@qwen-code/qwen-code 0.23.3-nightly.20260913.faa395885e → 0.23.4-dev.codemode-responses.20260914.87437db784

package/bundled/computer-use/SKILL.md

@@ -17,7 +17,7 @@ If `node_repl` is unavailable, run:
 
 ```bash
 qwen mcp add --scope user node-repl npx -y @qwen-code/node-repl-mcp@0.1.4
-npm install --no-save --package-lock=false @qwen-code/cua-sdk@0.20.6
+npm install --no-save --package-lock=false @qwen-code/cua-sdk@0.20.7
 ```
 
 Tell the user to restart Qwen Code, then stop. If only the SDK import is missing,

package/bundled/qc-helper/docs/features/channels/dws.md

@@ -67,7 +67,7 @@ without interactive confirmations:
 YOLO mode auto-approves every tool call. Use it only for a trusted bot account
 and workspace.
 
-`senderPolicy` and `groupPolicy` default to `pairing` for a newly managed DWS channel. Approve a user or group with the code returned by the channel:
+`senderPolicy` and `groupPolicy` default to `pairing` for a newly managed DWS channel. `dmPolicy` defaults to `open`, including existing configurations that omit it. Approve a user or group with the code returned by the channel:
 
 ```bash
 qwen channel pairing approve dws-work CODE
@@ -75,6 +75,10 @@ qwen channel pairing approve dws-work CODE
 
 `senderPolicy` controls direct-message senders, document-notification authors, native-todo creators, and senders in `open` or `allowlist` groups. `groupPolicy` controls group conversations. An approved pairing group follows the shared channel behavior and authorizes its members; open and allowlist groups must also pass `senderPolicy`.
 
+Group and direct-message access can be configured independently. For a group-only channel, set `dmPolicy: "disabled"` and choose an enabled `groupPolicy`. For a direct-message-only channel, set `groupPolicy: "disabled"` and `dmPolicy: "open"`. Direct-message access also controls document notifications. Native todo polling remains controlled separately by `watchTodos`.
+
+Disabled chat sources are not subscribed to or polled, and their messages cannot start new tasks through late callbacks or persisted replay. Pending work and history cursors are retained: after re-enabling a source, the existing recovery mechanism may process older messages, including messages from the disabled interval. Sender authorization, group pairing, and mention requirements still apply.
+
 `groups` controls mention behavior. A concrete group ID overrides `"*"`. With `requireMention: true`, only an @ message wakes the channel. With `requireMention: false`, ordinary messages are also received after the group and sender policies pass.
 
 Group mentions use the real-time personal event stream first. The channel also checks recent `@` message history every five seconds, so mentions from external groups are recovered when DingTalk omits them from the personal event stream. Messages are deduplicated by conversation and message ID across both paths.

package/bundled/qc-helper/docs/features/code-review.md

@@ -414,7 +414,7 @@ The exit code is the contract a gate should read:
 
 `--resume` continues an interrupted review of the same PR instead of starting over — when a long local run dies part-way (a dropped connection, a timeout, a killed terminal), the retry would otherwise re-fetch, re-chunk and re-launch agents whose work is already on disk. It is safe to pass unconditionally on a retry: `fetch-pr` rules on the on-disk state itself (worktree still at the fetched SHA and clean, diff bytes unchanged, PR head unmoved, resume cap unspent) and silently falls back to a fresh review whenever anything no longer matches, so the flag never fails a run that could start over. When the current invocation has only the built-in target default, a continuation stays pinned to the interrupted run's recorded effort. An explicit `--effort`, a project-remembered level, the operator `review.effort` setting, or an effective `--comment` supplies a required level; a mismatch refuses the resume and runs fresh at that level. PR targets only (a local review's diff is captured from a live working tree, which has no stable interrupted state to continue). Resume is a **local convenience**: the repository's own CI review workflow does **not** resume — each retry re-runs fresh, because a CI attempt runs no-sandbox and its worktree is deleted on exit, leaving no interrupted state to continue.
 
-A time-budgeted run can also export a **soft** deadline so the review stops its open-ended reverse-audit loop while there is still time to verify, compose and post: `QWEN_REVIEW_DEADLINE_EPOCH` is the Unix-seconds moment the run will be killed, and `QWEN_REVIEW_DEADLINE_RESERVE_SECONDS` (default 4800; `0` keeps only the round estimate) is the tail that must remain for the last round's verification, `compose-review` and submission. When the remaining budget no longer fits another round plus that tail, the round builder refuses to build it, and the composed verdict discloses the truncated audit (an otherwise-Approve verdict is capped at Comment). Without that variable the review uses the wall its plan recorded at capture: `--deadline <minutes>` on `qwen review fetch-pr` / `capture-local` / `plan-diff`, or by default **8 hours** on a small (Step 3A) diff, **12** on a large (3B) one and **16** on a huge one. That default is a liveness bound — sized above what a healthy run at the round cap spends — so it ends a loop that has stopped converging and leaves a run that keeps working untouched; it is charged in elapsed time, idle included, so a session left overnight spends it, and because the next round is priced from the previous round's admission, a multi-hour pause between rounds can stop a run with time still on the wall (a `--resume` from a new session restarts both the wall and the pricing). It stops the loop at the next round admission or verify build; it does not interrupt a build already running. A plan-recorded wall keeps a third of itself (capped at 4800 seconds, floored at the compose floor) as the tail reserve unless the reserve variable is set; a `--deadline` that cannot hold a convergence (two rounds plus that reserve — at or under ninety minutes, or more when the shell's reserve or compose-floor overrides raise the bar; that second leg is skipped while the environment exports a well-formed epoch, since the flag is inert then, and the wall it records is priced again in whatever shell a later env-less `--resume` runs in) is refused up front, and a wall just above it can still stop before round 1 once the fan-out and verification have spent it. When the wall can no longer admit a rebuild the coverage check would otherwise prescribe (a reverse-audit round, or a verifier shard under the compose floor), `compose-review` withholds that `FIX:` line and prints a `NOTE:` line saying so, with the gate's arithmetic; the gap is still disclosed in the posted body. The plan wall bounds the round builder and the verifier; two readers stay on the environment alone — the generated review workflow's launch allowance, and `qwen review run`'s own `--timeout-minutes` kill, which is not exported as a deadline. The plan stores the wall as a duration from the attempt's start, so a `--resume` from a new session renews it (a same-session resume continues the attempt and its wall; the flag itself is ignored on a resumed run — only its grammar and the default rule are checked — and the run says what wall the plan holds and how much of it is left, or that it has run out, and which builds the gates will now refuse; a wall can only run out on a same-session resume, or when the ledger failed to record the attempt, so the cheapest way past it is to resume from a new session, which renews the wall and keeps the worktree; a fresh review without `--resume` records a new wall too, and `--deadline none` on that fresh capture records none). `--deadline none` records no wall and leaves the loop bounded by the round cap alone — unless the environment exports an epoch, which clocks the run regardless. The `/review` slash command does not take the flag: it warns and drops it together with a value that could be one (whole minutes, or `none` — so a PR number typed right after it is dropped too), while any other value after it is disposed of like an invalid `--effort` value (a PR URL becomes the target; a typo is reported, and survives only as a sole file-shaped token), and a skill-driven run always uses the default. The huge tier's round reduction (3 rounds instead of 5) keys on an explicit deadline only — the environment's or the flag's — never on the default. A malformed environment deadline falls through to the plan's wall; a malformed plan field leaves the review ungated — the outer timeout still bounds the run.
+A time-budgeted run can also export a **soft** deadline so the review stops its open-ended reverse-audit loop while there is still time to verify, compose and post: `QWEN_REVIEW_DEADLINE_EPOCH` is the Unix-seconds moment the run will be killed, and `QWEN_REVIEW_DEADLINE_RESERVE_SECONDS` (default 4800; `0` keeps only the round estimate) is the tail that must remain for the last round's verification, `compose-review` and submission. When the remaining budget no longer fits another round plus that tail, the round builder refuses to build it, and the composed verdict discloses the truncated audit (an otherwise-Approve verdict is capped at Comment). Without that variable the review uses the wall its plan recorded at capture: `--deadline <minutes>` on `qwen review fetch-pr` / `capture-local` / `plan-diff`, or by default **8 hours** on a small (Step 3A) diff, **12** on a large (3B) one and **16** on a huge one. That default is a liveness bound — sized above what a healthy run at the round cap spends — so it ends a loop that has stopped converging and leaves a run that keeps working untouched; it is charged in elapsed time, idle included, so a session left overnight spends it, and because the next round is priced from the previous round's admission, a multi-hour pause between rounds can stop a run with time still on the wall (a `--resume` from a new session restarts both the wall and the pricing; **Review Deadline** below gives the ceilings). It stops the loop at the next round admission or verify build; it does not interrupt a build already running. A plan-recorded wall keeps a third of itself (capped at 4800 seconds, floored at the compose floor) as the tail reserve unless the reserve variable is set; a `--deadline` that cannot hold a convergence (two rounds plus that reserve — at or under ninety minutes, or more when the shell's reserve or compose-floor overrides raise the bar; that second leg is skipped while the environment exports a well-formed epoch, since the flag is inert then, and the wall it records is priced again in whatever shell a later env-less `--resume` runs in) is refused up front, and a wall just above it can still stop before round 1 once the fan-out and verification have spent it. When the wall can no longer admit a rebuild the coverage check would otherwise prescribe (a reverse-audit round, or a verifier shard under the compose floor), `compose-review` withholds that `FIX:` line and prints a `NOTE:` line saying so, with the gate's arithmetic; the gap is still disclosed in the posted body. The plan wall bounds the round builder and the verifier; two readers stay on the environment alone — the generated review workflow's launch allowance, and `qwen review run`'s own `--timeout-minutes` kill, which is not exported as a deadline. The plan stores the wall as a duration from the attempt's start, so a `--resume` from a new session renews it (a same-session resume continues the attempt and its wall; the flag itself is ignored on a resumed run — only its grammar and the default rule are checked — and the run says what wall the plan holds and how much of it is left, or that it has run out, and which builds the gates will now refuse; a wall can only run out on a same-session resume, or when the ledger failed to record the attempt, so the cheapest way past it is to resume from a new session, which renews the wall and keeps the worktree; a fresh review without `--resume` records a new wall too, and `--deadline none` on that fresh capture records none). `--deadline none` records no wall and leaves the loop bounded by the round cap alone — unless the environment exports an epoch, which clocks the run regardless. The `/review` slash command does not take the flag: it warns and drops it together with a value that could be one (whole minutes, or `none` — so a PR number typed right after it is dropped too), while any other value after it is disposed of like an invalid `--effort` value (a PR URL becomes the target; a typo is reported, and survives only as a sole file-shaped token), and a skill-driven run always uses the default. The huge tier's round reduction (3 rounds instead of 5) keys on an explicit deadline only — the environment's or the flag's — never on the default. A malformed environment deadline falls through to the plan's wall; a malformed plan field leaves the review ungated — the outer timeout still bounds the run.
 
 Nested inside that reserve is a smaller **compose floor**, `QWEN_REVIEW_DEADLINE_COMPOSE_FLOOR_SECONDS` (default 1200; `0` disables this gate entirely, at every point including past the deadline). The reserve is one number covering "verify the last round **plus** compose **plus** submit", which fits a normal per-finding re-trace but not a security review whose verification re-runs real filesystem/git workloads without bound. So the verifier — not the round builder — is gated on this floor: once the floor or less remains, `agent-prompt --role verify` refuses to build (a `VERIFY BUDGET:` line, exit **4**), the findings in hand keep their unverified tag (which caps the verdict), and `compose-review` and submission run. Under the plan's own rule the floor never exceeds the reserve (a plan-recorded wall's reserve can sit exactly on it), and the round gate prices the round on top of the reserve, so a healthy run hits the reverse-audit gate first and never reaches it (an explicit `QWEN_REVIEW_DEADLINE_RESERVE_SECONDS` below the floor — `0` is the documented escape hatch — is the operator's choice, and then the verifier's gate can fire first); it is the cover for the one span the reserve cannot bound.
 
@@ -447,6 +447,20 @@ Two things it deliberately does not do. It **never scales a dimension away**: wh
 
 Why the floors are where they are: on a nine-line typo fix, six inline walks are five walks over nothing, and the sweep — a fresh reader hunting what the first pass did not get to — has nothing to hunt when the first pass got to all of it. When a low-effort pass stays below `candidateFloor`, it takes one deterministic second look at every coverable hunk in the largest changed source file (falling back to the largest coverable file of any kind) and every coverable removed block. Files touching an uncoverable chunk are excluded from the target selection, and the pass always emits a receipt naming its target, new-candidate count, and any uncoverable chunks; when no file is coverable, it still checks the coverable removed blocks and discloses the missing target. The floor is a stopping signal, not a quota: a clean diff can still report no findings after that re-pass. Agent 8's floor is the substantive one: "one domain dominates the diff" is a judgement, and a judgement made about forty lines finds a dominant domain every time, because forty lines are usually all one thing.
 
+## Review Deadline
+
+Every review records a wall clock in its plan unless it was captured with `--deadline none` — `--deadline <minutes>` on `qwen review fetch-pr`, `capture-local` or `plan-diff`, otherwise **8 hours** on a small diff, **12** on a large one and **16** on a huge one — and a `QWEN_REVIEW_DEADLINE_EPOCH` exported by CI replaces it. At `high` effort the wall ends the reverse-audit loop at the first round it can no longer admit, and at `high` and `medium` effort it stops the verifier once no more than the compose floor remains; it never interrupts an agent that is already running. A review stopped this way composes its verdict with the stop disclosed and the verdict capped, verifies the last round's findings only while more than the compose floor remains, and reports what it proved like any other review. Running `/review` again does not continue the stopped audit: at `high` effort a PR review follows the Incremental Review rules above and may report nothing new on an unchanged head, and a local review with its cache may stop the same way on an unchanged working tree; at `medium` effort the review simply runs again.
+
+The wall is elapsed time, pauses included, and a pause is charged twice: it spends the wall, and while it is the longest gap between two round admissions it is also the price of the next round. The pause that matters in practice falls after the first audit pair — rounds 1 and 2, which launch together — and before round 3. Under the default reserve, a review whose pair launched the moment its capture finished can pause for at most:
+
+| Diff            | Default wall | Reserve | Longest pause after the first audit pair |
+| --------------- | ------------ | ------- | ---------------------------------------- |
+| Small (Step 3A) | 8 h          | 80 min  | 3 h 20 min                               |
+| Large (Step 3B) | 12 h         | 80 min  | 5 h 20 min                               |
+| Huge            | 16 h         | 80 min  | 7 h 20 min                               |
+
+Those are ceilings, and the same rule covers any wall of 4 hours or more under the default reserve: at most (wall − 80 min) / 2 after a pair launched at capture. The pause is counted from the pair's launch, so it includes the pair's own audits and the verifiers that ride with it, and every minute the review spent before the pair launched takes half a minute off. Each later gap is held to at most half of what was left above the reserve at the previous admission, and can be held to less, for instance once an earlier gap was longer than that half. The precedence rules, the environment variables that set the wall and the reserve, and the up-front refusal of a too-short `--deadline` are described under Headless runs above. The `/review` slash command takes no `--deadline`, so a review started from a session gets a different wall only through those environment variables, and they apply to every review the session runs: `QWEN_REVIEW_DEADLINE_EPOCH` is one absolute moment shared by all of them, and like an explicit `--deadline` it cuts a huge diff's round cap from 5 to 3. A `--resume` from a new session restarts the wall and the pricing for an interrupted PR review.
+
 ## Token Efficiency
 
 The high-effort pipeline bounds each stage (shard size, audit rounds), but total calls scale with findings — `ceil(F/8)` verification shards — and, under 3B, with chunk count (reverse audit runs per chunk per round). Typical 3A profile:

package/bundled/qc-helper/docs/features/computer-use.md

@@ -26,7 +26,7 @@ When first used, the skill runs these commands itself:
 
 ```bash
 qwen mcp add --scope user node-repl npx -y @qwen-code/node-repl-mcp@0.1.4
-npm install --no-save --package-lock=false @qwen-code/cua-sdk@0.20.6
+npm install --no-save --package-lock=false @qwen-code/cua-sdk@0.20.7
 ```
 
 Restart Qwen Code after the MCP server is first added. The skill then resumes

package/bundled/qc-helper/docs/features/goals.md

@@ -22,7 +22,7 @@ Two more windows are available and off by default: [`model.goalMaxTurns`](../con
 
 Each turn the session takes on its own reports what the Goal has spent so far, how many turns are behind it, and — unless the Goal runs unbounded — the window it is allowed. Every such turn except the final wind-down hand-off also carries standing instructions to re-check the workspace rather than trust earlier turns' reports, to work toward the end state the objective asks for, to do something different when the previous turn changed nothing (from the second turn on, once there is a previous turn to judge), and to check every requirement against citable evidence before proposing that the Goal is done.
 
-A long Goal periodically compresses the evidence it has recorded into checkpoint claims with a side model check, so later turns and the verifier still have it to cite. The check is bounded by [`model.goalCheckpointTimeoutSeconds`](../configuration/settings.md), 180 seconds by default. A reply wrapped in a markdown fence is read without the fence. If its claims overrun the aggregate byte budget, include a claim over the per-claim character limit, number more than one checkpoint may hold, cite an id that was not in the request, or change the proof kind of a source they cite, it makes one corrective model call that names what was wrong, and both calls share that ceiling. A reply that is not a JSON object holding a non-empty `claims` array gets no corrective call, and neither does one with any malformed claim, even beside usable ones: an extra key at either level, an unrecognised `proofKind`, an empty claim, or a `sourceRefs` list that is empty, holds a non-string or empty id, repeats an id, or holds more than 32 ids. A check that does not finish in time is abandoned as inconclusive; it counts toward the checkpoint stall limit only when the evidence window has overflowed, while a non-overflowing check preserves the streak and retries on a later turn. A check after a stall on an overflowing window does not resend the same request: it sends the evidence in batches of 24 records, or 12 after a second stall, one model call per batch, each bounded by that ceiling on its own. A window that still has room, and the check a resumed session replays at startup, are still sent in one call, since neither can spend a stall. Each batch's claims are carried into the next, and only the last batch's claims are kept. A batch that fails ends the check the way a failed single call does, and the recorded failure names the batch, as in `batch 2/5: …`. A check after a stall can therefore take up to five times the ceiling, or nine times after a second stall, and a message you send meanwhile waits for it. Batching helps when the model could not answer for the whole window in time or with usable claims; a checkpoint that comes back with the full 32 claims and still leaves evidence behind still needs a narrower objective. The calls are streamed, so the per-request transport timeout bounds only connect and first response, and the ceiling itself stops at the stream guards' 15-minute lifetime cap because past that the guard, not the setting, ends the check. That 15-minute limit on the setting is fixed, and raising the stream guard's own cap does not lift it.
+A long Goal periodically compresses the evidence it has recorded into checkpoint claims with a side model check, so later turns and the verifier still have it to cite. Each model call the check makes is bounded by [`model.goalCheckpointTimeoutSeconds`](../configuration/settings.md), 180 seconds by default. A reply wrapped in a markdown fence is read without the fence. If its claims overrun the aggregate byte budget, include a claim over the per-claim character limit, number more than one checkpoint may hold, cite an id that was not in the request, or change the proof kind of a source they cite, it makes one corrective model call that names what was wrong, and both calls share that ceiling. A reply that is not a JSON object holding a non-empty `claims` array gets no corrective call, and neither does one with any malformed claim, even beside usable ones: an extra key at either level, an unrecognised `proofKind`, an empty claim, or a `sourceRefs` list that is empty, holds a non-string or empty id, repeats an id, or holds more than 32 ids. A check that does not finish in time is abandoned as inconclusive; it counts toward the checkpoint stall limit only when the evidence window has overflowed, while a non-overflowing check preserves the streak and retries on a later turn. A check after a stall on an overflowing window does not resend the same request: it sends the evidence in batches of 24 records, or 12 after a second stall, one model call per batch, each bounded by that ceiling on its own. A window that still has room, and the check a resumed session replays at startup, are still sent in one call, since neither can spend a stall. Each batch's claims are carried into the next, and only the last batch's claims are kept. A batch that fails ends the check the way a failed single call does, and the recorded failure names the batch, as in `batch 2/5: …`. A check after a stall can therefore take up to five times the ceiling, or nine times after a second stall, and a message you send meanwhile waits for it; the whole span counts as active time, so it is charged against `model.goalMaxActiveMinutes` like any other wait. Batching helps when the model could not answer for the whole window in time or with usable claims; a checkpoint that comes back with the full 32 claims and still leaves evidence behind still needs a narrower objective. The calls are streamed, so the per-request transport timeout bounds only connect and first response, and the ceiling itself stops at the stream guards' 15-minute lifetime cap because past that the guard, not the setting, ends the check. That 15-minute limit on the setting is fixed, and raising the stream guard's own cap does not lift it.
 
 A failing checkpoint shows up before it stops the Goal. While an active Goal's stall streak runs, the footer pill switches to `checkpoint N/3 stalled` on its own; once the Goal pauses or stops, the pill shows that status instead. The web shell's Goal status strip shows the count whatever the status. Whenever a terminal Goal status card is rendered, for example by `/goal` or by a pause, resume or verifier card, it shows how many consecutive checks have stalled out of the three the Goal allows, together with the last failure while one is recorded; the web shell's Goals dialog and headless `/goal` text output show the same line, while the web shell's transcript cards for Goal events show only the stop reason, and the model sees both fields when it reads the Goal. A check that fails while the window still has room is shown too, without spending a stall, but only while the Goal is active, or when that failure is itself what stopped the Goal, as with a checkpoint request too large to send. A checkpoint stop for any other reason clears the failure and keeps the streak, and a completed Goal shows no checkpoint line. The failure is kept as a single line with control characters removed. A Goal stopped by three stalled checkpoints names what the last one ran into. A check that could not fit the window within the checkpoint claim bounds, whether a full claim list that still left evidence behind or claims over the claim count or size budget, means the objective produces more evidence than one window holds, so narrow it. An answer that could not be folded into claims means the checkpoint model is not returning the structured output it is asked for, and narrowing the objective does not fix that. A check that never answered can mean an unreachable or rate-limited provider, a check that did not finish within `model.goalCheckpointTimeoutSeconds`, or an error in the check itself; the recorded failure says which. Resuming after any of the three starts a fresh evidence window.
 

package/bundled/qc-helper/docs/features/hooks.md

@@ -383,7 +383,7 @@ Hooks fire at specific points during a Qwen Code session. Different events suppo
 - A matcher is first compared exactly. In a `|`-separated list such as `permission_prompt | idle_prompt`, the matcher matches when any entry, ignoring spaces around it, is `*`, `.*`, or exactly the value, unless the whole matcher starts with `^` or `(`, in which case it is only a regular expression. Only a `|` outside `[...]` and groups, and not escaped with a backslash, separates entries: the pipes in `notes\|todo\.md`, `foo[ |]bar` and `a(b | c)` are part of the regular expression, and the spaces around them are kept. List entries are never read as regular expressions on their own
 - Otherwise the matcher is an unanchored regular expression (e.g., `^run_shell_command$`, `read_.*`, `(write_file|edit)`). For a list that does not start with `^` or `(`, the expression is built from the trimmed, non-empty entries, so a stray `|` as in `read_(file|edit)|` is ignored and never makes the matcher match everything, and a matcher of only `|` matches nothing. A matcher that starts with `^` or `(` is compiled exactly as written, so a trailing `|` there, as in `^write_file|`, does make it match everything. Because the expression is unanchored, `read` also matches `read_file` and `edit` also matches `notebook_edit`. Add `^` and `$` to match a whole value, and anchor exclusions as well: `^(?!write_file).*$` excludes `write_file`, while unanchored `(?!write_file).*` still matches it
 - The same rules apply to every event that supports a matcher, and to hooks registered by skills
-- Tool hooks receive the runtime tool id in `tool_name` (for example, `write_file`). Built-in display names such as `WriteFile` and `ReadFile` are also accepted as matcher aliases for compatibility, but new configs should prefer runtime ids. Aliases are only compared exactly, so anchor runtime ids (`^write_file$`), not display names.
+- Tool hooks receive the runtime tool id in `tool_name` (for example, `write_file`). Built-in display names such as `WriteFile` and `ReadFile` are also accepted as matcher aliases for compatibility, and so are the tool names permission rules accept, including Claude Code's `Bash`, `Read` and `Write`, so a matcher copied from a Claude Code config such as `"Bash"` or `"Write|Edit"` works unchanged. New configs should still prefer runtime ids. Aliases are only compared exactly, so anchor runtime ids (`^write_file$`), not display names. Each alias names exactly one tool: unlike a permission rule, a `Read` matcher does not also cover `grep_search` or `glob`, and a `Bash` matcher does not cover `monitor`.
 
 **Examples:**
 

package/bundled/qc-helper/docs/features/skills.md

@@ -223,7 +223,8 @@ exit 0
 Notes:
 
 - Hooks are registered when the Skill is invoked and last for the rest of the session. This is true on both invocation paths — whether the model calls the Skill or you type `/<skill-name>`.
-- Session hooks live only in memory, so resuming a session with `--continue` / `--resume` does **not** restore them, on either invocation path. The Skill's instructions can come back with the replayed conversation while the hooks meant to enforce them are gone — re-run the Skill after resuming to re-arm its gate.
+- Resuming a session with `--continue` / `--resume` re-applies both halves — the `allowedTools` allow rules and the `hooks:` — of every Skill the **model** loaded through the Skill tool, because those invocations are recorded in the conversation as tool calls. The grants last for the resumed session only, the same as a live invocation. A Skill you started yourself with `/<skill-name>` is submitted as an ordinary prompt and leaves no tool-call record, so it is not restored — re-run `/<skill-name>` after resuming to re-arm its gate.
+- Resume does not re-apply them for a Skill a fresh tool call would refuse today (disabled, hidden from the model with `disable-model-invocation`, or a `paths:` Skill not yet activated), for a **project** Skill whose folder is no longer trusted, or when the recorded body does not match the body in `SKILL.md` — because it was edited, or because it was too long and was truncated for the model. In these cases a Skill that declares `hooks:` or `allowedTools` leaves a debug log line saying why. Resume also skips, without a log line, a Skill loaded from inside an `exec` script and a Skill that is no longer discovered (for example, one that was removed or renamed). The match covers the body only, so an edit to just the frontmatter is re-applied with the new `allowedTools` and `hooks:`.
 - Registration is idempotent: re-invoking a Skill does not stack duplicate hooks.
 - A Skill hook's `matcher:` follows the same rules as a settings hook (see [Hooks](hooks.md)). An omitted or empty `matcher:` matches every tool, and matchers are not anchored, so `edit` also matches `notebook_edit`. Skill hooks used to wrap their matcher in `^…$` and to match nothing when it was omitted: write `^edit$` to match exactly one tool, and write exclusions as `^(?!write_file).*$`.
 - The `command:` runs through the platform shell: `bash` on macOS and Linux, and on Windows Git Bash when it is detected (`MSYSTEM`/`TERM`), otherwise `cmd.exe` or PowerShell. The example above is POSIX shell — under `cmd.exe` `$QWEN_SKILL_ROOT` is not expanded and a `.sh` script is not executable, so the gate fails open there. A hook may set `shell: bash` to force bash, but that resolves to whatever `bash` is on `PATH`, so on Windows outside Git Bash write the gate for the shell you actually have.

package/chunks/{MaxSizedBox-XIOLMOXA.js → MaxSizedBox-CSMC6NNQ.js}

@@ -14,35 +14,35 @@ import "./chunk-47ECGEJC.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-U67XI6DF.js";
+import "./chunk-BS7ON54G.js";
 import "./chunk-GELRJXE2.js";
 import "./chunk-32CM56LO.js";
 import "./chunk-6WXVEDT2.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-35FHAAKR.js";
-import "./chunk-AWIDTT6L.js";
+import "./chunk-ZRZZLM37.js";
+import "./chunk-YVF4PKCV.js";
 import "./chunk-EKMJR7M3.js";
 import "./chunk-EDB556X7.js";
-import "./chunk-2WXEMERX.js";
-import "./chunk-SJM77TB6.js";
+import "./chunk-QR4Q425T.js";
+import "./chunk-C5ABXOC2.js";
 import "./chunk-DJXSOEFB.js";
-import "./chunk-U5RT4WTL.js";
+import "./chunk-5VQR2DD7.js";
 import "./chunk-BUQN5LTI.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-YM6KUQ2S.js";
-import "./chunk-U5MXMLTQ.js";
-import "./chunk-7NVASIXD.js";
-import "./chunk-BL7ND5BF.js";
+import "./chunk-FFBP5POK.js";
+import "./chunk-C3VNHDWJ.js";
+import "./chunk-CFSBWJBB.js";
 import "./chunk-GOFAQQZA.js";
-import "./chunk-6HUXPLB5.js";
+import "./chunk-HEOH7JZY.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
 import "./chunk-65I7S4Z3.js";
 import "./chunk-7CLLH5TI.js";
 import "./chunk-WK6DEH3Q.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DPFPIOT7.js";
-import "./chunk-EYN3G5XD.js";
+import "./chunk-QQL5BFOL.js";
+import "./chunk-ME4JBHSB.js";
 import "./chunk-GNV2SFO7.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
@@ -58,7 +58,7 @@ import "./chunk-ELRMZTPF.js";
 import "./chunk-U6H3XTFA.js";
 import "./chunk-ACHCT36C.js";
 import "./chunk-CHEIIBT3.js";
-import "./chunk-77A22NFK.js";
+import "./chunk-AEWCOE64.js";
 import "./chunk-OWUAZXXN.js";
 import "./chunk-CH2YDT6X.js";
 import "./chunk-JX6XHPTX.js";
@@ -68,10 +68,10 @@ import "./chunk-AXZMWAJV.js";
 import "./chunk-NXUZFW3G.js";
 import "./chunk-WFNEY5G7.js";
 import "./chunk-GSS4SZNG.js";
-import "./chunk-DBRCSM4Q.js";
+import "./chunk-BW2SMO6L.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-ZZFRNF5K.js";
-import "./chunk-ESW2J7ON.js";
+import "./chunk-VVI7MK3V.js";
+import "./chunk-WBSJ6VPZ.js";
 import "./chunk-G6UUOCUT.js";
 import "./chunk-IZ2U57NY.js";
 import "./chunk-Z72PLR74.js";
@@ -90,7 +90,7 @@ import "./chunk-C75BXMPM.js";
 import "./chunk-KFFCDLKV.js";
 import "./chunk-KP2FHIFR.js";
 import "./chunk-L6DIANLD.js";
-import "./chunk-PVY7BXFE.js";
+import "./chunk-NRUKL236.js";
 import "./chunk-5ETULJLP.js";
 import "./chunk-7MIBD3LG.js";
 import "./chunk-VGC4I5JJ.js";
@@ -102,7 +102,7 @@ import "./chunk-WZAD4ZNJ.js";
 import "./chunk-ARDHE6MM.js";
 import "./chunk-FPGTNKCP.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-LHLLMSQT.js";
+import "./chunk-6TMXX4Z4.js";
 import "./chunk-XFFRI3WM.js";
 import "./chunk-ERU3SDXT.js";
 import "./chunk-EWJTAP3Y.js";

package/chunks/{StandaloneSessionPicker-AO3IQQGI.js → StandaloneSessionPicker-5G46NROB.js}

@@ -3,15 +3,15 @@
 import {
   ConfigContext,
   SessionPicker
-} from "./chunk-XL6R67OR.js";
+} from "./chunk-NN4EC2WO.js";
 import {
   SettingsContext
-} from "./chunk-GGPCC2O6.js";
-import "./chunk-IKRQGUQZ.js";
+} from "./chunk-TYWLBEL2.js";
+import "./chunk-WUTXSXPP.js";
 import {
   KeypressProvider
-} from "./chunk-S6IHVYGH.js";
-import "./chunk-MG27DO5F.js";
+} from "./chunk-T3LUMYFP.js";
+import "./chunk-WLLRNQVT.js";
 import "./chunk-YGFJ6BRT.js";
 import "./chunk-FBDHP23D.js";
 import "./chunk-4WGODMVR.js";
@@ -30,60 +30,60 @@ import {
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
-import "./chunk-PWFDZN4R.js";
+import "./chunk-BNYQHLPR.js";
 import "./chunk-JRHKM3YQ.js";
 import "./chunk-C4HBZQNH.js";
 import "./chunk-EKTCKZV5.js";
-import "./chunk-NBROLZHT.js";
+import "./chunk-EZSSJSKR.js";
 import "./chunk-2S2WIGCM.js";
 import "./chunk-47ECGEJC.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
-import "./chunk-B6OHBZER.js";
+import "./chunk-GXN7DWZZ.js";
 import "./chunk-57OAHC2Y.js";
-import "./chunk-GX4SZXNA.js";
-import "./chunk-ZZO262KG.js";
+import "./chunk-J73WJIMT.js";
+import "./chunk-KSIOXYVX.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-I6YJZGHS.js";
 import "./chunk-5EJZE3FP.js";
-import "./chunk-QBOQHWSY.js";
+import "./chunk-A6YU6R5N.js";
 import "./chunk-BW4333PP.js";
 import "./chunk-IDS7MSUP.js";
 import "./chunk-XX5HQLCZ.js";
-import "./chunk-FQ366CXY.js";
+import "./chunk-NTCFKGQF.js";
 import "./chunk-NPQ5ZKRP.js";
 import "./chunk-MR3PXB6E.js";
-import "./chunk-U67XI6DF.js";
+import "./chunk-BS7ON54G.js";
 import "./chunk-GELRJXE2.js";
 import "./chunk-32CM56LO.js";
 import "./chunk-6WXVEDT2.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-35FHAAKR.js";
-import "./chunk-AWIDTT6L.js";
+import "./chunk-ZRZZLM37.js";
+import "./chunk-YVF4PKCV.js";
 import "./chunk-EKMJR7M3.js";
 import "./chunk-EDB556X7.js";
-import "./chunk-2WXEMERX.js";
-import "./chunk-SJM77TB6.js";
+import "./chunk-QR4Q425T.js";
+import "./chunk-C5ABXOC2.js";
 import "./chunk-DJXSOEFB.js";
-import "./chunk-U5RT4WTL.js";
+import "./chunk-5VQR2DD7.js";
 import "./chunk-BUQN5LTI.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-YM6KUQ2S.js";
-import "./chunk-U5MXMLTQ.js";
-import "./chunk-7NVASIXD.js";
+import "./chunk-FFBP5POK.js";
+import "./chunk-C3VNHDWJ.js";
 import {
   SessionService
-} from "./chunk-BL7ND5BF.js";
+} from "./chunk-CFSBWJBB.js";
 import "./chunk-GOFAQQZA.js";
-import "./chunk-6HUXPLB5.js";
+import "./chunk-HEOH7JZY.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
 import "./chunk-65I7S4Z3.js";
 import "./chunk-7CLLH5TI.js";
 import "./chunk-WK6DEH3Q.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DPFPIOT7.js";
-import "./chunk-EYN3G5XD.js";
+import "./chunk-QQL5BFOL.js";
+import "./chunk-ME4JBHSB.js";
 import "./chunk-GNV2SFO7.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
@@ -99,7 +99,7 @@ import "./chunk-ELRMZTPF.js";
 import "./chunk-U6H3XTFA.js";
 import "./chunk-ACHCT36C.js";
 import "./chunk-CHEIIBT3.js";
-import "./chunk-77A22NFK.js";
+import "./chunk-AEWCOE64.js";
 import "./chunk-OWUAZXXN.js";
 import "./chunk-CH2YDT6X.js";
 import "./chunk-JX6XHPTX.js";
@@ -111,10 +111,10 @@ import {
 } from "./chunk-NXUZFW3G.js";
 import "./chunk-WFNEY5G7.js";
 import "./chunk-GSS4SZNG.js";
-import "./chunk-DBRCSM4Q.js";
+import "./chunk-BW2SMO6L.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-ZZFRNF5K.js";
-import "./chunk-ESW2J7ON.js";
+import "./chunk-VVI7MK3V.js";
+import "./chunk-WBSJ6VPZ.js";
 import "./chunk-G6UUOCUT.js";
 import "./chunk-IZ2U57NY.js";
 import "./chunk-Z72PLR74.js";
@@ -133,7 +133,7 @@ import "./chunk-C75BXMPM.js";
 import "./chunk-KFFCDLKV.js";
 import "./chunk-KP2FHIFR.js";
 import "./chunk-L6DIANLD.js";
-import "./chunk-PVY7BXFE.js";
+import "./chunk-NRUKL236.js";
 import "./chunk-5ETULJLP.js";
 import "./chunk-7MIBD3LG.js";
 import "./chunk-VGC4I5JJ.js";
@@ -145,7 +145,7 @@ import "./chunk-WZAD4ZNJ.js";
 import "./chunk-ARDHE6MM.js";
 import "./chunk-FPGTNKCP.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-LHLLMSQT.js";
+import "./chunk-6TMXX4Z4.js";
 import "./chunk-XFFRI3WM.js";
 import "./chunk-ERU3SDXT.js";
 import "./chunk-EWJTAP3Y.js";
@@ -156,7 +156,7 @@ import "./chunk-SYROIHU7.js";
 import "./chunk-RSWBT7AZ.js";
 import "./chunk-ZAFYHRVY.js";
 import "./chunk-TBWQLLFO.js";
-import "./chunk-YVUZYCZC.js";
+import "./chunk-DBUOMHLZ.js";
 import {
   writeStdoutLine
 } from "./chunk-7FA2II6K.js";

package/chunks/{acp-subagent-executor-NIWF7S3U.js → acp-subagent-executor-4JLSF7SA.js}

@@ -12,7 +12,7 @@ import {
   selectPeerModeId,
   selectPermissionOption,
   selectRejectOption
-} from "./chunk-QSAJ4MKA.js";
+} from "./chunk-PAPBT3WP.js";
 import "./chunk-BYUAT5OC.js";
 import "./chunk-2YMRRI2C.js";
 import "./chunk-LYD3T3H7.js";
@@ -20,35 +20,35 @@ import "./chunk-54B2LTKP.js";
 import "./chunk-3VUENPWF.js";
 import "./chunk-M5GB774H.js";
 import "./chunk-IJOS26LH.js";
-import "./chunk-U67XI6DF.js";
+import "./chunk-BS7ON54G.js";
 import "./chunk-GELRJXE2.js";
 import "./chunk-32CM56LO.js";
 import "./chunk-6WXVEDT2.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-35FHAAKR.js";
-import "./chunk-AWIDTT6L.js";
+import "./chunk-ZRZZLM37.js";
+import "./chunk-YVF4PKCV.js";
 import "./chunk-EKMJR7M3.js";
 import "./chunk-EDB556X7.js";
-import "./chunk-2WXEMERX.js";
-import "./chunk-SJM77TB6.js";
+import "./chunk-QR4Q425T.js";
+import "./chunk-C5ABXOC2.js";
 import "./chunk-DJXSOEFB.js";
-import "./chunk-U5RT4WTL.js";
+import "./chunk-5VQR2DD7.js";
 import "./chunk-BUQN5LTI.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-YM6KUQ2S.js";
-import "./chunk-U5MXMLTQ.js";
-import "./chunk-7NVASIXD.js";
-import "./chunk-BL7ND5BF.js";
+import "./chunk-FFBP5POK.js";
+import "./chunk-C3VNHDWJ.js";
+import "./chunk-CFSBWJBB.js";
 import "./chunk-GOFAQQZA.js";
-import "./chunk-6HUXPLB5.js";
+import "./chunk-HEOH7JZY.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
 import "./chunk-65I7S4Z3.js";
 import "./chunk-7CLLH5TI.js";
 import "./chunk-WK6DEH3Q.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DPFPIOT7.js";
-import "./chunk-EYN3G5XD.js";
+import "./chunk-QQL5BFOL.js";
+import "./chunk-ME4JBHSB.js";
 import "./chunk-GNV2SFO7.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
@@ -64,7 +64,7 @@ import "./chunk-ELRMZTPF.js";
 import "./chunk-U6H3XTFA.js";
 import "./chunk-ACHCT36C.js";
 import "./chunk-CHEIIBT3.js";
-import "./chunk-77A22NFK.js";
+import "./chunk-AEWCOE64.js";
 import "./chunk-OWUAZXXN.js";
 import "./chunk-CH2YDT6X.js";
 import "./chunk-JX6XHPTX.js";
@@ -74,10 +74,10 @@ import "./chunk-AXZMWAJV.js";
 import "./chunk-NXUZFW3G.js";
 import "./chunk-WFNEY5G7.js";
 import "./chunk-GSS4SZNG.js";
-import "./chunk-DBRCSM4Q.js";
+import "./chunk-BW2SMO6L.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-ZZFRNF5K.js";
-import "./chunk-ESW2J7ON.js";
+import "./chunk-VVI7MK3V.js";
+import "./chunk-WBSJ6VPZ.js";
 import "./chunk-G6UUOCUT.js";
 import "./chunk-IZ2U57NY.js";
 import "./chunk-Z72PLR74.js";
@@ -96,7 +96,7 @@ import "./chunk-C75BXMPM.js";
 import "./chunk-KFFCDLKV.js";
 import "./chunk-KP2FHIFR.js";
 import "./chunk-L6DIANLD.js";
-import "./chunk-PVY7BXFE.js";
+import "./chunk-NRUKL236.js";
 import "./chunk-5ETULJLP.js";
 import "./chunk-7MIBD3LG.js";
 import "./chunk-VGC4I5JJ.js";
@@ -108,7 +108,7 @@ import "./chunk-WZAD4ZNJ.js";
 import "./chunk-ARDHE6MM.js";
 import "./chunk-FPGTNKCP.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-LHLLMSQT.js";
+import "./chunk-6TMXX4Z4.js";
 import "./chunk-XFFRI3WM.js";
 import "./chunk-ERU3SDXT.js";
 import "./chunk-EWJTAP3Y.js";