@qwen-code/qwen-code 0.21.5 → 0.21.6-preview.0

package/chunks/{acpAgent-MRPYN6FH.js → acpAgent-V54T2EEL.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   recomputeMcpGating
-} from "./chunk-YMUZQ3MQ.js";
+} from "./chunk-RTWF7FF7.js";
 import {
   classifyApiError,
   fireSessionDeleteHook
@@ -16,14 +16,14 @@ import {
   matchMcpServerByRef,
   parseExtensionRef,
   parseMcpServerRef
-} from "./chunk-JDNWIXHJ.js";
+} from "./chunk-PQTK2FVO.js";
 import {
   getAvailableCommands,
   handleSlashCommand,
   insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-IWYXZAGT.js";
+} from "./chunk-QWUYFMAR.js";
 import {
   SessionIdConflictError,
   appEvents,
@@ -31,23 +31,27 @@ import {
   cleanupReviewWorktreeLeases,
   loadCliConfig,
   normalizeDisabledToolList
-} from "./chunk-GP4IMBX5.js";
+} from "./chunk-XOZ2R6XI.js";
 import "./chunk-NYX53SV4.js";
 import {
   collectContextData,
   formatContextUsageText
-} from "./chunk-4NNR24EP.js";
+} from "./chunk-ZH7G3A4U.js";
 import {
   getCommandSubcommandNames
-} from "./chunk-G2UXFO2B.js";
+} from "./chunk-IISDPZ5X.js";
 import {
   getEffectiveSupportedModes
-} from "./chunk-C6ARWPCG.js";
+} from "./chunk-AVDEBBMI.js";
 import "./chunk-3LGZEYOF.js";
 import "./chunk-4WGODMVR.js";
-import "./chunk-EXHQZBVJ.js";
+import "./chunk-AFZTZLFB.js";
+import "./chunk-YAF2MQZ6.js";
 import "./chunk-KKN2IE7Q.js";
-import "./chunk-SVIEVA3L.js";
+import {
+  computeCpuPercent
+} from "./chunk-LBOVL47Y.js";
+import "./chunk-WPKIU4PA.js";
 import "./chunk-6H67XLET.js";
 import {
   beginAcpBootstrapConfigProfiling,
@@ -55,9 +59,8 @@ import {
   endAcpBootstrapConfigProfiling,
   markAcpStartup
 } from "./chunk-M744OFVE.js";
-import "./chunk-ZLGPHA34.js";
-import "./chunk-VJPF6GF2.js";
-import "./chunk-YAF2MQZ6.js";
+import "./chunk-BU4BRCPX.js";
+import "./chunk-EHMN6SEG.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   GENERATION_TIMEOUT_MS,
@@ -78,7 +81,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-IWGMDSC3.js";
+} from "./chunk-XSGQKR37.js";
 import {
   HistoryReplayer,
   MessageEmitter,
@@ -88,19 +91,16 @@ import {
   goalTerminalEventToHistoryItem,
   recordGoalStatusItem,
   restoreGoalFromHistory
-} from "./chunk-YO4JI7B4.js";
+} from "./chunk-EKWNNQQD.js";
 import "./chunk-DYA25Y7U.js";
 import "./chunk-4NFY2S7N.js";
-import "./chunk-5HWAJ4BK.js";
+import "./chunk-NAYPZ72V.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import {
   isTerminalGoalStatusKind
 } from "./chunk-EKTCKZV5.js";
 import "./chunk-3Z43GZUQ.js";
-import {
-  computeCpuPercent
-} from "./chunk-LBOVL47Y.js";
 import "./chunk-RXFQM6FQ.js";
 import "./chunk-HGCQ5SE7.js";
 import {
@@ -112,38 +112,38 @@ import {
   buildPermissionSettings,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-4O6HLCOF.js";
+} from "./chunk-X6DV3WKN.js";
 import {
   MAX_AUDIO_BYTES,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-LMNM37OE.js";
+} from "./chunk-HKNSU4WX.js";
 import {
   readVoiceModel
-} from "./chunk-TCOJPG2P.js";
+} from "./chunk-7FUVSN4D.js";
 import "./chunk-JELIWHXD.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
-import "./chunk-VOA2UPZM.js";
-import "./chunk-3GOCVBYR.js";
+import "./chunk-CDHNGCJI.js";
+import "./chunk-C4GRKMUL.js";
 import "./chunk-57OAHC2Y.js";
 import {
   createLoadedSettingsAdapter
-} from "./chunk-K6VEL5KP.js";
+} from "./chunk-3ZRS2XNY.js";
 import "./chunk-VXZBKKQR.js";
-import "./chunk-IK3RYLAD.js";
+import "./chunk-NYZAL2W2.js";
 import "./chunk-3SH53ANB.js";
 import {
   SESSION_SOURCE_META_KEY,
   parseSessionSource
-} from "./chunk-KH2BIJ4H.js";
+} from "./chunk-4T6QMNX2.js";
 import "./chunk-GLWP3FDB.js";
 import "./chunk-XCGIMOLN.js";
 import "./chunk-OCPBI7J5.js";
 import {
   ndJsonStream
-} from "./chunk-UWSXFI6E.js";
+} from "./chunk-2U7GPHA6.js";
 import {
   ACP_ROUTE_ID_PREFIX,
   buildAcpModelOptions,
@@ -152,7 +152,7 @@ import {
   parseAcpModelOption,
   resolveAcpModelOption,
   sanitizeProviderBaseUrl
-} from "./chunk-WU5NBSLD.js";
+} from "./chunk-6KEN3RIC.js";
 import {
   ACP_PREFLIGHT_KINDS,
   IDLE_HOOK_EVENTS,
@@ -160,10 +160,10 @@ import {
   SERVE_STATUS_EXT_METHODS,
   STATUS_SCHEMA_VERSION,
   mapDomainErrorToErrorKind
-} from "./chunk-PDDYAXL2.js";
-import "./chunk-LEZFUYPM.js";
-import "./chunk-DTAPI453.js";
+} from "./chunk-WIRAPZ62.js";
+import "./chunk-7GYP5COR.js";
 import "./chunk-VWOVHOTT.js";
+import "./chunk-DTAPI453.js";
 import "./chunk-V6WHFGST.js";
 import {
   CHANNEL_STARTUP_PROFILE_META_KEY,
@@ -193,6 +193,13 @@ import "./chunk-QONSRAEV.js";
 import "./chunk-24ER7UV4.js";
 import "./chunk-ALMR3E6Q.js";
 import "./chunk-BK2UNYWD.js";
+import {
+  EXTERNAL_TOOL_GUARD_READY_META_KEY,
+  EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
+  EXTERNAL_TOOL_GUARD_TOKEN_ENV,
+  PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
+  isValidExternalToolGuardDenialReason
+} from "./chunk-BKHCW2BI.js";
 import "./chunk-M5GB774H.js";
 import "./chunk-XC2VAFVZ.js";
 import "./chunk-WUC6ZFXO.js";
@@ -207,7 +214,7 @@ import {
 import {
   assembleMcpServers,
   loadMcpApprovals
-} from "./chunk-SJMCYCUQ.js";
+} from "./chunk-T4XY5CT4.js";
 import {
   getOutputLanguageFilePath,
   getPersistScopeForModelSelection,
@@ -215,7 +222,7 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-YUVTZ4UH.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
@@ -223,19 +230,19 @@ import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
   setLanguageAsync
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-546CDN6D.js";
 import {
   reloadEnvironment
-} from "./chunk-LYPXNRBX.js";
+} from "./chunk-IKXE3AAC.js";
 import "./chunk-6PEXNQTX.js";
-import "./chunk-CAX76R46.js";
-import "./chunk-IZ2CMEYO.js";
+import "./chunk-ZQL73PPE.js";
+import "./chunk-NKST54XA.js";
 import "./chunk-VJNBRRZG.js";
 import {
   isFolderTrustEnabled,
   isWorkspaceTrusted,
   loadTrustedFolders
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-72DZPDH4.js";
 import "./chunk-ALGGS7UH.js";
 import "./chunk-MR3PXB6E.js";
 import "./chunk-XFSFZCM5.js";
@@ -363,7 +370,7 @@ import {
   validatePlanModeShellApproval,
   validatePlanModeShellContext,
   wrapUserPromptSubmitContext
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-DOA7MCDY.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
@@ -377,11 +384,11 @@ import "./chunk-33FNCQSY.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
-import "./chunk-7W5KOBYU.js";
+import "./chunk-6D6V55ZQ.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
 import "./chunk-MOHAWIAW.js";
-import "./chunk-7MFQLOHZ.js";
+import "./chunk-3PRJYMXC.js";
 import {
   promptIdContext,
   todoWorkChainContext
@@ -411,7 +418,7 @@ import {
 import "./chunk-K623ENWT.js";
 import "./chunk-AQ37AY7B.js";
 import "./chunk-432XCUHF.js";
-import "./chunk-4LLUH3A7.js";
+import "./chunk-HU5TUALO.js";
 import {
   clearCachedCredentialFile,
   qwenOAuth2Events
@@ -423,7 +430,7 @@ import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-GLNBDYUX.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-AEWOKOJY.js";
+import "./chunk-AU3XNTMV.js";
 import {
   addToolArgumentsAttributes,
   addToolCallResultAttributes,
@@ -469,7 +476,8 @@ import {
   shouldRunVisionBridge,
   splitImageParts,
   uiTelemetryService
-} from "./chunk-ZPGMDT4S.js";
+} from "./chunk-O656RSMC.js";
+import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   getAutoMemoryRoot,
@@ -484,7 +492,7 @@ import {
 import {
   AuthType,
   preloadContentGenerator
-} from "./chunk-XD2PNH3K.js";
+} from "./chunk-P7LKADIT.js";
 import "./chunk-46UV252V.js";
 import {
   DEFAULT_TOKEN_LIMIT,
@@ -512,10 +520,10 @@ import {
   isSubpath
 } from "./chunk-3RXUYQJI.js";
 import "./chunk-VOQXFAY5.js";
-import "./chunk-K2ETEWG6.js";
+import "./chunk-WVRJKSIG.js";
 import {
   runExitCleanup
-} from "./chunk-LSYVASZS.js";
+} from "./chunk-QG2ACINA.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -2545,6 +2553,7 @@ var Session = class {
   resolveCloseGate = null;
   unsubscribeChatRecordingFailure;
   workflowApprovalAbortController = new AbortController();
+  activeTodoPlanRevision;
   // Modular components
   historyReplayer;
   toolCallEmitter;
@@ -2767,6 +2776,9 @@ var Session = class {
   clearTodoStopGuardTrust() {
     this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
   }
+  clearActiveTodoPlanRevision() {
+    this.activeTodoPlanRevision = void 0;
+  }
   hardSuspendTodoStopGuard() {
     this.#clearTodoStopGuardQueuedPromptWait();
     this.todoStopGuardDrainAutomaticQueuesWhenIdle = false;
@@ -3207,7 +3219,11 @@ var Session = class {
   }
   async replayHistory(records, gaps) {
     this.primeTurnFromHistory(records);
-    await this.historyReplayer.replay(records, gaps);
+    try {
+      await this.historyReplayer.replay(records, gaps);
+    } finally {
+      this.activeTodoPlanRevision = void 0;
+    }
   }
   rewindToTurn(targetTurnIndex, opts) {
     if (!Number.isInteger(targetTurnIndex) || targetTurnIndex < 0) {
@@ -3236,6 +3252,7 @@ var Session = class {
     }
     chat.truncateHistory(apiTruncateIndex);
     chat.stripThoughtsFromHistory();
+    this.activeTodoPlanRevision = void 0;
     const preserveQueuedPromptPriority = this.todoStopGuardQueuedPromptPriority;
     const shouldDrainAutomaticQueues = (this.todoStopGuard.blocksUnrelatedAutomaticTurns || this.todoStopGuard.hasCommittedContinuation) && !preserveQueuedPromptPriority;
     this.todoStopGuard.blockUntilOrdinaryPromptStarts();
@@ -3280,6 +3297,7 @@ var Session = class {
       );
     }
     this.config.getGeminiClient().getChat().setHistory(structuredClone(history));
+    this.activeTodoPlanRevision = void 0;
     this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
   }
   #computeApiTruncationIndexForUserTurn(apiHistory, targetTurnIndex) {
@@ -4819,7 +4837,21 @@ ${this.pendingRecoveredAgentsNotice}
       sessionId: this.sessionId,
       update
     };
+    if (update.sessionUpdate === "plan") {
+      this.activeTodoPlanRevision = void 0;
+    }
     await this.client.sessionUpdate(params);
+    if (update.sessionUpdate === "plan") {
+      this.#captureTodoPlanRevision(update);
+    }
+  }
+  #captureTodoPlanRevision(update) {
+    const meta = isRecord2(update["_meta"]) ? update["_meta"] : void 0;
+    const plan = isRecord2(meta?.["qwenTodoPlan"]) ? meta["qwenTodoPlan"] : void 0;
+    const transcript = isRecord2(meta?.["qwenTranscript"]) ? meta["qwenTranscript"] : void 0;
+    const planId = plan?.["id"];
+    const sourceCallId = transcript?.["planToolCallId"];
+    this.activeTodoPlanRevision = typeof planId === "string" && typeof sourceCallId === "string" && update.entries.length > 0 ? { planId, sourceCallId } : void 0;
   }
   #scheduleChannelDelivery(params) {
     const timer = setTimeout(() => {
@@ -6314,8 +6346,12 @@ ${this.pendingRecoveredAgentsNotice}
         `Unknown approval mode: ${params.modeId}`
       );
     }
+    const previousApprovalMode = this.config.getApprovalMode();
     this.config.setApprovalMode(approvalMode);
     if (approvalMode === "plan" /* PLAN */) {
+      if (previousApprovalMode !== "plan" /* PLAN */) {
+        this.activeTodoPlanRevision = void 0;
+      }
       this.clearTodoStopGuardTrust();
     }
     void this.client.extNotification("qwen/notify/session/mode-update", {
@@ -7660,7 +7696,10 @@ ${this.pendingRecoveredAgentsNotice}
                   // frame already ships _meta.toolName; mirror it here.
                   _meta: {
                     toolName,
-                    ...interactionMetaFields(confirmationDetails)
+                    ...interactionMetaFields(confirmationDetails),
+                    ...isExitPlanModeTool && this.activeTodoPlanRevision ? {
+                      qwenTodoApproval: this.activeTodoPlanRevision
+                    } : {}
                   }
                 }
               };
@@ -7887,13 +7926,15 @@ ${this.pendingRecoveredAgentsNotice}
           }
           const toolInvocationGuard = this.config.getToolInvocationGuard?.();
           if (toolInvocationGuard) {
+            const invocationContext = getInvocationContext();
             const guardDecision = await evaluateToolInvocationGuard(
               toolInvocationGuard,
               {
                 callId,
                 toolName: policyToolName,
                 args: invocation.params,
-                signal: activeToolAbortSignal
+                signal: activeToolAbortSignal,
+                ...invocationContext ? { invocationContext } : {}
               }
             );
             if (activeToolAbortSignal.aborted) {
@@ -8047,6 +8088,7 @@ ${this.pendingRecoveredAgentsNotice}
           if ((isEnterPlanModeTool || isExitPlanModeTool) && !toolResult.error && this.config.getApprovalMode() !== approvalMode) {
             await this.sendCurrentModeUpdateNotification();
             if (this.config.getApprovalMode() === "plan" /* PLAN */) {
+              this.activeTodoPlanRevision = void 0;
               this.#clearTodoStopGuardTrustAndDrainAutomaticQueues();
             }
           }
@@ -10692,6 +10734,74 @@ async function deliverClientMcpMessage(connection, serverName, message, sessionI
   return payload;
 }
 __name(deliverClientMcpMessage, "deliverClientMcpMessage");
+function createManagedExternalToolGuard(connection) {
+  return async (context) => {
+    const invocation = context.invocationContext;
+    if (!invocation) {
+      throw new Error(
+        "Managed external tool guard requires a runtime invocation context."
+      );
+    }
+    if (context.signal.aborted) {
+      throw new DOMException("Tool invocation aborted", "AbortError");
+    }
+    if (context.toolName === ToolNames.AGENT || context.toolName === ToolNames.WORKFLOW || context.toolName === ToolNames.CREATE_SUB_SESSION || context.toolName === ToolNames.SEND_MESSAGE) {
+      return {
+        allowed: false,
+        reason: "Managed external tool guard v1 does not support nested or delegated agent execution."
+      };
+    }
+    let rejectOnAbort;
+    const aborted = new Promise((_resolve, reject) => {
+      rejectOnAbort = reject;
+    });
+    const onAbort = /* @__PURE__ */ __name(() => rejectOnAbort?.(
+      new DOMException("Tool invocation aborted", "AbortError")
+    ), "onAbort");
+    context.signal.addEventListener("abort", onAbort, { once: true });
+    if (context.signal.aborted) onAbort();
+    try {
+      const response = await Promise.race([
+        connection.extMethod(
+          SERVE_CONTROL_EXT_METHODS.externalToolGuardPrepare,
+          {
+            sessionId: invocation.sessionId,
+            promptId: invocation.promptId,
+            toolCallId: context.callId,
+            toolName: context.toolName,
+            arguments: context.args
+          }
+        ),
+        aborted
+      ]);
+      const keys = Object.keys(response);
+      if (typeof response["allowed"] !== "boolean" || keys.some((key) => key !== "allowed" && key !== "reason")) {
+        throw new Error(
+          "Managed external tool guard returned an invalid reply."
+        );
+      }
+      if (response["allowed"]) {
+        if (Object.hasOwn(response, "reason")) {
+          throw new Error(
+            "Managed external tool guard allow reply contains a reason."
+          );
+        }
+        return { allowed: true };
+      }
+      const reason = response["reason"];
+      if (reason === void 0) return { allowed: false };
+      if (!isValidExternalToolGuardDenialReason(reason)) {
+        throw new Error(
+          "Managed external tool guard denial reason is invalid."
+        );
+      }
+      return { allowed: false, reason };
+    } finally {
+      context.signal.removeEventListener("abort", onAbort);
+    }
+  };
+}
+__name(createManagedExternalToolGuard, "createManagedExternalToolGuard");
 function readRuntimeMcpRequest(params) {
   const name = params["name"];
   if (typeof name !== "string" || name.length === 0) {
@@ -10785,6 +10895,14 @@ async function runAcpAgent(config, settings, argv, options) {
   const sessionWriterLeaseEnabledAtStartup = typeof config.isSessionWriterLeaseEnabled === "function" ? config.isSessionWriterLeaseEnabled() : settings.merged.experimental?.sessionWriterLease === true;
   const privateParentCapability = options === void 0 ? process.env[PRIVATE_ACP_CAPABILITY_ENV] : options.privateParentCapability;
   delete process.env[PRIVATE_ACP_CAPABILITY_ENV];
+  delete process.env[PRIVATE_EXTERNAL_TOOL_GUARD_ENV];
+  delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
+  const externalToolGuardRequired = options?.externalToolGuardRequired === true;
+  if (externalToolGuardRequired && privateParentCapability === void 0) {
+    throw new Error(
+      "Required external tool guard is available only to a private managed ACP parent."
+    );
+  }
   let acpConnection;
   const bootstrapClientMcpSender = /* @__PURE__ */ __name((serverName, message) => deliverClientMcpMessage(acpConnection, serverName, message), "bootstrapClientMcpSender");
   beginAcpBootstrapConfigProfiling();
@@ -10861,13 +10979,15 @@ async function runAcpAgent(config, settings, argv, options) {
     });
     connection = new AgentSideConnection((conn) => {
       acpConnection = conn;
+      const managedToolInvocationGuard = externalToolGuardRequired ? createManagedExternalToolGuard(conn) : void 0;
       agentInstance = new QwenAgent(
         config,
         settings,
         argv,
         conn,
         privateParentCapability,
-        sessionWriterLeaseEnabledAtStartup
+        sessionWriterLeaseEnabledAtStartup,
+        managedToolInvocationGuard
       );
       return agentInstance;
     }, stream);
@@ -11164,13 +11284,14 @@ function parseAcpSessionListCursor(value) {
 }
 __name(parseAcpSessionListCursor, "parseAcpSessionListCursor");
 var QwenAgent = class {
-  constructor(config, settings, argv, connection, expectedPrivateParentCapability, sessionWriterLeaseEnabledAtStartup = false) {
+  constructor(config, settings, argv, connection, expectedPrivateParentCapability, sessionWriterLeaseEnabledAtStartup = false, managedToolInvocationGuard) {
     this.config = config;
     this.settings = settings;
     this.argv = argv;
     this.connection = connection;
     this.expectedPrivateParentCapability = expectedPrivateParentCapability;
     this.sessionWriterLeaseEnabledAtStartup = sessionWriterLeaseEnabledAtStartup;
+    this.managedToolInvocationGuard = managedToolInvocationGuard;
     if (process.env["QWEN_SERVE_NO_MCP_POOL"] === "1") {
       this.mcpPool = void 0;
       this.workspaceMcpBudget = void 0;
@@ -11261,6 +11382,14 @@ var QwenAgent = class {
       throw new SessionWriterUnavailableError();
     }
   }
+  rejectUnsupportedGuardedHiddenAgent(operation) {
+    if (this.managedToolInvocationGuard) {
+      throw RequestError.invalidParams(
+        void 0,
+        `Managed external tool guard v1 does not support ${operation}.`
+      );
+    }
+  }
   beginManagedShutdown() {
     if (!this.isTrustedManagedParent()) {
       throw new Error("Managed shutdown requires a trusted private parent");
@@ -11912,7 +12041,7 @@ var QwenAgent = class {
     }
     this.clientCapabilities = args.clientCapabilities;
     const authMethods = buildAuthMethods();
-    const version = "0.21.5";
+    const version = "0.21.6-preview.0";
     const response = {
       protocolVersion: PROTOCOL_VERSION,
       agentInfo: {
@@ -11951,12 +12080,13 @@ var QwenAgent = class {
     }
     const requestedProfile = args._meta?.[CHANNEL_STARTUP_PROFILE_META_KEY];
     const profileRequested = requestedProfile !== null && typeof requestedProfile === "object" && !Array.isArray(requestedProfile) && requestedProfile["v"] === CHANNEL_STARTUP_PROFILE_VERSION;
-    return profileRequested && startupProfile ? {
-      ...response,
-      _meta: {
-        [CHANNEL_STARTUP_PROFILE_META_KEY]: startupProfile
-      }
-    } : response;
+    const responseMeta = {
+      ...this.managedToolInvocationGuard ? {
+        [EXTERNAL_TOOL_GUARD_READY_META_KEY]: EXTERNAL_TOOL_GUARD_REQUIRED_VALUE
+      } : {},
+      ...profileRequested && startupProfile ? { [CHANNEL_STARTUP_PROFILE_META_KEY]: startupProfile } : {}
+    };
+    return Object.keys(responseMeta).length > 0 ? { ...response, _meta: responseMeta } : response;
   }
   async authenticate({ methodId }) {
     const method = external_exports.nativeEnum(AuthType).parse(methodId);
@@ -12077,8 +12207,12 @@ var QwenAgent = class {
             logger: debugLogger6
           });
           if (!bulkReplay2) {
-            for (const update of replay.updates) {
-              await liveSession.sendUpdate(update);
+            try {
+              for (const update of replay.updates) {
+                await liveSession.sendUpdate(update);
+              }
+            } finally {
+              liveSession.clearActiveTodoPlanRevision();
             }
             if (replay.replayError !== void 0) {
               throw RequestError.internalError(void 0, replay.replayError);
@@ -14765,9 +14899,12 @@ var QwenAgent = class {
         );
       case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRememberAvailability:
         return {
-          available: this.config.isManagedMemoryAvailable()
+          available: !this.managedToolInvocationGuard && this.config.isManagedMemoryAvailable()
         };
       case SERVE_CONTROL_EXT_METHODS.workspaceMemoryRemember: {
+        this.rejectUnsupportedGuardedHiddenAgent(
+          "agent-backed workspace memory remember"
+        );
         const content = params["content"];
         if (typeof content !== "string" || !content.trim()) {
           throw RequestError.invalidParams(
@@ -14946,6 +15083,9 @@ var QwenAgent = class {
         }
       }
       case SERVE_CONTROL_EXT_METHODS.workspaceMemoryDream: {
+        this.rejectUnsupportedGuardedHiddenAgent(
+          "agent-backed workspace memory dream"
+        );
         if (!this.config.isManagedMemoryAvailable()) {
           throw new RequestError(
             -32009,
@@ -15862,6 +16002,9 @@ var QwenAgent = class {
         }
         const current = config.getApprovalMode();
         if (current === "plan") {
+          if (previous !== "plan") {
+            session.clearActiveTodoPlanRevision();
+          }
           session.clearTodoStopGuardTrust();
         }
         return { previous, current };
@@ -16092,6 +16235,12 @@ var QwenAgent = class {
         return { sessionId, answer: result.text || null };
       }
       case SERVE_CONTROL_EXT_METHODS.sessionForkAgent: {
+        if (this.managedToolInvocationGuard) {
+          throw RequestError.invalidParams(
+            void 0,
+            "Managed external tool guard v1 does not support /fork."
+          );
+        }
         const sessionId = params["sessionId"];
         if (typeof sessionId !== "string" || sessionId.length === 0) {
           throw RequestError.invalidParams(
@@ -17097,6 +17246,7 @@ ${outputText}
                 try {
                   config.setApprovalMode(newMode);
                   if (newMode === "plan") {
+                    session.clearActiveTodoPlanRevision();
                     session.clearTodoStopGuardTrust();
                   }
                 } catch (err) {
@@ -17442,7 +17592,8 @@ ${outputText}
       // A duplicate caller-supplied session id must fail this one request,
       // not process.exit(1) the shared ACP child and every session on its
       // channel. newSessionConfig maps the throw to a RequestError.
-      true
+      true,
+      this.managedToolInvocationGuard ? { toolInvocationGuard: this.managedToolInvocationGuard } : void 0
     );
     if (sessionSource) {
       config.setSessionSource(sessionSource.sourceType, sessionSource.sourceId);
@@ -17717,6 +17868,7 @@ __name(diffSettingsKeys, "diffSettingsKeys");
 export {
   AUTH_PREFLIGHT_ENV_KEYS,
   AUTH_PREFLIGHT_WAIVED_AUTH_TYPES,
+  createManagedExternalToolGuard,
   createWorkspaceMcpBudget,
   deliverClientMcpMessage,
   extractFilesFromTarGz,