docs(serve): fix stale permission-route note and document pending-prompt events - #13281

docs/developers/daemon/09-event-schema.md reached main unformatted in
8505479 (#13281), whose docs-only CI profile skipped the Prettier lane.
scripts/lint.js --prettier runs `prettier --check .` across the whole repo, so
every branch with that commit as an ancestor now fails Lint & Static on a file
it never touched. Normalize the emphasis markers and table padding so this
branch's own gate can pass.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-conflict/jmuxqta15bw

docs/developers/daemon/09-event-schema.md reached main unformatted in
8505479 (#13281), whose docs-only CI profile skipped the Prettier lane.
scripts/lint.js --prettier runs `prettier --check .` across the whole repo, so
every branch with that commit as an ancestor fails Lint & Static on a file it
never touched. Normalize the emphasis markers and table padding so this
branch's own gate can pass.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-conflict/jmuxqta15bw

…ier gate

main's #13281 added the pending-prompt queue table unformatted, so once
the branch merged main the repo-wide `node scripts/lint.js --prettier`
gate turned the Lint & Static lane red on `09-event-schema.md` — the
same fix H4b already carries as `e72c63a11c` upstream of its line.
Pure formatting; content unchanged.

Refs #13548

docs/developers/daemon/09-event-schema.md reached main unformatted in
8505479 (#13281), whose docs-only CI profile skipped the Prettier lane.
scripts/lint.js --prettier runs `prettier --check .` across the whole repo, so
every branch with that commit as an ancestor fails Lint & Static on a file it
never touched. Normalize the emphasis markers and table padding so this
branch's own gate can pass.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-conflict/jmuxqta15bw

…wenLM#13548)

* feat(managed-agent): H5a channel route and delivery record contract

Land slice H5a of the Managed Agent extension runtime (QwenLM#12827, stage H of
QwenLM#12380): the durable record contract for Channels. Define the
managed-channel_route and managed-channel_delivery record bodies — the two
domains H0b registered but left unbodied — with one shared fixture corpus
(83 shape cases, 54 successor cases) replayed identically by TypeScript and
Java, register both bodies with taskKind null, teach the Session authority
their resource closures, and keep both domains refused for submission. The
H5 design document (both languages) moves from contract direction to the
pinned byte-level contract this slice freezes.

Also widen ManagedExtensionRecords' value-based comparator to the package
so the channel records share the sibling JSON.stringify-compatible numeric
semantics instead of a double comparison that splits -0.0 from 0.0.

Refs QwenLM#12827 QwenLM#12380

* fix(managed-agent): close the two H5a review findings from QwenLM#13548

Two follow-ups from the wenshao review on the H5a record contract:

- The segment plan parser iterated with Array.prototype.map, so a sparse
  plan emptied its holes past every check and then failed its own durable
  round-trip once the holes serialized as null. Walk every index so a hole
  refuses as a non-object entry, pin a TypeScript regression for the
  sparse shapes, and add the explicit null-element corpus case both
  languages replay (84 shape cases, 54 successors).
- The Java store's resource closure only covered the MCP, Hook,
  child-run and monitor bodies, so a channel journal could persist a
  record the Session authority cannot reopen. Enumerate the channel
  route's policyRef and the delivery's contentRef, every segment
  contentRef and every non-null receipt proofRef in the commit
  transaction, with positive commits (planned, sending with a proofed
  receipt) and one refusal per missing resource kind.

Refs QwenLM#12827 QwenLM#13548

* fix(managed-agent): close the review F1/F2 follow-ups on H5a

- Leaving `unknown` requires proof: `unknown → partial` must settle a
  segment the unknown revision did not, in both validators, or the next
  `sending` revision could re-send a segment the provider may already
  hold (decision 5; the previous corpus composed the two-step bypass
  byte-for-byte). Corpus re-derived: `delivery-unknown-proves-partial`
  gains the third segment with a real new receipt, and
  `delivery-unknown-partial-without-proof` pins the refusal.
- Corpus strength: pin the ten rules both languages enforced without a
  fixture (thread scope with a senderId, single with a chatId, unknown
  scope kind with all-null carriers, non-boolean cancelRequested,
  unknown/rejected with every segment receipted, route accountId drift,
  delivery routeId drift, malformed proofRef, malformed segment
  contentRef), and correct `delivery-cancelled-with-receipt` so the
  refusal rides the zero-receipt conjunct it names.
- Design docs (both languages) record the leaving-unknown rule and the
  updated 92/57 corpus size.

Refs QwenLM#12827 QwenLM#13548

* fix(managed-agent): repair the store-test splice after the H4a merge

The H4a/H5a registry merge put the closure test and helper methods into a
splice that lost channelDelivery's closing brace and interleaved the H4a
tests mid-method. Re-laid the file on top of origin/main with the closure
test and helpers inserted before childRun, restoring compilation and the
full 25-test store suite.

Refs QwenLM#12827 QwenLM#13548

* fix(managed-agent): restore @test on the channel resource-closure regression

The store-test splice after the H4a merge dropped the annotation while
re-laying the file, so normal test runs silently skipped the regression
(the review-5438970962 Suggestion). Restored it; the suite runs 26 tests
including all positive commits and the four missing-resource refusals.

Refs QwenLM#13548

* chore(docs): format the daemon event-schema queue table for the Prettier gate

main's QwenLM#13281 added the pending-prompt queue table unformatted, so once
the branch merged main the repo-wide `node scripts/lint.js --prettier`
gate turned the Lint & Static lane red on `09-event-schema.md` — the
same fix H4b already carries as `e72c63a11c` upstream of its line.
Pure formatting; content unchanged.

Refs QwenLM#13548

* fix(managed-agent): widen RECORD_BODIES past Map.of's ten-pair cap

H6a's schedule and automation_run bodies bring the registry to eleven
bodies once this branch merges with main; Map.of constructor overloads
stop at ten. Convert to Map.ofEntries, mirroring the entries layout
that both contract surfaces and the projection fixtures drive.

Refs QwenLM#12827 QwenLM#13548

Upstream #13281 landed the doc with 4 badly wrapped table lines;
its own lint lane ran a 15 s light profile that never scanned it,
so the violation reached main unnoticed and began failing every PR
merge ref computed after 2026-10-07T04:45Z (this PR's run on
13d1735 inclusive). Format-only change: `prettier --write` (4
lines); the whole-tree `--check .` now passes, and upstream #13536's
version of the same file is already clean, so the next main merge
stays green by construction.

…LM#13573) (QwenLM#13580)

Main CI's Run Prettier step failed at 28512f1 because 8505479 (QwenLM#13281)
landed the pending-prompt table with asterisk emphasis that Prettier
normalizes to underscores, with the separator row re-padded to match.
Apply the normalization; no content change.

Co-authored-by: Qwen Autofix <[email protected]>
Co-authored-by: Qwen-Coder <[email protected]>

…3574)

* fix(acp): preserve branch checkpoints after Code Mode turns

Co-authored-by: Qwen-Coder <[email protected]>

* ci(docs): format the daemon event-schema table for the Prettier gate

docs/developers/daemon/09-event-schema.md reached main unformatted in
8505479 (QwenLM#13281), whose docs-only CI profile skipped the Prettier lane.
scripts/lint.js --prettier runs `prettier --check .` across the whole repo, so
every branch with that commit as an ancestor fails Lint & Static on a file it
never touched. Normalize the emphasis markers and table padding so this
branch's own gate can pass.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-conflict/jmuxqta15bw

* test(acp): accept code_mode_tool_result options arg in native-metadata test

The branch's checkpoint preservation now records nested Code Mode tool
results with a third options argument ({subtype: 'code_mode_tool_result'})
— a deliberate contract change already pinned by the sibling test at
~41694. The older 'allows top-level discovery' assertion still used a
two-argument toHaveBeenCalledWith, which no longer matched the nested
read_file call. Extend the matcher minimally to expect the new options
argument.

* test(acp): pin the Goal turn stamp on nested Code Mode originals

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmuxwj1f62z

* refactor(acp): keep subtype out of the queue callback input type

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmuxwj1f62z

---------

Co-authored-by: Qwen-Coder <[email protected]>
Co-authored-by: yiliang114 <[email protected]>

…dger (M5c) (QwenLM#13352)

* feat(managed-agent): prove Shell process-group stops with a worker ledger (M5c)

M5a settled a cancel on the worker's word: a Shell member that ignored
SIGTERM survived its leader, and a worker that crashed left the Shell
process groups it started unnamed to the child's snapshot-only registry.

Each Runtime worker now keeps an incarnated ledger of its Shell process
groups, rewritten atomically before any settled step. A settled cancel
waits for the whole group to die before the call journals; the host sweeps
the ledger of a dead worker, and every new child sweeps older ledgers,
neither one trusted. Identity is judged from the live process table with a
leader-dated, one-sided start-time proof: a young live leader or a live
pid the table cannot name is never signalled, and a group nothing can
prove is a quarantine that blocks new Managed sessions until a reaper
proves it. Registers and enables nothing; Windows stays on its documented
liveness-only shape pending real-machine verification before M6.

Refs QwenLM#12380

* docs(managed-agent): cite the M5c pull request in the engine design

* fix(managed-agent): harden the M5c worker ledger after review round 1

Identity: judge ages inside the boot-clock domain on Linux — ps etime is
boot-derived and a wall-clock step must not make a live leader read as a
recycled impostor — resolve a recycled id only once no old-enough member
of the recorded group remains, probe hostPid as a process whose EPERM
holds rather than sweeps a sibling, refresh the identity snapshot after
the worker's proof wait, and date every proven group with its own budget
rather than one shared serial deadline.

Containment: ledger filesystem failures no longer escape into fatal
states — an addGroup failure stops the newborn group and fails the call
loudly, close and the settle-evidence block contain errors instead of
rejecting the shutdown or losing the journal's terminal state, an
unreadable ledger retires aside once it outlives the debris age instead
of quarantining forever, the .tmp debris unlink joins the per-entry
containment, and the 1 Hz watchdog prunes by liveness alone instead of
forking a blocking ps each tick.

Quarantine: a dedicated managed_engine_quarantined error kind mapped to
HTTP 503 with the reason kept at both daemon mappers, replacing the
resume-conflict 409 rewrite; a startup sweep failure now has its report
test; the reaper backs off to a 30-second cadence. The worker also
scrubs the ledger path from the environment before any Shell command
inherits it.

* fix(managed-agent): close the M5c quarantine verdict and witnessed-retry holes

Round-2 review follow-up:

- Sweep verdicts: sweepWorkerLedger/sweepStaleLedgers now answer
  proven/absent/held/retired, and startLedgerReaper lifts only on the
  sweep's own proof. A retired unreadable ledger never fires onProven,
  and a vanished ledger re-probes the groups the last failure named
  before any lift.
- A witnessed sweep consults the live process table again: the exit
  witness is fresh only at the close it names, so a reaper's retry hours
  later resolves a provably recycled id without signalling its new
  holder, while a genuine or undatable survivor is still killed.
- recordAgeMs refuses a negative boot-domain age: a stamp ahead of this
  boot (a ledger that outlived a reboot) falls back to the wall clock
  instead of inverting the identity guard into an ownership assertion.
- addGroup derives the default uptime stamp from the caller's startedAt,
  so a backdated record keeps both clocks telling one story (fixes the
  recycled-id test that ran red on Linux).
- A quarantine refusal resets the deferred Managed-conversation
  activation instead of poisoning it, so an existing session can enter
  its workspace after the reaper proves the stop; terminal refusals stay
  poisoned.
- The 503 refusal summarizes the quarantine client-safely (ledger
  basename and unproven count) instead of republishing the sweep's
  absolute paths and live pgids.
- An orphaned worker's record omits hostPid (init's pid 1 is no host and
  the reader refuses it), and waitForGroupExit drops only the record it
  judged, never one re-recorded on the same id.
- close() leaves a ledger its reaper already owns to the reaper.
- Design docs (EN+zh-CN) realigned: the quarantine error kind, the
  reaper's backoff, the retirement path, the liveness-only prune, the
  fourth accepted hole, and the daemon mapper files in the M5c row.

* test(cli): pin POSIX shim scripts to CommonJS against up-tree package.json

Deterministic verification rejected the M5c round-2 commit: two
packages/cli tests failed — the review command's git-shim case and the
chafa caching case. Both write an extensionless `#!/usr/bin/env node`
shim whose body uses require()/__dirname__ into os.tmpdir(). A
package.json with "type": "module" in tmpdir's up-tree (this runner's
/tmp/package.json) makes Node load those shims as ES modules, so they
crash before arming or counting. The mermaid fake-mmdc/fake-chafa
helpers share the pattern and fail the same way in that environment.

Each shim directory now gets a {"type":"commonjs"} package.json, pinning
the interpretation the shims were written for. Verified: without the pin
the named tests fail under the polluted tmpdir and pass under a clean
one; with the pin they pass under both, and the full packages/cli suite
is green (38595 passed, 92 skipped).

* fix(cli): close the managed runtime sweep's false-proof and never-prove holes

Review round for QwenLM#13352:

- the startup reaper now accepts its own sweep's proof: the directory
  sweep returns 'proven' only for a ledger it judged clean itself, and
  'absent' (nothing judged) falls through to the last-failure liveness
  probe, so a deleted ledger still holds the quarantine until the groups
  it named die while a sweep-proven clean bill lifts it.
- a retired ledger now rejects with LedgerSweepRetiredError instead of
  resolving 'retired', so every production caller — close, the exit hook,
  the failed-launch sweep, the startup sweep — quarantines it, and both
  reaper closures map the rejection (seeded from the arming one, since
  the aside is judged by no later pass) to 'terminal'.
- a bookkeeping unlink that fails (aged .tmp debris, or the post-proof
  ledger removal) is logged and skipped rather than escalated into an
  unprovable stop.
- queryProcessTable pins COLUMNS=4096 and passes -ww so procps never
  truncates the args column the identity markers are matched against.
- the reaper's retries no longer carry the exit witness: the witness is
  fresh only at the exit it names, and a retry minutes later must judge
  by the live table alone rather than SIGKILL a recycled id's new holder.
- a pid-1 host is recorded as-is and told from init by the live table's
  argv, never by liveness alone; the reader accepts hostPid >= 1, and the
  hold never applies to a ledger this process itself parented.
- the single-ledger reaper maps an empty last-named set to 'terminal':
  an unreadable ledger that is then deleted is no proof of anything.
- the reaper backoff doubles on every unresolved retry, thrown or
  resolved-'unproven' alike; the group judgement re-reads the process
  table only after a proof wait aged the first snapshot, and keeps the
  paid-for snapshot when the re-read fails.

Each new guard carries a mutation-probed witness test; the design doc
records the pid-1 reading, the undatable-group hole, and the Windows
attribution qualifier in both languages.

Co-authored-by: Qwen-Coder <[email protected]>

* fix(cli): pin the managed runtime reaper's lift and harden ledger reads

Review round for QwenLM#13352:

- the startup reaper's lift is pinned to the files that armed the
  quarantine: a directory-level 'proven' an unrelated ledger earned no
  longer lifts, a file gone without a judgement falls back to the
  liveness of every group any failure named (accumulated across
  retries, never replaced), and a retirement ends the reaper
  terminally only after the remaining provable ledgers settle.
- recordAgeMs judges a previous-boot record as unmatchable
  (Number.POSITIVE_INFINITY) instead of wall-aging it into a negative
  age that matched every live process — the identity guard inverted
  into an ownership assertion; both identity matchers also refuse a
  record whose stamp lies in the future.
- a read-side failure (EMFILE/EIO/ENOMEM) no longer retires a valid
  aged ledger: reader and bytes are judged apart, the file stays in
  place, and the stop stays unproven for the next pass.
- the liftable-quarantine refusal guard no longer dereferences a null
  `data`, which wedged provisional activations on a TypeError thrown
  inside the catch.
- the pid-1 ledger test sweeps through a sys seam instead of against
  the runner's own pid (a Windows fork killer), and the child-kill
  process test now asserts the ledger file is gone end to end (M5c.3).
- dropped the duplicate CommonJS shim pins main already carries.

Each new guard carries a mutation-probed witness test.

Co-authored-by: Qwen-Coder <[email protected]>

* style(cli): fix Prettier spacing in managed-runtime-tool-executor test import (QwenLM#13352)

* refactor(cli): drop unreachable terminal verdict in startup ledger reaper (QwenLM#13352)

Co-authored-by: Qwen-Coder <[email protected]>

* fix(managed-agent): hold the quarantine for a ledger that vanished unjudged

The startup reaper lifted the engine's quarantine when a never-readable
ledger was deleted from outside the sweep, while its single-ledger
sibling holds the same fact terminal: a file nobody ever judged proves
nothing by disappearing, so the stop stays unprovable. The directory
reaper now returns terminal on that shape like its sibling, and the
shipped startup-sweep test is re-pinned to the held quarantine, with the
positive lift case next door. The design records the terminal rule in
both languages.

From qqqys's review comment, answered there with the ruling.

* fix(managed-agent): sweep the ledger's final truth and judge boot-stamped records in their own clock domain (QwenLM#13352)

Co-authored-by: Qwen-Coder <[email protected]>

* test(cli): align ACP bridge refusal assertions

Match the current named validation guidance and refusal prefix in the ACP
regression tests. The production bridge contract is unchanged.

Co-authored-by: Qwen-Coder <[email protected]>

* fix(managed-agent): address review round 2 on the M5c physical-stop slice

Identity and write discipline: ledger addGroup writes durably before the
in-memory mutation so a failed write never leaves a memory-only group the
host sweep cannot see; staging is uniquely named per write so concurrent
writers can no longer clobber a shared temporary; ps elapsed parsing
rejects procps's negative-wraparound spelling; proof deadlines live on the
monotonic clock; killOutstanding shares one process-table read across all
its waiters.

Reaper and sweep ownership: the single-ledger reaper accumulates named
groups like its sibling instead of replacing, records retirement, and
holds the quarantine terminal on the same facts; close() and the
launch-failure path join the exit hook's in-flight sweep instead of
starting a second one; two environment creations in the same window share
one directory sweep; judged ledgers accumulate across reaper ticks so a
pass's proofs stay visible to the next.

Admissions: the quarantine refusal fires only where the call is a Managed
admission (executionEngine), never on transcript replay or fork-copy
paths, and refusals are counted and shaped by cause, with shapeless sweep
failures named as sweep-level; conversations no longer freezes a runtime
where a retry is followed by a liftable Managed quarantine refusal —
bindAndRelease surfaces it as a retryable managed_engine_quarantined
instead.

* test(managed-agent): pin the r2 witnesses for elapsed bounds and addGroup write-fail

Two probes the review asked for: procps's negative-wraparound etime
spelling is rejected outright beside the four-digit ceiling the parser
accepts, and a write that cannot reach the ledger leaves neither the
in-memory map nor the file claiming anything was recorded.

* fix(managed-agent): address review round 3 on the M5c physical-stop slice

Sweep-vs-live-writer race closed for good: a worker the sweep cannot
prove stopped keeps its ledger file to itself — the sweep never reads,
merges, and writes behind a live writer, so a durable addGroup landing
in any window can no longer be lost with the group exiting unsignalled.
The final-truth re-read now adopts a same-pgid record the worker
published over the swept snapshot (new call, new stamps), so a young
replacement group is judged by its own record instead of being read as
'recycled' against the stamps the group its pgid used to name carried.

Quarantine lift is pinned per ledger: the directory reaper attributes
every named group to the file that named it, so a sibling ledger's
proof can no longer lift a vanished never-read ledger whose own truth
was never judged — the mixed-failure batch ends terminal exactly like
the single-ghost sibling.

Witnesses: an inode-stability probe for the no-rewrite law, a
same-pgid replacement adoption probe, and a mixed ghost+sibling reaper
run against a real process group; all three go red under a false flip
and green restored.

* fix(managed-agent): keep undatable process rows instead of dropping them

Review round 5 measured that the wrapped-etime clamp traded a false
'ours' for a false 'gone': parseProcessTable dropped the whole row, so
a group whose only live member carried an undatable etime read as
empty — silently resolved 'gone', ledger deleted, group left running,
witnessed sweep included. The row now stays in the table with its age
undatable: it still counts as a member (never 'gone'), but no age
judgement can be made from it — it cannot prove 'ours', it cannot
prove 'recycled' via a young leader, and a worker or host row whose
age cannot be read is held ('unknown' / hold) rather than decided.

The R1-36 witness that made writes fail with chmod(555) now fails them
through the writeFileSync mock instead — root runners ignore mode bits,
so the same red ran on their clean tree.

Witnesses: parser keeps undatable rows with their age undefined;
an unwitnessed sweep holds (never signals, never unlinks) a group
whose only member is undatable; a witnessed sweep still SIGKILLs it;
the row-drop mutation turns the parser witness red before restore.

* test(managed-agent): pin the r5 witnesses the review asked for

Five behaviours shipped in the round-2 batch now have their own
probes, each red under its reverting mutation and green restored:

- killOutstanding consults the process table once for its whole
  fanout: a blocking-ps counter proves three outstanding groups cost
  the prune's consult plus exactly one shared read, never one per
  waiter (R1-12);
- the sweep's proof deadline rides the monotonic clock: a 10 s
  backward wall step inside the first proof poll leaves the measured
  wait at its 600 ms budget instead of stretching to ~10.6 s (R1-48);
- close() joins the sweep the exit hook is already running over the
  same ledger: the wrapped sweep records exactly one pass for the two
  triggers (R1-45, the mock gains a per-call hold so the overlap is
  scripted, not raced);
- two environment creations in one sweep window share the
  stale-ledger pass: directory passes are counted at their own entry
  point because file-level calls never cross the module boundary, and
  the seeded ledger is judged exactly once (R1-8);
- the single-ledger reaper keeps the groups an earlier failure named
  across a later nameless one: armed on garbage, named on a valid
  held-group ledger, silenced on garbage again, then the file vanishes
  and the group dies — only the accumulated name lifts, where the
  replace-instead-of-accumulate mutation ends terminal (R1-5).

* style(docs): format 09-event-schema.md so the Prettier lane passes again

Upstream QwenLM#13281 landed the doc with 4 badly wrapped table lines;
its own lint lane ran a 15 s light profile that never scanned it,
so the violation reached main unnoticed and began failing every PR
merge ref computed after 2026-10-07T04:45Z (this PR's run on
13d1735 inclusive). Format-only change: `prettier --write` (4
lines); the whole-tree `--check .` now passes, and upstream QwenLM#13536's
version of the same file is already clean, so the next main merge
stays green by construction.

* fix(managed-agent): address review round R2 on the M5c physical-stop slice

Classification and surfaces: a liftable Managed-engine quarantine
refusal is translated once, at the throw site in bindAndRelease (both
the commit and the release arm), so create and restore alike see the
retryable managed_engine_quarantined StandaloneSessionServiceError —
restore no longer falls through to working_directory_compromised and
its HTTP-409-shaped "retrying is pointless". The create path's own
catch passes the already-translated error through instead of
rewrapping it as a creation-outcome failure. Both StandaloneSession-
ServiceError status ladders (acp-http dispatch and server
error-response) now map the code to 503 like the raw child refusal,
never the default conflict tier, so 503=retry-later stays the daemon's
own convention on both surfaces.

Quarantine summary: an unreadable ledger in an aggregate no longer
erases the names and counts of every sibling the same sweep
identified — concrete entries keep their basename and group count, and
the unreadable clause is appended; the unreadable-only shape is the
same clause alone, never "ghost.json: 0 process group(s)".

Witnesses, each red under its reverting mutation and green restored:
a restore-path load/resume whose commit arm refuses twice is reported
code managed_engine_quarantined, retryable: true, with the refusal as
cause (raw-rethrow flip reds); a 503 case on each mapper (tier-removal
flip reds); the named-entries-survive and unreadable-only summary
wordings (clause-removal flip reds both); the failed-launch inline
sweep — a worker that boots, writes a ledger naming a live group, then
fails attestation — leaves the group dead and the file gone (sweep
deletion reds); and the launchedLedgerPaths wiring — a second
environment creation leaves the first session's live marker-bearing
worker and its ledger untouched (empty skip set reds).

---------

Co-authored-by: Qwen Autofix <qwen-code@localhost>
Co-authored-by: qwen-code-dev-bot <[email protected]>
Co-authored-by: qwen-code-ci-bot <[email protected]>
Co-authored-by: Qwen-Coder <[email protected]>
Co-authored-by: qwen-code-dev-bot <[email protected]>
Co-authored-by: yiliang114 <[email protected]>