@qwen-code/qwen-code 0.21.12-preview.3 → 0.21.12

package/chunks/{chunk-UZPWH6SP.js → chunk-IX4PWUDU.js}

@@ -2,17 +2,17 @@
 "use strict";
 import {
   listCommand
-} from "./chunk-575MI5K3.js";
+} from "./chunk-ZQUY3ZJU.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-TEKFBSMY.js";
+} from "./chunk-RDVNSJQU.js";
 import {
   serveCommand
-} from "./chunk-ILVATFYJ.js";
+} from "./chunk-TDESMS7M.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-47FQVRCO.js";
+} from "./chunk-TMFWI4RC.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-4NFY2S7N.js";
@@ -28,12 +28,12 @@ import {
 } from "./chunk-TQOF5KBL.js";
 import {
   resolvePath
-} from "./chunk-IQFYO5BF.js";
+} from "./chunk-H7TMVHKE.js";
 import {
   collectProviderModelsForProtocol,
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-NPE3STIW.js";
+} from "./chunk-ROIJYS5K.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
@@ -53,27 +53,27 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-TRYJ3BVE.js";
+} from "./chunk-WM3LUQLO.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-LHY6HBRA.js";
+} from "./chunk-IH4Z54RJ.js";
 import {
   parseChannelConfig
-} from "./chunk-YTYPRVIZ.js";
-import {
-  findCliEntryPath
-} from "./chunk-V6WHFGST.js";
+} from "./chunk-BSR5AXZR.js";
 import {
   DEFAULT_BASE_URL,
   buildHeaders,
   clearAccount,
   loadAccount,
   saveAccount
-} from "./chunk-3GCU5O2E.js";
+} from "./chunk-ZLCT4C5A.js";
+import {
+  findCliEntryPath
+} from "./chunk-V6WHFGST.js";
 import {
   canonicalizeWorkspace
 } from "./chunk-6PLDPT2C.js";
@@ -101,7 +101,7 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-K7JW6V5O.js";
+} from "./chunk-A6NRNRKE.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -110,7 +110,14 @@ import {
 } from "./chunk-M5GB774H.js";
 import {
   EXTERNAL_TOOL_GUARD_TOKEN_ENV
-} from "./chunk-BKHCW2BI.js";
+} from "./chunk-3VUENPWF.js";
+import {
+  readServiceInfo,
+  removeServiceInfo,
+  signalService,
+  waitForExit,
+  writeServiceInfo
+} from "./chunk-3AEKDXKT.js";
 import {
   AcpBridge,
   ChannelLoopScheduler,
@@ -121,45 +128,38 @@ import {
   isChannelProactiveDeliveryError,
   sanitizeLogText,
   sanitizePromptText
-} from "./chunk-LT532KF4.js";
-import {
-  readServiceInfo,
-  removeServiceInfo,
-  signalService,
-  waitForExit,
-  writeServiceInfo
-} from "./chunk-AQHNAA7E.js";
+} from "./chunk-AW27A43Y.js";
 import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-4M2F7OG7.js";
+} from "./chunk-3LDGOQXZ.js";
 import {
   loadSettings
-} from "./chunk-M6SXIXBV.js";
+} from "./chunk-3GDBZJD6.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-GYBDYWMV.js";
+} from "./chunk-IRSLAS4M.js";
 import {
   loadEnvironment
-} from "./chunk-RRQJPCRQ.js";
+} from "./chunk-XH3KAV2G.js";
 import {
   resolveAcpChannelFallback,
   scrubAndReportInheritedLoaderEnv
 } from "./chunk-MS7GNABG.js";
 import {
   getCliVersion
-} from "./chunk-M2PY7CNK.js";
+} from "./chunk-OWXFBIB6.js";
 import {
   getPackageJson
-} from "./chunk-VJNBRRZG.js";
+} from "./chunk-WZMH7II3.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-4ETA3KRC.js";
+} from "./chunk-ZMY2P4L3.js";
 import {
   require_strip_json_comments
 } from "./chunk-NPQ5ZKRP.js";
@@ -193,15 +193,12 @@ import {
   parseInstallSource,
   promptForSetting,
   readChannelMemory,
-  redactUrlCredentials,
   removeChannelMemoryEntries,
   resolveBundleDir,
-  sessionIdContext,
-  stripAnsiAndControl,
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-M6HXP2SG.js";
+} from "./chunk-EBPLKY6U.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -211,32 +208,38 @@ import {
 } from "./chunk-IRH27ZC2.js";
 import {
   require_dist
-} from "./chunk-2AZMF6G5.js";
+} from "./chunk-5RUCD4ED.js";
 import {
+  addDaemonRequestAttribute,
   parseBooleanEnvFlag,
   resolveTelemetrySettings
-} from "./chunk-O5AZPHYZ.js";
+} from "./chunk-K34GJQOZ.js";
 import {
   getAllGeminiMdFilenames,
   parseLineTolerant,
   setGeminiMdFilename
-} from "./chunk-HB6QW4LM.js";
+} from "./chunk-4KM2SYK5.js";
 import {
   SchemaValidator,
   ToolNames
-} from "./chunk-XTH2OMDS.js";
+} from "./chunk-YIGGWOJE.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
 } from "./chunk-F6WFNA7U.js";
+import {
+  isTlsVerificationDisabled
+} from "./chunk-4AOVQPJU.js";
 import {
   atomicWriteFileSync
-} from "./chunk-F6AOBFUN.js";
+} from "./chunk-YBHUXEC6.js";
 import {
-  isTlsVerificationDisabled
-} from "./chunk-EFIMD5VA.js";
+  recordChannelMemoryRecallMetrics,
+  redactUrlCredentials,
+  stripAnsiAndControl
+} from "./chunk-N4SVADAV.js";
 import {
-  recordChannelMemoryRecallMetrics
-} from "./chunk-E5BWLU5J.js";
+  sessionIdContext
+} from "./chunk-K5IDV3PC.js";
 import {
   FatalConfigError,
   FatalSandboxError,
@@ -244,7 +247,7 @@ import {
   createDebugLogger,
   getErrorMessage,
   isNodeError
-} from "./chunk-MPBRV3UU.js";
+} from "./chunk-HOSVOUDK.js";
 import {
   writeStderrLine,
   writeStderrLineSafe,
@@ -2985,7 +2988,7 @@ var stopCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-PXIC4ZDK.js");
+        const sdk = await import("./daemon-GED37WOX.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -3171,7 +3174,7 @@ var statusCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-PXIC4ZDK.js");
+        const sdk = await import("./daemon-GED37WOX.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -3282,7 +3285,7 @@ var reloadCommand = {
     const token = resolveToken(argv.token);
     let sdk;
     try {
-      sdk = await import("./daemon-PXIC4ZDK.js");
+      sdk = await import("./daemon-GED37WOX.js");
     } catch (err) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(err)}`
@@ -3362,7 +3365,7 @@ var setCommand2 = {
     const selection = names[0] === "all" ? { mode: "all" } : { mode: "names", names };
     let sdk;
     try {
-      sdk = await import("./daemon-PXIC4ZDK.js");
+      sdk = await import("./daemon-GED37WOX.js");
     } catch (error) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(error)}`
@@ -3430,7 +3433,7 @@ function createDaemonSessionFactory({
       sessionScope: "thread"
     };
     if (req.sessionId) {
-      return await DaemonSessionClient.load(
+      return await DaemonSessionClient.resume(
         client,
         req.sessionId,
         daemonReq,
@@ -3491,7 +3494,7 @@ function createDaemonChannelBridgeFacade(bridge, opts) {
 }
 __name(createDaemonChannelBridgeFacade, "createDaemonChannelBridgeFacade");
 async function loadDaemonSdk() {
-  return await import("./daemon-PXIC4ZDK.js");
+  return await import("./daemon-GED37WOX.js");
 }
 __name(loadDaemonSdk, "loadDaemonSdk");
 function selectedChannelNames(channelsConfig, selection) {
@@ -4626,6 +4629,18 @@ init_esbuild_shims();
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 
+// packages/cli/src/commands/review/lib/review-settings.ts
+init_esbuild_shims();
+function operatorReviewSettings() {
+  const review = loadSettings(void 0, { skipWorkspaceSettings: true }).merged.review;
+  return {
+    attribution: typeof review?.attribution === "boolean" ? review.attribution : true,
+    comment: review?.comment === true,
+    effort: typeof review?.effort === "string" ? review.effort : void 0
+  };
+}
+__name(operatorReviewSettings, "operatorReviewSettings");
+
 // packages/cli/src/commands/review/lib/stale-bundle.ts
 init_esbuild_shims();
 import { createHash } from "node:crypto";
@@ -4900,19 +4915,29 @@ function classifyToken(token) {
   return { type: "file", path: token };
 }
 __name(classifyToken, "classifyToken");
-function parseReviewArgs(raw) {
+function parseReviewArgs(raw, defaults = {}) {
   const tokens = tokenizeArgs(raw);
   const warnings = [];
   const unknownFlags = [];
-  let commentRequested = false;
+  let commentRequestedByFlag = false;
   let fixRequested = false;
   let explicitEffort = null;
+  let configuredEffort;
+  let invalidConfiguredEffort;
+  if (defaults.effort !== void 0) {
+    const normalized = asEffort(defaults.effort);
+    if (normalized !== null) {
+      configuredEffort = normalized;
+    } else {
+      invalidConfiguredEffort = defaults.effort;
+    }
+  }
   const effortIssues = [];
   const kept = [];
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i];
     if (token === "--comment") {
-      commentRequested = true;
+      commentRequestedByFlag = true;
       continue;
     }
     if (token === "--fix") {
@@ -4991,8 +5016,9 @@ function parseReviewArgs(raw) {
     );
   }
   const isPr = target.type === "pr-number" || target.type === "pr-url";
+  const commentRequested = commentRequestedByFlag || defaults.comment === true;
   const commentEffective = commentRequested && isPr;
-  if (commentRequested && !isPr) {
+  if (commentRequestedByFlag && !isPr) {
     warnings.push(
       "Warning: `--comment` flag is ignored because the review target is not a PR."
     );
@@ -5008,6 +5034,9 @@ function parseReviewArgs(raw) {
   if (explicitEffort !== null) {
     effort = explicitEffort;
     effortSource = "explicit";
+  } else if (configuredEffort !== void 0) {
+    effort = configuredEffort;
+    effortSource = "configured";
   } else {
     effort = isPr ? "high" : "medium";
     effortSource = "default";
@@ -5016,7 +5045,7 @@ function parseReviewArgs(raw) {
     effort = "high";
     effortSource = "forced-by-comment";
     warnings.push(
-      "`--comment` requires a verified review; running at high effort."
+      commentRequestedByFlag ? "`--comment` requires a verified review; running at high effort." : "`review.comment` is enabled in settings; posting requires a verified review \u2014 running at high effort."
     );
   }
   if (fixEffective && effort === "low") {
@@ -5026,7 +5055,7 @@ function parseReviewArgs(raw) {
       "`--fix` edits your working tree, so it requires verified findings; running at medium effort."
     );
   }
-  const resolution = effortSource === "explicit" ? `--effort ${effort} (the last valid occurrence) is in effect` : effortSource === "forced-by-comment" ? "`--comment` forces high effort" : effortSource === "forced-by-fix" ? "`--fix` forces at least medium effort" : "using the default effort";
+  const resolution = effortSource === "explicit" ? `--effort ${effort} (the last valid occurrence) is in effect` : effortSource === "forced-by-comment" ? commentRequestedByFlag ? "`--comment` forces high effort" : "the `review.comment` setting forces high effort" : effortSource === "forced-by-fix" ? "`--fix` forces at least medium effort" : effortSource === "configured" ? "using the configured review.effort" : "using the default effort";
   for (const issue of effortIssues) {
     switch (issue.kind) {
       case "invalid-eq":
@@ -5051,11 +5080,16 @@ function parseReviewArgs(raw) {
         break;
     }
   }
+  if (invalidConfiguredEffort !== void 0) {
+    warnings.push(
+      `Invalid review.effort value ${JSON.stringify(invalidConfiguredEffort)} in settings; ${resolution}.`
+    );
+  }
   return {
     target,
     effort,
     effortSource,
-    comment: { requested: commentRequested, effective: commentEffective },
+    comment: { requested: commentRequestedByFlag, effective: commentEffective },
     fix: { requested: fixRequested, effective: fixEffective },
     extraTokens,
     unknownFlags,
@@ -5063,6 +5097,14 @@ function parseReviewArgs(raw) {
   };
 }
 __name(parseReviewArgs, "parseReviewArgs");
+function reviewDefaultsFromSettings() {
+  const review = operatorReviewSettings();
+  return {
+    effort: review.effort === void 0 || review.effort.toLowerCase() === "auto" ? void 0 : review.effort,
+    comment: review.comment
+  };
+}
+__name(reviewDefaultsFromSettings, "reviewDefaultsFromSettings");
 var parseArgsCommand = {
   command: "parse-args [raw]",
   describe: "Parse the /review skill argument string (--comment, --fix, --effort, target disambiguation) and emit the verdict as JSON; pass the string on stdin via --stdin (a positional that begins with a dash never reaches this handler \u2014 yargs rejects it as an unknown flag)",
@@ -5099,7 +5141,7 @@ var parseArgsCommand = {
     if (bundleNotice) {
       writeStderrLineSafe(bundleNotice);
     }
-    const parsed = parseReviewArgs(rawStr);
+    const parsed = parseReviewArgs(rawStr, reviewDefaultsFromSettings());
     const json = JSON.stringify(parsed, null, 2);
     if (out) {
       mkdirSync2(dirname2(out), { recursive: true });
@@ -11402,40 +11444,55 @@ function renderShellLayerBriefList(taxonomy = SHELL_MODEL_LAYERS) {
 }
 __name(renderShellLayerBriefList, "renderShellLayerBriefList");
 var LAYER_RECEIPT_LINE_RE = /^[ \t]*(?:[-*+]|\d+[.)])?[ \t]*[*_~]{0,3}layer\s+walked[*_~]{0,3}[ \t]*[:：][\s*_~`]*([a-z][a-z0-9-]*)/i;
-var LAYER_HINT_RE = /layer\s+walked/i;
+var TRAILING_STITCH = new RegExp("^[\\p{P}\\p{S}]*(?:[^\\s\\p{P}\\p{S}]|\\p{Pc})", "u");
 var MD = new lib_default2({ html: true });
-function quotedLines(text2) {
-  const quoted = /* @__PURE__ */ new Set();
+var DROPPED_INLINE = "\0";
+var BIDI_CONTROL = new RegExp("\\p{Bidi_Control}", "gu");
+var INVISIBLE_FORMAT = /[\p{Cf}\p{Variation_Selector}\u000B\u034F\u000C\u2028\u2029]/gu;
+function* usedLines(finalText) {
+  const src = finalText.replace(/\r\n?/g, "\n");
   let tokens;
   try {
-    tokens = MD.parse(text2, {});
+    tokens = MD.parse(src, {});
   } catch {
-    return quoted;
+    yield* src.split("\n");
+    return;
   }
+  let blockquoteDepth = 0;
   for (const t2 of tokens) {
-    if (t2.map && (t2.type === "fence" || t2.type === "code_block" || t2.type === "html_block" || t2.type === "blockquote_open")) {
-      for (let i = t2.map[0]; i < t2.map[1]; i++) quoted.add(i);
+    if (t2.type === "blockquote_open") blockquoteDepth++;
+    else if (t2.type === "blockquote_close") blockquoteDepth--;
+    else if (t2.type === "inline" && blockquoteDepth === 0) {
+      let prose = "";
+      for (const c of t2.children ?? []) {
+        if (c.type === "text")
+          prose += c.content.replace(/[\r\n]+/g, " ").replace(BIDI_CONTROL, DROPPED_INLINE).replace(INVISIBLE_FORMAT, "");
+        else if (c.type === "softbreak" || c.type === "hardbreak")
+          prose += "\n";
+        else if (c.type === "html_inline" && // A real GitHub break: `<br>`, self-closing, or with attributes — but
+        // NOT a `<br-…>` custom element (a hyphen keeps the tag name going, and
+        // GitHub strips the non-allowlisted tag, leaving no break). After `br`
+        // the tag must END, or continue with whitespace/slash then attributes.
+        /^<br(?:[ \t\n\f\r/][^>]*)?>$/i.test(c.content))
+          prose += "\n";
+        else if (c.type === "code_inline" || c.type === "html_inline" || c.type === "image")
+          prose += DROPPED_INLINE;
+      }
+      yield* prose.split("\n");
     }
   }
-  return quoted;
-}
-__name(quotedLines, "quotedLines");
-function* usedLines(finalText) {
-  const src = finalText.replace(/\r\n?/g, "\n");
-  const quoted = quotedLines(src);
-  const lines = src.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    if (!quoted.has(i)) yield lines[i];
-  }
 }
 __name(usedLines, "usedLines");
 function parseLayerReceipts(finalText, taxonomy = SHELL_MODEL_LAYERS) {
   const ids = /* @__PURE__ */ new Set();
-  if (!LAYER_HINT_RE.test(finalText)) return ids;
+  const bare = finalText.replace(/[*_~`[\]()]/g, "");
+  if (!/layer/i.test(bare) && !/walked/i.test(bare) && !/&[#a-z]/i.test(finalText))
+    return ids;
   const known = new Set(taxonomy.map((l) => l.id));
   for (const line of usedLines(finalText)) {
     const m = LAYER_RECEIPT_LINE_RE.exec(line);
     if (!m) continue;
+    if (TRAILING_STITCH.test(line.slice(m[0].length))) continue;
     const id = m[1].toLowerCase();
     if (known.has(id)) ids.add(id);
   }
@@ -11506,6 +11563,7 @@ function isRepositoryContextRoleId(value) {
 __name(isRepositoryContextRoleId, "isRepositoryContextRoleId");
 var REVERSE_AUDIT_EXAMPLE_RECEIPT = "No issues found \u2014 re-walked the reconnect state machine and the two changed exports' call sites; every gap I checked was already in the list";
 var MODELED_SYSTEM_EXECUTION_LENS = `- **A model of another system's EXECUTION, diverging in state \u2014 not only its syntax.** Beyond a parser that *reads* a format two ways, an *interpreter* \u2014 a guard, sandbox, or permission model that re-implements how another system (a shell, git, a query engine) RUNS \u2014 can have its model of that system's runtime state drift from the real thing. Syntax divergence is one token read two ways; **state divergence** is the model carrying the wrong VALUE across a boundary the real system crosses differently, so the guard allows what it would have denied. Enumerate the boundaries where the modeled system carries state across a call, and for each ask what the real system does that the model does not: what SURVIVES a function call or \`eval\` (working directory, exported vars, shell options, defined functions) that a subshell or \`$(\u2026)\` does NOT propagate back but DOES inherit; what name-resolution order applies (a function shadowing \`git\`/\`cd\`, \`command\`/\`builtin\` bypassing it, \`export -f\` importing a function into a child shell); which options (\`set -a\`) a child or substitution inherits. The bug shape is a recursive evaluator that computes a nested body's post-state and then DISCARDS or fails to merge it, so a later check runs against state the real system has already moved past. **A second bug shape is state that only ACCUMULATES:** the real system has operations that DELETE what earlier ones added \u2014 \`unset -f\`/\`unalias\`/\`export -n -f\` remove a definition or its export attribute, \`set +a\`/\`+o\` clears an option, \`cd -\`/\`popd\` walks a directory back \u2014 so a model that grows an add-only map of definitions, export attributes, or options and never removes an entry diverges the moment the real system removes one (a \`git\` function defined, then \`unset -f\`'d, still replayed against a stale body while the real shell resolves the external program). For every piece of modeled state, check the model has a REMOVAL path for every ADD path the real system does. **When the boundary is subtle, do not argue it \u2014 run it:** build the payload, execute it against the real system (\`run_shell_command\` real bash/git in the worktree), trace the same payload through the model, and state the divergence with BOTH observed behaviours. A guard that models an executable system and is reviewed only by reading is judged against the very model of that system whose gaps are the vulnerability \u2014 the reading and the code share the blind spot by construction.`;
+var ENUMERATION_TRAP_LENS = `A change that HAND-ROLLS parsing or matching of a surface whose **entrance space is unbounded** \u2014 untrusted input read a rendered format's way, a re-implemented general grammar, \`indexOf\`/\`slice\`/regex over structured input whose per-corner special-cases keep accumulating ("match what the renderer renders" logic, a growing hand-listed case set) \u2014 has **no last corner**, so enumerating cases never converges. (Adversarial input alone does NOT make a surface unbounded: a small, exhaustively specified grammar has a bounded, enumerable set of productions and IS closable by exhaustive validation \u2014 do not demand a structural replacement there. The trigger is unboundedness of the entrance space, not the mere hostility of the input.) The finding is the SHAPE, not the current corner: name the class-closing fix \u2014 defer to a real parser, the tool's own authoritative structured output, or a fail-closed decision \u2014 and file it ONCE, in place of enumerating cases. **Carry ONE demonstrated corner as the finding's witness** \u2014 the concrete input/state and the line(s) that produce the wrong outcome, executed against the real code where you can \u2014 so a verifier can confirm it at high confidence and it posts; that corner is the class's evidence, not a separate finding. Severity follows the risk the shape carries \u2014 a hand-rolled parser that can be fooled into a wrong result is **Critical**.`;
 var BRIEFS = {
   "0": {
     // Budget-exempt: Issue-sized mandatory work, not diff-sized: a small bugfix
@@ -11663,7 +11721,7 @@ Not your dimension: whether the change is at the right depth (3b owns altitude a
     publicLabel: "the altitude and abstraction pass",
     publicLabelZh: "\u4FEE\u590D\u5C42\u6B21\u4E0E\u62BD\u8C61\u5408\u7406\u6027\u68C0\u67E5",
     readsDiff: true,
-    brief: `You are **Agent 3b: Altitude & Abstraction Fit**. One question, walked to the end: **is each change at the right depth?**
+    brief: `You are **Agent 3b: Altitude & Abstraction Fit**. One question, walked to the end: **is each change at the right depth, and the right SHAPE for what it re-implements?**
 
 Altitude is the failure that reads as correct at every individual line and is wrong as a whole. For each change ask where the problem it addresses actually lives, and compare that to where the fix was written:
 
@@ -11671,6 +11729,7 @@ Altitude is the failure that reads as correct at every individual line and is wr
 - **Too shallow in the other direction \u2014 the wrong owner.** The defect is upstream (another module, another service, the data's producer) and the diff compensates for it downstream. Say whose bug it is.
 - **Too deep \u2014 over-engineering.** A new abstraction, indirection layer, options object, or configuration point serving exactly one call site; a generalisation for a second case that does not exist. The cost is real and concrete: every future reader pays for the indirection, and the shape is fixed by a single example that may be unrepresentative.
 - **Blast radius.** When a change to shared infrastructure exists to serve one caller, name the *other* callers it now also affects, and what it means for them.
+- **Wrong shape \u2014 the enumeration trap.** ${ENUMERATION_TRAP_LENS} Filed here as this change's altitude finding, once, in place of enumerating its cases.
 
 Every finding needs the concrete cost, not an aesthetic judgement: what breaks next, what has to be repeated, who else is affected. "This should be more general" with no named next caller is not a finding.
 
@@ -11921,6 +11980,8 @@ For each finding you were given:
 
 **When the fix IS a threshold, measure the threshold.** A guard built on a ratio or length cutoff makes the fix's coverage an empirical number, not a reading: hold every other variable fixed, vary the guarded quantity, and binary-search the boundary where behaviour flips. Then put that number next to what the linked issue actually reports \u2014 a live verification of a prose-ratio guard measured the minimum recovering payload at ~473 chars with the issue's own preamble held fixed, which proved the fix covered the issue's \`edit\`/\`write_file\` half and silently declined its \`run_shell_command\` half. "Fix is narrower than its claim, here is the boundary, here is the half it misses" is a finding no amount of code-reading produces.
 
+**When the defect is mechanically enumerable, sweep the real population \u2014 the count is the verdict.** For a claim about a pattern, a predicate, or a parser ("this misclassifies X", "this mishandles shape Y"), do not stop at the one reported instance: run the check over every real instance this repo holds (every workflow step body, every call site, every input the code will actually see) and report the count. "195 of 434 real \`run:\` bodies reach this path" confirms the finding, sizes its severity, and hands the author a number they can re-run rather than argue with \u2014 and a count of **zero** is the quoted contradiction that rejects it. Two rules keep a sweep evidence rather than theatre: its oracle must be an **external authority** \u2014 the real parser, the real tool, \`bash -n\` \u2014 never your own reimplementation of the logic under test, because a mirror shares the blind spots of what it mirrors and mirrored sweeps have manufactured false findings out of their own bugs; and spot-check one hit by reading it before you quote a nonzero count.
+
 **A suggested fix you did not run is a hypothesis; say which one you are giving.** When a finding's fix is cheap to apply, patch it in, re-run the same probe/harness to show it works, then revert \u2014 and state that every other number in your report comes from the unmodified PR (the contamination line is what lets a reader trust the rest). A fix too costly to verify is still worth proposing, labeled untested.
 
 **A probabilistic failure gets a RATE, not an anecdote.** For a timing/race claim, run N repetitions per arm and report the rates as the verdict; amplify with full CPU load to force the window open (a live case went from 4/11 idle to 5/5 loaded). And attribute honestly: a lower idle rate with no structural change is luck, not a fix. Fake-timer tests hardcode one ordering by construction \u2014 they cannot discriminate a race, so a green fake-timer suite is non-evidence here.
@@ -11981,6 +12042,8 @@ Return, for each finding, one verdict:
 - **confirmed (low confidence)** \u2014 the mechanism is real but the trigger is uncertain (timing, environment, configuration). Say what would confirm it. Carry the severity.
 - **rejected** \u2014 the code does not do what the finding claims (**quote the contradicting code**), or it matches an Exclusion Criterion (one-line reason).
 
+**A confirmed Critical returns its witness.** Alongside the verdict, include a \`witness:\` line quoting the observed output that settled it \u2014 the probe's two sides, the A/B's \`BASE:\`/\`PR:\` pair, the extracted step's run, the sweep count \u2014 trimmed to the deciding lines. When every run-capability above is genuinely inapplicable and the confirmation rests on the trace alone, write the one line \`witness: not run \u2014 <why no run could settle this claim>\` instead; writing that line is also the moment you notice when the claim was runnable after all. This is mechanical downstream \u2014 enforced in code at the findings canonicalization, not merely by the orchestrator's read of its rules: a confirmed Critical returning neither the witness nor the reason line is filed at **low confidence** \u2014 terminal-only, never posted \u2014 whatever your prose argued, because the evidence a run produced is the one part of a Critical its author can act on without re-deriving the bug.
+
 **Rejecting a Critical carries a higher bar than anything else, and it is one-way.** A rejected Critical is gone \u2014 no later stage revisits it, it vanishes from both the pull request and the terminal. To reject one you must **quote the specific code that contradicts the claim**. A passing test, a plausible-looking guard, or "I could not reproduce the reasoning" is not enough \u2014 when you cannot quote the contradiction, the floor is \`confirmed (low confidence)\`, never rejection. Downgrading is reversible; a human still sees a low-confidence finding under "Needs Human Review". Rejection is not.
 
 **For anything non-Critical, when uncertain, downgrade to low confidence rather than rejecting.** Reserve outright rejection for a finding that clearly does not match the code (it describes behaviour the code does not have) or matches an Exclusion Criterion. Low confidence is for "likely real, needs human judgement", not for "I have no idea" \u2014 a vague suspicion with no concrete evidence in the code can still be rejected.
@@ -12016,7 +12079,7 @@ If you find no new gap in your scope, say so **and name what you re-examined** \
 
 // packages/cli/src/commands/review/lib/repository-context.ts
 var REPOSITORY_CONTEXT_VERSION = 1;
-var MAX_ARRAY_ITEMS = 128;
+var MAX_ARRAY_ITEMS = 256;
 var MAX_PROVIDER_LENGTH = 64;
 var MAX_LABEL_LENGTH = 120;
 var MAX_TOKEN_LENGTH = 160;
@@ -13053,6 +13116,29 @@ function contextRoleRunsInThisReview(role, plan, mode) {
 }
 __name(contextRoleRunsInThisReview, "contextRoleRunsInThisReview");
 
+// packages/cli/src/commands/review/lib/agent-identity.ts
+init_esbuild_shims();
+var CHUNK_ROLE_RE = /^chunk\s+(\d+)\s+of\s+\d+$/i;
+var IDENTITY_LINE_RE = /^You are review agent `([^`\n]+)`(.*)$/;
+function labelFromIdentityLine(line) {
+  const m = IDENTITY_LINE_RE.exec(line.replace(/\r$/, ""));
+  if (!m) return null;
+  const [, role, rest] = m;
+  const chunk2 = CHUNK_ROLE_RE.exec(role);
+  if (chunk2) return `chunk ${chunk2[1]}`;
+  const round = /\(round (\d+)\)/.exec(rest);
+  if (round) return `agent ${role} (round ${round[1]})`;
+  const file = /Your file: `([^`\n]+)`/.exec(rest);
+  if (file) return `agent ${role} (${file[1]})`;
+  return `agent ${role}`;
+}
+__name(labelFromIdentityLine, "labelFromIdentityLine");
+function labelFromLaunchPrompt(prompt) {
+  const m = /^You are review agent `[^`\n]+`[^\n]*/m.exec(prompt);
+  return m ? labelFromIdentityLine(m[0]) : null;
+}
+__name(labelFromLaunchPrompt, "labelFromLaunchPrompt");
+
 // packages/cli/src/commands/review/lib/deadline.ts
 init_esbuild_shims();
 import {
@@ -13391,7 +13477,12 @@ __name(launchToolBudget, "launchToolBudget");
 var BUDGET_GAP_LINE_RE = /^(?:[ \t]*(?:[-*+]|\d+[.)]))?[ \t]*(`?)[*_~]{0,3}(?:budget gap|预算(?:缺口|不足|用尽))[*_~]{0,3}[ \t]*[:：][*_~]{0,3}[ \t]*(.+)$/i;
 var GAP_HINT_RE = /budget gap|预算(?:缺口|不足|用尽)/i;
 var INLINE_BUDGET_GAP_RE = /(?:budget gap|预算(?:缺口|不足|用尽))[*_~`]{0,3}[ \t]*[:：]/i;
-var PLACEHOLDER_GAP_RE = /^(?:<[^>]*>$|[-—*_~`]+$|(?:none|n\/a|nothing|no (?:gaps?|checks?))\b(?:[.!…,;:\s]*$|\s+(?:skipped|found|to report)\b[.!…,;:\s]*$|\s*[-—–]\s*(?:stayed\s+(?:under|within|below)\s+budget\b[.!…,;:\s]*$|(?:all|every(?:thing)?|planned|further|no further)\b(?:(?!\b(?:but|except|excepting|excluding)\b).)*(?<!\b(?:none|nothing|no|zero|never|not)\s)\b(?:complete[ds]?|done|finished|covered)\b[.!…,;:\s]*$)|\s*\(\s*(?:all|every(?:thing)?)\b(?:(?!\b(?:but|except|excepting|excluding)\b)[^()])*(?<!\b(?:none|nothing|no|zero|never|not)\s)\b(?:complete[ds]?|done|finished|covered)\b[.!…,;:\s]*\)\s*$))/i;
+var BUDGET_QUALIFIED = "(?:under|within|below|inside)\\s+(?:the\\s+)?(?:tool(?:[- ]call)?\\s+)?budget";
+var COMPLETION_TAIL = `(?:\\s+${BUDGET_QUALIFIED})?`;
+var PLACEHOLDER_GAP_RE = new RegExp(
+  `^(?:<[^>]*>$|[-\u2014*_~\`]+$|(?:none|n/a|nothing|no (?:gaps?|checks?))\\b(?:[.!\u2026,;:\\s]*$|\\s+(?:skipped|found|to report)\\b[.!\u2026,;:\\s]*$|\\s*[-\u2014\u2013]\\s*(?:stayed\\s+${BUDGET_QUALIFIED}\\b[.!\u2026,;:\\s]*$|(?:all|every(?:thing)?|planned|further|no further)\\b(?:(?!\\b(?:but|except|excepting|excluding)\\b).)*(?<!\\b(?:none|nothing|no|zero|never|not)\\s)\\b(?:complete[ds]?|done|finished|covered)\\b${COMPLETION_TAIL}[.!\u2026,;:\\s]*$)|\\s*\\(\\s*(?:all|every(?:thing)?)\\b(?:(?!\\b(?:but|except|excepting|excluding)\\b)[^()])*(?<!\\b(?:none|nothing|no|zero|never|not)\\s)\\b(?:complete[ds]?|done|finished|covered)\\b${COMPLETION_TAIL}[.!\u2026,;:\\s]*\\)\\s*$))`,
+  "i"
+);
 var MAX_GAP_LENGTH = 160;
 var MAX_GAPS_PER_AGENT = 8;
 var DANGEROUS_CHARS_RE = (
@@ -13577,6 +13668,8 @@ function publicRoleLabelZh(req) {
 __name(publicRoleLabelZh, "publicRoleLabelZh");
 function label(rec, chunk2) {
   if (chunk2 !== null) return `chunk ${chunk2}`;
+  const identity = labelFromLaunchPrompt(rec.launchPrompt);
+  if (identity !== null) return identity;
   const first = rec.launchPrompt.split("\n")[0]?.trim() ?? "";
   if (first) return first.replace(/\s+/g, " ");
   return rec.agentName || rec.agentId;
@@ -14246,6 +14339,7 @@ function validateFindings(raw) {
     const heldRaw = o.heldByMeasurement;
     const heldFile = heldRaw && typeof heldRaw === "object" ? asString(heldRaw, "file") : void 0;
     const shortSummary = asString(o, "shortSummary") ?? asString(o, "short_summary");
+    const witness = asString(o, "witness");
     return {
       id,
       severity,
@@ -14254,6 +14348,7 @@ function validateFindings(raw) {
       summary,
       shortSummary: shortSummary ? compressSummary(shortSummary) : compressSummary(summary),
       failureScenario,
+      ...witness ? { witness } : {},
       ...asString(o, "suggestedFix") || asString(o, "suggested_fix") ? {
         suggestedFix: asString(o, "suggestedFix") ?? asString(o, "suggested_fix")
       } : {},
@@ -14319,6 +14414,24 @@ Held back from Critical by measurement: \`test-delta\` reran the failing test co
   return { findings: out, held, readjudicated };
 }
 __name(holdCriticalsFailingOnBase, "holdCriticalsFailingOnBase");
+function holdUnwitnessedCriticals(findings) {
+  const unwitnessed = [];
+  const out = findings.map((f) => {
+    if (f.severity !== "Critical" || f.confidence !== "high" || f.source !== "review" || f.witness !== void 0) {
+      return f;
+    }
+    unwitnessed.push(f.id);
+    return {
+      ...f,
+      confidence: "low",
+      failureScenario: `${f.failureScenario}
+
+Filed at low confidence by the witness rule: this confirmed Critical arrived with neither a witness (the executed evidence that settled the verdict) nor a \`not run \u2014 <reason>\` line. Attach either and it stands at high confidence again.`
+    };
+  });
+  return { findings: out, unwitnessed };
+}
+__name(holdUnwitnessedCriticals, "holdUnwitnessedCriticals");
 var WORKSPACE_IN_COMMAND_RE = /--workspace="([^"]+)"/;
 function repoRelative(path3, workspace) {
   const at = path3.indexOf("::");
@@ -14553,6 +14666,8 @@ var findingsCommand = {
         shared
       ));
     }
+    const witnessHold = holdUnwitnessedCriticals(findings);
+    findings = witnessHold.findings;
     const report = buildReport(findings);
     const target = resolve6(out);
     mkdirSync6(dirname5(target), { recursive: true });
@@ -14567,6 +14682,11 @@ var findingsCommand = {
         `findings: ${h.id} held back from Critical \u2014 test-delta measured ${h.file} as failing on the merge base too`
       );
     }
+    for (const id of witnessHold.unwitnessed) {
+      writeStderrLine(
+        `findings: ${id} filed at low confidence \u2014 a confirmed Critical carried neither a witness nor a 'not run' reason (Step 4's witness rule)`
+      );
+    }
     for (const r of readjudicated) {
       writeStderrLine(
         `findings: ${r.id} left at Critical \u2014 it already carries the ${r.file} measurement and was raised again anyway`
@@ -14833,6 +14953,7 @@ __name(layerAuditGate, "layerAuditGate");
 
 // packages/cli/src/commands/review/lib/ledger.ts
 init_esbuild_shims();
+var SHA_RE = /^[0-9a-f]{7,64}$/;
 var LEDGER_MAX_FINDINGS = 50;
 var LEDGER_MAX_TITLE = 80;
 var LEDGER_MAX_FILE = 200;
@@ -14848,6 +14969,7 @@ function serializeLedger(ledger) {
   const render = /* @__PURE__ */ __name((findings, dropped) => {
     const payload = { v: 1, round: ledger.round, findings };
     if (dropped > 0) payload.dropped = dropped;
+    else if (ledger.sha && SHA_RE.test(ledger.sha)) payload.sha = ledger.sha;
     return `${OPEN}${JSON.stringify(payload).replace(/--/g, "-\\u002d")}${CLOSE}`;
   }, "render");
   const total = ledger.findings.length;
@@ -14872,19 +14994,28 @@ function parseLedger(body) {
       return null;
     }
     if (!Array.isArray(raw.findings)) return null;
-    const findings = raw.findings.filter(
+    const valid = raw.findings.filter(
       (f) => !!f && typeof f.id === "string" && (f.sev === "C" || f.sev === "S") && typeof f.file === "string" && typeof f.title === "string" && (f.line === void 0 || Number.isInteger(f.line))
-    ).slice(0, LEDGER_MAX_FINDINGS).map((f) => ({
+    );
+    const findings = valid.slice(0, LEDGER_MAX_FINDINGS).map((f) => ({
       ...f,
       title: f.title.slice(0, LEDGER_MAX_TITLE),
       file: f.file.slice(0, LEDGER_MAX_FILE)
     }));
-    const dropped = Number.isInteger(raw.dropped) && raw.dropped > 0 ? raw.dropped : void 0;
+    const declared = Number.isInteger(raw.dropped) && raw.dropped > 0 ? raw.dropped : 0;
+    const dropped = declared + (valid.length - findings.length) || void 0;
+    const sha = (
+      // Normalised on READ as the serializer holds on WRITE: a hand-edited
+      // marker carrying both `dropped` and `sha` would certify a range its
+      // own work list admits is partial.
+      typeof raw.sha === "string" && SHA_RE.test(raw.sha) && !dropped ? raw.sha : void 0
+    );
     return {
       v: 1,
       round: raw.round,
       findings,
-      ...dropped ? { dropped } : {}
+      ...dropped ? { dropped } : {},
+      ...sha ? { sha } : {}
     };
   } catch {
     return null;
@@ -14943,6 +15074,14 @@ function reviewFooter(modelId, cliVersion) {
 }
 __name(reviewFooter, "reviewFooter");
 var REVIEW_FOOTER_RE = /\s*(?:_— (?:(?! via Qwen Code \/review)[^\n])* via Qwen Code \/review(?: \(v[^\n)]*\))?_?\s*)+$/;
+var STRIP_TAIL_LIMIT = 8192;
+function stripReviewFooter(body) {
+  if (!body.includes(FOOTER_MARKER)) return body;
+  const tail2 = body.slice(-STRIP_TAIL_LIMIT);
+  const stripped = tail2.replace(REVIEW_FOOTER_RE, "");
+  return stripped === tail2 ? body : body.slice(0, body.length - tail2.length) + stripped;
+}
+__name(stripReviewFooter, "stripReviewFooter");
 function isFooterSafeModelId(modelId) {
   return !/[\n\r]/.test(modelId) && !modelId.includes(FOOTER_MARKER);
 }
@@ -15056,10 +15195,6 @@ function toStringList(value, field) {
   return [...value];
 }
 __name(toStringList, "toStringList");
-function stripReviewFooter(entry) {
-  return entry.includes(FOOTER_MARKER) ? entry.replace(REVIEW_FOOTER_RE, "") : entry;
-}
-__name(stripReviewFooter, "stripReviewFooter");
 function toBool(value, field) {
   if (value === void 0 || value === null) return false;
   if (typeof value !== "boolean") {
@@ -15070,15 +15205,15 @@ function toBool(value, field) {
   return value;
 }
 __name(toBool, "toBool");
-function composeReview(input, cliVersion = "unknown") {
-  const result = composeReviewBody(input, cliVersion);
-  const marker = ledgerMarkerFor(input);
+function composeReview(input, cliVersion = "unknown", attribution = true) {
+  const result = composeReviewBody(input, cliVersion, attribution);
+  const marker = ledgerMarkerFor(input, result.cappedBy);
   return marker ? { ...result, body: `${result.body}
 
 ${marker}` } : result;
 }
 __name(composeReview, "composeReview");
-function ledgerMarkerFor(input) {
+function ledgerMarkerFor(input, cappedBy) {
   try {
     if (!input.planPath) return null;
     const plan = JSON.parse(readFileSync13(input.planPath, "utf8"));
@@ -15100,19 +15235,22 @@ function ledgerMarkerFor(input) {
         prevRound = prev.round;
     } catch {
     }
-    return serializeLedger(
-      buildLedger(
+    const failClosed = (input.cannotTellCriticals?.length ?? 0) > 0 || cappedBy.length > 0;
+    const sha = !failClosed && typeof plan.fetchedSha === "string" ? plan.fetchedSha : void 0;
+    return serializeLedger({
+      ...buildLedger(
         prevRound + 1,
         input.draftedComments ?? [],
         toStringList(input.bodyCriticals, "bodyCriticals").map(stripReviewFooter).filter((entry) => entry.trim() !== "")
-      )
-    );
+      ),
+      ...sha ? { sha } : {}
+    });
   } catch {
     return null;
   }
 }
 __name(ledgerMarkerFor, "ledgerMarkerFor");
-function composeReviewBody(input, cliVersion) {
+function composeReviewBody(input, cliVersion, attribution) {
   const criticalsInline = toCount(input.criticalsInline, "criticalsInline");
   const suggestionsInline = toCount(
     input.suggestionsInline,
@@ -15343,15 +15481,19 @@ function composeReviewBody(input, cliVersion) {
     "presubmit.downgradeReasons"
   );
   const modelId = input.modelId;
-  if (typeof modelId !== "string" || modelId.trim() === "") {
-    throw new TypeError(
-      "compose-review: modelId is required (the public footer names the reviewing model)"
-    );
-  }
-  if (!isFooterSafeModelId(modelId)) {
-    throw new TypeError(
-      "compose-review: modelId is interpolated into the public footer verbatim \u2014 it must be a single line that does not contain the footer marker"
-    );
+  let footer = "";
+  if (attribution) {
+    if (typeof modelId !== "string" || modelId.trim() === "") {
+      throw new TypeError(
+        "compose-review: modelId is required (the public footer names the reviewing model)"
+      );
+    }
+    if (!isFooterSafeModelId(modelId)) {
+      throw new TypeError(
+        "compose-review: modelId is interpolated into the public footer verbatim \u2014 it must be a single line that does not contain the footer marker"
+      );
+    }
+    footer = reviewFooter(modelId, cliVersion);
   }
   const c = criticalsInline + bodyCriticals.length;
   const s = suggestionsInline + suggestionsDiscarded;
@@ -15399,7 +15541,6 @@ function composeReviewBody(input, cliVersion) {
       }
     }
   }
-  const footer = reviewFooter(modelId, cliVersion);
   const bilingual = bilingualFromPlan(input.planPath, input.prBodyFetcher);
   const render = /* @__PURE__ */ __name((parts, sep9) => {
     const en = parts.map((p) => p.en).join(sep9);
@@ -15413,7 +15554,7 @@ function composeReviewBody(input, cliVersion) {
 ${zh}
 
 </details>` : en;
-    return `${text2}
+    return footer === "" ? text2 : `${text2}
 
 ${footer}`;
   }, "render");
@@ -15999,7 +16140,8 @@ var composeReviewCommand = {
       },
       // Same pin as `submit`: the startup stamp, not a version resolved at
       // compose time — a shared runner can rewrite the install mid-session.
-      footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion()
+      footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion(),
+      operatorReviewSettings().attribution
     );
     const json = JSON.stringify(
       { ...result, verdictLine: verdictLine(result) },
@@ -17939,7 +18081,7 @@ function renderLedgerSection(ledger) {
   return [
     "## Previous /review round (machine ledger)",
     "",
-    `Round ${ledger.round}, recovered from the marker this account's last posted review carried. **Every entry below is owed a this-round ruling** (fixed / still stands / cannot tell) under Step 6's previous-round rules \u2014 the ledger is a work list, not a verdict; re-assert each claim against the code before repeating or retiring it.`,
+    `Round ${ledger.round}${ledger.sha ? `, reviewed at \`${code2(ledger.sha)}\`` : ""}, recovered from the marker this account's last posted review carried. **Every entry below is owed a this-round ruling** (fixed / still stands / cannot tell / superseded by <class-id>) under Step 6's previous-round rules \u2014 the ledger is a work list, not a verdict; re-assert each claim against the code before repeating or retiring it.${ledger.sha ? ` The reviewed-at sha is the incremental anchor Step 1's recovered-anchor check reads from the side file \u2014 validate it is an ancestor of the fetched head before scoping to it.` : ""}`,
     // A truncated ledger must not read like a complete one. `dropped` exists
     // to draw that line, and this is the only place a reader sees the list.
     ...ledger.dropped ? [
@@ -18867,7 +19009,7 @@ async function runPresubmit(args) {
     `repos/${owner}/${repo}/pulls/${prNumber}/comments`
   );
   const qwenComments = allComments.filter(
-    (c) => /via Qwen Code \/review/.test(c.body ?? "")
+    (c) => /via Qwen Code \/review/.test(c.body ?? "") || !c.in_reply_to_id && me !== "" && (c.user?.login ?? "").toLowerCase() === me.toLowerCase() && severityOf(c) !== null
   );
   const repliedToIds = /* @__PURE__ */ new Set();
   for (const c of allComments) {
@@ -19117,14 +19259,15 @@ function reviewWriteAuthorization(req) {
   } catch {
     return {
       ok: false,
-      why: `no review arguments were recorded at ${path3}, so this run cannot show that \`--comment\` was requested`
+      why: req.defaultComment === true ? `no review arguments were recorded at ${path3}, so no recorded invocation names a pull request to bind this write to \u2014 re-run the review naming the pull request` : `no review arguments were recorded at ${path3}, so this run cannot show that \`--comment\` was requested`
     };
   }
-  const verdict = parseReviewArgs(raw);
+  const verdict = parseReviewArgs(raw, { comment: req.defaultComment });
   if (!verdict.comment.effective) {
+    const commentRequested = verdict.comment.requested || req.defaultComment === true;
     return {
       ok: false,
-      why: `\`--comment\` was not in the review arguments (${JSON.stringify(raw.trim())})`
+      why: commentRequested ? `the review arguments (${JSON.stringify(raw.trim())}) do not name a pull request, so they cannot authorise posting to one` : `\`--comment\` was not in the review arguments (${JSON.stringify(raw.trim())})`
     };
   }
   const t2 = verdict.target;
@@ -19161,7 +19304,7 @@ function reviewWriteAuthorization(req) {
   }
   return {
     ok: true,
-    why: `\`--comment\` was in the review arguments for #${authorisedPr}`
+    why: verdict.comment.requested ? `\`--comment\` was in the review arguments for #${authorisedPr}` : `\`review.comment\` is enabled in settings, and the review arguments name #${authorisedPr}`
   };
 }
 __name(reviewWriteAuthorization, "reviewWriteAuthorization");
@@ -19403,6 +19546,7 @@ function runPublishAssets(args) {
   const effectiveHost = resolveGhHost(args.host);
   const auth = reviewWriteAuthorization({
     userAuthorized: args.userAuthorized,
+    defaultComment: args.defaultComment,
     skillArgs: args.skillArgs,
     pr: args.pr,
     // Bind the REVIEWED repo when the caller names it, never the assets repo:
@@ -19609,7 +19753,11 @@ var publishAssetsCommand = {
       out: argv["out"],
       host: argv["host"],
       userAuthorized: Boolean(argv["user-authorized"]),
-      skillArgs: argv["skill-args"]
+      skillArgs: argv["skill-args"],
+      // The same operator-scope resolution as `submit`: the two callers of
+      // the shared gate must agree on what authorises a run, or a run that
+      // posts the review still refuses to publish its evidence images.
+      defaultComment: operatorReviewSettings().comment
     });
   }, "handler")
 };
@@ -20289,7 +20437,7 @@ function toolBudgetBlock(report, launch) {
     "",
     "## Tool budget",
     "",
-    `About **${total} tool calls** for this whole review \u2014 reads, greps, shell, everything \u2014 and the ~${reads} reads your launch is assigned (your brief, the diff pages, any files your method mandates) are already counted in. It is a soft ceiling. At the ceiling: stop exploring, write your findings from the evidence already in hand, and disclose each unfinished check on its own line, exactly as \`Budget gap: <the check>\` \u2014 the coverage tool reads those lines, so the format is load-bearing. The budget never suppresses a finding: a candidate you can already name goes in your return regardless (at \`Confidence: low\` if the budget stopped you before verifying it).`
+    `About **${total} tool calls** for this whole review \u2014 reads, greps, shell, everything \u2014 and the ~${reads} reads your launch is assigned (your brief, the diff pages, any files your method mandates) are already counted in. It is a soft ceiling. At the ceiling: stop exploring, write your findings from the evidence already in hand, and disclose each unfinished check on its own line, exactly as \`Budget gap: <the check>\` \u2014 the coverage tool reads those lines, so the format is load-bearing. If nothing was cut short, write NO \`Budget gap:\` line at all \u2014 the format is only for checks the ceiling stopped: a "none" put there is at best filtered out, and any wording the filter does not recognize is published in the review body as a phantom coverage gap. The budget never suppresses a finding: a candidate you can already name goes in your return regardless (at \`Confidence: low\` if the budget stopped you before verifying it).`
   ];
 }
 __name(toolBudgetBlock, "toolBudgetBlock");
@@ -20318,6 +20466,7 @@ function buildChunkAgentPrompt(report, id, rules) {
       "",
       `    Uncoverable: chunk ${chunk2.id} \u2014 line exceeds the read limit`
     );
+    return parts.join("\n");
   } else if (chunk2.oversized) {
     parts.push(
       "",
@@ -20332,6 +20481,8 @@ function buildChunkAgentPrompt(report, id, rules) {
     "",
     "For your territory only, you own every dimension: line-by-line correctness, the removed-behavior audit of your own deleted lines, security, code quality, performance, test coverage, and the adversarial reading. Two duties are NOT yours, because a chunk agent is structurally blind to them: cross-file tracing (a caller in another chunk) and the cross-chunk half of removed-behavior. Audit the deletions in your own territory; do not conclude a deletion is unreplaced merely because its replacement is not in your range.",
     "",
+    "**Shape check (part of code quality \u2014 the altitude lens, scoped to your territory).** For the code in YOUR chunk: " + ENUMERATION_TRAP_LENS,
+    "",
     FINDING_FORMAT,
     "",
     SEVERITY,
@@ -23840,9 +23991,8 @@ function isDiffLine(n) {
   return typeof n === "number" && Number.isSafeInteger(n) && n > 0;
 }
 __name(isDiffLine, "isDiffLine");
-function normalizeInlineComments(comments, modelId, cliVersion) {
-  if (typeof modelId !== "string" || modelId.trim() === "") return comments;
-  const footer = reviewFooter(modelId, cliVersion);
+function normalizeInlineComments(comments, modelId, cliVersion, attribution) {
+  const footer = attribution && typeof modelId === "string" && modelId.trim() !== "" ? reviewFooter(modelId, cliVersion) : void 0;
   return comments.map(
     (comment2) => (
       // An empty body stays empty: this runs BEFORE the consistency check, and
@@ -23850,7 +24000,9 @@ function normalizeInlineComments(comments, modelId, cliVersion) {
       // names it ('has no body — an empty comment').
       typeof comment2.body === "string" && comment2.body.trim() !== "" ? {
         ...comment2,
-        body: `${comment2.body.replace(REVIEW_FOOTER_RE, "")}
+        // Forged footers are stripped even with attribution off: a comment
+        // authored by the model must not carry one the operator turned off.
+        body: footer === void 0 ? stripReviewFooter(comment2.body) : `${stripReviewFooter(comment2.body)}
 
 ${footer}`
       } : comment2
@@ -23858,9 +24010,10 @@ ${footer}`
   );
 }
 __name(normalizeInlineComments, "normalizeInlineComments");
-function authorization(args) {
+function authorization(args, defaultComment) {
   return reviewWriteAuthorization({
     userAuthorized: args.userAuthorized,
+    defaultComment,
     skillArgs: args.skillArgs,
     pr: args.pr,
     repo: args.repo,
@@ -23871,7 +24024,7 @@ function authorization(args) {
   });
 }
 __name(authorization, "authorization");
-function compose(payload, cliVersion) {
+function compose(payload, cliVersion, attribution) {
   const comments = payload.comments ?? [];
   const state = payload.state ?? {};
   const { criticalsInline, suggestionsInline } = countInlineFindings(comments);
@@ -23891,7 +24044,8 @@ function compose(payload, cliVersion) {
       suggestionsInline,
       draftedComments: comments
     },
-    cliVersion
+    cliVersion,
+    attribution
   );
   return { event: r.event, body: r.body, cappedBy: r.cappedBy };
 }
@@ -23971,7 +24125,8 @@ function inconsistencies(payload, event2) {
   return problems;
 }
 __name(inconsistencies, "inconsistencies");
-function runSubmit(args, cliVersion = "unknown") {
+function runSubmit(args, cliVersion = "unknown", opts = {}) {
+  const { attribution = true, defaultComment = false } = opts;
   setGhHost(args.host);
   if (!isOwnerRepo(args.repo)) {
     throw new Error(
@@ -23991,11 +24146,12 @@ function runSubmit(args, cliVersion = "unknown") {
       `Cannot read review JSON ${args.review}: ${err.message}`
     );
   }
-  const auth = authorization(args);
+  const auth = authorization(args, defaultComment);
   if (!auth.ok) {
+    const advice = auth.why.includes("`--comment` was") ? `This is the correct outcome of a review the user did not ask to publish \u2014 report the findings in the terminal and stop. Re-run with \`--comment\`, or pass --user-authorized only after the user has asked, in a message they typed, for this review to be published.` : `Nothing recorded authorises binding this target \u2014 report the findings in the terminal and stop. Posting to this pull request needs a review invoked naming it, or --user-authorized after the user has asked, in a message they typed, for this review to be published.`;
     writeStderrLine(
       `REFUSED to post to ${args.repo}#${args.pr}: ${auth.why}.
-Posting is a public, irreversible write, and this run has no authorisation for one. This is the correct outcome of a review the user did not ask to publish \u2014 report the findings in the terminal and stop. Re-run with \`--comment\`, or pass --user-authorized only after the user has asked, in a message they typed, for this review to be published.`
+Posting is a public, irreversible write, and this run has no authorisation for one. ${advice}`
     );
     writeStdoutLine(
       JSON.stringify({ posted: false, reason: auth.why }, null, 2)
@@ -24015,14 +24171,15 @@ Posting is a public, irreversible write, and this run has no authorisation for o
     comments: normalizeInlineComments(
       payload.comments ?? [],
       payload.state?.modelId,
-      cliVersion
+      cliVersion,
+      attribution
     )
   };
   let event2;
   let body;
   let cappedBy;
   try {
-    ({ event: event2, body, cappedBy } = compose(payload, cliVersion));
+    ({ event: event2, body, cappedBy } = compose(payload, cliVersion, attribution));
   } catch (err) {
     throw new Error(
       `The review state does not compose into a verdict; refusing to post:
@@ -24122,7 +24279,7 @@ var submitCommand = {
     describe: "Path to the review JSON (commit_id / comments / state). event and body are computed here from state and the comments \u2014 do not include them."
   }).option("skill-args", {
     type: "string",
-    describe: "Path to the CLI-written record of the review's invocation arguments (defaults to .qwen/tmp/qwen-skill-args-review.txt). Its `--comment` is what authorises a post. Deliberately NOT the parser's JSON output: that is a document the caller writes, and a caller that wants to post can write anything in it."
+    describe: "Path to the CLI-written record of the review's invocation arguments (defaults to .qwen/tmp/qwen-skill-args-review.txt). Its `--comment` \u2014 or the standing `review.comment` setting \u2014 is what authorises a post. Deliberately NOT the parser's JSON output: that is a document the caller writes, and a caller that wants to post can write anything in it."
   }).option("user-authorized", {
     type: "boolean",
     default: false,
@@ -24137,7 +24294,11 @@ var submitCommand = {
   }), "builder"),
   handler: /* @__PURE__ */ __name(async (argv) => {
     const cliVersion = footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion();
-    runSubmit(argv, cliVersion);
+    const review = operatorReviewSettings();
+    runSubmit(argv, cliVersion, {
+      attribution: review.attribution,
+      defaultComment: review.comment
+    });
   }, "handler")
 };
 
@@ -26314,23 +26475,14 @@ var AUDIT_BRIEF_RE = /read_file\(file_path="[^"]*reverse-audit--chunk-(\d+)--rou
 function labelOf(launch, fallback) {
   const nl = launch.indexOf("\n");
   const identity = nl === -1 ? launch : launch.slice(0, nl);
-  if (!identity.startsWith("You are review agent `")) return fallback;
+  const parsed = labelFromIdentityLine(identity);
+  if (parsed === null) return fallback;
   let auditChunk = null;
   for (const m of launch.matchAll(AUDIT_BRIEF_RE)) auditChunk = m;
   if (auditChunk) {
     return `audit chunk ${auditChunk[1]} (round ${auditChunk[2]})`;
   }
-  const role = /^You are review agent `([^`]+)`/.exec(identity);
-  if (!role) return fallback;
-  const round = /\(round (\d+)\)/.exec(identity);
-  const chunk2 = CHUNK_RE.exec(role[1]);
-  if (chunk2) return `chunk ${chunk2[1]}`;
-  if (round) {
-    return `agent ${role[1]} (round ${round[1]})`;
-  }
-  const file = /Your file: `([^`]+)`/.exec(identity);
-  if (file) return `agent ${role[1]} (${file[1]})`;
-  return `agent ${role[1]}`;
+  return parsed;
 }
 __name(labelOf, "labelOf");
 function foldEvents(id, label2, events) {
@@ -26572,7 +26724,50 @@ init_esbuild_shims();
 import { spawn, execFileSync as execFileSync6 } from "node:child_process";
 import { readdirSync as readdirSync9, readFileSync as readFileSync34, realpathSync as realpathSync6, statSync as statSync17 } from "node:fs";
 import { dirname as dirname25, join as join24, resolve as resolve26 } from "node:path";
-var COMPOSED_PATTERN = /^qwen-review-.*composed\.json$/;
+function classifyRunTarget(target) {
+  if (!target) return { kind: "local" };
+  const { target: t2 } = parseReviewArgs(target);
+  if (t2.type === "pr-number" || t2.type === "pr-url") {
+    return { kind: "pr", number: String(t2.number) };
+  }
+  if (t2.type === "file") {
+    const trimmed = t2.path.replace(/[\\/]+$/, "");
+    return { kind: "file", base: trimmed.split(/[\\/]/).pop() || trimmed };
+  }
+  return { kind: "local" };
+}
+__name(classifyRunTarget, "classifyRunTarget");
+var escapeRe = /* @__PURE__ */ __name((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "escapeRe");
+function composedNameFor(cls) {
+  switch (cls.kind) {
+    case "pr":
+      return `qwen-review-pr-${cls.number}-composed.json`;
+    case "file":
+      return `qwen-review-${cls.base}-composed.json`;
+    case "local":
+    default:
+      return "qwen-review-local-composed.json";
+  }
+}
+__name(composedNameFor, "composedNameFor");
+function composedPatternFor(cls) {
+  return new RegExp(`^${escapeRe(composedNameFor(cls))}$`);
+}
+__name(composedPatternFor, "composedPatternFor");
+function reportPatternFor(cls) {
+  switch (cls.kind) {
+    case "pr":
+      return new RegExp(`-pr-${cls.number}\\.md$`);
+    case "file":
+      return new RegExp(
+        cls.base.toLowerCase().endsWith(".md") ? `-${escapeRe(cls.base)}$` : `-${escapeRe(cls.base)}\\.md$`
+      );
+    case "local":
+    default:
+      return /^(?!.*-pr-\d+\.md$).*\.md$/;
+  }
+}
+__name(reportPatternFor, "reportPatternFor");
 var COMPOSED_POLL_MS = 250;
 var SIGNAL_EXIT_CODES = {
   SIGHUP: 129,
@@ -26582,8 +26777,12 @@ var SIGNAL_EXIT_CODES = {
 var PARENT_SIGNALS = Object.keys(SIGNAL_EXIT_CODES);
 function buildReviewPrompt(args) {
   const parts = ["/review"];
-  if (args.target) {
-    if (/\s/.test(args.target) || args.target.startsWith("-") || /['"]/.test(args.target)) {
+  if (args.target !== void 0) {
+    if (args.target.trim() === "" || /\s/.test(args.target) || args.target.startsWith("-") || /['"]/.test(args.target) || // A separators-only path (`/`, `//`, `\`) names no file: it survives
+    // basename extraction as the empty string, which pins the unmatchable
+    // `qwen-review--composed.json` and burns a whole child review before
+    // reporting "no composed verdict". Refuse it here instead.
+    /^[\\/]+$/.test(args.target)) {
       throw new Error(
         `Invalid review target ${JSON.stringify(args.target)}: expected a single PR number, PR URL, or file path`
       );
@@ -26615,7 +26814,7 @@ function newestArtifactSince(dir, pattern, startMs) {
     if (mtime < startMs) continue;
     if (!best || mtime > best.mtime) best = { path: path3, mtime };
   }
-  return best ? best.path : null;
+  return best;
 }
 __name(newestArtifactSince, "newestArtifactSince");
 function exitCodeFor(completed, event2, failOn) {
@@ -26705,20 +26904,19 @@ async function runReview(args) {
     child.stdout?.resume();
     child.stderr?.resume();
   }
+  const targetClass = classifyRunTarget(args.target);
+  const composedPattern = composedPatternFor(targetClass);
   let capturedPath = null;
   let capturedVerdict = null;
+  let capturedMtime = -Infinity;
   const captureTimer = setInterval(() => {
-    if (capturedVerdict !== null) return;
-    const path3 = newestArtifactSince(
-      REVIEW_TMP_DIR,
-      COMPOSED_PATTERN,
-      cutoffMs
-    );
-    if (path3 === null) return;
-    const verdict = readComposed(path3);
+    const best = newestArtifactSince(REVIEW_TMP_DIR, composedPattern, cutoffMs);
+    if (best === null || best.mtime <= capturedMtime) return;
+    const verdict = readComposed(best.path);
     if (verdict !== null) {
-      capturedPath = path3;
+      capturedPath = best.path;
       capturedVerdict = verdict;
+      capturedMtime = best.mtime;
     }
   }, COMPOSED_POLL_MS);
   let timedOut = false;
@@ -26761,14 +26959,11 @@ async function runReview(args) {
   let composedPath = capturedPath;
   let composed = capturedVerdict;
   if (composed === null) {
-    composedPath = newestArtifactSince(
-      REVIEW_TMP_DIR,
-      COMPOSED_PATTERN,
-      cutoffMs
-    );
+    const best = newestArtifactSince(REVIEW_TMP_DIR, composedPattern, cutoffMs);
+    composedPath = best?.path ?? null;
     composed = composedPath ? readComposed(composedPath) : null;
   }
-  const reportPath = newestArtifactSince(REVIEWS_DIR, /\.md$/, cutoffMs);
+  const reportPath = newestArtifactSince(REVIEWS_DIR, reportPatternFor(targetClass), cutoffMs)?.path ?? null;
   const completed = composed !== null;
   const result = {
     completed,
@@ -26780,6 +26975,7 @@ async function runReview(args) {
     downgradedFrom: composed?.downgradedFrom ?? null,
     remediation: composed?.remediation ?? [],
     composedPath: composedPath ? resolve26(composedPath) : null,
+    expectedComposedName: composedNameFor(targetClass),
     reportPath: reportPath ? resolve26(reportPath) : null,
     childExitCode,
     childSignal,
@@ -26794,7 +26990,10 @@ async function runReview(args) {
       writeStdoutLine(result.verdictLine ?? `Event: ${result.event}`);
       if (result.reportPath) writeStdoutLine(`Report: ${result.reportPath}`);
     } else {
-      const detail = composedPath !== null ? `a composed verdict was found at ${resolve26(composedPath)} but could not be parsed` : "no composed verdict was produced";
+      const detail = composedPath !== null ? `a composed verdict was found at ${resolve26(composedPath)} but could not be parsed` : `no composed verdict was produced (expected ${join24(
+        REVIEW_TMP_DIR,
+        composedNameFor(targetClass)
+      )})`;
       writeStdoutLine(
         timedOut ? "Review did not complete: timed out." : `Review did not complete: ${detail}${childExitCode !== null ? ` (CLI exit ${childExitCode})` : ""}${childSignal !== null ? ` (killed by ${childSignal})` : ""}.`
       );
@@ -27361,10 +27560,10 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-GUJ3TN2J.js"),
-      import("./updateCheck-YAKM36WQ.js"),
-      import("./installationInfo-4OA6UW7V.js"),
-      import("./standalone-update-MJ722XZ4.js"),
+      import("./settings-CSYVIP2R.js"),
+      import("./updateCheck-QJI2SYWF.js"),
+      import("./installationInfo-P7OTIR4P.js"),
+      import("./standalone-update-RB2EGUSF.js"),
       import("./stdioHelpers-7A2EE64Z.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
@@ -28439,6 +28638,9 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
   const screenReader = argv.screenReader !== void 0 ? argv.screenReader : settings.ui?.accessibility?.screenReader ?? false;
   let sessionId;
   let sessionData;
+  let sessionRestoreProjection;
+  const sessionRestoreProjectionSource = hostPolicy?.sessionRestore?.projectionSource;
+  let deferProjectionUntilWriterLease = false;
   if (argv.continue || argv.resume) {
     const sessionService = new SessionService(cwd);
     if (argv.continue) {
@@ -28454,8 +28656,19 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     }
     if (argv.resume) {
       sessionId = argv.resume;
-      sessionData = await sessionService.loadSession(argv.resume);
-      if (!sessionData) {
+      deferProjectionUntilWriterLease = sessionRestoreProjectionSource !== void 0 && (argv.chatRecording ?? settings.general?.chatRecording ?? true) && isAcpMode === true && settings.experimental?.sessionWriterLease === true;
+      if (sessionRestoreProjectionSource) {
+        if (!deferProjectionUntilWriterLease && !argv.forkSession) {
+          addDaemonRequestAttribute(
+            "qwen-code.daemon.session_restore.projection_acquisition",
+            "preloaded"
+          );
+          sessionRestoreProjection = await sessionRestoreProjectionSource(sessionId);
+        }
+      } else {
+        sessionData = await sessionService.loadSession(argv.resume);
+      }
+      if (!sessionRestoreProjectionSource && !sessionData) {
         const message = `No saved session found with ID ${argv.resume}. Run \`qwen --resume\` without an ID to choose from existing sessions.`;
         writeStderrLine(message);
         process.exit(1);
@@ -28473,10 +28686,21 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
         process.exit(1);
       }
       sessionId = forkedSessionId;
-      sessionData = await sessionService.loadSession(forkedSessionId);
-      if (!sessionData) {
-        writeStderrLine(`Failed to load forked session ${forkedSessionId}.`);
-        process.exit(1);
+      if (sessionRestoreProjectionSource) {
+        sessionData = void 0;
+        if (!deferProjectionUntilWriterLease) {
+          addDaemonRequestAttribute(
+            "qwen-code.daemon.session_restore.projection_acquisition",
+            "preloaded"
+          );
+          sessionRestoreProjection = await sessionRestoreProjectionSource(forkedSessionId);
+        }
+      } else {
+        sessionData = await sessionService.loadSession(forkedSessionId);
+        if (!sessionData) {
+          writeStderrLine(`Failed to load forked session ${forkedSessionId}.`);
+          process.exit(1);
+        }
       }
     }
   } else if (argv.sandboxSessionId) {
@@ -28502,6 +28726,8 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
   }
   const modelProvidersConfig = settings.modelProviders;
   const providerProtocolConfig = settings.providerProtocol;
+  const restoreSessionId = sessionId;
+  const boundSessionRestoreProjectionSource = sessionRestoreProjectionSource && restoreSessionId ? () => sessionRestoreProjectionSource(restoreSessionId) : void 0;
   const cliMcpServers = parseMcpConfig(argv.mcpConfig);
   const topTierMcpServers = sessionMcpServers || cliMcpServers ? { ...sessionMcpServers, ...cliMcpServers ?? {} } : void 0;
   const mcpServers = bareMode || safeMode ? { ...topTierMcpServers } : assembleMcpServers(settings.mcpServers, cwd, topTierMcpServers);
@@ -28509,6 +28735,8 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
   const configParams = {
     sessionId,
     sessionData,
+    sessionRestoreProjection,
+    sessionRestoreProjectionSource: boundSessionRestoreProjectionSource,
     embeddingModel: DEFAULT_QWEN_EMBEDDING_MODEL,
     sandbox: sandboxConfig,
     targetDir: cwd,
@@ -28526,7 +28754,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     disabledSlashCommands: disabledSlashCommands.length > 0 ? disabledSlashCommands : void 0,
     disabledSkillNamesProvider: bareMode || safeMode ? void 0 : disabledSkillNamesProvider,
     terminalImageRenderSupportProvider: interactive ? async () => {
-      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-BCUN3Z3W.js");
+      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-BTRE2GEU.js");
       return getTerminalImageRenderSupport();
     } : void 0,
     disabledSkillLevels: bareMode || safeMode || !Array.isArray(settings.skills?.disabledLevels) ? void 0 : settings.skills.disabledLevels.filter(isSkillLevel),