@qwen-code/qwen-code 0.21.5 → 0.21.6

package/chunks/{chunk-B3EBIZUY.js → chunk-ACZRB7AD.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-MR3PXB6E.js";
 import {
   ideContextStore
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   require_proper_lockfile
 } from "./chunk-KRXPRVGL.js";
@@ -20,11 +20,12 @@ import {
 import {
   FatalConfigError,
   Storage,
+  createDebugLogger,
   getErrorMessage
 } from "./chunk-3RXUYQJI.js";
 import {
   writeStderrLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -1845,6 +1846,7 @@ function pathsEqual(left, right) {
 __name(pathsEqual, "pathsEqual");
 
 // packages/cli/src/config/trustedFolders.ts
+var debugLogger = createDebugLogger("TRUSTED_FOLDERS");
 var TRUSTED_FOLDERS_FILENAME = "trustedFolders.json";
 function getTrustedFoldersPath() {
   if (process.env["QWEN_CODE_TRUSTED_FOLDERS_PATH"]) {
@@ -2001,7 +2003,10 @@ function writeTrustedFolders(filePath, update) {
   }
   const release = import_proper_lockfile.default.lockSync(filePath, {
     realpath: false,
-    stale: 1e4
+    stale: 1e4,
+    onCompromised: /* @__PURE__ */ __name((err) => {
+      debugLogger.warn("trusted folders lock compromised:", err);
+    }, "onCompromised")
   });
   try {
     let originalContent = "{}";

package/chunks/chunk-BKHCW2BI.js

@@ -0,0 +1,41 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/acp-bridge/src/externalToolGuard.ts
+init_esbuild_shims();
+var PRIVATE_EXTERNAL_TOOL_GUARD_ENV = "QWEN_CODE_PRIVATE_EXTERNAL_TOOL_GUARD";
+var EXTERNAL_TOOL_GUARD_READY_META_KEY = "qwen-code/external-tool-guard-ready";
+var EXTERNAL_TOOL_GUARD_REQUIRED_VALUE = "required-v1";
+var EXTERNAL_TOOL_GUARD_TOKEN_ENV = "QWEN_CODE_EXTERNAL_TOOL_GUARD_TOKEN";
+var EXTERNAL_TOOL_GUARD_MAX_DENIAL_REASON_CHARS = 500;
+function containsUnsafeExternalToolGuardControlCharacter(value) {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code < 32 || code >= 127 && code <= 159 || code === 8232 || code === 8233;
+  });
+}
+__name(containsUnsafeExternalToolGuardControlCharacter, "containsUnsafeExternalToolGuardControlCharacter");
+function isValidExternalToolGuardDenialReason(reason) {
+  return typeof reason === "string" && reason.trim().length > 0 && reason.length <= EXTERNAL_TOOL_GUARD_MAX_DENIAL_REASON_CHARS && !containsUnsafeExternalToolGuardControlCharacter(reason);
+}
+__name(isValidExternalToolGuardDenialReason, "isValidExternalToolGuardDenialReason");
+
+export {
+  PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
+  EXTERNAL_TOOL_GUARD_READY_META_KEY,
+  EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
+  EXTERNAL_TOOL_GUARD_TOKEN_ENV,
+  containsUnsafeExternalToolGuardControlCharacter,
+  isValidExternalToolGuardDenialReason
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-XD2PNH3K.js → chunk-BOGOR4HB.js}

@@ -407,18 +407,18 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
   try {
     if (authType === "openai" /* USE_OPENAI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-2AEXDN55.js");
+        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-RAJUFWQY.js");
         return createOpenAIContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "qwen-oauth" /* QWEN_OAUTH */) {
-      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-2KKPYA5J.js");
+      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-J2X3EN43.js");
       try {
         const qwenClient = await getQwenOauthClient(
           config,
           isInitialAuth ? { requireCachedCredentials: true } : void 0
         );
         loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-          const { QwenContentGenerator } = await import("./qwenContentGenerator-2FESCF27.js");
+          const { QwenContentGenerator } = await import("./qwenContentGenerator-2QLCUFNZ.js");
           return new QwenContentGenerator(qwenClient, generatorConfig, config);
         }, "loadBaseGenerator");
       } catch (error) {
@@ -434,7 +434,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       }, "loadBaseGenerator");
     } else if (authType === "gemini" /* USE_GEMINI */ || authType === "vertex-ai" /* USE_VERTEX_AI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createGeminiContentGenerator } = await import("./geminiContentGenerator-LLLZBOUG.js");
+        const { createGeminiContentGenerator } = await import("./geminiContentGenerator-LOCFHNVA.js");
         return createGeminiContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else {
@@ -450,7 +450,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       try {
         const [baseGenerator, { LoggingContentGenerator }] = await Promise.all([
           loadBaseGenerator(),
-          import("./loggingContentGenerator-B6B5EGB3.js")
+          import("./loggingContentGenerator-2P3MNACM.js")
         ]);
         return new LoggingContentGenerator(
           baseGenerator,

package/chunks/{chunk-QL4TN4HS.js → chunk-BRVWYMKV.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   writeStderrLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-TCOJPG2P.js → chunk-C4CBJQKY.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-KHUA3NQV.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-4O6HLCOF.js → chunk-CA4UIDFU.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   parseRule
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-SQTA6PAY.js → chunk-CJ5WLD5Y.js}

@@ -2,11 +2,11 @@
 "use strict";
 import {
   getPlugin
-} from "./chunk-DTAPI453.js";
+} from "./chunk-EMYZIABH.js";
 import {
   loadSettings,
   saveSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -294,6 +294,10 @@ var WorkspaceChannelSettingsStore = class {
       if (value !== void 0) nextConfig[key] = value;
     }
     assertManagedConfig(nextConfig, previous, plugin.management.fields);
+    const crossFieldError = plugin.management.validateConfig?.(nextConfig);
+    if (crossFieldError !== void 0) {
+      throw invalidConfig(crossFieldError);
+    }
     const channels = { ...current.channels, [name]: nextConfig };
     const workspaceFile = loadSettings(this.workspaceCwd, {
       skipLoadEnvironment: true

package/chunks/{chunk-7W5KOBYU.js → chunk-DIT4V3XH.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   AuthType
-} from "./chunk-XD2PNH3K.js";
+} from "./chunk-BOGOR4HB.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-OIGB253L.js → chunk-DVBEGGLG.js}

@@ -2,12 +2,12 @@
 "use strict";
 import {
   buildPermissionSettings
-} from "./chunk-4O6HLCOF.js";
+} from "./chunk-CA4UIDFU.js";
 import {
   resolveVoiceStreamConfig,
   resolveVoiceTranscriptionConfig,
   transcribeVoiceAudio
-} from "./chunk-LMNM37OE.js";
+} from "./chunk-O7V7N4G7.js";
 import {
   getVoiceSettingsScope,
   isSelectableVoiceModel,
@@ -16,7 +16,7 @@ import {
   readVoiceMode,
   readVoiceModel,
   resolveVoiceTransport
-} from "./chunk-TCOJPG2P.js";
+} from "./chunk-C4CBJQKY.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
@@ -42,7 +42,7 @@ import {
   createIdleWorkspaceProvidersStatus,
   createIdleWorkspaceSkillsStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-PDDYAXL2.js";
+} from "./chunk-UGTWD35F.js";
 import {
   McpServerNotFoundError,
   McpServerRestartFailedError,
@@ -55,15 +55,15 @@ import {
 import {
   getPersistScopeForModelSelection,
   loadSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-ACZRB7AD.js";
 import {
   ModelsConfig,
   SkillManager,
   require_yauzl
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   Storage,
   createDebugLogger
@@ -71,7 +71,7 @@ import {
 import {
   writeStderrLine,
   writeStderrLineSafe
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-DTAPI453.js → chunk-EMYZIABH.js}

@@ -21,7 +21,7 @@ function ensureBuiltins() {
         { name: "wecom", promise: import("./dist-HVBMEYWK.js") },
         { name: "feishu", promise: import("./dist-DPPHJAVL.js") },
         { name: "qqbot", promise: import("./dist-SFQ34F4M.js") },
-        { name: "github", promise: import("./dist-IKGVITP3.js") },
+        { name: "github", promise: import("./dist-KS4O2NKE.js") },
         { name: "gitlab", promise: import("./dist-C5U4LJKW.js") }
       ];
       const results = await Promise.allSettled(labelled.map((l) => l.promise));

package/chunks/{chunk-GBY3ODW7.js → chunk-EXCEQD22.js}

@@ -2,17 +2,17 @@
 "use strict";
 import {
   performStandaloneUpdate
-} from "./chunk-EXHQZBVJ.js";
+} from "./chunk-2POQWYM6.js";
 import {
   updateEventEmitter
 } from "./chunk-YAF2MQZ6.js";
 import {
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-KHUA3NQV.js";
 import {
   getInstallationInfo,
   resolveUpdateCommand
-} from "./chunk-CAX76R46.js";
+} from "./chunk-JE44IPH6.js";
 import {
   createDebugLogger
 } from "./chunk-3RXUYQJI.js";

package/chunks/{chunk-VJPF6GF2.js → chunk-FZFP7RZI.js}

@@ -3,7 +3,7 @@
 import {
   JsonFormatter,
   parseAndFormatApiError
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   FatalBudgetExceededError,
   FatalCancellationError,
@@ -12,10 +12,10 @@ import {
 } from "./chunk-3RXUYQJI.js";
 import {
   runExitCleanup
-} from "./chunk-LSYVASZS.js";
+} from "./chunk-RHTTKJTP.js";
 import {
   writeStderrLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-3GOCVBYR.js → chunk-G5NNWEYE.js}

@@ -5,27 +5,27 @@ import {
 } from "./chunk-57OAHC2Y.js";
 import {
   loadSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   getCurrentLanguage,
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-KHUA3NQV.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-ACZRB7AD.js";
 import {
   ExtensionManager,
   getExtensionDescription,
   getExtensionDisplayName,
   redactUrlCredentials,
   require_prompts
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   stripAnsi
 } from "./chunk-TWPJO254.js";
 import {
   writeStdoutLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-IWYXZAGT.js → chunk-GESMMPAK.js}

@@ -9,13 +9,7 @@ import {
   staleArgsWarning,
   validateAuthMethod,
   writeSkillArgs
-} from "./chunk-GP4IMBX5.js";
-import {
-  isKittyProtocolEnabled
-} from "./chunk-NYX53SV4.js";
-import {
-  contextCommand
-} from "./chunk-4NNR24EP.js";
+} from "./chunk-XM2O73NC.js";
 import {
   calculateCost,
   computeSessionStats,
@@ -24,20 +18,26 @@ import {
   findInlineMathExpressions,
   getSystemInfoFields,
   levelLabel
-} from "./chunk-C6ARWPCG.js";
+} from "./chunk-TOGZTG4X.js";
+import {
+  isKittyProtocolEnabled
+} from "./chunk-NYX53SV4.js";
 import {
   VSCODE_SHIFT_ENTER_SEQUENCE,
   writeOsc52
 } from "./chunk-3LGZEYOF.js";
+import {
+  contextCommand
+} from "./chunk-SKNE3KQC.js";
 import {
   rollbackStandaloneUpdate
-} from "./chunk-EXHQZBVJ.js";
+} from "./chunk-2POQWYM6.js";
 import {
   themeManager
 } from "./chunk-KKN2IE7Q.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-VJPF6GF2.js";
+} from "./chunk-FZFP7RZI.js";
 import {
   GITHUB_WORKFLOW_PATHS,
   INSIGHT_CSS,
@@ -51,11 +51,15 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-YO4JI7B4.js";
+} from "./chunk-W5DXUTXD.js";
 import {
   stripUnsafeCharacters,
   toCodePoints
 } from "./chunk-4NFY2S7N.js";
+import {
+  isInlineModelOverrideAllowed,
+  parseAcpModelOption
+} from "./chunk-5MJGUQU5.js";
 import {
   formatUnsupportedVoiceModelMessage,
   getVoiceSettingsScope,
@@ -63,20 +67,16 @@ import {
   isVoiceEnabled,
   readVoiceMode,
   readVoiceModel
-} from "./chunk-TCOJPG2P.js";
+} from "./chunk-C4CBJQKY.js";
 import {
   getExtendedSystemInfo,
   getGitVersion,
   getNpmVersion
-} from "./chunk-IK3RYLAD.js";
+} from "./chunk-K2B3X3E7.js";
 import {
   formatDuration,
   formatTokenCount
 } from "./chunk-3SH53ANB.js";
-import {
-  isInlineModelOverrideAllowed,
-  parseAcpModelOption
-} from "./chunk-WU5NBSLD.js";
 import {
   OUTPUT_LANGUAGE_AUTO,
   getAllSettingKeys,
@@ -88,7 +88,7 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   validateSettingValue,
   writeOutputLanguageAndRegisterPath
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   SUPPORTED_LANGUAGES,
   getCurrentLanguage,
@@ -96,14 +96,14 @@ import {
   resolveSupportedLanguage,
   setLanguageAsync,
   t
-} from "./chunk-K64OI7S7.js";
+} from "./chunk-KHUA3NQV.js";
 import {
   getInstallationInfo
-} from "./chunk-CAX76R46.js";
+} from "./chunk-JE44IPH6.js";
 import {
   isFolderTrustEnabled,
   loadTrustedFolders
-} from "./chunk-B3EBIZUY.js";
+} from "./chunk-ACZRB7AD.js";
 import {
   require_strip_json_comments
 } from "./chunk-ALGGS7UH.js";
@@ -174,13 +174,13 @@ import {
   runForkedAgent,
   tryGenerateSessionTitle,
   unregisterGoalHook
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   external_exports
 } from "./chunk-H6XPXXMH.js";
 import {
   resolveModelId
-} from "./chunk-7W5KOBYU.js";
+} from "./chunk-DIT4V3XH.js";
 import {
   getAutoSkillCuratorStatus,
   parse,
@@ -188,7 +188,7 @@ import {
   restoreArchivedAutoSkill,
   runAutoSkillCurator,
   setAutoSkillPinned
-} from "./chunk-MISUEWB4.js";
+} from "./chunk-4S4OEQ6U.js";
 import {
   HookEventName,
   sanitizeUserPromptExpansionAdditionalContext
@@ -213,7 +213,7 @@ import {
 } from "./chunk-DGEIYUC3.js";
 import {
   resolveOpenAILogDir
-} from "./chunk-AEWOKOJY.js";
+} from "./chunk-QZKYZCN3.js";
 import {
   IdeConnectionEvent,
   formatTokenUsageSummaryAsCsv,
@@ -227,7 +227,7 @@ import {
   recordSkillInvocation,
   runSideQuery,
   uiTelemetryService
-} from "./chunk-ZPGMDT4S.js";
+} from "./chunk-PX5DNLSA.js";
 import {
   getAutoMemoryRoot
 } from "./chunk-E4WHKETF.js";
@@ -248,7 +248,7 @@ import {
   isCpuProfileRecording,
   startCpuProfile,
   stopCpuProfile
-} from "./chunk-K2ETEWG6.js";
+} from "./chunk-VSALQLT7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -1945,7 +1945,7 @@ var approvalModeCommand = {
         };
       }
     }
-    const autoModeNotices = mode === "auto" /* AUTO */ && priorMode !== "auto" /* AUTO */ && config ? await import("./useAutoAcceptIndicator-ZYQW5SGJ.js") : void 0;
+    const autoModeNotices = mode === "auto" /* AUTO */ && priorMode !== "auto" /* AUTO */ && config ? await import("./useAutoAcceptIndicator-PC6MOJCO.js") : void 0;
     if (config) {
       try {
         config.setApprovalMode(mode);
@@ -6682,7 +6682,7 @@ var expandNowCommand = {
         content: t("History is already expanded in this session.")
       };
     }
-    const { expandCollapsedHistory } = await import("./resumeHistoryUtils-Z4OFBXPM.js");
+    const { expandCollapsedHistory } = await import("./resumeHistoryUtils-RCY7AL5Y.js");
     const updated = expandCollapsedHistory(history);
     loadHistory(updated);
     refreshStatic();
@@ -13894,10 +13894,10 @@ var updateCommand = {
       { performStandaloneUpdate },
       installationInfo
     ] = await Promise.all([
-      import("./updateCheck-ZXRCGY66.js"),
-      import("./processUtils-JLLRVZHT.js"),
-      import("./standalone-update-NYYZEHLD.js"),
-      import("./installationInfo-OFDYLDFD.js")
+      import("./updateCheck-UOVZSTP7.js"),
+      import("./processUtils-VIQ4JHVX.js"),
+      import("./standalone-update-WVINHRNS.js"),
+      import("./installationInfo-PO4Z3ES7.js")
     ]);
     const { formatUpdateInstructions, getInstallationInfo: getInstallationInfo2 } = installationInfo;
     const settings = context.services.settings;

package/chunks/{chunk-SVIEVA3L.js → chunk-GK2H5GRC.js}

@@ -18,12 +18,15 @@ import {
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
+import {
+  EXTERNAL_TOOL_GUARD_TOKEN_ENV
+} from "./chunk-BKHCW2BI.js";
 import {
   loadSettings
-} from "./chunk-RM3F46UT.js";
+} from "./chunk-PPUOYL77.js";
 import {
   MCP_BUDGET_WARN_FRACTION
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -36,7 +39,7 @@ import {
 } from "./chunk-E4WHKETF.js";
 import {
   writeStderrLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -214,6 +217,16 @@ var serveCommand = {
   }).option("permission-response-timeout-ms", {
     type: "number",
     description: "Wall-clock timeout for a single human permission / ask_user_question response in daemon (ACP) mode (ms). 0 = disabled (wait forever). Default: 300000 (5 min)."
+  }).option("external-tool-guard-mode", {
+    choices: ["off", "required"],
+    default: "off",
+    description: "Managed ACP pre-execution policy mode. Default off preserves current CLI and daemon behavior. Required fails startup unless a compatible loopback provider is available."
+  }).option("external-tool-guard-endpoint", {
+    type: "string",
+    description: "Origin-only loopback HTTP(S) endpoint for required external tool guarding, for example http://127.0.0.1:8787."
+  }).option("external-tool-guard-timeout-ms", {
+    type: "number",
+    description: "Per-handshake/prepare external tool guard timeout in milliseconds. Default: 3000."
   }).option("rate-limit", {
     type: "boolean",
     description: "Enable per-tier HTTP rate limiting. Tiers: prompt (10/min), mutation (30/min), read (120/min). Health, heartbeat, SSE, and /acp are exempt."
@@ -331,7 +344,9 @@ var serveCommand = {
         process.exit(1);
       }
     }
-    const { runQwenServe } = await import("./run-qwen-serve-K5W6MM6M.js");
+    const externalToolGuardToken = process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV] ?? "";
+    delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
+    const { runQwenServe } = await import("./run-qwen-serve-3JN75CIQ.js");
     try {
       const handle = await runQwenServe({
         port: argv.port,
@@ -367,6 +382,16 @@ var serveCommand = {
         ...argv["permission-response-timeout-ms"] !== void 0 ? {
           permissionResponseTimeoutMs: argv["permission-response-timeout-ms"]
         } : {},
+        ...argv["external-tool-guard-mode"] === "required" ? {
+          externalToolGuard: {
+            mode: "required",
+            endpoint: argv["external-tool-guard-endpoint"] ?? "",
+            token: externalToolGuardToken,
+            ...argv["external-tool-guard-timeout-ms"] !== void 0 ? {
+              timeoutMs: argv["external-tool-guard-timeout-ms"]
+            } : {}
+          }
+        } : {},
         ...rateLimit ? { rateLimit: true } : {},
         ...rateLimitPrompt !== void 0 ? { rateLimitPrompt } : {},
         ...rateLimitMutation !== void 0 ? { rateLimitMutation } : {},

package/chunks/{chunk-7M2RLFNX.js → chunk-GWRHVJY2.js}

@@ -3,16 +3,16 @@
 import {
   settleChatRecording,
   subscribeToHeadlessChatRecordingFailures
-} from "./chunk-3H5RFLTS.js";
+} from "./chunk-ODPXHGLL.js";
 import {
   handleAtCommand
-} from "./chunk-JDNWIXHJ.js";
+} from "./chunk-SLSWFHDF.js";
 import {
   JsonOutputAdapter
-} from "./chunk-FEUXV3DC.js";
+} from "./chunk-Q5RM32DR.js";
 import {
   StreamJsonOutputAdapter
-} from "./chunk-N3RERU5N.js";
+} from "./chunk-NGJOAKJY.js";
 import {
   buildInitialSystemReminders,
   buildSystemMessage,
@@ -24,11 +24,11 @@ import {
   insertAfterFunctionResponses,
   isSlashCommand,
   normalizePartList
-} from "./chunk-IWYXZAGT.js";
+} from "./chunk-GESMMPAK.js";
 import {
   RunBudgetEnforcer,
   cleanupReviewWorktreeLeases
-} from "./chunk-GP4IMBX5.js";
+} from "./chunk-XM2O73NC.js";
 import {
   AlreadyReportedError,
   handleBudgetExceededError,
@@ -36,10 +36,10 @@ import {
   handleError,
   handleMaxTurnsExceededError,
   handleToolError
-} from "./chunk-VJPF6GF2.js";
+} from "./chunk-FZFP7RZI.js";
 import {
   isInlineModelOverrideAllowed
-} from "./chunk-WU5NBSLD.js";
+} from "./chunk-5MJGUQU5.js";
 import {
   PLAN_MODE_ENTRY_SIBLING_SKIP_MESSAGE,
   buildSessionRecoveryPlanFromApiHistory,
@@ -57,7 +57,7 @@ import {
   parseAndFormatApiError,
   partitionByConcurrencySafety,
   restoreWorktreeContext
-} from "./chunk-YLL3SC5S.js";
+} from "./chunk-A4VTILZT.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -79,7 +79,7 @@ import {
   shouldRunVisionBridge,
   splitImageParts,
   uiTelemetryService
-} from "./chunk-ZPGMDT4S.js";
+} from "./chunk-PX5DNLSA.js";
 import {
   ToolNames
 } from "./chunk-D7D7RXIJ.js";
@@ -93,7 +93,7 @@ import {
 } from "./chunk-3RXUYQJI.js";
 import {
   registerCleanup
-} from "./chunk-LSYVASZS.js";
+} from "./chunk-RHTTKJTP.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";