@qwen-code/qwen-code 0.20.1-preview.7215 → 0.20.2-gdpval-vl-agent.0

package/chunks/{acpAgent-6RBIJFDI.js → acpAgent-FTFFYP5G.js}

@@ -1,5 +1,8 @@
 // Force strict mode and setup for ESM
 "use strict";
+import {
+  recomputeMcpGating
+} from "./chunk-E2ZK5M4P.js";
 import {
   classifyApiError
 } from "./chunk-V7RNNPGC.js";
@@ -12,42 +15,37 @@ import {
   matchMcpServerByRef,
   parseExtensionRef,
   parseMcpServerRef
-} from "./chunk-Z5R4JMOL.js";
+} from "./chunk-FJ2IUWNQ.js";
 import {
   getAvailableCommands,
   handleSlashCommand,
   insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-VFAE4AGH.js";
-import {
-  recomputeMcpGating
-} from "./chunk-GA7VRJVN.js";
+} from "./chunk-CGZ5SV23.js";
 import {
   appEvents,
   buildDisabledSkillNamesProvider,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-4SLLEAQP.js";
+} from "./chunk-MJPBB2GK.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-3EUZWNWA.js";
+} from "./chunk-OPDZT2VG.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-WOT64EP2.js";
+} from "./chunk-HCJQORKC.js";
 import "./chunk-5DTTYNB7.js";
-import "./chunk-QKYTTBYW.js";
+import "./chunk-4LVZNIDO.js";
 import {
   collectContextData,
   formatContextUsageText
-} from "./chunk-NOWTNYC7.js";
+} from "./chunk-UVFCANV5.js";
 import "./chunk-4WGODMVR.js";
-import "./chunk-AYCDXHZB.js";
-import "./chunk-QOK6RMIP.js";
-import "./chunk-P2YAOGJD.js";
-import "./chunk-DA7OOKVN.js";
-import "./chunk-LZYWWWCZ.js";
+import "./chunk-IKP54WUL.js";
+import "./chunk-KF6CTNTJ.js";
 import "./chunk-YAF2MQZ6.js";
+import "./chunk-7Z6JQEL6.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   GENERATION_TIMEOUT_MS,
@@ -66,7 +64,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-TTSKHF43.js";
+} from "./chunk-BK6UOUJ2.js";
 import {
   HistoryReplayer,
   MessageEmitter,
@@ -76,21 +74,21 @@ import {
   goalTerminalEventToHistoryItem,
   recordGoalStatusItem,
   restoreGoalFromHistory
-} from "./chunk-FVS747N7.js";
-import "./chunk-KTUQMDEP.js";
+} from "./chunk-C54UTDOC.js";
+import "./chunk-4K7VDKAD.js";
+import "./chunk-V4AKJQ26.js";
 import "./chunk-RS7MT2QG.js";
-import "./chunk-CVDW42JT.js";
 import "./chunk-H2XVO6NE.js";
+import "./chunk-QHTIBUWB.js";
 import {
   isTerminalGoalStatusKind
 } from "./chunk-QTERJVPZ.js";
-import "./chunk-QHTIBUWB.js";
-import "./chunk-L573Z2QZ.js";
+import "./chunk-3Z43GZUQ.js";
 import {
   computeCpuPercent
 } from "./chunk-HGT6JR3U.js";
 import "./chunk-RXFQM6FQ.js";
-import "./chunk-N6YTEVLV.js";
+import "./chunk-HL6AKUGD.js";
 import "./chunk-6H67XLET.js";
 import {
   beginAcpBootstrapConfigProfiling,
@@ -98,32 +96,10 @@ import {
   endAcpBootstrapConfigProfiling,
   markAcpStartup
 } from "./chunk-TDKQP3M6.js";
-import {
-  createLoadedSettingsAdapter
-} from "./chunk-Z5Q65RVH.js";
+import "./chunk-UKU3NGW6.js";
 import "./chunk-LXXMOYPL.js";
-import "./chunk-7KDI2IB2.js";
+import "./chunk-HDATOR4J.js";
 import "./chunk-E5Z2AVNV.js";
-import {
-  parseSessionSource
-} from "./chunk-EVSTCA7S.js";
-import "./chunk-6RLROE6G.js";
-import "./chunk-COH43MRJ.js";
-import {
-  CHANNEL_STARTUP_PROFILE_META_KEY,
-  CHANNEL_STARTUP_PROFILE_VERSION,
-  CLIENT_MCP_OVER_WS_CONFIG_FLAG,
-  LOAD_REPLAY_BULK_MODE,
-  LOAD_REPLAY_META_KEY,
-  LOAD_REPLAY_MODE_META_KEY,
-  LOAD_REPLAY_PAGE_SIZE_META_KEY,
-  LOAD_REPLAY_VERSION,
-  MID_TURN_QUEUE_DRAIN_METHOD,
-  TODO_STOP_GUARD_QUEUE_RELEASE_METHOD
-} from "./chunk-QR6U5QPP.js";
-import {
-  ndJsonStream
-} from "./chunk-6GUTHAN7.js";
 import {
   ACP_ROUTE_ID_PREFIX,
   buildAcpModelOptions,
@@ -132,7 +108,7 @@ import {
   parseAcpModelOption,
   resolveAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-TCKTNY66.js";
+} from "./chunk-M4VFMLQK.js";
 import {
   mapSkillConfigToStatus
 } from "./chunk-2W3OOD4W.js";
@@ -142,19 +118,48 @@ import {
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-WAX3ITOA.js";
+} from "./chunk-A3TAEAHX.js";
 import {
   MAX_AUDIO_BYTES,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-B453NMZJ.js";
+} from "./chunk-M3EQ3GZC.js";
 import {
   readVoiceModel
-} from "./chunk-IB35C3IL.js";
-import "./chunk-BVLROR2T.js";
+} from "./chunk-AVQ6EX4J.js";
+import "./chunk-QLJUC7TG.js";
+import {
+  parseSessionSource
+} from "./chunk-RMY5SX7S.js";
+import "./chunk-6RLROE6G.js";
+import "./chunk-COH43MRJ.js";
+import {
+  CHANNEL_STARTUP_PROFILE_META_KEY,
+  CHANNEL_STARTUP_PROFILE_VERSION,
+  CLIENT_MCP_OVER_WS_CONFIG_FLAG,
+  LOAD_REPLAY_BULK_MODE,
+  LOAD_REPLAY_META_KEY,
+  LOAD_REPLAY_MODE_META_KEY,
+  LOAD_REPLAY_PAGE_SIZE_META_KEY,
+  LOAD_REPLAY_VERSION,
+  MID_TURN_QUEUE_DRAIN_METHOD,
+  TODO_STOP_GUARD_QUEUE_RELEASE_METHOD
+} from "./chunk-QR6U5QPP.js";
 import {
   NOT_CURRENTLY_GENERATING_CANCEL_MESSAGE
-} from "./chunk-X6YQWCIJ.js";
+} from "./chunk-UH3WSE5L.js";
+import "./chunk-Q22WWVR6.js";
+import "./chunk-FQI7LT7T.js";
+import "./chunk-57OAHC2Y.js";
+import "./chunk-GHRSKGHF.js";
+import "./chunk-6ZBPS62S.js";
+import "./chunk-V6WHFGST.js";
+import {
+  createLoadedSettingsAdapter
+} from "./chunk-VJPRLNLR.js";
+import {
+  ndJsonStream
+} from "./chunk-6HOCJNO5.js";
 import {
   ACP_PREFLIGHT_KINDS,
   IDLE_HOOK_EVENTS,
@@ -162,29 +167,23 @@ import {
   SERVE_STATUS_EXT_METHODS,
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-WXAXH7IJ.js";
-import "./chunk-KXEGCGUG.js";
-import "./chunk-JVTCARQ6.js";
-import "./chunk-57OAHC2Y.js";
-import "./chunk-OMH3276Y.js";
-import "./chunk-4ODB7WIB.js";
-import "./chunk-V6WHFGST.js";
-import {
-  assembleMcpServers,
-  loadMcpApprovals
-} from "./chunk-V25Z5UUB.js";
-import "./chunk-W7FJ3N32.js";
-import "./chunk-Y2ENGUD6.js";
+} from "./chunk-ESQHGKPJ.js";
+import "./chunk-2RFKHEXL.js";
+import "./chunk-QKTHJXCS.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
-import "./chunk-RFIAR4YL.js";
-import "./chunk-2HOVDT7W.js";
-import "./chunk-NIJEXGV6.js";
+import "./chunk-RV4C2ZFG.js";
+import "./chunk-2LI23QA6.js";
+import "./chunk-RVLZCXEE.js";
 import {
   AgentSideConnection,
   PROTOCOL_VERSION,
   RequestError
 } from "./chunk-UDXSXLER.js";
+import {
+  assembleMcpServers,
+  loadMcpApprovals
+} from "./chunk-P6PBZL3N.js";
 import {
   getOutputLanguageFilePath,
   getPersistScopeForModelSelection,
@@ -193,38 +192,39 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-KPZNOZPC.js";
+} from "./chunk-GWM4PDYK.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-GOXKNSDZ.js";
-import {
-  getSystemDefaultsPath,
-  getSystemSettingsPath
-} from "./chunk-IDS7MSUP.js";
 import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-2DXOIVUI.js";
+} from "./chunk-YLSB23Y2.js";
 import {
   findEnvFiles,
   preResolveHomeEnvOverrides,
   reloadEnvironment
-} from "./chunk-OF2BBLYQ.js";
+} from "./chunk-YNWJAOPL.js";
+import "./chunk-4CTP6VR6.js";
+import "./chunk-GOXKNSDZ.js";
+import {
+  getSystemDefaultsPath,
+  getSystemSettingsPath
+} from "./chunk-IDS7MSUP.js";
 import "./chunk-QRUIS3DN.js";
-import "./chunk-IUSNI6IX.js";
+import "./chunk-XFSFZCM5.js";
+import "./chunk-ISMD2AB3.js";
 import "./chunk-VJNBRRZG.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-MC2DOZS7.js";
+} from "./chunk-PVT6E3ZI.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
 } from "./chunk-OWAK7LMW.js";
-import "./chunk-XFSFZCM5.js";
 import {
   ALL_PROVIDERS,
   APPROVAL_MODE_INFO,
@@ -243,16 +243,20 @@ import {
   McpServerSpawnFailedError,
   McpTransportPool,
   MessageDisplayDispatcher,
+  PLAN_MODE_ENTRY_SIBLING_SKIP_MESSAGE,
   POOLED_TRANSPORTS_DEFAULT,
   SESSION_ARTIFACT_PERSISTENCE_VERSION,
   SESSION_TITLE_MAX_LENGTH,
   SESSION_TRANSCRIPT_MAX_LIMIT,
   SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
+  SESSION_WRITER_RPC_CODES,
   SessionService,
   SessionTranscriptPageTooLargeError,
   SessionTranscriptReader,
   SessionTranscriptSnapshotUnavailableError,
   SessionTranscriptTooLargeError,
+  SessionWriterError,
+  SessionWriterUnavailableError,
   TURN_INTERRUPTION_HISTORY_TAIL_COUNT,
   WorkspaceMcpBudget,
   abortGoalForStopHookCap,
@@ -260,6 +264,7 @@ import {
   applyAutoModeDecision,
   applyProviderInstallPlan,
   approxBase64Bytes,
+  bridgeToolResultImages,
   buildBackgroundEntryLabel,
   buildBtwCacheSafeParams,
   buildBtwPrompt,
@@ -272,13 +277,18 @@ import {
   convertToFunctionErrorResponse,
   convertToFunctionResponse,
   createDuplicateProviderToolCallResponse,
+  decorateClassifierUnavailableConfirmation,
+  decoratePlanModeShellConfirmation,
   dedupeToolCallsById,
   detectAutonomousSentinel,
   detectLoopSentinel,
   encodeSessionTranscriptCursor,
   evaluateAutoMode,
   evaluatePermissionFlow,
+  evaluatePlanModeShellPolicy,
+  finalizeToolResponses,
   findExistingProviderModels,
+  findPlanModeEntryBatchBoundaryIndex,
   findProviderById,
   findRepeatedDuplicateProviderToolCall,
   fireNotificationHook,
@@ -301,21 +311,19 @@ import {
   getPlanModeSystemReminder,
   getProviderToolCallId,
   getScopedEnvContents,
-  getStartupContextLength,
+  getStopHookContinuationReason,
   ideContextStore,
   injectPermissionRulesIfMissing,
   isApproveOutcome,
   isDenialFallbackReason,
   isGatedMcpScope,
   isPlanModeBlocked,
-  isSystemReminderContent,
   markDuplicateProviderToolCallResponseSent,
   matchesAnyServerPattern,
   mcpServerRequiresOAuth,
   needsConfirmation,
   normalizeEventPayload,
   normalizeSnapshotPayload,
-  parsePositiveIntegerEnv,
   persistPermissionOutcome,
   readManyFiles,
   recordAllow,
@@ -337,45 +345,57 @@ import {
   shouldRunAutoModeForCall,
   subagentGenerator,
   unregisterGoalHook,
-  updateSetting
-} from "./chunk-6OH6A5EX.js";
-import "./chunk-5M6IDOMF.js";
+  updateSetting,
+  validatePlanModeShellApproval,
+  validatePlanModeShellContext
+} from "./chunk-BLAEKN6K.js";
 import "./chunk-T4TZQJ7W.js";
 import {
   external_exports
 } from "./chunk-H6XPXXMH.js";
-import "./chunk-OONJNQ42.js";
-import "./chunk-JDI67JFB.js";
+import "./chunk-5M6IDOMF.js";
+import "./chunk-T2L47JJK.js";
+import "./chunk-GPSKDNEE.js";
+import "./chunk-X6N25LXS.js";
+import "./chunk-E2UVIFI2.js";
+import "./chunk-L5F3T6TQ.js";
+import "./chunk-Q2YKNMLS.js";
 import "./chunk-XU457J4V.js";
 import "./chunk-VDDGDZMA.js";
-import "./chunk-EIAK6Q2B.js";
-import "./chunk-FSL5W5TI.js";
-import "./chunk-D2VIDMVM.js";
-import "./chunk-E2UVIFI2.js";
-import "./chunk-WBTZGWQ6.js";
+import "./chunk-KHOVYUHX.js";
 import "./chunk-SZRN75WQ.js";
-import "./chunk-HTO4JFDZ.js";
+import {
+  parsePositiveIntegerEnv
+} from "./chunk-6PVPNMXU.js";
 import "./chunk-CPBF7KYF.js";
+import "./chunk-NABLFI57.js";
+import {
+  HookEventName,
+  createHookOutput
+} from "./chunk-QBUDF33N.js";
+import "./chunk-LIZRAKPB.js";
 import {
   APPROVAL_MODES,
   FORK_SUBAGENT_TYPE,
+  getStartupContextLength,
+  isSystemReminderContent,
   runWithRuntimeContentGenerator
-} from "./chunk-ETD6K42I.js";
+} from "./chunk-WHGVTP7Q.js";
 import "./chunk-6AM5D4ME.js";
-import "./chunk-G45X5TRN.js";
-import {
-  HookEventName,
-  createHookOutput
-} from "./chunk-PBATSWUQ.js";
-import "./chunk-ZEOZL37W.js";
-import "./chunk-OOCI5VVU.js";
+import "./chunk-JCW2R7WC.js";
+import "./chunk-57FIIFJN.js";
+import "./chunk-HTO4JFDZ.js";
 import {
   clearCachedCredentialFile,
   qwenOAuth2Events
-} from "./chunk-UQES76OO.js";
-import "./chunk-OKWRU4NO.js";
-import "./chunk-XNP57UDV.js";
+} from "./chunk-2HGTVAOW.js";
 import "./chunk-JESCGQM3.js";
+import "./chunk-RC7A7SSL.js";
+import "./chunk-C3EXYVFX.js";
+import "./chunk-XVNQMZ2I.js";
+import "./chunk-FODK6UMO.js";
+import "./chunk-GLNBDYUX.js";
+import "./chunk-DJ2GSRLV.js";
 import {
   AuthType,
   ConversationFinishedEvent,
@@ -383,8 +403,6 @@ import {
   LoopDetectedEvent,
   PromptSuggestionEvent,
   UserPromptEvent,
-  endToolExecutionSpan,
-  endToolSpan,
   extractDaemonTraceContext,
   formatFullTurnVisionNotice,
   formatVisionBridgeNotice,
@@ -400,63 +418,63 @@ import {
   logUserPrompt,
   normalizeParts,
   registerAcpEventLoopLagGauge,
-  runInToolSpanContext,
   runSideQuery,
   runVisionBridge,
   shouldRunVisionBridge,
   splitImageParts,
   startEventLoopLagMonitor,
-  startToolExecutionSpan,
-  startToolSpan,
   uiTelemetryService,
-  withDaemonSpan,
-  withInteractionSpan
-} from "./chunk-ONWW74X6.js";
-import "./chunk-4WKAA4KS.js";
-import "./chunk-CR3C7WXL.js";
+  withDaemonSpan
+} from "./chunk-U6TQGUNB.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   getAutoMemoryRoot,
   getUserAutoMemoryRoot
-} from "./chunk-JD3MKVKL.js";
-import "./chunk-UEY4AYUL.js";
-import "./chunk-BDBMYST4.js";
-import "./chunk-467G3SV5.js";
-import {
-  ToolConfirmationOutcome,
-  ToolNames,
-  isShellProgressData
-} from "./chunk-S35ZDXOS.js";
-import "./chunk-XVNQMZ2I.js";
-import "./chunk-FODK6UMO.js";
-import "./chunk-GLNBDYUX.js";
-import "./chunk-DJ2GSRLV.js";
-import "./chunk-6EFTQYW7.js";
+} from "./chunk-4K56OJFJ.js";
 import {
   DEFAULT_TOKEN_LIMIT,
   getToolCallPreparations,
   tokenLimit
-} from "./chunk-MAQQGNQ5.js";
+} from "./chunk-CBOQ3HY7.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
+import "./chunk-QNLNLENL.js";
+import "./chunk-6X4GWOPW.js";
 import "./chunk-TYQMGACW.js";
 import "./chunk-TYAMGABM.js";
 import "./chunk-FCMNKVXT.js";
+import {
+  endToolExecutionSpan,
+  endToolSpan,
+  runInToolSpanContext,
+  startToolExecutionSpan,
+  startToolSpan,
+  withInteractionSpan
+} from "./chunk-RCUEYZDE.js";
+import "./chunk-HTR4WV6U.js";
+import "./chunk-BULDBTYC.js";
+import "./chunk-U7ZFW55U.js";
+import "./chunk-NPQDJGKU.js";
+import {
+  ToolConfirmationOutcome,
+  ToolNames,
+  isShellProgressData
+} from "./chunk-YM3SZTH4.js";
 import {
   Storage,
   createDebugLogger,
   getErrorMessage,
   getErrorStatus,
   isSubpath
-} from "./chunk-C27BYUX6.js";
-import "./chunk-MKLKHZAK.js";
+} from "./chunk-OQB4EXO4.js";
+import "./chunk-LU3RXCM7.js";
 import {
   runExitCleanup
-} from "./chunk-FLTN6NRU.js";
+} from "./chunk-O4OT3DM3.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
-import "./chunk-TB6UDU4T.js";
+import "./chunk-THJNPLI4.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -466,7 +484,7 @@ import {
 
 // packages/cli/src/acp-integration/acpAgent.ts
 init_esbuild_shims();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { performance } from "node:perf_hooks";
 
 // packages/cli/src/acp-integration/authMethods.ts
@@ -844,6 +862,7 @@ __name(isInactiveExtensionSkill, "isInactiveExtensionSkill");
 // packages/cli/src/acp-integration/session/Session.ts
 init_esbuild_shims();
 import { Buffer as Buffer2 } from "node:buffer";
+import { randomUUID } from "node:crypto";
 import { existsSync as existsSync2, statSync as statSync2 } from "node:fs";
 import * as os2 from "node:os";
 import * as path3 from "node:path";
@@ -968,8 +987,23 @@ function supportsHideAlwaysAllow(confirmation) {
 }
 __name(supportsHideAlwaysAllow, "supportsHideAlwaysAllow");
 function filterAlwaysAllowOptions(confirmation, options, forceHideAlwaysAllow = false) {
-  const hideAlwaysAllow = forceHideAlwaysAllow || supportsHideAlwaysAllow(confirmation) && confirmation.hideAlwaysAllow === true;
-  return hideAlwaysAllow ? options.filter((option) => option.kind !== "allow_always") : options;
+  const hideAlwaysAllow = forceHideAlwaysAllow || confirmation.autoModeFallback !== void 0 || supportsHideAlwaysAllow(confirmation) && confirmation.hideAlwaysAllow === true;
+  const visibleOptions = hideAlwaysAllow ? options.filter((option) => option.kind !== "allow_always") : options;
+  if (!confirmation.autoModeFallback) return visibleOptions;
+  const switchOption = {
+    optionId: "proceed_once_and_switch_to_default" /* ProceedOnceAndSwitchToDefault */,
+    name: "Switch to Default Mode and allow once (recommended)",
+    kind: "allow_once"
+  };
+  const rejectIndex = visibleOptions.findIndex(
+    (option) => option.kind === "reject_once"
+  );
+  if (rejectIndex === -1) return [...visibleOptions, switchOption];
+  return [
+    ...visibleOptions.slice(0, rejectIndex),
+    switchOption,
+    ...visibleOptions.slice(rejectIndex)
+  ];
 }
 __name(filterAlwaysAllowOptions, "filterAlwaysAllowOptions");
 function formatExecPermissionScopeLabel(confirmation) {
@@ -997,6 +1031,22 @@ function interactionMetaFields(confirmation) {
 __name(interactionMetaFields, "interactionMetaFields");
 function buildPermissionRequestContent(confirmation) {
   const content = [];
+  if (confirmation.autoModeFallback) {
+    content.push({
+      type: "content",
+      content: {
+        type: "text",
+        text: confirmation.autoModeFallback.message
+      }
+    });
+  }
+  const warnings = confirmation.type === "exec" || confirmation.type === "edit" ? confirmation.warnings ?? [] : [];
+  for (const warning of warnings) {
+    content.push({
+      type: "content",
+      content: { type: "text", text: warning }
+    });
+  }
   if (confirmation.type === "edit") {
     content.push({
       type: "diff",
@@ -1017,6 +1067,56 @@ function buildPermissionRequestContent(confirmation) {
   return content;
 }
 __name(buildPermissionRequestContent, "buildPermissionRequestContent");
+function permissionAbortError(signal) {
+  return signal.reason instanceof Error ? signal.reason : new Error("Permission request was aborted.");
+}
+__name(permissionAbortError, "permissionAbortError");
+function requestPermissionWithAbort(client, params, signal) {
+  if (signal.aborted) {
+    return Promise.reject(permissionAbortError(signal));
+  }
+  return new Promise((resolve5, reject) => {
+    let settled = false;
+    const finish = /* @__PURE__ */ __name((callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    }, "finish");
+    const onAbort = /* @__PURE__ */ __name(() => finish(() => reject(permissionAbortError(signal))), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    let request;
+    try {
+      request = client.requestPermission(params);
+    } catch (error) {
+      finish(() => reject(error));
+      return;
+    }
+    request.then(
+      (response) => finish(() => resolve5(response)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+__name(requestPermissionWithAbort, "requestPermissionWithAbort");
+function resolvePermissionOutcome(response, offeredOptions) {
+  if (response.outcome.outcome === "cancelled") {
+    return "cancel" /* Cancel */;
+  }
+  const optionId = response.outcome.optionId;
+  if (!offeredOptions.some((option) => option.optionId === optionId)) {
+    throw new Error(
+      `Permission response selected unoffered option: ${optionId}`
+    );
+  }
+  if (!Object.values(ToolConfirmationOutcome).includes(
+    optionId
+  )) {
+    throw new Error(`Permission response selected invalid option: ${optionId}`);
+  }
+  return optionId;
+}
+__name(resolvePermissionOutcome, "resolvePermissionOutcome");
 function toPermissionOptions(confirmation, forceHideAlwaysAllow = false) {
   switch (confirmation.type) {
     case "edit":
@@ -1243,9 +1343,13 @@ var SubAgentTracker = class {
         }, "onConfirm")
       };
       const { title, locations, kind } = this.toolCallEmitter.resolveToolMetadata(event.name, state?.args);
+      const permissionOptions = toPermissionOptions(fullConfirmationDetails);
+      const offeredPermissionOptions = permissionOptions.map((option) => ({
+        ...option
+      }));
       const params = {
         sessionId: this.ctx.sessionId,
-        options: toPermissionOptions(fullConfirmationDetails),
+        options: permissionOptions,
         toolCall: {
           toolCallId: event.callId,
           status: "pending",
@@ -1266,8 +1370,15 @@ var SubAgentTracker = class {
         }
       };
       try {
-        const output = await this.client.requestPermission(params);
-        const outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
+        const output = await requestPermissionWithAbort(
+          this.client,
+          params,
+          abortSignal
+        );
+        const outcome = resolvePermissionOutcome(
+          output,
+          offeredPermissionOptions
+        );
         await event.respond(outcome, {
           answers: "answers" in output ? output.answers : void 0
         });
@@ -1859,6 +1970,10 @@ function maskApiKeyForDisplay(apiKey) {
   return `${trimmed.slice(0, 3)}...${trimmed.slice(-4)}`;
 }
 __name(maskApiKeyForDisplay, "maskApiKeyForDisplay");
+function getAbortAwareEndTurnStopReason(signal) {
+  return signal.aborted ? "cancelled" : "end_turn";
+}
+__name(getAbortAwareEndTurnStopReason, "getAbortAwareEndTurnStopReason");
 var DAEMON_INVALID_TOOL_PARAMS_THRESHOLD = 3;
 var PERMISSION_CANCEL_SKIP_MESSAGE = "Skipped because a permission request was cancelled before the user answered; user input is required before continuing.";
 var LOOP_DETECTED_SKIP_MESSAGE = "Skipped because loop detection stopped the current turn before this tool call could run.";
@@ -2310,7 +2425,7 @@ var Session = class {
     this.client = client;
     this.settings = settings;
     this.sessionId = id;
-    this.runtimeBaseDir = Storage.getRuntimeBaseDir();
+    this.runtimeBaseDir = config.storage.getRuntimeBaseDir();
     const todoStopGuardEnabled = this.settings.merged.experimental?.todoStopGuard === true && !this.config.getBareMode() && !this.config.isSafeMode();
     this.todoStopGuard = new DaemonTodoStopGuard(todoStopGuardEnabled);
     this.todoStopGuardBackgroundBaseline = todoStopGuardEnabled ? this.#captureTodoStopGuardBackgroundBaseline() : {
@@ -2341,6 +2456,7 @@ var Session = class {
    * process termination is slow.
    */
   pendingPromptCompletion = null;
+  automaticDrainRetry = null;
   /**
    * Per-turn AbortController for the fire-and-forget follow-up suggestion
    * generation. Aborted on the top of the next `prompt()` and on
@@ -2403,6 +2519,9 @@ var Session = class {
   // or session reload), which would otherwise execute orphaned cron prompts
   // on a session whose registries are already unregistered.
   disposed = false;
+  closing = false;
+  closeGateCompletion = null;
+  resolveCloseGate = null;
   unsubscribeChatRecordingFailure;
   // Modular components
   historyReplayer;
@@ -2637,7 +2756,7 @@ var Session = class {
    * mount.
    */
   startCronScheduler() {
-    this.#startCronSchedulerIfNeeded().catch((error) => {
+    this.#startCronSchedulerInRuntime().catch((error) => {
       debugLogger6.warn(
         `Cron scheduler startup failed [session ${this.sessionId}]: ${error}`
       );
@@ -2646,8 +2765,95 @@ var Session = class {
   getConfig() {
     return this.config;
   }
+  async assertCanStartTurn() {
+    if (this.closing) {
+      throw RequestError.invalidParams(void 0, "Session is closing");
+    }
+    try {
+      await this.config.assertCanStartTurn();
+    } catch (error) {
+      if (error instanceof SessionWriterError) {
+        throw new RequestError(error.rpcCode, error.message, {
+          errorKind: error.errorKind
+        });
+      }
+      throw error;
+    }
+    if (this.closing) {
+      throw RequestError.invalidParams(void 0, "Session is closing");
+    }
+  }
   isIdle() {
-    return !this.pendingPrompt && !this.pendingPromptCompletion && !this.cronProcessing && !this.cronAbortController && !this.notificationProcessing && !this.notificationAbortController;
+    return !this.closing && !this.#hasActiveTurn();
+  }
+  #hasActiveTurn() {
+    return Boolean(
+      this.pendingPrompt || this.pendingPromptCompletion || this.cronProcessing || this.cronAbortController || this.cronCompletion || this.notificationProcessing || this.notificationAbortController || this.notificationCompletion
+    );
+  }
+  beginClose() {
+    if (this.closing) {
+      throw RequestError.invalidParams(
+        void 0,
+        "Session close is already in progress"
+      );
+    }
+    this.closing = true;
+    let resolveGate;
+    const completion = new Promise((resolve5) => {
+      resolveGate = resolve5;
+    });
+    this.closeGateCompletion = completion;
+    this.resolveCloseGate = resolveGate;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      if (this.closeGateCompletion === completion) {
+        this.closeGateCompletion = null;
+        this.resolveCloseGate = null;
+      }
+      resolveGate();
+      if (this.disposed) return;
+      this.closing = false;
+      void this.#drainCronQueue();
+      void this.#drainNotificationQueue();
+    };
+  }
+  beginCloseIfAvailable() {
+    if (this.disposed) {
+      throw RequestError.invalidParams(void 0, "Session has been disposed");
+    }
+    return this.closing ? null : this.beginClose();
+  }
+  waitForCloseGateToRelease() {
+    return this.closeGateCompletion ?? Promise.resolve();
+  }
+  async waitForActiveTurnsToSettle() {
+    const pending = [
+      this.pendingPromptCompletion,
+      this.cronCompletion,
+      this.notificationCompletion
+    ].filter((completion) => completion !== null);
+    await Promise.allSettled(pending);
+  }
+  #deferAutomaticQueueDrainUntilTurnsSettle() {
+    const completions = [
+      this.pendingPromptCompletion,
+      this.cronCompletion,
+      this.notificationCompletion
+    ].filter((completion) => completion !== null);
+    if (completions.length === 0) return false;
+    if (this.automaticDrainRetry) return true;
+    const retry = Promise.allSettled(completions).then(() => {
+      if (this.automaticDrainRetry !== retry) return;
+      this.automaticDrainRetry = null;
+      if (this.disposed) return;
+      void this.#drainCronQueue();
+      void this.#drainNotificationQueue();
+    });
+    this.automaticDrainRetry = retry;
+    return true;
   }
   getTurnCount() {
     return this.turn;
@@ -2657,6 +2863,10 @@ var Session = class {
   }
   dispose() {
     this.disposed = true;
+    this.closing = true;
+    this.resolveCloseGate?.();
+    this.resolveCloseGate = null;
+    this.closeGateCompletion = null;
     this.todoStopGuardQueuedPromptPriority = false;
     this.todoStopGuardDrainAutomaticQueuesWhenIdle = false;
     this.todoStopGuard.clearTrust();
@@ -2673,7 +2883,7 @@ var Session = class {
     this.cronProcessing = false;
     this.cronCompletion = null;
     if (this.config.isCronEnabled()) {
-      this.config.getCronScheduler().stop();
+      this.#stopCronSchedulerInRuntime();
     }
     this.config.getBackgroundTaskRegistry().setNotificationCallback(void 0);
     this.config.getMonitorRegistry().setNotificationCallback(void 0);
@@ -2757,7 +2967,7 @@ var Session = class {
         "targetTurnIndex must be a non-negative integer"
       );
     }
-    if (this.pendingPrompt || this.cronProcessing || this.cronAbortController || this.notificationProcessing || this.notificationAbortController) {
+    if (this.closing || this.#hasActiveTurn()) {
       throw RequestError.invalidParams(
         void 0,
         "Cannot rewind while a prompt is running"
@@ -2814,7 +3024,7 @@ var Session = class {
     return count;
   }
   restoreHistory(history) {
-    if (this.pendingPrompt || this.cronProcessing || this.cronAbortController || this.notificationProcessing || this.notificationAbortController) {
+    if (this.closing || this.#hasActiveTurn()) {
       throw RequestError.invalidParams(
         void 0,
         "Cannot restore history while a prompt is running"
@@ -2888,13 +3098,17 @@ var Session = class {
     const scheduler = this.config.isCronEnabled() ? this.config.getCronScheduler() : null;
     if (scheduler) {
       const summary = scheduler.getExitSummary();
-      scheduler.stop();
+      this.#stopCronSchedulerInRuntime();
       if (summary) {
         await this.messageEmitter.emitAgentMessage(summary);
       }
     }
   }
   async prompt(params) {
+    if (this.closing) {
+      throw RequestError.invalidParams(void 0, "Session is closing");
+    }
+    await this.assertCanStartTurn();
     const todoStopGuardPreparation = this.#prepareTodoStopGuardForPrompt(params);
     this.pendingPrompt?.abort();
     const pendingSend = new AbortController();
@@ -2954,6 +3168,13 @@ var Session = class {
       void this.#drainNotificationQueue();
       this.#maybeEmitFollowupSuggestion(result);
       return result;
+    } catch (error) {
+      if (error instanceof SessionWriterError) {
+        throw new RequestError(error.rpcCode, error.message, {
+          errorKind: error.errorKind
+        });
+      }
+      throw error;
     } finally {
       this.pendingPrompt = null;
       const shouldDrainAutomaticQueues = todoStopGuardPreparation.drainSupersededAutomaticQueues || this.todoStopGuardDrainAutomaticQueuesWhenIdle || this.todoStopGuard.blocksUnrelatedAutomaticTurns || this.todoStopGuard.hasCommittedContinuation || this.todoStopGuardQueuedPromptPriority;
@@ -2962,7 +3183,7 @@ var Session = class {
         void this.#drainCronQueue();
         void this.#drainNotificationQueue();
       }
-      void this.#startCronSchedulerIfNeeded();
+      void this.#startCronSchedulerInRuntime();
       resolveCompletion();
       this.pendingPromptCompletion = null;
     }
@@ -3096,6 +3317,10 @@ var Session = class {
       this.runtimeBaseDir,
       this.config.getWorkingDir(),
       async () => {
+        await this.assertCanStartTurn();
+        if (pendingSend.signal.aborted) {
+          return { stopReason: "cancelled" };
+        }
         this.turn += 1;
         const promptId = this.config.getSessionId() + "########" + this.turn;
         const parentContext = extractDaemonTraceContext(params);
@@ -3162,6 +3387,9 @@ var Session = class {
             let parts;
             let fullTurnModelOverride;
             const onFullTurnModel = /* @__PURE__ */ __name((model) => {
+              if (fullTurnModelOverride === model) {
+                return true;
+              }
               if (fullTurnModelOverride) {
                 return false;
               }
@@ -3397,7 +3625,8 @@ ${this.pendingWorktreeNotice}
                       pendingSend.signal,
                       promptId,
                       functionCalls,
-                      toolLoopState
+                      toolLoopState,
+                      onFullTurnModel
                     )
                   );
                   if (toolRun.stopAfterPermissionCancel) {
@@ -3406,7 +3635,11 @@ ${this.pendingWorktreeNotice}
                       toolRun,
                       pendingSend.signal
                     );
-                    return { stopReason: "end_turn" };
+                    return {
+                      stopReason: getAbortAwareEndTurnStopReason(
+                        pendingSend.signal
+                      )
+                    };
                   }
                   const nextAfterTools = await this.#buildNextMessageAfterToolRun(
                     toolRun,
@@ -3420,7 +3653,11 @@ ${this.pendingWorktreeNotice}
                       toolRun,
                       pendingSend.signal
                     );
-                    return { stopReason: "end_turn" };
+                    return {
+                      stopReason: getAbortAwareEndTurnStopReason(
+                        pendingSend.signal
+                      )
+                    };
                   }
                 }
               }
@@ -3455,6 +3692,9 @@ ${this.pendingWorktreeNotice}
     let stopHookIterationCount = 0;
     let stopHookReasons = [];
     const onFullTurnModel = /* @__PURE__ */ __name((model) => {
+      if (modelOverride === model) {
+        return true;
+      }
       if (modelOverride) {
         return false;
       }
@@ -3465,7 +3705,7 @@ ${this.pendingWorktreeNotice}
     while (true) {
       if (pendingSend.signal.aborted) {
         this.todoStopGuard.suspend();
-        return { stopReason: "end_turn" };
+        return { stopReason: "cancelled" };
       }
       if (this.config.getApprovalMode() === "plan" /* PLAN */) {
         this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
@@ -3568,7 +3808,7 @@ ${this.pendingWorktreeNotice}
           await this.messageEmitter.emitAgentMessage(stopOutput.systemMessage);
         }
         if (stopOutput?.isBlockingDecision() || stopOutput?.shouldStopExecution()) {
-          externalReason = stopOutput.getEffectiveReason();
+          externalReason = getStopHookContinuationReason(stopOutput);
           stopHookIterationCount++;
           stopHookReasons = [...stopHookReasons, externalReason];
           stopHookCount = response.stopHookCount ?? 1;
@@ -3907,7 +4147,8 @@ ${this.pendingWorktreeNotice}
             pendingSend.signal,
             toolPromptId,
             functionCalls,
-            toolLoopState
+            toolLoopState,
+            options.onFullTurnModel
           )
         );
         if (toolRun.stopAfterPermissionCancel || toolRun.loopDetected) {
@@ -3915,7 +4156,7 @@ ${this.pendingWorktreeNotice}
           await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
           return {
             kind: "terminal",
-            stopReason: "end_turn",
+            stopReason: getAbortAwareEndTurnStopReason(pendingSend.signal),
             ...supersededAutomaticContinuation ? { supersededAutomaticContinuation: true } : {}
           };
         }
@@ -4164,13 +4405,18 @@ ${this.pendingWorktreeNotice}
     }
   }
   async #preserveStoppedToolRun(toolRun, abortSignal) {
+    const midTurnParts = abortSignal.aborted ? await this.#buildMidTurnParts(
+      this.#takeRecoveredMidTurnMessages(),
+      abortSignal,
+      { preserveFallbackOnAbort: true }
+    ) : await this.#drainMidTurnUserMessages(abortSignal);
     this.#preserveUnsentMessageHistory(
       {
         role: "user",
         parts: [
           ...toolRun.parts,
           ...toolRun.loopDetected ? [{ text: LOOP_DETECTED_CONTEXT_MESSAGE }] : [],
-          ...await this.#drainMidTurnUserMessages(abortSignal)
+          ...midTurnParts
         ]
       },
       true
@@ -4285,11 +4531,7 @@ ${this.pendingWorktreeNotice}
     const recovered = this.#takeRecoveredMidTurnMessages();
     if (this.midTurnDrainUnavailable) {
       return {
-        parts: await this.#buildMidTurnParts(
-          recovered,
-          abortSignal,
-          options.onFullTurnModel
-        ),
+        parts: await this.#buildMidTurnParts(recovered, abortSignal, options),
         hasQueuedPrompt: false
       };
     }
@@ -4317,7 +4559,7 @@ ${this.pendingWorktreeNotice}
         parts: await this.#buildMidTurnParts(
           [...recovered, ...parseMidTurnDrainResponse(response)],
           abortSignal,
-          options.onFullTurnModel
+          options
         ),
         hasQueuedPrompt: isRecord2(response) && response["hasQueuedPrompt"] === true
       };
@@ -4337,11 +4579,7 @@ ${this.pendingWorktreeNotice}
         `Mid-turn queue drain ${isPermanentError ? "permanently " : ""}unavailable [session ${this.sessionId}]: ${errorMessage}`
       );
       return {
-        parts: await this.#buildMidTurnParts(
-          recovered,
-          abortSignal,
-          options.onFullTurnModel
-        ),
+        parts: await this.#buildMidTurnParts(recovered, abortSignal, options),
         hasQueuedPrompt: false
       };
     }
@@ -4401,7 +4639,7 @@ ${this.pendingWorktreeNotice}
    * happens on injection (here), so a message recovered from an earlier
    * timed-out drain is still recorded exactly once.
    */
-  async #buildMidTurnParts(messages, abortSignal, onFullTurnModel) {
+  async #buildMidTurnParts(messages, abortSignal, options = {}) {
     const parts = [];
     for (const message of messages) {
       const displayText = message.kind === "text" ? message.message : message.displayText;
@@ -4411,13 +4649,19 @@ ${this.pendingWorktreeNotice}
           abortSignal,
           MID_TURN_QUEUE_RESOLVE_TIMEOUT_MS,
           (signal) => this.#resolvePrompt(message.content, signal, {
-            onFullTurnModel
+            onFullTurnModel: options.onFullTurnModel
           })
         );
       } catch (messageError) {
-        if (abortSignal.aborted) return parts;
-        const errorMessage = this.#formatError(messageError);
-        debugLogger6.warn(`Failed to resolve mid-turn message: ${errorMessage}`);
+        if (abortSignal.aborted && !options.preserveFallbackOnAbort) {
+          return parts;
+        }
+        if (!abortSignal.aborted) {
+          const errorMessage = this.#formatError(messageError);
+          debugLogger6.warn(
+            `Failed to resolve mid-turn message: ${errorMessage}`
+          );
+        }
         rawParts = [{ text: displayText }];
         if (message.kind === "structured" && hasInlineMediaContentBlock(message.content)) {
           rawParts.push({ text: MID_TURN_ATTACHMENT_PROCESSING_FAILURE_TEXT });
@@ -4459,6 +4703,20 @@ ${this.pendingWorktreeNotice}
       void this.#drainCronQueue();
     });
   }
+  #startCronSchedulerInRuntime() {
+    return Storage.runWithRuntimeBaseDir(
+      this.runtimeBaseDir,
+      this.config.getWorkingDir(),
+      () => this.#startCronSchedulerIfNeeded()
+    );
+  }
+  #stopCronSchedulerInRuntime() {
+    Storage.runWithRuntimeBaseDir(
+      this.runtimeBaseDir,
+      this.config.getWorkingDir(),
+      () => this.config.getCronScheduler().stop()
+    );
+  }
   #enqueueCronPrompt(item) {
     if ((this.todoStopGuard.blocksUnrelatedAutomaticTurns || this.todoStopGuardQueuedPromptPriority) && !this.#cronContinuesTodoStopGuardWorkChain(item)) {
       if (item.taskId) {
@@ -4489,10 +4747,24 @@ ${this.pendingWorktreeNotice}
    */
   async #drainCronQueue() {
     if (this.disposed) return;
+    if (this.closing) return;
     if (this.cronProcessing) return;
     if (this.pendingPrompt) return;
     if (this.notificationProcessing) return;
+    if (this.#deferAutomaticQueueDrainUntilTurnsSettle()) return;
     if (this.#nextCronQueueIndex() < 0) return;
+    try {
+      await this.assertCanStartTurn();
+    } catch (error) {
+      debugLogger6.warn(
+        `Cron turn rejected [session ${this.sessionId}]: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return;
+    }
+    if (this.disposed || this.closing || this.cronProcessing || this.pendingPrompt || this.notificationProcessing || this.#nextCronQueueIndex() < 0) {
+      return;
+    }
+    if (this.#deferAutomaticQueueDrainUntilTurnsSettle()) return;
     this.cronProcessing = true;
     let resolveCompletion;
     this.cronCompletion = new Promise((resolve5) => {
@@ -4514,7 +4786,7 @@ ${this.pendingWorktreeNotice}
       if (this.config.isCronEnabled()) {
         const scheduler = this.config.getCronScheduler();
         if (!scheduler.hasPendingWork) {
-          scheduler.stop();
+          this.#stopCronSchedulerInRuntime();
         }
       }
     }
@@ -4581,6 +4853,8 @@ ${this.pendingWorktreeNotice}
           async () => {
             let turnCount = 0;
             try {
+              await this.assertCanStartTurn();
+              if (ac.signal.aborted) return;
               const loopMode = detectLoopSentinel(prompt);
               const autonomousMode = loopMode ? null : detectAutonomousSentinel(prompt);
               let loopTick = null;
@@ -4910,12 +5184,26 @@ ${this.pendingWorktreeNotice}
   }
   async #drainNotificationQueue() {
     if (this.disposed) return;
+    if (this.closing) return;
     if (this.notificationProcessing) return;
     if (this.pendingPrompt || this.cronProcessing || this.cronAbortController) {
       return;
     }
+    if (this.#deferAutomaticQueueDrainUntilTurnsSettle()) return;
     if (this.notificationQueue.length === 0) return;
     if (this.#nextNotificationQueueIndex() < 0) return;
+    try {
+      await this.assertCanStartTurn();
+    } catch (error) {
+      debugLogger6.warn(
+        `Notification turn rejected [session ${this.sessionId}]: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return;
+    }
+    if (this.disposed || this.closing || this.notificationProcessing || this.pendingPrompt || this.cronProcessing || this.cronAbortController || this.#nextNotificationQueueIndex() < 0) {
+      return;
+    }
+    if (this.#deferAutomaticQueueDrainUntilTurnsSettle()) return;
     this.notificationProcessing = true;
     let resolveCompletion;
     this.notificationCompletion = new Promise((resolve5) => {
@@ -4965,6 +5253,8 @@ ${this.pendingWorktreeNotice}
         );
         const promptId = this.config.getSessionId() + "########notification" + Date.now();
         try {
+          await this.assertCanStartTurn();
+          if (ac.signal.aborted) return;
           await this.#emitBackgroundNotificationDisplay(item);
           const notificationParts = [{ text: item.modelText }];
           this.config.getChatRecordingService()?.recordNotification(notificationParts, item.displayText);
@@ -5094,7 +5384,9 @@ ${this.pendingWorktreeNotice}
               if (toolRun.stopAfterPermissionCancel) {
                 this.todoStopGuard.suspend();
                 await this.#preserveStoppedToolRun(toolRun, ac.signal);
-                await this.#emitBackgroundNotificationEndTurn("end_turn");
+                await this.#emitBackgroundNotificationEndTurn(
+                  getAbortAwareEndTurnStopReason(ac.signal)
+                );
                 return;
               }
               const nextAfterTools = await this.#buildNextMessageAfterToolRun(
@@ -5105,7 +5397,9 @@ ${this.pendingWorktreeNotice}
               if (toolRun.loopDetected) {
                 this.todoStopGuard.suspend();
                 await this.#preserveStoppedToolRun(toolRun, ac.signal);
-                await this.#emitBackgroundNotificationEndTurn("end_turn");
+                await this.#emitBackgroundNotificationEndTurn(
+                  getAbortAwareEndTurnStopReason(ac.signal)
+                );
                 return;
               }
             }
@@ -5123,7 +5417,9 @@ ${this.pendingWorktreeNotice}
               false
             )).stopReason;
           }
-          await this.#emitBackgroundNotificationEndTurn(stopReason);
+          await this.#emitBackgroundNotificationEndTurn(
+            ac.signal.aborted ? "cancelled" : stopReason
+          );
         } catch (error) {
           if (ac.signal.aborted) {
             this.todoStopGuard.suspend();
@@ -5414,10 +5710,48 @@ ${this.pendingWorktreeNotice}
    * sequential batch to preserve the implicit ordering the model may rely
    * on. Response-part ordering matches the original `functionCalls` order.
    */
-  async runToolCalls(abortSignal, promptId, functionCalls, toolLoopState) {
+  async runToolCalls(abortSignal, promptId, functionCalls, toolLoopState, onFullTurnModel) {
     const dedupedFunctionCalls = dedupeToolCallsById(functionCalls);
+    const generatedCallIdBase = randomUUID();
+    const executionCallIds = new Map(
+      dedupedFunctionCalls.map((functionCall, index) => [
+        functionCall,
+        functionCall.id ?? `${functionCall.name ?? "tool"}-${generatedCallIdBase}-${index}`
+      ])
+    );
+    const pendingToolResultRecords = [];
+    let toolResultRecordSequence = 0;
+    const queueToolResultRecord = /* @__PURE__ */ __name((fc, record) => {
+      pendingToolResultRecords.push({
+        ...record,
+        ordinal: dedupedFunctionCalls.indexOf(fc),
+        sequence: toolResultRecordSequence++
+      });
+    }, "queueToolResultRecord");
+    const finalizeRunToolResult = /* @__PURE__ */ __name(async (result) => {
+      if (pendingToolResultRecords.length === 0) return result;
+      const orderedRecords = [...pendingToolResultRecords].sort(
+        (left, right) => left.ordinal - right.ordinal || left.sequence - right.sequence
+      );
+      const finalized = await finalizeToolResponses(
+        this.config,
+        orderedRecords.map((record) => ({
+          callId: record.callId,
+          toolName: record.toolName,
+          responseParts: record.responseParts,
+          persistedOutputFiles: record.persistedOutputFiles
+        }))
+      );
+      orderedRecords.forEach((record, index) => {
+        this.config.getChatRecordingService()?.recordToolResult(finalized[index].responseParts, record.metadata);
+      });
+      return {
+        ...result,
+        parts: finalized.flatMap((entry) => entry.responseParts)
+      };
+    }, "finalizeRunToolResult");
     let skippedToolCallCounter = 0;
-    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc, message = PERMISSION_CANCEL_SKIP_MESSAGE, emitStart = true) => {
+    const recordSkippedToolCall = /* @__PURE__ */ __name(async (fc, message = PERMISSION_CANCEL_SKIP_MESSAGE, emitStart = true, errorType) => {
       const toolName = fc.name ?? "unknown_tool";
       const callId = fc.id ?? `${toolName}-skip-${++skippedToolCallCounter}`;
       const part = {
@@ -5429,12 +5763,17 @@ ${this.pendingWorktreeNotice}
       };
       const error = new Error(message);
       try {
-        this.config.getChatRecordingService()?.recordToolResult([part], {
+        queueToolResultRecord(fc, {
           callId,
-          status: "error",
-          resultDisplay: void 0,
-          error,
-          errorType: void 0
+          toolName,
+          responseParts: [part],
+          metadata: {
+            callId,
+            status: "error",
+            resultDisplay: void 0,
+            error,
+            errorType
+          }
         });
         if (emitStart) {
           await this.toolCallEmitter.emitStart({
@@ -5456,7 +5795,7 @@ ${this.pendingWorktreeNotice}
       toolLoopState,
       dedupedFunctionCalls.length
     )) {
-      return {
+      return await finalizeRunToolResult({
         parts: await Promise.all(
           dedupedFunctionCalls.map(
             (fc) => recordSkippedToolCall(fc, LOOP_DETECTED_SKIP_MESSAGE, false)
@@ -5464,7 +5803,7 @@ ${this.pendingWorktreeNotice}
         ),
         stopAfterPermissionCancel: false,
         loopDetected: true
-      };
+      });
     }
     const batches = [];
     const handledProviderToolCallIds = new Set(
@@ -5481,13 +5820,13 @@ ${this.pendingWorktreeNotice}
       debugLogger6.debug(
         `[Session.runToolCalls] Dropping batch after repeated duplicate provider tool-call id: ${providerCallId} (tool: ${repeatedDuplicateCall.name ?? "unknown_tool"})`
       );
-      return {
+      return await finalizeRunToolResult({
         parts: [],
         stopAfterPermissionCancel: false,
         repeatedDuplicateProviderToolCall: true
-      };
+      });
     }
-    const pushDuplicateBatch = /* @__PURE__ */ __name((request) => {
+    const pushDuplicateBatch = /* @__PURE__ */ __name((fc, request) => {
       const providerCallId = request.providerCallId ?? request.callId;
       markDuplicateProviderToolCallResponseSent(
         providerCallId,
@@ -5497,7 +5836,7 @@ ${this.pendingWorktreeNotice}
       debugLogger6.debug(
         `[Session.runToolCalls] Suppressing duplicate provider tool-call id: ${providerCallId} (tool: ${request.name})`
       );
-      batches.push({ kind: "duplicate", request, response });
+      batches.push({ kind: "duplicate", fc, request, response });
     }, "pushDuplicateBatch");
     const emitDuplicateBatch = /* @__PURE__ */ __name(async (batch) => {
       const { request, response } = batch;
@@ -5534,20 +5873,26 @@ ${this.pendingWorktreeNotice}
           success: false
         });
       }
-      this.config.getChatRecordingService()?.recordToolResult(response.responseParts, {
+      queueToolResultRecord(batch.fc, {
         callId: response.callId,
-        status: "error",
-        resultDisplay: response.resultDisplay,
-        error: response.error,
-        errorType: response.errorType
+        toolName: request.name,
+        responseParts: response.responseParts,
+        persistedOutputFiles: response.persistedOutputFiles,
+        metadata: {
+          callId: response.callId,
+          status: "error",
+          resultDisplay: response.resultDisplay,
+          error: response.error,
+          errorType: response.errorType
+        }
       });
     }, "emitDuplicateBatch");
     for (const fc of dedupedFunctionCalls) {
       const providerCallId = getProviderToolCallId(fc) ?? fc.id;
       if (providerCallId) {
         if (handledProviderToolCallIds.has(providerCallId)) {
-          const callId = fc.id ?? `${fc.name}-${Date.now()}`;
-          pushDuplicateBatch({
+          const callId = executionCallIds.get(fc);
+          pushDuplicateBatch(fc, {
             callId,
             providerCallId,
             name: fc.name ?? "unknown_tool",
@@ -5567,6 +5912,13 @@ ${this.pendingWorktreeNotice}
         batches.push({ kind: "execute", concurrent: isAgent, calls: [fc] });
       }
     }
+    const executableCalls = batches.flatMap(
+      (batch) => batch.kind === "execute" ? batch.calls : []
+    );
+    const planModeEntryBoundaryIndex = findPlanModeEntryBatchBoundaryIndex(
+      executableCalls.map((call) => call.name)
+    );
+    const planModeEntryBoundary = planModeEntryBoundaryIndex === void 0 ? void 0 : executableCalls[planModeEntryBoundaryIndex];
     const appendSkippedAfter = /* @__PURE__ */ __name(async (parts2, fc, message = PERMISSION_CANCEL_SKIP_MESSAGE) => {
       const startIndex = dedupedFunctionCalls.indexOf(fc) + 1;
       for (const remainingCall of dedupedFunctionCalls.slice(startIndex)) {
@@ -5633,7 +5985,10 @@ ${this.pendingWorktreeNotice}
             calls[i],
             onStopAfterPermissionCancel,
             toolLoopState,
-            recordSkippedToolCall
+            recordSkippedToolCall,
+            queueToolResultRecord,
+            executionCallIds.get(calls[i]),
+            onFullTurnModel
           );
           results[i] = r;
           if (r.loopDetected) {
@@ -5665,7 +6020,10 @@ ${this.pendingWorktreeNotice}
           calls[idx],
           onStopAfterPermissionCancel,
           toolLoopState,
-          recordSkippedToolCall
+          recordSkippedToolCall,
+          queueToolResultRecord,
+          executionCallIds.get(calls[idx]),
+          onFullTurnModel
         ).then((r) => {
           results[idx] = r;
         }).finally(() => {
@@ -5704,6 +6062,19 @@ ${this.pendingWorktreeNotice}
           parts.push(...batch.response.responseParts);
           continue;
         }
+        if (planModeEntryBoundary && !batch.calls.includes(planModeEntryBoundary)) {
+          for (const fc of batch.calls) {
+            parts.push(
+              await recordSkippedToolCall(
+                fc,
+                PLAN_MODE_ENTRY_SIBLING_SKIP_MESSAGE,
+                true,
+                "execution_denied" /* EXECUTION_DENIED */
+              )
+            );
+          }
+          continue;
+        }
         if (batch.concurrent && batch.calls.length > 1) {
           const batchAbortController = new AbortController();
           let batchStopAfterPermissionCancel = false;
@@ -5747,24 +6118,24 @@ ${this.pendingWorktreeNotice}
               batch.calls[batch.calls.length - 1],
               LOOP_DETECTED_SKIP_MESSAGE
             );
-            return {
+            return await finalizeRunToolResult({
               parts,
               stopAfterPermissionCancel: false,
               loopDetected: true,
               memoryWriteCandidates
-            };
+            });
           }
           if (shouldStop) {
             await appendSkippedAfter(
               parts,
               batch.calls[batch.calls.length - 1]
             );
-            return {
+            return await finalizeRunToolResult({
               parts,
               stopAfterPermissionCancel: true,
               repeatedDuplicateProviderToolCall: false,
               memoryWriteCandidates
-            };
+            });
           }
         } else {
           for (const fc of batch.calls) {
@@ -5774,37 +6145,40 @@ ${this.pendingWorktreeNotice}
               fc,
               void 0,
               toolLoopState,
-              recordSkippedToolCall
+              recordSkippedToolCall,
+              queueToolResultRecord,
+              executionCallIds.get(fc),
+              onFullTurnModel
             );
             parts.push(...r.parts);
             collectMemoryWriteCandidates(r);
             if (r.loopDetected) {
               await appendSkippedAfter(parts, fc, LOOP_DETECTED_SKIP_MESSAGE);
-              return {
+              return await finalizeRunToolResult({
                 parts,
                 stopAfterPermissionCancel: false,
                 loopDetected: true,
                 memoryWriteCandidates
-              };
+              });
             }
             if (r.stopAfterPermissionCancel) {
               await appendSkippedAfter(parts, fc);
-              return {
+              return await finalizeRunToolResult({
                 parts,
                 stopAfterPermissionCancel: true,
                 repeatedDuplicateProviderToolCall: false,
                 memoryWriteCandidates
-              };
+              });
             }
           }
         }
       }
-      return {
+      return await finalizeRunToolResult({
         parts,
         stopAfterPermissionCancel: false,
         repeatedDuplicateProviderToolCall: false,
         memoryWriteCandidates
-      };
+      });
     } finally {
       await refreshMemoryIfNeeded();
     }
@@ -5839,8 +6213,8 @@ ${this.pendingWorktreeNotice}
     }
     return reminders;
   }
-  async runTool(abortSignal, promptId, fc, onStopAfterPermissionCancel, toolLoopState, recordSkippedToolCall) {
-    const callId = fc.id ?? `${fc.name}-${Date.now()}`;
+  async runTool(abortSignal, promptId, fc, onStopAfterPermissionCancel, toolLoopState, recordSkippedToolCall, queueToolResultRecord, generatedCallId, onFullTurnModel) {
+    const callId = fc.id ?? generatedCallId ?? `${fc.name}-${Date.now()}`;
     let args = fc.args ?? {};
     if (toolLoopState?.loopDetected) {
       return {
@@ -5902,12 +6276,17 @@ ${this.pendingWorktreeNotice}
         await this.toolCallEmitter.emitError(callId, toolName2, error);
       }
       const errorParts = errorResponse(error);
-      this.config.getChatRecordingService()?.recordToolResult(errorParts, {
+      queueToolResultRecord?.(fc, {
         callId,
-        status: "error",
-        resultDisplay: void 0,
-        error,
-        errorType: void 0
+        toolName: toolName2,
+        responseParts: errorParts,
+        metadata: {
+          callId,
+          status: "error",
+          resultDisplay: void 0,
+          error,
+          errorType: void 0
+        }
       });
       const loopDetected = opts?.recordInvalidToolParams === true && !activeToolAbortSignal.aborted && !opts?.stopAfterPermissionCancel && recordDaemonInvalidToolParams(
         this.config,
@@ -5937,19 +6316,21 @@ ${this.pendingWorktreeNotice}
         { recordInvalidToolParams: true }
       );
     }
-    const toolSpan = startToolSpan(toolName, {
+    const policyToolName = tool.name;
+    const originalPolicyRequestArgs = policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR ? structuredClone(args) : args;
+    const toolSpan = startToolSpan(policyToolName, {
       "tool.call_id": callId,
       // Dual-emit the legacy call_id/tool_name aliases like CoreToolScheduler
       // (coreToolScheduler.ts) so pre-Phase-2 dashboards keyed off call_id keep
       // matching daemon/ACP tool spans during the migration window.
       call_id: callId,
-      tool_name: toolName
+      tool_name: policyToolName
     });
     let spanSuccess = false;
     try {
       return await runInToolSpanContext(toolSpan, async () => {
         const pm = this.config.getPermissionManager?.();
-        if (pm && !await pm.isToolEnabled(toolName)) {
+        if (pm && !await pm.isToolEnabled(policyToolName)) {
           return earlyErrorResponse(
             new Error(`Tool "${toolName}" is disabled.`),
             toolName
@@ -5978,7 +6359,7 @@ ${this.pendingWorktreeNotice}
           }
         }
         const toolUseId = generateToolUseId();
-        const approvalMode = this.config.getApprovalMode();
+        let approvalMode = this.config.getApprovalMode();
         let toolBuildSucceeded = false;
         try {
           const invocation = tool.build(args);
@@ -6003,12 +6384,12 @@ ${this.pendingWorktreeNotice}
               activeToolAbortSignal
             );
           }
-          const isAskUserQuestionTool = toolName === ToolNames.ASK_USER_QUESTION;
-          const toolParams = invocation.params;
+          const isAskUserQuestionTool = policyToolName === ToolNames.ASK_USER_QUESTION;
+          let toolParams = invocation.params;
           const flowResult = await evaluatePermissionFlow(
             this.config,
             invocation,
-            toolName,
+            policyToolName,
             toolParams
           );
           const {
@@ -6018,31 +6399,75 @@ ${this.pendingWorktreeNotice}
             denyMessage,
             requiresUserInteraction
           } = flowResult;
+          approvalMode = this.config.getApprovalMode();
           const isPlanMode = approvalMode === "plan" /* PLAN */;
+          const isPlanShellCall = isPlanMode && (policyToolName === ToolNames.SHELL || policyToolName === ToolNames.MONITOR);
           if (finalPermission === "deny") {
             return earlyErrorResponse(
               new Error(denyMessage ?? `Tool "${toolName}" is denied.`),
               toolName
             );
           }
-          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(toolName, this.config));
+          let planShellAmbientWorkingDirectory;
+          if (isPlanShellCall) {
+            const directory = toolParams["directory"];
+            planShellAmbientWorkingDirectory = typeof directory === "string" && directory.length > 0 ? void 0 : this.config.getTargetDir();
+            invocation.params = {
+              ...structuredClone(invocation.params),
+              directory: typeof directory === "string" && directory.length > 0 ? directory : planShellAmbientWorkingDirectory
+            };
+            toolParams = invocation.params;
+          }
+          const planShellDecision = isPlanShellCall ? await evaluatePlanModeShellPolicy({
+            config: this.config,
+            toolName: policyToolName,
+            requestArgs: originalPolicyRequestArgs,
+            invocationParams: toolParams,
+            permissionContext: pmCtx,
+            ambientWorkingDirectory: planShellAmbientWorkingDirectory,
+            signal: activeToolAbortSignal
+          }) : { classification: "not-applicable" };
+          if (planShellDecision.classification !== "not-applicable") {
+            const initialPlanShellError = await validatePlanModeShellContext({
+              config: this.config,
+              decision: planShellDecision,
+              requestArgs: args,
+              invocationParams: invocation.params,
+              signal: activeToolAbortSignal
+            });
+            if (initialPlanShellError) {
+              return earlyErrorResponse(
+                new Error(initialPlanShellError),
+                toolName
+              );
+            }
+          }
+          if (planShellDecision.classification === "write") {
+            return earlyErrorResponse(
+              new Error(planShellDecision.writeBlockMessage),
+              toolName
+            );
+          }
+          const planShellRequiresConfirmation = planShellDecision.classification === "unknown";
+          const forceAutoReviewForAllow = approvalMode === "auto" /* AUTO */ && (shouldForceAutoModeReviewForAllow(pmCtx, this.config.getCwd()) || shouldClassifyAllShellForAutoMode(policyToolName, this.config));
           const confirmationPermission = getEffectivePermissionForConfirmation(
             finalPermission,
             forceAutoReviewForAllow
           );
           if (finalPermission === "allow" && forceAutoReviewForAllow) {
             debugLogger6.info(
-              `Auto mode: L4 allow overridden by protected-write guard for ${toolName}`
+              `Auto mode: L4 allow overridden by protected-write guard for ${policyToolName}`
             );
           }
-          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow;
+          let autoModeAllowed = finalPermission === "allow" && !forceAutoReviewForAllow && !planShellRequiresConfirmation;
           if (autoModeAllowed && approvalMode === "auto" /* AUTO */) {
             this.config.setAutoModeDenialState(
               recordAllow(this.config.getAutoModeDenialState())
             );
           }
-          let wasAutoModeDenialFallback = false;
-          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, toolName)) {
+          let wasAutoModeManualFallback = false;
+          let autoModeFallbackMessage;
+          if (!autoModeAllowed && !requiresUserInteraction && shouldRunAutoModeForCall(approvalMode, policyToolName)) {
             const denialState = this.config.getAutoModeDenialState();
             const fallback = shouldFallback(denialState);
             const messages = this.config.getGeminiClient?.()?.getHistoryTail(MAX_TRANSCRIPT_MESSAGES, false) ?? [];
@@ -6064,7 +6489,7 @@ ${this.pendingWorktreeNotice}
               this.config,
               decision,
               outcome,
-              toolName,
+              policyToolName,
               toolParams,
               callId,
               abortSignal
@@ -6075,17 +6500,16 @@ ${this.pendingWorktreeNotice}
                 break;
               case "blocked":
                 debugLogger6.warn(
-                  `Auto mode blocked (${outcome.reason}): tool=${toolName}, ` + formatDenialStateLog(denialState)
+                  `Auto mode blocked (${outcome.reason}): tool=${policyToolName}, ` + formatDenialStateLog(denialState)
                 );
                 return earlyErrorResponse(
                   new Error(outcome.errorMessage),
                   toolName
                 );
               case "fallback":
-                wasAutoModeDenialFallback = isDenialFallbackReason(
-                  outcome.reason
-                );
-                if (wasAutoModeDenialFallback) {
+                wasAutoModeManualFallback = isDenialFallbackReason(outcome.reason) || outcome.reason === "classifier_unavailable";
+                autoModeFallbackMessage = outcome.message;
+                if (wasAutoModeManualFallback) {
                   debugLogger6.warn(
                     `Auto mode fallback to manual approval (${outcome.reason}): ` + formatDenialStateLog(denialState)
                   );
@@ -6100,7 +6524,7 @@ ${this.pendingWorktreeNotice}
           let didRequestPermission = false;
           let confirmationDetails;
           const recordAutoModeFallbackResolution = /* @__PURE__ */ __name((outcome) => {
-            if (approvalMode === "auto" /* AUTO */ && wasAutoModeDenialFallback && isApproveOutcome(outcome)) {
+            if (approvalMode === "auto" /* AUTO */ && wasAutoModeManualFallback && isApproveOutcome(outcome)) {
               const before = this.config.getAutoModeDenialState();
               const after = recordFallbackApprove(before);
               if (after === before) {
@@ -6116,14 +6540,51 @@ ${this.pendingWorktreeNotice}
             }
           }, "recordAutoModeFallbackResolution");
           if (!autoModeAllowed && needsConfirmation(
-            confirmationPermission,
+            planShellRequiresConfirmation ? "ask" : confirmationPermission,
             approvalMode,
-            toolName,
+            policyToolName,
             requiresUserInteraction
           )) {
-            confirmationDetails = await invocation.getConfirmationDetails(abortSignal);
+            confirmationDetails = await invocation.getConfirmationDetails(
+              activeToolAbortSignal
+            );
+            if (autoModeFallbackMessage) {
+              confirmationDetails = decorateClassifierUnavailableConfirmation(
+                confirmationDetails,
+                autoModeFallbackMessage
+              );
+            }
+            if (planShellDecision.classification !== "not-applicable") {
+              const preDisplayPlanShellError = await validatePlanModeShellContext({
+                config: this.config,
+                decision: planShellDecision,
+                requestArgs: args,
+                invocationParams: invocation.params,
+                signal: activeToolAbortSignal
+              });
+              if (preDisplayPlanShellError) {
+                return earlyErrorResponse(
+                  new Error(preDisplayPlanShellError),
+                  toolName
+                );
+              }
+            }
+            try {
+              confirmationDetails = decoratePlanModeShellConfirmation(
+                planShellDecision,
+                confirmationDetails
+              );
+            } catch {
+              if (planShellDecision.classification === "unknown") {
+                return earlyErrorResponse(
+                  new Error(planShellDecision.noApprovalMessage),
+                  toolName
+                );
+              }
+              throw new Error("Unable to prepare shell confirmation.");
+            }
             injectPermissionRulesIfMissing(confirmationDetails, pmCtx);
-            if (isPlanModeBlocked(
+            if (planShellDecision.classification === "not-applicable" && isPlanModeBlocked(
               isPlanMode,
               isExitPlanModeTool,
               isAskUserQuestionTool,
@@ -6143,23 +6604,50 @@ ${this.pendingWorktreeNotice}
             if (hooksEnabled && messageBus) {
               const hookResult = await firePermissionRequestHook(
                 messageBus,
-                toolName,
+                policyToolName,
                 args,
-                String(approvalMode)
+                String(approvalMode),
+                void 0,
+                activeToolAbortSignal
               );
               if (hookResult.hasDecision && (!hookResult.shouldAllow || !requiresUserInteraction)) {
                 hookHandled = true;
                 if (hookResult.shouldAllow) {
-                  if (hookResult.updatedInput) {
-                    args = hookResult.updatedInput;
-                    invocation.params = hookResult.updatedInput;
+                  if (planShellDecision.classification !== "not-applicable") {
+                    const approval = await validatePlanModeShellApproval({
+                      config: this.config,
+                      decision: planShellDecision,
+                      requestArgs: args,
+                      invocationParams: invocation.params,
+                      signal: activeToolAbortSignal,
+                      outcome: "proceed_once" /* ProceedOnce */,
+                      payload: hookResult.updatedInput ? { updatedInput: hookResult.updatedInput } : void 0
+                    });
+                    await confirmationDetails.onConfirm(
+                      approval.outcome,
+                      approval.payload
+                    );
+                    if (approval.outcome === "cancel" /* Cancel */) {
+                      return earlyErrorResponse(
+                        new Error(
+                          approval.payload?.cancelMessage ?? planShellDecision.noApprovalMessage
+                        ),
+                        toolName
+                      );
+                    }
+                    recordAutoModeFallbackResolution(approval.outcome);
+                  } else {
+                    if (hookResult.updatedInput) {
+                      args = hookResult.updatedInput;
+                      invocation.params = hookResult.updatedInput;
+                    }
+                    await confirmationDetails.onConfirm(
+                      "proceed_once" /* ProceedOnce */
+                    );
+                    recordAutoModeFallbackResolution(
+                      "proceed_once" /* ProceedOnce */
+                    );
                   }
-                  await confirmationDetails.onConfirm(
-                    "proceed_once" /* ProceedOnce */
-                  );
-                  recordAutoModeFallbackResolution(
-                    "proceed_once" /* ProceedOnce */
-                  );
                 } else {
                   return earlyErrorResponse(
                     new Error(
@@ -6172,11 +6660,26 @@ ${this.pendingWorktreeNotice}
             }
             if (!requiresUserInteraction && approvalMode === "auto-edit" /* AUTO_EDIT */ && (confirmationDetails.type === "edit" || confirmationDetails.type === "info")) {
             } else if (!hookHandled) {
+              if (planShellDecision.classification !== "not-applicable") {
+                const finalPreDisplayPlanShellError = await validatePlanModeShellContext({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal
+                });
+                if (finalPreDisplayPlanShellError) {
+                  return earlyErrorResponse(
+                    new Error(finalPreDisplayPlanShellError),
+                    toolName
+                  );
+                }
+              }
               didRequestPermission = true;
               const content = buildPermissionRequestContent(confirmationDetails);
               const mappedKind = this.toolCallEmitter.mapToolKind(
                 tool.kind,
-                toolName
+                policyToolName
               );
               if (hooksEnabled && messageBus) {
                 this.fireNotificationHookWithTerminalSequence(
@@ -6186,9 +6689,16 @@ ${this.pendingWorktreeNotice}
                   "Permission needed"
                 );
               }
+              const permissionOptions = toPermissionOptions(
+                confirmationDetails,
+                pmForcedAsk
+              );
+              const offeredPermissionOptions = permissionOptions.map(
+                (option) => ({ ...option })
+              );
               const params = {
                 sessionId: this.sessionId,
-                options: toPermissionOptions(confirmationDetails, pmForcedAsk),
+                options: permissionOptions,
                 toolCall: {
                   toolCallId: callId,
                   status: "pending",
@@ -6207,10 +6717,12 @@ ${this.pendingWorktreeNotice}
                   }
                 }
               };
-              const stopAfterPermissionCancel = /* @__PURE__ */ __name(() => {
+              const stopAfterPermissionCancel = /* @__PURE__ */ __name((message) => {
                 onStopAfterPermissionCancel?.();
                 return earlyErrorResponse(
-                  new Error(`Tool "${toolName}" was canceled by the user.`),
+                  new Error(
+                    message ?? `Tool "${toolName}" was canceled by the user.`
+                  ),
                   toolName,
                   { stopAfterPermissionCancel: true }
                 );
@@ -6218,10 +6730,15 @@ ${this.pendingWorktreeNotice}
               let output;
               let outcome;
               try {
-                output = await this.client.requestPermission(
-                  params
+                output = await requestPermissionWithAbort(
+                  this.client,
+                  params,
+                  activeToolAbortSignal
+                );
+                outcome = resolvePermissionOutcome(
+                  output,
+                  offeredPermissionOptions
                 );
-                outcome = output.outcome.outcome === "cancelled" ? "cancel" /* Cancel */ : external_exports.nativeEnum(ToolConfirmationOutcome).parse(output.outcome.optionId);
               } catch (error) {
                 debugLogger6.error(
                   `Permission request failed for tool ${toolName}:`,
@@ -6238,7 +6755,9 @@ ${this.pendingWorktreeNotice}
                   );
                 }
                 onStopAfterPermissionCancel?.();
-                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : `Permission request failed for "${toolName}": ${this.#formatError(
+                const permissionFailureMessage = isExitPlanModeTool ? "The host could not present plan-exit approval. Plan mode remains active; use the host mode selector or /plan exit to leave plan mode." : planShellDecision.classification === "unknown" ? `Plan mode could not complete approval for this shell command: ${this.#formatError(
+                  error
+                )}. The command was not run; Plan mode remains active.` : `Permission request failed for "${toolName}": ${this.#formatError(
                   error
                 )}`;
                 return earlyErrorResponse(
@@ -6247,11 +6766,32 @@ ${this.pendingWorktreeNotice}
                   { stopAfterPermissionCancel: true }
                 );
               }
+              let confirmationPayload = {
+                answers: output.answers
+              };
+              if (planShellDecision.classification !== "not-applicable") {
+                const approval = await validatePlanModeShellApproval({
+                  config: this.config,
+                  decision: planShellDecision,
+                  requestArgs: args,
+                  invocationParams: invocation.params,
+                  signal: activeToolAbortSignal,
+                  outcome,
+                  payload: confirmationPayload
+                });
+                outcome = approval.outcome;
+                confirmationPayload = approval.payload;
+              }
+              const shouldSwitchToDefault = outcome === "proceed_once_and_switch_to_default" /* ProceedOnceAndSwitchToDefault */;
+              if (shouldSwitchToDefault) {
+                outcome = "proceed_once" /* ProceedOnce */;
+              }
               recordAutoModeFallbackResolution(outcome);
               try {
-                await confirmationDetails.onConfirm(outcome, {
-                  answers: output.answers
-                });
+                await confirmationDetails.onConfirm(
+                  outcome,
+                  confirmationPayload
+                );
               } catch (error) {
                 if (outcome !== "cancel" /* Cancel */) {
                   throw error;
@@ -6262,21 +6802,31 @@ ${this.pendingWorktreeNotice}
                 );
                 return stopAfterPermissionCancel();
               }
+              if (shouldSwitchToDefault) {
+                this.config.setApprovalMode("default" /* DEFAULT */);
+                await this.sendCurrentModeUpdateNotification();
+              }
               if (outcome === "proceed_always" /* ProceedAlways */ || outcome === "proceed_always_project" /* ProceedAlwaysProject */ || outcome === "proceed_always_user" /* ProceedAlwaysUser */) {
                 await persistPermissionOutcome(
                   outcome,
                   confirmationDetails,
                   this.config.getOnPersistPermissionRule?.(),
                   this.config.getPermissionManager?.(),
-                  { answers: output.answers }
+                  confirmationPayload
                 );
               }
               if (confirmationDetails.type === "edit" && outcome === "proceed_always" /* ProceedAlways */) {
                 await this.sendCurrentModeUpdateNotification();
               }
               switch (outcome) {
+                case "proceed_once_and_switch_to_default" /* ProceedOnceAndSwitchToDefault */:
+                  throw new Error(
+                    "Switch-to-Default outcome must be normalized before execution."
+                  );
                 case "cancel" /* Cancel */:
-                  return stopAfterPermissionCancel();
+                  return stopAfterPermissionCancel(
+                    confirmationPayload?.cancelMessage
+                  );
                 case "proceed_once" /* ProceedOnce */:
                 case "proceed_always" /* ProceedAlways */:
                 case "proceed_always_project" /* ProceedAlwaysProject */:
@@ -6308,7 +6858,7 @@ ${this.pendingWorktreeNotice}
           if (hooksEnabledForTool && messageBusForTool) {
             const preHookResult = await firePreToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolUseId,
               permissionMode,
@@ -6398,7 +6948,7 @@ ${this.pendingWorktreeNotice}
               this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
             }
           }
-          const responseParts = toolResult.error ? convertToFunctionErrorResponse(
+          let responseParts = toolResult.error ? convertToFunctionErrorResponse(
             toolName,
             callId,
             toolResult.llmContent,
@@ -6425,7 +6975,7 @@ ${this.pendingWorktreeNotice}
             };
             const postHookResult = await firePostToolUseHook(
               messageBusForTool,
-              toolName,
+              policyToolName,
               args,
               toolResponse,
               toolUseId,
@@ -6456,7 +7006,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForTool,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               toolResult.error?.message ?? "Tool execution was cancelled",
               isInterrupt,
@@ -6476,6 +7026,12 @@ ${this.pendingWorktreeNotice}
               artifacts: failureHookResult.artifacts
             });
           }
+          responseParts = await bridgeToolResultImages({
+            config: this.config,
+            responseParts,
+            signal: activeToolAbortSignal,
+            onFullTurnModel
+          });
           if (isTodoWriteTool) {
             const todos = this.planEmitter.extractTodos(
               toolResult.returnDisplay,
@@ -6510,12 +7066,18 @@ ${this.pendingWorktreeNotice}
             prompt_id: promptId,
             tool_type: typeof tool !== "undefined" && tool instanceof DiscoveredMCPTool ? "mcp" : "native"
           });
-          this.config.getChatRecordingService()?.recordToolResult(responseParts, {
+          queueToolResultRecord?.(fc, {
             callId,
-            status,
-            resultDisplay: toolResult.returnDisplay,
-            error: toolResult.error ? new Error(toolResult.error.message) : void 0,
-            errorType: toolResult.error?.type
+            toolName,
+            responseParts,
+            persistedOutputFiles: toolResult.persistedOutputFiles,
+            metadata: {
+              callId,
+              status,
+              resultDisplay: toolResult.returnDisplay,
+              error: toolResult.error ? new Error(toolResult.error.message) : void 0,
+              errorType: toolResult.error?.type
+            }
           });
           spanSuccess = succeeded;
           if (toolResult.error) {
@@ -6545,7 +7107,7 @@ ${this.pendingWorktreeNotice}
             const failureHookResult = await firePostToolUseFailureHook(
               messageBusForError,
               toolUseId,
-              toolName,
+              policyToolName,
               args,
               error.message,
               isInterrupt,
@@ -6566,24 +7128,6 @@ ${this.pendingWorktreeNotice}
             });
           }
           await this.toolCallEmitter.emitError(callId, toolName, error);
-          const errorParts = [
-            {
-              functionResponse: {
-                id: callId,
-                name: toolName,
-                response: { error: error.message }
-              }
-            }
-          ];
-          this.config.getChatRecordingService()?.recordToolResult(errorParts, {
-            callId,
-            // A throw caused by abort (e.g. AbortError) is a cancellation, not
-            // a genuine tool error — keep it consistent with the success path.
-            status: activeToolAbortSignal.aborted ? "cancelled" : "error",
-            resultDisplay: void 0,
-            error,
-            errorType: void 0
-          });
           const loopDetected = !activeToolAbortSignal.aborted && !toolBuildSucceeded && recordDaemonInvalidToolParams(
             this.config,
             promptId,
@@ -6592,6 +7136,18 @@ ${this.pendingWorktreeNotice}
             error
           );
           const responseParts = errorResponse(error);
+          queueToolResultRecord?.(fc, {
+            callId,
+            toolName,
+            responseParts,
+            metadata: {
+              callId,
+              status: activeToolAbortSignal.aborted ? "cancelled" : "error",
+              resultDisplay: void 0,
+              error,
+              errorType: void 0
+            }
+          });
           return {
             parts: responseParts,
             stopAfterPermissionCancel: nestedPermissionCancelled,
@@ -7152,7 +7708,8 @@ function serializeAgentTask(entry, now) {
         at: a.at
       }))
     } : {},
-    ...optionalField("prompt", entry.prompt)
+    ...optionalField("prompt", entry.prompt),
+    ...optionalField("toolUseId", entry.toolUseId)
   };
 }
 __name(serializeAgentTask, "serializeAgentTask");
@@ -7228,6 +7785,7 @@ var QWEN_ACP_LOCAL_READ_ROOTS_ENV = "QWEN_ACP_LOCAL_READ_ROOTS";
 var POSIX_TMP_LOCAL_READ_ROOT = "/tmp";
 var BTW_CHILD_TIMEOUT_MS = 55e3;
 var MCP_OAUTH_START_TIMEOUT_MS = 3e4;
+var SESSION_DRAIN_TIMEOUT_MS = 3e4;
 var WORKSPACE_MEMORY_REMEMBER_CHILD_TIMEOUT_MS = 295e3;
 function createAcpSessionStartProfiler(span) {
   let failedStage;
@@ -7286,6 +7844,77 @@ function workspaceMemoryErrorData(code, diagnostics) {
   };
 }
 __name(workspaceMemoryErrorData, "workspaceMemoryErrorData");
+var SESSION_WRITER_MESSAGES = {
+  session_writer_conflict: "This session is already open in another Qwen process.",
+  session_writer_lost: "Write ownership for this session was lost.",
+  session_transcript_changed: "The session transcript changed outside its active writer.",
+  session_writer_unavailable: "Session write ownership could not be verified."
+};
+function getSessionWriterError(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const candidate = error;
+  const errorKind = candidate["errorKind"];
+  if (typeof errorKind !== "string" || !(errorKind in SESSION_WRITER_RPC_CODES)) {
+    return void 0;
+  }
+  const typedKind = errorKind;
+  if (candidate["rpcCode"] !== SESSION_WRITER_RPC_CODES[typedKind]) {
+    return void 0;
+  }
+  return {
+    rpcCode: SESSION_WRITER_RPC_CODES[typedKind],
+    errorKind: typedKind,
+    message: SESSION_WRITER_MESSAGES[typedKind]
+  };
+}
+__name(getSessionWriterError, "getSessionWriterError");
+function mapSessionWriterRequestError(error) {
+  const writerError = getSessionWriterError(error);
+  return writerError ? new RequestError(writerError.rpcCode, writerError.message, {
+    errorKind: writerError.errorKind
+  }) : error;
+}
+__name(mapSessionWriterRequestError, "mapSessionWriterRequestError");
+async function shutdownSessionConfig(config) {
+  await config.shutdown({ shutdownTelemetry: false });
+  if (config.hasSessionWriteOwnership()) {
+    throw new SessionWriterUnavailableError();
+  }
+}
+__name(shutdownSessionConfig, "shutdownSessionConfig");
+async function waitForSessionDrain(operation, timeoutMs, kind) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`Session ${kind} timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    timer.unref();
+  });
+  try {
+    await Promise.race([operation, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+__name(waitForSessionDrain, "waitForSessionDrain");
+async function beginSessionCloseAfterCurrentGate(session, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    const releaseGate = session.beginCloseIfAvailable();
+    if (releaseGate) return releaseGate;
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) {
+      throw new Error(`Session close timed out after ${timeoutMs}ms`);
+    }
+    await waitForSessionDrain(
+      session.waitForCloseGateToRelease(),
+      remainingMs,
+      "close"
+    );
+  }
+}
+__name(beginSessionCloseAfterCurrentGate, "beginSessionCloseAfterCurrentGate");
 var logWorkspaceMemoryExtractionError = createWorkspaceMemoryExtractionErrorLogger(debugLogger7);
 function parseAcpLocalReadRootsEnv(raw = process.env[QWEN_ACP_LOCAL_READ_ROOTS_ENV]) {
   if (!raw) return [];
@@ -7303,7 +7932,7 @@ function buildAcpLocalReadRoots(config) {
     // local read fallback, not read_file's default permission.
     config.storage.getProjectTempDir(),
     path4.join(config.storage.getProjectDir(), "subagents"),
-    Storage.getGlobalTempDir(),
+    path4.join(config.getSessionRuntimeBaseDir(), "tmp"),
     getAutoMemoryRoot(config.getTargetDir()),
     getUserAutoMemoryRoot(),
     ...config.storage.getUserSkillsDirs(),
@@ -8881,7 +9510,7 @@ async function runAcpAgent(config, settings, argv) {
     debugLogger7.debug("[ACP] Shutdown signal received, closing streams");
     try {
       await fireSessionEndOnce("other" /* Other */);
-      agentInstance?.disposeSessions();
+      await agentInstance?.disposeSessions();
       try {
         process.stdin.destroy();
       } catch {
@@ -8908,7 +9537,7 @@ async function runAcpAgent(config, settings, argv) {
     await connection.closed;
     await fireSessionEndOnce("prompt_input_exit" /* PromptInputExit */);
     await drainPoolBeforeExit("ide_close");
-    agentInstance?.disposeSessions();
+    await agentInstance?.disposeSessions();
   } finally {
     process.off("SIGTERM", shutdownHandler);
     process.off("SIGINT", shutdownHandler);
@@ -9067,6 +9696,7 @@ var QwenAgent = class {
   mcpAuthenticationResults = /* @__PURE__ */ new Map();
   generationControllers = /* @__PURE__ */ new Map();
   transcriptReplayConfigCache = /* @__PURE__ */ new Map();
+  pendingConfigCleanup = /* @__PURE__ */ new Map();
   clientCapabilities;
   // CPU-usage delta baseline for the daemon's `workspaceResource` extMethod
   // (Daemon Status child-resource chart). The daemon polls this at a fixed
@@ -9169,21 +9799,26 @@ var QwenAgent = class {
   async createWorkspaceMcpDiscoveryConfig(settings) {
     if (this.workspaceMcpDiscoveryConfig) return;
     const cwd = this.config.getTargetDir();
-    const config = await loadCliConfig(
-      settings.merged,
-      {
-        ...this.argv,
-        sessionId: "workspace-mcp-discovery",
-        resume: void 0,
-        continue: false
-      },
+    const config = await this.runWithPinnedRuntimeBaseDir(
+      settings,
       cwd,
-      void 0,
-      {
-        userHooks: settings.getUserHooks(),
-        projectHooks: settings.getProjectHooks()
-      },
-      buildDisabledSkillNamesProvider(settings)
+      () => loadCliConfig(
+        settings.merged,
+        {
+          ...this.argv,
+          sessionId: "workspace-mcp-discovery",
+          resume: void 0,
+          continue: false,
+          chatRecording: false
+        },
+        cwd,
+        void 0,
+        {
+          userHooks: settings.getUserHooks(),
+          projectHooks: settings.getProjectHooks()
+        },
+        buildDisabledSkillNamesProvider(settings)
+      )
     );
     config.setMcpTransportPool(this.mcpPool);
     try {
@@ -9291,100 +9926,225 @@ var QwenAgent = class {
       );
     }
   }
-  async closeStoredSession(sessionId, opts) {
-    for (const [requestId, generation] of this.generationControllers) {
-      if (generation.sessionId !== sessionId) continue;
-      generation.controller.abort();
-      this.generationControllers.delete(requestId);
-    }
-    const session = this.sessions.get(sessionId);
-    if (!session) {
-      this.mcpPool?.releaseSession(sessionId);
-      return;
+  async removeStoredSessionEntry(sessionId, session, cleanupErrors = [], options = {}) {
+    if (this.sessions.get(sessionId) !== session) return;
+    try {
+      session.dispose();
+    } catch (error) {
+      cleanupErrors.push(error);
     }
-    const requireFlush = opts?.requireFlush === true;
-    const flushRecording = /* @__PURE__ */ __name(async () => {
+    if (options.shutdownConfig !== false) {
       try {
-        await session.getConfig().getChatRecordingService()?.flush();
-        return void 0;
-      } catch (err) {
-        debugLogger7.debug(
-          `Session ${sessionId} chat recording flush during close failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-        return err;
-      }
-    }, "flushRecording");
-    if (requireFlush) {
-      const preCancelFlushError = await flushRecording();
-      if (preCancelFlushError !== void 0) {
-        throw preCancelFlushError;
+        await session.getConfig().shutdown({ shutdownTelemetry: false });
+      } catch (error) {
+        cleanupErrors.push(error);
       }
     }
     try {
-      await session.cancelPendingPrompt();
-    } catch (err) {
-      debugLogger7.debug(
-        `Session ${sessionId} cancel during close failed: ${err instanceof Error ? err.message : String(err)}`
-      );
+      unregisterGoalHook(session.getConfig(), sessionId);
+    } catch (error) {
+      cleanupErrors.push(error);
     }
-    const flushError = await flushRecording();
-    if (flushError !== void 0 && requireFlush) {
-      throw flushError;
+    try {
+      this.mcpPool?.releaseSession(sessionId);
+    } catch (error) {
+      cleanupErrors.push(error);
     }
     try {
-      await session.getConfig().getToolRegistry()?.stop();
-    } catch (err) {
-      debugLogger7.debug(
-        `Session ${sessionId} tool registry stop during close failed: ${err instanceof Error ? err.message : String(err)}`
-      );
+      uiTelemetryService.removeSession(sessionId);
+    } catch (error) {
+      cleanupErrors.push(error);
     }
-    unregisterGoalHook(session.getConfig(), sessionId);
-    this.mcpPool?.releaseSession(sessionId);
-    uiTelemetryService.removeSession(sessionId);
     this.sessions.delete(sessionId);
-  }
-  discardStoredSessionIfCurrent(sessionId, session) {
-    if (this.sessions.get(sessionId) !== session) {
-      return;
-    }
-    const logCleanupFailure = /* @__PURE__ */ __name((action, err) => {
-      debugLogger7.debug(
-        `Session ${sessionId} ${action} during failed restore cleanup failed: ${err instanceof Error ? err.message : String(err)}`
+    if (cleanupErrors.length > 0) {
+      debugLogger7.warn(
+        `Session ${sessionId} closed after ${cleanupErrors.length} cleanup failure(s): ${cleanupErrors.map(
+          (error) => error instanceof Error ? error.message : String(error)
+        ).join("; ")}`
       );
-    }, "logCleanupFailure");
+    }
+  }
+  async withLiveSessionRestore(sessionId, session, operation) {
+    await session.assertCanStartTurn();
+    const config = session.getConfig();
+    const releaseGate = session.beginClose();
     try {
-      session.dispose();
-    } catch (err) {
-      logCleanupFailure("dispose", err);
+      await waitForSessionDrain(
+        session.waitForActiveTurnsToSettle(),
+        SESSION_DRAIN_TIMEOUT_MS,
+        "restore"
+      );
+      const recorder = config.getChatRecordingService();
+      const loadAuthoritative = /* @__PURE__ */ __name(() => config.getSessionService().loadSession(sessionId), "loadAuthoritative");
+      const data = recorder ? await recorder.runWithWriteBarrier(loadAuthoritative) : await loadAuthoritative();
+      if (!data) throw new SessionWriterUnavailableError();
+      return await operation(config, data);
+    } catch (error) {
+      throw mapSessionWriterRequestError(error);
+    } finally {
+      releaseGate();
     }
+  }
+  async cleanupUnstoredConfig(config) {
+    const sessionId = config.getSessionId();
+    const cleanupKey = this.pendingConfigCleanupKey(
+      config.getSessionRuntimeBaseDir(),
+      sessionId
+    );
     try {
-      unregisterGoalHook(session.getConfig(), sessionId);
-    } catch (err) {
-      logCleanupFailure("goal hook unregister", err);
+      await shutdownSessionConfig(config);
+    } catch (error) {
+      const pending2 = this.pendingConfigCleanup.get(cleanupKey) ?? /* @__PURE__ */ new Set();
+      pending2.add(config);
+      this.pendingConfigCleanup.set(cleanupKey, pending2);
+      throw mapSessionWriterRequestError(error);
+    }
+    const pending = this.pendingConfigCleanup.get(cleanupKey);
+    pending?.delete(config);
+    if (pending?.size === 0) {
+      this.pendingConfigCleanup.delete(cleanupKey);
     }
+  }
+  async cleanupAfterRequestFailure(error, cleanup) {
     try {
+      await cleanup();
+    } catch (cleanupError) {
+      debugLogger7.warn(
+        `Session cleanup failed while preserving the original request error: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`
+      );
+    }
+    throw error;
+  }
+  pendingConfigCleanupKey(runtimeBaseDir, sessionId) {
+    return `${path4.resolve(runtimeBaseDir)}\0${sessionId}`;
+  }
+  async retryPendingConfigCleanup(runtimeBaseDir, requiredSessionId) {
+    const resolvedRuntimeBaseDir = path4.resolve(runtimeBaseDir);
+    const configs = /* @__PURE__ */ new Set();
+    for (const pending of this.pendingConfigCleanup.values()) {
+      for (const config of pending) {
+        if (path4.resolve(config.getSessionRuntimeBaseDir()) === resolvedRuntimeBaseDir) {
+          configs.add(config);
+        }
+      }
+    }
+    for (const config of configs) {
+      try {
+        await this.cleanupUnstoredConfig(config);
+      } catch (error) {
+        if (config.getSessionId() === requiredSessionId) throw error;
+        debugLogger7.warn(
+          `Deferred Config cleanup retry failed for session ${config.getSessionId()}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
+  async closeStoredSession(sessionId, opts) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
       this.mcpPool?.releaseSession(sessionId);
-    } catch (err) {
-      logCleanupFailure("MCP pool release", err);
+      return;
+    }
+    const recorder = session.getConfig().getChatRecordingService();
+    const requireFlush = opts?.requireFlush === true;
+    if (requireFlush) {
+      await recorder?.flush();
+    }
+    const drainTimeoutMs = opts?.drainTimeoutMs ?? SESSION_DRAIN_TIMEOUT_MS;
+    const cancelClose = opts?.waitForCloseGate ? await beginSessionCloseAfterCurrentGate(session, drainTimeoutMs) : session.beginClose();
+    for (const [requestId, generation] of this.generationControllers) {
+      if (generation.sessionId !== sessionId) continue;
+      generation.controller.abort();
+      this.generationControllers.delete(requestId);
     }
+    let removedFromStore = false;
     try {
-      uiTelemetryService.removeSession(sessionId);
-    } catch (err) {
-      logCleanupFailure("telemetry removal", err);
+      await waitForSessionDrain(
+        (async () => {
+          try {
+            await session.cancelPendingPrompt();
+          } catch (err) {
+            debugLogger7.debug(
+              `Session ${sessionId} cancel during close failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+          await session.waitForActiveTurnsToSettle();
+        })(),
+        drainTimeoutMs,
+        "close"
+      );
+      recorder?.finalize();
+      let flushError;
+      try {
+        await recorder?.flush();
+      } catch (error) {
+        flushError = error;
+      }
+      if (flushError !== void 0 && requireFlush) {
+        throw flushError;
+      }
+      let closeError;
+      try {
+        await recorder?.close();
+      } catch (error) {
+        closeError = error;
+      }
+      if (recorder?.hasWriteOwnership()) {
+        throw closeError ?? new SessionWriterUnavailableError();
+      }
+      const cleanupErrors = [];
+      if (flushError !== void 0) cleanupErrors.push(flushError);
+      if (closeError !== void 0) cleanupErrors.push(closeError);
+      await this.removeStoredSessionEntry(sessionId, session, cleanupErrors, {
+        shutdownConfig: opts?.shutdownConfig
+      });
+      removedFromStore = true;
+    } finally {
+      if (!removedFromStore) cancelClose();
     }
-    this.sessions.delete(sessionId);
   }
-  disposeSessions() {
+  async discardStoredSessionIfCurrent(sessionId, session, opts) {
+    if (this.sessions.get(sessionId) !== session) {
+      return;
+    }
+    await this.closeStoredSession(sessionId, opts);
+  }
+  async disposeSessions() {
     for (const generation of this.generationControllers.values()) {
       generation.controller.abort();
     }
     this.generationControllers.clear();
-    for (const session of this.sessions.values()) {
-      session.dispose();
-    }
-    this.sessions.clear();
+    await Promise.allSettled(
+      [...this.sessions.entries()].map(
+        ([sessionId, session]) => this.discardStoredSessionIfCurrent(sessionId, session, {
+          waitForCloseGate: true
+        })
+      )
+    );
+    await Promise.allSettled(
+      [...this.pendingConfigCleanup.values()].flatMap((configs) => [...configs]).map((config) => this.cleanupUnstoredConfig(config))
+    );
     this.disposeTranscriptReplayConfigs();
   }
+  runWithPinnedRuntimeBaseDir(settings, cwd, operation) {
+    return runWithAcpRuntimeOutputDir(settings, cwd, operation);
+  }
+  async assertLiveSessionScope(config, settings, cwd) {
+    if (path4.resolve(config.storage.getProjectRoot()) !== path4.resolve(cwd)) {
+      throw RequestError.invalidParams(
+        void 0,
+        "The live session belongs to another workspace."
+      );
+    }
+    const requestedRuntimeBaseDir = await this.runWithPinnedRuntimeBaseDir(
+      settings,
+      cwd,
+      () => Storage.getRuntimeBaseDir()
+    );
+    if (path4.resolve(config.getSessionRuntimeBaseDir()) !== path4.resolve(requestedRuntimeBaseDir)) {
+      throw mapSessionWriterRequestError(new SessionWriterUnavailableError());
+    }
+  }
   /** Expose the pool's workspace-scoped budget controller for snapshot builders. */
   getWorkspaceMcpBudget() {
     return this.workspaceMcpBudget;
@@ -9414,7 +10174,7 @@ var QwenAgent = class {
     markAcpStartup("initializeHandlerStart");
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.20.1-preview.7215";
+    const version = "0.20.2-gdpval-vl-agent.0";
     const response = {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {
@@ -9503,15 +10263,24 @@ var QwenAgent = class {
           "config_setup",
           () => this.newSessionConfig(cwd, mcpServers, settings)
         );
-        await profiler.time("auth", () => this.ensureAuthenticated(config));
-        profiler.timeSync(
-          "file_system_setup",
-          () => this.setupFileSystem(config)
-        );
-        const session = await profiler.time(
-          "session_register",
-          () => this.createAndStoreSession(config, settings)
-        );
+        let session;
+        try {
+          await profiler.time("auth", () => this.ensureAuthenticated(config));
+          profiler.timeSync(
+            "file_system_setup",
+            () => this.setupFileSystem(config)
+          );
+          session = await profiler.time(
+            "session_register",
+            () => this.createAndStoreSession(config, settings)
+          );
+        } catch (error) {
+          return this.cleanupAfterRequestFailure(error, async () => {
+            if (this.sessions.get(config.getSessionId())?.getConfig() !== config) {
+              await this.cleanupUnstoredConfig(config);
+            }
+          });
+        }
         profiler.setSessionId(session.getId());
         return profiler.timeSync("response_build", () => ({
           sessionId: session.getId(),
@@ -9525,7 +10294,56 @@ var QwenAgent = class {
   }
   async loadSession(params) {
     const settings = loadSettingsCached(params.cwd);
-    const exists = await runWithAcpRuntimeOutputDir(
+    const liveSession = this.sessions.get(params.sessionId);
+    if (liveSession) {
+      const liveConfig = liveSession.getConfig();
+      await this.assertLiveSessionScope(liveConfig, settings, params.cwd);
+      return this.withLiveSessionRestore(
+        params.sessionId,
+        liveSession,
+        async (config2, sessionData2) => {
+          const response2 = {
+            modes: this.buildModesData(config2),
+            models: this.buildAvailableModels(config2),
+            configOptions: this.buildConfigOptions(config2),
+            ...sessionData2.artifactSnapshot ? { artifactSnapshot: sessionData2.artifactSnapshot } : {}
+          };
+          const records = sessionData2.conversation.messages;
+          if (records.length === 0) return response2;
+          const bulkReplay2 = isBulkLoadReplayRequest(params);
+          const replayPage = bulkReplay2 ? selectRecentHistoryRecords(records, getLoadReplayPageSize(params)) : { records, hasMore: false };
+          const replay = await collectHistoryReplayUpdates({
+            sessionId: params.sessionId,
+            config: config2,
+            records: replayPage.records,
+            gaps: sessionData2.historyGaps,
+            cumulativeUsage: createReplayCumulativeUsage(),
+            logger: debugLogger7
+          });
+          if (!bulkReplay2) {
+            for (const update of replay.updates) {
+              await liveSession.sendUpdate(update);
+            }
+            if (replay.replayError !== void 0) {
+              throw RequestError.internalError(void 0, replay.replayError);
+            }
+            return response2;
+          }
+          return {
+            ...response2,
+            _meta: {
+              [LOAD_REPLAY_META_KEY]: {
+                v: LOAD_REPLAY_VERSION,
+                updates: replay.updates,
+                ...replay.replayError !== void 0 ? { partial: true, replayError: replay.replayError } : {},
+                ...replayPage.hasMore ? { hasMore: true } : {}
+              }
+            }
+          };
+        }
+      );
+    }
+    const exists = await this.runWithPinnedRuntimeBaseDir(
       settings,
       params.cwd,
       async () => {
@@ -9548,17 +10366,26 @@ var QwenAgent = class {
       params.sessionId,
       true
     );
-    await this.ensureAuthenticated(config);
-    this.setupFileSystem(config);
     const sessionData = config.getResumedSessionData();
     const bulkReplay = isBulkLoadReplayRequest(params);
     const replayPageSize = bulkReplay ? getLoadReplayPageSize(params) : void 0;
-    const session = await this.createAndStoreSession(
-      config,
-      settings,
-      sessionData,
-      bulkReplay ? { replayHistory: false, startPostReplayServices: false } : {}
-    );
+    let session;
+    try {
+      await this.ensureAuthenticated(config);
+      this.setupFileSystem(config);
+      session = await this.createAndStoreSession(
+        config,
+        settings,
+        sessionData,
+        bulkReplay ? { replayHistory: false, startPostReplayServices: false } : {}
+      );
+    } catch (error) {
+      return this.cleanupAfterRequestFailure(error, async () => {
+        if (this.sessions.get(config.getSessionId())?.getConfig() !== config) {
+          await this.cleanupUnstoredConfig(config);
+        }
+      });
+    }
     let replayEnvelope;
     if (bulkReplay) {
       try {
@@ -9605,8 +10432,21 @@ var QwenAgent = class {
         session.installRewriter();
         session.startCronScheduler();
       } catch (err) {
-        this.discardStoredSessionIfCurrent(params.sessionId, session);
-        throw err;
+        return this.cleanupAfterRequestFailure(err, async () => {
+          try {
+            await this.discardStoredSessionIfCurrent(params.sessionId, session);
+          } catch (cleanupError) {
+            await this.removeStoredSessionEntry(
+              params.sessionId,
+              session,
+              [cleanupError],
+              {
+                shutdownConfig: false
+              }
+            );
+            await this.cleanupUnstoredConfig(config);
+          }
+        });
       }
     }
     await this.#restoreWorktreeOnResume(config, session);
@@ -9632,7 +10472,22 @@ var QwenAgent = class {
   }
   async unstable_resumeSession(params) {
     const settings = loadSettingsCached(params.cwd);
-    const exists = await runWithAcpRuntimeOutputDir(
+    const liveSession = this.sessions.get(params.sessionId);
+    if (liveSession) {
+      const liveConfig = liveSession.getConfig();
+      await this.assertLiveSessionScope(liveConfig, settings, params.cwd);
+      return this.withLiveSessionRestore(
+        params.sessionId,
+        liveSession,
+        async (config2, sessionData2) => ({
+          modes: this.buildModesData(config2),
+          models: this.buildAvailableModels(config2),
+          configOptions: this.buildConfigOptions(config2),
+          ...sessionData2.artifactSnapshot ? { artifactSnapshot: sessionData2.artifactSnapshot } : {}
+        })
+      );
+    }
+    const exists = await this.runWithPinnedRuntimeBaseDir(
       settings,
       params.cwd,
       async () => {
@@ -9651,14 +10506,23 @@ var QwenAgent = class {
       params.sessionId,
       true
     );
-    await this.ensureAuthenticated(config);
-    this.setupFileSystem(config);
-    const session = await this.createAndStoreSession(
-      config,
-      settings,
-      config.getResumedSessionData(),
-      { replayHistory: false }
-    );
+    let session;
+    try {
+      await this.ensureAuthenticated(config);
+      this.setupFileSystem(config);
+      session = await this.createAndStoreSession(
+        config,
+        settings,
+        config.getResumedSessionData(),
+        { replayHistory: false }
+      );
+    } catch (error) {
+      return this.cleanupAfterRequestFailure(error, async () => {
+        if (this.sessions.get(config.getSessionId())?.getConfig() !== config) {
+          await this.cleanupUnstoredConfig(config);
+        }
+      });
+    }
     await this.#restoreWorktreeOnResume(config, session);
     this.#restoreGoalOnResume(config, session);
     const modesData = this.buildModesData(config);
@@ -11572,6 +12436,19 @@ var QwenAgent = class {
     };
   }
   async extMethod(method, params) {
+    try {
+      return await this.extMethodInternal(method, params);
+    } catch (error) {
+      const writerError = getSessionWriterError(error);
+      if (writerError) {
+        throw new RequestError(writerError.rpcCode, writerError.message, {
+          errorKind: writerError.errorKind
+        });
+      }
+      throw error;
+    }
+  }
+  async extMethodInternal(method, params) {
     const requestedCwd = typeof params["cwd"] === "string" ? params["cwd"] : void 0;
     const cwd = requestedCwd || process.cwd();
     const SESSION_ID_RE = /^[0-9a-fA-F-]{32,36}$/;
@@ -11845,6 +12722,25 @@ var QwenAgent = class {
             "Transcript cursor and record boundary are mutually exclusive"
           );
         }
+        const rawDirection = params["direction"];
+        if (rawDirection !== void 0 && rawDirection !== "backward") {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid transcript direction"
+          );
+        }
+        if (rawCursor !== void 0 && rawDirection !== void 0) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Transcript cursor and direction are mutually exclusive"
+          );
+        }
+        if (rawBeforeRecordId !== void 0 && rawDirection !== void 0) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Transcript record boundary and direction are mutually exclusive"
+          );
+        }
         const rawLimit = params["limit"];
         if (rawLimit !== void 0 && (!Number.isSafeInteger(rawLimit) || rawLimit < 1 || rawLimit > SESSION_TRANSCRIPT_MAX_LIMIT)) {
           throw RequestError.invalidParams(
@@ -11855,10 +12751,14 @@ var QwenAgent = class {
         try {
           const settings = loadSettingsCached(cwd);
           return await runWithAcpRuntimeOutputDir(settings, cwd, async () => {
+            if (rawDirection === "backward") {
+              await this.sessions.get(sessionId)?.getConfig().getChatRecordingService()?.flush();
+            }
             const reader = new SessionTranscriptReader(cwd);
             const page = await reader.readPage(sessionId, {
               ...typeof rawCursor === "string" ? { cursor: rawCursor } : {},
               ...typeof rawBeforeRecordId === "string" ? { beforeRecordId: rawBeforeRecordId } : {},
+              ...rawDirection === "backward" ? { direction: rawDirection } : {},
               ...typeof rawLimit === "number" ? { limit: rawLimit } : {},
               maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
             });
@@ -12712,6 +13612,34 @@ var QwenAgent = class {
         }
         return { sessionId, persisted: true, kind };
       }
+      case "qwen/session/recordTextElements": {
+        const sessionId = params["sessionId"];
+        const content = params["content"];
+        const textElements = params["textElements"];
+        if (typeof sessionId !== "string" || sessionId.length === 0) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid or missing sessionId"
+          );
+        }
+        if (typeof content !== "string" || !Array.isArray(textElements)) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid user text elements payload"
+          );
+        }
+        const session = this.sessionOrThrow(sessionId);
+        await session.assertCanStartTurn();
+        const recording = session.getConfig().getChatRecordingService();
+        if (!recording) {
+          throw RequestError.internalError(
+            void 0,
+            "Chat recording service unavailable"
+          );
+        }
+        await recording.recordUserTextElements({ content, textElements });
+        return { sessionId, persisted: true };
+      }
       case SERVE_CONTROL_EXT_METHODS.sessionTitle: {
         const sessionId = params["sessionId"];
         const displayName = params["displayName"];
@@ -12807,8 +13735,16 @@ var QwenAgent = class {
             "Invalid or missing sessionId"
           );
         }
+        const rawDrainTimeoutMs = params["drainTimeoutMs"];
+        if (rawDrainTimeoutMs !== void 0 && (typeof rawDrainTimeoutMs !== "number" || !Number.isSafeInteger(rawDrainTimeoutMs) || rawDrainTimeoutMs < 1 || rawDrainTimeoutMs > 2147483647)) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Invalid session close drain timeout"
+          );
+        }
         await this.closeStoredSession(sessionId, {
-          requireFlush: params["requireFlush"] === true
+          requireFlush: params["requireFlush"] === true,
+          ...typeof rawDrainTimeoutMs === "number" ? { drainTimeoutMs: rawDrainTimeoutMs } : {}
         });
         return { sessionId, closed: true };
       }
@@ -12850,6 +13786,21 @@ var QwenAgent = class {
           });
         }
         const canonicalPath = await fs2.realpath(targetPath);
+        const allowedRoots = params["allowedRoots"];
+        if (Array.isArray(allowedRoots) && allowedRoots.length > 0) {
+          const contained = allowedRoots.some((root) => {
+            if (typeof root !== "string") return false;
+            const rel = path4.relative(root, canonicalPath);
+            return !rel.startsWith("..") && !path4.isAbsolute(rel);
+          });
+          if (!contained) {
+            throw new RequestError(
+              -32004,
+              `Path outside allowed roots: ${canonicalPath}`,
+              { errorKind: "containment_violation", path: canonicalPath }
+            );
+          }
+        }
         const previousCwd = config.getTargetDir();
         if (canonicalPath === previousCwd) {
           return { previousCwd, newCwd: canonicalPath, warnings: [] };
@@ -13731,16 +14682,11 @@ ${outputText}
         let artifactSnapshot;
         let artifactSnapshotUnavailable;
         try {
-          await session.getConfig().getChatRecordingService()?.flush();
-          const cwd2 = session.getConfig().getProjectRoot();
-          const sessionData = await runWithAcpRuntimeOutputDir(
-            this.settings,
-            cwd2,
-            async () => {
-              const sessionService = new SessionService(cwd2);
-              return sessionService.loadSession(sessionId);
-            }
-          );
+          const config = session.getConfig();
+          const recording = config.getChatRecordingService();
+          await recording?.flush();
+          const loadAuthoritative = /* @__PURE__ */ __name(() => config.getSessionService().loadSession(sessionId), "loadAuthoritative");
+          const sessionData = recording ? await recording.runWithWriteBarrier(loadAuthoritative) : await loadAuthoritative();
           if (sessionData === void 0) {
             artifactSnapshotUnavailable = "session data unavailable after rewind";
           } else if (sessionData.artifactSnapshot) {
@@ -13781,20 +14727,37 @@ ${outputText}
             "Invalid or missing sessionId"
           );
         }
-        const sessionData = await runWithAcpRuntimeOutputDir(
-          this.settings,
-          cwd,
-          async () => {
-            const sessionService = new SessionService(cwd);
-            return sessionService.loadSession(sessionId);
-          }
-        );
+        const liveSession = this.sessions.get(sessionId);
+        let replayConfig = this.config;
+        let sessionData;
+        if (liveSession) {
+          const config = liveSession.getConfig();
+          await this.assertLiveSessionScope(
+            config,
+            loadSettingsCached(cwd),
+            cwd
+          );
+          const recording = config.getChatRecordingService();
+          const loadAuthoritative = /* @__PURE__ */ __name(() => config.getSessionService().loadSession(sessionId), "loadAuthoritative");
+          sessionData = recording ? await recording.runWithWriteBarrier(loadAuthoritative) : await loadAuthoritative();
+          replayConfig = config;
+        } else {
+          const settings = loadSettingsCached(cwd);
+          sessionData = await this.runWithPinnedRuntimeBaseDir(
+            settings,
+            cwd,
+            async () => {
+              const sessionService = new SessionService(cwd);
+              return sessionService.loadSession(sessionId);
+            }
+          );
+        }
         if (!sessionData?.conversation) {
           return { updates: [] };
         }
         const replay = await collectHistoryReplayUpdates({
           sessionId,
-          config: this.config,
+          config: replayConfig,
           records: sessionData.conversation.messages,
           gaps: sessionData.historyGaps,
           cumulativeUsage: createReplayCumulativeUsage(),
@@ -13862,56 +14825,51 @@ ${outputText}
             sessionId
           });
         }
-        const recording = sourceSession.getConfig().getChatRecordingService();
+        const sourceConfig = sourceSession.getConfig();
+        const recording = sourceConfig.getChatRecordingService();
         if (recording) {
           await recording.flush();
         }
-        const newSessionId = randomUUID();
-        return await runWithAcpRuntimeOutputDir(
-          this.settings,
-          cwd,
-          async () => {
-            const sessionService = new SessionService(cwd);
-            await sessionService.forkSession(sessionId, newSessionId);
-            let title;
-            try {
-              let baseName;
-              if (typeof name === "string" && name.trim().length > 0) {
-                baseName = name.trim();
-              } else {
-                const existingTitle = recording?.getCurrentCustomTitle();
-                const stripped = existingTitle?.replace(/\s*\(Branch(?:\s+\d+)?\)\s*$/, "").trim();
-                if (stripped && stripped.length > 0) {
-                  baseName = stripped;
-                } else {
-                  baseName = sessionId.slice(0, 8);
-                }
-              }
-              title = await computeUniqueBranchTitle(baseName, sessionService);
-              const renamed = await sessionService.renameSession(
-                newSessionId,
-                title,
-                "manual"
-              );
-              if (!renamed) {
-                throw new RequestError(
-                  -32603,
-                  `Failed to set title on forked session ${newSessionId}`,
-                  { errorKind: "internal", sessionId: newSessionId }
-                );
-              }
-            } catch (err) {
-              sessionService.removeSession(newSessionId).catch((rmErr) => {
-                process.stderr.write(
-                  `qwen serve: failed to clean up orphan session ${newSessionId}: ${rmErr instanceof Error ? rmErr.message : rmErr}
-`
-                );
-              });
-              throw err;
+        const newSessionId = randomUUID2();
+        const sessionService = sourceConfig.getSessionService();
+        await sessionService.forkSession(sessionId, newSessionId);
+        let title;
+        try {
+          let baseName;
+          if (typeof name === "string" && name.trim().length > 0) {
+            baseName = name.trim();
+          } else {
+            const existingTitle = recording?.getCurrentCustomTitle();
+            const stripped = existingTitle?.replace(/\s*\(Branch(?:\s+\d+)?\)\s*$/, "").trim();
+            if (stripped && stripped.length > 0) {
+              baseName = stripped;
+            } else {
+              baseName = sessionId.slice(0, 8);
             }
-            return { newSessionId, title, displayName: title };
           }
-        );
+          title = await computeUniqueBranchTitle(baseName, sessionService);
+          const renamed = await sessionService.renameSession(
+            newSessionId,
+            title,
+            "manual"
+          );
+          if (!renamed) {
+            throw new RequestError(
+              -32603,
+              `Failed to set title on forked session ${newSessionId}`,
+              { errorKind: "internal", sessionId: newSessionId }
+            );
+          }
+        } catch (err) {
+          sessionService.removeSession(newSessionId).catch((rmErr) => {
+            process.stderr.write(
+              `qwen serve: failed to clean up orphan session ${newSessionId}: ${rmErr instanceof Error ? rmErr.message : rmErr}
+`
+            );
+          });
+          throw err;
+        }
+        return { newSessionId, title, displayName: title };
       }
       case "qwen/settings/getCore": {
         const settings = loadSettings(cwd);
@@ -14300,17 +15258,25 @@ ${outputText}
       this.disposeTranscriptReplayConfig(cached.config);
     }
     const entry = { settings };
-    const pending = this.newSessionConfig(cwd, [], settings, void 0, false, {
-      skipMcpDiscovery: true,
-      skipHooks: true,
-      skipSkillManager: true,
-      skipFileCheckpointing: true,
-      // Read-only replay: tolerate tools that cannot construct without the
-      // subsystems skipped above (e.g. SkillTool needs the SkillManager). The
-      // registry is only consulted for optional tool_call metadata during
-      // replay, and ToolCallEmitter falls back to the recorded tool name.
-      lenientToolWarmup: true
-    });
+    const pending = this.newSessionConfig(
+      cwd,
+      [],
+      settings,
+      void 0,
+      false,
+      {
+        skipMcpDiscovery: true,
+        skipHooks: true,
+        skipSkillManager: true,
+        skipFileCheckpointing: true,
+        // Read-only replay: tolerate tools that cannot construct without the
+        // subsystems skipped above (e.g. SkillTool needs the SkillManager). The
+        // registry is only consulted for optional tool_call metadata during
+        // replay, and ToolCallEmitter falls back to the recorded tool name.
+        lenientToolWarmup: true
+      },
+      false
+    );
     entry.pending = pending;
     this.transcriptReplayConfigCache.set(key, entry);
     try {
@@ -14338,7 +15304,34 @@ ${outputText}
       throw error;
     }
   }
-  async newSessionConfig(cwd, mcpServers, settings, sessionId, resume, initializeOptions = {}) {
+  async newSessionConfig(cwd, mcpServers, settings, sessionId, resume, initializeOptions = {}, chatRecording) {
+    try {
+      return await this.runWithPinnedRuntimeBaseDir(settings, cwd, async () => {
+        await this.retryPendingConfigCleanup(
+          Storage.getRuntimeBaseDir(),
+          sessionId
+        );
+        return this.newSessionConfigInRuntimeContext(
+          cwd,
+          mcpServers,
+          settings,
+          sessionId,
+          resume,
+          initializeOptions,
+          chatRecording
+        );
+      });
+    } catch (error) {
+      const writerError = getSessionWriterError(error);
+      if (writerError) {
+        throw new RequestError(writerError.rpcCode, writerError.message, {
+          errorKind: writerError.errorKind
+        });
+      }
+      throw error;
+    }
+  }
+  async newSessionConfigInRuntimeContext(cwd, mcpServers, settings, sessionId, resume, initializeOptions = {}, chatRecording) {
     const sessionMcpServers = {};
     for (const server of mcpServers) {
       const stdioServer = toStdioServer(server);
@@ -14394,8 +15387,14 @@ ${outputText}
     const sessionArg = resume === true ? { resume: sessionId, sessionId: void 0 } : { sessionId, resume: void 0 };
     const argvForSession = {
       ...this.argv,
+      // Docker sandbox relaunch injects a fixed --sandbox-session-id into
+      // the ACP process argv. Without clearing it, every newSession()
+      // inherits the same ID and the second session collides with the
+      // first's writer lease (#7435).
+      sandboxSessionId: void 0,
       ...sessionArg,
-      continue: false
+      continue: false,
+      ...chatRecording !== void 0 ? { chatRecording } : {}
     };
     const config = await loadCliConfig(
       mergedSettings,
@@ -14449,15 +15448,22 @@ ${outputText}
         });
       });
     }
-    await config.initialize({
-      ...initializeOptions,
-      // Reverse tool channel (issue #5626, Phase 2): bind the session
-      // manager's SDK MCP callback to the `client_mcp/message` ext-method so a
-      // client-hosted (extension) MCP server added at runtime reaches the
-      // daemon WS. Servers that aren't client-hosted never use this callback
-      // (the daemon only adds SDK-type runtime servers for client MCP).
-      sendSdkMcpMessage: this.buildClientMcpSender(wiredSessionId)
-    });
+    try {
+      await config.initialize({
+        ...initializeOptions,
+        // Reverse tool channel (issue #5626, Phase 2): bind the session
+        // manager's SDK MCP callback to the `client_mcp/message` ext-method so a
+        // client-hosted (extension) MCP server added at runtime reaches the
+        // daemon WS. Servers that aren't client-hosted never use this callback
+        // (the daemon only adds SDK-type runtime servers for client MCP).
+        sendSdkMcpMessage: this.buildClientMcpSender(wiredSessionId)
+      });
+    } catch (error) {
+      return this.cleanupAfterRequestFailure(
+        error,
+        () => this.cleanupUnstoredConfig(config)
+      );
+    }
     void this.surfaceMcpFailuresWhenReady(config);
     return config;
   }
@@ -14518,29 +15524,47 @@ ${outputText}
     if (needsInitialize) {
       await geminiClient.initialize();
     }
-    this.sessions.get(sessionId)?.dispose();
+    if (this.sessions.has(sessionId)) {
+      throw new Error(`Session ${sessionId} is already active.`);
+    }
     const session = new Session(sessionId, config, this.connection, settings);
     this.sessions.set(sessionId, session);
-    setTimeout(async () => {
-      await session.sendAvailableCommandsUpdate();
-    }, 0);
-    if (sessionData?.fileHistorySnapshots?.length) {
-      config.getFileHistoryService().restoreFromSnapshots(sessionData.fileHistorySnapshots);
-    }
-    if (sessionData?.conversation.messages) {
-      config.getChatRecordingService()?.rebuildTurnBoundaries(sessionData.conversation.messages);
-    }
-    if (options.replayHistory !== false && sessionData?.conversation.messages) {
-      await session.replayHistory(
-        sessionData.conversation.messages,
-        sessionData.historyGaps
-      );
-    }
-    if (options.startPostReplayServices !== false) {
-      session.installRewriter();
-      session.startCronScheduler();
+    try {
+      if (sessionData?.fileHistorySnapshots?.length) {
+        config.getFileHistoryService().restoreFromSnapshots(sessionData.fileHistorySnapshots);
+      }
+      if (sessionData?.conversation.messages) {
+        config.getChatRecordingService()?.rebuildTurnBoundaries(sessionData.conversation.messages);
+      }
+      if (options.replayHistory !== false && sessionData?.conversation.messages) {
+        await session.replayHistory(
+          sessionData.conversation.messages,
+          sessionData.historyGaps
+        );
+      }
+      if (options.startPostReplayServices !== false) {
+        session.installRewriter();
+        session.startCronScheduler();
+      }
+      setTimeout(() => {
+        void session.sendAvailableCommandsUpdate();
+      }, 0);
+      return session;
+    } catch (error) {
+      try {
+        await this.discardStoredSessionIfCurrent(sessionId, session, {
+          shutdownConfig: false
+        });
+      } catch (cleanupError) {
+        await this.removeStoredSessionEntry(
+          sessionId,
+          session,
+          [cleanupError],
+          { shutdownConfig: false }
+        );
+      }
+      throw error;
     }
-    return session;
   }
   buildAvailableModels(config) {
     const rawCurrentModelId = (config.getModel() || this.config.getModel() || "").trim();