@qwen-code/qwen-code 0.19.3 → 0.19.4

package/chunks/{acpAgent-7RZUOWOM.js → acpAgent-UMN6OYTR.js}

@@ -3,8 +3,13 @@
 import {
   classifyApiError,
   prefixMidTurnUserMessageParts
-} from "./chunk-QE6KJYLT.js";
-import "./chunk-UFLGERMB.js";
+} from "./chunk-VKGG724L.js";
+import {
+  EXTENSION_CONTEXT_BUDGET,
+  buildExtensionMentionContext,
+  matchExtensionByRef,
+  parseExtensionRef
+} from "./chunk-MNDTD5E5.js";
 import {
   HistoryReplayer,
   MessageEmitter,
@@ -12,74 +17,90 @@ import {
   ToolCallEmitter,
   getAvailableCommands,
   handleSlashCommand,
+  insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-RRFZXMYP.js";
+} from "./chunk-ZXCVPMIK.js";
 import {
   appEvents,
   buildDisabledSkillNamesProvider,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-EDMZZFDU.js";
+} from "./chunk-MVZXZWGT.js";
+import "./chunk-JZSY4WP3.js";
 import {
   collectContextData,
   formatContextUsageText
-} from "./chunk-FNJ7BDPH.js";
+} from "./chunk-SFN4TEHY.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-J7FA27RO.js";
-import "./chunk-5GOVVXEV.js";
+} from "./chunk-TTFNVEO5.js";
+import "./chunk-CG7SVARK.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-3TV3HUWZ.js";
+} from "./chunk-75X2VLSH.js";
 import {
   isTerminalGoalStatusKind
 } from "./chunk-KSPVDFE4.js";
 import "./chunk-MRO43B25.js";
-import "./chunk-SMXULRAN.js";
-import "./chunk-T4T2FNV4.js";
+import "./chunk-VXGPYF7U.js";
+import "./chunk-2X2JUE47.js";
 import "./chunk-KYMBIKIW.js";
-import "./chunk-I4H7PRWQ.js";
-import "./chunk-JZSY4WP3.js";
-import "./chunk-JVHEVCAU.js";
-import "./chunk-CNLEDYE3.js";
+import "./chunk-HTWHAN44.js";
+import "./chunk-AHNXYU4O.js";
+import "./chunk-ND25GXEU.js";
+import "./chunk-BJBWRCSK.js";
+import "./chunk-CS5XYDBO.js";
 import "./chunk-3GONHQOA.js";
-import "./chunk-PR32FRT6.js";
-import "./chunk-CKQA6AWF.js";
-import "./chunk-BW4KCQFD.js";
+import "./chunk-OAFUMTWW.js";
+import "./chunk-J3F7X3LW.js";
 import {
   createLoadedSettingsAdapter
-} from "./chunk-BXSHL2SF.js";
-import "./chunk-NDOC6M5S.js";
-import "./chunk-M2U5NM24.js";
-import "./chunk-JJXWTVSK.js";
-import "./chunk-R2BXK7SX.js";
-import "./chunk-RKIZXJMB.js";
-import "./chunk-MNF6S5PR.js";
+} from "./chunk-73H73ASU.js";
+import {
+  MAX_REMEMBER_CONTENT_BYTES,
+  extractRememberErrorCode,
+  isValidServerName
+} from "./chunk-RM3PGSGL.js";
+import "./chunk-L7QPM2YD.js";
+import "./chunk-54YZOP7P.js";
+import "./chunk-HRZB5CSC.js";
+import "./chunk-RNBYOUGV.js";
+import "./chunk-W2ZOAX7F.js";
 import "./chunk-KHDZHZMH.js";
+import "./chunk-W6X4FGWX.js";
+import {
+  CLIENT_MCP_OVER_WS_CONFIG_FLAG,
+  MID_TURN_QUEUE_DRAIN_METHOD
+} from "./chunk-EWALXUAD.js";
+import "./chunk-ALX6BUYW.js";
 import {
   formatAcpModelId,
   parseAcpBaseModelId,
   parseAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-UYT3MWEB.js";
+} from "./chunk-BQNJBEUA.js";
 import {
   PERMISSION_RULE_TYPES,
   PermissionRulesValidationError,
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-ODLIHNOY.js";
-import "./chunk-4LUZAKMK.js";
-import "./chunk-BC3C4F3Q.js";
-import "./chunk-GT2FGICD.js";
-import {
-  MID_TURN_QUEUE_DRAIN_METHOD
-} from "./chunk-QBZ22PQX.js";
-import "./chunk-ALX6BUYW.js";
+} from "./chunk-QAFQLTXG.js";
+import "./chunk-Q7VHIRDD.js";
+import "./chunk-NIOPRZNN.js";
 import {
   NOT_CURRENTLY_GENERATING_CANCEL_MESSAGE
-} from "./chunk-JE5FVRPC.js";
+} from "./chunk-T22H4V4R.js";
+import "./chunk-SEZC2725.js";
+import {
+  ACP_PREFLIGHT_KINDS,
+  IDLE_HOOK_EVENTS,
+  SERVE_CONTROL_EXT_METHODS,
+  SERVE_STATUS_EXT_METHODS,
+  STATUS_SCHEMA_VERSION,
+  mapDomainErrorToErrorKind
+} from "./chunk-GICCHL2Q.js";
 import {
   OUTPUT_LANGUAGE_AUTO,
   getOutputLanguageFilePath,
@@ -90,34 +111,29 @@ import {
   resolveOutputLanguage,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-FKAVULLM.js";
+} from "./chunk-MKHC4BYZ.js";
 import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-R5OP2ATH.js";
+} from "./chunk-UQYOMM6J.js";
 import "./chunk-TLRYABYP.js";
-import "./chunk-5DWXLGOM.js";
+import "./chunk-EDAGQADF.js";
+import "./chunk-MX2YXRER.js";
+import "./chunk-HI55Z6PR.js";
 import {
   AgentSideConnection,
   PROTOCOL_VERSION,
   RequestError,
   ndJsonStream
 } from "./chunk-UFC57OYT.js";
-import {
-  ACP_PREFLIGHT_KINDS,
-  IDLE_HOOK_EVENTS,
-  SERVE_CONTROL_EXT_METHODS,
-  SERVE_STATUS_EXT_METHODS,
-  STATUS_SCHEMA_VERSION,
-  mapDomainErrorToErrorKind
-} from "./chunk-L7OKCI7T.js";
-import "./chunk-CF6BB3LT.js";
+import "./chunk-OJCECIJA.js";
+import "./chunk-PPFWEV7G.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-F3ZYSEY6.js";
+} from "./chunk-ZJP5T7IA.js";
 import "./chunk-Y6Z2O3WR.js";
 import "./chunk-QYUE6W3T.js";
 import {
@@ -128,6 +144,7 @@ import {
   ExtensionManager,
   FORK_SUBAGENT_TYPE,
   InvalidMcpConfigError,
+  LoopTickResolver,
   MAX_TRANSCRIPT_MESSAGES,
   MCPOAuthProvider,
   MCPOAuthTokenStorage,
@@ -136,9 +153,11 @@ import {
   McpBudgetWouldExceedError,
   McpServerSpawnFailedError,
   McpTransportPool,
+  ORPHAN_TOOL_USE_REPAIR_REASON,
   POOLED_TRANSPORTS_DEFAULT,
   SESSION_TITLE_MAX_LENGTH,
   SessionService,
+  TURN_INTERRUPTION_HISTORY_TAIL_COUNT,
   WorkspaceMcpBudget,
   abortGoalForStopHookCap,
   acquireSleepInhibitor,
@@ -147,13 +166,18 @@ import {
   buildBackgroundEntryLabel,
   buildBtwCacheSafeParams,
   buildBtwPrompt,
+  buildContextUsage,
   buildInstallPlan,
+  buildSyntheticToolResponseParts,
   clampInlineMediaPart,
   clearGoalTerminalObserver,
   computeUniqueBranchTitle,
   convertToFunctionResponse,
   createDuplicateProviderToolCallResponse,
   dedupeToolCallsById,
+  detectAutonomousSentinel,
+  detectLoopSentinel,
+  detectTurnInterruption,
   evaluateAutoMode,
   evaluatePermissionFlow,
   findExistingProviderModels,
@@ -179,13 +203,16 @@ import {
   getProviderToolCallId,
   getScopedEnvContents,
   getStartupContextLength,
+  hasImageParts,
   injectPermissionRulesIfMissing,
   isApproveOutcome,
   isDenialFallbackReason,
   isPlanModeBlocked,
   isSystemReminderContent,
   markDuplicateProviderToolCallResponseSent,
+  matchesAnyServerPattern,
   needsConfirmation,
+  normalizeParts,
   parsePositiveIntegerEnv,
   persistPermissionOutcome,
   readManyFiles,
@@ -195,44 +222,53 @@ import {
   resolveBaseUrl,
   restoreWorktreeContext,
   runForkedAgent,
+  runManagedRememberByAgent,
+  runVisionBridge,
   sessionIdContext,
   setGoalTerminalObserver,
+  shouldClassifyAllShellForAutoMode,
   shouldFallback,
   shouldFirePermissionDeniedForAutoMode,
   shouldForceAutoModeReviewForAllow,
   shouldRunAutoModeForCall,
+  shouldRunVisionBridge,
+  splitImageParts,
   subagentGenerator,
   unregisterGoalHook,
   updateSetting
-} from "./chunk-YAINVQ3Q.js";
+} from "./chunk-BFG6OZN7.js";
+import "./chunk-5P5XGNYH.js";
 import {
   external_exports
 } from "./chunk-K5PGHDBN.js";
 import "./chunk-SKAZWEV5.js";
-import "./chunk-XJYUPHRC.js";
-import "./chunk-QLDPRILK.js";
-import "./chunk-BVSVIN45.js";
+import "./chunk-QOMAHFYI.js";
+import "./chunk-G7OQ3RFJ.js";
+import "./chunk-LKWAVAB5.js";
 import {
   runSideQuery
-} from "./chunk-SBBN4BWR.js";
-import "./chunk-S7AKE7HL.js";
+} from "./chunk-MEQWZGK5.js";
+import "./chunk-UANCYOOQ.js";
 import "./chunk-2MPVVENX.js";
 import "./chunk-ZTQ26VBE.js";
-import "./chunk-O2VBQ3Y2.js";
+import "./chunk-SJBIFVD2.js";
 import "./chunk-MLZQVCF3.js";
+import "./chunk-S5EQPDTM.js";
 import "./chunk-LQ7TMOCE.js";
-import "./chunk-LD2XBG6Z.js";
-import "./chunk-HYCC3XM3.js";
+import "./chunk-E5A7LHNN.js";
+import "./chunk-GO6LNQXT.js";
+import "./chunk-B236XPGF.js";
 import {
   HookEventName,
   createHookOutput
-} from "./chunk-NL4C3H6C.js";
-import "./chunk-JOLIREYR.js";
-import "./chunk-DDMOU62Q.js";
+} from "./chunk-YXK4GPYO.js";
+import "./chunk-TOAUDIS7.js";
+import "./chunk-NPQWQYU6.js";
 import {
   AuthType,
   ConversationFinishedEvent,
   DiscoveredMCPTool,
+  LoopDetectedEvent,
   PromptSuggestionEvent,
   UserPromptEvent,
   endToolExecutionSpan,
@@ -241,6 +277,7 @@ import {
   getAllGeminiMdFilenames,
   getMCPServerStatus,
   logConversationFinishedEvent,
+  logLoopDetected,
   logPromptSuggestion,
   logToolCall,
   logUserPrompt,
@@ -249,45 +286,51 @@ import {
   startToolSpan,
   uiTelemetryService,
   withInteractionSpan
-} from "./chunk-QNKBEJO2.js";
-import "./chunk-3PJXIDKI.js";
+} from "./chunk-HJDF3ZVU.js";
+import "./chunk-E6US47KI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";
 import "./chunk-OMX7CUOE.js";
 import {
-  getAutoMemoryRoot
-} from "./chunk-RD6YJJJ6.js";
-import "./chunk-SKQZZVAV.js";
-import "./chunk-BUUQ5HPX.js";
+  getAutoMemoryRoot,
+  getUserAutoMemoryRoot
+} from "./chunk-MOUXUCXQ.js";
+import "./chunk-BZHLWC6T.js";
+import "./chunk-UQFP2FEF.js";
 import {
   ToolConfirmationOutcome,
   ToolNames
-} from "./chunk-BX5YO7UW.js";
+} from "./chunk-4VZH35PN.js";
 import {
   clearCachedCredentialFile,
   qwenOAuth2Events
-} from "./chunk-UO5GVXQE.js";
-import "./chunk-KMGMKW5Q.js";
+} from "./chunk-TENOUWY2.js";
+import "./chunk-GLPV75ES.js";
 import "./chunk-22IFUCVR.js";
-import "./chunk-3227DZO4.js";
+import "./chunk-T42ACHFI.js";
 import {
+  DEFAULT_TOKEN_LIMIT,
   tokenLimit
-} from "./chunk-U3KSMM7G.js";
-import "./chunk-BKXBARJZ.js";
-import "./chunk-EJYJYJZ2.js";
+} from "./chunk-YTFBURQD.js";
+import "./chunk-YPCPZSZB.js";
+import "./chunk-IRJWHZWU.js";
+import "./chunk-SYCJMSIJ.js";
 import "./chunk-55ZMG67I.js";
 import "./chunk-H6BD2ELD.js";
 import "./chunk-5IFG2VC4.js";
 import "./chunk-64WXLC72.js";
+import "./chunk-D5KISTLW.js";
 import {
   Storage,
   createDebugLogger,
-  getErrorStatus
-} from "./chunk-UX4SGCGN.js";
-import "./chunk-SMYQZVZ3.js";
+  getErrorMessage,
+  getErrorStatus,
+  isSubpath
+} from "./chunk-AVQDCKNF.js";
+import "./chunk-XCUFHOAD.js";
 import {
   runExitCleanup
-} from "./chunk-I2LYBGNI.js";
+} from "./chunk-FYKX6XOT.js";
 import "./chunk-ZERZSAZL.js";
 import "./chunk-QN5NZ3UQ.js";
 import "./chunk-BR4QREVK.js";
@@ -331,17 +374,50 @@ __name(pickAuthMethodsForAuthRequired, "pickAuthMethodsForAuthRequired");
 
 // packages/cli/src/acp-integration/service/filesystem.ts
 init_esbuild_shims();
+import { realpath } from "node:fs/promises";
+import path from "node:path";
 var RESOURCE_NOT_FOUND_CODE = -32002;
+var PATH_OUTSIDE_WORKSPACE_KIND = "path_outside_workspace";
+var SYMLINK_ESCAPE_KIND = "symlink_escape";
+var LOCAL_READ_FALLBACK_ERROR_KINDS = /* @__PURE__ */ new Set([
+  PATH_OUTSIDE_WORKSPACE_KIND,
+  SYMLINK_ESCAPE_KIND
+]);
+var debugLogger = createDebugLogger("ACP_FILE_SYSTEM");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
 function getErrorCode(error) {
   if (error instanceof RequestError) {
     return error.code;
   }
-  if (typeof error === "object" && error !== null && "code" in error) {
-    return error.code;
+  if (isRecord(error)) {
+    return error["code"];
   }
   return void 0;
 }
 __name(getErrorCode, "getErrorCode");
+function getErrorData(error) {
+  const data = isRecord(error) ? error["data"] : void 0;
+  return isRecord(data) ? data : void 0;
+}
+__name(getErrorData, "getErrorData");
+function getErrorKind(error) {
+  const data = getErrorData(error);
+  if (data && typeof data["errorKind"] === "string") {
+    return data["errorKind"];
+  }
+  return void 0;
+}
+__name(getErrorKind, "getErrorKind");
+function normalizeError(error) {
+  if (error instanceof Error) return error;
+  return new Error(getErrorMessage(error), {
+    cause: error
+  });
+}
+__name(normalizeError, "normalizeError");
 function createEnoentError(filePath) {
   const err = new Error(`File not found: ${filePath}`);
   err.code = "ENOENT";
@@ -350,12 +426,32 @@ function createEnoentError(filePath) {
   return err;
 }
 __name(createEnoentError, "createEnoentError");
+function isLocalReadFallbackErrorKind(errorKind) {
+  return typeof errorKind === "string" && LOCAL_READ_FALLBACK_ERROR_KINDS.has(errorKind);
+}
+__name(isLocalReadFallbackErrorKind, "isLocalReadFallbackErrorKind");
+async function resolveRealPath(value) {
+  if (!value.trim()) return void 0;
+  try {
+    return await realpath(path.resolve(value));
+  } catch (error) {
+    if (getErrorCode(error) !== "ENOENT") {
+      debugLogger.warn("realpath failed during ACP local read fallback check", {
+        path: value,
+        error: getErrorMessage(error)
+      });
+    }
+    return void 0;
+  }
+}
+__name(resolveRealPath, "resolveRealPath");
 var AcpFileSystemService = class {
-  constructor(connection, sessionId, capabilities, fallback) {
+  constructor(connection, sessionId, capabilities, fallback, options = {}) {
     this.connection = connection;
     this.sessionId = sessionId;
     this.capabilities = capabilities;
     this.fallback = fallback;
+    this.options = options;
   }
   static {
     __name(this, "AcpFileSystemService");
@@ -375,7 +471,45 @@ var AcpFileSystemService = class {
       if (errorCode === RESOURCE_NOT_FOUND_CODE) {
         throw createEnoentError(params.path);
       }
-      throw error;
+      const errorKind = getErrorKind(error);
+      const shouldTryLocalReadFallback = isLocalReadFallbackErrorKind(errorKind);
+      const fallbackPath = shouldTryLocalReadFallback ? await this.getLocalReadFallbackPath(params.path) : void 0;
+      if (shouldTryLocalReadFallback && !fallbackPath) {
+        debugLogger.debug("Local read fallback skipped - no safe local path", {
+          path: params.path,
+          errorKind
+        });
+      }
+      if (shouldTryLocalReadFallback && fallbackPath) {
+        debugLogger.debug("Falling back to local read after ACP error", {
+          path: params.path,
+          resolvedPath: fallbackPath,
+          errorKind,
+          error: getErrorMessage(error)
+        });
+        try {
+          return await this.fallback.readTextFile({
+            ...params,
+            path: fallbackPath
+          });
+        } catch (fallbackError) {
+          if (getErrorCode(fallbackError) === "ENOENT") {
+            throw fallbackError;
+          }
+          debugLogger.warn("Local read fallback failed after ACP error", {
+            path: params.path,
+            resolvedPath: fallbackPath,
+            errorKind,
+            originalError: getErrorMessage(error),
+            fallbackError: getErrorMessage(fallbackError)
+          });
+          throw new Error(
+            `Local fallback read failed for ${params.path}: ${getErrorMessage(fallbackError)} (original ACP error: ${getErrorMessage(error)})`,
+            { cause: { fallbackError, acpError: error } }
+          );
+        }
+      }
+      throw normalizeError(error);
     }
     return response;
   }
@@ -384,27 +518,53 @@ var AcpFileSystemService = class {
       return this.fallback.writeTextFile(params);
     }
     const finalContent = params._meta?.["bom"] && params.content.charCodeAt(0) !== 65279 ? "\uFEFF" + params.content : params.content;
-    await this.connection.writeTextFile({
-      ...params,
-      content: finalContent,
-      sessionId: this.sessionId
-    });
+    try {
+      await this.connection.writeTextFile({
+        ...params,
+        content: finalContent,
+        sessionId: this.sessionId
+      });
+    } catch (error) {
+      if (getErrorCode(error) === RESOURCE_NOT_FOUND_CODE) {
+        throw createEnoentError(params.path);
+      }
+      throw normalizeError(error);
+    }
     return { _meta: params._meta };
   }
   findFiles(fileName, searchPaths) {
     return this.fallback.findFiles(fileName, searchPaths);
   }
+  async getResolvedLocalReadRoots() {
+    const roots = await Promise.all(
+      (this.options.localReadRoots ?? []).map(resolveRealPath)
+    );
+    return roots.filter((root) => Boolean(root));
+  }
+  async getLocalReadFallbackPath(filePath) {
+    const normalizedFilePath = path.resolve(filePath);
+    const realFilePath = await resolveRealPath(normalizedFilePath);
+    if (!realFilePath) return void 0;
+    for (const realRoot of await this.getResolvedLocalReadRoots()) {
+      if (isSubpath(realRoot, realFilePath)) {
+        return realFilePath;
+      }
+    }
+    return void 0;
+  }
 };
 
 // packages/cli/src/acp-integration/acpAgent.ts
 import { Readable, Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import * as fs from "node:fs/promises";
-import * as path from "node:path";
+import * as path3 from "node:path";
 import { createGunzip } from "node:zlib";
 
 // packages/cli/src/acp-integration/session/Session.ts
 init_esbuild_shims();
+import * as os from "node:os";
+import * as path2 from "node:path";
 
 // packages/cli/src/acp-integration/session/SubAgentTracker.ts
 init_esbuild_shims();
@@ -586,7 +746,7 @@ function toPermissionOptions(confirmation, forceHideAlwaysAllow = false) {
 __name(toPermissionOptions, "toPermissionOptions");
 
 // packages/cli/src/acp-integration/session/SubAgentTracker.ts
-var debugLogger = createDebugLogger("ACP_SUBAGENT_TRACKER");
+var debugLogger2 = createDebugLogger("ACP_SUBAGENT_TRACKER");
 var SubAgentTracker = class {
   constructor(ctx, client, parentToolCallId, subagentType, onPermissionCancel) {
     this.ctx = ctx;
@@ -646,7 +806,7 @@ var SubAgentTracker = class {
         try {
           invocation = tool.build(event.args);
         } catch (e) {
-          debugLogger.warn(`Failed to build subagent tool ${event.name}:`, e);
+          debugLogger2.warn(`Failed to build subagent tool ${event.name}:`, e);
         }
       }
       this.toolStates.set(event.callId, {
@@ -725,7 +885,7 @@ var SubAgentTracker = class {
           this.onPermissionCancel?.();
         }
       } catch (error) {
-        debugLogger.error(
+        debugLogger2.error(
           `Permission request failed for subagent tool ${event.name}:`,
           error
         );
@@ -733,7 +893,7 @@ var SubAgentTracker = class {
         try {
           await event.respond("cancel" /* Cancel */);
         } catch (respondError) {
-          debugLogger.error(
+          debugLogger2.error(
             `Failed to cancel subagent tool ${event.name} after permission request failure:`,
             respondError
           );
@@ -832,7 +992,7 @@ var TurnBuffer = class {
 init_esbuild_shims();
 import { readFileSync, existsSync } from "node:fs";
 import { resolve } from "node:path";
-var debugLogger2 = createDebugLogger("MESSAGE_REWRITER");
+var debugLogger3 = createDebugLogger("MESSAGE_REWRITER");
 var DEFAULT_REWRITE_PROMPT = `You are an assistant that rewrites raw coding-agent output into concise, user-friendly progress updates.
 
 The agent is a software engineering assistant that reads files, writes code, runs commands, and uses tools. Its raw output mixes internal reasoning with user-facing information. Your job: extract what the user cares about, drop what they don't.
@@ -861,11 +1021,11 @@ var LlmRewriter = class {
       const filePath = resolve(rewriteConfig.promptFile);
       if (existsSync(filePath)) {
         this.prompt = readFileSync(filePath, "utf-8").trim();
-        debugLogger2.info(
+        debugLogger3.info(
           `Loaded rewrite prompt from file: ${filePath} (${this.prompt.length} chars)`
         );
       } else {
-        debugLogger2.warn(
+        debugLogger3.warn(
           `Rewrite prompt file not found: ${filePath}, using default`
         );
         this.prompt = DEFAULT_REWRITE_PROMPT;
@@ -902,7 +1062,7 @@ var LlmRewriter = class {
     const inputText = inputParts.join("\n\n");
     if (!inputText.trim()) return null;
     if (inputText.length < 10) return null;
-    debugLogger2.info(
+    debugLogger3.info(
       `[REWRITE INPUT] system_prompt_len=${this.prompt.length} input_len=${inputText.length} context_turns=${this.outputHistory.length}
 --- INPUT TEXT ---
 ${inputText}
@@ -931,10 +1091,10 @@ ${inputText}
       });
       const rewritten = result.text;
       if (!rewritten || rewritten.length < 5) {
-        debugLogger2.info(`[REWRITE OUTPUT] empty or too short, skipping`);
+        debugLogger3.info(`[REWRITE OUTPUT] empty or too short, skipping`);
         return null;
       }
-      debugLogger2.info(
+      debugLogger3.info(
         `[REWRITE OUTPUT] len=${rewritten.length}
 --- OUTPUT ---
 ${rewritten}
@@ -943,7 +1103,7 @@ ${rewritten}
       this.outputHistory.push(rewritten);
       return rewritten;
     } catch (error) {
-      debugLogger2.warn(
+      debugLogger3.warn(
         `LLM rewrite failed, skipping: ${error instanceof Error ? error.message : String(error)}`
       );
       return null;
@@ -952,7 +1112,7 @@ ${rewritten}
 };
 
 // packages/cli/src/acp-integration/session/rewrite/MessageRewriteMiddleware.ts
-var debugLogger3 = createDebugLogger("MESSAGE_REWRITE");
+var debugLogger4 = createDebugLogger("MESSAGE_REWRITE");
 var DEFAULT_REWRITE_TIMEOUT_MS = 3e4;
 var REWRITE_META_EXCLUDED_KEYS = /* @__PURE__ */ new Set([]);
 var MessageRewriteMiddleware = class {
@@ -1032,10 +1192,10 @@ var MessageRewriteMiddleware = class {
         try {
           const rewritten = await this.rewriter.rewrite(content, rewriteSignal);
           if (!rewritten) {
-            debugLogger3.info(`Turn ${turnIdx}: no rewrite output`);
+            debugLogger4.info(`Turn ${turnIdx}: no rewrite output`);
             return;
           }
-          debugLogger3.info(
+          debugLogger4.info(
             `Turn ${turnIdx}: rewritten ${rewritten.length} chars`
           );
           await this.sendUpdate({
@@ -1048,7 +1208,7 @@ var MessageRewriteMiddleware = class {
             }
           });
         } catch (error) {
-          debugLogger3.warn(
+          debugLogger4.warn(
             `Turn ${turnIdx}: rewrite failed: ${error instanceof Error ? error.message : String(error)}`
           );
         }
@@ -1093,9 +1253,10 @@ function loadRewriteConfig(settings) {
 __name(loadRewriteConfig, "loadRewriteConfig");
 
 // packages/cli/src/acp-integration/session/Session.ts
-var debugLogger4 = createDebugLogger("SESSION");
+var debugLogger5 = createDebugLogger("SESSION");
 var USER_CANCEL_ABORT_REASON = "qwen:user-cancel";
 var DAEMON_RETRY_META_KEY = "qwen.daemon.retry";
+var DAEMON_CONTINUE_META_KEY = "qwen.daemon.continueLastTurn";
 function maskApiKeyForDisplay(apiKey) {
   const trimmed = apiKey?.trim() ?? "";
   if (trimmed.length === 0) return "(not set)";
@@ -1103,7 +1264,58 @@ function maskApiKeyForDisplay(apiKey) {
   return `${trimmed.slice(0, 3)}...${trimmed.slice(-4)}`;
 }
 __name(maskApiKeyForDisplay, "maskApiKeyForDisplay");
+var DAEMON_TURN_TOOL_CALL_CAP = 100;
+var DAEMON_INVALID_TOOL_PARAMS_THRESHOLD = 3;
 var PERMISSION_CANCEL_SKIP_MESSAGE = "Skipped because a permission request was cancelled before the user answered; user input is required before continuing.";
+var LOOP_DETECTED_SKIP_MESSAGE = "Skipped because loop detection stopped the current turn before this tool call could run.";
+var LOOP_DETECTED_CONTEXT_MESSAGE = "System: this turn was terminated because the model exceeded tool-call safety limits. Try a different approach on the next turn.";
+function createDaemonToolLoopState() {
+  return {
+    totalToolCalls: 0,
+    invalidToolParamErrors: /* @__PURE__ */ new Map(),
+    loopDetected: false
+  };
+}
+__name(createDaemonToolLoopState, "createDaemonToolLoopState");
+function recordDaemonLoopDetected(config, promptId, loopType, message, loopState) {
+  if (!loopState.loopDetected) {
+    loopState.loopDetected = true;
+    debugLogger5.warn(message);
+    logLoopDetected(config, new LoopDetectedEvent(loopType, promptId));
+  }
+  return true;
+}
+__name(recordDaemonLoopDetected, "recordDaemonLoopDetected");
+function recordDaemonToolCalls(config, promptId, loopState, count) {
+  if (!loopState || loopState.loopDetected)
+    return loopState?.loopDetected ?? false;
+  loopState.totalToolCalls += count;
+  if (loopState.totalToolCalls <= DAEMON_TURN_TOOL_CALL_CAP) return false;
+  return recordDaemonLoopDetected(
+    config,
+    promptId,
+    "turn_tool_call_cap" /* TURN_TOOL_CALL_CAP */,
+    `Stopping ACP turn after ${loopState.totalToolCalls} tool calls in one turn.`,
+    loopState
+  );
+}
+__name(recordDaemonToolCalls, "recordDaemonToolCalls");
+function recordDaemonInvalidToolParams(config, promptId, loopState, toolName, error) {
+  if (!loopState || loopState.loopDetected)
+    return loopState?.loopDetected ?? false;
+  const key = toolName;
+  const count = (loopState.invalidToolParamErrors.get(key) ?? 0) + 1;
+  loopState.invalidToolParamErrors.set(key, count);
+  if (count < DAEMON_INVALID_TOOL_PARAMS_THRESHOLD) return false;
+  return recordDaemonLoopDetected(
+    config,
+    promptId,
+    "invalid_tool_params_stagnation" /* INVALID_TOOL_PARAMS_STAGNATION */,
+    `Stopping ACP turn after repeated tool parameter errors from ${toolName}: ${error.message}`,
+    loopState
+  );
+}
+__name(recordDaemonInvalidToolParams, "recordDaemonInvalidToolParams");
 var MID_TURN_QUEUE_DRAIN_TIMEOUT_MS = 2e3;
 var MID_TURN_QUEUE_RECOVERY_TIMEOUT_MS = 3e4;
 var MID_TURN_QUEUE_RESOLVE_TIMEOUT_MS = 1e4;
@@ -1111,12 +1323,20 @@ var MAX_MID_TURN_DRAIN_ITEMS = 10;
 var MID_TURN_ATTACHMENT_PROCESSING_FAILURE_TEXT = "[Attachment could not be processed]";
 var MAX_MID_TURN_RESOURCE_TEXT_LENGTH = 1e5;
 var MID_TURN_QUEUE_DRAIN_MAX_TIMEOUT_STRIKES = 3;
-function isRecord(value) {
+var TRANSIENT_FS_CODES = [
+  "EACCES",
+  "EIO",
+  "EBUSY",
+  "EPERM",
+  "EISDIR",
+  "ENOTDIR"
+];
+function isRecord2(value) {
   return value !== null && typeof value === "object";
 }
-__name(isRecord, "isRecord");
+__name(isRecord2, "isRecord");
 function isContentBlock(value) {
-  if (!isRecord(value) || typeof value["type"] !== "string") return false;
+  if (!isRecord2(value) || typeof value["type"] !== "string") return false;
   switch (value["type"]) {
     case "text":
       return typeof value["text"] === "string";
@@ -1129,7 +1349,7 @@ function isContentBlock(value) {
     case "resource":
       return isEmbeddedResourceResource(value["resource"]);
     default:
-      debugLogger4.warn(`Unknown ContentBlock type: ${value["type"]}`);
+      debugLogger5.warn(`Unknown ContentBlock type: ${value["type"]}`);
       return false;
   }
 }
@@ -1155,7 +1375,7 @@ async function withTimeoutSignal(parentSignal, timeoutMs, fn) {
 }
 __name(withTimeoutSignal, "withTimeoutSignal");
 function isEmbeddedResourceResource(value) {
-  if (!isRecord(value) || typeof value["uri"] !== "string") return false;
+  if (!isRecord2(value) || typeof value["uri"] !== "string") return false;
   if (typeof value["text"] === "string") {
     return value["text"].length <= MAX_MID_TURN_RESOURCE_TEXT_LENGTH;
   }
@@ -1168,7 +1388,7 @@ function hasInlineMediaContentBlock(content) {
 __name(hasInlineMediaContentBlock, "hasInlineMediaContentBlock");
 function capMidTurnDrainItems(items, fieldName) {
   if (items.length <= MAX_MID_TURN_DRAIN_ITEMS) return items;
-  debugLogger4.warn(
+  debugLogger5.warn(
     `Mid-turn drain response had ${items.length} ${fieldName}; processing first ${MAX_MID_TURN_DRAIN_ITEMS}`
   );
   return items.slice(0, MAX_MID_TURN_DRAIN_ITEMS);
@@ -1183,7 +1403,7 @@ function getMidTurnItemDisplayTextForLog(displayText) {
 __name(getMidTurnItemDisplayTextForLog, "getMidTurnItemDisplayTextForLog");
 function getValidMidTurnContentBlocks(content, displayText) {
   if (!Array.isArray(content)) {
-    debugLogger4.warn(
+    debugLogger5.warn(
       `Dropped invalid mid-turn item: ${getMidTurnItemDisplayTextForLog(
         displayText
       )}`
@@ -1193,7 +1413,7 @@ function getValidMidTurnContentBlocks(content, displayText) {
   const validBlocks = content.filter(isContentBlock);
   const invalidBlockCount = content.length - validBlocks.length;
   if (invalidBlockCount > 0) {
-    debugLogger4.warn(
+    debugLogger5.warn(
       `Dropped ${invalidBlockCount} invalid mid-turn content block(s): ${getMidTurnItemDisplayTextForLog(
         displayText
       )}`
@@ -1213,11 +1433,11 @@ function getStructuredMidTurnDisplayText(content, displayText) {
 }
 __name(getStructuredMidTurnDisplayText, "getStructuredMidTurnDisplayText");
 function parseMidTurnDrainResponse(response) {
-  if (!isRecord(response)) return [];
+  if (!isRecord2(response)) return [];
   if (Array.isArray(response["items"])) {
     return capMidTurnDrainItems(response["items"], "item(s)").flatMap(
       (item) => {
-        if (!isRecord(item)) {
+        if (!isRecord2(item)) {
           return [];
         }
         const content = getValidMidTurnContentBlocks(
@@ -1239,7 +1459,7 @@ function parseMidTurnDrainResponse(response) {
     );
   }
   if (!Array.isArray(response["messages"])) {
-    debugLogger4.warn(
+    debugLogger5.warn(
       `Mid-turn drain response had no recognized 'items' or 'messages' field; keys: ${Object.keys(
         response
       ).join(", ")}`
@@ -1262,6 +1482,17 @@ var MidTurnDrainTimeoutError = class extends Error {
   }
 };
 var MAX_NOTIFICATION_QUEUE = 20;
+function resolveHomeLoopResolverRoots({
+  homeQwenDir = Storage.getGlobalQwenDir(),
+  homeDir = os.homedir(),
+  qwenHome = process.env["QWEN_HOME"]
+} = {}) {
+  return {
+    homeConfineRoot: (qwenHome ? homeQwenDir : homeDir) || path2.dirname(homeQwenDir),
+    homeQwenDir
+  };
+}
+__name(resolveHomeLoopResolverRoots, "resolveHomeLoopResolverRoots");
 function computeInitialTurnFromHistory(records, sessionId) {
   let maxPromptTurn = 0;
   let userMessageCount = 0;
@@ -1296,7 +1527,7 @@ async function fireSessionPermissionDeniedForAutoMode(config, decision, outcome,
         callId
       );
     } catch (hookError) {
-      debugLogger4.warn(
+      debugLogger5.warn(
         `PermissionDenied hook failed for tool ${callId}: ${hookError instanceof Error ? hookError.message : String(hookError)}`
       );
     }
@@ -1337,6 +1568,18 @@ function isUserPromptRecord(record) {
   ) ?? false;
 }
 __name(isUserPromptRecord, "isUserPromptRecord");
+var AT_TOKEN_RE = /@([^\s,;!?()[\]{}]+)/g;
+function collectExtensionMentionRefs(text, mentions) {
+  for (const match of text.matchAll(AT_TOKEN_RE)) {
+    const pathName = match[1];
+    if (!pathName) continue;
+    const ref = parseExtensionRef(pathName);
+    if (ref) {
+      mentions.set(ref.name.toLowerCase(), ref.name);
+    }
+  }
+}
+__name(collectExtensionMentionRefs, "collectExtensionMentionRefs");
 async function buildAvailableCommandsSnapshot(config, abortSignal = AbortSignal.timeout(1e4), settings) {
   const slashCommands = await getAvailableCommands(
     config,
@@ -1356,7 +1599,12 @@ async function buildAvailableCommandsSnapshot(config, abortSignal = AbortSignal.
         sourceLabel: cmd.sourceLabel,
         supportedModes: getEffectiveSupportedModes(cmd),
         subcommands: getCommandSubcommandNames(cmd),
-        modelInvocable: cmd.modelInvocable === true
+        modelInvocable: cmd.modelInvocable === true,
+        // Carry aliases so a channel consumer (which only sees the wire snapshot,
+        // not the command registry) can recognize an aliased command and avoid
+        // tagging it. _meta is ACP's extension point; omitted when there are none
+        // so command entries without aliases stay byte-identical on the wire.
+        ...cmd.altNames && cmd.altNames.length > 0 ? { altNames: cmd.altNames } : {}
       }
     };
   });
@@ -1379,7 +1627,7 @@ async function buildAvailableCommandsSnapshot(config, abortSignal = AbortSignal.
       }
     }
   } catch (error) {
-    debugLogger4.error("Error loading available skills:", error);
+    debugLogger5.error("Error loading available skills:", error);
   }
   for (const command of slashCommands) {
     if (command.kind !== "skill" /* SKILL */ || !command.skillDetail) {
@@ -1451,6 +1699,13 @@ var Session = class {
   cronQueue = [];
   cronProcessing = false;
   cronAbortController = null;
+  // Resolves the `<<loop.md>>` / `<<loop.md-dynamic>>` sentinels at fire time.
+  // Lazily created on the first loop tick; its content cache is reset on
+  // compaction (see #sendMessageStreamWithAutoCompression) and it is rebuilt if
+  // the working dir changes (e.g. /cd) so it always reads the current project's
+  // loop.md.
+  loopTickResolver = null;
+  loopTickResolverRoot = null;
   cronCompletion = null;
   cronDisabledByTokenLimit = false;
   lastPromptTokenCount = 0;
@@ -1514,7 +1769,7 @@ var Session = class {
    */
   startCronScheduler() {
     this.#startCronSchedulerIfNeeded().catch((error) => {
-      debugLogger4.warn(
+      debugLogger5.warn(
         `Cron scheduler startup failed [session ${this.sessionId}]: ${error}`
       );
     });
@@ -1561,7 +1816,7 @@ var Session = class {
   installRewriter() {
     const rewriteConfig = loadRewriteConfig(this.settings);
     if (rewriteConfig?.enabled) {
-      debugLogger4.info("Message rewrite middleware enabled");
+      debugLogger5.info("Message rewrite middleware enabled");
       this.messageRewriter = new MessageRewriteMiddleware(
         this.config,
         rewriteConfig,
@@ -1572,7 +1827,7 @@ var Session = class {
   #installGoalTerminalObserver() {
     setGoalTerminalObserver(this.sessionId, (event) => {
       void this.messageEmitter.emitGoalTerminal(event).catch((error) => {
-        debugLogger4.warn(
+        debugLogger5.warn(
           `Failed to emit goal terminal update: ${this.#formatError(error)}`
         );
       });
@@ -1580,7 +1835,7 @@ var Session = class {
   }
   emitGoalStatus(status) {
     void this.messageEmitter.emitGoalStatus(status).catch((error) => {
-      debugLogger4.warn(
+      debugLogger5.warn(
         `Failed to emit goal status update: ${this.#formatError(error)}`
       );
     });
@@ -1783,6 +2038,36 @@ var Session = class {
       this.pendingPromptCompletion = null;
     }
   }
+  /**
+   * Classify whether an unfinished previous turn can be resumed — an
+   * interrupted prompt (the model never answered) or a turn left with dangling
+   * tool calls — without injecting a synthetic "continue" user message.
+   * Classifies from persisted history. Idempotent no-op (accepted:false) when
+   * the last turn ended cleanly or a prompt is already in flight.
+   *
+   * This is the accept/reject pre-check only — it does NOT fire the turn. When
+   * accepted, the daemon bridge drives the continuation through the normal
+   * prompt-admission path (`sendPrompt` with the trusted continue meta) so it is
+   * tracked like any other prompt; `prompt()` then re-detects/strips
+   * authoritatively. Powers `qwen/control/session/continue`.
+   */
+  async continueLastTurn() {
+    const geminiClient = this.config.getGeminiClient();
+    if (!geminiClient || !geminiClient.isInitialized()) {
+      return { accepted: false, interruption: "none" };
+    }
+    const chat = this.#getCurrentChat();
+    const detection = detectTurnInterruption(
+      chat.getHistoryTailShallow?.(TURN_INTERRUPTION_HISTORY_TAIL_COUNT) ?? chat.getHistoryTail(TURN_INTERRUPTION_HISTORY_TAIL_COUNT)
+    );
+    if (detection.kind === "none") {
+      return { accepted: false, interruption: "none" };
+    }
+    if (this.pendingPrompt && !this.pendingPrompt.signal.aborted) {
+      return { accepted: false, interruption: detection.kind };
+    }
+    return { accepted: true, interruption: detection.kind };
+  }
   /**
    * Generate a server-side follow-up suggestion for the just-completed
    * turn and push it to attached clients via the daemon's
@@ -1819,7 +2104,7 @@ var Session = class {
         const fullHistory = chat.getHistory(true);
         const lastEntry = fullHistory[fullHistory.length - 1];
         if (!lastEntry || lastEntry.role !== "model") {
-          debugLogger4.debug(
+          debugLogger5.debug(
             "Skipping followup suggestion: last history entry is not model"
           );
           return;
@@ -1855,9 +2140,9 @@ var Session = class {
         }
       } catch (error) {
         if (ac.signal.aborted) {
-          debugLogger4.debug("Follow-up suggestion generation aborted");
+          debugLogger5.debug("Follow-up suggestion generation aborted");
         } else {
-          debugLogger4.warn("Follow-up suggestion generation failed", error);
+          debugLogger5.warn("Follow-up suggestion generation failed", error);
         }
       } finally {
         if (this.followupAbort === ac) {
@@ -1900,7 +2185,40 @@ var Session = class {
               )
             );
             const isRetry = params.retry === true || params._meta?.[DAEMON_RETRY_META_KEY] === true;
-            if (isRetry) {
+            const isContinue = params._meta?.[DAEMON_CONTINUE_META_KEY] === true;
+            let continuationParts = null;
+            let strippedOrphanEntries = null;
+            let orphanPushCountSnapshot = 0;
+            if (isContinue) {
+              const detection = detectTurnInterruption(
+                this.#getCurrentChat().getHistory()
+              );
+              if (detection.kind === "none") {
+                debugLogger5.warn(
+                  `[Session] continue ${promptId}: no interrupted turn on re-detection, nothing to continue`
+                );
+                logConversationFinishedEvent(
+                  this.config,
+                  new ConversationFinishedEvent(
+                    this.config.getApprovalMode(),
+                    0
+                  )
+                );
+                return { stopReason: "end_turn" };
+              }
+              if (detection.kind === "interrupted_prompt") {
+                strippedOrphanEntries = this.#getCurrentChat().stripOrphanedUserEntriesFromHistory() ?? null;
+                orphanPushCountSnapshot = this.#getCurrentChat().getUserContentPushCount?.() ?? 0;
+                continuationParts = detection.parts;
+              } else {
+                continuationParts = buildSyntheticToolResponseParts(
+                  detection.danglingCalls,
+                  ORPHAN_TOOL_USE_REPAIR_REASON
+                );
+              }
+            }
+            if (isContinue) {
+            } else if (isRetry) {
               this.#getCurrentChat().stripOrphanedUserEntriesFromHistory();
             } else {
               this.config.getChatRecordingService()?.recordUserMessage(promptText);
@@ -1910,7 +2228,9 @@ var Session = class {
             );
             const inputText = firstTextBlock?.text || "";
             let parts;
-            if (isSlashCommand(inputText)) {
+            if (isContinue) {
+              parts = continuationParts;
+            } else if (isSlashCommand(inputText)) {
               const slashCommandResult = await handleSlashCommand(
                 inputText,
                 pendingSend,
@@ -1932,7 +2252,7 @@ var Session = class {
             }
             const hooksEnabled = !this.config.getDisableAllHooks?.();
             const messageBus = this.config.getMessageBus?.();
-            if (hooksEnabled && messageBus && this.config.hasHooksForEvent?.("UserPromptSubmit")) {
+            if (!isContinue && hooksEnabled && messageBus && this.config.hasHooksForEvent?.("UserPromptSubmit")) {
               const response = await messageBus.request(
                 {
                   type: "hook-execution-request" /* HOOK_EXECUTION_REQUEST */,
@@ -1948,7 +2268,7 @@ var Session = class {
               if (hookOutput?.isBlockingDecision() || hookOutput?.shouldStopExecution()) {
                 const blockReason = hookOutput?.getEffectiveReason() || "No reason provided";
                 await this.messageEmitter.emitAgentMessage(
-                  `\u{1F6AB} **UserPromptSubmit blocked**: ${blockReason}`
+                  `\u2717 **UserPromptSubmit blocked**: ${blockReason}`
                 );
                 return { stopReason: "end_turn" };
               }
@@ -1966,30 +2286,34 @@ var Session = class {
                   this.config.getChatRecordingService()?.recordFileHistorySnapshot(latestSnapshot);
                 }
               } catch (e) {
-                debugLogger4.error(`FileHistory: recordSnapshot failed: ${e}`);
+                debugLogger5.error(`FileHistory: recordSnapshot failed: ${e}`);
               }
             } catch (e) {
-              debugLogger4.error(`FileHistory: makeSnapshot failed: ${e}`);
+              debugLogger5.error(`FileHistory: makeSnapshot failed: ${e}`);
             }
             const systemReminders = await this.#buildInitialSystemReminders();
             if (systemReminders.length > 0) {
-              parts = [...systemReminders, ...parts];
+              const alreadyHasReminder = isContinue && parts.some(
+                (part) => isSystemReminderContent({ role: "user", parts: [part] })
+              );
+              if (!alreadyHasReminder) {
+                parts = insertAfterFunctionResponses(parts, systemReminders);
+              }
             }
             if (this.pendingWorktreeNotice) {
-              parts = [
-                {
-                  text: `<system-reminder>
+              const noticePart = {
+                text: `<system-reminder>
 ${this.pendingWorktreeNotice}
 </system-reminder>
 
 `
-                },
-                ...parts
-              ];
+              };
+              parts = insertAfterFunctionResponses(parts, [noticePart]);
               this.pendingWorktreeNotice = null;
             }
             let nextMessage = { role: "user", parts };
             let turnCount = 0;
+            const toolLoopState = createDaemonToolLoopState();
             try {
               while (nextMessage !== null) {
                 turnCount++;
@@ -2009,7 +2333,7 @@ ${this.pendingWorktreeNotice}
                   if (!sendResult.responseStream) {
                     this.#preserveUnsentMessageHistory(
                       nextMessage,
-                      sendResult.stopReason === "cancelled"
+                      isContinue || sendResult.stopReason === "cancelled"
                     );
                     return { stopReason: sendResult.stopReason };
                   }
@@ -2040,6 +2364,12 @@ ${this.pendingWorktreeNotice}
                     }
                   }
                 } catch (error) {
+                  if (strippedOrphanEntries && (this.#getCurrentChat().getUserContentPushCount?.() ?? 0) <= orphanPushCountSnapshot) {
+                    for (const entry of strippedOrphanEntries) {
+                      this.#getCurrentChat().addHistory(entry);
+                    }
+                    strippedOrphanEntries = null;
+                  }
                   if (pendingSend.signal.aborted && pendingSend.signal.reason === USER_CANCEL_ABORT_REASON && this.#isAbortError(error)) {
                     return { stopReason: "cancelled" };
                   }
@@ -2053,7 +2383,7 @@ ${this.pendingWorktreeNotice}
                   const hooksEnabledForStopFailure = !this.config.getDisableAllHooks?.();
                   if (hooksEnabledForStopFailure && hookSystem && this.config.hasHooksForEvent?.("StopFailure")) {
                     hookSystem.fireStopFailureEvent(errorType, errorMessage).catch((err) => {
-                      debugLogger4.warn(`StopFailure hook failed: ${err}`);
+                      debugLogger5.warn(`StopFailure hook failed: ${err}`);
                     });
                   }
                   if (errorStatus === 429) {
@@ -2080,10 +2410,11 @@ ${this.pendingWorktreeNotice}
                   const toolRun = await this.runToolCalls(
                     pendingSend.signal,
                     promptId,
-                    functionCalls
+                    functionCalls,
+                    toolLoopState
                   );
                   if (toolRun.stopAfterPermissionCancel) {
-                    await this.#preserveCancelledPermissionToolRun(
+                    await this.#preserveStoppedToolRun(
                       toolRun,
                       pendingSend.signal
                     );
@@ -2093,6 +2424,13 @@ ${this.pendingWorktreeNotice}
                     toolRun,
                     pendingSend.signal
                   );
+                  if (toolRun.loopDetected) {
+                    await this.#preserveStoppedToolRun(
+                      toolRun,
+                      pendingSend.signal
+                    );
+                    return { stopReason: "end_turn" };
+                  }
                 }
               }
               if (this.messageRewriter) {
@@ -2140,13 +2478,18 @@ ${this.pendingWorktreeNotice}
         return { stopReason: "end_turn" };
       }
       const responseText = this.#getCurrentChat().getLastModelMessageText?.() || "[no response text]";
+      const contextUsage = buildContextUsage(
+        this.config.getContentGeneratorConfig()?.contextWindowSize ?? DEFAULT_TOKEN_LIMIT,
+        this.lastPromptTokenCount
+      );
       const response = await messageBus.request(
         {
           type: "hook-execution-request" /* HOOK_EXECUTION_REQUEST */,
           eventName: "Stop",
           input: {
             stop_hook_active: true,
-            last_assistant_message: responseText
+            last_assistant_message: responseText,
+            ...contextUsage
           },
           signal: pendingSend.signal
         },
@@ -2175,7 +2518,7 @@ ${this.pendingWorktreeNotice}
             warning
           );
           await this.messageEmitter.emitAgentMessage(warning);
-          debugLogger4.warn(warning);
+          debugLogger5.warn(warning);
           return { stopReason: "end_turn" };
         }
         if (stopHookIterationCount > 1) {
@@ -2190,6 +2533,7 @@ ${this.pendingWorktreeNotice}
           role: "user",
           parts: continueParts
         };
+        const toolLoopState = createDaemonToolLoopState();
         while (nextMessage !== null) {
           if (pendingSend.signal.aborted) {
             return { stopReason: "cancelled" };
@@ -2246,7 +2590,7 @@ ${this.pendingWorktreeNotice}
             const hooksEnabledForStopFailure = !this.config.getDisableAllHooks?.();
             if (hooksEnabledForStopFailure && hookSystem && this.config.hasHooksForEvent?.("StopFailure")) {
               hookSystem.fireStopFailureEvent(errorType, errorMessage).catch((err) => {
-                debugLogger4.warn(`StopFailure hook failed: ${err}`);
+                debugLogger5.warn(`StopFailure hook failed: ${err}`);
               });
             }
             if (errorStatus === 429) {
@@ -2270,19 +2614,21 @@ ${this.pendingWorktreeNotice}
             const toolRun = await this.runToolCalls(
               pendingSend.signal,
               promptId,
-              functionCalls
+              functionCalls,
+              toolLoopState
             );
             if (toolRun.stopAfterPermissionCancel) {
-              await this.#preserveCancelledPermissionToolRun(
-                toolRun,
-                pendingSend.signal
-              );
+              await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
               return { stopReason: "end_turn" };
             }
             nextMessage = await this.#buildNextMessageAfterToolRun(
               toolRun,
               pendingSend.signal
             );
+            if (toolRun.loopDetected) {
+              await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
+              return { stopReason: "end_turn" };
+            }
           }
         }
         continue;
@@ -2323,21 +2669,22 @@ ${this.pendingWorktreeNotice}
         compressionInfo = compressed;
         this.#recordCompressionTokenCount(compressed);
         if (compressed.compressionStatus === 1 /* COMPRESSED */) {
+          this.loopTickResolver?.resetCache();
           const reasonClause = compressed.triggerReason === "image_overflow" ? `accumulated enough tool screenshots to trigger compaction for ${this.config.getModel()}` : `approached the input token limit for ${this.config.getModel()}`;
           compressionDiagnostic = `IMPORTANT: This conversation ${reasonClause}. A compressed context will be sent for future messages (compressed from: ${compressed.originalTokenCount ?? "unknown"} to ${compressed.newTokenCount ?? "unknown"} tokens).`;
         }
       } catch (compressionError) {
         if (abortSignal.aborted || this.#isAbortError(compressionError)) {
-          debugLogger4.debug(`Auto-compression aborted for prompt ${promptId}`);
+          debugLogger5.debug(`Auto-compression aborted for prompt ${promptId}`);
           return { responseStream: null, stopReason: "cancelled" };
         }
-        debugLogger4.warn(
+        debugLogger5.warn(
           `Auto-compression failed for prompt ${promptId}; proceeding without compression: ` + this.#formatError(compressionError)
         );
       }
     }
     if (abortSignal.aborted) {
-      debugLogger4.debug(`Auto-compression aborted for prompt ${promptId}`);
+      debugLogger5.debug(`Auto-compression aborted for prompt ${promptId}`);
       return { responseStream: null, stopReason: "cancelled" };
     }
     if (!compressionInfo) {
@@ -2347,7 +2694,7 @@ ${this.pendingWorktreeNotice}
     if (sessionTokenLimit > 0) {
       const lastPromptTokenCount = this.#getPostCompressionTokenCount(compressionInfo);
       if (lastPromptTokenCount > sessionTokenLimit) {
-        debugLogger4.warn(
+        debugLogger5.warn(
           `Session token limit exceeded for prompt ${promptId}: ${lastPromptTokenCount} > ${sessionTokenLimit}. Send dropped.`
         );
         await this.#emitAgentDiagnosticMessageSafely(
@@ -2364,7 +2711,7 @@ ${this.pendingWorktreeNotice}
       );
     }
     if (abortSignal.aborted) {
-      debugLogger4.debug(
+      debugLogger5.debug(
         `Send aborted after compression diagnostic for prompt ${promptId}`
       );
       return { responseStream: null, stopReason: "cancelled" };
@@ -2392,7 +2739,7 @@ ${this.pendingWorktreeNotice}
     ) ?? [];
     const droppedParts = (message.parts?.length ?? 0) - functionResponseParts.length;
     if (droppedParts > 0) {
-      debugLogger4.debug(
+      debugLogger5.debug(
         `Dropping ${droppedParts} non-functionResponse part(s) from unsent ACP message after send was skipped.`
       );
     }
@@ -2403,12 +2750,13 @@ ${this.pendingWorktreeNotice}
       });
     }
   }
-  async #preserveCancelledPermissionToolRun(toolRun, abortSignal) {
+  async #preserveStoppedToolRun(toolRun, abortSignal) {
     this.#preserveUnsentMessageHistory(
       {
         role: "user",
         parts: [
           ...toolRun.parts,
+          ...toolRun.loopDetected ? [{ text: LOOP_DETECTED_CONTEXT_MESSAGE }] : [],
           ...await this.#drainMidTurnUserMessages(abortSignal)
         ]
       },
@@ -2417,8 +2765,12 @@ ${this.pendingWorktreeNotice}
     await this.messageRewriter?.waitForPendingRewrites();
   }
   async #buildNextMessageAfterToolRun(toolRun, abortSignal) {
+    if (toolRun.loopDetected) {
+      debugLogger5.debug("Stopping ACP turn after daemon loop detection.");
+      return null;
+    }
     if (toolRun.repeatedDuplicateProviderToolCall) {
-      debugLogger4.debug(
+      debugLogger5.debug(
         "Stopping ACP turn after dropping repeated duplicate provider tool-call response."
       );
       return null;
@@ -2496,7 +2848,7 @@ ${this.pendingWorktreeNotice}
     try {
       await this.#emitAgentDiagnosticMessage(text);
     } catch (notifyError) {
-      debugLogger4.warn(`${failureContext}: ${this.#formatError(notifyError)}`);
+      debugLogger5.warn(`${failureContext}: ${this.#formatError(notifyError)}`);
     }
   }
   async #emitAgentDiagnosticMessage(text) {
@@ -2545,7 +2897,7 @@ ${this.pendingWorktreeNotice}
       if (isPermanentError) {
         this.midTurnDrainUnavailable = true;
       }
-      debugLogger4.warn(
+      debugLogger5.warn(
         `Mid-turn queue drain ${isPermanentError ? "permanently " : ""}unavailable [session ${this.sessionId}]: ${errorMessage}`
       );
       return this.#buildMidTurnParts(recovered, abortSignal);
@@ -2587,14 +2939,14 @@ ${this.pendingWorktreeNotice}
       clearTimeout(timer);
     }
     if (late === expired) {
-      debugLogger4.warn(
+      debugLogger5.warn(
         `[mid-turn] dropped a drain response that arrived after the ${MID_TURN_QUEUE_RECOVERY_TIMEOUT_MS}ms recovery deadline [session ${this.sessionId}]`
       );
       return;
     }
     const lateMessages = parseMidTurnDrainResponse(late);
     if (lateMessages.length > 0) {
-      debugLogger4.debug(
+      debugLogger5.debug(
         `[mid-turn] recovered ${lateMessages.length} message(s) from a timed-out drain [session ${this.sessionId}]`
       );
       this.midTurnRecoveredMessages.push(...lateMessages);
@@ -2620,7 +2972,7 @@ ${this.pendingWorktreeNotice}
       } catch (messageError) {
         if (abortSignal.aborted) return parts;
         const errorMessage = this.#formatError(messageError);
-        debugLogger4.warn(`Failed to resolve mid-turn message: ${errorMessage}`);
+        debugLogger5.warn(`Failed to resolve mid-turn message: ${errorMessage}`);
         rawParts = [{ text: displayText }];
         if (message.kind === "structured" && hasInlineMediaContentBlock(message.content)) {
           rawParts.push({ text: MID_TURN_ATTACHMENT_PROCESSING_FAILURE_TEXT });
@@ -2645,20 +2997,23 @@ ${this.pendingWorktreeNotice}
     try {
       await scheduler.enableDurable(this.sessionId);
     } catch (err) {
-      debugLogger4.warn(
+      debugLogger5.warn(
         `Durable cron init failed \u2014 persistent tasks will not fire in this session: ${err}`
       );
     }
     if (this.disposed) return;
     if (!scheduler.hasPendingWork) return;
-    scheduler.start((job) => {
-      if (this.cronDisabledByTokenLimit) return;
-      this.cronQueue.push({
-        prompt: job.prompt,
-        source: job.cronExpr === "@wakeup" ? "loop" : "cron"
-      });
-      void this.#drainCronQueue();
-    });
+    scheduler.start(
+      (job) => {
+        if (this.cronDisabledByTokenLimit) return;
+        if (job.missed && detectAutonomousSentinel(job.prompt)) return;
+        this.cronQueue.push({
+          prompt: job.prompt,
+          source: job.cronExpr === "@wakeup" ? "loop" : "cron"
+        });
+        void this.#drainCronQueue();
+      }
+    );
   }
   /**
    * Processes queued cron prompts one at a time. Uses `cronProcessing`
@@ -2692,6 +3047,27 @@ ${this.pendingWorktreeNotice}
       }
     }
   }
+  #getLoopTickResolver() {
+    const root = this.config.getWorkingDir();
+    if (!this.loopTickResolver || this.loopTickResolverRoot !== root) {
+      const { homeConfineRoot, homeQwenDir } = resolveHomeLoopResolverRoots();
+      this.loopTickResolver = new LoopTickResolver({
+        projectRoot: root,
+        homeDir: homeConfineRoot,
+        homeQwenDir,
+        // The project `.qwen/loop.md` is repo-controlled, so an untrusted folder
+        // must not read it and feed it to the model (mirrors getProjectHooks()'s
+        // trust gate). The home/global `~/.qwen/loop.md` is user-owned and stays
+        // allowed. Pass a getter, not a snapshot: isTrustedFolder() can flip
+        // mid-session on an IDE workspace-trust update, and the resolver outlives
+        // a single tick — re-read it on every resolve() so a trusted→untrusted
+        // flip stops reading the project file immediately.
+        allowProjectFile: /* @__PURE__ */ __name(() => this.config.isTrustedFolder(), "allowProjectFile")
+      });
+      this.loopTickResolverRoot = root;
+    }
+    return this.loopTickResolver;
+  }
   /**
    * Executes a single cron-fired prompt: echoes it as a user message with
    * `_meta.source='cron'`, streams the model response, and handles tool calls.
@@ -2722,16 +3098,65 @@ ${this.pendingWorktreeNotice}
           async () => {
             let turnCount = 0;
             try {
+              const loopMode = detectLoopSentinel(prompt);
+              const autonomousMode = loopMode ? null : detectAutonomousSentinel(prompt);
+              let loopTick = null;
+              if (loopMode) {
+                const resolver = this.#getLoopTickResolver();
+                const trustedAtResolve = this.config.isTrustedFolder();
+                try {
+                  loopTick = await resolver.resolve(loopMode, trustedAtResolve);
+                } catch (resolveErr) {
+                  const code = resolveErr.code ?? "unknown";
+                  debugLogger5.warn(
+                    `loop.md sentinel resolution failed (mode=${loopMode}, code=${code}) \u2014 check .qwen/loop.md permissions/IO`,
+                    resolveErr
+                  );
+                  if (loopMode === "dynamic" && TRANSIENT_FS_CODES.includes(code)) {
+                    loopTick = resolver.buildTransientErrorTick(
+                      loopMode,
+                      trustedAtResolve,
+                      code
+                    );
+                  } else {
+                    throw new Error(
+                      `loop.md resolution failed (${code}) for ${resolver.absentLocations(
+                        trustedAtResolve
+                      )}`
+                    );
+                  }
+                }
+              } else if (autonomousMode) {
+                loopTick = this.#getLoopTickResolver().resolveAutonomous(autonomousMode);
+              }
+              const modelText = loopTick ? loopTick.modelText : prompt;
+              if (loopTick) {
+                debugLogger5.debug(
+                  `loop tick: mode=${loopMode ?? autonomousMode} delivery=${loopTick.full ? "full" : loopTick.transientError ? "transient-error" : loopTick.autonomous ? "autonomous-tick" : loopTick.sourceLabel ? "reminder" : "absent"} source=${loopTick.sourceLabel ?? "none"} autonomous=${loopTick.autonomous ?? false} transient=${loopTick.transientError ?? false}`
+                );
+              }
+              const echoText = !loopTick ? prompt : (
+                // An autonomous tick (a bare-`/loop` sentinel, or a loop.md
+                // sentinel whose file is gone and converged on the preamble).
+                loopTick.autonomous ? "Autonomous loop tick" : loopTick.sourceLabel ? `Loop tick \u2014 tasks from ${loopTick.sourceLabel}` : (
+                  // The only remaining tick is a transient read failure
+                  // (buildTransientErrorTick): a loop.md exists but couldn't be
+                  // read this tick. A genuinely-absent loop.md converges on the
+                  // autonomous branch above, so there is no "not present" echo.
+                  "Loop tick \u2014 loop.md temporarily unavailable"
+                )
+              );
               await this.sendUpdate({
                 sessionUpdate: "user_message_chunk",
-                content: { type: "text", text: prompt },
+                content: { type: "text", text: echoText },
                 _meta: { source: item.source }
               });
               const cronReminders = await this.#buildInitialSystemReminders();
               let nextMessage = {
                 role: "user",
-                parts: [...cronReminders, { text: prompt }]
+                parts: [...cronReminders, { text: modelText }]
               };
+              const toolLoopState = createDaemonToolLoopState();
               while (nextMessage !== null) {
                 turnCount++;
                 if (ac.signal.aborted) return;
@@ -2754,6 +3179,9 @@ ${this.pendingWorktreeNotice}
                   return;
                 }
                 const responseStream = sendResult.responseStream;
+                if (loopTick && turnCount === 1) {
+                  this.loopTickResolver?.markDelivered();
+                }
                 nextMessage = null;
                 for await (const resp of responseStream) {
                   if (ac.signal.aborted) return;
@@ -2791,25 +3219,27 @@ ${this.pendingWorktreeNotice}
                   const toolRun = await this.runToolCalls(
                     ac.signal,
                     promptId,
-                    functionCalls
+                    functionCalls,
+                    toolLoopState
                   );
                   if (toolRun.stopAfterPermissionCancel) {
-                    await this.#preserveCancelledPermissionToolRun(
-                      toolRun,
-                      ac.signal
-                    );
+                    await this.#preserveStoppedToolRun(toolRun, ac.signal);
                     return;
                   }
                   nextMessage = await this.#buildNextMessageAfterToolRun(
                     toolRun,
                     ac.signal
                   );
+                  if (toolRun.loopDetected) {
+                    await this.#preserveStoppedToolRun(toolRun, ac.signal);
+                    return;
+                  }
                 }
               }
             } catch (error) {
               if (ac.signal.aborted) return;
               cronHadError = true;
-              debugLogger4.error("Error processing cron prompt:", error);
+              debugLogger5.error("Error processing cron prompt:", error);
               const msg = error instanceof Error ? error.message : String(error);
               await this.messageEmitter.emitAgentMessage(
                 `[${item.source} error] ${msg}`
@@ -2893,7 +3323,7 @@ ${this.pendingWorktreeNotice}
   #enqueueBackgroundNotification(item) {
     while (this.notificationQueue.length >= MAX_NOTIFICATION_QUEUE) {
       const evicted = this.notificationQueue.shift();
-      debugLogger4.warn(
+      debugLogger5.warn(
         `Notification queue overflow: evicting task=${evicted.taskId} kind=${evicted.kind}`
       );
     }
@@ -2950,6 +3380,7 @@ ${this.pendingWorktreeNotice}
             role: "user",
             parts: [...notificationReminders, ...notificationParts]
           };
+          const toolLoopState = createDaemonToolLoopState();
           while (nextMessage !== null) {
             if (ac.signal.aborted) {
               await this.#emitBackgroundNotificationEndTurn("cancelled");
@@ -3026,13 +3457,11 @@ ${this.pendingWorktreeNotice}
               const toolRun = await this.runToolCalls(
                 ac.signal,
                 promptId,
-                functionCalls
+                functionCalls,
+                toolLoopState
               );
               if (toolRun.stopAfterPermissionCancel) {
-                await this.#preserveCancelledPermissionToolRun(
-                  toolRun,
-                  ac.signal
-                );
+                await this.#preserveStoppedToolRun(toolRun, ac.signal);
                 await this.#emitBackgroundNotificationEndTurn("end_turn");
                 return;
               }
@@ -3040,6 +3469,11 @@ ${this.pendingWorktreeNotice}
                 toolRun,
                 ac.signal
               );
+              if (toolRun.loopDetected) {
+                await this.#preserveStoppedToolRun(toolRun, ac.signal);
+                await this.#emitBackgroundNotificationEndTurn("end_turn");
+                return;
+              }
             }
           }
           if (this.messageRewriter) {
@@ -3051,14 +3485,14 @@ ${this.pendingWorktreeNotice}
             await this.#emitBackgroundNotificationEndTurn("cancelled");
             return;
           }
-          debugLogger4.error("Error processing background notification:", error);
+          debugLogger5.error("Error processing background notification:", error);
           const msg = error instanceof Error ? error.message : String(error);
           try {
             await this.messageEmitter.emitAgentMessage(
               `[notification error] ${msg}`
             );
           } catch (emitError) {
-            debugLogger4.error(
+            debugLogger5.error(
               "Failed to emit background notification error:",
               emitError
             );
@@ -3118,7 +3552,7 @@ ${this.pendingWorktreeNotice}
         source: "background_notification"
       });
     } catch (error) {
-      debugLogger4.debug(
+      debugLogger5.debug(
         `Background notification end-turn extNotification dropped: ${this.#formatError(error)}`
       );
     }
@@ -3142,7 +3576,7 @@ ${this.pendingWorktreeNotice}
       };
       await this.sendUpdate(update);
     } catch (error) {
-      debugLogger4.error("Error sending available commands update:", error);
+      debugLogger5.error("Error sending available commands update:", error);
     }
   }
   /**
@@ -3177,7 +3611,7 @@ ${this.pendingWorktreeNotice}
       sessionId: this.sessionId,
       currentModeId: params.modeId
     }).catch((error) => {
-      debugLogger4.debug("mode-update extNotification failed", error);
+      debugLogger5.debug("mode-update extNotification failed", error);
     });
   }
   /**
@@ -3211,7 +3645,7 @@ ${this.pendingWorktreeNotice}
       sessionId: this.sessionId,
       currentModelId: effectiveModelId
     }).catch((error) => {
-      debugLogger4.debug("model-update extNotification failed", error);
+      debugLogger5.debug("model-update extNotification failed", error);
     });
     if (options.persistDefault ?? true) {
       const persistScope = getPersistScopeForModelSelection(this.settings);
@@ -3264,7 +3698,7 @@ ${this.pendingWorktreeNotice}
       currentModeId: newModeId,
       legacyFrameSent: true
     }).catch((error) => {
-      debugLogger4.debug("mode-update extNotification failed", error);
+      debugLogger5.debug("mode-update extNotification failed", error);
     });
   }
   /**
@@ -3277,8 +3711,58 @@ ${this.pendingWorktreeNotice}
    * sequential batch to preserve the implicit ordering the model may rely
    * on. Response-part ordering matches the original `functionCalls` order.
    */
-  async runToolCalls(abortSignal, promptId, functionCalls) {
+  async runToolCalls(abortSignal, promptId, functionCalls, toolLoopState) {
     const dedupedFunctionCalls = dedupeToolCallsById(functionCalls);
+    let skippedToolCallCounter = 0;
+    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc, message = PERMISSION_CANCEL_SKIP_MESSAGE, emitStart = true) => {
+      const toolName = fc.name ?? "unknown_tool";
+      const callId = fc.id ?? `${toolName}-skip-${++skippedToolCallCounter}`;
+      const part = {
+        functionResponse: {
+          id: callId,
+          name: toolName,
+          response: { error: message }
+        }
+      };
+      const error = new Error(message);
+      try {
+        this.config.getChatRecordingService()?.recordToolResult([part], {
+          callId,
+          status: "error",
+          resultDisplay: void 0,
+          error,
+          errorType: void 0
+        });
+        if (emitStart) {
+          await this.toolCallEmitter.emitStart({
+            callId,
+            toolName,
+            args: fc.args ?? {},
+            status: "pending"
+          });
+        }
+        await this.toolCallEmitter.emitError(callId, toolName, error);
+      } catch (recordError) {
+        debugLogger5.error("Failed to record skipped tool call:", recordError);
+      }
+      return part;
+    }, "recordSkippedToolCall");
+    if (recordDaemonToolCalls(
+      this.config,
+      promptId,
+      toolLoopState,
+      dedupedFunctionCalls.length
+    )) {
+      return {
+        parts: await Promise.all(
+          dedupedFunctionCalls.map(
+            (fc) => recordSkippedToolCall(fc, LOOP_DETECTED_SKIP_MESSAGE, false)
+          )
+        ),
+        stopAfterPermissionCancel: false,
+        loopDetected: true
+      };
+    }
     const batches = [];
     const handledProviderToolCallIds = new Set(
       this.#getCurrentChat().getHistoryFunctionResponseIds()
@@ -3291,7 +3775,7 @@ ${this.pendingWorktreeNotice}
     );
     if (repeatedDuplicateCall) {
       const providerCallId = getProviderToolCallId(repeatedDuplicateCall) ?? repeatedDuplicateCall.id;
-      debugLogger4.debug(
+      debugLogger5.debug(
         `[Session.runToolCalls] Dropping batch after repeated duplicate provider tool-call id: ${providerCallId} (tool: ${repeatedDuplicateCall.name ?? "unknown_tool"})`
       );
       return {
@@ -3307,7 +3791,7 @@ ${this.pendingWorktreeNotice}
         this.duplicateProviderToolCallResponseIds
       );
       const response = createDuplicateProviderToolCallResponse(request);
-      debugLogger4.debug(
+      debugLogger5.debug(
         `[Session.runToolCalls] Suppressing duplicate provider tool-call id: ${providerCallId} (tool: ${request.name})`
       );
       batches.push({ kind: "duplicate", request, response });
@@ -3380,53 +3864,80 @@ ${this.pendingWorktreeNotice}
         batches.push({ kind: "execute", concurrent: isAgent, calls: [fc] });
       }
     }
-    let skippedToolCallCounter = 0;
-    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc) => {
-      const toolName = fc.name ?? "unknown_tool";
-      const callId = fc.id ?? `${toolName}-skip-${++skippedToolCallCounter}`;
-      const part = {
-        functionResponse: {
-          id: callId,
-          name: toolName,
-          response: { error: PERMISSION_CANCEL_SKIP_MESSAGE }
-        }
-      };
-      const error = new Error(PERMISSION_CANCEL_SKIP_MESSAGE);
-      try {
-        this.config.getChatRecordingService()?.recordToolResult([part], {
-          callId,
-          status: "error",
-          resultDisplay: void 0,
-          error,
-          errorType: void 0
-        });
-        await this.toolCallEmitter.emitStart({
-          callId,
-          toolName,
-          args: fc.args ?? {},
-          status: "pending"
-        });
-        await this.toolCallEmitter.emitError(callId, toolName, error);
-      } catch (recordError) {
-        debugLogger4.error("Failed to record skipped tool call:", recordError);
-      }
-      return part;
-    }, "recordSkippedToolCall");
-    const appendSkippedAfter = /* @__PURE__ */ __name(async (parts2, fc) => {
+    const appendSkippedAfter = /* @__PURE__ */ __name(async (parts2, fc, message = PERMISSION_CANCEL_SKIP_MESSAGE) => {
       const startIndex = dedupedFunctionCalls.indexOf(fc) + 1;
       for (const remainingCall of dedupedFunctionCalls.slice(startIndex)) {
-        parts2.push(await recordSkippedToolCall(remainingCall));
+        parts2.push(await recordSkippedToolCall(remainingCall, message));
       }
     }, "appendSkippedAfter");
-    const runBounded = /* @__PURE__ */ __name(async (calls, runAbortSignal, onStopAfterPermissionCancel, shouldSkipUnstarted) => {
-      const maxConcurrency = parsePositiveIntegerEnv(
+    const runBounded = /* @__PURE__ */ __name(async (calls, runAbortSignal, onStopAfterPermissionCancel, onStopAfterLoopDetected, shouldSkipUnstarted) => {
+      const configuredMaxConcurrency = parsePositiveIntegerEnv(
         process.env["QWEN_CODE_MAX_TOOL_CONCURRENCY"],
         10
       );
+      const maxConcurrency = toolLoopState ? Math.min(
+        configuredMaxConcurrency,
+        DAEMON_INVALID_TOOL_PARAMS_THRESHOLD
+      ) : configuredMaxConcurrency;
       const results = new Array(calls.length);
       const executing = /* @__PURE__ */ new Set();
-      for (let i = 0; i < calls.length; i++) {
+      const fillLoopSkippedFrom = /* @__PURE__ */ __name(async (startIndex2) => {
+        for (let i = startIndex2; i < calls.length; i++) {
+          if (results[i]) continue;
+          results[i] = {
+            parts: [
+              await recordSkippedToolCall(calls[i], LOOP_DETECTED_SKIP_MESSAGE)
+            ],
+            stopAfterPermissionCancel: false,
+            loopDetected: true
+          };
+        }
+      }, "fillLoopSkippedFrom");
+      const fillPermissionSkippedFrom = /* @__PURE__ */ __name(async (startIndex2) => {
+        for (let i = startIndex2; i < calls.length; i++) {
+          if (results[i]) continue;
+          results[i] = {
+            parts: [await recordSkippedToolCall(calls[i])],
+            stopAfterPermissionCancel: false
+          };
+        }
+      }, "fillPermissionSkippedFrom");
+      let startIndex = 0;
+      if (toolLoopState && calls.length > DAEMON_INVALID_TOOL_PARAMS_THRESHOLD) {
+        startIndex = DAEMON_INVALID_TOOL_PARAMS_THRESHOLD;
+        for (let i = 0; i < startIndex; i++) {
+          if (runAbortSignal.aborted && shouldSkipUnstarted?.()) {
+            results[i] = {
+              parts: [await recordSkippedToolCall(calls[i])],
+              stopAfterPermissionCancel: false
+            };
+            continue;
+          }
+          const r = await this.runTool(
+            runAbortSignal,
+            promptId,
+            calls[i],
+            onStopAfterPermissionCancel,
+            toolLoopState,
+            recordSkippedToolCall
+          );
+          results[i] = r;
+          if (r.loopDetected) {
+            await fillLoopSkippedFrom(i + 1);
+            return results;
+          }
+          if (r.stopAfterPermissionCancel) {
+            await fillPermissionSkippedFrom(i + 1);
+            return results;
+          }
+        }
+      }
+      for (let i = startIndex; i < calls.length; i++) {
         const idx = i;
+        if (toolLoopState?.loopDetected) {
+          await fillLoopSkippedFrom(idx);
+          return results;
+        }
         if (runAbortSignal.aborted && shouldSkipUnstarted?.()) {
           results[idx] = {
             parts: [await recordSkippedToolCall(calls[idx])],
@@ -3438,7 +3949,9 @@ ${this.pendingWorktreeNotice}
           runAbortSignal,
           promptId,
           calls[idx],
-          onStopAfterPermissionCancel
+          onStopAfterPermissionCancel,
+          toolLoopState,
+          recordSkippedToolCall
         ).then((r) => {
           results[idx] = r;
         }).finally(() => {
@@ -3447,6 +3960,23 @@ ${this.pendingWorktreeNotice}
         executing.add(p);
         if (executing.size >= maxConcurrency) {
           await Promise.race(executing);
+          if (results.some((result) => result?.loopDetected)) {
+            onStopAfterLoopDetected?.();
+            await Promise.all(executing);
+            await fillLoopSkippedFrom(idx + 1);
+            return results;
+          }
+          const invalidToolErrorNearThreshold = toolLoopState && [...toolLoopState.invalidToolParamErrors.values()].some(
+            (count) => count >= DAEMON_INVALID_TOOL_PARAMS_THRESHOLD - 1
+          );
+          if (invalidToolErrorNearThreshold && executing.size > 0) {
+            await Promise.all(executing);
+            if (results.some((result) => result?.loopDetected)) {
+              onStopAfterLoopDetected?.();
+              await fillLoopSkippedFrom(idx + 1);
+              return results;
+            }
+          }
         }
       }
       await Promise.all(executing);
@@ -3482,15 +4012,30 @@ ${this.pendingWorktreeNotice}
             batch.calls,
             batchAbortController.signal,
             stopBatchAfterPermissionCancel,
+            () => batchAbortController.abort("loop_detected"),
             () => batchStopAfterPermissionCancel
           );
         } finally {
           abortSignal.removeEventListener("abort", propagateAbort);
         }
         let shouldStop = false;
+        let shouldStopForLoop = false;
         for (const r of results) {
           parts.push(...r.parts);
           shouldStop ||= r.stopAfterPermissionCancel;
+          shouldStopForLoop ||= r.loopDetected === true;
+        }
+        if (shouldStopForLoop) {
+          await appendSkippedAfter(
+            parts,
+            batch.calls[batch.calls.length - 1],
+            LOOP_DETECTED_SKIP_MESSAGE
+          );
+          return {
+            parts,
+            stopAfterPermissionCancel: false,
+            loopDetected: true
+          };
         }
         if (shouldStop) {
           await appendSkippedAfter(parts, batch.calls[batch.calls.length - 1]);
@@ -3502,8 +4047,23 @@ ${this.pendingWorktreeNotice}
         }
       } else {
         for (const fc of batch.calls) {
-          const r = await this.runTool(abortSignal, promptId, fc);
+          const r = await this.runTool(
+            abortSignal,
+            promptId,
+            fc,
+            void 0,
+            toolLoopState,
+            recordSkippedToolCall
+          );
           parts.push(...r.parts);
+          if (r.loopDetected) {
+            await appendSkippedAfter(parts, fc, LOOP_DETECTED_SKIP_MESSAGE);
+            return {
+              parts,
+              stopAfterPermissionCancel: false,
+              loopDetected: true
+            };
+          }
           if (r.stopAfterPermissionCancel) {
             await appendSkippedAfter(parts, fc);
             return {
@@ -3551,9 +4111,24 @@ ${this.pendingWorktreeNotice}
     }
     return reminders;
   }
-  async runTool(abortSignal, promptId, fc, onStopAfterPermissionCancel) {
+  async runTool(abortSignal, promptId, fc, onStopAfterPermissionCancel, toolLoopState, recordSkippedToolCall) {
     const callId = fc.id ?? `${fc.name}-${Date.now()}`;
     let args = fc.args ?? {};
+    if (toolLoopState?.loopDetected) {
+      return {
+        parts: [
+          recordSkippedToolCall ? await recordSkippedToolCall(fc, LOOP_DETECTED_SKIP_MESSAGE, false) : {
+            functionResponse: {
+              id: callId,
+              name: fc.name ?? "unknown_tool",
+              response: { error: LOOP_DETECTED_SKIP_MESSAGE }
+            }
+          }
+        ],
+        stopAfterPermissionCancel: false,
+        loopDetected: true
+      };
+    }
     const startTime = Date.now();
     let spanError;
     let activeToolAbortSignal = abortSignal;
@@ -3606,20 +4181,32 @@ ${this.pendingWorktreeNotice}
         error,
         errorType: void 0
       });
+      const loopDetected = opts?.recordInvalidToolParams === true && !activeToolAbortSignal.aborted && !opts?.stopAfterPermissionCancel && recordDaemonInvalidToolParams(
+        this.config,
+        promptId,
+        toolLoopState,
+        toolName2,
+        error
+      );
       return {
         parts: errorParts,
-        stopAfterPermissionCancel: opts?.stopAfterPermissionCancel ?? false
+        stopAfterPermissionCancel: opts?.stopAfterPermissionCancel ?? false,
+        loopDetected
       };
     }, "earlyErrorResponse");
     if (!fc.name) {
-      return earlyErrorResponse(new Error("Missing function name"));
+      return earlyErrorResponse(new Error("Missing function name"), void 0, {
+        recordInvalidToolParams: true
+      });
     }
     const toolName = fc.name;
     const toolRegistry = this.config.getToolRegistry();
     const tool = toolRegistry.getTool(toolName);
     if (!tool) {
       return earlyErrorResponse(
-        new Error(`Tool "${toolName}" not found in registry.`)
+        new Error(`Tool "${toolName}" not found in registry.`),
+        toolName,
+        { recordInvalidToolParams: true }
       );
     }
     const toolSpan = startToolSpan(toolName, {
@@ -3663,8 +4250,10 @@ ${this.pendingWorktreeNotice}
         }
         const toolUseId = generateToolUseId();
         const approvalMode = this.config.getApprovalMode();
+        let toolBuildSucceeded = false;
         try {
           const invocation = tool.build(args);
+          toolBuildSucceeded = true;
           const taskEventEmitter = invocation.eventEmitter;
           if (isAgentTool && taskEventEmitter) {
             const parentToolCallId = callId;
@@ -3701,13 +4290,13 @@ ${this.pendingWorktreeNotice}
               toolName
             );
           }
-          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd());
+          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(toolName, this.config));
           const confirmationPermission = getEffectivePermissionForConfirmation(
             finalPermission,
             forceAutoReviewForAllow
           );
           if (finalPermission === "allow" && forceAutoReviewForAllow) {
-            debugLogger4.info(
+            debugLogger5.info(
               `Auto mode: L4 allow overridden by protected-write guard for ${toolName}`
             );
           }
@@ -3750,7 +4339,7 @@ ${this.pendingWorktreeNotice}
                 autoModeAllowed = true;
                 break;
               case "blocked":
-                debugLogger4.warn(
+                debugLogger5.warn(
                   `Auto mode blocked (${outcome.reason}): tool=${toolName}, ` + formatDenialStateLog(denialState)
                 );
                 return earlyErrorResponse(
@@ -3762,7 +4351,7 @@ ${this.pendingWorktreeNotice}
                   outcome.reason
                 );
                 if (wasAutoModeDenialFallback) {
-                  debugLogger4.warn(
+                  debugLogger5.warn(
                     `Auto mode fallback to manual approval (${outcome.reason}): ` + formatDenialStateLog(denialState)
                   );
                 }
@@ -3780,12 +4369,12 @@ ${this.pendingWorktreeNotice}
               const before = this.config.getAutoModeDenialState();
               const after = recordFallbackApprove(before);
               if (after === before) {
-                debugLogger4.warn(
+                debugLogger5.warn(
                   `Auto mode denial counters already clear after fallback approval: ` + formatDenialStateLog(before)
                 );
                 return;
               }
-              debugLogger4.warn(
+              debugLogger5.warn(
                 `Auto mode denial counters reset after fallback approval: ${formatDenialStateLog(before)} -> ${formatDenialStateLog(after)}`
               );
               this.config.setAutoModeDenialState(after);
@@ -3891,7 +4480,7 @@ ${this.pendingWorktreeNotice}
                 );
                 outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
               } catch (error) {
-                debugLogger4.error(
+                debugLogger5.error(
                   `Permission request failed for tool ${toolName}:`,
                   error
                 );
@@ -3900,7 +4489,7 @@ ${this.pendingWorktreeNotice}
                     "cancel" /* Cancel */
                   );
                 } catch (confirmError) {
-                  debugLogger4.error(
+                  debugLogger5.error(
                     `Failed to cancel tool ${toolName} after permission request failure:`,
                     confirmError
                   );
@@ -3925,7 +4514,7 @@ ${this.pendingWorktreeNotice}
                 if (outcome !== "cancel" /* Cancel */) {
                   throw error;
                 }
-                debugLogger4.error(
+                debugLogger5.error(
                   `Failed to confirm cancellation for tool ${toolName}:`,
                   error
                 );
@@ -3990,12 +4579,12 @@ ${this.pendingWorktreeNotice}
             if (!preHookResult.shouldProceed) {
               const blockReason = preHookResult.blockReason || "Blocked by PreToolUse hook";
               await this.messageEmitter.emitAgentMessage(
-                `\u{1F6AB} **PreToolUse blocked**: ${toolName} - ${blockReason}`
+                `\u2717 **PreToolUse blocked**: ${toolName} - ${blockReason}`
               );
               return earlyErrorResponse(new Error(blockReason), toolName);
             }
             if (preHookResult.additionalContext) {
-              debugLogger4.debug(
+              debugLogger5.debug(
                 `PreToolUse hook additional context for ${toolName}: ${preHookResult.additionalContext}`
               );
             }
@@ -4058,7 +4647,7 @@ ${this.pendingWorktreeNotice}
             );
             if (postHookResult.shouldStop) {
               const stopMessage = postHookResult.stopReason || "Execution stopped by PostToolUse hook";
-              debugLogger4.info(
+              debugLogger5.info(
                 `PostToolUse hook requested stop for ${toolName}: ${stopMessage}`
               );
               return earlyErrorResponse(new Error(stopMessage), toolName);
@@ -4081,7 +4670,7 @@ ${this.pendingWorktreeNotice}
               callId
             );
             if (failureHookResult.additionalContext) {
-              debugLogger4.debug(
+              debugLogger5.debug(
                 `PostToolUseFailure hook additional context for ${toolName}: ${failureHookResult.additionalContext}`
               );
             }
@@ -4157,7 +4746,7 @@ ${this.pendingWorktreeNotice}
               callId
             );
             if (failureHookResult.additionalContext) {
-              debugLogger4.debug(
+              debugLogger5.debug(
                 `PostToolUseFailure hook additional context for ${toolName}: ${failureHookResult.additionalContext}`
               );
             }
@@ -4181,9 +4770,17 @@ ${this.pendingWorktreeNotice}
             error,
             errorType: void 0
           });
+          const loopDetected = !activeToolAbortSignal.aborted && !toolBuildSucceeded && recordDaemonInvalidToolParams(
+            this.config,
+            promptId,
+            toolLoopState,
+            toolName,
+            error
+          );
           return {
             parts: errorResponse(error),
-            stopAfterPermissionCancel: nestedPermissionCancelled
+            stopAfterPermissionCancel: nestedPermissionCancelled,
+            loopDetected
           };
         }
       });
@@ -4292,11 +4889,30 @@ ${this.pendingWorktreeNotice}
   async #resolvePrompt(message, abortSignal) {
     const FILE_URI_SCHEME = "file://";
     const embeddedContext = [];
+    const extensionMentions = /* @__PURE__ */ new Map();
+    const preserveUnsupportedImageForBridge = shouldRunVisionBridge(
+      this.config
+    );
     const parts = message.map((part) => {
       switch (part.type) {
         case "text":
+          collectExtensionMentionRefs(part.text, extensionMentions);
           return { text: part.text };
         case "image":
+          if (preserveUnsupportedImageForBridge) {
+            return {
+              inlineData: {
+                mimeType: part.mimeType,
+                data: part.data
+              }
+            };
+          }
+          return clampInlineMediaPart({
+            inlineData: {
+              mimeType: part.mimeType,
+              data: part.data
+            }
+          });
         case "audio":
           return clampInlineMediaPart({
             inlineData: {
@@ -4328,8 +4944,18 @@ ${this.pendingWorktreeNotice}
       }
     });
     const atPathCommandParts = parts.filter((part) => "fileData" in part);
+    const extensionParts = await this.#resolveExtensionMentionParts(
+      extensionMentions,
+      abortSignal
+    );
+    if (atPathCommandParts.length === 0 && embeddedContext.length === 0 && extensionParts.length === 0) {
+      return this.#applyVisionBridgeIfNeeded(parts, abortSignal);
+    }
     if (atPathCommandParts.length === 0 && embeddedContext.length === 0) {
-      return parts;
+      return this.#applyVisionBridgeIfNeeded(
+        [...parts, ...extensionParts],
+        abortSignal
+      );
     }
     const pathSpecsToRead = atPathCommandParts.map(
       (part) => part.fileData.fileUri
@@ -4351,19 +4977,24 @@ ${this.pendingWorktreeNotice}
     if (pathSpecsToRead.length > 0) {
       const readResult = await readManyFiles(this.config, {
         paths: pathSpecsToRead,
-        signal: abortSignal
+        signal: abortSignal,
+        ...preserveUnsupportedImageForBridge ? { preserveUnsupportedImageForBridge } : {}
       });
       const contentParts = Array.isArray(readResult.contentParts) ? readResult.contentParts : [readResult.contentParts];
       processedQueryParts.push({ text: initialQueryText });
+      processedQueryParts.push(...extensionParts);
       for (const part of contentParts) {
         if (typeof part === "string") {
           processedQueryParts.push({ text: part });
+        } else if (preserveUnsupportedImageForBridge && hasImageParts([part])) {
+          processedQueryParts.push(part);
         } else {
           processedQueryParts.push(clampInlineMediaPart(part));
         }
       }
     } else {
       processedQueryParts.push({ text: initialQueryText.trim() });
+      processedQueryParts.push(...extensionParts);
     }
     for (const contextPart of embeddedContext) {
       if ("text" in contextPart && contextPart.text) {
@@ -4373,21 +5004,104 @@ ${contextPart.text}`
         });
       }
       if ("blob" in contextPart && contextPart.blob) {
+        const inlinePart = {
+          inlineData: {
+            mimeType: contextPart.mimeType ?? "application/octet-stream",
+            data: contextPart.blob
+          }
+        };
         processedQueryParts.push(
-          clampInlineMediaPart({
-            inlineData: {
-              mimeType: contextPart.mimeType ?? "application/octet-stream",
-              data: contextPart.blob
-            }
-          })
+          preserveUnsupportedImageForBridge && hasImageParts([inlinePart]) ? inlinePart : clampInlineMediaPart(inlinePart)
         );
       }
     }
-    return processedQueryParts;
+    return this.#applyVisionBridgeIfNeeded(processedQueryParts, abortSignal);
+  }
+  async #applyVisionBridgeIfNeeded(parts, abortSignal) {
+    if (!hasImageParts(parts) || !shouldRunVisionBridge(this.config)) {
+      return parts;
+    }
+    let bridgeResult;
+    try {
+      debugLogger5.debug("vision bridge: gate matched, running conversion");
+      bridgeResult = await runVisionBridge({
+        config: this.config,
+        parts,
+        signal: abortSignal
+      });
+    } catch (error) {
+      debugLogger5.debug(
+        `vision bridge: failed before replacement; falling back to text-only parts error=${String(error instanceof Error ? error.message : error)}`
+      );
+      return splitImageParts(parts).nonImageParts;
+    }
+    debugLogger5.debug(
+      `vision bridge: status=${bridgeResult.status} applied=${bridgeResult.applied} model=${bridgeResult.modelId ?? "(none)"}${bridgeResult.error ? ` error=${bridgeResult.error}` : ""}`
+    );
+    if (bridgeResult.status !== "skipped" || bridgeResult.egressOccurred) {
+      try {
+        await this.messageEmitter.emitAgentMessage(
+          this.#formatVisionBridgeNotice(bridgeResult)
+        );
+      } catch (error) {
+        debugLogger5.debug(
+          `vision bridge: failed to emit notice; continuing with bridge result error=${String(error instanceof Error ? error.message : error)}`
+        );
+      }
+    }
+    if (abortSignal.aborted) {
+      debugLogger5.debug("vision bridge: turn aborted after bridge returned");
+      return splitImageParts(parts).nonImageParts;
+    }
+    if (bridgeResult.applied && bridgeResult.parts != null) {
+      return normalizeParts(bridgeResult.parts);
+    }
+    return splitImageParts(parts).nonImageParts;
+  }
+  #formatVisionBridgeNotice(result) {
+    const modelName = result.modelId ?? "vision model";
+    const target = result.modelEndpoint ? `${modelName} (${result.modelEndpoint})` : modelName;
+    const egressNote = result.egressOccurred ? ` Your image and prompt/context were sent to ${target}.` : "";
+    if (result.status === "failed") {
+      const reason = result.egressOccurred ? "the vision model request failed" : "the vision bridge could not run";
+      return `Vision bridge (${modelName}) failed: ${reason}.${egressNote} The image was not interpreted.`;
+    }
+    if (result.status === "skipped") {
+      return `Vision bridge cancelled.${egressNote}`;
+    }
+    const omitted = result.omittedCount > 0 ? ` (${result.omittedCount} image(s) omitted)` : "";
+    return `Converted ${result.convertedCount} image(s)${omitted} to text via ${target}. Your image and prompt/context were sent to that model.`;
+  }
+  async #resolveExtensionMentionParts(extensionMentions, abortSignal) {
+    if (extensionMentions.size === 0) return [];
+    const activeExtensions = this.config.getActiveExtensions?.() ?? [];
+    if (activeExtensions.length === 0) return [];
+    const extensionParts = [];
+    const resolvedExtensionNames = /* @__PURE__ */ new Set();
+    let remainingBudget = EXTENSION_CONTEXT_BUDGET;
+    for (const name of extensionMentions.values()) {
+      const extension = matchExtensionByRef(name, activeExtensions);
+      if (!extension) {
+        this.debug(
+          `Extension "${name}" not found among active extensions. Available: ${activeExtensions.map((e) => e.name).join(", ") || "(none)"}`
+        );
+        continue;
+      }
+      if (resolvedExtensionNames.has(extension.name)) continue;
+      resolvedExtensionNames.add(extension.name);
+      const context = await buildExtensionMentionContext(extension, {
+        remainingBudget,
+        signal: abortSignal,
+        onDebugMessage: /* @__PURE__ */ __name((message) => this.debug(message), "onDebugMessage")
+      });
+      remainingBudget = context.remainingBudget;
+      extensionParts.push({ text: context.text });
+    }
+    return extensionParts;
   }
   debug(msg) {
     if (this.config.getDebugMode()) {
-      debugLogger4.warn(msg);
+      debugLogger5.warn(msg);
     }
   }
   /**
@@ -4407,7 +5121,7 @@ ${contextPart.text}`
         }
       );
     }).catch((err) => {
-      debugLogger4.debug(
+      debugLogger5.debug(
         `ACP terminalSequence notification dropped (session=${this.sessionId}): ${err instanceof Error ? err.message : String(err)}`
       );
     });
@@ -4518,8 +5232,9 @@ function runWithAcpRuntimeOutputDir(settings, cwd, fn) {
 __name(runWithAcpRuntimeOutputDir, "runWithAcpRuntimeOutputDir");
 
 // packages/cli/src/acp-integration/acpAgent.ts
-var debugLogger5 = createDebugLogger("ACP_AGENT");
+var debugLogger6 = createDebugLogger("ACP_AGENT");
 var BTW_CHILD_TIMEOUT_MS = 55e3;
+var WORKSPACE_MEMORY_REMEMBER_CHILD_TIMEOUT_MS = 295e3;
 function collapseForkDirective(directive, maxLength) {
   const oneLine = directive.replace(/\s+/g, " ").trim();
   return oneLine.length > maxLength ? `${oneLine.slice(0, maxLength - 3)}\u2026` : oneLine;
@@ -4642,7 +5357,7 @@ function readRequiredString(value, fieldName) {
 }
 __name(readRequiredString, "readRequiredString");
 function validateSkillSlug(slug) {
-  if (!slug || slug === "." || slug === ".." || slug.includes("/") || slug.includes(path.sep) || !/^[a-zA-Z0-9._-]+$/.test(slug)) {
+  if (!slug || slug === "." || slug === ".." || slug.includes("/") || slug.includes(path3.sep) || !/^[a-zA-Z0-9._-]+$/.test(slug)) {
     throw RequestError.invalidParams(void 0, "Invalid skill.slug");
   }
 }
@@ -5111,7 +5826,7 @@ async function downloadGitHubSkillDirectoryFromApi(githubUrl, directoryPath, rel
     const name = readRequiredString(record["name"], "github.name");
     const itemPath = readRequiredString(record["path"], "github.path");
     const type = readRequiredString(record["type"], "github.type");
-    const relativePath = relativeRoot ? path.posix.join(relativeRoot, name) : name;
+    const relativePath = relativeRoot ? path3.posix.join(relativeRoot, name) : name;
     if (type === "dir") {
       files.push(
         ...await downloadGitHubSkillDirectoryFromApi(
@@ -5158,7 +5873,7 @@ async function downloadGitHubSkillDirectory(githubUrl, directoryPath) {
     githubUrl,
     directoryPath
   ).catch((error) => {
-    debugLogger5.warn(
+    debugLogger6.warn(
       "GitHub API directory listing failed, falling back to archive download:",
       error
     );
@@ -5171,10 +5886,10 @@ __name(downloadGitHubSkillDirectory, "downloadGitHubSkillDirectory");
 async function downloadSkill(sourceUrl) {
   assertAllowedSkillSourceUrl(sourceUrl);
   const githubUrl = parseGitHubBlobSkillUrl(sourceUrl);
-  if (!githubUrl || path.posix.basename(githubUrl.filePath) !== "SKILL.md") {
+  if (!githubUrl || path3.posix.basename(githubUrl.filePath) !== "SKILL.md") {
     return downloadSingleSkillFile(sourceUrl);
   }
-  const skillDirectory = path.posix.dirname(githubUrl.filePath);
+  const skillDirectory = path3.posix.dirname(githubUrl.filePath);
   const files = await downloadGitHubSkillDirectory(githubUrl, skillDirectory);
   const skillFile = files.find((file) => file.relativePath === "SKILL.md");
   if (!skillFile) {
@@ -5190,9 +5905,9 @@ async function downloadSkill(sourceUrl) {
 }
 __name(downloadSkill, "downloadSkill");
 function resolveSkillInstallPath(skillDir, relativePath) {
-  const root = path.resolve(skillDir);
-  const target = path.resolve(skillDir, relativePath);
-  if (target !== root && !target.startsWith(root + path.sep)) {
+  const root = path3.resolve(skillDir);
+  const target = path3.resolve(skillDir, relativePath);
+  if (target !== root && !target.startsWith(root + path3.sep)) {
     throw RequestError.invalidParams(
       void 0,
       `Invalid skill file path: ${relativePath}`
@@ -5202,9 +5917,9 @@ function resolveSkillInstallPath(skillDir, relativePath) {
 }
 __name(resolveSkillInstallPath, "resolveSkillInstallPath");
 function resolveManagedSkillDir(skillsBaseDir, slug) {
-  const root = path.resolve(skillsBaseDir);
-  const skillDir = path.resolve(skillsBaseDir, slug);
-  if (!skillDir.startsWith(root + path.sep)) {
+  const root = path3.resolve(skillsBaseDir);
+  const skillDir = path3.resolve(skillsBaseDir, slug);
+  if (!skillDir.startsWith(root + path3.sep)) {
     throw RequestError.invalidParams(void 0, "Invalid skill.slug");
   }
   return skillDir;
@@ -5760,7 +6475,7 @@ function readMcpServers(source, scope) {
       const server = toMcpServerConfig(value);
       return server ? { name, scope, server: redactMcpServerSecrets(server) } : void 0;
     } catch (error) {
-      debugLogger5.warn(
+      debugLogger6.warn(
         `Skipping malformed MCP server config [${scope}:${name}]:`,
         error
       );
@@ -5856,7 +6571,7 @@ function readHooks(source, scope, extensionName) {
           extensionName
         });
       } catch (error) {
-        debugLogger5.warn(
+        debugLogger6.warn(
           `Skipping malformed hook entry [${scope}:${event}:${index}]:`,
           error
         );
@@ -5881,14 +6596,14 @@ function readScopeSettings(settings, scope) {
 __name(readScopeSettings, "readScopeSettings");
 async function resolvePreferredMemoryFile(dir, fallbackFilename) {
   for (const filename of getAllGeminiMdFilenames()) {
-    const filePath = path.join(dir, filename);
+    const filePath = path3.join(dir, filename);
     try {
       await fs.access(filePath);
       return filePath;
     } catch {
     }
   }
-  return path.join(dir, fallbackFilename);
+  return path3.join(dir, fallbackFilename);
 }
 __name(resolvePreferredMemoryFile, "resolvePreferredMemoryFile");
 async function resolveQwenMemoryPaths(params) {
@@ -5909,13 +6624,37 @@ async function resolveQwenMemoryPaths(params) {
   };
 }
 __name(resolveQwenMemoryPaths, "resolveQwenMemoryPaths");
+async function deliverClientMcpMessage(connection, serverName, message) {
+  if (!connection) {
+    throw new Error(
+      `client MCP server '${serverName}' has no ACP connection yet`
+    );
+  }
+  const response = await connection.extMethod(
+    SERVE_CONTROL_EXT_METHODS.clientMcpMessage,
+    { server: serverName, payload: message }
+  );
+  const payload = response["payload"];
+  if (payload === void 0 || payload === null) {
+    throw new Error(
+      `client_mcp/message returned no payload for server '${serverName}'`
+    );
+  }
+  return payload;
+}
+__name(deliverClientMcpMessage, "deliverClientMcpMessage");
 async function runAcpAgent(config, settings, argv) {
+  let acpConnection;
+  const bootstrapClientMcpSender = /* @__PURE__ */ __name((serverName, message) => deliverClientMcpMessage(acpConnection, serverName, message), "bootstrapClientMcpSender");
   await config.initialize({
     skipGeminiInitialization: true,
     // Bootstrap skips MCP discovery — each session runs its own
     // pool-routed discovery, so bootstrap-level spawns would be
     // redundant subprocess leaks (W119).
-    skipMcpDiscovery: true
+    skipMcpDiscovery: true,
+    // Bind the workspace-level manager's SDK callback so a runtime-added
+    // client-hosted MCP server (#5626) round-trips over the parent WS.
+    sendSdkMcpMessage: bootstrapClientMcpSender
   });
   const stdout = Writable.toWeb(process.stdout);
   const stdin = Readable.toWeb(process.stdin);
@@ -5925,6 +6664,7 @@ async function runAcpAgent(config, settings, argv) {
   const stream = ndJsonStream(stdout, stdin);
   let agentInstance;
   const connection = new AgentSideConnection((conn) => {
+    acpConnection = conn;
     agentInstance = new QwenAgent(config, settings, argv, conn);
     return agentInstance;
   }, stream);
@@ -5933,7 +6673,7 @@ async function runAcpAgent(config, settings, argv) {
     try {
       await agentInstance.shutdownMcpPool(8e3);
     } catch (err) {
-      debugLogger5.error(`[ACP] MCP pool drain (${label}) error:`, err);
+      debugLogger6.error(`[ACP] MCP pool drain (${label}) error:`, err);
     }
   }, "drainPoolBeforeExit");
   let shuttingDown = false;
@@ -5960,7 +6700,7 @@ async function runAcpAgent(config, settings, argv) {
       try {
         await hookSystem.fireSessionEndEvent(reason);
       } catch (err) {
-        debugLogger5.warn(
+        debugLogger6.warn(
           `SessionEnd hook failed: ${err instanceof Error ? err.message : String(err)}`
         );
       }
@@ -5969,7 +6709,7 @@ async function runAcpAgent(config, settings, argv) {
   const shutdownHandler = /* @__PURE__ */ __name(async () => {
     if (shuttingDown) return;
     shuttingDown = true;
-    debugLogger5.debug("[ACP] Shutdown signal received, closing streams");
+    debugLogger6.debug("[ACP] Shutdown signal received, closing streams");
     await fireSessionEndOnce("other" /* Other */);
     agentInstance?.disposeSessions();
     try {
@@ -5982,7 +6722,7 @@ async function runAcpAgent(config, settings, argv) {
     }
     await drainPoolBeforeExit("signal");
     runExitCleanup().catch((err) => {
-      debugLogger5.error("[ACP] Cleanup error:", err);
+      debugLogger6.error("[ACP] Cleanup error:", err);
     }).finally(() => {
       process.exit(0);
     });
@@ -6169,33 +6909,55 @@ var QwenAgent = class {
     try {
       const result = await this.mcpPool.drainAll({ force: true, timeoutMs });
       if (result.forced > 0 || result.errors.length > 0) {
-        debugLogger5.warn(
+        debugLogger6.warn(
           `MCP pool drain: ${result.drained} clean, ${result.forced} timed out, ${result.errors.length} errors`
         );
       }
     } catch (err) {
-      debugLogger5.error(
+      debugLogger6.error(
         `MCP pool drainAll failed: ${err instanceof Error ? err.message : String(err)}`
       );
     }
   }
-  async closeStoredSession(sessionId) {
+  async closeStoredSession(sessionId, opts) {
     const session = this.sessions.get(sessionId);
     if (!session) {
       this.mcpPool?.releaseSession(sessionId);
       return;
     }
+    const requireFlush = opts?.requireFlush === true;
+    const flushRecording = /* @__PURE__ */ __name(async () => {
+      try {
+        await session.getConfig().getChatRecordingService()?.flush();
+        return void 0;
+      } catch (err) {
+        debugLogger6.debug(
+          `Session ${sessionId} chat recording flush during close failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+        return err;
+      }
+    }, "flushRecording");
+    if (requireFlush) {
+      const preCancelFlushError = await flushRecording();
+      if (preCancelFlushError !== void 0) {
+        throw preCancelFlushError;
+      }
+    }
     try {
       await session.cancelPendingPrompt();
     } catch (err) {
-      debugLogger5.debug(
+      debugLogger6.debug(
         `Session ${sessionId} cancel during close failed: ${err instanceof Error ? err.message : String(err)}`
       );
     }
+    const flushError = await flushRecording();
+    if (flushError !== void 0 && requireFlush) {
+      throw flushError;
+    }
     try {
       await session.getConfig().getToolRegistry()?.stop();
     } catch (err) {
-      debugLogger5.debug(
+      debugLogger6.debug(
         `Session ${sessionId} tool registry stop during close failed: ${err instanceof Error ? err.message : String(err)}`
       );
     }
@@ -6229,7 +6991,7 @@ var QwenAgent = class {
         scope: "workspace",
         ...event
       }).catch((err) => {
-        debugLogger5.debug(
+        debugLogger6.debug(
           `MCP workspace budget event delivery to session ${sid} failed (kind=${event.kind}): ${err instanceof Error ? err.message : String(err)}`
         );
       });
@@ -6238,7 +7000,7 @@ var QwenAgent = class {
   async initialize(args) {
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.19.3";
+    const version = "0.19.4";
     return {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {
@@ -6394,7 +7156,7 @@ var QwenAgent = class {
         session.pendingWorktreeNotice = restored.contextMessage;
       }
     } catch (error) {
-      debugLogger5.warn(`ACP worktree restore failed: ${error}`);
+      debugLogger6.warn(`ACP worktree restore failed: ${error}`);
     }
   }
   async unstable_listSessions(params) {
@@ -6515,7 +7277,7 @@ var QwenAgent = class {
       await extensionManager.refreshCache();
       extensions = extensionManager.getLoadedExtensions();
     } catch (error) {
-      debugLogger5.warn(
+      debugLogger6.warn(
         "Extension loading failed, continuing without extensions:",
         error
       );
@@ -6641,7 +7403,7 @@ var QwenAgent = class {
             pm.addPersistentRule(rule, ruleType);
           }
         } catch (error) {
-          debugLogger5.warn(
+          debugLogger6.warn(
             `Failed to sync permission rules to a live session: ${error instanceof Error ? error.message : String(error)}`
           );
         }
@@ -7151,7 +7913,7 @@ var QwenAgent = class {
       const currentAuth = activeRuntimeSnapshot?.authType ?? currentAuthType;
       const currentAcpModelId = hasCurrentModel && currentAuth ? formatAcpModelId(currentModelId, currentAuth) : currentModelId || void 0;
       const providers = /* @__PURE__ */ new Map();
-      for (const model of config.getAllConfiguredModels()) {
+      for (const model of config.getAllConfiguredModels().filter(isMainSelectableModel)) {
         const authType = String(model.authType);
         let provider = providers.get(authType);
         if (!provider) {
@@ -7871,6 +8633,7 @@ var QwenAgent = class {
             id: ext.id,
             name: ext.name,
             displayName: ext.displayName,
+            ...ext.config.description ? { description: ext.config.description } : {},
             version: ext.version,
             isActive: ext.isActive,
             path: ext.path,
@@ -7917,9 +8680,9 @@ var QwenAgent = class {
       );
     }
     const download = await downloadSkill(request.sourceUrl);
-    const skillsBaseDir = path.join(Storage.getGlobalQwenDir(), "skills");
+    const skillsBaseDir = path3.join(Storage.getGlobalQwenDir(), "skills");
     const skillDir = resolveManagedSkillDir(skillsBaseDir, request.slug);
-    const skillFile = path.join(skillDir, "SKILL.md");
+    const skillFile = path3.join(skillDir, "SKILL.md");
     const parsed = skillManager.parseSkillContent(
       download.skillContent,
       skillFile,
@@ -7939,7 +8702,7 @@ var QwenAgent = class {
           stagingDir,
           file.relativePath
         );
-        await fs.mkdir(path.dirname(targetPath), { recursive: true });
+        await fs.mkdir(path3.dirname(targetPath), { recursive: true });
         await fs.writeFile(targetPath, file.content);
       }
       await fs.rm(skillDir, { recursive: true, force: true });
@@ -7978,11 +8741,11 @@ var QwenAgent = class {
         `Skill name "${parsed.name}" does not match requested slug "${request.slug}"`
       );
     }
-    const resolvedSkillDir = path.resolve(skillDir);
-    const resolvedSkillFile = path.resolve(skillFile);
-    const globalDir = path.resolve(Storage.getGlobalQwenDir());
-    const isDedicatedSkillDir = resolvedSkillFile === path.join(resolvedSkillDir, "SKILL.md");
-    if (!isDedicatedSkillDir || resolvedSkillDir === path.parse(resolvedSkillDir).root || resolvedSkillDir === globalDir) {
+    const resolvedSkillDir = path3.resolve(skillDir);
+    const resolvedSkillFile = path3.resolve(skillFile);
+    const globalDir = path3.resolve(Storage.getGlobalQwenDir());
+    const isDedicatedSkillDir = resolvedSkillFile === path3.join(resolvedSkillDir, "SKILL.md");
+    if (!isDedicatedSkillDir || resolvedSkillDir === path3.parse(resolvedSkillDir).root || resolvedSkillDir === globalDir) {
       throw RequestError.invalidParams(
         void 0,
         `Refusing to delete unexpected skill directory: ${skillDir}`
@@ -7998,10 +8761,10 @@ var QwenAgent = class {
   async readManagedSkillFile(slug, scope, skillManager, cwd) {
     if (scope === "global") {
       const qwenSkillDir = resolveManagedSkillDir(
-        path.join(Storage.getGlobalQwenDir(), "skills"),
+        path3.join(Storage.getGlobalQwenDir(), "skills"),
         slug
       );
-      const qwenSkillFile = path.join(qwenSkillDir, "SKILL.md");
+      const qwenSkillFile = path3.join(qwenSkillDir, "SKILL.md");
       const qwenContent = await fs.readFile(qwenSkillFile, "utf8").catch(() => void 0);
       if (qwenContent !== void 0) {
         return {
@@ -8037,15 +8800,15 @@ var QwenAgent = class {
       );
     });
     return {
-      skillDir: path.dirname(skillFile),
+      skillDir: path3.dirname(skillFile),
       skillFile,
       content
     };
   }
   async findProjectSkillFileFromCwd(slug, cwd, skillManager) {
-    const projectRoot = path.resolve(cwd);
+    const projectRoot = path3.resolve(cwd);
     for (const configDir of PROJECT_SKILL_DIRS) {
-      const baseDir = path.join(projectRoot, configDir, SKILLS_DIR);
+      const baseDir = path3.join(projectRoot, configDir, SKILLS_DIR);
       const skills = await skillManager.loadSkillsFromDir(baseDir, "project");
       const skill = skills.find((candidate) => candidate.name === slug);
       const skillFile = skill?.filePath;
@@ -8057,7 +8820,7 @@ var QwenAgent = class {
         );
       });
       return {
-        skillDir: path.dirname(skillFile),
+        skillDir: path3.dirname(skillFile),
         skillFile,
         content
       };
@@ -8088,7 +8851,7 @@ var QwenAgent = class {
     }
     const nextContent = setSkillFrontmatterEnabled(content, request.enabled);
     skillManager.parseSkillContent(nextContent, skillFile, level);
-    if (path.basename(skillFile) !== "SKILL.md") {
+    if (path3.basename(skillFile) !== "SKILL.md") {
       throw RequestError.invalidParams(
         void 0,
         `Refusing to write to unexpected skill file: ${skillFile}`
@@ -8368,6 +9131,76 @@ var QwenAgent = class {
         return this.buildWorkspaceExtensionsStatus(
           this.config
         );
+      case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRememberAvailability:
+        return {
+          available: this.config.isManagedMemoryAvailable()
+        };
+      case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRemember: {
+        const content = params["content"];
+        if (typeof content !== "string" || !content.trim()) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid or missing content"
+          );
+        }
+        if (Buffer.byteLength(content, "utf8") > MAX_REMEMBER_CONTENT_BYTES) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Content exceeds maximum size"
+          );
+        }
+        const rawContextMode = params["contextMode"] ?? "workspace";
+        if (rawContextMode !== "workspace" && rawContextMode !== "clean") {
+          throw RequestError.invalidParams(void 0, "Invalid contextMode");
+        }
+        const contextMode = rawContextMode;
+        if (!this.config.isManagedMemoryAvailable()) {
+          throw new RequestError(
+            -32009,
+            "Managed memory is unavailable for this daemon workspace",
+            { errorKind: "managed_memory_unavailable" }
+          );
+        }
+        const childSignal = AbortSignal.timeout(
+          WORKSPACE_MEMORY_REMEMBER_CHILD_TIMEOUT_MS
+        );
+        try {
+          const result = await runManagedRememberByAgent({
+            config: this.config,
+            projectRoot: this.config.getProjectRoot(),
+            content: content.trim(),
+            contextMode,
+            abortSignal: childSignal
+          });
+          return result;
+        } catch (err) {
+          if (err instanceof RequestError) {
+            throw err;
+          }
+          if (childSignal.aborted) {
+            throw new RequestError(
+              -32099,
+              "Workspace memory remember timed out",
+              { errorKind: "remember_timeout" }
+            );
+          }
+          const code = extractRememberErrorCode(err);
+          if (code === "managed_memory_unavailable") {
+            throw new RequestError(
+              -32009,
+              "Managed memory is unavailable for this daemon workspace",
+              { errorKind: "managed_memory_unavailable" }
+            );
+          }
+          throw new RequestError(
+            -32099,
+            err instanceof Error && err.message ? err.message : "Workspace memory remember failed",
+            {
+              errorKind: code
+            }
+          );
+        }
+      }
       case SERVE_CONTROL_EXT_METHODS.workspaceMcpRestart: {
         const serverName = params["serverName"];
         if (typeof serverName !== "string" || serverName.length === 0) {
@@ -8523,23 +9356,34 @@ var QwenAgent = class {
         }
         if (action === "enable") {
           const settings = loadSettings(this.config.getTargetDir());
+          let settingsChanged = false;
           for (const scope of ["User" /* User */, "Workspace" /* Workspace */]) {
             const scopeSettings = settings.forScope(scope).settings;
             const currentExcluded2 = scopeSettings.mcp?.excluded || [];
-            if (currentExcluded2.includes(serverName)) {
-              settings.setValue(
-                scope,
-                "mcp.excluded",
-                currentExcluded2.filter((name) => name !== serverName)
-              );
+            const filtered = currentExcluded2.filter(
+              (pattern) => pattern !== serverName
+            );
+            if (filtered.length !== currentExcluded2.length) {
+              settings.setValue(scope, "mcp.excluded", filtered);
+              settingsChanged = true;
             }
           }
           const currentExcluded = this.config.getExcludedMcpServers() || [];
-          this.config.setExcludedMcpServers(
-            currentExcluded.filter((name) => name !== serverName)
+          const runtimeFiltered = currentExcluded.filter(
+            (pattern) => pattern !== serverName
           );
+          let runtimeChanged = false;
+          if (runtimeFiltered.length !== currentExcluded.length) {
+            this.config.setExcludedMcpServers(runtimeFiltered);
+            runtimeChanged = true;
+          }
           await toolRegistry.discoverToolsForServer(serverName);
-          return { serverName, action, ok: true, changed: true };
+          return {
+            serverName,
+            action,
+            ok: true,
+            changed: settingsChanged || runtimeChanged
+          };
         }
         if (action === "disable") {
           const settings = loadSettings(this.config.getTargetDir());
@@ -8561,18 +9405,27 @@ var QwenAgent = class {
           }
           const scopeSettings = settings.forScope(targetScope).settings;
           const currentExcluded = scopeSettings.mcp?.excluded || [];
-          if (!currentExcluded.includes(serverName)) {
+          let settingsChanged = false;
+          if (!matchesAnyServerPattern(serverName, currentExcluded)) {
             settings.setValue(targetScope, "mcp.excluded", [
               ...currentExcluded,
               serverName
             ]);
+            settingsChanged = true;
           }
           const runtimeExcluded = this.config.getExcludedMcpServers() || [];
-          if (!runtimeExcluded.includes(serverName)) {
+          let runtimeChanged = false;
+          if (!matchesAnyServerPattern(serverName, runtimeExcluded)) {
             this.config.setExcludedMcpServers([...runtimeExcluded, serverName]);
+            runtimeChanged = true;
           }
           await toolRegistry.disableMcpServer(serverName);
-          return { serverName, action, ok: true, changed: true };
+          return {
+            serverName,
+            action,
+            ok: true,
+            changed: settingsChanged || runtimeChanged
+          };
         }
         if (action === "clear-auth") {
           const tokenStorage = new MCPOAuthTokenStorage();
@@ -8687,7 +9540,9 @@ var QwenAgent = class {
             "Invalid or missing sessionId"
           );
         }
-        await this.closeStoredSession(sessionId);
+        await this.closeStoredSession(sessionId, {
+          requireFlush: params["requireFlush"] === true
+        });
         return { sessionId, closed: true };
       }
       case SERVE_CONTROL_EXT_METHODS.sessionCd: {
@@ -8699,7 +9554,7 @@ var QwenAgent = class {
             "Invalid or missing sessionId"
           );
         }
-        if (typeof targetPath !== "string" || targetPath.length === 0 || !path.isAbsolute(targetPath) || targetPath.includes("\0")) {
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path3.isAbsolute(targetPath) || targetPath.includes("\0")) {
           throw RequestError.invalidParams(
             void 0,
             "Invalid or missing path (must be an absolute path)"
@@ -8817,7 +9672,7 @@ var QwenAgent = class {
         try {
           await setLanguageAsync(language);
         } catch (err) {
-          debugLogger5.warn("setLanguageAsync failed:", err);
+          debugLogger6.warn("setLanguageAsync failed:", err);
           throw new RequestError(
             -32603,
             `Failed to switch UI language: ${err instanceof Error ? err.message : String(err)}`
@@ -8831,7 +9686,7 @@ var QwenAgent = class {
             language
           );
         } catch (err) {
-          debugLogger5.warn("Failed to persist UI language setting:", err);
+          debugLogger6.warn("Failed to persist UI language setting:", err);
         }
         let outputLanguage = null;
         let refreshed = false;
@@ -8846,7 +9701,7 @@ var QwenAgent = class {
             );
             fileWriteOk = true;
           } catch (err) {
-            debugLogger5.warn("Failed to write output-language.md:", err);
+            debugLogger6.warn("Failed to write output-language.md:", err);
           }
           if (fileWriteOk) {
             try {
@@ -8856,7 +9711,7 @@ var QwenAgent = class {
                 settingValue
               );
             } catch (err) {
-              debugLogger5.warn(
+              debugLogger6.warn(
                 "Failed to persist output language setting:",
                 err
               );
@@ -8876,7 +9731,7 @@ var QwenAgent = class {
                     writeOutputLanguageAndRegisterPath(settingValue, cfg);
                   }
                 } catch (err) {
-                  debugLogger5.warn(
+                  debugLogger6.warn(
                     `Failed to write output-language.md for session ${s.getId()} (path=${sessionPath ?? "global-default"}):`,
                     err
                   );
@@ -8889,7 +9744,7 @@ var QwenAgent = class {
               (r) => r.status === "rejected"
             ).length;
             if (failedCount > 0) {
-              debugLogger5.warn(
+              debugLogger6.warn(
                 `Language refresh failed for ${failedCount}/${results.length} session(s)`
               );
             }
@@ -8907,14 +9762,14 @@ var QwenAgent = class {
             "Invalid or missing sessionId"
           );
         }
-        debugLogger5.debug(`recap ext-method received for session=${sessionId}`);
+        debugLogger6.debug(`recap ext-method received for session=${sessionId}`);
         const session = this.sessionOrThrow(sessionId);
         const config = session.getConfig();
         const recap = await generateSessionRecap(
           config,
           new AbortController().signal
         );
-        debugLogger5.debug(
+        debugLogger6.debug(
           `recap ext-method completed for session=${sessionId} result=${recap ? `len=${recap.length}` : "null"}`
         );
         return { sessionId, recap };
@@ -8938,7 +9793,7 @@ var QwenAgent = class {
         const config = session.getConfig();
         const cacheSafeParams = buildBtwCacheSafeParams(config);
         if (!cacheSafeParams) {
-          debugLogger5.debug(`btw: no cacheSafeParams for session=${sessionId}`);
+          debugLogger6.debug(`btw: no cacheSafeParams for session=${sessionId}`);
           return { sessionId, answer: null };
         }
         const childSignal = AbortSignal.timeout(BTW_CHILD_TIMEOUT_MS);
@@ -8986,7 +9841,7 @@ var QwenAgent = class {
         try {
           hasHistory = (config.getGeminiClient().getHistoryShallow() ?? []).length > 0;
         } catch (error) {
-          debugLogger5.debug("Failed to read history before /fork:", error);
+          debugLogger6.debug("Failed to read history before /fork:", error);
         }
         if (!hasHistory) {
           throw RequestError.invalidParams(
@@ -9028,7 +9883,7 @@ var QwenAgent = class {
             ]
           });
         } catch (error) {
-          debugLogger5.debug("Failed to record fork event in history:", error);
+          debugLogger6.debug("Failed to record fork event in history:", error);
         }
         return { sessionId, description, launched: true };
       }
@@ -9091,7 +9946,7 @@ ${outputText}
             'taskKind must be "agent", "shell", or "monitor"'
           );
         }
-        debugLogger5.info(
+        debugLogger6.info(
           `sessionTaskCancel requested sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind}`
         );
         const session = this.sessionOrThrow(sessionId);
@@ -9101,7 +9956,7 @@ ${outputText}
             const task = config.getBackgroundTaskRegistry().get(taskId);
             if (!task || task.status !== "running" && task.status !== "paused") {
               const reason = task ? "not_running" : "not_found";
-              debugLogger5.info(
+              debugLogger6.info(
                 `sessionTaskCancel skipped sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} reason=${reason} status=${task?.status ?? "missing"}`
               );
               return { cancelled: false, reason, status: task?.status };
@@ -9111,7 +9966,7 @@ ${outputText}
             } else {
               config.getBackgroundTaskRegistry().cancel(taskId);
             }
-            debugLogger5.info(
+            debugLogger6.info(
               `sessionTaskCancel completed sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} status=${task.status}`
             );
             return { cancelled: true, status: task.status };
@@ -9120,13 +9975,13 @@ ${outputText}
             const task = config.getBackgroundShellRegistry().get(taskId);
             if (!task || task.status !== "running") {
               const reason = task ? "not_running" : "not_found";
-              debugLogger5.info(
+              debugLogger6.info(
                 `sessionTaskCancel skipped sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} reason=${reason} status=${task?.status ?? "missing"}`
               );
               return { cancelled: false, reason, status: task?.status };
             }
             config.getBackgroundShellRegistry().requestCancel(taskId);
-            debugLogger5.info(
+            debugLogger6.info(
               `sessionTaskCancel completed sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} status=${task.status}`
             );
             return { cancelled: true, status: task.status };
@@ -9135,13 +9990,13 @@ ${outputText}
             const task = config.getMonitorRegistry().get(taskId);
             if (!task || task.status !== "running") {
               const reason = task ? "not_running" : "not_found";
-              debugLogger5.info(
+              debugLogger6.info(
                 `sessionTaskCancel skipped sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} reason=${reason} status=${task?.status ?? "missing"}`
               );
               return { cancelled: false, reason, status: task?.status };
             }
             config.getMonitorRegistry().cancel(taskId);
-            debugLogger5.info(
+            debugLogger6.info(
               `sessionTaskCancel completed sessionId=${sessionId} taskId=${taskId} taskKind=${taskKind} status=${task.status}`
             );
             return { cancelled: true, status: task.status };
@@ -9171,7 +10026,7 @@ ${outputText}
             durationMs: Date.now() - cleared.setAt
           });
         }
-        debugLogger5.info(
+        debugLogger6.info(
           `sessionGoalClear sessionId=${sessionId} cleared=${!!cleared} condition=${cleared?.condition ?? "(none)"}`
         );
         return {
@@ -9179,6 +10034,21 @@ ${outputText}
           condition: cleared?.condition
         };
       }
+      case SERVE_CONTROL_EXT_METHODS.sessionContinue: {
+        const sessionId = params["sessionId"];
+        if (typeof sessionId !== "string" || sessionId.length === 0) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid or missing sessionId"
+          );
+        }
+        const session = this.sessionOrThrow(sessionId);
+        const result = await session.continueLastTurn();
+        debugLogger6.info(
+          `sessionContinue sessionId=${sessionId} accepted=${result.accepted} interruption=${result.interruption}`
+        );
+        return result;
+      }
       case SERVE_CONTROL_EXT_METHODS.workspaceMcpRuntimeAdd: {
         const name = params["name"];
         const config = params["config"];
@@ -9189,7 +10059,7 @@ ${outputText}
             "Invalid or missing name"
           );
         }
-        if (name.length > 256 || !/^[A-Za-z0-9_-]+$/.test(name) || name === "__proto__" || name === "constructor" || name === "prototype") {
+        if (!isValidServerName(name)) {
           throw RequestError.invalidParams(
             void 0,
             "Server name must be \u2264256 chars, alphanumeric + underscore/hyphen, and not a reserved JS property name"
@@ -9225,13 +10095,37 @@ ${outputText}
             oauth: _oauth,
             headers: _headers,
             type: _type,
+            // Reverse tool channel marker (issue #5626, Phase 2). The parent
+            // serve process stamps this on a client-hosted (extension) MCP
+            // server's runtime config; it never reaches the transport itself.
+            [CLIENT_MCP_OVER_WS_CONFIG_FLAG]: clientMcpOverWs,
             ...safeConfig
           } = config;
+          if (clientMcpOverWs === true) {
+            safeConfig["type"] = "sdk";
+          }
           const result = await manager.addRuntimeMcpServer(
             name,
             safeConfig,
             originatorClientId
           );
+          await Promise.all(
+            this.getActiveSessions().map(async (session) => {
+              const sessionManager = session.getConfig().getToolRegistry()?.getMcpClientManager();
+              if (!sessionManager) return;
+              try {
+                await sessionManager.addRuntimeMcpServer(
+                  name,
+                  safeConfig,
+                  originatorClientId
+                );
+              } catch (sessionErr) {
+                debugLogger6.warn(
+                  `workspaceMcpRuntimeAdd: failed to add runtime MCP server '${name}' to active session ${session.getConfig().getSessionId()}: ${sessionErr instanceof Error ? sessionErr.message : String(sessionErr)}`
+                );
+              }
+            })
+          );
           return result;
         } catch (err) {
           if (err instanceof McpBudgetWouldExceedError) {
@@ -9266,7 +10160,7 @@ ${outputText}
             "Invalid or missing name"
           );
         }
-        if (name.length > 256 || !/^[A-Za-z0-9_-]+$/.test(name) || name === "__proto__" || name === "constructor" || name === "prototype") {
+        if (!isValidServerName(name)) {
           throw RequestError.invalidParams(
             void 0,
             "Server name must be \u2264256 chars, alphanumeric + underscore/hyphen, and not a reserved JS property name"
@@ -9289,6 +10183,22 @@ ${outputText}
           name,
           originatorClientId
         );
+        await Promise.all(
+          this.getActiveSessions().map(async (session) => {
+            const sessionManager = session.getConfig().getToolRegistry()?.getMcpClientManager();
+            if (!sessionManager) return;
+            try {
+              await sessionManager.removeRuntimeMcpServer(
+                name,
+                originatorClientId
+              );
+            } catch (sessionErr) {
+              debugLogger6.warn(
+                `workspaceMcpRuntimeRemove: failed to remove runtime MCP server '${name}' from active session ${session.getConfig().getSessionId()}: ${sessionErr instanceof Error ? sessionErr.message : String(sessionErr)}`
+              );
+            }
+          })
+        );
         return result;
       }
       case SERVE_CONTROL_EXT_METHODS.workspaceExtensionsRefresh: {
@@ -9299,7 +10209,7 @@ ${outputText}
         try {
           await extensionManager.refreshTools();
         } catch (err) {
-          debugLogger5.warn(
+          debugLogger6.warn(
             `Extension tool refresh failed for session ${sessionId}: ${err instanceof Error ? err.message : String(err)}`
           );
         }
@@ -9447,7 +10357,7 @@ ${outputText}
             filesFailed = fileResult.filesFailed;
           } catch (err) {
             const reason = err instanceof Error ? err.message : String(err);
-            debugLogger5.error(
+            debugLogger6.error(
               `[ACP] File-history rewind failed for session=${sessionId} promptId=${promptId}: ${reason}`
             );
             filesFailed = [`file-history-rewind: ${reason}`];
@@ -9505,7 +10415,7 @@ ${outputText}
           );
         } catch (error) {
           replayError = error instanceof Error ? error.message : String(error);
-          debugLogger5.warn(
+          debugLogger6.warn(
             "[loadUpdates] History replay failed for session %s (partial updates: %d):",
             sessionId,
             updates.length,
@@ -9865,7 +10775,7 @@ ${outputText}
                   newMerged.providerProtocol ?? {}
                 );
               } catch (err) {
-                debugLogger5.warn(
+                debugLogger6.warn(
                   `reload: reloadModelProvidersConfig failed for session ${id}: ${err}`
                 );
               }
@@ -9875,7 +10785,7 @@ ${outputText}
               try {
                 await config.switchModel(authType, newModelName);
               } catch (err) {
-                debugLogger5.warn(
+                debugLogger6.warn(
                   `reload: switchModel failed for session ${id}: ${err}`
                 );
               }
@@ -9883,7 +10793,7 @@ ${outputText}
               try {
                 await config.refreshAuth(authType);
               } catch (err) {
-                debugLogger5.warn(
+                debugLogger6.warn(
                   `reload: refreshAuth failed for session ${id}: ${err}`
                 );
               }
@@ -9898,7 +10808,7 @@ ${outputText}
                 try {
                   config.setApprovalMode(newMode);
                 } catch (err) {
-                  debugLogger5.warn(
+                  debugLogger6.warn(
                     `reload: setApprovalMode failed for session ${id}: ${err}`
                   );
                 }
@@ -9907,14 +10817,14 @@ ${outputText}
             try {
               await config.refreshHierarchicalMemory();
             } catch (err) {
-              debugLogger5.warn(
+              debugLogger6.warn(
                 `reload: refreshHierarchicalMemory failed for session ${id}: ${err}`
               );
             }
             try {
               await config.getGeminiClient()?.refreshSystemInstruction();
             } catch (err) {
-              debugLogger5.warn(
+              debugLogger6.warn(
                 `reload: refreshSystemInstruction failed for session ${id}: ${err}`
               );
             }
@@ -9924,7 +10834,7 @@ ${outputText}
         for (let i = 0; i < results.length; i++) {
           if (results[i].status === "rejected") {
             const reason = results[i].reason;
-            debugLogger5.warn(
+            debugLogger6.warn(
               `Session ${sessions[i][0]} reload failed: ${reason}`
             );
             skipped.push(sessions[i][0]);
@@ -9942,6 +10852,21 @@ ${outputText}
     }
   }
   // --- private helpers ---
+  /**
+   * Reverse tool channel (issue #5626, Phase 2). Build the session
+   * `McpClientManager`'s `sendSdkMcpMessage` callback. Client-hosted
+   * (extension) MCP servers are registered SDK-type, so the manager routes
+   * their JSON-RPC through this callback. We forward each frame UP to the
+   * parent serve process via the `qwen/control/client_mcp/message` ext-method;
+   * the parent's `BridgeClient.extMethod` hands it to the per-WS-connection
+   * `ClientMcpRegistrar`, which carries it down the daemon WS to the extension
+   * and returns the correlated response (the `payload` field). All SDK-type
+   * servers in this session share one callback — the `serverName` argument
+   * routes to the right client-hosted server in the parent.
+   */
+  buildClientMcpSender() {
+    return (serverName, message) => deliverClientMcpMessage(this.connection, serverName, message);
+  }
   async newSessionConfig(cwd, mcpServers, sessionId, resume) {
     this.settings = loadSettings(cwd);
     const sessionMcpServers = {};
@@ -10026,6 +10951,14 @@ ${outputText}
     if (typeof config.enableFileCheckpointing === "function") {
       config.enableFileCheckpointing();
     }
+    if (typeof this.config.getRuntimeMcpServers === "function" && typeof config.addRuntimeMcpServer === "function") {
+      const bootstrapRuntimeMcpServers = this.config.getRuntimeMcpServers();
+      for (const [runtimeServerName, runtimeServerConfig] of Object.entries(
+        bootstrapRuntimeMcpServers
+      )) {
+        config.addRuntimeMcpServer(runtimeServerName, runtimeServerConfig);
+      }
+    }
     if (this.mcpPool !== void 0 && typeof config.setMcpTransportPool === "function") {
       config.setMcpTransportPool(this.mcpPool);
     }
@@ -10039,13 +10972,20 @@ ${outputText}
           sessionId: sid,
           ...event
         }).catch((err) => {
-          debugLogger5.debug(
+          debugLogger6.debug(
             `MCP budget extNotification dropped (session=${sid}, kind=${event.kind}): ${err instanceof Error ? err.message : String(err)}`
           );
         });
       });
     }
-    await config.initialize();
+    await config.initialize({
+      // Reverse tool channel (issue #5626, Phase 2): bind the session
+      // manager's SDK MCP callback to the `client_mcp/message` ext-method so a
+      // client-hosted (extension) MCP server added at runtime reaches the
+      // daemon WS. Servers that aren't client-hosted never use this callback
+      // (the daemon only adds SDK-type runtime servers for client MCP).
+      sendSdkMcpMessage: this.buildClientMcpSender()
+    });
     await config.waitForMcpReady();
     const failedMcpServers = typeof config.getFailedMcpServerNames === "function" ? config.getFailedMcpServerNames() : [];
     if (failedMcpServers.length > 0) {
@@ -10067,7 +11007,7 @@ ${outputText}
     try {
       await config.refreshAuth(selectedType, true);
     } catch (e) {
-      debugLogger5.error(`Authentication failed: ${e}`);
+      debugLogger6.error(`Authentication failed: ${e}`);
       throw RequestError.authRequired(
         {
           authMethods: pickAuthMethodsForAuthRequired(selectedType)
@@ -10082,7 +11022,20 @@ ${outputText}
       this.connection,
       config.getSessionId(),
       this.clientCapabilities.fs,
-      config.getFileSystemService()
+      config.getFileSystemService(),
+      {
+        // SYNC: Mirrors ReadFileTool's default allowed local roots, including
+        // auto-memory roots, so ACP-local read fallback follows the same policy.
+        localReadRoots: [
+          config.storage.getProjectTempDir(),
+          path3.join(config.storage.getProjectDir(), "subagents"),
+          Storage.getGlobalTempDir(),
+          getAutoMemoryRoot(config.getTargetDir()),
+          getUserAutoMemoryRoot(),
+          ...config.storage.getUserSkillsDirs(),
+          Storage.getUserExtensionsDir()
+        ]
+      }
     );
     config.setFileSystemService(acpFileSystemService);
   }
@@ -10120,7 +11073,7 @@ ${outputText}
   buildAvailableModels(config) {
     const rawCurrentModelId = (config.getModel() || this.config.getModel() || "").trim();
     const currentAuthType = config.getAuthType();
-    const allConfiguredModels = config.getAllConfiguredModels();
+    const allConfiguredModels = config.getAllConfiguredModels().filter(isMainSelectableModel);
     const activeRuntimeSnapshot = config.getActiveRuntimeModelSnapshot?.();
     const currentModelId = activeRuntimeSnapshot ? formatAcpModelId(
       activeRuntimeSnapshot.id,
@@ -10156,7 +11109,7 @@ ${outputText}
   }
   buildConfigOptions(config) {
     const currentApprovalMode = config.getApprovalMode();
-    const allConfiguredModels = config.getAllConfiguredModels();
+    const allConfiguredModels = config.getAllConfiguredModels().filter(isMainSelectableModel);
     const rawCurrentModelId = (config.getModel() || "").trim();
     const currentAuthType = config.getAuthType?.();
     const activeRuntimeSnapshot = config.getActiveRuntimeModelSnapshot?.();
@@ -10202,6 +11155,10 @@ ${outputText}
     return authType ? formatAcpModelId(baseModelId, authType) : baseModelId;
   }
 };
+function isMainSelectableModel(model) {
+  return model.fastOnly !== true && model.voiceOnly !== true;
+}
+__name(isMainSelectableModel, "isMainSelectableModel");
 function diffSettingsKeys(oldMerged, newMerged) {
   const changed = /* @__PURE__ */ new Set();
   const allKeys = /* @__PURE__ */ new Set([
@@ -10220,6 +11177,7 @@ export {
   AUTH_PREFLIGHT_ENV_KEYS,
   AUTH_PREFLIGHT_WAIVED_AUTH_TYPES,
   createWorkspaceMcpBudget,
+  deliverClientMcpMessage,
   extractFilesFromTarGz,
   fetchAllowedGitHub,
   normalizeCoreSettingValue,