by @rakaarwaky in #146

Full Changelog: v5.0.0...v5.1.0

v5.0.0

v5.0.0 — AES 0 violations, consumer-first surface fixes, shared prompt-flow refactor

Quality gates (all green)

• lint-arwaky-cli scan . → 0 violations (was 9: 2× AES305, 5× AES401, 2× AES203)
• ruff format / ruff check clean · mypy strict clean (62 files) · full pytest passing (3.12 & 3.13) · uv build OK

Architecture (AES)

• New IPromptFlowAggregate contract + SharedFlowOrchestrator agent — de-duplicates direct/file/attachment orchestrators via contract aggregate + DI (no agent→agent imports)
• taxonomy_core_constant.py now pure constants (AES401); get_playwright_browsers_path() moved to utility_core_paths.py
• Unused imports removed (AES203); legacy DEFAULT_TODO deleted

Consumer-first fixes (UI/UX audit)

• MCP: failed runs return typed error envelopes (AUTH_REQUIRED / EXECUTION_ERROR) instead of success: true; tool schemas documented (descriptions, 100 MB limit, blocked extensions)
• TUI: red FAILED render on failure, Enter-key misfire fixed, async session badge, Cancel Run + quit guard
• CLI: working --json output, exit code 2 for AuthRequiredError, --headless removed from login, -v/--verbose flag
• SKILL.md: .qwen-web/ workspace rule, orphan-process cleanup, no-external-timeout policy

Security (Codacy review)

• UpdateManager: subprocess hardened against shell metacharacter/path injection + https-only URL scheme + github repo allowlist
• delete_session path-safety strengthened

Review

• Codacy findings resolved · cubic SUCCESS · CodeRabbit skipped · PR #143 merged

What's Changed

• v5.0.0: AES 0 violations, consumer-first surface fixes, shared prompt-flow refactor by @rakaarwaky in #143

Full Changelog: v4.4.0...v5.0.0

v4.4.0

Changes
Updated SendDispatcher.click_send in modules/core/src/capabilities_send_dispatcher.py to support both config and _config parameters matching ISendProtocol.
Added unit test test_click_send_with_config_keyword_arg in tests/unit_capability_send_dispatcher.py.

What's Changed

• fix(core): support config parameter in SendDispatcher.click_send by @rakaarwaky in #138

Full Changelog: v4.3.0...v4.4.0

v4.3.0

What's Changed

• docs: add side-by-side synchronized desktop demo animation to README by @rakaarwaky in #132
• chore(ci): add .coderabbit.yaml to filter binary media assets from AI review by @rakaarwaky in #134
• feat(cli): hide debug event logs by default and add -v/--verbose flag by @rakaarwaky in #135
• fix(docs): replace webp with animated GIF in README for GitHub compatibility by @rakaarwaky in #133
• chore(release): v4.3.0 by @rakaarwaky in #137

Full Changelog: v4.2.0...v4.3.0

v4.2.0 — Cross-Platform Installer & Core Automation Enhancements

What's Changed in v4.2.0

🚀 Major Highlights

• Cross-Platform Installer: Introduced scripts/install.py (pure Python cross-platform installer for Linux, macOS, & Windows) alongside scripts/install.ps1 and scripts/install.sh wrappers.
• Repository Rename: Fully migrated repository remote and CI workflows to qwen-web-arwaky.
• System Health Diagnostics: Added qwen-web-cli doctor subcommand for 5-dimension environment health audits.
• MCP Server Enhancements: Structured JSON envelopes for tool execution and session management utilities.
• Quality & CI: Fixed all ruff and mypy linting checks with 231 unit tests passing across Python 3.10-3.13.

What's Changed

• ci: add Dependabot for dependency updates by @arena-ai-coding-agent[bot] in #8
• chore(deps): update setuptools requirement from >=61.0 to >=84.0.0 in the python group by @dependabot[bot] in #10
• chore(deps-ci): bump the actions group with 3 updates by @dependabot[bot] in #9
• ci: add main branch protection ruleset (wajib PR untuk main) by @arena-ai-coding-agent[bot] in #11
• ci: add release automation and PR maintenance workflows by @rakaarwaky in #14
• chore(release): v4.1.0 by @github-actions[bot] in #15
• chore(release): v4.1.0 by @github-actions[bot] in #17
• fix: chmod session dir to 755 before Chrome launch by @rakaarwaky in #18
• chore: gitignore worktrees/ directory by @rakaarwaky in #32
• fix(ci): restore os.chmod on session dir to unbreak pytest job (pre-existing failure in #24) by @arena-ai-coding-agent[bot] in #30
• chore(release): v4.1.0 by @github-actions[bot] in #38
• chore(deps-ci): bump astral-sh/setup-uv from 5.4.2 to 9.0.0 in the actions group by @dependabot[bot] in #24
• chore(release): v4.1.0 by @github-actions[bot] in #39
• fix(install): clean reinstall + repair browser session dir perms by @rakaarwaky in #25
• chore(release): v4.1.0 by @github-actions[bot] in #40
• fix(browser): chmod session dir 0700 at runtime (fixes #25 CI) by @arena-ai-coding-agent[bot] in #31
• chore(release): v4.1.0 by @github-actions[bot] in #41
• chore(release): v4.1.0 by @github-actions[bot] in #42
• docs: lock scope to Stabilization Mode (PRD, README, FRDs, skill) by @rakaarwaky in #44
• fix: keep manual login browser open and verify session by @arena-ai-coding-agent[bot] in #46
• fix: pass built config to run command in interactive mode by @rakaarwaky in #47
• chore(release): v4.1.0 by @github-actions[bot] in #45
• docs(core): refine PRD/FRD into 10 capability-aligned FRs by @arena-ai-coding-agent[bot] in #60
• chore(release): v4.1.0 by @github-actions[bot] in #61
• fix(mcp): protect stdio and generate audit log tool by @rakaarwaky in #98
• fix(cli): enforce surface precedence and LinuxGuard lifecycle by @rakaarwaky in #99
• fix(core): enforce pipeline routing outcomes and lifecycle gates by @rakaarwaky in #100
• fix(core): complete capabilities and aggregate test coverage by @rakaarwaky in #101
• chore(release): v4.1.0 by @github-actions[bot] in #104
• refactor(shared): extract event and error taxonomy by @rakaarwaky in #107
• fix: enforce strict CLI event pipeline gates by @rakaarwaky in #110
• Update README.md by @rakaarwaky in #111
• chore(release): v4.1.0 by @github-actions[bot] in #112
• session-setup: Textual UI submenu for session status and delete/login actions by @rakaarwaky in #113
• fix: emit document parsed before prompt injected by @rakaarwaky in #116
• feat: unify cross-platform installation and release 4.2.0 by @rakaarwaky in #125

New Contributors

• @arena-ai-coding-agent[bot] made their first contribution in #8
• @dependabot[bot] made their first contribution in #10

Full Changelog: v4.0.1...v4.2.0

v4.0.1

[4.0.1] - 2026-08-10

Fixed

• Import fallback for FastMCP: tries fastmcp package first, then falls back to mcp.server.fastmcp

Full Changelog: v4.0.0...v4.0.1

v4.0.0

[4.0.0] - 2026-08-10

Added

• MCP server mode (--mcp) for AI agent integration
• File attachment upload support
• Role-based directory structure for prompt organization
• Watcher mode (--watch) for continuous file processing
• Single-instance lock to prevent concurrent runs
• Systemd sd_notify integration for service readiness
• OpenTelemetry distributed tracing
• Sentry error monitoring
• Structured logging with structlog
• Lifecycle event emission system
• XDG-compliant configuration paths
• init command for first-time setup
• login command for manual authentication
• Regression test suite with behavior locks
• GitHub Actions CI pipeline (lint + test matrix)

Changed

• Migrated to modular architecture: prompt_injector, sender, streamer, saver
• Response extraction now uses JS-based text detection (robust against CSS class changes)
• Default file paths reorganized under ~/.qwen-web/
• Navigation wait strategy changed to domcontentloaded
• Python 3.10+ required

Fixed

• AuthRequiredError handling in MCP tools and CLI
• Role-based done/failed paths for nested role folders
• Hardcoded user home path replaced with generic qwc command
• License metadata string format in pyproject.toml

Removed

• Legacy role prompts
• Stale task fixtures

Full Changelog: https://github.com/rakaarwaky/qwen-web/commits/v4.0.0

Full Changelog: https://github.com/rakaarwaky/qwen-web/commits/v4.0.0