@qwen-code/qwen-code 0.23.1-preview.1 → 0.23.1

package/chunks/{chunk-RDKXZ2LS.js → chunk-LYT2OU7D.js}

@@ -23,7 +23,7 @@ import {
 } from "./chunk-F53KKZUD.js";
 import {
   ToolNames
-} from "./chunk-RPBMP6BN.js";
+} from "./chunk-MWIO7MF6.js";
 import {
   Storage,
   createDebugLogger,

package/chunks/{chunk-SAZS4IWW.js → chunk-LZGFVUWZ.js}

@@ -2,15 +2,15 @@
 "use strict";
 import {
   multiSessionCompatibilityError
-} from "./chunk-TMWB67LS.js";
+} from "./chunk-UXDVUFKU.js";
 import {
   UNSAFE_OBJECT_KEYS,
   getPlugin
-} from "./chunk-4IQKBLTQ.js";
+} from "./chunk-UHUT4IDM.js";
 import {
   loadSettings,
   saveSettings
-} from "./chunk-AQ5NAGWI.js";
+} from "./chunk-66JBCTJF.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-32YDNYXP.js → chunk-M73KHGNR.js}

@@ -16,9 +16,12 @@ import {
 import {
   isInternalWorkspaceRuntime
 } from "./chunk-NYWWQ437.js";
+import {
+  conversationRuntimeUnavailableError
+} from "./chunk-2Z3T52OC.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-WEXA2DNG.js";
+} from "./chunk-PSPAM24S.js";
 import {
   parseToolWriteOriginMeta
 } from "./chunk-GELRJXE2.js";
@@ -1783,6 +1786,10 @@ var SERVE_CAPABILITY_REGISTRY = {
   workspace_skill_settings_toggle: { since: "v1" },
   workspace_skill_settings_batch_toggle: { since: "v1" },
   extension_batch_activation_v2: { since: "v1" },
+  // Extension activation commits do not refresh active sessions. Clients that
+  // need immediate runtime application must submit the independent refresh
+  // operation after the activation operation commits.
+  extension_activation_explicit_refresh: { since: "v1" },
   workspace_skill_manage: { since: "v1" },
   workspace_settings: { since: "v1" },
   // `GET /workspace/permissions` is always available when this tag is
@@ -2024,6 +2031,11 @@ var SERVE_CAPABILITY_REGISTRY = {
   // Worktree-backed session create/load responses are durably persisted and
   // carry per-response `persisted-v1` attestation.
   session_worktree_persistence_v1: { since: "v1" },
+  // Worktree ownership transfer: `POST /session/:id/worktree-reset` moves a
+  // session's checkout ownership to a fresh replacement session, and the
+  // restore surface reports the superseded / interrupted / missing-marker
+  // classifications as typed 409s.
+  session_worktree_reset_v1: { since: "v1" },
   // Workspace-qualified ACP transport (issue #6378 Phase 4):
   // `/workspaces/:workspace/acp` mounts a per-runtime ACP dispatcher (HTTP +
   // WebSocket) for each registered workspace, with per-runtime device-flow and
@@ -2702,58 +2714,6 @@ async function createManagedScratchDirectory(root) {
 }
 __name(createManagedScratchDirectory, "createManagedScratchDirectory");
 
-// packages/cli/src/serve/conversations/conversation-runtime-errors.ts
-init_esbuild_shims();
-var DEFAULT_MESSAGES = {
-  conversation_runtime_in_use: "The Conversations runtime is owned by another daemon.",
-  conversation_runtime_unavailable: "The Conversations runtime is temporarily unavailable.",
-  conversation_root_compromised: "The Conversations root could not be verified.",
-  conversation_runtime_ownership_compromised: "The Conversations runtime ownership state could not be verified."
-};
-var ConversationRuntimeOwnershipError = class extends Error {
-  constructor(code, retryable, options) {
-    super(DEFAULT_MESSAGES[code], options);
-    this.code = code;
-    this.retryable = retryable;
-    this.name = "ConversationRuntimeOwnershipError";
-  }
-  static {
-    __name(this, "ConversationRuntimeOwnershipError");
-  }
-  status = 503;
-};
-function conversationRuntimeInUseError() {
-  return new ConversationRuntimeOwnershipError(
-    "conversation_runtime_in_use",
-    true
-  );
-}
-__name(conversationRuntimeInUseError, "conversationRuntimeInUseError");
-function conversationRuntimeUnavailableError(cause) {
-  return new ConversationRuntimeOwnershipError(
-    "conversation_runtime_unavailable",
-    true,
-    { cause }
-  );
-}
-__name(conversationRuntimeUnavailableError, "conversationRuntimeUnavailableError");
-function conversationRuntimeOwnershipCompromisedError(cause) {
-  return new ConversationRuntimeOwnershipError(
-    "conversation_runtime_ownership_compromised",
-    false,
-    { cause }
-  );
-}
-__name(conversationRuntimeOwnershipCompromisedError, "conversationRuntimeOwnershipCompromisedError");
-function conversationRootCompromisedError(cause) {
-  return new ConversationRuntimeOwnershipError(
-    "conversation_root_compromised",
-    false,
-    { cause }
-  );
-}
-__name(conversationRootCompromisedError, "conversationRootCompromisedError");
-
 // packages/cli/src/serve/serve-app-lifecycle.ts
 init_esbuild_shims();
 var SERVE_APP_LIFECYCLE = Symbol("qwen.serveAppLifecycle");
@@ -2781,7 +2741,6 @@ var ServeAppLifecycleController = class {
   listenerClosed = false;
   sealed = false;
   closePending;
-  ownership;
   appDrain;
   hostDrain;
   bootStarter;
@@ -2837,12 +2796,6 @@ var ServeAppLifecycleController = class {
     });
     return pending;
   }
-  setOwnership(ownership) {
-    if (this.ownership) {
-      throw new Error("Serve app lifecycle ownership is already configured.");
-    }
-    this.ownership = ownership;
-  }
   setAppDrain(drain) {
     this.appDrain = drain;
   }
@@ -2926,7 +2879,6 @@ var ServeAppLifecycleController = class {
     if (errors.length > 1) {
       throw new AggregateError(errors, "Serve app shutdown is incomplete.");
     }
-    await this.ownership?.release();
   }
   startDrain(drain) {
     if (!drain) return void 0;
@@ -4564,11 +4516,6 @@ export {
   isScratchRootCompatible,
   prepareManagedScratchRoot,
   createManagedScratchDirectory,
-  ConversationRuntimeOwnershipError,
-  conversationRuntimeInUseError,
-  conversationRuntimeUnavailableError,
-  conversationRuntimeOwnershipCompromisedError,
-  conversationRootCompromisedError,
   ServeAppLifecycleController,
   installServeAppLifecycle,
   createRateLimiter,

package/chunks/{chunk-ADJD4LZF.js → chunk-MA5OUNN6.js}

@@ -6,7 +6,7 @@ import {
   MAX_STREAM_GUARD_TIMEOUT_MS,
   QWEN_STREAM_IDLE_TIMEOUT_MS_ENV,
   QWEN_STREAM_MAX_LIFETIME_MS_ENV
-} from "./chunk-2LD5U7Q3.js";
+} from "./chunk-6YEOCHSE.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-2RYWGYB3.js → chunk-MFYH2VXV.js}

@@ -5,15 +5,15 @@ import {
 } from "./chunk-47ECGEJC.js";
 import {
   t
-} from "./chunk-MUZCSTOO.js";
+} from "./chunk-CRZBDVP2.js";
 import {
   findProviderByCredentials,
   resolveMetadataKey
-} from "./chunk-UEZOXZNI.js";
+} from "./chunk-ZU2T5JIS.js";
 import {
   fetchGitDiff,
   isCompressionFailureStatus
-} from "./chunk-I72PHOKL.js";
+} from "./chunk-PDUMGZ2P.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-RPBMP6BN.js → chunk-MWIO7MF6.js}

@@ -15644,6 +15644,9 @@ var BaseToolInvocation = class {
   requiresUserInteraction() {
     return false;
   }
+  canAutoApproveOnAllow() {
+    return true;
+  }
   /**
    * Default fallback: returns a generic 'info' confirmation dialog using the
    * tool's getDescription(). This ensures that even tools whose

package/chunks/{chunk-OECNP26L.js → chunk-N6S3NUYJ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   isTool
-} from "./chunk-RPBMP6BN.js";
+} from "./chunk-MWIO7MF6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-5MTARK4Y.js → chunk-N7YQEKGX.js}

@@ -411,18 +411,18 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
   try {
     if (authType === "openai" /* USE_OPENAI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-7ND7K5CP.js");
+        const { createOpenAIContentGenerator } = await import("./openaiContentGenerator-NSU3ERBH.js");
         return createOpenAIContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "qwen-oauth" /* QWEN_OAUTH */) {
-      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-BS5D2LYV.js");
+      const { getQwenOAuthClient: getQwenOauthClient } = await import("./qwenOAuth2-KX6LVYQ3.js");
       try {
         const qwenClient = await getQwenOauthClient(
           config,
           isInitialAuth ? { requireCachedCredentials: true } : void 0
         );
         loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-          const { QwenContentGenerator } = await import("./qwenContentGenerator-AELTUTH6.js");
+          const { QwenContentGenerator } = await import("./qwenContentGenerator-HTA57WFC.js");
           return new QwenContentGenerator(qwenClient, generatorConfig, config);
         }, "loadBaseGenerator");
       } catch (error) {
@@ -433,12 +433,12 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
       }
     } else if (authType === "anthropic" /* USE_ANTHROPIC */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-6XDHXIII.js");
+        const { createAnthropicContentGenerator } = await import("./anthropicContentGenerator-I7LQZH26.js");
         return createAnthropicContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else if (authType === "gemini" /* USE_GEMINI */ || authType === "vertex-ai" /* USE_VERTEX_AI */) {
       loadBaseGenerator = /* @__PURE__ */ __name(async () => {
-        const { createLlmContentGenerator } = await import("./llm-content-generator-R4NL3OQN.js");
+        const { createLlmContentGenerator } = await import("./llm-content-generator-VLMZ2A7A.js");
         return createLlmContentGenerator(generatorConfig, config);
       }, "loadBaseGenerator");
     } else {
@@ -453,7 +453,7 @@ async function createContentGenerator(generatorConfig, config, isInitialAuth) {
     try {
       const [baseGenerator, { LoggingContentGenerator }] = await Promise.all([
         loadBaseGenerator(),
-        import("./loggingContentGenerator-ZYSWVNEO.js")
+        import("./loggingContentGenerator-RGVUMUVX.js")
       ]);
       return new LoggingContentGenerator(
         baseGenerator,

package/chunks/{chunk-XOVVCGZX.js → chunk-NB3NDQQK.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   t
-} from "./chunk-MUZCSTOO.js";
+} from "./chunk-CRZBDVP2.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-NOO4QFXM.js

@@ -0,0 +1,171 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  createDebugLogger
+} from "./chunk-ZAFYHRVY.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/core/outbound-session-id.ts
+init_esbuild_shims();
+
+// packages/core/src/core/outbound-dynamic-headers.ts
+init_esbuild_shims();
+var debugLogger = createDebugLogger("OUTBOUND_CORRELATION");
+var PLACEHOLDERS = [{ token: "${session_id}", resolve: /* @__PURE__ */ __name((config) => config.getSessionId(), "resolve") }];
+var SESSION_ID_PLACEHOLDER_PATTERN = /\$(?:session_id|QWEN_CODE_SESSION_ID)(?!\w)|\$\{(?:session_id|QWEN_CODE_SESSION_ID)\}/gi;
+var warnedGateOff = /* @__PURE__ */ new Set();
+function warnIfDynamicHeadersDisabled(customHeaders, config) {
+  try {
+    const names = Object.entries(customHeaders ?? {}).filter(
+      ([, value]) => typeof value === "string" && hasDynamicPlaceholder(value)
+    ).map(([name]) => name);
+    if (names.length === 0) return;
+    if (config.getOutboundAllowDynamicHeaderValues()) return;
+    const key = names.slice().sort().join(",");
+    if (warnedGateOff.has(key)) return;
+    warnedGateOff.add(key);
+    console.warn(
+      `customHeaders ${names.join(", ")} contain a runtime placeholder, but outboundCorrelation.allowDynamicHeaderValues is not enabled \u2014 the header(s) will not be sent. Set it to true in settings.json to allow the value to be filled in per request.`
+    );
+  } catch {
+  }
+}
+__name(warnIfDynamicHeadersDisabled, "warnIfDynamicHeadersDisabled");
+function hasDynamicPlaceholder(value) {
+  return value.search(SESSION_ID_PLACEHOLDER_PATTERN) !== -1;
+}
+__name(hasDynamicPlaceholder, "hasDynamicPlaceholder");
+function resolveDynamicHeaderValue(value, config) {
+  if (typeof value !== "string") return void 0;
+  if (!hasDynamicPlaceholder(value)) return value;
+  try {
+    if (!config.getOutboundAllowDynamicHeaderValues()) {
+      debugLogger.warn(
+        `Dropping a customHeaders value containing a runtime placeholder: outboundCorrelation.allowDynamicHeaderValues is not enabled.`
+      );
+      return void 0;
+    }
+    let expanded = value.replace(
+      SESSION_ID_PLACEHOLDER_PATTERN,
+      "${session_id}"
+    );
+    for (const { token, resolve } of PLACEHOLDERS) {
+      if (!expanded.includes(token)) continue;
+      const resolved = resolve(config);
+      if (!resolved) return void 0;
+      expanded = expanded.split(token).join(resolved);
+    }
+    return expanded;
+  } catch (error) {
+    debugLogger.warn(
+      `Unable to expand a customHeaders placeholder: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return void 0;
+  }
+}
+__name(resolveDynamicHeaderValue, "resolveDynamicHeaderValue");
+function applyDynamicHeaderValues(headers, config) {
+  const pending = [];
+  headers.forEach((value, key) => {
+    if (hasDynamicPlaceholder(value)) pending.push([key, value]);
+  });
+  for (const [key, value] of pending) {
+    const resolved = resolveDynamicHeaderValue(value, config);
+    if (resolved === void 0) {
+      headers.delete(key);
+    } else {
+      headers.set(key, resolved);
+    }
+  }
+}
+__name(applyDynamicHeaderValues, "applyDynamicHeaderValues");
+function expandDynamicHeaders(customHeaders, config) {
+  if (!customHeaders) return {};
+  const expanded = {};
+  for (const [key, value] of Object.entries(customHeaders)) {
+    if (typeof value !== "string" || !hasDynamicPlaceholder(value)) continue;
+    const resolved = resolveDynamicHeaderValue(value, config);
+    if (resolved !== void 0) expanded[key] = resolved;
+  }
+  return expanded;
+}
+__name(expandDynamicHeaders, "expandDynamicHeaders");
+
+// packages/core/src/core/outbound-session-id.ts
+var debugLogger2 = createDebugLogger("OUTBOUND_CORRELATION");
+var SESSION_ID_HEADER = "session_id";
+var SESSION_ID_HEADER_HOSTS = [
+  "routify.alibaba-inc.com",
+  "routify-online.alibaba-inc.com",
+  "routify-pub.alibaba-inc.com"
+];
+function requestUrl(input) {
+  try {
+    if (typeof input === "string") return new URL(input);
+    if (input instanceof URL) return input;
+    return new URL(input.url);
+  } catch {
+    return void 0;
+  }
+}
+__name(requestUrl, "requestUrl");
+function buildSessionIdHeaders(config, destination) {
+  try {
+    const url = requestUrl(destination);
+    if (url?.protocol !== "https:" || !SESSION_ID_HEADER_HOSTS.includes(url.hostname.toLowerCase())) {
+      return {};
+    }
+    const sessionId = config.getSessionId();
+    return sessionId ? { [SESSION_ID_HEADER]: sessionId } : {};
+  } catch (error) {
+    debugLogger2.warn(
+      `Unable to add ${SESSION_ID_HEADER} to outbound request: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return {};
+  }
+}
+__name(buildSessionIdHeaders, "buildSessionIdHeaders");
+function wrapFetchWithSessionId(baseFetch, config, customHeaders) {
+  const fetchLike = baseFetch;
+  const expandsHeaders = Object.values(customHeaders ?? {}).some(
+    (value) => typeof value === "string" && hasDynamicPlaceholder(value)
+  );
+  if (expandsHeaders) warnIfDynamicHeadersDisabled(customHeaders, config);
+  const wrapped = /* @__PURE__ */ __name(async (input, init) => {
+    const sessionHeaders = buildSessionIdHeaders(config, input);
+    const sessionId = sessionHeaders[SESSION_ID_HEADER];
+    if (!sessionId && !expandsHeaders) return fetchLike(input, init);
+    const headers = new Headers(
+      input instanceof Request ? input.headers : void 0
+    );
+    new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+    if (expandsHeaders) applyDynamicHeaderValues(headers, config);
+    if (sessionId) headers.set(SESSION_ID_HEADER, sessionId);
+    return fetchLike(input, { ...init, headers });
+  }, "wrapped");
+  return wrapped;
+}
+__name(wrapFetchWithSessionId, "wrapFetchWithSessionId");
+function buildSessionAwareFetch(runtimeFetch, config, customHeaders) {
+  const baseFetch = runtimeFetch ?? globalThis.fetch;
+  return wrapFetchWithSessionId(baseFetch, config, customHeaders);
+}
+__name(buildSessionAwareFetch, "buildSessionAwareFetch");
+
+export {
+  warnIfDynamicHeadersDisabled,
+  hasDynamicPlaceholder,
+  expandDynamicHeaders,
+  buildSessionIdHeaders,
+  buildSessionAwareFetch
+};
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-NGX4NUNP.js → chunk-O2FEO2CB.js}

@@ -2,10 +2,10 @@
 "use strict";
 import {
   escapeXml
-} from "./chunk-FKJM6JKY.js";
+} from "./chunk-G6UUOCUT.js";
 import {
   ToolNames
-} from "./chunk-RPBMP6BN.js";
+} from "./chunk-MWIO7MF6.js";
 import {
   createDebugLogger
 } from "./chunk-ZAFYHRVY.js";
@@ -18,7 +18,84 @@ import {
 
 // packages/core/src/tools/skill-utils.ts
 init_esbuild_shims();
-var debugLogger = createDebugLogger("SKILL");
+
+// packages/core/src/hooks/registerSkillHooks.ts
+init_esbuild_shims();
+var debugLogger = createDebugLogger("SKILL_HOOKS");
+function registerSkillHooks(sessionHooksManager, sessionId, skill) {
+  if (!skill.hooks) {
+    debugLogger.debug(`Skill '${skill.name}' has no hooks to register`);
+    return 0;
+  }
+  const hooksSettings = skill.hooks;
+  let registeredCount = 0;
+  for (const eventName of Object.keys(hooksSettings)) {
+    const matchers = hooksSettings[eventName];
+    if (!matchers) continue;
+    for (const matcher of matchers) {
+      const matcherPattern = matcher.matcher || "";
+      for (const hook of matcher.hooks) {
+        if (hook.type === "function" /* Function */) {
+          debugLogger.debug(
+            "Skipping function hook from skill (not supported in frontmatter)"
+          );
+          continue;
+        }
+        const hookConfig = prepareHookConfig(
+          hook,
+          skill.skillRoot
+        );
+        const alreadyRegistered = sessionHooksManager.getHooksForEvent(sessionId, eventName).some(
+          (entry) => entry.matcher === matcherPattern && entry.skillRoot === skill.skillRoot && hookConfigKey(entry.config) === hookConfigKey(hookConfig)
+        );
+        if (alreadyRegistered) {
+          debugLogger.debug(
+            `Hook for ${eventName} with matcher '${matcherPattern}' from skill '${skill.name}' already registered; skipping duplicate`
+          );
+          continue;
+        }
+        sessionHooksManager.addSessionHook(
+          sessionId,
+          eventName,
+          matcherPattern,
+          hookConfig,
+          { skillRoot: skill.skillRoot, trustGated: skill.level === "project" }
+        );
+        registeredCount++;
+        debugLogger.debug(
+          `Registered hook for ${eventName} with matcher '${matcherPattern}' from skill '${skill.name}'`
+        );
+      }
+    }
+  }
+  if (registeredCount > 0) {
+    debugLogger.info(
+      `Registered ${registeredCount} hooks from skill '${skill.name}'`
+    );
+  }
+  return registeredCount;
+}
+__name(registerSkillHooks, "registerSkillHooks");
+function hookConfigKey(hook) {
+  return `${hook.type}:${JSON.stringify(hook)}`;
+}
+__name(hookConfigKey, "hookConfigKey");
+function prepareHookConfig(hook, skillRoot) {
+  if (hook.type === "command" && skillRoot) {
+    return {
+      ...hook,
+      env: {
+        ...hook.env,
+        QWEN_SKILL_ROOT: skillRoot
+      }
+    };
+  }
+  return hook;
+}
+__name(prepareHookConfig, "prepareHookConfig");
+
+// packages/core/src/tools/skill-utils.ts
+var debugLogger2 = createDebugLogger("SKILL");
 function buildSkillLlmContent(baseDir, body) {
   return `Base directory for this skill: ${baseDir}
 Important: ALWAYS resolve absolute paths from this base directory when working with skills.
@@ -145,11 +222,55 @@ function applySkillAllowedTools(permissionManager, allowedTools, options) {
   }
 }
 __name(applySkillAllowedTools, "applySkillAllowedTools");
+function applySkillHooks(config, skill) {
+  if (!skill.hooks || Object.keys(skill.hooks).length === 0) {
+    return;
+  }
+  const hookSystem = config.getHookSystem();
+  const sessionId = config.getSessionId();
+  if (!hookSystem || !sessionId) {
+    debugLogger2.warn(
+      `Skipping hook registration for skill "${skill.name}": no hook system or session id (hooks disabled?)`
+    );
+    return;
+  }
+  const count = registerSkillHooks(
+    hookSystem.getSessionHooksManager(),
+    sessionId,
+    skill
+  );
+  if (count > 0) {
+    debugLogger2.info(`Registered ${count} hooks from skill "${skill.name}"`);
+  } else {
+    debugLogger2.debug(
+      `No new hooks registered from skill "${skill.name}" (already registered or none registrable)`
+    );
+  }
+}
+__name(applySkillHooks, "applySkillHooks");
+function applySkillSideEffects(config, skill) {
+  if (!config) {
+    return;
+  }
+  if (!canApplySkillSideEffects(skill, config)) {
+    if (skill.allowedTools?.length || skill.hooks) {
+      debugLogger2.warn(
+        `Skill "${skill.name}" is a project skill in an untrusted folder; ignoring its allowedTools and hooks.`
+      );
+    }
+    return;
+  }
+  applySkillAllowedTools(config.getPermissionManager(), skill.allowedTools, {
+    trustGated: skill.level === "project"
+  });
+  applySkillHooks(config, skill);
+}
+__name(applySkillSideEffects, "applySkillSideEffects");
 function clearLoadedSkillTracking(toolRegistry, logTag) {
   const tool = toolRegistry?.getTool(ToolNames.SKILL);
   if (tool && "clearLoadedSkills" in tool) {
     tool.clearLoadedSkills();
-    debugLogger.debug(
+    debugLogger2.debug(
       `[SKILL_TRACKING] conservatively cleared loaded-skill tracking after ${logTag}`
     );
   }
@@ -161,10 +282,14 @@ export {
   clearCollectedSkillEntriesCache,
   collectAvailableSkillEntries,
   renderAvailableSkillsBlock,
-  canApplySkillSideEffects,
-  applySkillAllowedTools,
+  applySkillSideEffects,
   clearLoadedSkillTracking
 };
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /**
  * @license
  * Copyright 2025 Qwen

package/chunks/{chunk-XHGGYCTA.js → chunk-O2JBJQCF.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   getEffectiveSupportedModes
-} from "./chunk-2RYWGYB3.js";
+} from "./chunk-MFYH2VXV.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-LPBQODMR.js → chunk-OESZTXTG.js}

@@ -3,17 +3,17 @@
 import {
   getGitVersion,
   getNpmVersion
-} from "./chunk-P6LATTDG.js";
+} from "./chunk-5IL2BZHW.js";
 import {
   buildEnvStatusFromEnv,
   snapshotProcessEnv
-} from "./chunk-4HC4DYKN.js";
+} from "./chunk-6RZX2HIH.js";
 import {
   mapDomainErrorToErrorKind
-} from "./chunk-KPXRFTT7.js";
+} from "./chunk-FETY36NQ.js";
 import {
   canUseRipgrep
-} from "./chunk-PZV2FASB.js";
+} from "./chunk-TRWQQBVH.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-UKADFFL2.js → chunk-OFVAS4AR.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   delay
-} from "./chunk-EJNYBDYC.js";
+} from "./chunk-HNLMYDQE.js";
 import {
   isTlsVerificationDisabled
 } from "./chunk-4HOEU2OR.js";

package/chunks/{chunk-TDP7UULF.js → chunk-OPMKGOLD.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   registerCleanup
-} from "./chunk-BKNY7PDI.js";
+} from "./chunk-USN6VNTO.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-LDS57224.js → chunk-OWCFKIFQ.js}

@@ -8,7 +8,7 @@ import {
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-RPBMP6BN.js";
+} from "./chunk-MWIO7MF6.js";
 import {
   isNodeError
 } from "./chunk-ZAFYHRVY.js";