@qwen-code/qwen-code 0.19.12 → 0.20.0-nightly.20260720.0c271659d

package/chunks/{acpAgent-OB2CTF3P.js → acpAgent-HOBFF5B6.js}

@@ -1,11 +1,8 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  recomputeMcpGating
-} from "./chunk-GW7BONBU.js";
 import {
   classifyApiError
-} from "./chunk-LUJQUNKY.js";
+} from "./chunk-V7RNNPGC.js";
 import {
   EXTENSION_CONTEXT_BUDGET,
   buildExtensionMentionContext,
@@ -15,40 +12,40 @@ import {
   matchMcpServerByRef,
   parseExtensionRef,
   parseMcpServerRef
-} from "./chunk-KGWA7XYL.js";
+} from "./chunk-JRJ2LV6P.js";
 import {
   getAvailableCommands,
   handleSlashCommand,
   insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-4SJJT466.js";
+} from "./chunk-YDZ6J2BY.js";
+import {
+  recomputeMcpGating
+} from "./chunk-2JOLZA6L.js";
 import {
   appEvents,
   buildDisabledSkillNamesProvider,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-NALRQ3SG.js";
-import "./chunk-5DTTYNB7.js";
-import {
-  collectContextData,
-  formatContextUsageText
-} from "./chunk-NPMVLWYL.js";
+} from "./chunk-Y5534U4G.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-GFYFLDEG.js";
-import "./chunk-EDFD7VOX.js";
+} from "./chunk-DIKIJS6Z.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-MRE77ST5.js";
+} from "./chunk-27AJEU6G.js";
+import "./chunk-5DTTYNB7.js";
+import "./chunk-QKYTTBYW.js";
+import {
+  collectContextData,
+  formatContextUsageText
+} from "./chunk-STFP7PJR.js";
 import "./chunk-4WGODMVR.js";
-import "./chunk-KW7NOTN6.js";
-import "./chunk-GEHSF7MS.js";
-import "./chunk-XAAEDML2.js";
-import "./chunk-ETN2G32U.js";
-import "./chunk-NHDKSOEY.js";
-import "./chunk-OBSLEYCD.js";
-import "./chunk-WIYV7CSF.js";
+import "./chunk-AYCDXHZB.js";
+import "./chunk-DR5AUNJ2.js";
+import "./chunk-6HQW55TM.js";
+import "./chunk-RB7NXUP5.js";
 import "./chunk-YAF2MQZ6.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
@@ -68,7 +65,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-KRMARA3A.js";
+} from "./chunk-3SNKL6L6.js";
 import {
   HistoryReplayer,
   MessageEmitter,
@@ -78,21 +75,21 @@ import {
   goalTerminalEventToHistoryItem,
   recordGoalStatusItem,
   restoreGoalFromHistory
-} from "./chunk-GXFYV7MP.js";
-import "./chunk-QSG4ZFG4.js";
-import "./chunk-HZ4M2UQD.js";
-import "./chunk-J6NT5YTN.js";
+} from "./chunk-SG2PEESS.js";
+import "./chunk-KTUQMDEP.js";
+import "./chunk-TFNZCC4B.js";
+import "./chunk-RS7MT2QG.js";
+import "./chunk-H2XVO6NE.js";
 import "./chunk-QHTIBUWB.js";
 import {
   isTerminalGoalStatusKind
-} from "./chunk-76BFY7AF.js";
-import "./chunk-HTHUX2T5.js";
+} from "./chunk-QTERJVPZ.js";
 import "./chunk-L573Z2QZ.js";
 import {
   computeCpuPercent
 } from "./chunk-HGT6JR3U.js";
 import "./chunk-RXFQM6FQ.js";
-import "./chunk-DJ4VHAFJ.js";
+import "./chunk-3ZL6YMO2.js";
 import "./chunk-6H67XLET.js";
 import {
   beginAcpBootstrapConfigProfiling,
@@ -100,9 +97,9 @@ import {
   endAcpBootstrapConfigProfiling,
   markAcpStartup
 } from "./chunk-TDKQP3M6.js";
-import "./chunk-UZC5VPOJ.js";
+import "./chunk-IDGTC5AS.js";
 import "./chunk-LXXMOYPL.js";
-import "./chunk-3B6PSWHE.js";
+import "./chunk-3ML52IFS.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   ACP_ROUTE_ID_PREFIX,
@@ -112,7 +109,7 @@ import {
   parseAcpModelOption,
   resolveAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-HVGJWOR6.js";
+} from "./chunk-JBCFW3IL.js";
 import {
   mapSkillConfigToStatus
 } from "./chunk-2W3OOD4W.js";
@@ -122,19 +119,19 @@ import {
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-QIFTJDBY.js";
+} from "./chunk-INL2RSLA.js";
 import {
   MAX_AUDIO_BYTES,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-3ESL7JXA.js";
+} from "./chunk-FODJ5Q5K.js";
 import {
   readVoiceModel
-} from "./chunk-2476XGOU.js";
-import "./chunk-F2RR4HO2.js";
+} from "./chunk-A4TJMY65.js";
+import "./chunk-BVLROR2T.js";
 import {
   parseSessionSource
-} from "./chunk-W4UN42YP.js";
+} from "./chunk-QOSKUG5P.js";
 import "./chunk-6RLROE6G.js";
 import "./chunk-COH43MRJ.js";
 import {
@@ -151,7 +148,7 @@ import {
 } from "./chunk-QR6U5QPP.js";
 import {
   ndJsonStream
-} from "./chunk-PUKUUASO.js";
+} from "./chunk-SLLG5XXE.js";
 import {
   NOT_CURRENTLY_GENERATING_CANCEL_MESSAGE
 } from "./chunk-X6YQWCIJ.js";
@@ -162,23 +159,23 @@ import {
   SERVE_STATUS_EXT_METHODS,
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-64GC5EMF.js";
-import "./chunk-HD6EGS5K.js";
-import "./chunk-RKUMFUFM.js";
+} from "./chunk-TQBA6DVX.js";
+import "./chunk-VWLLDHAY.js";
+import "./chunk-LTQ5C5AB.js";
 import "./chunk-57OAHC2Y.js";
-import "./chunk-EFAXBOQO.js";
-import "./chunk-W6CQPLWM.js";
+import "./chunk-YWEW33JY.js";
+import "./chunk-4ODB7WIB.js";
 import "./chunk-V6WHFGST.js";
 import {
   createLoadedSettingsAdapter
-} from "./chunk-42VIHAYT.js";
+} from "./chunk-UGRL5B5F.js";
 import "./chunk-W7FJ3N32.js";
-import "./chunk-I7RRHHYG.js";
+import "./chunk-Y2ENGUD6.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-HCCR43AY.js";
-import "./chunk-BABX5XRO.js";
-import "./chunk-BKNPMEN6.js";
+import "./chunk-RFIAR4YL.js";
+import "./chunk-2HOVDT7W.js";
+import "./chunk-NIJEXGV6.js";
 import {
   AgentSideConnection,
   PROTOCOL_VERSION,
@@ -187,7 +184,7 @@ import {
 import {
   assembleMcpServers,
   loadMcpApprovals
-} from "./chunk-4MPYGENG.js";
+} from "./chunk-DCCW7CRR.js";
 import {
   getOutputLanguageFilePath,
   getPersistScopeForModelSelection,
@@ -196,7 +193,7 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-6IITZE7O.js";
+} from "./chunk-2YJLFCYI.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import {
@@ -207,20 +204,20 @@ import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-TKASNYDS.js";
+} from "./chunk-3QR5MOHP.js";
 import {
   findEnvFiles,
   preResolveHomeEnvOverrides,
   reloadEnvironment
-} from "./chunk-PR5XQ73G.js";
+} from "./chunk-NQVA6O7F.js";
 import "./chunk-QRUIS3DN.js";
-import "./chunk-GLH2NTPB.js";
+import "./chunk-SQMTULHJ.js";
 import "./chunk-VJNBRRZG.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-GMUPIMHF.js";
+} from "./chunk-RS5JPH6Y.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
 import {
@@ -275,12 +272,14 @@ import {
   convertToFunctionErrorResponse,
   convertToFunctionResponse,
   createDuplicateProviderToolCallResponse,
+  decoratePlanModeShellConfirmation,
   dedupeToolCallsById,
   detectAutonomousSentinel,
   detectLoopSentinel,
   encodeSessionTranscriptCursor,
   evaluateAutoMode,
   evaluatePermissionFlow,
+  evaluatePlanModeShellPolicy,
   findExistingProviderModels,
   findProviderById,
   findRepeatedDuplicateProviderToolCall,
@@ -305,6 +304,7 @@ import {
   getProviderToolCallId,
   getScopedEnvContents,
   getStartupContextLength,
+  getStopHookContinuationReason,
   ideContextStore,
   injectPermissionRulesIfMissing,
   isApproveOutcome,
@@ -340,21 +340,23 @@ import {
   shouldRunAutoModeForCall,
   subagentGenerator,
   unregisterGoalHook,
-  updateSetting
-} from "./chunk-GCY7QTCE.js";
+  updateSetting,
+  validatePlanModeShellApproval,
+  validatePlanModeShellContext
+} from "./chunk-JDPCOUZ3.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-T4TZQJ7W.js";
 import {
   external_exports
 } from "./chunk-H6XPXXMH.js";
-import "./chunk-LKR7QQ63.js";
-import "./chunk-4XCVGEEX.js";
-import "./chunk-XSPFQQRE.js";
-import "./chunk-4RPARQ5D.js";
+import "./chunk-EAUYY7SS.js";
+import "./chunk-FSL5W5TI.js";
+import "./chunk-OONJNQ42.js";
+import "./chunk-D2VIDMVM.js";
 import "./chunk-E2UVIFI2.js";
 import "./chunk-XU457J4V.js";
 import "./chunk-VDDGDZMA.js";
-import "./chunk-J2MKYJKZ.js";
+import "./chunk-EIAK6Q2B.js";
 import "./chunk-SZRN75WQ.js";
 import "./chunk-HTO4JFDZ.js";
 import "./chunk-CPBF7KYF.js";
@@ -362,20 +364,20 @@ import {
   APPROVAL_MODES,
   FORK_SUBAGENT_TYPE,
   runWithRuntimeContentGenerator
-} from "./chunk-UOA2IHRI.js";
+} from "./chunk-CPCVCKKF.js";
 import "./chunk-6AM5D4ME.js";
-import "./chunk-OSSDHJDU.js";
+import "./chunk-G45X5TRN.js";
 import {
   HookEventName,
   createHookOutput
-} from "./chunk-SGPFJMRP.js";
-import "./chunk-335ECZTA.js";
-import "./chunk-JCJPZMJV.js";
+} from "./chunk-PBATSWUQ.js";
+import "./chunk-ZEOZL37W.js";
+import "./chunk-OOCI5VVU.js";
 import {
   clearCachedCredentialFile,
   qwenOAuth2Events
-} from "./chunk-2CCDMJM7.js";
-import "./chunk-6ETOSWAO.js";
+} from "./chunk-53OPIXUE.js";
+import "./chunk-DSBCU6JY.js";
 import "./chunk-JESCGQM3.js";
 import {
   AuthType,
@@ -412,31 +414,31 @@ import {
   uiTelemetryService,
   withDaemonSpan,
   withInteractionSpan
-} from "./chunk-CPU6I5YV.js";
+} from "./chunk-I6JUVU7J.js";
 import "./chunk-4WKAA4KS.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   getAutoMemoryRoot,
   getUserAutoMemoryRoot
-} from "./chunk-LPHGXXZX.js";
-import "./chunk-4CA4WUMS.js";
-import "./chunk-VAJS2E2D.js";
-import "./chunk-WEPXQKGP.js";
+} from "./chunk-JD3MKVKL.js";
+import "./chunk-UEY4AYUL.js";
+import "./chunk-BDBMYST4.js";
+import "./chunk-EZVDJFZ7.js";
 import {
   ToolConfirmationOutcome,
   ToolNames,
   isShellProgressData
-} from "./chunk-ANRANWVE.js";
+} from "./chunk-OP4MOGXF.js";
 import "./chunk-XVNQMZ2I.js";
 import "./chunk-FEOZBUMT.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-4CHDYDG3.js";
+import "./chunk-6EFTQYW7.js";
 import {
   DEFAULT_TOKEN_LIMIT,
   getToolCallPreparations,
   tokenLimit
-} from "./chunk-V4PCIS25.js";
+} from "./chunk-MAQQGNQ5.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
 import "./chunk-TYQMGACW.js";
@@ -448,11 +450,11 @@ import {
   getErrorMessage,
   getErrorStatus,
   isSubpath
-} from "./chunk-UE5TZ55T.js";
-import "./chunk-PK7COE5O.js";
+} from "./chunk-C27BYUX6.js";
+import "./chunk-CL7IRYTA.js";
 import {
   runExitCleanup
-} from "./chunk-KMJOMWHE.js";
+} from "./chunk-COWNNAWJ.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -997,6 +999,13 @@ function interactionMetaFields(confirmation) {
 __name(interactionMetaFields, "interactionMetaFields");
 function buildPermissionRequestContent(confirmation) {
   const content = [];
+  const warnings = confirmation.type === "exec" || confirmation.type === "edit" ? confirmation.warnings ?? [] : [];
+  for (const warning of warnings) {
+    content.push({
+      type: "content",
+      content: { type: "text", text: warning }
+    });
+  }
   if (confirmation.type === "edit") {
     content.push({
       type: "diff",
@@ -1017,6 +1026,56 @@ function buildPermissionRequestContent(confirmation) {
   return content;
 }
 __name(buildPermissionRequestContent, "buildPermissionRequestContent");
+function permissionAbortError(signal) {
+  return signal.reason instanceof Error ? signal.reason : new Error("Permission request was aborted.");
+}
+__name(permissionAbortError, "permissionAbortError");
+function requestPermissionWithAbort(client, params, signal) {
+  if (signal.aborted) {
+    return Promise.reject(permissionAbortError(signal));
+  }
+  return new Promise((resolve5, reject) => {
+    let settled = false;
+    const finish = /* @__PURE__ */ __name((callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    }, "finish");
+    const onAbort = /* @__PURE__ */ __name(() => finish(() => reject(permissionAbortError(signal))), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    let request;
+    try {
+      request = client.requestPermission(params);
+    } catch (error) {
+      finish(() => reject(error));
+      return;
+    }
+    request.then(
+      (response) => finish(() => resolve5(response)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+__name(requestPermissionWithAbort, "requestPermissionWithAbort");
+function resolvePermissionOutcome(response, offeredOptions) {
+  if (response.outcome.outcome === "cancelled") {
+    return "cancel" /* Cancel */;
+  }
+  const optionId = response.outcome.optionId;
+  if (!offeredOptions.some((option) => option.optionId === optionId)) {
+    throw new Error(
+      `Permission response selected unoffered option: ${optionId}`
+    );
+  }
+  if (!Object.values(ToolConfirmationOutcome).includes(
+    optionId
+  )) {
+    throw new Error(`Permission response selected invalid option: ${optionId}`);
+  }
+  return optionId;
+}
+__name(resolvePermissionOutcome, "resolvePermissionOutcome");
 function toPermissionOptions(confirmation, forceHideAlwaysAllow = false) {
   switch (confirmation.type) {
     case "edit":
@@ -1243,9 +1302,13 @@ var SubAgentTracker = class {
         }, "onConfirm")
       };
       const { title, locations, kind } = this.toolCallEmitter.resolveToolMetadata(event.name, state?.args);
+      const permissionOptions = toPermissionOptions(fullConfirmationDetails);
+      const offeredPermissionOptions = permissionOptions.map((option) => ({
+        ...option
+      }));
       const params = {
         sessionId: this.ctx.sessionId,
-        options: toPermissionOptions(fullConfirmationDetails),
+        options: permissionOptions,
         toolCall: {
           toolCallId: event.callId,
           status: "pending",
@@ -1266,8 +1329,15 @@ var SubAgentTracker = class {
         }
       };
       try {
-        const output = await this.client.requestPermission(params);
-        const outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
+        const output = await requestPermissionWithAbort(
+          this.client,
+          params,
+          abortSignal
+        );
+        const outcome = resolvePermissionOutcome(
+          output,
+          offeredPermissionOptions
+        );
         await event.respond(outcome, {
           answers: "answers" in output ? output.answers : void 0
         });
@@ -3568,7 +3638,7 @@ ${this.pendingWorktreeNotice}
           await this.messageEmitter.emitAgentMessage(stopOutput.systemMessage);
         }
         if (stopOutput?.isBlockingDecision() || stopOutput?.shouldStopExecution()) {
-          externalReason = stopOutput.getEffectiveReason();
+          externalReason = getStopHookContinuationReason(stopOutput);
           stopHookIterationCount++;
           stopHookReasons = [...stopHookReasons, externalReason];
           stopHookCount = response.stopHookCount ?? 1;
@@ -5937,19 +6007,21 @@ ${this.pendingWorktreeNotice}
         { recordInvalidToolParams: true }
       );
     }
-    const toolSpan = startToolSpan(toolName, {
+    const policyToolName = tool.name;
+    const originalPolicyRequestArgs = policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR ? structuredClone(args) : args;
+    const toolSpan = startToolSpan(policyToolName, {
       "tool.call_id": callId,
       // Dual-emit the legacy call_id/tool_name aliases like CoreToolScheduler
       // (coreToolScheduler.ts) so pre-Phase-2 dashboards keyed off call_id keep
       // matching daemon/ACP tool spans during the migration window.
       call_id: callId,
-      tool_name: toolName
+      tool_name: policyToolName
     });
     let spanSuccess = false;
     try {
       return await runInToolSpanContext(toolSpan, async () => {
         const pm = this.config.getPermissionManager?.();
-        if (pm && !await pm.isToolEnabled(toolName)) {
+        if (pm && !await pm.isToolEnabled(policyToolName)) {
           return earlyErrorResponse(
             new Error(`Tool "${toolName}" is disabled.`),
             toolName
@@ -5978,7 +6050,7 @@ ${this.pendingWorktreeNotice}
           }
         }
         const toolUseId = generateToolUseId();
-        const approvalMode = this.config.getApprovalMode();
+        let approvalMode = this.config.getApprovalMode();
         let toolBuildSucceeded = false;
         try {
           const invocation = tool.build(args);
@@ -6003,12 +6075,12 @@ ${this.pendingWorktreeNotice}
               activeToolAbortSignal
             );
           }
-          const isAskUserQuestionTool = toolName === ToolNames.ASK_USER_QUESTION;
-          const toolParams = invocation.params;
+          const isAskUserQuestionTool = policyToolName === ToolNames.ASK_USER_QUESTION;
+          let toolParams = invocation.params;
           const flowResult = await evaluatePermissionFlow(
             this.config,
             invocation,
-            toolName,
+            policyToolName,
             toolParams
           );
           const {
@@ -6018,31 +6090,74 @@ ${this.pendingWorktreeNotice}
             denyMessage,
             requiresUserInteraction
           } = flowResult;
+          approvalMode = this.config.getApprovalMode();
           const isPlanMode = approvalMode === "plan" /* PLAN */;
+          const isPlanShellCall = isPlanMode && (policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR);
           if (finalPermission === "deny") {
             return earlyErrorResponse(
               new Error(denyMessage ?? `Tool "${toolName}" is denied.`),
               toolName
             );
           }
-          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(toolName, this.config));
+          let planShellAmbientWorkingDirectory;
+          if (isPlanShellCall) {
+            const directory = toolParams["directory"];
+            planShellAmbientWorkingDirectory = typeof directory === "string" && directory.length > 0 ? void 0 : this.config.getTargetDir();
+            invocation.params = {
+              ...structuredClone(invocation.params),
+              directory: typeof directory === "string" && directory.length > 0 ? directory : planShellAmbientWorkingDirectory
+            };
+            toolParams = invocation.params;
+          }
+          const planShellDecision = isPlanShellCall ? await evaluatePlanModeShellPolicy({
+            config: this.config,
+            toolName: policyToolName,
+            requestArgs: originalPolicyRequestArgs,
+            invocationParams: toolParams,
+            permissionContext: pmCtx,
+            ambientWorkingDirectory: planShellAmbientWorkingDirectory,
+            signal: activeToolAbortSignal
+          }) : { classification: "not-applicable" };
+          if (planShellDecision.classification !== "not-applicable") {
+            const initialPlanShellError = await validatePlanModeShellContext({
+              config: this.config,
+              decision: planShellDecision,
+              requestArgs: args,
+              invocationParams: invocation.params,
+              signal: activeToolAbortSignal
+            });
+            if (initialPlanShellError) {
+              return earlyErrorResponse(
+                new Error(initialPlanShellError),
+                toolName
+              );
+            }
+          }
+          if (planShellDecision.classification === "write") {
+            return earlyErrorResponse(
+              new Error(planShellDecision.writeBlockMessage),
+              toolName
+            );
+          }
+          const planShellRequiresConfirmation = planShellDecision.classification === "unknown";
+          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(policyToolName, this.config));
           const confirmationPermission = getEffectivePermissionForConfirmation(
             finalPermission,
             forceAutoReviewForAllow
           );
           if (finalPermission === "allow" && forceAutoReviewForAllow) {
             debugLogger6.info(
-              `Auto mode: L4 allow overridden by protected-write guard for ${toolName}`
+              `Auto mode: L4 allow overridden by protected-write guard for ${policyToolName}`
             );
           }
-          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow;
+          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow && !planShellRequiresConfirmation;
           if (autoModeAllowed && approvalMode === "auto" /* AUTO */) {
             this.config.setAutoModeDenialState(
               recordAllow(this.config.getAutoModeDenialState())
             );
           }
           let wasAutoModeDenialFallback = false;
-          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, toolName)) {
+          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, policyToolName)) {
             const denialState = this.config.getAutoModeDenialState();
             const fallback = shouldFallback(denialState);
             const messages = this.config.getGeminiClient?.()?.getHistoryTail(MAX_TRANSCRIPT_MESSAGES, false) ?? [];
@@ -6064,7 +6179,7 @@ ${this.pendingWorktreeNotice}
               this.config,
               decision,
               outcome,
-              toolName,
+              policyToolName,
               toolParams,
               callId,
               abortSignal
@@ -6075,7 +6190,7 @@ ${this.pendingWorktreeNotice}
                 break;
               case "blocked":
                 debugLogger6.warn(
-                  `Auto mode blocked (${outcome.reason}): tool=${toolName}, ` + formatDenialStateLog(denialState)
+                  `Auto mode blocked (${outcome.reason}): tool=${policyToolName}, ` + formatDenialStateLog(denialState)
                 );
                 return earlyErrorResponse(
                   new Error(outcome.errorMessage),
@@ -6116,14 +6231,45 @@ ${this.pendingWorktreeNotice}
             }
           }, "recordAutoModeFallbackResolution");
           if (!autoModeAllowed && needsConfirmation(
-            confirmationPermission,
+            planShellRequiresConfirmation ? "ask" : confirmationPermission,
             approvalMode,
-            toolName,
+            policyToolName,
             requiresUserInteraction
           )) {
-            confirmationDetails = await invocation.getConfirmationDetails(abortSignal);
+            confirmationDetails = await invocation.getConfirmationDetails(
+              activeToolAbortSignal
+            );
+            if (planShellDecision.classification !== "not-applicable") {
+              const preDisplayPlanShellError = await validatePlanModeShellContext({
+                config: this.config,
+                decision: planShellDecision,
+                requestArgs: args,
+                invocationParams: invocation.params,
+                signal: activeToolAbortSignal
+              });
+              if (preDisplayPlanShellError) {
+                return earlyErrorResponse(
+                  new Error(preDisplayPlanShellError),
+                  toolName
+                );
+              }
+            }
+            try {
+              confirmationDetails = decoratePlanModeShellConfirmation(
+                planShellDecision,
+                confirmationDetails
+              );
+            } catch {
+              if (planShellDecision.classification === "unknown") {
+                return earlyErrorResponse(
+                  new Error(planShellDecision.noApprovalMessage),
+                  toolName
+                );
+              }
+              throw new Error("Unable to prepare shell confirmation.");
+            }
             injectPermissionRulesIfMissing(confirmationDetails, pmCtx);
-            if (isPlanModeBlocked(
+            if (planShellDecision.classification === "not-applicable" && isPlanModeBlocked(
               isPlanMode,
               isExitPlanModeTool,
               isAskUserQuestionTool,
@@ -6143,23 +6289,50 @@ ${this.pendingWorktreeNotice}
             if (hooksEnabled && messageBus) {
               const hookResult = await firePermissionRequestHook(
                 messageBus,
-                toolName,
+                policyToolName,
                 args,
-                String(approvalMode)
+                String(approvalMode),
+                void 0,
+                activeToolAbortSignal
               );
               if (hookResult.hasDecision && (!hookResult.shouldAllow || !requiresUserInteraction)) {
                 hookHandled = true;
                 if (hookResult.shouldAllow) {
-                  if (hookResult.updatedInput) {
-                    args = hookResult.updatedInput;
-                    invocation.params = hookResult.updatedInput;
+                  if (planShellDecision.classification !== "not-applicable") {
+                    const approval = await validatePlanModeShellApproval({
+                      config: this.config,
+                      decision: planShellDecision,
+                      requestArgs: args,
+                      invocationParams: invocation.params,
+                      signal: activeToolAbortSignal,
+                      outcome: "proceed_once" /* ProceedOnce */,
+                      payload: hookResult.updatedInput ? { updatedInput: hookResult.updatedInput } : void 0
+                    });
+                    await confirmationDetails.onConfirm(
+                      approval.outcome,
+                      approval.payload
+                    );
+                    if (approval.outcome === "cancel" /* Cancel */) {
+                      return earlyErrorResponse(
+                        new Error(
+                          approval.payload?.cancelMessage ?? planShellDecision.noApprovalMessage
+                        ),
+                        toolName
+                      );
+                    }
+                    recordAutoModeFallbackResolution(approval.outcome);
+                  } else {
+                    if (hookResult.updatedInput) {
+                      args = hookResult.updatedInput;
+                      invocation.params = hookResult.updatedInput;
+                    }
+                    await confirmationDetails.onConfirm(
+                      "proceed_once" /* ProceedOnce */
+                    );
+                    recordAutoModeFallbackResolution(
+                      "proceed_once" /* ProceedOnce */
+                    );
                   }
-                  await confirmationDetails.onConfirm(
-                    "proceed_once" /* ProceedOnce */
-                  );
-                  recordAutoModeFallbackResolution(
-                    "proceed_once" /* ProceedOnce */
-                  );
                 } else {
                   return earlyErrorResponse(
                     new Error(
@@ -6172,11 +6345,26 @@ ${this.pendingWorktreeNotice}
             }
             if (!requiresUserInteraction && approvalMode === "auto-edit" /* AUTO_EDIT */ && (confirmationDetails.type === "edit" || confirmationDetails.type === "info")) {
             } else if (!hookHandled) {
+              if (planShellDecision.classification !== "not-applicable") {
+                const finalPreDisplayPlanShellError = await validatePlanModeShellContext({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal
+                });
+                if (finalPreDisplayPlanShellError) {
+                  return earlyErrorResponse(
+                    new Error(finalPreDisplayPlanShellError),
+                    toolName
+                  );
+                }
+              }
               didRequestPermission = true;
               const content = buildPermissionRequestContent(confirmationDetails);
               const mappedKind = this.toolCallEmitter.mapToolKind(
                 tool.kind,
-                toolName
+                policyToolName
               );
               if (hooksEnabled && messageBus) {
                 this.fireNotificationHookWithTerminalSequence(
@@ -6186,9 +6374,16 @@ ${this.pendingWorktreeNotice}
                   "Permission needed"
                 );
               }
+              const permissionOptions = toPermissionOptions(
+                confirmationDetails,
+                pmForcedAsk
+              );
+              const offeredPermissionOptions = permissionOptions.map(
+                (option) => ({ ...option })
+              );
               const params = {
                 sessionId: this.sessionId,
-                options: toPermissionOptions(confirmationDetails, pmForcedAsk),
+                options: permissionOptions,
                 toolCall: {
                   toolCallId: callId,
                   status: "pending",
@@ -6207,10 +6402,12 @@ ${this.pendingWorktreeNotice}
                   }
                 }
               };
-              const stopAfterPermissionCancel = /* @__PURE__ */ __name(() => {
+              const stopAfterPermissionCancel = /* @__PURE__ */ __name((message) => {
                 onStopAfterPermissionCancel?.();
                 return earlyErrorResponse(
-                  new Error(`Tool "${toolName}" was canceled by the user.`),
+                  new Error(
+                    message ?? `Tool "${toolName}" was canceled by the user.`
+                  ),
                   toolName,
                   { stopAfterPermissionCancel: true }
                 );
@@ -6218,10 +6415,15 @@ ${this.pendingWorktreeNotice}
               let output;
               let outcome;
               try {
-                output = await this.client.requestPermission(
-                  params
+                output = await requestPermissionWithAbort(
+                  this.client,
+                  params,
+                  activeToolAbortSignal
+                );
+                outcome = resolvePermissionOutcome(
+                  output,
+                  offeredPermissionOptions
                 );
-                outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
               } catch (error) {
                 debugLogger6.error(
                   `Permission request failed for tool ${toolName}:`,
@@ -6238,7 +6440,9 @@ ${this.pendingWorktreeNotice}
                   );
                 }
                 onStopAfterPermissionCancel?.();
-                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : `Permission request failed for "${toolName}": ${this.#formatError(
+                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : planShellDecision.classification === "unknown" ? `Plan mode could not complete approval for this shell command: ${this.#formatError(
+                  error
+                )}. The command was not run; Plan mode remains active.` : `Permission request failed for "${toolName}": ${this.#formatError(
                   error
                 )}`;
                 return earlyErrorResponse(
@@ -6247,11 +6451,28 @@ ${this.pendingWorktreeNotice}
                   { stopAfterPermissionCancel: true }
                 );
               }
+              let confirmationPayload = {
+                answers: output.answers
+              };
+              if (planShellDecision.classification !== "not-applicable") {
+                const approval = await validatePlanModeShellApproval({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal,
+                  outcome,
+                  payload: confirmationPayload
+                });
+                outcome = approval.outcome;
+                confirmationPayload = approval.payload;
+              }
               recordAutoModeFallbackResolution(outcome);
               try {
-                await confirmationDetails.onConfirm(outcome, {
-                  answers: output.answers
-                });
+                await confirmationDetails.onConfirm(
+                  outcome,
+                  confirmationPayload
+                );
               } catch (error) {
                 if (outcome !== "cancel" /* Cancel */) {
                   throw error;
@@ -6268,7 +6489,7 @@ ${this.pendingWorktreeNotice}
                   confirmationDetails,
                   this.config.getOnPersistPermissionRule?.(),
                   this.config.getPermissionManager?.(),
-                  { answers: output.answers }
+                  confirmationPayload
                 );
               }
               if (confirmationDetails.type === "edit" && outcome === "proceed_always" /* ProceedAlways */) {
@@ -6276,7 +6497,9 @@ ${this.pendingWorktreeNotice}
               }
               switch (outcome) {
                 case "cancel" /* Cancel */:
-                  return stopAfterPermissionCancel();
+                  return stopAfterPermissionCancel(
+                    confirmationPayload?.cancelMessage
+                  );
                 case "proceed_once" /* ProceedOnce */:
                 case "proceed_always" /* ProceedAlways */:
                 case "proceed_always_project" /* ProceedAlwaysProject */:
@@ -6308,7 +6531,7 @@ ${this.pendingWorktreeNotice}
           if (hooksEnabledForTool && messageBusForTool) {
             const preHookResult = await firePreToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolUseId,
               permissionMode,
@@ -6425,7 +6648,7 @@ ${this.pendingWorktreeNotice}
             };
             const postHookResult = await firePostToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolResponse,
               toolUseId,
@@ -6456,7 +6679,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForTool,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               toolResult.error?.message ?? "Tool execution was cancelled",
               isInterrupt,
@@ -6545,7 +6768,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForError,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               error.message,
               isInterrupt,
@@ -9409,7 +9632,7 @@ var QwenAgent = class {
     markAcpStartup("initializeHandlerStart");
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.19.12";
+    const version = "0.20.0-nightly.20260720.0c271659d";
     const response = {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {