@qwen-code/qwen-code 0.21.4 → 0.21.5

package/chunks/{chunk-2T3RYG4L.js → chunk-GP4IMBX5.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   serveCommand
-} from "./chunk-2ON2O4MD.js";
+} from "./chunk-SVIEVA3L.js";
 import {
   listCommand
-} from "./chunk-P5UJMCVS.js";
+} from "./chunk-ZLGPHA34.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-EJXATV5R.js";
+} from "./chunk-VJPF6GF2.js";
 import {
   ObservedChannelContactStore
 } from "./chunk-DYA25Y7U.js";
@@ -46,19 +46,19 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-5XGI4IPK.js";
+} from "./chunk-VOA2UPZM.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-O4IWFYUW.js";
+} from "./chunk-3GOCVBYR.js";
 import {
   collectProviderModelsForProtocol,
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-IMGNGOGC.js";
+} from "./chunk-WU5NBSLD.js";
 import {
   parseChannelConfig
 } from "./chunk-LEZFUYPM.js";
@@ -128,29 +128,29 @@ import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-6ME3PVMM.js";
+} from "./chunk-SJMCYCUQ.js";
 import {
   loadSettings
-} from "./chunk-KB6VSG2U.js";
+} from "./chunk-RM3F46UT.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-FV4TUUDE.js";
+} from "./chunk-K64OI7S7.js";
 import {
   loadEnvironment
-} from "./chunk-4PZ7SPD5.js";
+} from "./chunk-LYPXNRBX.js";
 import {
   getCliVersion
-} from "./chunk-HBCKZF2A.js";
+} from "./chunk-IZ2CMEYO.js";
 import {
   getPackageJson
 } from "./chunk-VJNBRRZG.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-URVJ4AZC.js";
+} from "./chunk-B3EBIZUY.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -191,7 +191,7 @@ import {
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-E2SYUEIA.js";
+} from "./chunk-YLL3SC5S.js";
 import {
   nextFireTime,
   parseCron
@@ -202,18 +202,18 @@ import {
 import {
   parseBooleanEnvFlag,
   resolveTelemetrySettings
-} from "./chunk-RPYYTL7E.js";
+} from "./chunk-MGSSJT27.js";
 import {
   getAllGeminiMdFilenames,
   setGeminiMdFilename
-} from "./chunk-JDJ7SC4E.js";
+} from "./chunk-ZPGMDT4S.js";
 import {
   SchemaValidator,
   ToolNames
-} from "./chunk-CFDR3GNL.js";
+} from "./chunk-D7D7RXIJ.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
-} from "./chunk-TXZDRD36.js";
+} from "./chunk-XD2PNH3K.js";
 import {
   isTlsVerificationDisabled
 } from "./chunk-BFHXDAR7.js";
@@ -222,7 +222,7 @@ import {
 } from "./chunk-UH7Z7Y45.js";
 import {
   recordChannelMemoryRecallMetrics
-} from "./chunk-O2ZYHG33.js";
+} from "./chunk-5L6CQ4ZU.js";
 import {
   FatalConfigError,
   FatalSandboxError,
@@ -358,9 +358,9 @@ var require_command_exists = __commonJS({
       cleanInput = /* @__PURE__ */ __name(function(s) {
         var isPathName = /[\\]/.test(s);
         if (isPathName) {
-          var dirname23 = '"' + path3.dirname(s) + '"';
+          var dirname24 = '"' + path3.dirname(s) + '"';
           var basename6 = '"' + path3.basename(s) + '"';
-          return dirname23 + ":" + basename6;
+          return dirname24 + ":" + basename6;
         }
         return '"' + s + '"';
       }, "cleanInput");
@@ -368,10 +368,10 @@ var require_command_exists = __commonJS({
     module.exports = /* @__PURE__ */ __name(function commandExists2(commandName, callback) {
       var cleanedCommandName = cleanInput(commandName);
       if (!callback && typeof Promise !== "undefined") {
-        return new Promise(function(resolve23, reject) {
+        return new Promise(function(resolve24, reject) {
           commandExists2(commandName, function(error, output) {
             if (output) {
-              resolve23(commandName);
+              resolve24(commandName);
             } else {
               reject(error);
             }
@@ -2255,8 +2255,8 @@ function createBridgeReadinessGate() {
     current: /* @__PURE__ */ __name(() => pending, "current"),
     block: /* @__PURE__ */ __name(() => {
       if (pending) return;
-      pending = new Promise((resolve23) => {
-        releasePending = resolve23;
+      pending = new Promise((resolve24) => {
+        releasePending = resolve24;
       });
     }, "block"),
     release: /* @__PURE__ */ __name(() => {
@@ -2338,7 +2338,7 @@ function createBridgeRecovery(options) {
         writeStderrLine(
           `[Channel] Bridge crashed (${recentCrashCount}/${MAX_CRASH_RESTARTS} in window). Restarting in ${RESTART_DELAY_MS / 1e3}s...`
         );
-        await new Promise((resolve23) => setTimeout(resolve23, RESTART_DELAY_MS));
+        await new Promise((resolve24) => setTimeout(resolve24, RESTART_DELAY_MS));
         const bridge = new AcpBridge(bridgeOpts);
         setBridge(bridge);
         attachDisconnectHandler(bridge);
@@ -3206,12 +3206,12 @@ async function abortableStartup(value, signal) {
   const promise = Promise.resolve(value);
   if (!signal) return await promise;
   if (signal.aborted) throw startupAbortError();
-  return await new Promise((resolve23, reject) => {
+  return await new Promise((resolve24, reject) => {
     const onAbort = /* @__PURE__ */ __name(() => {
       reject(startupAbortError());
     }, "onAbort");
     signal.addEventListener("abort", onAbort, { once: true });
-    promise.then(resolve23, reject).finally(() => {
+    promise.then(resolve24, reject).finally(() => {
       signal.removeEventListener("abort", onAbort);
     });
   });
@@ -3619,7 +3619,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
   if (!send) {
     return Promise.reject(new Error("Channel worker IPC is unavailable."));
   }
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     let settled = false;
     let unsubscribeMessage = /* @__PURE__ */ __name(() => {
     }, "unsubscribeMessage");
@@ -3633,7 +3633,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
       settled = true;
       cleanup();
       if (error) reject(error);
-      else resolve23();
+      else resolve24();
     }, "finish");
     const onMessage = /* @__PURE__ */ __name((value) => {
       if (isChannelStartupReportAckMessage(value)) {
@@ -3881,8 +3881,8 @@ var daemonWorkerCommand = {
       let shuttingDown = false;
       let exitCode = 0;
       let finish;
-      const finished = new Promise((resolve23) => {
-        finish = resolve23;
+      const finished = new Promise((resolve24) => {
+        finish = resolve24;
       });
       const shutdown = /* @__PURE__ */ __name(async (reason) => {
         if (shuttingDown) {
@@ -3910,8 +3910,8 @@ var daemonWorkerCommand = {
                   ...activeChannelDeliveries.values(),
                   ...activeWebhookTasks.values()
                 ]),
-                new Promise((resolve23) => {
-                  const timer = setTimeout(resolve23, WORKER_SHUTDOWN_DRAIN_MS);
+                new Promise((resolve24) => {
+                  const timer = setTimeout(resolve24, WORKER_SHUTDOWN_DRAIN_MS);
                   timer.unref();
                 })
               ]);
@@ -6283,6 +6283,11 @@ function coverageFromTranscripts(planPath, env = process.env) {
   const idleAgents = [];
   const unopenedAgents = [];
   const rewrittenPrompts = [];
+  const driftedLaunches = [];
+  const openedBriefOf = /* @__PURE__ */ __name((rec, key) => {
+    const needle = JSON.stringify(briefPath(planPath, key));
+    return rec.successfulCallArgs.some((a) => a.includes(needle));
+  }, "openedBriefOf");
   const disclosures = [];
   const disclose = /* @__PURE__ */ __name((subject, reason, pub) => {
     disclosures.push({
@@ -6355,15 +6360,23 @@ function coverageFromTranscripts(planPath, env = process.env) {
           );
         }
       } else if (!wasDeliveredVerbatim(rec.launchPrompt, b)) {
-        rewrittenThisRecord = true;
-        if (!superseded(rec, chunk2)) {
-          rewrittenPrompts.push(
-            disclose(
-              name,
-              "launched with a prompt that is not the one the CLI built",
-              { reasonZh: "\u542F\u52A8\u65F6\u4F7F\u7528\u7684 prompt \u4E0D\u662F CLI \u6784\u5EFA\u7684\u90A3\u4E00\u4EFD" }
-            )
-          );
+        if (openedBriefOf(rec, `chunk-${chunk2}`) && rec.diffToolCalls > 0) {
+          if (!superseded(rec, chunk2)) {
+            driftedLaunches.push(
+              `${name} \u2014 launched with a near-verbatim prompt; its brief was opened and the diff was read, so the delivery stands`
+            );
+          }
+        } else {
+          rewrittenThisRecord = true;
+          if (!superseded(rec, chunk2)) {
+            rewrittenPrompts.push(
+              disclose(
+                name,
+                "launched with a prompt that is not the one the CLI built",
+                { reasonZh: "\u542F\u52A8\u65F6\u4F7F\u7528\u7684 prompt \u4E0D\u662F CLI \u6784\u5EFA\u7684\u90A3\u4E00\u4EFD" }
+              )
+            );
+          }
         }
       }
     }
@@ -6407,16 +6420,12 @@ function coverageFromTranscripts(planPath, env = process.env) {
     );
   }
   const buildable = roster.filter((r) => builtOf(r.key) !== void 0);
-  const openedBrief = /* @__PURE__ */ __name((rec, key) => {
-    const needle = JSON.stringify(briefPath(planPath, key));
-    return rec.successfulCallArgs.some((a) => a.includes(needle));
-  }, "openedBrief");
   const candidatesOf = buildable.map((req) => {
     const b = builtOf(req.key);
     return records.filter((r) => wasDeliveredVerbatim(r.launchPrompt, b));
   });
   const openedOfReq = buildable.map(
-    (req, i) => candidatesOf[i].filter((r) => openedBrief(r, req.key))
+    (req, i) => candidatesOf[i].filter((r) => openedBriefOf(r, req.key))
   );
   const matchedRec = /* @__PURE__ */ new Map();
   const augment = /* @__PURE__ */ __name((i, edges, seen) => {
@@ -6441,6 +6450,7 @@ function coverageFromTranscripts(planPath, env = process.env) {
   }
   const assignment = /* @__PURE__ */ new Map();
   for (const [rec, i] of matchedRec) assignment.set(i, rec);
+  const rescued = /* @__PURE__ */ new Set();
   let buildableIdx = -1;
   for (const req of roster) {
     const b = builtOf(req.key);
@@ -6465,6 +6475,21 @@ function coverageFromTranscripts(planPath, env = process.env) {
     const pick2 = assignment.get(buildableIdx);
     if (pick2 === void 0) {
       const anyMatch = candidatesOf[buildableIdx].length > 0;
+      if (!anyMatch) {
+        const needsDiff = req.role === "chunk" || BRIEFS[req.role].readsDiff;
+        const rescue = records.find(
+          (r) => !matchedRec.has(r) && !rescued.has(r) && r.successfulToolCalls > 0 && (!needsDiff || r.diffToolCalls > 0) && openedBriefOf(r, req.key)
+        );
+        if (rescue !== void 0) {
+          rescued.add(rescue);
+          if (req.role !== "chunk") {
+            driftedLaunches.push(
+              `${roleLabel(req)} \u2014 no launch matched its block verbatim, but an agent opened this role's brief and did the work, so the delivery stands`
+            );
+          }
+          continue;
+        }
+      }
       missingRoles.push(
         disclose(
           roleLabel(req),
@@ -6512,6 +6537,7 @@ function coverageFromTranscripts(planPath, env = process.env) {
     idleAgents,
     unopenedAgents,
     rewrittenPrompts,
+    driftedLaunches,
     missingRoles,
     missingRoleSelectors,
     disclosures,
@@ -7217,25 +7243,25 @@ function composeReviewBody(input, cliVersion) {
   }
   if (contextUnavailable) cappedBy.push("context-unavailable");
   if (criticalsUnverified) cappedBy.push("criticals-unverified");
-  let event = baseEvent;
-  if (event === "APPROVE" && cappedBy.length > 0) event = "COMMENT";
+  let event2 = baseEvent;
+  if (event2 === "APPROVE" && cappedBy.length > 0) event2 = "COMMENT";
   const deterministicBodyCriticals = bodyCriticals.length - nonDeterministicBodyCriticals;
-  if (event === "REQUEST_CHANGES" && criticalsUnverified && deterministicBodyCriticals === 0) {
-    event = "COMMENT";
+  if (event2 === "REQUEST_CHANGES" && criticalsUnverified && deterministicBodyCriticals === 0) {
+    event2 = "COMMENT";
   }
   let downgraded = false;
   let downgradedFrom = null;
-  if (event === "APPROVE" && downgradeApprove) {
-    event = "COMMENT";
+  if (event2 === "APPROVE" && downgradeApprove) {
+    event2 = "COMMENT";
     downgraded = true;
     downgradedFrom = "Approve";
-  } else if ((event === "REQUEST_CHANGES" || baseEvent === "REQUEST_CHANGES" && criticalsUnverified) && downgradeRequestChanges) {
-    event = "COMMENT";
+  } else if ((event2 === "REQUEST_CHANGES" || baseEvent === "REQUEST_CHANGES" && criticalsUnverified) && downgradeRequestChanges) {
+    event2 = "COMMENT";
     downgraded = true;
     downgradedFrom = "Request changes";
   }
   let lowSignal = null;
-  if (event === "APPROVE" && input.planPath) {
+  if (event2 === "APPROVE" && input.planPath) {
     try {
       const plan = JSON.parse(
         readFileSync8(input.planPath, "utf8")
@@ -7249,10 +7275,10 @@ function composeReviewBody(input, cliVersion) {
   }
   const footer = `_\u2014 ${modelId} via Qwen Code /review (v${cliVersion})_`;
   const bilingual = bilingualFromPlan(input.planPath, input.prBodyFetcher);
-  const render = /* @__PURE__ */ __name((parts, sep4) => {
-    const en = parts.map((p) => p.en).join(sep4);
+  const render = /* @__PURE__ */ __name((parts, sep5) => {
+    const en = parts.map((p) => p.en).join(sep5);
     if (en === "") return "";
-    const zh = parts.map((p) => p.zh).join(sep4);
+    const zh = parts.map((p) => p.zh).join(sep5);
     const text = bilingual && zh !== en ? `${en}
 
 <details>
@@ -7386,7 +7412,7 @@ ${footer}`;
       zh: `Test Plan\uFF08\u975E\u963B\u65AD\uFF09\uFF1A${testPlanNotes.join("; ")}\u3002`
     }
   ] : [];
-  if (event === "REQUEST_CHANGES") {
+  if (event2 === "REQUEST_CHANGES") {
     const parts = [
       ...contextUnavailable ? [contextUnavailableClause] : [],
       ...cannotTellBlock,
@@ -7396,7 +7422,7 @@ ${footer}`;
       ...bodyCriticalBlock
     ];
     return {
-      event,
+      event: event2,
       body: render(parts, "\n\n"),
       baseEvent,
       cappedBy,
@@ -7406,9 +7432,9 @@ ${footer}`;
       lowSignal
     };
   }
-  if (event === "APPROVE") {
+  if (event2 === "APPROVE") {
     return {
-      event,
+      event: event2,
       body: render(
         [
           { en: "No issues found. LGTM! \u2705", zh: "\u672A\u53D1\u73B0\u95EE\u9898\u3002LGTM\uFF01\u2705" },
@@ -7471,7 +7497,7 @@ ${footer}`;
     clauses.push(...bodyCriticalBlock);
   }
   return {
-    event,
+    event: event2,
     body: render(clauses, " "),
     baseEvent,
     cappedBy,
@@ -7901,8 +7927,8 @@ function parseLocations(o, index) {
       const lo = l;
       const file2 = asString(lo, "file");
       if (!file2) fail(index, `location ${j} is missing a non-empty "file".`);
-      if (lo["line"] !== void 0 && typeof lo["line"] !== "number") {
-        fail(index, `location ${j} has a non-numeric "line".`);
+      if (lo["line"] !== void 0 && (typeof lo["line"] !== "number" || !Number.isSafeInteger(lo["line"]) || lo["line"] <= 0)) {
+        fail(index, `location ${j} has an invalid "line".`);
       }
       return {
         file: file2,
@@ -7918,8 +7944,8 @@ function parseLocations(o, index) {
       'needs a non-empty "file" (or a "locations" array for a pattern aggregate).'
     );
   }
-  if (o["line"] !== void 0 && typeof o["line"] !== "number") {
-    fail(index, 'has a non-numeric "line".');
+  if (o["line"] !== void 0 && (typeof o["line"] !== "number" || !Number.isSafeInteger(o["line"]) || o["line"] <= 0)) {
+    fail(index, 'has an invalid "line".');
   }
   return [
     {
@@ -11398,8 +11424,8 @@ function validateRequests(raw) {
         );
       }
     }
-    if (o["line"] !== void 0 && typeof o["line"] !== "number") {
-      throw new Error(`Finding "${o["id"]}" has a non-numeric "line".`);
+    if (o["line"] !== void 0 && (typeof o["line"] !== "number" || !Number.isSafeInteger(o["line"]) || o["line"] <= 0)) {
+      throw new Error(`Finding "${o["id"]}" has an invalid "line".`);
     }
     return {
       id: o["id"],
@@ -11547,6 +11573,11 @@ This is an environment problem, not a finding about the agents. Coverage cannot
       `ERROR: ${report.rewrittenPrompts.length} agent(s) were not launched with the prompt this CLI built for them \u2014 ${report.rewrittenPrompts.join("; ")}. \`agent-prompt\` prints a prompt to be passed VERBATIM; a summary of it is not it. The last run to paraphrase one dropped the rule against reciting a stock sentence and replaced the project's review rules with three sentences of its own. Re-run \`"\${QWEN_CODE_CLI:-qwen}" review agent-prompt\` and pass its output unedited \u2014 copy it, do not retype it.`
     );
   }
+  if (report.driftedLaunches.length > 0) {
+    writeStderrLine(
+      `NOTE: ${report.driftedLaunches.length} agent(s) launched with a near-verbatim prompt \u2014 ${report.driftedLaunches.join("; ")}. Their briefs were opened and the work is on record, so the delivery stands and NO relaunch is owed. Copy future blocks exactly \u2014 one edited word is what turns a clean pass into this note.`
+    );
+  }
   if (report.missingRoles.length > 0) {
     writeStderrLine(
       // No count: when no role was briefed at all, `missingRoles` collapses to one
@@ -14762,12 +14793,12 @@ function structuralProblems(payload) {
   return problems;
 }
 __name(structuralProblems, "structuralProblems");
-function inconsistencies(payload, event) {
+function inconsistencies(payload, event2) {
   const problems = [];
   const comments = payload.comments ?? [];
-  if (!EVENTS.has(event)) {
+  if (!EVENTS.has(event2)) {
     problems.push(
-      `computed \`event\` is ${JSON.stringify(event)}; GitHub accepts only ${[...EVENTS].join(", ")}`
+      `computed \`event\` is ${JSON.stringify(event2)}; GitHub accepts only ${[...EVENTS].join(", ")}`
     );
   }
   comments.forEach((c, i) => {
@@ -14849,18 +14880,18 @@ Posting is a public, irreversible write, and this run has no authorisation for o
 ` + structural.map((p) => `  - ${p}`).join("\n")
     );
   }
-  let event;
+  let event2;
   let body;
   let cappedBy;
   try {
-    ({ event, body, cappedBy } = compose(payload, cliVersion));
+    ({ event: event2, body, cappedBy } = compose(payload, cliVersion));
   } catch (err) {
     throw new Error(
       `The review state does not compose into a verdict; refusing to post:
   - ${err.message}`
     );
   }
-  const problems = inconsistencies(payload, event);
+  const problems = inconsistencies(payload, event2);
   if (problems.length > 0) {
     throw new Error(
       `The review payload contradicts itself; refusing to post it:
@@ -14869,7 +14900,7 @@ Posting is a public, irreversible write, and this run has no authorisation for o
   }
   const post = {
     commit_id: payload.commit_id,
-    event,
+    event: event2,
     body,
     comments: payload.comments ?? []
   };
@@ -14880,7 +14911,7 @@ Posting is a public, irreversible write, and this run has no authorisation for o
     );
     writeStdoutLine(
       JSON.stringify(
-        { posted: false, wouldPost: true, target, event, cappedBy },
+        { posted: false, wouldPost: true, target, event: event2, cappedBy },
         null,
         2
       )
@@ -14903,20 +14934,20 @@ Posting is a public, irreversible write, and this run has no authorisation for o
       mkdirSync22(REVIEW_TMP_DIR, { recursive: true });
       atomicWriteFileSync(
         receiptPath,
-        `${JSON.stringify({ reviewIds, event, postedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+        `${JSON.stringify({ reviewIds, event: event2, postedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `
       );
     }
   } catch {
   }
   writeStderrLine(
-    `Posted ${event} to ${args.repo}#${args.pr} \u2014 ${auth.why}` + (cappedBy.length ? ` (capped by ${cappedBy.join(", ")})` : "") + "."
+    `Posted ${event2} to ${args.repo}#${args.pr} \u2014 ${auth.why}` + (cappedBy.length ? ` (capped by ${cappedBy.join(", ")})` : "") + "."
   );
   writeStdoutLine(
     JSON.stringify(
       {
         posted: true,
-        event,
+        event: event2,
         cappedBy,
         inlineComments: post.comments.length
       },
@@ -17093,9 +17124,9 @@ function newestArtifactSince(dir, pattern, startMs) {
   return best ? best.path : null;
 }
 __name(newestArtifactSince, "newestArtifactSince");
-function exitCodeFor(completed, event, failOn) {
+function exitCodeFor(completed, event2, failOn) {
   if (!completed) return 1;
-  if (failOn === "request-changes" && event === "REQUEST_CHANGES") return 3;
+  if (failOn === "request-changes" && event2 === "REQUEST_CHANGES") return 3;
   return 0;
 }
 __name(exitCodeFor, "exitCodeFor");
@@ -17332,13 +17363,308 @@ var runCommand = {
   }, "handler")
 };
 
+// packages/cli/src/commands/review/save-artifact.ts
+init_esbuild_shims();
+import {
+  existsSync as existsSync14,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync25,
+  readFileSync as readFileSync29,
+  statSync as statSync10
+} from "node:fs";
+import {
+  dirname as dirname23,
+  isAbsolute as isAbsolute4,
+  join as join21,
+  relative as relative3,
+  resolve as resolve22,
+  sep as sep4,
+  toNamespacedPath
+} from "node:path";
+import { isDeepStrictEqual } from "node:util";
+function workspaceRoot() {
+  return resolve22(process.env["QWEN_CODE_PROJECT_DIR"] ?? process.cwd());
+}
+__name(workspaceRoot, "workspaceRoot");
+function isWithin(parent, child) {
+  const rel = relative3(parent, child);
+  return rel === "" || !isAbsolute4(rel) && rel !== ".." && !rel.startsWith(`..${sep4}`);
+}
+__name(isWithin, "isWithin");
+function workspacePath(root, value, label2) {
+  const absolute = resolve22(root, value);
+  if (!isWithin(root, absolute)) {
+    throw new Error(
+      `${label2} must be inside the workspace: ${JSON.stringify(value)}.`
+    );
+  }
+  return absolute;
+}
+__name(workspacePath, "workspacePath");
+function rejectSymlinkPath(root, path3, label2) {
+  const rel = relative3(root, path3);
+  let current = root;
+  for (const segment of rel.split(sep4)) {
+    current = join21(current, segment);
+    if (existsSync14(current) && lstatSync5(current).isSymbolicLink()) {
+      throw new Error(`${label2} must not traverse a symbolic link.`);
+    }
+  }
+}
+__name(rejectSymlinkPath, "rejectSymlinkPath");
+function sameFile(left, right) {
+  if (left === right) return true;
+  if (!existsSync14(left) || !existsSync14(right)) return false;
+  const leftStat = statSync10(left);
+  const rightStat = statSync10(right);
+  return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
+}
+__name(sameFile, "sameFile");
+function readText(path3, label2) {
+  try {
+    return readFileSync29(path3, "utf8");
+  } catch (error) {
+    throw new Error(
+      `Could not read the ${label2} file at ${JSON.stringify(path3)}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+__name(readText, "readText");
+function readJson2(path3, label2) {
+  const text = readText(path3, label2);
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new Error(
+      `The ${label2} file at ${JSON.stringify(path3)} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+__name(readJson2, "readJson");
+function object(value, label2) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label2} must be an object.`);
+  }
+  return value;
+}
+__name(object, "object");
+function string(value, label2) {
+  if (typeof value !== "string") {
+    throw new Error(`${label2} must be a string.`);
+  }
+  return value;
+}
+__name(string, "string");
+function nonEmptyString(value, label2) {
+  const text = string(value, label2);
+  if (text.trim() === "") {
+    throw new Error(`${label2} must be a non-empty string.`);
+  }
+  return text;
+}
+__name(nonEmptyString, "nonEmptyString");
+function stringArray2(value, label2) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw new Error(`${label2} must be an array of strings.`);
+  }
+  return value;
+}
+__name(stringArray2, "stringArray");
+function event(value, label2) {
+  if (value !== "APPROVE" && value !== "COMMENT" && value !== "REQUEST_CHANGES") {
+    throw new Error(`${label2} has an unsupported value.`);
+  }
+  return value;
+}
+__name(event, "event");
+function validateVerdict(value) {
+  const verdict = object(value, "Composed verdict");
+  const downgradedFrom = verdict["downgradedFrom"];
+  if (downgradedFrom !== null && downgradedFrom !== "Approve" && downgradedFrom !== "Request changes") {
+    throw new Error(
+      "Composed verdict.downgradedFrom has an unsupported value."
+    );
+  }
+  if (typeof verdict["downgraded"] !== "boolean") {
+    throw new Error("Composed verdict.downgraded must be a boolean.");
+  }
+  const lowSignal = verdict["lowSignal"];
+  if (lowSignal !== null) {
+    const signal = object(lowSignal, "Composed verdict.lowSignal");
+    for (const key of ["agents", "srcDiffLines"]) {
+      if (typeof signal[key] !== "number" || !Number.isInteger(signal[key]) || signal[key] < 0) {
+        throw new Error(
+          `Composed verdict.lowSignal.${key} must be a non-negative integer.`
+        );
+      }
+    }
+  }
+  return {
+    event: event(verdict["event"], "Composed verdict.event"),
+    body: string(verdict["body"], "Composed verdict.body"),
+    baseEvent: event(verdict["baseEvent"], "Composed verdict.baseEvent"),
+    cappedBy: stringArray2(verdict["cappedBy"], "Composed verdict.cappedBy"),
+    downgraded: verdict["downgraded"],
+    downgradedFrom,
+    remediation: stringArray2(
+      verdict["remediation"],
+      "Composed verdict.remediation"
+    ),
+    lowSignal: lowSignal === null ? null : {
+      agents: lowSignal["agents"],
+      srcDiffLines: lowSignal["srcDiffLines"]
+    },
+    verdictLine: nonEmptyString(
+      verdict["verdictLine"],
+      "Composed verdict.verdictLine"
+    )
+  };
+}
+__name(validateVerdict, "validateVerdict");
+function validateFindingsReport(value) {
+  const report = object(value, "Canonical findings report");
+  if (typeof report["outcomesRecorded"] !== "boolean") {
+    throw new Error(
+      "Canonical findings report.outcomesRecorded must be a boolean."
+    );
+  }
+  const canonical = buildReport(validateFindings(report["findings"]));
+  const supplied = {
+    findings: report["findings"],
+    counts: report["counts"],
+    outcomesRecorded: report["outcomesRecorded"]
+  };
+  if (!isDeepStrictEqual(supplied, canonical)) {
+    throw new Error(
+      "Canonical findings report is malformed or inconsistent with its findings."
+    );
+  }
+  return supplied;
+}
+__name(validateFindingsReport, "validateFindingsReport");
+function saveReviewArtifact(args) {
+  const root = workspaceRoot();
+  const findingsPath = workspacePath(root, args.findings, "Findings input");
+  const composedPath = workspacePath(root, args.composed, "Composed input");
+  const reportPath = workspacePath(root, args.report, "Markdown report");
+  const outputPath = workspacePath(root, args.out, "Output");
+  const reviewsRoot = resolve22(root, REVIEWS_DIR);
+  if (!isWithin(reviewsRoot, reportPath) || reportPath === reviewsRoot) {
+    throw new Error(
+      `Markdown report must be a file under ${JSON.stringify(REVIEWS_DIR)}: ${JSON.stringify(args.report)}.`
+    );
+  }
+  if (!isWithin(reviewsRoot, outputPath) || outputPath === reviewsRoot) {
+    throw new Error(
+      `Output must be a file under ${JSON.stringify(REVIEWS_DIR)}: ${JSON.stringify(args.out)}.`
+    );
+  }
+  for (const [label2, inputPath] of [
+    ["findings input", findingsPath],
+    ["composed input", composedPath],
+    ["Markdown report", reportPath]
+  ]) {
+    if (sameFile(outputPath, inputPath)) {
+      throw new Error(`Output must not overwrite the ${label2}.`);
+    }
+  }
+  rejectSymlinkPath(root, findingsPath, "Findings input");
+  rejectSymlinkPath(root, composedPath, "Composed input");
+  rejectSymlinkPath(root, reportPath, "Markdown report");
+  rejectSymlinkPath(root, outputPath, "Output");
+  if (!EFFORT_LEVELS.has(args.effort)) {
+    throw new Error(
+      `Unsupported review effort: ${JSON.stringify(args.effort)}.`
+    );
+  }
+  if (args.effort === "low") {
+    throw new Error(
+      "save-artifact does not support low-effort reviews: low has no canonical composed verdict to persist."
+    );
+  }
+  nonEmptyString(args.target, "Target");
+  const findings = validateFindingsReport(
+    readJson2(findingsPath, "canonical findings")
+  );
+  const verdict = validateVerdict(readJson2(composedPath, "composed verdict"));
+  let reportIsFile;
+  try {
+    reportIsFile = statSync10(reportPath).isFile();
+  } catch {
+  }
+  if (reportIsFile === false) {
+    throw new Error(
+      `Markdown report is not a file: ${JSON.stringify(args.report)}.`
+    );
+  }
+  readText(reportPath, "Markdown report");
+  const markdownReportPath = relative3(root, reportPath).split(sep4).join("/");
+  const document = {
+    schemaVersion: 1,
+    target: args.target,
+    effort: args.effort,
+    verdict,
+    findings: findings.findings,
+    counts: findings.counts,
+    outcomesRecorded: findings.outcomesRecorded,
+    markdownReportPath
+  };
+  mkdirSync25(dirname23(outputPath), { recursive: true });
+  atomicWriteFileSync(
+    toNamespacedPath(outputPath),
+    `${JSON.stringify(document, null, 2)}
+`,
+    { encoding: "utf8", noFollow: true }
+  );
+  return {
+    path: outputPath,
+    workspacePath: relative3(root, outputPath).split(sep4).join("/")
+  };
+}
+__name(saveReviewArtifact, "saveReviewArtifact");
+var saveArtifactCommand = {
+  command: "save-artifact",
+  describe: "Create a durable versioned code-review JSON document from canonical review artifacts",
+  builder: /* @__PURE__ */ __name((yargs) => yargs.option("findings", {
+    type: "string",
+    demandOption: true,
+    describe: "Canonical findings JSON"
+  }).option("composed", {
+    type: "string",
+    demandOption: true,
+    describe: "Composed verdict JSON"
+  }).option("report", {
+    type: "string",
+    demandOption: true,
+    describe: "Existing durable Markdown report"
+  }).option("target", {
+    type: "string",
+    demandOption: true,
+    describe: "Review target label"
+  }).option("effort", {
+    type: "string",
+    choices: [...EFFORT_LEVELS].filter((effort) => effort !== "low"),
+    demandOption: true,
+    describe: "Resolved review effort"
+  }).option("out", {
+    type: "string",
+    demandOption: true,
+    describe: "Output path under .qwen/reviews/"
+  }), "builder"),
+  handler: /* @__PURE__ */ __name((argv) => {
+    const saved = saveReviewArtifact(argv);
+    writeStdoutLine(JSON.stringify(saved));
+    writeStderrLine(`save-artifact: wrote ${saved.path}`);
+  }, "handler")
+};
+
 // packages/cli/src/commands/review.ts
 var reviewCommand = {
   command: "review",
   describe: "Run a review non-interactively (`run`), plus the internal helpers used by the /review skill (PR worktree setup, context fetch, rules loading, presubmit checks, cleanup)",
-  builder: /* @__PURE__ */ __name((yargs) => yargs.command(runCommand).command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(baseTreeCommand).command(testDeltaCommand).command(driveCommand).command(mockProviderCommand).command(extractStepCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(presubmitCommand).command(testEfficacyCommand).command(testPlanCommand).command(findingsCommand).command(publishAssetsCommand).command(composeReviewCommand).command(submitCommand).command(cleanupCommand).demandCommand(
+  builder: /* @__PURE__ */ __name((yargs) => yargs.command(runCommand).command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(baseTreeCommand).command(testDeltaCommand).command(driveCommand).command(mockProviderCommand).command(extractStepCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(presubmitCommand).command(testEfficacyCommand).command(testPlanCommand).command(findingsCommand).command(publishAssetsCommand).command(composeReviewCommand).command(saveArtifactCommand).command(submitCommand).command(cleanupCommand).demandCommand(
     1,
-    "Specify a subcommand: run, parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, submit, or cleanup."
+    "Specify a subcommand: run, parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, save-artifact, submit, or cleanup."
   ).version(false), "builder"),
   handler: /* @__PURE__ */ __name(() => {
   }, "handler")
@@ -17538,10 +17864,10 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-ILWAOKA4.js"),
-      import("./updateCheck-42SPCLH7.js"),
-      import("./installationInfo-IWMM6DPV.js"),
-      import("./standalone-update-Y5JB4S2K.js"),
+      import("./settings-E6H3AURD.js"),
+      import("./updateCheck-ZXRCGY66.js"),
+      import("./installationInfo-OFDYLDFD.js"),
+      import("./standalone-update-NYYZEHLD.js"),
       import("./stdioHelpers-HGIYTWAY.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
@@ -18708,7 +19034,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     disabledSlashCommands: disabledSlashCommands.length > 0 ? disabledSlashCommands : void 0,
     disabledSkillNamesProvider: bareMode || safeMode ? void 0 : disabledSkillNamesProvider,
     terminalImageRenderSupportProvider: interactive ? async () => {
-      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-NWC2RALG.js");
+      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-QRSCS2BE.js");
       return getTerminalImageRenderSupport();
     } : void 0,
     disabledSkillLevels: bareMode || safeMode || !Array.isArray(settings.skills?.disabledLevels) ? void 0 : settings.skills.disabledLevels.filter(isSkillLevel),
@@ -18984,11 +19310,11 @@ var ExtensionRefreshState = class {
   contentChangedDuringReload = false;
   suppressionDepth = 0;
   suppressUntil = 0;
-  on(event, listener) {
-    this.events.on(event, listener);
+  on(event2, listener) {
+    this.events.on(event2, listener);
   }
-  off(event, listener) {
-    this.events.off(event, listener);
+  off(event2, listener) {
+    this.events.off(event2, listener);
   }
   markExtensionsChanged(reason) {
     if (this.isSuppressed()) {