feat(goal): let the model propose a Goal the user approves in a dialog - #10171

⚠️ Deferred approval withheld — 1 PR CI workflow run(s) on e2c77fd did not finish green; see the updated table in the Stage 2 comment. Re-run @qwen-code /triage after fixes. finalize run

⚠️ 延迟审批已搁置 —— e2c77fd 有 1 个 PR CI workflow 未以绿色完成，详见 Stage 2 评论中已更新的表格。修复后可重新运行 @qwen-code /triage。查看 finalize 运行

Thanks for the PR!

Template looks good ✓

Problem: real and observed. #10002 shipped /goal-draft with a paste-a-1,000-character-line hand-off, and the merged design doc for it explicitly lists this propose_goal tool as the next phase. The PR also includes a real before/after tmux session, not a hypothetical.

Direction: aligned. This is the planned P2 of the goal-draft design note, and Claude Code's /goal + ProposeGoal is the established analogue (its changelog shows /goal under active iteration; no direct ProposeGoal entry to cite). The two deliberate deviations — no auto mode, never replacing a running Goal — are the right conservative calls for a consent surface that starts an unattended loop.

Size: core paths touched (packages/core/src/goals, config, tools, permissions + CLI settings). Breakdown: ~352 production lines, ~339 test lines, ~14 schema, ~25 docs/skill content — under the 500-line maintainer-awareness bar. 19 files, but every one of them serves the feature (tool, registration, setting, scope restriction, skill hand-off, display names, docs). No drive-by changes spotted.

Approach: scope feels right — it matches what the design doc scoped. Reusing the generic info confirmation instead of adding a per-host dialog component is the simple path, and the tradeoff (generic button labels) is called out honestly in the PR body. Keeping the printed /goal set fallback for headless/disabled/active-Goal cases preserves every existing path.

Risk: no elevated risk signals — none of the changed files match the revert-correlated high-risk paths.

Moving on to code review. 🔍

— Qwen Code · qwen3.8-max

_{Reviewed at e2c77fdae97ee70cc33ad5bd2b9ecd3f4388044b · re-run with @qwen-code /triage}

Code review

The approach matches what I'd have proposed independently — new tool beside get_goal / update_goal, reuse the existing info confirmation so no host needs new UI, gate registration on host capability and the opt-out setting, user-scope-only consent, skill hand-off with the text fallback kept. I verified the load-bearing claims against the base code rather than taking the PR's word for them:

• The dialog cannot be skipped. requiresUserInteraction() is an established mechanism (used by exit_plan_mode) and I checked every bypass route in the scheduler: permissionFlow forces ask over allow rules when it is set; needsConfirmation returns true before the YOLO override; the AUTO-mode three-layer filter, the AUTO_EDIT auto-approval of info dialogs, and the PermissionRequest hook's allow path are all guarded by !requiresUserInteraction (hooks can still deny). The scheduler also sets hideAlwaysAllow, which matches the evidence showing only "Yes, allow once" / "No". Deny rules still work, as they should.
• Registration gating is structural, not advisory. The registration sits inside registerGoalWorkerTools, which early-returns for subagent contexts; the new gate checks resolveInteractionMode !== 'headless' and the setting. Headless, subagents, and the disabled setting all miss the tool; the registration-matrix tests pin this.
• TOCTOU handling is real. Preconditions run before the dialog and again in execute(); a replace carries expectedGoalId / expectedRevision and the goal reducer's version assert turns a concurrent /goal change into a friendly refusal instead of a clobber. Without an onConfirm approval the invocation fails closed (approved stays false).
• Scope restriction works through the existing generic machinery. WORKSPACE_RESTRICTED_SETTINGS strips workspace values and warns; the Settings type is schema-derived so the new goals section type-checks end to end; the CLI normalizer closes the enum before it reaches core. Same pattern as agents.crossSession*.
• renderPromptAsPlainText and the info confirmation are established surfaces (the Workflow tool uses both), so no host renders anything new.

One non-blocking nit: propose_goal isn't added to the two existing goal-tool enumerations — the chat-recording goal_runtime provenance tagging (coreToolScheduler.ts ~6294, useGeminiStream.ts ~3936/~4878) and the tool-use summarizer exclusion (useGeminiStream.ts ~5052). Practical impact is small: the tool refuses while a Goal is active, so it effectively never carries a goalContext, and the exclusion only matters because a fast-model summary could echo beside the tool's own "Goal set · …" display. Worth adding for consistency in a follow-up or a quick amend — not a merge blocker.

sequenceDiagram
    participant P1 as Model
    participant P2 as Tool scheduler
    participant P3 as ProposeGoalInvocation
    participant P4 as User dialog
    participant P5 as Goal runtime
    P1->>P2: calls propose_goal with objective
    P2->>P3: permission flow forces ask and hides always-allow
    P3->>P3: checks plan mode, trust, persistence, active Goal
    P3->>P4: info dialog with the full objective
    P4-->>P3: approve or decline
    P3->>P5: dispatch create or versioned replace
    P5-->>P3: Goal record or conflict error
    P3-->>P1: result telling it to acknowledge and end the turn
    P5->>P5: broadcast renders Goal card and starts first Goal turn

Testing evidence (the PR's own CI — per policy this review does not run PR code)

The ubuntu unit suite and the web-shell visual capture are still running as of this review; the windows/macos unit jobs and the CLI integration job were skipped by workflow conditions (not failures). The Desktop Shell jobs on both platforms passed — those compile the whole monorepo including this diff, which is a real build signal. No red checks on this commit at review time.

Final CI results for e2c77fd (auto-updated by the triage finalize job after CI completed):

_{One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。}

The remaining checks on the commit are bot orchestration (review-pr, label, authorize, …). Not verified: live TUI/Web Shell/ACP rendering of the dialog — the author's tmux capture below is their evidence, not an independent re-run:

Sandboxed verification would settle this: @qwen-code /tmux — that the approval dialog actually renders with the full objective under YOLO and that approving it starts the first Goal turn currently rests on the author's tmux capture (Linux only); the unit suite pins the gating logic but not host rendering. (@qwen-code /verify would settle the A/B behavioural side.) The author has write access, so a maintainer trigger is all it takes.

— Qwen Code · qwen3.8-max

_{Reviewed at e2c77fdae97ee70cc33ad5bd2b9ecd3f4388044b · re-run with @qwen-code /triage}

Confidence: 4/5 — clean, minimal, direction pre-approved in the merged design doc; the only open items are the non-blocking enumeration nit and CI still in flight.

Stepping back: this is exactly the follow-up phase the goal-draft design note promised, and it lands the hard parts right. My independent proposal for this feature and the PR's implementation converge on the same shape, and where the PR goes further — the versioned replace, the double precondition check across the dialog window, the closed-enum normalizer, the workspace-scope lockdown — each addition earns its place. Nothing in the diff is unrelated, nothing feels over-engineered, and the security model (consent for starting an autonomous loop must come from a human at a dialog that no rule or mode can skip) verifies cleanly against the scheduler code, not just against the PR's description. The test suite pins the behaviors that matter rather than the implementation details.

Reservations, plainly stated: the cross-host rendering of the dialog (TUI buttons, Web Shell description-only approval, ACP) is covered by unit tests and the author's tmux session but not independently exercised here, and the ubuntu unit suite had not finished when this review ran. Neither is a reason to hold the PR — they are what the green-CI precondition and the sandboxed lanes above are for.

Verdict: approve, with approval deferred until CI lands green on e2c77fdae97ee70cc33ad5bd2b9ecd3f4388044b (the ubuntu unit suite and web-shell visuals are still in flight). If anything lands red, the finalize step flags it instead of approving.

— Qwen Code · qwen3.8-max

_{Reviewed at e2c77fdae97ee70cc33ad5bd2b9ecd3f4388044b · re-run with @qwen-code /triage}

🖼️ web-shell visual preview

Rendered against a mock daemon (no real backend): the PR base vs this PR head 5c640ce. Only screenshots that changed are shown (flows below, if any, are head-only) — refreshes on every push.

Screenshots · before / after

_{Full-resolution recordings (.webm) are attached to the workflow run.}

— Qwen Code · web-shell visuals

已修复 ProposeGoal 的 CLI 工具名翻译覆盖，补齐 en、zh、zh-TW。验证：CLI i18n 31/31、全仓 typecheck、完整 build/bundle 均通过。

Merged main (103 commits; the only conflict was the settings table row — resolved by re-inserting the row into main's table, net diff still +1 line) and closed out the review rounds:

• Every R1 / R3 thread now has a reply pointing at the commit and test that covers it, and is resolved. Mutation-checked today against client-goal.test.ts: commenting out any of the three tail settle sites, the UserQuery-entry discard, or the !turnEnded gate turns the suite red.
• 751799f adds the tests round 3 asked for (set-once refusal branch, consumed-slot assertion on abort, interactive+stream-json / interactive+Zed registration divergence, runtime-rebuild clears the slot, loadCliConfig wiring for goals.modelProposed), each verified red under its mutation, and fixes the LlmEventType rename that merging main introduced into the bot's test.
• Docs: goals.md no longer claims Web Shell has propose_goal; Web Shell / ACP keep the printed /goal set hand-off until they have a turn-boundary settlement path (follow-up). The PR body's registration and settlement paragraphs are updated to match HEAD.

Verification at 751799f: core tsc --noEmit clean; core client-goal + goal-tools + config 678 tests, cli config (goals.modelProposed + normalize) 4 tests; full npm run build green.

@qwen-code /takeover

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This is a fork PR, so the first round comes from the next scheduled scan (usually within minutes). Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

🤖 AutoFix hit a verification-gate error before reaching a verdict (attempt 11/100) — it will retry on the next scan.

⚠️ This change was NOT pushed — any commit referenced below was made only in the runner workspace and has been discarded. What the agent reported:
This round (head 9f1df49b8f): merged origin/main as requested (--conflict true), verified and declined the remaining Critical with production-runtime evidence, and addressed the two non-blocking observations from @wenshao's round-2 verification.

Base conflict resolution (--conflict true)

Merged origin/main (41 commits). One conflict, in the docs/users/configuration/settings.md settings table:

• origin/main updated the tools.eager wording (test(core): pin tools.eager Object.prototype-key tolerance and correct related docs #10479) and re-padded the table; this PR carries the goals.modelProposed row. Resolved by keeping main's table and re-inserting the goals.modelProposed row at its position (after tools.workflowsEnabled) — the same approach used when this table conflicted in the earlier merge.
• All other files (including client.ts, client-goal.test.ts, config.ts) auto-merged cleanly; the goal code was untouched by incoming commits.

Feedback dispositions

R9-1 (Critical, rc:3890179439) — Declined with probe evidence

The round-9 finding claims the goal-permit early-return path can exit with an approved proposal still parked, because pause does not bump the revision so the permit "remains valid under isCurrentPermit". I re-ran the exact chain against the production createGoalRuntime (not the mock runtime): Goal active → UserQuery admitted with a beginTurn permit → dispatch({ action: 'pause' }) mid-turn → approval parked under the turn's prompt id → turn ends with no tool calls. Probe report:

Run log: https://github.com/QwenLM/qwen-code/actions/runs/33424919148

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

@qwen-code /resolve

🤖 AutoFix hit a verification-gate error before reaching a verdict (attempt 12/100) — it will retry on the next scan.

⚠️ This change was NOT pushed — any commit referenced below was made only in the runner workspace and has been discarded. What the agent reported:

Round summary — PR #10171 (Critical-only window, conflict round)

Critical-only mode is active (window seeded at round 9, round counter ≥ 5). This round: merged origin/main (requested conflict resolution), disposed of the one new Critical (R9-1), re-verified the standing Criticals fixed by earlier commits, and addressed the two non-blocking observations from the maintainer's round-2 E2E (the only human feedback still in budget).

Base-conflict resolution (required, --conflict true)

Merged origin/main @ bd59085311 (42 commits) as 11e5145cb1. Exactly one conflict: the #### tools table in docs/users/configuration/settings.md — main re-flowed the table padding while this PR carries the added goals.modelProposed row. Resolved by understanding both sides: kept main's table verbatim and re-inserted the goals.modelProposed row (net +1 line, same resolution shape as the previous main-sync), then normalized with prettier. All code files auto-merged; the notable upstream overlaps (output-style turn reminder #10282 in client.ts/client-goal.test.ts, Goal token budget #10543 in the config files, extension skill state #10600) landed beside this PR's hunks and are covered by the verification below.

Feedback dispositions

R9-1 (Critical, rc:3890179439) — Declined as refuted (probe-verified). The claimed chain requires finishTurn(goalPermit) to succeed on the goal-permit early-return path after a mid-turn Goal pause. A probe against the real `create

Run log: https://github.com/QwenLM/qwen-code/actions/runs/33440419108

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

Qwen Code attempted to resolve merge conflicts but the run did not complete successfully.

Check the workflow run for full logs.

@qwen-code /resolve

🤖 AutoFix ran out of time before finishing (timeout (3600000ms)) (attempt 13/100) — it will retry on the next scan.

⚠️ This change was NOT pushed — any commit referenced below was made only in the runner workspace and has been discarded. What the agent reported:
Qwen failed during address-review: timeout (3600000ms).

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/33452214748

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

Qwen Code resolved the merge conflicts and pushed the branch update. The head branch moved to 9d54eab868778e5bc6bbd35fed05e15311305d62 while the conflicts were being resolved; the resolution was replayed on top of it and re-checked before the push — where a file still conflicted and the new commits had not touched it, the replay took the agent's version. The pushed branch is that replay: its diff against main is attached as the qwen-resolve-pr-10171-pushed artifact on the workflow run; the qwen-resolve-pr-10171-attempt-1 artifact describes the original resolution it was replayed from.

Merge resolution — PR #10171 ← upstream/main

Root cause. Main's #10479 (f86098363d) rewrote every row of the #### tools table in docs/users/configuration/settings.md — correcting the tools.core description (deny semantics for MCP tools) and tools.eager (two carve-outs for resumed sessions / tools.visible) — which widened the Description column and re-padded all 24 rows. This PR inserts one new row (goals.modelProposed) into the middle of that same table. Both edits hit the same contiguous table block, so git could not auto-merge.

Textual, not semantic. The sides modified no shared row: main re-padded/edited existing rows, the PR only added one. Everything outside the table auto-merged. Resolution = keep main's table intact, re-insert the PR's row at the author's chosen position, re-padded to the new column widths:

| `goals.modelProposed` | enum | Controls the `propose_goal` tool … | `alwaysAsk` | User, System, and SystemDefaults scopes … |

(abbreviated; the real row is space-padded to 1823 chars like every other table row)

What is load-bearing.

1. Row order: goals.modelProposed sits between tools.workflowsEnabled and tools.truncateToolOutputThreshold — where the PR author placed it. This doc has no #### goals section; the setting lives in the tools table because it controls a tool.
2. Padding invariant: every table row is exactly uniform in width (now 1823 chars; 1643 before main's change); prettier enforces this. The Description column is padded to 1428 chars, dictated by main's lengthened tools.core description. A row inserted at the old width would be rewritten by the next format run.
3. tools.core / tools.eager descriptions must stay at main's wording; the PR never touched those cells.

Could not verify. No build/typecheck/tests run (out of scope). Only the conflicted file was modified. Cross-checks done: all 8 files referencing modelProposed (settingsSchema.ts, both packages' config.ts + config.test.ts, settingsUtils.ts, settings.test.ts, settings.schema.json) auto-merged and carry the PR's references in identical counts; the merged diff vs main contains only the one added row for this file. Doc-only change — no caller or test depends on it.

Released in v0.23.0.