@qwen-code/qwen-code 0.22.0-nightly.20260825.22bb5e8b9f → 0.22.1

package/chunks/{chunk-UFWRXRQ5.js → chunk-XYX474JQ.js}

@@ -40,7 +40,7 @@ import {
   CronScheduler,
   DEFAULT_RECURRING_MAX_AGE_DAYS,
   normalizeRecurringMaxAge
-} from "./chunk-J54EA46E.js";
+} from "./chunk-3UZCLCXR.js";
 import {
   consumeUnread,
   forwardApproval,
@@ -49,13 +49,13 @@ import {
   sendStructuredMessage,
   wrapConfirmWithBadge,
   writeMessage
-} from "./chunk-PQ4RTSTH.js";
+} from "./chunk-TOF4UZHH.js";
 import {
   claimTask,
   listTasks,
   onTasksUpdated,
   unassignTeammateTasks
-} from "./chunk-3E53DKST.js";
+} from "./chunk-O3BUXIPM.js";
 import {
   assignTeammateColor,
   classifyShutdownResponse,
@@ -68,7 +68,7 @@ import {
   readProcStartToken,
   sanitizeName,
   writeTeamFile
-} from "./chunk-DV3KOUUU.js";
+} from "./chunk-ZLTEQYNC.js";
 import {
   parsePositiveIntegerEnv
 } from "./chunk-6PVPNMXU.js";
@@ -78,7 +78,7 @@ import {
   buildRuntimeSnapshotId,
   resolveModelId,
   stripRuntimeSnapshotPrefix
-} from "./chunk-R7Q5V3A5.js";
+} from "./chunk-AYVIGUUK.js";
 import {
   promptIdContext,
   todoWorkChainContext
@@ -93,7 +93,7 @@ import {
   worktreeBranchForSlug,
   writeRuntimeStatus,
   writeWorktreeSessionMarker
-} from "./chunk-FLTGTSLG.js";
+} from "./chunk-LJP2BBMK.js";
 import {
   LEADER_NAME,
   MAX_TEAMMATES
@@ -117,7 +117,7 @@ import {
   require_dist as require_dist2,
   stringify,
   validateSkillName
-} from "./chunk-NA6AZRDQ.js";
+} from "./chunk-5Y2JCJAH.js";
 import {
   DefaultHookOutput,
   HOOKS_CONFIG_FIELDS,
@@ -132,11 +132,11 @@ import {
   createHookOutput,
   getHookKey,
   isToolArtifactLike
-} from "./chunk-ZB7VDPZB.js";
+} from "./chunk-T2CRBIDJ.js";
 import {
   canUseRipgrep,
   resolveBundleDir
-} from "./chunk-CGWPQ6IM.js";
+} from "./chunk-77TOMRBG.js";
 import {
   findGitRoot,
   getCachedGitBranch,
@@ -146,7 +146,7 @@ import {
   globSync,
   isGitRepository,
   readFirstLineNoFollow
-} from "./chunk-RSWDOHXS.js";
+} from "./chunk-DEYPMJPD.js";
 import {
   SHELL_SELF_KILL_REJECTION,
   buildShellExecWarnings,
@@ -165,15 +165,15 @@ import {
   shouldDefaultToNodePty,
   splitCommands,
   stripShellWrapper
-} from "./chunk-5X33EPHJ.js";
+} from "./chunk-T6OODF2U.js";
 import {
   BaseTokenStorage,
   KeychainTokenStorage
-} from "./chunk-CPZQJP6J.js";
+} from "./chunk-27ONXAFY.js";
 import {
   normalizeImageGenerationBaseUrl,
   resolveNetworkTarget
-} from "./chunk-UY2JOZK7.js";
+} from "./chunk-ZEADBZLO.js";
 import {
   EvidenceSourceUnavailableError,
   GoalEvidenceCheckpointAccumulator,
@@ -198,7 +198,7 @@ import {
   validateTranscriptRecord,
   walkTranscriptUuidChain,
   wrapUserPromptSubmitContext
-} from "./chunk-WANR3VVK.js";
+} from "./chunk-FN5C6C7G.js";
 import {
   APPROVAL_MODES,
   READ_ONLY_INSPECTION_TOOLS,
@@ -214,7 +214,7 @@ import {
   isPlanRequiredTeammatePreApprovalAllowedTool,
   isSubagentLikeExecutionContext,
   shouldUsePlanOnlyReminderInSubagentContext
-} from "./chunk-3KV5KXKU.js";
+} from "./chunk-BVE5EMIG.js";
 import {
   require_proper_lockfile
 } from "./chunk-MLXTMF7H.js";
@@ -225,7 +225,7 @@ import {
 import {
   isUnattendedMode,
   retryWithBackoff
-} from "./chunk-AHQBSQYT.js";
+} from "./chunk-V3GINY6K.js";
 import {
   isRetryableStreamTransportError
 } from "./chunk-QHMLYMMS.js";
@@ -237,17 +237,17 @@ import {
   addToolArgumentsAttributes,
   addToolCallResultAttributes,
   addUserPromptAttributes
-} from "./chunk-JS55F2GJ.js";
+} from "./chunk-SDVF6A42.js";
 import {
   addDaemonRequestAttribute
-} from "./chunk-O5ONGZGZ.js";
+} from "./chunk-ILPXSKGQ.js";
 import {
   supportsOpenAIPrefixCaching
 } from "./chunk-SAH4BD2J.js";
 import {
   DashScopeOpenAICompatibleProvider,
   selectDashScopeThinkingKnob
-} from "./chunk-CZIF7I53.js";
+} from "./chunk-ZKAZP2ZG.js";
 import {
   childLaunchDepth,
   getCurrentAgentDepth,
@@ -258,7 +258,7 @@ import {
   runWithAgentContext,
   runWithRuntimeContentGenerator,
   spawnBlockReason
-} from "./chunk-OWE7TE3F.js";
+} from "./chunk-DP7LABIB.js";
 import {
   getTeammateContext,
   isTeammate,
@@ -275,7 +275,7 @@ import {
 import {
   classifyRetryError,
   isFallbackEligible
-} from "./chunk-BOQRZ443.js";
+} from "./chunk-I6VVOZDK.js";
 import {
   getThoughtSummary
 } from "./chunk-K2OJUPOE.js";
@@ -293,7 +293,7 @@ import {
   isQuotaExhaustedError,
   isRateLimitError,
   isStructuredError
-} from "./chunk-27HAGBZG.js";
+} from "./chunk-EB4VDXNI.js";
 import {
   ApiRetryEvent,
   COMBINED_PASS_TOLERANCE_FACTOR,
@@ -383,7 +383,7 @@ import {
   updateMCPServerStatus,
   writeLine,
   writeLineSync
-} from "./chunk-EUZE3GSL.js";
+} from "./chunk-UX3IFLJM.js";
 import {
   defaultModalities,
   isTieredEffortWireModel
@@ -403,7 +403,7 @@ import {
   readTextCursorWindowFromHandle,
   readTextRangeFromHandle,
   setGeminiMdFilename
-} from "./chunk-QKGJIP2H.js";
+} from "./chunk-WBT3STGU.js";
 import {
   AUTO_MEMORY_INDEX_FILENAME,
   AUTO_MEMORY_PINNED_DIRNAME,
@@ -423,10 +423,10 @@ import {
   isManagedMemoryPath,
   isTeamAutoMemPath,
   isUserAutoMemPath
-} from "./chunk-MTKBZIXU.js";
+} from "./chunk-PVBT5QPD.js";
 import {
   runSideQuery
-} from "./chunk-QQQSUCC4.js";
+} from "./chunk-IPQA4SR5.js";
 import {
   normalizeMcpToolName,
   sanitizeToolNameForProvider
@@ -451,7 +451,7 @@ import {
   createContentGenerator,
   resetPreloadedContentGenerator,
   resolveContentGeneratorConfigWithSources
-} from "./chunk-O6CS7VRT.js";
+} from "./chunk-ICWGPK23.js";
 import {
   DEFAULT_QWEN_MODEL
 } from "./chunk-XZA32HII.js";
@@ -460,7 +460,7 @@ import {
   atomicWriteFileSync,
   atomicWriteJSON,
   renameWithRetry
-} from "./chunk-UEY5WCRB.js";
+} from "./chunk-7QGEJI7M.js";
 import {
   AuthType,
   getOrCreateMcpDispatcher,
@@ -468,7 +468,7 @@ import {
   preloadRuntimeFetchModule,
   redactProxyError,
   setResolvedProxyUrlForRuntimeFetch
-} from "./chunk-FNZ42WN7.js";
+} from "./chunk-GTUKW3I6.js";
 import {
   safeJsonStringify
 } from "./chunk-HHJLM3WQ.js";
@@ -518,10 +518,10 @@ import {
   startToolSpan,
   stripAnsiAndControl,
   truncateSpanError
-} from "./chunk-ZJWFRMCY.js";
+} from "./chunk-6US7BF3G.js";
 import {
   STRUCTURED_OUTPUT_REDACTED_ARGS
-} from "./chunk-DD5XZICM.js";
+} from "./chunk-VL4YX3FH.js";
 import {
   BUBBLE_APPROVAL_MODE,
   FORK_AGENT,
@@ -554,11 +554,11 @@ import {
   selectForkHistory,
   stripSystemReminderBlocks,
   validateForkToolList
-} from "./chunk-COT2IXPM.js";
+} from "./chunk-JUIJ3FXC.js";
 import {
   collectAvailableSkillEntries,
   renderAvailableSkillsBlock
-} from "./chunk-K623ENWT.js";
+} from "./chunk-E6FGMDFQ.js";
 import {
   escapeSystemReminderTags,
   escapeXml
@@ -570,7 +570,7 @@ import {
   formatQwenIgnoreFileNames,
   isPathWithinRoot,
   require_ignore
-} from "./chunk-SJLW5XGQ.js";
+} from "./chunk-RRKNX553.js";
 import {
   AgentStatistics,
   BaseDeclarativeTool,
@@ -587,7 +587,7 @@ import {
   require_dist,
   require_fast_deep_equal,
   require_fast_uri
-} from "./chunk-3LUGIYS3.js";
+} from "./chunk-KOJ6MHD5.js";
 import {
   FatalConfigError,
   PATH_ARG_KEYS,
@@ -623,7 +623,7 @@ import {
   unescapePath,
   unregisterSessionModel,
   unregisterSessionProjectDir
-} from "./chunk-VLEGGCEA.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   require_src
 } from "./chunk-AMDSOFFV.js";
@@ -22158,6 +22158,58 @@ function compactTodoResultDisplay(display, purpose) {
   };
 }
 __name(compactTodoResultDisplay, "compactTodoResultDisplay");
+function isFindingsResultDisplay(resultDisplay) {
+  return typeof resultDisplay === "object" && resultDisplay !== null && "type" in resultDisplay && resultDisplay.type === "findings_list";
+}
+__name(isFindingsResultDisplay, "isFindingsResultDisplay");
+function findingRetainedSize(finding) {
+  return (finding.id?.length ?? 0) + finding.severity.length + (finding.confidence?.length ?? 0) + (finding.source?.length ?? 0) + finding.file.length + String(finding.line ?? "").length + finding.summary.length + finding.shortSummary.length + finding.failureScenario.length + (finding.category?.length ?? 0) + (finding.outcome?.length ?? 0) + (finding.outcomeNote?.length ?? 0) + 20;
+}
+__name(findingRetainedSize, "findingRetainedSize");
+function compactFindingsResultDisplay(display, purpose) {
+  const compacted = {
+    ...display,
+    findings: display.findings.map((finding) => ({
+      ...finding,
+      summary: compactString(
+        finding.summary,
+        purpose,
+        MAX_RETAINED_AGENT_FIELD_CHARS
+      ),
+      failureScenario: compactString(
+        finding.failureScenario,
+        purpose,
+        MAX_RETAINED_AGENT_FIELD_CHARS
+      ),
+      ...finding.outcomeNote !== void 0 && {
+        outcomeNote: compactString(
+          finding.outcomeNote,
+          purpose,
+          MAX_RETAINED_AGENT_FIELD_CHARS
+        )
+      }
+    }))
+  };
+  let total = 0;
+  let kept = 0;
+  for (const finding of compacted.findings) {
+    const size = findingRetainedSize(finding);
+    if (total + size > MAX_RETAINED_TOOL_RESULT_DISPLAY_CHARS) {
+      break;
+    }
+    total += size;
+    kept += 1;
+  }
+  if (kept === compacted.findings.length) {
+    return compacted;
+  }
+  return {
+    ...compacted,
+    findings: compacted.findings.slice(0, kept),
+    omittedFindings: compacted.findings.length - kept
+  };
+}
+__name(compactFindingsResultDisplay, "compactFindingsResultDisplay");
 function isPlanResultDisplay(resultDisplay) {
   return typeof resultDisplay === "object" && resultDisplay !== null && "type" in resultDisplay && resultDisplay.type === "plan_summary";
 }
@@ -22271,6 +22323,9 @@ function compactToolResultDisplay(resultDisplay, purpose) {
   if (isTodoResultDisplay(resultDisplay)) {
     return compactTodoResultDisplay(resultDisplay, purpose);
   }
+  if (isFindingsResultDisplay(resultDisplay)) {
+    return compactFindingsResultDisplay(resultDisplay, purpose);
+  }
   if (isPlanResultDisplay(resultDisplay)) {
     return compactPlanResultDisplay(resultDisplay, purpose);
   }
@@ -22475,17 +22530,17 @@ function summarizeTranscript(records) {
   };
 }
 __name(summarizeTranscript, "summarizeTranscript");
-async function persistUsageBeforeTranscriptDeletion(transcriptPath) {
+async function prepareUsageBeforeTranscriptDeletion(transcriptPath) {
   try {
     const records = await read(transcriptPath);
     const summarized = summarizeTranscript(records);
-    if (!summarized?.record) return false;
+    if (!summarized?.record) return null;
     const usagePath = getUsageHistoryPath();
     try {
       if (fs5.existsSync(usagePath)) {
         const existing = await read(usagePath);
         if (existing.some((r) => r?.sessionId === summarized.sessionId)) {
-          return false;
+          return null;
         }
       }
     } catch (e) {
@@ -22493,14 +22548,33 @@ async function persistUsageBeforeTranscriptDeletion(transcriptPath) {
         `persistUsageBeforeTranscriptDeletion: cannot read history: ${e}`
       );
     }
-    writeLineSync(usagePath, summarized.record);
+    return { usagePath, record: summarized.record };
+  } catch (e) {
+    debugLogger11.debug(`prepareUsageBeforeTranscriptDeletion: ${e}`);
+    return null;
+  }
+}
+__name(prepareUsageBeforeTranscriptDeletion, "prepareUsageBeforeTranscriptDeletion");
+function commitUsageBeforeTranscriptDeletion(prepared) {
+  try {
+    if (fs5.existsSync(prepared.usagePath)) {
+      const alreadyPersisted = fs5.readFileSync(prepared.usagePath, "utf8").split(/\r?\n/).some((line) => {
+        const trimmed = line.trim();
+        return trimmed.length > 0 && parseLineTolerant(
+          trimmed,
+          prepared.usagePath
+        ).some((record4) => record4.sessionId === prepared.record.sessionId);
+      });
+      if (alreadyPersisted) return false;
+    }
+    writeLineSync(prepared.usagePath, prepared.record);
     return true;
   } catch (e) {
-    debugLogger11.debug(`persistUsageBeforeTranscriptDeletion: ${e}`);
+    debugLogger11.debug(`commitUsageBeforeTranscriptDeletion: ${e}`);
     return false;
   }
 }
-__name(persistUsageBeforeTranscriptDeletion, "persistUsageBeforeTranscriptDeletion");
+__name(commitUsageBeforeTranscriptDeletion, "commitUsageBeforeTranscriptDeletion");
 async function rebuildFromSessionJsonl(options2 = {}) {
   const {
     skipSessionInRebuild,
@@ -26844,17 +26918,17 @@ var SessionOrganizationService = class {
       return viewOrganization(store2.sessions[sessionId]);
     });
   }
-  async removeSession(sessionId) {
+  async removeSession(sessionId, options2 = {}) {
     await this.withStoreLock(async () => {
       const store2 = await this.readStore();
       if (!Object.prototype.hasOwnProperty.call(store2.sessions, sessionId)) {
         return;
       }
       delete store2.sessions[sessionId];
-      await this.writeStore(store2);
+      await this.writeStore(store2, options2);
     });
   }
-  async removeSessions(sessionIds) {
+  async removeSessions(sessionIds, options2 = {}) {
     const uniqueSessionIds = [...new Set(sessionIds)];
     if (uniqueSessionIds.length === 0) return;
     await this.withStoreLock(async () => {
@@ -26867,7 +26941,7 @@ var SessionOrganizationService = class {
         }
       }
       if (changed) {
-        await this.writeStore(store2);
+        await this.writeStore(store2, options2);
       }
     });
   }
@@ -26945,7 +27019,7 @@ var SessionOrganizationService = class {
     );
     return emptyStore();
   }
-  async writeStore(store2) {
+  async writeStore(store2, options2 = {}) {
     await fs7.mkdir(path7.dirname(this.getStorePath()), { recursive: true });
     if (this.readFailed) {
       throw new SessionOrganizationError(
@@ -26953,11 +27027,15 @@ var SessionOrganizationService = class {
         "session_organization_store_unreadable"
       );
     }
-    await atomicWriteJSON(this.getStorePath(), {
-      schemaVersion: SCHEMA_VERSION,
-      groups: this.sortGroups(store2.groups),
-      sessions: store2.sessions
-    });
+    await atomicWriteJSON(
+      this.getStorePath(),
+      {
+        schemaVersion: SCHEMA_VERSION,
+        groups: this.sortGroups(store2.groups),
+        sessions: store2.sessions
+      },
+      { assertCanCommit: options2.assertCanCommit }
+    );
     this.readFailed = false;
   }
   assertGroupNameAvailable(groups, name, exceptGroupId) {
@@ -27108,9 +27186,9 @@ async function readSessionPrs(filePath, options2 = {}) {
   return parsed.prs;
 }
 __name(readSessionPrs, "readSessionPrs");
-async function writeSessionPrs(filePath, prs) {
+async function writeSessionPrs(filePath, prs, options2 = {}) {
   await fs8.mkdir(path8.dirname(filePath), { recursive: true });
-  await atomicWriteJSON(filePath, { prs });
+  await atomicWriteJSON(filePath, { prs }, options2);
 }
 __name(writeSessionPrs, "writeSessionPrs");
 function mergeSessionPrLists(base, incoming) {
@@ -31534,6 +31612,20 @@ var BranchPointInvalidError = class extends Error {
     __name(this, "BranchPointInvalidError");
   }
 };
+var MAX_MAINTAINABLE_FIRST_RECORD_BYTES = 1024 * 1024;
+var SessionStorageEntryError = class extends Error {
+  constructor(sessionId, reason) {
+    super(
+      reason === "non_regular" ? `Session storage entry for "${sessionId}" is not a regular file.` : reason === "foreign_project" ? `Session "${sessionId}" belongs to a different workspace.` : `Session "${sessionId}" does not have unambiguous workspace ownership.`
+    );
+    this.sessionId = sessionId;
+    this.reason = reason;
+  }
+  static {
+    __name(this, "SessionStorageEntryError");
+  }
+  name = "SessionStorageEntryError";
+};
 var SessionIdCaseConflictError = class extends Error {
   // `candidateSessionId` is set only when one exact spelling was found
   // persisted in both active and archived states, so callers can re-check
@@ -31725,6 +31817,17 @@ var SessionService = class {
       ...options2
     });
   }
+  async acquireSessionMaintenanceLease(sessionId, options2) {
+    if (!SESSION_FILE_PATTERN.test(`${sessionId}.jsonl`)) {
+      throw new SessionWriterUnavailableError();
+    }
+    return SessionWriterLease.acquire({
+      runtimeBaseDir: this.storage.getRuntimeBaseDir(),
+      sessionId,
+      transcriptPath: `${this.getSessionFilePath(sessionId, "active")}.maintenance`,
+      ...options2
+    });
+  }
   warn(message) {
     debugLogger15.warn(message);
     this.onWarning?.(message);
@@ -31822,7 +31925,7 @@ var SessionService = class {
         return void 0;
       }
       const firstRecord = records[0];
-      if (!await this.sessionBelongsToCurrentProject(sessionId, firstRecord.cwd)) {
+      if (typeof firstRecord.sessionId !== "string" || typeof firstRecord.cwd !== "string" || firstRecord.sessionId.toLowerCase() !== sessionId.toLowerCase() || !await this.sessionBelongsToCurrentProject(sessionId, firstRecord.cwd)) {
         return void 0;
       }
       return firstRecord;
@@ -31910,6 +32013,207 @@ var SessionService = class {
     if (archived) return "archived";
     return void 0;
   }
+  /**
+   * Classifies exact-spelling transcript files for lifecycle maintenance.
+   * Unlike {@link getSessionLocation}, empty or damaged regular files still
+   * occupy their state. A readable head that explicitly belongs to another
+   * workspace remains unavailable to this service.
+   */
+  async getMaintainableSessionLocation(sessionId) {
+    try {
+      return (await this.resolveMaintainableSessionSnapshot(sessionId, false)).location;
+    } catch (error3) {
+      if (error3 instanceof SessionStorageEntryError && error3.reason === "foreign_project") {
+        return void 0;
+      }
+      throw error3;
+    }
+  }
+  async resolveMaintainableSessionSnapshot(sessionId, captureIdentity = true) {
+    if (!SESSION_FILE_PATTERN.test(`${sessionId}.jsonl`)) {
+      return { location: void 0, identities: [] };
+    }
+    const identities = [];
+    let hasForeignState = false;
+    for (const state of ["active", "archived"]) {
+      try {
+        const identity = await this.readMaintainableSessionIdentity(
+          sessionId,
+          state,
+          captureIdentity
+        );
+        if (identity) identities.push(identity);
+      } catch (error3) {
+        if (error3 instanceof SessionStorageEntryError && error3.reason === "foreign_project") {
+          hasForeignState = true;
+          continue;
+        }
+        throw error3;
+      }
+    }
+    if (hasForeignState) {
+      if (identities.length === 0) {
+        throw new SessionStorageEntryError(sessionId, "foreign_project");
+      }
+      throw new SessionStorageEntryError(sessionId, "ambiguous_project");
+    }
+    const active = identities.some((identity) => identity.state === "active");
+    const archived = identities.some(
+      (identity) => identity.state === "archived"
+    );
+    return {
+      location: active && archived ? "conflict" : active ? "active" : archived ? "archived" : void 0,
+      identities
+    };
+  }
+  async readMaintainableSessionIdentity(sessionId, state, captureIdentity) {
+    const filePath = this.getSessionFilePath(sessionId, state);
+    let fileHandle;
+    try {
+      fileHandle = await fs11.promises.open(
+        filePath,
+        fs11.constants.O_RDONLY | (process.platform === "win32" ? 0 : (fs11.constants.O_NOFOLLOW ?? 0) | (fs11.constants.O_NONBLOCK ?? 0))
+      );
+    } catch (error3) {
+      const code = error3.code;
+      if (code === "ENOENT") return void 0;
+      if (code === "ELOOP") {
+        throw new SessionStorageEntryError(sessionId, "non_regular");
+      }
+      throw error3;
+    }
+    try {
+      const opened = this.maintainableSessionIdentity(
+        sessionId,
+        state,
+        filePath,
+        await fileHandle.stat()
+      );
+      const firstRecord = await this.readFirstMaintainableRecord(
+        fileHandle,
+        filePath
+      );
+      if (firstRecord) {
+        if (typeof firstRecord.sessionId !== "string" || typeof firstRecord.cwd !== "string") {
+          throw new SessionStorageEntryError(sessionId, "unknown_project");
+        }
+        if (firstRecord.sessionId.toLowerCase() !== sessionId.toLowerCase()) {
+          throw new SessionStorageEntryError(sessionId, "foreign_project");
+        }
+        if (!await this.sessionBelongsToCurrentProject(
+          firstRecord.sessionId,
+          firstRecord.cwd
+        )) {
+          throw new SessionStorageEntryError(sessionId, "foreign_project");
+        }
+      }
+      const current = this.maintainableSessionIdentity(
+        sessionId,
+        state,
+        filePath,
+        await fs11.promises.lstat(filePath)
+      );
+      const stillOpened = this.maintainableSessionIdentity(
+        sessionId,
+        state,
+        filePath,
+        await fileHandle.stat()
+      );
+      if (!this.sameMaintainableSessionIdentity(opened, current) || !this.sameMaintainableSessionIdentity(opened, stillOpened)) {
+        throw new SessionTranscriptChangedError();
+      }
+      return captureIdentity ? current : opened;
+    } finally {
+      await fileHandle.close();
+    }
+  }
+  async readFirstMaintainableRecord(fileHandle, filePath) {
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const decoder = new TextDecoder();
+    let pending = "";
+    while (true) {
+      const { bytesRead } = await fileHandle.read(buffer);
+      pending += decoder.decode(buffer.subarray(0, bytesRead), {
+        stream: bytesRead > 0
+      });
+      let newline2 = pending.indexOf("\n");
+      const firstLineLength = newline2 >= 0 ? newline2 : pending.length;
+      if (firstLineLength > MAX_MAINTAINABLE_FIRST_RECORD_BYTES && newline2 < 0) {
+        const prefix = pending.trimStart();
+        if (!prefix || prefix.startsWith("{")) {
+          throw new SessionTranscriptIdentityUnavailableError();
+        }
+        return void 0;
+      }
+      while (newline2 >= 0) {
+        const line = pending.slice(0, newline2).trim();
+        pending = pending.slice(newline2 + 1);
+        if (line) {
+          const record4 = parseLineTolerant(
+            line,
+            filePath
+          )[0];
+          if (record4) return record4;
+        }
+        newline2 = pending.indexOf("\n");
+      }
+      if (bytesRead === 0) {
+        if (!pending.trim()) return void 0;
+        return parseLineTolerant(
+          pending.trim(),
+          filePath
+        )[0];
+      }
+    }
+  }
+  maintainableSessionIdentity(sessionId, state, filePath, stats) {
+    if (!stats.isFile()) {
+      throw new SessionStorageEntryError(sessionId, "non_regular");
+    }
+    if (!hasVerifiableInode(stats.ino)) {
+      throw new SessionTranscriptIdentityUnavailableError();
+    }
+    return {
+      state,
+      filePath,
+      dev: stats.dev,
+      ino: stats.ino,
+      size: stats.size,
+      mtimeMs: stats.mtimeMs,
+      ctimeMs: stats.ctimeMs
+    };
+  }
+  sameMaintainableSessionIdentity(expected, actual) {
+    return expected.state === actual.state && expected.filePath === actual.filePath && expected.dev === actual.dev && expected.ino === actual.ino && expected.size === actual.size && expected.mtimeMs === actual.mtimeMs && expected.ctimeMs === actual.ctimeMs;
+  }
+  assertMaintainableSessionUnchanged(sessionId, snapshot) {
+    for (const state of ["active", "archived"]) {
+      const expected = snapshot.identities.find(
+        (identity) => identity.state === state
+      );
+      const filePath = this.getSessionFilePath(sessionId, state);
+      let stats;
+      try {
+        stats = fs11.lstatSync(filePath);
+      } catch (error3) {
+        if (error3.code === "ENOENT") {
+          if (!expected) continue;
+          throw new SessionTranscriptChangedError();
+        }
+        throw error3;
+      }
+      if (!expected) throw new SessionTranscriptChangedError();
+      const actual = this.maintainableSessionIdentity(
+        sessionId,
+        state,
+        filePath,
+        stats
+      );
+      if (!this.sameMaintainableSessionIdentity(expected, actual)) {
+        throw new SessionTranscriptChangedError();
+      }
+    }
+  }
   /**
    * Finds a persisted session whose UUID filename differs only by case.
    * Legacy CLI sessions may have been written with `uuidgen`'s uppercase
@@ -32042,12 +32346,23 @@ var SessionService = class {
       { recursive: true, force: true }
     );
   }
-  async removeSessionOrganization(sessionId) {
+  async removeSessionOrganization(sessionId, assertCanMutate) {
     try {
-      await new SessionOrganizationService(this.projectRoot, (message) => {
-        this.warn(message);
-      }).removeSession(sessionId);
+      const service = new SessionOrganizationService(
+        this.projectRoot,
+        (message) => {
+          this.warn(message);
+        }
+      );
+      if (assertCanMutate) {
+        await service.removeSession(sessionId, {
+          assertCanCommit: assertCanMutate
+        });
+      } else {
+        await service.removeSession(sessionId);
+      }
     } catch (error3) {
+      assertCanMutate?.();
       this.warn(
         `removeSession: failed to clear session organization for ${sessionId}: ${error3}`
       );
@@ -32113,12 +32428,13 @@ ${payload}`, "utf8");
    * no transition would ever reunite them otherwise. Throws propagate to
    * the caller, which owns the warn-only policy.
    */
-  async movePrSidecar(sourcePath, destinationPath) {
+  async movePrSidecar(sourcePath, destinationPath, assertCanMutate) {
     if (!fs11.existsSync(sourcePath)) {
       return;
     }
     fs11.mkdirSync(path11.dirname(destinationPath), { recursive: true });
     if (!fs11.existsSync(destinationPath)) {
+      assertCanMutate?.();
       fs11.renameSync(sourcePath, destinationPath);
       return;
     }
@@ -32127,8 +32443,15 @@ ${payload}`, "utf8");
       await readSessionPrs(sourcePath) ?? []
     );
     if (merged.length > 0) {
-      await writeSessionPrs(destinationPath, merged);
+      if (assertCanMutate) {
+        await writeSessionPrs(destinationPath, merged, {
+          assertCanCommit: assertCanMutate
+        });
+      } else {
+        await writeSessionPrs(destinationPath, merged);
+      }
     }
+    assertCanMutate?.();
     fs11.unlinkSync(sourcePath);
   }
   sessionFileMoveError(action, error3) {
@@ -32714,65 +33037,77 @@ ${payload}`, "utf8");
    * @param sessionId The session ID to remove
    * @returns true if removed, false if not found
    */
-  async removeSession(sessionId) {
-    const removed = await this.removeSessionFiles(sessionId);
+  async removeSession(sessionId, options2 = {}) {
+    const removed = await this.removeSessionFiles(sessionId, options2);
     if (removed) {
-      await this.removeSessionOrganization(sessionId);
+      await this.removeSessionOrganization(sessionId, options2.assertCanMutate);
     }
     return removed;
   }
   /**
    * Usage salvage wrapper enforcing the "never blocks deletion" contract at
-   * the call site: persistUsageBeforeTranscriptDeletion catches its own
-   * errors, but this second layer keeps the guarantee structural rather
-   * than an implementation detail of another module.
+   * the call site. Preparation is read-only so rejected lifecycle mutations
+   * cannot pin an incomplete usage summary; commit happens only after every
+   * mutation fence passes.
    */
-  async salvageUsageBestEffort(transcriptPath) {
+  async prepareUsageSalvageBestEffort(transcriptPath) {
     try {
-      await persistUsageBeforeTranscriptDeletion(transcriptPath);
+      return await prepareUsageBeforeTranscriptDeletion(transcriptPath);
     } catch (error3) {
       this.warn(
         `usage salvage failed for ${transcriptPath}: ${error3}; deleting anyway`
       );
+      return null;
     }
   }
-  async removeSessionFiles(sessionId) {
+  commitUsageSalvageBestEffort(prepared) {
+    if (!prepared) return;
+    try {
+      commitUsageBeforeTranscriptDeletion(prepared);
+    } catch (error3) {
+      this.warn(`usage salvage commit failed: ${error3}; deleting anyway`);
+    }
+  }
+  async removeSessionFiles(sessionId, options2 = {}) {
     if (!SESSION_FILE_PATTERN.test(`${sessionId}.jsonl`)) {
       return false;
     }
     try {
-      const activePath = this.getSessionFilePath(sessionId, "active");
-      const active = await this.readProjectSessionHead(sessionId, activePath);
-      if (active) {
-        await this.salvageUsageBestEffort(activePath);
-        this.removeFileIfExists(activePath);
-        const archivedPath2 = this.getSessionFilePath(sessionId, "archived");
-        if (fs11.existsSync(archivedPath2)) {
-          await this.salvageUsageBestEffort(archivedPath2);
-          this.removeFileIfExists(archivedPath2);
-        }
-        this.removeWorktreeSidecars(sessionId);
-        this.removePrSidecars(sessionId);
-        this.removePromptLedgers(sessionId);
-        this.removeFileHistoryBackups(sessionId);
-        return true;
+      const physicalSnapshot = await this.resolveMaintainableSessionSnapshot(sessionId);
+      if (physicalSnapshot.location === void 0) return false;
+      const preparedUsage = /* @__PURE__ */ new Map();
+      const preparedSessionIds = /* @__PURE__ */ new Set();
+      for (const identity of physicalSnapshot.identities) {
+        const prepared = await this.prepareUsageSalvageBestEffort(
+          identity.filePath
+        );
+        if (prepared && !preparedSessionIds.has(prepared.record.sessionId)) {
+          preparedUsage.set(identity.filePath, prepared);
+          preparedSessionIds.add(prepared.record.sessionId);
+        }
       }
-      const archivedPath = this.getSessionFilePath(sessionId, "archived");
-      const archived = await this.readProjectSessionHead(
-        sessionId,
-        archivedPath
-      );
-      if (!archived) {
-        return false;
+      await options2.assertStorageUnchanged?.();
+      options2.assertCanMutate?.();
+      this.assertMaintainableSessionUnchanged(sessionId, physicalSnapshot);
+      for (const identity of physicalSnapshot.identities) {
+        this.removeFileIfExists(identity.filePath);
+        this.commitUsageSalvageBestEffort(
+          preparedUsage.get(identity.filePath) ?? null
+        );
       }
-      await this.salvageUsageBestEffort(archivedPath);
-      this.removeFileIfExists(archivedPath);
+      options2.assertCanMutate?.();
       this.removeWorktreeSidecars(sessionId);
+      options2.assertCanMutate?.();
       this.removePrSidecars(sessionId);
+      options2.assertCanMutate?.();
       this.removePromptLedgers(sessionId);
+      options2.assertCanMutate?.();
       this.removeFileHistoryBackups(sessionId);
       return true;
     } catch (error3) {
+      if (error3 instanceof SessionStorageEntryError && error3.reason === "foreign_project") {
+        return false;
+      }
       if (error3.code === "ENOENT") {
         return false;
       }
@@ -32782,6 +33117,7 @@ ${payload}`, "utf8");
   async archiveSessions(sessionIds, options2 = {}) {
     const archived = [];
     const alreadyArchived = [];
+    const resolvedConflicts = [];
     const notFound = [];
     const errors = [];
     for (const sessionId of [...new Set(sessionIds)]) {
@@ -32790,25 +33126,54 @@ ${payload}`, "utf8");
           notFound.push(sessionId);
           continue;
         }
-        if (options2.knownLocation !== "active") {
-          const location = await this.getSessionLocation(sessionId);
-          if (location === void 0) {
-            notFound.push(sessionId);
-            continue;
-          }
-          if (location === "archived") {
-            alreadyArchived.push(sessionId);
-            continue;
-          }
-          if (location === "conflict") {
+        const snapshot = await this.resolveMaintainableSessionSnapshot(sessionId);
+        const location = snapshot.location;
+        if (location === void 0) {
+          notFound.push(sessionId);
+          continue;
+        }
+        if (location === "archived") {
+          alreadyArchived.push(sessionId);
+          continue;
+        }
+        if (location === "conflict") {
+          if (!options2.resolveConflicts) {
             throw new Error(`Session archive conflict: ${sessionId}`);
           }
+          const active = snapshot.identities.find(
+            (identity) => identity.state === "active"
+          );
+          await options2.assertStorageUnchanged?.();
+          options2.assertCanMutate?.();
+          this.assertMaintainableSessionUnchanged(sessionId, snapshot);
+          this.removeFileIfExists(active.filePath);
+          try {
+            options2.assertCanMutate?.();
+            await this.movePrSidecar(
+              this.getPrSessionPathForState(sessionId, "active"),
+              this.getPrSessionPathForState(sessionId, "archived"),
+              options2.assertCanMutate
+            );
+          } catch (sidecarError) {
+            options2.assertCanMutate?.();
+            this.warn(
+              `archiveSessions: failed to merge active pr sidecar for ${sessionId}: ${sidecarError}`
+            );
+          }
+          options2.assertCanMutate?.();
+          this.removeFileIfExists(
+            this.getWorktreeSessionPathForState(sessionId, "active")
+          );
+          options2.assertCanMutate?.();
+          this.removeFileIfExists(
+            this.getPromptLedgerPathForState(sessionId, "active")
+          );
+          archived.push(sessionId);
+          resolvedConflicts.push(sessionId);
+          continue;
         }
         const sourcePath = this.getSessionFilePath(sessionId, "active");
         const targetPath = this.getSessionFilePath(sessionId, "archived");
-        if (fs11.existsSync(targetPath)) {
-          throw new Error(`Session archive conflict: ${sessionId}`);
-        }
         fs11.mkdirSync(this.getArchiveChatsDir(), { recursive: true });
         const activeSidecar = this.getWorktreeSessionPathForState(
           sessionId,
@@ -32826,11 +33191,15 @@ ${payload}`, "utf8");
           sessionId,
           "archived"
         );
+        await options2.assertStorageUnchanged?.();
+        options2.assertCanMutate?.();
+        this.assertMaintainableSessionUnchanged(sessionId, snapshot);
         try {
           fs11.renameSync(sourcePath, targetPath);
         } catch (error3) {
           throw this.sessionFileMoveError("archive", error3);
         }
+        options2.assertCanMutate?.();
         try {
           this.moveOptionalFile(activeSidecar, archivedSidecar);
         } catch (sidecarError) {
@@ -32841,56 +33210,100 @@ ${payload}`, "utf8");
         try {
           await this.movePrSidecar(
             this.getPrSessionPathForState(sessionId, "active"),
-            this.getPrSessionPathForState(sessionId, "archived")
+            this.getPrSessionPathForState(sessionId, "archived"),
+            options2.assertCanMutate
           );
         } catch (sidecarError) {
+          options2.assertCanMutate?.();
           this.warn(
             `archiveSessions: failed to move pr sidecar for ${sessionId}: ${sidecarError}`
           );
         }
         try {
+          options2.assertCanMutate?.();
           this.moveLedgerSidecar(activeLedger, archivedLedger);
         } catch (ledgerError) {
+          options2.assertCanMutate?.();
           this.warn(
             `archiveSessions: failed to move prompt ledger for ${sessionId} from ${activeLedger} to ${archivedLedger}: ${ledgerError}`
           );
         }
         archived.push(sessionId);
       } catch (error3) {
+        if (error3 instanceof SessionStorageEntryError && error3.reason === "foreign_project") {
+          notFound.push(sessionId);
+          continue;
+        }
         errors.push({
           sessionId,
           error: error3 instanceof Error ? error3 : new Error(String(error3))
         });
       }
     }
-    return { archived, alreadyArchived, notFound, errors };
+    return {
+      archived,
+      alreadyArchived,
+      resolvedConflicts,
+      notFound,
+      errors
+    };
   }
   async unarchiveSessions(sessionIds, options2 = {}) {
     const unarchived = [];
     const alreadyActive = [];
+    const resolvedConflicts = [];
     const notFound = [];
     const errors = [];
     for (const sessionId of [...new Set(sessionIds)]) {
       try {
-        if (options2.knownLocation !== "archived") {
-          const location = await this.getSessionLocation(sessionId);
-          if (location === void 0) {
-            notFound.push(sessionId);
-            continue;
-          }
-          if (location === "active") {
-            alreadyActive.push(sessionId);
-            continue;
-          }
-          if (location === "conflict") {
+        const snapshot = await this.resolveMaintainableSessionSnapshot(sessionId);
+        const location = snapshot.location;
+        if (location === void 0) {
+          notFound.push(sessionId);
+          continue;
+        }
+        if (location === "active") {
+          alreadyActive.push(sessionId);
+          continue;
+        }
+        if (location === "conflict") {
+          if (!options2.resolveConflicts) {
             throw new Error(`Session archive conflict: ${sessionId}`);
           }
+          const archived = snapshot.identities.find(
+            (identity) => identity.state === "archived"
+          );
+          await options2.assertStorageUnchanged?.();
+          options2.assertCanMutate?.();
+          this.assertMaintainableSessionUnchanged(sessionId, snapshot);
+          this.removeFileIfExists(archived.filePath);
+          try {
+            options2.assertCanMutate?.();
+            await this.movePrSidecar(
+              this.getPrSessionPathForState(sessionId, "archived"),
+              this.getPrSessionPathForState(sessionId, "active"),
+              options2.assertCanMutate
+            );
+          } catch (sidecarError) {
+            options2.assertCanMutate?.();
+            this.warn(
+              `unarchiveSessions: failed to merge archived pr sidecar for ${sessionId}: ${sidecarError}`
+            );
+          }
+          options2.assertCanMutate?.();
+          this.removeFileIfExists(
+            this.getWorktreeSessionPathForState(sessionId, "archived")
+          );
+          options2.assertCanMutate?.();
+          this.removeFileIfExists(
+            this.getPromptLedgerPathForState(sessionId, "archived")
+          );
+          unarchived.push(sessionId);
+          resolvedConflicts.push(sessionId);
+          continue;
         }
         const sourcePath = this.getSessionFilePath(sessionId, "archived");
         const targetPath = this.getSessionFilePath(sessionId, "active");
-        if (fs11.existsSync(targetPath)) {
-          throw new Error(`Session archive conflict: ${sessionId}`);
-        }
         const archivedSidecar = this.getWorktreeSessionPathForState(
           sessionId,
           "archived"
@@ -32900,11 +33313,15 @@ ${payload}`, "utf8");
           "active"
         );
         fs11.mkdirSync(path11.dirname(targetPath), { recursive: true });
+        await options2.assertStorageUnchanged?.();
+        options2.assertCanMutate?.();
+        this.assertMaintainableSessionUnchanged(sessionId, snapshot);
         try {
           fs11.renameSync(sourcePath, targetPath);
         } catch (error3) {
           throw this.sessionFileMoveError("unarchive", error3);
         }
+        options2.assertCanMutate?.();
         try {
           this.moveOptionalFile(archivedSidecar, activeSidecar);
         } catch (sidecarError) {
@@ -32915,9 +33332,11 @@ ${payload}`, "utf8");
         try {
           await this.movePrSidecar(
             this.getPrSessionPathForState(sessionId, "archived"),
-            this.getPrSessionPathForState(sessionId, "active")
+            this.getPrSessionPathForState(sessionId, "active"),
+            options2.assertCanMutate
           );
         } catch (sidecarError) {
+          options2.assertCanMutate?.();
           this.warn(
             `unarchiveSessions: failed to move pr sidecar for ${sessionId}: ${sidecarError}`
           );
@@ -32931,21 +33350,33 @@ ${payload}`, "utf8");
           "active"
         );
         try {
+          options2.assertCanMutate?.();
           this.moveLedgerSidecar(archivedLedger, activeLedger);
         } catch (ledgerError) {
+          options2.assertCanMutate?.();
           this.warn(
             `unarchiveSessions: failed to move prompt ledger for ${sessionId} from ${archivedLedger} to ${activeLedger}: ${ledgerError}`
           );
         }
         unarchived.push(sessionId);
       } catch (error3) {
+        if (error3 instanceof SessionStorageEntryError && error3.reason === "foreign_project") {
+          notFound.push(sessionId);
+          continue;
+        }
         errors.push({
           sessionId,
           error: error3 instanceof Error ? error3 : new Error(String(error3))
         });
       }
     }
-    return { unarchived, alreadyActive, notFound, errors };
+    return {
+      unarchived,
+      alreadyActive,
+      resolvedConflicts,
+      notFound,
+      errors
+    };
   }
   /**
    * Removes multiple sessions in one call.
@@ -33337,6 +33768,29 @@ ${payload}`, "utf8");
     const filePath = path11.join(chatsDir, `${sessionId}.jsonl`);
     return this.readSessionTitleFromFile(filePath);
   }
+  async readSessionDisplayNameFromFile(filePath, titleInfo = this.readSessionTitleInfoFromFile(filePath)) {
+    const records = await readLines(
+      filePath,
+      titleInfo.title ? 1 : MAX_PROMPT_SCAN_LINES
+    );
+    if (records.length === 0) return void 0;
+    if (!await this.sessionBelongsToCurrentProject(
+      records[0].sessionId,
+      records[0].cwd
+    )) {
+      return void 0;
+    }
+    return titleInfo.title || this.extractFirstPromptFromRecords(records) || void 0;
+  }
+  async getSessionDisplayName(sessionId) {
+    if (!SESSION_FILE_PATTERN.test(`${sessionId}.jsonl`)) return void 0;
+    const filePath = path11.join(this.getChatsDir(), `${sessionId}.jsonl`);
+    try {
+      return await this.readSessionDisplayNameFromFile(filePath);
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Finds sessions by custom title.
    * Returns all matching sessions ordered by most recent first.
@@ -33409,15 +33863,14 @@ ${payload}`, "utf8");
     return matches;
   }
   /**
-   * Returns the customTitles in this project that start with `prefix`
+   * Returns the picker display names in this project that start with `prefix`
    * (case-insensitive). Single project-wide scan — meant to replace
    * repeated `findSessionsByTitle()` probes when the caller needs to
-   * pick the first free `(Branch N)` slot in memory.
+   * pick the first free numeric suffix in memory.
    *
-   * Skips the heavy hydration steps (message count, prompt extraction)
-   * that `findSessionsByTitle` does — collision lookup only needs the
-   * title and a project filter, so we read the first record only when
-   * the title actually matches the prefix.
+   * Matches the session picker by preferring `customTitle` and falling back
+   * to the first prompt. Each untitled candidate performs one head read
+   * bounded by `MAX_PROMPT_SCAN_LINES`; other metadata stays unhydrated.
    *
    * @param prefix Case-insensitive title prefix to match.
    */
@@ -33441,23 +33894,22 @@ ${payload}`, "utf8");
       filesProcessed++;
       const filePath = path11.join(chatsDir, name);
       const titleInfo = this.readSessionTitleInfoFromFile(filePath);
-      if (!titleInfo.title) continue;
-      if (!titleInfo.title.toLowerCase().trim().startsWith(normalizedPrefix)) {
+      if (titleInfo.title && !titleInfo.title.toLowerCase().trim().startsWith(normalizedPrefix)) {
         continue;
       }
       try {
-        const records = await readLines(filePath, 1);
-        if (records.length === 0) continue;
-        if (!await this.sessionBelongsToCurrentProject(
-          records[0].sessionId,
-          records[0].cwd
-        )) {
+        const displayName = await this.readSessionDisplayNameFromFile(
+          filePath,
+          titleInfo
+        );
+        if (!displayName) continue;
+        if (!displayName.toLowerCase().trim().startsWith(normalizedPrefix)) {
           continue;
         }
+        titles.push(displayName);
       } catch {
         continue;
       }
-      titles.push(titleInfo.title);
     }
     return titles;
   }
@@ -33650,24 +34102,25 @@ function replayUiTelemetryFromConversation(conversation, sessionId) {
   return resumeTokenCounts;
 }
 __name(replayUiTelemetryFromConversation, "replayUiTelemetryFromConversation");
-var MAX_BRANCH_COLLISION_SCAN = 99;
 async function computeUniqueBranchTitle(baseName, sessionService) {
-  const maxSuffixLen = " (Branch 1234567890123)".length;
+  const maxSuffixLen = "(1234567890123)".length;
   const trimmed = baseName.trim().slice(0, SESSION_TITLE_MAX_LENGTH - maxSuffixLen);
   const taken = new Set(
-    (await sessionService.findSessionTitlesByPrefix(`${trimmed} (Branch`)).map(
+    (await sessionService.findSessionTitlesByPrefix(`${trimmed}(`)).map(
       (t) => t.toLowerCase().trim()
     )
   );
-  const first = `${trimmed} (Branch)`;
-  if (!taken.has(first.toLowerCase())) return first;
-  for (let n = 2; n <= MAX_BRANCH_COLLISION_SCAN; n++) {
-    const candidate = `${trimmed} (Branch ${n})`;
+  for (let n = 1; ; n++) {
+    const candidate = `${trimmed}(${n})`;
     if (!taken.has(candidate.toLowerCase())) return candidate;
   }
-  return `${trimmed} (Branch ${Date.now()})`;
 }
 __name(computeUniqueBranchTitle, "computeUniqueBranchTitle");
+function normalizeDerivedBranchTitle(baseName) {
+  const normalized = baseName.trim().replace(/\s*\(Branch(?:\s+\d+)?\)$/, "").replace(/(\S)\(\d+\)$/, "$1").trim();
+  return normalized || void 0;
+}
+__name(normalizeDerivedBranchTitle, "normalizeDerivedBranchTitle");
 
 // packages/core/src/services/sessionTitle.ts
 var debugLogger16 = createDebugLogger("SESSION_TITLE");
@@ -38951,11 +39404,12 @@ var GeminiChat = class {
    */
   async tryCompress(promptId, force = false, signal, options2) {
     this.adoptTokenCountsForRoute(options2?.requestRouteKey);
-    const originalTokenCountIsEstimated = options2?.originalTokenCountOverride === void 0 && this.promptCountIsEstimateDerived();
-    const originalTokenCount = originalTokenCountIsEstimated ? options2?.precomputedEffectiveTokens ?? estimateContentTokens(
+    const originalTokenCountOverride = options2?.originalTokenCountOverride;
+    const originalTokenCountIsEstimated = originalTokenCountOverride !== void 0 ? originalTokenCountOverride.isEstimated : options2?.precomputedEffectiveTokens !== void 0 || this.promptCountIsEstimateDerived();
+    const originalTokenCount = originalTokenCountOverride !== void 0 ? originalTokenCountOverride.count : originalTokenCountIsEstimated ? options2?.precomputedEffectiveTokens ?? estimateContentTokens(
       options2?.pendingUserMessage ? [...this.getHistoryShallow(true), options2.pendingUserMessage] : this.getHistoryShallow(true),
       resolveSlimmingConfig(this.config.getChatCompression()).imageTokenEstimate
-    ) : options2?.originalTokenCountOverride ?? this.lastPromptTokenCount;
+    ) : this.lastPromptTokenCount;
     debugLogger21.debug(
       `[compaction] token-count provenance: prompt_id=${promptId}, originalTokenCount=${originalTokenCount}, estimated=${originalTokenCountIsEstimated}`
     );
@@ -38973,6 +39427,7 @@ var GeminiChat = class {
       customInstructions: options2?.customInstructions,
       signal
     });
+    info.originalTokenCountIsEstimated = originalTokenCountIsEstimated;
     this.adoptTokenCountsForRoute(options2?.requestRouteKey);
     if (info.compressionStatus === 1 /* COMPRESSED */ && newHistory) {
       info.newTokenCountIsEstimated ??= true;
@@ -39039,6 +39494,7 @@ var GeminiChat = class {
         info: {
           originalTokenCount: apiBaseline2,
           newTokenCount: apiBaseline2,
+          originalTokenCountIsEstimated: this.promptCountIsEstimateDerived(),
           compressionStatus: 5 /* NOOP */
         }
       };
@@ -39053,6 +39509,7 @@ var GeminiChat = class {
     const info = {
       originalTokenCount: apiBaseline,
       newTokenCount: adjustedTokenCount,
+      originalTokenCountIsEstimated: baselineIsEstimated,
       newTokenCountIsEstimated: true,
       compressionStatus: 1 /* COMPRESSED */,
       triggerReason: "manual"
@@ -39642,6 +40099,7 @@ var GeminiChat = class {
             if (contextOverflow.isExceeded) {
               if (!exactRoute && !reactiveCompressionAttempted) {
                 reactiveCompressionAttempted = true;
+                const reactiveOriginalTokenCountIsEstimated = contextOverflow.actualTokens === void 0;
                 const reactiveOriginalTokenCount = contextOverflow.actualTokens ?? contextOverflow.limitTokens ?? cgConfig?.contextWindowSize ?? DEFAULT_TOKEN_LIMIT;
                 debugLogger21.warn(
                   "Context length exceeded; attempting reactive compression."
@@ -39652,7 +40110,10 @@ var GeminiChat = class {
                     true,
                     params.config?.abortSignal,
                     {
-                      originalTokenCountOverride: reactiveOriginalTokenCount,
+                      originalTokenCountOverride: {
+                        count: reactiveOriginalTokenCount,
+                        isEstimated: reactiveOriginalTokenCountIsEstimated
+                      },
                       precomputedEffectiveTokens: reactiveOriginalTokenCount,
                       requestGenerationConfig: params.config,
                       requestRouteKey,
@@ -43127,6 +43588,91 @@ var TOOL_NAME_ALIASES = {
   monitor: "monitor",
   Monitor: "monitor",
   MonitorTool: "monitor",
+  // Send Message tool (teams)
+  send_message: "send_message",
+  SendMessage: "send_message",
+  SendMessageTool: "send_message",
+  // Goal tools — the display name of get_goal is "Goal" (see ToolDisplayNames)
+  get_goal: "get_goal",
+  Goal: "get_goal",
+  GetGoal: "get_goal",
+  update_goal: "update_goal",
+  UpdateGoal: "update_goal",
+  UpdateGoalTool: "update_goal",
+  // Save Memory tool
+  save_memory: "save_memory",
+  SaveMemory: "save_memory",
+  SaveMemoryTool: "save_memory",
+  // Ask User Question tool
+  ask_user_question: "ask_user_question",
+  AskUserQuestion: "ask_user_question",
+  AskUserQuestionTool: "ask_user_question",
+  // Cron tools
+  cron_create: "cron_create",
+  CronCreate: "cron_create",
+  cron_list: "cron_list",
+  CronList: "cron_list",
+  cron_delete: "cron_delete",
+  CronDelete: "cron_delete",
+  // Loop wakeup tool
+  loop_wakeup: "loop_wakeup",
+  LoopWakeup: "loop_wakeup",
+  LoopWakeupTool: "loop_wakeup",
+  // Create Sub Session tool
+  create_sub_session: "create_sub_session",
+  CreateSubSession: "create_sub_session",
+  CreateSubSessionTool: "create_sub_session",
+  // List Agents tool
+  list_agents: "list_agents",
+  ListAgents: "list_agents",
+  ListAgentsTool: "list_agents",
+  // Task lifecycle tools (teams)
+  task_stop: "task_stop",
+  TaskStop: "task_stop",
+  task_create: "task_create",
+  TaskCreate: "task_create",
+  task_update: "task_update",
+  TaskUpdate: "task_update",
+  task_list: "task_list",
+  TaskList: "task_list",
+  // Team tools
+  team_create: "team_create",
+  TeamCreate: "team_create",
+  team_delete: "team_delete",
+  TeamDelete: "team_delete",
+  team_plan_approval: "team_plan_approval",
+  TeamPlanApproval: "team_plan_approval",
+  // Image generation tool
+  image_gen: "image_gen",
+  ImageGen: "image_gen",
+  ImageGenTool: "image_gen",
+  // Tool search tool
+  tool_search: "tool_search",
+  ToolSearch: "tool_search",
+  ToolSearchTool: "tool_search",
+  // Structured output (synthetic --json-schema contract)
+  structured_output: "structured_output",
+  StructuredOutput: "structured_output",
+  // Worktree tools
+  enter_worktree: "enter_worktree",
+  EnterWorktree: "enter_worktree",
+  exit_worktree: "exit_worktree",
+  ExitWorktree: "exit_worktree",
+  // Workflow / artifact tools
+  workflow: "workflow",
+  Workflow: "workflow",
+  artifact: "artifact",
+  Artifact: "artifact",
+  record_artifact: "record_artifact",
+  RecordArtifact: "record_artifact",
+  // Report Findings tool
+  report_findings: "report_findings",
+  ReportFindings: "report_findings",
+  request_shutdown: "request_shutdown",
+  RequestShutdown: "request_shutdown",
+  // Display image tool
+  display_image: "display_image",
+  DisplayImage: "display_image",
   // Legacy edit tool name
   replace: "edit"
 };
@@ -63192,8 +63738,26 @@ var CoreToolScheduler = class {
             const matchingRule = pm.findMatchingDenyRule({
               toolName: canonicalName
             });
-            const ruleInfo = matchingRule ? ` Matching deny rule: "${matchingRule}".` : "";
-            const permissionErrorMessage = `Qwen Code requires permission to use "${reqInfo.name}", but that permission was declined.${ruleInfo}`;
+            let permissionErrorMessage;
+            if (matchingRule) {
+              permissionErrorMessage = `Qwen Code requires permission to use "${reqInfo.name}", but that permission was declined. Matching deny rule: "${matchingRule}".`;
+            } else if (pm.isPermissionsAllowListActive() && // Only attribute the miss to `permissions.allow` when the tool
+            // is genuinely uncovered. While the allowlist is active a
+            // COVERED tool can still be rejected by a different gate —
+            // e.g. the legacy `coreTools` (`--core-tools` / `tools.core`)
+            // allowlist — and there the "add a permissions.allow rule"
+            // advice is factually wrong and a no-op (#9827). The optional
+            // call keeps scoped PermissionManager shims (installed via
+            // `as unknown as PermissionManager`, e.g.
+            // memory-scoped-agent-config.ts) from throwing until they grow
+            // the delegation; when coverage is unknown the fallback stays
+            // on the pre-#9827 message rather than risk the wrong
+            // attribution (#9827).
+            (typeof pm.isCoveredByAllowOrAskRule === "function" ? !pm.isCoveredByAllowOrAskRule(canonicalName) : false)) {
+              permissionErrorMessage = `"${reqInfo.name}" is not covered by any permissions.allow rule in the active registry allowlist, so the tool is not available. Add a rule covering it to settings permissions.allow (or permissions.ask) and restart to re-enable it.`;
+            } else {
+              permissionErrorMessage = `Qwen Code requires permission to use "${reqInfo.name}", but that permission was declined.`;
+            }
             newToolCalls.push({
               status: "error",
               request: reqInfo,
@@ -79831,6 +80395,14 @@ function createMemoryScopedAgentConfig(config3, projectRoot, options2 = {}) {
         return basePm.isToolEnabled(toolName);
       }
       return true;
+    },
+    // The scheduler's permission-denied message branch calls this on
+    // whatever `getPermissionManager()` returns (#9827). Without the
+    // delegation a shim-rejected call under an active allowlist threw
+    // `TypeError: ... is not a function` instead of reaching the
+    // designed permission error.
+    isPermissionsAllowListActive() {
+      return basePm?.isPermissionsAllowListActive() ?? false;
     }
   };
   const scopedConfig = Object.create(config3);
@@ -81977,6 +82549,14 @@ function createSkillScopedAgentConfig(config3, projectRoot) {
       if (isScopedTool2(toolName)) return true;
       if (basePm) return basePm.isToolEnabled(toolName);
       return true;
+    },
+    // The scheduler's permission-denied message branch calls this on
+    // whatever `getPermissionManager()` returns (#9827). Without the
+    // delegation a shim-rejected call under an active allowlist threw
+    // `TypeError: ... is not a function` instead of reaching the
+    // designed permission error.
+    isPermissionsAllowListActive() {
+      return basePm?.isPermissionsAllowListActive() ?? false;
     }
   };
   const scopedConfig = Object.create(config3);
@@ -83476,6 +84056,13 @@ var GeminiClient = class _GeminiClient {
   }
   chat;
   initializedSessionId;
+  /**
+   * Open session-swap telemetry transaction, if any. See
+   * {@link beginTelemetrySwap} for the lifetime contract. Holds the undo for
+   * the replay the current swap's `initialize()` performed, armed by
+   * {@link armTelemetrySwapUndo} inside the replay branches.
+   */
+  telemetrySwap;
   sessionTurnCount = 0;
   toolCallCount = 0;
   skillsModifiedInSession = false;
@@ -83572,6 +84159,7 @@ var GeminiClient = class _GeminiClient {
     const resumedSessionData = this.config.getResumedSessionData();
     const restoreRuntime = this.config.getSessionRestoreRuntime?.();
     if (restoreRuntime) {
+      this.armTelemetrySwapUndo(sessionId);
       uiTelemetryService.resetSession(sessionId);
       for (const event of restoreRuntime.uiTelemetryEvents) {
         uiTelemetryService.addEvent(event, sessionId);
@@ -83596,6 +84184,7 @@ var GeminiClient = class _GeminiClient {
         );
       }
     } else if (resumedSessionData) {
+      this.armTelemetrySwapUndo(sessionId);
       const resumeTokenCounts = replayUiTelemetryFromConversation(
         resumedSessionData.conversation,
         this.config.getSessionId()
@@ -83664,6 +84253,140 @@ var GeminiClient = class _GeminiClient {
   isInitialized() {
     return this.chat !== void 0;
   }
+  /**
+   * Opens a session-swap telemetry transaction for the `/resume` / `/branch`
+   * hooks (#9833).
+   *
+   * Lifetime contract: one call per swap attempt, closed by exactly one
+   * {@link commitTelemetrySwap} (the UI swap committed — the replayed history
+   * now belongs to the session the user is on) or
+   * {@link abortTelemetrySwap} (the swap failed and core rolled back — put
+   * the usage aggregate back). The undo is armed lazily by
+   * {@link armTelemetrySwapUndo} inside `initialize()`'s replay branches, so
+   * it is scoped to the ONE replay this swap performs:
+   *
+   * - A replay outside any transaction (process-startup `Config.initialize()`,
+   *   ACP) arms nothing — there is no owning swap to settle it, and a
+   *   process-lived undo would let a much later failed swap restore a
+   *   process-start snapshot and wipe everything accrued since.
+   * - `initialize()` only replays when its private `initializedSessionId`
+   *   differs from the config session id. The hooks cannot see that fact, so
+   *   the snapshot is taken here, inside the replay decision, never keyed on
+   *   a caller's guess.
+   *
+   * Serialization: returns false WITHOUT opening when a transaction is
+   * already open. Callers MUST abort the swap attempt on a false return
+   * (the hooks surface "a session switch is already in progress"). Two
+   * concurrent swaps cannot share this single slot: the second open would
+   * no-op while both replays mutate the same aggregate, so the first swap's
+   * stale settlement would either no-op or restore its snapshot over the
+   * second swap's committed state — the double-count / split-brain this
+   * transaction exists to close. Nothing else serializes the swaps: the
+   * session picker fires them fire-and-forget and no input gate covers
+   * them, so this slot is the latch.
+   */
+  beginTelemetrySwap() {
+    if (this.telemetrySwap) {
+      if (debugLogger59.isEnabled()) {
+        debugLogger59.debug(
+          "[TELEMETRY_SWAP_BEGIN] rejected: a swap is already in progress"
+        );
+      }
+      return false;
+    }
+    this.telemetrySwap = { outgoingHint: this.config.getSessionId() };
+    return true;
+  }
+  /**
+   * The swap committed: drop the armed undo without restoring. The replayed
+   * history legitimately belongs to the session the user is now on, and a
+   * later failed swap must restore ITS OWN pre-swap snapshot, never this one.
+   * Safe to call with no transaction open (no-op).
+   */
+  commitTelemetrySwap() {
+    const undo = this.telemetrySwap?.undo;
+    this.telemetrySwap = void 0;
+    if (debugLogger59.isEnabled()) {
+      debugLogger59.debug(
+        `[TELEMETRY_SWAP_COMMIT] undo=${undo ? "dropped" : "none"} incoming=${undo?.sessionId ?? "n/a"}`
+      );
+    }
+  }
+  /**
+   * The swap failed and core rolled back: restore the usage aggregate (and
+   * the two affected session buckets) to the state captured before this
+   * swap's replay. Overwrites rather than subtracts, so it stays correct
+   * when the rollback's own re-`initialize()` (the `/branch` and `/resume`
+   * paths) has already replayed something else on top.
+   *
+   * Also forgets `initializedSessionId` when it still names the abandoned
+   * INCOMING session: undoing the replay without forgetting it would make a
+   * retry early-return and never replay, permanently under-counting the
+   * session. The clear is an identity check, not the assumption that the
+   * undo always names the incoming session — when the swap's forward
+   * `initialize()` never ran (e.g. `/branch` fails between
+   * `startNewSession(fork)` and `initialize()`), the rollback's own
+   * re-initialize arms the undo with the PARENT's id and sets
+   * `initializedSessionId` to it. That session is live and correctly
+   * initialized; clearing it would make the next `initialize()` of the
+   * session the user is already on skip the early return and re-replay its
+   * stored telemetry on top of the live aggregate — a permanent
+   * double-count. The undo belongs to the outgoing session's own
+   * re-initialize exactly when `undo.sessionId` matches the begin-time
+   * `outgoingHint` (#9844 review).
+   *
+   * Safe to call with no transaction open or nothing armed (no-op). Returns
+   * whether an undo was applied.
+   */
+  abortTelemetrySwap() {
+    const swap = this.telemetrySwap;
+    this.telemetrySwap = void 0;
+    if (debugLogger59.isEnabled()) {
+      debugLogger59.debug(
+        `[TELEMETRY_SWAP_ABORT] undo=${swap?.undo ? "applied" : "none"} incoming=${swap?.undo?.sessionId ?? "n/a"} outgoing=${swap?.undo?.snapshot.outgoingSessionId ?? "n/a"}`
+      );
+    }
+    if (!swap?.undo) return false;
+    uiTelemetryService.restoreFromReplaySnapshot(swap.undo.snapshot);
+    if (swap.undo.sessionId !== swap.outgoingHint && this.initializedSessionId === swap.undo.sessionId) {
+      this.initializedSessionId = void 0;
+    }
+    return true;
+  }
+  /**
+   * Arms the undo for the replay the current `initialize()` call is about to
+   * perform. Called only by the replay branches; a fresh-start `initialize()`
+   * replays nothing, and an undo armed there would outlive the transaction.
+   *
+   * `??=` on the undo: within one swap only the FIRST replay's pre-state is
+   * the correct restore point — on the `/branch` rollback the re-initialize
+   * of the parent runs while the failed swap's undo is still outstanding.
+   * No-ops when no transaction is open (replay outside a swap).
+   *
+   * The snapshot also covers the session the process is currently on — the
+   * one a failed swap rolls back to. That is the transaction's
+   * `outgoingHint`, captured at open time, NOT `initializedSessionId`: an
+   * earlier failed swap's abort clears `initializedSessionId`, so keying on
+   * it would snapshot no outgoing bucket and the rollback's re-initialize
+   * would wipe the live session's never-persisted state. The `/branch`
+   * rollback re-initializes that session, and the re-initialize's
+   * `resetSession` wipes its live bucket — only what the transcript persists
+   * comes back (skill invocations never do), so the undo must put the
+   * captured bucket back.
+   */
+  armTelemetrySwapUndo(sessionId) {
+    if (!this.telemetrySwap || this.telemetrySwap.undo) return;
+    const outgoing = this.telemetrySwap.outgoingHint ?? this.initializedSessionId;
+    this.telemetrySwap.undo = {
+      sessionId,
+      snapshot: uiTelemetryService.snapshotForReplay(sessionId, outgoing)
+    };
+    if (debugLogger59.isEnabled()) {
+      debugLogger59.debug(
+        `[TELEMETRY_SWAP_ARM] incoming=${sessionId} outgoing=${outgoing ?? "n/a"}`
+      );
+    }
+  }
   getHistory(curated = false) {
     return this.getChat().getHistory(curated);
   }
@@ -117737,7 +118460,7 @@ var HybridTokenStorage = class extends BaseTokenStorage {
     const forceFileStorage = process.env[FORCE_FILE_STORAGE_ENV_VAR] === "true";
     if (!forceFileStorage) {
       try {
-        const { KeychainTokenStorage: KeychainTokenStorage2 } = await import("./keychain-token-storage-LQTBIXSX.js");
+        const { KeychainTokenStorage: KeychainTokenStorage2 } = await import("./keychain-token-storage-3MGFRYGM.js");
         const keychainStorage = new KeychainTokenStorage2(this.serviceName);
         const isAvailable = await keychainStorage.isAvailable();
         if (isAvailable) {
@@ -122963,11 +123686,21 @@ var ToolRegistry = class _ToolRegistry {
           }
         }
       }
+      const permissionManager = this.config.getPermissionManager?.();
       for (const func of functions) {
         if (!func.name) {
           debugLogger75.warn("Discovered a tool with no name. Skipping.");
           continue;
         }
+        if (permissionManager) {
+          const toolEnabled = await permissionManager.isToolEnabled(func.name);
+          if (!toolEnabled) {
+            debugLogger75.info(
+              `Discovered tool "${func.name}" skipped: not enabled by the permission manager (permissions.allow registry allowlist or whole-tool deny rule, #9827).`
+            );
+            continue;
+          }
+        }
         const parameters = func.parametersJsonSchema && typeof func.parametersJsonSchema === "object" && !Array.isArray(func.parametersJsonSchema) ? func.parametersJsonSchema : {};
         this.registerTool(
           new DiscoveredTool(
@@ -126548,6 +127281,59 @@ var PermissionManager = class _PermissionManager {
    * Populated during `initialize()` from `config.getCoreTools()`.
    */
   coreToolsAllowList = null;
+  /**
+   * Whether the `permissions.allow` registry allowlist is active.
+   *
+   * Snapshotted once in `initialize()`: the allowlist activates only when
+   * `settings.permissions.allow` (exposed via `getRegistryAllowList()`)
+   * contains at least one VALID rule. Pure auto-approval sources —
+   * `--allowed-tools`, the SDK `allowedTools` param, the legacy
+   * `tools.allowed` key — deliberately do NOT activate it; they keep their
+   * documented "bypass the confirmation dialog" semantics (#9827).
+   *
+   * Activation is not re-evaluated later: rules granted mid-session
+   * ("Always allow", skill `allowedTools`, `/permissions` writes) extend
+   * allowlist MEMBERSHIP but must never activate the allowlist under a
+   * running session, or approving one tool would suddenly
+   * permission-error every tool not on the list. Registry composition is
+   * a startup decision, consistent with the "Requires restart" semantics
+   * of the other tool-availability settings.
+   */
+  permissionsAllowListActive = false;
+  /**
+   * Frozen snapshot of the allow rules in force at startup, captured at
+   * the end of `initialize()`.
+   *
+   * Registry membership must be monotonic within a session: activation and
+   * registration are snapshotted at startup ("Requires restart"), so
+   * REMOVING an allow rule mid-session — `/permissions` →
+   * `removePersistentRule`, or a `qwen serve` settings edit →
+   * `syncLivePermissionManagers` — must not hard-block a tool that was
+   * legitimately registered (it is still listed in `/tools` and its schema
+   * is still sent to the model; blocking every call with EXECUTION_DENIED
+   * until restart contradicts the restart-scoped contract). Removals take
+   * effect at restart; membership is the union of this frozen startup set
+   * and the live rule set, so mid-session GRANTS still extend coverage
+   * (#9827).
+   */
+  startupAllowRules = [];
+  /**
+   * Frozen snapshot of the ask rules in force at startup.
+   *
+   * Ask rules count toward registry-allowlist membership: a tool the user
+   * configured to always be prompted for must stay usable, so "always ask"
+   * must not silently become "unregistered" whenever an allowlist is
+   * active (#9827). Membership is monotonic within the session for the
+   * same reason as `startupAllowRules`: removing an ask rule mid-session
+   * must not deregister a tool that was legitimately registered.
+   */
+  startupAskRules = [];
+  /**
+   * Set once the restart caveat for session allow-rule grants under an
+   * active registry allowlist has been logged, so repeated skill
+   * `allowedTools` grants do not pile identical warnings into the log.
+   */
+  sessionGrantAllowlistCaveatLogged = false;
   /**
    * Initialise from the config's permission parameters.
    * Must be called once before any rule lookups.
@@ -126570,6 +127356,11 @@ var PermissionManager = class _PermissionManager {
     if (this.config.getApprovalMode?.() === "auto") {
       this.stripDangerousRulesForAutoMode();
     }
+    this.permissionsAllowListActive = parseRules(
+      this.config.getRegistryAllowList?.() ?? []
+    ).some((rule) => !rule.invalid);
+    this.startupAllowRules = this.getEffectiveAllowRules();
+    this.startupAskRules = this.getEffectiveAskRules();
   }
   // ---------------------------------------------------------------------------
   // Core evaluation
@@ -126848,6 +127639,21 @@ var PermissionManager = class _PermissionManager {
     "create_sub_session",
     "monitor"
   ]);
+  /**
+   * Synthetic plan-mode lifecycle tools that must stay registered even under
+   * an active `permissions.allow` registry allowlist. The plan-mode system
+   * reminder instructs the model to present its plan by calling
+   * `exit_plan_mode`, and `enter_plan_mode` / `ask_user_question` are the
+   * sanctioned plan-flow entry and clarification tools; dropping their
+   * schemas makes the plan flow impossible to complete (#9827). They belong
+   * to the same exemption class as `structured_output` and the "synthetic
+   * system tools" the CORE_TOOLS docstring names — deny rules still apply.
+   */
+  static PLAN_LIFECYCLE_TOOLS = /* @__PURE__ */ new Set([
+    ToolNames.EXIT_PLAN_MODE,
+    ToolNames.ENTER_PLAN_MODE,
+    ToolNames.ASK_USER_QUESTION
+  ]);
   /**
    * Check if a tool is a core tool subject to the coreTools allowlist check.
    */
@@ -126857,17 +127663,35 @@ var PermissionManager = class _PermissionManager {
   /**
    * Determine whether a tool should be present in the tool registry.
    *
-   * A tool is disabled (returns false) when a `deny` rule without a specifier
-   * (i.e. a whole-tool deny) matches.  Specifier-based deny rules such as
-   * `"Bash(rm -rf *)"` do NOT remove the tool from the registry – they only
-   * deny specific invocations at runtime.
+   * A tool is disabled (returns false) when:
+   * - the `permissions.allow` registry allowlist is active and the tool is
+   *   not covered by any allow or ask rule (see
+   *   `isPermissionsAllowListActive`; ask rules keep their tool registered
+   *   so "always require confirmation" never silently becomes "tool
+   *   unavailable"), or
+   * - a `deny` rule without a specifier (i.e. a whole-tool deny) matches.
+   *
+   * Specifier-based deny rules such as `"Bash(rm -rf *)"` do NOT remove the
+   * tool from the registry – they only deny specific invocations at runtime.
+   * Likewise, specifier-based allow rules such as `"Bash(npm test)"` DO keep
+   * the tool in the registry — the allowlist is tool-level, not
+   * invocation-level.
    *
    * Non-core tools (MCP, Skill, Agent, etc.) skip the coreTools allowlist
    * check because they are dynamically discovered or essential for system
-   * operation.
+   * operation, but they ARE subject to the `permissions.allow` registry
+   * allowlist (except MCP tools, `structured_output`, and the
+   * `computer_use__*` family, see below) — that is the documented migration
+   * semantic of the legacy `tools.core` whitelist ("unlisted tools are
+   * disabled at registry level") and the only way to keep e.g.
+   * `send_message` / `update_goal` schemas out of the model request
+   * (#9827).
    */
   async isToolEnabled(toolName) {
     const canonicalName = resolveToolName(toolName);
+    if (this.permissionsAllowListActive && canonicalName !== ToolNames.STRUCTURED_OUTPUT && !_PermissionManager.PLAN_LIFECYCLE_TOOLS.has(canonicalName) && canonicalName !== ToolNames.TASK_STOP && canonicalName !== ToolNames.TOOL_SEARCH && !canonicalName.startsWith("mcp__") && !canonicalName.startsWith("computer_use__") && !this.isCoveredByAllowOrAskRule(canonicalName)) {
+      return false;
+    }
     if (!this.isCoreTool(canonicalName)) {
       const decision2 = await this.evaluate({ toolName: canonicalName });
       return decision2 !== "deny";
@@ -126880,6 +127704,74 @@ var PermissionManager = class _PermissionManager {
     const decision = await this.evaluate({ toolName: canonicalName });
     return decision !== "deny";
   }
+  /**
+   * Whether the `permissions.allow` registry allowlist is active for this
+   * session. See the `permissionsAllowListActive` field for the activation
+   * contract (snapshot at `initialize()`, restart-scoped).
+   */
+  isPermissionsAllowListActive() {
+    return this.permissionsAllowListActive;
+  }
+  /**
+   * All allow rules currently in force: persistent + session + any rules
+   * the AUTO-mode strip moved to the stash (they are configured rules,
+   * merely suspended for runtime auto-approval purposes).
+   */
+  getEffectiveAllowRules() {
+    return [
+      ...this.sessionRules.allow,
+      ...this.persistentRules.allow,
+      ...this.strippedAllowRules?.session ?? [],
+      ...this.strippedAllowRules?.persistent ?? []
+    ];
+  }
+  /**
+   * All ask rules currently in force: persistent + session. AUTO mode
+   * strips only allow rules (the stash in `strippedAllowRules`), so ask
+   * rules are never suspended and no stash applies here.
+   */
+  getEffectiveAskRules() {
+    return [...this.sessionRules.ask, ...this.persistentRules.ask];
+  }
+  /**
+   * Registry-membership check for the `permissions.allow` allowlist: true
+   * when any in-force allow OR ask rule mentions the tool. Ask rules count
+   * because they express "this tool must stay usable, with confirmation" —
+   * a tool covered only by an ask rule must not be silently deregistered
+   * whenever an allowlist is active, or the documented "always require
+   * user confirmation" would become "tool unavailable" and the ask rule
+   * could never fire (#9827). Tool-name matching is specifier-agnostic
+   * (`Bash(npm test)` keeps `run_shell_command` registered) and honours
+   * meta-categories (`Read` covers grep/glob/..., `Bash` covers monitor)
+   * via `toolMatchesRuleToolName`.
+   *
+   * Membership is monotonic within the session: the union of the frozen
+   * startup rule sets (`startupAllowRules` / `startupAskRules`) and the
+   * live rule sets. Removing a STARTUP rule mid-session therefore never
+   * deregisters an already-registered tool (removals take effect at
+   * restart, matching the documented "Requires restart" contract), while
+   * rules granted mid-session — skill `allowedTools`, "Always allow",
+   * `/permissions` writes — extend membership live even though they can
+   * never ACTIVATE the allowlist (#9827).
+   *
+   * Caveat: extending membership flips this runtime predicate only. A
+   * mid-session grant can never RESTORE a tool that the startup allowlist
+   * skipped at REGISTRATION — the registry is built once in
+   * `Config.initialize` and `ensureTool` returns undefined for factories
+   * that were never stored, so such a call still fails TOOL_NOT_REGISTERED
+   * until the rule is added to settings `permissions.allow` and the
+   * session restarts (#9827).
+   *
+   * Public so the scheduler can tell an allowlist miss (tool genuinely
+   * uncovered) apart from a rejection by a different gate — e.g. the
+   * legacy `coreTools` allowlist — for a tool that IS covered, where
+   * "add a permissions.allow rule" advice would be a no-op (#9827).
+   */
+  isCoveredByAllowOrAskRule(toolName) {
+    const canonicalName = resolveToolName(toolName);
+    const covered = /* @__PURE__ */ __name((rule) => !rule.invalid && toolMatchesRuleToolName(rule.toolName, canonicalName), "covered");
+    return this.startupAllowRules.some(covered) || this.getEffectiveAllowRules().some(covered) || this.startupAskRules.some(covered) || this.getEffectiveAskRules().some(covered);
+  }
   /**
    * Find the first deny rule that matches the given context.
    * Returns the raw rule string if found, or undefined if no deny rule matches.
@@ -127128,6 +128020,12 @@ var PermissionManager = class _PermissionManager {
    * Add a session-level allow rule (in-memory, cleared when the session ends).
    * Used when the user clicks "Always allow for this session".
    *
+   * Under an active `permissions.allow` registry allowlist the grant
+   * auto-approves matching calls and extends allowlist MEMBERSHIP, but it
+   * cannot REGISTER a tool the startup allowlist skipped — registry
+   * composition is restart-scoped. The first such grant logs a caveat
+   * pointing at the restart path (#9827).
+   *
    * @param raw - The raw rule string, e.g. "Bash(git status)".
    */
   addSessionAllowRule(raw) {
@@ -127139,6 +128037,12 @@ var PermissionManager = class _PermissionManager {
         );
         return;
       }
+      if (this.permissionsAllowListActive && !this.sessionGrantAllowlistCaveatLogged) {
+        this.sessionGrantAllowlistCaveatLogged = true;
+        debugLogger81.warn(
+          "Session allow rule granted while the permissions.allow registry allowlist is active: the grant auto-approves matching calls, but it cannot register a tool the startup allowlist skipped at registration \u2014 an unavailable tool stays unavailable until the rule is added to settings permissions.allow and the session restarts (#9827)."
+        );
+      }
       if (this.strippedAllowRules && isDangerousAllowRule(rule)) {
         const exists2 = this.strippedAllowRules.session.some(
           (r) => r.raw === rule.raw
@@ -130383,7 +131287,7 @@ var FileReadCache = class _FileReadCache {
 init_esbuild_shims();
 import * as fs70 from "node:fs";
 import * as path68 from "node:path";
-import * as os19 from "node:os";
+import * as os20 from "node:os";
 
 // packages/core/src/extension/variables.ts
 init_esbuild_shims();
@@ -130626,7 +131530,7 @@ __name(resolveEnvVarsInObjectInternal, "resolveEnvVarsInObjectInternal");
 // packages/core/src/extension/github.ts
 init_esbuild_shims();
 import * as crypto6 from "node:crypto";
-import * as os18 from "node:os";
+import * as os19 from "node:os";
 import * as https2 from "node:https";
 import * as fs62 from "node:fs";
 import * as path61 from "node:path";
@@ -135939,6 +136843,110 @@ async function prepareStoredGitCredentialDeletion(extensionDir) {
 }
 __name(prepareStoredGitCredentialDeletion, "prepareStoredGitCredentialDeletion");
 
+// packages/core/src/extension/extension-git-client.ts
+init_esbuild_shims();
+import * as os18 from "node:os";
+function assertCredentialedHttpsSource(source) {
+  try {
+    const parsed = new URL(source);
+    if (parsed.protocol === "https:" && !parsed.username && !parsed.password && parsed.href === source) {
+      return;
+    }
+  } catch {
+  }
+  throw new Error(
+    "Credentialed Git operations require a valid HTTPS repository URL."
+  );
+}
+__name(assertCredentialedHttpsSource, "assertCredentialedHttpsSource");
+var generatedConfigKeyAllowances = [
+  [/alias/, "allowUnsafeAlias"],
+  [/core.askpass/, "allowUnsafeAskPass"],
+  [/core.editor/, "allowUnsafeEditor"],
+  [/core.fsmonitor/, "allowUnsafeFsMonitor"],
+  [/core.gitproxy/, "allowUnsafeGitProxy"],
+  [/core.hookspath/, "allowUnsafeHooksPath"],
+  [/core.pager/, "allowUnsafePager"],
+  [/core.sshcommand/, "allowUnsafeSshCommand"],
+  [/credential(..+)?.helper/, "allowUnsafeCredentialHelper"],
+  [/diff(..+)?.command/, "allowUnsafeDiffExternal"],
+  [/diff.external/, "allowUnsafeDiffExternal"],
+  [/diff(..+)?.textconv/, "allowUnsafeDiffTextConv"],
+  [/filter(..+)?.clean/, "allowUnsafeFilter"],
+  [/filter(..+)?.smudge/, "allowUnsafeFilter"],
+  [/gpg(..+)?.program/, "allowUnsafeGpgProgram"],
+  [/init.templatedir/, "allowUnsafeTemplateDir"],
+  [/merge(..+)?.driver/, "allowUnsafeMergeDriver"],
+  [/mergetool(..+)?.path/, "allowUnsafeMergeDriver"],
+  [/mergetool(..+)?.cmd/, "allowUnsafeMergeDriver"],
+  [/protocol(..+)?.allow/, "allowUnsafeProtocolOverride"],
+  [/remote(..+)?.receivepack/, "allowUnsafePack"],
+  [/remote(..+)?.uploadpack/, "allowUnsafePack"],
+  [/sequence.editor/, "allowUnsafeEditor"]
+];
+function allowGeneratedConfigKeyFalsePositives(unsafe, key) {
+  const normalizedKey = key.toLowerCase().trim();
+  for (const [pattern, category] of generatedConfigKeyAllowances) {
+    if (pattern.test(normalizedKey)) {
+      unsafe[category] = true;
+    }
+  }
+}
+__name(allowGeneratedConfigKeyFalsePositives, "allowGeneratedConfigKeyFalsePositives");
+function createExtensionGitClient(simpleGit, {
+  baseDir,
+  signal,
+  networkPolicy,
+  networkConfig = [],
+  authentication
+}) {
+  if (authentication) assertCredentialedHttpsSource(authentication.source);
+  const restrictEnvironment = networkPolicy === "public" || authentication !== void 0;
+  const hasNetworkConfig = networkConfig.length > 0;
+  const unsafe = {};
+  if (restrictEnvironment) unsafe.allowUnsafeConfigPaths = true;
+  if (hasNetworkConfig) unsafe.allowUnsafeProtocolOverride = true;
+  const credentialConfigKey = authentication ? `http.${authentication.source}.extraHeader` : void 0;
+  if (credentialConfigKey) {
+    unsafe.allowUnsafeConfigEnvCount = true;
+    allowGeneratedConfigKeyFalsePositives(unsafe, credentialConfigKey);
+  }
+  const git = simpleGit(baseDir, {
+    ...signal ? { abort: signal } : {},
+    ...hasNetworkConfig ? { config: networkConfig } : {},
+    ...restrictEnvironment || hasNetworkConfig ? { unsafe } : {}
+  });
+  if (!restrictEnvironment) return git;
+  const environment = {
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: os18.devNull
+  };
+  for (const key of [
+    "PATH",
+    "Path",
+    "SystemRoot",
+    "SYSTEMROOT",
+    "WINDIR",
+    "TEMP",
+    "TMP",
+    "TMPDIR"
+  ]) {
+    const value = process.env[key];
+    if (value !== void 0) environment[key] = value;
+  }
+  if (authentication && credentialConfigKey) {
+    const value = Buffer.from(
+      `${authentication.credential.username}:${authentication.credential.password}`,
+      "utf8"
+    ).toString("base64");
+    environment["GIT_CONFIG_COUNT"] = "1";
+    environment["GIT_CONFIG_KEY_0"] = credentialConfigKey;
+    environment["GIT_CONFIG_VALUE_0"] = `Authorization: Basic ${value}`;
+  }
+  return git.env(environment);
+}
+__name(createExtensionGitClient, "createExtensionGitClient");
+
 // packages/core/src/extension/github.ts
 var debugLogger90 = createDebugLogger("EXT_GITHUB");
 var SUPPORTED_ARCHIVE_EXTENSIONS = [".tar.gz", ".zip"];
@@ -136045,40 +137053,18 @@ function createPinnedGitConfig(curlResolve) {
   ];
 }
 __name(createPinnedGitConfig, "createPinnedGitConfig");
-function restrictGitEnvironment(git, networkPolicy, authentication) {
-  if (networkPolicy !== "public" && !authentication) return git;
-  const environment = {
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_GLOBAL: os18.devNull
-  };
-  for (const key of [
-    "PATH",
-    "Path",
-    "SystemRoot",
-    "SYSTEMROOT",
-    "WINDIR",
-    "TEMP",
-    "TMP",
-    "TMPDIR"
-  ]) {
-    const value = process.env[key];
-    if (value !== void 0) environment[key] = value;
-  }
-  if (authentication) {
-    const value = Buffer.from(
-      `${authentication.credential.username}:${authentication.credential.password}`,
-      "utf8"
-    ).toString("base64");
-    environment["GIT_CONFIG_COUNT"] = "1";
-    environment["GIT_CONFIG_KEY_0"] = `http.${authentication.source}.extraHeader`;
-    environment["GIT_CONFIG_VALUE_0"] = `Authorization: Basic ${value}`;
+function resolveGitRef(ref) {
+  const resolvedRef = ref || "HEAD";
+  if (resolvedRef.startsWith("-")) {
+    throw new Error('Git refs must not start with "-".');
   }
-  return git.env(environment);
+  return resolvedRef;
 }
-__name(restrictGitEnvironment, "restrictGitEnvironment");
+__name(resolveGitRef, "resolveGitRef");
 async function cloneFromGit(installMetadata, destination, signal, credential, hideSource = false) {
   const redactedSource = hideSource ? "credentialed HTTPS Git source" : redactUrlCredentials(installMetadata.source);
   try {
+    const refToFetch = resolveGitRef(installMetadata.ref);
     const { simpleGit } = await loadSimpleGit();
     let networkConfig = [];
     if (installMetadata.networkPolicy === "public") {
@@ -136094,22 +137080,15 @@ async function cloneFromGit(installMetadata, destination, signal, credential, hi
       networkConfig = networkTarget.curlResolve ? createPinnedGitConfig(networkTarget.curlResolve) : [];
     }
     const effectiveCredential = credential ?? getGitHubCredential(installMetadata.source);
-    const git = restrictGitEnvironment(
-      simpleGit(destination, {
-        ...signal ? { abort: signal } : {},
-        ...networkConfig.length > 0 ? {
-          config: networkConfig,
-          unsafe: {
-            allowUnsafeConfigPaths: true,
-            allowUnsafeProtocolOverride: true
-          }
-        } : {}
-      }),
-      installMetadata.networkPolicy,
-      effectiveCredential ? { source: installMetadata.source, credential: effectiveCredential } : void 0
-    );
+    const git = createExtensionGitClient(simpleGit, {
+      baseDir: destination,
+      signal,
+      networkPolicy: installMetadata.networkPolicy,
+      networkConfig,
+      authentication: effectiveCredential ? { source: installMetadata.source, credential: effectiveCredential } : void 0
+    });
     signal?.throwIfAborted();
-    const symlinkValue = os18.platform() === "win32" ? "false" : "true";
+    const symlinkValue = os19.platform() === "win32" ? "false" : "true";
     await git.clone(installMetadata.source, "./", [
       "-c",
       `core.symlinks=${symlinkValue}`,
@@ -136121,7 +137100,6 @@ async function cloneFromGit(installMetadata, destination, signal, credential, hi
     if (remotes.length === 0) {
       throw new Error(`Unable to find any remotes for repo ${redactedSource}`);
     }
-    const refToFetch = installMetadata.ref || "HEAD";
     const remoteUrl = remotes[0].refs.fetch;
     if (!remoteUrl) {
       throw new Error(`Unable to find a fetch URL for repo ${redactedSource}`);
@@ -136319,7 +137297,7 @@ async function checkForExtensionUpdate(extension, extensionManager, signal) {
       let extensionDir = installMetadata.source;
       if (isSupportedArchivePath(installMetadata.source)) {
         tempDir = await fs62.promises.mkdtemp(
-          path61.join(os18.tmpdir(), "extension-archive-update-")
+          path61.join(os19.tmpdir(), "extension-archive-update-")
         );
         signal?.throwIfAborted();
         await extractArchiveFile(installMetadata.source, tempDir, signal);
@@ -136376,7 +137354,7 @@ async function checkForExtensionUpdate(extension, extensionManager, signal) {
     let convertedDir;
     try {
       tempDir = await fs62.promises.mkdtemp(
-        path61.join(os18.tmpdir(), "extension-archive-update-")
+        path61.join(os19.tmpdir(), "extension-archive-update-")
       );
       await downloadFromArchiveUrl(installMetadata, tempDir, signal);
       const converted = await convertCompatibleExtension(
@@ -136425,6 +137403,7 @@ async function checkForExtensionUpdate(extension, extensionManager, signal) {
   }
   try {
     if (installMetadata.type === "git") {
+      const refToCheck = resolveGitRef(installMetadata.ref);
       const storedCredential = installMetadata.credentialPersistence === "stored" ? (await resolveStoredGitCredential(extension.path)).credential : void 0;
       if (await shouldUsePublicGitHubArchiveFallback(installMetadata)) {
         if (!installMetadata.gitCommit) {
@@ -136436,7 +137415,7 @@ async function checkForExtensionUpdate(extension, extensionManager, signal) {
         const remoteSha = await resolvePublicGitHubCommitSha(
           owner,
           repo,
-          installMetadata.ref || "HEAD",
+          refToCheck,
           signal
         );
         return remoteSha === installMetadata.gitCommit ? "up to date" /* UP_TO_DATE */ : "update available" /* UPDATE_AVAILABLE */;
@@ -136488,21 +137467,13 @@ async function checkForExtensionUpdate(extension, extensionManager, signal) {
       }
       signal?.throwIfAborted();
       const effectiveCredential = storedCredential ?? getGitHubCredential(remoteUrl);
-      const git = restrictGitEnvironment(
-        simpleGit(extension.path, {
-          ...signal ? { abort: signal } : {},
-          ...networkConfig.length > 0 ? {
-            config: networkConfig,
-            unsafe: {
-              allowUnsafeConfigPaths: true,
-              allowUnsafeProtocolOverride: true
-            }
-          } : {}
-        }),
-        installMetadata.networkPolicy,
-        effectiveCredential ? { source: remoteUrl, credential: effectiveCredential } : void 0
-      );
-      const refToCheck = installMetadata.ref || "HEAD";
+      const git = createExtensionGitClient(simpleGit, {
+        baseDir: extension.path,
+        signal,
+        networkPolicy: installMetadata.networkPolicy,
+        networkConfig,
+        authentication: effectiveCredential ? { source: remoteUrl, credential: effectiveCredential } : void 0
+      });
       const refPatterns = installMetadata.ref ? [refToCheck, `${refToCheck}^{}`] : [refToCheck];
       const lsRemoteOutput = await git.listRemote([remoteUrl, ...refPatterns]);
       signal?.throwIfAborted();
@@ -136678,8 +137649,8 @@ async function extractArchiveFile(archivePath, destination, signal, options2 = {
 }
 __name(extractArchiveFile, "extractArchiveFile");
 function findReleaseAsset(assets) {
-  const platform2 = os18.platform();
-  const arch2 = os18.arch();
+  const platform2 = os19.platform();
+  const arch2 = os19.arch();
   const platformArchPrefix = `${platform2}.${arch2}.`;
   const platformPrefix = `${platform2}.`;
   const platformArchAsset = assets.find(
@@ -140070,7 +141041,7 @@ var ExtensionManager = class _ExtensionManager {
           "enabled"
         );
       } else {
-        const scopePath = os19.homedir();
+        const scopePath = os20.homedir();
         snapshot = await this.extensionStore.setLegacyPathActivation(
           { id: extension.id, name: extension.name },
           scopePath,
@@ -140112,7 +141083,7 @@ var ExtensionManager = class _ExtensionManager {
           "disabled"
         );
       } else {
-        const scopePath = os19.homedir();
+        const scopePath = os20.homedir();
         snapshot = await this.extensionStore.setLegacyPathActivation(
           { id: extension.id, name: extension.name },
           scopePath,
@@ -152257,6 +153228,7 @@ var Config = class _Config {
   permissionsAllow;
   permissionsAsk;
   permissionsDeny;
+  permissionsRegistryAllowList;
   permissionsAutoMode;
   toolDiscoveryCommand;
   toolCallCommand;
@@ -152564,6 +153536,7 @@ var Config = class _Config {
     this.permissionsAllow = params.permissions?.allow || [];
     this.permissionsAsk = params.permissions?.ask || [];
     this.permissionsDeny = params.permissions?.deny || [];
+    this.permissionsRegistryAllowList = params.permissions?.registryAllowList || [];
     this.permissionsAutoMode = params.permissions?.autoMode ?? {};
     this.toolInvocationGuard = params.toolInvocationGuard;
     this.toolDiscoveryCommand = params.toolDiscoveryCommand;
@@ -154969,6 +155942,16 @@ var Config = class _Config {
   getPermissionsAsk() {
     return this.permissionsAsk;
   }
+  /**
+   * Returns the allow rules that come from `settings.permissions.allow`
+   * only — never `--allowed-tools` / the SDK `allowedTools` param (merged
+   * into `getPermissionsAllow()` above) nor the legacy `tools.allowed`
+   * key. Consumed by `PermissionManager` to decide whether the
+   * registry-level allowlist is active (#9827).
+   */
+  getRegistryAllowList() {
+    return this.permissionsRegistryAllowList;
+  }
   /**
    * Returns the merged deny-rules for PermissionManager.
    *
@@ -156107,17 +157090,42 @@ var Config = class _Config {
   }
   /**
    * Whether the built-in `list_directory` tool is enabled. Opt-in: the tool
-   * is disabled by default and turns on either through the
-   * `tools.listDirectory.enabled` setting or by being explicitly listed in
-   * the `coreTools` allowlist. Entries are normalised with `parseRule` — the
-   * same parser `PermissionManager` uses to build its allowlist — so alias
-   * forms (`ListFiles`) and specifier forms (`list_directory(/src)`) match.
+   * is disabled by default and turns on through the
+   * `tools.listDirectory.enabled` setting, by being explicitly listed in the
+   * `coreTools` allowlist, or by being covered by an allow OR ask rule while
+   * the `permissions.allow` registry allowlist is active (#9827). Coverage
+   * scans the merged allow set (`getPermissionsAllow()` — settings +
+   * `--allowed-tools` + SDK `allowedTools` + legacy `tools.allowed`) so it
+   * counts exactly what `PermissionManager.isToolEnabled()` counts, while
+   * activation still comes only from `settings.permissions.allow` rules
+   * (`getRegistryAllowList()`), ignoring empty/whitespace-only entries the
+   * same way `PermissionManager.initialize`'s `parseRules` does (and
+   * skipping non-string entries, which settings load never type-validates).
+   * Entries are
+   * normalised with `parseRule` — the same parser `PermissionManager` uses —
+   * so alias forms (`ListFiles`) and specifier forms (`list_directory(/src)`)
+   * match; the check honours meta-categories (`Read`) via
+   * `toolMatchesRuleToolName`, matching the coverage semantics of the
+   * registry gate itself (`isCoveredByAllowOrAskRule`, which counts ask
+   * rules too).
    */
   isLsToolEnabled() {
     if (this.lsToolEnabled) return true;
-    return this.getCoreTools()?.some(
+    if (this.getCoreTools()?.some(
       (name) => parseRule(name).toolName === ToolNames.LS
-    ) ?? false;
+    ) ?? false) {
+      return true;
+    }
+    const coveredByPermissionRule = /* @__PURE__ */ __name((raw) => {
+      if (typeof raw !== "string" || raw.trim() === "") return false;
+      const rule = parseRule(raw);
+      return !rule.invalid && toolMatchesRuleToolName(rule.toolName, ToolNames.LS);
+    }, "coveredByPermissionRule");
+    const allowListActive = this.getRegistryAllowList().some(
+      (raw) => typeof raw === "string" && raw.trim() !== "" && !parseRule(raw).invalid
+    );
+    if (!allowListActive) return false;
+    return this.getPermissionsAllow().some(coveredByPermissionRule) || this.getPermissionsAsk().some(coveredByPermissionRule);
   }
   isAgentTeamEnabled() {
     if (process10.env["QWEN_CODE_ENABLE_AGENT_TEAM"] === "1") return true;
@@ -157212,6 +158220,11 @@ var Config = class _Config {
    * skills, user/project file commands, MCP prompts). Called by the CLI's
    * CommandService after initialisation so that the startup snapshot and
    * per-turn drain can include these in the `<available_skills>` listing.
+   *
+   * Unlike `disabledSkillNamesProvider`, late attachment (after
+   * `Config.initialize()` has warmed the tool registry) is supported:
+   * `SkillTool.validateToolParams` consults this provider live rather than
+   * relying on its construction-time snapshot (issue #9821).
    */
   setModelInvocableCommandsProvider(provider) {
     this.modelInvocableCommandsProvider = provider;
@@ -157290,7 +158303,7 @@ var Config = class _Config {
     }
     if (!enabled) return;
     registry3.registerFactory(ToolNames.IMAGE_GEN, async () => {
-      const { ImageGenTool } = await import("./image-gen-RYOBEDNB.js");
+      const { ImageGenTool } = await import("./image-gen-63NN2H5N.js");
       return new ImageGenTool(this);
     });
   }
@@ -157320,36 +158333,36 @@ var Config = class _Config {
       if (options2?.forSubAgent) return;
       const schema = this.jsonSchema;
       await registerLazy(ToolNames.STRUCTURED_OUTPUT, async () => {
-        const { SyntheticOutputTool } = await import("./syntheticOutput-3ITPRJOB.js");
+        const { SyntheticOutputTool } = await import("./syntheticOutput-5AJ444QT.js");
         return new SyntheticOutputTool(schema);
       });
     }, "registerStructuredOutputIfRequested");
     const registerGoalWorkerTools = /* @__PURE__ */ __name(async () => {
       if (options2?.forSubAgent) return;
       await registerLazy(ToolNames.GET_GOAL, async () => {
-        const { GetGoalTool } = await import("./goal-tools-FTDQHRRX.js");
+        const { GetGoalTool } = await import("./goal-tools-CNVXMSZD.js");
         return new GetGoalTool(this);
       });
       await registerLazy(ToolNames.UPDATE_GOAL, async () => {
-        const { UpdateGoalTool } = await import("./goal-tools-FTDQHRRX.js");
+        const { UpdateGoalTool } = await import("./goal-tools-CNVXMSZD.js");
         return new UpdateGoalTool(this);
       });
     }, "registerGoalWorkerTools");
     if (this.getBareMode()) {
       await registerLazy(ToolNames.READ_FILE, async () => {
-        const { ReadFileTool } = await import("./read-file-T7ESVJAQ.js");
+        const { ReadFileTool } = await import("./read-file-N3E5DY7N.js");
         return new ReadFileTool(this);
       });
       await registerLazy(ToolNames.EDIT, async () => {
-        const { EditTool } = await import("./edit-4MZYBPF5.js");
+        const { EditTool } = await import("./edit-KSPVUEAS.js");
         return new EditTool(this);
       });
       await registerLazy(ToolNames.NOTEBOOK_EDIT, async () => {
-        const { NotebookEditTool } = await import("./notebook-edit-TGU7XHIO.js");
+        const { NotebookEditTool } = await import("./notebook-edit-4ANFZON5.js");
         return new NotebookEditTool(this);
       });
       await registerLazy(ToolNames.SHELL, async () => {
-        const { ShellTool: ShellTool2 } = await import("./shell-IJYC4BVX.js");
+        const { ShellTool: ShellTool2 } = await import("./shell-LZ55AAJB.js");
         return new ShellTool2(this);
       });
       await registerGoalWorkerTools();
@@ -157361,45 +158374,45 @@ var Config = class _Config {
     }
     await registerGoalWorkerTools();
     await registerLazy(ToolNames.TOOL_SEARCH, async () => {
-      const { ToolSearchTool } = await import("./tool-search-TQNHT22X.js");
+      const { ToolSearchTool } = await import("./tool-search-SV35UV72.js");
       return new ToolSearchTool(this);
     });
     await registerLazy(ToolNames.READ_MCP_RESOURCE, async () => {
-      const { ReadMcpResourceTool } = await import("./read-mcp-resource-5QGBDZ43.js");
+      const { ReadMcpResourceTool } = await import("./read-mcp-resource-7A7NFSFL.js");
       return new ReadMcpResourceTool(this);
     });
     await registerLazy(ToolNames.AGENT, async () => {
-      const { AgentTool: AgentTool2 } = await import("./agent-TQ6CYOIL.js");
+      const { AgentTool: AgentTool2 } = await import("./agent-7U6CC5KF.js");
       return new AgentTool2(this);
     });
     await registerLazy(ToolNames.LIST_AGENTS, async () => {
-      const { ListAgentsTool } = await import("./list-agents-522ILPAR.js");
+      const { ListAgentsTool } = await import("./list-agents-EXRSHIDJ.js");
       return new ListAgentsTool(this);
     });
     await registerLazy(ToolNames.TASK_STOP, async () => {
-      const { TaskStopTool } = await import("./task-stop-I2CQSMDX.js");
+      const { TaskStopTool } = await import("./task-stop-U3S3KZG2.js");
       return new TaskStopTool(this);
     });
     await registerLazy(ToolNames.SEND_MESSAGE, async () => {
-      const { SendMessageTool } = await import("./send-message-EJUCEIKN.js");
+      const { SendMessageTool } = await import("./send-message-A2GXDX3B.js");
       return new SendMessageTool(this);
     });
     await registerLazy(ToolNames.SKILL, async () => {
-      const { SkillTool } = await import("./skill-RTZU743G.js");
+      const { SkillTool } = await import("./skill-WSZ53D2R.js");
       return new SkillTool(this);
     });
     if (this.isLsToolEnabled()) {
       await registerLazy(ToolNames.LS, async () => {
-        const { LSTool } = await import("./ls-FUCLEBTL.js");
+        const { LSTool } = await import("./ls-WFONAND2.js");
         return new LSTool(this);
       });
     }
     await registerLazy(ToolNames.READ_FILE, async () => {
-      const { ReadFileTool } = await import("./read-file-T7ESVJAQ.js");
+      const { ReadFileTool } = await import("./read-file-N3E5DY7N.js");
       return new ReadFileTool(this);
     });
     await registerLazy(ToolNames.ZOOM_IMAGE, async () => {
-      const { ZoomImageTool } = await import("./zoom-image-TCBO2YL5.js");
+      const { ZoomImageTool } = await import("./zoom-image-NYJPC3NI.js");
       return new ZoomImageTool(this);
     });
     if (this.getUseRipgrep()) {
@@ -157414,7 +158427,7 @@ var Config = class _Config {
       recordStartupEvent("config_initialize_ripgrep_probe_end");
       if (useRipgrep) {
         await registerLazy(ToolNames.GREP, async () => {
-          const { RipGrepTool } = await import("./ripGrep-KOP6AHIX.js");
+          const { RipGrepTool } = await import("./ripGrep-NEIHKBKB.js");
           return new RipGrepTool(this);
         });
       } else {
@@ -157427,7 +158440,7 @@ var Config = class _Config {
           )
         );
         await registerLazy(ToolNames.GREP, async () => {
-          const { GrepTool } = await import("./grep-QUQ3J6SR.js");
+          const { GrepTool } = await import("./grep-3NLSS32D.js");
           return new GrepTool(this);
         });
       }
@@ -157435,77 +158448,81 @@ var Config = class _Config {
       recordStartupEvent("config_initialize_ripgrep_probe_start");
       recordStartupEvent("config_initialize_ripgrep_probe_end");
       await registerLazy(ToolNames.GREP, async () => {
-        const { GrepTool } = await import("./grep-QUQ3J6SR.js");
+        const { GrepTool } = await import("./grep-3NLSS32D.js");
         return new GrepTool(this);
       });
     }
     await registerLazy(ToolNames.GLOB, async () => {
-      const { GlobTool } = await import("./glob-TWUYSRRG.js");
+      const { GlobTool } = await import("./glob-TDVEVPQZ.js");
       return new GlobTool(this);
     });
     await registerLazy(ToolNames.EDIT, async () => {
-      const { EditTool } = await import("./edit-4MZYBPF5.js");
+      const { EditTool } = await import("./edit-KSPVUEAS.js");
       return new EditTool(this);
     });
     await registerLazy(ToolNames.NOTEBOOK_EDIT, async () => {
-      const { NotebookEditTool } = await import("./notebook-edit-TGU7XHIO.js");
+      const { NotebookEditTool } = await import("./notebook-edit-4ANFZON5.js");
       return new NotebookEditTool(this);
     });
     await registerLazy(ToolNames.WRITE_FILE, async () => {
-      const { WriteFileTool } = await import("./write-file-2KVXXVWB.js");
+      const { WriteFileTool } = await import("./write-file-PWOYCT2K.js");
       return new WriteFileTool(this);
     });
     await registerLazy(ToolNames.SHELL, async () => {
-      const { ShellTool: ShellTool2 } = await import("./shell-IJYC4BVX.js");
+      const { ShellTool: ShellTool2 } = await import("./shell-LZ55AAJB.js");
       return new ShellTool2(this);
     });
     await registerLazy(ToolNames.TODO_WRITE, async () => {
-      const { TodoWriteTool } = await import("./todoWrite-ZUS3HGEF.js");
+      const { TodoWriteTool } = await import("./todoWrite-435EO2CS.js");
       return new TodoWriteTool(this);
     });
+    await registerLazy(ToolNames.REPORT_FINDINGS, async () => {
+      const { ReportFindingsTool } = await import("./report-findings-VFM5DENC.js");
+      return new ReportFindingsTool();
+    });
     const supportsUserInteraction = resolveInteractionMode(this) !== "headless";
     if (supportsUserInteraction) {
       await registerLazy(ToolNames.ASK_USER_QUESTION, async () => {
-        const { AskUserQuestionTool } = await import("./askUserQuestion-BSZALR7M.js");
+        const { AskUserQuestionTool } = await import("./askUserQuestion-ZXXERLEV.js");
         return new AskUserQuestionTool(this);
       });
     }
     if (!this.sdkMode && (supportsUserInteraction || options2?.forSubAgent)) {
       await registerLazy(ToolNames.EXIT_PLAN_MODE, async () => {
-        const { ExitPlanModeTool: ExitPlanModeTool2 } = await import("./exitPlanMode-F73VQJBO.js");
+        const { ExitPlanModeTool: ExitPlanModeTool2 } = await import("./exitPlanMode-PZG4FXRB.js");
         return new ExitPlanModeTool2(this);
       });
     }
     if (!this.sdkMode && supportsUserInteraction) {
       await registerLazy(ToolNames.ENTER_PLAN_MODE, async () => {
-        const { EnterPlanModeTool } = await import("./enterPlanMode-2EL6YAM5.js");
+        const { EnterPlanModeTool } = await import("./enterPlanMode-DZTABSKN.js");
         return new EnterPlanModeTool(this);
       });
     }
     await registerLazy(ToolNames.ENTER_WORKTREE, async () => {
-      const { EnterWorktreeTool } = await import("./enter-worktree-WNR4JUPU.js");
+      const { EnterWorktreeTool } = await import("./enter-worktree-UOZ6ZTP7.js");
       return new EnterWorktreeTool(this);
     });
     await registerLazy(ToolNames.EXIT_WORKTREE, async () => {
-      const { ExitWorktreeTool } = await import("./exit-worktree-BUHUM6YC.js");
+      const { ExitWorktreeTool } = await import("./exit-worktree-G2QATUCV.js");
       return new ExitWorktreeTool(this);
     });
     await registerLazy(ToolNames.WEB_FETCH, async () => {
-      const { WebFetchTool } = await import("./web-fetch-FUG5KGKQ.js");
+      const { WebFetchTool } = await import("./web-fetch-VFHZLLNZ.js");
       return new WebFetchTool(this);
     });
     if (resolveInteractionMode(this) === "interactive" && !this.sdkMode && !this.getScreenReader() && !options2?.forSubAgent) {
       await registerLazy(ToolNames.DISPLAY_IMAGE, async () => {
-        const { DisplayImageTool } = await import("./display-image-HOBBUJS5.js");
+        const { DisplayImageTool } = await import("./display-image-DR55LL6M.js");
         return new DisplayImageTool(this);
       });
     }
     if (this.webSearchSettings?.enabled) {
-      const { evaluateWebSearchGate } = await import("./web-search-SO3LHSHP.js");
+      const { evaluateWebSearchGate } = await import("./web-search-AQE5A4J5.js");
       const gate = evaluateWebSearchGate(this);
       if (gate.ok) {
         await registerLazy(ToolNames.WEB_SEARCH, async () => {
-          const { WebSearchTool } = await import("./web-search-SO3LHSHP.js");
+          const { WebSearchTool } = await import("./web-search-AQE5A4J5.js");
           return new WebSearchTool(this);
         });
       } else if (!this.webSearchNoticeEmitted && !options2?.forSubAgent) {
@@ -157516,87 +158533,87 @@ var Config = class _Config {
     await this.registerImageGenerationTool(registry3);
     if (this.isArtifactEnabled()) {
       await registerLazy(ToolNames.ARTIFACT, async () => {
-        const { ArtifactTool } = await import("./artifact-tool-UQTNZDUF.js");
+        const { ArtifactTool } = await import("./artifact-tool-XDJCZZCF.js");
         return new ArtifactTool(this);
       });
     }
     if (this.isRecordArtifactEnabled()) {
       await registerLazy(ToolNames.RECORD_ARTIFACT, async () => {
-        const { RecordArtifactTool } = await import("./record-artifact-K6BYYWXY.js");
+        const { RecordArtifactTool } = await import("./record-artifact-CPJ4IJSD.js");
         return new RecordArtifactTool(this);
       });
     }
     if (this.isLspEnabled() && this.getLspClient()) {
       await registerLazy(ToolNames.LSP, async () => {
-        const { LspTool } = await import("./lsp-FYP6TW4R.js");
+        const { LspTool } = await import("./lsp-DUKPDUXN.js");
         return new LspTool(this);
       });
     }
     await registerStructuredOutputIfRequested();
     if (this.isCronEnabled()) {
       await registerLazy(ToolNames.CRON_CREATE, async () => {
-        const { CronCreateTool } = await import("./cron-create-P4CPPO25.js");
+        const { CronCreateTool } = await import("./cron-create-IJGVR5R2.js");
         return new CronCreateTool(this);
       });
       await registerLazy(ToolNames.CRON_LIST, async () => {
-        const { CronListTool } = await import("./cron-list-QPML4MWL.js");
+        const { CronListTool } = await import("./cron-list-2CATIPUX.js");
         return new CronListTool(this);
       });
       await registerLazy(ToolNames.CRON_DELETE, async () => {
-        const { CronDeleteTool } = await import("./cron-delete-FPD75GL4.js");
+        const { CronDeleteTool } = await import("./cron-delete-4N5BI6GL.js");
         return new CronDeleteTool(this);
       });
       await registerLazy(ToolNames.LOOP_WAKEUP, async () => {
-        const { LoopWakeupTool } = await import("./loop-wakeup-VSA4TBIC.js");
+        const { LoopWakeupTool } = await import("./loop-wakeup-XBPB2BRO.js");
         return new LoopWakeupTool(this);
       });
     }
     if (this.getSubSessionSpawner()) {
       await registerLazy(ToolNames.CREATE_SUB_SESSION, async () => {
-        const { CreateSubSessionTool } = await import("./create-sub-session-5ZLCAS2P.js");
+        const { CreateSubSessionTool } = await import("./create-sub-session-RVHSWVAP.js");
         return new CreateSubSessionTool(this);
       });
     }
     if (this.isAgentTeamEnabled()) {
       await registerLazy(ToolNames.TEAM_CREATE, async () => {
-        const { TeamCreateTool } = await import("./team-create-IU2A6HD3.js");
+        const { TeamCreateTool } = await import("./team-create-UF4TMQEH.js");
         return new TeamCreateTool(this);
       });
       await registerLazy(ToolNames.TEAM_DELETE, async () => {
-        const { TeamDeleteTool } = await import("./team-delete-E4C4AMPF.js");
+        const { TeamDeleteTool } = await import("./team-delete-YWFXX77L.js");
         return new TeamDeleteTool(this);
       });
       await registerLazy(ToolNames.TEAM_PLAN_APPROVAL, async () => {
-        const { TeamPlanApprovalTool } = await import("./team-plan-approval-BWI43D37.js");
+        const { TeamPlanApprovalTool } = await import("./team-plan-approval-U57NSR6C.js");
         return new TeamPlanApprovalTool(this);
       });
       if (!options2?.forSubAgent) {
         await registerLazy(ToolNames.REQUEST_SHUTDOWN, async () => {
-          const { RequestShutdownTool } = await import("./request-shutdown-EUXDG4IH.js");
+          const { RequestShutdownTool } = await import("./request-shutdown-AXVOFN5C.js");
           return new RequestShutdownTool(this);
         });
       }
       await registerLazy(ToolNames.TASK_CREATE, async () => {
-        const { TaskCreateTool } = await import("./task-create-USIZE733.js");
+        const { TaskCreateTool } = await import("./task-create-CDJSOEQD.js");
         return new TaskCreateTool(this);
       });
       await registerLazy(ToolNames.TASK_UPDATE, async () => {
-        const { TaskUpdateTool } = await import("./task-update-TFF2KJGL.js");
+        const { TaskUpdateTool } = await import("./task-update-77VCFDDZ.js");
         return new TaskUpdateTool(this);
       });
       await registerLazy(ToolNames.TASK_LIST, async () => {
-        const { TaskListTool } = await import("./task-list-AWAJUPIP.js");
+        const { TaskListTool } = await import("./task-list-BELMPA75.js");
         return new TaskListTool(this);
       });
     }
     if (this.isWorkflowsEnabled()) {
       await registerLazy(ToolNames.WORKFLOW, async () => {
-        const { WorkflowTool } = await import("./workflow-XJRA3GRI.js");
+        const { WorkflowTool } = await import("./workflow-XL6AEUZ7.js");
         return new WorkflowTool(this);
       });
     }
     await registerLazy(ToolNames.MONITOR, async () => {
-      const { MonitorTool } = await import("./monitor-AU2SG5OL.js");
+      const { MonitorTool } = await import("./monitor-A4J5QRGJ.js");
       return new MonitorTool(this);
     });
     if (this.pendingMcpBudgetCallback) {
@@ -158055,6 +159072,7 @@ export {
   fetchGitLog,
   fetchGitCommitDetail,
   FILE_HISTORY_DIR,
+  hasVerifiableInode,
   SESSION_ARTIFACT_PERSISTENCE_VERSION,
   WORKSPACE_CONTENT_SHA256_METADATA_KEY,
   WORKSPACE_CONTENT_MTIME_MS_METADATA_KEY,
@@ -158087,12 +159105,16 @@ export {
   SessionTranscriptReader,
   SessionWriterError,
   SESSION_WRITER_RPC_CODES,
+  SessionTranscriptChangedError,
   SessionWriterUnavailableError,
+  SessionTranscriptIdentityUnavailableError,
   BranchPointInvalidError,
+  SessionStorageEntryError,
   SessionIdCaseConflictError,
   SESSION_TITLE_MAX_LENGTH,
   SessionService,
   computeUniqueBranchTitle,
+  normalizeDerivedBranchTitle,
   tryGenerateSessionTitle,
   TURN_RESULT_TEXT_MAX_CHARS,
   TURN_RESULT_CODE_TEXT_TRUNCATED,