{"record":{"id":"66029235f2536db3","repo":"JuliusBrussee/caveman","slug":"cannot-safely-resolve-qwen-s-effective-settings","errorCode":null,"errorMessage":"cannot safely resolve Qwen's effective settings","messagePattern":"cannot safely resolve Qwen's effective settings","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cli/src/index.ts","lineNumber":9051,"sourceCode":"  if (agent?.id === \"gemini\" && wrapMode(gw) === \"managed\") {\n    throw new Error(\"managed Gemini CLI routing is unsupported because Gemini CLI cannot send separate Caveman and upstream credentials\");\n  }\n  const renderedGw = agent ? attributedGatewayUrl(gw, agent) : gw;\n  const env: NodeJS.ProcessEnv = {\n    ...process.env,\n    ...(agent?.injection.method === \"native-extension\" ? {} : wrapBaseUrlEnv(renderedGw)),\n  };\n  if (wrapMode(gw) === \"managed\") {\n    const gatewayKey = connectedGatewayAPIKey();\n    if (gatewayKey) env.CAVE_API_KEY = gatewayKey;\n  }\n  if (!agent) return env;\n  if (applyClaudeBedrockWrap(env, agent, renderedGw, gw)) return env;\n  const routeOverride = agentRouteOverride(agent, agentArgs);\n  if (agent.id === \"qwen\") {\n    const override = routeOverride;\n    if (override?.surface === \"effective settings\") {\n      throw new Error(\"cannot safely resolve Qwen's effective settings\");\n    }\n    if (override?.surface === \"--safe-mode\" && override.reason === \"ignores Caveman system settings\") {\n      throw new Error(\"Qwen safe mode ignores Caveman system settings\");\n    }\n    // These environment switches outrank settings in pinned Qwen 0.22.3.\n    // Keep side-request tools and workflow-spawned agents off in routed mode;\n    // corresponding system settings provide the durable second lock.\n    env.ENABLE_WEB_SEARCH = \"0\";\n    env.QWEN_CODE_DISABLE_WORKFLOWS = \"1\";\n  }\n  if (routeOverride) throw new Error(`${routeOverrideLabel(agent)} ${routeOverride.surface} ${routeOverride.reason}`);\n  const inj = agent.injection;\n  if (inj.method === \"env\") {\n    for (const [k, raw] of Object.entries(inj.env)) {\n      const val = renderTemplate(raw, renderedGw);\n      if (val !== \"\") env[k] = val;\n    }\n  } else if (inj.method === \"config-env-content\") {","sourceCodeStart":9033,"sourceCodeEnd":9069,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/5184b3d11ac6a1acb7d44b9bfaa31698157cff97/packages/cli/src/index.ts#L9033-L9069","documentation":"In buildWrapEnv, before any other Qwen handling, the CLI checks agentRouteOverride for command-line flags that change how Qwen loads its configuration. If the user passed a flag/argument combination whose effect on Qwen's effective settings cannot be safely reproduced in the temporary system settings (override.surface === \"effective settings\"), the wrap aborts fail-closed with this error rather than launching Qwen with settings that could silently bypass or contradict the Caveman route.","triggerScenarios":"Running `caveman wrap qwen ...` (or `caveman qwen ...`) while passing agent arguments that agentRouteOverride classifies as altering \"effective settings\" — e.g. flags that point Qwen at alternate settings files or override its settings resolution — so the CLI cannot guarantee the pinned Qwen 0.22.3 settings precedence.","commonSituations":"Passing Qwen's own settings-selection flags through the wrap; scripts that forward arbitrary flags to the underlying qwen binary via caveman; operator attempts to use a personal settings file while routed, which would defeat managed routing.","solutions":["Remove the settings-affecting flag from the wrapped invocation and let caveman supply its temporary system settings.","If you need custom Qwen settings, edit the layer caveman reads (project/system Qwen settings) instead of overriding via CLI flags.","Check `agentRouteOverride` behavior in the CLI version you run; upgrade the CLI if a flag you need should now be supported.","For debugging, run the raw qwen binary directly (not through caveman wrap) — but understand it will not be routed/compressed."],"exampleFix":"// before: flag forwarded that overrides effective settings\ncaveman qwen --settings ./my-settings.json\n// after: default resolution via caveman's temp settings\ncaveman qwen","handlingStrategy":"validation","validationCode":"// Screen forwarded args before invoking the qwen wrap\nconst settingsFlags = [\"--settings\", \"--config\", \"-c\"];\nconst args = process.argv.slice(2);\nif (args.some((a) => settingsFlags.some((f) => a === f || a.startsWith(f + \"=\")))) {\n  throw new Error(\"Settings-override flags cannot be forwarded through `caveman qwen`; edit Qwen settings files directly instead.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  execSync(\"caveman qwen\", { stdio: \"inherit\" });\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"cannot safely resolve Qwen's effective settings\")) {\n    console.error(\"Remove settings-override flags from the wrapped qwen invocation.\");\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Do not forward Qwen settings-selection flags through `caveman wrap qwen` / `caveman qwen`.","Configure Qwen by editing its settings layers, not per-invocation flags, when routed through caveman.","In wrapper scripts, filter or reject settings-affecting flags before spawning the wrap.","Check the CLI's agentRouteOverride surface list when adding new qwen flags to automation."],"tags":["unsupported-flags","qwen","wrap","fail-closed","cli"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"5184b3d11ac6a1acb7d44b9bfaa31698157cff97","analyzedAt":"2026-09-06T12:00:26.372Z","contentChangedAt":"2026-09-06T12:00:26.372Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}