@qwen-code/qwen-code 0.19.10 → 0.19.11-nightly.20260717.f8e6e8931

package/chunks/{server-NJPHQHLH.js → server-G5MM2BRI.js}

@@ -1,22 +1,25 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
-  openQwenAsrRealtimeStream,
-  openVoiceStream,
-  openVoiceStreamWithRetry
-} from "./chunk-JSJFKYWT.js";
-import {
+  GENERATION_MAX_PROMPT_BYTES,
   MAX_REMEMBER_CONTENT_BYTES,
   createWorkspaceMemoryExtractionErrorLogger,
   extractRememberErrorCode,
   formatWorkspaceMemoryDreamSummary,
   formatWorkspaceMemoryForgetSummary,
   isValidServerName,
+  redactMcpServersSetting,
   replayTranscriptRecordPage,
+  restoreRedactedMcpServersSetting,
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-6W6DI34P.js";
+} from "./chunk-SE6GSFAO.js";
+import {
+  openQwenAsrRealtimeStream,
+  openVoiceStream,
+  openVoiceStreamWithRetry
+} from "./chunk-5VWYKIMW.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -27,9 +30,9 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-4FMG7EDJ.js";
-import "./chunk-SPUYQB4T.js";
-import "./chunk-WTSXKLG5.js";
+} from "./chunk-AEKHQ3E5.js";
+import "./chunk-DPXB3XRN.js";
+import "./chunk-SUARMD4Q.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-L573Z2QZ.js";
 import {
@@ -62,9 +65,11 @@ import {
   denyBrowserOriginCors,
   detectFromLoopback,
   getAdvertisedServeFeatures,
+  getDeferredRuntimeRequestTiming,
   getServeProtocolVersions,
   hostAllowlist,
   isBrowserAutomationMcpAvailable,
+  isDeepHealthQuery,
   parseAllowOriginPatterns,
   parseAndValidateWorkspaceClientId,
   parseClientIdHeader,
@@ -85,28 +90,29 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-MO7O5722.js";
+} from "./chunk-KW46DBFM.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-ZQTZXVHP.js";
-import "./chunk-WDWJ4OQJ.js";
+} from "./chunk-3KSHYS4T.js";
+import "./chunk-LXXMOYPL.js";
+import "./chunk-CC2UASQ4.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-7MJAZMXK.js";
+} from "./chunk-BZ5D7OVV.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-GGJII3FM.js";
+} from "./chunk-WZJELXEU.js";
 import {
   snapshotProcessEnv
-} from "./chunk-ZKMGAFYV.js";
+} from "./chunk-3LS57JZI.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-WLXYAKV7.js";
+} from "./chunk-D7KYA6EY.js";
 import "./chunk-2W3OOD4W.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
@@ -118,14 +124,14 @@ import {
   transcribeWorkspaceVoiceAudio,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-OFEVHGVU.js";
+} from "./chunk-X5HZX4EP.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-N6FXRR6P.js";
+} from "./chunk-7ZFXHKKZ.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -133,12 +139,12 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-FXMC7SL2.js";
+} from "./chunk-I6NOSIVF.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-DPFBNG72.js";
+} from "./chunk-4UBEB74N.js";
 import "./chunk-FSA7ERJ2.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
@@ -148,24 +154,24 @@ import {
 } from "./chunk-OA4JVLSA.js";
 import {
   createTotalSessionAdmissionController
-} from "./chunk-7R4DPSRA.js";
+} from "./chunk-R3VWUU2E.js";
 import {
   createSingleWorkspaceRegistry,
   createWorkspaceSessionOwnerIndex
-} from "./chunk-YHN5SUIJ.js";
+} from "./chunk-W7H223ZZ.js";
 import "./chunk-GRC5HGPI.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
-  createAcpSessionBridge
-} from "./chunk-HHEFI4RP.js";
+  createAcpSessionBridge,
+  parseSessionSource
+} from "./chunk-YOJGIRTD.js";
 import "./chunk-PZL23GTM.js";
 import {
   EVENT_SCHEMA_VERSION,
   SubscriberLimitExceededError
 } from "./chunk-6RLROE6G.js";
 import "./chunk-COH43MRJ.js";
-import "./chunk-OCPBI7J5.js";
 import {
   BranchWhilePromptActiveError,
   CancelSentinelCollisionError,
@@ -186,6 +192,7 @@ import {
   SessionBusyError,
   SessionConflictError,
   SessionLimitExceededError,
+  SessionNotArchivedError,
   SessionNotFoundError,
   SessionShellClientRequiredError,
   SessionShellDisabledError,
@@ -196,39 +203,44 @@ import {
   WorkspaceInitRaceError,
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
-} from "./chunk-KSO42X3Z.js";
+} from "./chunk-X6YQWCIJ.js";
 import "./chunk-WBL3FJEU.js";
 import {
   loadChannelsConfig
-} from "./chunk-Q5GLXH5Q.js";
-import "./chunk-AAR5SGMD.js";
+} from "./chunk-UJG4VV2O.js";
+import "./chunk-4YR7FSAM.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-OATTJGPJ.js";
-import "./chunk-ZRKBI3DP.js";
+} from "./chunk-5CNYZ7TN.js";
+import "./chunk-FNX3LGAK.js";
 import "./chunk-V6WHFGST.js";
-import "./chunk-UFOKA4PR.js";
-import "./chunk-TEGEBB2I.js";
+import "./chunk-VHCSIMTF.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-CUUXANEQ.js";
+} from "./chunk-W6J7RSCK.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceRegistrationStoreCommittedError,
   WorkspaceRegistrationStoreLimitError,
   workspaceRegistrationId
-} from "./chunk-L37RC7MQ.js";
+} from "./chunk-4HTHLSIH.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
   canonicalizeWorkspaces
 } from "./chunk-W7FJ3N32.js";
 import {
-  QWEN_SERVER_TOKEN_ENV
-} from "./chunk-GYTKQYDB.js";
+  MAX_CHANNEL_STARTUP_FAILURES,
+  MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
+  MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
+  MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
+  QWEN_SERVER_TOKEN_ENV,
+  isChannelWebhookEnqueueError,
+  normalizeWorkerDiagnostic
+} from "./chunk-KSZKSE23.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-TJTKSVIV.js";
@@ -236,11 +248,10 @@ import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import "./chunk-5HBA2Z7V.js";
-import {
-  isChannelWebhookEnqueueError
-} from "./chunk-OJAMDVF5.js";
 import "./chunk-T2NCM2ET.js";
-import "./chunk-SXU3KKNI.js";
+import {
+  sanitizeLogText
+} from "./chunk-ZQIYGQCG.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -251,18 +262,18 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-6GETGQWP.js";
+} from "./chunk-5WWYHNAH.js";
 import "./chunk-RKUWKYED.js";
 import {
   SUPPORTED_LANGUAGES
-} from "./chunk-RDRVMDWV.js";
-import "./chunk-5EBKKSBX.js";
+} from "./chunk-EMJJBXS7.js";
+import "./chunk-JY74T7PW.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import "./chunk-QRUIS3DN.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-4YWLED2A.js";
+} from "./chunk-PNCWEDF6.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -270,7 +281,7 @@ import {
 import {
   writeStderrLine
 } from "./chunk-YUZI3WAC.js";
-import "./chunk-YU56QGXX.js";
+import "./chunk-Y3TNSHKF.js";
 import "./chunk-VJNBRRZG.js";
 import {
   ALL_PROVIDERS,
@@ -284,6 +295,7 @@ import {
   InvalidSessionTranscriptCursorError,
   ModelsConfig,
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
+  SESSION_TRANSCRIPT_MAX_INDEX_BYTES,
   SESSION_TRANSCRIPT_MAX_LIMIT,
   SessionOrganizationError,
   SessionOrganizationService,
@@ -315,18 +327,18 @@ import {
   stripTerminalControlSequences,
   watchRepoBranch,
   writeWorkspaceContextFile
-} from "./chunk-K7CRWKOE.js";
+} from "./chunk-R6AO7HBQ.js";
+import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-E67NFMF4.js";
+} from "./chunk-A2HWMJVO.js";
 import "./chunk-RCEEXIOO.js";
 import "./chunk-KKRTYONM.js";
 import "./chunk-TV6K2FB4.js";
 import "./chunk-E2UVIFI2.js";
-import "./chunk-6OATMEYN.js";
 import {
   nextFireTime,
   parseCron
@@ -347,7 +359,7 @@ import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-TXY2C3D2.js";
+} from "./chunk-F333XEAU.js";
 import "./chunk-6AM5D4ME.js";
 import "./chunk-2Z5UX4KI.js";
 import "./chunk-ARKANCNX.js";
@@ -366,15 +378,15 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-P6LART6G.js";
+} from "./chunk-BTSE2DUP.js";
 import "./chunk-4WKAA4KS.js";
 import "./chunk-CR3C7WXL.js";
-import "./chunk-CARU2RR2.js";
+import "./chunk-RTV5TUYB.js";
 import "./chunk-VGC4I5JJ.js";
 import "./chunk-FBU7WRZI.js";
 import "./chunk-Y66VOBRP.js";
-import "./chunk-WX6SD4IQ.js";
-import "./chunk-2UUAIFQO.js";
+import "./chunk-WTNZ6DXB.js";
+import "./chunk-JGUT3LWZ.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -388,8 +400,8 @@ import "./chunk-ZPAHLFZU.js";
 import "./chunk-JESCGQM3.js";
 import "./chunk-WIEO4CWB.js";
 import "./chunk-XVNQMZ2I.js";
-import "./chunk-B7NUUEXC.js";
-import "./chunk-TQBODCFD.js";
+import "./chunk-FEOZBUMT.js";
+import "./chunk-VRR65QYW.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
 import "./chunk-4LD5APFL.js";
@@ -2900,7 +2912,7 @@ async function handleSetupGithub(req, res, deps) {
     const result = await setupGithub({
       cwd: deps.boundWorkspace,
       workspaceRoot: deps.boundWorkspace,
-      proxy: resolveSetupGithubProxy(deps.boundWorkspace),
+      proxy: resolveSetupGithubProxy(deps.boundWorkspace, deps.env),
       abortSignal: requestAbortSignal(req, res),
       fileOps: createSetupGithubFileOps(factory, ROUTE, originatorClientId)
     });
@@ -3118,14 +3130,14 @@ function setupGithubEventData(result) {
   };
 }
 __name(setupGithubEventData, "setupGithubEventData");
-function resolveSetupGithubProxy(boundWorkspace) {
+function resolveSetupGithubProxy(boundWorkspace, env) {
   const settings = loadSettings(boundWorkspace, { skipLoadEnvironment: true });
   const trustState = getWorkspaceTrustStatus(
     settingsForSetupGithubTrust(settings),
     boundWorkspace
   ).effective.state;
   const settingsProxy = trustState === "trusted" ? settings.merged.proxy : settings.user.settings.proxy || settings.system.settings.proxy || settings.systemDefaults.settings.proxy;
-  return settingsProxy || process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env["http_proxy"];
+  return settingsProxy || env["HTTPS_PROXY"] || env["https_proxy"] || env["HTTP_PROXY"] || env["http_proxy"];
 }
 __name(resolveSetupGithubProxy, "resolveSetupGithubProxy");
 function settingsForSetupGithubTrust(settings) {
@@ -6226,6 +6238,21 @@ async function assertSessionLoadable(workspaceCwd, sessionId) {
   return location;
 }
 __name(assertSessionLoadable, "assertSessionLoadable");
+async function assertSessionArchived(workspaceCwd, sessionId) {
+  const location = await new SessionService(workspaceCwd).getSessionLocation(
+    sessionId
+  );
+  if (location === "active") {
+    throw new SessionNotArchivedError(sessionId);
+  }
+  if (location === "conflict") {
+    throw new SessionConflictError(sessionId);
+  }
+  if (location === void 0) {
+    throw new SessionNotFoundError(sessionId);
+  }
+}
+__name(assertSessionArchived, "assertSessionArchived");
 function isSessionNotFoundError(err) {
   return err instanceof SessionNotFoundError || err instanceof Error && err.name === "SessionNotFoundError";
 }
@@ -6928,9 +6955,10 @@ function rpcErrorFrame(id, err) {
 __name(rpcErrorFrame, "rpcErrorFrame");
 var ACP_PROTOCOL_VERSION = 1;
 var AcpDispatcher = class {
-  constructor(bridge, boundWorkspace, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
+  constructor(bridge, boundWorkspace, env, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
     this.bridge = bridge;
     this.boundWorkspace = boundWorkspace;
+    this.env = env;
     this.workspace = workspace;
     this.workspaceRememberLane = workspaceRememberLane;
     this.fsFactory = fsFactory;
@@ -6944,8 +6972,14 @@ var AcpDispatcher = class {
     __name(this, "AcpDispatcher");
   }
   agentManager;
-  killOrphanSession(sessionId) {
-    void this.bridge.killSession(sessionId, { requireZeroAttaches: true }).catch(
+  killOrphanSession(sessionId, removePersistedSession = false) {
+    void this.bridge.killSession(sessionId, { requireZeroAttaches: true }).then(async (killed) => {
+      if (killed && removePersistedSession) {
+        await new SessionService(this.boundWorkspace).removeSession(
+          sessionId
+        );
+      }
+    }).catch(
       (err) => writeStderrLine(
         `qwen serve: /acp orphan killSession(${logSafe(sessionId)}) failed: ${logSafe(errMsg(err))}`
       )
@@ -7229,26 +7263,40 @@ var AcpDispatcher = class {
           return;
         case "session/new": {
           const cwd = parseOptionalWorkspaceCwd2(params, this.boundWorkspace);
+          const source = parseSessionSource(
+            params["sourceType"],
+            params["sourceId"]
+          );
+          if ("error" in source) {
+            if (id !== void 0) {
+              conn.sendConn(error(id, RPC.INVALID_PARAMS, source.error));
+            }
+            return;
+          }
           const session = await this.bridge.spawnOrAttach({
             workspaceCwd: cwd,
             clientId: conn.clientId,
-            sessionScope: "thread"
+            sessionScope: "thread",
+            ...source
           });
           if (conn.destroyed) {
-            this.killOrphanSession(session.sessionId);
+            this.killOrphanSession(session.sessionId, true);
             return;
           }
           conn.getOrCreateSession(session.sessionId).clientId = session.clientId;
           conn.ownSession(session.sessionId);
           const configOptions = await this.configOptionsFor(session.sessionId);
           if (conn.destroyed) {
-            this.killOrphanSession(session.sessionId);
+            this.killOrphanSession(session.sessionId, true);
             return;
           }
           const models = this.extractModelState(configOptions);
           const modes = this.extractModeState(configOptions);
           this.replyConn(conn, id, {
             sessionId: session.sessionId,
+            ...session.sourceType ? { sourceType: session.sourceType } : {},
+            ...session.sourceId !== void 0 ? { sourceId: session.sourceId } : {},
+            ...session.sourcePersisted !== void 0 ? { sourcePersisted: session.sourcePersisted } : {},
             ...configOptions ? { configOptions } : {},
             ...models ? { models } : {},
             ...modes ? { modes } : {}
@@ -7283,20 +7331,20 @@ var AcpDispatcher = class {
             [sessionId],
             async () => {
               await assertSessionLoadable(cwd, sessionId);
-              const parentSessionId = await new SessionService(
+              const metadata = await new SessionService(
                 cwd
-              ).readParentSessionId(sessionId);
+              ).readCreationMetadata(sessionId);
               return method === "session/load" ? await this.bridge.loadSession({
                 sessionId,
                 workspaceCwd: cwd,
                 clientId: conn.clientId,
                 historyReplay: "response",
-                ...parentSessionId !== void 0 ? { parentSessionId } : {}
+                ...metadata
               }) : await this.bridge.resumeSession({
                 sessionId,
                 workspaceCwd: cwd,
                 clientId: conn.clientId,
-                ...parentSessionId !== void 0 ? { parentSessionId } : {}
+                ...metadata
               });
             }
           );
@@ -7395,6 +7443,13 @@ var AcpDispatcher = class {
               );
             }
           }
+          const parsedSource = parseSessionSource(
+            params["sourceType"],
+            params["sourceId"]
+          );
+          if ("error" in parsedSource) {
+            throw new AcpParamError(parsedSource.error);
+          }
           const result = await listWorkspaceSessionsForResponse(
             this.bridge,
             workspaceCwd,
@@ -7404,7 +7459,8 @@ var AcpDispatcher = class {
               archiveState,
               view,
               group,
-              parentSessionId
+              parentSessionId,
+              ...parsedSource
             }
           );
           this.replyConn(conn, id, {
@@ -7417,6 +7473,8 @@ var AcpDispatcher = class {
               displayName: s.displayName,
               title: s.displayName,
               ...s.parentSessionId !== void 0 ? { parentSessionId: s.parentSessionId } : {},
+              ...s.sourceType !== void 0 ? { sourceType: s.sourceType } : {},
+              ...s.sourceId !== void 0 ? { sourceId: s.sourceId } : {},
               clientCount: s.clientCount,
               hasActivePrompt: s.hasActivePrompt,
               isArchived: s.isArchived === true,
@@ -8277,7 +8335,7 @@ var AcpDispatcher = class {
             const result = await setupGithub({
               cwd: this.boundWorkspace,
               workspaceRoot: this.boundWorkspace,
-              proxy: resolveSetupGithubProxy(this.boundWorkspace),
+              proxy: resolveSetupGithubProxy(this.boundWorkspace, this.env),
               abortSignal: conn.abortSignal,
               fileOps: createSetupGithubFileOps(
                 this.fsFactory,
@@ -11748,11 +11806,11 @@ function delay(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 __name(delay, "delay");
-function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname) {
+function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname, env) {
   if (localPort === void 0 || !Number.isInteger(localPort) || localPort <= 0) {
     return void 0;
   }
-  const command = resolveCdpMcpCommand(process.env);
+  const command = resolveCdpMcpCommand(env);
   if (!command) {
     writeStderrLine(
       `qwen serve: set ${QWEN_CDP_MCP_COMMAND_ENV} to enable browser automation MCP (no adapter is bundled)`
@@ -11858,9 +11916,18 @@ function workspaceRateLimitKey(mount, clientKey) {
   return JSON.stringify([clientKey, mount.rateLimitScope]);
 }
 __name(workspaceRateLimitKey, "workspaceRateLimitKey");
+function runtimeEffectiveEnv(runtime, daemonEnv) {
+  if (runtime.env.mode === "runtime-overlay") {
+    return runtime.env.effectiveEnv ?? {};
+  }
+  return runtime.env.effectiveEnv ?? daemonEnv;
+}
+__name(runtimeEffectiveEnv, "runtimeEffectiveEnv");
 function mountAcpHttp(app, bridge, opts) {
   const enabled = opts.enabled ?? resolveAcpHttpEnabled();
   if (!enabled) return void 0;
+  const daemonEnv = opts.daemonEnv ?? process.env;
+  const primaryEnv = opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv;
   const path15 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
@@ -11950,7 +12017,8 @@ function mountAcpHttp(app, bridge, opts) {
     }
     const runtimeConfig = buildChromeDevToolsMcpRuntimeConfig(
       localPort,
-      opts.hostname
+      opts.hostname,
+      daemonEnv
     );
     if (!runtimeConfig) {
       cdpMcpTerminalSkipLogged = true;
@@ -12009,6 +12077,7 @@ function mountAcpHttp(app, bridge, opts) {
   const dispatcher = new AcpDispatcher(
     bridge,
     opts.boundWorkspace,
+    primaryEnv,
     opts.workspace,
     opts.workspaceRememberLane,
     opts.fsFactory,
@@ -12297,6 +12366,7 @@ function mountAcpHttp(app, bridge, opts) {
     const secondaryDispatcher = new AcpDispatcher(
       rt.bridge,
       rt.workspaceCwd,
+      runtimeEffectiveEnv(rt, daemonEnv),
       rt.workspaceService,
       workspaceRememberLane,
       rt.routeFileSystemFactory,
@@ -14402,7 +14472,13 @@ __name(getDemoHtml, "getDemoHtml");
 
 // packages/cli/src/serve/routes/health-demo.ts
 function createHealthDemoRoutes(deps) {
-  const { opts, getPort, bridge, getActiveSseCount: getActiveSseCount2, getRateLimiter } = deps;
+  const {
+    opts,
+    getPort,
+    workspaceRegistry,
+    getActiveSseCount: getActiveSseCount2,
+    getRateLimiter
+  } = deps;
   const demoHandler = /* @__PURE__ */ __name((_req, res) => {
     try {
       res.type("html").set("X-Frame-Options", "DENY").set(
@@ -14417,32 +14493,55 @@ function createHealthDemoRoutes(deps) {
     }
   }, "demoHandler");
   const healthHandler = /* @__PURE__ */ __name((req, res) => {
-    const deepQuery = req.query["deep"];
-    const deep = deepQuery === "1" || deepQuery === "true" || deepQuery === "";
-    if (!deep) {
+    if (!isDeepHealthQuery(req.query["deep"])) {
       res.status(200).json({ status: "ok" });
       return;
     }
+    let failedWorkspaceId;
     try {
-      const lastActivity = bridge.lastActivityAt;
+      const runtimes = workspaceRegistry.listManaged();
+      let sessions = 0;
+      let pendingPermissions = 0;
+      let activePrompts = 0;
+      let channelAlive = false;
+      let lastActivity = null;
+      for (const runtime of runtimes) {
+        failedWorkspaceId = runtime.workspaceId;
+        const bridge = runtime.bridge;
+        const runtimeSessions = bridge.sessionCount;
+        const runtimePendingPermissions = bridge.pendingPermissionCount;
+        const runtimeActivePrompts = bridge.activePromptCount;
+        const runtimeChannelAlive = bridge.isChannelLive();
+        const runtimeLastActivity = bridge.lastActivityAt;
+        sessions += runtimeSessions;
+        pendingPermissions += runtimePendingPermissions;
+        activePrompts += runtimeActivePrompts;
+        channelAlive = channelAlive || runtimeChannelAlive;
+        if (runtimeLastActivity !== null && (lastActivity === null || runtimeLastActivity > lastActivity)) {
+          lastActivity = runtimeLastActivity;
+        }
+        failedWorkspaceId = void 0;
+      }
       const now = Date.now();
       const rateLimiter = getRateLimiter();
       res.status(200).json({
         status: "ok",
-        sessions: bridge.sessionCount,
-        pendingPermissions: bridge.pendingPermissionCount,
-        activePrompts: bridge.activePromptCount,
+        workspaceCount: runtimes.length,
+        sessions,
+        pendingPermissions,
+        activePrompts,
         connectedClients: getActiveSseCount2(),
-        channelAlive: bridge.isChannelLive(),
+        channelAlive,
         lastActivityAt: lastActivity !== null ? new Date(lastActivity).toISOString() : null,
         idleSinceMs: lastActivity !== null ? now - lastActivity : null,
         ...rateLimiter ? { rateLimitHits: rateLimiter.getHitCounts() } : {}
       });
     } catch (err) {
+      const workspaceContext = failedWorkspaceId !== void 0 ? ` for workspace ${JSON.stringify(failedWorkspaceId)}` : "";
       writeStderrLine(
-        `qwen serve: /health deep probe failed: ${err instanceof Error ? err.message : String(err)}`
+        `qwen serve: /health deep probe failed${workspaceContext}: ${err instanceof Error ? err.message : String(err)}`
       );
-      res.status(503).json({ status: "degraded" });
+      res.status(503).json({ status: "degraded", reason: "aggregation_failed" });
     }
   }, "healthHandler");
   const loopback = isLoopbackBind(opts.hostname);
@@ -14950,6 +15049,7 @@ __name(registerWorkspaceAuthRoutes, "registerWorkspaceAuthRoutes");
 
 // packages/cli/src/serve/routes/workspace-extensions.ts
 init_esbuild_shims();
+import * as crypto2 from "node:crypto";
 
 // packages/cli/src/serve/extension-operation-scheduler.ts
 init_esbuild_shims();
@@ -15029,6 +15129,18 @@ init_esbuild_shims();
 import * as crypto from "node:crypto";
 var MAX_UNFINISHED_EXTENSION_OPERATIONS = 10;
 var sanitizeDaemonMessage = /* @__PURE__ */ __name((message) => redactUrlCredentials(stripAnsiAndControl(message)), "sanitizeDaemonMessage");
+var redactExtensionDisplaySource = /* @__PURE__ */ __name((source) => {
+  const redacted = redactUrlCredentials(source);
+  if (/^[A-Za-z]:[\\/]/.test(redacted)) return redacted;
+  try {
+    const url = new URL(redacted);
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return redacted;
+  }
+}, "redactExtensionDisplaySource");
 var EXTENSION_PREPARATION_CONCURRENCY = 2;
 var EXTENSION_REFRESH_TIMEOUT_MS = 3e4;
 var RECONCILE_SLOW_MS = 3e4;
@@ -15057,21 +15169,21 @@ function createExtensionsController(deps) {
       unfinishedOperationCount -= 1;
     };
   }, "acquireOperationSlot");
-  const createExtensionManager = /* @__PURE__ */ __name((workspaceDir = boundWorkspace, trustedOverride) => new ExtensionManager({
+  const createExtensionManager = /* @__PURE__ */ __name((workspaceDir = boundWorkspace, trustedOverride, interactions) => new ExtensionManager({
     workspaceDir,
     isWorkspaceTrusted: trustedOverride ?? getWorkspaceTrustStatus(loadSettings(workspaceDir).merged, workspaceDir).effective.state === "trusted",
     requestConsent: /* @__PURE__ */ __name(() => Promise.resolve(), "requestConsent"),
     networkPolicy: "public",
-    requestSetting: /* @__PURE__ */ __name(async (setting) => {
+    requestSetting: interactions?.requestSetting ?? (async (setting) => {
       throw new Error(
         `Extension setting "${setting.envVar}" requires interactive configuration and is not supported over the daemon install endpoint.`
       );
-    }, "requestSetting"),
-    requestChoicePlugin: /* @__PURE__ */ __name(async () => {
+    }),
+    requestChoicePlugin: interactions?.requestChoicePlugin ?? (async () => {
       throw new Error(
         "Marketplace plugin selection is not supported over the daemon install endpoint. Specify a plugin name in the source."
       );
-    }, "requestChoicePlugin")
+    })
   }), "createExtensionManager");
   const validateExtensionMutationClient = /* @__PURE__ */ __name((req, res, opts = {}) => {
     const clientId = parseAndValidateWorkspaceClientId(
@@ -15090,10 +15202,10 @@ function createExtensionsController(deps) {
     return true;
   }, "validateExtensionMutationClient");
   const extensionOperations = /* @__PURE__ */ new Map();
-  const isTerminalExtensionOperation = /* @__PURE__ */ __name((operation) => operation.status !== "queued" && operation.status !== "running", "isTerminalExtensionOperation");
+  const isTerminalExtensionOperation = /* @__PURE__ */ __name((operation) => operation.status !== "queued" && operation.status !== "running" && operation.status !== "waiting_for_input", "isTerminalExtensionOperation");
   const redactExtensionOperationResult = /* @__PURE__ */ __name((event) => ({
     ...event,
-    ...event.source ? { source: redactUrlCredentials(event.source) } : {}
+    ...event.source ? { source: redactExtensionDisplaySource(event.source) } : {}
   }), "redactExtensionOperationResult");
   const bridgeMutationEvent = /* @__PURE__ */ __name((event) => {
     const redacted = redactExtensionOperationResult(event);
@@ -15174,7 +15286,7 @@ function createExtensionsController(deps) {
       status: "queued",
       createdAt: now,
       updatedAt: now,
-      ...failureContext.source ? { source: redactUrlCredentials(failureContext.source) } : {},
+      ...failureContext.source ? { source: redactExtensionDisplaySource(failureContext.source) } : {},
       ...failureContext.name ? { name: failureContext.name } : {}
     });
     const operationBasePath = options.operationBasePath ?? "/workspace/extensions/operations";
@@ -15201,7 +15313,7 @@ function createExtensionsController(deps) {
           status: "running",
           phase: "preparing"
         });
-        const extensionManager = options.manager ?? createExtensionManager();
+        const extensionManager = options.manager ?? options.createManager?.(operationId) ?? createExtensionManager();
         const deadlineController = new AbortController();
         let deadlineStarted = false;
         const startDeadline = /* @__PURE__ */ __name(() => {
@@ -15302,7 +15414,8 @@ function createExtensionsController(deps) {
         const event = await run(
           extensionManager,
           deadlineController.signal,
-          context
+          context,
+          operationId
         );
         mutationEvent = event;
         if (deadline) clearTimeout(deadline);
@@ -15527,7 +15640,9 @@ function createExtensionsController(deps) {
             bridge.broadcastExtensionsChanged({
               ...mutationEvent ? bridgeMutationEvent(mutationEvent) : {
                 ...failureContext.source ? {
-                  source: redactUrlCredentials(failureContext.source)
+                  source: redactExtensionDisplaySource(
+                    failureContext.source
+                  )
                 } : {},
                 ...failureContext.name ? { name: failureContext.name } : {}
               },
@@ -15548,13 +15663,14 @@ function createExtensionsController(deps) {
         updateExtensionOperation(operationId, {
           status: "failed",
           phase: void 0,
+          interaction: void 0,
           error: message.slice(0, 500),
           ...code ? { code } : {}
         });
         try {
           bridge.broadcastExtensionsChanged({
             status: "failed",
-            ...failureContext.source ? { source: redactUrlCredentials(failureContext.source) } : {},
+            ...failureContext.source ? { source: redactExtensionDisplaySource(failureContext.source) } : {},
             ...failureContext.name ? { name: failureContext.name } : {},
             refreshed: 0,
             failed: 0,
@@ -15576,6 +15692,7 @@ function createExtensionsController(deps) {
       } finally {
         if (deadline) clearTimeout(deadline);
         reconciliationReservation?.release();
+        options.onSettled?.(operationId);
         releaseOperationSlot();
       }
     })();
@@ -15610,7 +15727,11 @@ function createExtensionsController(deps) {
         version: ext.version,
         isActive: ext.isActive,
         path: ext.path,
-        ...ext.installMetadata?.source ? { source: redactUrlCredentials(ext.installMetadata.source) } : {},
+        ...ext.installMetadata?.source ? {
+          source: redactExtensionDisplaySource(
+            ext.installMetadata.source
+          )
+        } : {},
         ...ext.installMetadata?.type ? { installType: ext.installMetadata.type } : {},
         ...ext.installMetadata?.originSource ? { originSource: ext.installMetadata.originSource } : {},
         ...ext.installMetadata?.ref ? { ref: ext.installMetadata.ref } : {},
@@ -15646,6 +15767,10 @@ function createExtensionsController(deps) {
     buildLocalExtensionsStatus,
     refreshExtensionsForAllSessions,
     getOperation: /* @__PURE__ */ __name((operationId) => extensionOperations.get(operationId), "getOperation"),
+    getActiveOperations: /* @__PURE__ */ __name(() => [...extensionOperations.values()].filter(
+      (operation) => !isTerminalExtensionOperation(operation)
+    ), "getActiveOperations"),
+    updateOperation: updateExtensionOperation,
     preparationQueue,
     acquireOperationSlot,
     validateExtensionMutationClient,
@@ -15656,6 +15781,8 @@ __name(createExtensionsController, "createExtensionsController");
 
 // packages/cli/src/serve/routes/workspace-extensions.ts
 var EXTENSION_PREPARE_DEADLINE_MS = 10 * 6e4;
+var EXTENSION_INTERACTION_DEADLINE_MS = 10 * 6e4;
+var EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS = EXTENSION_PREPARE_DEADLINE_MS + EXTENSION_INTERACTION_DEADLINE_MS;
 var EXTENSION_UPDATE_CHECK_DEADLINE_MS = 2 * 6e4;
 var parseExtensionScope = /* @__PURE__ */ __name((body, res) => {
   const scope = body["scope"];
@@ -15761,6 +15888,96 @@ function registerWorkspaceExtensionRoutes(app, deps) {
   const primaryController = createExtensionsController(
     controllerDeps(boundWorkspace, bridge, workspace)
   );
+  const pendingExtensionInteractions = /* @__PURE__ */ new Map();
+  const supersededInstallOperations = /* @__PURE__ */ new Set();
+  const cancelPendingExtensionInteraction = /* @__PURE__ */ __name((operationId, reason) => {
+    const pending = pendingExtensionInteractions.get(operationId);
+    if (!pending) return;
+    clearTimeout(pending.timeout);
+    pendingExtensionInteractions.delete(operationId);
+    pending.reject(new Error(reason));
+  }, "cancelPendingExtensionInteraction");
+  const supersedeActiveInstallOperations = /* @__PURE__ */ __name((controller, currentOperationId) => {
+    for (const operation of controller.getActiveOperations()) {
+      if (operation.operation !== "install" || operation.operationId === currentOperationId) {
+        continue;
+      }
+      supersededInstallOperations.add(operation.operationId);
+      cancelPendingExtensionInteraction(
+        operation.operationId,
+        "Extension installation cancelled by a new install request"
+      );
+    }
+  }, "supersedeActiveInstallOperations");
+  const waitForExtensionInteraction = /* @__PURE__ */ __name((controller, operationId, interaction) => {
+    if (supersededInstallOperations.delete(operationId)) {
+      return Promise.reject(
+        new Error("Extension installation superseded by a new install request")
+      );
+    }
+    const operation = controller.getOperation(operationId);
+    if (operation && operation.status !== "queued" && operation.status !== "running" && operation.status !== "waiting_for_input") {
+      return Promise.reject(new Error("Extension operation already completed"));
+    }
+    const pendingInteraction = {
+      ...interaction,
+      id: crypto2.randomUUID()
+    };
+    return new Promise((resolve5, reject) => {
+      const timeout = setTimeout(() => {
+        pendingExtensionInteractions.delete(operationId);
+        controller.updateOperation(operationId, {
+          status: "failed",
+          phase: void 0,
+          interaction: void 0,
+          error: "Extension interaction timed out"
+        });
+        reject(new Error("Extension interaction timed out"));
+      }, EXTENSION_INTERACTION_DEADLINE_MS);
+      timeout.unref?.();
+      pendingExtensionInteractions.set(operationId, {
+        interaction: pendingInteraction,
+        resolve: resolve5,
+        reject,
+        timeout
+      });
+      controller.updateOperation(operationId, {
+        status: "waiting_for_input",
+        phase: void 0,
+        interaction: pendingInteraction
+      });
+    });
+  }, "waitForExtensionInteraction");
+  const extensionInteractionHandlers = /* @__PURE__ */ __name((controller, operationId) => ({
+    requestSetting: /* @__PURE__ */ __name((setting) => waitForExtensionInteraction(controller, operationId, {
+      kind: "setting",
+      setting: {
+        name: setting.name,
+        description: setting.description,
+        sensitive: setting.sensitive === true
+      }
+    }), "requestSetting"),
+    requestChoicePlugin: /* @__PURE__ */ __name((marketplace) => {
+      if (marketplace.plugins.length === 0) {
+        return Promise.reject(
+          new Error(`Marketplace "${marketplace.name}" has no plugins`)
+        );
+      }
+      return waitForExtensionInteraction(controller, operationId, {
+        kind: "marketplace_plugin",
+        marketplace: { name: marketplace.name },
+        plugins: marketplace.plugins.map((plugin) => ({
+          name: plugin.name,
+          ...plugin.description ? { description: plugin.description } : {},
+          source: redactExtensionDisplaySource(
+            typeof plugin.source === "string" ? plugin.source : plugin.source.source === "github" ? plugin.source.repo : plugin.source.url
+          ),
+          ...plugin.category ? { category: plugin.category } : {},
+          ...plugin.tags ? { tags: plugin.tags } : {}
+        }))
+      });
+    }, "requestChoicePlugin")
+  }), "extensionInteractionHandlers");
   const runtimeReconciliationQueue = createFifoTaskQueue(1);
   const reserveRuntimeReconciliation = /* @__PURE__ */ __name(() => {
     let provideTask;
@@ -15877,6 +16094,11 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         sendBridgeError2(res, err, { route: `GET ${base}` });
       }
     });
+    app.get(`${base}/operations`, async (req, res) => {
+      const ctrl = resolve5(req, res, false);
+      if (!ctrl) return;
+      res.status(200).json({ v: 1, operations: ctrl.getActiveOperations() });
+    });
     app.get(`${base}/operations/:operationId`, async (req, res) => {
       const ctrl = resolve5(req, res, false);
       if (!ctrl) return;
@@ -15918,11 +16140,85 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         });
       }
     });
+    app.post(
+      `${base}/operations/:operationId/interactions/:interactionId`,
+      mutate({ strict: true }),
+      async (req, res) => {
+        const ctrl = resolve5(req, res, false);
+        if (!ctrl) return;
+        try {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
+            return;
+          }
+          const operationId = req.params["operationId"];
+          const interactionId = req.params["interactionId"];
+          const pending = operationId ? pendingExtensionInteractions.get(operationId) : void 0;
+          if (!operationId || !interactionId || !pending) {
+            res.status(404).json({ error: "Extension interaction not found" });
+            return;
+          }
+          if (pending.interaction.id !== interactionId) {
+            res.status(404).json({ error: "Extension interaction not found" });
+            return;
+          }
+          const body = safeBody2(req);
+          let value;
+          if (body["cancelled"] === true) {
+            clearTimeout(pending.timeout);
+            pendingExtensionInteractions.delete(operationId);
+            ctrl.updateOperation(operationId, {
+              status: "failed",
+              phase: void 0,
+              interaction: void 0,
+              error: "Extension operation cancelled"
+            });
+            pending.reject(new Error("Extension operation cancelled"));
+            res.status(200).json({ accepted: true });
+            return;
+          }
+          if (pending.interaction.kind === "marketplace_plugin") {
+            const pluginName = body["pluginName"];
+            if (typeof pluginName !== "string" || !pending.interaction.plugins.some(
+              (plugin) => plugin.name === pluginName
+            )) {
+              res.status(400).json({ error: "Invalid marketplace plugin name" });
+              return;
+            }
+            value = pluginName;
+          } else {
+            const settingValue = body["value"];
+            if (typeof settingValue !== "string") {
+              res.status(400).json({ error: "Extension setting value must be a string" });
+              return;
+            }
+            value = settingValue;
+          }
+          clearTimeout(pending.timeout);
+          pendingExtensionInteractions.delete(operationId);
+          ctrl.updateOperation(operationId, {
+            status: "running",
+            phase: "preparing",
+            interaction: void 0,
+            error: void 0
+          });
+          pending.resolve(value);
+          res.status(200).json({ accepted: true });
+        } catch (err) {
+          sendBridgeError2(res, err, {
+            route: `POST ${base}/operations/:operationId/interactions/:interactionId`
+          });
+        }
+      }
+    );
     app.post(`${base}/install`, mutate({ strict: true }), async (req, res) => {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const body = safeBody2(req);
@@ -15972,11 +16268,56 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         if (!validateExtensionSourceHost(sourceValue, res)) {
           return;
         }
+        const localSource = /^[A-Za-z]:[\\/]/.test(sourceValue) || sourceValue.startsWith("/") || sourceValue.startsWith(".");
+        if (localSource) {
+          try {
+            const metadata = await parseInstallSource(sourceValue, {
+              networkPolicy: "public"
+            });
+            if (metadata.type !== "git" && metadata.type !== "github-release" && metadata.type !== "npm") {
+              res.status(400).json({
+                error: "Only GitHub, Git, and npm extension installs are supported over the daemon endpoint."
+              });
+              return;
+            }
+          } catch (error2) {
+            const message = error2 instanceof Error ? error2.message : "Invalid install source";
+            res.status(400).json({
+              error: redactUrlCredentials(
+                message.replaceAll(
+                  sourceValue,
+                  redactExtensionDisplaySource(sourceValue)
+                )
+              )
+            });
+            return;
+          }
+        }
+        const npmSource = sourceValue.startsWith("@");
+        const remoteSource = npmSource || sourceValue.startsWith("https://") || /^[^/\s]+\/[^/\s]+/.test(sourceValue);
+        if (!localSource && !remoteSource) {
+          res.status(400).json({
+            error: `Install source not found: ${redactExtensionDisplaySource(
+              sourceValue
+            )}`
+          });
+          return;
+        }
+        if (npmSource && refValue) {
+          res.status(400).json({ error: "--ref is not applicable for npm extensions." });
+          return;
+        }
+        if (!npmSource && registryValue) {
+          res.status(400).json({
+            error: "--registry is only applicable for npm extensions."
+          });
+          return;
+        }
         ctrl.runQueuedExtensionMutation(
           "install",
           { source: sourceValue },
           res,
-          async (extensionManager, _signal, context) => {
+          async (extensionManager, _signal, context, operationId) => {
             const prepared = await context.prepare(async (signal) => {
               const installMetadata = await parseInstallSource(sourceValue, {
                 networkPolicy: "public"
@@ -16000,6 +16341,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               if (installMetadata.type === "npm" && registryUrl) {
                 installMetadata.registryUrl = registryUrl;
               }
+              supersedeActiveInstallOperations(ctrl, operationId);
               return await extensionManager.prepareExtensionInstall({
                 installMetadata: {
                   ...installMetadata,
@@ -16030,7 +16372,19 @@ function registerWorkspaceExtensionRoutes(app, deps) {
             }
           },
           {
-            deadlineMs: EXTENSION_PREPARE_DEADLINE_MS,
+            createManager: /* @__PURE__ */ __name((operationId) => ctrl.createExtensionManager(
+              void 0,
+              void 0,
+              extensionInteractionHandlers(ctrl, operationId)
+            ), "createManager"),
+            onSettled: /* @__PURE__ */ __name((operationId) => {
+              supersededInstallOperations.delete(operationId);
+              cancelPendingExtensionInteraction(
+                operationId,
+                "Extension operation ended"
+              );
+            }, "onSettled"),
+            deadlineMs: EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS,
             ...globalReconciliationOptions()
           }
         );
@@ -16047,7 +16401,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         let timer;
         let releaseOperationSlot;
         try {
-          if (!ctrl.validateExtensionMutationClient(req, res)) {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
             return;
           }
           releaseOperationSlot = ctrl.acquireOperationSlot(res);
@@ -16107,7 +16463,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const releaseOperationSlot = ctrl.acquireOperationSlot(res);
@@ -16223,7 +16581,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         const ctrl = resolve5(req, res, true);
         if (!ctrl) return;
         try {
-          if (!ctrl.validateExtensionMutationClient(req, res)) {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
             return;
           }
           const name = req.params["name"];
@@ -16280,7 +16640,18 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               }
             },
             {
-              deadlineMs: EXTENSION_PREPARE_DEADLINE_MS,
+              createManager: /* @__PURE__ */ __name((operationId) => ctrl.createExtensionManager(
+                void 0,
+                void 0,
+                extensionInteractionHandlers(ctrl, operationId)
+              ), "createManager"),
+              onSettled: /* @__PURE__ */ __name((operationId) => {
+                cancelPendingExtensionInteraction(
+                  operationId,
+                  "Extension operation ended"
+                );
+              }, "onSettled"),
+              deadlineMs: EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS,
               ...globalReconciliationOptions()
             }
           );
@@ -16293,7 +16664,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const name = req.params["name"];
@@ -17509,7 +17882,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 
 // packages/cli/src/serve/routes/session.ts
 init_esbuild_shims();
-import * as crypto2 from "node:crypto";
+import * as crypto3 from "node:crypto";
 import * as path11 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
@@ -17566,7 +17939,7 @@ function parseOrganizedCursor(cursor, expected) {
     const decoded = Buffer.from(cursor, "base64url").toString("utf8");
     const parsed = JSON.parse(decoded);
     const last = parsed.last;
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.isPinned !== "boolean" || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.group !== expected.group || parsed.archiveState !== expected.archiveState) {
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.isPinned !== "boolean" || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.group !== expected.group || parsed.archiveState !== expected.archiveState || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId) {
       throw new Error("invalid organized cursor");
     }
     return last;
@@ -17575,9 +17948,9 @@ function parseOrganizedCursor(cursor, expected) {
   }
 }
 __name(parseOrganizedCursor, "parseOrganizedCursor");
-function encodeOrganizedCursor(last, group, archiveState) {
+function encodeOrganizedCursor(last, group, archiveState, sourceType, sourceId) {
   return Buffer.from(
-    JSON.stringify({ group, archiveState, last }),
+    JSON.stringify({ group, archiveState, sourceType, sourceId, last }),
     "utf8"
   ).toString("base64url");
 }
@@ -17601,29 +17974,39 @@ function encodeLiveSessionCursor(last) {
   return Buffer.from(JSON.stringify(last), "utf8").toString("base64url");
 }
 __name(encodeLiveSessionCursor, "encodeLiveSessionCursor");
-function parseParentSessionCursor(cursor, expected) {
+function matchesSessionMetadataSource(session, filter) {
+  const sourceTypeMatches = filter.sourceType === void 0 || session.sourceType === filter.sourceType || // Legacy sessions without source metadata belong to the default catalog.
+  filter.sourceType === "default" && session.sourceType === void 0;
+  return sourceTypeMatches && // sourceId remains exact; only the default source type has legacy fallback.
+  (filter.sourceId === void 0 || session.sourceId === filter.sourceId);
+}
+__name(matchesSessionMetadataSource, "matchesSessionMetadataSource");
+function parseMetadataSessionCursor(cursor, expected) {
   if (cursor === "") return void 0;
   try {
     const parsed = JSON.parse(
       Buffer.from(cursor, "base64url").toString("utf8")
     );
     const last = parsed.last;
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.parentSessionId !== expected.parentSessionId || parsed.archiveState !== expected.archiveState) {
-      throw new Error("invalid parent cursor");
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.parentSessionId !== expected.parentSessionId || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId || parsed.archiveState !== expected.archiveState) {
+      throw new Error("invalid metadata cursor");
     }
     return { activityTime: last.activityTime, sessionId: last.sessionId };
   } catch {
-    throw new InvalidCursorError(cursor, "parent");
+    throw new InvalidCursorError(
+      cursor,
+      expected.sourceType === void 0 ? "parent" : "metadata"
+    );
   }
 }
-__name(parseParentSessionCursor, "parseParentSessionCursor");
-function encodeParentSessionCursor(last, parentSessionId, archiveState) {
+__name(parseMetadataSessionCursor, "parseMetadataSessionCursor");
+function encodeMetadataSessionCursor(last, filter, archiveState) {
   return Buffer.from(
-    JSON.stringify({ parentSessionId, archiveState, last }),
+    JSON.stringify({ ...filter, archiveState, last }),
     "utf8"
   ).toString("base64url");
 }
-__name(encodeParentSessionCursor, "encodeParentSessionCursor");
+__name(encodeMetadataSessionCursor, "encodeMetadataSessionCursor");
 function toSummary2(item) {
   return {
     sessionId: item.sessionId,
@@ -17632,6 +18015,8 @@ function toSummary2(item) {
     updatedAt: new Date(item.mtime).toISOString(),
     displayName: item.customTitle || item.prompt,
     ...item.parentSessionId ? { parentSessionId: item.parentSessionId } : {},
+    ...item.sourceType ? { sourceType: item.sourceType } : {},
+    ...item.sourceId !== void 0 ? { sourceId: item.sourceId } : {},
     clientCount: 0,
     hasActivePrompt: false,
     isArchived: item.isArchived === true
@@ -17647,6 +18032,8 @@ function mergeLiveSessionSummary(existing, live) {
     // Immutable lineage; the persisted transcript is authoritative, and a live
     // entry only carries it when spawned this run.
     parentSessionId: existing.parentSessionId ?? live.parentSessionId,
+    sourceType: existing.sourceType ?? live.sourceType,
+    sourceId: existing.sourceType !== void 0 ? existing.sourceId : live.sourceId,
     updatedAt: live.updatedAt ?? existing.updatedAt,
     clientCount: live.clientCount,
     hasActivePrompt: live.hasActivePrompt,
@@ -17746,7 +18133,12 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
       "group"
     );
   }
-  const cursorKey = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, { group, archiveState }) : void 0;
+  const cursorKey = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, {
+    group,
+    archiveState,
+    sourceType: options.sourceType,
+    sourceId: options.sourceId
+  }) : void 0;
   const isFirstPage = cursorKey === void 0;
   let liveMergeFailed = false;
   const bySessionId = /* @__PURE__ */ new Map();
@@ -17798,6 +18190,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
     }
   }
   const filtered = [...bySessionId.values()].filter((session) => {
+    if (!matchesSessionMetadataSource(session, options)) return false;
     if (group === "all") return true;
     if (group === "pinned") return session.isPinned === true;
     if (group === "ungrouped")
@@ -17821,7 +18214,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   const nextCursor = page.length < afterCursor.length ? encodeOrganizedCursor(
     getOrganizedCursorKey(activityTimeById, page[page.length - 1]),
     group,
-    archiveState
+    archiveState,
+    options.sourceType,
+    options.sourceId
   ) : void 0;
   return {
     sessions: page,
@@ -17831,7 +18226,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   };
 }
 __name(listOrganizedWorkspaceSessionsForResponse, "listOrganizedWorkspaceSessionsForResponse");
-async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, options, pageSize, parentSessionId, readOptions) {
+async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd, options, pageSize, filter, readOptions) {
   const archiveState = options.archiveState ?? "active";
   const sessionService = new SessionService(workspaceCwd);
   const bySessionId = /* @__PURE__ */ new Map();
@@ -17865,18 +18260,20 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     } catch (error2) {
       liveMergeFailed = true;
       writeStderrLine(
-        `qwen serve: session-by-parent live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
+        `qwen serve: session metadata filter live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
       );
     }
   }
-  const matches = [...bySessionId.values()].filter((session) => session.parentSessionId === parentSessionId).sort(
+  const matches = [...bySessionId.values()].filter(
+    (session) => (filter.parentSessionId === void 0 || session.parentSessionId === filter.parentSessionId) && matchesSessionMetadataSource(session, filter)
+  ).sort(
     (a, b) => compareLiveSessionCursorKeys(
       getLiveSessionCursorKey(a),
       getLiveSessionCursorKey(b)
     )
   );
-  const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseParentSessionCursor(options.cursor, {
-    parentSessionId,
+  const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseMetadataSessionCursor(options.cursor, {
+    ...filter,
     archiveState
   }) : void 0;
   const afterCursor = cursorKey === void 0 ? matches : matches.filter(
@@ -17886,9 +18283,9 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     ) < 0
   );
   const page = afterCursor.slice(0, pageSize);
-  const nextCursor = page.length < afterCursor.length ? encodeParentSessionCursor(
+  const nextCursor = page.length < afterCursor.length ? encodeMetadataSessionCursor(
     getLiveSessionCursorKey(page[page.length - 1]),
-    parentSessionId,
+    filter,
     archiveState
   ) : void 0;
   return {
@@ -17898,7 +18295,7 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     ...persisted.truncated ? { truncated: true } : {}
   };
 }
-__name(listWorkspaceSessionsByParentForResponse, "listWorkspaceSessionsByParentForResponse");
+__name(listWorkspaceSessionsByMetadataForResponse, "listWorkspaceSessionsByMetadataForResponse");
 async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, readOptions = {}) {
   const rawSize = options?.size;
   const requestedSize = typeof rawSize === "number" && Number.isSafeInteger(rawSize) ? rawSize : DEFAULT_SESSION_PAGE_SIZE;
@@ -17912,13 +18309,17 @@ async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, r
       readOptions
     );
   }
-  if (options?.parentSessionId !== void 0) {
-    return listWorkspaceSessionsByParentForResponse(
+  if (options?.parentSessionId !== void 0 || options?.sourceType !== void 0) {
+    return listWorkspaceSessionsByMetadataForResponse(
       bridge,
       workspaceCwd,
       options,
       pageSize,
-      options.parentSessionId,
+      {
+        ...options.parentSessionId !== void 0 ? { parentSessionId: options.parentSessionId } : {},
+        ...options.sourceType !== void 0 ? { sourceType: options.sourceType } : {},
+        ...options.sourceId !== void 0 ? { sourceId: options.sourceId } : {}
+      },
       readOptions
     );
   }
@@ -18036,9 +18437,10 @@ function sessionExportFormatValues() {
 __name(sessionExportFormatValues, "sessionExportFormatValues");
 async function exportSessionTranscript(params) {
   const { workspaceCwd, sessionId, format } = params;
-  const sessionData = await new SessionService(workspaceCwd).loadSession(
-    sessionId
-  );
+  const service = new SessionService(workspaceCwd);
+  const sessionData = params.archiveState === "archived" ? await service.loadArchivedSession(sessionId, {
+    maxBytes: SESSION_TRANSCRIPT_MAX_INDEX_BYTES
+  }) : await service.loadSession(sessionId);
   if (!sessionData) {
     throw new SessionNotFoundError(sessionId);
   }
@@ -18067,6 +18469,60 @@ var WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
+var GENERATION_HEARTBEAT_MS = 15e3;
+var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
+  "POST /session/:id/branch",
+  "POST /session/:id/fork",
+  "POST /session/:id/cd"
+];
+function isPrimaryOnlyLiveSessionRoute(route) {
+  return PRIMARY_ONLY_LIVE_SESSION_ROUTES.includes(
+    route
+  );
+}
+__name(isPrimaryOnlyLiveSessionRoute, "isPrimaryOnlyLiveSessionRoute");
+function formatGenerationSse(event, data) {
+  return `event: ${event}
+data: ${JSON.stringify({ v: 1, ...data })}
+
+`;
+}
+__name(formatGenerationSse, "formatGenerationSse");
+function writeGenerationSseChunk(res, chunk) {
+  if (res.destroyed) {
+    return Promise.reject(new Error("Generation SSE connection destroyed"));
+  }
+  const writable = res.write(chunk);
+  const flush = res.flush;
+  flush?.call(res);
+  if (writable) {
+    return res.destroyed ? Promise.reject(new Error("Generation SSE connection destroyed")) : Promise.resolve();
+  }
+  return new Promise((resolve5, reject) => {
+    const cleanup = /* @__PURE__ */ __name(() => {
+      res.off("drain", onDrain);
+      res.off("close", onClose);
+      res.off("error", onError);
+    }, "cleanup");
+    const onDrain = /* @__PURE__ */ __name(() => {
+      cleanup();
+      resolve5();
+    }, "onDrain");
+    const onClose = /* @__PURE__ */ __name(() => {
+      cleanup();
+      reject(new Error("Generation SSE connection closed"));
+    }, "onClose");
+    const onError = /* @__PURE__ */ __name((error2) => {
+      cleanup();
+      reject(error2);
+    }, "onError");
+    res.once("drain", onDrain);
+    res.once("close", onClose);
+    res.once("error", onError);
+    if (res.destroyed) onClose();
+  });
+}
+__name(writeGenerationSseChunk, "writeGenerationSseChunk");
 function isReadOnlyWorkspaceInspection(runtime) {
   return !runtime.primary && !runtime.trusted;
 }
@@ -18212,14 +18668,14 @@ function registerSessionRoutes(app, deps) {
     sessionShellCommandEnabled
   } = deps;
   const LANGUAGE_CODES = deps.languageCodes;
-  const transcriptCursorMasterKey = crypto2.randomBytes(32);
+  const transcriptCursorMasterKey = crypto3.randomBytes(32);
   const transcriptCursorCodecs = /* @__PURE__ */ new Map();
   const getTranscriptCursorCodec = /* @__PURE__ */ __name((runtime) => {
     const canonicalCwd = canonicalizeWorkspace(runtime.workspaceCwd);
     const cacheKey = `${runtime.workspaceId}\0${canonicalCwd}`;
     const cached = transcriptCursorCodecs.get(cacheKey);
     if (cached) return cached;
-    const derivedKey = crypto2.hkdfSync(
+    const derivedKey = crypto3.hkdfSync(
       "sha256",
       transcriptCursorMasterKey,
       Buffer.alloc(0),
@@ -18397,11 +18853,16 @@ function registerSessionRoutes(app, deps) {
       const result = await archiveCoordinator.runSharedMany(
         [sessionId],
         async () => {
-          await assertSessionLoadable(target.workspaceCwd, sessionId);
+          if (target.archiveState === "archived") {
+            await assertSessionArchived(target.workspaceCwd, sessionId);
+          } else {
+            await assertSessionLoadable(target.workspaceCwd, sessionId);
+          }
           return exportSessionTranscript({
             workspaceCwd: target.workspaceCwd,
             sessionId,
             format,
+            archiveState: target.archiveState,
             config: { getChannel: /* @__PURE__ */ __name(() => "daemon", "getChannel") }
           });
         }
@@ -18573,7 +19034,7 @@ function registerSessionRoutes(app, deps) {
   }), "resolveLiveSessionRuntime");
   const sendNonPrimarySessionRouteUnsupported = /* @__PURE__ */ __name((res, route, sessionId, runtime) => {
     res.status(400).json({
-      error: `Route "${route}" is primary-only for non-primary workspace sessions in Phase 2a.`,
+      error: `Route "${route}" is only available for primary workspace sessions.`,
       code: "non_primary_session_route_not_supported",
       sessionId,
       workspaceId: runtime.workspaceId,
@@ -18722,23 +19183,37 @@ function registerSessionRoutes(app, deps) {
     }
     return key;
   }, "resolveWorkspaceParam");
-  const withMutableSession = /* @__PURE__ */ __name((route, handler) => async (req, res) => {
-    const sessionId = requireSessionId(req, res);
-    if (sessionId === null) return;
-    const runtime = resolveLiveSessionRuntime(sessionId, res, route);
-    if (!runtime) return;
-    if (!runtime.primary) {
-      sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
-      return;
+  const withPrimaryOnlyMutableSession = /* @__PURE__ */ __name((route, handler) => {
+    if (!isPrimaryOnlyLiveSessionRoute(route)) {
+      throw new Error(`Unregistered primary-only session route: ${route}`);
     }
-    try {
-      await archiveCoordinator.runSharedMany([sessionId], async () => {
-        await handler(req, res, sessionId);
-      });
-    } catch (err) {
-      sendBridgeError2(res, err, { route, sessionId });
-    }
-  }, "withMutableSession");
+    return async (req, res) => {
+      const sessionId = requireSessionId(req, res);
+      if (sessionId === null) return;
+      const runtime = resolveLiveSessionRuntime(sessionId, res, route);
+      if (!runtime) return;
+      if (!runtime.primary) {
+        logSessionRoutingFailure(
+          route,
+          "non_primary_session_route_not_supported",
+          {
+            sessionId,
+            workspaceId: runtime.workspaceId,
+            workspaceCwd: runtime.workspaceCwd
+          }
+        );
+        sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
+        return;
+      }
+      try {
+        await archiveCoordinator.runSharedMany([sessionId], async () => {
+          await handler(req, res, sessionId);
+        });
+      } catch (err) {
+        sendBridgeError2(res, err, { route, sessionId });
+      }
+    };
+  }, "withPrimaryOnlyMutableSession");
   app.post("/session", mutate(), async (req, res) => {
     const body = safeBody(req);
     const resolvedRuntime = resolveRuntimeForSessionCreation(body, res);
@@ -18759,6 +19234,14 @@ function registerSessionRoutes(app, deps) {
     }
     const approvalMode = parseOptionalApprovalMode(body, res);
     if (approvalMode === null) return;
+    const source = parseSessionSource(body["sourceType"], body["sourceId"]);
+    if ("error" in source) {
+      res.status(400).json({
+        error: source.error,
+        code: "invalid_session_source"
+      });
+      return;
+    }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
@@ -18767,7 +19250,9 @@ function registerSessionRoutes(app, deps) {
         modelServiceId,
         ...clientId !== void 0 ? { clientId } : {},
         ...sessionScope !== void 0 ? { sessionScope } : {},
-        ...approvalMode !== void 0 ? { approvalMode } : {}
+        ...approvalMode !== void 0 ? { approvalMode } : {},
+        ...source.sourceType !== void 0 ? { sourceType: source.sourceType } : {},
+        ...source.sourceId !== void 0 ? { sourceId: source.sourceId } : {}
       });
       if (daemonLog) {
         daemonLog.info(
@@ -18786,8 +19271,17 @@ function registerSessionRoutes(app, deps) {
           );
         }
         if (!session.attached) {
-          runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
-          });
+          try {
+            const killed = await runtime.bridge.killSession(session.sessionId, {
+              requireZeroAttaches: true
+            });
+            if (killed) {
+              await new SessionService(runtime.workspaceCwd).removeSession(
+                session.sessionId
+              );
+            }
+          } catch {
+          }
         } else {
           runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
           });
@@ -18840,22 +19334,22 @@ function registerSessionRoutes(app, deps) {
         [sessionId],
         async () => {
           await assertSessionLoadable(workspaceCwd, sessionId);
-          const parentSessionId = await new SessionService(
+          const metadata = await new SessionService(
             workspaceCwd
-          ).readParentSessionId(sessionId);
+          ).readCreationMetadata(sessionId);
           return action === "load" ? await runtime.bridge.loadSession({
             sessionId,
             workspaceCwd,
             historyReplay: "response",
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
-            ...parentSessionId !== void 0 ? { parentSessionId } : {}
+            ...metadata
           }) : await runtime.bridge.resumeSession({
             sessionId,
             workspaceCwd,
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
-            ...parentSessionId !== void 0 ? { parentSessionId } : {}
+            ...metadata
           });
         }
       );
@@ -18890,7 +19384,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/branch",
     mutate(),
-    withMutableSession(
+    withPrimaryOnlyMutableSession(
       "POST /session/:id/branch",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -18925,7 +19419,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/fork",
     mutate(),
-    withMutableSession(
+    withPrimaryOnlyMutableSession(
       "POST /session/:id/fork",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -18951,25 +19445,28 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/cd",
     mutate(),
-    withMutableSession("POST /session/:id/cd", async (req, res, sessionId) => {
-      const body = safeBody(req);
-      const targetPath = body["path"];
-      if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
-        res.status(400).json({
-          error: "`path` is required and must be an absolute path",
-          code: "invalid_path"
-        });
-        return;
+    withPrimaryOnlyMutableSession(
+      "POST /session/:id/cd",
+      async (req, res, sessionId) => {
+        const body = safeBody(req);
+        const targetPath = body["path"];
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
+          res.status(400).json({
+            error: "`path` is required and must be an absolute path",
+            code: "invalid_path"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const result = await bridge.changeSessionCwd(
+          sessionId,
+          { path: targetPath },
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json(result);
       }
-      const clientId = parseClientIdHeader(req, res);
-      if (clientId === null) return;
-      const result = await bridge.changeSessionCwd(
-        sessionId,
-        { path: targetPath },
-        clientId !== void 0 ? { clientId } : void 0
-      );
-      res.status(200).json(result);
-    })
+    )
   );
   app.get("/session/:id/status", (req, res) => {
     const sessionId = requireSessionId(req, res);
@@ -19005,6 +19502,20 @@ function registerSessionRoutes(app, deps) {
       workspaceQualified: true
     });
   });
+  app.get(
+    "/workspaces/:workspace/session/:id/archive/export",
+    async (req, res) => {
+      const route = "GET /workspaces/:workspace/session/:id/archive/export";
+      const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
+      if (!runtime) return;
+      await handleSessionExport(req, res, {
+        route,
+        workspaceCwd: runtime.workspaceCwd,
+        workspaceQualified: true,
+        archiveState: "archived"
+      });
+    }
+  );
   app.get("/session/:id/transcript", async (req, res) => {
     const route = "GET /session/:id/transcript";
     const sessionId = requireSessionId(req, res);
@@ -19348,7 +19859,7 @@ function registerSessionRoutes(app, deps) {
       async (req, res, sessionId, runtime) => {
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const promptId = crypto2.randomUUID();
+        const promptId = crypto3.randomUUID();
         res.status(200).json(
           await runtime.bridge.continueSession(sessionId, {
             ...clientId !== void 0 ? { clientId } : {},
@@ -19395,7 +19906,7 @@ function registerSessionRoutes(app, deps) {
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const promptId = crypto2.randomUUID();
+        const promptId = crypto3.randomUUID();
         const forwardedBody = { ...body };
         delete forwardedBody["deadlineMs"];
         const lastEventId = ownerBridge.getSessionLastEventId(sessionId);
@@ -19496,6 +20007,88 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.post(
+    "/session/:id/generate",
+    mutate(),
+    withOwnerReadSession(
+      "POST /session/:id/generate",
+      async (req, res, sessionId, runtime) => {
+        const body = safeBody(req);
+        const prompt = body["prompt"];
+        if (typeof prompt !== "string" || prompt.trim().length === 0 || Buffer.byteLength(prompt, "utf8") > GENERATION_MAX_PROMPT_BYTES) {
+          res.status(400).json({
+            error: `\`prompt\` must be a non-empty string no larger than ${GENERATION_MAX_PROMPT_BYTES} UTF-8 bytes`,
+            code: "invalid_prompt"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        if (!runtime.bridge.generateSessionContent) {
+          res.status(501).json({
+            error: "Stateless generation is not supported by this bridge",
+            code: "generation_not_supported"
+          });
+          return;
+        }
+        const abort = new AbortController();
+        let completed = false;
+        const onClose = /* @__PURE__ */ __name(() => {
+          if (!completed) abort.abort();
+        }, "onClose");
+        res.once("close", onClose);
+        const stream = runtime.bridge.generateSessionContent(
+          sessionId,
+          prompt,
+          abort.signal,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.setHeader("X-Accel-Buffering", "no");
+        res.flushHeaders();
+        let writeChain = Promise.resolve();
+        const write = /* @__PURE__ */ __name((chunk) => {
+          writeChain = writeChain.then(
+            () => writeGenerationSseChunk(res, chunk)
+          );
+          return writeChain;
+        }, "write");
+        await write(": connected\n\n");
+        const heartbeat = setInterval(() => {
+          void write(": heartbeat\n\n").catch(() => abort.abort());
+        }, GENERATION_HEARTBEAT_MS);
+        heartbeat.unref();
+        try {
+          for await (const event of stream) {
+            await write(formatGenerationSse(event.type, event));
+          }
+        } catch (err) {
+          if (!abort.signal.aborted && !res.destroyed) {
+            daemonLog?.error(
+              "session generation failed",
+              err instanceof Error ? err : new Error(String(err)),
+              { sessionId, clientId }
+            );
+            await write(
+              formatGenerationSse("error", {
+                type: "error",
+                code: "generation_failed",
+                message: "Generation failed"
+              })
+            ).catch(() => void 0);
+          }
+        } finally {
+          completed = true;
+          clearInterval(heartbeat);
+          res.off("close", onClose);
+          if (!res.destroyed) res.end();
+        }
+      }
+    )
+  );
   app.post(
     "/session/:id/heartbeat",
     mutate(),
@@ -20064,16 +20657,28 @@ function registerSessionRoutes(app, deps) {
         }
         parentSessionId = rawParentSessionId;
       }
+      const parsedSource = parseSessionSource(
+        req.query["sourceType"],
+        req.query["sourceId"]
+      );
+      if ("error" in parsedSource) {
+        res.status(400).json({
+          error: parsedSource.error,
+          code: "invalid_session_source"
+        });
+        return;
+      }
       const options = {
         ...cursor !== void 0 ? { cursor } : {},
         ...size !== void 0 ? { size } : {},
         ...archiveState !== void 0 ? { archiveState } : {},
         ...view !== void 0 ? { view } : {},
         ...group !== void 0 ? { group } : {},
-        ...parentSessionId !== void 0 ? { parentSessionId } : {}
+        ...parentSessionId !== void 0 ? { parentSessionId } : {},
+        ...parsedSource
       };
-      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(key));
-      if (!usePersisted && (view !== void 0 || archiveState === "archived")) {
+      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(key));
+      if (!usePersisted && (view !== void 0 || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0)) {
         throw new Error(
           "session list live path received persisted-only options"
         );
@@ -20672,6 +21277,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     }
     const recurring = body["recurring"] !== false;
     const enabled = body["enabled"] !== false;
+    const taskId = generateCronTaskId();
     let boundSessionId;
     if (bridge) {
       try {
@@ -20687,7 +21293,9 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       try {
         const session = await bridge.spawnOrAttach({
           workspaceCwd,
-          sessionScope: "thread"
+          sessionScope: "thread",
+          sourceType: "scheduled_task",
+          sourceId: taskId
         });
         boundSessionId = session.sessionId;
         try {
@@ -20709,7 +21317,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     }
     const now = Date.now();
     const task = {
-      id: generateCronTaskId(),
+      id: taskId,
       cron,
       prompt,
       recurring,
@@ -21192,7 +21800,9 @@ async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawn
       binding.add(task.id);
       const rawSpawn = bridge.spawnOrAttach({
         workspaceCwd: boundWorkspace,
-        sessionScope: "thread"
+        sessionScope: "thread",
+        sourceType: "scheduled_task",
+        sourceId: task.id
       });
       let timedOut = false;
       rawSpawn.then(({ sessionId: sessionId2 }) => {
@@ -21301,12 +21911,16 @@ function startScheduledTaskKeepalive(opts) {
           continue;
         }
         log.debug("keepalive: recordHeartbeat failed for", sessionId, err);
+        reviving.add(sessionId);
+        const metadata = await new SessionService(
+          boundWorkspace
+        ).readCreationMetadata(sessionId);
         const load = bridge.loadSession({
           sessionId,
           workspaceCwd: boundWorkspace,
-          historyReplay: "response"
+          historyReplay: "response",
+          ...metadata
         });
-        reviving.add(sessionId);
         void load.catch(() => {
         }).finally(() => {
           reviving.delete(sessionId);
@@ -21417,10 +22031,14 @@ async function rehydrateScheduledTaskSessions(deps) {
   const loaded = [];
   const failed = [];
   const loadOne = /* @__PURE__ */ __name(async (sessionId) => {
+    const metadata = await new SessionService(
+      boundWorkspace
+    ).readCreationMetadata(sessionId);
     const load = bridge.loadSession({
       sessionId,
       workspaceCwd: boundWorkspace,
-      historyReplay: "response"
+      historyReplay: "response",
+      ...metadata
     });
     void load.catch(() => {
     });
@@ -21767,6 +22385,7 @@ function createServeFeatures(deps) {
     boundWorkspace,
     persistSettingAvailable,
     sessionArtifactsPersistenceAvailable,
+    sessionGenerationAvailable,
     reloadAvailable,
     channelReloadAvailable,
     channelControlAvailable,
@@ -21800,6 +22419,7 @@ function createServeFeatures(deps) {
       persistSettingAvailable,
       sessionShellCommandEnabled,
       sessionArtifactsPersistenceAvailable,
+      sessionGenerationAvailable: sessionGenerationAvailable(),
       rateLimit: opts.rateLimit === true,
       reloadAvailable,
       channelReloadAvailable: channelReloadAvailable(),
@@ -22089,6 +22709,7 @@ init_esbuild_shims();
 var TUI_ONLY_SETTINGS = /* @__PURE__ */ new Set([
   "general.vimMode",
   "general.terminalBell",
+  "general.notificationMode",
   "general.preferredEditor",
   "general.outputLanguage",
   "ide.enabled",
@@ -22099,9 +22720,14 @@ var TUI_ONLY_SETTINGS = /* @__PURE__ */ new Set([
   "ui.accessibility.enableLoadingPhrases",
   "ui.enableWelcomeBack"
 ]);
-var WEB_SHELL_SETTINGS = /* @__PURE__ */ new Set(["ui.compactMode", "voiceModel"]);
+var WEB_SHELL_SETTINGS = /* @__PURE__ */ new Set([
+  "ui.compactMode",
+  "voiceModel",
+  "mcpServers"
+]);
 var VALID_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace", "user"]);
 var QUALIFIED_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace"]);
+var mcpServerMutationQueues = /* @__PURE__ */ new Map();
 var SECURITY_SENSITIVE_SETTINGS = /* @__PURE__ */ new Set(["tools.approvalMode"]);
 function getAllowedKeys() {
   const keys = new Set(
@@ -22133,11 +22759,12 @@ function buildSettingsResponse(boundWorkspace, keys) {
       loaded.workspace.settings,
       key
     );
+    const publicValue = /* @__PURE__ */ __name((value) => key === "mcpServers" ? redactMcpServersSetting(value) : value, "publicValue");
     const values = {
-      effective: effective !== void 0 ? effective : def.default
+      effective: publicValue(effective !== void 0 ? effective : def.default)
     };
-    if (userVal !== void 0) values.user = userVal;
-    if (wsVal !== void 0) values.workspace = wsVal;
+    if (userVal !== void 0) values.user = publicValue(userVal);
+    if (wsVal !== void 0) values.workspace = publicValue(wsVal);
     settings.push({
       key,
       type: def.type,
@@ -22165,9 +22792,62 @@ function buildSettingsResponse(boundWorkspace, keys) {
 }
 __name(buildSettingsResponse, "buildSettingsResponse");
 var SCOPE_MAP = {
-  workspace: "Workspace" /* Workspace */,
-  user: "User" /* User */
+  user: "User" /* User */,
+  workspace: "Workspace" /* Workspace */
 };
+function prepareSettingWrite(workspace, scope, key, value, mcpServerMutation) {
+  if (key !== "mcpServers") {
+    return { persistedValue: value, publicValue: value };
+  }
+  const existing = loadSettings(workspace).forScope(scope).settings.mcpServers ?? {};
+  let nextValue = value;
+  if (mcpServerMutation) {
+    const servers = { ...existing };
+    if (mcpServerMutation.operation === "set") {
+      servers[mcpServerMutation.name] = value;
+    } else {
+      delete servers[mcpServerMutation.name];
+    }
+    nextValue = servers;
+  }
+  const persistedValue = restoreRedactedMcpServersSetting(nextValue, existing);
+  return {
+    persistedValue,
+    publicValue: redactMcpServersSetting(persistedValue)
+  };
+}
+__name(prepareSettingWrite, "prepareSettingWrite");
+function parseMcpServerMutation(key, value) {
+  if (value === void 0) return void 0;
+  if (key !== "mcpServers" || typeof value !== "object" || value === null) {
+    throw new Error("mcpServerMutation is only valid for mcpServers");
+  }
+  const operation = value["operation"];
+  const name = value["name"];
+  if (operation !== "set" && operation !== "remove" || typeof name !== "string" || !name.trim()) {
+    throw new Error("mcpServerMutation requires a valid operation and name");
+  }
+  return { operation, name };
+}
+__name(parseMcpServerMutation, "parseMcpServerMutation");
+async function withMcpServerMutationLock(workspace, scope, operation) {
+  const key = `${workspace}\0${scope}`;
+  const previous = mcpServerMutationQueues.get(key) ?? Promise.resolve();
+  const run = previous.catch(() => void 0).then(operation);
+  const tail = run.then(
+    () => void 0,
+    () => void 0
+  );
+  mcpServerMutationQueues.set(key, tail);
+  try {
+    return await run;
+  } finally {
+    if (mcpServerMutationQueues.get(key) === tail) {
+      mcpServerMutationQueues.delete(key);
+    }
+  }
+}
+__name(withMcpServerMutationLock, "withMcpServerMutationLock");
 function registerWorkspaceSettingsRoutes(app, deps) {
   const {
     boundWorkspace,
@@ -22200,6 +22880,19 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       const scope = body["scope"];
       const key = body["key"];
       const value = body["value"];
+      let mcpServerMutation;
+      try {
+        mcpServerMutation = parseMcpServerMutation(
+          typeof key === "string" ? key : "",
+          body["mcpServerMutation"]
+        );
+      } catch (error2) {
+        res.status(400).json({
+          error: error2 instanceof Error ? error2.message : String(error2),
+          code: "invalid_mcp_server_mutation"
+        });
+        return;
+      }
       if (typeof scope !== "string" || !VALID_WRITE_SCOPES.has(scope)) {
         res.status(400).json({
           error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
@@ -22246,16 +22939,41 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       }
       const clientId = parseAndValidateClientId(req, res);
       if (clientId === null) return;
+      const settingScope = SCOPE_MAP[scope];
+      if (!settingScope) {
+        res.status(400).json({
+          error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
+          code: "invalid_scope"
+        });
+        return;
+      }
+      let publicValue = value;
       try {
-        const settingScope = SCOPE_MAP[scope];
-        if (!settingScope) {
-          res.status(400).json({
-            error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
-            code: "invalid_scope"
-          });
-          return;
+        const persist = /* @__PURE__ */ __name(async () => {
+          const prepared = prepareSettingWrite(
+            boundWorkspace,
+            settingScope,
+            key,
+            value,
+            mcpServerMutation
+          );
+          publicValue = prepared.publicValue;
+          await persistSetting(
+            boundWorkspace,
+            settingScope,
+            key,
+            prepared.persistedValue
+          );
+        }, "persist");
+        if (mcpServerMutation) {
+          await withMcpServerMutationLock(
+            boundWorkspace,
+            settingScope,
+            persist
+          );
+        } else {
+          await persist();
         }
-        await persistSetting(boundWorkspace, settingScope, key, value);
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspace/settings persist error (key=${key}, scope=${scope}, workspace=${boundWorkspace}): ${err instanceof Error ? err.message : String(err)}`
@@ -22267,7 +22985,7 @@ function registerWorkspaceSettingsRoutes(app, deps) {
         return;
       }
       try {
-        broadcastSettingsChanged(key, value, scope, clientId);
+        broadcastSettingsChanged(key, publicValue, scope, clientId);
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspace/settings broadcast error (key=${key}, scope=${scope}): ${err instanceof Error ? err.message : String(err)}`
@@ -22276,7 +22994,7 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       res.status(200).json({
         key,
         scope,
-        value,
+        value: publicValue,
         requiresRestart: def.requiresRestart
       });
     }
@@ -22319,6 +23037,19 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
       const scope = body["scope"];
       const key = body["key"];
       const value = body["value"];
+      let mcpServerMutation;
+      try {
+        mcpServerMutation = parseMcpServerMutation(
+          typeof key === "string" ? key : "",
+          body["mcpServerMutation"]
+        );
+      } catch (error2) {
+        res.status(400).json({
+          error: error2 instanceof Error ? error2.message : String(error2),
+          code: "invalid_mcp_server_mutation"
+        });
+        return;
+      }
       if (typeof scope !== "string" || !QUALIFIED_WRITE_SCOPES.has(scope)) {
         res.status(400).json({
           error: `scope must be one of: ${[...QUALIFIED_WRITE_SCOPES].join(", ")}`,
@@ -22377,13 +23108,33 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
         });
         return;
       }
+      let publicValue = value;
       try {
-        await deps.persistSetting(
-          runtime.workspaceCwd,
-          settingScope,
-          key,
-          value
-        );
+        const persist = /* @__PURE__ */ __name(async () => {
+          const prepared = prepareSettingWrite(
+            runtime.workspaceCwd,
+            settingScope,
+            key,
+            value,
+            mcpServerMutation
+          );
+          publicValue = prepared.publicValue;
+          await deps.persistSetting(
+            runtime.workspaceCwd,
+            settingScope,
+            key,
+            prepared.persistedValue
+          );
+        }, "persist");
+        if (mcpServerMutation) {
+          await withMcpServerMutationLock(
+            runtime.workspaceCwd,
+            settingScope,
+            persist
+          );
+        } else {
+          await persist();
+        }
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspaces/:workspace/settings persist error (key=${key}, scope=${scope}, workspace=${runtime.workspaceCwd}): ${err instanceof Error ? err.message : String(err)}`
@@ -22397,13 +23148,13 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
       deps.invalidateServeFeaturesCache();
       runtime.bridge.publishWorkspaceEvent({
         type: "settings_changed",
-        data: { key, value, scope },
+        data: { key, value: publicValue, scope },
         ...clientId ? { originatorClientId: clientId } : {}
       });
       res.status(200).json({
         key,
         scope,
-        value,
+        value: publicValue,
         requiresRestart: def.requiresRestart
       });
     }
@@ -22621,6 +23372,14 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     });
     return;
   }
+  if (err instanceof SessionNotArchivedError) {
+    res.status(409).json({
+      error: err.message,
+      code: "session_not_archived",
+      sessionId: err.sessionId
+    });
+    return;
+  }
   if (err instanceof SessionConflictError) {
     res.status(409).json({
       error: err.message,
@@ -22674,7 +23433,7 @@ function sendBridgeError(res, err, ctx, daemonLog) {
   }
   if (err instanceof WorkspaceMismatchError) {
     writeStderrLine(
-      `qwen serve: workspace_mismatch (POST /session): daemon bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
+      `qwen serve: workspace_mismatch (POST /session): runtime bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
     );
     res.status(400).json({
       error: err.message,
@@ -23774,6 +24533,15 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: workspaceExport[1]
     };
   }
+  const workspaceArchivedExport = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
+  );
+  if (workspaceArchivedExport?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/archive/export",
+      sessionId: workspaceArchivedExport[1]
+    };
+  }
   const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
   if (pluralWorkspacePrefix.test(path15)) {
     const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
@@ -23811,7 +24579,7 @@ function resolveDaemonTelemetryRoute(req) {
       if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
         return { route: "POST /workspace/agents/:agentType" };
       }
-      if (/^\/workspace\/mcp\/[^/]+\/(enable|disable|authenticate|clear-auth)$/.test(
+      if (/^\/workspace\/mcp\/[^/]+\/(approve|enable|disable|authenticate|clear-auth)$/.test(
         suffix
       )) {
         return {
@@ -23913,7 +24681,8 @@ function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest, resolveSe
     const workspaceHash = resolveWorkspaceHash(workspaceCwd);
     const rawClientId = req.get(CLIENT_ID_HEADER);
     const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
-    const startMs = Date.now();
+    const deferredRuntime = getDeferredRuntimeRequestTiming(req);
+    const startMs = deferredRuntime?.startedAt.getTime() ?? Date.now();
     void withDaemonRequestSpan(
       {
         method: req.method,
@@ -23921,7 +24690,12 @@ function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest, resolveSe
         workspaceHash,
         ...sessionId ? { sessionId } : {},
         ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
-        ...clientId ? { clientId } : {}
+        ...clientId ? { clientId } : {},
+        ...deferredRuntime?.waitMs !== void 0 ? {
+          startTime: deferredRuntime.startedAt,
+          deferredRuntimeWaitMs: deferredRuntime.waitMs,
+          deferredRuntimePath: deferredRuntime.path
+        } : {}
       },
       async (span) => await new Promise((resolve5, reject) => {
         let done = false;
@@ -23930,7 +24704,12 @@ function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest, resolveSe
           done = true;
           recordDaemonHttpResponse(span, res.statusCode);
           const durationMs = Date.now() - startMs;
-          recordDaemonHttpRequest(durationMs, route.route, res.statusCode);
+          recordDaemonHttpRequest(
+            durationMs,
+            route.route,
+            res.statusCode,
+            deferredRuntime?.path
+          );
           if (route.route !== "GET /daemon/status") {
             recordRequest?.(durationMs, res.statusCode);
           }
@@ -25330,6 +26109,30 @@ function registerWorkspaceMcpControlRoutes(app, deps) {
     parseAndValidateClientId
   } = deps;
   const buildWorkspaceCtx = createBuildWorkspaceCtx(boundWorkspace);
+  app.post(
+    "/workspace/mcp/initialize",
+    mutate({ strict: true }),
+    async (_req, res) => {
+      try {
+        const result = await bridge.initializeWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        sendBridgeError2(res, err, { route: "POST /workspace/mcp/initialize" });
+      }
+    }
+  );
+  app.post(
+    "/workspace/mcp/reload",
+    mutate({ strict: true }),
+    async (_req, res) => {
+      try {
+        const result = await bridge.reloadWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        sendBridgeError2(res, err, { route: "POST /workspace/mcp/reload" });
+      }
+    }
+  );
   app.post(
     "/workspace/mcp/:server/restart",
     mutate({ strict: true }),
@@ -25384,6 +26187,7 @@ function registerWorkspaceMcpControlRoutes(app, deps) {
     }
   );
   for (const [routeAction, bridgeAction] of [
+    ["approve", "approve"],
     ["enable", "enable"],
     ["disable", "disable"],
     ["authenticate", "authenticate"],
@@ -25498,6 +26302,44 @@ function resolveTrustedMcpRuntime(registry, req, res) {
 }
 __name(resolveTrustedMcpRuntime, "resolveTrustedMcpRuntime");
 function registerWorkspaceQualifiedMcpControlRoutes(app, deps) {
+  app.post(
+    "/workspaces/:workspace/mcp/initialize",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveTrustedMcpRuntime(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime) return;
+      const route = "POST /workspaces/:workspace/mcp/initialize";
+      try {
+        const result = await runtime.bridge.initializeWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        deps.sendBridgeError(res, err, { route });
+      }
+    }
+  );
+  app.post(
+    "/workspaces/:workspace/mcp/reload",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveTrustedMcpRuntime(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime) return;
+      const route = "POST /workspaces/:workspace/mcp/reload";
+      try {
+        const result = await runtime.bridge.reloadWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        deps.sendBridgeError(res, err, { route });
+      }
+    }
+  );
   app.post(
     "/workspaces/:workspace/mcp/:server/restart",
     deps.mutate({ strict: true }),
@@ -25561,6 +26403,7 @@ function registerWorkspaceQualifiedMcpControlRoutes(app, deps) {
     }
   );
   for (const [routeAction, bridgeAction] of [
+    ["approve", "approve"],
     ["enable", "enable"],
     ["disable", "disable"],
     ["authenticate", "authenticate"],
@@ -25752,11 +26595,84 @@ function parseSelection(body, res) {
   }
 }
 __name(parseSelection, "parseSelection");
+function sanitizeControlDiagnostic(value, maxLength) {
+  return sanitizeLogText(
+    redactLogCredentials(normalizeWorkerDiagnostic(value)),
+    maxLength
+  );
+}
+__name(sanitizeControlDiagnostic, "sanitizeControlDiagnostic");
+function startupFailureResponseFields(error2) {
+  if (!error2 || typeof error2 !== "object") return {};
+  let rawFailures;
+  let rawTruncated;
+  try {
+    rawFailures = Reflect.get(error2, "startupFailures");
+    rawTruncated = Reflect.get(error2, "startupFailuresTruncated");
+  } catch {
+    return {};
+  }
+  if (!Array.isArray(rawFailures)) return {};
+  let limitedFailures;
+  let rawFailureCount;
+  try {
+    limitedFailures = rawFailures.slice(0, MAX_CHANNEL_STARTUP_FAILURES);
+    rawFailureCount = rawFailures.length;
+  } catch {
+    return {};
+  }
+  const startupFailures = limitedFailures.flatMap((raw) => {
+    try {
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+      const failure = raw;
+      if (typeof failure["workspaceCwd"] !== "string" || failure["workspaceCwd"].length === 0 || typeof failure["channel"] !== "string" || failure["channel"].length === 0 || failure["phase"] !== "connect" || typeof failure["message"] !== "string" || failure["message"].length === 0 || failure["code"] !== void 0 && (typeof failure["code"] !== "string" || failure["code"].length === 0)) {
+        return [];
+      }
+      const workspaceCwd = sanitizeControlDiagnostic(
+        failure["workspaceCwd"],
+        MAX_WORKSPACE_PATH_LENGTH
+      );
+      const channel = sanitizeControlDiagnostic(
+        failure["channel"],
+        MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH
+      );
+      const message = sanitizeControlDiagnostic(
+        failure["message"],
+        MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH
+      );
+      const code = typeof failure["code"] === "string" ? sanitizeControlDiagnostic(
+        failure["code"],
+        MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH
+      ) : void 0;
+      if (!workspaceCwd || !channel || !message) return [];
+      return [
+        {
+          workspaceCwd,
+          channel,
+          phase: "connect",
+          ...code ? { code } : {},
+          message
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+  if (startupFailures.length === 0) return {};
+  const truncated = rawTruncated === true || rawFailureCount > MAX_CHANNEL_STARTUP_FAILURES;
+  return {
+    startupFailures,
+    ...truncated ? { startupFailuresTruncated: true } : {}
+  };
+}
+__name(startupFailureResponseFields, "startupFailureResponseFields");
 function sendChannelControlError(res, error2, getState) {
   const code = error2 && typeof error2 === "object" && "code" in error2 ? error2.code : void 0;
-  const message = redactLogCredentials(
-    error2 instanceof Error ? error2.message : String(error2)
-  );
+  const rawMessage = error2 instanceof Error ? error2.message : String(error2);
+  const message = code === "channel_worker_start_failed" ? sanitizeControlDiagnostic(
+    rawMessage,
+    MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH
+  ) : redactLogCredentials(rawMessage);
   if (code === "channel_workspace_mismatch" || code === "ambiguous_channel_workspace") {
     res.status(400).json({ error: message, code });
     return true;
@@ -25792,7 +26708,13 @@ function sendChannelControlError(res, error2, getState) {
     error: message,
     code,
     ...typeof controlError.rolledBack === "boolean" ? { rolledBack: controlError.rolledBack } : {},
-    ...typeof controlError.rollbackError === "string" && controlError.rollbackError ? { rollbackError: redactLogCredentials(controlError.rollbackError) } : {},
+    ...typeof controlError.rollbackError === "string" && controlError.rollbackError ? {
+      rollbackError: sanitizeControlDiagnostic(
+        controlError.rollbackError,
+        512
+      )
+    } : {},
+    ...code === "channel_worker_start_failed" ? startupFailureResponseFields(error2) : {},
     state: getState()
   });
   return true;
@@ -26525,6 +27447,12 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     boundWorkspace,
     persistSettingAvailable: deps.persistSetting !== void 0,
     sessionArtifactsPersistenceAvailable: deps.sessionArtifactsPersistenceAvailable !== false,
+    sessionGenerationAvailable: /* @__PURE__ */ __name(() => {
+      const runtimes = workspaceRegistry.list();
+      return runtimes.length > 0 && runtimes.every(
+        (runtime) => runtime.bridge.generateSessionContent !== void 0
+      );
+    }, "sessionGenerationAvailable"),
     // Registry injection supplies the primary workspace service through the
     // runtime, so it has the same reload surface as legacy deps.workspace.
     reloadAvailable: deps.workspace !== void 0 || injectedWorkspaceRegistry !== void 0,
@@ -26653,6 +27581,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   );
   app.locals.workspaceRegistry = workspaceRegistry;
   const primaryRuntime = workspaceRegistry.primary;
+  const daemonEnv = deps.daemonEnv ?? process.env;
+  const primaryRuntimeEffectiveEnv = getRuntimeEffectiveEnv(primaryRuntime.env) ?? daemonEnv;
   const voiceCoordinator = deps.voiceCoordinator ?? new WorkspaceVoiceCoordinator();
   const primaryBoundWorkspace = primaryRuntime.workspaceCwd;
   const primaryBridge = primaryRuntime.bridge;
@@ -26681,7 +27611,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   const healthDemoRoutes = createHealthDemoRoutes({
     opts,
     getPort,
-    bridge: primaryBridge,
+    workspaceRegistry,
     getActiveSseCount,
     getRateLimiter: /* @__PURE__ */ __name(() => rateLimiter, "getRateLimiter")
   });
@@ -26915,6 +27845,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   registerWorkspaceSetupGithubRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
+    env: primaryRuntimeEffectiveEnv,
     mutate,
     parseClientId: parseClientIdHeader,
     safeBody
@@ -27211,6 +28142,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   });
   acpHandleRef.current = mountAcpHttp(app, primaryBridge, {
     boundWorkspace: primaryBoundWorkspace,
+    daemonEnv,
     // Phase 4 (issue #6378): pass the registry so `/workspaces/:workspace/acp`
     // mounts a per-runtime ACP dispatcher for each registered workspace.
     workspaceRegistry,