@qwen-code/qwen-code 0.21.5 → 0.21.6-preview.0

package/chunks/{chunk-GP4IMBX5.js → chunk-XOZ2R6XI.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   serveCommand
-} from "./chunk-SVIEVA3L.js";
+} from "./chunk-WPKIU4PA.js";
 import {
   listCommand
-} from "./chunk-ZLGPHA34.js";
+} from "./chunk-BU4BRCPX.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-VJPF6GF2.js";
+} from "./chunk-EHMN6SEG.js";
 import {
   ObservedChannelContactStore
 } from "./chunk-DYA25Y7U.js";
@@ -46,22 +46,22 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-VOA2UPZM.js";
+} from "./chunk-CDHNGCJI.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-3GOCVBYR.js";
+} from "./chunk-C4GRKMUL.js";
 import {
   collectProviderModelsForProtocol,
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-WU5NBSLD.js";
+} from "./chunk-6KEN3RIC.js";
 import {
   parseChannelConfig
-} from "./chunk-LEZFUYPM.js";
+} from "./chunk-7GYP5COR.js";
 import {
   findCliEntryPath
 } from "./chunk-V6WHFGST.js";
@@ -96,6 +96,9 @@ import {
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
+import {
+  EXTERNAL_TOOL_GUARD_TOKEN_ENV
+} from "./chunk-BKHCW2BI.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
@@ -128,29 +131,29 @@ import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-SJMCYCUQ.js";
+} from "./chunk-T4XY5CT4.js";
 import {
   loadSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-YUVTZ4UH.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-546CDN6D.js";
 import {
   loadEnvironment
-} from "./chunk-LYPXNRBX.js";
+} from "./chunk-IKXE3AAC.js";
 import {
   getCliVersion
-} from "./chunk-IZ2CMEYO.js";
+} from "./chunk-NKST54XA.js";
 import {
   getPackageJson
 } from "./chunk-VJNBRRZG.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-72DZPDH4.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -191,7 +194,7 @@ import {
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-DOA7MCDY.js";
 import {
   nextFireTime,
   parseCron
@@ -206,14 +209,14 @@ import {
 import {
   getAllGeminiMdFilenames,
   setGeminiMdFilename
-} from "./chunk-ZPGMDT4S.js";
+} from "./chunk-O656RSMC.js";
 import {
   SchemaValidator,
   ToolNames
 } from "./chunk-D7D7RXIJ.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
-} from "./chunk-XD2PNH3K.js";
+} from "./chunk-P7LKADIT.js";
 import {
   isTlsVerificationDisabled
 } from "./chunk-BFHXDAR7.js";
@@ -3585,6 +3588,7 @@ function scrubDaemonWorkerEnv() {
   delete process.env[QWEN_DAEMON_URL_ENV];
   delete process.env[QWEN_DAEMON_WORKSPACE_ENV];
   delete process.env[QWEN_SERVER_TOKEN_ENV];
+  delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
 }
 __name(scrubDaemonWorkerEnv, "scrubDaemonWorkerEnv");
 function readDaemonWorkerEnv() {
@@ -4547,12 +4551,12 @@ var parseArgsCommand = {
 
 // packages/cli/src/commands/review/compose-review.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname4, join as join9 } from "node:path";
 
 // packages/cli/src/commands/review/lib/coverage.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/transcripts.ts
 init_esbuild_shims();
@@ -6186,6 +6190,150 @@ If you find no new gap in your scope, say so **and name what you re-examined** \
   }
 };
 
+// packages/cli/src/commands/review/lib/deadline.ts
+init_esbuild_shims();
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+var DEADLINE_ENV = "QWEN_REVIEW_DEADLINE_EPOCH";
+var RESERVE_ENV = "QWEN_REVIEW_DEADLINE_RESERVE_SECONDS";
+var DEFAULT_RESERVE_SECONDS = 3600;
+var DEFAULT_ROUND_SECONDS = 1800;
+var MIN_OBSERVED_ROUND_SECONDS = 600;
+var STAMPS_FILE = "budget-rounds.json";
+var STOP_FILE = "budget-stop.json";
+var RUN_EPOCH_SLACK_MS = 2e3;
+function runEpochMs(planPath) {
+  try {
+    return statSync2(planPath).mtimeMs - RUN_EPOCH_SLACK_MS;
+  } catch {
+    return Number.NEGATIVE_INFINITY;
+  }
+}
+__name(runEpochMs, "runEpochMs");
+function readRoundStamps(planPath) {
+  try {
+    const raw = readFileSync7(
+      join8(promptRecordDir(planPath), STAMPS_FILE),
+      "utf8"
+    );
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    const epoch = runEpochMs(planPath);
+    return parsed.filter(
+      (e) => typeof e === "object" && e !== null && typeof e.atMs === "number" && e.atMs >= epoch
+    );
+  } catch {
+    return [];
+  }
+}
+__name(readRoundStamps, "readRoundStamps");
+function stampRound(planPath, round, nowMs = Date.now()) {
+  try {
+    const stamps = readRoundStamps(planPath);
+    if (round !== void 0 && stamps.some((s) => s.round === round)) return;
+    stamps.push({ round: round ?? null, atMs: nowMs });
+    const dir = promptRecordDir(planPath);
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync5(join8(dir, STAMPS_FILE), JSON.stringify(stamps));
+  } catch {
+  }
+}
+__name(stampRound, "stampRound");
+function expectedRoundSeconds(planPath, round, nowMs = Date.now()) {
+  const stamps = readRoundStamps(planPath);
+  for (let i = stamps.length - 1; i >= 0; i--) {
+    const s = stamps[i];
+    if (round !== void 0 && s.round === round) continue;
+    const observed = Math.round((nowMs - s.atMs) / 1e3);
+    return Math.max(MIN_OBSERVED_ROUND_SECONDS, observed);
+  }
+  return DEFAULT_ROUND_SECONDS;
+}
+__name(expectedRoundSeconds, "expectedRoundSeconds");
+function reverseAuditBudgetExhausted(env, roundCostSeconds, nowMs = Date.now()) {
+  const raw = env[DEADLINE_ENV];
+  if (raw === void 0 || raw.trim() === "") return null;
+  const deadline = Number(raw);
+  if (!Number.isFinite(deadline) || deadline <= 0) return null;
+  let reserve = DEFAULT_RESERVE_SECONDS;
+  const reserveRaw = env[RESERVE_ENV];
+  if (reserveRaw !== void 0 && reserveRaw.trim() !== "") {
+    const r = Number(reserveRaw);
+    if (Number.isFinite(r) && r >= 0) reserve = r;
+  }
+  const remainingSeconds = Math.floor(deadline - nowMs / 1e3);
+  if (remainingSeconds >= reserve + roundCostSeconds) return null;
+  return {
+    remainingSeconds,
+    reserveSeconds: reserve,
+    expectedRoundSeconds: roundCostSeconds
+  };
+}
+__name(reverseAuditBudgetExhausted, "reverseAuditBudgetExhausted");
+var BUDGET_STOP_PHRASE = "review time budget";
+function budgetStopDisclosure(round) {
+  const which = round !== void 0 ? `round ${round}` : "the next round";
+  const whichZh = round !== void 0 ? `\u7B2C ${round} \u8F6E` : "\u4E0B\u4E00\u8F6E";
+  return {
+    subject: "reverse audit",
+    reason: `stopped before ${which} by the ${BUDGET_STOP_PHRASE}`,
+    subjectZh: "\u53CD\u5411\u5BA1\u8BA1",
+    reasonZh: `\u8BC4\u5BA1\u65F6\u95F4\u9884\u7B97\u4E0D\u8DB3\uFF0C\u672A\u80FD\u5F00\u59CB${whichZh}`
+  };
+}
+__name(budgetStopDisclosure, "budgetStopDisclosure");
+function budgetStopEntry(round) {
+  const d = budgetStopDisclosure(round);
+  return `${d.subject} \u2014 ${d.reason}`;
+}
+__name(budgetStopEntry, "budgetStopEntry");
+function budgetStopEntryZh(round) {
+  const d = budgetStopDisclosure(round);
+  return `${d.subjectZh}\u2014\u2014${d.reasonZh}`;
+}
+__name(budgetStopEntryZh, "budgetStopEntryZh");
+function writeBudgetStop(planPath, spent, round, nowMs = Date.now()) {
+  try {
+    const dir = promptRecordDir(planPath);
+    mkdirSync5(dir, { recursive: true });
+    const stop = {
+      entry: budgetStopEntry(round),
+      entryZh: budgetStopEntryZh(round),
+      round: round ?? null,
+      remainingSeconds: spent.remainingSeconds,
+      reserveSeconds: spent.reserveSeconds,
+      atMs: nowMs
+    };
+    writeFileSync5(join8(dir, STOP_FILE), JSON.stringify(stop, null, 2));
+  } catch {
+  }
+}
+__name(writeBudgetStop, "writeBudgetStop");
+function readBudgetStop(planPath) {
+  try {
+    const raw = readFileSync7(
+      join8(promptRecordDir(planPath), STOP_FILE),
+      "utf8"
+    );
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || typeof parsed.entry !== "string" || typeof parsed.atMs !== "number" || parsed.atMs < runEpochMs(planPath)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+__name(readBudgetStop, "readBudgetStop");
+function reverseAuditBudgetMessage(spent, round) {
+  const minutesLeft = Math.max(0, Math.floor(spent.remainingSeconds / 60));
+  const reserveMinutes = Math.round(spent.reserveSeconds / 60);
+  const roundMinutes = Math.round(spent.expectedRoundSeconds / 60);
+  const which = round !== void 0 ? `round ${round}` : "the next round";
+  return `BUDGET: ${minutesLeft} minute(s) remain before this review's deadline \u2014 not enough for the ~${roundMinutes}-minute round being asked for plus the ${reserveMinutes}-minute reserve kept for its verification, compose-review and submission \u2014 so no further reverse-audit round will be built. This is the loop's termination rule, not an error: do not rebuild ${which} and do not relaunch auditors. A budget-stop marker has been recorded and compose-review will disclose it and cap the verdict itself; also add exactly this entry to unreviewedDimensions so the terminal report says it too \u2014 \`${budgetStopEntry(round)}\` \u2014 and proceed to Step 6 with the findings already confirmed. Spend what time remains only on verifying findings already in hand, composing, and submitting. A review that stops here still reports everything it proved; a review that runs past its deadline is killed holding all of it.`;
+}
+__name(reverseAuditBudgetMessage, "reverseAuditBudgetMessage");
+
 // packages/cli/src/commands/review/lib/shell-quote.ts
 init_esbuild_shims();
 function shellQuotePath(p) {
@@ -6195,7 +6343,7 @@ __name(shellQuotePath, "shellQuotePath");
 
 // packages/cli/src/commands/review/lib/coverage.ts
 function readPlan(path3) {
-  const plan = JSON.parse(readFileSync7(path3, "utf8"));
+  const plan = JSON.parse(readFileSync8(path3, "utf8"));
   if (typeof plan?.diffPathAbsolute !== "string" || !plan.diffPathAbsolute) {
     throw new Error(`coverage: ${path3} has no diffPathAbsolute`);
   }
@@ -6206,7 +6354,7 @@ function readPlan(path3) {
   if (problem) {
     throw new Error(`coverage: ${path3} has ${problem}`);
   }
-  return { plan, mtimeMs: statSync2(path3).mtimeMs };
+  return { plan, mtimeMs: statSync3(path3).mtimeMs };
 }
 __name(readPlan, "readPlan");
 var CHUNK_RE = /\bchunk\s+(\d+)\s+of\s+\d+\b/i;
@@ -6552,7 +6700,13 @@ function coverageFromTranscripts(planPath, env = process.env) {
   };
 }
 __name(coverageFromTranscripts, "coverageFromTranscripts");
-var rebuildFix = /* @__PURE__ */ __name((role, noun) => `build the prompt with \`"\${QWEN_CODE_CLI:-qwen}" review agent-prompt --plan <plan> --role ${role} --findings <file> [--rules <rules file>] [--round <k>]\` ` + (role === "reverse-audit" ? `(an early round with nothing confirmed passes an empty file; ` : `(pass the shard's findings, never an empty file \u2014 a verifier that sees no findings verifies nothing; `) + `pass --rules whenever the review loaded any, or the rebuilt brief silently drops the project rules) and launch an agent with EXACTLY what it prints \u2014 no hand-added ${noun} number` + // --round bakes in a ROUND number. Verify's noun is "shard", and a
+var rebuildFix = /* @__PURE__ */ __name((role, noun) => `build the prompt with \`"\${QWEN_CODE_CLI:-qwen}" review agent-prompt --plan <plan> --role ${role} --findings <file> [--rules <rules file>] ` + // --round is MANDATORY for a reverse-audit build (`agent-prompt` refuses a
+// round-less call — the label keys the record and the budget gate's
+// accounting), so the paste-and-run repair must not bracket it as optional:
+// an orchestrator honouring the bracket convention would have its first
+// repair attempt rejected. Verify genuinely takes it or not (only a repeat
+// verification round passes one), so its brackets stay.
+(role === "reverse-audit" ? `--round <k>\` ` : `[--round <k>]\` `) + (role === "reverse-audit" ? `(an early round with nothing confirmed passes an empty file; ` : `(pass the shard's findings, never an empty file \u2014 a verifier that sees no findings verifies nothing; `) + `pass --rules whenever the review loaded any, or the rebuilt brief silently drops the project rules) and launch an agent with EXACTLY what it prints \u2014 no hand-added ${noun} number` + // --round bakes in a ROUND number. Verify's noun is "shard", and a
 // parenthetical claiming --round bakes it in would send the reader to the
 // wrong flag — shards are already told apart by their findings digest.
 (role === "reverse-audit" ? ` (--round bakes it in)` : ``) + `, no summary of your own, no rewording`, "rebuildFix");
@@ -6667,7 +6821,9 @@ function verificationGaps(planPath, opts, env = process.env) {
     (k) => k === "reverse-audit" || k.startsWith("reverse-audit--")
   );
   const reverse = bestDelivery(reverseKeys);
-  const reverseGap = !balancedMedium && reverse !== "ok";
+  const budgetStopped = readBudgetStop(planPath) !== null;
+  const reverseByDesign = budgetStopped && reverse === "not-built";
+  const reverseGap = !balancedMedium && !reverseByDesign && reverse !== "ok";
   if (reverseGap) {
     remediation.push(
       `reverse audit: ${REVERSE_AUDIT_GAP[reverse].fix.replace(
@@ -6970,6 +7126,24 @@ function unmarkedComments(comments) {
 }
 __name(unmarkedComments, "unmarkedComments");
 
+// packages/cli/src/commands/review/lib/review-footer.ts
+init_esbuild_shims();
+var FOOTER_MARKER = "via Qwen Code /review";
+function reviewFooter(modelId, cliVersion) {
+  return `_\u2014 ${modelId} ${FOOTER_MARKER} (v${cliVersion})_`;
+}
+__name(reviewFooter, "reviewFooter");
+var REVIEW_FOOTER_RE = /\s*(?:_— (?:(?! via Qwen Code \/review)[^\n])* via Qwen Code \/review(?: \(v[^\n)]*\))?_?\s*)+$/;
+function isFooterSafeModelId(modelId) {
+  return !/[\n\r]/.test(modelId) && !modelId.includes(FOOTER_MARKER);
+}
+__name(isFooterSafeModelId, "isFooterSafeModelId");
+var FOOTER_VERSION_RE = /^[A-Za-z0-9._+-]+$/;
+function footerVersion(stamp) {
+  return stamp !== void 0 && FOOTER_VERSION_RE.test(stamp) ? stamp : void 0;
+}
+__name(footerVersion, "footerVersion");
+
 // packages/cli/src/commands/review/compose-review.ts
 var LOW_SIGNAL_SRC_DIFF_LINES = 100;
 function withMarker(line) {
@@ -6996,6 +7170,10 @@ function toStringList(value, field) {
   return [...value];
 }
 __name(toStringList, "toStringList");
+function stripReviewFooter(entry) {
+  return entry.replace(REVIEW_FOOTER_RE, "");
+}
+__name(stripReviewFooter, "stripReviewFooter");
 function toBool(value, field) {
   if (value === void 0 || value === null) return false;
   if (typeof value !== "boolean") {
@@ -7017,15 +7195,15 @@ __name(composeReview, "composeReview");
 function ledgerMarkerFor(input) {
   try {
     if (!input.planPath) return null;
-    const plan = JSON.parse(readFileSync8(input.planPath, "utf8"));
+    const plan = JSON.parse(readFileSync9(input.planPath, "utf8"));
     const pr = plan?.prNumber;
     const isPr = typeof pr === "number" && Number.isInteger(pr) && pr > 0 || typeof pr === "string" && /^\d+$/.test(pr);
     if (!isPr) return null;
     let prevRound = 0;
     try {
       const prev = JSON.parse(
-        readFileSync8(
-          join8(
+        readFileSync9(
+          join9(
             dirname4(input.planPath),
             `qwen-review-pr-${pr}-prev-ledger.json`
           ),
@@ -7040,7 +7218,7 @@ function ledgerMarkerFor(input) {
       buildLedger(
         prevRound + 1,
         input.draftedComments ?? [],
-        toStringList(input.bodyCriticals, "bodyCriticals")
+        toStringList(input.bodyCriticals, "bodyCriticals").map(stripReviewFooter).filter((entry) => entry.trim() !== "")
       )
     );
   } catch {
@@ -7054,7 +7232,7 @@ function composeReviewBody(input, cliVersion) {
     input.suggestionsInline,
     "suggestionsInline"
   );
-  const bodyCriticals = toStringList(input.bodyCriticals, "bodyCriticals");
+  const bodyCriticals = toStringList(input.bodyCriticals, "bodyCriticals").map(stripReviewFooter).filter((entry) => entry.trim() !== "");
   const suggestionsDiscarded = toCount(
     input.suggestionsDiscarded,
     "suggestionsDiscarded"
@@ -7062,7 +7240,7 @@ function composeReviewBody(input, cliVersion) {
   const cannotTell = toStringList(
     input.cannotTellCriticals,
     "cannotTellCriticals"
-  );
+  ).map(stripReviewFooter).filter((entry) => entry.trim() !== "");
   const uncoverable = toStringList(
     input.uncoverableChunks,
     "uncoverableChunks"
@@ -7072,6 +7250,19 @@ function composeReviewBody(input, cliVersion) {
     "unreviewedDimensions"
   );
   const coverageEntries = [];
+  let budgetEntry;
+  if (input.planPath) {
+    const stop = readBudgetStop(input.planPath);
+    if (stop !== null) {
+      for (let i = unreviewed.length - 1; i >= 0; i--) {
+        if (unreviewed[i].includes(BUDGET_STOP_PHRASE)) {
+          unreviewed.splice(i, 1);
+        }
+      }
+      budgetEntry = budgetStopDisclosure(stop.round ?? void 0);
+      coverageEntries.push(budgetEntry);
+    }
+  }
   const remediation = [];
   const planRef = input.planPath ? shellQuotePath(input.planPath) : "<plan>";
   const missingReceipts = [];
@@ -7231,6 +7422,11 @@ function composeReviewBody(input, cliVersion) {
       "compose-review: modelId is required (the public footer names the reviewing model)"
     );
   }
+  if (!isFooterSafeModelId(modelId)) {
+    throw new TypeError(
+      "compose-review: modelId is interpolated into the public footer verbatim \u2014 it must be a single line that does not contain the footer marker"
+    );
+  }
   const c = criticalsInline + bodyCriticals.length;
   const s = suggestionsInline + suggestionsDiscarded;
   const baseEvent = c >= 1 ? "REQUEST_CHANGES" : s >= 1 ? "COMMENT" : "APPROVE";
@@ -7264,7 +7460,7 @@ function composeReviewBody(input, cliVersion) {
   if (event2 === "APPROVE" && input.planPath) {
     try {
       const plan = JSON.parse(
-        readFileSync8(input.planPath, "utf8")
+        readFileSync9(input.planPath, "utf8")
       );
       const src = Number(plan.srcDiffLines ?? 0);
       if (src > LOW_SIGNAL_SRC_DIFF_LINES) {
@@ -7273,7 +7469,7 @@ function composeReviewBody(input, cliVersion) {
     } catch {
     }
   }
-  const footer = `_\u2014 ${modelId} via Qwen Code /review (v${cliVersion})_`;
+  const footer = reviewFooter(modelId, cliVersion);
   const bilingual = bilingualFromPlan(input.planPath, input.prBodyFetcher);
   const render = /* @__PURE__ */ __name((parts, sep5) => {
     const en = parts.map((p) => p.en).join(sep5);
@@ -7332,7 +7528,7 @@ ${footer}`;
     if (seenCaller.has(d)) continue;
     seenCaller.add(d);
     const echoesCoverage = covEntries.some(
-      (e) => d === e.subject || d.startsWith(`${e.subject} \u2014 `)
+      (e) => d === e.subject || e !== budgetEntry && d.startsWith(`${e.subject} \u2014 `)
     );
     if (!echoesCoverage) callerLeft.push(d);
   }
@@ -7556,7 +7752,7 @@ function scriptLintGate(planPath) {
   const disclosed = [];
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     unreviewed.push(
       "the executable-script lint \u2014 could not read the plan to check the gate"
@@ -7567,13 +7763,13 @@ function scriptLintGate(planPath) {
     return { criticals, unreviewed, disclosed };
   }
   const owed = hasExecutableScript(plan);
-  const reportPath = join8(
+  const reportPath = join9(
     dirname4(planPath),
     scriptLintReportName(plan.prNumber)
   );
   let report;
   try {
-    report = JSON.parse(readFileSync8(reportPath, "utf8"));
+    report = JSON.parse(readFileSync9(reportPath, "utf8"));
   } catch {
     if (owed) {
       unreviewed.push(
@@ -7629,7 +7825,7 @@ function testPlanGate(planPath) {
   const notes = [];
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     return { notes };
   }
@@ -7639,8 +7835,8 @@ function testPlanGate(planPath) {
   let report;
   try {
     report = JSON.parse(
-      readFileSync8(
-        join8(dirname4(planPath), `qwen-review-pr-${pr}-test-plan.json`),
+      readFileSync9(
+        join9(dirname4(planPath), `qwen-review-pr-${pr}-test-plan.json`),
         "utf8"
       )
     );
@@ -7673,7 +7869,7 @@ function bilingualFromPlan(planPath, fetchPrBody2 = fetchPrBodyViaGh) {
   if (!planPath) return false;
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     return false;
   }
@@ -7693,7 +7889,7 @@ __name(bilingualFromPlan, "bilingualFromPlan");
 function readDraftedComments(path3) {
   let raw;
   try {
-    raw = readFileSync8(path3, "utf8");
+    raw = readFileSync9(path3, "utf8");
   } catch (err) {
     throw new Error(
       `compose-review: cannot read the comments file ${path3}: ${err.message}. Pass the drafted inline comments \u2014 the same array the review payload will carry \u2014 or a file containing [] when nothing anchors inline.`
@@ -7747,7 +7943,7 @@ var composeReviewCommand = {
         "compose-review: --comments is required \u2014 the inline counts are counted from the drafted comments file, never typed. Pass a file containing [] when nothing anchors inline."
       );
     }
-    const raw = readFileSync8(input ?? 0, "utf8");
+    const raw = readFileSync9(input ?? 0, "utf8");
     const parsed = JSON.parse(raw);
     delete parsed.env;
     delete parsed.prBodyFetcher;
@@ -7764,7 +7960,9 @@ var composeReviewCommand = {
         ...countInlineFindings(drafted),
         draftedComments: drafted
       },
-      await getCliVersion()
+      // Same pin as `submit`: the startup stamp, not a version resolved at
+      // compose time — a shared runner can rewrite the install mid-session.
+      footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion()
     );
     const json = JSON.stringify(
       { ...result, verdictLine: verdictLine(result) },
@@ -7772,8 +7970,8 @@ var composeReviewCommand = {
       2
     );
     if (out) {
-      mkdirSync5(dirname4(out), { recursive: true });
-      writeFileSync5(out, json, "utf8");
+      mkdirSync6(dirname4(out), { recursive: true });
+      writeFileSync6(out, json, "utf8");
     }
     writeStdoutLine(json);
     for (const fix of result.remediation) {
@@ -7874,7 +8072,7 @@ __name(verdictLine, "verdictLine");
 
 // packages/cli/src/commands/review/findings.ts
 init_esbuild_shims();
-import { existsSync as existsSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "node:fs";
 import { dirname as dirname5, resolve as resolve5 } from "node:path";
 var SEVERITIES = ["Critical", "Suggestion", "Nice to have"];
 var CONFIDENCES = ["high", "low"];
@@ -8248,7 +8446,7 @@ __name(renderFindings, "renderFindings");
 function readJson(path3, what) {
   let text;
   try {
-    text = readFileSync9(resolve5(path3), "utf8");
+    text = readFileSync10(resolve5(path3), "utf8");
   } catch (err) {
     throw new Error(
       `Could not read the ${what} file at ${JSON.stringify(path3)}: ${err instanceof Error ? err.message : String(err)}`
@@ -8319,8 +8517,8 @@ var findingsCommand = {
     }
     const report = buildReport(findings);
     const target = resolve5(out);
-    mkdirSync6(dirname5(target), { recursive: true });
-    writeFileSync6(target, `${JSON.stringify(report, null, 2)}
+    mkdirSync7(dirname5(target), { recursive: true });
+    writeFileSync7(target, `${JSON.stringify(report, null, 2)}
 `, "utf8");
     const { bySeverity, byConfidence } = report.counts;
     writeStderrLine(
@@ -8351,7 +8549,7 @@ var findingsCommand = {
 // packages/cli/src/commands/review/fetch-pr.ts
 init_esbuild_shims();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname6, resolve as resolve6 } from "node:path";
 
 // packages/cli/src/commands/review/lib/git.ts
@@ -8459,11 +8657,11 @@ var LITERAL_PATHSPECS = "--literal-pathspecs";
 
 // packages/cli/src/commands/review/lib/effort.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 function resolveEffort(explicit) {
   if (explicit && EFFORT_LEVELS.has(explicit)) return explicit;
   try {
-    const parsed = JSON.parse(readFileSync10(PARSE_ARGS_REPORT, "utf8"));
+    const parsed = JSON.parse(readFileSync11(PARSE_ARGS_REPORT, "utf8"));
     if (typeof parsed.effort === "string" && EFFORT_LEVELS.has(parsed.effort)) {
       return parsed.effort;
     }
@@ -8484,7 +8682,7 @@ __name(planEffortField, "planEffortField");
 
 // packages/cli/src/commands/review/lib/report.ts
 init_esbuild_shims();
-import { statSync as statSync3 } from "node:fs";
+import { statSync as statSync4 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/heavy.ts
 init_esbuild_shims();
@@ -8587,7 +8785,7 @@ __name(buildPlanReport, "buildPlanReport");
 function warnOnReportSize(path3, cap) {
   let size = 0;
   try {
-    size = statSync3(path3).size;
+    size = statSync4(path3).size;
   } catch {
     return;
   }
@@ -8710,7 +8908,7 @@ async function runFetchPr(args) {
     );
   }
   try {
-    mkdirSync7(dirname6(wt), { recursive: true });
+    mkdirSync8(dirname6(wt), { recursive: true });
     git("worktree", "add", wt, ref);
   } catch (err) {
     tryRemove(
@@ -8720,7 +8918,7 @@ async function runFetchPr(args) {
       `Failed to create worktree at ${wt}: ${err.message}`
     );
   }
-  mkdirSync7(REVIEW_TMP_DIR, { recursive: true });
+  mkdirSync8(REVIEW_TMP_DIR, { recursive: true });
   const { sha: mergeBaseSha, baseFetchFailed } = resolveMergeBase(
     remote,
     meta.baseRefName,
@@ -8744,7 +8942,7 @@ async function runFetchPr(args) {
         ...PINNED_DIFF_FLAGS,
         `${mergeBaseSha}..${fetchedSha}`
       );
-      writeFileSync7(diffRel, buf);
+      writeFileSync8(diffRel, buf);
       diffText = buf.toString("utf8");
       diffPath = diffRel;
       diffPathAbsolute = resolve6(diffRel);
@@ -8771,7 +8969,7 @@ async function runFetchPr(args) {
   let auditSince = fetchedAt;
   let prevRaw = null;
   try {
-    prevRaw = readFileSync11(out, "utf8");
+    prevRaw = readFileSync12(out, "utf8");
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") {
@@ -8854,7 +9052,7 @@ async function runFetchPr(args) {
     ...buildPlanReport(plan, (path3) => fileLineCount(fetchedSha, path3)),
     ...planEffortField(args.effort)
   };
-  writeFileSync7(out, stringifyPlanReport(result), "utf8");
+  writeFileSync8(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote fetch-pr report to ${out}`);
   if (diffPath) writeStdoutLine(`Wrote review diff to ${diffPath}`);
   writeStderrLine(
@@ -8938,13 +9136,13 @@ var fetchPrCommand = {
 
 // packages/cli/src/commands/review/capture-local.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname7, resolve as resolve8 } from "node:path";
 
 // packages/cli/src/commands/review/lib/local-diff.ts
 init_esbuild_shims();
-import { lstatSync as lstatSync2, statSync as statSync4, realpathSync as realpathSync2 } from "node:fs";
-import { join as join9, relative as relative2, resolve as resolve7, isAbsolute as isAbsolute2, sep as sep2 } from "node:path";
+import { lstatSync as lstatSync2, statSync as statSync5, realpathSync as realpathSync2 } from "node:fs";
+import { join as join10, relative as relative2, resolve as resolve7, isAbsolute as isAbsolute2, sep as sep2 } from "node:path";
 var MAX_UNTRACKED_BYTES = 1e6;
 var MAX_UNTRACKED_FILES = 500;
 var MAX_UNTRACKED_TOTAL_BYTES = 1e7;
@@ -8965,7 +9163,7 @@ function describeUndiffable(abs, st) {
   }
   if (st.isSymbolicLink()) {
     try {
-      return statSync4(abs).isDirectory() ? "is a symlink to a directory \u2014 git cannot diff it as a file" : null;
+      return statSync5(abs).isDirectory() ? "is a symlink to a directory \u2014 git cannot diff it as a file" : null;
     } catch {
       return null;
     }
@@ -9070,7 +9268,7 @@ function captureLocalDiff(opts) {
       for (const path3 of candidates) {
         let bytes;
         try {
-          const abs = join9(repoRoot, path3);
+          const abs = join10(repoRoot, path3);
           const st = lstatSync2(abs);
           const kind = describeUndiffable(abs, st);
           if (kind) {
@@ -9162,10 +9360,10 @@ function runCaptureLocal(args) {
     includeUntracked: args.untracked
   });
   const diffText = capture.diff.toString("utf8");
-  mkdirSync8(REVIEW_TMP_DIR, { recursive: true });
-  mkdirSync8(dirname7(resolve8(out)), { recursive: true });
+  mkdirSync9(REVIEW_TMP_DIR, { recursive: true });
+  mkdirSync9(dirname7(resolve8(out)), { recursive: true });
   const diffPath = tmpFile(target, "diff.txt");
-  writeFileSync8(diffPath, capture.diff);
+  writeFileSync9(diffPath, capture.diff);
   const plan = buildDiffPlan(diffText);
   const result = {
     diffPath,
@@ -9178,7 +9376,7 @@ function runCaptureLocal(args) {
     skippedFiles: capture.skipped,
     ...planEffortField(args.effort)
   };
-  writeFileSync8(out, stringifyPlanReport(result), "utf8");
+  writeFileSync9(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote diff to ${diffPath} and plan to ${out}`);
   if (capture.unbornHead) {
     writeStderrLine(
@@ -9236,13 +9434,13 @@ var captureLocalCommand = {
 
 // packages/cli/src/commands/review/plan-diff.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 function runPlanDiff(args) {
   const { diff_path: diffPath, out } = args;
   let diffText;
   try {
-    diffText = readFileSync12(diffPath, "utf8");
+    diffText = readFileSync13(diffPath, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read diff file ${diffPath}: ${err.message}`
@@ -9269,8 +9467,8 @@ function runPlanDiff(args) {
     ...buildPlanReport(plan, null),
     ...planEffortField(args.effort)
   };
-  mkdirSync9(REVIEW_TMP_DIR, { recursive: true });
-  writeFileSync9(out, stringifyPlanReport(result), "utf8");
+  mkdirSync10(REVIEW_TMP_DIR, { recursive: true });
+  writeFileSync10(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote diff plan to ${out}`);
   if (plan.diffLines === 0) {
     writeStderrLine(
@@ -9316,8 +9514,8 @@ var planDiffCommand = {
 
 // packages/cli/src/commands/review/pr-context.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname8, join as join11 } from "node:path";
 var SUMMARY_MARKER = "<!-- qwen-review-suggestion-summary -->";
 function isLegacySuggestionSummary(body) {
   return (body ?? "").includes(SUMMARY_MARKER);
@@ -9795,9 +9993,9 @@ async function runPrContext(args) {
   }
   if (prevLedger) {
     try {
-      mkdirSync10(dirname8(out), { recursive: true });
-      writeFileSync10(
-        join10(dirname8(out), `qwen-review-pr-${prNumber}-prev-ledger.json`),
+      mkdirSync11(dirname8(out), { recursive: true });
+      writeFileSync11(
+        join11(dirname8(out), `qwen-review-pr-${prNumber}-prev-ledger.json`),
         JSON.stringify(prevLedger, null, 2)
       );
     } catch {
@@ -9812,8 +10010,8 @@ async function runPrContext(args) {
     reviews,
     prevLedger
   );
-  mkdirSync10(dirname8(out), { recursive: true });
-  writeFileSync10(out, md, "utf8");
+  mkdirSync11(dirname8(out), { recursive: true });
+  writeFileSync11(out, md, "utf8");
   const meaningfulReviewCount = reviews.filter(
     (r) => isReviewWorthShowing(stripLedgerMarker(r.body ?? ""))
   ).length;
@@ -9867,7 +10065,7 @@ var prContextCommand = {
 
 // packages/cli/src/commands/review/comment-status.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 var TOUCHED_BY_CAP = 10;
 function buildThreadStatuses(comments, prAuthor, probe) {
@@ -10073,9 +10271,9 @@ async function runCommentStatus(args) {
       summary,
       threads
     };
-    mkdirSync11(dirname9(out), { recursive: true });
+    mkdirSync12(dirname9(out), { recursive: true });
     const json = JSON.stringify(report, null, 2) + "\n";
-    writeFileSync11(out, json, "utf8");
+    writeFileSync12(out, json, "utf8");
     writeStdoutLine(
       `Wrote comment-status report to ${out} (${comments.length} inline comments in ${summary.threads} threads: ${summary.outdated} outdated, ${summary.blockers} blocker(s), ${summary.changedSinceComment} on files changed since their comment, ${summary.withReplies} with replies, ${summary.authorReplied} answered by the PR author)`
     );
@@ -10103,8 +10301,8 @@ async function runCommentStatus(args) {
     writeStdoutLine(
       `warning: comment-status failed: ${msg}. It is an index, not the evidence \u2014 re-derive thread statuses per-comment if needed.`
     );
-    mkdirSync11(dirname9(out), { recursive: true });
-    writeFileSync11(
+    mkdirSync12(dirname9(out), { recursive: true });
+    writeFileSync12(
       out,
       JSON.stringify(
         {
@@ -10166,7 +10364,7 @@ var commentStatusCommand = {
 
 // packages/cli/src/commands/review/load-rules.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "node:fs";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname10 } from "node:path";
 function showFile(baseRef, path3) {
   return gitOpt("show", `${baseRef}:${path3}`);
@@ -10247,8 +10445,8 @@ __name(loadCombined, "loadCombined");
 async function runLoadRules(args) {
   const { base_ref: baseRef, out } = args;
   const { combined, loaded } = loadCombined(baseRef);
-  mkdirSync12(dirname10(out), { recursive: true });
-  writeFileSync12(out, combined, "utf8");
+  mkdirSync13(dirname10(out), { recursive: true });
+  writeFileSync13(out, combined, "utf8");
   if (loaded.length === 0) {
     writeStdoutLine(
       `No review rules found on ${baseRef}; wrote empty file to ${out}`
@@ -10279,7 +10477,7 @@ var loadRulesCommand = {
 
 // packages/cli/src/commands/review/presubmit.ts
 init_esbuild_shims();
-import { writeFileSync as writeFileSync13, readFileSync as readFileSync13 } from "node:fs";
+import { writeFileSync as writeFileSync14, readFileSync as readFileSync14 } from "node:fs";
 function verdictStamp(run4) {
   return run4.completed_at ?? run4.started_at ?? "";
 }
@@ -10315,7 +10513,7 @@ __name(isCurrentActionsRunCheck, "isCurrentActionsRunCheck");
 function parseFindingsFile(path3) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(path3, "utf8"));
+    parsed = JSON.parse(readFileSync14(path3, "utf8"));
   } catch {
     return null;
   }
@@ -10618,7 +10816,7 @@ async function runPresubmit(args) {
     findingsFileInvalid,
     headDrift
   };
-  writeFileSync13(outPath, JSON.stringify(result, null, 2) + "\n", "utf8");
+  writeFileSync14(outPath, JSON.stringify(result, null, 2) + "\n", "utf8");
   writeStdoutLine(`Wrote presubmit report to ${outPath}`);
 }
 __name(runPresubmit, "runPresubmit");
@@ -10657,17 +10855,17 @@ var presubmitCommand = {
 // packages/cli/src/commands/review/publish-assets.ts
 init_esbuild_shims();
 import { createHash as createHash2 } from "node:crypto";
-import { readFileSync as readFileSync15, statSync as statSync5, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14 } from "node:fs";
+import { readFileSync as readFileSync16, statSync as statSync6, writeFileSync as writeFileSync15, mkdirSync as mkdirSync15 } from "node:fs";
 import { basename as basename5, dirname as dirname11, resolve as resolve10 } from "node:path";
 
 // packages/cli/src/commands/review/lib/authorization.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 
 // packages/cli/src/services/skill-args-file.ts
 init_esbuild_shims();
 import {
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync14,
   openSync as openSync2,
   writeSync,
   closeSync as closeSync2,
@@ -10676,9 +10874,9 @@ import {
   existsSync as existsSync5,
   constants
 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var debugLogger3 = createDebugLogger("SKILL_ARGS_FILE");
-var SKILL_ARGS_DIR = join11(".qwen", "tmp");
+var SKILL_ARGS_DIR = join12(".qwen", "tmp");
 function safe(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "_");
 }
@@ -10688,11 +10886,11 @@ function currentSessionId() {
 }
 __name(currentSessionId, "currentSessionId");
 function skillArgsDir(sessionId = currentSessionId()) {
-  return sessionId ? join11(SKILL_ARGS_DIR, `s-${safe(sessionId)}`) : SKILL_ARGS_DIR;
+  return sessionId ? join12(SKILL_ARGS_DIR, `s-${safe(sessionId)}`) : SKILL_ARGS_DIR;
 }
 __name(skillArgsDir, "skillArgsDir");
 function skillArgsPath(skillName, sessionId = currentSessionId()) {
-  return join11(
+  return join12(
     skillArgsDir(sessionId),
     `qwen-skill-args-${safe(skillName)}.txt`
   );
@@ -10702,7 +10900,7 @@ function writeSkillArgs(skillName, args) {
   const path3 = skillArgsPath(skillName);
   try {
     const dir = skillArgsDir();
-    mkdirSync13(dir, { recursive: true });
+    mkdirSync14(dir, { recursive: true });
     if (lstatSync3(dir).isSymbolicLink()) {
       debugLogger3.warn(
         `Skill args directory ${dir} is a symlink; refusing to write through it.`
@@ -10785,7 +10983,7 @@ function reviewWriteAuthorization(req) {
   const path3 = currentSessionId() === "" && req.skillArgs ? req.skillArgs : sessionScoped;
   let raw;
   try {
-    raw = readFileSync14(path3, "utf8");
+    raw = readFileSync15(path3, "utf8");
   } catch {
     return {
       ok: false,
@@ -11051,7 +11249,7 @@ function runPublishAssets(args) {
   const fileList = [...args.files ?? []];
   if (args.findings) {
     try {
-      const artifact = JSON.parse(readFileSync15(resolve10(args.findings), "utf8"));
+      const artifact = JSON.parse(readFileSync16(resolve10(args.findings), "utf8"));
       findings = validateFindings(
         Array.isArray(artifact) ? artifact : artifact.findings
       );
@@ -11081,7 +11279,7 @@ function runPublishAssets(args) {
   for (const file of unique) {
     const abs = resolve10(file);
     try {
-      const st = statSync5(abs);
+      const st = statSync6(abs);
       if (!st.isFile()) throw new Error("not a regular file");
       stats.push({ file, abs, basename: basename5(abs), bytes: st.size });
     } catch (err) {
@@ -11100,7 +11298,7 @@ function runPublishAssets(args) {
   for (const st of stats) {
     let content;
     try {
-      content = readFileSync15(st.abs);
+      content = readFileSync16(st.abs);
     } catch (err) {
       refuse(
         `cannot read ${JSON.stringify(st.file)}: ${err instanceof Error ? err.message : String(err)}`
@@ -11147,8 +11345,8 @@ function runPublishAssets(args) {
     published
   };
   const outPath = resolve10(args.out);
-  mkdirSync14(dirname11(outPath), { recursive: true });
-  writeFileSync14(outPath, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync15(dirname11(outPath), { recursive: true });
+  writeFileSync15(outPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   if (findings && !args.findingsOut) {
     writeStderrLine(
@@ -11163,8 +11361,8 @@ function runPublishAssets(args) {
     });
     const report = buildReport(updated);
     const fOut = resolve10(args.findingsOut);
-    mkdirSync14(dirname11(fOut), { recursive: true });
-    writeFileSync14(fOut, `${JSON.stringify(report, null, 2)}
+    mkdirSync15(dirname11(fOut), { recursive: true });
+    writeFileSync15(fOut, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   writeStderrLine(
@@ -11226,7 +11424,7 @@ var publishAssetsCommand = {
 
 // packages/cli/src/commands/review/resolve-anchors.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync15, mkdirSync as mkdirSync15 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync16, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname12, resolve as resolve11 } from "node:path";
 
 // packages/cli/src/commands/review/lib/anchors.ts
@@ -11451,7 +11649,7 @@ __name(validateRequests, "validateRequests");
 function runResolveAnchors(args) {
   let diffText;
   try {
-    diffText = readFileSync16(args.diff, "utf8");
+    diffText = readFileSync17(args.diff, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read diff file ${args.diff}: ${err.message}`
@@ -11459,7 +11657,7 @@ function runResolveAnchors(args) {
   }
   let rawText;
   try {
-    rawText = readFileSync16(args.input, "utf8");
+    rawText = readFileSync17(args.input, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read findings file ${args.input}: ${err.message}`
@@ -11490,8 +11688,8 @@ function runResolveAnchors(args) {
       loose: resolved.filter((r) => r.tier?.startsWith("loose")).length
     }
   };
-  mkdirSync15(dirname12(resolve11(args.out)), { recursive: true });
-  writeFileSync15(args.out, JSON.stringify(report, null, 2), "utf8");
+  mkdirSync16(dirname12(resolve11(args.out)), { recursive: true });
+  writeFileSync16(args.out, JSON.stringify(report, null, 2), "utf8");
   writeStdoutLine(`Wrote resolved anchors to ${args.out}`);
   const s = report.stats;
   writeStderrLine(
@@ -11538,7 +11736,7 @@ var resolveAnchorsCommand = {
 
 // packages/cli/src/commands/review/check-coverage.ts
 init_esbuild_shims();
-import { writeFileSync as writeFileSync16, mkdirSync as mkdirSync16 } from "node:fs";
+import { writeFileSync as writeFileSync17, mkdirSync as mkdirSync17 } from "node:fs";
 import { dirname as dirname13, resolve as resolve12 } from "node:path";
 function runCheckCoverage(args) {
   let report;
@@ -11555,8 +11753,8 @@ This is an environment problem, not a finding about the agents. Coverage cannot
     }
     throw err;
   }
-  mkdirSync16(dirname13(resolve12(args.out)), { recursive: true });
-  writeFileSync16(args.out, JSON.stringify(report, null, 2));
+  mkdirSync17(dirname13(resolve12(args.out)), { recursive: true });
+  writeFileSync17(args.out, JSON.stringify(report, null, 2));
   writeStdoutLine(`Wrote coverage report to ${args.out}`);
   const totalChunks = report.coveredChunks.length + report.missingChunks.length + report.uncoverableChunks.length;
   const worked = report.agents - report.blindAgents.length - report.idleAgents.length;
@@ -11655,8 +11853,8 @@ var checkCoverageCommand = {
 // packages/cli/src/commands/review/agent-prompt.ts
 init_esbuild_shims();
 import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname14, join as join12, resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { dirname as dirname14, join as join13, resolve as resolve13 } from "node:path";
 
 // packages/cli/src/commands/review/lib/path-rules.ts
 init_esbuild_shims();
@@ -12108,7 +12306,7 @@ function buildRoleBrief(report, role, opts = {}) {
         "agent-prompt: --role 0 needs a plan with `prNumber` and `ownerRepo` (the report `fetch-pr` writes). Issue fidelity has nothing to check against without a pull request."
       );
     }
-    const ctx = opts.planPath ? join12(dirname14(resolve13(opts.planPath)), `qwen-review-pr-${pr}-context.md`) : null;
+    const ctx = opts.planPath ? join13(dirname14(resolve13(opts.planPath)), `qwen-review-pr-${pr}-context.md`) : null;
     parts.push(
       "",
       `**This PR:** #${pr} of \`${repo}\`. Use exactly that number and repo \u2014 a bare \`gh pr view\` falls back to the current branch's PR and would judge this diff against an unrelated issue.`
@@ -12367,7 +12565,7 @@ The \`description\` parameter of each Agent call is the task name the user watch
   );
 }
 __name(runRoster, "runRoster");
-function runAllChunks(report, planPath, role, findingsContent, rules, round) {
+function requireAuditableChunks(report) {
   if (!Array.isArray(report.chunks) || report.chunks.length === 0) {
     throw new Error("agent-prompt: the plan has no `chunks[]`.");
   }
@@ -12378,6 +12576,11 @@ function runAllChunks(report, planPath, role, findingsContent, rules, round) {
       `agent-prompt: the plan has ${problem} \u2014 a round built from what remains would look complete while a territory goes unaudited. Re-run the Step 1 capture; do not hand-edit the plan.`
     );
   }
+  return chunks;
+}
+__name(requireAuditableChunks, "requireAuditableChunks");
+function runAllChunks(report, planPath, role, findingsContent, rules, round) {
+  const chunks = requireAuditableChunks(report);
   const digest = findingsDigest(findingsContent, rules);
   const roundPart = round !== void 0 ? `--round-${round}` : "";
   const blocks = chunks.map((c, i) => {
@@ -12483,6 +12686,11 @@ function runAgentPrompt(args) {
         );
       }
     }
+    if (role === "reverse-audit" && !hasRound) {
+      bad(
+        "--role reverse-audit builds one round of the Step 5 loop and requires --round <k>: the label keys the record and the budget gate's per-round accounting."
+      );
+    }
   } else if (hasFindings) {
     const findingRoles = Object.keys(BRIEFS).filter(
       (r) => BRIEFS[r].acceptsFindings
@@ -12513,7 +12721,7 @@ function runAgentPrompt(args) {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync17(args.plan, "utf8"));
+    report = JSON.parse(readFileSync18(args.plan, "utf8"));
   } catch (err) {
     throw new Error(
       `agent-prompt: cannot read the plan ${args.plan}: ${err.message}`
@@ -12522,7 +12730,7 @@ function runAgentPrompt(args) {
   let rules;
   if (args.rules) {
     try {
-      rules = readFileSync17(args.rules, "utf8");
+      rules = readFileSync18(args.rules, "utf8");
     } catch (err) {
       throw new Error(
         `agent-prompt: cannot read the rules ${args.rules}: ${err.message}. Omit --rules if this review has none; passing a path that does not resolve would silently review without the project rules it was told to enforce.`
@@ -12537,7 +12745,7 @@ function runAgentPrompt(args) {
   if (hasFindings && args.role) {
     const role = args.role;
     try {
-      findingsContent = readFileSync17(args.findings, "utf8");
+      findingsContent = readFileSync18(args.findings, "utf8");
     } catch (err) {
       throw new Error(
         `agent-prompt: cannot read the findings ${args.findings}: ${err.message}. Pass a path that resolves \u2014 --findings is required for this role, so omitting it only fails one guard earlier. An early reverse-audit round with nothing confirmed passes an empty file (create it first).`
@@ -12549,6 +12757,21 @@ function runAgentPrompt(args) {
       );
     }
   }
+  if (args.allChunks && args.role && findingsContent !== void 0) {
+    requireAuditableChunks(report);
+  }
+  if (args.role === "reverse-audit") {
+    const spent = reverseAuditBudgetExhausted(
+      process.env,
+      expectedRoundSeconds(args.plan, args.round)
+    );
+    if (spent !== null) {
+      writeBudgetStop(args.plan, spent, args.round);
+      writeStderrLine(reverseAuditBudgetMessage(spent, args.round));
+      process.exitCode = 4;
+      return;
+    }
+  }
   if (args.allChunks && args.role && findingsContent !== void 0) {
     runAllChunks(
       report,
@@ -12558,6 +12781,9 @@ function runAgentPrompt(args) {
       rules,
       args.round
     );
+    if (args.role === "reverse-audit") {
+      stampRound(args.plan, args.round);
+    }
     return;
   }
   let prompt;
@@ -12588,11 +12814,14 @@ function runAgentPrompt(args) {
   const printed = findingsContent !== void 0 && args.role ? foldFindings(args.role, findingsContent, prompt) : prompt;
   recordPrompt(args.plan, key, printed);
   writeStdoutLine(printed);
+  if (args.role === "reverse-audit") {
+    stampRound(args.plan, args.round);
+  }
 }
 __name(runAgentPrompt, "runAgentPrompt");
 var agentPromptCommand = {
   command: "agent-prompt",
-  describe: "Build a review agent's launch prompt from the plan (the diff path, its line ranges and the agent's own brief are welded in, not left to the caller to remember)",
+  describe: "Build a review agent's launch prompt from the plan (the diff path, its line ranges and the agent's own brief are welded in, not left to the caller to remember). Exit codes: 0 built; 4 the review time budget refused another reverse-audit round (a termination rule, not an error \u2014 see the BUDGET line on stderr); anything else is a bad call or a broken plan.",
   builder: /* @__PURE__ */ __name((yargs) => yargs.option("plan", {
     type: "string",
     demandOption: true,
@@ -12647,17 +12876,17 @@ init_esbuild_shims();
 import { spawnSync as spawnSync2 } from "node:child_process";
 import {
   existsSync as existsSync7,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   rmSync as rmSync5,
   statfsSync,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "node:fs";
-import { join as join14, resolve as resolve14 } from "node:path";
+import { join as join15, resolve as resolve14 } from "node:path";
 
 // packages/cli/src/commands/review/lib/workspaces.ts
 init_esbuild_shims();
-import { existsSync as existsSync6, readFileSync as readFileSync18, readdirSync as readdirSync4 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync19, readdirSync as readdirSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 function isWorkspaceMember(filePath, workspaceGlobs) {
   return workspaceDirFor(filePath, workspaceGlobs) !== null;
 }
@@ -12695,7 +12924,7 @@ __name(hasUnmodeledWorkspaceGlob, "hasUnmodeledWorkspaceGlob");
 function readWorkspaceGlobs(root) {
   try {
     const pkg = JSON.parse(
-      readFileSync18(join13(root, "package.json"), "utf8")
+      readFileSync19(join14(root, "package.json"), "utf8")
     );
     const ws = pkg.workspaces;
     const globs = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
@@ -12708,7 +12937,7 @@ __name(readWorkspaceGlobs, "readWorkspaceGlobs");
 function readRootPackage(root) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(join13(root, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync19(join14(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -12732,7 +12961,7 @@ function readWorkspacePackages(root) {
       const base = g.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync4(join13(root, base), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+        entries = readdirSync4(join14(root, base), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
       } catch {
         continue;
       }
@@ -12744,11 +12973,11 @@ function readWorkspacePackages(root) {
   const pkgs = [];
   for (const dir of dirs) {
     if (workspaceDirFor(`${dir}/package.json`, globs) !== dir) continue;
-    const manifest = join13(root, dir, "package.json");
+    const manifest = join14(root, dir, "package.json");
     if (!existsSync6(manifest)) continue;
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync18(manifest, "utf8"));
+      pkg = JSON.parse(readFileSync19(manifest, "utf8"));
     } catch {
       continue;
     }
@@ -12921,7 +13150,7 @@ __name(unresolvedWorkspaceDeps, "unresolvedWorkspaceDeps");
 function changedFilesFrom(planPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync19(planPath, "utf8"));
+    parsed = JSON.parse(readFileSync20(planPath, "utf8"));
   } catch (err) {
     throw new Error(
       `build-test: cannot read the plan ${planPath}: ${err.message}`
@@ -13004,15 +13233,15 @@ function runBuildTest(args) {
     timedOut: [],
     note: ""
   };
-  const npmLock = existsSync7(join14(root, "package-lock.json"));
-  const installComplete = /* @__PURE__ */ __name(() => existsSync7(join14(root, "node_modules", ".package-lock.json")), "installComplete");
-  if (args.install && !npmLock && !existsSync7(join14(root, "node_modules"))) {
+  const npmLock = existsSync7(join15(root, "package-lock.json"));
+  const installComplete = /* @__PURE__ */ __name(() => existsSync7(join15(root, "node_modules", ".package-lock.json")), "installComplete");
+  if (args.install && !npmLock && !existsSync7(join15(root, "node_modules"))) {
     const altLock = [
       ["yarn.lock", "yarn install --frozen-lockfile"],
       ["pnpm-lock.yaml", "pnpm install --frozen-lockfile"],
       ["bun.lockb", "bun install --frozen-lockfile"],
       ["bun.lock", "bun install --frozen-lockfile"]
-    ].find(([f]) => existsSync7(join14(root, f)));
+    ].find(([f]) => existsSync7(join15(root, f)));
     return unsupportedReport(
       altLock ? `This is a ${altLock[0]} repo with no installed \`node_modules\`, so \`npm ci\` cannot install it. Run \`${altLock[1]}\` first, then fall back to the build/test precedence in your brief, each command with a deadline it can meet.` : "There is no lockfile and no `node_modules` here, so nothing can be installed deterministically. Install dependencies first, then fall back to the build/test precedence in your brief."
     );
@@ -13030,7 +13259,7 @@ function runBuildTest(args) {
     if (install.timedOut) results.timedOut.push(install.command);
     if (install.timedOut) {
       try {
-        rmSync5(join14(root, "node_modules"), {
+        rmSync5(join15(root, "node_modules"), {
           recursive: true,
           force: true,
           maxRetries: 3
@@ -13153,7 +13382,7 @@ var buildTestCommand = {
     try {
       const report = runBuildTest(args);
       if (args.out) {
-        writeFileSync17(args.out, JSON.stringify(report, null, 2));
+        writeFileSync18(args.out, JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
     } catch (err) {
@@ -13168,13 +13397,13 @@ init_esbuild_shims();
 import { spawnSync as spawnSync4 } from "node:child_process";
 import {
   existsSync as existsSync8,
-  mkdirSync as mkdirSync17,
-  readFileSync as readFileSync20,
+  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync21,
   rmSync as rmSync7,
-  statSync as statSync6,
-  writeFileSync as writeFileSync18
+  statSync as statSync7,
+  writeFileSync as writeFileSync19
 } from "node:fs";
-import { dirname as dirname15, join as join15, resolve as resolve15 } from "node:path";
+import { dirname as dirname15, join as join16, resolve as resolve15 } from "node:path";
 
 // packages/cli/src/commands/review/lib/worktree.ts
 init_esbuild_shims();
@@ -13221,7 +13450,7 @@ function runBaseTree(args) {
   }), "unavailable");
   let plan;
   try {
-    plan = JSON.parse(readFileSync20(args.plan, "utf8"));
+    plan = JSON.parse(readFileSync21(args.plan, "utf8"));
   } catch (err) {
     return unavailable(
       `cannot read the plan ${args.plan}: ${err.message}`
@@ -13243,10 +13472,10 @@ function runBaseTree(args) {
     return unavailable(`the review worktree ${worktree} does not exist`);
   }
   const tree = baseWorktreePath(worktree);
-  const marker = /* @__PURE__ */ __name(() => join15(tree, ".qwen-review-base-ok"), "marker");
-  const failedMarker = /* @__PURE__ */ __name(() => join15(tree, ".qwen-review-base-failed"), "failedMarker");
+  const marker = /* @__PURE__ */ __name(() => join16(tree, ".qwen-review-base-ok"), "marker");
+  const failedMarker = /* @__PURE__ */ __name(() => join16(tree, ".qwen-review-base-failed"), "failedMarker");
   try {
-    if (existsSync8(tree) && readFileSync20(marker(), "utf8").trim() === baseSha && gitOut(tree, "rev-parse", "HEAD") === baseSha) {
+    if (existsSync8(tree) && readFileSync21(marker(), "utf8").trim() === baseSha && gitOut(tree, "rev-parse", "HEAD") === baseSha) {
       return {
         available: true,
         path: tree,
@@ -13258,7 +13487,7 @@ function runBaseTree(args) {
   } catch {
   }
   try {
-    if (existsSync8(tree) && readFileSync20(failedMarker(), "utf8").trim() === baseSha) {
+    if (existsSync8(tree) && readFileSync21(failedMarker(), "utf8").trim() === baseSha) {
       return {
         available: false,
         path: tree,
@@ -13271,14 +13500,14 @@ function runBaseTree(args) {
   }
   const lock = `${tree}.lock`;
   try {
-    const age = Date.now() - statSync6(lock).mtimeMs;
+    const age = Date.now() - statSync7(lock).mtimeMs;
     if (age > 30 * 60 * 1e3) {
       rmSync7(lock, { recursive: true, force: true });
     }
   } catch {
   }
   try {
-    mkdirSync17(lock);
+    mkdirSync18(lock);
   } catch (err) {
     if (err.code !== "EEXIST") {
       return unavailable(
@@ -13316,7 +13545,7 @@ function runBaseTree(args) {
     });
     if (!build.ok || build.toolchain !== "npm" || build.build.length === 0) {
       try {
-        writeFileSync18(failedMarker(), `${baseSha2}
+        writeFileSync19(failedMarker(), `${baseSha2}
 `);
       } catch {
       }
@@ -13329,7 +13558,7 @@ function runBaseTree(args) {
       };
     }
     try {
-      writeFileSync18(marker(), `${baseSha2}
+      writeFileSync19(marker(), `${baseSha2}
 `);
     } catch {
     }
@@ -13369,8 +13598,8 @@ var baseTreeCommand = {
     try {
       const report = runBaseTree(args);
       if (args.out) {
-        mkdirSync17(dirname15(resolve15(args.out)), { recursive: true });
-        writeFileSync18(resolve15(args.out), JSON.stringify(report, null, 2));
+        mkdirSync18(dirname15(resolve15(args.out)), { recursive: true });
+        writeFileSync19(resolve15(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`base-tree: ${report.note}`);
@@ -13384,7 +13613,7 @@ var baseTreeCommand = {
 // packages/cli/src/commands/review/test-delta.ts
 init_esbuild_shims();
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync20 } from "node:fs";
 import { dirname as dirname16, resolve as resolve16 } from "node:path";
 var ANSI_SGR_RE2 = /\x1b\[[0-9;]*m/g;
 var RERUNNABLE_COMMAND_RE = /^npm test(?: --workspace="[\w@./-]+")?$/;
@@ -13458,7 +13687,7 @@ function runTestDelta(args) {
   }), "empty");
   let report;
   try {
-    report = JSON.parse(readFileSync21(args.report, "utf8"));
+    report = JSON.parse(readFileSync22(args.report, "utf8"));
   } catch (err) {
     return empty(
       `cannot read the build-test report ${args.report}: ${err.message}`
@@ -13600,8 +13829,8 @@ var testDeltaCommand = {
     const args = argv;
     const report = runTestDelta(args);
     if (args.out) {
-      mkdirSync18(dirname16(resolve16(args.out)), { recursive: true });
-      writeFileSync19(resolve16(args.out), JSON.stringify(report, null, 2));
+      mkdirSync19(dirname16(resolve16(args.out)), { recursive: true });
+      writeFileSync20(resolve16(args.out), JSON.stringify(report, null, 2));
     }
     writeStdoutLine(JSON.stringify(report, null, 2));
     writeStderrLine(`test-delta: ${report.note}`);
@@ -13612,14 +13841,14 @@ var testDeltaCommand = {
 init_esbuild_shims();
 import { spawnSync as spawnSync6 } from "node:child_process";
 import {
-  mkdirSync as mkdirSync19,
-  writeFileSync as writeFileSync20,
-  readFileSync as readFileSync22,
+  mkdirSync as mkdirSync20,
+  writeFileSync as writeFileSync21,
+  readFileSync as readFileSync23,
   existsSync as existsSync10,
   rmSync as rmSync8,
-  statSync as statSync7
+  statSync as statSync8
 } from "node:fs";
-import { dirname as dirname17, join as join16, resolve as resolve17 } from "node:path";
+import { dirname as dirname17, join as join17, resolve as resolve17 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 var SERVER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 function shellQuote(v) {
@@ -13631,7 +13860,7 @@ var LOG_MAX_BYTES = 8 * 1024 * 1024;
 var POLL_MS = 250;
 function logBytes(p) {
   try {
-    return statSync7(p).size;
+    return statSync8(p).size;
   } catch {
     return 0;
   }
@@ -13737,13 +13966,13 @@ function runDrive(args) {
       waitMs(POLL_MS);
     }
   }
-  const dir = join16(tmpdir2(), `qwen-review-drive-${server}`);
-  mkdirSync19(dir, { recursive: true });
-  const scriptPath = join16(dir, "drive.sh");
-  const logPath = args.logPath ?? join16(dir, "drive.log");
-  const sentinelPath = join16(dir, "drive.rc");
+  const dir = join17(tmpdir2(), `qwen-review-drive-${server}`);
+  mkdirSync20(dir, { recursive: true });
+  const scriptPath = join17(dir, "drive.sh");
+  const logPath = args.logPath ?? join17(dir, "drive.log");
+  const sentinelPath = join17(dir, "drive.rc");
   rmSync8(sentinelPath, { force: true });
-  writeFileSync20(scriptPath, wrapScript(args.script, sentinelPath), "utf8");
+  writeFileSync21(scriptPath, wrapScript(args.script, sentinelPath), "utf8");
   const droveFrom = Date.now();
   let output = "";
   let exitCode = null;
@@ -13773,8 +14002,8 @@ function runDrive(args) {
     }
     const deadline = droveFrom + args.timeout * 1e3;
     for (; ; ) {
-      output = existsSync10(logPath) ? readFileSync22(logPath, "utf8") : "";
-      exitCode = existsSync10(sentinelPath) ? sentinelExitCode(readFileSync22(sentinelPath, "utf8")) : null;
+      output = existsSync10(logPath) ? readFileSync23(logPath, "utf8") : "";
+      exitCode = existsSync10(sentinelPath) ? sentinelExitCode(readFileSync23(sentinelPath, "utf8")) : null;
       if (exitCode !== null) {
         outcome = "completed";
         break;
@@ -13841,8 +14070,8 @@ var driveCommand = {
       const args = argv;
       const report = runDrive(args);
       if (args.out) {
-        mkdirSync19(dirname17(resolve17(args.out)), { recursive: true });
-        writeFileSync20(resolve17(args.out), JSON.stringify(report, null, 2));
+        mkdirSync20(dirname17(resolve17(args.out)), { recursive: true });
+        writeFileSync21(resolve17(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`drive: ${report.note}`);
@@ -13859,7 +14088,7 @@ init_esbuild_shims();
 import {
   createServer
 } from "node:http";
-import { appendFileSync, mkdirSync as mkdirSync20, writeFileSync as writeFileSync21 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync21, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname18, resolve as resolve18 } from "node:path";
 import { pathToFileURL } from "node:url";
 function messagesText(body) {
@@ -14116,8 +14345,8 @@ async function startMockProvider(args, respondOverride) {
     respond = fn;
   }
   const logPath = resolve18(args.log);
-  mkdirSync20(dirname18(logPath), { recursive: true });
-  writeFileSync21(logPath, "");
+  mkdirSync21(dirname18(logPath), { recursive: true });
+  writeFileSync22(logPath, "");
   let n = 0;
   const record = /* @__PURE__ */ __name((entry) => appendFileSync(logPath, `${JSON.stringify(entry)}
 `), "record");
@@ -14279,8 +14508,8 @@ var mockProviderCommand = {
       const args = argv;
       const { report, close } = await startMockProvider(args);
       if (args.out) {
-        mkdirSync20(dirname18(resolve18(args.out)), { recursive: true });
-        writeFileSync21(resolve18(args.out), JSON.stringify(report, null, 2));
+        mkdirSync21(dirname18(resolve18(args.out)), { recursive: true });
+        writeFileSync22(resolve18(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`mock-provider: ${report.note}`);
@@ -14298,7 +14527,7 @@ var mockProviderCommand = {
 // packages/cli/src/commands/review/extract-step.ts
 init_esbuild_shims();
 var import_yaml = __toESM(require_dist(), 1);
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync23, writeFileSync as writeFileSync22, chmodSync } from "node:fs";
+import { mkdirSync as mkdirSync22, readFileSync as readFileSync24, writeFileSync as writeFileSync23, chmodSync } from "node:fs";
 import { dirname as dirname19, resolve as resolve19 } from "node:path";
 function expressionsOf(...texts) {
   const seen = /* @__PURE__ */ new Set();
@@ -14546,7 +14775,7 @@ function runExtractStep(args) {
   const wfPath = resolve19(args.workflow);
   let text;
   try {
-    text = readFileSync23(wfPath, "utf8");
+    text = readFileSync24(wfPath, "utf8");
   } catch (err) {
     throw new Error(
       `extract-step: cannot read ${args.workflow}: ${err.message}`
@@ -14613,7 +14842,7 @@ function runExtractStep(args) {
   const script = step.run;
   const stepLabel = String(step.name ?? step.id ?? index);
   const outPath = resolve19(args.out);
-  mkdirSync21(dirname19(outPath), { recursive: true });
+  mkdirSync22(dirname19(outPath), { recursive: true });
   const header = [
     `#!/usr/bin/env ${shellCommand}`,
     ...commentLines(
@@ -14637,7 +14866,7 @@ function runExtractStep(args) {
     ),
     ""
   ].join("\n");
-  writeFileSync22(outPath, header + script + (script.endsWith("\n") ? "" : "\n"));
+  writeFileSync23(outPath, header + script + (script.endsWith("\n") ? "" : "\n"));
   chmodSync(outPath, 493);
   return {
     workflow: args.workflow,
@@ -14698,7 +14927,7 @@ var extractStepCommand = {
 
 // packages/cli/src/commands/review/submit.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync22, readFileSync as readFileSync24 } from "node:fs";
+import { mkdirSync as mkdirSync23, readFileSync as readFileSync25 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/receipt.ts
 init_esbuild_shims();
@@ -14720,7 +14949,7 @@ __name(parseReceiptIds, "parseReceiptIds");
 var EVENTS = /* @__PURE__ */ new Set(["APPROVE", "REQUEST_CHANGES", "COMMENT"]);
 function readReceiptIds(receiptPath) {
   try {
-    return parseReceiptIds(readFileSync24(receiptPath, "utf8"));
+    return parseReceiptIds(readFileSync25(receiptPath, "utf8"));
   } catch {
     return [];
   }
@@ -14730,6 +14959,24 @@ function isDiffLine(n) {
   return typeof n === "number" && Number.isSafeInteger(n) && n > 0;
 }
 __name(isDiffLine, "isDiffLine");
+function normalizeInlineComments(comments, modelId, cliVersion) {
+  if (typeof modelId !== "string" || modelId.trim() === "") return comments;
+  const footer = reviewFooter(modelId, cliVersion);
+  return comments.map(
+    (comment) => (
+      // An empty body stays empty: this runs BEFORE the consistency check, and
+      // a footer pasted onto '' would hide the emptiness from the refusal that
+      // names it ('has no body — an empty comment').
+      typeof comment.body === "string" && comment.body.trim() !== "" ? {
+        ...comment,
+        body: `${comment.body.replace(REVIEW_FOOTER_RE, "")}
+
+${footer}`
+      } : comment
+    )
+  );
+}
+__name(normalizeInlineComments, "normalizeInlineComments");
 function authorization(args) {
   return reviewWriteAuthorization({
     userAuthorized: args.userAuthorized,
@@ -14775,6 +15022,18 @@ __name(compose, "compose");
 function structuralProblems(payload) {
   const problems = [];
   if (!payload.commit_id) problems.push("`commit_id` is missing");
+  if (payload.comments !== void 0 && !Array.isArray(payload.comments)) {
+    problems.push(
+      "`comments` is not an array \u2014 it is the list of findings this post carries; any other shape is not a list of findings."
+    );
+  }
+  if (Array.isArray(payload.comments) && payload.comments.some(
+    (c) => c === null || typeof c !== "object"
+  )) {
+    problems.push(
+      "`comments` entries must each be an object \u2014 a finding is a path, a line and a body; any other shape is not a finding."
+    );
+  }
   if (payload.event !== void 0 || payload.body !== void 0) {
     problems.push(
       "the payload carries `event`/`body`. Those are computed here, from `state` and from the comments you attached \u2014 they are not inputs. Remove them. (A run that skipped `compose-review` and typed its own Approve is exactly what this refuses.)"
@@ -14855,7 +15114,7 @@ function runSubmit(args, cliVersion = "unknown") {
   }
   let payload;
   try {
-    payload = JSON.parse(readFileSync24(args.review, "utf8"));
+    payload = JSON.parse(readFileSync25(args.review, "utf8"));
   } catch (err) {
     throw new Error(
       `Cannot read review JSON ${args.review}: ${err.message}`
@@ -14880,6 +15139,14 @@ Posting is a public, irreversible write, and this run has no authorisation for o
 ` + structural.map((p) => `  - ${p}`).join("\n")
     );
   }
+  payload = {
+    ...payload,
+    comments: normalizeInlineComments(
+      payload.comments ?? [],
+      payload.state?.modelId,
+      cliVersion
+    )
+  };
   let event2;
   let body;
   let cappedBy;
@@ -14931,7 +15198,7 @@ Posting is a public, irreversible write, and this run has no authorisation for o
       const receiptPath = tmpFile(`pr-${args.pr}`, "submit-receipt.json");
       const priorIds = readReceiptIds(receiptPath);
       const reviewIds = [.../* @__PURE__ */ new Set([...priorIds, reviewId])];
-      mkdirSync22(REVIEW_TMP_DIR, { recursive: true });
+      mkdirSync23(REVIEW_TMP_DIR, { recursive: true });
       atomicWriteFileSync(
         receiptPath,
         `${JSON.stringify({ reviewIds, event: event2, postedAt: (/* @__PURE__ */ new Date()).toISOString() })}
@@ -14988,7 +15255,8 @@ var submitCommand = {
     describe: "Check authorisation and payload consistency, then stop."
   }), "builder"),
   handler: /* @__PURE__ */ __name(async (argv) => {
-    runSubmit(argv, await getCliVersion());
+    const cliVersion = footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion();
+    runSubmit(argv, cliVersion);
   }, "handler")
 };
 
@@ -14996,18 +15264,18 @@ var submitCommand = {
 init_esbuild_shims();
 import { spawnSync as spawnSync7 } from "node:child_process";
 import {
-  mkdirSync as mkdirSync23,
+  mkdirSync as mkdirSync24,
   readdirSync as readdirSync5,
-  writeFileSync as writeFileSync23,
-  readFileSync as readFileSync25,
+  writeFileSync as writeFileSync24,
+  readFileSync as readFileSync26,
   rmSync as rmSync9,
   lstatSync as lstatSync4,
   existsSync as existsSync11,
-  statSync as statSync8,
+  statSync as statSync9,
   symlinkSync
 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname20, join as join17, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
+import { dirname as dirname20, join as join18, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
 var FIXTURE_DIR_RE = /(^|\/)(__fixtures__|__mocks__|__snapshots__|fixtures)\//;
 function planTestEfficacy(files, workspaceGlobs) {
   const tests = files.filter((f) => f.kind === "test").map((f) => f.path);
@@ -15530,23 +15798,24 @@ function gitOut2(cwd, ...args) {
   return (r.stdout ?? "").trim();
 }
 __name(gitOut2, "gitOut");
-function findVitestBin(worktree) {
-  const req = createRequire(join17(worktree, "noop.js"));
+function findVitestBin(worktree, resolveModule = createRequire(
+  join18(worktree, "noop.js")
+).resolve) {
   let pkgPath;
   try {
-    pkgPath = req.resolve("vitest/package.json");
+    pkgPath = resolveModule("vitest/package.json");
   } catch (error) {
     if (error.code === "MODULE_NOT_FOUND") {
       throw new Error(`vitest not found searching up from ${worktree}`);
     }
     throw error;
   }
-  const pkg = JSON.parse(readFileSync25(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync26(pkgPath, "utf8"));
   const bin = pkg.bin?.vitest;
   if (!bin) {
     throw new Error(`vitest package at ${pkgPath} declares no "vitest" bin`);
   }
-  return join17(dirname20(pkgPath), bin);
+  return join18(dirname20(pkgPath), bin);
 }
 __name(findVitestBin, "findVitestBin");
 function gitCapture(cwd, ...args) {
@@ -15572,7 +15841,7 @@ function safeRmWithin(worktree, relPath) {
   const parts = relPath.split(/[/\\]+/).filter((s) => s && s !== ".");
   let cur = worktree;
   for (let i = 0; i < parts.length; i++) {
-    cur = join17(cur, parts[i]);
+    cur = join18(cur, parts[i]);
     let st;
     try {
       st = lstatSync4(cur);
@@ -15597,15 +15866,15 @@ __name(probeCleanupFailureDetail, "probeCleanupFailureDetail");
 function exposeDependencies(probeTree, dependencyRoot) {
   const done = { linked: 0, failed: 0 };
   if (probeTree === dependencyRoot) return done;
-  const source = join17(dependencyRoot, "node_modules");
-  const target = join17(probeTree, "node_modules");
+  const source = join18(dependencyRoot, "node_modules");
+  const target = join18(probeTree, "node_modules");
   if (!existsSync11(source) || existsSync11(target)) return done;
-  mkdirSync23(target);
+  mkdirSync24(target);
   const linkType = process.platform === "win32" ? "junction" : "dir";
   for (const entry of readdirSync5(source, { withFileTypes: true })) {
     if (entry.name === ".vite" || entry.name === ".vite-temp") continue;
-    const sourceEntry = join17(source, entry.name);
-    const targetEntry = join17(target, entry.name);
+    const sourceEntry = join18(source, entry.name);
+    const targetEntry = join18(target, entry.name);
     let sourceStats;
     try {
       sourceStats = lstatSync4(sourceEntry);
@@ -15615,7 +15884,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
     }
     if (sourceStats.isSymbolicLink()) {
       try {
-        if (!statSync8(sourceEntry).isDirectory()) continue;
+        if (!statSync9(sourceEntry).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -15625,7 +15894,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
     if (entry.name.startsWith("@")) {
       let pkgs;
       try {
-        mkdirSync23(targetEntry);
+        mkdirSync24(targetEntry);
         pkgs = readdirSync5(sourceEntry);
       } catch {
         done.failed++;
@@ -15633,7 +15902,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
       }
       for (const pkg of pkgs) {
         try {
-          symlinkSync(join17(sourceEntry, pkg), join17(targetEntry, pkg), linkType);
+          symlinkSync(join18(sourceEntry, pkg), join18(targetEntry, pkg), linkType);
           done.linked++;
         } catch {
           done.failed++;
@@ -15779,10 +16048,10 @@ function newSideLength(header) {
 __name(newSideLength, "newSideLength");
 function runOneHunkProbe(probeTree, hunk, probes, deadlineAt, now = Date.now) {
   const { patch: _patch, ...meta } = hunk;
-  const abs = join17(probeTree, hunk.file);
+  const abs = join18(probeTree, hunk.file);
   let original;
   try {
-    original = readFileSync25(abs, "utf8");
+    original = readFileSync26(abs, "utf8");
   } catch (e) {
     return {
       ...meta,
@@ -15808,21 +16077,21 @@ function runOneHunkProbe(probeTree, hunk, probes, deadlineAt, now = Date.now) {
     const detail = verdict === "killed" ? "the suite went red with this hunk reverted \u2014 a test covers this change" : verdict === "survived" ? "every affected test still PASSED with this hunk reverted \u2014 no test in this diff fails when the change is undone" : "the tree with this hunk reverted produced no clean verdict (likely a compile or import error) \u2014 not evidence either way";
     return { ...meta, verdict, detail };
   } finally {
-    mkdirSync23(dirname20(abs), { recursive: true });
-    writeFileSync23(abs, original, "utf8");
+    mkdirSync24(dirname20(abs), { recursive: true });
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runOneHunkProbe, "runOneHunkProbe");
 function runControlMutant(probeTree, probeFile, deadlineAt, now = Date.now) {
-  const abs = join17(probeTree, probeFile);
+  const abs = join18(probeTree, probeFile);
   let original;
   try {
-    original = readFileSync25(abs, "utf8");
+    original = readFileSync26(abs, "utf8");
   } catch {
     return null;
   }
   try {
-    writeFileSync23(
+    writeFileSync24(
       abs,
       `${original}
 ;import { it as __qcIt, expect as __qcExpect } from 'vitest';
@@ -15835,13 +16104,13 @@ __qcIt('QWEN-REVIEW-POSITIVE-CONTROL', () => {
     const { perFile } = runProbeSuite(probeTree, [probeFile], deadlineAt, now);
     return perFile.some((r) => r.verdict === "gated");
   } finally {
-    writeFileSync23(abs, original, "utf8");
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runControlMutant, "runControlMutant");
 function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dependencyRoot = probeTree) {
-  const abs = join17(probeTree, mutant.file);
-  const original = readFileSync25(abs, "utf8");
+  const abs = join18(probeTree, mutant.file);
+  const original = readFileSync26(abs, "utf8");
   const lines2 = original.split("\n");
   if ((lines2[mutant.line - 1] ?? "").trim() !== mutant.statement) {
     return {
@@ -15857,7 +16126,7 @@ function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dep
     lines2.splice(mutant.line - 1, 1);
   }
   try {
-    writeFileSync23(abs, lines2.join("\n"), "utf8");
+    writeFileSync24(abs, lines2.join("\n"), "utf8");
     const { perFile } = runProbeSuite(
       probeTree,
       probes,
@@ -15869,7 +16138,7 @@ function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dep
     const detail = verdict === "killed" ? `the suite went red with this statement ${what} \u2014 a test catches it` : verdict === "survived" ? `every affected test still PASSED with this statement ${what} \u2014 no test fails ${mutant.mutated === void 0 ? "when it is removed" : "when it changes"}` : "the mutated tree produced no clean verdict (likely a compile or import error) \u2014 not evidence either way";
     return { ...mutant, verdict, detail };
   } finally {
-    writeFileSync23(abs, original, "utf8");
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runOneMutant, "runOneMutant");
@@ -15908,9 +16177,9 @@ async function runTestEfficacy(args) {
   const now = args.now ?? Date.now;
   const startedAt = now();
   const { report, worktree, base, out } = args;
-  const plan = JSON.parse(readFileSync25(report, "utf8"));
+  const plan = JSON.parse(readFileSync26(report, "utf8"));
   const rootPkg = JSON.parse(
-    readFileSync25(`${worktree}/package.json`, "utf8")
+    readFileSync26(`${worktree}/package.json`, "utf8")
   );
   const globs = rootPkg.workspaces ?? [];
   const { unreachable, probes, revert } = planTestEfficacy(
@@ -15918,8 +16187,8 @@ async function runTestEfficacy(args) {
     globs
   );
   for (const p of revert) {
-    const norm = join17(worktree, p);
-    const root = join17(worktree, ".");
+    const norm = join18(worktree, p);
+    const root = join18(worktree, ".");
     if (isAbsolute3(p) || norm !== root && !norm.startsWith(root + sep3)) {
       throw new Error(
         `refusing to run: revert path escapes the worktree: ${JSON.stringify(p)}`
@@ -16290,8 +16559,8 @@ async function runTestEfficacy(args) {
     findings,
     cleanupFailure
   };
-  mkdirSync23(dirname20(out), { recursive: true });
-  writeFileSync23(out, JSON.stringify(result, null, 2), "utf8");
+  mkdirSync24(dirname20(out), { recursive: true });
+  writeFileSync24(out, JSON.stringify(result, null, 2), "utf8");
   writeStdoutLine(
     `Wrote test-efficacy report to ${out} (${unreachable.length} unreachable, ${results.length} probed, ${mutantResults.length} mutant(s), ${hunkResults.length} hunk probe(s), ${findings.length} finding(s))`
   );
@@ -16368,8 +16637,8 @@ var testEfficacyCommand = {
 
 // packages/cli/src/commands/review/test-plan.ts
 init_esbuild_shims();
-import { existsSync as existsSync12, mkdirSync as mkdirSync24, readFileSync as readFileSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { dirname as dirname21, join as join18, normalize, resolve as resolve20 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync25, readFileSync as readFileSync27, writeFileSync as writeFileSync25 } from "node:fs";
+import { dirname as dirname21, join as join19, normalize, resolve as resolve20 } from "node:path";
 var PLAN_NAME_RE = /(test\s*plan|\btesting\b|how\s+(?:has\s+this|to)\s+(?:been\s+)?test(?:ed)?|测试计划|测试方案|测试步骤)/i;
 var HEADING_LINE_RE = /^(#{1,6})(?:[ \t](.*))?$/;
 var BOLD_LINE_RE = /^\*\*([^*\n]+)\*\*:?\s*$/;
@@ -16572,7 +16841,7 @@ function rulePath(text, worktree, changed) {
     };
   }
   const ignored = isGitIgnored(worktree, path3);
-  if (existsSync12(join18(worktree, path3))) {
+  if (existsSync12(join19(worktree, path3))) {
     return {
       kind: "path",
       text,
@@ -16643,7 +16912,7 @@ function ruleCommand(text, worktree, buildTest) {
   let rootScripts = [];
   try {
     const rootPkg = JSON.parse(
-      readFileSync26(join18(worktree, "package.json"), "utf8")
+      readFileSync27(join19(worktree, "package.json"), "utf8")
     );
     rootScripts = Object.keys(rootPkg.scripts ?? {});
   } catch {
@@ -16721,7 +16990,7 @@ __name(fetchPrBody, "fetchPrBody");
 function runTestPlan(args, fetchBody = fetchPrBody) {
   let plan;
   try {
-    plan = JSON.parse(readFileSync26(args.plan, "utf8"));
+    plan = JSON.parse(readFileSync27(args.plan, "utf8"));
   } catch (err) {
     throw new Error(
       `test-plan: cannot read the plan ${args.plan}: ${err.message}`
@@ -16756,7 +17025,7 @@ function runTestPlan(args, fetchBody = fetchPrBody) {
   if (args.buildTest) {
     try {
       buildTest = JSON.parse(
-        readFileSync26(args.buildTest, "utf8")
+        readFileSync27(args.buildTest, "utf8")
       );
     } catch {
       buildTest = null;
@@ -16813,8 +17082,8 @@ var testPlanCommand = {
     try {
       const report = runTestPlan(args);
       if (args.out) {
-        mkdirSync24(dirname21(resolve20(args.out)), { recursive: true });
-        writeFileSync24(resolve20(args.out), JSON.stringify(report, null, 2));
+        mkdirSync25(dirname21(resolve20(args.out)), { recursive: true });
+        writeFileSync25(resolve20(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`test-plan: ${report.note}`);
@@ -16828,8 +17097,8 @@ var testPlanCommand = {
 // packages/cli/src/commands/review/cleanup.ts
 init_esbuild_shims();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync27, readdirSync as readdirSync6, rmSync as rmSync10 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync28, readdirSync as readdirSync6, rmSync as rmSync10 } from "node:fs";
+import { join as join20 } from "node:path";
 var AUTOMATION_MARKER = "<!-- qwen-";
 function isAutomationComment(body) {
   return (body ?? "").trimStart().startsWith(AUTOMATION_MARKER);
@@ -16860,7 +17129,7 @@ var OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 function readAuditWindow(target, expectedPrNumber) {
   let raw;
   try {
-    raw = readFileSync27(tmpFile(target, "fetch.json"), "utf8");
+    raw = readFileSync28(tmpFile(target, "fetch.json"), "utf8");
   } catch (err) {
     const code = err.code;
     return code === "ENOENT" ? { skip: "no fetch report" } : {
@@ -16907,7 +17176,7 @@ function readSubmitReceipt(target) {
   try {
     return new Set(
       parseReceiptIds(
-        readFileSync27(tmpFile(target, "submit-receipt.json"), "utf8")
+        readFileSync28(tmpFile(target, "submit-receipt.json"), "utf8")
       )
     );
   } catch {
@@ -17042,7 +17311,7 @@ function runCleanup(target) {
   }
   for (const file of tmpEntries) {
     if (!file.startsWith(prefix)) continue;
-    const full = join19(REVIEW_TMP_DIR, file);
+    const full = join20(REVIEW_TMP_DIR, file);
     try {
       rmSync10(full, { recursive: true, force: true });
       writeStdoutLine(`Removed temp file: ${full}`);
@@ -17076,8 +17345,8 @@ var cleanupCommand = {
 // packages/cli/src/commands/review/run.ts
 init_esbuild_shims();
 import { spawn, execFileSync as execFileSync6 } from "node:child_process";
-import { readdirSync as readdirSync7, readFileSync as readFileSync28, realpathSync as realpathSync3, statSync as statSync9 } from "node:fs";
-import { dirname as dirname22, join as join20, resolve as resolve21 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync29, realpathSync as realpathSync3, statSync as statSync10 } from "node:fs";
+import { dirname as dirname22, join as join21, resolve as resolve21 } from "node:path";
 var COMPOSED_PATTERN = /^qwen-review-.*composed\.json$/;
 var COMPOSED_POLL_MS = 250;
 var SIGNAL_EXIT_CODES = {
@@ -17111,10 +17380,10 @@ function newestArtifactSince(dir, pattern, startMs) {
   }
   for (const name of names) {
     if (!pattern.test(name)) continue;
-    const path3 = join20(dir, name);
+    const path3 = join21(dir, name);
     let mtime;
     try {
-      mtime = statSync9(path3).mtimeMs;
+      mtime = statSync10(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -17132,7 +17401,7 @@ function exitCodeFor(completed, event2, failOn) {
 __name(exitCodeFor, "exitCodeFor");
 function readComposed(path3) {
   try {
-    const parsed = JSON.parse(readFileSync28(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync29(path3, "utf8"));
     return typeof parsed.event === "string" ? parsed : null;
   } catch {
     return null;
@@ -17368,14 +17637,14 @@ init_esbuild_shims();
 import {
   existsSync as existsSync14,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync25,
-  readFileSync as readFileSync29,
-  statSync as statSync10
+  mkdirSync as mkdirSync26,
+  readFileSync as readFileSync30,
+  statSync as statSync11
 } from "node:fs";
 import {
   dirname as dirname23,
   isAbsolute as isAbsolute4,
-  join as join21,
+  join as join22,
   relative as relative3,
   resolve as resolve22,
   sep as sep4,
@@ -17405,7 +17674,7 @@ function rejectSymlinkPath(root, path3, label2) {
   const rel = relative3(root, path3);
   let current = root;
   for (const segment of rel.split(sep4)) {
-    current = join21(current, segment);
+    current = join22(current, segment);
     if (existsSync14(current) && lstatSync5(current).isSymbolicLink()) {
       throw new Error(`${label2} must not traverse a symbolic link.`);
     }
@@ -17415,14 +17684,14 @@ __name(rejectSymlinkPath, "rejectSymlinkPath");
 function sameFile(left, right) {
   if (left === right) return true;
   if (!existsSync14(left) || !existsSync14(right)) return false;
-  const leftStat = statSync10(left);
-  const rightStat = statSync10(right);
+  const leftStat = statSync11(left);
+  const rightStat = statSync11(right);
   return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
 }
 __name(sameFile, "sameFile");
 function readText(path3, label2) {
   try {
-    return readFileSync29(path3, "utf8");
+    return readFileSync30(path3, "utf8");
   } catch (error) {
     throw new Error(
       `Could not read the ${label2} file at ${JSON.stringify(path3)}: ${error instanceof Error ? error.message : String(error)}`
@@ -17589,7 +17858,7 @@ function saveReviewArtifact(args) {
   const verdict = validateVerdict(readJson2(composedPath, "composed verdict"));
   let reportIsFile;
   try {
-    reportIsFile = statSync10(reportPath).isFile();
+    reportIsFile = statSync11(reportPath).isFile();
   } catch {
   }
   if (reportIsFile === false) {
@@ -17609,7 +17878,7 @@ function saveReviewArtifact(args) {
     outcomesRecorded: findings.outcomesRecorded,
     markdownReportPath
   };
-  mkdirSync25(dirname23(outputPath), { recursive: true });
+  mkdirSync26(dirname23(outputPath), { recursive: true });
   atomicWriteFileSync(
     toNamespacedPath(outputPath),
     `${JSON.stringify(document, null, 2)}
@@ -17864,10 +18133,10 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-E6H3AURD.js"),
-      import("./updateCheck-ZXRCGY66.js"),
-      import("./installationInfo-OFDYLDFD.js"),
-      import("./standalone-update-NYYZEHLD.js"),
+      import("./settings-NX4EUIE6.js"),
+      import("./updateCheck-FDAVGOFT.js"),
+      import("./installationInfo-AEGIIQAT.js"),
+      import("./standalone-update-ICW7H5IF.js"),
       import("./stdioHelpers-HGIYTWAY.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
@@ -18713,7 +18982,7 @@ var SessionIdConflictError = class extends Error {
     this.sessionId = sessionId;
   }
 };
-async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtensions, hooksConfig, disabledSkillNamesProvider, sessionMcpServers, settingsWatcher, throwOnSessionIdConflict = false) {
+async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtensions, hooksConfig, disabledSkillNamesProvider, sessionMcpServers, settingsWatcher, throwOnSessionIdConflict = false, hostPolicy) {
   const debugMode = isDebugMode(argv);
   if (debugMode && process.env["QWEN_DEBUG_LOG_FILE"] === void 0) {
     process.env["QWEN_DEBUG_LOG_FILE"] = "1";
@@ -19034,7 +19303,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     disabledSlashCommands: disabledSlashCommands.length > 0 ? disabledSlashCommands : void 0,
     disabledSkillNamesProvider: bareMode || safeMode ? void 0 : disabledSkillNamesProvider,
     terminalImageRenderSupportProvider: interactive ? async () => {
-      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-QRSCS2BE.js");
+      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-PW6Z6VFY.js");
       return getTerminalImageRenderSupport();
     } : void 0,
     disabledSkillLevels: bareMode || safeMode || !Array.isArray(settings.skills?.disabledLevels) ? void 0 : settings.skills.disabledLevels.filter(isSkillLevel),
@@ -19051,6 +19320,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
       deny: mergedDeny.length > 0 ? mergedDeny : void 0,
       autoMode: bareMode || safeMode ? void 0 : settings.permissions?.autoMode
     },
+    toolInvocationGuard: hostPolicy?.toolInvocationGuard,
     // Permission rule persistence callback (writes to settings files).
     onPersistPermissionRule: /* @__PURE__ */ __name(async (scope, ruleType, rule) => {
       const currentSettings = loadSettings(cwd);