An agent that hears “no” from an automatic policy has two bad ways to fail. It can keep trying equivalent commands until the policy becomes theater, or it can stop cold while the person who owns the work never gets a useful decision to make. Qwen Code’s merged AUTO-mode recovery change enters that gap.
It tries to keep the narrow path between them: after its classifier blocks a tool call, the agent may repeat that exact call once and put it in front of a human for manual review.
That word—exact—does the work. The public merge commit derives a repeat key from the tool, canonicalized arguments, and current working directory. A pending retry remembers that fingerprint; the next matching call goes to ordinary manual confirmation and the marker is consumed before the prompt is displayed. Change the command’s arguments or move it to another directory, and it is a new action for the classifier to assess—not a continuation of yesterday’s refusal.
The pause has to preserve the action’s identity
The design matters because a generic “try again manually” button would be an ambiguity machine. Was the person approving the same write, a rewritten shell command, or a different location? Qwen’s state tracks the blocked action rather than granting a broad exception. Its confirmation code also keeps persistent approval out of this recovery path. The human can allow once or cancel; the session’s AUTO setting does not quietly become a standing pass.
The boundary is firmer for destructive commands. The changed policy guidance still says an action in that class must stop and ask for explicit approval; it does not receive the classifier-blocked retry recipe. The implementation and its scheduler, permission, ACP, and UI tests establish that intended split. They do not prove a live model will classify every command well, or that the change is already in a released package.
Safety needs a legible handoff
The useful lesson is not that agents should push through a denial. It is that a denial needs to leave behind an object a person can inspect: this tool, these arguments, this directory, this one decision. Qwen’s public issue trail makes the user situation visible; the source makes the constraint visible. The next signal worth watching is whether that one-shot review stays comprehensible under real provider failures and complicated workspaces—without ever becoming an invitation to edit the request until a guard stops noticing it.