@qwen-code/qwen-code 0.22.2 → 0.22.3

package/chunks/{chunk-4K7NQDCG.js → chunk-T4EFG2P5.js}

@@ -49,7 +49,8 @@ __name(getModelConfiguration, "getModelConfiguration");
 function buildModelReasoningConfigOption(modelId, state = {}) {
   const reasoning = getModelConfiguration(modelId)?.reasoning;
   if (!reasoning?.thinking) return void 0;
-  const currentValue = state.enabled === false ? REASONING_EFFORT_NONE : reasoning.toggleOnly ? REASONING_EFFORT_DEFAULT : reasoning.efforts.find((effort) => effort === state.effort) ?? reasoning.defaultEffort;
+  const thinkingMandatory = state.thinkingMandatory === true;
+  const currentValue = state.enabled === false && !thinkingMandatory ? REASONING_EFFORT_NONE : reasoning.toggleOnly ? REASONING_EFFORT_DEFAULT : reasoning.efforts.find((effort) => effort === state.effort) ?? reasoning.defaultEffort;
   return {
     id: "reasoning_effort",
     name: "Reasoning effort",
@@ -58,11 +59,13 @@ function buildModelReasoningConfigOption(modelId, state = {}) {
     type: "select",
     currentValue,
     options: [
-      {
-        value: REASONING_EFFORT_NONE,
-        name: "Thinking off",
-        description: "Disable thinking for this session"
-      },
+      ...thinkingMandatory ? [] : [
+        {
+          value: REASONING_EFFORT_NONE,
+          name: "Thinking off",
+          description: "Disable thinking for this session"
+        }
+      ],
       ...reasoning.toggleOnly ? [
         {
           value: REASONING_EFFORT_DEFAULT,
@@ -76,15 +79,21 @@ function buildModelReasoningConfigOption(modelId, state = {}) {
       }))
     ],
     _meta: {
-      "qwenCode/reasoning": reasoning.toggleOnly ? { toggleOnly: true } : { defaultEffort: reasoning.defaultEffort }
+      "qwenCode/reasoning": reasoning.toggleOnly ? {
+        toggleOnly: true,
+        ...thinkingMandatory ? { thinkingMandatory: true } : {}
+      } : {
+        defaultEffort: reasoning.defaultEffort,
+        ...thinkingMandatory ? { thinkingMandatory: true } : {}
+      }
     }
   };
 }
 __name(buildModelReasoningConfigOption, "buildModelReasoningConfigOption");
-function buildModelReasoningConfigPreview(modelId) {
+function buildModelReasoningConfigPreview(modelId, state = {}) {
   const reasoning = getModelConfiguration(modelId)?.reasoning;
   if (!reasoning?.thinking || reasoning.toggleOnly) return void 0;
-  const option = buildModelReasoningConfigOption(modelId);
+  const option = buildModelReasoningConfigOption(modelId, state);
   return option ? [option] : void 0;
 }
 __name(buildModelReasoningConfigPreview, "buildModelReasoningConfigPreview");

package/chunks/{chunk-TWSKM647.js → chunk-T7KMERIX.js}

@@ -17,7 +17,7 @@ import {
   isLoaderEnvKey,
   publishPendingCompileCache,
   reportRejectedLoaderKeys
-} from "./chunk-5PA6UEYA.js";
+} from "./chunk-MZCJWS5Y.js";
 import {
   buildTrustPrecedenceRules,
   require_strip_json_comments,

package/chunks/{chunk-77RG5SFQ.js → chunk-TEBDFQBZ.js}

@@ -563,7 +563,7 @@ var WorkspaceRegistrationStore = class {
     return removed;
   }
   async update(mutate) {
-    const { atomicWriteFile } = await import("./deferred-core-runtime-BBVIOP24.js");
+    const { atomicWriteFile } = await import("./deferred-core-runtime-WOYLUQQ7.js");
     return withInProcessLock(this.filePath, async () => {
       const lock = await acquireFileLock(this.filePath);
       let committed = false;

package/chunks/{chunk-6CGL7E7G.js → chunk-TVC6HQ2U.js}

@@ -6,8 +6,8 @@ import {
 
 // packages/cli/src/generated/git-commit.ts
 init_esbuild_shims();
-var GIT_COMMIT_INFO = "0d573e4527";
-var CLI_VERSION = "0.22.2";
+var GIT_COMMIT_INFO = "09825973e7";
+var CLI_VERSION = "0.22.3";
 
 export {
   GIT_COMMIT_INFO,

package/chunks/{chunk-BBWV7ONL.js → chunk-TZBSGJ6C.js}

@@ -2,23 +2,23 @@
 "use strict";
 import {
   mapSkillConfigToStatus
-} from "./chunk-BGXZBI5B.js";
+} from "./chunk-N4X7G4J2.js";
 import {
   resolveSkillSettings
-} from "./chunk-Z4X5MTRT.js";
+} from "./chunk-HCOBAG2L.js";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-JHS74YAB.js";
+} from "./chunk-KID24ZFN.js";
 import {
   loadSettings
-} from "./chunk-F7TNAPZ4.js";
+} from "./chunk-AIAOIFY4.js";
 import {
   SkillManager,
   isSafeModeEnv
-} from "./chunk-TGWAQ5RB.js";
+} from "./chunk-PZ66FRIC.js";
 import {
   writeStderrLine
-} from "./chunk-KGJGEEVR.js";
+} from "./chunk-7FA2II6K.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-T3WXYEZ4.js → chunk-U54AYGEC.js}

@@ -42,6 +42,10 @@ function getConversationDirectoryName(storageSessionId) {
   return `conversation-${createHash("sha256").update(storageSessionId).digest("hex")}`;
 }
 __name(getConversationDirectoryName, "getConversationDirectoryName");
+function getConversationStagedDirectoryName(storageSessionId) {
+  return `${getConversationDirectoryName(storageSessionId)}.deleting`;
+}
+__name(getConversationStagedDirectoryName, "getConversationStagedDirectoryName");
 function validateDirectoryStats(stats, scope) {
   if (stats.isSymbolicLink() || !stats.isDirectory()) {
     throw new ConversationDirectoryIdentityError(scope, "not_directory");
@@ -67,14 +71,15 @@ function isSameDirectoryIdentity(before, after) {
 }
 __name(isSameDirectoryIdentity, "isSameDirectoryIdentity");
 function hasExpectedDirectoryIdentity(identity, expected) {
-  const inodesProvable = hasVerifiableInode(identity.inode) && hasVerifiableInode(expected.inode);
-  return identity.storageSessionId === expected.storageSessionId && identity.name === expected.name && isSameConversationPath(identity.canonicalPath, expected.canonicalPath) && identity.device === expected.device && (!inodesProvable || identity.inode === expected.inode) && isSameConversationPath(
+  const identityInodeVerifiable = hasVerifiableInode(identity.inode);
+  const expectedInodeVerifiable = hasVerifiableInode(expected.inode);
+  return identity.storageSessionId === expected.storageSessionId && identity.name === expected.name && isSameConversationPath(identity.canonicalPath, expected.canonicalPath) && identity.device === expected.device && identityInodeVerifiable === expectedInodeVerifiable && (!identityInodeVerifiable || identity.inode === expected.inode) && isSameConversationPath(
     identity.root.configuredRoot,
     expected.root.configuredRoot
   ) && isSameConversationPath(
     identity.root.canonicalRoot,
     expected.root.canonicalRoot
-  ) && identity.root.device === expected.root.device && (!identity.root.inodeVerifiable || !expected.root.inodeVerifiable || identity.root.inode === expected.root.inode);
+  ) && identity.root.device === expected.root.device && identity.root.inodeVerifiable === expected.root.inodeVerifiable && (!identity.root.inodeVerifiable || identity.root.inode === expected.root.inode);
 }
 __name(hasExpectedDirectoryIdentity, "hasExpectedDirectoryIdentity");
 async function createConversationRootIdentity(configuredRoot) {
@@ -176,9 +181,8 @@ async function assertExactConversationRootIdentity(root, candidate) {
   return root;
 }
 __name(assertExactConversationRootIdentity, "assertExactConversationRootIdentity");
-async function inspectConversationDirectoryIdentity(root, storageSessionId, expected) {
+async function inspectConversationNamedDirectoryIdentity(root, storageSessionId, name, expected) {
   await revalidateConversationRootIdentity(root);
-  const name = getConversationDirectoryName(storageSessionId);
   const candidate = join(root.canonicalRoot, name);
   let before;
   try {
@@ -222,7 +226,33 @@ async function inspectConversationDirectoryIdentity(root, storageSessionId, expe
   }
   return identity;
 }
+__name(inspectConversationNamedDirectoryIdentity, "inspectConversationNamedDirectoryIdentity");
+async function inspectConversationDirectoryIdentity(root, storageSessionId, expected) {
+  return inspectConversationNamedDirectoryIdentity(
+    root,
+    storageSessionId,
+    getConversationDirectoryName(storageSessionId),
+    expected
+  );
+}
 __name(inspectConversationDirectoryIdentity, "inspectConversationDirectoryIdentity");
+async function inspectConversationStagedDirectoryIdentity(root, storageSessionId) {
+  return inspectConversationNamedDirectoryIdentity(
+    root,
+    storageSessionId,
+    getConversationStagedDirectoryName(storageSessionId)
+  );
+}
+__name(inspectConversationStagedDirectoryIdentity, "inspectConversationStagedDirectoryIdentity");
+function isSameConversationDirectoryObject(identity, expected) {
+  const identityInodeVerifiable = hasVerifiableInode(identity.inode);
+  const expectedInodeVerifiable = hasVerifiableInode(expected.inode);
+  return identity.storageSessionId === expected.storageSessionId && identity.device === expected.device && identityInodeVerifiable === expectedInodeVerifiable && (!identityInodeVerifiable || identity.inode === expected.inode) && isSameConversationPath(
+    identity.root.canonicalRoot,
+    expected.root.canonicalRoot
+  ) && identity.root.device === expected.root.device && identity.root.inodeVerifiable === expected.root.inodeVerifiable && (!identity.root.inodeVerifiable || identity.root.inode === expected.root.inode);
+}
+__name(isSameConversationDirectoryObject, "isSameConversationDirectoryObject");
 async function materializeConversationDirectoryIdentity(root, storageSessionId) {
   await revalidateConversationRootIdentity(root);
   const name = getConversationDirectoryName(storageSessionId);
@@ -286,10 +316,13 @@ export {
   ConversationDirectoryIdentityError,
   isSameConversationPath,
   getConversationDirectoryName,
+  getConversationStagedDirectoryName,
   createConversationRootIdentity,
   revalidateConversationRootIdentity,
   assertExactConversationRootIdentity,
   inspectConversationDirectoryIdentity,
+  inspectConversationStagedDirectoryIdentity,
+  isSameConversationDirectoryObject,
   materializeConversationDirectoryIdentity
 };
 /**

package/chunks/{chunk-JCQD3INC.js → chunk-URE3QBBB.js}

@@ -5,7 +5,7 @@ import {
   isTranscribableVoiceModel,
   readVoiceLanguage,
   resolveVoiceTransport
-} from "./chunk-XRSOI3DL.js";
+} from "./chunk-A3LWD5MK.js";
 import {
   resolvePath
 } from "./chunk-YTDVNSUQ.js";

package/chunks/{chunk-Y3QL45LS.js → chunk-V4264FEG.js}

@@ -716,7 +716,7 @@ function anthropicTools(value) {
   return result;
 }
 __name(anthropicTools, "anthropicTools");
-function geminiTools(value) {
+function llmTools(value) {
   if (!Array.isArray(value)) return void 0;
   const result = [];
   for (const wrapper of value) {
@@ -734,7 +734,7 @@ function geminiTools(value) {
   }
   return result;
 }
-__name(geminiTools, "geminiTools");
+__name(llmTools, "llmTools");
 function extractOpenAiContent(request) {
   const value = request;
   return {
@@ -756,7 +756,7 @@ function extractAnthropicContent(request) {
   };
 }
 __name(extractAnthropicContent, "extractAnthropicContent");
-function extractGeminiContent(request) {
+function extractLlmContent(request) {
   const value = request;
   const config = record(value["config"]);
   return {
@@ -766,10 +766,10 @@ function extractGeminiContent(request) {
       (role) => role === "model" ? "assistant" : role
     ) : void 0,
     systemInstructions: config && Object.hasOwn(config, "systemInstruction") ? systemParts(config["systemInstruction"], geminiPart) : void 0,
-    toolDefinitions: config && Object.hasOwn(config, "tools") ? geminiTools(config["tools"]) : void 0
+    toolDefinitions: config && Object.hasOwn(config, "tools") ? llmTools(config["tools"]) : void 0
   };
 }
-__name(extractGeminiContent, "extractGeminiContent");
+__name(extractLlmContent, "extractLlmContent");
 function stringifyGenAiJson(value, maxLength, requireObject = false) {
   const converted = jsonValue(value);
   if (converted === void 0 || requireObject && (converted === null || Array.isArray(converted) || typeof converted !== "object")) {
@@ -1032,7 +1032,7 @@ var GenAiOutputAccumulator = class {
       if (finishReason) candidate.finishReason = finishReason;
     }
   }
-  recordGeminiResponse(response) {
+  recordLlmResponse(response) {
     const candidates = response["candidates"];
     if (!Array.isArray(candidates)) return;
     this.observedResponse = true;
@@ -1061,7 +1061,7 @@ var GenAiOutputAccumulator = class {
       if (finishReason) outputCandidate.finishReason = finishReason;
     }
   }
-  recordGeminiChunk(chunk) {
+  recordLlmChunk(chunk) {
     const candidates = chunk["candidates"];
     if (!Array.isArray(candidates)) return;
     this.observedResponse = true;
@@ -1241,7 +1241,7 @@ var GenAiOutputAccumulator = class {
 export {
   extractOpenAiContent,
   extractAnthropicContent,
-  extractGeminiContent,
+  extractLlmContent,
   stringifyGenAiJson,
   GenAiOutputAccumulator
 };

package/chunks/{chunk-KEKZFOL6.js → chunk-V7EESTJV.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   parseRule
-} from "./chunk-TGWAQ5RB.js";
+} from "./chunk-PZ66FRIC.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-R4PMVSR5.js → chunk-VBCPNIQD.js}

@@ -7,7 +7,7 @@ import {
   OpenAIContentConverter,
   TaggedThinkingParser,
   openaiRequestCaptureContext
-} from "./chunk-4J657AJR.js";
+} from "./chunk-DJECZIJX.js";
 import {
   safeJsonParse
 } from "./chunk-ABS25QER.js";
@@ -18,18 +18,22 @@ import {
   reportOpenAiChunk,
   reportOpenAiRequest,
   reportOpenAiResponse
-} from "./chunk-B7CDU2SL.js";
+} from "./chunk-KYWTPLBJ.js";
 import {
   applyOfficialOpenAIPromptCaching,
   isOfficialOpenAIEndpoint
-} from "./chunk-SAH4BD2J.js";
+} from "./chunk-PQEISIKS.js";
 import {
   DashScopeOpenAICompatibleProvider,
   DefaultOpenAICompatibleProvider
-} from "./chunk-PDMJ3KGS.js";
+} from "./chunk-EB6QRGHM.js";
 import {
   getCurrentAgentId
 } from "./chunk-CMHFCLBU.js";
+import {
+  InvalidStreamError,
+  getToolCallPreparations
+} from "./chunk-CFKIH3D3.js";
 import {
   DEFAULT_STREAM_IDLE_TIMEOUT_MS,
   DEFAULT_STREAM_MAX_LIFETIME_MS,
@@ -42,23 +46,17 @@ import {
   createChildAbortController
 } from "./chunk-DJ2GSRLV.js";
 import {
+  getRateLimitErrorDetails,
   getTransportCode
-} from "./chunk-J2OSJFP3.js";
-import {
-  InvalidStreamError,
-  getToolCallPreparations
-} from "./chunk-CFKIH3D3.js";
-import {
-  getRateLimitErrorDetails
-} from "./chunk-4FTKQNWJ.js";
+} from "./chunk-DYXFD5RO.js";
 import {
   ProtocolTagSanitizedEvent,
   logProtocolTagSanitized
-} from "./chunk-L2M46FP5.js";
+} from "./chunk-QYMAKPY5.js";
 import {
   isQwenFamilyWireModel,
   isTieredEffortWireModel
-} from "./chunk-YRLW2MSX.js";
+} from "./chunk-XBVNNDPK.js";
 import {
   reconcileMaxTokens
 } from "./chunk-FPGTNKCP.js";
@@ -1063,7 +1061,7 @@ var StreamContentError = class extends Error {
 var StreamInactivityTimeoutError = class extends Error {
   constructor(idleMs, chunksReceived, streamLifetimeMs) {
     super(
-      `No stream activity for ${idleMs}ms after ${chunksReceived} chunks (stream lifetime: ${streamLifetimeMs}ms). Set ${QWEN_STREAM_IDLE_TIMEOUT_MS_ENV} to increase this window (or 0 to disable it).`
+      `No stream activity for ${idleMs}ms after ${chunksReceived} chunks (stream lifetime: ${streamLifetimeMs}ms). For provider-backed models, increase modelProviders[providerId][].generationConfig.streamIdleTimeoutMs; provider configuration takes precedence, so model.generationConfig is ignored for those models. For runtime models, increase model.generationConfig.streamIdleTimeoutMs. Built-in Qwen OAuth models cannot be overridden via settings. Use ${QWEN_STREAM_IDLE_TIMEOUT_MS_ENV} for them or whenever no explicit value is active. Set the active value to 0 to disable it.`
     );
     this.idleMs = idleMs;
     this.chunksReceived = chunksReceived;
@@ -1301,11 +1299,11 @@ var ContentGenerationPipeline = class {
             }
           );
           reportOpenAiResponse(telemetryAttempt, openaiResponse);
-          const geminiResponse = OpenAIContentConverter.convertOpenAIResponseToGemini(
+          const llmResponse = OpenAIContentConverter.convertOpenAIResponseToLlm(
             openaiResponse,
             context
           );
-          return geminiResponse;
+          return llmResponse;
         } finally {
           perRequestAc?.abort();
         }
@@ -1426,7 +1424,7 @@ var ContentGenerationPipeline = class {
           const errorContent = chunk.choices?.[0]?.delta?.content?.trim() || "Unknown stream error";
           throw new StreamContentError(errorContent);
         }
-        const response = OpenAIContentConverter.convertOpenAIChunkToGemini(
+        const response = OpenAIContentConverter.convertOpenAIChunkToLlm(
           chunk,
           context
         );
@@ -1585,7 +1583,7 @@ var ContentGenerationPipeline = class {
     return true;
   }
   async buildRequest(request, userPromptId, context, isStreaming) {
-    const messages = OpenAIContentConverter.convertGeminiRequestToOpenAI(
+    const messages = OpenAIContentConverter.convertLlmRequestToOpenAI(
       request,
       context
     );
@@ -1602,7 +1600,7 @@ var ContentGenerationPipeline = class {
       baseRequest.stream = false;
     }
     if (request.config?.tools && request.config.tools.length > 0) {
-      baseRequest.tools = await OpenAIContentConverter.convertGeminiToolsToOpenAI(
+      baseRequest.tools = await OpenAIContentConverter.convertLlmToolsToOpenAI(
         request.config.tools,
         this.contentGeneratorConfig.schemaCompliance ?? "auto"
       );

package/chunks/{chunk-RJC5EIKY.js → chunk-VGIFXISB.js}

@@ -2,14 +2,14 @@
 "use strict";
 import {
   GIT_COMMIT_INFO
-} from "./chunk-6CGL7E7G.js";
+} from "./chunk-TVC6HQ2U.js";
 import {
   getCliVersion
-} from "./chunk-7UYV53BC.js";
+} from "./chunk-Q2MSPKIJ.js";
 import {
   IdeClient,
   formatMemoryUsage
-} from "./chunk-TGWAQ5RB.js";
+} from "./chunk-PZ66FRIC.js";
 import {
   createDebugLogger
 } from "./chunk-UHQFIS7N.js";

package/chunks/{chunk-Z7FLBQPR.js → chunk-W3JH33JE.js}

@@ -410,18 +410,18 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
   try {
     if (authType === "openai" /* USE_OPENAI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-SUCYANUZ.js");
+        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-J6QIF7EX.js");
         return createOpenAIContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "qwen-oauth" /* QWEN_OAUTH */) {
-      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-RF33DNZW.js");
+      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-OF5WRBQT.js");
       try {
         const qwenClient = await getQwenOauthClient(
           config,
           isInitialAuth ? { requireCachedCredentials: true } : void 0
         );
         loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-          const { QwenContentGenerator } = await import("./qwenContentGenerator-J4TXFGJT.js");
+          const { QwenContentGenerator } = await import("./qwenContentGenerator-WWDXPYQI.js");
           return new QwenContentGenerator(qwenClient, generatorConfig, config);
         }, "loadBaseGenerator");
       } catch (error) {
@@ -432,13 +432,13 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       }
     } else if (authType === "anthropic" /* USE_ANTHROPIC */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-HGMBACVE.js");
+        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-YVTB6QX7.js");
         return createAnthropicContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "gemini" /* USE_GEMINI */ || authType === "vertex-ai" /* USE_VERTEX_AI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createGeminiContentGenerator } = await import("./geminiContentGenerator-PUNEBWJW.js");
-        return createGeminiContentGenerator(generatorConfig, config);
+        const { createLlmContentGenerator } = await import("./llm-content-generator-AY2QKXHE.js");
+        return createLlmContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else {
       throw new Error(
@@ -452,7 +452,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
     try {
       const [baseGenerator, { LoggingContentGenerator }] = await Promise.all([
         loadBaseGenerator(),
-        import("./loggingContentGenerator-2GGZNGLG.js")
+        import("./loggingContentGenerator-DSFQHXIF.js")
       ]);
       return new LoggingContentGenerator(
         baseGenerator,

package/chunks/{chunk-K2NQPH5D.js → chunk-WGY3AVGM.js}

@@ -5,14 +5,14 @@ import {
 } from "./chunk-E7REAOTN.js";
 import {
   t
-} from "./chunk-LDP5OD6N.js";
+} from "./chunk-CLWO3B77.js";
 import {
   findProviderByCredentials,
   resolveMetadataKey
-} from "./chunk-KUX5D6DK.js";
+} from "./chunk-NV55WWD6.js";
 import {
   fetchGitDiff
-} from "./chunk-TGWAQ5RB.js";
+} from "./chunk-PZ66FRIC.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-PKAYJDB3.js → chunk-WNPDGUJO.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   hasControlCharacter
-} from "./chunk-6IUNAPLR.js";
+} from "./chunk-K5KXUXWC.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
@@ -36,6 +36,11 @@ var FINDING_SOURCES = [
   "probe",
   "lint"
 ];
+var FINDING_DIRECTIONS = [
+  "certifies-falsely",
+  "fails-closed"
+];
+var FINDING_BASELINES = ["regression", "new-surface"];
 var REPORT_FINDINGS_LEVELS = ["low", "medium", "high"];
 var REPORT_FINDINGS_MAX = 50;
 var SHORT_SUMMARY_MAX = 60;
@@ -53,7 +58,7 @@ function compressFindingSummary(summary, max = SHORT_SUMMARY_MAX) {
   return `${cut.trimEnd()}\u2026`;
 }
 __name(compressFindingSummary, "compressFindingSummary");
-var DESCRIPTION = `Reports code-review findings as typed data so clients (the terminal UI, the Web Shell, ACP hosts) can render a per-finding list. Use it only when an active review flow (such as the bundled review skill) instructs you to report findings with it; otherwise present findings as ordinary text. Call it once per report with the complete list, most severe first \u2014 a later call replaces the whole list, it never appends. When the review wrote a findings artifact, copy each field verbatim from it (id, severity, confidence, source, file/line, summary, shortSummary, failureScenario, category); do not re-derive or re-word values \u2014 the artifact is the oracle.
+var DESCRIPTION = `Reports code-review findings as typed data so clients (the terminal UI, the Web Shell, ACP hosts) can render a per-finding list. Use it only when an active review flow (such as the bundled review skill) instructs you to report findings with it; otherwise present findings as ordinary text. Call it once per report with the complete list, most severe first \u2014 a later call replaces the whole list, it never appends. When the review wrote a findings artifact, copy each field verbatim from it (id, severity, confidence, source, file/line, summary, shortSummary, failureScenario, category, direction, baseline); do not re-derive or re-word values \u2014 the artifact is the oracle.
 
 After fixes are applied \u2014 at the review's own fix step, or ANY later time in the session a reported finding's disposition changes \u2014 call it again with the same findings, each carrying "outcome" ("fixed", "skipped", or "no_change_needed"; "outcomeNote" for the reason). Client per-finding status trusts only a call that carries outcomes, and a call where some findings carry an outcome and others do not is refused: account for every finding.
 
@@ -109,6 +114,16 @@ var FINDING_ITEM_SCHEMA = {
       maxLength: 64,
       description: 'Free-form kebab-case tag ("correctness", "security", "test-coverage", \u2026).'
     },
+    direction: {
+      type: "string",
+      enum: [...FINDING_DIRECTIONS],
+      description: 'Which way a Critical fails, from the artifact: "certifies-falsely" (a wrong result presented as correct) or "fails-closed" (refuses, wedges or degrades without a wrong result). Omit when the artifact carries none.'
+    },
+    baseline: {
+      type: "string",
+      enum: [...FINDING_BASELINES],
+      description: 'What a Critical is measured against, from the artifact: "regression" (the merge base handled the trigger correctly) or "new-surface" (the failing path does not exist at the merge base). Omit when the artifact carries none.'
+    },
     outcome: {
       type: "string",
       enum: [...FINDING_OUTCOMES],
@@ -172,6 +187,8 @@ function normalizeFinding(raw) {
     shortSummary: compressFindingSummary(shortSource),
     failureScenario: raw.failureScenario.trim(),
     ...raw.category?.trim() ? { category: raw.category.trim() } : {},
+    ...raw.direction ? { direction: raw.direction } : {},
+    ...raw.baseline ? { baseline: raw.baseline } : {},
     ...raw.outcome ? { outcome: raw.outcome } : {},
     ...raw.outcomeNote?.trim() ? { outcomeNote: raw.outcomeNote.trim() } : {}
   };
@@ -332,6 +349,8 @@ export {
   FINDING_CONFIDENCES,
   FINDING_OUTCOMES,
   FINDING_SOURCES,
+  FINDING_DIRECTIONS,
+  FINDING_BASELINES,
   REPORT_FINDINGS_LEVELS,
   REPORT_FINDINGS_MAX,
   SHORT_SUMMARY_MAX,

package/chunks/{chunk-IZIVM7LZ.js → chunk-WXEA74YB.js}

@@ -3,7 +3,7 @@
 import {
   getTasksDir,
   sanitizeName
-} from "./chunk-SFPGAQUL.js";
+} from "./chunk-42IDLQWS.js";
 import {
   require_proper_lockfile
 } from "./chunk-MLXTMF7H.js";

package/chunks/{chunk-YRLW2MSX.js → chunk-XBVNNDPK.js}

@@ -41,7 +41,9 @@ var MODALITY_PATTERNS = [
   [/^qwen3\.5-plus/, { image: true, video: true }],
   [/^qwen3\.6-plus/, { image: true, video: true }],
   [/^qwen3\.7-plus/, { image: true, video: true }],
-  // Qwen Max models (3.8+): image support
+  // Qwen 3.8 series: flash/plus support image + video; max supports image only
+  [/^qwen3\.8-flash/, { image: true, video: true }],
+  [/^qwen3\.8-plus/, { image: true, video: true }],
   [/^qwen3\.8-max/, { image: true }],
   [/^coder-model$/, { image: true, video: true }],
   // Qwen VL (vision-language) models: image + video
@@ -53,13 +55,18 @@ var MODALITY_PATTERNS = [
   [/^qwen3\.6-35b/, { image: true, video: true }],
   [/^qwen/, {}],
   // -------------------
-  // DeepSeek — text-only
+  // DeepSeek — text-only, except explicit vision variants
+  // (QwenLM/qwen-code#10270)
   // -------------------
+  [/^deepseek-.*vision/, { image: true }],
   [/^deepseek/, {}],
   // -------------------
-  // Zhipu GLM
+  // Zhipu GLM — v-suffix ids are vision models; others are text-only
+  // (QwenLM/qwen-code#10270)
   // -------------------
-  [/^glm-4\.5v/, { image: true }],
+  [/^glm-[0-9.]+v/, { image: true }],
+  // glm-5.3-flash natively integrates vision input (no v suffix)
+  [/^glm-5\.3-flash/, { image: true }],
   [/^glm-5(?:-|$)/, {}],
   [/^glm-/, {}],
   // -------------------

package/chunks/{chunk-IK5BW3CS.js → chunk-XHF7WQ6B.js}

@@ -9,10 +9,10 @@ import {
   publishPendingCompileCache,
   reportRejectedLoaderKeys,
   resetLoaderKeyRejectionReportingForTesting
-} from "./chunk-5PA6UEYA.js";
+} from "./chunk-MZCJWS5Y.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-V4QXXQJ2.js";
+} from "./chunk-MF7HCQWZ.js";
 import {
   require_main
 } from "./chunk-5M6IDOMF.js";