@qwen-code/qwen-code 0.21.0-nightly.20260727.c003e1718 → 0.21.0-preview.0

package/bundled/qc-helper/docs/configuration/settings.md

@@ -557,6 +557,7 @@ LSP server configuration is done through `.lsp.json` files in your project root
 | -------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
 | `experimental.cron`                    | boolean | Enable in-session cron/loop tools (`cron_create`, `cron_list`, `cron_delete`) so the model can create recurring prompts. Can be disabled via the `QWEN_CODE_DISABLE_CRON=1` environment variable. Requires restart.                                                                                                                                                                                          | `true`  |
 | `experimental.todoStopGuard`           | boolean | Allow daemon and ACP sessions to continue after a natural model stop when the current work chain successfully wrote an unfinished top-level Todo list. Adds at most two consecutive primary-model calls without new user input; mid-turn user input starts a fresh two-attempt stage. It is not restored after process restart and is forced off in safe, bare, and Approval `plan` modes. Requires restart. | `false` |
+| `experimental.sessionWriterLease`      | boolean | Enable cross-process write fencing for persisted ACP and daemon sessions. The value is frozen when the ACP or daemon process starts. All concurrent ACP writers must enable the setting; mixed versions or configurations remain unsafe. Interactive and headless recorders are unaffected. Requires process restart.                                                                                        | `false` |
 | `experimental.cronRecurringMaxAgeDays` | number  | Days a recurring cron/loop job lives before auto-expiring (it fires one final time, then is deleted). Set to `0` to disable expiry so jobs run until deleted — useful for long-running daemon deployments. Can be overridden via the `QWEN_CODE_CRON_MAX_AGE_DAYS` environment variable. Requires restart.                                                                                                   | `7`     |
 | `experimental.agentTeam`               | boolean | Enable agent-team collaboration tools (`team_create`, `task_create`, `task_update`, `send_message`, etc.) for multi-agent coordination. Can also be enabled via `QWEN_CODE_ENABLE_AGENT_TEAM=1`. Requires restart.                                                                                                                                                                                           | `false` |
 | `experimental.artifact`                | boolean | Enable artifact tools. Enabled by default. In interactive, non-SDK sessions, the model can publish a self-contained HTML page as an interactive Artifact and open it in the browser. Non-SDK daemon sessions can use metadata-only `record_artifact`. Set this to `false` or use `QWEN_CODE_DISABLE_ARTIFACT=1` to disable both. Requires restart.                                                           | `true`  |
@@ -592,6 +593,7 @@ Configures logging and metrics collection for Qwen Code. For more information, s
 | `telemetry.otlpEndpoint`                    | string  | The endpoint for the OTLP Exporter.                                                                                                                                                                                                                                                      |           |
 | `telemetry.otlpProtocol`                    | string  | The protocol for the OTLP Exporter (`grpc` or `http`).                                                                                                                                                                                                                                   |           |
 | `telemetry.logPrompts`                      | boolean | Whether or not to include the content of user prompts in the logs.                                                                                                                                                                                                                       |           |
+| `telemetry.userId`                          | string  | Stable end-user identifier written to GenAI spans as the ARMS extension `gen_ai.user.id`. Prefer a pseudonymous value. Do not set a process-wide value for a shared multi-user daemon or channel instance.                                                                               |           |
 | `telemetry.includeSensitiveSpanAttributes`  | boolean | When enabled, attaches verbatim user prompts, system prompts, tool inputs/outputs, and model responses to native OTel span attributes (in addition to log-to-span bridge spans). ⚠️ Streams sensitive data — file contents, shell commands, conversation history — to your OTLP backend. | `false`   |
 | `telemetry.sensitiveSpanAttributeMaxLength` | number  | Maximum JavaScript string length for each sensitive native OTel span attribute content payload. Must be between `1` and `104857600` (100 MiB). Set lower if your collector or backend rejects large attributes.                                                                          | `1048576` |
 | `telemetry.outfile`                         | string  | Path to write telemetry to a file. When set, overrides OTLP export.                                                                                                                                                                                                                      |           |
@@ -638,6 +640,7 @@ Here is an example of a `settings.json` file with the nested structure, new as o
     "target": "local",
     "otlpEndpoint": "http://localhost:4317",
     "logPrompts": true,
+    "userId": "user-079458",
     "includeSensitiveSpanAttributes": false,
     "sensitiveSpanAttributeMaxLength": 1048576
   },
@@ -695,6 +698,7 @@ For authentication-related variables (like `OPENAI_*`) and the recommended `.qwe
 | `QWEN_TELEMETRY_OTLP_ENDPOINT`                       | Sets the OTLP endpoint for telemetry.                                                                                                                                                                                                                                                                                                                                                                            | Overrides the `telemetry.otlpEndpoint` setting.                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `QWEN_TELEMETRY_OTLP_PROTOCOL`                       | Sets the OTLP protocol (`grpc` or `http`).                                                                                                                                                                                                                                                                                                                                                                       | Overrides the `telemetry.otlpProtocol` setting.                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `QWEN_TELEMETRY_LOG_PROMPTS`                         | Set to `true` or `1` to enable or disable logging of user prompts. Any other value is treated as disabling it.                                                                                                                                                                                                                                                                                                   | Overrides the `telemetry.logPrompts` setting.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `QWEN_TELEMETRY_USER_ID`                             | Sets a stable end-user identifier on interaction, LLM, Tool, and Agent spans as `gen_ai.user.id`. Prefer a pseudonymous value.                                                                                                                                                                                                                                                                                   | Overrides `telemetry.userId` after trimming. A blank value falls back to settings. This is process-wide and must not be used as per-request identity in a shared multi-user process.                                                                                                                                                                                                                                                                                               |
 | `QWEN_TELEMETRY_INCLUDE_SENSITIVE_SPAN_ATTRIBUTES`   | Set to `true` or `1` to attach verbatim user prompts, system prompts, tool I/O, and model responses to native OTel span attributes (and keep `prompt` / `function_args` / `response_text` on log-to-span bridge spans). Any other value disables it.                                                                                                                                                             | Overrides the `telemetry.includeSensitiveSpanAttributes` setting. ⚠️ Streams sensitive data to your OTLP backend.                                                                                                                                                                                                                                                                                                                                                                  |
 | `QWEN_TELEMETRY_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH` | Sets the maximum JavaScript string length for each sensitive native OTel span attribute content payload. Must be a positive integer no greater than `104857600` (100 MiB).                                                                                                                                                                                                                                       | Overrides the `telemetry.sensitiveSpanAttributeMaxLength` setting. Default is `1048576` (1 MiB); lower it if your collector or backend rejects large span attributes.                                                                                                                                                                                                                                                                                                              |
 | `QWEN_TELEMETRY_OUTFILE`                             | Sets the file path to write telemetry to. When set, overrides OTLP export.                                                                                                                                                                                                                                                                                                                                       | Overrides the `telemetry.outfile` setting.                                                                                                                                                                                                                                                                                                                                                                                                                                         |

package/bundled/qc-helper/docs/features/channels/github.md

@@ -1,6 +1,6 @@
 # GitHub
 
-This guide covers setting up a Qwen Code channel that monitors GitHub notifications and responds to mentions on issues and pull requests.
+This guide covers setting up a Qwen Code channel that monitors GitHub notifications and responds to mentions, review requests, assignments, and followed-thread activity.
 
 ## Prerequisites
 
@@ -57,18 +57,18 @@ For GitHub Enterprise Server, set `baseUrl`:
 
 ## Configuration Options
 
-| Option                    | Default                  | Description                                          |
-| ------------------------- | ------------------------ | ---------------------------------------------------- |
-| `token`                   | (required)               | Classic PAT with `notifications` scope               |
-| `pollInterval`            | `60000`                  | Poll interval in ms                                  |
-| `baseUrl`                 | `https://api.github.com` | API base URL (for GHE)                               |
-| `groupPolicy`             | `"disabled"`             | Must be `"open"` for notifications to flow           |
-| `senderPolicy`            | `"allowlist"`            | Who can trigger the bot                              |
-| `groups.*.requireMention` | `true`                   | Only respond when @mentioned (nested under `groups`) |
+| Option                    | Default                  | Description                                                                      |
+| ------------------------- | ------------------------ | -------------------------------------------------------------------------------- |
+| `token`                   | (required)               | Classic PAT with `notifications` scope                                           |
+| `pollInterval`            | `60000`                  | Poll interval in ms                                                              |
+| `baseUrl`                 | `https://api.github.com` | API base URL (for GHE)                                                           |
+| `groupPolicy`             | `"disabled"`             | Must be `"open"` for notifications to flow                                       |
+| `senderPolicy`            | `"allowlist"`            | Who can trigger the bot                                                          |
+| `groups.*.requireMention` | `true`                   | Require @mentions for ordinary comments; directed notification reasons still run |
 
 ## ⚠️ Security
 
-On a **public repository**, setting `senderPolicy: "open"` allows **any GitHub user** who @mentions the bot to submit prompts that drive the agent in your `cwd`. This includes reading code, spending tokens, posting comments, and (subject to permission policy) running tools.
+On a **public repository**, setting `senderPolicy: "open"` allows **any GitHub user** who triggers a supported notification reason to submit prompts that drive the agent in your `cwd`. This includes reading code, spending tokens, posting comments, and (subject to permission policy) running tools.
 
 Always use `senderPolicy: "allowlist"` with explicit `allowedUsers` on public repos.
 
@@ -76,7 +76,7 @@ Allowlist and pairing entries follow the **username**, not the immutable account
 
 ## Mention Detection
 
-The adapter detects mentions by scanning the **comment body** for `@bot-username` using a case-insensitive regex. It does NOT rely on GitHub's notification `reason` field, which is a sticky thread-level value that doesn't reflect per-comment mentions.
+The adapter detects mentions by scanning comment text and first-contact issue or PR bodies for `@bot-username` using a case-insensitive regex. It does not trust `reason: "mention"` alone because that value is sticky at the thread level. Other reasons select review, triage, followed-thread, or fallback prompts.
 
 ## How It Works
 
@@ -85,8 +85,8 @@ The adapter uses GitHub's Notifications API as a wake-up signal:
 1. **Poll** `GET /notifications` for unread threads
 2. **Mark read** via `markNotificationsAsRead` (best-effort cleanup, before processing)
 3. **Enumerate** comments via `listComments` within a cursor-based time window
-4. **Process** each new comment (mention detection, envelope building)
-5. **First-contact**: if no mention was dispatched and the thread is brand-new (no `last_read_at`), the issue/PR body is fetched and processed if it contains @bot
+4. **Dispatch** by notification reason: strict mention matching, pull request review, issue triage, followed-thread comment aggregation, or per-comment fallback
+5. **First-contact fallback**: a brand-new unread issue/PR body can be processed when no comment was dispatched; mention notifications still require an actual body mention
 
 The comment window is `(previousCursor, currentMaxUpdatedAt]` — comments already eligible in a previous poll cycle are excluded by the cursor, preventing duplicate replies even when the async mark-read has not taken effect. If the process crashes mid-processing, the user can re-mention the bot to retry.
 
@@ -96,7 +96,7 @@ Non-comment activity (push, label changes) bumps the notification's `updated_at`
 
 - **First start skips existing unread notifications.** The cursor initializes to "now" on first launch. Notifications created before the bot starts are not processed unless the thread receives new activity afterwards.
 - If a user marks a notification as read on github.com before the bot's poll cycle, the bot will not process it.
-- The bot does not read prior conversation history — only the triggering comment is processed.
+- The bot does not read comments before the current polling window; `author` and `comment` notifications may aggregate up to 20 comments from that window.
 - Inline PR review comments and review summary bodies are not enumerated; only issue/PR comments are processed.
 - Requires a classic PAT with `notifications` scope. Fine-grained PATs do not support the notifications API.
 

package/bundled/qc-helper/docs/features/hooks.md

@@ -139,6 +139,8 @@ Function hooks directly call registered JavaScript/TypeScript functions. They ar
 
 Prompt hooks use an LLM to evaluate hook input and return a decision. This is useful for making intelligent decisions based on context, such as determining whether to allow or block an operation.
 
+> **Data handling:** A prompt hook sends its event input to the configured model provider. When file-backed debug logging is enabled, the fully expanded prompt-hook request is also written to the session debug log. Treat hook input and debug logs as potentially sensitive.
+
 **How it works:**
 
 1. The hook input JSON is injected into your prompt using the `$ARGUMENTS` placeholder
@@ -184,7 +186,7 @@ Prompt hooks can be used with most hook events, including:
 - `PostToolUse` - Evaluate tool results and potentially inject context
 - `Stop` - Determine whether to continue or stop
 - `SubagentStop` - Evaluate subagent results
-- `UserPromptSubmit` - Evaluate or enrich user prompts
+- `UserPromptSubmit` - Evaluate or enrich eligible model-bound prompts
 
 **Example: Stop Hook**
 
@@ -240,7 +242,7 @@ Hooks fire at specific points during a Qwen Code session. Different events suppo
 | `PreToolUse`         | Before tool execution                     | Tool id (`write_file`, `read_file`, `run_shell_command`, etc.) |
 | `PostToolUse`        | After successful tool execution           | Tool id                                                        |
 | `PostToolUseFailure` | After tool execution fails                | Tool id                                                        |
-| `UserPromptSubmit`   | After user submits prompt                 | None (always fires)                                            |
+| `UserPromptSubmit`   | Before supported model invocations        | None                                                           |
 | `SessionStart`       | When session starts or resumes            | Source (`startup`, `resume`, `clear`, `compact`)               |
 | `SessionEnd`         | When session ends                         | Reason (`clear`, `logout`, `prompt_input_exit`, etc.)          |
 | `MessageDisplay`     | Repeatedly, as the reply streams          | None (always fires)                                            |
@@ -327,7 +329,18 @@ Hooks fire at specific points during a Qwen Code session. Different events suppo
 
 ### Hook Input Structure
 
-All hooks receive standardized input in JSON format through stdin (command) or POST body (http).
+All hook executors receive the standardized event input. The delivery boundary depends on the executor:
+
+| Hook type  | Input recipient                                                 |
+| :--------- | :-------------------------------------------------------------- |
+| `command`  | Child process through JSON on `stdin`                           |
+| `http`     | Configured endpoint through a JSON `POST` body                  |
+| `function` | Trusted in-process callback                                     |
+| `prompt`   | Configured model provider after the input replaces `$ARGUMENTS` |
+
+Function hooks are trusted code running in the Qwen process. They receive an in-process object, so fields must not be treated as immutable against a function hook.
+
+Qwen does not control whether a hook process, endpoint, callback, or model provider retains or forwards its input. Review each configured executor's data-handling policy.
 
 **Common Fields:**
 
@@ -343,6 +356,8 @@ All hooks receive standardized input in JSON format through stdin (command) or P
 
 Event-specific fields are added based on the hook type. When running in a subagent, `agent_id` and `agent_type` are additionally included.
 
+Hook input is a forward-extensible JSON contract: new optional fields can be added to existing events. Consumers should ignore unknown fields. A strict decoder that rejects unknown properties must be updated to explicitly allow each new optional field before upgrading Qwen Code. For security-sensitive hooks, a decoder failure can change fail-open or fail-closed behavior, so administrators must validate the upgraded payload against the deployed hook before rollout.
+
 ### Hook Output Structure
 
 Hook output is returned via `stdout` (command) or HTTP response body (http) as JSON.
@@ -491,16 +506,33 @@ The `permissionDecision` value controls whether the tool runs:
 
 #### UserPromptSubmit
 
-**Purpose**: Executed when the user submits a prompt to modify, validate, or enrich the input.
+**Purpose**: Executed before supported model invocations to validate, block, or enrich the current model-bound prompt. The event currently covers `UserQuery`, `ToolResult`, and `Hook` sends, while `Retry`, `Steer`, `Cron`, `Notification`, and `Teammate` sends are skipped. It can therefore occur on continuation paths, and `prompt` must not be assumed to be raw user input.
 
 **Event-specific fields**:
 
 ```json
 {
-  "prompt": "the user's submitted prompt text"
+  "prompt": "current model-bound prompt for this hook invocation",
+  "submitted_prompt": "optional user text captured at a supported interactive TUI submission boundary"
 }
 ```
 
+`submitted_prompt` is optional. It is present only when Qwen can carry provenance from a supported interactive TUI submission to a fresh `UserQuery`. It is omitted for unsupported producers and machine-driven paths such as same-turn steering, tool-result continuations, retries, cron, notifications, and teammate traffic. ACP, headless, `serve`, SDK, and remote-input paths do not produce it in this version.
+
+Deferred input can retain the field when its provenance remains complete. A combined batch retains provenance only when every constituent item has it; edited, partially known, or otherwise ambiguous input omits the field. Prompt, command, and shell-history navigation or selected search matches, cross-restart stash restores, and conversation rewind restores also omit it because those paths can surface model-bound text without its original provenance. Consumers that require user-submitted text should treat absence as unavailable rather than falling back to `prompt`.
+
+After restored or provenance-unavailable model-bound input is cleared or submitted, the composer also clears its undo and redo history. This prevents undo from restoring expanded text after its marker or sidecar has been consumed.
+
+Large-paste placeholders remain compact in `submitted_prompt`; the expanded pasted content appears only in `prompt`. Consumers should treat the field as a TUI text projection rather than a byte-for-byte record of clipboard input.
+
+Any non-empty input present while Vim mode is enabled omits `submitted_prompt`, including after Vim is disabled, because Vim registers do not carry provenance in this version. This conservative rule also covers drafts entered before enabling Vim. Clearing the composer starts a new eligible input.
+
+This field is provenance, not authentication, tenant identity, authorization, or DLP. It is caller-supplied data. Every executor configured for this event receives it; in particular, HTTP hooks send it to their endpoint and prompt hooks send it to their model provider.
+
+When both fields are present, prompt-hook payloads contain overlapping text and can consume additional model input tokens. There is no per-hook field suppression in this version.
+
+Sequential UserPromptSubmit hooks can append `additionalContext` to `prompt`; `submitted_prompt` continues to represent the captured submission. Function hooks are trusted same-process code and are not constrained by an immutability guarantee.
+
 **Output Options**:
 
 - `decision`: "allow", "deny", "block", or "ask"
@@ -1289,9 +1321,11 @@ A PostToolUse HTTP hook that sends all tool execution records to a remote audit
 }
 ```
 
-### Example 3: User Prompt Validation Hook
+### Example 3: Interactive TUI Submitted Prompt Validation Hook
+
+To inspect the current model-bound content instead, read `prompt`. That field can include generated or expanded content, is not the original user input, and does not imply that `UserPromptSubmit` covers every model send. Do not silently fall back from `submitted_prompt` to `prompt` when source provenance is required.
 
-A UserPromptSubmit hook that validates user prompts for sensitive information and provides context for long prompts:
+A UserPromptSubmit hook that validates supported interactive TUI submissions for sensitive information and provides context for long prompts. It skips invocations where source provenance is unavailable. The keyword check is illustrative and is not a complete DLP policy:
 
 **prompt_validator.py**
 
@@ -1305,9 +1339,12 @@ try:
     input_data = json.load(sys.stdin)
 except json.JSONDecodeError as e:
     print(f"Error: Invalid JSON input: {e}", file=sys.stderr)
-    exit(1)
+    sys.exit(1)
 
-user_prompt = input_data.get("prompt", "")
+user_prompt = input_data.get("submitted_prompt")
+if user_prompt is None:
+    # Do not mistake model-bound or machine-generated content for raw input.
+    sys.exit(0)
 
 # Sensitive words list
 sensitive_words = ["password", "secret", "token", "api_key"]
@@ -1324,7 +1361,7 @@ for word in sensitive_words:
             }
         }
         print(json.dumps(output))
-        exit(0)
+        sys.exit(0)
 
 # Check prompt length and add warning context if too long
 if len(user_prompt) > 1000:
@@ -1335,10 +1372,10 @@ if len(user_prompt) > 1000:
         }
     }
     print(json.dumps(output))
-    exit(0)
+    sys.exit(0)
 
 # No processing needed for normal cases
-exit(0)
+sys.exit(0)
 ```
 
 ## Troubleshooting
@@ -1347,5 +1384,5 @@ exit(0)
 - Verify hook script permissions and executability
 - Ensure proper JSON formatting in hook outputs
 - Use specific matcher patterns to avoid unintended hook execution
-- Use `--debug` mode to see detailed hook matching and execution information
+- Use `--debug` mode to see detailed hook matching and execution information. Prompt-hook inputs can be written to the session debug log, so apply appropriate access and retention controls.
 - Temporarily disable all hooks: add `"disableAllHooks": true` in settings

package/bundled/qc-helper/docs/reference/keyboard-shortcuts.md

@@ -69,7 +69,7 @@ This document lists the available keyboard shortcuts in Qwen Code.
 
 ## History scrollback
 
-Active only when `ui.useTerminalBuffer` is enabled (Settings → UI → Virtualized History). In that mode conversation history is rendered inside an in-app viewport instead of the host terminal scrollback, so the keys below replace the terminal's native scroll.
+Active when `ui.useTerminalBuffer` is enabled (Settings → UI → Virtualized History), screen reader mode is off, and Qwen Code is running in a compatible interactive terminal (`stdout` is a TTY, CI is inactive, and `TERM` is not `dumb`), which is the default for ordinary non-screen-reader sessions. In that mode conversation history is rendered inside an in-app viewport instead of the host terminal scrollback, so the keys below replace the terminal's native scroll.
 
 | Shortcut        | Description                                          |
 | --------------- | ---------------------------------------------------- |
@@ -87,7 +87,7 @@ When `ui.useTerminalBuffer` is on, the terminal forwards mouse events to qwen-co
 
 Inside tmux, some terminals translate trackpad or wheel gestures into plain `Up Arrow` and `Down Arrow` sequences before qwen-code sees them. Those bytes are identical to real arrow-key presses, so qwen-code cannot tell whether you meant to scroll the viewport or navigate prompt history.
 
-If trackpad scrolling changes the prompt history in tmux, enable `ui.useTerminalBuffer`; then use `Shift+Up` / `Shift+Down`, or the mouse wheel when tmux forwards wheel events to the app. If you prefer host scrollback, adjust your tmux mouse bindings for wheel events.
+If trackpad scrolling changes the prompt history in tmux, make sure `ui.useTerminalBuffer` is enabled; then use `Shift+Up` / `Shift+Down`, or the mouse wheel when tmux forwards wheel events to the app. If you prefer host scrollback, adjust your tmux mouse bindings for wheel events.
 
 ## IDE Integration
 

package/bundled/qc-helper/docs/support/troubleshooting.md

@@ -59,6 +59,7 @@ This guide provides solutions to common issues and debugging tips, including top
   - A: Start Qwen Code with the `--safe-mode` flag to disable all customizations — context files, hooks, extensions, skills, MCP servers, custom subagents (only built-in subagents load), permission rules, settings-sourced approval mode overrides, memory features, and sandbox settings — for the session. Note: the CLI flags `--yolo` and `--approval-mode` still take effect in safe mode. If the problem disappears in safe mode, re-enable your customizations one at a time to find the culprit.
     - Example: `qwen --safe-mode`
     - Alternative: set the environment variable `QWEN_CODE_SAFE_MODE=true` if the CLI cannot accept flags.
+    - Note: "MCP servers" here means servers configured in `settings.json` / project `.mcp.json` — local, ambient state that safe mode is meant to isolate against. MCP servers you explicitly supply for the current invocation (an embedding ACP client's `session/new` `mcpServers`, or `--mcp-config`) are not local/ambient state and are still honored under safe mode.
 
 ## Common error messages and solutions
 
@@ -99,7 +100,7 @@ This guide provides solutions to common issues and debugging tips, including top
 - **Trackpad scrolling in tmux changes prompt history instead of scrolling the conversation**
   - **Issue:** In a tmux session, trackpad or wheel scrolling may cycle through previous prompts, similar to pressing `Up Arrow` or `Down Arrow`.
   - **Cause:** tmux can translate wheel gestures into plain arrow-key sequences. Those sequences are indistinguishable from real arrow-key presses by the time qwen-code receives them.
-  - **Solution:** Enable `ui.useTerminalBuffer`; then use `Shift+Up` / `Shift+Down`, or the mouse wheel when tmux forwards wheel events to the app. If you prefer host scrollback, adjust your tmux mouse bindings for wheel events.
+  - **Solution:** If screen reader mode is disabled, make sure `ui.useTerminalBuffer` is enabled; then use `Shift+Up` / `Shift+Down`, or the mouse wheel when tmux forwards wheel events to the app. If you prefer host scrollback, adjust your tmux mouse bindings for wheel events.
 
 ## IDE Companion not connecting
 

package/bundled/review/SKILL.md

@@ -646,6 +646,21 @@ A `C=0` outcome — Approve, or a Comment with no Critical — is a claim that n
 
 Two failure modes this closes, both observed in this repo's own dogfood: reporting a Critical that cites code **not present** at the reviewed commit (a fabricated blocker), and submitting `C=0` while a **live, already-filed** Critical still stands (a dropped blocker). The event must follow from reading the code, never from the finding count or the thread flags.
 
+### The executable-script lint (deterministic — you run it, not an agent)
+
+**Before composing the verdict, lint the executable scripts the diff changed** — for every review that has a tree to lint: a same-repo **PR** review (the fetch worktree) and a **local** review (the project root you are already in). Only a cross-repo **lightweight** review is exempt (it has no tree). A diff's shell — a `.sh`/`.bash` file, a `.github/workflows/*` `run:` block, a Dockerfile — is code whose bugs (an unquoted `$x` that word-splits, a `${PIPESTATUS[1]}` read after the array was reset) hide from a read of a long YAML and are caught by _running_ the checker. Measured, twice: a model told in prose to run the step scripts read them and did not run them (0/4), and even the strongest model's attacker persona walked into a double-execute bug and declared it correct. So this is **not** an agent's job and **not** a lens to remember — it is a command you run:
+
+```bash
+# --worktree: the PR's `worktreePath` (PR review), or `.` — the project root — (local review).
+# --out: next to the plan; `qwen-review-pr-<n>-script-lint.json` for a PR, `qwen-review-script-lint.json` for a local review.
+"${QWEN_CODE_CLI:-qwen}" review script-lint \
+  --plan <the plan report from Step 1> \
+  --worktree <worktreePath for a PR review, or . for a local review> \
+  --out <the plan report's directory>/<the derived report name>
+```
+
+**You do not read its output or decide anything from it — `compose-review` does.** It derives the report's path from the plan (the pr-numbered name above, next to the plan; `qwen-review-script-lint.json` for a local review), reads it as the sole authority, and turns it into the verdict itself: a finding on a **changed line** above cosmetic `style` becomes a **pre-confirmed `[lint]` Critical** that needs no verifier (the tool already ran); an **uninstalled or crashed** checker becomes **unreviewed scope** that caps a would-be Approve; a **deferred** checker — a workflow's embedded `run:` shell, which `actionlint` would lint but whose output this env cannot trust — is **disclosed in the body on every verdict (including Approve) but does not cap**, because it is a tool limitation, not a gap the author can close; and — the proof it ran — a diff that carries an executable script but produced **no readable report** is itself unreviewed (fail closed). That is the whole reason it runs here rather than inside an agent: neither the blocker nor its severity depends on a model, and skipping the command cannot slip an Approve past the fail-closed gate. It is harmless when the diff has no scripts (it reports "nothing to lint"), and it must write to the derived path or `compose-review` will not find it.
+
 ### Verdict
 
 **You do not decide the verdict, and you do not write it. Ask for it:**

package/chunks/{MaxSizedBox-2N5IOLMA.js → MaxSizedBox-UQGQ6O3I.js}

@@ -4,71 +4,71 @@ import {
   MINIMUM_MAX_HEIGHT,
   MaxSizedBox,
   setMaxSizedBoxDebugging
-} from "./chunk-R2F2DRBY.js";
-import "./chunk-VV6QF662.js";
+} from "./chunk-U3E3UQAA.js";
+import "./chunk-GKX7E4CO.js";
 import "./chunk-SV5PQVQE.js";
-import "./chunk-TXI4LPWT.js";
+import "./chunk-GATT5TKW.js";
+import "./chunk-UWMLWVCA.js";
 import "./chunk-5QWWOFGG.js";
-import "./chunk-7GC5YKSS.js";
-import "./chunk-IPUUTYMV.js";
+import "./chunk-YDLJGZHL.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-G3RJEBAA.js";
+import "./chunk-HUK2P4RS.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
-import "./chunk-2WVVMSPB.js";
-import "./chunk-IUNB6SUW.js";
-import "./chunk-ECBKZ7SV.js";
+import "./chunk-UPUG4GXM.js";
+import "./chunk-64LQLPL7.js";
+import "./chunk-2LQTH543.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-3FNJBOF7.js";
+import "./chunk-DJGYJDYR.js";
+import "./chunk-CVHIL5IG.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-6LOSXNKO.js";
+import "./chunk-PONHVBRT.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-3YAW4B2W.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-7R4YENCL.js";
-import "./chunk-IJDXG4RL.js";
-import "./chunk-IM6PC55H.js";
-import "./chunk-YF7TVSQK.js";
-import "./chunk-DMEKUQ5Z.js";
+import "./chunk-6QIGFD5W.js";
+import "./chunk-XWWKIXVD.js";
+import "./chunk-75GFAX4R.js";
+import "./chunk-OKF7JF3R.js";
+import "./chunk-JSD33JG6.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-JCW2R7WC.js";
-import "./chunk-2PHWA4IO.js";
+import "./chunk-2DN4J57Y.js";
 import "./chunk-ZPJWUGCS.js";
-import "./chunk-HHYPUCUF.js";
+import "./chunk-2LKVPASC.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-2LFSPVBC.js";
-import "./chunk-67ZRSECV.js";
+import "./chunk-LW3RFMG7.js";
+import "./chunk-W4MIWP6M.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-GLNBDYUX.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-EWYICJNY.js";
-import "./chunk-IXNNGTUI.js";
+import "./chunk-P2YNZWXZ.js";
+import "./chunk-75MIQ3LV.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-ACPMPDKQ.js";
+import "./chunk-RPLGZJV2.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-4CCAX23S.js";
-import "./chunk-6PQHZ4YW.js";
+import "./chunk-DZLYR4U3.js";
+import "./chunk-BWKCTLEJ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-MFBM3CQZ.js";
-import "./chunk-ZWL7SSVL.js";
-import "./chunk-MB3M2BFP.js";
-import "./chunk-2WUAKFCQ.js";
+import "./chunk-SGFT55XI.js";
+import "./chunk-Y4IHBGBP.js";
+import "./chunk-Y6AXW2OG.js";
+import "./chunk-LNHZ3A4I.js";
 import "./chunk-46UV252V.js";
-import "./chunk-WDMODYUC.js";
-import "./chunk-XM5V2A2E.js";
-import "./chunk-ZYD3KZPB.js";
-import "./chunk-BOWYL27T.js";
-import "./chunk-FUFNINKB.js";
+import "./chunk-ZBVS26BY.js";
+import "./chunk-WZRWHXFE.js";
+import "./chunk-A3NDJ5SB.js";
+import "./chunk-7XATOOE7.js";
+import "./chunk-BGTQCTQW.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-S7W2GKIO.js";
-import "./chunk-ATIV6G7N.js";
+import "./chunk-UHUSJ6X7.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";

package/chunks/{StandaloneSessionPicker-6SNFY63D.js → StandaloneSessionPicker-QLO5COVM.js}

@@ -4,47 +4,47 @@ import {
   ConfigContext,
   SessionPicker,
   SettingsContext
-} from "./chunk-CO3BKKFP.js";
+} from "./chunk-ML5M5XOY.js";
+import "./chunk-KY3NRFJ5.js";
 import {
   KeypressProvider
-} from "./chunk-IIJCNWAY.js";
-import "./chunk-SJOQ5GW7.js";
-import "./chunk-RGZ34F4F.js";
-import "./chunk-SEWRIH7H.js";
+} from "./chunk-AL62VKMS.js";
+import "./chunk-KADQPLPX.js";
+import "./chunk-TUQ36KWK.js";
+import "./chunk-M7OONWYU.js";
 import "./chunk-4WGODMVR.js";
 import "./chunk-KW7NOTN6.js";
-import "./chunk-R2F2DRBY.js";
-import "./chunk-ZGVQLKMP.js";
-import "./chunk-VV6QF662.js";
+import "./chunk-U3E3UQAA.js";
+import "./chunk-GKX7E4CO.js";
 import {
   require_jsx_runtime
 } from "./chunk-SV5PQVQE.js";
+import "./chunk-GATT5TKW.js";
 import {
   Box_default,
   render_default,
   use_app_default
-} from "./chunk-TXI4LPWT.js";
+} from "./chunk-UWMLWVCA.js";
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
-import "./chunk-2KLJYA37.js";
-import "./chunk-7GC5YKSS.js";
-import "./chunk-IPUUTYMV.js";
-import "./chunk-6K2CPEAB.js";
+import "./chunk-FW4M4GA7.js";
+import "./chunk-HKFEPLKW.js";
+import "./chunk-YDLJGZHL.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-QTERJVPZ.js";
+import "./chunk-ZSQ5LDBH.js";
 import "./chunk-E5Z2AVNV.js";
 import "./chunk-57OAHC2Y.js";
-import "./chunk-4CKLWQQR.js";
-import "./chunk-VCBKBEU7.js";
+import "./chunk-7A4ZDITM.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-C6U6ZR65.js";
-import "./chunk-ZAJIOSFI.js";
+import "./chunk-ATZOB5Y2.js";
+import "./chunk-NNERMV7T.js";
 import "./chunk-GOXKNSDZ.js";
-import "./chunk-6PEXNQTX.js";
 import "./chunk-IDS7MSUP.js";
-import "./chunk-IUYFCE34.js";
+import "./chunk-6PEXNQTX.js";
+import "./chunk-4WSL256B.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
 import {
@@ -53,63 +53,63 @@ import {
 import {
   SessionService,
   getGitBranch
-} from "./chunk-G3RJEBAA.js";
+} from "./chunk-HUK2P4RS.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
-import "./chunk-2WVVMSPB.js";
-import "./chunk-IUNB6SUW.js";
-import "./chunk-ECBKZ7SV.js";
+import "./chunk-UPUG4GXM.js";
+import "./chunk-64LQLPL7.js";
+import "./chunk-2LQTH543.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-3FNJBOF7.js";
+import "./chunk-DJGYJDYR.js";
+import "./chunk-CVHIL5IG.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-6LOSXNKO.js";
+import "./chunk-PONHVBRT.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-3YAW4B2W.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-7R4YENCL.js";
-import "./chunk-IJDXG4RL.js";
-import "./chunk-IM6PC55H.js";
-import "./chunk-YF7TVSQK.js";
-import "./chunk-DMEKUQ5Z.js";
+import "./chunk-6QIGFD5W.js";
+import "./chunk-XWWKIXVD.js";
+import "./chunk-75GFAX4R.js";
+import "./chunk-OKF7JF3R.js";
+import "./chunk-JSD33JG6.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-JCW2R7WC.js";
-import "./chunk-2PHWA4IO.js";
+import "./chunk-2DN4J57Y.js";
 import "./chunk-ZPJWUGCS.js";
-import "./chunk-HHYPUCUF.js";
+import "./chunk-2LKVPASC.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-2LFSPVBC.js";
-import "./chunk-67ZRSECV.js";
+import "./chunk-LW3RFMG7.js";
+import "./chunk-W4MIWP6M.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-GLNBDYUX.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-EWYICJNY.js";
-import "./chunk-IXNNGTUI.js";
+import "./chunk-P2YNZWXZ.js";
+import "./chunk-75MIQ3LV.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-ACPMPDKQ.js";
+import "./chunk-RPLGZJV2.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-4CCAX23S.js";
-import "./chunk-6PQHZ4YW.js";
+import "./chunk-DZLYR4U3.js";
+import "./chunk-BWKCTLEJ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-MFBM3CQZ.js";
-import "./chunk-ZWL7SSVL.js";
-import "./chunk-MB3M2BFP.js";
-import "./chunk-2WUAKFCQ.js";
+import "./chunk-SGFT55XI.js";
+import "./chunk-Y4IHBGBP.js";
+import "./chunk-Y6AXW2OG.js";
+import "./chunk-LNHZ3A4I.js";
 import "./chunk-46UV252V.js";
-import "./chunk-WDMODYUC.js";
-import "./chunk-XM5V2A2E.js";
-import "./chunk-ZYD3KZPB.js";
-import "./chunk-BOWYL27T.js";
-import "./chunk-FUFNINKB.js";
+import "./chunk-ZBVS26BY.js";
+import "./chunk-WZRWHXFE.js";
+import "./chunk-A3NDJ5SB.js";
+import "./chunk-7XATOOE7.js";
+import "./chunk-BGTQCTQW.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-S7W2GKIO.js";
-import "./chunk-ATIV6G7N.js";
+import "./chunk-UHUSJ6X7.js";
 import "./chunk-VOQXFAY5.js";
-import "./chunk-XL7TLW5I.js";
+import "./chunk-XBZQT63P.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";

package/chunks/{acp-startup-profiler-RV3IV562.js → acp-startup-profiler-DFVPFQ6C.js}

@@ -9,8 +9,8 @@ import {
   markAcpStartup,
   recordAcpConfigStartupEvent,
   resetAcpStartupProfilerForTesting
-} from "./chunk-HIJQF5B5.js";
-import "./chunk-3SJ43L4W.js";
+} from "./chunk-3L2SPEBH.js";
+import "./chunk-XZC5VLBZ.js";
 import "./chunk-5O2XNYP6.js";
 import "./chunk-J2S4EL5Y.js";
 export {