@qwen-code/qwen-code 0.19.12 → 0.20.0-nightly.20260721.cda0e0348

package/chunks/{acpAgent-OB2CTF3P.js → acpAgent-2ATF4LMP.js}

@@ -1,11 +1,8 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  recomputeMcpGating
-} from "./chunk-GW7BONBU.js";
 import {
   classifyApiError
-} from "./chunk-LUJQUNKY.js";
+} from "./chunk-V7RNNPGC.js";
 import {
   EXTENSION_CONTEXT_BUDGET,
   buildExtensionMentionContext,
@@ -15,40 +12,40 @@ import {
   matchMcpServerByRef,
   parseExtensionRef,
   parseMcpServerRef
-} from "./chunk-KGWA7XYL.js";
+} from "./chunk-AY3CSB6F.js";
 import {
   getAvailableCommands,
   handleSlashCommand,
   insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-4SJJT466.js";
+} from "./chunk-WQQDJE2P.js";
+import {
+  recomputeMcpGating
+} from "./chunk-OV2KB55J.js";
 import {
   appEvents,
   buildDisabledSkillNamesProvider,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-NALRQ3SG.js";
-import "./chunk-5DTTYNB7.js";
-import {
-  collectContextData,
-  formatContextUsageText
-} from "./chunk-NPMVLWYL.js";
+} from "./chunk-FCUUJKZF.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-GFYFLDEG.js";
-import "./chunk-EDFD7VOX.js";
+} from "./chunk-7KGXAXF7.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-MRE77ST5.js";
+} from "./chunk-2GOPPEHK.js";
+import "./chunk-5DTTYNB7.js";
+import "./chunk-QKYTTBYW.js";
+import {
+  collectContextData,
+  formatContextUsageText
+} from "./chunk-5YVZ2XLV.js";
 import "./chunk-4WGODMVR.js";
-import "./chunk-KW7NOTN6.js";
-import "./chunk-GEHSF7MS.js";
-import "./chunk-XAAEDML2.js";
-import "./chunk-ETN2G32U.js";
-import "./chunk-NHDKSOEY.js";
-import "./chunk-OBSLEYCD.js";
-import "./chunk-WIYV7CSF.js";
+import "./chunk-AYCDXHZB.js";
+import "./chunk-JPRLCXAO.js";
+import "./chunk-5PZ6R37W.js";
+import "./chunk-BWK3FX3K.js";
 import "./chunk-YAF2MQZ6.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
@@ -68,7 +65,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-KRMARA3A.js";
+} from "./chunk-CG2HPAVD.js";
 import {
   HistoryReplayer,
   MessageEmitter,
@@ -78,21 +75,21 @@ import {
   goalTerminalEventToHistoryItem,
   recordGoalStatusItem,
   restoreGoalFromHistory
-} from "./chunk-GXFYV7MP.js";
-import "./chunk-QSG4ZFG4.js";
-import "./chunk-HZ4M2UQD.js";
-import "./chunk-J6NT5YTN.js";
+} from "./chunk-PFKNXN67.js";
+import "./chunk-KTUQMDEP.js";
+import "./chunk-6RVJRVQR.js";
+import "./chunk-RS7MT2QG.js";
+import "./chunk-H2XVO6NE.js";
 import "./chunk-QHTIBUWB.js";
 import {
   isTerminalGoalStatusKind
-} from "./chunk-76BFY7AF.js";
-import "./chunk-HTHUX2T5.js";
+} from "./chunk-QTERJVPZ.js";
 import "./chunk-L573Z2QZ.js";
 import {
   computeCpuPercent
 } from "./chunk-HGT6JR3U.js";
 import "./chunk-RXFQM6FQ.js";
-import "./chunk-DJ4VHAFJ.js";
+import "./chunk-4CWPMWCD.js";
 import "./chunk-6H67XLET.js";
 import {
   beginAcpBootstrapConfigProfiling,
@@ -100,9 +97,9 @@ import {
   endAcpBootstrapConfigProfiling,
   markAcpStartup
 } from "./chunk-TDKQP3M6.js";
-import "./chunk-UZC5VPOJ.js";
+import "./chunk-2GFRA3MN.js";
 import "./chunk-LXXMOYPL.js";
-import "./chunk-3B6PSWHE.js";
+import "./chunk-GH7OEOYU.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   ACP_ROUTE_ID_PREFIX,
@@ -112,7 +109,7 @@ import {
   parseAcpModelOption,
   resolveAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-HVGJWOR6.js";
+} from "./chunk-L4YSPHR4.js";
 import {
   mapSkillConfigToStatus
 } from "./chunk-2W3OOD4W.js";
@@ -122,19 +119,19 @@ import {
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-QIFTJDBY.js";
+} from "./chunk-IM2A6YO3.js";
 import {
   MAX_AUDIO_BYTES,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-3ESL7JXA.js";
+} from "./chunk-U4VGYZN7.js";
 import {
   readVoiceModel
-} from "./chunk-2476XGOU.js";
-import "./chunk-F2RR4HO2.js";
+} from "./chunk-GPILFVPY.js";
+import "./chunk-BVLROR2T.js";
 import {
   parseSessionSource
-} from "./chunk-W4UN42YP.js";
+} from "./chunk-R3VZNHRX.js";
 import "./chunk-6RLROE6G.js";
 import "./chunk-COH43MRJ.js";
 import {
@@ -151,7 +148,7 @@ import {
 } from "./chunk-QR6U5QPP.js";
 import {
   ndJsonStream
-} from "./chunk-PUKUUASO.js";
+} from "./chunk-DMRO4GU2.js";
 import {
   NOT_CURRENTLY_GENERATING_CANCEL_MESSAGE
 } from "./chunk-X6YQWCIJ.js";
@@ -162,23 +159,23 @@ import {
   SERVE_STATUS_EXT_METHODS,
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-64GC5EMF.js";
-import "./chunk-HD6EGS5K.js";
-import "./chunk-RKUMFUFM.js";
+} from "./chunk-DZZIOIVF.js";
+import "./chunk-CUJX3F4X.js";
+import "./chunk-6MC5ASQK.js";
 import "./chunk-57OAHC2Y.js";
-import "./chunk-EFAXBOQO.js";
-import "./chunk-W6CQPLWM.js";
+import "./chunk-32F7BZSK.js";
+import "./chunk-6ZBPS62S.js";
 import "./chunk-V6WHFGST.js";
 import {
   createLoadedSettingsAdapter
-} from "./chunk-42VIHAYT.js";
+} from "./chunk-B452RETY.js";
 import "./chunk-W7FJ3N32.js";
-import "./chunk-I7RRHHYG.js";
+import "./chunk-QKTHJXCS.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-HCCR43AY.js";
-import "./chunk-BABX5XRO.js";
-import "./chunk-BKNPMEN6.js";
+import "./chunk-RFIAR4YL.js";
+import "./chunk-2LI23QA6.js";
+import "./chunk-RVLZCXEE.js";
 import {
   AgentSideConnection,
   PROTOCOL_VERSION,
@@ -187,7 +184,7 @@ import {
 import {
   assembleMcpServers,
   loadMcpApprovals
-} from "./chunk-4MPYGENG.js";
+} from "./chunk-G45NOBV7.js";
 import {
   getOutputLanguageFilePath,
   getPersistScopeForModelSelection,
@@ -196,7 +193,7 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-6IITZE7O.js";
+} from "./chunk-5JX5EWR5.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import {
@@ -207,20 +204,20 @@ import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-TKASNYDS.js";
+} from "./chunk-6DHWO5ZF.js";
 import {
   findEnvFiles,
   preResolveHomeEnvOverrides,
   reloadEnvironment
-} from "./chunk-PR5XQ73G.js";
+} from "./chunk-KTNIZG2C.js";
 import "./chunk-QRUIS3DN.js";
-import "./chunk-GLH2NTPB.js";
+import "./chunk-XCHUDLER.js";
 import "./chunk-VJNBRRZG.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-GMUPIMHF.js";
+} from "./chunk-4RA7PWIY.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
 import {
@@ -246,6 +243,7 @@ import {
   McpServerSpawnFailedError,
   McpTransportPool,
   MessageDisplayDispatcher,
+  PLAN_MODE_ENTRY_SIBLING_SKIP_MESSAGE,
   POOLED_TRANSPORTS_DEFAULT,
   SESSION_ARTIFACT_PERSISTENCE_VERSION,
   SESSION_TITLE_MAX_LENGTH,
@@ -275,13 +273,16 @@ import {
   convertToFunctionErrorResponse,
   convertToFunctionResponse,
   createDuplicateProviderToolCallResponse,
+  decoratePlanModeShellConfirmation,
   dedupeToolCallsById,
   detectAutonomousSentinel,
   detectLoopSentinel,
   encodeSessionTranscriptCursor,
   evaluateAutoMode,
   evaluatePermissionFlow,
+  evaluatePlanModeShellPolicy,
   findExistingProviderModels,
+  findPlanModeEntryBatchBoundaryIndex,
   findProviderById,
   findRepeatedDuplicateProviderToolCall,
   fireNotificationHook,
@@ -305,6 +306,7 @@ import {
   getProviderToolCallId,
   getScopedEnvContents,
   getStartupContextLength,
+  getStopHookContinuationReason,
   ideContextStore,
   injectPermissionRulesIfMissing,
   isApproveOutcome,
@@ -340,21 +342,23 @@ import {
   shouldRunAutoModeForCall,
   subagentGenerator,
   unregisterGoalHook,
-  updateSetting
-} from "./chunk-GCY7QTCE.js";
+  updateSetting,
+  validatePlanModeShellApproval,
+  validatePlanModeShellContext
+} from "./chunk-NO6XTCYT.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-T4TZQJ7W.js";
 import {
   external_exports
 } from "./chunk-H6XPXXMH.js";
-import "./chunk-LKR7QQ63.js";
-import "./chunk-4XCVGEEX.js";
-import "./chunk-XSPFQQRE.js";
-import "./chunk-4RPARQ5D.js";
+import "./chunk-EAUYY7SS.js";
+import "./chunk-FSL5W5TI.js";
+import "./chunk-OONJNQ42.js";
+import "./chunk-D2VIDMVM.js";
 import "./chunk-E2UVIFI2.js";
 import "./chunk-XU457J4V.js";
 import "./chunk-VDDGDZMA.js";
-import "./chunk-J2MKYJKZ.js";
+import "./chunk-EIAK6Q2B.js";
 import "./chunk-SZRN75WQ.js";
 import "./chunk-HTO4JFDZ.js";
 import "./chunk-CPBF7KYF.js";
@@ -362,20 +366,20 @@ import {
   APPROVAL_MODES,
   FORK_SUBAGENT_TYPE,
   runWithRuntimeContentGenerator
-} from "./chunk-UOA2IHRI.js";
+} from "./chunk-CPCVCKKF.js";
 import "./chunk-6AM5D4ME.js";
-import "./chunk-OSSDHJDU.js";
+import "./chunk-G45X5TRN.js";
 import {
   HookEventName,
   createHookOutput
-} from "./chunk-SGPFJMRP.js";
-import "./chunk-335ECZTA.js";
-import "./chunk-JCJPZMJV.js";
+} from "./chunk-PBATSWUQ.js";
+import "./chunk-ZEOZL37W.js";
+import "./chunk-OOCI5VVU.js";
 import {
   clearCachedCredentialFile,
   qwenOAuth2Events
-} from "./chunk-2CCDMJM7.js";
-import "./chunk-6ETOSWAO.js";
+} from "./chunk-25Y6JSH2.js";
+import "./chunk-246TW4IX.js";
 import "./chunk-JESCGQM3.js";
 import {
   AuthType,
@@ -412,31 +416,31 @@ import {
   uiTelemetryService,
   withDaemonSpan,
   withInteractionSpan
-} from "./chunk-CPU6I5YV.js";
+} from "./chunk-P64HXIC5.js";
 import "./chunk-4WKAA4KS.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   getAutoMemoryRoot,
   getUserAutoMemoryRoot
-} from "./chunk-LPHGXXZX.js";
-import "./chunk-4CA4WUMS.js";
-import "./chunk-VAJS2E2D.js";
-import "./chunk-WEPXQKGP.js";
+} from "./chunk-JD3MKVKL.js";
+import "./chunk-UEY4AYUL.js";
+import "./chunk-BDBMYST4.js";
+import "./chunk-EZVDJFZ7.js";
 import {
   ToolConfirmationOutcome,
   ToolNames,
   isShellProgressData
-} from "./chunk-ANRANWVE.js";
+} from "./chunk-OP4MOGXF.js";
 import "./chunk-XVNQMZ2I.js";
 import "./chunk-FEOZBUMT.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-4CHDYDG3.js";
+import "./chunk-6EFTQYW7.js";
 import {
   DEFAULT_TOKEN_LIMIT,
   getToolCallPreparations,
   tokenLimit
-} from "./chunk-V4PCIS25.js";
+} from "./chunk-FZVSFBNW.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
 import "./chunk-TYQMGACW.js";
@@ -448,11 +452,11 @@ import {
   getErrorMessage,
   getErrorStatus,
   isSubpath
-} from "./chunk-UE5TZ55T.js";
-import "./chunk-PK7COE5O.js";
+} from "./chunk-C27BYUX6.js";
+import "./chunk-ABIL4ZQU.js";
 import {
   runExitCleanup
-} from "./chunk-KMJOMWHE.js";
+} from "./chunk-WRRF6TEQ.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -997,6 +1001,13 @@ function interactionMetaFields(confirmation) {
 __name(interactionMetaFields, "interactionMetaFields");
 function buildPermissionRequestContent(confirmation) {
   const content = [];
+  const warnings = confirmation.type === "exec" || confirmation.type === "edit" ? confirmation.warnings ?? [] : [];
+  for (const warning of warnings) {
+    content.push({
+      type: "content",
+      content: { type: "text", text: warning }
+    });
+  }
   if (confirmation.type === "edit") {
     content.push({
       type: "diff",
@@ -1017,6 +1028,56 @@ function buildPermissionRequestContent(confirmation) {
   return content;
 }
 __name(buildPermissionRequestContent, "buildPermissionRequestContent");
+function permissionAbortError(signal) {
+  return signal.reason instanceof Error ? signal.reason : new Error("Permission request was aborted.");
+}
+__name(permissionAbortError, "permissionAbortError");
+function requestPermissionWithAbort(client, params, signal) {
+  if (signal.aborted) {
+    return Promise.reject(permissionAbortError(signal));
+  }
+  return new Promise((resolve5, reject) => {
+    let settled = false;
+    const finish = /* @__PURE__ */ __name((callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    }, "finish");
+    const onAbort = /* @__PURE__ */ __name(() => finish(() => reject(permissionAbortError(signal))), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    let request;
+    try {
+      request = client.requestPermission(params);
+    } catch (error) {
+      finish(() => reject(error));
+      return;
+    }
+    request.then(
+      (response) => finish(() => resolve5(response)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+__name(requestPermissionWithAbort, "requestPermissionWithAbort");
+function resolvePermissionOutcome(response, offeredOptions) {
+  if (response.outcome.outcome === "cancelled") {
+    return "cancel" /* Cancel */;
+  }
+  const optionId = response.outcome.optionId;
+  if (!offeredOptions.some((option) => option.optionId === optionId)) {
+    throw new Error(
+      `Permission response selected unoffered option: ${optionId}`
+    );
+  }
+  if (!Object.values(ToolConfirmationOutcome).includes(
+    optionId
+  )) {
+    throw new Error(`Permission response selected invalid option: ${optionId}`);
+  }
+  return optionId;
+}
+__name(resolvePermissionOutcome, "resolvePermissionOutcome");
 function toPermissionOptions(confirmation, forceHideAlwaysAllow = false) {
   switch (confirmation.type) {
     case "edit":
@@ -1243,9 +1304,13 @@ var SubAgentTracker = class {
         }, "onConfirm")
       };
       const { title, locations, kind } = this.toolCallEmitter.resolveToolMetadata(event.name, state?.args);
+      const permissionOptions = toPermissionOptions(fullConfirmationDetails);
+      const offeredPermissionOptions = permissionOptions.map((option) => ({
+        ...option
+      }));
       const params = {
         sessionId: this.ctx.sessionId,
-        options: toPermissionOptions(fullConfirmationDetails),
+        options: permissionOptions,
         toolCall: {
           toolCallId: event.callId,
           status: "pending",
@@ -1266,8 +1331,15 @@ var SubAgentTracker = class {
         }
       };
       try {
-        const output = await this.client.requestPermission(params);
-        const outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
+        const output = await requestPermissionWithAbort(
+          this.client,
+          params,
+          abortSignal
+        );
+        const outcome = resolvePermissionOutcome(
+          output,
+          offeredPermissionOptions
+        );
         await event.respond(outcome, {
           answers: "answers" in output ? output.answers : void 0
         });
@@ -1859,6 +1931,10 @@ function maskApiKeyForDisplay(apiKey) {
   return `${trimmed.slice(0, 3)}...${trimmed.slice(-4)}`;
 }
 __name(maskApiKeyForDisplay, "maskApiKeyForDisplay");
+function getAbortAwareEndTurnStopReason(signal) {
+  return signal.aborted ? "cancelled" : "end_turn";
+}
+__name(getAbortAwareEndTurnStopReason, "getAbortAwareEndTurnStopReason");
 var DAEMON_INVALID_TOOL_PARAMS_THRESHOLD = 3;
 var PERMISSION_CANCEL_SKIP_MESSAGE = "Skipped because a permission request was cancelled before the user answered; user input is required before continuing.";
 var LOOP_DETECTED_SKIP_MESSAGE = "Skipped because loop detection stopped the current turn before this tool call could run.";
@@ -3406,7 +3482,11 @@ ${this.pendingWorktreeNotice}
                       toolRun,
                       pendingSend.signal
                     );
-                    return { stopReason: "end_turn" };
+                    return {
+                      stopReason: getAbortAwareEndTurnStopReason(
+                        pendingSend.signal
+                      )
+                    };
                   }
                   const nextAfterTools = await this.#buildNextMessageAfterToolRun(
                     toolRun,
@@ -3420,7 +3500,11 @@ ${this.pendingWorktreeNotice}
                       toolRun,
                       pendingSend.signal
                     );
-                    return { stopReason: "end_turn" };
+                    return {
+                      stopReason: getAbortAwareEndTurnStopReason(
+                        pendingSend.signal
+                      )
+                    };
                   }
                 }
               }
@@ -3465,7 +3549,7 @@ ${this.pendingWorktreeNotice}
     while (true) {
       if (pendingSend.signal.aborted) {
         this.todoStopGuard.suspend();
-        return { stopReason: "end_turn" };
+        return { stopReason: "cancelled" };
       }
       if (this.config.getApprovalMode() === "plan" /* PLAN */) {
         this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
@@ -3568,7 +3652,7 @@ ${this.pendingWorktreeNotice}
           await this.messageEmitter.emitAgentMessage(stopOutput.systemMessage);
         }
         if (stopOutput?.isBlockingDecision() || stopOutput?.shouldStopExecution()) {
-          externalReason = stopOutput.getEffectiveReason();
+          externalReason = getStopHookContinuationReason(stopOutput);
           stopHookIterationCount++;
           stopHookReasons = [...stopHookReasons, externalReason];
           stopHookCount = response.stopHookCount ?? 1;
@@ -3915,7 +3999,7 @@ ${this.pendingWorktreeNotice}
           await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
           return {
             kind: "terminal",
-            stopReason: "end_turn",
+            stopReason: getAbortAwareEndTurnStopReason(pendingSend.signal),
             ...supersededAutomaticContinuation ? { supersededAutomaticContinuation: true } : {}
           };
         }
@@ -4164,13 +4248,18 @@ ${this.pendingWorktreeNotice}
     }
   }
   async #preserveStoppedToolRun(toolRun, abortSignal) {
+    const midTurnParts = abortSignal.aborted ? await this.#buildMidTurnParts(
+      this.#takeRecoveredMidTurnMessages(),
+      abortSignal,
+      { preserveFallbackOnAbort: true }
+    ) : await this.#drainMidTurnUserMessages(abortSignal);
     this.#preserveUnsentMessageHistory(
       {
         role: "user",
         parts: [
           ...toolRun.parts,
           ...toolRun.loopDetected ? [{ text: LOOP_DETECTED_CONTEXT_MESSAGE }] : [],
-          ...await this.#drainMidTurnUserMessages(abortSignal)
+          ...midTurnParts
         ]
       },
       true
@@ -4285,11 +4374,7 @@ ${this.pendingWorktreeNotice}
     const recovered = this.#takeRecoveredMidTurnMessages();
     if (this.midTurnDrainUnavailable) {
       return {
-        parts: await this.#buildMidTurnParts(
-          recovered,
-          abortSignal,
-          options.onFullTurnModel
-        ),
+        parts: await this.#buildMidTurnParts(recovered, abortSignal, options),
         hasQueuedPrompt: false
       };
     }
@@ -4317,7 +4402,7 @@ ${this.pendingWorktreeNotice}
         parts: await this.#buildMidTurnParts(
           [...recovered, ...parseMidTurnDrainResponse(response)],
           abortSignal,
-          options.onFullTurnModel
+          options
         ),
         hasQueuedPrompt: isRecord2(response) && response["hasQueuedPrompt"] === true
       };
@@ -4337,11 +4422,7 @@ ${this.pendingWorktreeNotice}
         `Mid-turn queue drain ${isPermanentError ? "permanently " : ""}unavailable [session ${this.sessionId}]: ${errorMessage}`
       );
       return {
-        parts: await this.#buildMidTurnParts(
-          recovered,
-          abortSignal,
-          options.onFullTurnModel
-        ),
+        parts: await this.#buildMidTurnParts(recovered, abortSignal, options),
         hasQueuedPrompt: false
       };
     }
@@ -4401,7 +4482,7 @@ ${this.pendingWorktreeNotice}
    * happens on injection (here), so a message recovered from an earlier
    * timed-out drain is still recorded exactly once.
    */
-  async #buildMidTurnParts(messages, abortSignal, onFullTurnModel) {
+  async #buildMidTurnParts(messages, abortSignal, options = {}) {
     const parts = [];
     for (const message of messages) {
       const displayText = message.kind === "text" ? message.message : message.displayText;
@@ -4411,13 +4492,19 @@ ${this.pendingWorktreeNotice}
           abortSignal,
           MID_TURN_QUEUE_RESOLVE_TIMEOUT_MS,
           (signal) => this.#resolvePrompt(message.content, signal, {
-            onFullTurnModel
+            onFullTurnModel: options.onFullTurnModel
           })
         );
       } catch (messageError) {
-        if (abortSignal.aborted) return parts;
-        const errorMessage = this.#formatError(messageError);
-        debugLogger6.warn(`Failed to resolve mid-turn message: ${errorMessage}`);
+        if (abortSignal.aborted && !options.preserveFallbackOnAbort) {
+          return parts;
+        }
+        if (!abortSignal.aborted) {
+          const errorMessage = this.#formatError(messageError);
+          debugLogger6.warn(
+            `Failed to resolve mid-turn message: ${errorMessage}`
+          );
+        }
         rawParts = [{ text: displayText }];
         if (message.kind === "structured" && hasInlineMediaContentBlock(message.content)) {
           rawParts.push({ text: MID_TURN_ATTACHMENT_PROCESSING_FAILURE_TEXT });
@@ -5094,7 +5181,9 @@ ${this.pendingWorktreeNotice}
               if (toolRun.stopAfterPermissionCancel) {
                 this.todoStopGuard.suspend();
                 await this.#preserveStoppedToolRun(toolRun, ac.signal);
-                await this.#emitBackgroundNotificationEndTurn("end_turn");
+                await this.#emitBackgroundNotificationEndTurn(
+                  getAbortAwareEndTurnStopReason(ac.signal)
+                );
                 return;
               }
               const nextAfterTools = await this.#buildNextMessageAfterToolRun(
@@ -5105,7 +5194,9 @@ ${this.pendingWorktreeNotice}
               if (toolRun.loopDetected) {
                 this.todoStopGuard.suspend();
                 await this.#preserveStoppedToolRun(toolRun, ac.signal);
-                await this.#emitBackgroundNotificationEndTurn("end_turn");
+                await this.#emitBackgroundNotificationEndTurn(
+                  getAbortAwareEndTurnStopReason(ac.signal)
+                );
                 return;
               }
             }
@@ -5123,7 +5214,9 @@ ${this.pendingWorktreeNotice}
               false
             )).stopReason;
           }
-          await this.#emitBackgroundNotificationEndTurn(stopReason);
+          await this.#emitBackgroundNotificationEndTurn(
+            ac.signal.aborted ? "cancelled" : stopReason
+          );
         } catch (error) {
           if (ac.signal.aborted) {
             this.todoStopGuard.suspend();
@@ -5417,7 +5510,7 @@ ${this.pendingWorktreeNotice}
   async runToolCalls(abortSignal, promptId, functionCalls, toolLoopState) {
     const dedupedFunctionCalls = dedupeToolCallsById(functionCalls);
     let skippedToolCallCounter = 0;
-    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc, message = PERMISSION_CANCEL_SKIP_MESSAGE, emitStart = true) => {
+    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc, message = PERMISSION_CANCEL_SKIP_MESSAGE, emitStart = true, errorType) => {
       const toolName = fc.name ?? "unknown_tool";
       const callId = fc.id ?? `${toolName}-skip-${++skippedToolCallCounter}`;
       const part = {
@@ -5434,7 +5527,7 @@ ${this.pendingWorktreeNotice}
           status: "error",
           resultDisplay: void 0,
           error,
-          errorType: void 0
+          errorType
         });
         if (emitStart) {
           await this.toolCallEmitter.emitStart({
@@ -5567,6 +5660,13 @@ ${this.pendingWorktreeNotice}
         batches.push({ kind: "execute", concurrent: isAgent, calls: [fc] });
       }
     }
+    const executableCalls = batches.flatMap(
+      (batch) => batch.kind === "execute" ? batch.calls : []
+    );
+    const planModeEntryBoundaryIndex = findPlanModeEntryBatchBoundaryIndex(
+      executableCalls.map((call) => call.name)
+    );
+    const planModeEntryBoundary = planModeEntryBoundaryIndex === void 0 ? void 0 : executableCalls[planModeEntryBoundaryIndex];
     const appendSkippedAfter = /* @__PURE__ */ __name(async (parts2, fc, message = PERMISSION_CANCEL_SKIP_MESSAGE) => {
       const startIndex = dedupedFunctionCalls.indexOf(fc) + 1;
       for (const remainingCall of dedupedFunctionCalls.slice(startIndex)) {
@@ -5704,6 +5804,19 @@ ${this.pendingWorktreeNotice}
           parts.push(...batch.response.responseParts);
           continue;
         }
+        if (planModeEntryBoundary && !batch.calls.includes(planModeEntryBoundary)) {
+          for (const fc of batch.calls) {
+            parts.push(
+              await recordSkippedToolCall(
+                fc,
+                PLAN_MODE_ENTRY_SIBLING_SKIP_MESSAGE,
+                true,
+                "execution_denied" /* EXECUTION_DENIED */
+              )
+            );
+          }
+          continue;
+        }
         if (batch.concurrent && batch.calls.length > 1) {
           const batchAbortController = new AbortController();
           let batchStopAfterPermissionCancel = false;
@@ -5937,19 +6050,21 @@ ${this.pendingWorktreeNotice}
         { recordInvalidToolParams: true }
       );
     }
-    const toolSpan = startToolSpan(toolName, {
+    const policyToolName = tool.name;
+    const originalPolicyRequestArgs = policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR ? structuredClone(args) : args;
+    const toolSpan = startToolSpan(policyToolName, {
       "tool.call_id": callId,
       // Dual-emit the legacy call_id/tool_name aliases like CoreToolScheduler
       // (coreToolScheduler.ts) so pre-Phase-2 dashboards keyed off call_id keep
       // matching daemon/ACP tool spans during the migration window.
       call_id: callId,
-      tool_name: toolName
+      tool_name: policyToolName
     });
     let spanSuccess = false;
     try {
       return await runInToolSpanContext(toolSpan, async () => {
         const pm = this.config.getPermissionManager?.();
-        if (pm && !await pm.isToolEnabled(toolName)) {
+        if (pm && !await pm.isToolEnabled(policyToolName)) {
           return earlyErrorResponse(
             new Error(`Tool "${toolName}" is disabled.`),
             toolName
@@ -5978,7 +6093,7 @@ ${this.pendingWorktreeNotice}
           }
         }
         const toolUseId = generateToolUseId();
-        const approvalMode = this.config.getApprovalMode();
+        let approvalMode = this.config.getApprovalMode();
         let toolBuildSucceeded = false;
         try {
           const invocation = tool.build(args);
@@ -6003,12 +6118,12 @@ ${this.pendingWorktreeNotice}
               activeToolAbortSignal
             );
           }
-          const isAskUserQuestionTool = toolName === ToolNames.ASK_USER_QUESTION;
-          const toolParams = invocation.params;
+          const isAskUserQuestionTool = policyToolName === ToolNames.ASK_USER_QUESTION;
+          let toolParams = invocation.params;
           const flowResult = await evaluatePermissionFlow(
             this.config,
             invocation,
-            toolName,
+            policyToolName,
             toolParams
           );
           const {
@@ -6018,31 +6133,74 @@ ${this.pendingWorktreeNotice}
             denyMessage,
             requiresUserInteraction
           } = flowResult;
+          approvalMode = this.config.getApprovalMode();
           const isPlanMode = approvalMode === "plan" /* PLAN */;
+          const isPlanShellCall = isPlanMode && (policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR);
           if (finalPermission === "deny") {
             return earlyErrorResponse(
               new Error(denyMessage ?? `Tool "${toolName}" is denied.`),
               toolName
             );
           }
-          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(toolName, this.config));
+          let planShellAmbientWorkingDirectory;
+          if (isPlanShellCall) {
+            const directory = toolParams["directory"];
+            planShellAmbientWorkingDirectory = typeof directory === "string" && directory.length > 0 ? void 0 : this.config.getTargetDir();
+            invocation.params = {
+              ...structuredClone(invocation.params),
+              directory: typeof directory === "string" && directory.length > 0 ? directory : planShellAmbientWorkingDirectory
+            };
+            toolParams = invocation.params;
+          }
+          const planShellDecision = isPlanShellCall ? await evaluatePlanModeShellPolicy({
+            config: this.config,
+            toolName: policyToolName,
+            requestArgs: originalPolicyRequestArgs,
+            invocationParams: toolParams,
+            permissionContext: pmCtx,
+            ambientWorkingDirectory: planShellAmbientWorkingDirectory,
+            signal: activeToolAbortSignal
+          }) : { classification: "not-applicable" };
+          if (planShellDecision.classification !== "not-applicable") {
+            const initialPlanShellError = await validatePlanModeShellContext({
+              config: this.config,
+              decision: planShellDecision,
+              requestArgs: args,
+              invocationParams: invocation.params,
+              signal: activeToolAbortSignal
+            });
+            if (initialPlanShellError) {
+              return earlyErrorResponse(
+                new Error(initialPlanShellError),
+                toolName
+              );
+            }
+          }
+          if (planShellDecision.classification === "write") {
+            return earlyErrorResponse(
+              new Error(planShellDecision.writeBlockMessage),
+              toolName
+            );
+          }
+          const planShellRequiresConfirmation = planShellDecision.classification === "unknown";
+          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(policyToolName, this.config));
           const confirmationPermission = getEffectivePermissionForConfirmation(
             finalPermission,
             forceAutoReviewForAllow
           );
           if (finalPermission === "allow" && forceAutoReviewForAllow) {
             debugLogger6.info(
-              `Auto mode: L4 allow overridden by protected-write guard for ${toolName}`
+              `Auto mode: L4 allow overridden by protected-write guard for ${policyToolName}`
             );
           }
-          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow;
+          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow && !planShellRequiresConfirmation;
           if (autoModeAllowed && approvalMode === "auto" /* AUTO */) {
             this.config.setAutoModeDenialState(
               recordAllow(this.config.getAutoModeDenialState())
             );
           }
           let wasAutoModeDenialFallback = false;
-          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, toolName)) {
+          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, policyToolName)) {
             const denialState = this.config.getAutoModeDenialState();
             const fallback = shouldFallback(denialState);
             const messages = this.config.getGeminiClient?.()?.getHistoryTail(MAX_TRANSCRIPT_MESSAGES, false) ?? [];
@@ -6064,7 +6222,7 @@ ${this.pendingWorktreeNotice}
               this.config,
               decision,
               outcome,
-              toolName,
+              policyToolName,
               toolParams,
               callId,
               abortSignal
@@ -6075,7 +6233,7 @@ ${this.pendingWorktreeNotice}
                 break;
               case "blocked":
                 debugLogger6.warn(
-                  `Auto mode blocked (${outcome.reason}): tool=${toolName}, ` + formatDenialStateLog(denialState)
+                  `Auto mode blocked (${outcome.reason}): tool=${policyToolName}, ` + formatDenialStateLog(denialState)
                 );
                 return earlyErrorResponse(
                   new Error(outcome.errorMessage),
@@ -6116,14 +6274,45 @@ ${this.pendingWorktreeNotice}
             }
           }, "recordAutoModeFallbackResolution");
           if (!autoModeAllowed && needsConfirmation(
-            confirmationPermission,
+            planShellRequiresConfirmation ? "ask" : confirmationPermission,
             approvalMode,
-            toolName,
+            policyToolName,
             requiresUserInteraction
           )) {
-            confirmationDetails = await invocation.getConfirmationDetails(abortSignal);
+            confirmationDetails = await invocation.getConfirmationDetails(
+              activeToolAbortSignal
+            );
+            if (planShellDecision.classification !== "not-applicable") {
+              const preDisplayPlanShellError = await validatePlanModeShellContext({
+                config: this.config,
+                decision: planShellDecision,
+                requestArgs: args,
+                invocationParams: invocation.params,
+                signal: activeToolAbortSignal
+              });
+              if (preDisplayPlanShellError) {
+                return earlyErrorResponse(
+                  new Error(preDisplayPlanShellError),
+                  toolName
+                );
+              }
+            }
+            try {
+              confirmationDetails = decoratePlanModeShellConfirmation(
+                planShellDecision,
+                confirmationDetails
+              );
+            } catch {
+              if (planShellDecision.classification === "unknown") {
+                return earlyErrorResponse(
+                  new Error(planShellDecision.noApprovalMessage),
+                  toolName
+                );
+              }
+              throw new Error("Unable to prepare shell confirmation.");
+            }
             injectPermissionRulesIfMissing(confirmationDetails, pmCtx);
-            if (isPlanModeBlocked(
+            if (planShellDecision.classification === "not-applicable" && isPlanModeBlocked(
               isPlanMode,
               isExitPlanModeTool,
               isAskUserQuestionTool,
@@ -6143,23 +6332,50 @@ ${this.pendingWorktreeNotice}
             if (hooksEnabled && messageBus) {
               const hookResult = await firePermissionRequestHook(
                 messageBus,
-                toolName,
+                policyToolName,
                 args,
-                String(approvalMode)
+                String(approvalMode),
+                void 0,
+                activeToolAbortSignal
               );
               if (hookResult.hasDecision && (!hookResult.shouldAllow || !requiresUserInteraction)) {
                 hookHandled = true;
                 if (hookResult.shouldAllow) {
-                  if (hookResult.updatedInput) {
-                    args = hookResult.updatedInput;
-                    invocation.params = hookResult.updatedInput;
+                  if (planShellDecision.classification !== "not-applicable") {
+                    const approval = await validatePlanModeShellApproval({
+                      config: this.config,
+                      decision: planShellDecision,
+                      requestArgs: args,
+                      invocationParams: invocation.params,
+                      signal: activeToolAbortSignal,
+                      outcome: "proceed_once" /* ProceedOnce */,
+                      payload: hookResult.updatedInput ? { updatedInput: hookResult.updatedInput } : void 0
+                    });
+                    await confirmationDetails.onConfirm(
+                      approval.outcome,
+                      approval.payload
+                    );
+                    if (approval.outcome === "cancel" /* Cancel */) {
+                      return earlyErrorResponse(
+                        new Error(
+                          approval.payload?.cancelMessage ?? planShellDecision.noApprovalMessage
+                        ),
+                        toolName
+                      );
+                    }
+                    recordAutoModeFallbackResolution(approval.outcome);
+                  } else {
+                    if (hookResult.updatedInput) {
+                      args = hookResult.updatedInput;
+                      invocation.params = hookResult.updatedInput;
+                    }
+                    await confirmationDetails.onConfirm(
+                      "proceed_once" /* ProceedOnce */
+                    );
+                    recordAutoModeFallbackResolution(
+                      "proceed_once" /* ProceedOnce */
+                    );
                   }
-                  await confirmationDetails.onConfirm(
-                    "proceed_once" /* ProceedOnce */
-                  );
-                  recordAutoModeFallbackResolution(
-                    "proceed_once" /* ProceedOnce */
-                  );
                 } else {
                   return earlyErrorResponse(
                     new Error(
@@ -6172,11 +6388,26 @@ ${this.pendingWorktreeNotice}
             }
             if (!requiresUserInteraction && approvalMode === "auto-edit" /* AUTO_EDIT */ && (confirmationDetails.type === "edit" || confirmationDetails.type === "info")) {
             } else if (!hookHandled) {
+              if (planShellDecision.classification !== "not-applicable") {
+                const finalPreDisplayPlanShellError = await validatePlanModeShellContext({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal
+                });
+                if (finalPreDisplayPlanShellError) {
+                  return earlyErrorResponse(
+                    new Error(finalPreDisplayPlanShellError),
+                    toolName
+                  );
+                }
+              }
               didRequestPermission = true;
               const content = buildPermissionRequestContent(confirmationDetails);
               const mappedKind = this.toolCallEmitter.mapToolKind(
                 tool.kind,
-                toolName
+                policyToolName
               );
               if (hooksEnabled && messageBus) {
                 this.fireNotificationHookWithTerminalSequence(
@@ -6186,9 +6417,16 @@ ${this.pendingWorktreeNotice}
                   "Permission needed"
                 );
               }
+              const permissionOptions = toPermissionOptions(
+                confirmationDetails,
+                pmForcedAsk
+              );
+              const offeredPermissionOptions = permissionOptions.map(
+                (option) => ({ ...option })
+              );
               const params = {
                 sessionId: this.sessionId,
-                options: toPermissionOptions(confirmationDetails, pmForcedAsk),
+                options: permissionOptions,
                 toolCall: {
                   toolCallId: callId,
                   status: "pending",
@@ -6207,10 +6445,12 @@ ${this.pendingWorktreeNotice}
                   }
                 }
               };
-              const stopAfterPermissionCancel = /* @__PURE__ */ __name(() => {
+              const stopAfterPermissionCancel = /* @__PURE__ */ __name((message) => {
                 onStopAfterPermissionCancel?.();
                 return earlyErrorResponse(
-                  new Error(`Tool "${toolName}" was canceled by the user.`),
+                  new Error(
+                    message ?? `Tool "${toolName}" was canceled by the user.`
+                  ),
                   toolName,
                   { stopAfterPermissionCancel: true }
                 );
@@ -6218,10 +6458,15 @@ ${this.pendingWorktreeNotice}
               let output;
               let outcome;
               try {
-                output = await this.client.requestPermission(
-                  params
+                output = await requestPermissionWithAbort(
+                  this.client,
+                  params,
+                  activeToolAbortSignal
+                );
+                outcome = resolvePermissionOutcome(
+                  output,
+                  offeredPermissionOptions
                 );
-                outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
               } catch (error) {
                 debugLogger6.error(
                   `Permission request failed for tool ${toolName}:`,
@@ -6238,7 +6483,9 @@ ${this.pendingWorktreeNotice}
                   );
                 }
                 onStopAfterPermissionCancel?.();
-                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : `Permission request failed for "${toolName}": ${this.#formatError(
+                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : planShellDecision.classification === "unknown" ? `Plan mode could not complete approval for this shell command: ${this.#formatError(
+                  error
+                )}. The command was not run; Plan mode remains active.` : `Permission request failed for "${toolName}": ${this.#formatError(
                   error
                 )}`;
                 return earlyErrorResponse(
@@ -6247,11 +6494,28 @@ ${this.pendingWorktreeNotice}
                   { stopAfterPermissionCancel: true }
                 );
               }
+              let confirmationPayload = {
+                answers: output.answers
+              };
+              if (planShellDecision.classification !== "not-applicable") {
+                const approval = await validatePlanModeShellApproval({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal,
+                  outcome,
+                  payload: confirmationPayload
+                });
+                outcome = approval.outcome;
+                confirmationPayload = approval.payload;
+              }
               recordAutoModeFallbackResolution(outcome);
               try {
-                await confirmationDetails.onConfirm(outcome, {
-                  answers: output.answers
-                });
+                await confirmationDetails.onConfirm(
+                  outcome,
+                  confirmationPayload
+                );
               } catch (error) {
                 if (outcome !== "cancel" /* Cancel */) {
                   throw error;
@@ -6268,7 +6532,7 @@ ${this.pendingWorktreeNotice}
                   confirmationDetails,
                   this.config.getOnPersistPermissionRule?.(),
                   this.config.getPermissionManager?.(),
-                  { answers: output.answers }
+                  confirmationPayload
                 );
               }
               if (confirmationDetails.type === "edit" && outcome === "proceed_always" /* ProceedAlways */) {
@@ -6276,7 +6540,9 @@ ${this.pendingWorktreeNotice}
               }
               switch (outcome) {
                 case "cancel" /* Cancel */:
-                  return stopAfterPermissionCancel();
+                  return stopAfterPermissionCancel(
+                    confirmationPayload?.cancelMessage
+                  );
                 case "proceed_once" /* ProceedOnce */:
                 case "proceed_always" /* ProceedAlways */:
                 case "proceed_always_project" /* ProceedAlwaysProject */:
@@ -6308,7 +6574,7 @@ ${this.pendingWorktreeNotice}
           if (hooksEnabledForTool && messageBusForTool) {
             const preHookResult = await firePreToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolUseId,
               permissionMode,
@@ -6425,7 +6691,7 @@ ${this.pendingWorktreeNotice}
             };
             const postHookResult = await firePostToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolResponse,
               toolUseId,
@@ -6456,7 +6722,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForTool,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               toolResult.error?.message ?? "Tool execution was cancelled",
               isInterrupt,
@@ -6545,7 +6811,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForError,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               error.message,
               isInterrupt,
@@ -9409,7 +9675,7 @@ var QwenAgent = class {
     markAcpStartup("initializeHandlerStart");
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.19.12";
+    const version = "0.20.0-nightly.20260721.cda0e0348";
     const response = {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {
@@ -12845,6 +13111,21 @@ var QwenAgent = class {
           });
         }
         const canonicalPath = await fs2.realpath(targetPath);
+        const allowedRoots = params["allowedRoots"];
+        if (Array.isArray(allowedRoots) && allowedRoots.length > 0) {
+          const contained = allowedRoots.some((root) => {
+            if (typeof root !== "string") return false;
+            const rel = path4.relative(root, canonicalPath);
+            return !rel.startsWith("..") && !path4.isAbsolute(rel);
+          });
+          if (!contained) {
+            throw new RequestError(
+              -32004,
+              `Path outside allowed roots: ${canonicalPath}`,
+              { errorKind: "containment_violation", path: canonicalPath }
+            );
+          }
+        }
         const previousCwd = config.getTargetDir();
         if (canonicalPath === previousCwd) {
           return { previousCwd, newCwd: canonicalPath, warnings: [] };