@qwen-code/qwen-code 0.21.12-preview.4 → 0.21.12

package/chunks/{acpAgent-7YC6SNIS.js → acpAgent-7JOAESF5.js}

@@ -1,14 +1,9 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
-  recomputeMcpGating
-} from "./chunk-OIZWCOYC.js";
-import {
-  classifyApiError
-} from "./chunk-V7RNNPGC.js";
-import {
+  classifyApiError,
   fireSessionDeleteHook
-} from "./chunk-L34XSHIZ.js";
+} from "./chunk-P5Y23G2L.js";
 import {
   EXTENSION_CONTEXT_BUDGET,
   buildExtensionMentionContext,
@@ -18,17 +13,17 @@ import {
   matchMcpServerByRef,
   parseExtensionRef,
   parseMcpServerRef
-} from "./chunk-JGD35ZSJ.js";
-import "./chunk-WLML6VIA.js";
+} from "./chunk-X5SLJOMF.js";
 import {
   getAvailableCommands,
   handleSlashCommand,
   insertAfterFunctionResponses,
+  isSlashCommand,
   normalizePartList
-} from "./chunk-MUN34TTF.js";
+} from "./chunk-QSD4UH74.js";
 import {
-  isSlashCommand
-} from "./chunk-DUFZ3OW6.js";
+  recomputeMcpGating
+} from "./chunk-CIDQISGM.js";
 import {
   SessionIdConflictError,
   appEvents,
@@ -36,43 +31,44 @@ import {
   cleanupReviewWorktreeLeases,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-CTEGMF77.js";
+} from "./chunk-IX4PWUDU.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-VRQD5D7R.js";
+} from "./chunk-4XA4QIUA.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-QXFAQDBV.js";
+} from "./chunk-MDNUCDKZ.js";
+import "./chunk-3SH53ANB.js";
 import "./chunk-NYX53SV4.js";
-import "./chunk-UPUAGRKY.js";
+import "./chunk-NW2GIPG3.js";
 import {
   collectContextData,
   formatContextUsageText
-} from "./chunk-TB6DPBE4.js";
+} from "./chunk-62X3CM7Q.js";
 import "./chunk-4WGODMVR.js";
 import {
   isGoalStatusKind
 } from "./chunk-EKTCKZV5.js";
-import "./chunk-6LDLDK6E.js";
+import "./chunk-OYWVIXHT.js";
 import {
   startNonInteractiveOpenAILogHousekeeping
-} from "./chunk-KB4ISUT3.js";
+} from "./chunk-5AFGJNY6.js";
 import "./chunk-KW7NOTN6.js";
-import "./chunk-LIBTBTHP.js";
-import "./chunk-6T5HCY34.js";
-import "./chunk-L3YACXS2.js";
+import "./chunk-ZQUY3ZJU.js";
+import "./chunk-RDVNSJQU.js";
+import "./chunk-OPVF453Q.js";
 import "./chunk-YAF2MQZ6.js";
 import {
   computeCpuPercent
 } from "./chunk-LBOVL47Y.js";
-import "./chunk-SFBRH5RY.js";
+import "./chunk-TDESMS7M.js";
 import "./chunk-6H67XLET.js";
 import {
   beginAcpBootstrapConfigProfiling,
   buildAndFreezeAcpStartupProfile,
   endAcpBootstrapConfigProfiling,
   markAcpStartup
-} from "./chunk-ZZ7RUTJ4.js";
+} from "./chunk-FMIH5KMQ.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   GENERATION_TIMEOUT_MS,
@@ -95,8 +91,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-UWIJU22K.js";
-import "./chunk-ZBBVBZBR.js";
+} from "./chunk-CZ4OWGQQ.js";
 import {
   BaseEmitter,
   HistoryReplayer,
@@ -105,10 +100,10 @@ import {
   createTranscriptMessageUpdate,
   createTranscriptUsageUpdate,
   hasFullSessionContext
-} from "./chunk-APQTLUZ3.js";
-import "./chunk-EGB2PIYM.js";
+} from "./chunk-UI5UGEF4.js";
+import "./chunk-TMFWI4RC.js";
 import "./chunk-4NFY2S7N.js";
-import "./chunk-FNVF5RR4.js";
+import "./chunk-V6OBVAST.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-3Z43GZUQ.js";
@@ -126,26 +121,18 @@ import {
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-Y2EOB7WZ.js";
+} from "./chunk-YX2RDGAL.js";
 import {
   MAX_AUDIO_BYTES,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-Y2HK3ELT.js";
+} from "./chunk-LCX5B364.js";
 import {
   readVoiceModel
-} from "./chunk-BGIKUE5J.js";
-import "./chunk-5KZNWF2M.js";
+} from "./chunk-VIFA5VJD.js";
+import "./chunk-H7TMVHKE.js";
 import "./chunk-NTTBXH7U.js";
-import "./chunk-WIHSDI6U.js";
-import "./chunk-3SH53ANB.js";
-import {
-  SESSION_SOURCE_META_KEY,
-  parseSessionSource
-} from "./chunk-A2QIWDFO.js";
-import "./chunk-JVY7FHUZ.js";
-import "./chunk-WCCLLK7X.js";
-import "./chunk-OCPBI7J5.js";
+import "./chunk-RQJA2YYO.js";
 import {
   ACP_ROUTE_ID_PREFIX,
   buildAcpModelOptions,
@@ -154,26 +141,32 @@ import {
   parseAcpModelOption,
   resolveAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-3JI5D6RU.js";
+} from "./chunk-ROIJYS5K.js";
 import {
   mapSkillConfigToStatus
 } from "./chunk-BGXZBI5B.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
-import "./chunk-N56NYJWY.js";
-import "./chunk-N3J3CO35.js";
+import "./chunk-WM3LUQLO.js";
+import "./chunk-IH4Z54RJ.js";
 import "./chunk-57OAHC2Y.js";
-import "./chunk-VUTOV2HG.js";
-import "./chunk-XY7DGTIC.js";
-import "./chunk-TN3REXN4.js";
-import "./chunk-V6WHFGST.js";
+import "./chunk-BSR5AXZR.js";
+import "./chunk-45NQKMYB.js";
+import "./chunk-OK47XBYH.js";
 import {
   createLoadedSettingsAdapter
-} from "./chunk-QSMZHJ62.js";
+} from "./chunk-2IVYL3IF.js";
+import {
+  SESSION_SOURCE_META_KEY,
+  parseSessionSource
+} from "./chunk-6P5EXEBL.js";
+import "./chunk-7U5G6JXI.js";
+import "./chunk-WCCLLK7X.js";
+import "./chunk-OCPBI7J5.js";
 import {
   ndJsonStream
-} from "./chunk-2U3UCXZ3.js";
+} from "./chunk-DAV4QFD5.js";
 import {
   ACP_PREFLIGHT_KINDS,
   IDLE_HOOK_EVENTS,
@@ -181,14 +174,15 @@ import {
   SERVE_STATUS_EXT_METHODS,
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-NHZF4VCD.js";
-import "./chunk-U7ROFHSH.js";
-import "./chunk-QSDPJROT.js";
+} from "./chunk-HTYND72J.js";
+import "./chunk-ZLCT4C5A.js";
+import "./chunk-V6WHFGST.js";
 import {
   ACTIVE_WORK_CLOSE_IF_UNHELD_PARAM,
   ACTIVE_WORK_HEARTBEAT_META_KEY,
   ACTIVE_WORK_HEARTBEAT_VERSION,
   ACTIVE_WORK_HOLD_CATEGORIES,
+  ACTIVE_WORK_LEGACY_HOLD_CATEGORIES,
   ACTIVE_WORK_NOTIFICATION_METHOD,
   CHANNEL_STARTUP_PROFILE_META_KEY,
   CHANNEL_STARTUP_PROFILE_VERSION,
@@ -212,7 +206,7 @@ import {
   WORKTREE_MCP_DEFER_META_KEY,
   clampActiveWorkIntervalMs,
   isValidTrustedModelPrompt
-} from "./chunk-UFHPAMAV.js";
+} from "./chunk-FQDCO3CJ.js";
 import {
   NOT_CURRENTLY_GENERATING_CANCEL_MESSAGE,
   isNotCurrentlyGeneratingCancelError
@@ -220,7 +214,7 @@ import {
 import "./chunk-6PLDPT2C.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-YP5KH5Y7.js";
-import "./chunk-JW5UEE3V.js";
+import "./chunk-A6NRNRKE.js";
 import "./chunk-ALMR3E6Q.js";
 import "./chunk-HIBNSEJE.js";
 import "./chunk-M5GB774H.js";
@@ -229,22 +223,24 @@ import {
   EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
   EXTERNAL_TOOL_GUARD_TOKEN_ENV,
   PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
+  PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV,
+  SHELL_EXECUTING_TOOL_NAMES,
   isValidExternalToolGuardDenialReason
-} from "./chunk-BKHCW2BI.js";
+} from "./chunk-3VUENPWF.js";
+import "./chunk-3AEKDXKT.js";
 import {
   ACP_EVENT_LOOP_STALL_RESTART_MS,
   CHANNEL_PROMPT_META_KEY
-} from "./chunk-ADJDLEVO.js";
+} from "./chunk-AW27A43Y.js";
 import {
   AgentSideConnection,
   PROTOCOL_VERSION,
   RequestError
 } from "./chunk-IW6RQPQB.js";
-import "./chunk-7JL5YBSA.js";
 import {
   assembleMcpServers,
   loadMcpApprovals
-} from "./chunk-PYLVQ6RT.js";
+} from "./chunk-3LDGOQXZ.js";
 import {
   getOutputLanguageFilePath,
   getPersistScopeForModelSelection,
@@ -253,9 +249,9 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-H2U4FK62.js";
+} from "./chunk-3GDBZJD6.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-4X5J3V2I.js";
+import "./chunk-FA5K6YI2.js";
 import "./chunk-GOXKNSDZ.js";
 import {
   getSystemDefaultsPath,
@@ -264,7 +260,7 @@ import {
 import {
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-JXS2JNMZ.js";
+} from "./chunk-IRSLAS4M.js";
 import {
   SUPPORTED_LANGUAGES
 } from "./chunk-5EJZE3FP.js";
@@ -272,17 +268,18 @@ import {
   findEnvFiles,
   preResolveHomeEnvOverrides,
   reloadEnvironment
-} from "./chunk-FXWGMPAP.js";
+} from "./chunk-XH3KAV2G.js";
 import {
   ENV_ACP_REPEATED_TOOL_FAILURE_GUARD
 } from "./chunk-MS7GNABG.js";
-import "./chunk-V2U6FOJB.js";
+import "./chunk-7KJPO7YH.js";
+import "./chunk-OWXFBIB6.js";
 import "./chunk-WZMH7II3.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-ZA2JN5IZ.js";
+} from "./chunk-ZMY2P4L3.js";
 import "./chunk-NPQ5ZKRP.js";
 import "./chunk-MR3PXB6E.js";
 import "./chunk-XFSFZCM5.js";
@@ -395,7 +392,6 @@ import {
   readManyFiles,
   recordAllow,
   recordFallbackApprove,
-  redactUrlCredentials,
   refreshMemoryAfterManagedWrite,
   refreshMemoryInstruction,
   resolveBaseUrl,
@@ -414,25 +410,25 @@ import {
   updateSetting,
   validatePlanModeShellApproval,
   validatePlanModeShellContext
-} from "./chunk-GHOUZ5X4.js";
+} from "./chunk-EBPLKY6U.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import {
   external_exports
 } from "./chunk-CQ35AJ4Z.js";
-import "./chunk-NM33GGOM.js";
-import "./chunk-A4BAHMJF.js";
-import "./chunk-ZPZANKVP.js";
-import "./chunk-A6GQUQ7I.js";
+import "./chunk-QPBFRWCP.js";
+import "./chunk-JRIVMPD2.js";
+import "./chunk-YILJKX2T.js";
+import "./chunk-D2RNVVH6.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
-import "./chunk-JBZYGFIB.js";
+import "./chunk-I7BT2MME.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-AAZWJAPQ.js";
-import "./chunk-7WUMS2UA.js";
+import "./chunk-AKBFSOC5.js";
+import "./chunk-DEDESZDL.js";
 import {
   promptIdContext,
   todoWorkChainContext
@@ -440,17 +436,14 @@ import {
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import {
-  APPROVAL_MODES
-} from "./chunk-SNHBRO4C.js";
-import "./chunk-KTWUFHS4.js";
+import "./chunk-5RUCD4ED.js";
 import "./chunk-KRXPRVGL.js";
 import {
   HookEventName,
   createHookOutput
-} from "./chunk-2ASWIM4A.js";
-import "./chunk-67F2BEYW.js";
-import "./chunk-TNETSI2A.js";
+} from "./chunk-YBVVOSOH.js";
+import "./chunk-CPFFU46D.js";
+import "./chunk-ULNWG62W.js";
 import {
   GoalPersistenceUnavailableError,
   emptyGoalSnapshot,
@@ -458,9 +451,14 @@ import {
   parseGoalSnapshotV2,
   parseGoalStateCause,
   wrapUserPromptSubmitContext
-} from "./chunk-B66LYK4B.js";
-import "./chunk-VPZMLGD3.js";
+} from "./chunk-DPTMKFIH.js";
 import {
+  APPROVAL_MODES
+} from "./chunk-63FNZTWG.js";
+import "./chunk-3GM5DLBI.js";
+import {
+  AgentOutputMessageCapture,
+  addAgentInputMessageAttributes,
   addDaemonRequestAttribute,
   addToolArgumentsAttributes,
   addToolCallResultAttributes,
@@ -468,14 +466,43 @@ import {
   registerAcpEventLoopLagGauge,
   startEventLoopLagMonitor,
   withDaemonSpan
-} from "./chunk-U5C2GIN2.js";
+} from "./chunk-K34GJQOZ.js";
 import "./chunk-SAH4BD2J.js";
-import "./chunk-2RTRFLWH.js";
+import "./chunk-KLOMACIR.js";
 import {
   runWithRuntimeContentGenerator
-} from "./chunk-SKRHR6N2.js";
+} from "./chunk-VPV7WBVT.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-2J3OJGTL.js";
+import {
+  FORK_SUBAGENT_TYPE,
+  getStartupContextLength,
+  isSystemReminderContent
+} from "./chunk-TTRH3RTQ.js";
+import "./chunk-K623ENWT.js";
+import "./chunk-AQ37AY7B.js";
+import "./chunk-FRHQQC2Z.js";
+import {
+  clearCachedCredentialFile,
+  qwenOAuth2Events
+} from "./chunk-DG4IQ6JG.js";
+import "./chunk-NAVJD2PQ.js";
+import "./chunk-KEC5FHLM.js";
+import "./chunk-2ZWH53I4.js";
+import "./chunk-P3QQPMQA.js";
+import "./chunk-TB4YFWXG.js";
+import "./chunk-D7QGE3RT.js";
+import {
+  REASONING_EFFORT_TIERS,
+  applyReasoningEffort
+} from "./chunk-KM73TBQ4.js";
+import "./chunk-MPHPFVKK.js";
+import "./chunk-AXMWHKXA.js";
+import {
+  getToolCallPreparations
+} from "./chunk-GLCZKT5V.js";
+import "./chunk-DJ2GSRLV.js";
+import "./chunk-NLFLYSS4.js";
 import {
   ConversationFinishedEvent,
   DiscoveredMCPTool,
@@ -508,26 +535,17 @@ import {
   shouldRunVisionBridge,
   splitImageParts,
   uiTelemetryService
-} from "./chunk-UAAWNTOC.js";
+} from "./chunk-4KM2SYK5.js";
 import "./chunk-YRLW2MSX.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   getAutoMemoryRoot,
   getUserAutoMemoryRoot
-} from "./chunk-6OJDN5ZT.js";
+} from "./chunk-G6MUFRNI.js";
 import {
   runSideQuery
-} from "./chunk-JRTJEGSP.js";
-import "./chunk-O6SLWH4X.js";
-import "./chunk-C2DR57L6.js";
-import {
-  FORK_SUBAGENT_TYPE,
-  getStartupContextLength,
-  isSystemReminderContent
-} from "./chunk-TROB4PZY.js";
-import "./chunk-K623ENWT.js";
-import "./chunk-AQ37AY7B.js";
-import "./chunk-UHF5VBKO.js";
+} from "./chunk-LSRI3ND3.js";
+import "./chunk-PVXEJB66.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
@@ -535,49 +553,31 @@ import {
   ToolNames,
   canonicalToolName,
   isShellProgressData
-} from "./chunk-ZRT36RSF.js";
-import {
-  clearCachedCredentialFile,
-  qwenOAuth2Events
-} from "./chunk-CDDLHCC2.js";
-import "./chunk-NAVJD2PQ.js";
-import "./chunk-YI5G32RU.js";
-import "./chunk-QEWAHAW2.js";
-import "./chunk-P3QQPMQA.js";
-import "./chunk-FTGU6G45.js";
-import "./chunk-PSTHNTHF.js";
+} from "./chunk-YIGGWOJE.js";
 import {
   AuthType,
   preloadContentGenerator
-} from "./chunk-XJ6IMYUS.js";
+} from "./chunk-KWX56CHZ.js";
 import "./chunk-F6WFNA7U.js";
-import "./chunk-NW7SPXVG.js";
-import {
-  REASONING_EFFORT_TIERS,
-  applyReasoningEffort
-} from "./chunk-KM73TBQ4.js";
-import "./chunk-MPHPFVKK.js";
-import "./chunk-AXMWHKXA.js";
-import {
-  getToolCallPreparations
-} from "./chunk-GLCZKT5V.js";
-import "./chunk-KK3FEHPJ.js";
 import "./chunk-46UV252V.js";
 import {
   DEFAULT_TOKEN_LIMIT,
   tokenLimit
 } from "./chunk-FPGTNKCP.js";
-import "./chunk-DJ2GSRLV.js";
-import "./chunk-H6BFLALJ.js";
+import "./chunk-4AOVQPJU.js";
+import "./chunk-PZW46OTB.js";
+import "./chunk-YBHUXEC6.js";
 import {
   endToolExecutionSpan,
   endToolSpan,
+  getActiveInteractionSpan,
   initializeTelemetry,
+  redactUrlCredentials,
   runInToolSpanContext,
   startToolExecutionSpan,
   startToolSpan,
   withInteractionSpan
-} from "./chunk-3MJ44LNC.js";
+} from "./chunk-N4SVADAV.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   sessionIdContext
@@ -588,12 +588,12 @@ import {
   getErrorMessage,
   getErrorStatus,
   isSubpath
-} from "./chunk-YMB77M76.js";
+} from "./chunk-HOSVOUDK.js";
 import "./chunk-VOQXFAY5.js";
-import "./chunk-BXAGPCYH.js";
+import "./chunk-MELQSJOU.js";
 import {
   runExitCleanup
-} from "./chunk-NX5QZVRS.js";
+} from "./chunk-OR64CU46.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -3136,6 +3136,7 @@ var DAEMON_INVALID_TOOL_PARAMS_THRESHOLD = 3;
 var PERMISSION_CANCEL_SKIP_MESSAGE = "Skipped because a permission request was cancelled before the user answered; user input is required before continuing.";
 var LOOP_DETECTED_SKIP_MESSAGE = "Skipped because loop detection stopped the current turn before this tool call could run.";
 var LOOP_DETECTED_CONTEXT_MESSAGE = "System: this turn was terminated because the model exceeded tool-call safety limits. Try a different approach on the next turn.";
+var LOOP_DETECTED_TURN_ERROR_MESSAGE = "Tool-call loop protection stopped this turn. The session is still available; send a more specific instruction to continue.";
 var TOOL_EXECUTION_CANCELLED_MESSAGE = "Tool execution was cancelled.";
 var TOOL_POST_EXECUTION_CANCELLED_MESSAGE = "The tool had already completed; its output was discarded.";
 function createDaemonToolLoopState(repeatedToolFailureMode) {
@@ -3204,6 +3205,7 @@ __name(recordRepeatedToolFailureDecision, "recordRepeatedToolFailureDecision");
 function recordDaemonLoopDetected(config, promptId, loopType, message, loopState, options = {}) {
   if (!loopState.loopDetected) {
     loopState.loopDetected = true;
+    loopState.loopType = loopType;
     debugLogger6.warn(message);
     try {
       logLoopDetected(
@@ -3221,6 +3223,25 @@ function recordDaemonLoopDetected(config, promptId, loopType, message, loopState
   return true;
 }
 __name(recordDaemonLoopDetected, "recordDaemonLoopDetected");
+function createLoopDetectedTurnError(loopState) {
+  return new RequestError(-32603, LOOP_DETECTED_TURN_ERROR_MESSAGE, {
+    code: "LOOP_DETECTED",
+    errorKind: "loop_detected",
+    ...loopState.loopType ? { loopType: loopState.loopType } : {}
+  });
+}
+__name(createLoopDetectedTurnError, "createLoopDetectedTurnError");
+function cancelledOrThrowLoopDetected(signal, loopState) {
+  if (signal.aborted) return "cancelled";
+  throw createLoopDetectedTurnError(loopState);
+}
+__name(cancelledOrThrowLoopDetected, "cancelledOrThrowLoopDetected");
+function isLoopDetectedTurnError(error) {
+  if (!(error instanceof RequestError)) return false;
+  const data = error.data;
+  return typeof data === "object" && data !== null && data.code === "LOOP_DETECTED";
+}
+__name(isLoopDetectedTurnError, "isLoopDetectedTurnError");
 function recordDaemonToolCalls(config, promptId, loopState, calls) {
   if (!loopState || loopState.loopDetected)
     return loopState?.loopDetected ?? false;
@@ -3484,14 +3505,16 @@ var TodoStopGuardClaimTimeoutError = class extends Error {
   }
 };
 function beginChannelDeliveryResponseBlock(capture) {
-  if (!capture) return void 0;
-  capture.finalText = "";
+  capture?.agentOutput.beginResponse();
+  if (!capture?.channelDelivery) return void 0;
+  capture.channelDelivery.finalText = "";
   return [];
 }
 __name(beginChannelDeliveryResponseBlock, "beginChannelDeliveryResponseBlock");
 function commitChannelDeliveryResponseBlock(capture, responseBlock, hasFunctionCalls) {
-  if (capture && responseBlock && !hasFunctionCalls) {
-    capture.finalText = responseBlock.join("");
+  capture?.agentOutput.commitResponse(hasFunctionCalls);
+  if (capture?.channelDelivery && responseBlock && !hasFunctionCalls) {
+    capture.channelDelivery.finalText = responseBlock.join("");
   }
 }
 __name(commitChannelDeliveryResponseBlock, "commitChannelDeliveryResponseBlock");
@@ -3784,6 +3807,7 @@ var Session = class {
   notificationAbortController = null;
   notificationCompletion = null;
   currentAgentNotificationTaskId = null;
+  currentShellNotificationActive = false;
   persistedBackgroundNotificationTaskIds = /* @__PURE__ */ new Set();
   backgroundNotificationAcceptances = /* @__PURE__ */ new Map();
   activeAgentNotificationAcceptances = /* @__PURE__ */ new Set();
@@ -3811,6 +3835,7 @@ var Session = class {
   /** The exact status-change callback this Session installed, so dispose can
    *  retract its own and nobody else's. */
   #statusChangeCallback;
+  #shellStatusChangeCallback;
   workflowApprovalAbortController = new AbortController();
   activeTodoPlanRevision;
   // Modular components
@@ -4779,6 +4804,10 @@ var Session = class {
     for (const taskId of notificationIds) {
       holds.push({ category: "notification", id: taskId });
     }
+    const shellActive = this.config.getBackgroundShellRegistry().hasRunningEntries() || this.notificationQueue.some((item) => item.kind === "shell") || this.currentShellNotificationActive;
+    if (shellActive) {
+      holds.push({ category: "shell", id: "background-shells" });
+    }
     return holds;
   }
   #activeWorkChanged() {
@@ -4906,7 +4935,12 @@ var Session = class {
       this.#statusChangeCallback = void 0;
     }
     this.config.getMonitorRegistry().setNotificationCallback(void 0);
-    this.config.getBackgroundShellRegistry().setNotificationCallback(void 0);
+    const shellRegistry = this.config.getBackgroundShellRegistry();
+    shellRegistry.setNotificationCallback(void 0);
+    if (this.#shellStatusChangeCallback) {
+      shellRegistry.clearStatusChangeCallback(this.#shellStatusChangeCallback);
+      this.#shellStatusChangeCallback = void 0;
+    }
     this.config.getChatRecordingService()?.setTitleRecordedCallback(void 0);
     this.unsubscribeChatRecordingFailure?.();
     this.unsubscribeChatRecordingFailure = void 0;
@@ -5277,21 +5311,37 @@ var Session = class {
     }
     this.duplicateProviderToolCallResponseIds.clear();
     const channelDelivery = parsePromptChannelDelivery(params);
-    const channelDeliveryCapture = channelDelivery ? { finalText: "" } : void 0;
+    const responseCapture = {
+      ...channelDelivery ? { channelDelivery: { finalText: "" } } : {},
+      agentOutput: new AgentOutputMessageCapture(this.config)
+    };
+    const channelPromptTurn = params._meta?.[CHANNEL_PROMPT_META_KEY] === true;
     let resolveCompletion;
     this.pendingPromptCompletion = new Promise((resolve6) => {
       resolveCompletion = resolve6;
     });
+    let rejectedByLoopProtection = false;
     let promptResult;
     let promptFailed = false;
     try {
       const result = await this.#executePrompt(
         params,
         pendingSend,
-        channelDeliveryCapture,
+        responseCapture,
         invocationContext,
         modelPrompt,
-        goalTurn
+        // Channel turns are non-interactive deliveries: like cron,
+        // background-notification, and goal turns they keep the graceful
+        // end-turn handling so the collected response text is still
+        // delivered. Only the authenticated CHANNEL_PROMPT_META_KEY turns
+        // sent by the channel bridges qualify; the delivery meta alone
+        // schedules the delivery but keeps the foreground rejection. Goal
+        // turns bypass the bridge entirely, so a rejection there would
+        // settle the turn as failed and pause the goal without any
+        // turn_error ever being published.
+        !channelPromptTurn && goalTurn === void 0,
+        goalTurn,
+        channelPromptTurn
       );
       promptResult = result;
       releasePendingSend();
@@ -5305,7 +5355,7 @@ var Session = class {
           source: "prompt",
           target: channelDelivery.target,
           text: normalizeChannelDeliveryText(
-            channelDeliveryCapture?.finalText ?? ""
+            responseCapture.channelDelivery?.finalText ?? ""
           ),
           promptId: channelDelivery.deliveryId
         });
@@ -5318,11 +5368,17 @@ var Session = class {
           errorKind: error.errorKind
         });
       }
+      rejectedByLoopProtection = isLoopDetectedTurnError(error);
       throw error;
     } finally {
       const stillOwnsPendingPrompt = this.pendingPrompt === pendingSend;
       releasePendingSend();
-      const shouldDrainAutomaticQueues = todoStopGuardPreparation.drainSupersededAutomaticQueues || this.todoStopGuardDrainAutomaticQueuesWhenIdle || this.todoStopGuard.blocksUnrelatedAutomaticTurns || this.todoStopGuard.hasCommittedContinuation || this.todoStopGuardQueuedPromptPriority;
+      const shouldDrainAutomaticQueues = (
+        // Loop-detected turns resolved end_turn (and drained) before loop
+        // stops became rejections; keep that invariant on the new path so
+        // queued cron/notification work is not stranded.
+        rejectedByLoopProtection || todoStopGuardPreparation.drainSupersededAutomaticQueues || this.todoStopGuardDrainAutomaticQueuesWhenIdle || this.todoStopGuard.blocksUnrelatedAutomaticTurns || this.todoStopGuard.hasCommittedContinuation || this.todoStopGuardQueuedPromptPriority
+      );
       if (stillOwnsPendingPrompt) {
         this.todoStopGuardDrainAutomaticQueuesWhenIdle = false;
       }
@@ -5460,7 +5516,7 @@ var Session = class {
       }
     })();
   }
-  async #executePrompt(params, pendingSend, channelDeliveryCapture, invocationContext, modelPrompt, goalTurn) {
+  async #executePrompt(params, pendingSend, responseCapture, invocationContext, modelPrompt, rejectOnLoopDetected = false, goalTurn, channelTurn = false) {
     const sessionId = this.config.getSessionId();
     if (invocationContext !== void 0 && invocationContext.sessionId !== sessionId) {
       throw RequestError.invalidParams(
@@ -5475,15 +5531,17 @@ var Session = class {
         () => this.#executePromptInner(
           params,
           pendingSend,
-          channelDeliveryCapture,
+          responseCapture,
           modelPrompt,
-          goalTurn
+          rejectOnLoopDetected,
+          goalTurn,
+          channelTurn
         )
       )
     ), "execute");
     return goalTurn ? goalTurnContext.run(goalTurn.permit, execute) : goalTurnContext.exit(execute);
   }
-  async #executePromptInner(params, pendingSend, channelDeliveryCapture, modelPrompt, goalTurn) {
+  async #executePromptInner(params, pendingSend, responseCapture, modelPrompt, rejectOnLoopDetected = false, goalTurn, channelTurn = false) {
     return Storage.runWithRuntimeBaseDir(
       this.runtimeBaseDir,
       this.config.getWorkingDir(),
@@ -5521,6 +5579,16 @@ var Session = class {
             );
             const isRetry = params.retry === true || params._meta?.[DAEMON_RETRY_META_KEY] === true;
             const isContinue = params._meta?.[DAEMON_CONTINUE_META_KEY] === true;
+            if (!isRetry && !isContinue && goalTurn?.origin !== "runtime") {
+              const interactionSpan = getActiveInteractionSpan();
+              if (interactionSpan) {
+                addAgentInputMessageAttributes(
+                  this.config,
+                  interactionSpan,
+                  promptDisplayText ?? promptText
+                );
+              }
+            }
             let continuationParts = null;
             let strippedOrphanEntries = null;
             let orphanPushCountSnapshot = 0;
@@ -5719,7 +5787,7 @@ ${this.pendingRecoveredAgentsNotice}
             let nextMessage = { role: "user", parts };
             let turnCount = 0;
             const toolLoopState = createDaemonToolLoopState(
-              promptMetadata?.[CHANNEL_PROMPT_META_KEY] === true ? "off" : this.repeatedToolFailureGuardMode
+              channelTurn ? "off" : this.repeatedToolFailureGuardMode
             );
             try {
               while (nextMessage !== null) {
@@ -5739,6 +5807,7 @@ ${this.pendingRecoveredAgentsNotice}
                   pendingSend.signal
                 );
                 let channelDeliveryResponseBlock;
+                let channelDeliveryCheckpoint = 0;
                 try {
                   if (goalTurn) goalTurn.modelStarted = true;
                   const sendResult = await this.#sendMessageStreamWithAutoCompression(
@@ -5757,8 +5826,8 @@ ${this.pendingRecoveredAgentsNotice}
                   }
                   const responseStream = sendResult.responseStream;
                   nextMessage = null;
-                  channelDeliveryResponseBlock = beginChannelDeliveryResponseBlock(channelDeliveryCapture);
-                  const channelDeliveryCheckpoint = channelDeliveryResponseBlock?.length ?? 0;
+                  channelDeliveryResponseBlock = beginChannelDeliveryResponseBlock(responseCapture);
+                  channelDeliveryCheckpoint = channelDeliveryResponseBlock?.length ?? 0;
                   let streamFailed = false;
                   try {
                     for await (const resp of responseStream) {
@@ -5778,10 +5847,14 @@ ${this.pendingRecoveredAgentsNotice}
                             part.thought
                           );
                           if (!part.thought) {
+                            responseCapture.agentOutput.appendText(part.text);
                             channelDeliveryResponseBlock?.push(part.text);
                             messageDisplay?.addChunk(part.text);
                           }
                         }
+                        responseCapture.agentOutput.observeFinishReason(
+                          candidate.finishReason
+                        );
                       }
                       if (resp.type === "chunk" /* CHUNK */ && resp.value.usageMetadata) {
                         usageMetadata = resp.value.usageMetadata;
@@ -5794,6 +5867,9 @@ ${this.pendingRecoveredAgentsNotice}
                         }
                       }
                       if (resp.type === "retry" /* RETRY */ || resp.type === "model_fallback" /* MODEL_FALLBACK */) {
+                        responseCapture.agentOutput.restartAttempt(
+                          resp.type === "retry" /* RETRY */ && resp.isContinuation === true
+                        );
                         if (resp.type === "model_fallback" /* MODEL_FALLBACK */ || !resp.isContinuation) {
                           if (channelDeliveryResponseBlock) {
                             channelDeliveryResponseBlock.length = channelDeliveryCheckpoint;
@@ -5854,7 +5930,7 @@ ${this.pendingRecoveredAgentsNotice}
                   await messageDisplay?.finish();
                 }
                 commitChannelDeliveryResponseBlock(
-                  channelDeliveryCapture,
+                  responseCapture,
                   channelDeliveryResponseBlock,
                   functionCalls.length > 0
                 );
@@ -5898,14 +5974,16 @@ ${this.pendingRecoveredAgentsNotice}
                     pendingSend.signal,
                     promptId,
                     toolLoopState,
-                    onFullTurnModel
+                    onFullTurnModel,
+                    rejectOnLoopDetected
                   );
                   nextMessage = nextAfterTools.message;
                   if (nextAfterTools.stoppedByRepeatedToolFailure) {
                     return {
-                      stopReason: getAbortAwareEndTurnStopReason(
-                        pendingSend.signal
-                      )
+                      stopReason: rejectOnLoopDetected ? cancelledOrThrowLoopDetected(
+                        pendingSend.signal,
+                        toolLoopState
+                      ) : getAbortAwareEndTurnStopReason(pendingSend.signal)
                     };
                   }
                   if (toolRun.loopDetected) {
@@ -5915,9 +5993,10 @@ ${this.pendingRecoveredAgentsNotice}
                       pendingSend.signal
                     );
                     return {
-                      stopReason: getAbortAwareEndTurnStopReason(
-                        pendingSend.signal
-                      )
+                      stopReason: rejectOnLoopDetected ? cancelledOrThrowLoopDetected(
+                        pendingSend.signal,
+                        toolLoopState
+                      ) : getAbortAwareEndTurnStopReason(pendingSend.signal)
                     };
                   }
                 }
@@ -5925,15 +6004,22 @@ ${this.pendingRecoveredAgentsNotice}
               if (this.messageRewriter) {
                 await this.messageRewriter.waitForPendingRewrites();
               }
-              return await this.#handleStopHookLoop(
+              const result = await this.#handleStopHookLoop(
                 pendingSend,
                 promptId,
                 hooksEnabled,
                 messageBus,
                 true,
                 fullTurnModelOverride,
-                channelDeliveryCapture
+                responseCapture,
+                rejectOnLoopDetected
               );
+              if (result.stopReason !== "cancelled") {
+                responseCapture.agentOutput.writeToSpan(
+                  getActiveInteractionSpan()
+                );
+              }
+              return result;
             } finally {
               logConversationFinishedEvent(
                 this.config,
@@ -5954,7 +6040,7 @@ ${this.pendingRecoveredAgentsNotice}
       }
     );
   }
-  async #handleStopHookLoop(pendingSend, promptId, hooksEnabled, messageBus, allowExternalHooks = true, modelOverride, channelDeliveryCapture) {
+  async #handleStopHookLoop(pendingSend, promptId, hooksEnabled, messageBus, allowExternalHooks = true, modelOverride, responseCapture, rejectOnLoopDetected = false) {
     const stopHookBlockingCap = this.config.getStopHookBlockingCap();
     let stopHookIterationCount = 0;
     let stopHookReasons = [];
@@ -6014,7 +6100,8 @@ ${this.pendingRecoveredAgentsNotice}
             {
               onFullTurnModel,
               getModelOverride: /* @__PURE__ */ __name(() => modelOverride, "getModelOverride"),
-              channelDeliveryCapture
+              responseCapture,
+              rejectOnLoopDetected
             }
           );
           if (continuation2.kind === "terminal") {
@@ -6098,7 +6185,8 @@ ${this.pendingRecoveredAgentsNotice}
               {
                 onFullTurnModel,
                 getModelOverride: /* @__PURE__ */ __name(() => modelOverride, "getModelOverride"),
-                channelDeliveryCapture
+                responseCapture,
+                rejectOnLoopDetected
               }
             );
             if (continuation2.kind === "terminal") {
@@ -6197,7 +6285,8 @@ ${this.pendingRecoveredAgentsNotice}
           } : {},
           onFullTurnModel,
           getModelOverride: /* @__PURE__ */ __name(() => modelOverride, "getModelOverride"),
-          channelDeliveryCapture
+          responseCapture,
+          rejectOnLoopDetected
         }
       );
       if (continuation.supersededAutomaticContinuation && externalReason) {
@@ -6264,6 +6353,7 @@ ${this.pendingRecoveredAgentsNotice}
         pendingSend.signal
       );
       let channelDeliveryResponseBlock;
+      let channelDeliveryCheckpoint = 0;
       let providerSendChat;
       let userContentPushCountBeforeSend = 0;
       try {
@@ -6494,9 +6584,9 @@ ${this.pendingRecoveredAgentsNotice}
         const responseStream = sendResult.responseStream;
         nextMessage = null;
         channelDeliveryResponseBlock = beginChannelDeliveryResponseBlock(
-          options.channelDeliveryCapture
+          options.responseCapture
         );
-        const channelDeliveryCheckpoint = channelDeliveryResponseBlock?.length ?? 0;
+        channelDeliveryCheckpoint = channelDeliveryResponseBlock?.length ?? 0;
         initialSend = false;
         if (guardForThisSend) {
           const guardCommitted = this.todoStopGuard.commitContinuation(
@@ -6528,10 +6618,14 @@ ${this.pendingRecoveredAgentsNotice}
                 part.thought
               );
               if (!part.thought) {
+                options.responseCapture?.agentOutput.appendText(part.text);
                 channelDeliveryResponseBlock?.push(part.text);
                 messageDisplay?.addChunk(part.text);
               }
             }
+            options.responseCapture?.agentOutput.observeFinishReason(
+              candidate.finishReason
+            );
           }
           if (response.type === "chunk" /* CHUNK */ && response.value.usageMetadata) {
             usageMetadata = response.value.usageMetadata;
@@ -6544,6 +6638,9 @@ ${this.pendingRecoveredAgentsNotice}
             }
           }
           if (response.type === "retry" /* RETRY */ || response.type === "model_fallback" /* MODEL_FALLBACK */) {
+            options.responseCapture?.agentOutput.restartAttempt(
+              response.type === "retry" /* RETRY */ && response.isContinuation === true
+            );
             if (response.type === "model_fallback" /* MODEL_FALLBACK */ || !response.isContinuation) {
               if (channelDeliveryResponseBlock) {
                 channelDeliveryResponseBlock.length = channelDeliveryCheckpoint;
@@ -6606,7 +6703,7 @@ ${this.pendingRecoveredAgentsNotice}
         }
       }
       commitChannelDeliveryResponseBlock(
-        options.channelDeliveryCapture,
+        options.responseCapture,
         channelDeliveryResponseBlock,
         functionCalls.length > 0
       );
@@ -6630,7 +6727,7 @@ ${this.pendingRecoveredAgentsNotice}
             options.onFullTurnModel
           )
         );
-        if (toolRun.stopAfterPermissionCancel || toolRun.loopDetected || pendingSend.signal.aborted) {
+        if (toolRun.stopAfterPermissionCancel || pendingSend.signal.aborted) {
           this.todoStopGuard.suspend();
           await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
           return {
@@ -6639,12 +6736,25 @@ ${this.pendingRecoveredAgentsNotice}
             ...supersededAutomaticContinuation ? { supersededAutomaticContinuation: true } : {}
           };
         }
+        if (toolRun.loopDetected) {
+          this.todoStopGuard.suspend();
+          await this.#preserveStoppedToolRun(toolRun, pendingSend.signal);
+          return {
+            kind: "terminal",
+            // Only the foreground chain rejects a loop-detected stop; cron
+            // and background-notification turns keep the graceful end-turn
+            // handling they had before loop stops became rejections.
+            stopReason: options.rejectOnLoopDetected ? cancelledOrThrowLoopDetected(pendingSend.signal, toolLoopState) : getAbortAwareEndTurnStopReason(pendingSend.signal),
+            ...supersededAutomaticContinuation ? { supersededAutomaticContinuation: true } : {}
+          };
+        }
         const nextAfterTools = await this.#buildNextMessageAfterToolRun(
           toolRun,
           pendingSend.signal,
           toolPromptId,
           toolLoopState,
-          options.onFullTurnModel
+          options.onFullTurnModel,
+          options.rejectOnLoopDetected ?? false
         );
         nextMessage = nextAfterTools.message;
         if (nextAfterTools.hadMidTurnUserInput) {
@@ -6949,7 +7059,7 @@ ${this.pendingRecoveredAgentsNotice}
     );
     await this.messageRewriter?.waitForPendingRewrites();
   }
-  async #buildNextMessageAfterToolRun(toolRun, abortSignal, promptId, toolLoopState, onFullTurnModel) {
+  async #buildNextMessageAfterToolRun(toolRun, abortSignal, promptId, toolLoopState, onFullTurnModel, rejectOnLoopDetected = false) {
     if (toolRun.loopDetected) {
       debugLogger6.debug("Stopping ACP turn after daemon loop detection.");
       return { message: null, hadMidTurnUserInput: false };
@@ -7039,14 +7149,16 @@ ${this.pendingRecoveredAgentsNotice}
         toolLoopState,
         { recordToQwenLogger: false }
       );
-      try {
-        await this.messageEmitter.emitAgentMessage(
-          REPEATED_TOOL_FAILURE_STOP_MESSAGE
-        );
-      } catch (error) {
-        debugLogger6.warn(
-          `Failed to emit repeated tool failure stop message: ${this.#formatError(error)}`
-        );
+      if (!rejectOnLoopDetected) {
+        try {
+          await this.messageEmitter.emitAgentMessage(
+            REPEATED_TOOL_FAILURE_STOP_MESSAGE
+          );
+        } catch (error) {
+          debugLogger6.warn(
+            `Failed to emit repeated tool failure stop message: ${this.#formatError(error)}`
+          );
+        }
       }
       return {
         message: null,
@@ -7483,7 +7595,10 @@ ${this.pendingRecoveredAgentsNotice}
         const promptId = this.config.getSessionId() + "########cron" + Date.now();
         let cronHadError = false;
         let cronCompleted = false;
-        const channelDeliveryCapture = item.delivery ? { finalText: "" } : void 0;
+        const responseCapture = {
+          ...item.delivery ? { channelDelivery: { finalText: "" } } : {},
+          agentOutput: new AgentOutputMessageCapture(this.config)
+        };
         await withInteractionSpan(
           this.config,
           {
@@ -7596,7 +7711,7 @@ ${this.pendingRecoveredAgentsNotice}
                   return;
                 }
                 const responseStream = sendResult.responseStream;
-                const channelDeliveryResponseBlock = beginChannelDeliveryResponseBlock(channelDeliveryCapture);
+                const channelDeliveryResponseBlock = beginChannelDeliveryResponseBlock(responseCapture);
                 const channelDeliveryCheckpoint = channelDeliveryResponseBlock?.length ?? 0;
                 if (loopTick && turnCount === 1) {
                   this.loopTickResolver?.markDelivered();
@@ -7622,10 +7737,14 @@ ${this.pendingRecoveredAgentsNotice}
                           part.thought
                         );
                         if (!part.thought) {
+                          responseCapture.agentOutput.appendText(part.text);
                           channelDeliveryResponseBlock?.push(part.text);
                           messageDisplay?.addChunk(part.text);
                         }
                       }
+                      responseCapture.agentOutput.observeFinishReason(
+                        candidate.finishReason
+                      );
                     }
                     if (resp.type === "chunk" /* CHUNK */ && resp.value.usageMetadata) {
                       usageMetadata = resp.value.usageMetadata;
@@ -7638,6 +7757,9 @@ ${this.pendingRecoveredAgentsNotice}
                       }
                     }
                     if (resp.type === "retry" /* RETRY */ || resp.type === "model_fallback" /* MODEL_FALLBACK */) {
+                      responseCapture.agentOutput.restartAttempt(
+                        resp.type === "retry" /* RETRY */ && resp.isContinuation === true
+                      );
                       if (resp.type === "model_fallback" /* MODEL_FALLBACK */ || !resp.isContinuation) {
                         if (channelDeliveryResponseBlock) {
                           channelDeliveryResponseBlock.length = channelDeliveryCheckpoint;
@@ -7666,7 +7788,7 @@ ${this.pendingRecoveredAgentsNotice}
                   }
                 }
                 commitChannelDeliveryResponseBlock(
-                  channelDeliveryCapture,
+                  responseCapture,
                   channelDeliveryResponseBlock,
                   functionCalls.length > 0
                 );
@@ -7717,7 +7839,7 @@ ${this.pendingRecoveredAgentsNotice}
                   void 0,
                   false,
                   void 0,
-                  channelDeliveryCapture
+                  responseCapture
                 );
                 stopReason = guardStop.stopReason;
                 if (guardStop.stopReason === "max_tokens") {
@@ -7750,6 +7872,11 @@ ${this.pendingRecoveredAgentsNotice}
                 )
               );
             }
+            if (!ac.signal.aborted && !cronHadError) {
+              responseCapture.agentOutput.writeToSpan(
+                getActiveInteractionSpan()
+              );
+            }
           },
           () => ac.signal.aborted ? "cancelled" : cronHadError ? "error" : "ok"
         );
@@ -7760,7 +7887,7 @@ ${this.pendingRecoveredAgentsNotice}
             source: "scheduled",
             target: item.delivery.target,
             text: normalizeChannelDeliveryText(
-              channelDeliveryCapture?.finalText ?? ""
+              responseCapture.channelDelivery?.finalText ?? ""
             ),
             taskId: item.taskId,
             firedAt: item.firedAt
@@ -7832,6 +7959,10 @@ ${this.pendingRecoveredAgentsNotice}
       });
     });
     const shellRegistry = this.config.getBackgroundShellRegistry();
+    this.#shellStatusChangeCallback = () => {
+      this.#activeWorkChanged();
+    };
+    shellRegistry.setStatusChangeCallback(this.#shellStatusChangeCallback);
     shellRegistry.setNotificationCallback((displayText, modelText, meta) => {
       const entry = shellRegistry.get(meta.shellId);
       this.#enqueueBackgroundNotification({
@@ -7990,6 +8121,7 @@ ${this.pendingRecoveredAgentsNotice}
         const [item] = this.notificationQueue.splice(nextIndex, 1);
         if (!item) break;
         this.currentAgentNotificationTaskId = item.kind === "agent" ? item.taskId : null;
+        this.currentShellNotificationActive = item.kind === "shell";
         this.#activeWorkChanged();
         try {
           await runWithInvocationContext(
@@ -8001,6 +8133,7 @@ ${this.pendingRecoveredAgentsNotice}
           );
         } finally {
           this.currentAgentNotificationTaskId = null;
+          this.currentShellNotificationActive = false;
           this.#activeWorkChanged();
         }
       }
@@ -10016,6 +10149,13 @@ ${this.pendingRecoveredAgentsNotice}
                 toolName: policyToolName,
                 args: invocation.params,
                 signal: activeToolAbortSignal,
+                // Same identity and execution scope `CoreToolScheduler`
+                // supplies. This is the path daemon ACP sessions actually
+                // take, so without them a host policy that falls back to the
+                // session — or reasons about where the tool runs — sees
+                // neither on every call made here.
+                sessionId: this.config.getSessionId(),
+                cwd: this.config.getTargetDir(),
                 ...invocationContext ? { invocationContext } : {}
               }
             );
@@ -11022,10 +11162,11 @@ ${contextPart.text}`
 init_esbuild_shims();
 var debugLogger7 = createDebugLogger("ACTIVE_WORK");
 var ActiveWorkReporter = class {
-  constructor(send, listSources, intervalMs) {
+  constructor(send, listSources, intervalMs, enabledCategories) {
     this.send = send;
     this.listSources = listSources;
     this.intervalMs = intervalMs;
+    this.#enabledCategories = new Set(enabledCategories);
     this.#timer = setInterval(() => {
       this.#publish();
     }, intervalMs);
@@ -11040,6 +11181,7 @@ var ActiveWorkReporter = class {
   #coalescing = false;
   #timer;
   #disposed = false;
+  #enabledCategories;
   /**
    * Note that some Session's derived state may have changed. Coalesced to
    * one snapshot per microtask so a burst of transitions (an agent finishing
@@ -11087,7 +11229,7 @@ var ActiveWorkReporter = class {
       for (const source of this.listSources()) {
         sessions.push({
           sessionId: source.sessionId,
-          holds: source.collectActiveWorkHolds()
+          holds: source.collectActiveWorkHolds().filter((hold) => this.#enabledCategories.has(hold.category))
         });
       }
     } catch (error) {
@@ -13086,23 +13228,28 @@ async function deliverClientMcpMessage(connection, serverName, message, sessionI
   return payload;
 }
 __name(deliverClientMcpMessage, "deliverClientMcpMessage");
-function createManagedExternalToolGuard(connection) {
+function createManagedExternalToolGuard(connection, options = {
+  externalProviderAttached: false
+}) {
   return async (context) => {
+    if (!options.externalProviderAttached && !SHELL_EXECUTING_TOOL_NAMES.has(context.toolName)) {
+      return { allowed: true };
+    }
     const invocation = context.invocationContext;
-    if (!invocation) {
+    if (!invocation && options.externalProviderAttached) {
       throw new Error(
         "Managed external tool guard requires a runtime invocation context."
       );
     }
+    const sessionId = invocation?.sessionId ?? context.sessionId;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+      throw new Error(
+        "Managed external tool guard requires a session identity."
+      );
+    }
     if (context.signal.aborted) {
       throw new DOMException("Tool invocation aborted", "AbortError");
     }
-    if (context.toolName === ToolNames.AGENT || context.toolName === ToolNames.WORKFLOW || context.toolName === ToolNames.CREATE_SUB_SESSION || context.toolName === ToolNames.SEND_MESSAGE) {
-      return {
-        allowed: false,
-        reason: "Managed external tool guard v1 does not support nested or delegated agent execution."
-      };
-    }
     let rejectOnAbort;
     const aborted = new Promise((_resolve, reject) => {
       rejectOnAbort = reject;
@@ -13117,11 +13264,14 @@ function createManagedExternalToolGuard(connection) {
         connection.extMethod(
           SERVE_CONTROL_EXT_METHODS.externalToolGuardPrepare,
           {
-            sessionId: invocation.sessionId,
-            promptId: invocation.promptId,
+            sessionId,
+            ...invocation ? { promptId: invocation.promptId } : {},
             toolCallId: context.callId,
             toolName: context.toolName,
-            arguments: context.args
+            arguments: context.args,
+            // A sub-agent pinned to a worktree executes here, not in the
+            // session's own directory; the host validates this before use.
+            ...typeof context.cwd === "string" && context.cwd.length > 0 ? { invocationCwd: context.cwd } : {}
           }
         ),
         aborted
@@ -13248,8 +13398,10 @@ async function runAcpAgent(config, settings, argv, options) {
   const privateParentCapability = options === void 0 ? process.env[PRIVATE_ACP_CAPABILITY_ENV] : options.privateParentCapability;
   delete process.env[PRIVATE_ACP_CAPABILITY_ENV];
   delete process.env[PRIVATE_EXTERNAL_TOOL_GUARD_ENV];
+  delete process.env[PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV];
   delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
   const externalToolGuardRequired = options?.externalToolGuardRequired === true;
+  const externalToolGuardProviderAttached = options?.externalToolGuardProviderAttached === true;
   if (externalToolGuardRequired && privateParentCapability === void 0) {
     throw new Error(
       "Required external tool guard is available only to a private managed ACP parent."
@@ -13331,7 +13483,9 @@ async function runAcpAgent(config, settings, argv, options) {
     });
     connection = new AgentSideConnection((conn) => {
       acpConnection = conn;
-      const managedToolInvocationGuard = externalToolGuardRequired ? createManagedExternalToolGuard(conn) : void 0;
+      const managedToolInvocationGuard = externalToolGuardRequired ? createManagedExternalToolGuard(conn, {
+        externalProviderAttached: externalToolGuardProviderAttached
+      }) : void 0;
       agentInstance = new QwenAgent(
         config,
         settings,
@@ -13339,7 +13493,8 @@ async function runAcpAgent(config, settings, argv, options) {
         conn,
         privateParentCapability,
         sessionWriterLeaseEnabledAtStartup,
-        managedToolInvocationGuard
+        managedToolInvocationGuard,
+        externalToolGuardProviderAttached
       );
       return agentInstance;
     }, stream);
@@ -13645,7 +13800,7 @@ function isOwnerOnlyDirectory(stats) {
 }
 __name(isOwnerOnlyDirectory, "isOwnerOnlyDirectory");
 var QwenAgent = class {
-  constructor(config, settings, argv, connection, expectedPrivateParentCapability, sessionWriterLeaseEnabledAtStartup = false, managedToolInvocationGuard) {
+  constructor(config, settings, argv, connection, expectedPrivateParentCapability, sessionWriterLeaseEnabledAtStartup = false, managedToolInvocationGuard, externalToolGuardProviderAttached = false) {
     this.config = config;
     this.settings = settings;
     this.argv = argv;
@@ -13653,6 +13808,7 @@ var QwenAgent = class {
     this.expectedPrivateParentCapability = expectedPrivateParentCapability;
     this.sessionWriterLeaseEnabledAtStartup = sessionWriterLeaseEnabledAtStartup;
     this.managedToolInvocationGuard = managedToolInvocationGuard;
+    this.externalToolGuardProviderAttached = externalToolGuardProviderAttached;
     if (process.env["QWEN_SERVE_NO_MCP_POOL"] === "1") {
       this.mcpPool = void 0;
       this.workspaceMcpBudget = void 0;
@@ -13747,7 +13903,7 @@ var QwenAgent = class {
     }
   }
   rejectUnsupportedGuardedHiddenAgent(operation) {
-    if (this.managedToolInvocationGuard) {
+    if (this.managedToolInvocationGuard && this.externalToolGuardProviderAttached) {
       throw RequestError.invalidParams(
         void 0,
         `Managed external tool guard v1 does not support ${operation}.`
@@ -14278,6 +14434,12 @@ var QwenAgent = class {
         drainTimeoutMs,
         "close"
       );
+      if (opts?.onlyIfUnheld) {
+        const holds = session.collectActiveWorkHolds();
+        if (holds.length > 0) {
+          return { closed: false, holds };
+        }
+      }
       recorder?.finalize();
       let flushError;
       try {
@@ -14411,7 +14573,7 @@ var QwenAgent = class {
     }
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.21.12-preview.4";
+    const version = "0.21.12";
     const response = {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {
@@ -14455,12 +14617,17 @@ var QwenAgent = class {
     const activeWorkIntervalMs = activeWorkRequested ? clampActiveWorkIntervalMs(
       requestedActiveWork["intervalMs"]
     ) : void 0;
+    const requestedActiveWorkCategories = activeWorkRequested ? requestedActiveWork["categories"] : void 0;
+    const activeWorkCategories = activeWorkRequested ? Array.isArray(requestedActiveWorkCategories) ? ACTIVE_WORK_HOLD_CATEGORIES.filter(
+      (category) => requestedActiveWorkCategories.includes(category)
+    ) : ACTIVE_WORK_LEGACY_HOLD_CATEGORIES : void 0;
     if (activeWorkIntervalMs !== void 0) {
       this.activeWorkReporter?.dispose();
       this.activeWorkReporter = new ActiveWorkReporter(
         (method, params) => this.connection.extNotification(method, params),
         () => this.sessions.values(),
-        activeWorkIntervalMs
+        activeWorkIntervalMs,
+        activeWorkCategories ?? []
       );
     }
     const responseMeta = {
@@ -14472,7 +14639,7 @@ var QwenAgent = class {
         [ACTIVE_WORK_HEARTBEAT_META_KEY]: {
           v: ACTIVE_WORK_HEARTBEAT_VERSION,
           intervalMs: activeWorkIntervalMs,
-          categories: [...ACTIVE_WORK_HOLD_CATEGORIES]
+          categories: [...activeWorkCategories ?? []]
         }
       } : {}
     };
@@ -15234,13 +15401,23 @@ var QwenAgent = class {
     const suppliedContext = meta[INVOCATION_CONTEXT_META_KEY];
     const suppliedModelPrompt = meta[DAEMON_MODEL_PROMPT_META_KEY];
     const suppliedPromptDisplayText = meta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
+    const suppliedChannelPrompt = meta[CHANNEL_PROMPT_META_KEY];
+    const suppliedChannelDelivery = meta[DAEMON_CHANNEL_DELIVERY_META_KEY];
     delete meta[INVOCATION_CONTEXT_META_KEY];
     delete meta[DAEMON_MODEL_PROMPT_META_KEY];
     delete meta[PRIVATE_PARENT_CAPABILITY_META_KEY];
     delete meta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
+    delete meta[CHANNEL_PROMPT_META_KEY];
+    delete meta[DAEMON_CHANNEL_DELIVERY_META_KEY];
     if (this.privateParentState === "trusted" && typeof suppliedPromptDisplayText === "string") {
       meta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY] = suppliedPromptDisplayText;
     }
+    if (this.privateParentState === "trusted" && suppliedChannelPrompt === true) {
+      meta[CHANNEL_PROMPT_META_KEY] = true;
+    }
+    if (this.privateParentState === "trusted" && suppliedChannelDelivery !== void 0) {
+      meta[DAEMON_CHANNEL_DELIVERY_META_KEY] = suppliedChannelDelivery;
+    }
     if (Object.keys(meta).length > 0) {
       sanitizedParams._meta = meta;
     } else {
@@ -17597,7 +17774,7 @@ var QwenAgent = class {
         );
       case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRememberAvailability:
         return {
-          available: !this.managedToolInvocationGuard && this.config.isManagedMemoryAvailable()
+          available: !(this.managedToolInvocationGuard && this.externalToolGuardProviderAttached) && this.config.isManagedMemoryAvailable()
         };
       case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRemember: {
         this.rejectUnsupportedGuardedHiddenAgent(
@@ -19154,7 +19331,7 @@ var QwenAgent = class {
         return { sessionId, answer: result.text || null };
       }
       case SERVE_CONTROL_EXT_METHODS.sessionForkAgent: {
-        if (this.managedToolInvocationGuard) {
+        if (this.managedToolInvocationGuard && this.externalToolGuardProviderAttached) {
           throw RequestError.invalidParams(
             void 0,
             "Managed external tool guard v1 does not support /fork."