@qwen-code/qwen-code 0.21.1 → 0.21.2-nightly.20260801.bc382c3ff

package/bundled/qc-helper/docs/configuration/settings.md

@@ -125,7 +125,7 @@ Settings are organized into categories. Most settings should be placed within th
 | `ui.showCitations`                      | boolean          | Show citations for generated text in the chat.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`       |
 | `ui.history.collapseOnResume`           | boolean          | Whether to collapse history by default when resuming a session. Can be toggled via `/history collapse-on-resume` and `/history expand-on-resume`.                                                                                                                                                                                                                                                                                                                                                                                                  | `false`       |
 | `ui.history.collapsePreviewCount`       | number           | Number of most recent user turns to keep visible when `ui.history.collapseOnResume` is enabled. `0` collapses all restored history by default; `-1` shows all restored history.                                                                                                                                                                                                                                                                                                                                                                    | `0`           |
-| `ui.compactMode`                        | boolean          | Retired in the terminal UI. The CLI now always shows the compact, type-based tool view in the main transcript; press `Ctrl+O` to open the full-detail transcript instead of toggling a mode. Still honored by the web shell.                                                                                                                                                                                                                                                                                                                       | `false`       |
+| `ui.compactMode`                        | boolean          | Retired in the terminal UI. The CLI now always shows the compact, type-based tool view in the main transcript; press `Ctrl+O` to toggle expanded detail mode (expand or collapse all thinking blocks and tool outputs inline) instead of toggling a mode. Still honored by the web shell.                                                                                                                                                                                                                                                          | `false`       |
 | `ui.shellOutputMaxLines`                | number           | Max number of shell output lines shown inline. Set to `0` to disable the cap and show full output. Hidden lines are surfaced via the `+N lines` indicator. Errors, `!`-prefix user-initiated commands, confirming tools, and focused embedded shells always show full output.                                                                                                                                                                                                                                                                      | `5`           |
 | `ui.enableWelcomeBack`                  | boolean          | Show welcome back dialog when returning to a project with conversation history. When enabled, Qwen Code will automatically detect if you're returning to a project with a previously generated project summary (`.qwen/PROJECT_SUMMARY.md`) and show a dialog allowing you to continue your previous conversation or start fresh. If you choose **Start new chat session**, that choice is remembered for the current project until the project summary changes. This feature integrates with the `/summary` command and quit confirmation dialog. | `true`        |
 | `ui.accessibility.enableLoadingPhrases` | boolean          | Enable loading phrases (disable for accessibility).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `true`        |
@@ -337,6 +337,7 @@ If you are experiencing performance issues with file searching (e.g., with `@` c
 | `tools.computerUse.maxImageDimension` | number            | Longest-edge pixel cap applied to cua-driver screenshots (via `set_config`'s `max_image_dimension`). `-1` (default) keeps cua-driver's built-in default (1568); `0` disables resizing (full resolution); a positive value caps the longest edge. Lower caps cut vision-token cost at the expense of fine detail.                                                                                                                                                                                                                                                                                                                                                                                                                                     | `-1`        | Requires restart: Yes. Env override: `QWEN_COMPUTER_USE_MAX_IMAGE_DIMENSION` (a non-negative integer; takes precedence over this setting)                                                                                                                                                                                   |
 | `tools.computerUse.idleTimeoutMs`     | number            | Milliseconds to keep the cua-driver process alive after the last `computer_use__*` call. The default is `300000` (5 minutes). Set to `0` to keep it running until Qwen Code exits.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `300000`    | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 | `tools.toolSearch.enabled`            | boolean           | Load MCP tools on demand via ToolSearch to reduce prompt size. Disable this for models that rely on prefix-based KV caching (e.g. DeepSeek) to keep the prompt prefix stable and maximize cache hit rates.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `true`      | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
+| `tools.toolSearch.threshold`          | number            | Context-window percentage used as the session-start budget for preloading deferred tools (bundled built-ins and MCP alike). When the combined schemas of every deferred tool fit within this budget, they are all declared upfront instead of loaded on demand via ToolSearch — a stable declaration list keeps prefix KV caches valid for the whole session. Set `0` to always load deferred tools on demand.                                                                                                                                                                                                                                                                                                                                       | `10`        | Requires restart: Yes                                                                                                                                                                                                                                                                                                       |
 
 > [!note]
 >
@@ -496,11 +497,12 @@ execute when typed.
 
 Controls which [Skills](../features/skills) are exposed to the model.
 
-| Setting                  | Type             | Description                                                                                                                                                                                                                                             | Default     |
-| ------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
-| `skills.disabled`        | array of strings | Hard-disabled skill names. Matched case-insensitively and **merged as a union** across settings scopes, so project settings cannot override a user or system entry. Hidden skills do not appear in `<available_skills>` or as `/<name>` slash commands. | `undefined` |
-| `skills.defaultDisabled` | array of strings | Skill names that start disabled but can be opted into through `skills.enabled`. Matched case-insensitively and merged as a union across settings scopes.                                                                                                | `undefined` |
-| `skills.enabled`         | array of strings | Explicit opt-ins that override matching `skills.defaultDisabled` entries. Matched case-insensitively and merged as a union across settings scopes. This setting cannot override `skills.disabled`.                                                      | `undefined` |
+| Setting                  | Type             | Description                                                                                                                                                                                                                                                                                                                                      | Default     |
+| ------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- |
+| `skills.disabledLevels`  | array of strings | Skill discovery levels to skip entirely. Supported values are `project`, `user`, `extension`, and `bundled`. Merged as a union across settings scopes. Use `["bundled"]` to hide every bundled skill while retaining host-provided skills. Note: `skills.directories` entries are discovered at the `user` level, so `["user"]` hides those too. | `undefined` |
+| `skills.disabled`        | array of strings | Hard-disabled skill names. Matched case-insensitively and **merged as a union** across settings scopes, so project settings cannot override a user or system entry. Hidden skills do not appear in `<available_skills>` or as `/<name>` slash commands.                                                                                          | `undefined` |
+| `skills.defaultDisabled` | array of strings | Skill names that start disabled but can be opted into through `skills.enabled`. Matched case-insensitively and merged as a union across settings scopes.                                                                                                                                                                                         | `undefined` |
+| `skills.enabled`         | array of strings | Explicit opt-ins that override matching `skills.defaultDisabled` entries. Matched case-insensitively and merged as a union across settings scopes. This setting cannot override `skills.disabled` or re-enable skills from a `skills.disabledLevels`-excluded level.                                                                             | `undefined` |
 
 The precedence is `skills.disabled` > `skills.enabled` > `skills.defaultDisabled`. For example, a user can put a skill in `defaultDisabled` and a project can add the same name to `enabled`; a hard `disabled` entry at any scope still wins.
 
@@ -854,7 +856,7 @@ To help us improve Qwen Code, we collect anonymized usage statistics. This data
 
 **What we collect:**
 
-- **Tool Calls:** We log the names of the tools that are called, whether they succeed or fail, and how long they take to execute. We do not collect the arguments passed to the tools or any data returned by them.
+- **Tool Calls:** We log the names and categories (native or MCP) of the tools that are called, their terminal status (success, error, or cancelled), and how long they take to execute. We do not collect the arguments passed to the tools or any data returned by them.
 - **API Requests:** We log the model used for each request, the duration of the request, and whether it was successful. We do not collect the content of the prompts or responses.
 - **Session Information:** We collect information about the configuration of the CLI, such as the enabled tools and the approval mode.
 

package/bundled/qc-helper/docs/features/channels/_meta.ts

@@ -7,5 +7,6 @@ export default {
   feishu: 'Feishu',
   qqbot: 'QQ Bot',
   github: 'GitHub',
+  gitlab: 'GitLab',
   plugins: 'Plugins',
 };

package/bundled/qc-helper/docs/features/channels/github.md

@@ -4,7 +4,8 @@ This guide covers setting up a Qwen Code channel that monitors GitHub notificati
 
 ## Prerequisites
 
-- A GitHub account (or a dedicated bot account)
+- A GitHub account for the channel. Use a dedicated bot account when the PAT
+  owner also needs to operate the channel.
 - A GitHub Personal Access Token (PAT) with `notifications` and `public_repo` (or `repo`) scopes
 
 ## Creating a Token
@@ -26,10 +27,12 @@ Add the channel to `~/.qwen/settings.json`:
       "type": "github",
       "token": "$GITHUB_TOKEN",
       "pollInterval": 60000,
+      "reasonFilter": ["mention", "review_requested", "assign"],
       "senderPolicy": "allowlist",
-      "allowedUsers": ["your-github-username"],
+      "allowedUsers": ["operator-github-username"],
       "sessionScope": "chat_thread",
       "cwd": "/path/to/your/project",
+      "blockStreaming": "off",
       "groupPolicy": "open",
       "groups": {
         "*": { "requireMention": true }
@@ -45,6 +48,13 @@ Set the token as an environment variable:
 export GITHUB_TOKEN="ghp_your_token_here"
 ```
 
+The PAT owner cannot trigger its own channel: GitHub self-activity does not
+provide a usable notification, and the adapter intentionally ignores its own
+comments to prevent reply loops. If the PAT owner needs to operate the channel,
+use a separate bot-owned PAT and put only operator accounts in `allowedUsers`.
+Startup rejects an allowlist containing only the PAT owner and warns when the
+PAT owner appears alongside other operators.
+
 ### GitHub Enterprise
 
 For GitHub Enterprise Server, set `baseUrl`:
@@ -57,14 +67,22 @@ For GitHub Enterprise Server, set `baseUrl`:
 
 ## Configuration Options
 
-| Option                    | Default                  | Description                                                                      |
-| ------------------------- | ------------------------ | -------------------------------------------------------------------------------- |
-| `token`                   | (required)               | Classic PAT with `notifications` scope                                           |
-| `pollInterval`            | `60000`                  | Poll interval in ms                                                              |
-| `baseUrl`                 | `https://api.github.com` | API base URL (for GHE)                                                           |
-| `groupPolicy`             | `"disabled"`             | Must be `"open"` for notifications to flow                                       |
-| `senderPolicy`            | `"allowlist"`            | Who can trigger the bot                                                          |
-| `groups.*.requireMention` | `true`                   | Require @mentions for ordinary comments; directed notification reasons still run |
+| Option                    | Default                  | Description                                                                                   |
+| ------------------------- | ------------------------ | --------------------------------------------------------------------------------------------- |
+| `token`                   | (required)               | Classic PAT with `notifications` scope                                                        |
+| `pollInterval`            | `60000`                  | Poll interval in ms                                                                           |
+| `baseUrl`                 | `https://api.github.com` | API base URL (for GHE)                                                                        |
+| `groupPolicy`             | `"disabled"`             | Must be `"open"` for notifications to flow                                                    |
+| `senderPolicy`            | `"allowlist"`            | Who can trigger the bot                                                                       |
+| `groups.*.requireMention` | `true`                   | Require @mentions for ordinary comments; directed notification reasons still run              |
+| `blockStreaming`          | `"off"`                  | Always forced to `"off"`; intermediate model chunks aren't published; `"on"` is not supported |
+| `reasonFilter`            | unset                    | Optional allowlist of GitHub notification reasons to process                                  |
+
+Use `reasonFilter` to drop noisy notification classes such as `ci_activity` or `state_change`. Do not use `reasonFilter: ["mention"]` as a replacement for `groups.*.requireMention`: GitHub's `mention` reason is sticky at the thread level, so real new @mentions can arrive later under `comment`, `subscribed`, `author`, or other reasons and would be skipped.
+
+Valid `reasonFilter` values are `mention`, `review_requested`, `assign`, `author`, `comment`, `ci_activity`, `manual`, `state_change`, `subscribed`, `team_mention`, `security_alert`, `approval_requested`, `invitation`, `member_feature_requested`, and `security_advisory_credit`.
+
+Filtered notifications are still marked read before they are skipped. Removing the filter later will not replay notifications the channel already skipped.
 
 ## ⚠️ Security
 
@@ -92,6 +110,27 @@ The comment window is `(previousCursor, currentMaxUpdatedAt]` — comments alrea
 
 Non-comment activity (push, label changes) bumps the notification's `updated_at` but produces zero new comments in the window, so re-fetched threads are skipped without triggering the agent.
 
+## Response Feedback
+
+For an accepted issue or pull-request comment, the channel adds GitHub's `👀` reaction while the agent is working, then removes it when the run completes, fails, or is cancelled. Both operations are best-effort: a reaction API or permission failure is logged and never prevents the final response.
+
+### Final-only output
+
+The GitHub channel always forces final-only delivery. The adapter sets `blockStreaming` to `"off"`, so intermediate model chunks are never published as separate comments and `blockStreaming: "on"` is not supported.
+
+```json
+{
+  "blockStreaming": "off"
+}
+```
+
+If GitHub returns a definite no-write delivery failure, such as a rate-limit
+response, the channel stores the final reply in
+`~/.qwen/channels/<workspace-scope>/<channel>-<name-hash>-github-pending-deliveries.json`
+with private file permissions and retries it on the next channel start.
+Ambiguous delivery failures are not retried automatically because GitHub may
+have created the comment.
+
 ## Known Limitations
 
 - **First start skips existing unread notifications.** The cursor initializes to "now" on first launch. Notifications created before the bot starts are not processed unless the thread receives new activity afterwards.

package/bundled/qc-helper/docs/features/channels/gitlab.md

@@ -0,0 +1,177 @@
+# GitLab
+
+This guide covers setting up a Qwen Code channel that monitors GitLab todos and responds to mentions on issues and merge requests.
+
+## Prerequisites
+
+- A GitLab account (or a dedicated bot account)
+- A GitLab Personal Access Token with `read_api` and `api` scopes
+
+## Creating a Token
+
+1. Go to **Preferences → Access Tokens**
+2. Create a token with these scopes:
+   - **read_api** — read todos and project data
+   - **api** — post notes (comments) on issues/MRs
+3. Save the token securely as an environment variable
+
+## Configuration
+
+Add the channel to `~/.qwen/settings.json`:
+
+```json
+{
+  "channels": {
+    "my-gitlab": {
+      "type": "gitlab",
+      "token": "$GITLAB_TOKEN",
+      "pollInterval": 60000,
+      "senderPolicy": "open",
+      "sessionScope": "chat_thread",
+      "cwd": "/path/to/your/project",
+      "groupPolicy": "open",
+      "action_prompt_template": {
+        "mentioned": "Project: %project% | URL: %project_url% | Author: %author% | Type: %target_type% | IID: %iid% | Title: %title% | Description: %description% | TodoID: %todo_id%"
+      }
+    }
+  }
+}
+```
+
+Set the token as an environment variable:
+
+```bash
+export GITLAB_TOKEN="glpat-your_token_here"
+```
+
+### Self-hosted GitLab
+
+For self-hosted instances, set `baseUrl`:
+
+```json
+{
+  "baseUrl": "https://gitlab.example.com"
+}
+```
+
+## Configuration Options
+
+| Option                   | Default                   | Description                                                |
+| ------------------------ | ------------------------- | ---------------------------------------------------------- |
+| `token`                  | (required)                | PAT with `read_api` + `api` scopes                         |
+| `pollInterval`           | `60000`                   | Poll interval in ms                                        |
+| `baseUrl`                | `https://gitlab.com`      | GitLab instance URL                                        |
+| `action_prompt_template` | (required for processing) | Maps GitLab action names to metadata templates             |
+| `groupPolicy`            | `"disabled"`              | Must be `"open"`, or `"allowlist"` with the project listed |
+| `senderPolicy`           | `"allowlist"`             | Who can trigger the bot                                    |
+
+## action_prompt_template
+
+This field controls which todo actions are processed and how metadata is rendered. Only actions with a configured template are dispatched; all others are skipped and marked done.
+
+```json
+{
+  "action_prompt_template": {
+    "mentioned": "Project: %project% | Author: %author% | Title: %title%"
+  }
+}
+```
+
+The `directly_addressed` action (comment starting with `@bot`) automatically falls back to the `mentioned` template if not explicitly configured.
+
+### Available Action Keys
+
+| Key                   | Trigger                                                                  |
+| --------------------- | ------------------------------------------------------------------------ |
+| `mentioned`           | Someone @mentions the bot in a comment or description (not at the start) |
+| `directly_addressed`  | A comment **starts with** `@bot` (falls back to `mentioned` template)    |
+| `assigned`            | Someone assigns the bot to an issue/MR                                   |
+| `review_requested`    | Someone requests the bot as a reviewer on an MR                          |
+| `approval_required`   | An MR requires the bot's approval (approval rules)                       |
+| `marked`              | Someone marks the bot's comment/issue/MR (star)                          |
+| `build_failed`        | A CI/CD pipeline fails on the bot's branch/MR                            |
+| `unmergeable`         | An MR the bot is involved with becomes unmergeable (conflicts)           |
+| `merge_train_removed` | An MR is removed from the merge train                                    |
+
+Only keys present in `action_prompt_template` are processed. Unconfigured actions are skipped and marked done silently.
+
+### Template Variables
+
+| Variable        | Value                             |
+| --------------- | --------------------------------- |
+| `%project%`     | Project path (e.g., `owner/repo`) |
+| `%project_url%` | Full project URL                  |
+| `%author%`      | Todo author username              |
+| `%target_type%` | `Issue` or `MergeRequest`         |
+| `%iid%`         | Issue/MR internal ID              |
+| `%title%`       | Issue/MR title                    |
+| `%description%` | Issue/MR description body         |
+| `%todo_id%`     | GitLab todo ID                    |
+| `%%`            | Literal `%` (escape)              |
+
+Unknown variables are preserved as-is in the output.
+
+### Prompt Assembly
+
+The template renders into `envelope.metadata` (structured context). The triggering text (`todo.body` or description) goes into `envelope.text` (primary prompt). The base class assembles the final prompt sent to the agent:
+
+```
+[alice] please fix this bug
+
+Project: owner/repo | URL: https://gitlab.com/owner/repo | Author: alice | Type: Issue | IID: 42 | Title: Test Issue | Description: ... | TodoID: 100
+```
+
+- Line 1: `[sender]` prefix + `envelope.text` (with `@bot` stripped)
+- Line 3: `envelope.metadata` (rendered template, sanitized)
+
+You do **not** need a `%body%` variable — the comment/description text is always the primary prompt content, and the template provides supplementary context below it.
+
+## ⚠️ Security
+
+On a **public project**, setting `senderPolicy: "open"` allows **any GitLab user** who @mentions the bot to submit prompts that drive the agent in your `cwd`.
+
+Always use `senderPolicy: "allowlist"` with explicit `allowedUsers` on public projects.
+
+## Mention Detection
+
+The adapter always sets `isMentioned = true` on dispatched envelopes, because GitLab has already determined the mention when creating the todo. The `action_prompt_template` config is the real event filter — only actions with a configured template are processed. The `@bot` mention is stripped from the message text before dispatch via `stripBotMention`.
+
+### ⚠️ groupPolicy Must Be "open" or "allowlist"
+
+`groupPolicy` must be set to `"open"`, or `"allowlist"` with the project explicitly listed, for todos to be processed. The default value `"disabled"` drops all mentions: todos are marked done and the cursor advances, but no dispatch occurs. A rejection is logged (`preflight rejected reason=group_disabled`) but the todo is still consumed. If your bot is not responding to mentions, check that `groupPolicy` is not `"disabled"`.
+
+## How It Works
+
+The adapter uses GitLab's Todos API as the message source:
+
+1. **Poll** `GET /todos?state=pending` for new todos
+2. **First-poll drain**: if the cursor has never been initialized (`initialized: false`), all pending todos are marked done without dispatch and the cursor advances to the max todo ID. This prevents a backlog flood on first start.
+3. **Clean up stale todos**: todos with `id <= cursor` are marked done (best-effort) to prevent them from being re-fetched on every poll
+4. **Filter** by `id > cursor` and configured `action_prompt_template`
+5. **Detect mention type** via `target_url` anchor:
+   - `#note_123` present → comment mention → text is `todo.body` (the comment)
+   - No anchor → description mention → text is the issue/MR description
+6. **Dispatch** the envelope through `handleInbound` (requires `groupPolicy: "open"` or `"allowlist"` with the project listed)
+7. **Advance cursor** and **mark todo done** (best-effort)
+
+The cursor (`lastProcessedId`) advances regardless of dispatch success or failure. Failed dispatches post a ⚠️ error comment on the issue/MR and are not retried — the user can re-mention the bot to trigger a new todo.
+
+## Response Feedback
+
+For an accepted comment mention (note with `#note_` anchor), the channel adds a 👀 award emoji to the note while the agent is working, then removes it when the run completes, fails, or is cancelled. Both operations are best-effort: an award emoji API or permission failure is logged and never prevents the final response.
+
+Description mentions (no `#note_` anchor) do not receive an award emoji because there is no specific note to react to.
+
+## Known Limitations
+
+- **First start skips existing pending todos.** The cursor initializes to `{ lastProcessedId: 0, initialized: false }` on first launch. On the first poll cycle, all pre-existing pending todos are marked done without dispatch (the `initialized` flag gates this one-time drain), preventing a backlog flood.
+- The bot does not read prior conversation history — only the triggering content is processed.
+- **Confidential (internal) notes:** If someone @mentions the bot in a confidential note, the todo body contains that internal text and the agent will process it. The bot's reply is always posted as a **public** note, potentially exposing internal discussion. GitLab's todo API does not expose note visibility, so the adapter cannot filter this. Avoid @mentioning the bot in confidential notes.
+- Requires `read_api` + `api` PAT scopes. Group-level or project-level tokens work if they have these scopes.
+- Todos for Epics, Designs, and Alerts are skipped (only Issues and MRs are processed).
+
+## Starting the Channel
+
+```bash
+qwen channel start my-gitlab
+```

package/bundled/qc-helper/docs/features/code-review.md

@@ -277,6 +277,26 @@ The deterministic halves of the pipeline — argument parsing (`qwen review pars
 
 Every run ends with one machine-readable line (`Review complete: <target> — <disposition>`), so scripts and CI wrappers can detect completion and outcome with a single `^Review complete: ` match.
 
+## Headless runs (`qwen review run`)
+
+`/review` is interactive. When a script or CI job needs to run a review and act on its outcome, use the headless wrapper:
+
+```bash
+qwen review run [target] [--json] [--fail-on request-changes] [--comment] [--quiet]
+```
+
+`target` is a PR number, a PR URL, or a file path; omit it to review the local working tree. The command runs this build's own CLI non-interactively (with stdin closed, so slash-command detection survives), streams the child's progress to **stderr**, and prints the verdict to **stdout** — or, with `--json`, the full result object. The verdict is read from the artifact `compose-review` writes (the same JSON the skill treats as the verdict authority), never parsed from the model's prose.
+
+The exit code is the contract a gate should read:
+
+| Exit | Meaning                                                                                           |
+| ---- | ------------------------------------------------------------------------------------------------- |
+| `0`  | The review completed (whatever it decided)                                                        |
+| `1`  | It never reached a verdict — the child failed, timed out, or left no composed artifact            |
+| `3`  | It completed with `REQUEST_CHANGES` **and** `--fail-on request-changes` was set (opt-in blocking) |
+
+`3` (not `2`) lets a gate distinguish "the review is blocking" from "the tool broke" — yargs already uses `1` for usage errors — without parsing any output. `--timeout-minutes` (default 120, floored at 1) terminates a hung review and exits `1`, and cancelling the command (Ctrl+C / SIGTERM) terminates the review's process group rather than orphaning it.
+
 ## Cross-file Impact Analysis
 
 A dedicated cross-file tracer (Agent 1c) owns this walk end-to-end. When code changes modify exported functions, classes, or interfaces, it searches for all callers and checks compatibility:

package/bundled/qc-helper/docs/features/commands.md

@@ -83,6 +83,7 @@ Commands for managing AI tools and models.
 | `/import-config`  | Import MCP servers from Claude configs                                                | `/import-config all`, `/import-config claude-code`, `/import-config claude-desktop --scope user\|project` |
 | `/tools`          | Display currently available tool list                                                 | `/tools`, `/tools desc`                                                                                   |
 | `/skills`         | Open the Skills panel to browse, search, toggle, and launch skills                    | `/skills`, `/<skill-name>`                                                                                |
+| `/curator`        | Inspect, pin, archive, or restore inactive project auto-skills                        | `/curator`, `/curator run --dry-run`, `/curator pin <directory>`, `/curator restore <directory>`          |
 | `/plan`           | Switch to plan mode or exit plan mode                                                 | `/plan`, `/plan <task>`, `/plan exit`                                                                     |
 | `/approval-mode`  | Change the tool-approval mode (current session only)                                  | `/approval-mode`, `/approval-mode auto-edit`                                                              |
 | → `plan`          | Analysis only, no execution (secure review)                                           | `/approval-mode plan`                                                                                     |

package/bundled/qc-helper/docs/features/hooks.md

@@ -103,6 +103,24 @@ HTTP hooks send hook input as POST requests to specified URLs. They support URL
 - **DNS Validation**: Validates domain resolution before requests to prevent DNS rebinding attacks
 - **Environment Variable Interpolation**: `${VAR}` syntax, only allows variables in `allowedEnvVars` whitelist
 
+#### Allowing private-network hooks (managed environments only)
+
+By default, HTTP hooks cannot target private or link-local IP ranges. In platform-managed environments where the hook receiver is a first-party, VPC-internal endpoint (for example, an internal API gateway resolving to `172.16.0.0/12`), you can relax the IP-range checks with:
+
+```json
+{
+  "security": {
+    "allowPrivateNetworkHooks": true
+  }
+}
+```
+
+- This setting is **only honored from User, System, and SystemDefaults settings scopes**. A value set in Workspace (project) settings is ignored and logged as a warning, so a cloned repository can never self-grant this bypass.
+- The flag relaxes only the general private/CGNAT/link-local **range** checks. Cloud metadata endpoints stay blocked in every configuration: the `BLOCKED_HOSTS` list is matched literally (`metadata.google.internal`, `metadata.azure.internal`, ...), and the metadata IPs `169.254.169.254` and `100.100.100.200` are blocked in all serialized forms (including IPv4-mapped IPv6 such as `::ffff:a9fe:a9fe`) and after DNS resolution.
+- The `security.allowedHttpHookUrls` whitelist still applies independently. In managed environments, pair this flag with a whitelist so only the intended internal endpoints are reachable.
+
+> **Warning:** Enabling this flag lets hooks reach internal infrastructure on your network. Enable it only in trusted, managed settings — never in a repository you do not control.
+
 **Example:**
 
 ```json
@@ -129,6 +147,87 @@ HTTP hooks send hook input as POST requests to specified URLs. They support URL
 }
 ```
 
+**Example: External Judgment Service Adapter**
+
+The `remote-security-check` config above expects `http://127.0.0.1:8080/hooks/pre-tool-use` to
+already be running a service that speaks this contract (POST `{tool_name, tool_input, ...}` in,
+`hookSpecificOutput.permissionDecision` out). Here is a minimal, stdlib-only adapter that fills
+in that missing half, wired to one concrete judgment backend so the whole thing is runnable and
+testable end to end rather than a stub. Only the `review()` function is backend-specific — swap
+its body and request/response shape for whichever service you use; everything else (the server,
+the fail-open handling, the hook response shape) stays the same regardless of backend.
+
+_Disclosure: the backend used below, [invinoveritas](https://api.babyblueviper.com), is a
+service the author is affiliated with — used here because it was the one that could be
+verified end to end for this example, not an endorsement. Any HTTP service that returns a
+JSON verdict works equally well; only `review()` needs to change._
+
+_Data handling: with `matcher: "*"`, the full `tool_input` of **every** tool call is sent to
+the judgment backend — treat that input as sensitive (it may contain file contents, paths, or
+secrets). Narrow the matcher (e.g. to `run_shell_command`) if you only need to judge shell
+commands._
+
+```python
+#!/usr/bin/env python3
+# judgment_hook.py -- run: JUDGMENT_API_KEY=... python3 judgment_hook.py
+import json, os, sys, urllib.request
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+JUDGMENT_API_KEY = os.environ["JUDGMENT_API_KEY"]
+JUDGMENT_URL = os.environ.get("JUDGMENT_URL", "https://api.babyblueviper.com/review")
+
+def review(tool_name, tool_input):
+    """POST the call to the judgment backend and return its verdict. This is the
+    one function to change for a different backend -- request/response shape
+    below matches invinoveritas's /review; adapt both to your own backend's
+    contract if you swap it out."""
+    body = json.dumps({
+        "artifact": json.dumps({"tool_name": tool_name, "tool_input": tool_input}),
+        "artifact_type": "shell_command" if tool_name in ("run_shell_command", "shell") else "general",
+        "context": f"qwen-code PreToolUse: {tool_name}",
+    }).encode()
+    req = urllib.request.Request(
+        JUDGMENT_URL, data=body,
+        headers={"Authorization": f"Bearer {JUDGMENT_API_KEY}", "Content-Type": "application/json"},
+    )
+    # Keep this below the HTTP hook's own timeout (10s in the config above), so a "deny"
+    # verdict is always returned before the hook gives up and fails open on its own.
+    with urllib.request.urlopen(req, timeout=8) as resp:
+        return json.loads(resp.read())  # response includes a "verdict" field: "reject" denies, anything else allows
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        payload = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))) or b"{}")
+        tool_name, tool_input = payload.get("tool_name", "unknown"), payload.get("tool_input", {})
+        try:
+            verdict = review(tool_name, tool_input)
+            decision = "deny" if verdict.get("verdict") == "reject" else "allow"
+            reason = verdict.get("summary", f"judgment verdict: {verdict.get('verdict')}")
+        except Exception as e:
+            decision, reason = "allow", "judgment backend unavailable, failing open"  # never block on a review-side outage
+            print(f"judgment backend unavailable for {tool_name}, failing open: {e}", file=sys.stderr)
+        out = {"continue": True, "decision": decision, "hookSpecificOutput": {
+            "hookEventName": "PreToolUse", "permissionDecision": decision, "permissionDecisionReason": reason,
+        }}
+        body = json.dumps(out).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+    def log_message(self, *a): pass
+
+if __name__ == "__main__":
+    HTTPServer(("127.0.0.1", 8080), Handler).serve_forever()
+```
+
+Tested live end to end against the real production API above: a genuinely destructive input
+(`{"tool_name": "run_shell_command", "tool_input": {"command": "rm -rf /important_data"}}`)
+returned `permissionDecision: "deny"` with a real explanation; a benign one (`ls -la`) returned
+`"allow"`. Fails open on any network/timeout/malformed-response issue from the judgment
+backend, so an outage never blocks legitimate tool calls — same discipline the `command`-hook
+examples above apply with their own exit codes.
+
 ### Function Hooks
 
 Function hooks directly call registered JavaScript/TypeScript functions. They are used internally by the Skill system and are not currently exposed as a public API for end users.
@@ -237,24 +336,25 @@ When `ok` is `false`, Qwen Code will continue working and use the `reason` as co
 
 Hooks fire at specific points during a Qwen Code session. Different events support different matchers to filter trigger conditions.
 
-| Event                | Triggered When                            | Matcher Target                                                 |
-| :------------------- | :---------------------------------------- | :------------------------------------------------------------- |
-| `PreToolUse`         | Before tool execution                     | Tool id (`write_file`, `read_file`, `run_shell_command`, etc.) |
-| `PostToolUse`        | After successful tool execution           | Tool id                                                        |
-| `PostToolUseFailure` | After tool execution fails                | Tool id                                                        |
-| `UserPromptSubmit`   | Before supported model invocations        | None                                                           |
-| `SessionStart`       | When session starts or resumes            | Source (`startup`, `resume`, `clear`, `compact`)               |
-| `SessionEnd`         | When session ends                         | Reason (`clear`, `logout`, `prompt_input_exit`, etc.)          |
-| `MessageDisplay`     | Repeatedly, as the reply streams          | None (always fires)                                            |
-| `Stop`               | When Claude prepares to conclude response | None (always fires)                                            |
-| `SubagentStart`      | When subagent starts                      | Agent type (`Bash`, `Explorer`, `Plan`, etc.)                  |
-| `SubagentStop`       | When subagent stops                       | Agent type                                                     |
-| `PreCompact`         | Before conversation compaction            | Trigger (`manual`, `auto`)                                     |
-| `Notification`       | When notifications are sent               | Type (`permission_prompt`, `idle_prompt`, `auth_success`)      |
-| `PermissionRequest`  | When permission dialog is shown           | Tool id                                                        |
-| `PermissionDenied`   | When tool permission is denied            | Tool id                                                        |
-| `TodoCreated`        | When a new todo item is created           | None (always fires)                                            |
-| `TodoCompleted`      | When a todo item is marked as completed   | None (always fires)                                            |
+| Event                | Triggered When                                  | Matcher Target                                                 |
+| :------------------- | :---------------------------------------------- | :------------------------------------------------------------- |
+| `PreToolUse`         | Before tool execution                           | Tool id (`write_file`, `read_file`, `run_shell_command`, etc.) |
+| `PostToolUse`        | After successful tool execution                 | Tool id                                                        |
+| `PostToolUseFailure` | After tool execution fails                      | Tool id                                                        |
+| `UserPromptSubmit`   | Before supported model invocations              | None                                                           |
+| `SessionStart`       | When session starts or resumes                  | Source (`startup`, `resume`, `clear`, `compact`)               |
+| `SessionEnd`         | When session ends                               | Reason (`clear`, `logout`, `prompt_input_exit`, etc.)          |
+| `SessionDelete`      | After an explicitly selected session is deleted | None                                                           |
+| `MessageDisplay`     | Repeatedly, as the reply streams                | None (always fires)                                            |
+| `Stop`               | When Claude prepares to conclude response       | None (always fires)                                            |
+| `SubagentStart`      | When subagent starts                            | Agent type (`Bash`, `Explorer`, `Plan`, etc.)                  |
+| `SubagentStop`       | When subagent stops                             | Agent type                                                     |
+| `PreCompact`         | Before conversation compaction                  | Trigger (`manual`, `auto`)                                     |
+| `Notification`       | When notifications are sent                     | Type (`permission_prompt`, `idle_prompt`, `auth_success`)      |
+| `PermissionRequest`  | When permission dialog is shown                 | Tool id                                                        |
+| `PermissionDenied`   | When tool permission is denied                  | Tool id                                                        |
+| `TodoCreated`        | When a new todo item is created                 | None (always fires)                                            |
+| `TodoCompleted`      | When a todo item is marked as completed         | None (always fires)                                            |
 
 ### Matcher Patterns
 
@@ -266,6 +366,7 @@ Hooks fire at specific points during a Qwen Code session. Different events suppo
 | Subagent Events     | `SubagentStart`, `SubagentStop`                                                            | ✅ Regex        | Agent type: `Bash`, `Explorer`, etc.                          |
 | Session Events      | `SessionStart`                                                                             | ✅ Regex        | Source: `startup`, `resume`, `clear`, `compact`               |
 | Session Events      | `SessionEnd`                                                                               | ✅ Regex        | Reason: `clear`, `logout`, `prompt_input_exit`, etc.          |
+| Session Events      | `SessionDelete`                                                                            | ❌ No           | N/A                                                           |
 | Notification Events | `Notification`                                                                             | ✅ Exact match  | Type: `permission_prompt`, `idle_prompt`, `auth_success`      |
 | Compact Events      | `PreCompact`                                                                               | ✅ Exact match  | Trigger: `manual`, `auto`                                     |
 | Todo Events         | `TodoCreated`, `TodoCompleted`                                                             | ❌ No           | N/A                                                           |
@@ -539,6 +640,8 @@ Sequential UserPromptSubmit hooks can append `additionalContext` to `prompt`; `s
 - `reason`: human-readable explanation for the decision
 - `hookSpecificOutput.additionalContext`: additional context to append to the prompt (optional)
 
+When sent to the model, injected `additionalContext` is appended as its own message part wrapped in a reserved `<qwen:user-prompt-submit-context>...</qwen:user-prompt-submit-context>` tag, so it stays distinguishable from user-authored text in model history and session transcripts. Angle brackets in hook output are escaped before wrapping, so hook content cannot close or forge the tag. The session transcript also records the user's original prompt text separately; the interactive TUI and the ACP/export transcript-replay path display that original text rather than the injected context.
+
 **Note**: Since UserPromptSubmitOutput extends HookOutput, all standard fields are available but only additionalContext in hookSpecificOutput is specifically defined for this event.
 
 **Example Output**:
@@ -599,6 +702,20 @@ Sequential UserPromptSubmit hooks can append `additionalContext` to `prompt`; `s
 
 - Standard hook output fields (typically not used for blocking)
 
+#### SessionDelete
+
+**Purpose**: Runs after an explicitly selected session has been permanently deleted. This event is fire-and-forget: output and failures cannot undo the deletion.
+
+**Event-specific fields**:
+
+```json
+{
+  "deleted_session_id": "the session that was deleted"
+}
+```
+
+The hook uses the deleting runtime's normal session fields (`session_id`, `transcript_path`, and `cwd`); over ACP, `transcript_path` is empty because the deleting runtime has no transcript of its own. `SessionDelete` currently fires for the interactive `/delete` flow and ACP's explicit `deleteSession` method; daemon REST batch deletion and internal cleanup do not emit it.
+
 #### MessageDisplay
 
 **Purpose**: Fires repeatedly as the assistant's reply streams — before `Stop`, which fires once at the end of the turn. Useful for live narration, incremental logging, or any consumer that wants to react to the reply as it's written rather than after the fact. This is a **fire-and-forget** event - hook output and exit codes are ignored.

package/bundled/qc-helper/docs/features/memory.md

@@ -95,6 +95,33 @@ Auto-memory files live at `~/.qwen/projects/<project>/memory/`. All branches of
 
 Everything saved is plain markdown — you can open, edit, or delete any file at any time.
 
+#### Pinned memory
+
+Put hand-curated documents that automatic memory maintenance should preserve
+under `pinned/` in a managed-memory directory, for example
+`~/.qwen/projects/<project>/memory/pinned/architecture.md` or
+`~/.qwen/memories/pinned/preferences.md`. Use the same frontmatter as other
+memory documents. Valid pinned files are readable by Qwen and are included the
+next time `MEMORY.md` is rebuilt, under the same size and file-count limits as
+other memory documents.
+
+Only the top-level `pinned/` directory directly inside a managed-memory root is
+protected; nested directories such as `memory/project/pinned/` are ordinary
+writable memory. Automatic extraction and Dream workers match the reserved
+directory name case-insensitively.
+
+Automatic extraction is instructed to leave pinned records and their valid
+index entries unchanged, while Dream is instructed to skip `pinned/` during
+consolidation. Both automatic extraction and forked Dream workers, including
+background cleanup, enforce the pinned-file boundary on their write and edit
+tools, including paths that resolve through a symlink into `pinned/`; their
+existing read-only shell policy blocks command-line deletion. You still control
+these files directly and can remove them with an explicit `/forget` request.
+
+> **Note:** The visible `/dream` slash command runs on the main Agent. It
+> receives the same skip instruction, but does not yet receive the forked
+> worker's deterministic per-turn tool gate.
+
 ### Periodic cleanup
 
 Qwen periodically goes through its saved memories to remove duplicates and clean up outdated entries. This runs automatically in the background once a day after enough sessions have accumulated. You can trigger it manually with `/dream` if you want it to run now.