@qwen-code/qwen-code 0.21.5 → 0.21.6

package/chunks/{chunk-GP4IMBX5.js → chunk-XM2O73NC.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   serveCommand
-} from "./chunk-SVIEVA3L.js";
+} from "./chunk-GK2H5GRC.js";
 import {
   listCommand
-} from "./chunk-ZLGPHA34.js";
+} from "./chunk-536SWZTA.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-VJPF6GF2.js";
+} from "./chunk-FZFP7RZI.js";
 import {
   ObservedChannelContactStore
 } from "./chunk-DYA25Y7U.js";
@@ -24,6 +24,11 @@ import {
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
+import {
+  collectProviderModelsForProtocol,
+  getAuthTypeFromEnv,
+  resolveCliGenerationConfig
+} from "./chunk-5MJGUQU5.js";
 import {
   resolvePath
 } from "./chunk-JELIWHXD.js";
@@ -46,22 +51,17 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-VOA2UPZM.js";
+} from "./chunk-OWSW7EYP.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-3GOCVBYR.js";
-import {
-  collectProviderModelsForProtocol,
-  getAuthTypeFromEnv,
-  resolveCliGenerationConfig
-} from "./chunk-WU5NBSLD.js";
+} from "./chunk-G5NNWEYE.js";
 import {
   parseChannelConfig
-} from "./chunk-LEZFUYPM.js";
+} from "./chunk-LAAFLUQV.js";
 import {
   findCliEntryPath
 } from "./chunk-V6WHFGST.js";
@@ -88,7 +88,7 @@ import {
   isChannelDeliveryMessage,
   isChannelStartupReportAckMessage,
   isChannelWebhookTaskMessage
-} from "./chunk-QONSRAEV.js";
+} from "./chunk-YP5KH5Y7.js";
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
@@ -96,6 +96,9 @@ import {
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
+import {
+  EXTERNAL_TOOL_GUARD_TOKEN_ENV
+} from "./chunk-BKHCW2BI.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
@@ -128,29 +131,29 @@ import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-SJMCYCUQ.js";
+} from "./chunk-3UOLYNTF.js";
 import {
   loadSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-KHUA3NQV.js";
 import {
   loadEnvironment
-} from "./chunk-LYPXNRBX.js";
+} from "./chunk-RK2EE3T7.js";
 import {
   getCliVersion
-} from "./chunk-IZ2CMEYO.js";
+} from "./chunk-YMBOEAF4.js";
 import {
   getPackageJson
 } from "./chunk-VJNBRRZG.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-ACZRB7AD.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -191,29 +194,30 @@ import {
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   nextFireTime,
   parseCron
 } from "./chunk-IRH27ZC2.js";
 import {
   require_dist
-} from "./chunk-MISUEWB4.js";
+} from "./chunk-4S4OEQ6U.js";
 import {
   parseBooleanEnvFlag,
   resolveTelemetrySettings
 } from "./chunk-MGSSJT27.js";
 import {
   getAllGeminiMdFilenames,
+  parseLineTolerant,
   setGeminiMdFilename
-} from "./chunk-ZPGMDT4S.js";
+} from "./chunk-PX5DNLSA.js";
 import {
   SchemaValidator,
   ToolNames
 } from "./chunk-D7D7RXIJ.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
-} from "./chunk-XD2PNH3K.js";
+} from "./chunk-BOGOR4HB.js";
 import {
   isTlsVerificationDisabled
 } from "./chunk-BFHXDAR7.js";
@@ -234,8 +238,9 @@ import {
 import {
   writeStderrLine,
   writeStderrLineSafe,
-  writeStdoutLine
-} from "./chunk-OWAK7LMW.js";
+  writeStdoutLine,
+  writeStdoutLineSafe
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -358,9 +363,9 @@ var require_command_exists = __commonJS({
       cleanInput = /* @__PURE__ */ __name(function(s) {
         var isPathName = /[\\]/.test(s);
         if (isPathName) {
-          var dirname24 = '"' + path3.dirname(s) + '"';
+          var dirname25 = '"' + path3.dirname(s) + '"';
           var basename6 = '"' + path3.basename(s) + '"';
-          return dirname24 + ":" + basename6;
+          return dirname25 + ":" + basename6;
         }
         return '"' + s + '"';
       }, "cleanInput");
@@ -368,10 +373,10 @@ var require_command_exists = __commonJS({
     module.exports = /* @__PURE__ */ __name(function commandExists2(commandName, callback) {
       var cleanedCommandName = cleanInput(commandName);
       if (!callback && typeof Promise !== "undefined") {
-        return new Promise(function(resolve24, reject) {
+        return new Promise(function(resolve25, reject) {
           commandExists2(commandName, function(error, output) {
             if (output) {
-              resolve24(commandName);
+              resolve25(commandName);
             } else {
               reject(error);
             }
@@ -700,6 +705,7 @@ import { join, resolve } from "node:path";
 var REVIEW_TMP_DIR = join(".qwen", "tmp");
 var REVIEWS_DIR = join(".qwen", "reviews");
 var REVIEW_CACHE_DIR = join(".qwen", "review-cache");
+var LEASE_PREFIX = "qwen-review-lease-";
 var PARSE_ARGS_REPORT = join(
   REVIEW_TMP_DIR,
   "qwen-review-parse-args.json"
@@ -735,7 +741,6 @@ function tmpPrefix(target) {
 __name(tmpPrefix, "tmpPrefix");
 
 // packages/cli/src/services/review-worktree-lease.ts
-var LEASE_PREFIX = "qwen-review-lease-";
 var GIT_TIMEOUT_MS = 12e4;
 var debugLogger = createDebugLogger("REVIEW_WORKTREE_LEASE");
 function gitOptions(timeout) {
@@ -2255,8 +2260,8 @@ function createBridgeReadinessGate() {
     current: /* @__PURE__ */ __name(() => pending, "current"),
     block: /* @__PURE__ */ __name(() => {
       if (pending) return;
-      pending = new Promise((resolve24) => {
-        releasePending = resolve24;
+      pending = new Promise((resolve25) => {
+        releasePending = resolve25;
       });
     }, "block"),
     release: /* @__PURE__ */ __name(() => {
@@ -2338,7 +2343,7 @@ function createBridgeRecovery(options) {
         writeStderrLine(
           `[Channel] Bridge crashed (${recentCrashCount}/${MAX_CRASH_RESTARTS} in window). Restarting in ${RESTART_DELAY_MS / 1e3}s...`
         );
-        await new Promise((resolve24) => setTimeout(resolve24, RESTART_DELAY_MS));
+        await new Promise((resolve25) => setTimeout(resolve25, RESTART_DELAY_MS));
         const bridge = new AcpBridge(bridgeOpts);
         setBridge(bridge);
         attachDisconnectHandler(bridge);
@@ -2656,7 +2661,7 @@ var stopCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-CCIX4BMG.js");
+        const sdk = await import("./daemon-YI5RY62O.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -2770,7 +2775,7 @@ function formatChannelStartupFailures(source, fallbackWorkspaceCwd) {
   } catch {
     return [];
   }
-  const lines2 = [];
+  const lines = [];
   for (const raw of limitedFailures) {
     try {
       if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
@@ -2802,16 +2807,16 @@ function formatChannelStartupFailures(source, fallbackWorkspaceCwd) {
         "phase=connect",
         ...code ? [`code=${code}`] : []
       ];
-      lines2.push(
+      lines.push(
         `[Channel] Startup failure (${fields.join(", ")}): ${safeMessage}`
       );
     } catch {
     }
   }
   if (rawTruncated === true || rawFailureCount > MAX_CHANNEL_STARTUP_FAILURES) {
-    lines2.push("[Channel] Additional startup failures were truncated.");
+    lines.push("[Channel] Additional startup failures were truncated.");
   }
-  return lines2;
+  return lines;
 }
 __name(formatChannelStartupFailures, "formatChannelStartupFailures");
 
@@ -2842,7 +2847,7 @@ var statusCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-CCIX4BMG.js");
+        const sdk = await import("./daemon-YI5RY62O.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -2953,7 +2958,7 @@ var reloadCommand = {
     const token = resolveToken(argv.token);
     let sdk;
     try {
-      sdk = await import("./daemon-CCIX4BMG.js");
+      sdk = await import("./daemon-YI5RY62O.js");
     } catch (err) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(err)}`
@@ -3033,7 +3038,7 @@ var setCommand2 = {
     const selection = names[0] === "all" ? { mode: "all" } : { mode: "names", names };
     let sdk;
     try {
-      sdk = await import("./daemon-CCIX4BMG.js");
+      sdk = await import("./daemon-YI5RY62O.js");
     } catch (error) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(error)}`
@@ -3159,7 +3164,7 @@ function createDaemonChannelBridgeFacade(bridge, opts) {
 }
 __name(createDaemonChannelBridgeFacade, "createDaemonChannelBridgeFacade");
 async function loadDaemonSdk() {
-  return await import("./daemon-CCIX4BMG.js");
+  return await import("./daemon-YI5RY62O.js");
 }
 __name(loadDaemonSdk, "loadDaemonSdk");
 function selectedChannelNames(channelsConfig, selection) {
@@ -3206,12 +3211,12 @@ async function abortableStartup(value, signal) {
   const promise = Promise.resolve(value);
   if (!signal) return await promise;
   if (signal.aborted) throw startupAbortError();
-  return await new Promise((resolve24, reject) => {
+  return await new Promise((resolve25, reject) => {
     const onAbort = /* @__PURE__ */ __name(() => {
       reject(startupAbortError());
     }, "onAbort");
     signal.addEventListener("abort", onAbort, { once: true });
-    promise.then(resolve24, reject).finally(() => {
+    promise.then(resolve25, reject).finally(() => {
       signal.removeEventListener("abort", onAbort);
     });
   });
@@ -3585,6 +3590,7 @@ function scrubDaemonWorkerEnv() {
   delete process.env[QWEN_DAEMON_URL_ENV];
   delete process.env[QWEN_DAEMON_WORKSPACE_ENV];
   delete process.env[QWEN_SERVER_TOKEN_ENV];
+  delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
 }
 __name(scrubDaemonWorkerEnv, "scrubDaemonWorkerEnv");
 function readDaemonWorkerEnv() {
@@ -3619,7 +3625,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
   if (!send) {
     return Promise.reject(new Error("Channel worker IPC is unavailable."));
   }
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     let settled = false;
     let unsubscribeMessage = /* @__PURE__ */ __name(() => {
     }, "unsubscribeMessage");
@@ -3633,7 +3639,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
       settled = true;
       cleanup();
       if (error) reject(error);
-      else resolve24();
+      else resolve25();
     }, "finish");
     const onMessage = /* @__PURE__ */ __name((value) => {
       if (isChannelStartupReportAckMessage(value)) {
@@ -3881,8 +3887,8 @@ var daemonWorkerCommand = {
       let shuttingDown = false;
       let exitCode = 0;
       let finish;
-      const finished = new Promise((resolve24) => {
-        finish = resolve24;
+      const finished = new Promise((resolve25) => {
+        finish = resolve25;
       });
       const shutdown = /* @__PURE__ */ __name(async (reason) => {
         if (shuttingDown) {
@@ -3910,8 +3916,8 @@ var daemonWorkerCommand = {
                   ...activeChannelDeliveries.values(),
                   ...activeWebhookTasks.values()
                 ]),
-                new Promise((resolve24) => {
-                  const timer = setTimeout(resolve24, WORKER_SHUTDOWN_DRAIN_MS);
+                new Promise((resolve25) => {
+                  const timer = setTimeout(resolve25, WORKER_SHUTDOWN_DRAIN_MS);
                   timer.unref();
                 })
               ]);
@@ -4547,12 +4553,12 @@ var parseArgsCommand = {
 
 // packages/cli/src/commands/review/compose-review.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname4, join as join9 } from "node:path";
 
 // packages/cli/src/commands/review/lib/coverage.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/transcripts.ts
 init_esbuild_shims();
@@ -4563,7 +4569,7 @@ var TranscriptsUnavailableError = class extends Error {
     __name(this, "TranscriptsUnavailableError");
   }
 };
-function transcriptDir(env = process.env) {
+function transcriptPaths(env = process.env) {
   const projectDir = env["QWEN_CODE_PROJECT_DIR"]?.trim();
   const sessionId = env["QWEN_CODE_SESSION_ID"]?.trim();
   if (!projectDir || !sessionId) {
@@ -4571,7 +4577,15 @@ function transcriptDir(env = process.env) {
       "the CLI did not export QWEN_CODE_PROJECT_DIR / QWEN_CODE_SESSION_ID, so this run cannot find the harness's record of what its agents did"
     );
   }
-  return join5(projectDir, "subagents", sessionId);
+  return {
+    projectDir,
+    sessionId,
+    dir: join5(projectDir, "subagents", sessionId)
+  };
+}
+__name(transcriptPaths, "transcriptPaths");
+function transcriptDir(env = process.env) {
+  return transcriptPaths(env).dir;
 }
 __name(transcriptDir, "transcriptDir");
 function textOf(rec) {
@@ -4602,8 +4616,8 @@ function parseTranscript(file, diffPath) {
   } catch {
     return null;
   }
-  const lines2 = raw.split("\n").filter((l) => l.trim());
-  if (lines2.length === 0) return null;
+  const lines = raw.split("\n").filter((l) => l.trim());
+  if (lines.length === 0) return null;
   let agentId = "";
   let agentName = "";
   let launchPrompt = "";
@@ -4614,7 +4628,7 @@ function parseTranscript(file, diffPath) {
   const successfulCallArgs = [];
   const byId = /* @__PURE__ */ new Map();
   const anonymous = [];
-  for (const line of lines2) {
+  for (const line of lines) {
     let rec;
     try {
       rec = JSON.parse(line);
@@ -4688,11 +4702,15 @@ function parseTranscript(file, diffPath) {
   };
 }
 __name(parseTranscript, "parseTranscript");
+function listAgentTranscriptFiles(dir) {
+  return readdirSync2(dir).filter((name) => name.endsWith(".jsonl"));
+}
+__name(listAgentTranscriptFiles, "listAgentTranscriptFiles");
 function readTranscripts(since, env = process.env, diffPath) {
   const dir = transcriptDir(env);
   let names;
   try {
-    names = readdirSync2(dir);
+    names = listAgentTranscriptFiles(dir);
   } catch (err) {
     throw new TranscriptsUnavailableError(
       `no subagent transcripts at ${dir} (${err.message}). The harness writes one per agent; if there are none, either no agents ran or the harness could not write them.`
@@ -4700,7 +4718,6 @@ function readTranscripts(since, env = process.env, diffPath) {
   }
   const out = [];
   for (const name of names) {
-    if (!name.endsWith(".jsonl")) continue;
     const rec = parseTranscript(join5(dir, name), diffPath);
     if (!rec) continue;
     if (since !== void 0 && rec.mtimeMs < since) continue;
@@ -4718,7 +4735,13 @@ __name(wasGivenTheDiff, "wasGivenTheDiff");
 
 // packages/cli/src/commands/review/lib/prompt-record.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import {
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
 import { dirname as dirname2, join as join6, basename as basename3, resolve as resolve3 } from "node:path";
 function promptRecordDir(planPath) {
   const p = resolve3(planPath);
@@ -4760,7 +4783,7 @@ function recordPrompt(planPath, key, prompt) {
   }
 }
 __name(recordPrompt, "recordPrompt");
-function readRecordedPrompts(planPath) {
+function readRecordedPrompts(planPath, sinceMs) {
   const out = /* @__PURE__ */ new Map();
   const dir = promptRecordDir(planPath);
   let names;
@@ -4778,7 +4801,9 @@ function readRecordedPrompts(planPath) {
       } catch {
         continue;
       }
-      out.set(key, readFileSync5(join6(dir, name), "utf8"));
+      const file = join6(dir, name);
+      if (sinceMs !== void 0 && statSync2(file).mtimeMs < sinceMs) continue;
+      out.set(key, readFileSync5(file, "utf8"));
     } catch {
     }
   }
@@ -4786,25 +4811,33 @@ function readRecordedPrompts(planPath) {
 }
 __name(readRecordedPrompts, "readRecordedPrompts");
 function wasDeliveredVerbatim(launchPrompt, built) {
+  return deliveredVerbatim(flattenPrompt(launchPrompt), built);
+}
+__name(wasDeliveredVerbatim, "wasDeliveredVerbatim");
+function deliveredVerbatim(flattenedLaunch, built) {
   if (built.trim().length === 0) return false;
-  const delivered = flatten(launchPrompt);
+  return deliveredVerbatimLines(flattenedLaunch, promptLines(built));
+}
+__name(deliveredVerbatim, "deliveredVerbatim");
+function deliveredVerbatimLines(flattenedLaunch, builtLines) {
+  if (builtLines.length === 0) return false;
   let at = 0;
-  for (const line of lines(built)) {
-    const i = delivered.indexOf(line, at);
+  for (const line of builtLines) {
+    const i = flattenedLaunch.indexOf(line, at);
     if (i === -1) return false;
     at = i + line.length;
   }
   return true;
 }
-__name(wasDeliveredVerbatim, "wasDeliveredVerbatim");
-function flatten(s) {
+__name(deliveredVerbatimLines, "deliveredVerbatimLines");
+function flattenPrompt(s) {
   return s.replace(/\s+/g, " ").trim();
 }
-__name(flatten, "flatten");
-function lines(built) {
-  return built.split("\n").map((l) => flatten(l)).filter((l) => l.length > 0);
+__name(flattenPrompt, "flattenPrompt");
+function promptLines(built) {
+  return built.split("\n").map((l) => flattenPrompt(l)).filter((l) => l.length > 0);
 }
-__name(lines, "lines");
+__name(promptLines, "promptLines");
 
 // packages/cli/src/commands/review/lib/roster.ts
 init_esbuild_shims();
@@ -4908,9 +4941,9 @@ function splitHeaderPaths(rest) {
 }
 __name(splitHeaderPaths, "splitHeaderPaths");
 function parseDiff(diffText) {
-  const lines2 = diffText.split("\n");
-  if (lines2.length > 0 && lines2[lines2.length - 1] === "") lines2.pop();
-  const total = lines2.length;
+  const lines = diffText.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const total = lines.length;
   const files = [];
   let cur = null;
   let curHunk = null;
@@ -4937,7 +4970,7 @@ function parseDiff(diffText) {
     }
   }, "closeFile");
   for (let i = 0; i < total; i++) {
-    const line = lines2[i];
+    const line = lines[i];
     const n = i + 1;
     if (line.startsWith("diff --git ")) {
       closeFile(n - 1);
@@ -5016,9 +5049,9 @@ function parseDiff(diffText) {
 }
 __name(parseDiff, "parseDiff");
 var MIN_SPLIT_SEGMENT = 40;
-function isSafeSplitPoint(lines2, n) {
-  const cur = lines2[n - 1];
-  const prev = lines2[n - 2];
+function isSafeSplitPoint(lines, n) {
+  const cur = lines[n - 1];
+  const prev = lines[n - 2];
   if (cur === void 0 || prev === void 0) return false;
   const isNewSide = /* @__PURE__ */ __name((l) => l === "" || /^[+ ]/.test(l), "isNewSide");
   if (!isNewSide(cur) || !isNewSide(prev)) return false;
@@ -5028,9 +5061,9 @@ function isSafeSplitPoint(lines2, n) {
   return prev === "" || /^\s*$/.test(prev.slice(1));
 }
 __name(isSafeSplitPoint, "isSafeSplitPoint");
-function charPrefix(lines2) {
-  const p = new Array(lines2.length + 1).fill(0);
-  for (let i = 0; i < lines2.length; i++) p[i + 1] = p[i] + lines2[i].length + 1;
+function charPrefix(lines) {
+  const p = new Array(lines.length + 1).fill(0);
+  for (let i = 0; i < lines.length; i++) p[i + 1] = p[i] + lines[i].length + 1;
   return p;
 }
 __name(charPrefix, "charPrefix");
@@ -5038,14 +5071,14 @@ function charsIn(prefix, s, e) {
   return prefix[e] - prefix[s - 1];
 }
 __name(charsIn, "charsIn");
-function splitUnit(unit, lines2, prefix, maxChunkLines, bodyStart) {
+function splitUnit(unit, lines, prefix, maxChunkLines, bodyStart) {
   const over = /* @__PURE__ */ __name((s, e) => e - s + 1 > maxChunkLines || charsIn(prefix, s, e) > MAX_CHUNK_CHARS, "over");
   const bigEnough = /* @__PURE__ */ __name((s, e) => e - s + 1 >= MIN_SPLIT_SEGMENT || charsIn(prefix, s, e) >= MAX_CHUNK_CHARS / 2, "bigEnough");
   if (!over(unit.start, unit.end)) return [unit];
   const newLineOf = /* @__PURE__ */ new Map();
   let newLine = unit.newStart;
   for (let n = bodyStart; n <= unit.end; n++) {
-    const c = lines2[n - 1]?.[0];
+    const c = lines[n - 1]?.[0];
     if (c === " " || c === "+") newLineOf.set(n, newLine++);
   }
   const out = [];
@@ -5054,7 +5087,7 @@ function splitUnit(unit, lines2, prefix, maxChunkLines, bodyStart) {
     const upper = Math.min(unit.end, segStart + maxChunkLines - 1);
     let cut = -1;
     for (let n = upper; n > bodyStart; n--) {
-      if (!isSafeSplitPoint(lines2, n)) continue;
+      if (!isSafeSplitPoint(lines, n)) continue;
       if (over(segStart, n - 1)) continue;
       if (!bigEnough(segStart, n - 1)) continue;
       cut = n;
@@ -5062,7 +5095,7 @@ function splitUnit(unit, lines2, prefix, maxChunkLines, bodyStart) {
     }
     if (cut < 0) {
       for (let n = upper + 1; n <= unit.end; n++) {
-        if (isSafeSplitPoint(lines2, n) && bigEnough(segStart, n - 1)) {
+        if (isSafeSplitPoint(lines, n) && bigEnough(segStart, n - 1)) {
           cut = n;
           break;
         }
@@ -5088,10 +5121,10 @@ function splitUnit(unit, lines2, prefix, maxChunkLines, bodyStart) {
   return out;
 }
 __name(splitUnit, "splitUnit");
-function planChunks(files, lines2, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
-  const diffLines = lines2.length;
+function planChunks(files, lines, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
+  const diffLines = lines.length;
   if (diffLines === 0) return [];
-  const prefix = charPrefix(lines2);
+  const prefix = charPrefix(lines);
   const units = [];
   for (const f of files) {
     if (f.hunks.length === 0) {
@@ -5115,7 +5148,7 @@ function planChunks(files, lines2, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
         newEnd: h.newEnd
       };
       units.push(
-        ...splitUnit(unit, lines2, prefix, maxChunkLines, h.diffStart + 1)
+        ...splitUnit(unit, lines, prefix, maxChunkLines, h.diffStart + 1)
       );
     });
   }
@@ -5127,7 +5160,7 @@ function planChunks(files, lines2, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
       cur.chars = charsIn(prefix, cur.startLine, cur.endLine);
       let widest = 0;
       for (let n = cur.startLine; n <= cur.endLine; n++) {
-        if (lines2[n - 1].length > widest) widest = lines2[n - 1].length;
+        if (lines[n - 1].length > widest) widest = lines[n - 1].length;
       }
       cur.maxLineChars = widest;
       chunks.push(cur);
@@ -5170,10 +5203,10 @@ function planChunks(files, lines2, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
 __name(planChunks, "planChunks");
 function buildDiffPlan(diffText, maxChunkLines = DEFAULT_MAX_CHUNK_LINES) {
   const { files, diffLines } = parseDiff(diffText);
-  const lines2 = diffText.split("\n");
-  if (lines2.length > 0 && lines2[lines2.length - 1] === "") lines2.pop();
+  const lines = diffText.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
   const linesOf = /* @__PURE__ */ __name((kind) => files.filter((f) => f.kind === kind).reduce((n, f) => n + (f.diffEnd - f.diffStart + 1), 0), "linesOf");
-  const chunks = planChunks(files, lines2, maxChunkLines);
+  const chunks = planChunks(files, lines, maxChunkLines);
   if (!chunksCoverDiff(chunks, diffLines)) {
     throw new Error(
       `diff-plan: chunks do not tile the diff (${chunks.length} chunks over ${diffLines} lines). Refusing to plan a review with a coverage hole.`
@@ -5692,6 +5725,7 @@ __name(requiredAgents, "requiredAgents");
 
 // packages/cli/src/commands/review/lib/agent-briefs.ts
 init_esbuild_shims();
+var REVERSE_AUDIT_EXAMPLE_RECEIPT = "No issues found \u2014 re-walked the reconnect state machine and the two changed exports' call sites; every gap I checked was already in the list";
 var BRIEFS = {
   "0": {
     label: "Agent 0: Issue fidelity & root-cause ownership",
@@ -5990,11 +6024,11 @@ You are undirected on purpose. Do not restrict yourself to the list.`
     readsDiff: false,
     brief: `You are **Agent 7: Build & Test Verification**. You do not review the diff \u2014 you run the project's own deterministic checks and report what they say. Your evidence is **the commands you ran and their output**; a return that names no command has not done this job.
 
-**Run \`qwen review build-test\` (the exact command, with its \`--plan\` and \`--worktree\`, is below).** It installs if needed, then builds only the workspaces the diff changes plus everything they compile against, and tests the changed ones \u2014 reading the plan for what changed and the root \`package.json\` for the workspace layout. Do **not** substitute \`npm run build\` / \`npm test\` by hand. The old brief did, with a 120-second deadline, and this repo's cold full build is 125 seconds: measured across the harness's own transcripts, that command timed out **71 times** and verified nothing. \`build-test\` scopes the build, gives it a deadline it can meet, and \u2014 this is the part a hand-run command gets wrong \u2014 reports a timeout as **infrastructure, not a finding**. A build that runs out of time is never a Critical against someone's pull request.
+**Run \`qwen review build-test\` (the exact command, with its \`--plan\` and \`--worktree\`, is below).** It installs if needed, then builds only the workspaces the diff changes plus everything they compile against, and tests the changed ones plus every workspace that depends on them \u2014 reading the plan for what changed and the root \`package.json\` for the workspace layout. Do **not** substitute \`npm run build\` / \`npm test\` by hand. The old brief did, with a 120-second deadline, and this repo's cold full build is 125 seconds: measured across the harness's own transcripts, that command timed out **71 times** and verified nothing. \`build-test\` scopes the build, gives it a deadline it can meet, and \u2014 this is the part a hand-run command gets wrong \u2014 reports a timeout as **infrastructure, not a finding**. A build that runs out of time is never a Critical against someone's pull request.
 
 Read the JSON it prints:
 
-- \`toolchain: "npm"\` \u2192 use its \`build[]\` / \`test[]\` results. A failure in a file **the diff changed** is a **Critical** (\`Source: [build]\` or \`[test]\`); a failure in a file it did **not** touch is pre-existing \u2014 say so, do not file it against this PR. A non-empty \`timedOut\`, or a failed \`install\`, is environment/infrastructure \u2014 informational, never a Critical. On \`ok: true\`, name the workspaces built and the commands run; a return that names no command is a whiff.
+- \`toolchain: "npm"\` \u2192 use its \`build[]\` / \`test[]\` results. A failure in a file **the diff changed** is a **Critical** (\`Source: [build]\` or \`[test]\`); a failure in a file it did **not** touch is pre-existing \u2014 say so, do not file it against this PR. A non-empty \`timedOut\`, or a failed \`install\`, is environment/infrastructure \u2014 informational, never a Critical. On \`ok: true\`, name the workspaces built and the commands run; a return that names no command is a whiff. Report the TEST coverage from \`testScope\`, never from assumption. \`testScope.workspaces\` lists exactly the suites that ran \u2014 say "tests scoped to <list> \u2014 the changed workspaces and their declared dependents that define a test script". \`testScope.notRun\`, when present, names suites the whole-call budget stopped before they ran \u2014 say they did not run, never fold them into the coverage. When \`testScope.caveat\` is present, the scope may be incomplete \u2014 quote the caveat and say exactly that. A green run is a claim about those suites only \u2014 do not phrase it as the whole suite passing.
 - **When any \`test[]\` command failed (exit non-zero, not a timeout), MEASURE which failures are the PR's before ruling by path.** The path rule above misclassifies in both directions \u2014 an environment-flaky test in a touched file gets filed as a Critical it did not cause, and a PR that breaks a test in an UNTOUCHED file gets waved through as pre-existing. The measurement is two commands: \`qwen review base-tree --plan <plan> --worktree <worktree> --out <plan dir>/qwen-review-pr-<n>-base-tree.json\` (builds the merge base beside the worktree). **Read \`available\` before using \`path\`** \u2014 a tree that was created but did NOT build populates \`path\` too, and a base that failed to build says nothing whatsoever about the PR, so measuring against it turns an infrastructure failure into a list of Criticals. \`available: false\` (local/lightweight review, no merge base, a base that would not compile) means the path rule stands \u2014 say so and stop here, and \`qwen review test-delta --report <the build-test report you wrote> --baseline <the base-tree report's path field> --pr-worktree <this worktree> --out <plan dir>/qwen-review-pr-<n>-test-delta.json\`. Read its verdict: a file in \`netNew\` fails on the PR side only \u2014 **that is the Critical**, whatever file the diff touches; a file in \`shared\` fails on base too \u2014 **pre-existing by measurement**, never filed, whatever file the diff touches; an \`unparsed\` entry, a timed-out base rerun, a base rerun that FAILED without naming any failing file (it did not measure the base \u2014 an unbuilt tree, a missing install, a workspace absent at base), or a command the whole-command budget could not fit attributes nothing \u2014 the report names each with its own reason; fall back to the path rule for those and say the delta could not rule. Compare failing FILE SETS, never counts: a flaky suite fails different test NAMES on two runs of the same tree, so counts are noise and the set difference is the signal.
 - \`toolchain: "unsupported"\` (build-test could not scope this repo \u2014 no npm package with a build/test script) \u2192 **install dependencies first** (build-test's own install only runs on the npm path, so nothing has installed yet: \`pip install -e .\`, \`mvn -q -DskipTests package\`'s own fetch, \`cargo fetch\`, \`go mod download\`, etc.), then fall back to **one** build and **one** test command by this precedence, each with a deadline it can meet: \`pom.xml\` \u2192 \`{mvn} compile\` / \`{mvn} test -q\`; \`build.gradle\` \u2192 \`{gradle} compileJava\` / \`{gradle} test\`; \`Makefile\` \u2192 \`make build\`; \`Cargo.toml\` \u2192 \`cargo build\` / \`cargo test\`; \`go.mod\` \u2192 \`go build ./...\` / \`go test ./...\`; \`pytest.ini\` or \`pyproject.toml\` \`[tool.pytest]\` \u2192 \`pytest\`. If none match, read the CI config **from the base branch** (\`git show <base>:<path>\`), never the worktree \u2014 the PR branch is untrusted and a modified workflow or Makefile could inject arbitrary commands.
 
@@ -6182,10 +6216,159 @@ The asymmetry cuts both ways: confirming also requires the trace, and a finding
 - **Report only Critical or Suggestion.** Do not report Nice to have.
 - A found gap uses the standard finding format (with \`Source: [review]\`), including its failure scenario \u2014 your findings go through the same verification as any other, so they must carry the evidence a verifier can trace.
 
-If you find no new gap in your scope, say so **and name what you re-examined** \u2014 \`No issues found \u2014 re-walked the reconnect state machine and the two changed exports' call sites; every gap I checked was already in the list\`. A bare "No issues found." is indistinguishable from an agent that did nothing, and it is treated as one: it ends nothing, and it earns your scope a relaunch.`
+If you find no new gap in your scope, say so **and name what you re-examined** \u2014 \`${REVERSE_AUDIT_EXAMPLE_RECEIPT}\`. A bare "No issues found." is indistinguishable from an agent that did nothing, and it is treated as one: it ends nothing, and it earns your scope a relaunch.`
   }
 };
 
+// packages/cli/src/commands/review/lib/deadline.ts
+init_esbuild_shims();
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+var DEADLINE_ENV = "QWEN_REVIEW_DEADLINE_EPOCH";
+var RESERVE_ENV = "QWEN_REVIEW_DEADLINE_RESERVE_SECONDS";
+var DEFAULT_RESERVE_SECONDS = 4800;
+var DEFAULT_ROUND_SECONDS = 1800;
+var MIN_OBSERVED_ROUND_SECONDS = 600;
+var STAMPS_FILE = "budget-rounds.json";
+var STOP_FILE = "budget-stop.json";
+var RUN_EPOCH_SLACK_MS = 2e3;
+function runEpochMs(planPath) {
+  try {
+    return statSync3(planPath).mtimeMs - RUN_EPOCH_SLACK_MS;
+  } catch {
+    return Number.NEGATIVE_INFINITY;
+  }
+}
+__name(runEpochMs, "runEpochMs");
+function readRoundStamps(planPath) {
+  try {
+    const raw = readFileSync7(
+      join8(promptRecordDir(planPath), STAMPS_FILE),
+      "utf8"
+    );
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    const epoch = runEpochMs(planPath);
+    return parsed.filter(
+      (e) => typeof e === "object" && e !== null && typeof e.atMs === "number" && e.atMs >= epoch
+    );
+  } catch {
+    return [];
+  }
+}
+__name(readRoundStamps, "readRoundStamps");
+function stampRound(planPath, round, nowMs = Date.now()) {
+  try {
+    const stamps = readRoundStamps(planPath);
+    if (round !== void 0 && stamps.some((s) => s.round === round)) return;
+    stamps.push({ round: round ?? null, atMs: nowMs });
+    const dir = promptRecordDir(planPath);
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync5(join8(dir, STAMPS_FILE), JSON.stringify(stamps));
+  } catch {
+  }
+}
+__name(stampRound, "stampRound");
+function expectedRoundSeconds(planPath, round, nowMs = Date.now()) {
+  const stamps = readRoundStamps(planPath).filter(
+    (s) => round === void 0 || s.round !== round
+  );
+  if (stamps.length === 0) return DEFAULT_ROUND_SECONDS;
+  let maxSeconds = 0;
+  for (let i = 0; i < stamps.length; i++) {
+    const end = i + 1 < stamps.length ? stamps[i + 1].atMs : nowMs;
+    maxSeconds = Math.max(
+      maxSeconds,
+      Math.round((end - stamps[i].atMs) / 1e3)
+    );
+  }
+  return Math.max(MIN_OBSERVED_ROUND_SECONDS, maxSeconds);
+}
+__name(expectedRoundSeconds, "expectedRoundSeconds");
+function reverseAuditBudgetExhausted(env, roundCostSeconds, nowMs = Date.now()) {
+  const raw = env[DEADLINE_ENV];
+  if (raw === void 0 || raw.trim() === "") return null;
+  const deadline = Number(raw);
+  if (!Number.isFinite(deadline) || deadline <= 0) return null;
+  let reserve = DEFAULT_RESERVE_SECONDS;
+  const reserveRaw = env[RESERVE_ENV];
+  if (reserveRaw !== void 0 && reserveRaw.trim() !== "") {
+    const r = Number(reserveRaw);
+    if (Number.isFinite(r) && r >= 0) reserve = r;
+  }
+  const remainingSeconds = Math.floor(deadline - nowMs / 1e3);
+  if (remainingSeconds >= reserve + roundCostSeconds) return null;
+  return {
+    remainingSeconds,
+    reserveSeconds: reserve,
+    expectedRoundSeconds: roundCostSeconds
+  };
+}
+__name(reverseAuditBudgetExhausted, "reverseAuditBudgetExhausted");
+var BUDGET_STOP_PHRASE = "review time budget";
+function budgetStopDisclosure(round) {
+  const which = round !== void 0 ? `round ${round}` : "the next round";
+  const whichZh = round !== void 0 ? `\u7B2C ${round} \u8F6E` : "\u4E0B\u4E00\u8F6E";
+  return {
+    subject: "reverse audit",
+    reason: `stopped before ${which} by the ${BUDGET_STOP_PHRASE}`,
+    subjectZh: "\u53CD\u5411\u5BA1\u8BA1",
+    reasonZh: `\u8BC4\u5BA1\u65F6\u95F4\u9884\u7B97\u4E0D\u8DB3\uFF0C\u672A\u80FD\u5F00\u59CB${whichZh}`
+  };
+}
+__name(budgetStopDisclosure, "budgetStopDisclosure");
+function budgetStopEntry(round) {
+  const d = budgetStopDisclosure(round);
+  return `${d.subject} \u2014 ${d.reason}`;
+}
+__name(budgetStopEntry, "budgetStopEntry");
+function budgetStopEntryZh(round) {
+  const d = budgetStopDisclosure(round);
+  return `${d.subjectZh}\u2014\u2014${d.reasonZh}`;
+}
+__name(budgetStopEntryZh, "budgetStopEntryZh");
+function writeBudgetStop(planPath, spent, round, nowMs = Date.now()) {
+  try {
+    const dir = promptRecordDir(planPath);
+    mkdirSync5(dir, { recursive: true });
+    const stop = {
+      entry: budgetStopEntry(round),
+      entryZh: budgetStopEntryZh(round),
+      round: round ?? null,
+      remainingSeconds: spent.remainingSeconds,
+      reserveSeconds: spent.reserveSeconds,
+      atMs: nowMs
+    };
+    writeFileSync5(join8(dir, STOP_FILE), JSON.stringify(stop, null, 2));
+  } catch {
+  }
+}
+__name(writeBudgetStop, "writeBudgetStop");
+function readBudgetStop(planPath) {
+  try {
+    const raw = readFileSync7(
+      join8(promptRecordDir(planPath), STOP_FILE),
+      "utf8"
+    );
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || typeof parsed.entry !== "string" || typeof parsed.atMs !== "number" || parsed.atMs < runEpochMs(planPath)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+__name(readBudgetStop, "readBudgetStop");
+function reverseAuditBudgetMessage(spent, round) {
+  const minutesLeft = Math.max(0, Math.floor(spent.remainingSeconds / 60));
+  const reserveMinutes = Math.round(spent.reserveSeconds / 60);
+  const roundMinutes = Math.round(spent.expectedRoundSeconds / 60);
+  const which = round !== void 0 ? `round ${round}` : "the next round";
+  return `BUDGET: ${minutesLeft} minute(s) remain before this review's deadline \u2014 not enough for the ~${roundMinutes}-minute round being asked for plus the ${reserveMinutes}-minute reserve kept for its verification, compose-review and submission \u2014 so no further reverse-audit round will be built. This is the loop's termination rule, not an error: do not rebuild ${which} and do not relaunch auditors. A budget-stop marker has been recorded and compose-review will disclose it and cap the verdict itself; also add exactly this entry to unreviewedDimensions so the terminal report says it too \u2014 \`${budgetStopEntry(round)}\` \u2014 and proceed to Step 6 with the findings already confirmed. Spend what time remains only on verifying findings already in hand, composing, and submitting. A review that stops here still reports everything it proved; a review that runs past its deadline is killed holding all of it.`;
+}
+__name(reverseAuditBudgetMessage, "reverseAuditBudgetMessage");
+
 // packages/cli/src/commands/review/lib/shell-quote.ts
 init_esbuild_shims();
 function shellQuotePath(p) {
@@ -6195,7 +6378,7 @@ __name(shellQuotePath, "shellQuotePath");
 
 // packages/cli/src/commands/review/lib/coverage.ts
 function readPlan(path3) {
-  const plan = JSON.parse(readFileSync7(path3, "utf8"));
+  const plan = JSON.parse(readFileSync8(path3, "utf8"));
   if (typeof plan?.diffPathAbsolute !== "string" || !plan.diffPathAbsolute) {
     throw new Error(`coverage: ${path3} has no diffPathAbsolute`);
   }
@@ -6206,7 +6389,7 @@ function readPlan(path3) {
   if (problem) {
     throw new Error(`coverage: ${path3} has ${problem}`);
   }
-  return { plan, mtimeMs: statSync2(path3).mtimeMs };
+  return { plan, mtimeMs: statSync4(path3).mtimeMs };
 }
 __name(readPlan, "readPlan");
 var CHUNK_RE = /\bchunk\s+(\d+)\s+of\s+\d+\b/i;
@@ -6552,7 +6735,13 @@ function coverageFromTranscripts(planPath, env = process.env) {
   };
 }
 __name(coverageFromTranscripts, "coverageFromTranscripts");
-var rebuildFix = /* @__PURE__ */ __name((role, noun) => `build the prompt with \`"\${QWEN_CODE_CLI:-qwen}" review agent-prompt --plan <plan> --role ${role} --findings <file> [--rules <rules file>] [--round <k>]\` ` + (role === "reverse-audit" ? `(an early round with nothing confirmed passes an empty file; ` : `(pass the shard's findings, never an empty file \u2014 a verifier that sees no findings verifies nothing; `) + `pass --rules whenever the review loaded any, or the rebuilt brief silently drops the project rules) and launch an agent with EXACTLY what it prints \u2014 no hand-added ${noun} number` + // --round bakes in a ROUND number. Verify's noun is "shard", and a
+var rebuildFix = /* @__PURE__ */ __name((role, noun) => `build the prompt with \`"\${QWEN_CODE_CLI:-qwen}" review agent-prompt --plan <plan> --role ${role} --findings <file> [--rules <rules file>] ` + // --round is MANDATORY for a reverse-audit build (`agent-prompt` refuses a
+// round-less call — the label keys the record and the budget gate's
+// accounting), so the paste-and-run repair must not bracket it as optional:
+// an orchestrator honouring the bracket convention would have its first
+// repair attempt rejected. Verify genuinely takes it or not (only a repeat
+// verification round passes one), so its brackets stay.
+(role === "reverse-audit" ? `--round <k>\` ` : `[--round <k>]\` `) + (role === "reverse-audit" ? `(an early round with nothing confirmed passes an empty file; ` : `(pass the shard's findings, never an empty file \u2014 a verifier that sees no findings verifies nothing; `) + `pass --rules whenever the review loaded any, or the rebuilt brief silently drops the project rules) and launch an agent with EXACTLY what it prints \u2014 no hand-added ${noun} number` + // --round bakes in a ROUND number. Verify's noun is "shard", and a
 // parenthetical claiming --round bakes it in would send the reader to the
 // wrong flag — shards are already told apart by their findings digest.
 (role === "reverse-audit" ? ` (--round bakes it in)` : ``) + `, no summary of your own, no rewording`, "rebuildFix");
@@ -6667,7 +6856,9 @@ function verificationGaps(planPath, opts, env = process.env) {
     (k) => k === "reverse-audit" || k.startsWith("reverse-audit--")
   );
   const reverse = bestDelivery(reverseKeys);
-  const reverseGap = !balancedMedium && reverse !== "ok";
+  const budgetStopped = readBudgetStop(planPath) !== null;
+  const reverseByDesign = budgetStopped && reverse === "not-built";
+  const reverseGap = !balancedMedium && !reverseByDesign && reverse !== "ok";
   if (reverseGap) {
     remediation.push(
       `reverse audit: ${REVERSE_AUDIT_GAP[reverse].fix.replace(
@@ -6970,8 +7161,27 @@ function unmarkedComments(comments) {
 }
 __name(unmarkedComments, "unmarkedComments");
 
+// packages/cli/src/commands/review/lib/review-footer.ts
+init_esbuild_shims();
+var FOOTER_MARKER = "via Qwen Code /review";
+function reviewFooter(modelId, cliVersion) {
+  return `_\u2014 ${modelId} ${FOOTER_MARKER} (v${cliVersion})_`;
+}
+__name(reviewFooter, "reviewFooter");
+var REVIEW_FOOTER_RE = /\s*(?:_— (?:(?! via Qwen Code \/review)[^\n])* via Qwen Code \/review(?: \(v[^\n)]*\))?_?\s*)+$/;
+function isFooterSafeModelId(modelId) {
+  return !/[\n\r]/.test(modelId) && !modelId.includes(FOOTER_MARKER);
+}
+__name(isFooterSafeModelId, "isFooterSafeModelId");
+var FOOTER_VERSION_RE = /^[A-Za-z0-9._+-]+$/;
+function footerVersion(stamp) {
+  return stamp !== void 0 && FOOTER_VERSION_RE.test(stamp) ? stamp : void 0;
+}
+__name(footerVersion, "footerVersion");
+
 // packages/cli/src/commands/review/compose-review.ts
 var LOW_SIGNAL_SRC_DIFF_LINES = 100;
+var UNVERIFIED_FINDING_TAG_RE = /—\s*\[unverified\]/gi;
 function withMarker(line) {
   return line.startsWith(CRITICAL_PREFIX) ? line : `${CRITICAL_PREFIX} ${line}`;
 }
@@ -6996,6 +7206,10 @@ function toStringList(value, field) {
   return [...value];
 }
 __name(toStringList, "toStringList");
+function stripReviewFooter(entry) {
+  return entry.replace(REVIEW_FOOTER_RE, "");
+}
+__name(stripReviewFooter, "stripReviewFooter");
 function toBool(value, field) {
   if (value === void 0 || value === null) return false;
   if (typeof value !== "boolean") {
@@ -7017,15 +7231,15 @@ __name(composeReview, "composeReview");
 function ledgerMarkerFor(input) {
   try {
     if (!input.planPath) return null;
-    const plan = JSON.parse(readFileSync8(input.planPath, "utf8"));
+    const plan = JSON.parse(readFileSync9(input.planPath, "utf8"));
     const pr = plan?.prNumber;
     const isPr = typeof pr === "number" && Number.isInteger(pr) && pr > 0 || typeof pr === "string" && /^\d+$/.test(pr);
     if (!isPr) return null;
     let prevRound = 0;
     try {
       const prev = JSON.parse(
-        readFileSync8(
-          join8(
+        readFileSync9(
+          join9(
             dirname4(input.planPath),
             `qwen-review-pr-${pr}-prev-ledger.json`
           ),
@@ -7040,7 +7254,7 @@ function ledgerMarkerFor(input) {
       buildLedger(
         prevRound + 1,
         input.draftedComments ?? [],
-        toStringList(input.bodyCriticals, "bodyCriticals")
+        toStringList(input.bodyCriticals, "bodyCriticals").map(stripReviewFooter).filter((entry) => entry.trim() !== "")
       )
     );
   } catch {
@@ -7054,7 +7268,7 @@ function composeReviewBody(input, cliVersion) {
     input.suggestionsInline,
     "suggestionsInline"
   );
-  const bodyCriticals = toStringList(input.bodyCriticals, "bodyCriticals");
+  const bodyCriticals = toStringList(input.bodyCriticals, "bodyCriticals").map(stripReviewFooter).filter((entry) => entry.trim() !== "");
   const suggestionsDiscarded = toCount(
     input.suggestionsDiscarded,
     "suggestionsDiscarded"
@@ -7062,7 +7276,7 @@ function composeReviewBody(input, cliVersion) {
   const cannotTell = toStringList(
     input.cannotTellCriticals,
     "cannotTellCriticals"
-  );
+  ).map(stripReviewFooter).filter((entry) => entry.trim() !== "");
   const uncoverable = toStringList(
     input.uncoverableChunks,
     "uncoverableChunks"
@@ -7072,6 +7286,19 @@ function composeReviewBody(input, cliVersion) {
     "unreviewedDimensions"
   );
   const coverageEntries = [];
+  let budgetEntry;
+  if (input.planPath) {
+    const stop = readBudgetStop(input.planPath);
+    if (stop !== null) {
+      for (let i = unreviewed.length - 1; i >= 0; i--) {
+        if (unreviewed[i].includes(BUDGET_STOP_PHRASE)) {
+          unreviewed.splice(i, 1);
+        }
+      }
+      budgetEntry = budgetStopDisclosure(stop.round ?? void 0);
+      coverageEntries.push(budgetEntry);
+    }
+  }
   const remediation = [];
   const planRef = input.planPath ? shellQuotePath(input.planPath) : "<plan>";
   const missingReceipts = [];
@@ -7202,6 +7429,33 @@ function composeReviewBody(input, cliVersion) {
       criticalsUnverified = criticalsNeedingVerify >= 1;
     }
   }
+  let findingsUnverifiedAtCompose = false;
+  let findingsFileUnreadable = false;
+  let unverifiedTagCount = 0;
+  const findingsPath = input.findingsPath;
+  if (findingsPath !== void 0 && findingsPath !== null) {
+    if (typeof findingsPath !== "string" || findingsPath.trim() === "") {
+      throw new TypeError(
+        `compose-review: findingsPath must be a non-empty string, got ${JSON.stringify(findingsPath)}`
+      );
+    }
+    try {
+      const findingsContent = readFileSync9(findingsPath, "utf8");
+      unverifiedTagCount = (findingsContent.match(UNVERIFIED_FINDING_TAG_RE) ?? []).length;
+      findingsUnverifiedAtCompose = unverifiedTagCount > 0;
+      if (findingsUnverifiedAtCompose) {
+        remediation.push(
+          "findings still tagged `\u2014 [unverified]`: relaunch the verifier for each tagged entry (Step 4, `--role verify` with that entry), apply its verdict in the cumulative findings file, and run compose-review again with the updated file"
+        );
+      }
+    } catch {
+      findingsFileUnreadable = true;
+      findingsUnverifiedAtCompose = true;
+      remediation.push(
+        "findings file not readable: pass the cumulative reverse-audit findings file \u2014 the one every round's `--findings` received \u2014 as `findingsPath` in the state JSON, and run compose-review again"
+      );
+    }
+  }
   const contextUnavailable = toBool(
     input.contextUnavailable,
     "contextUnavailable"
@@ -7231,6 +7485,11 @@ function composeReviewBody(input, cliVersion) {
       "compose-review: modelId is required (the public footer names the reviewing model)"
     );
   }
+  if (!isFooterSafeModelId(modelId)) {
+    throw new TypeError(
+      "compose-review: modelId is interpolated into the public footer verbatim \u2014 it must be a single line that does not contain the footer marker"
+    );
+  }
   const c = criticalsInline + bodyCriticals.length;
   const s = suggestionsInline + suggestionsDiscarded;
   const baseEvent = c >= 1 ? "REQUEST_CHANGES" : s >= 1 ? "COMMENT" : "APPROVE";
@@ -7243,10 +7502,13 @@ function composeReviewBody(input, cliVersion) {
   }
   if (contextUnavailable) cappedBy.push("context-unavailable");
   if (criticalsUnverified) cappedBy.push("criticals-unverified");
+  if (findingsUnverifiedAtCompose) {
+    cappedBy.push("findings-unverified-at-compose");
+  }
   let event2 = baseEvent;
   if (event2 === "APPROVE" && cappedBy.length > 0) event2 = "COMMENT";
   const deterministicBodyCriticals = bodyCriticals.length - nonDeterministicBodyCriticals;
-  if (event2 === "REQUEST_CHANGES" && criticalsUnverified && deterministicBodyCriticals === 0) {
+  if (event2 === "REQUEST_CHANGES" && (criticalsUnverified || findingsUnverifiedAtCompose && criticalsNeedingVerify >= 1) && deterministicBodyCriticals === 0) {
     event2 = "COMMENT";
   }
   let downgraded = false;
@@ -7264,7 +7526,7 @@ function composeReviewBody(input, cliVersion) {
   if (event2 === "APPROVE" && input.planPath) {
     try {
       const plan = JSON.parse(
-        readFileSync8(input.planPath, "utf8")
+        readFileSync9(input.planPath, "utf8")
       );
       const src = Number(plan.srcDiffLines ?? 0);
       if (src > LOW_SIGNAL_SRC_DIFF_LINES) {
@@ -7273,7 +7535,7 @@ function composeReviewBody(input, cliVersion) {
     } catch {
     }
   }
-  const footer = `_\u2014 ${modelId} via Qwen Code /review (v${cliVersion})_`;
+  const footer = reviewFooter(modelId, cliVersion);
   const bilingual = bilingualFromPlan(input.planPath, input.prBodyFetcher);
   const render = /* @__PURE__ */ __name((parts, sep5) => {
     const en = parts.map((p) => p.en).join(sep5);
@@ -7332,7 +7594,7 @@ ${footer}`;
     if (seenCaller.has(d)) continue;
     seenCaller.add(d);
     const echoesCoverage = covEntries.some(
-      (e) => d === e.subject || d.startsWith(`${e.subject} \u2014 `)
+      (e) => d === e.subject || e !== budgetEntry && d.startsWith(`${e.subject} \u2014 `)
     );
     if (!echoesCoverage) callerLeft.push(d);
   }
@@ -7412,11 +7674,23 @@ ${footer}`;
       zh: `Test Plan\uFF08\u975E\u963B\u65AD\uFF09\uFF1A${testPlanNotes.join("; ")}\u3002`
     }
   ] : [];
+  const unverifiedTagsBlock = !findingsUnverifiedAtCompose ? [] : findingsFileUnreadable ? [
+    {
+      en: "\u26A0\uFE0F The reverse-audit findings file could not be read at compose time, so this run cannot show its findings were verified.",
+      zh: "\u26A0\uFE0F \u7EC4\u5408\u8BC4\u5BA1\u65F6\u65E0\u6CD5\u8BFB\u53D6\u53CD\u5411\u5BA1\u8BA1\u53D1\u73B0\u6587\u4EF6\uFF0C\u672C\u6B21\u8FD0\u884C\u65E0\u6CD5\u8BC1\u660E\u5176\u53D1\u73B0\u5DF2\u7ECF\u8FC7\u9A8C\u8BC1\u3002"
+    }
+  ] : [
+    {
+      en: `\u26A0\uFE0F ${unverifiedTagCount} finding(s) still carried the \`\u2014 [unverified]\` tag when the loop ended \u2014 the verifier never ruled on them, and they are not confirmed.`,
+      zh: `\u26A0\uFE0F \u5FAA\u73AF\u7ED3\u675F\u65F6\u4ECD\u6709 ${unverifiedTagCount} \u6761\u53D1\u73B0\u5E26\u7740 \`\u2014 [unverified]\` \u6807\u8BB0\u2014\u2014\u9A8C\u8BC1\u8005\u4ECE\u672A\u5BF9\u5B83\u4EEC\u4F5C\u51FA\u88C1\u51B3\uFF0C\u5B83\u4EEC\u4E0D\u7B97\u5DF2\u786E\u8BA4\u3002`
+    }
+  ];
   if (event2 === "REQUEST_CHANGES") {
     const parts = [
       ...contextUnavailable ? [contextUnavailableClause] : [],
       ...cannotTellBlock,
       ...notReviewedParts,
+      ...unverifiedTagsBlock,
       ...deferredBlock,
       ...testPlanBlock,
       ...bodyCriticalBlock
@@ -7465,8 +7739,9 @@ ${footer}`;
   } else {
     const canCertify = !downgraded && !downgradeApprove && !downgradeRequestChanges && c === 0 && cannotTell.length === 0 && uncoverable.length === 0 && unreviewed.length + coverageEntries.length === 0 && // A missing receipt caps the event but was left out of certification, so a
     // body could open "Reviewed — no blockers." two lines above "nobody read
-    // them." Nothing nobody read can be certified blocker-free.
-    missingReceipts.length === 0;
+    // them." Nothing nobody read can be certified blocker-free — and neither
+    // can a loop that ended with findings no verifier ever ruled on.
+    missingReceipts.length === 0 && !findingsUnverifiedAtCompose;
     const disclosedChunkIds = /* @__PURE__ */ new Set();
     for (const e of coverageEntries) {
       const m = /^chunk (\d+)$/.exec(e.subject);
@@ -7491,6 +7766,7 @@ ${footer}`;
   }
   clauses.push(...cannotTellBlock);
   clauses.push(...notReviewedParts);
+  clauses.push(...unverifiedTagsBlock);
   clauses.push(...deferredBlock);
   clauses.push(...testPlanBlock);
   if (downgradedFrom === "Request changes" || criticalsUnverified) {
@@ -7556,7 +7832,7 @@ function scriptLintGate(planPath) {
   const disclosed = [];
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     unreviewed.push(
       "the executable-script lint \u2014 could not read the plan to check the gate"
@@ -7567,13 +7843,13 @@ function scriptLintGate(planPath) {
     return { criticals, unreviewed, disclosed };
   }
   const owed = hasExecutableScript(plan);
-  const reportPath = join8(
+  const reportPath = join9(
     dirname4(planPath),
     scriptLintReportName(plan.prNumber)
   );
   let report;
   try {
-    report = JSON.parse(readFileSync8(reportPath, "utf8"));
+    report = JSON.parse(readFileSync9(reportPath, "utf8"));
   } catch {
     if (owed) {
       unreviewed.push(
@@ -7629,7 +7905,7 @@ function testPlanGate(planPath) {
   const notes = [];
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     return { notes };
   }
@@ -7639,8 +7915,8 @@ function testPlanGate(planPath) {
   let report;
   try {
     report = JSON.parse(
-      readFileSync8(
-        join8(dirname4(planPath), `qwen-review-pr-${pr}-test-plan.json`),
+      readFileSync9(
+        join9(dirname4(planPath), `qwen-review-pr-${pr}-test-plan.json`),
         "utf8"
       )
     );
@@ -7673,7 +7949,7 @@ function bilingualFromPlan(planPath, fetchPrBody2 = fetchPrBodyViaGh) {
   if (!planPath) return false;
   let plan;
   try {
-    plan = JSON.parse(readFileSync8(planPath, "utf8"));
+    plan = JSON.parse(readFileSync9(planPath, "utf8"));
   } catch {
     return false;
   }
@@ -7693,7 +7969,7 @@ __name(bilingualFromPlan, "bilingualFromPlan");
 function readDraftedComments(path3) {
   let raw;
   try {
-    raw = readFileSync8(path3, "utf8");
+    raw = readFileSync9(path3, "utf8");
   } catch (err) {
     throw new Error(
       `compose-review: cannot read the comments file ${path3}: ${err.message}. Pass the drafted inline comments \u2014 the same array the review payload will carry \u2014 or a file containing [] when nothing anchors inline.`
@@ -7747,7 +8023,7 @@ var composeReviewCommand = {
         "compose-review: --comments is required \u2014 the inline counts are counted from the drafted comments file, never typed. Pass a file containing [] when nothing anchors inline."
       );
     }
-    const raw = readFileSync8(input ?? 0, "utf8");
+    const raw = readFileSync9(input ?? 0, "utf8");
     const parsed = JSON.parse(raw);
     delete parsed.env;
     delete parsed.prBodyFetcher;
@@ -7764,7 +8040,9 @@ var composeReviewCommand = {
         ...countInlineFindings(drafted),
         draftedComments: drafted
       },
-      await getCliVersion()
+      // Same pin as `submit`: the startup stamp, not a version resolved at
+      // compose time — a shared runner can rewrite the install mid-session.
+      footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion()
     );
     const json = JSON.stringify(
       { ...result, verdictLine: verdictLine(result) },
@@ -7772,8 +8050,8 @@ var composeReviewCommand = {
       2
     );
     if (out) {
-      mkdirSync5(dirname4(out), { recursive: true });
-      writeFileSync5(out, json, "utf8");
+      mkdirSync6(dirname4(out), { recursive: true });
+      writeFileSync6(out, json, "utf8");
     }
     writeStdoutLine(json);
     for (const fix of result.remediation) {
@@ -7851,11 +8129,12 @@ function verdictLine(r) {
     "chunk-nobody-read": "part of the diff was never read",
     "uncoverable-chunk": "part of the diff cannot be read at all",
     "unreviewed-dimension": "a dimension nobody reviewed",
-    "context-unavailable": "the PR's existing discussion could not be read"
+    "context-unavailable": "the PR's existing discussion could not be read",
+    "findings-unverified-at-compose": "findings were still unverified when the loop ended"
   };
   let line = `Verdict: ${label2[r.event]}`;
-  if (r.baseEvent === "REQUEST_CHANGES" && r.event === "COMMENT" && r.cappedBy.includes("criticals-unverified")) {
-    line += " \u2014 a Request changes was NOT available: its blockers were never verified (they are posted, disclosed as unverified)";
+  if (r.baseEvent === "REQUEST_CHANGES" && r.event === "COMMENT" && (r.cappedBy.includes("criticals-unverified") || r.cappedBy.includes("findings-unverified-at-compose"))) {
+    line += " \u2014 a Request changes was NOT available: " + (r.cappedBy.includes("criticals-unverified") ? "its blockers were never verified (they are posted, disclosed as unverified)" : "findings were still unverified when the loop ended (they are posted, disclosed)");
   } else if (r.baseEvent === "APPROVE" && r.event !== "APPROVE") {
     const reasons = r.cappedBy.map((c) => why[c] ?? c);
     if (r.downgraded) reasons.push("a presubmit check failed");
@@ -7874,7 +8153,7 @@ __name(verdictLine, "verdictLine");
 
 // packages/cli/src/commands/review/findings.ts
 init_esbuild_shims();
-import { existsSync as existsSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "node:fs";
 import { dirname as dirname5, resolve as resolve5 } from "node:path";
 var SEVERITIES = ["Critical", "Suggestion", "Nice to have"];
 var CONFIDENCES = ["high", "low"];
@@ -8248,7 +8527,7 @@ __name(renderFindings, "renderFindings");
 function readJson(path3, what) {
   let text;
   try {
-    text = readFileSync9(resolve5(path3), "utf8");
+    text = readFileSync10(resolve5(path3), "utf8");
   } catch (err) {
     throw new Error(
       `Could not read the ${what} file at ${JSON.stringify(path3)}: ${err instanceof Error ? err.message : String(err)}`
@@ -8319,8 +8598,8 @@ var findingsCommand = {
     }
     const report = buildReport(findings);
     const target = resolve5(out);
-    mkdirSync6(dirname5(target), { recursive: true });
-    writeFileSync6(target, `${JSON.stringify(report, null, 2)}
+    mkdirSync7(dirname5(target), { recursive: true });
+    writeFileSync7(target, `${JSON.stringify(report, null, 2)}
 `, "utf8");
     const { bySeverity, byConfidence } = report.counts;
     writeStderrLine(
@@ -8351,7 +8630,7 @@ var findingsCommand = {
 // packages/cli/src/commands/review/fetch-pr.ts
 init_esbuild_shims();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname6, resolve as resolve6 } from "node:path";
 
 // packages/cli/src/commands/review/lib/git.ts
@@ -8459,11 +8738,11 @@ var LITERAL_PATHSPECS = "--literal-pathspecs";
 
 // packages/cli/src/commands/review/lib/effort.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 function resolveEffort(explicit) {
   if (explicit && EFFORT_LEVELS.has(explicit)) return explicit;
   try {
-    const parsed = JSON.parse(readFileSync10(PARSE_ARGS_REPORT, "utf8"));
+    const parsed = JSON.parse(readFileSync11(PARSE_ARGS_REPORT, "utf8"));
     if (typeof parsed.effort === "string" && EFFORT_LEVELS.has(parsed.effort)) {
       return parsed.effort;
     }
@@ -8484,7 +8763,7 @@ __name(planEffortField, "planEffortField");
 
 // packages/cli/src/commands/review/lib/report.ts
 init_esbuild_shims();
-import { statSync as statSync3 } from "node:fs";
+import { statSync as statSync5 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/heavy.ts
 init_esbuild_shims();
@@ -8587,7 +8866,7 @@ __name(buildPlanReport, "buildPlanReport");
 function warnOnReportSize(path3, cap) {
   let size = 0;
   try {
-    size = statSync3(path3).size;
+    size = statSync5(path3).size;
   } catch {
     return;
   }
@@ -8710,7 +8989,7 @@ async function runFetchPr(args) {
     );
   }
   try {
-    mkdirSync7(dirname6(wt), { recursive: true });
+    mkdirSync8(dirname6(wt), { recursive: true });
     git("worktree", "add", wt, ref);
   } catch (err) {
     tryRemove(
@@ -8720,7 +8999,7 @@ async function runFetchPr(args) {
       `Failed to create worktree at ${wt}: ${err.message}`
     );
   }
-  mkdirSync7(REVIEW_TMP_DIR, { recursive: true });
+  mkdirSync8(REVIEW_TMP_DIR, { recursive: true });
   const { sha: mergeBaseSha, baseFetchFailed } = resolveMergeBase(
     remote,
     meta.baseRefName,
@@ -8744,7 +9023,7 @@ async function runFetchPr(args) {
         ...PINNED_DIFF_FLAGS,
         `${mergeBaseSha}..${fetchedSha}`
       );
-      writeFileSync7(diffRel, buf);
+      writeFileSync8(diffRel, buf);
       diffText = buf.toString("utf8");
       diffPath = diffRel;
       diffPathAbsolute = resolve6(diffRel);
@@ -8771,7 +9050,7 @@ async function runFetchPr(args) {
   let auditSince = fetchedAt;
   let prevRaw = null;
   try {
-    prevRaw = readFileSync11(out, "utf8");
+    prevRaw = readFileSync12(out, "utf8");
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") {
@@ -8854,7 +9133,7 @@ async function runFetchPr(args) {
     ...buildPlanReport(plan, (path3) => fileLineCount(fetchedSha, path3)),
     ...planEffortField(args.effort)
   };
-  writeFileSync7(out, stringifyPlanReport(result), "utf8");
+  writeFileSync8(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote fetch-pr report to ${out}`);
   if (diffPath) writeStdoutLine(`Wrote review diff to ${diffPath}`);
   writeStderrLine(
@@ -8938,13 +9217,13 @@ var fetchPrCommand = {
 
 // packages/cli/src/commands/review/capture-local.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname7, resolve as resolve8 } from "node:path";
 
 // packages/cli/src/commands/review/lib/local-diff.ts
 init_esbuild_shims();
-import { lstatSync as lstatSync2, statSync as statSync4, realpathSync as realpathSync2 } from "node:fs";
-import { join as join9, relative as relative2, resolve as resolve7, isAbsolute as isAbsolute2, sep as sep2 } from "node:path";
+import { lstatSync as lstatSync2, statSync as statSync6, realpathSync as realpathSync2 } from "node:fs";
+import { join as join10, relative as relative2, resolve as resolve7, isAbsolute as isAbsolute2, sep as sep2 } from "node:path";
 var MAX_UNTRACKED_BYTES = 1e6;
 var MAX_UNTRACKED_FILES = 500;
 var MAX_UNTRACKED_TOTAL_BYTES = 1e7;
@@ -8965,7 +9244,7 @@ function describeUndiffable(abs, st) {
   }
   if (st.isSymbolicLink()) {
     try {
-      return statSync4(abs).isDirectory() ? "is a symlink to a directory \u2014 git cannot diff it as a file" : null;
+      return statSync6(abs).isDirectory() ? "is a symlink to a directory \u2014 git cannot diff it as a file" : null;
     } catch {
       return null;
     }
@@ -9070,7 +9349,7 @@ function captureLocalDiff(opts) {
       for (const path3 of candidates) {
         let bytes;
         try {
-          const abs = join9(repoRoot, path3);
+          const abs = join10(repoRoot, path3);
           const st = lstatSync2(abs);
           const kind = describeUndiffable(abs, st);
           if (kind) {
@@ -9162,10 +9441,10 @@ function runCaptureLocal(args) {
     includeUntracked: args.untracked
   });
   const diffText = capture.diff.toString("utf8");
-  mkdirSync8(REVIEW_TMP_DIR, { recursive: true });
-  mkdirSync8(dirname7(resolve8(out)), { recursive: true });
+  mkdirSync9(REVIEW_TMP_DIR, { recursive: true });
+  mkdirSync9(dirname7(resolve8(out)), { recursive: true });
   const diffPath = tmpFile(target, "diff.txt");
-  writeFileSync8(diffPath, capture.diff);
+  writeFileSync9(diffPath, capture.diff);
   const plan = buildDiffPlan(diffText);
   const result = {
     diffPath,
@@ -9178,7 +9457,7 @@ function runCaptureLocal(args) {
     skippedFiles: capture.skipped,
     ...planEffortField(args.effort)
   };
-  writeFileSync8(out, stringifyPlanReport(result), "utf8");
+  writeFileSync9(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote diff to ${diffPath} and plan to ${out}`);
   if (capture.unbornHead) {
     writeStderrLine(
@@ -9236,13 +9515,13 @@ var captureLocalCommand = {
 
 // packages/cli/src/commands/review/plan-diff.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync10 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 function runPlanDiff(args) {
   const { diff_path: diffPath, out } = args;
   let diffText;
   try {
-    diffText = readFileSync12(diffPath, "utf8");
+    diffText = readFileSync13(diffPath, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read diff file ${diffPath}: ${err.message}`
@@ -9269,8 +9548,8 @@ function runPlanDiff(args) {
     ...buildPlanReport(plan, null),
     ...planEffortField(args.effort)
   };
-  mkdirSync9(REVIEW_TMP_DIR, { recursive: true });
-  writeFileSync9(out, stringifyPlanReport(result), "utf8");
+  mkdirSync10(REVIEW_TMP_DIR, { recursive: true });
+  writeFileSync10(out, stringifyPlanReport(result), "utf8");
   writeStdoutLine(`Wrote diff plan to ${out}`);
   if (plan.diffLines === 0) {
     writeStderrLine(
@@ -9316,8 +9595,8 @@ var planDiffCommand = {
 
 // packages/cli/src/commands/review/pr-context.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname8, join as join11 } from "node:path";
 var SUMMARY_MARKER = "<!-- qwen-review-suggestion-summary -->";
 function isLegacySuggestionSummary(body) {
   return (body ?? "").includes(SUMMARY_MARKER);
@@ -9511,9 +9790,9 @@ function blockerSection(roots, issueBlockers, repliesByRoot, ctx) {
     ""
   ];
   let spent = out.join("\n").length;
-  const charge = /* @__PURE__ */ __name((lines2) => {
-    spent += lines2.join("\n").length;
-    return lines2;
+  const charge = /* @__PURE__ */ __name((lines) => {
+    spent += lines.join("\n").length;
+    return lines;
   }, "charge");
   const refsLine = /* @__PURE__ */ __name((body) => {
     const refs = extractCodeRefs(body);
@@ -9795,9 +10074,9 @@ async function runPrContext(args) {
   }
   if (prevLedger) {
     try {
-      mkdirSync10(dirname8(out), { recursive: true });
-      writeFileSync10(
-        join10(dirname8(out), `qwen-review-pr-${prNumber}-prev-ledger.json`),
+      mkdirSync11(dirname8(out), { recursive: true });
+      writeFileSync11(
+        join11(dirname8(out), `qwen-review-pr-${prNumber}-prev-ledger.json`),
         JSON.stringify(prevLedger, null, 2)
       );
     } catch {
@@ -9812,8 +10091,8 @@ async function runPrContext(args) {
     reviews,
     prevLedger
   );
-  mkdirSync10(dirname8(out), { recursive: true });
-  writeFileSync10(out, md, "utf8");
+  mkdirSync11(dirname8(out), { recursive: true });
+  writeFileSync11(out, md, "utf8");
   const meaningfulReviewCount = reviews.filter(
     (r) => isReviewWorthShowing(stripLedgerMarker(r.body ?? ""))
   ).length;
@@ -9867,7 +10146,7 @@ var prContextCommand = {
 
 // packages/cli/src/commands/review/comment-status.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 var TOUCHED_BY_CAP = 10;
 function buildThreadStatuses(comments, prAuthor, probe) {
@@ -10073,9 +10352,9 @@ async function runCommentStatus(args) {
       summary,
       threads
     };
-    mkdirSync11(dirname9(out), { recursive: true });
+    mkdirSync12(dirname9(out), { recursive: true });
     const json = JSON.stringify(report, null, 2) + "\n";
-    writeFileSync11(out, json, "utf8");
+    writeFileSync12(out, json, "utf8");
     writeStdoutLine(
       `Wrote comment-status report to ${out} (${comments.length} inline comments in ${summary.threads} threads: ${summary.outdated} outdated, ${summary.blockers} blocker(s), ${summary.changedSinceComment} on files changed since their comment, ${summary.withReplies} with replies, ${summary.authorReplied} answered by the PR author)`
     );
@@ -10103,8 +10382,8 @@ async function runCommentStatus(args) {
     writeStdoutLine(
       `warning: comment-status failed: ${msg}. It is an index, not the evidence \u2014 re-derive thread statuses per-comment if needed.`
     );
-    mkdirSync11(dirname9(out), { recursive: true });
-    writeFileSync11(
+    mkdirSync12(dirname9(out), { recursive: true });
+    writeFileSync12(
       out,
       JSON.stringify(
         {
@@ -10166,18 +10445,18 @@ var commentStatusCommand = {
 
 // packages/cli/src/commands/review/load-rules.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "node:fs";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname10 } from "node:path";
 function showFile(baseRef, path3) {
   return gitOpt("show", `${baseRef}:${path3}`);
 }
 __name(showFile, "showFile");
 function extractCodeReviewSection(content) {
-  const lines2 = content.split("\n");
+  const lines = content.split("\n");
   let start = -1;
-  let end = lines2.length;
-  for (let i = 0; i < lines2.length; i++) {
-    const line = lines2[i];
+  let end = lines.length;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
     if (start < 0) {
       if (/^## Code Review\s*$/i.test(line)) start = i;
     } else if (/^## /.test(line)) {
@@ -10186,7 +10465,7 @@ function extractCodeReviewSection(content) {
     }
   }
   if (start < 0) return null;
-  return lines2.slice(start, end).join("\n").trim();
+  return lines.slice(start, end).join("\n").trim();
 }
 __name(extractCodeReviewSection, "extractCodeReviewSection");
 function loadCombined(baseRef) {
@@ -10247,8 +10526,8 @@ __name(loadCombined, "loadCombined");
 async function runLoadRules(args) {
   const { base_ref: baseRef, out } = args;
   const { combined, loaded } = loadCombined(baseRef);
-  mkdirSync12(dirname10(out), { recursive: true });
-  writeFileSync12(out, combined, "utf8");
+  mkdirSync13(dirname10(out), { recursive: true });
+  writeFileSync13(out, combined, "utf8");
   if (loaded.length === 0) {
     writeStdoutLine(
       `No review rules found on ${baseRef}; wrote empty file to ${out}`
@@ -10279,7 +10558,7 @@ var loadRulesCommand = {
 
 // packages/cli/src/commands/review/presubmit.ts
 init_esbuild_shims();
-import { writeFileSync as writeFileSync13, readFileSync as readFileSync13 } from "node:fs";
+import { writeFileSync as writeFileSync14, readFileSync as readFileSync14 } from "node:fs";
 function verdictStamp(run4) {
   return run4.completed_at ?? run4.started_at ?? "";
 }
@@ -10315,7 +10594,7 @@ __name(isCurrentActionsRunCheck, "isCurrentActionsRunCheck");
 function parseFindingsFile(path3) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(path3, "utf8"));
+    parsed = JSON.parse(readFileSync14(path3, "utf8"));
   } catch {
     return null;
   }
@@ -10618,7 +10897,7 @@ async function runPresubmit(args) {
     findingsFileInvalid,
     headDrift
   };
-  writeFileSync13(outPath, JSON.stringify(result, null, 2) + "\n", "utf8");
+  writeFileSync14(outPath, JSON.stringify(result, null, 2) + "\n", "utf8");
   writeStdoutLine(`Wrote presubmit report to ${outPath}`);
 }
 __name(runPresubmit, "runPresubmit");
@@ -10657,17 +10936,17 @@ var presubmitCommand = {
 // packages/cli/src/commands/review/publish-assets.ts
 init_esbuild_shims();
 import { createHash as createHash2 } from "node:crypto";
-import { readFileSync as readFileSync15, statSync as statSync5, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14 } from "node:fs";
+import { readFileSync as readFileSync16, statSync as statSync7, writeFileSync as writeFileSync15, mkdirSync as mkdirSync15 } from "node:fs";
 import { basename as basename5, dirname as dirname11, resolve as resolve10 } from "node:path";
 
 // packages/cli/src/commands/review/lib/authorization.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 
 // packages/cli/src/services/skill-args-file.ts
 init_esbuild_shims();
 import {
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync14,
   openSync as openSync2,
   writeSync,
   closeSync as closeSync2,
@@ -10676,9 +10955,9 @@ import {
   existsSync as existsSync5,
   constants
 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var debugLogger3 = createDebugLogger("SKILL_ARGS_FILE");
-var SKILL_ARGS_DIR = join11(".qwen", "tmp");
+var SKILL_ARGS_DIR = join12(".qwen", "tmp");
 function safe(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "_");
 }
@@ -10688,11 +10967,11 @@ function currentSessionId() {
 }
 __name(currentSessionId, "currentSessionId");
 function skillArgsDir(sessionId = currentSessionId()) {
-  return sessionId ? join11(SKILL_ARGS_DIR, `s-${safe(sessionId)}`) : SKILL_ARGS_DIR;
+  return sessionId ? join12(SKILL_ARGS_DIR, `s-${safe(sessionId)}`) : SKILL_ARGS_DIR;
 }
 __name(skillArgsDir, "skillArgsDir");
 function skillArgsPath(skillName, sessionId = currentSessionId()) {
-  return join11(
+  return join12(
     skillArgsDir(sessionId),
     `qwen-skill-args-${safe(skillName)}.txt`
   );
@@ -10702,7 +10981,7 @@ function writeSkillArgs(skillName, args) {
   const path3 = skillArgsPath(skillName);
   try {
     const dir = skillArgsDir();
-    mkdirSync13(dir, { recursive: true });
+    mkdirSync14(dir, { recursive: true });
     if (lstatSync3(dir).isSymbolicLink()) {
       debugLogger3.warn(
         `Skill args directory ${dir} is a symlink; refusing to write through it.`
@@ -10785,7 +11064,7 @@ function reviewWriteAuthorization(req) {
   const path3 = currentSessionId() === "" && req.skillArgs ? req.skillArgs : sessionScoped;
   let raw;
   try {
-    raw = readFileSync14(path3, "utf8");
+    raw = readFileSync15(path3, "utf8");
   } catch {
     return {
       ok: false,
@@ -10840,7 +11119,64 @@ __name(reviewWriteAuthorization, "reviewWriteAuthorization");
 
 // packages/cli/src/commands/review/lib/assets.ts
 init_esbuild_shims();
-var ASSET_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp"]);
+var EXTENSION_FORMAT = {
+  png: "png",
+  jpg: "jpeg",
+  jpeg: "jpeg",
+  gif: "gif",
+  webp: "webp"
+};
+var ASSET_EXTENSIONS = new Set(Object.keys(EXTENSION_FORMAT));
+function claimedExtension(basename6) {
+  return basename6.includes(".") ? basename6.slice(basename6.lastIndexOf(".") + 1).toLowerCase() : "";
+}
+__name(claimedExtension, "claimedExtension");
+var ASSET_HEADER_BYTES = 16;
+function sniffImageFormat(header) {
+  const at = /* @__PURE__ */ __name((i) => header[i] ?? -1, "at");
+  const ascii = /* @__PURE__ */ __name((i, s) => [...s].every((ch, k) => at(i + k) === ch.charCodeAt(0)), "ascii");
+  if (at(0) === 137 && ascii(1, "PNG") && at(4) === 13 && at(5) === 10 && at(6) === 26 && at(7) === 10) {
+    return "png";
+  }
+  if (at(0) === 255 && at(1) === 216 && at(2) === 255) {
+    return "jpeg";
+  }
+  if (ascii(0, "GIF87a") || ascii(0, "GIF89a")) {
+    return "gif";
+  }
+  if (ascii(0, "RIFF") && ascii(8, "WEBP") && // The container claim is not the image: a RIFF box carrying WEBP at
+  // offset 8 could still hold anything. Every spec-conformant WebP's
+  // first chunk is VP8, VP8L or VP8X at byte 12, and the 16-byte read
+  // this gate sniffs always covers it.
+  (ascii(12, "VP8 ") || ascii(12, "VP8L") || ascii(12, "VP8X"))) {
+    return "webp";
+  }
+  return null;
+}
+__name(sniffImageFormat, "sniffImageFormat");
+function refusedExtension(basename6, ext) {
+  return {
+    ok: false,
+    reason: `${basename6}: extension ${JSON.stringify(ext)} is not an allowed evidence image type (${[...ASSET_EXTENSIONS].join(", ")})`
+  };
+}
+__name(refusedExtension, "refusedExtension");
+function validateAssetContent(basename6, header) {
+  const ext = claimedExtension(basename6);
+  const claimed = Object.hasOwn(EXTENSION_FORMAT, ext) ? EXTENSION_FORMAT[ext] : void 0;
+  if (claimed === void 0) {
+    return refusedExtension(basename6, ext);
+  }
+  const actual = sniffImageFormat(header);
+  if (actual !== claimed) {
+    return {
+      ok: false,
+      reason: `content is ${actual ?? "not a recognized image"} but the extension claims ${claimed} \u2014 evidence is admitted by content, not by name`
+    };
+  }
+  return { ok: true };
+}
+__name(validateAssetContent, "validateAssetContent");
 var MAX_ASSET_BYTES = 10 * 1024 * 1024;
 var MAX_TOTAL_ASSET_BYTES = 40 * 1024 * 1024;
 function assetsBranch(pr) {
@@ -10875,12 +11211,9 @@ function parseAssetsRepo(value) {
 }
 __name(parseAssetsRepo, "parseAssetsRepo");
 function validateAssetFile(basename6, bytes) {
-  const ext = basename6.includes(".") ? basename6.slice(basename6.lastIndexOf(".") + 1).toLowerCase() : "";
+  const ext = claimedExtension(basename6);
   if (!ASSET_EXTENSIONS.has(ext)) {
-    return {
-      ok: false,
-      reason: `${basename6}: extension ${JSON.stringify(ext)} is not an allowed evidence image type (${[...ASSET_EXTENSIONS].join(", ")})`
-    };
+    return refusedExtension(basename6, ext);
   }
   if (bytes <= 0) {
     return { ok: false, reason: `${basename6}: empty file` };
@@ -11051,7 +11384,7 @@ function runPublishAssets(args) {
   const fileList = [...args.files ?? []];
   if (args.findings) {
     try {
-      const artifact = JSON.parse(readFileSync15(resolve10(args.findings), "utf8"));
+      const artifact = JSON.parse(readFileSync16(resolve10(args.findings), "utf8"));
       findings = validateFindings(
         Array.isArray(artifact) ? artifact : artifact.findings
       );
@@ -11081,7 +11414,7 @@ function runPublishAssets(args) {
   for (const file of unique) {
     const abs = resolve10(file);
     try {
-      const st = statSync5(abs);
+      const st = statSync7(abs);
       if (!st.isFile()) throw new Error("not a regular file");
       stats.push({ file, abs, basename: basename5(abs), bytes: st.size });
     } catch (err) {
@@ -11100,13 +11433,21 @@ function runPublishAssets(args) {
   for (const st of stats) {
     let content;
     try {
-      content = readFileSync15(st.abs);
+      content = readFileSync16(st.abs);
     } catch (err) {
       refuse(
         `cannot read ${JSON.stringify(st.file)}: ${err instanceof Error ? err.message : String(err)}`
       );
       return;
     }
+    const contentRuling = validateAssetContent(
+      st.basename,
+      content.subarray(0, ASSET_HEADER_BYTES)
+    );
+    if (!contentRuling.ok) {
+      refuse(`${JSON.stringify(st.file)}: ${contentRuling.reason}`);
+      return;
+    }
     const sha256 = createHash2("sha256").update(content).digest("hex");
     prepared.push({
       file: st.file,
@@ -11147,8 +11488,8 @@ function runPublishAssets(args) {
     published
   };
   const outPath = resolve10(args.out);
-  mkdirSync14(dirname11(outPath), { recursive: true });
-  writeFileSync14(outPath, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync15(dirname11(outPath), { recursive: true });
+  writeFileSync15(outPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   if (findings && !args.findingsOut) {
     writeStderrLine(
@@ -11163,8 +11504,8 @@ function runPublishAssets(args) {
     });
     const report = buildReport(updated);
     const fOut = resolve10(args.findingsOut);
-    mkdirSync14(dirname11(fOut), { recursive: true });
-    writeFileSync14(fOut, `${JSON.stringify(report, null, 2)}
+    mkdirSync15(dirname11(fOut), { recursive: true });
+    writeFileSync15(fOut, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   writeStderrLine(
@@ -11226,19 +11567,19 @@ var publishAssetsCommand = {
 
 // packages/cli/src/commands/review/resolve-anchors.ts
 init_esbuild_shims();
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync15, mkdirSync as mkdirSync15 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync16, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname12, resolve as resolve11 } from "node:path";
 
 // packages/cli/src/commands/review/lib/anchors.ts
 init_esbuild_shims();
 function collectNewSideLines(diffText, file) {
-  const lines2 = diffText.split("\n");
+  const lines = diffText.split("\n");
   const out = [];
   for (const hunk of file.hunks) {
     if (hunk.newCount === 0) continue;
     let newCursor = hunk.newStart;
     for (let n = hunk.diffStart + 1; n <= hunk.diffEnd; n++) {
-      const raw = lines2[n - 1];
+      const raw = lines[n - 1];
       if (raw === void 0) break;
       if (raw.startsWith("+")) {
         out.push({ newLine: newCursor, text: raw.slice(1), added: true });
@@ -11266,20 +11607,20 @@ function normalizeLoose(s) {
 }
 __name(normalizeLoose, "normalizeLoose");
 function anchorVariants(anchor) {
-  const lines2 = anchor.replace(/\r\n/g, "\n").split("\n");
-  while (lines2.length > 0 && lines2[0].trim() === "") lines2.shift();
-  while (lines2.length > 0 && lines2[lines2.length - 1].trim() === "") lines2.pop();
-  if (lines2.length === 0) return [];
-  const variants = [lines2];
-  const meaningful = lines2.filter((l) => l.trim() !== "");
+  const lines = anchor.replace(/\r\n/g, "\n").split("\n");
+  while (lines.length > 0 && lines[0].trim() === "") lines.shift();
+  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
+  if (lines.length === 0) return [];
+  const variants = [lines];
+  const meaningful = lines.filter((l) => l.trim() !== "");
   if (meaningful.length > 0 && meaningful.every((l) => /^\+/.test(l))) {
-    variants.push(lines2.map((l) => l.startsWith("+") ? l.slice(1) : l));
+    variants.push(lines.map((l) => l.startsWith("+") ? l.slice(1) : l));
   }
   const NO_NEWLINE = /^\$/;
-  const marked = lines2.filter((l) => l !== "" && !NO_NEWLINE.test(l));
+  const marked = lines.filter((l) => l !== "" && !NO_NEWLINE.test(l));
   if (marked.length > 0 && marked.every((l) => /^[+\- ]/.test(l)) && marked.some((l) => l.startsWith("+"))) {
     variants.push(
-      lines2.filter((l) => !l.startsWith("-") && !NO_NEWLINE.test(l)).map((l) => l.slice(1))
+      lines.filter((l) => !l.startsWith("-") && !NO_NEWLINE.test(l)).map((l) => l.slice(1))
     );
   }
   return variants;
@@ -11451,7 +11792,7 @@ __name(validateRequests, "validateRequests");
 function runResolveAnchors(args) {
   let diffText;
   try {
-    diffText = readFileSync16(args.diff, "utf8");
+    diffText = readFileSync17(args.diff, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read diff file ${args.diff}: ${err.message}`
@@ -11459,7 +11800,7 @@ function runResolveAnchors(args) {
   }
   let rawText;
   try {
-    rawText = readFileSync16(args.input, "utf8");
+    rawText = readFileSync17(args.input, "utf8");
   } catch (err) {
     throw new Error(
       `Cannot read findings file ${args.input}: ${err.message}`
@@ -11490,8 +11831,8 @@ function runResolveAnchors(args) {
       loose: resolved.filter((r) => r.tier?.startsWith("loose")).length
     }
   };
-  mkdirSync15(dirname12(resolve11(args.out)), { recursive: true });
-  writeFileSync15(args.out, JSON.stringify(report, null, 2), "utf8");
+  mkdirSync16(dirname12(resolve11(args.out)), { recursive: true });
+  writeFileSync16(args.out, JSON.stringify(report, null, 2), "utf8");
   writeStdoutLine(`Wrote resolved anchors to ${args.out}`);
   const s = report.stats;
   writeStderrLine(
@@ -11538,7 +11879,7 @@ var resolveAnchorsCommand = {
 
 // packages/cli/src/commands/review/check-coverage.ts
 init_esbuild_shims();
-import { writeFileSync as writeFileSync16, mkdirSync as mkdirSync16 } from "node:fs";
+import { writeFileSync as writeFileSync17, mkdirSync as mkdirSync17 } from "node:fs";
 import { dirname as dirname13, resolve as resolve12 } from "node:path";
 function runCheckCoverage(args) {
   let report;
@@ -11555,8 +11896,8 @@ This is an environment problem, not a finding about the agents. Coverage cannot
     }
     throw err;
   }
-  mkdirSync16(dirname13(resolve12(args.out)), { recursive: true });
-  writeFileSync16(args.out, JSON.stringify(report, null, 2));
+  mkdirSync17(dirname13(resolve12(args.out)), { recursive: true });
+  writeFileSync17(args.out, JSON.stringify(report, null, 2));
   writeStdoutLine(`Wrote coverage report to ${args.out}`);
   const totalChunks = report.coveredChunks.length + report.missingChunks.length + report.uncoverableChunks.length;
   const worked = report.agents - report.blindAgents.length - report.idleAgents.length;
@@ -11655,8 +11996,172 @@ var checkCoverageCommand = {
 // packages/cli/src/commands/review/agent-prompt.ts
 init_esbuild_shims();
 import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname14, join as join12, resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { dirname as dirname14, join as join13, resolve as resolve13 } from "node:path";
+
+// packages/cli/src/commands/review/lib/retirement.ts
+init_esbuild_shims();
+import { statSync as statSync8 } from "node:fs";
+var REVERSE_AUDIT_MAX_ROUNDS = 5;
+var RECORD_KEY_RE = /^reverse-audit--chunk-(\d+)--round-(\d+)--[0-9a-f]+$/;
+var REVERSE_AUDIT_MARKER = "reverse-audit";
+function bakedRanges(prompt, diffPath) {
+  const out = [];
+  if (diffPath === void 0) return out;
+  for (const m of prompt.matchAll(
+    /read_file\(\s*file_path="([^"]*)",\s*offset=(\d+),\s*limit=(\d+)/gi
+  )) {
+    if (m[1] !== diffPath) continue;
+    const offset = Number(m[2]);
+    const limit = Number(m[3]);
+    if (limit > 0) out.push([offset + 1, offset + limit]);
+  }
+  return out;
+}
+__name(bakedRanges, "bakedRanges");
+var FILE_LINE_RE = /\*\*File:\*\*\s*([^\n]*)/g;
+var SEVERITY_LINE_RE = /\*\*Severity:\*\*/;
+var DRY_RECEIPT_RE = new RegExp(
+  '(?:\\bno (?:new )?(?:issues?|findings?|gaps?)[ \\w()]{0,32}?|\u672A\u53D1\u73B0(?:\u65B0\u7684?)?(?:\u95EE\u9898|\u53D1\u73B0)|\u65E0\u65B0\u7684?(?:\u95EE\u9898|\u53D1\u73B0)|\u6CA1\u6709(?:\u53D1\u73B0)?(?:\u65B0\u7684?)?\u95EE\u9898)\\s*[*_)\\]"\u201D\u2019]*\\s*(?:[\u2014\u2013]+|[:\uFF1A]|--+|-+\\s)\\s*([\\s\\S]*)',
+  "i"
+);
+var CJK_RE = /[一-鿿]/g;
+var EXAMPLE_RECEIPT_CLAUSE = (DRY_RECEIPT_RE.exec(REVERSE_AUDIT_EXAMPLE_RECEIPT)?.[1] ?? "").trim();
+function substantiveClause(clause) {
+  const c = clause.replace(/\s+/g, " ").trim();
+  if (c.length === 0) return false;
+  if (EXAMPLE_RECEIPT_CLAUSE.length > 0 && c.includes(EXAMPLE_RECEIPT_CLAUSE)) {
+    return false;
+  }
+  if (/`[^`]+`/.test(c)) return true;
+  if (/\w[\w.-]+\/[\w.$-]+\/\w/.test(c)) return true;
+  if (/\w[\w.-]+\/[\w$-]+\.\w+/.test(c)) return true;
+  if ((c.match(CJK_RE) ?? []).length >= 4) return true;
+  return c.length >= 20;
+}
+__name(substantiveClause, "substantiveClause");
+function classifyReturn(rec, territory) {
+  const text = rec.finalText.trim();
+  if (SEVERITY_LINE_RE.test(text)) {
+    for (const m of text.matchAll(FILE_LINE_RE)) {
+      const file = (m[1] ?? "").trim();
+      if (file === "" || /^N\/A\b/i.test(file)) continue;
+      if (rec.launchPrompt.includes(`**File:** ${file}`)) continue;
+      return "yielded";
+    }
+  }
+  const receipt = DRY_RECEIPT_RE.exec(text);
+  if (rec.successfulToolCalls > 0 && rec.diffToolCalls > 0 && openedTheTerritory(rec.diffReads, territory) && receipt !== null && substantiveClause(receipt[1] ?? "")) {
+    return "dry";
+  }
+  return "unknown";
+}
+__name(classifyReturn, "classifyReturn");
+function openedTheTerritory(diffReads, territory) {
+  if (territory.length === 0) return true;
+  return diffReads.some(
+    ([s, e]) => territory.some(([ts, te]) => s <= te && ts <= e)
+  );
+}
+__name(openedTheTerritory, "openedTheTerritory");
+function mergeOutcomes(outcomes) {
+  if (outcomes.includes("yielded")) return "yielded";
+  if (outcomes.includes("dry")) return "dry";
+  return "unknown";
+}
+__name(mergeOutcomes, "mergeOutcomes");
+function scheduleReverseAuditRound(planPath, chunkIds, round, env = process.env, diffPath) {
+  if (round < 3) {
+    return {
+      due: [...chunkIds],
+      coldChecks: [],
+      skipped: [],
+      converged: false
+    };
+  }
+  const since = statSync8(planPath).mtimeMs;
+  const transcripts = readTranscripts(since, env, diffPath);
+  const built = readRecordedPrompts(planPath, since);
+  const records = [];
+  for (const [key, prompt] of built) {
+    const m = RECORD_KEY_RE.exec(key);
+    if (!m) continue;
+    const r = Number(m[2]);
+    if (r >= round) continue;
+    records.push({
+      chunkId: Number(m[1]),
+      round: r,
+      // Flattened ONCE per record, beside the once-per-transcript flatten
+      // below: the pairing walk pays neither half per (record, transcript)
+      // pair.
+      lines: promptLines(prompt),
+      territory: bakedRanges(prompt, diffPath)
+    });
+  }
+  const candidates = transcripts.filter((t2) => t2.launchPrompt.includes(REVERSE_AUDIT_MARKER)).map((t2) => ({ transcript: t2, flat: flattenPrompt(t2.launchPrompt) }));
+  const matchesByRecord = records.map(
+    (rec) => candidates.filter((c) => deliveredVerbatimLines(c.flat, rec.lines)).map((c) => c.transcript)
+  );
+  const recordsPerTranscript = /* @__PURE__ */ new Map();
+  for (const matches of matchesByRecord) {
+    for (const t2 of matches) {
+      recordsPerTranscript.set(t2, (recordsPerTranscript.get(t2) ?? 0) + 1);
+    }
+  }
+  const outcomesByRecord = matchesByRecord.map(
+    (matches, i) => matches.filter((t2) => recordsPerTranscript.get(t2) === 1).map((t2) => classifyReturn(t2, records[i].territory))
+  );
+  const history = /* @__PURE__ */ new Map();
+  records.forEach((rec, i) => {
+    let byRound = history.get(rec.chunkId);
+    if (!byRound) {
+      byRound = /* @__PURE__ */ new Map();
+      history.set(rec.chunkId, byRound);
+    }
+    byRound.set(rec.round, [
+      ...byRound.get(rec.round) ?? [],
+      ...outcomesByRecord[i]
+    ]);
+  });
+  const due = [];
+  const coldChecks = [];
+  const skipped = [];
+  for (const chunkId of chunkIds) {
+    const audits = [...history.get(chunkId)?.entries() ?? []].map(([r, outcomes]) => ({ round: r, outcome: mergeOutcomes(outcomes) })).sort((a, b) => a.round - b.round);
+    const lastTwo = audits.slice(-2);
+    const retired = lastTwo.length === 2 && lastTwo.every((a) => a.outcome === "dry");
+    if (!retired) {
+      due.push(chunkId);
+      continue;
+    }
+    if (round % 2 === 0) {
+      due.push(chunkId);
+      coldChecks.push(chunkId);
+    } else {
+      skipped.push({
+        chunkId,
+        dryRounds: [lastTwo[0].round, lastTwo[1].round],
+        // The next even round — this branch only runs on odd rounds, so
+        // that is always round + 1. Whether the cap allows it is the note
+        // composer's question, not the schedule's (see
+        // REVERSE_AUDIT_MAX_ROUNDS).
+        nextColdCheck: round + 1
+      });
+    }
+  }
+  return {
+    due,
+    coldChecks,
+    skipped,
+    // An empty `chunkIds` empties `due` vacuously — nothing was ever under
+    // audit, so nothing has proven itself cold. `runAllChunks` refuses a
+    // chunkless plan long before scheduling, but this function is exported,
+    // and convergence is an exit-5 termination rule: it must not be
+    // reachable from nothing.
+    converged: chunkIds.length > 0 && due.length === 0
+  };
+}
+__name(scheduleReverseAuditRound, "scheduleReverseAuditRound");
 
 // packages/cli/src/commands/review/lib/path-rules.ts
 init_esbuild_shims();
@@ -12108,7 +12613,7 @@ function buildRoleBrief(report, role, opts = {}) {
         "agent-prompt: --role 0 needs a plan with `prNumber` and `ownerRepo` (the report `fetch-pr` writes). Issue fidelity has nothing to check against without a pull request."
       );
     }
-    const ctx = opts.planPath ? join12(dirname14(resolve13(opts.planPath)), `qwen-review-pr-${pr}-context.md`) : null;
+    const ctx = opts.planPath ? join13(dirname14(resolve13(opts.planPath)), `qwen-review-pr-${pr}-context.md`) : null;
     parts.push(
       "",
       `**This PR:** #${pr} of \`${repo}\`. Use exactly that number and repo \u2014 a bare \`gh pr view\` falls back to the current branch's PR and would judge this diff against an unrelated issue.`
@@ -12367,7 +12872,7 @@ The \`description\` parameter of each Agent call is the task name the user watch
   );
 }
 __name(runRoster, "runRoster");
-function runAllChunks(report, planPath, role, findingsContent, rules, round) {
+function requireAuditableChunks(report) {
   if (!Array.isArray(report.chunks) || report.chunks.length === 0) {
     throw new Error("agent-prompt: the plan has no `chunks[]`.");
   }
@@ -12378,9 +12883,60 @@ function runAllChunks(report, planPath, role, findingsContent, rules, round) {
       `agent-prompt: the plan has ${problem} \u2014 a round built from what remains would look complete while a territory goes unaudited. Re-run the Step 1 capture; do not hand-edit the plan.`
     );
   }
+  return chunks;
+}
+__name(requireAuditableChunks, "requireAuditableChunks");
+function admitReverseAuditRound(planPath, round) {
+  const spent = reverseAuditBudgetExhausted(
+    process.env,
+    expectedRoundSeconds(planPath, round)
+  );
+  if (spent !== null) {
+    writeBudgetStop(planPath, spent, round);
+    writeStderrLine(reverseAuditBudgetMessage(spent, round));
+    process.exitCode = 4;
+    return false;
+  }
+  return true;
+}
+__name(admitReverseAuditRound, "admitReverseAuditRound");
+function refuseConverged() {
+  writeStderrLine(
+    "CONVERGED: every chunk holds two consecutive substantive dry audits; the reverse audit has converged \u2014 stop the loop and proceed to Step 6. This is a clean convergence, not a gap: no unreviewedDimensions entry is owed."
+  );
+  process.exitCode = 5;
+}
+__name(refuseConverged, "refuseConverged");
+function runAllChunks(report, planPath, role, findingsContent, rules, round) {
+  const chunks = requireAuditableChunks(report);
+  let schedule = null;
+  if (role === "reverse-audit" && round !== void 0 && round >= 3) {
+    try {
+      schedule = scheduleReverseAuditRound(
+        planPath,
+        chunks.map((c) => c.id),
+        round,
+        process.env,
+        typeof report.diffPathAbsolute === "string" ? report.diffPathAbsolute : void 0
+      );
+    } catch {
+      schedule = null;
+    }
+  }
+  if (schedule !== null && schedule.converged) {
+    refuseConverged();
+    return;
+  }
+  if (role === "reverse-audit" && !admitReverseAuditRound(planPath, round)) {
+    return;
+  }
+  const dueSet = schedule === null ? null : new Set(schedule.due);
+  const dueChunks = dueSet === null ? chunks : chunks.filter((c) => dueSet.has(c.id));
+  const coldSet = new Set(schedule?.coldChecks ?? []);
+  const skipped = schedule?.skipped ?? [];
   const digest = findingsDigest(findingsContent, rules);
   const roundPart = round !== void 0 ? `--round-${round}` : "";
-  const blocks = chunks.map((c, i) => {
+  const blocks = dueChunks.map((c, i) => {
     const key = `${role}--chunk-${c.id}${roundPart}--${digest}`;
     const { prompt } = buildLaunch(
       report,
@@ -12390,17 +12946,29 @@ function runAllChunks(report, planPath, role, findingsContent, rules, round) {
     );
     const printed = foldFindings(role, findingsContent, prompt);
     recordPrompt(planPath, key, printed);
-    return `\u2500\u2500\u2500\u2500\u2500 auditor ${i + 1} of ${chunks.length} \u2014 chunk ${c.id} \u2500\u2500\u2500\u2500\u2500
+    const cold = coldSet.has(c.id) ? " (cold check)" : "";
+    return `\u2500\u2500\u2500\u2500\u2500 auditor ${i + 1} of ${dueChunks.length} \u2014 chunk ${c.id}${cold} \u2500\u2500\u2500\u2500\u2500
 
 ` + printed;
   });
+  const scope = skipped.length === 0 ? "one per chunk" : `one per chunk still under audit (${skipped.length} retired chunk(s) skipped; the retirement note after the end-of-round line says which \u2014 relay it to the terminal)`;
+  const retirementNote = skipped.length === 0 ? [] : [
+    `retirement: a chunk whose two most recent audits are substantive dry receipts is cold-checked on alternating rounds instead of audited on every one; a cold check that yields returns it to every-round auditing. Skipped this round:
+` + skipped.map(
+      (s) => `chunk ${s.chunkId} \u2014 retired: dry in rounds ${s.dryRounds[0]} and ${s.dryRounds[1]}, ` + (s.nextColdCheck > REVERSE_AUDIT_MAX_ROUNDS ? `certificate final \u2014 the ${REVERSE_AUDIT_MAX_ROUNDS}-round hard cap leaves the loop no round for a cold check` : `next cold check round ${s.nextColdCheck}`)
+    ).join("\n")
+  ];
   writeStdoutLine(
     [
-      `${chunks.length} auditors required this round \u2014 one per chunk. Launch one agent per block below, passing its block VERBATIM \u2014 copy, do not retype, and NEVER sample this output (no \`| head\`): the text IS the deliverable, and a launch reconstructed from a sample matches no record. Blocks are numbered \`auditor k of ${chunks.length}\` and the output ends with an end-of-round line \u2014 if either is missing, the output was truncated in transit; rebuild just the missing chunks with --chunk <id>. Write each Agent call's \`description\` (the task name the user watches) in your output language, translating the separator label \u2014 display only; the prompt stays the block VERBATIM.`,
+      `${dueChunks.length} auditors required this round \u2014 ${scope}. Launch one agent per block below, passing its block VERBATIM \u2014 copy, do not retype, and NEVER sample this output (no \`| head\`): the text IS the deliverable, and a launch reconstructed from a sample matches no record. Blocks are numbered \`auditor k of ${dueChunks.length}\`, and the output ends with an end-of-round line \u2014 followed by the retirement note, when there is one. If either the numbering or the end-of-round line is missing, the output was truncated in transit; rebuild just the missing chunks with --chunk <id>. Write each Agent call's \`description\` (the task name the user watches) in your output language, translating the separator label \u2014 display only; the prompt stays the block VERBATIM.`,
       ...blocks,
-      `\u2500\u2500\u2500\u2500\u2500 end of round \u2014 ${chunks.length} auditors \u2500\u2500\u2500\u2500\u2500`
+      `\u2500\u2500\u2500\u2500\u2500 end of round \u2014 ${dueChunks.length} auditors \u2500\u2500\u2500\u2500\u2500`,
+      ...retirementNote
     ].join("\n\n")
   );
+  if (role === "reverse-audit") {
+    stampRound(planPath, round);
+  }
 }
 __name(runAllChunks, "runAllChunks");
 function runAgentPrompt(args) {
@@ -12483,6 +13051,11 @@ function runAgentPrompt(args) {
         );
       }
     }
+    if (role === "reverse-audit" && !hasRound) {
+      bad(
+        "--role reverse-audit builds one round of the Step 5 loop and requires --round <k>: the label keys the record and the budget gate's per-round accounting."
+      );
+    }
   } else if (hasFindings) {
     const findingRoles = Object.keys(BRIEFS).filter(
       (r) => BRIEFS[r].acceptsFindings
@@ -12513,7 +13086,7 @@ function runAgentPrompt(args) {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync17(args.plan, "utf8"));
+    report = JSON.parse(readFileSync18(args.plan, "utf8"));
   } catch (err) {
     throw new Error(
       `agent-prompt: cannot read the plan ${args.plan}: ${err.message}`
@@ -12522,7 +13095,7 @@ function runAgentPrompt(args) {
   let rules;
   if (args.rules) {
     try {
-      rules = readFileSync17(args.rules, "utf8");
+      rules = readFileSync18(args.rules, "utf8");
     } catch (err) {
       throw new Error(
         `agent-prompt: cannot read the rules ${args.rules}: ${err.message}. Omit --rules if this review has none; passing a path that does not resolve would silently review without the project rules it was told to enforce.`
@@ -12537,7 +13110,7 @@ function runAgentPrompt(args) {
   if (hasFindings && args.role) {
     const role = args.role;
     try {
-      findingsContent = readFileSync17(args.findings, "utf8");
+      findingsContent = readFileSync18(args.findings, "utf8");
     } catch (err) {
       throw new Error(
         `agent-prompt: cannot read the findings ${args.findings}: ${err.message}. Pass a path that resolves \u2014 --findings is required for this role, so omitting it only fails one guard earlier. An early reverse-audit round with nothing confirmed passes an empty file (create it first).`
@@ -12549,6 +13122,30 @@ function runAgentPrompt(args) {
       );
     }
   }
+  if (args.role === "reverse-audit" && !hasChunk && !args.allChunks && !admitReverseAuditRound(args.plan, args.round)) {
+    return;
+  }
+  if (args.role === "reverse-audit" && hasChunk && !readRoundStamps(args.plan).some((s) => s.round === (args.round ?? null))) {
+    if (args.round !== void 0) {
+      let schedule = null;
+      try {
+        schedule = scheduleReverseAuditRound(
+          args.plan,
+          (Array.isArray(report.chunks) ? report.chunks : []).map((c) => c?.id).filter((id) => typeof id === "number"),
+          args.round,
+          process.env,
+          typeof report.diffPathAbsolute === "string" ? report.diffPathAbsolute : void 0
+        );
+      } catch {
+        schedule = null;
+      }
+      if (schedule !== null && schedule.converged) {
+        refuseConverged();
+        return;
+      }
+    }
+    if (!admitReverseAuditRound(args.plan, args.round)) return;
+  }
   if (args.allChunks && args.role && findingsContent !== void 0) {
     runAllChunks(
       report,
@@ -12588,11 +13185,14 @@ function runAgentPrompt(args) {
   const printed = findingsContent !== void 0 && args.role ? foldFindings(args.role, findingsContent, prompt) : prompt;
   recordPrompt(args.plan, key, printed);
   writeStdoutLine(printed);
+  if (args.role === "reverse-audit") {
+    stampRound(args.plan, args.round);
+  }
 }
 __name(runAgentPrompt, "runAgentPrompt");
 var agentPromptCommand = {
   command: "agent-prompt",
-  describe: "Build a review agent's launch prompt from the plan (the diff path, its line ranges and the agent's own brief are welded in, not left to the caller to remember)",
+  describe: "Build a review agent's launch prompt from the plan (the diff path, its line ranges and the agent's own brief are welded in, not left to the caller to remember). Exit codes: 0 built; 4 the review time budget refused another reverse-audit round (a termination rule, not an error \u2014 see the BUDGET line on stderr); 5 the reverse audit CONVERGED \u2014 every chunk holds two consecutive substantive dry audits and none is due a cold check, so stop the loop and proceed to Step 6 (also a termination rule, and a clean one: no disclosure is owed); anything else is a bad call or a broken plan.",
   builder: /* @__PURE__ */ __name((yargs) => yargs.option("plan", {
     type: "string",
     demandOption: true,
@@ -12603,13 +13203,13 @@ var agentPromptCommand = {
     describe: "The dimension this agent owns. Builds its WHOLE prompt \u2014 the diff's line ranges, the brief, the finding format, the severity definitions and the project rules. Pass it to the agent verbatim."
   }).option("chunk", {
     type: "number",
-    describe: "Which chunk id this agent owns (a Step 3B territory agent)"
+    describe: "Which chunk id this agent owns (a Step 3B territory agent). With --role reverse-audit --round N it rebuilds ONE auditor of that round: a round already admitted is repaired without gates; a round never admitted answers to the same convergence and budget gates as --all-chunks."
   }).option("file", {
     type: "string",
     describe: "The heavily-rewritten file an invariant agent owns (--role invariant-a|invariant-b|invariant-c)"
   }).option("all-chunks", {
     type: "boolean",
-    describe: "With --role reverse-audit --findings: build one block per chunk in one call, labelled and separated (Step 5, 3B). Never sample the output; each block is pasted verbatim to its own agent."
+    describe: "With --role reverse-audit --findings: build one block per chunk in one call, labelled and separated (Step 5, 3B). Never sample the output; each block is pasted verbatim to its own agent. From --round 3 on, a chunk whose two most recent audits were both substantive dry receipts is retired to alternating-round cold checks (the retirement note after the end-of-round line says which); a round where every chunk is retired and none is due exits 5 \u2014 the audit has converged."
   }).option("roster", {
     type: "boolean",
     describe: "Build EVERY prompt the plan requires \u2014 chunk, dimension and invariant agents alike \u2014 in one call, each labelled and separated. The list is the same one check-coverage reads out of the plan."
@@ -12647,17 +13247,17 @@ init_esbuild_shims();
 import { spawnSync as spawnSync2 } from "node:child_process";
 import {
   existsSync as existsSync7,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   rmSync as rmSync5,
   statfsSync,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "node:fs";
-import { join as join14, resolve as resolve14 } from "node:path";
+import { join as join15, resolve as resolve14 } from "node:path";
 
 // packages/cli/src/commands/review/lib/workspaces.ts
 init_esbuild_shims();
-import { existsSync as existsSync6, readFileSync as readFileSync18, readdirSync as readdirSync4 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync19, readdirSync as readdirSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 function isWorkspaceMember(filePath, workspaceGlobs) {
   return workspaceDirFor(filePath, workspaceGlobs) !== null;
 }
@@ -12665,9 +13265,10 @@ __name(isWorkspaceMember, "isWorkspaceMember");
 function workspaceDirFor(filePath, workspaceGlobs) {
   const norm = filePath.replace(/^\.\//, "");
   let owner = null;
+  const previous = [];
   for (const glob of workspaceGlobs) {
     const negated = glob.startsWith("!");
-    const g = glob.replace(/^!/, "").replace(/\/$/, "");
+    const g = glob.replace(/^!/, "").replace(/^\.\//, "").replace(/\/$/, "");
     let dir = null;
     if (g.endsWith("/*")) {
       const base = g.slice(0, -2);
@@ -12679,14 +13280,27 @@ function workspaceDirFor(filePath, workspaceGlobs) {
       dir = g;
     }
     if (dir === null) continue;
-    owner = negated ? null : dir;
+    if (!negated) {
+      if (dir !== owner) {
+        previous.push(owner);
+        owner = dir;
+      }
+    } else if (dir === owner) {
+      owner = previous.pop() ?? null;
+    }
   }
   return owner;
 }
 __name(workspaceDirFor, "workspaceDirFor");
+function isNegationExcluded(filePath, workspaceGlobs) {
+  if (workspaceDirFor(filePath, workspaceGlobs) !== null) return false;
+  const positives = workspaceGlobs.filter((g) => !g.startsWith("!"));
+  return workspaceDirFor(filePath, positives) !== null;
+}
+__name(isNegationExcluded, "isNegationExcluded");
 function hasUnmodeledWorkspaceGlob(globs) {
   return globs.some((glob) => {
-    const g = glob.replace(/^!/, "");
+    const g = glob.replace(/^!/, "").replace(/^\.\//, "");
     if (!g.includes("*")) return false;
     return !/^[^*]+\/\*$/.test(g);
   });
@@ -12695,7 +13309,7 @@ __name(hasUnmodeledWorkspaceGlob, "hasUnmodeledWorkspaceGlob");
 function readWorkspaceGlobs(root) {
   try {
     const pkg = JSON.parse(
-      readFileSync18(join13(root, "package.json"), "utf8")
+      readFileSync19(join14(root, "package.json"), "utf8")
     );
     const ws = pkg.workspaces;
     const globs = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
@@ -12708,31 +13322,51 @@ __name(readWorkspaceGlobs, "readWorkspaceGlobs");
 function readRootPackage(root) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync18(join13(root, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync19(join14(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
+  if (pkg === null) return null;
   const scripts = Object.keys(pkg.scripts ?? {});
   if (!scripts.includes("build") && !scripts.includes("test")) return null;
+  const scriptsText = {};
+  for (const [k, v] of Object.entries(pkg.scripts ?? {})) {
+    if (typeof v === "string") scriptsText[k] = v;
+  }
   return {
     dir: ".",
     name: typeof pkg.name === "string" && pkg.name ? pkg.name : "root",
     scripts,
-    deps: []
+    deps: declaredDeps(pkg),
+    scriptsText
   };
 }
 __name(readRootPackage, "readRootPackage");
-function readWorkspacePackages(root) {
-  const globs = readWorkspaceGlobs(root);
+function scriptFansOut(text) {
+  return typeof text === "string" && /(^|\s)(--workspaces(?=\s|$)|--?ws(?=\s|$))/.test(text);
+}
+__name(scriptFansOut, "scriptFansOut");
+function declaredDeps(pkg) {
+  return [
+    ...Object.keys(pkg.dependencies ?? {}),
+    ...Object.keys(pkg.devDependencies ?? {}),
+    ...Object.keys(pkg.peerDependencies ?? {}),
+    ...Object.keys(pkg.optionalDependencies ?? {})
+  ];
+}
+__name(declaredDeps, "declaredDeps");
+function workspaceDirCandidates(root, globs) {
   const dirs = /* @__PURE__ */ new Set();
   for (const glob of globs) {
     if (glob.startsWith("!")) continue;
-    const g = glob.replace(/\/$/, "");
+    const g = glob.replace(/^\.\//, "").replace(/\/$/, "");
     if (g.endsWith("/*")) {
       const base = g.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync4(join13(root, base), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+        entries = readdirSync4(join14(root, base), { withFileTypes: true }).filter(
+          (e) => e.isDirectory() || e.isSymbolicLink() && existsSync6(join14(root, base, e.name, "package.json"))
+        ).map((e) => e.name);
       } catch {
         continue;
       }
@@ -12741,30 +13375,43 @@ function readWorkspacePackages(root) {
       dirs.add(g);
     }
   }
-  const pkgs = [];
-  for (const dir of dirs) {
-    if (workspaceDirFor(`${dir}/package.json`, globs) !== dir) continue;
-    const manifest = join13(root, dir, "package.json");
+  return [...dirs].sort();
+}
+__name(workspaceDirCandidates, "workspaceDirCandidates");
+function readWorkspacePackages(root) {
+  const globs = readWorkspaceGlobs(root);
+  const packages = [];
+  const skipped = [];
+  for (const dir of workspaceDirCandidates(root, globs)) {
+    const manifest = join14(root, dir, "package.json");
     if (!existsSync6(manifest)) continue;
+    if (workspaceDirFor(`${dir}/package.json`, globs) !== dir) {
+      const positives = globs.filter((g) => !g.startsWith("!"));
+      if (workspaceDirFor(`${dir}/package.json`, positives) === dir) continue;
+      skipped.push(dir);
+      continue;
+    }
     let pkg;
     try {
-      pkg = JSON.parse(readFileSync18(manifest, "utf8"));
+      pkg = JSON.parse(readFileSync19(manifest, "utf8"));
     } catch {
+      skipped.push(dir);
+      continue;
+    }
+    if (pkg === null || typeof pkg.name !== "string" || !pkg.name) {
+      skipped.push(dir);
       continue;
     }
-    if (typeof pkg.name !== "string" || !pkg.name) continue;
-    pkgs.push({
+    packages.push({
       dir,
       name: pkg.name,
       scripts: Object.keys(pkg.scripts ?? {}),
-      deps: [
-        ...Object.keys(pkg.dependencies ?? {}),
-        ...Object.keys(pkg.devDependencies ?? {}),
-        ...Object.keys(pkg.peerDependencies ?? {})
-      ]
+      deps: declaredDeps(pkg)
     });
   }
-  return pkgs.sort((a, b) => a.dir.localeCompare(b.dir));
+  packages.sort((a, b) => a.dir.localeCompare(b.dir));
+  skipped.sort();
+  return { packages, skipped };
 }
 __name(readWorkspacePackages, "readWorkspacePackages");
 function affectedWorkspaces(changedFiles, workspaceGlobs) {
@@ -12776,8 +13423,7 @@ function affectedWorkspaces(changedFiles, workspaceGlobs) {
   return [...dirs].sort();
 }
 __name(affectedWorkspaces, "affectedWorkspaces");
-function buildSetFor(affected, packages, alsoBuild = []) {
-  const byDir = new Map(packages.map((p) => [p.dir, p]));
+function dependencyEdges(packages) {
   const byName = new Map(packages.map((p) => [p.name, p]));
   const dependsOn = /* @__PURE__ */ new Map();
   for (const p of packages) {
@@ -12786,6 +13432,12 @@ function buildSetFor(affected, packages, alsoBuild = []) {
       p.deps.map((d) => byName.get(d)?.dir).filter((d) => !!d && d !== p.dir)
     );
   }
+  return dependsOn;
+}
+__name(dependencyEdges, "dependencyEdges");
+function reverseDependencyClosure(affected, packages) {
+  const byDir = new Map(packages.map((p) => [p.dir, p]));
+  const dependsOn = dependencyEdges(packages);
   const consumers = new Set(affected.filter((a) => byDir.has(a)));
   let grew = true;
   while (grew) {
@@ -12798,6 +13450,13 @@ function buildSetFor(affected, packages, alsoBuild = []) {
       }
     }
   }
+  return [...consumers].sort();
+}
+__name(reverseDependencyClosure, "reverseDependencyClosure");
+function buildSetFor(affected, packages, alsoBuild = []) {
+  const byDir = new Map(packages.map((p) => [p.dir, p]));
+  const dependsOn = dependencyEdges(packages);
+  const consumers = reverseDependencyClosure(affected, packages);
   const wanted = /* @__PURE__ */ new Set();
   const addDeps = /* @__PURE__ */ __name((dir) => {
     if (wanted.has(dir)) return;
@@ -12822,13 +13481,81 @@ function buildSetFor(affected, packages, alsoBuild = []) {
 }
 __name(buildSetFor, "buildSetFor");
 
+// packages/cli/src/commands/review/lib/workspace-scope.ts
+init_esbuild_shims();
+var LICENSE_LIKE_RE = /(^|\/)(LICEN[CS]ES?|COPYING|NOTICES?)(-[^/.]+)?(\.(md|txt|rst))?$/;
+function isInertLicense(path3) {
+  return LICENSE_LIKE_RE.test(path3);
+}
+__name(isInertLicense, "isInertLicense");
+var INERT_OUTSIDE_RE = /^(\.github\/|CHANGELOG\.md$|\.gitignore$|\.gitattributes$|\.editorconfig$|\.idea\/|\.vscode\/)/;
+function resolveTestScope(input) {
+  const { changed, globs, packages, skipped } = input;
+  const affected = affectedWorkspaces(changed, globs);
+  const graph = input.rootPackage ? [input.rootPackage, ...packages] : packages;
+  const scriptsOf = new Map(graph.map((p) => [p.dir, p.scripts]));
+  const caveats = [];
+  if (skipped.length > 0) {
+    caveats.push(
+      `the workspace graph could not be fully computed: ${skipped.join(", ")} ${skipped.length === 1 ? "has" : "have"} a package.json that does not parse, has no usable \`name\`, or is shadowed by a later workspace glob, so a reverse dependency may be missing from the scoped set`
+    );
+  }
+  const unmapped = affected.filter(
+    (d) => d !== "." && !scriptsOf.has(d) && !skipped.includes(d)
+  );
+  const outside = changed.filter((f) => workspaceDirFor(f, globs) === null);
+  const excluded = outside.filter((f) => isNegationExcluded(f, globs));
+  const influential = outside.filter(
+    (f) => !isInertLicense(f) && !f.startsWith("docs/") && !INERT_OUTSIDE_RE.test(f) && !isNegationExcluded(f, globs)
+  );
+  if (unmapped.length > 0) {
+    caveats.push(
+      `the workspace globs claim ${unmapped.join(", ")}, but no readable package.json there makes a graph member \u2014 no suite covers a change inside, and a dependent of the diff may be missing from the scoped set`
+    );
+  }
+  if (influential.length > 0) {
+    caveats.push(
+      `${influential.length} changed file(s) sit outside every workspace and are not inert (e.g. ${influential.slice(0, 3).join(", ")}); a root script or config can affect any package's tests, and the scoped set cannot cover them`
+    );
+  }
+  if (excluded.length > 0) {
+    caveats.push(
+      `${excluded.length} changed file(s) sit in negated workspaces (e.g. ${excluded.slice(0, 3).join(", ")}) \u2014 excluded from the npm workspace graph (a separate toolchain and lockfile); their own toolchain's suites were not run`
+    );
+  }
+  const closure = reverseDependencyClosure(affected, graph);
+  let workspaces = closure.filter((d) => scriptsOf.get(d)?.includes("test"));
+  let fanOutCaveat;
+  if (input.rootTestFansOut && workspaces.includes(".")) {
+    workspaces = workspaces.filter((d) => d !== ".");
+    fanOutCaveat = "the root's `test` script fans out over every workspace (`--workspaces`), so the root suite did not run \u2014 it cannot finish inside one command deadline; the scoped member suites are the coverage";
+  }
+  {
+    const rootRuns = input.rootPackage?.scripts.includes("test") && !input.rootTestFansOut ? 1 : 0;
+    const testable = packages.filter((p) => p.scripts.includes("test")).length + rootRuns;
+    const scoped = workspaces.length;
+    if (scoped * 2 > testable) {
+      caveats.push(
+        `the diff's reverse-dependency closure covers ${scoped} of ${testable} testable ${rootRuns ? "suites (including the root)" : "workspaces"} \u2014 more than half, so the scoped set is not a meaningful narrowing`
+      );
+    }
+  }
+  if (fanOutCaveat) caveats.push(fanOutCaveat);
+  return caveats.length > 0 ? { workspaces, caveat: caveats.join("; ") } : { workspaces };
+}
+__name(resolveTestScope, "resolveTestScope");
+
 // packages/cli/src/commands/review/build-test.ts
+function shellArg(dir) {
+  return `"${dir.replace(/[\\"$`]/g, "\\$&")}"`;
+}
+__name(shellArg, "shellArg");
 function buildCommand(dir) {
-  return dir === "." ? "npm run build" : `npm run build --workspace="${dir}"`;
+  return dir === "." ? "npm run build" : `npm run build --workspace=${shellArg(dir)}`;
 }
 __name(buildCommand, "buildCommand");
 function testCommand(dir) {
-  return dir === "." ? "npm test" : `npm test --workspace="${dir}"`;
+  return dir === "." ? "npm test" : `npm test --workspace=${shellArg(dir)}`;
 }
 __name(testCommand, "testCommand");
 var KEEP_HEAD = 2e3;
@@ -12863,6 +13590,7 @@ ${rescued.join("\n")}
 __name(trimOutput, "trimOutput");
 var INSTALL_MIN_FREE_BYTES = 3 * 1024 ** 3;
 var BUILD_MIN_FREE_BYTES = 1024 ** 3;
+var BUDGET_MIN_ATTEMPT_MS = 15e3;
 function freeDiskBytes(dir) {
   try {
     const s = statfsSync(dir);
@@ -12900,7 +13628,8 @@ function run(command, cwd, timeoutMs) {
     exitCode: r.status,
     seconds: Math.round((Date.now() - started) / 1e3),
     timedOut,
-    output: trimOutput(`${r.stdout ?? ""}${r.stderr ?? ""}`)
+    output: trimOutput(`${r.stdout ?? ""}${r.stderr ?? ""}`),
+    deadlineMs: timeoutMs
   };
 }
 __name(run, "run");
@@ -12921,7 +13650,7 @@ __name(unresolvedWorkspaceDeps, "unresolvedWorkspaceDeps");
 function changedFilesFrom(planPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync19(planPath, "utf8"));
+    parsed = JSON.parse(readFileSync20(planPath, "utf8"));
   } catch (err) {
     throw new Error(
       `build-test: cannot read the plan ${planPath}: ${err.message}`
@@ -12940,6 +13669,10 @@ __name(changedFilesFrom, "changedFilesFrom");
 function runBuildTest(args) {
   const root = resolve14(args.worktree);
   const perCommandMs = args.timeout * 1e3;
+  const callBudgetMs = (args.budget ?? Math.max(args.timeout, args.timeout * 2 - 30)) * 1e3;
+  const runStarted = Date.now();
+  const remainingMs = /* @__PURE__ */ __name(() => callBudgetMs - (Date.now() - runStarted), "remainingMs");
+  const deadlineSecs = /* @__PURE__ */ __name((r) => Math.round((r.deadlineMs ?? perCommandMs) / 1e3), "deadlineSecs");
   const exec = args.exec ?? run;
   const changed = changedFilesFrom(args.plan);
   const unsupportedReport = /* @__PURE__ */ __name((note) => ({
@@ -12955,15 +13688,13 @@ function runBuildTest(args) {
     note
   }), "unsupportedReport");
   const globs = readWorkspaceGlobs(root);
-  let packages = readWorkspacePackages(root);
+  let { packages, skipped } = readWorkspacePackages(root);
+  const rootPkg = readRootPackage(root);
   let singleRoot = false;
   const unmodeled = globs.length > 0 && hasUnmodeledWorkspaceGlob(globs);
-  if (!unmodeled && globs.length === 0) {
-    const rootPkg = readRootPackage(root);
-    if (rootPkg) {
-      packages = [rootPkg];
-      singleRoot = true;
-    }
+  if (!unmodeled && globs.length === 0 && rootPkg) {
+    packages = [rootPkg];
+    singleRoot = true;
   }
   if (unmodeled || !singleRoot && (globs.length === 0 || packages.length === 0)) {
     return unsupportedReport(
@@ -12971,6 +13702,15 @@ function runBuildTest(args) {
     );
   }
   const affected = singleRoot ? changed.length > 0 ? ["."] : [] : affectedWorkspaces(changed, globs);
+  let testScope = singleRoot || args.buildOnly ? void 0 : resolveTestScope({
+    changed,
+    globs,
+    packages,
+    skipped,
+    rootPackage: rootPkg,
+    rootTestFansOut: rootPkg?.scripts.includes("test") ? scriptFansOut(rootPkg.scriptsText["test"]) : false
+  });
+  const scopeGraph = !singleRoot && rootPkg ? [rootPkg, ...packages] : packages;
   if (affected.length === 0) {
     return {
       toolchain: "npm",
@@ -12980,12 +13720,13 @@ function runBuildTest(args) {
       install: null,
       build: [],
       test: [],
+      ...testScope ? { testScope } : {},
       ok: true,
       timedOut: [],
-      note: `The diff changes ${changed.length} file(s), none of them inside a workspace (docs, root config, CI). There is no package to build and no test to run \u2014 this is a complete answer, not a skipped step.`
+      note: args.buildOnly ? `The diff changes ${changed.length} file(s), none of them inside a workspace. There is no package to build, and tests are out of scope for a build-only probe.` : testScope?.caveat ? `The diff changes ${changed.length} file(s), none of them inside a workspace. There is no package to build and no test to run, but the scope decision recorded a caveat: ${testScope.caveat}.` : `The diff changes ${changed.length} file(s), none of them inside a workspace (nothing the workspaces' tests can feel). There is no package to build and no test to run \u2014 this is a complete answer, not a skipped step.`
     };
   }
-  const byDir = new Map(packages.map((p) => [p.dir, p]));
+  const byDir = new Map(scopeGraph.map((p) => [p.dir, p]));
   const unmapped = affected.filter((d) => d !== "." && !byDir.has(d));
   if (unmapped.length > 0) {
     return unsupportedReport(
@@ -13004,15 +13745,15 @@ function runBuildTest(args) {
     timedOut: [],
     note: ""
   };
-  const npmLock = existsSync7(join14(root, "package-lock.json"));
-  const installComplete = /* @__PURE__ */ __name(() => existsSync7(join14(root, "node_modules", ".package-lock.json")), "installComplete");
-  if (args.install && !npmLock && !existsSync7(join14(root, "node_modules"))) {
+  const npmLock = existsSync7(join15(root, "package-lock.json"));
+  const installComplete = /* @__PURE__ */ __name(() => existsSync7(join15(root, "node_modules", ".package-lock.json")), "installComplete");
+  if (args.install && !npmLock && !existsSync7(join15(root, "node_modules"))) {
     const altLock = [
       ["yarn.lock", "yarn install --frozen-lockfile"],
       ["pnpm-lock.yaml", "pnpm install --frozen-lockfile"],
       ["bun.lockb", "bun install --frozen-lockfile"],
       ["bun.lock", "bun install --frozen-lockfile"]
-    ].find(([f]) => existsSync7(join14(root, f)));
+    ].find(([f]) => existsSync7(join15(root, f)));
     return unsupportedReport(
       altLock ? `This is a ${altLock[0]} repo with no installed \`node_modules\`, so \`npm ci\` cannot install it. Run \`${altLock[1]}\` first, then fall back to the build/test precedence in your brief, each command with a deadline it can meet.` : "There is no lockfile and no `node_modules` here, so nothing can be installed deterministically. Install dependencies first, then fall back to the build/test precedence in your brief."
     );
@@ -13025,12 +13766,21 @@ function runBuildTest(args) {
       results.note = `Insufficient disk space (${gib(free)}G free, need ~${gib(INSTALL_MIN_FREE_BYTES)}G): skipped \`${installCmd}\`, so nothing could be built or tested. This is an environment issue, not a code finding \u2014 report it as informational.`;
       return results;
     }
-    const install = exec(installCmd, root, perCommandMs);
+    if (remainingMs() < BUDGET_MIN_ATTEMPT_MS) {
+      results.ok = false;
+      results.note = `The whole-call budget was spent before the install could start (${args.budget != null ? `--budget ${args.budget}s` : "default budget"}), so nothing could be built or tested. This is an infrastructure result, not a defect in the diff \u2014 report it as informational.`;
+      return results;
+    }
+    const install = exec(
+      installCmd,
+      root,
+      Math.min(perCommandMs, remainingMs())
+    );
     results.install = install;
     if (install.timedOut) results.timedOut.push(install.command);
     if (install.timedOut) {
       try {
-        rmSync5(join14(root, "node_modules"), {
+        rmSync5(join15(root, "node_modules"), {
           recursive: true,
           force: true,
           maxRetries: 3
@@ -13040,7 +13790,7 @@ function runBuildTest(args) {
     }
     if (install.timedOut || !installComplete()) {
       results.ok = false;
-      results.note = install.timedOut ? `\`${install.command}\` ran out of time (${args.timeout}s) and left an incomplete \`node_modules\`, so nothing could be built or tested against it. This is an infrastructure result, not a defect in the diff \u2014 report it as informational.` : "The install failed and left no usable `node_modules`, so nothing could be built or tested. This is an environment failure, not a defect in the diff \u2014 report it as informational.";
+      results.note = install.timedOut ? `\`${install.command}\` ran out of time (${deadlineSecs(install)}s) and left an incomplete \`node_modules\`, so nothing could be built or tested against it. This is an infrastructure result, not a defect in the diff \u2014 report it as informational.` : "The install failed and left no usable `node_modules`, so nothing could be built or tested. This is an environment failure, not a defect in the diff \u2014 report it as informational.";
       return results;
     }
   }
@@ -13051,9 +13801,12 @@ function runBuildTest(args) {
     return results;
   }
   const alsoBuild = [];
-  let set = buildSetFor(affected, packages);
+  let set = buildSetFor(affected, scopeGraph);
   const built = /* @__PURE__ */ new Set();
   const widened = /* @__PURE__ */ new Set();
+  const rootBuildRuns = !!rootPkg?.scripts.includes("build") && !scriptFansOut(rootPkg.scriptsText["build"]);
+  const rootBuildSkipped = !singleRoot && !rootBuildRuns;
+  const notBuilt = [];
   for (let attempt = 0; attempt <= 3; attempt++) {
     let failure = null;
     for (const dir of set) {
@@ -13063,7 +13816,23 @@ function runBuildTest(args) {
         built.add(dir);
         continue;
       }
-      const r = exec(buildCommand(dir), root, perCommandMs);
+      if (dir === "." && rootBuildSkipped) {
+        built.add(dir);
+        continue;
+      }
+      if (remainingMs() < BUDGET_MIN_ATTEMPT_MS) {
+        notBuilt.push(
+          ...set.filter(
+            (d) => !built.has(d) && byDir.get(d)?.scripts.includes("build")
+          )
+        );
+        break;
+      }
+      const r = exec(
+        buildCommand(dir),
+        root,
+        Math.min(perCommandMs, remainingMs())
+      );
       results.build.push(r);
       if (r.timedOut) results.timedOut.push(r.command);
       if (r.exitCode !== 0) {
@@ -13079,8 +13848,8 @@ function runBuildTest(args) {
     });
     if (missing.length === 0 || failure.timedOut || attempt === 3) {
       results.ok = false;
-      results.note = failure.timedOut ? `\`${failure.command}\` ran out of time (${args.timeout}s). That is an infrastructure result, not a defect in the diff \u2014 report it as informational.` : `\`${failure.command}\` failed. Correlate the errors below with the diff: a compile error in a file the PR changed is a Critical; one in a file it did not touch is a pre-existing failure, and belongs in the terminal, not on the PR.`;
-      results.buildSet = set;
+      results.note = failure.timedOut ? `\`${failure.command}\` ran out of time (${deadlineSecs(failure)}s). That is an infrastructure result, not a defect in the diff \u2014 report it as informational.` : `\`${failure.command}\` failed. Correlate the errors below with the diff: a compile error in a file the PR changed is a Critical; one in a file it did not touch is a pre-existing failure, and belongs in the terminal, not on the PR.`;
+      results.buildSet = (rootBuildSkipped ? set.filter((d) => d !== ".") : set).filter((d) => !notBuilt.includes(d));
       results.widenedWith = [...widened];
       return results;
     }
@@ -13090,31 +13859,85 @@ function runBuildTest(args) {
       const dir = packages.find((p) => p.name === name)?.dir;
       if (dir) alsoBuild.push(dir);
     }
-    set = buildSetFor(affected, packages, alsoBuild);
+    set = buildSetFor(affected, scopeGraph, alsoBuild);
   }
-  results.buildSet = set;
+  results.buildSet = (rootBuildSkipped ? set.filter((d) => d !== ".") : set).filter((d) => !notBuilt.includes(d));
   results.widenedWith = [...widened];
-  for (const dir of args.buildOnly ? [] : affected) {
-    const pkg = byDir.get(dir);
-    if (!pkg?.scripts.includes("test")) continue;
-    const r = exec(testCommand(dir), root, perCommandMs);
+  if (notBuilt.length > 0) results.notBuilt = [...notBuilt].sort();
+  const rootHasTest = !!rootPkg?.scripts.includes("test");
+  const testDirs = args.buildOnly ? [] : !testScope ? affected : testScope.workspaces;
+  const runnable = /* @__PURE__ */ __name((dir) => dir === "." ? rootHasTest : !!byDir.get(dir)?.scripts.includes("test"), "runnable");
+  const affectedSet = new Set(affected);
+  const runnableDirs = [
+    ...testDirs.filter((d) => affectedSet.has(d) && runnable(d)),
+    ...testDirs.filter((d) => !affectedSet.has(d) && runnable(d))
+  ];
+  const untestable = notBuilt.length > 0 ? new Set(reverseDependencyClosure(notBuilt, scopeGraph)) : /* @__PURE__ */ new Set();
+  const notRun = [];
+  for (let i = 0; i < runnableDirs.length; i++) {
+    const dir = runnableDirs[i];
+    if (untestable.has(dir)) {
+      notRun.push(dir);
+      continue;
+    }
+    const remaining = remainingMs();
+    if (remaining < BUDGET_MIN_ATTEMPT_MS) {
+      notRun.push(...runnableDirs.slice(i).filter((d) => !untestable.has(d)));
+      break;
+    }
+    const r = exec(testCommand(dir), root, Math.min(perCommandMs, remaining));
     results.test.push(r);
     if (r.timedOut) results.timedOut.push(r.command);
     if (r.exitCode !== 0) results.ok = false;
   }
+  notRun.sort();
+  const partialNote = [
+    notBuilt.length > 0 ? `the build phase reached the whole-call budget \u2014 not built: ` + notBuilt.join(", ") : "",
+    notRun.length > 0 ? `the whole-call budget (${Math.round(callBudgetMs / 1e3)}s) was spent with ${notRun.length} suite(s) still to run \u2014 not run: ` + notRun.join(", ") : ""
+  ].filter(Boolean).join("; ") || void 0;
+  if (testScope && partialNote) {
+    const ran = testScope.workspaces.filter((d) => !notRun.includes(d));
+    testScope = {
+      workspaces: ran,
+      ...notRun.length > 0 ? { notRun } : {},
+      caveat: testScope.caveat ? `${testScope.caveat}; ${partialNote}` : partialNote
+    };
+  }
+  if (testScope) results.testScope = testScope;
   if (!results.note) {
     const failed = [...results.build, ...results.test].filter(
       (r) => r.exitCode !== 0
     );
     const realFailures = failed.filter((r) => !r.timedOut);
     if (results.ok) {
-      results.note = `Built ${results.buildSet.length} of ${packages.length} workspaces (the ${affected.length} the diff changes, plus what they compile against${widened.size ? `, plus ${[...widened].join(", ")} the compiler asked for` : ""})${args.buildOnly ? ". Tests were not run (build-only)." : " and ran the tests of the changed ones. Everything passed."}`;
+      let testsClause;
+      if (args.buildOnly) {
+        testsClause = ". Tests were not run (build-only).";
+      } else if (!testScope) {
+        testsClause = results.test.length === 0 ? ", but the package defines no test script, so no tests ran." : " and ran the tests of the changed ones. Everything passed.";
+      } else if (testScope.workspaces.length === 0) {
+        testsClause = testScope.notRun?.length ? ", but the whole-call budget was spent before any suite could run." : ", but no workspace in scope defines a test script, so no tests ran.";
+      } else {
+        testsClause = ` and ran the tests scoped to ${testScope.workspaces.join(", ")} \u2014 the changed workspaces and every workspace declared to depend on them that defines a test script. Everything passed.`;
+      }
+      if (testScope?.caveat) testsClause += ` Caveat: ${testScope.caveat}.`;
+      const builtWorkspaces = results.buildSet.filter(
+        (d) => singleRoot || d !== "."
+      ).length;
+      const rootSuffix = !singleRoot && results.buildSet.includes(".") && !rootBuildSkipped ? " (plus the root package)" : "";
+      results.note = `Built ${builtWorkspaces} of ${packages.length} workspaces${rootSuffix} (the ${affected.length} the diff changes, plus what they compile against${widened.size ? `, plus ${[...widened].join(", ")} the compiler asked for` : ""})${testsClause}`;
     } else if (realFailures.length === 0) {
-      results.note = `${failed.length} command(s) ran out of time (${args.timeout}s). A timeout is an infrastructure result, not a defect in the diff \u2014 report it as informational.`;
+      results.note = `${failed.length} command(s) ran out of time (${deadlineSecs(failed[0])}s). A timeout is an infrastructure result, not a defect in the diff \u2014 report it as informational.`;
     } else {
       results.note = `${realFailures.length} command(s) failed. Correlate each error with the diff: a failure in a file the PR changed is a Critical; one in a file it did not touch is pre-existing.` + (failed.length > realFailures.length ? " (Commands that timed out are infrastructure, not findings.)" : "");
     }
   }
+  if (results.testScope?.caveat && !results.note.includes("Caveat:")) {
+    results.note += ` Caveat: ${results.testScope.caveat}.`;
+  }
+  if (partialNote && !results.testScope) {
+    results.note = results.note ? `${results.note} ${partialNote}.` : partialNote;
+  }
   if (results.install && results.install.exitCode !== 0) {
     results.note = `\`${results.install.command}\` exited ${results.install.exitCode} but left a usable \`node_modules\`, so the build and test below ran anyway and their results stand. The install failure is an environment/infrastructure result \u2014 report it as informational, never as a Critical, and never against this PR. ` + results.note;
   }
@@ -13123,7 +13946,7 @@ function runBuildTest(args) {
 __name(runBuildTest, "runBuildTest");
 var buildTestCommand = {
   command: "build-test",
-  describe: "Build and test the workspaces the diff changes (and what they compile against), with a deadline the commands can actually meet",
+  describe: "Build the workspaces the diff changes (and what they compile against), test those plus their dependents, with a deadline the commands can actually meet",
   builder: /* @__PURE__ */ __name((yargs) => yargs.option("plan", {
     type: "string",
     demandOption: true,
@@ -13138,7 +13961,10 @@ var buildTestCommand = {
   }).option("timeout", {
     type: "number",
     default: 300,
-    describe: "Per-command deadline in seconds. Kept strictly below the 600s (600000ms) tool timeout the agent's brief welds onto the whole call, so a single hung command's own deadline fires \u2014 and build-test reports it as data \u2014 before the outer shell kill would discard the report. (A giant PR whose commands sum past the tool ceiling is a separate, acknowledged follow-up.)"
+    describe: "Per-command deadline in seconds. Kept strictly below the 600s (600000ms) tool timeout the agent's brief welds onto the whole call, so a single hung command's own deadline fires \u2014 and build-test reports it as data \u2014 before the outer shell kill would discard the report. Commands that would SUM past the whole call are stopped and disclosed instead \u2014 see --budget."
+  }).option("budget", {
+    type: "number",
+    describe: "Whole-call wall-clock budget in seconds, measured from the top of the call \u2014 install and build time count against it (default: 2\xD7 --timeout minus 30s of headroom for process startup and the report write). Each suite is attempted with whatever of the budget remains \u2014 a suite killed at the boundary is a timeout, reported as infrastructure \u2014 and only suites never attempted are named notRun. A partial report survives where the outer shell kill would discard the whole one."
   }).option("install", {
     type: "boolean",
     default: true,
@@ -13153,7 +13979,7 @@ var buildTestCommand = {
     try {
       const report = runBuildTest(args);
       if (args.out) {
-        writeFileSync17(args.out, JSON.stringify(report, null, 2));
+        writeFileSync18(args.out, JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
     } catch (err) {
@@ -13168,13 +13994,13 @@ init_esbuild_shims();
 import { spawnSync as spawnSync4 } from "node:child_process";
 import {
   existsSync as existsSync8,
-  mkdirSync as mkdirSync17,
-  readFileSync as readFileSync20,
+  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync21,
   rmSync as rmSync7,
-  statSync as statSync6,
-  writeFileSync as writeFileSync18
+  statSync as statSync9,
+  writeFileSync as writeFileSync19
 } from "node:fs";
-import { dirname as dirname15, join as join15, resolve as resolve15 } from "node:path";
+import { dirname as dirname15, join as join16, resolve as resolve15 } from "node:path";
 
 // packages/cli/src/commands/review/lib/worktree.ts
 init_esbuild_shims();
@@ -13221,7 +14047,7 @@ function runBaseTree(args) {
   }), "unavailable");
   let plan;
   try {
-    plan = JSON.parse(readFileSync20(args.plan, "utf8"));
+    plan = JSON.parse(readFileSync21(args.plan, "utf8"));
   } catch (err) {
     return unavailable(
       `cannot read the plan ${args.plan}: ${err.message}`
@@ -13243,10 +14069,10 @@ function runBaseTree(args) {
     return unavailable(`the review worktree ${worktree} does not exist`);
   }
   const tree = baseWorktreePath(worktree);
-  const marker = /* @__PURE__ */ __name(() => join15(tree, ".qwen-review-base-ok"), "marker");
-  const failedMarker = /* @__PURE__ */ __name(() => join15(tree, ".qwen-review-base-failed"), "failedMarker");
+  const marker = /* @__PURE__ */ __name(() => join16(tree, ".qwen-review-base-ok"), "marker");
+  const failedMarker = /* @__PURE__ */ __name(() => join16(tree, ".qwen-review-base-failed"), "failedMarker");
   try {
-    if (existsSync8(tree) && readFileSync20(marker(), "utf8").trim() === baseSha && gitOut(tree, "rev-parse", "HEAD") === baseSha) {
+    if (existsSync8(tree) && readFileSync21(marker(), "utf8").trim() === baseSha && gitOut(tree, "rev-parse", "HEAD") === baseSha) {
       return {
         available: true,
         path: tree,
@@ -13258,7 +14084,7 @@ function runBaseTree(args) {
   } catch {
   }
   try {
-    if (existsSync8(tree) && readFileSync20(failedMarker(), "utf8").trim() === baseSha) {
+    if (existsSync8(tree) && readFileSync21(failedMarker(), "utf8").trim() === baseSha) {
       return {
         available: false,
         path: tree,
@@ -13271,14 +14097,14 @@ function runBaseTree(args) {
   }
   const lock = `${tree}.lock`;
   try {
-    const age = Date.now() - statSync6(lock).mtimeMs;
+    const age = Date.now() - statSync9(lock).mtimeMs;
     if (age > 30 * 60 * 1e3) {
       rmSync7(lock, { recursive: true, force: true });
     }
   } catch {
   }
   try {
-    mkdirSync17(lock);
+    mkdirSync18(lock);
   } catch (err) {
     if (err.code !== "EEXIST") {
       return unavailable(
@@ -13314,9 +14140,18 @@ function runBaseTree(args) {
       // tree to run against.
       buildOnly: true
     });
+    if ((build.notBuilt?.length ?? 0) > 0) {
+      return {
+        available: false,
+        path: tree,
+        baseSha: baseSha2,
+        build,
+        note: `the base tree build at ${baseSha2.slice(0, 9)} was cut short by the whole-call budget (${build.notBuilt.join(", ")} not built), so a rerun against it would manufacture pre-existing failures; an A/B is not available for this review (this is an infrastructure result, never a finding against the PR)`
+      };
+    }
     if (!build.ok || build.toolchain !== "npm" || build.build.length === 0) {
       try {
-        writeFileSync18(failedMarker(), `${baseSha2}
+        writeFileSync19(failedMarker(), `${baseSha2}
 `);
       } catch {
       }
@@ -13329,7 +14164,7 @@ function runBaseTree(args) {
       };
     }
     try {
-      writeFileSync18(marker(), `${baseSha2}
+      writeFileSync19(marker(), `${baseSha2}
 `);
     } catch {
     }
@@ -13369,8 +14204,8 @@ var baseTreeCommand = {
     try {
       const report = runBaseTree(args);
       if (args.out) {
-        mkdirSync17(dirname15(resolve15(args.out)), { recursive: true });
-        writeFileSync18(resolve15(args.out), JSON.stringify(report, null, 2));
+        mkdirSync18(dirname15(resolve15(args.out)), { recursive: true });
+        writeFileSync19(resolve15(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`base-tree: ${report.note}`);
@@ -13384,7 +14219,7 @@ var baseTreeCommand = {
 // packages/cli/src/commands/review/test-delta.ts
 init_esbuild_shims();
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync20 } from "node:fs";
 import { dirname as dirname16, resolve as resolve16 } from "node:path";
 var ANSI_SGR_RE2 = /\x1b\[[0-9;]*m/g;
 var RERUNNABLE_COMMAND_RE = /^npm test(?: --workspace="[\w@./-]+")?$/;
@@ -13458,7 +14293,7 @@ function runTestDelta(args) {
   }), "empty");
   let report;
   try {
-    report = JSON.parse(readFileSync21(args.report, "utf8"));
+    report = JSON.parse(readFileSync22(args.report, "utf8"));
   } catch (err) {
     return empty(
       `cannot read the build-test report ${args.report}: ${err.message}`
@@ -13600,8 +14435,8 @@ var testDeltaCommand = {
     const args = argv;
     const report = runTestDelta(args);
     if (args.out) {
-      mkdirSync18(dirname16(resolve16(args.out)), { recursive: true });
-      writeFileSync19(resolve16(args.out), JSON.stringify(report, null, 2));
+      mkdirSync19(dirname16(resolve16(args.out)), { recursive: true });
+      writeFileSync20(resolve16(args.out), JSON.stringify(report, null, 2));
     }
     writeStdoutLine(JSON.stringify(report, null, 2));
     writeStderrLine(`test-delta: ${report.note}`);
@@ -13612,14 +14447,14 @@ var testDeltaCommand = {
 init_esbuild_shims();
 import { spawnSync as spawnSync6 } from "node:child_process";
 import {
-  mkdirSync as mkdirSync19,
-  writeFileSync as writeFileSync20,
-  readFileSync as readFileSync22,
+  mkdirSync as mkdirSync20,
+  writeFileSync as writeFileSync21,
+  readFileSync as readFileSync23,
   existsSync as existsSync10,
   rmSync as rmSync8,
-  statSync as statSync7
+  statSync as statSync10
 } from "node:fs";
-import { dirname as dirname17, join as join16, resolve as resolve17 } from "node:path";
+import { dirname as dirname17, join as join17, resolve as resolve17 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 var SERVER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 function shellQuote(v) {
@@ -13631,7 +14466,7 @@ var LOG_MAX_BYTES = 8 * 1024 * 1024;
 var POLL_MS = 250;
 function logBytes(p) {
   try {
-    return statSync7(p).size;
+    return statSync10(p).size;
   } catch {
     return 0;
   }
@@ -13737,13 +14572,13 @@ function runDrive(args) {
       waitMs(POLL_MS);
     }
   }
-  const dir = join16(tmpdir2(), `qwen-review-drive-${server}`);
-  mkdirSync19(dir, { recursive: true });
-  const scriptPath = join16(dir, "drive.sh");
-  const logPath = args.logPath ?? join16(dir, "drive.log");
-  const sentinelPath = join16(dir, "drive.rc");
+  const dir = join17(tmpdir2(), `qwen-review-drive-${server}`);
+  mkdirSync20(dir, { recursive: true });
+  const scriptPath = join17(dir, "drive.sh");
+  const logPath = args.logPath ?? join17(dir, "drive.log");
+  const sentinelPath = join17(dir, "drive.rc");
   rmSync8(sentinelPath, { force: true });
-  writeFileSync20(scriptPath, wrapScript(args.script, sentinelPath), "utf8");
+  writeFileSync21(scriptPath, wrapScript(args.script, sentinelPath), "utf8");
   const droveFrom = Date.now();
   let output = "";
   let exitCode = null;
@@ -13773,8 +14608,8 @@ function runDrive(args) {
     }
     const deadline = droveFrom + args.timeout * 1e3;
     for (; ; ) {
-      output = existsSync10(logPath) ? readFileSync22(logPath, "utf8") : "";
-      exitCode = existsSync10(sentinelPath) ? sentinelExitCode(readFileSync22(sentinelPath, "utf8")) : null;
+      output = existsSync10(logPath) ? readFileSync23(logPath, "utf8") : "";
+      exitCode = existsSync10(sentinelPath) ? sentinelExitCode(readFileSync23(sentinelPath, "utf8")) : null;
       if (exitCode !== null) {
         outcome = "completed";
         break;
@@ -13841,8 +14676,8 @@ var driveCommand = {
       const args = argv;
       const report = runDrive(args);
       if (args.out) {
-        mkdirSync19(dirname17(resolve17(args.out)), { recursive: true });
-        writeFileSync20(resolve17(args.out), JSON.stringify(report, null, 2));
+        mkdirSync20(dirname17(resolve17(args.out)), { recursive: true });
+        writeFileSync21(resolve17(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`drive: ${report.note}`);
@@ -13859,7 +14694,7 @@ init_esbuild_shims();
 import {
   createServer
 } from "node:http";
-import { appendFileSync, mkdirSync as mkdirSync20, writeFileSync as writeFileSync21 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync21, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname18, resolve as resolve18 } from "node:path";
 import { pathToFileURL } from "node:url";
 function messagesText(body) {
@@ -14116,8 +14951,8 @@ async function startMockProvider(args, respondOverride) {
     respond = fn;
   }
   const logPath = resolve18(args.log);
-  mkdirSync20(dirname18(logPath), { recursive: true });
-  writeFileSync21(logPath, "");
+  mkdirSync21(dirname18(logPath), { recursive: true });
+  writeFileSync22(logPath, "");
   let n = 0;
   const record = /* @__PURE__ */ __name((entry) => appendFileSync(logPath, `${JSON.stringify(entry)}
 `), "record");
@@ -14279,8 +15114,8 @@ var mockProviderCommand = {
       const args = argv;
       const { report, close } = await startMockProvider(args);
       if (args.out) {
-        mkdirSync20(dirname18(resolve18(args.out)), { recursive: true });
-        writeFileSync21(resolve18(args.out), JSON.stringify(report, null, 2));
+        mkdirSync21(dirname18(resolve18(args.out)), { recursive: true });
+        writeFileSync22(resolve18(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`mock-provider: ${report.note}`);
@@ -14298,7 +15133,7 @@ var mockProviderCommand = {
 // packages/cli/src/commands/review/extract-step.ts
 init_esbuild_shims();
 var import_yaml = __toESM(require_dist(), 1);
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync23, writeFileSync as writeFileSync22, chmodSync } from "node:fs";
+import { mkdirSync as mkdirSync22, readFileSync as readFileSync24, writeFileSync as writeFileSync23, chmodSync } from "node:fs";
 import { dirname as dirname19, resolve as resolve19 } from "node:path";
 function expressionsOf(...texts) {
   const seen = /* @__PURE__ */ new Set();
@@ -14546,7 +15381,7 @@ function runExtractStep(args) {
   const wfPath = resolve19(args.workflow);
   let text;
   try {
-    text = readFileSync23(wfPath, "utf8");
+    text = readFileSync24(wfPath, "utf8");
   } catch (err) {
     throw new Error(
       `extract-step: cannot read ${args.workflow}: ${err.message}`
@@ -14613,7 +15448,7 @@ function runExtractStep(args) {
   const script = step.run;
   const stepLabel = String(step.name ?? step.id ?? index);
   const outPath = resolve19(args.out);
-  mkdirSync21(dirname19(outPath), { recursive: true });
+  mkdirSync22(dirname19(outPath), { recursive: true });
   const header = [
     `#!/usr/bin/env ${shellCommand}`,
     ...commentLines(
@@ -14637,7 +15472,7 @@ function runExtractStep(args) {
     ),
     ""
   ].join("\n");
-  writeFileSync22(outPath, header + script + (script.endsWith("\n") ? "" : "\n"));
+  writeFileSync23(outPath, header + script + (script.endsWith("\n") ? "" : "\n"));
   chmodSync(outPath, 493);
   return {
     workflow: args.workflow,
@@ -14698,7 +15533,7 @@ var extractStepCommand = {
 
 // packages/cli/src/commands/review/submit.ts
 init_esbuild_shims();
-import { mkdirSync as mkdirSync22, readFileSync as readFileSync24 } from "node:fs";
+import { mkdirSync as mkdirSync23, readFileSync as readFileSync25 } from "node:fs";
 
 // packages/cli/src/commands/review/lib/receipt.ts
 init_esbuild_shims();
@@ -14720,7 +15555,7 @@ __name(parseReceiptIds, "parseReceiptIds");
 var EVENTS = /* @__PURE__ */ new Set(["APPROVE", "REQUEST_CHANGES", "COMMENT"]);
 function readReceiptIds(receiptPath) {
   try {
-    return parseReceiptIds(readFileSync24(receiptPath, "utf8"));
+    return parseReceiptIds(readFileSync25(receiptPath, "utf8"));
   } catch {
     return [];
   }
@@ -14730,6 +15565,24 @@ function isDiffLine(n) {
   return typeof n === "number" && Number.isSafeInteger(n) && n > 0;
 }
 __name(isDiffLine, "isDiffLine");
+function normalizeInlineComments(comments, modelId, cliVersion) {
+  if (typeof modelId !== "string" || modelId.trim() === "") return comments;
+  const footer = reviewFooter(modelId, cliVersion);
+  return comments.map(
+    (comment) => (
+      // An empty body stays empty: this runs BEFORE the consistency check, and
+      // a footer pasted onto '' would hide the emptiness from the refusal that
+      // names it ('has no body — an empty comment').
+      typeof comment.body === "string" && comment.body.trim() !== "" ? {
+        ...comment,
+        body: `${comment.body.replace(REVIEW_FOOTER_RE, "")}
+
+${footer}`
+      } : comment
+    )
+  );
+}
+__name(normalizeInlineComments, "normalizeInlineComments");
 function authorization(args) {
   return reviewWriteAuthorization({
     userAuthorized: args.userAuthorized,
@@ -14775,6 +15628,18 @@ __name(compose, "compose");
 function structuralProblems(payload) {
   const problems = [];
   if (!payload.commit_id) problems.push("`commit_id` is missing");
+  if (payload.comments !== void 0 && !Array.isArray(payload.comments)) {
+    problems.push(
+      "`comments` is not an array \u2014 it is the list of findings this post carries; any other shape is not a list of findings."
+    );
+  }
+  if (Array.isArray(payload.comments) && payload.comments.some(
+    (c) => c === null || typeof c !== "object"
+  )) {
+    problems.push(
+      "`comments` entries must each be an object \u2014 a finding is a path, a line and a body; any other shape is not a finding."
+    );
+  }
   if (payload.event !== void 0 || payload.body !== void 0) {
     problems.push(
       "the payload carries `event`/`body`. Those are computed here, from `state` and from the comments you attached \u2014 they are not inputs. Remove them. (A run that skipped `compose-review` and typed its own Approve is exactly what this refuses.)"
@@ -14855,7 +15720,7 @@ function runSubmit(args, cliVersion = "unknown") {
   }
   let payload;
   try {
-    payload = JSON.parse(readFileSync24(args.review, "utf8"));
+    payload = JSON.parse(readFileSync25(args.review, "utf8"));
   } catch (err) {
     throw new Error(
       `Cannot read review JSON ${args.review}: ${err.message}`
@@ -14880,6 +15745,14 @@ Posting is a public, irreversible write, and this run has no authorisation for o
 ` + structural.map((p) => `  - ${p}`).join("\n")
     );
   }
+  payload = {
+    ...payload,
+    comments: normalizeInlineComments(
+      payload.comments ?? [],
+      payload.state?.modelId,
+      cliVersion
+    )
+  };
   let event2;
   let body;
   let cappedBy;
@@ -14931,7 +15804,7 @@ Posting is a public, irreversible write, and this run has no authorisation for o
       const receiptPath = tmpFile(`pr-${args.pr}`, "submit-receipt.json");
       const priorIds = readReceiptIds(receiptPath);
       const reviewIds = [.../* @__PURE__ */ new Set([...priorIds, reviewId])];
-      mkdirSync22(REVIEW_TMP_DIR, { recursive: true });
+      mkdirSync23(REVIEW_TMP_DIR, { recursive: true });
       atomicWriteFileSync(
         receiptPath,
         `${JSON.stringify({ reviewIds, event: event2, postedAt: (/* @__PURE__ */ new Date()).toISOString() })}
@@ -14988,7 +15861,8 @@ var submitCommand = {
     describe: "Check authorisation and payload consistency, then stop."
   }), "builder"),
   handler: /* @__PURE__ */ __name(async (argv) => {
-    runSubmit(argv, await getCliVersion());
+    const cliVersion = footerVersion(process.env["QWEN_CODE_STARTUP_VERSION"]) ?? await getCliVersion();
+    runSubmit(argv, cliVersion);
   }, "handler")
 };
 
@@ -14996,18 +15870,18 @@ var submitCommand = {
 init_esbuild_shims();
 import { spawnSync as spawnSync7 } from "node:child_process";
 import {
-  mkdirSync as mkdirSync23,
+  mkdirSync as mkdirSync24,
   readdirSync as readdirSync5,
-  writeFileSync as writeFileSync23,
-  readFileSync as readFileSync25,
+  writeFileSync as writeFileSync24,
+  readFileSync as readFileSync26,
   rmSync as rmSync9,
   lstatSync as lstatSync4,
   existsSync as existsSync11,
-  statSync as statSync8,
+  statSync as statSync11,
   symlinkSync
 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname20, join as join17, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
+import { dirname as dirname20, join as join18, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
 var FIXTURE_DIR_RE = /(^|\/)(__fixtures__|__mocks__|__snapshots__|fixtures)\//;
 function planTestEfficacy(files, workspaceGlobs) {
   const tests = files.filter((f) => f.kind === "test").map((f) => f.path);
@@ -15204,8 +16078,8 @@ function insideClassBody(codeLines, idx) {
   return false;
 }
 __name(insideClassBody, "insideClassBody");
-function isRemovableStatement(lines2, codeLines, idx) {
-  const t2 = (lines2[idx] ?? "").trim();
+function isRemovableStatement(lines, codeLines, idx) {
+  const t2 = (lines[idx] ?? "").trim();
   if (!(codeLines[idx] ?? "").endsWith(";")) return false;
   if ((codeLines[idx] ?? "").slice(0, -1).includes(";")) return false;
   if (!/^(?:await\s+)?[A-Za-z_$]/.test(t2)) return false;
@@ -15274,19 +16148,19 @@ function selectMutants(files, cap = MAX_MUTANTS) {
   const replRest = [];
   const derailed = [];
   for (const f of files) {
-    const lines2 = f.content.split("\n");
+    const lines = f.content.split("\n");
     const { inLiteral, codeLines, endState } = scanFileLines(f.content);
     if (endState !== "code") {
       derailed.push(f.file);
       continue;
     }
     for (const n of [...f.addedLines].sort((a, b) => a - b)) {
-      const raw = lines2[n - 1];
+      const raw = lines[n - 1];
       if (raw === void 0) continue;
       const t2 = raw.trim();
       if (inLiteral[n - 1]) continue;
       const code = codeLines[n - 1] ?? "";
-      if (SAFETY_VERB_RE.test(code) && isRemovableStatement(lines2, codeLines, n - 1)) {
+      if (SAFETY_VERB_RE.test(code) && isRemovableStatement(lines, codeLines, n - 1)) {
         (f.hasNewTests ? preferred : rest).push({
           file: f.file,
           line: n,
@@ -15530,23 +16404,24 @@ function gitOut2(cwd, ...args) {
   return (r.stdout ?? "").trim();
 }
 __name(gitOut2, "gitOut");
-function findVitestBin(worktree) {
-  const req = createRequire(join17(worktree, "noop.js"));
+function findVitestBin(worktree, resolveModule = createRequire(
+  join18(worktree, "noop.js")
+).resolve) {
   let pkgPath;
   try {
-    pkgPath = req.resolve("vitest/package.json");
+    pkgPath = resolveModule("vitest/package.json");
   } catch (error) {
     if (error.code === "MODULE_NOT_FOUND") {
       throw new Error(`vitest not found searching up from ${worktree}`);
     }
     throw error;
   }
-  const pkg = JSON.parse(readFileSync25(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync26(pkgPath, "utf8"));
   const bin = pkg.bin?.vitest;
   if (!bin) {
     throw new Error(`vitest package at ${pkgPath} declares no "vitest" bin`);
   }
-  return join17(dirname20(pkgPath), bin);
+  return join18(dirname20(pkgPath), bin);
 }
 __name(findVitestBin, "findVitestBin");
 function gitCapture(cwd, ...args) {
@@ -15572,7 +16447,7 @@ function safeRmWithin(worktree, relPath) {
   const parts = relPath.split(/[/\\]+/).filter((s) => s && s !== ".");
   let cur = worktree;
   for (let i = 0; i < parts.length; i++) {
-    cur = join17(cur, parts[i]);
+    cur = join18(cur, parts[i]);
     let st;
     try {
       st = lstatSync4(cur);
@@ -15597,15 +16472,15 @@ __name(probeCleanupFailureDetail, "probeCleanupFailureDetail");
 function exposeDependencies(probeTree, dependencyRoot) {
   const done = { linked: 0, failed: 0 };
   if (probeTree === dependencyRoot) return done;
-  const source = join17(dependencyRoot, "node_modules");
-  const target = join17(probeTree, "node_modules");
+  const source = join18(dependencyRoot, "node_modules");
+  const target = join18(probeTree, "node_modules");
   if (!existsSync11(source) || existsSync11(target)) return done;
-  mkdirSync23(target);
+  mkdirSync24(target);
   const linkType = process.platform === "win32" ? "junction" : "dir";
   for (const entry of readdirSync5(source, { withFileTypes: true })) {
     if (entry.name === ".vite" || entry.name === ".vite-temp") continue;
-    const sourceEntry = join17(source, entry.name);
-    const targetEntry = join17(target, entry.name);
+    const sourceEntry = join18(source, entry.name);
+    const targetEntry = join18(target, entry.name);
     let sourceStats;
     try {
       sourceStats = lstatSync4(sourceEntry);
@@ -15615,7 +16490,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
     }
     if (sourceStats.isSymbolicLink()) {
       try {
-        if (!statSync8(sourceEntry).isDirectory()) continue;
+        if (!statSync11(sourceEntry).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -15625,7 +16500,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
     if (entry.name.startsWith("@")) {
       let pkgs;
       try {
-        mkdirSync23(targetEntry);
+        mkdirSync24(targetEntry);
         pkgs = readdirSync5(sourceEntry);
       } catch {
         done.failed++;
@@ -15633,7 +16508,7 @@ function exposeDependencies(probeTree, dependencyRoot) {
       }
       for (const pkg of pkgs) {
         try {
-          symlinkSync(join17(sourceEntry, pkg), join17(targetEntry, pkg), linkType);
+          symlinkSync(join18(sourceEntry, pkg), join18(targetEntry, pkg), linkType);
           done.linked++;
         } catch {
           done.failed++;
@@ -15689,34 +16564,34 @@ function runProbeSuite(probeTree, probes, deadlineAt, now = Date.now, dependency
 }
 __name(runProbeSuite, "runProbeSuite");
 function splitDiffIntoHunks(diffText) {
-  const lines2 = diffText.split("\n");
-  const first = lines2.findIndex((l) => l.startsWith("@@"));
+  const lines = diffText.split("\n");
+  const first = lines.findIndex((l) => l.startsWith("@@"));
   if (first < 0) return [];
   let headerStart = 0;
   for (let k = first - 1; k >= 0; k--) {
-    if (lines2[k].startsWith("diff --git ")) {
+    if (lines[k].startsWith("diff --git ")) {
       headerStart = k;
       break;
     }
   }
-  let fileHeader = lines2.slice(headerStart, first);
+  let fileHeader = lines.slice(headerStart, first);
   const out = [];
   let i = first;
-  while (i < lines2.length) {
-    if (lines2[i].startsWith("diff --git ")) {
+  while (i < lines.length) {
+    if (lines[i].startsWith("diff --git ")) {
       const start = i;
-      while (i < lines2.length && !lines2[i].startsWith("@@") && !(i > start && lines2[i].startsWith("diff --git ")))
+      while (i < lines.length && !lines[i].startsWith("@@") && !(i > start && lines[i].startsWith("diff --git ")))
         i++;
-      fileHeader = lines2.slice(start, i);
+      fileHeader = lines.slice(start, i);
       continue;
     }
-    if (!lines2[i].startsWith("@@")) {
+    if (!lines[i].startsWith("@@")) {
       i++;
       continue;
     }
-    const header = lines2[i];
+    const header = lines[i];
     let j = i + 1;
-    while (j < lines2.length && !lines2[j].startsWith("@@") && !lines2[j].startsWith("diff --git ")) {
+    while (j < lines.length && !lines[j].startsWith("@@") && !lines[j].startsWith("diff --git ")) {
       j++;
     }
     let startLine = Number(
@@ -15724,18 +16599,18 @@ function splitDiffIntoHunks(diffText) {
     );
     let offset = 0;
     for (let k = i + 1; k < j; k++) {
-      if (lines2[k].startsWith("+")) {
+      if (lines[k].startsWith("+")) {
         startLine += offset;
         break;
       }
-      if (!lines2[k].startsWith("-") && !lines2[k].startsWith("\\")) offset++;
+      if (!lines[k].startsWith("-") && !lines[k].startsWith("\\")) offset++;
     }
     out.push({
       header: header.trim(),
       startLine,
       // `git apply` requires the trailing newline; a patch that ends mid-line is
       // rejected with `corrupt patch`.
-      patch: `${[...fileHeader, ...lines2.slice(i, j)].join("\n").replace(/\n+$/, "")}
+      patch: `${[...fileHeader, ...lines.slice(i, j)].join("\n").replace(/\n+$/, "")}
 `
     });
     i = j;
@@ -15779,10 +16654,10 @@ function newSideLength(header) {
 __name(newSideLength, "newSideLength");
 function runOneHunkProbe(probeTree, hunk, probes, deadlineAt, now = Date.now) {
   const { patch: _patch, ...meta } = hunk;
-  const abs = join17(probeTree, hunk.file);
+  const abs = join18(probeTree, hunk.file);
   let original;
   try {
-    original = readFileSync25(abs, "utf8");
+    original = readFileSync26(abs, "utf8");
   } catch (e) {
     return {
       ...meta,
@@ -15808,21 +16683,21 @@ function runOneHunkProbe(probeTree, hunk, probes, deadlineAt, now = Date.now) {
     const detail = verdict === "killed" ? "the suite went red with this hunk reverted \u2014 a test covers this change" : verdict === "survived" ? "every affected test still PASSED with this hunk reverted \u2014 no test in this diff fails when the change is undone" : "the tree with this hunk reverted produced no clean verdict (likely a compile or import error) \u2014 not evidence either way";
     return { ...meta, verdict, detail };
   } finally {
-    mkdirSync23(dirname20(abs), { recursive: true });
-    writeFileSync23(abs, original, "utf8");
+    mkdirSync24(dirname20(abs), { recursive: true });
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runOneHunkProbe, "runOneHunkProbe");
 function runControlMutant(probeTree, probeFile, deadlineAt, now = Date.now) {
-  const abs = join17(probeTree, probeFile);
+  const abs = join18(probeTree, probeFile);
   let original;
   try {
-    original = readFileSync25(abs, "utf8");
+    original = readFileSync26(abs, "utf8");
   } catch {
     return null;
   }
   try {
-    writeFileSync23(
+    writeFileSync24(
       abs,
       `${original}
 ;import { it as __qcIt, expect as __qcExpect } from 'vitest';
@@ -15835,15 +16710,15 @@ __qcIt('QWEN-REVIEW-POSITIVE-CONTROL', () => {
     const { perFile } = runProbeSuite(probeTree, [probeFile], deadlineAt, now);
     return perFile.some((r) => r.verdict === "gated");
   } finally {
-    writeFileSync23(abs, original, "utf8");
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runControlMutant, "runControlMutant");
 function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dependencyRoot = probeTree) {
-  const abs = join17(probeTree, mutant.file);
-  const original = readFileSync25(abs, "utf8");
-  const lines2 = original.split("\n");
-  if ((lines2[mutant.line - 1] ?? "").trim() !== mutant.statement) {
+  const abs = join18(probeTree, mutant.file);
+  const original = readFileSync26(abs, "utf8");
+  const lines = original.split("\n");
+  if ((lines[mutant.line - 1] ?? "").trim() !== mutant.statement) {
     return {
       ...mutant,
       verdict: "inconclusive",
@@ -15852,12 +16727,12 @@ function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dep
   }
   const what = mutant.operator === "coalesce" ? "with its `?? fallback` dropped" : mutant.operator === "guard-true" ? "with its guard condition replaced by `true`" : mutant.operator === "term-drop" ? "with its `+ CONSTANT` term dropped" : "deleted";
   if (mutant.mutated !== void 0) {
-    lines2[mutant.line - 1] = mutant.mutated;
+    lines[mutant.line - 1] = mutant.mutated;
   } else {
-    lines2.splice(mutant.line - 1, 1);
+    lines.splice(mutant.line - 1, 1);
   }
   try {
-    writeFileSync23(abs, lines2.join("\n"), "utf8");
+    writeFileSync24(abs, lines.join("\n"), "utf8");
     const { perFile } = runProbeSuite(
       probeTree,
       probes,
@@ -15869,7 +16744,7 @@ function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now, dep
     const detail = verdict === "killed" ? `the suite went red with this statement ${what} \u2014 a test catches it` : verdict === "survived" ? `every affected test still PASSED with this statement ${what} \u2014 no test fails ${mutant.mutated === void 0 ? "when it is removed" : "when it changes"}` : "the mutated tree produced no clean verdict (likely a compile or import error) \u2014 not evidence either way";
     return { ...mutant, verdict, detail };
   } finally {
-    writeFileSync23(abs, original, "utf8");
+    writeFileSync24(abs, original, "utf8");
   }
 }
 __name(runOneMutant, "runOneMutant");
@@ -15908,9 +16783,9 @@ async function runTestEfficacy(args) {
   const now = args.now ?? Date.now;
   const startedAt = now();
   const { report, worktree, base, out } = args;
-  const plan = JSON.parse(readFileSync25(report, "utf8"));
+  const plan = JSON.parse(readFileSync26(report, "utf8"));
   const rootPkg = JSON.parse(
-    readFileSync25(`${worktree}/package.json`, "utf8")
+    readFileSync26(`${worktree}/package.json`, "utf8")
   );
   const globs = rootPkg.workspaces ?? [];
   const { unreachable, probes, revert } = planTestEfficacy(
@@ -15918,8 +16793,8 @@ async function runTestEfficacy(args) {
     globs
   );
   for (const p of revert) {
-    const norm = join17(worktree, p);
-    const root = join17(worktree, ".");
+    const norm = join18(worktree, p);
+    const root = join18(worktree, ".");
     if (isAbsolute3(p) || norm !== root && !norm.startsWith(root + sep3)) {
       throw new Error(
         `refusing to run: revert path escapes the worktree: ${JSON.stringify(p)}`
@@ -16290,8 +17165,8 @@ async function runTestEfficacy(args) {
     findings,
     cleanupFailure
   };
-  mkdirSync23(dirname20(out), { recursive: true });
-  writeFileSync23(out, JSON.stringify(result, null, 2), "utf8");
+  mkdirSync24(dirname20(out), { recursive: true });
+  writeFileSync24(out, JSON.stringify(result, null, 2), "utf8");
   writeStdoutLine(
     `Wrote test-efficacy report to ${out} (${unreachable.length} unreachable, ${results.length} probed, ${mutantResults.length} mutant(s), ${hunkResults.length} hunk probe(s), ${findings.length} finding(s))`
   );
@@ -16368,17 +17243,17 @@ var testEfficacyCommand = {
 
 // packages/cli/src/commands/review/test-plan.ts
 init_esbuild_shims();
-import { existsSync as existsSync12, mkdirSync as mkdirSync24, readFileSync as readFileSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { dirname as dirname21, join as join18, normalize, resolve as resolve20 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync25, readFileSync as readFileSync27, writeFileSync as writeFileSync25 } from "node:fs";
+import { dirname as dirname21, join as join19, normalize, resolve as resolve20 } from "node:path";
 var PLAN_NAME_RE = /(test\s*plan|\btesting\b|how\s+(?:has\s+this|to)\s+(?:been\s+)?test(?:ed)?|测试计划|测试方案|测试步骤)/i;
 var HEADING_LINE_RE = /^(#{1,6})(?:[ \t](.*))?$/;
 var BOLD_LINE_RE = /^\*\*([^*\n]+)\*\*:?\s*$/;
 function extractTestPlanSection(body) {
-  const lines2 = body.split(/\r?\n/);
-  const fenced = new Array(lines2.length).fill(false);
+  const lines = body.split(/\r?\n/);
+  const fenced = new Array(lines.length).fill(false);
   let fenceMarker = null;
-  for (let i = 0; i < lines2.length; i++) {
-    const m = /^\s*(```|~~~)/.exec(lines2[i]);
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^\s*(```|~~~)/.exec(lines[i]);
     if (m) {
       fenced[i] = true;
       if (!fenceMarker) fenceMarker = m[1];
@@ -16387,27 +17262,27 @@ function extractTestPlanSection(body) {
     }
     fenced[i] = fenceMarker !== null;
   }
-  for (let i = 0; i < lines2.length; i++) {
+  for (let i = 0; i < lines.length; i++) {
     if (fenced[i]) continue;
-    const hash = HEADING_LINE_RE.exec(lines2[i]);
-    const bold = BOLD_LINE_RE.exec(lines2[i]);
+    const hash = HEADING_LINE_RE.exec(lines[i]);
+    const bold = BOLD_LINE_RE.exec(lines[i]);
     const name = (hash?.[2] ?? bold?.[1])?.trim();
     if (!name || !PLAN_NAME_RE.test(name)) continue;
     const level = hash ? hash[1].length : Infinity;
     const out = [];
-    for (let j = i + 1; j < lines2.length; j++) {
+    for (let j = i + 1; j < lines.length; j++) {
       if (!fenced[j]) {
-        const next = HEADING_LINE_RE.exec(lines2[j]);
+        const next = HEADING_LINE_RE.exec(lines[j]);
         if (next && !next[2]?.trim()) {
-          out.push(lines2[j]);
+          out.push(lines[j]);
           continue;
         }
         if (next && next[1].length <= level) break;
-        if (!hash && (next || BOLD_LINE_RE.test(lines2[j]))) break;
+        if (!hash && (next || BOLD_LINE_RE.test(lines[j]))) break;
       }
-      out.push(lines2[j]);
+      out.push(lines[j]);
     }
-    return { heading: lines2[i].trim(), content: out.join("\n").trim() };
+    return { heading: lines[i].trim(), content: out.join("\n").trim() };
   }
   return null;
 }
@@ -16572,7 +17447,7 @@ function rulePath(text, worktree, changed) {
     };
   }
   const ignored = isGitIgnored(worktree, path3);
-  if (existsSync12(join18(worktree, path3))) {
+  if (existsSync12(join19(worktree, path3))) {
     return {
       kind: "path",
       text,
@@ -16643,15 +17518,27 @@ function ruleCommand(text, worktree, buildTest) {
   let rootScripts = [];
   try {
     const rootPkg = JSON.parse(
-      readFileSync26(join18(worktree, "package.json"), "utf8")
+      readFileSync27(join19(worktree, "package.json"), "utf8")
     );
     rootScripts = Object.keys(rootPkg.scripts ?? {});
   } catch {
   }
   const defined = new Set(rootScripts);
-  for (const pkg of readWorkspacePackages(worktree)) {
+  const { packages, skipped } = readWorkspacePackages(worktree);
+  for (const pkg of packages) {
     for (const s of pkg.scripts) defined.add(s);
   }
+  const unreadable = [];
+  for (const dir of skipped) {
+    try {
+      const pkg = JSON.parse(
+        readFileSync27(join19(worktree, dir, "package.json"), "utf8")
+      );
+      for (const s of Object.keys(pkg?.scripts ?? {})) defined.add(s);
+    } catch {
+      unreadable.push(dir);
+    }
+  }
   if (defined.size === 0) {
     return {
       kind: "command",
@@ -16660,12 +17547,31 @@ function ruleCommand(text, worktree, buildTest) {
       note: "no package manifest could be read"
     };
   }
-  return defined.has(script) ? {
-    kind: "command",
-    text,
-    verdict: "reproduces",
-    note: `\`${script}\` is a defined script`
-  } : {
+  if (defined.has(script)) {
+    return {
+      kind: "command",
+      text,
+      verdict: "reproduces",
+      note: `\`${script}\` is a defined script`
+    };
+  }
+  if (hasUnmodeledWorkspaceGlob(readWorkspaceGlobs(worktree))) {
+    return {
+      kind: "command",
+      text,
+      verdict: "unchecked",
+      note: "the workspace globs use a shape this check does not model, so the script table may be incomplete"
+    };
+  }
+  if (unreadable.length > 0) {
+    return {
+      kind: "command",
+      text,
+      verdict: "unchecked",
+      note: `${unreadable.join(", ")} ${unreadable.length === 1 ? "has" : "have"} a package.json this check could not read, so the script table may be incomplete`
+    };
+  }
+  return {
     kind: "command",
     text,
     verdict: "contradicted",
@@ -16721,7 +17627,7 @@ __name(fetchPrBody, "fetchPrBody");
 function runTestPlan(args, fetchBody = fetchPrBody) {
   let plan;
   try {
-    plan = JSON.parse(readFileSync26(args.plan, "utf8"));
+    plan = JSON.parse(readFileSync27(args.plan, "utf8"));
   } catch (err) {
     throw new Error(
       `test-plan: cannot read the plan ${args.plan}: ${err.message}`
@@ -16756,7 +17662,7 @@ function runTestPlan(args, fetchBody = fetchPrBody) {
   if (args.buildTest) {
     try {
       buildTest = JSON.parse(
-        readFileSync26(args.buildTest, "utf8")
+        readFileSync27(args.buildTest, "utf8")
       );
     } catch {
       buildTest = null;
@@ -16813,8 +17719,8 @@ var testPlanCommand = {
     try {
       const report = runTestPlan(args);
       if (args.out) {
-        mkdirSync24(dirname21(resolve20(args.out)), { recursive: true });
-        writeFileSync24(resolve20(args.out), JSON.stringify(report, null, 2));
+        mkdirSync25(dirname21(resolve20(args.out)), { recursive: true });
+        writeFileSync25(resolve20(args.out), JSON.stringify(report, null, 2));
       }
       writeStdoutLine(JSON.stringify(report, null, 2));
       writeStderrLine(`test-plan: ${report.note}`);
@@ -16828,8 +17734,8 @@ var testPlanCommand = {
 // packages/cli/src/commands/review/cleanup.ts
 init_esbuild_shims();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync27, readdirSync as readdirSync6, rmSync as rmSync10 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync28, readdirSync as readdirSync6, rmSync as rmSync10 } from "node:fs";
+import { join as join20 } from "node:path";
 var AUTOMATION_MARKER = "<!-- qwen-";
 function isAutomationComment(body) {
   return (body ?? "").trimStart().startsWith(AUTOMATION_MARKER);
@@ -16860,7 +17766,7 @@ var OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 function readAuditWindow(target, expectedPrNumber) {
   let raw;
   try {
-    raw = readFileSync27(tmpFile(target, "fetch.json"), "utf8");
+    raw = readFileSync28(tmpFile(target, "fetch.json"), "utf8");
   } catch (err) {
     const code = err.code;
     return code === "ENOENT" ? { skip: "no fetch report" } : {
@@ -16907,7 +17813,7 @@ function readSubmitReceipt(target) {
   try {
     return new Set(
       parseReceiptIds(
-        readFileSync27(tmpFile(target, "submit-receipt.json"), "utf8")
+        readFileSync28(tmpFile(target, "submit-receipt.json"), "utf8")
       )
     );
   } catch {
@@ -17042,7 +17948,7 @@ function runCleanup(target) {
   }
   for (const file of tmpEntries) {
     if (!file.startsWith(prefix)) continue;
-    const full = join19(REVIEW_TMP_DIR, file);
+    const full = join20(REVIEW_TMP_DIR, file);
     try {
       rmSync10(full, { recursive: true, force: true });
       writeStdoutLine(`Removed temp file: ${full}`);
@@ -17073,11 +17979,324 @@ var cleanupCommand = {
   }, "handler")
 };
 
+// packages/cli/src/commands/review/cost-ledger.ts
+init_esbuild_shims();
+import { mkdirSync as mkdirSync26, readFileSync as readFileSync29, statSync as statSync12, writeFileSync as writeFileSync26 } from "node:fs";
+import { dirname as dirname22, join as join21, resolve as resolve21 } from "node:path";
+function readUsage(file, floorMs) {
+  const raw = readFileSync29(file, "utf8");
+  const events = [];
+  let launch = "";
+  for (const line of raw.split("\n")) {
+    if (line.trim() === "") continue;
+    for (const rec of parseLineTolerant(line, file)) {
+      if (launch === "" && rec["type"] === "user") {
+        launch = textOf(rec);
+      }
+      if (rec["type"] !== "assistant") continue;
+      const usage = rec["usageMetadata"];
+      if (usage === null || typeof usage !== "object") continue;
+      if (Array.isArray(usage)) continue;
+      const u = usage;
+      const ts = rec["timestamp"];
+      if (typeof ts !== "string") continue;
+      const tsMs = Date.parse(ts);
+      if (!Number.isFinite(tsMs) || tsMs < floorMs) continue;
+      const rawCount = /* @__PURE__ */ __name((k) => {
+        const v = u[k];
+        return typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : null;
+      }, "rawCount");
+      const rawPrompt = rawCount("promptTokenCount");
+      const rawTotal = rawCount("totalTokenCount");
+      const prompt = rawPrompt ?? 0;
+      const candidates = rawCount("candidatesTokenCount") ?? 0;
+      events.push({
+        timestampMs: tsMs,
+        timestamp: ts,
+        input: prompt,
+        // Cached is part of the prompt it is reported with; a broken proxy
+        // can report the pair inverted, and the inversion would otherwise
+        // land in BOTH the rendered share and the archived --out JSON.
+        cached: Math.min(rawCount("cachedContentTokenCount") ?? 0, prompt),
+        // `total − prompt` is the output including thinking under BOTH usage
+        // conventions — reasoning inside candidates, and thoughts disjoint
+        // from them — the same derivation tokenEstimation uses. Candidates
+        // alone is the fallback when the provider reported no total; it stays
+        // correct for the providers this CLI converts, which clamp thoughts
+        // inside candidates. Derive it only when BOTH operands survived the
+        // provider intact: a mixed-sign record coerces prompt to 0 while
+        // keeping a positive total, and the subtraction would bill the
+        // call's whole total as output.
+        output: rawPrompt !== null && rawTotal !== null && rawTotal > rawPrompt ? rawTotal - rawPrompt : candidates,
+        thoughts: rawCount("thoughtsTokenCount") ?? 0
+      });
+    }
+  }
+  return { events, launch };
+}
+__name(readUsage, "readUsage");
+var AUDIT_BRIEF_RE = /read_file\(file_path="[^"]*reverse-audit--chunk-(\d+)--round-(\d+)--[0-9a-f][^"]*\.brief\.md"\)/g;
+function labelOf(launch, fallback) {
+  const nl = launch.indexOf("\n");
+  const identity = nl === -1 ? launch : launch.slice(0, nl);
+  if (!identity.startsWith("You are review agent `")) return fallback;
+  let auditChunk = null;
+  for (const m of launch.matchAll(AUDIT_BRIEF_RE)) auditChunk = m;
+  if (auditChunk) {
+    return `audit chunk ${auditChunk[1]} (round ${auditChunk[2]})`;
+  }
+  const role = /^You are review agent `([^`]+)`/.exec(identity);
+  if (!role) return fallback;
+  const round = /\(round (\d+)\)/.exec(identity);
+  const chunk2 = CHUNK_RE.exec(role[1]);
+  if (chunk2) return `chunk ${chunk2[1]}`;
+  if (round) {
+    return `agent ${role[1]} (round ${round[1]})`;
+  }
+  const file = /Your file: `([^`]+)`/.exec(identity);
+  if (file) return `agent ${role[1]} (${file[1]})`;
+  return `agent ${role[1]}`;
+}
+__name(labelOf, "labelOf");
+function foldEvents(id, label2, events) {
+  const s = {
+    id,
+    label: label2,
+    calls: 0,
+    inputTokens: 0,
+    cachedTokens: 0,
+    outputTokens: 0,
+    thoughtsTokens: 0,
+    firstAt: null,
+    lastAt: null
+  };
+  let firstMs = Number.POSITIVE_INFINITY;
+  let lastMs = Number.NEGATIVE_INFINITY;
+  for (const e of events) {
+    s.calls += 1;
+    s.inputTokens += e.input;
+    s.cachedTokens += e.cached;
+    s.outputTokens += e.output;
+    s.thoughtsTokens += e.thoughts;
+    if (e.timestampMs < firstMs) {
+      firstMs = e.timestampMs;
+      s.firstAt = e.timestamp;
+    }
+    if (e.timestampMs > lastMs) {
+      lastMs = e.timestampMs;
+      s.lastAt = e.timestamp;
+    }
+  }
+  return s;
+}
+__name(foldEvents, "foldEvents");
+function human(n) {
+  if (n >= 9995e5) return `${(n / 1e9).toFixed(1)}B`;
+  if (n >= 999500) return `${(n / 1e6).toFixed(1)}M`;
+  if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
+  return String(n);
+}
+__name(human, "human");
+var plural = /* @__PURE__ */ __name((n, word) => `${n} ${word}${n === 1 ? "" : "s"}`, "plural");
+function planFloorMs(planPath) {
+  let raw;
+  let floorMs;
+  try {
+    raw = readFileSync29(planPath, "utf8");
+    floorMs = statSync12(planPath).mtimeMs;
+  } catch (err) {
+    throw new Error(
+      `could not read the plan report ${planPath}: ${err.message}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = null;
+  }
+  const plan = parsed !== null && typeof parsed === "object" ? parsed : void 0;
+  if (typeof plan?.["diffLines"] !== "number" || !Array.isArray(plan?.["chunks"])) {
+    throw new Error(`not a review plan report: ${planPath}`);
+  }
+  return floorMs;
+}
+__name(planFloorMs, "planFloorMs");
+function computeLedger(planPath, env = process.env) {
+  const floorMs = planFloorMs(planPath);
+  const { projectDir, sessionId, dir } = transcriptPaths(env);
+  const chatFile = join21(projectDir, "chats", `${sessionId}.jsonl`);
+  let mainEvents;
+  try {
+    mainEvents = readUsage(chatFile, floorMs).events;
+  } catch (err) {
+    throw new Error(
+      `could not read the chat transcript ${chatFile}: ${err.message}`
+    );
+  }
+  const main = mainEvents.length > 0 ? foldEvents("main", "main loop", mainEvents) : null;
+  let files;
+  try {
+    files = listAgentTranscriptFiles(dir);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      files = [];
+    } else {
+      throw new Error(
+        `could not list the subagent transcripts at ${dir}: ${err.message}`
+      );
+    }
+  }
+  const agents = [];
+  const agentEvents = [];
+  for (const f of files) {
+    const full = join21(dir, f);
+    let mtimeMs;
+    try {
+      mtimeMs = statSync12(full).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (mtimeMs < floorMs) continue;
+    let read;
+    try {
+      read = readUsage(full, floorMs);
+    } catch {
+      continue;
+    }
+    if (read.events.length === 0) continue;
+    const id = f.replace(/^agent-/, "").replace(/\.jsonl$/, "");
+    agents.push(foldEvents(id, labelOf(read.launch, id), read.events));
+    agentEvents.push(...read.events);
+  }
+  agents.sort((a, b) => b.inputTokens - a.inputTokens);
+  if (mainEvents.length === 0) {
+    throw new Error(
+      `could not read the chat transcript ${chatFile}: no main-loop usage records at or after the plan`
+    );
+  }
+  const totals = foldEvents("totals", "totals", [
+    ...mainEvents,
+    ...agentEvents
+  ]);
+  const wallSeconds = totals.firstAt !== null && totals.lastAt !== null ? Math.max(
+    0,
+    Math.round(
+      (Date.parse(totals.lastAt) - Date.parse(totals.firstAt)) / 1e3
+    )
+  ) : 0;
+  const { id: _i, label: _l, ...totalsRest } = totals;
+  return { totals: { ...totalsRest, wallSeconds }, main, agents };
+}
+__name(computeLedger, "computeLedger");
+function renderLedger(ledger) {
+  const t2 = ledger.totals;
+  const cachedPct = t2.inputTokens > 0 ? Math.round(t2.cachedTokens / t2.inputTokens * 100) : 0;
+  const lines = [];
+  lines.push(
+    `Cost ledger: ${plural(t2.calls, "model call")} \xB7 ${human(t2.inputTokens)} input (${cachedPct}% cached) \xB7 ${human(t2.outputTokens)} output (${human(t2.thoughtsTokens)} thinking) \xB7 ${Math.round(t2.wallSeconds / 60)} min wall`
+  );
+  if (ledger.main !== null) {
+    const m = ledger.main;
+    lines.push(
+      `  main loop: ${plural(m.calls, "call")} \xB7 ${human(m.inputTokens)} in \xB7 ${human(m.outputTokens)} out`
+    );
+  }
+  if (ledger.agents.length > 0) {
+    const rows = [];
+    for (const a of ledger.agents) {
+      const row = rows.find((r) => r.label === a.label);
+      if (row) {
+        row.calls += a.calls;
+        row.inputTokens += a.inputTokens;
+        row.outputTokens += a.outputTokens;
+        row.count += 1;
+      } else {
+        rows.push({
+          label: a.label,
+          calls: a.calls,
+          inputTokens: a.inputTokens,
+          outputTokens: a.outputTokens,
+          count: 1
+        });
+      }
+    }
+    rows.sort((a, b) => b.inputTokens - a.inputTokens);
+    lines.push(`  agent runs: ${ledger.agents.length}`);
+    for (const r of rows.slice(0, 8)) {
+      const label2 = r.count > 1 ? `${r.label} (\xD7${r.count})` : r.label;
+      lines.push(
+        `    ${label2}: ${plural(r.calls, "call")} \xB7 ${human(r.inputTokens)} in \xB7 ${human(r.outputTokens)} out`
+      );
+    }
+    if (rows.length > 8) {
+      const rest = rows.slice(8);
+      const restIn = rest.reduce((n, r) => n + r.inputTokens, 0);
+      const restAgents = rest.reduce((n, r) => n + r.count, 0);
+      lines.push(
+        `    \u2026and ${plural(restAgents, "more agent")} \xB7 ${human(restIn)} in combined`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+__name(renderLedger, "renderLedger");
+function runCostLedger(args) {
+  const stdoutErrorHandler = /* @__PURE__ */ __name((err) => {
+    if (err.code === "EPIPE") process.stdout.destroy();
+  }, "stdoutErrorHandler");
+  const stderrErrorHandler = /* @__PURE__ */ __name((err) => {
+    if (err.code === "EPIPE") process.stderr.destroy();
+  }, "stderrErrorHandler");
+  process.stdout.on("error", stdoutErrorHandler);
+  process.stderr.on("error", stderrErrorHandler);
+  try {
+    let ledger;
+    try {
+      ledger = computeLedger(args.plan, process.env);
+    } catch (err) {
+      const why = err instanceof TranscriptsUnavailableError ? err.message : err.message;
+      writeStderrLineSafe(`cost-ledger unavailable \u2014 ${why}`);
+      return;
+    }
+    if (args.out !== void 0 && args.out.length > 0) {
+      try {
+        mkdirSync26(dirname22(resolve21(args.out)), { recursive: true });
+        writeFileSync26(args.out, JSON.stringify(ledger, null, 2));
+      } catch (err) {
+        writeStderrLineSafe(
+          `cost-ledger: could not write ${args.out} \u2014 ${err.message}`
+        );
+      }
+    }
+    writeStdoutLineSafe(renderLedger(ledger));
+  } finally {
+    process.stdout.removeListener("error", stdoutErrorHandler);
+    process.stderr.removeListener("error", stderrErrorHandler);
+  }
+}
+__name(runCostLedger, "runCostLedger");
+var costLedgerCommand = {
+  command: "cost-ledger",
+  describe: "Aggregate this review's model-call cost from the harness's usage records",
+  builder: /* @__PURE__ */ __name((yargs) => yargs.option("plan", {
+    type: "string",
+    demandOption: true,
+    describe: "The plan report from Step 1 \u2014 its mtime marks the review start"
+  }).option("out", {
+    type: "string",
+    describe: "Also write the full ledger as JSON to this path"
+  }), "builder"),
+  handler: /* @__PURE__ */ __name((args) => {
+    runCostLedger(args);
+  }, "handler")
+};
+
 // packages/cli/src/commands/review/run.ts
 init_esbuild_shims();
 import { spawn, execFileSync as execFileSync6 } from "node:child_process";
-import { readdirSync as readdirSync7, readFileSync as readFileSync28, realpathSync as realpathSync3, statSync as statSync9 } from "node:fs";
-import { dirname as dirname22, join as join20, resolve as resolve21 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync30, realpathSync as realpathSync3, statSync as statSync13 } from "node:fs";
+import { dirname as dirname23, join as join22, resolve as resolve22 } from "node:path";
 var COMPOSED_PATTERN = /^qwen-review-.*composed\.json$/;
 var COMPOSED_POLL_MS = 250;
 var SIGNAL_EXIT_CODES = {
@@ -17111,10 +18330,10 @@ function newestArtifactSince(dir, pattern, startMs) {
   }
   for (const name of names) {
     if (!pattern.test(name)) continue;
-    const path3 = join20(dir, name);
+    const path3 = join22(dir, name);
     let mtime;
     try {
-      mtime = statSync9(path3).mtimeMs;
+      mtime = statSync13(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -17132,7 +18351,7 @@ function exitCodeFor(completed, event2, failOn) {
 __name(exitCodeFor, "exitCodeFor");
 function readComposed(path3) {
   try {
-    const parsed = JSON.parse(readFileSync28(path3, "utf8"));
+    const parsed = JSON.parse(readFileSync30(path3, "utf8"));
     return typeof parsed.event === "string" ? parsed : null;
   } catch {
     return null;
@@ -17163,7 +18382,7 @@ function childEnv() {
     return env;
   }
   try {
-    if (dirname22(realpathSync3(inherited)) === dirname22(realpathSync3(ownEntry))) {
+    if (dirname23(realpathSync3(inherited)) === dirname23(realpathSync3(ownEntry))) {
       return env;
     }
   } catch {
@@ -17285,8 +18504,8 @@ async function runReview(args) {
     downgraded: composed?.downgraded ?? false,
     downgradedFrom: composed?.downgradedFrom ?? null,
     remediation: composed?.remediation ?? [],
-    composedPath: composedPath ? resolve21(composedPath) : null,
-    reportPath: reportPath ? resolve21(reportPath) : null,
+    composedPath: composedPath ? resolve22(composedPath) : null,
+    reportPath: reportPath ? resolve22(reportPath) : null,
     childExitCode,
     childSignal,
     timedOut,
@@ -17300,7 +18519,7 @@ async function runReview(args) {
       writeStdoutLine(result.verdictLine ?? `Event: ${result.event}`);
       if (result.reportPath) writeStdoutLine(`Report: ${result.reportPath}`);
     } else {
-      const detail = composedPath !== null ? `a composed verdict was found at ${resolve21(composedPath)} but could not be parsed` : "no composed verdict was produced";
+      const detail = composedPath !== null ? `a composed verdict was found at ${resolve22(composedPath)} but could not be parsed` : "no composed verdict was produced";
       writeStdoutLine(
         timedOut ? "Review did not complete: timed out." : `Review did not complete: ${detail}${childExitCode !== null ? ` (CLI exit ${childExitCode})` : ""}${childSignal !== null ? ` (killed by ${childSignal})` : ""}.`
       );
@@ -17368,22 +18587,22 @@ init_esbuild_shims();
 import {
   existsSync as existsSync14,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync25,
-  readFileSync as readFileSync29,
-  statSync as statSync10
+  mkdirSync as mkdirSync27,
+  readFileSync as readFileSync31,
+  statSync as statSync14
 } from "node:fs";
 import {
-  dirname as dirname23,
+  dirname as dirname24,
   isAbsolute as isAbsolute4,
-  join as join21,
+  join as join23,
   relative as relative3,
-  resolve as resolve22,
+  resolve as resolve23,
   sep as sep4,
   toNamespacedPath
 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function workspaceRoot() {
-  return resolve22(process.env["QWEN_CODE_PROJECT_DIR"] ?? process.cwd());
+  return resolve23(process.env["QWEN_CODE_PROJECT_DIR"] ?? process.cwd());
 }
 __name(workspaceRoot, "workspaceRoot");
 function isWithin(parent, child) {
@@ -17392,7 +18611,7 @@ function isWithin(parent, child) {
 }
 __name(isWithin, "isWithin");
 function workspacePath(root, value, label2) {
-  const absolute = resolve22(root, value);
+  const absolute = resolve23(root, value);
   if (!isWithin(root, absolute)) {
     throw new Error(
       `${label2} must be inside the workspace: ${JSON.stringify(value)}.`
@@ -17405,7 +18624,7 @@ function rejectSymlinkPath(root, path3, label2) {
   const rel = relative3(root, path3);
   let current = root;
   for (const segment of rel.split(sep4)) {
-    current = join21(current, segment);
+    current = join23(current, segment);
     if (existsSync14(current) && lstatSync5(current).isSymbolicLink()) {
       throw new Error(`${label2} must not traverse a symbolic link.`);
     }
@@ -17415,14 +18634,14 @@ __name(rejectSymlinkPath, "rejectSymlinkPath");
 function sameFile(left, right) {
   if (left === right) return true;
   if (!existsSync14(left) || !existsSync14(right)) return false;
-  const leftStat = statSync10(left);
-  const rightStat = statSync10(right);
+  const leftStat = statSync14(left);
+  const rightStat = statSync14(right);
   return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
 }
 __name(sameFile, "sameFile");
 function readText(path3, label2) {
   try {
-    return readFileSync29(path3, "utf8");
+    return readFileSync31(path3, "utf8");
   } catch (error) {
     throw new Error(
       `Could not read the ${label2} file at ${JSON.stringify(path3)}: ${error instanceof Error ? error.message : String(error)}`
@@ -17548,7 +18767,7 @@ function saveReviewArtifact(args) {
   const composedPath = workspacePath(root, args.composed, "Composed input");
   const reportPath = workspacePath(root, args.report, "Markdown report");
   const outputPath = workspacePath(root, args.out, "Output");
-  const reviewsRoot = resolve22(root, REVIEWS_DIR);
+  const reviewsRoot = resolve23(root, REVIEWS_DIR);
   if (!isWithin(reviewsRoot, reportPath) || reportPath === reviewsRoot) {
     throw new Error(
       `Markdown report must be a file under ${JSON.stringify(REVIEWS_DIR)}: ${JSON.stringify(args.report)}.`
@@ -17589,7 +18808,7 @@ function saveReviewArtifact(args) {
   const verdict = validateVerdict(readJson2(composedPath, "composed verdict"));
   let reportIsFile;
   try {
-    reportIsFile = statSync10(reportPath).isFile();
+    reportIsFile = statSync14(reportPath).isFile();
   } catch {
   }
   if (reportIsFile === false) {
@@ -17609,7 +18828,7 @@ function saveReviewArtifact(args) {
     outcomesRecorded: findings.outcomesRecorded,
     markdownReportPath
   };
-  mkdirSync25(dirname23(outputPath), { recursive: true });
+  mkdirSync27(dirname24(outputPath), { recursive: true });
   atomicWriteFileSync(
     toNamespacedPath(outputPath),
     `${JSON.stringify(document, null, 2)}
@@ -17662,9 +18881,9 @@ var saveArtifactCommand = {
 var reviewCommand = {
   command: "review",
   describe: "Run a review non-interactively (`run`), plus the internal helpers used by the /review skill (PR worktree setup, context fetch, rules loading, presubmit checks, cleanup)",
-  builder: /* @__PURE__ */ __name((yargs) => yargs.command(runCommand).command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(baseTreeCommand).command(testDeltaCommand).command(driveCommand).command(mockProviderCommand).command(extractStepCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(presubmitCommand).command(testEfficacyCommand).command(testPlanCommand).command(findingsCommand).command(publishAssetsCommand).command(composeReviewCommand).command(saveArtifactCommand).command(submitCommand).command(cleanupCommand).demandCommand(
+  builder: /* @__PURE__ */ __name((yargs) => yargs.command(runCommand).command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(baseTreeCommand).command(testDeltaCommand).command(driveCommand).command(mockProviderCommand).command(extractStepCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(costLedgerCommand).command(presubmitCommand).command(testEfficacyCommand).command(testPlanCommand).command(findingsCommand).command(publishAssetsCommand).command(composeReviewCommand).command(saveArtifactCommand).command(submitCommand).command(cleanupCommand).demandCommand(
     1,
-    "Specify a subcommand: run, parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, save-artifact, submit, or cleanup."
+    "Specify a subcommand: run, parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, save-artifact, submit, or cleanup."
   ).version(false), "builder"),
   handler: /* @__PURE__ */ __name(() => {
   }, "handler")
@@ -17864,11 +19083,11 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-E6H3AURD.js"),
-      import("./updateCheck-ZXRCGY66.js"),
-      import("./installationInfo-OFDYLDFD.js"),
-      import("./standalone-update-NYYZEHLD.js"),
-      import("./stdioHelpers-HGIYTWAY.js"),
+      import("./settings-AI2BTBOZ.js"),
+      import("./updateCheck-UOVZSTP7.js"),
+      import("./installationInfo-PO4Z3ES7.js"),
+      import("./standalone-update-WVINHRNS.js"),
+      import("./stdioHelpers-7A2EE64Z.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
     const { formatUpdateInstructions, getInstallationInfo } = installationInfoModule;
@@ -18713,7 +19932,7 @@ var SessionIdConflictError = class extends Error {
     this.sessionId = sessionId;
   }
 };
-async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtensions, hooksConfig, disabledSkillNamesProvider, sessionMcpServers, settingsWatcher, throwOnSessionIdConflict = false) {
+async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtensions, hooksConfig, disabledSkillNamesProvider, sessionMcpServers, settingsWatcher, throwOnSessionIdConflict = false, hostPolicy) {
   const debugMode = isDebugMode(argv);
   if (debugMode && process.env["QWEN_DEBUG_LOG_FILE"] === void 0) {
     process.env["QWEN_DEBUG_LOG_FILE"] = "1";
@@ -19034,7 +20253,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     disabledSlashCommands: disabledSlashCommands.length > 0 ? disabledSlashCommands : void 0,
     disabledSkillNamesProvider: bareMode || safeMode ? void 0 : disabledSkillNamesProvider,
     terminalImageRenderSupportProvider: interactive ? async () => {
-      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-QRSCS2BE.js");
+      const { getTerminalImageRenderSupport } = await import("./terminal-image-renderer-II74TFVW.js");
       return getTerminalImageRenderSupport();
     } : void 0,
     disabledSkillLevels: bareMode || safeMode || !Array.isArray(settings.skills?.disabledLevels) ? void 0 : settings.skills.disabledLevels.filter(isSkillLevel),
@@ -19051,6 +20270,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
       deny: mergedDeny.length > 0 ? mergedDeny : void 0,
       autoMode: bareMode || safeMode ? void 0 : settings.permissions?.autoMode
     },
+    toolInvocationGuard: hostPolicy?.toolInvocationGuard,
     // Permission rule persistence callback (writes to settings files).
     onPersistPermissionRule: /* @__PURE__ */ __name(async (scope, ruleType, rule) => {
       const currentSettings = loadSettings(cwd);