@qwen-code/qwen-code 0.19.10 → 0.19.11-nightly.20260718.767a32484

package/chunks/{server-NJPHQHLH.js → server-LDY4YVU4.js}

@@ -1,22 +1,25 @@
 // Force strict mode and setup for ESM
 "use strict";
 import {
-  openQwenAsrRealtimeStream,
-  openVoiceStream,
-  openVoiceStreamWithRetry
-} from "./chunk-JSJFKYWT.js";
-import {
+  GENERATION_MAX_PROMPT_BYTES,
   MAX_REMEMBER_CONTENT_BYTES,
   createWorkspaceMemoryExtractionErrorLogger,
   extractRememberErrorCode,
   formatWorkspaceMemoryDreamSummary,
   formatWorkspaceMemoryForgetSummary,
   isValidServerName,
+  redactMcpServersSetting,
   replayTranscriptRecordPage,
+  restoreRedactedMcpServersSetting,
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-6W6DI34P.js";
+} from "./chunk-IX7O5WI3.js";
+import {
+  openQwenAsrRealtimeStream,
+  openVoiceStream,
+  openVoiceStreamWithRetry
+} from "./chunk-DPSHAB47.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -27,9 +30,9 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-4FMG7EDJ.js";
-import "./chunk-SPUYQB4T.js";
-import "./chunk-WTSXKLG5.js";
+} from "./chunk-PWYLF7SS.js";
+import "./chunk-JBAQ5BYX.js";
+import "./chunk-SUARMD4Q.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-L573Z2QZ.js";
 import {
@@ -41,7 +44,6 @@ import {
   MAX_CLIENT_ID_LENGTH,
   MAX_CONCURRENT_VOICE_SESSIONS,
   MAX_SERVER_NAME_LENGTH,
-  MAX_SKILL_NAME_LENGTH,
   MAX_TOOL_NAME_LENGTH,
   PathMutexRegistry,
   QWEN_CDP_MCP_COMMAND_ENV,
@@ -62,9 +64,11 @@ import {
   denyBrowserOriginCors,
   detectFromLoopback,
   getAdvertisedServeFeatures,
+  getDeferredRuntimeRequestTiming,
   getServeProtocolVersions,
   hostAllowlist,
   isBrowserAutomationMcpAvailable,
+  isDeepHealthQuery,
   parseAllowOriginPatterns,
   parseAndValidateWorkspaceClientId,
   parseClientIdHeader,
@@ -85,47 +89,51 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-MO7O5722.js";
+} from "./chunk-HQXQCIT2.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-ZQTZXVHP.js";
-import "./chunk-WDWJ4OQJ.js";
+} from "./chunk-U6OPT4H2.js";
+import "./chunk-LXXMOYPL.js";
+import "./chunk-K2GBHL73.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-7MJAZMXK.js";
+} from "./chunk-ECZFTRTP.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-GGJII3FM.js";
+} from "./chunk-6Z5NRZVU.js";
 import {
   snapshotProcessEnv
-} from "./chunk-ZKMGAFYV.js";
+} from "./chunk-2YSZE74N.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-WLXYAKV7.js";
+} from "./chunk-GG6RSNWS.js";
 import "./chunk-2W3OOD4W.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
+  MAX_WORKSPACE_SKILL_NAME_LENGTH,
+  WorkspaceSkillManagementError,
   WorkspaceVoiceError,
   buildWorkspaceVoiceSettingsWrites,
   buildWorkspaceVoiceStatus,
   createDaemonWorkspaceService,
   hasConfiguredBatchVoiceTranscriptionModel,
   transcribeWorkspaceVoiceAudio,
+  validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-OFEVHGVU.js";
+} from "./chunk-FSJGBUQI.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-N6FXRR6P.js";
+} from "./chunk-57RWF6R7.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -133,13 +141,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-FXMC7SL2.js";
+} from "./chunk-6ITLKEOZ.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-DPFBNG72.js";
-import "./chunk-FSA7ERJ2.js";
+} from "./chunk-AEKYFMYE.js";
+import "./chunk-F2RR4HO2.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
   WorkspaceSettingsPartialPersistError,
@@ -148,24 +156,24 @@ import {
 } from "./chunk-OA4JVLSA.js";
 import {
   createTotalSessionAdmissionController
-} from "./chunk-7R4DPSRA.js";
+} from "./chunk-R3VWUU2E.js";
 import {
   createSingleWorkspaceRegistry,
   createWorkspaceSessionOwnerIndex
-} from "./chunk-YHN5SUIJ.js";
+} from "./chunk-W7H223ZZ.js";
 import "./chunk-GRC5HGPI.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
-  createAcpSessionBridge
-} from "./chunk-HHEFI4RP.js";
-import "./chunk-PZL23GTM.js";
+  createAcpSessionBridge,
+  parseSessionSource
+} from "./chunk-KEVDWH3U.js";
+import "./chunk-T3W4SDRB.js";
 import {
   EVENT_SCHEMA_VERSION,
   SubscriberLimitExceededError
 } from "./chunk-6RLROE6G.js";
 import "./chunk-COH43MRJ.js";
-import "./chunk-OCPBI7J5.js";
 import {
   BranchWhilePromptActiveError,
   CancelSentinelCollisionError,
@@ -186,6 +194,7 @@ import {
   SessionBusyError,
   SessionConflictError,
   SessionLimitExceededError,
+  SessionNotArchivedError,
   SessionNotFoundError,
   SessionShellClientRequiredError,
   SessionShellDisabledError,
@@ -196,39 +205,44 @@ import {
   WorkspaceInitRaceError,
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
-} from "./chunk-KSO42X3Z.js";
+} from "./chunk-X6YQWCIJ.js";
 import "./chunk-WBL3FJEU.js";
 import {
   loadChannelsConfig
-} from "./chunk-Q5GLXH5Q.js";
-import "./chunk-AAR5SGMD.js";
+} from "./chunk-3CL5SEDT.js";
+import "./chunk-IVKLDHU6.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-OATTJGPJ.js";
-import "./chunk-ZRKBI3DP.js";
+} from "./chunk-Y72B36CP.js";
+import "./chunk-FZRES4GK.js";
 import "./chunk-V6WHFGST.js";
-import "./chunk-UFOKA4PR.js";
-import "./chunk-TEGEBB2I.js";
+import "./chunk-O2K6BLPZ.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-CUUXANEQ.js";
+} from "./chunk-URP6O2PP.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceRegistrationStoreCommittedError,
   WorkspaceRegistrationStoreLimitError,
   workspaceRegistrationId
-} from "./chunk-L37RC7MQ.js";
+} from "./chunk-JUVTV4NF.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
   canonicalizeWorkspaces
 } from "./chunk-W7FJ3N32.js";
 import {
-  QWEN_SERVER_TOKEN_ENV
-} from "./chunk-GYTKQYDB.js";
+  MAX_CHANNEL_STARTUP_FAILURES,
+  MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
+  MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
+  MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
+  QWEN_SERVER_TOKEN_ENV,
+  isChannelWebhookEnqueueError,
+  normalizeWorkerDiagnostic
+} from "./chunk-JDIUK2Y3.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-TJTKSVIV.js";
@@ -236,11 +250,10 @@ import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import "./chunk-5HBA2Z7V.js";
-import {
-  isChannelWebhookEnqueueError
-} from "./chunk-OJAMDVF5.js";
 import "./chunk-T2NCM2ET.js";
-import "./chunk-SXU3KKNI.js";
+import {
+  sanitizeLogText
+} from "./chunk-ATJ7H5AS.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -251,18 +264,18 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-6GETGQWP.js";
+} from "./chunk-C5NSOSF4.js";
 import "./chunk-RKUWKYED.js";
 import {
   SUPPORTED_LANGUAGES
-} from "./chunk-RDRVMDWV.js";
-import "./chunk-5EBKKSBX.js";
+} from "./chunk-HIMIG6PI.js";
+import "./chunk-336KPNNV.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import "./chunk-QRUIS3DN.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-4YWLED2A.js";
+} from "./chunk-LSFVUGXT.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -270,7 +283,7 @@ import {
 import {
   writeStderrLine
 } from "./chunk-YUZI3WAC.js";
-import "./chunk-YU56QGXX.js";
+import "./chunk-KTKETHMY.js";
 import "./chunk-VJNBRRZG.js";
 import {
   ALL_PROVIDERS,
@@ -284,7 +297,9 @@ import {
   InvalidSessionTranscriptCursorError,
   ModelsConfig,
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
+  SESSION_TRANSCRIPT_MAX_INDEX_BYTES,
   SESSION_TRANSCRIPT_MAX_LIMIT,
+  SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
   SessionOrganizationError,
   SessionOrganizationService,
   SessionService,
@@ -315,18 +330,18 @@ import {
   stripTerminalControlSequences,
   watchRepoBranch,
   writeWorkspaceContextFile
-} from "./chunk-K7CRWKOE.js";
+} from "./chunk-3YJZ6WNY.js";
+import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-E67NFMF4.js";
-import "./chunk-RCEEXIOO.js";
-import "./chunk-KKRTYONM.js";
-import "./chunk-TV6K2FB4.js";
+} from "./chunk-LKR7QQ63.js";
+import "./chunk-4XCVGEEX.js";
+import "./chunk-XSPFQQRE.js";
+import "./chunk-4RPARQ5D.js";
 import "./chunk-E2UVIFI2.js";
-import "./chunk-6OATMEYN.js";
 import {
   nextFireTime,
   parseCron
@@ -339,7 +354,7 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-SPJQO2CE.js";
+} from "./chunk-J2MKYJKZ.js";
 import "./chunk-SZRN75WQ.js";
 import "./chunk-HTO4JFDZ.js";
 import "./chunk-CPBF7KYF.js";
@@ -347,12 +362,12 @@ import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-TXY2C3D2.js";
+} from "./chunk-VNN3JNYT.js";
 import "./chunk-6AM5D4ME.js";
-import "./chunk-2Z5UX4KI.js";
-import "./chunk-ARKANCNX.js";
-import "./chunk-L5U3ELZX.js";
-import "./chunk-TYLOFD2U.js";
+import "./chunk-OSSDHJDU.js";
+import "./chunk-SGPFJMRP.js";
+import "./chunk-335ECZTA.js";
+import "./chunk-JCJPZMJV.js";
 import {
   addDaemonRequestAttribute,
   decodeBufferWithEncodingInfo,
@@ -366,15 +381,15 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-P6LART6G.js";
+} from "./chunk-66IT3EY2.js";
 import "./chunk-4WKAA4KS.js";
 import "./chunk-CR3C7WXL.js";
-import "./chunk-CARU2RR2.js";
+import "./chunk-U2LNTX56.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-FBU7WRZI.js";
-import "./chunk-Y66VOBRP.js";
-import "./chunk-WX6SD4IQ.js";
-import "./chunk-2UUAIFQO.js";
+import "./chunk-FUTHTZVV.js";
+import "./chunk-4CA4WUMS.js";
+import "./chunk-WEPXQKGP.js";
+import "./chunk-ANRANWVE.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -383,28 +398,28 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-OKAIGAYW.js";
-import "./chunk-ZPAHLFZU.js";
+} from "./chunk-G274ETR6.js";
+import "./chunk-Z2LBNX3R.js";
 import "./chunk-JESCGQM3.js";
-import "./chunk-WIEO4CWB.js";
+import "./chunk-VAJS2E2D.js";
 import "./chunk-XVNQMZ2I.js";
-import "./chunk-B7NUUEXC.js";
-import "./chunk-TQBODCFD.js";
+import "./chunk-FEOZBUMT.js";
+import "./chunk-CMVFTMRD.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
-import "./chunk-4LD5APFL.js";
+import "./chunk-TYQMGACW.js";
 import {
   import_websocket_server
 } from "./chunk-TYAMGABM.js";
 import "./chunk-FCMNKVXT.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-LQIDP6K5.js";
+import "./chunk-4CHDYDG3.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   runWithoutDebugLogSession
-} from "./chunk-7NFB7LBQ.js";
+} from "./chunk-UE5TZ55T.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -2900,7 +2915,7 @@ async function handleSetupGithub(req, res, deps) {
     const result = await setupGithub({
       cwd: deps.boundWorkspace,
       workspaceRoot: deps.boundWorkspace,
-      proxy: resolveSetupGithubProxy(deps.boundWorkspace),
+      proxy: resolveSetupGithubProxy(deps.boundWorkspace, deps.env),
       abortSignal: requestAbortSignal(req, res),
       fileOps: createSetupGithubFileOps(factory, ROUTE, originatorClientId)
     });
@@ -3118,14 +3133,14 @@ function setupGithubEventData(result) {
   };
 }
 __name(setupGithubEventData, "setupGithubEventData");
-function resolveSetupGithubProxy(boundWorkspace) {
+function resolveSetupGithubProxy(boundWorkspace, env) {
   const settings = loadSettings(boundWorkspace, { skipLoadEnvironment: true });
   const trustState = getWorkspaceTrustStatus(
     settingsForSetupGithubTrust(settings),
     boundWorkspace
   ).effective.state;
   const settingsProxy = trustState === "trusted" ? settings.merged.proxy : settings.user.settings.proxy || settings.system.settings.proxy || settings.systemDefaults.settings.proxy;
-  return settingsProxy || process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env["http_proxy"];
+  return settingsProxy || env["HTTPS_PROXY"] || env["https_proxy"] || env["HTTP_PROXY"] || env["http_proxy"];
 }
 __name(resolveSetupGithubProxy, "resolveSetupGithubProxy");
 function settingsForSetupGithubTrust(settings) {
@@ -6226,6 +6241,21 @@ async function assertSessionLoadable(workspaceCwd, sessionId) {
   return location;
 }
 __name(assertSessionLoadable, "assertSessionLoadable");
+async function assertSessionArchived(workspaceCwd, sessionId) {
+  const location = await new SessionService(workspaceCwd).getSessionLocation(
+    sessionId
+  );
+  if (location === "active") {
+    throw new SessionNotArchivedError(sessionId);
+  }
+  if (location === "conflict") {
+    throw new SessionConflictError(sessionId);
+  }
+  if (location === void 0) {
+    throw new SessionNotFoundError(sessionId);
+  }
+}
+__name(assertSessionArchived, "assertSessionArchived");
 function isSessionNotFoundError(err) {
   return err instanceof SessionNotFoundError || err instanceof Error && err.name === "SessionNotFoundError";
 }
@@ -6928,9 +6958,10 @@ function rpcErrorFrame(id, err) {
 __name(rpcErrorFrame, "rpcErrorFrame");
 var ACP_PROTOCOL_VERSION = 1;
 var AcpDispatcher = class {
-  constructor(bridge, boundWorkspace, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
+  constructor(bridge, boundWorkspace, env, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
     this.bridge = bridge;
     this.boundWorkspace = boundWorkspace;
+    this.env = env;
     this.workspace = workspace;
     this.workspaceRememberLane = workspaceRememberLane;
     this.fsFactory = fsFactory;
@@ -6944,8 +6975,14 @@ var AcpDispatcher = class {
     __name(this, "AcpDispatcher");
   }
   agentManager;
-  killOrphanSession(sessionId) {
-    void this.bridge.killSession(sessionId, { requireZeroAttaches: true }).catch(
+  killOrphanSession(sessionId, removePersistedSession = false) {
+    void this.bridge.killSession(sessionId, { requireZeroAttaches: true }).then(async (killed) => {
+      if (killed && removePersistedSession) {
+        await new SessionService(this.boundWorkspace).removeSession(
+          sessionId
+        );
+      }
+    }).catch(
       (err) => writeStderrLine(
         `qwen serve: /acp orphan killSession(${logSafe(sessionId)}) failed: ${logSafe(errMsg(err))}`
       )
@@ -7229,26 +7266,40 @@ var AcpDispatcher = class {
           return;
         case "session/new": {
           const cwd = parseOptionalWorkspaceCwd2(params, this.boundWorkspace);
+          const source = parseSessionSource(
+            params["sourceType"],
+            params["sourceId"]
+          );
+          if ("error" in source) {
+            if (id !== void 0) {
+              conn.sendConn(error(id, RPC.INVALID_PARAMS, source.error));
+            }
+            return;
+          }
           const session = await this.bridge.spawnOrAttach({
             workspaceCwd: cwd,
             clientId: conn.clientId,
-            sessionScope: "thread"
+            sessionScope: "thread",
+            ...source
           });
           if (conn.destroyed) {
-            this.killOrphanSession(session.sessionId);
+            this.killOrphanSession(session.sessionId, true);
             return;
           }
           conn.getOrCreateSession(session.sessionId).clientId = session.clientId;
           conn.ownSession(session.sessionId);
           const configOptions = await this.configOptionsFor(session.sessionId);
           if (conn.destroyed) {
-            this.killOrphanSession(session.sessionId);
+            this.killOrphanSession(session.sessionId, true);
             return;
           }
           const models = this.extractModelState(configOptions);
           const modes = this.extractModeState(configOptions);
           this.replyConn(conn, id, {
             sessionId: session.sessionId,
+            ...session.sourceType ? { sourceType: session.sourceType } : {},
+            ...session.sourceId !== void 0 ? { sourceId: session.sourceId } : {},
+            ...session.sourcePersisted !== void 0 ? { sourcePersisted: session.sourcePersisted } : {},
             ...configOptions ? { configOptions } : {},
             ...models ? { models } : {},
             ...modes ? { modes } : {}
@@ -7283,20 +7334,20 @@ var AcpDispatcher = class {
             [sessionId],
             async () => {
               await assertSessionLoadable(cwd, sessionId);
-              const parentSessionId = await new SessionService(
+              const metadata = await new SessionService(
                 cwd
-              ).readParentSessionId(sessionId);
+              ).readCreationMetadata(sessionId);
               return method === "session/load" ? await this.bridge.loadSession({
                 sessionId,
                 workspaceCwd: cwd,
                 clientId: conn.clientId,
                 historyReplay: "response",
-                ...parentSessionId !== void 0 ? { parentSessionId } : {}
+                ...metadata
               }) : await this.bridge.resumeSession({
                 sessionId,
                 workspaceCwd: cwd,
                 clientId: conn.clientId,
-                ...parentSessionId !== void 0 ? { parentSessionId } : {}
+                ...metadata
               });
             }
           );
@@ -7395,6 +7446,13 @@ var AcpDispatcher = class {
               );
             }
           }
+          const parsedSource = parseSessionSource(
+            params["sourceType"],
+            params["sourceId"]
+          );
+          if ("error" in parsedSource) {
+            throw new AcpParamError(parsedSource.error);
+          }
           const result = await listWorkspaceSessionsForResponse(
             this.bridge,
             workspaceCwd,
@@ -7404,7 +7462,8 @@ var AcpDispatcher = class {
               archiveState,
               view,
               group,
-              parentSessionId
+              parentSessionId,
+              ...parsedSource
             }
           );
           this.replyConn(conn, id, {
@@ -7417,6 +7476,8 @@ var AcpDispatcher = class {
               displayName: s.displayName,
               title: s.displayName,
               ...s.parentSessionId !== void 0 ? { parentSessionId: s.parentSessionId } : {},
+              ...s.sourceType !== void 0 ? { sourceType: s.sourceType } : {},
+              ...s.sourceId !== void 0 ? { sourceId: s.sourceId } : {},
               clientCount: s.clientCount,
               hasActivePrompt: s.hasActivePrompt,
               isArchived: s.isArchived === true,
@@ -8277,7 +8338,7 @@ var AcpDispatcher = class {
             const result = await setupGithub({
               cwd: this.boundWorkspace,
               workspaceRoot: this.boundWorkspace,
-              proxy: resolveSetupGithubProxy(this.boundWorkspace),
+              proxy: resolveSetupGithubProxy(this.boundWorkspace, this.env),
               abortSignal: conn.abortSignal,
               fileOps: createSetupGithubFileOps(
                 this.fsFactory,
@@ -11748,11 +11809,11 @@ function delay(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 __name(delay, "delay");
-function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname) {
+function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname, env) {
   if (localPort === void 0 || !Number.isInteger(localPort) || localPort <= 0) {
     return void 0;
   }
-  const command = resolveCdpMcpCommand(process.env);
+  const command = resolveCdpMcpCommand(env);
   if (!command) {
     writeStderrLine(
       `qwen serve: set ${QWEN_CDP_MCP_COMMAND_ENV} to enable browser automation MCP (no adapter is bundled)`
@@ -11858,9 +11919,18 @@ function workspaceRateLimitKey(mount, clientKey) {
   return JSON.stringify([clientKey, mount.rateLimitScope]);
 }
 __name(workspaceRateLimitKey, "workspaceRateLimitKey");
+function runtimeEffectiveEnv(runtime, daemonEnv) {
+  if (runtime.env.mode === "runtime-overlay") {
+    return runtime.env.effectiveEnv ?? {};
+  }
+  return runtime.env.effectiveEnv ?? daemonEnv;
+}
+__name(runtimeEffectiveEnv, "runtimeEffectiveEnv");
 function mountAcpHttp(app, bridge, opts) {
   const enabled = opts.enabled ?? resolveAcpHttpEnabled();
   if (!enabled) return void 0;
+  const daemonEnv = opts.daemonEnv ?? process.env;
+  const primaryEnv = opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv;
   const path15 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
@@ -11950,7 +12020,8 @@ function mountAcpHttp(app, bridge, opts) {
     }
     const runtimeConfig = buildChromeDevToolsMcpRuntimeConfig(
       localPort,
-      opts.hostname
+      opts.hostname,
+      daemonEnv
     );
     if (!runtimeConfig) {
       cdpMcpTerminalSkipLogged = true;
@@ -12009,6 +12080,7 @@ function mountAcpHttp(app, bridge, opts) {
   const dispatcher = new AcpDispatcher(
     bridge,
     opts.boundWorkspace,
+    primaryEnv,
     opts.workspace,
     opts.workspaceRememberLane,
     opts.fsFactory,
@@ -12297,6 +12369,7 @@ function mountAcpHttp(app, bridge, opts) {
     const secondaryDispatcher = new AcpDispatcher(
       rt.bridge,
       rt.workspaceCwd,
+      runtimeEffectiveEnv(rt, daemonEnv),
       rt.workspaceService,
       workspaceRememberLane,
       rt.routeFileSystemFactory,
@@ -14402,7 +14475,13 @@ __name(getDemoHtml, "getDemoHtml");
 
 // packages/cli/src/serve/routes/health-demo.ts
 function createHealthDemoRoutes(deps) {
-  const { opts, getPort, bridge, getActiveSseCount: getActiveSseCount2, getRateLimiter } = deps;
+  const {
+    opts,
+    getPort,
+    workspaceRegistry,
+    getActiveSseCount: getActiveSseCount2,
+    getRateLimiter
+  } = deps;
   const demoHandler = /* @__PURE__ */ __name((_req, res) => {
     try {
       res.type("html").set("X-Frame-Options", "DENY").set(
@@ -14417,32 +14496,55 @@ function createHealthDemoRoutes(deps) {
     }
   }, "demoHandler");
   const healthHandler = /* @__PURE__ */ __name((req, res) => {
-    const deepQuery = req.query["deep"];
-    const deep = deepQuery === "1" || deepQuery === "true" || deepQuery === "";
-    if (!deep) {
+    if (!isDeepHealthQuery(req.query["deep"])) {
       res.status(200).json({ status: "ok" });
       return;
     }
+    let failedWorkspaceId;
     try {
-      const lastActivity = bridge.lastActivityAt;
+      const runtimes = workspaceRegistry.listManaged();
+      let sessions = 0;
+      let pendingPermissions = 0;
+      let activePrompts = 0;
+      let channelAlive = false;
+      let lastActivity = null;
+      for (const runtime of runtimes) {
+        failedWorkspaceId = runtime.workspaceId;
+        const bridge = runtime.bridge;
+        const runtimeSessions = bridge.sessionCount;
+        const runtimePendingPermissions = bridge.pendingPermissionCount;
+        const runtimeActivePrompts = bridge.activePromptCount;
+        const runtimeChannelAlive = bridge.isChannelLive();
+        const runtimeLastActivity = bridge.lastActivityAt;
+        sessions += runtimeSessions;
+        pendingPermissions += runtimePendingPermissions;
+        activePrompts += runtimeActivePrompts;
+        channelAlive = channelAlive || runtimeChannelAlive;
+        if (runtimeLastActivity !== null && (lastActivity === null || runtimeLastActivity > lastActivity)) {
+          lastActivity = runtimeLastActivity;
+        }
+        failedWorkspaceId = void 0;
+      }
       const now = Date.now();
       const rateLimiter = getRateLimiter();
       res.status(200).json({
         status: "ok",
-        sessions: bridge.sessionCount,
-        pendingPermissions: bridge.pendingPermissionCount,
-        activePrompts: bridge.activePromptCount,
+        workspaceCount: runtimes.length,
+        sessions,
+        pendingPermissions,
+        activePrompts,
         connectedClients: getActiveSseCount2(),
-        channelAlive: bridge.isChannelLive(),
+        channelAlive,
         lastActivityAt: lastActivity !== null ? new Date(lastActivity).toISOString() : null,
         idleSinceMs: lastActivity !== null ? now - lastActivity : null,
         ...rateLimiter ? { rateLimitHits: rateLimiter.getHitCounts() } : {}
       });
     } catch (err) {
+      const workspaceContext = failedWorkspaceId !== void 0 ? ` for workspace ${JSON.stringify(failedWorkspaceId)}` : "";
       writeStderrLine(
-        `qwen serve: /health deep probe failed: ${err instanceof Error ? err.message : String(err)}`
+        `qwen serve: /health deep probe failed${workspaceContext}: ${err instanceof Error ? err.message : String(err)}`
       );
-      res.status(503).json({ status: "degraded" });
+      res.status(503).json({ status: "degraded", reason: "aggregation_failed" });
     }
   }, "healthHandler");
   const loopback = isLoopbackBind(opts.hostname);
@@ -14950,6 +15052,7 @@ __name(registerWorkspaceAuthRoutes, "registerWorkspaceAuthRoutes");
 
 // packages/cli/src/serve/routes/workspace-extensions.ts
 init_esbuild_shims();
+import * as crypto2 from "node:crypto";
 
 // packages/cli/src/serve/extension-operation-scheduler.ts
 init_esbuild_shims();
@@ -15029,6 +15132,18 @@ init_esbuild_shims();
 import * as crypto from "node:crypto";
 var MAX_UNFINISHED_EXTENSION_OPERATIONS = 10;
 var sanitizeDaemonMessage = /* @__PURE__ */ __name((message) => redactUrlCredentials(stripAnsiAndControl(message)), "sanitizeDaemonMessage");
+var redactExtensionDisplaySource = /* @__PURE__ */ __name((source) => {
+  const redacted = redactUrlCredentials(source);
+  if (/^[A-Za-z]:[\\/]/.test(redacted)) return redacted;
+  try {
+    const url = new URL(redacted);
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return redacted;
+  }
+}, "redactExtensionDisplaySource");
 var EXTENSION_PREPARATION_CONCURRENCY = 2;
 var EXTENSION_REFRESH_TIMEOUT_MS = 3e4;
 var RECONCILE_SLOW_MS = 3e4;
@@ -15057,21 +15172,21 @@ function createExtensionsController(deps) {
       unfinishedOperationCount -= 1;
     };
   }, "acquireOperationSlot");
-  const createExtensionManager = /* @__PURE__ */ __name((workspaceDir = boundWorkspace, trustedOverride) => new ExtensionManager({
+  const createExtensionManager = /* @__PURE__ */ __name((workspaceDir = boundWorkspace, trustedOverride, interactions) => new ExtensionManager({
     workspaceDir,
     isWorkspaceTrusted: trustedOverride ?? getWorkspaceTrustStatus(loadSettings(workspaceDir).merged, workspaceDir).effective.state === "trusted",
     requestConsent: /* @__PURE__ */ __name(() => Promise.resolve(), "requestConsent"),
     networkPolicy: "public",
-    requestSetting: /* @__PURE__ */ __name(async (setting) => {
+    requestSetting: interactions?.requestSetting ?? (async (setting) => {
       throw new Error(
         `Extension setting "${setting.envVar}" requires interactive configuration and is not supported over the daemon install endpoint.`
       );
-    }, "requestSetting"),
-    requestChoicePlugin: /* @__PURE__ */ __name(async () => {
+    }),
+    requestChoicePlugin: interactions?.requestChoicePlugin ?? (async () => {
       throw new Error(
         "Marketplace plugin selection is not supported over the daemon install endpoint. Specify a plugin name in the source."
       );
-    }, "requestChoicePlugin")
+    })
   }), "createExtensionManager");
   const validateExtensionMutationClient = /* @__PURE__ */ __name((req, res, opts = {}) => {
     const clientId = parseAndValidateWorkspaceClientId(
@@ -15090,10 +15205,10 @@ function createExtensionsController(deps) {
     return true;
   }, "validateExtensionMutationClient");
   const extensionOperations = /* @__PURE__ */ new Map();
-  const isTerminalExtensionOperation = /* @__PURE__ */ __name((operation) => operation.status !== "queued" && operation.status !== "running", "isTerminalExtensionOperation");
+  const isTerminalExtensionOperation = /* @__PURE__ */ __name((operation) => operation.status !== "queued" && operation.status !== "running" && operation.status !== "waiting_for_input", "isTerminalExtensionOperation");
   const redactExtensionOperationResult = /* @__PURE__ */ __name((event) => ({
     ...event,
-    ...event.source ? { source: redactUrlCredentials(event.source) } : {}
+    ...event.source ? { source: redactExtensionDisplaySource(event.source) } : {}
   }), "redactExtensionOperationResult");
   const bridgeMutationEvent = /* @__PURE__ */ __name((event) => {
     const redacted = redactExtensionOperationResult(event);
@@ -15174,7 +15289,7 @@ function createExtensionsController(deps) {
       status: "queued",
       createdAt: now,
       updatedAt: now,
-      ...failureContext.source ? { source: redactUrlCredentials(failureContext.source) } : {},
+      ...failureContext.source ? { source: redactExtensionDisplaySource(failureContext.source) } : {},
       ...failureContext.name ? { name: failureContext.name } : {}
     });
     const operationBasePath = options.operationBasePath ?? "/workspace/extensions/operations";
@@ -15201,7 +15316,7 @@ function createExtensionsController(deps) {
           status: "running",
           phase: "preparing"
         });
-        const extensionManager = options.manager ?? createExtensionManager();
+        const extensionManager = options.manager ?? options.createManager?.(operationId) ?? createExtensionManager();
         const deadlineController = new AbortController();
         let deadlineStarted = false;
         const startDeadline = /* @__PURE__ */ __name(() => {
@@ -15302,7 +15417,8 @@ function createExtensionsController(deps) {
         const event = await run(
           extensionManager,
           deadlineController.signal,
-          context
+          context,
+          operationId
         );
         mutationEvent = event;
         if (deadline) clearTimeout(deadline);
@@ -15527,7 +15643,9 @@ function createExtensionsController(deps) {
             bridge.broadcastExtensionsChanged({
               ...mutationEvent ? bridgeMutationEvent(mutationEvent) : {
                 ...failureContext.source ? {
-                  source: redactUrlCredentials(failureContext.source)
+                  source: redactExtensionDisplaySource(
+                    failureContext.source
+                  )
                 } : {},
                 ...failureContext.name ? { name: failureContext.name } : {}
               },
@@ -15548,13 +15666,14 @@ function createExtensionsController(deps) {
         updateExtensionOperation(operationId, {
           status: "failed",
           phase: void 0,
+          interaction: void 0,
           error: message.slice(0, 500),
           ...code ? { code } : {}
         });
         try {
           bridge.broadcastExtensionsChanged({
             status: "failed",
-            ...failureContext.source ? { source: redactUrlCredentials(failureContext.source) } : {},
+            ...failureContext.source ? { source: redactExtensionDisplaySource(failureContext.source) } : {},
             ...failureContext.name ? { name: failureContext.name } : {},
             refreshed: 0,
             failed: 0,
@@ -15576,6 +15695,7 @@ function createExtensionsController(deps) {
       } finally {
         if (deadline) clearTimeout(deadline);
         reconciliationReservation?.release();
+        options.onSettled?.(operationId);
         releaseOperationSlot();
       }
     })();
@@ -15610,7 +15730,11 @@ function createExtensionsController(deps) {
         version: ext.version,
         isActive: ext.isActive,
         path: ext.path,
-        ...ext.installMetadata?.source ? { source: redactUrlCredentials(ext.installMetadata.source) } : {},
+        ...ext.installMetadata?.source ? {
+          source: redactExtensionDisplaySource(
+            ext.installMetadata.source
+          )
+        } : {},
         ...ext.installMetadata?.type ? { installType: ext.installMetadata.type } : {},
         ...ext.installMetadata?.originSource ? { originSource: ext.installMetadata.originSource } : {},
         ...ext.installMetadata?.ref ? { ref: ext.installMetadata.ref } : {},
@@ -15646,6 +15770,10 @@ function createExtensionsController(deps) {
     buildLocalExtensionsStatus,
     refreshExtensionsForAllSessions,
     getOperation: /* @__PURE__ */ __name((operationId) => extensionOperations.get(operationId), "getOperation"),
+    getActiveOperations: /* @__PURE__ */ __name(() => [...extensionOperations.values()].filter(
+      (operation) => !isTerminalExtensionOperation(operation)
+    ), "getActiveOperations"),
+    updateOperation: updateExtensionOperation,
     preparationQueue,
     acquireOperationSlot,
     validateExtensionMutationClient,
@@ -15656,6 +15784,8 @@ __name(createExtensionsController, "createExtensionsController");
 
 // packages/cli/src/serve/routes/workspace-extensions.ts
 var EXTENSION_PREPARE_DEADLINE_MS = 10 * 6e4;
+var EXTENSION_INTERACTION_DEADLINE_MS = 10 * 6e4;
+var EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS = EXTENSION_PREPARE_DEADLINE_MS + EXTENSION_INTERACTION_DEADLINE_MS;
 var EXTENSION_UPDATE_CHECK_DEADLINE_MS = 2 * 6e4;
 var parseExtensionScope = /* @__PURE__ */ __name((body, res) => {
   const scope = body["scope"];
@@ -15761,6 +15891,96 @@ function registerWorkspaceExtensionRoutes(app, deps) {
   const primaryController = createExtensionsController(
     controllerDeps(boundWorkspace, bridge, workspace)
   );
+  const pendingExtensionInteractions = /* @__PURE__ */ new Map();
+  const supersededInstallOperations = /* @__PURE__ */ new Set();
+  const cancelPendingExtensionInteraction = /* @__PURE__ */ __name((operationId, reason) => {
+    const pending = pendingExtensionInteractions.get(operationId);
+    if (!pending) return;
+    clearTimeout(pending.timeout);
+    pendingExtensionInteractions.delete(operationId);
+    pending.reject(new Error(reason));
+  }, "cancelPendingExtensionInteraction");
+  const supersedeActiveInstallOperations = /* @__PURE__ */ __name((controller, currentOperationId) => {
+    for (const operation of controller.getActiveOperations()) {
+      if (operation.operation !== "install" || operation.operationId === currentOperationId) {
+        continue;
+      }
+      supersededInstallOperations.add(operation.operationId);
+      cancelPendingExtensionInteraction(
+        operation.operationId,
+        "Extension installation cancelled by a new install request"
+      );
+    }
+  }, "supersedeActiveInstallOperations");
+  const waitForExtensionInteraction = /* @__PURE__ */ __name((controller, operationId, interaction) => {
+    if (supersededInstallOperations.delete(operationId)) {
+      return Promise.reject(
+        new Error("Extension installation superseded by a new install request")
+      );
+    }
+    const operation = controller.getOperation(operationId);
+    if (operation && operation.status !== "queued" && operation.status !== "running" && operation.status !== "waiting_for_input") {
+      return Promise.reject(new Error("Extension operation already completed"));
+    }
+    const pendingInteraction = {
+      ...interaction,
+      id: crypto2.randomUUID()
+    };
+    return new Promise((resolve5, reject) => {
+      const timeout = setTimeout(() => {
+        pendingExtensionInteractions.delete(operationId);
+        controller.updateOperation(operationId, {
+          status: "failed",
+          phase: void 0,
+          interaction: void 0,
+          error: "Extension interaction timed out"
+        });
+        reject(new Error("Extension interaction timed out"));
+      }, EXTENSION_INTERACTION_DEADLINE_MS);
+      timeout.unref?.();
+      pendingExtensionInteractions.set(operationId, {
+        interaction: pendingInteraction,
+        resolve: resolve5,
+        reject,
+        timeout
+      });
+      controller.updateOperation(operationId, {
+        status: "waiting_for_input",
+        phase: void 0,
+        interaction: pendingInteraction
+      });
+    });
+  }, "waitForExtensionInteraction");
+  const extensionInteractionHandlers = /* @__PURE__ */ __name((controller, operationId) => ({
+    requestSetting: /* @__PURE__ */ __name((setting) => waitForExtensionInteraction(controller, operationId, {
+      kind: "setting",
+      setting: {
+        name: setting.name,
+        description: setting.description,
+        sensitive: setting.sensitive === true
+      }
+    }), "requestSetting"),
+    requestChoicePlugin: /* @__PURE__ */ __name((marketplace) => {
+      if (marketplace.plugins.length === 0) {
+        return Promise.reject(
+          new Error(`Marketplace "${marketplace.name}" has no plugins`)
+        );
+      }
+      return waitForExtensionInteraction(controller, operationId, {
+        kind: "marketplace_plugin",
+        marketplace: { name: marketplace.name },
+        plugins: marketplace.plugins.map((plugin) => ({
+          name: plugin.name,
+          ...plugin.description ? { description: plugin.description } : {},
+          source: redactExtensionDisplaySource(
+            typeof plugin.source === "string" ? plugin.source : plugin.source.source === "github" ? plugin.source.repo : plugin.source.url
+          ),
+          ...plugin.category ? { category: plugin.category } : {},
+          ...plugin.tags ? { tags: plugin.tags } : {}
+        }))
+      });
+    }, "requestChoicePlugin")
+  }), "extensionInteractionHandlers");
   const runtimeReconciliationQueue = createFifoTaskQueue(1);
   const reserveRuntimeReconciliation = /* @__PURE__ */ __name(() => {
     let provideTask;
@@ -15877,6 +16097,11 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         sendBridgeError2(res, err, { route: `GET ${base}` });
       }
     });
+    app.get(`${base}/operations`, async (req, res) => {
+      const ctrl = resolve5(req, res, false);
+      if (!ctrl) return;
+      res.status(200).json({ v: 1, operations: ctrl.getActiveOperations() });
+    });
     app.get(`${base}/operations/:operationId`, async (req, res) => {
       const ctrl = resolve5(req, res, false);
       if (!ctrl) return;
@@ -15918,11 +16143,85 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         });
       }
     });
+    app.post(
+      `${base}/operations/:operationId/interactions/:interactionId`,
+      mutate({ strict: true }),
+      async (req, res) => {
+        const ctrl = resolve5(req, res, false);
+        if (!ctrl) return;
+        try {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
+            return;
+          }
+          const operationId = req.params["operationId"];
+          const interactionId = req.params["interactionId"];
+          const pending = operationId ? pendingExtensionInteractions.get(operationId) : void 0;
+          if (!operationId || !interactionId || !pending) {
+            res.status(404).json({ error: "Extension interaction not found" });
+            return;
+          }
+          if (pending.interaction.id !== interactionId) {
+            res.status(404).json({ error: "Extension interaction not found" });
+            return;
+          }
+          const body = safeBody2(req);
+          let value;
+          if (body["cancelled"] === true) {
+            clearTimeout(pending.timeout);
+            pendingExtensionInteractions.delete(operationId);
+            ctrl.updateOperation(operationId, {
+              status: "failed",
+              phase: void 0,
+              interaction: void 0,
+              error: "Extension operation cancelled"
+            });
+            pending.reject(new Error("Extension operation cancelled"));
+            res.status(200).json({ accepted: true });
+            return;
+          }
+          if (pending.interaction.kind === "marketplace_plugin") {
+            const pluginName = body["pluginName"];
+            if (typeof pluginName !== "string" || !pending.interaction.plugins.some(
+              (plugin) => plugin.name === pluginName
+            )) {
+              res.status(400).json({ error: "Invalid marketplace plugin name" });
+              return;
+            }
+            value = pluginName;
+          } else {
+            const settingValue = body["value"];
+            if (typeof settingValue !== "string") {
+              res.status(400).json({ error: "Extension setting value must be a string" });
+              return;
+            }
+            value = settingValue;
+          }
+          clearTimeout(pending.timeout);
+          pendingExtensionInteractions.delete(operationId);
+          ctrl.updateOperation(operationId, {
+            status: "running",
+            phase: "preparing",
+            interaction: void 0,
+            error: void 0
+          });
+          pending.resolve(value);
+          res.status(200).json({ accepted: true });
+        } catch (err) {
+          sendBridgeError2(res, err, {
+            route: `POST ${base}/operations/:operationId/interactions/:interactionId`
+          });
+        }
+      }
+    );
     app.post(`${base}/install`, mutate({ strict: true }), async (req, res) => {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const body = safeBody2(req);
@@ -15972,11 +16271,56 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         if (!validateExtensionSourceHost(sourceValue, res)) {
           return;
         }
+        const localSource = /^[A-Za-z]:[\\/]/.test(sourceValue) || sourceValue.startsWith("/") || sourceValue.startsWith(".");
+        if (localSource) {
+          try {
+            const metadata = await parseInstallSource(sourceValue, {
+              networkPolicy: "public"
+            });
+            if (metadata.type !== "git" && metadata.type !== "github-release" && metadata.type !== "npm") {
+              res.status(400).json({
+                error: "Only GitHub, Git, and npm extension installs are supported over the daemon endpoint."
+              });
+              return;
+            }
+          } catch (error2) {
+            const message = error2 instanceof Error ? error2.message : "Invalid install source";
+            res.status(400).json({
+              error: redactUrlCredentials(
+                message.replaceAll(
+                  sourceValue,
+                  redactExtensionDisplaySource(sourceValue)
+                )
+              )
+            });
+            return;
+          }
+        }
+        const npmSource = sourceValue.startsWith("@");
+        const remoteSource = npmSource || sourceValue.startsWith("https://") || /^[^/\s]+\/[^/\s]+/.test(sourceValue);
+        if (!localSource && !remoteSource) {
+          res.status(400).json({
+            error: `Install source not found: ${redactExtensionDisplaySource(
+              sourceValue
+            )}`
+          });
+          return;
+        }
+        if (npmSource && refValue) {
+          res.status(400).json({ error: "--ref is not applicable for npm extensions." });
+          return;
+        }
+        if (!npmSource && registryValue) {
+          res.status(400).json({
+            error: "--registry is only applicable for npm extensions."
+          });
+          return;
+        }
         ctrl.runQueuedExtensionMutation(
           "install",
           { source: sourceValue },
           res,
-          async (extensionManager, _signal, context) => {
+          async (extensionManager, _signal, context, operationId) => {
             const prepared = await context.prepare(async (signal) => {
               const installMetadata = await parseInstallSource(sourceValue, {
                 networkPolicy: "public"
@@ -16000,6 +16344,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               if (installMetadata.type === "npm" && registryUrl) {
                 installMetadata.registryUrl = registryUrl;
               }
+              supersedeActiveInstallOperations(ctrl, operationId);
               return await extensionManager.prepareExtensionInstall({
                 installMetadata: {
                   ...installMetadata,
@@ -16030,7 +16375,19 @@ function registerWorkspaceExtensionRoutes(app, deps) {
             }
           },
           {
-            deadlineMs: EXTENSION_PREPARE_DEADLINE_MS,
+            createManager: /* @__PURE__ */ __name((operationId) => ctrl.createExtensionManager(
+              void 0,
+              void 0,
+              extensionInteractionHandlers(ctrl, operationId)
+            ), "createManager"),
+            onSettled: /* @__PURE__ */ __name((operationId) => {
+              supersededInstallOperations.delete(operationId);
+              cancelPendingExtensionInteraction(
+                operationId,
+                "Extension operation ended"
+              );
+            }, "onSettled"),
+            deadlineMs: EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS,
             ...globalReconciliationOptions()
           }
         );
@@ -16047,7 +16404,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         let timer;
         let releaseOperationSlot;
         try {
-          if (!ctrl.validateExtensionMutationClient(req, res)) {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
             return;
           }
           releaseOperationSlot = ctrl.acquireOperationSlot(res);
@@ -16107,7 +16466,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const releaseOperationSlot = ctrl.acquireOperationSlot(res);
@@ -16223,7 +16584,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         const ctrl = resolve5(req, res, true);
         if (!ctrl) return;
         try {
-          if (!ctrl.validateExtensionMutationClient(req, res)) {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
             return;
           }
           const name = req.params["name"];
@@ -16280,7 +16643,18 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               }
             },
             {
-              deadlineMs: EXTENSION_PREPARE_DEADLINE_MS,
+              createManager: /* @__PURE__ */ __name((operationId) => ctrl.createExtensionManager(
+                void 0,
+                void 0,
+                extensionInteractionHandlers(ctrl, operationId)
+              ), "createManager"),
+              onSettled: /* @__PURE__ */ __name((operationId) => {
+                cancelPendingExtensionInteraction(
+                  operationId,
+                  "Extension operation ended"
+                );
+              }, "onSettled"),
+              deadlineMs: EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS,
               ...globalReconciliationOptions()
             }
           );
@@ -16293,7 +16667,9 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
       try {
-        if (!ctrl.validateExtensionMutationClient(req, res)) {
+        if (!ctrl.validateExtensionMutationClient(req, res, {
+          requireClientId: false
+        })) {
           return;
         }
         const name = req.params["name"];
@@ -17355,67 +17731,682 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/routes/session-runtime.ts
 init_esbuild_shims();
-function requireSessionRuntime(opts) {
-  const {
-    sessionId,
-    route,
-    res,
-    workspaceRegistry,
-    daemonLog,
-    details = {}
-  } = opts;
-  if (workspaceRegistry.list().length === 1) {
-    return workspaceRegistry.primary;
+
+// packages/cli/src/serve/server/telemetry.ts
+init_esbuild_shims();
+var legacySessionTelemetryRoutes = [
+  {
+    method: "POST",
+    path: "/session",
+    attribution: "handler_resolved",
+    route: "POST /session"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/load",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/load"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/resume",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/resume"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/branch",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/branch"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/fork",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/fork"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/cd",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/cd"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/status",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/status"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/export",
+    attribution: "pre_resolved",
+    route: "GET /session/:id/export"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/transcript",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/transcript"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/context",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/context"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/context-usage",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/context-usage"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/stats",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/stats"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/supported-commands",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/supported-commands"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/tasks",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/tasks"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/lsp",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/lsp"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/hooks",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/hooks"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/artifacts",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/artifacts"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/artifacts",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/artifacts"
+  },
+  {
+    method: "DELETE",
+    path: "/session/:id/artifacts/:artifactId",
+    attribution: "handler_resolved",
+    route: "DELETE /session/:id/artifacts/:artifactId"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/tasks/:taskId/cancel",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/tasks/:taskId/cancel"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/goal/clear",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/goal/clear"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/continue",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/continue"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/prompt",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/prompt"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/generate",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/generate"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/heartbeat",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/heartbeat"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/detach",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/detach"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/cancel",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/cancel"
+  },
+  {
+    method: "DELETE",
+    path: "/session/:id",
+    attribution: "handler_resolved",
+    route: "DELETE /session/:id"
+  },
+  {
+    method: "POST",
+    path: "/sessions/delete",
+    attribution: "pre_resolved",
+    route: "POST /sessions/delete"
+  },
+  {
+    method: "POST",
+    path: "/sessions/archive",
+    attribution: "pre_resolved",
+    route: "POST /sessions/archive"
+  },
+  {
+    method: "POST",
+    path: "/sessions/unarchive",
+    attribution: "pre_resolved",
+    route: "POST /sessions/unarchive"
+  },
+  {
+    method: "PATCH",
+    path: "/session/:id/metadata",
+    attribution: "handler_resolved",
+    route: "PATCH /session/:id/metadata"
+  },
+  {
+    method: "PATCH",
+    path: "/session/:id/organization",
+    attribution: "pre_resolved",
+    route: "PATCH /session/:id/organization"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/model",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/model"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/recap",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/recap"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/btw",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/btw"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/mid-turn-message",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/mid-turn-message"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/pending-prompts",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/pending-prompts"
+  },
+  {
+    method: "DELETE",
+    path: "/session/:id/pending-prompts/:promptId",
+    attribution: "handler_resolved",
+    route: "DELETE /session/:id/pending-prompts/:promptId"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/shell",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/shell"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/rewind/snapshots",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/rewind/snapshots"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/rewind",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/rewind"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/approval-mode",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/approval-mode"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/language",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/language"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/permission/:requestId",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/permission/:requestId"
+  },
+  {
+    method: "POST",
+    path: "/permission/:requestId",
+    attribution: "pre_resolved",
+    route: "POST /permission/:requestId"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/events",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/events"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/a2ui-action",
+    attribution: "pre_resolved",
+    route: "POST /session/:id/a2ui-action"
   }
-  const resolution = workspaceRegistry.resolveLiveSessionOwner(sessionId);
-  if (resolution.kind === "found") {
-    const runtime = resolution.runtime;
-    if (!runtime.primary && !runtime.trusted) {
-      daemonLog?.warn("session routing failed", {
-        route,
-        resolutionKind: "untrusted_workspace",
-        sessionId,
-        workspaceId: runtime.workspaceId,
-        workspaceCwd: runtime.workspaceCwd,
-        ...details
-      });
-      sendUntrustedWorkspaceResponse(res, {
-        sessionId,
-        workspaceCwd: runtime.workspaceCwd,
-        workspaceId: runtime.workspaceId
-      });
-      return void 0;
-    }
-    return runtime;
+];
+var daemonTelemetryResponseContext = Symbol("daemonTelemetryResponseContext");
+function decodePathSegment(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
   }
-  if (resolution.kind === "not_found") {
-    daemonLog?.warn("session routing failed", {
-      route,
-      resolutionKind: "not_found",
-      sessionId,
-      ...details
-    });
-    res.status(404).json({
-      error: `No session with id "${sessionId}"`,
-      code: "session_not_found",
-      sessionId
-    });
+}
+__name(decodePathSegment, "decodePathSegment");
+function matchLegacySessionTelemetryRoute(method, requestPath) {
+  const path15 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
+  const requestSegments = path15.split("/").slice(1);
+  const prefix = requestSegments[0]?.toLowerCase();
+  if (prefix !== "session" && prefix !== "sessions" && prefix !== "permission") {
     return void 0;
   }
-  const workspaceIds = resolution.runtimes.map(
-    (runtime) => runtime.workspaceId
-  );
-  daemonLog?.warn("session routing failed", {
-    route,
-    resolutionKind: "ambiguous",
-    sessionId,
-    workspaceIds,
-    ...details
-  });
-  res.status(500).json({
-    error: `Session owner is ambiguous for "${sessionId}"`,
-    code: "ambiguous_session_owner",
-    sessionId,
+  for (const entry of legacySessionTelemetryRoutes) {
+    if (entry.method !== method) continue;
+    const templateSegments = entry.path.split("/").slice(1);
+    if (templateSegments.length !== requestSegments.length) continue;
+    const params = /* @__PURE__ */ new Map();
+    let matched = true;
+    for (let index = 0; index < templateSegments.length; index += 1) {
+      const templateSegment = templateSegments[index];
+      const requestSegment = requestSegments[index];
+      if (templateSegment.startsWith(":")) {
+        if (requestSegment === "") {
+          matched = false;
+          break;
+        }
+        params.set(templateSegment.slice(1), requestSegment);
+      } else if (templateSegment.toLowerCase() !== requestSegment.toLowerCase()) {
+        matched = false;
+        break;
+      }
+    }
+    if (!matched) continue;
+    const rawSessionId = params.get("id");
+    const rawRequestId = params.get("requestId");
+    const requestId = rawRequestId !== void 0 ? decodePathSegment(rawRequestId) : void 0;
+    return {
+      route: entry.route,
+      attribution: entry.attribution,
+      ...rawSessionId ? { sessionId: decodePathSegment(rawSessionId) } : {},
+      ...requestId !== void 0 && requestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(requestId) ? { permissionRequestId: requestId } : {}
+    };
+  }
+  return void 0;
+}
+__name(matchLegacySessionTelemetryRoute, "matchLegacySessionTelemetryRoute");
+function setDaemonTelemetryWorkspace(res, workspaceCwd) {
+  try {
+    const context = res[daemonTelemetryResponseContext];
+    if (context && context.workspaceCwd === void 0) {
+      context.workspaceCwd = workspaceCwd;
+    }
+  } catch {
+  }
+}
+__name(setDaemonTelemetryWorkspace, "setDaemonTelemetryWorkspace");
+function resolveDaemonTelemetryRoute(req) {
+  const legacyRoute = matchLegacySessionTelemetryRoute(req.method, req.path);
+  if (legacyRoute) return legacyRoute;
+  const path15 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "GET" && path15 === "/daemon/status") {
+    return { route: "GET /daemon/status" };
+  }
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
+    return { route: "GET /workspace/:id/sessions" };
+  }
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
+    return { route: "GET /workspace/:id/sessions" };
+  }
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path15)) {
+    return { route: "GET /workspace/:id/session-info" };
+  }
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path15)) {
+    return { route: "GET /workspace/:id/session-info" };
+  }
+  const workspaceTranscript = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
+  );
+  if (workspaceTranscript?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/transcript",
+      sessionId: decodePathSegment(workspaceTranscript[1])
+    };
+  }
+  const workspaceExport = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
+  );
+  if (workspaceExport?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/export",
+      sessionId: decodePathSegment(workspaceExport[1])
+    };
+  }
+  const workspaceArchivedExport = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
+  );
+  if (workspaceArchivedExport?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/archive/export",
+      sessionId: decodePathSegment(workspaceArchivedExport[1])
+    };
+  }
+  const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
+  if (pluralWorkspacePrefix.test(path15)) {
+    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
+    if (req.method === "GET") {
+      if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
+        return { route: `GET ${suffix}` };
+      }
+      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+        return { route: "GET /workspace/agents/:agentType" };
+      }
+      if (suffix === "/workspace/file") return { route: "GET /file" };
+      if (suffix === "/workspace/file/bytes") {
+        return { route: "GET /file/bytes" };
+      }
+      if (suffix === "/workspace/stat") return { route: "GET /stat" };
+      if (suffix === "/workspace/list") return { route: "GET /list" };
+      if (suffix === "/workspace/glob") return { route: "GET /glob" };
+      if (/^\/workspace\/mcp\/[^/]+\/tools$/.test(suffix)) {
+        return { route: "GET /workspace/mcp/:server/tools" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/resources$/.test(suffix)) {
+        return { route: "GET /workspace/mcp/:server/resources" };
+      }
+    }
+    if (req.method === "POST") {
+      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
+        return { route: `POST ${suffix}` };
+      }
+      if (/^\/workspace\/tools\/[^/]+\/enable$/.test(suffix)) {
+        return { route: "POST /workspace/tools/:name/enable" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/restart$/.test(suffix)) {
+        return { route: "POST /workspace/mcp/:server/restart" };
+      }
+      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+        return { route: "POST /workspace/agents/:agentType" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/(approve|enable|disable|authenticate|clear-auth)$/.test(
+        suffix
+      )) {
+        return {
+          route: `POST /workspace/mcp/:server/${suffix.split("/").at(-1)}`
+        };
+      }
+    }
+    if (req.method === "DELETE" && /^\/workspace\/mcp\/servers\/[^/]+$/.test(suffix)) {
+      return { route: "DELETE /workspace/mcp/servers/:name" };
+    }
+    if (req.method === "DELETE" && /^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+      return { route: "DELETE /workspace/agents/:agentType" };
+    }
+    if (suffix === "/workspace/session-groups" && req.method === "GET") {
+      return { route: "GET /workspace/session-groups" };
+    }
+    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "PATCH") {
+      return { route: "PATCH /workspace/session-groups/:groupId" };
+    }
+    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "DELETE") {
+      return { route: "DELETE /workspace/session-groups/:groupId" };
+    }
+  }
+  if (req.method === "POST" && path15 === "/workspace/init") {
+    return { route: "POST /workspace/init" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/setup-github") {
+    return { route: "POST /workspace/setup-github" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/reload") {
+    return { route: "POST /workspace/reload" };
+  }
+  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  if (mcpRestart?.[1] && req.method === "POST") {
+    return { route: "POST /workspace/mcp/:server/restart" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
+    return { route: "POST /workspace/mcp/servers" };
+  }
+  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  if (mcpDelete?.[1] && req.method === "DELETE") {
+    return { route: "DELETE /workspace/mcp/servers/:name" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
+    return { route: "POST /workspace/auth/device-flow" };
+  }
+  const deviceFlowDelete = path15.match(
+    /^\/workspace\/auth\/device-flow\/([^/]+)$/
+  );
+  if (deviceFlowDelete?.[1] && req.method === "DELETE") {
+    return { route: "DELETE /workspace/auth/device-flow/:id" };
+  }
+  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  if (toolEnable?.[1] && req.method === "POST") {
+    return { route: "POST /workspace/tools/:name/enable" };
+  }
+  if (path15 === "/workspace/settings") {
+    if (req.method === "GET") return { route: "GET /workspace/settings" };
+    if (req.method === "POST") return { route: "POST /workspace/settings" };
+  }
+  if (path15 === "/workspace/permissions") {
+    if (req.method === "GET") return { route: "GET /workspace/permissions" };
+    if (req.method === "POST") return { route: "POST /workspace/permissions" };
+  }
+  if (path15 === "/workspace/trust") {
+    if (req.method === "GET") return { route: "GET /workspace/trust" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/trust/request") {
+    return { route: "POST /workspace/trust/request" };
+  }
+  if (path15 === "/workspace/voice") {
+    if (req.method === "GET") return { route: "GET /workspace/voice" };
+    if (req.method === "POST") return { route: "POST /workspace/voice" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
+    return { route: "POST /workspace/voice/transcribe" };
+  }
+  return void 0;
+}
+__name(resolveDaemonTelemetryRoute, "resolveDaemonTelemetryRoute");
+function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest) {
+  const workspaceHashByCwd = /* @__PURE__ */ new Map();
+  const resolveWorkspaceHash = /* @__PURE__ */ __name((workspaceCwd) => {
+    const existing = workspaceHashByCwd.get(workspaceCwd);
+    if (existing !== void 0) return existing;
+    const workspaceHash = hashDaemonWorkspace(workspaceCwd);
+    workspaceHashByCwd.set(workspaceCwd, workspaceHash);
+    return workspaceHash;
+  }, "resolveWorkspaceHash");
+  return (req, res, next) => {
+    const route = resolveDaemonTelemetryRoute(req);
+    if (!route) {
+      next();
+      return;
+    }
+    const sessionId = route.sessionId;
+    let workspaceHash;
+    if (route.attribution !== "handler_resolved") {
+      try {
+        workspaceHash = resolveWorkspaceHash(resolveWorkspaceCwd(req));
+      } catch {
+      }
+    }
+    const rawClientId = req.get(CLIENT_ID_HEADER);
+    const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
+    const deferredRuntime = getDeferredRuntimeRequestTiming(req);
+    const startMs = deferredRuntime?.startedAt.getTime() ?? Date.now();
+    const telemetryRes = res;
+    if (route.attribution === "handler_resolved") {
+      try {
+        telemetryRes[daemonTelemetryResponseContext] = {};
+      } catch {
+      }
+    }
+    void withDaemonRequestSpan(
+      {
+        method: req.method,
+        route: route.route,
+        ...workspaceHash !== void 0 ? { workspaceHash } : {},
+        ...sessionId ? { sessionId } : {},
+        ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
+        ...clientId ? { clientId } : {},
+        ...deferredRuntime?.waitMs !== void 0 ? {
+          startTime: deferredRuntime.startedAt,
+          deferredRuntimeWaitMs: deferredRuntime.waitMs,
+          deferredRuntimePath: deferredRuntime.path
+        } : {}
+      },
+      async (span) => await new Promise((resolve5, reject) => {
+        let done = false;
+        const finish = /* @__PURE__ */ __name(() => {
+          if (done) return;
+          done = true;
+          try {
+            const context = telemetryRes[daemonTelemetryResponseContext];
+            delete telemetryRes[daemonTelemetryResponseContext];
+            if (context?.workspaceCwd !== void 0) {
+              span?.setAttribute(
+                "qwen-code.workspace.hash",
+                resolveWorkspaceHash(context.workspaceCwd)
+              );
+            }
+          } catch {
+          }
+          recordDaemonHttpResponse(span, res.statusCode);
+          const durationMs = Date.now() - startMs;
+          const successfulSse = route.route === "GET /session/:id/events" && res.statusCode === 200 && res.headersSent;
+          if (!successfulSse) {
+            recordDaemonHttpRequest(
+              durationMs,
+              route.route,
+              res.statusCode,
+              deferredRuntime?.path
+            );
+          }
+          if (!successfulSse && route.route !== "GET /daemon/status" && route.route !== "POST /session/:id/heartbeat") {
+            recordRequest?.(durationMs, res.statusCode);
+          }
+          resolve5();
+        }, "finish");
+        res.once("finish", finish);
+        res.once("close", finish);
+        try {
+          next();
+        } catch (error2) {
+          recordDaemonError(span, error2);
+          reject(error2);
+        }
+      })
+    ).catch(next);
+  };
+}
+__name(daemonTelemetryMiddleware, "daemonTelemetryMiddleware");
+
+// packages/cli/src/serve/routes/session-runtime.ts
+function requireSessionRuntime(opts) {
+  const {
+    sessionId,
+    route,
+    res,
+    workspaceRegistry,
+    daemonLog,
+    details = {}
+  } = opts;
+  if (workspaceRegistry.list().length === 1) {
+    const runtime = workspaceRegistry.primary;
+    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
+    return runtime;
+  }
+  const resolution = workspaceRegistry.resolveLiveSessionOwner(sessionId);
+  if (resolution.kind === "found") {
+    const runtime = resolution.runtime;
+    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
+    if (!runtime.primary && !runtime.trusted) {
+      daemonLog?.warn("session routing failed", {
+        route,
+        resolutionKind: "untrusted_workspace",
+        sessionId,
+        workspaceId: runtime.workspaceId,
+        workspaceCwd: runtime.workspaceCwd,
+        ...details
+      });
+      sendUntrustedWorkspaceResponse(res, {
+        sessionId,
+        workspaceCwd: runtime.workspaceCwd,
+        workspaceId: runtime.workspaceId
+      });
+      return void 0;
+    }
+    return runtime;
+  }
+  if (resolution.kind === "not_found") {
+    daemonLog?.warn("session routing failed", {
+      route,
+      resolutionKind: "not_found",
+      sessionId,
+      ...details
+    });
+    res.status(404).json({
+      error: `No session with id "${sessionId}"`,
+      code: "session_not_found",
+      sessionId
+    });
+    return void 0;
+  }
+  const workspaceIds = resolution.runtimes.map(
+    (runtime) => runtime.workspaceId
+  );
+  daemonLog?.warn("session routing failed", {
+    route,
+    resolutionKind: "ambiguous",
+    sessionId,
+    workspaceIds,
+    ...details
+  });
+  res.status(500).json({
+    error: `Session owner is ambiguous for "${sessionId}"`,
+    code: "ambiguous_session_owner",
+    sessionId,
     route,
     workspaceIds
   });
@@ -17509,7 +18500,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 
 // packages/cli/src/serve/routes/session.ts
 init_esbuild_shims();
-import * as crypto2 from "node:crypto";
+import * as crypto3 from "node:crypto";
 import * as path11 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
@@ -17566,7 +18557,7 @@ function parseOrganizedCursor(cursor, expected) {
     const decoded = Buffer.from(cursor, "base64url").toString("utf8");
     const parsed = JSON.parse(decoded);
     const last = parsed.last;
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.isPinned !== "boolean" || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.group !== expected.group || parsed.archiveState !== expected.archiveState) {
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.isPinned !== "boolean" || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.group !== expected.group || parsed.archiveState !== expected.archiveState || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId) {
       throw new Error("invalid organized cursor");
     }
     return last;
@@ -17575,9 +18566,9 @@ function parseOrganizedCursor(cursor, expected) {
   }
 }
 __name(parseOrganizedCursor, "parseOrganizedCursor");
-function encodeOrganizedCursor(last, group, archiveState) {
+function encodeOrganizedCursor(last, group, archiveState, sourceType, sourceId) {
   return Buffer.from(
-    JSON.stringify({ group, archiveState, last }),
+    JSON.stringify({ group, archiveState, sourceType, sourceId, last }),
     "utf8"
   ).toString("base64url");
 }
@@ -17601,29 +18592,39 @@ function encodeLiveSessionCursor(last) {
   return Buffer.from(JSON.stringify(last), "utf8").toString("base64url");
 }
 __name(encodeLiveSessionCursor, "encodeLiveSessionCursor");
-function parseParentSessionCursor(cursor, expected) {
+function matchesSessionMetadataSource(session, filter) {
+  const sourceTypeMatches = filter.sourceType === void 0 || session.sourceType === filter.sourceType || // Legacy sessions without source metadata belong to the default catalog.
+  filter.sourceType === "default" && session.sourceType === void 0;
+  return sourceTypeMatches && // sourceId remains exact; only the default source type has legacy fallback.
+  (filter.sourceId === void 0 || session.sourceId === filter.sourceId);
+}
+__name(matchesSessionMetadataSource, "matchesSessionMetadataSource");
+function parseMetadataSessionCursor(cursor, expected) {
   if (cursor === "") return void 0;
   try {
     const parsed = JSON.parse(
       Buffer.from(cursor, "base64url").toString("utf8")
     );
     const last = parsed.last;
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.parentSessionId !== expected.parentSessionId || parsed.archiveState !== expected.archiveState) {
-      throw new Error("invalid parent cursor");
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.parentSessionId !== expected.parentSessionId || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId || parsed.archiveState !== expected.archiveState) {
+      throw new Error("invalid metadata cursor");
     }
     return { activityTime: last.activityTime, sessionId: last.sessionId };
   } catch {
-    throw new InvalidCursorError(cursor, "parent");
+    throw new InvalidCursorError(
+      cursor,
+      expected.sourceType === void 0 ? "parent" : "metadata"
+    );
   }
 }
-__name(parseParentSessionCursor, "parseParentSessionCursor");
-function encodeParentSessionCursor(last, parentSessionId, archiveState) {
+__name(parseMetadataSessionCursor, "parseMetadataSessionCursor");
+function encodeMetadataSessionCursor(last, filter, archiveState) {
   return Buffer.from(
-    JSON.stringify({ parentSessionId, archiveState, last }),
+    JSON.stringify({ ...filter, archiveState, last }),
     "utf8"
   ).toString("base64url");
 }
-__name(encodeParentSessionCursor, "encodeParentSessionCursor");
+__name(encodeMetadataSessionCursor, "encodeMetadataSessionCursor");
 function toSummary2(item) {
   return {
     sessionId: item.sessionId,
@@ -17632,6 +18633,8 @@ function toSummary2(item) {
     updatedAt: new Date(item.mtime).toISOString(),
     displayName: item.customTitle || item.prompt,
     ...item.parentSessionId ? { parentSessionId: item.parentSessionId } : {},
+    ...item.sourceType ? { sourceType: item.sourceType } : {},
+    ...item.sourceId !== void 0 ? { sourceId: item.sourceId } : {},
     clientCount: 0,
     hasActivePrompt: false,
     isArchived: item.isArchived === true
@@ -17647,6 +18650,8 @@ function mergeLiveSessionSummary(existing, live) {
     // Immutable lineage; the persisted transcript is authoritative, and a live
     // entry only carries it when spawned this run.
     parentSessionId: existing.parentSessionId ?? live.parentSessionId,
+    sourceType: existing.sourceType ?? live.sourceType,
+    sourceId: existing.sourceType !== void 0 ? existing.sourceId : live.sourceId,
     updatedAt: live.updatedAt ?? existing.updatedAt,
     clientCount: live.clientCount,
     hasActivePrompt: live.hasActivePrompt,
@@ -17746,7 +18751,12 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
       "group"
     );
   }
-  const cursorKey = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, { group, archiveState }) : void 0;
+  const cursorKey = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, {
+    group,
+    archiveState,
+    sourceType: options.sourceType,
+    sourceId: options.sourceId
+  }) : void 0;
   const isFirstPage = cursorKey === void 0;
   let liveMergeFailed = false;
   const bySessionId = /* @__PURE__ */ new Map();
@@ -17798,6 +18808,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
     }
   }
   const filtered = [...bySessionId.values()].filter((session) => {
+    if (!matchesSessionMetadataSource(session, options)) return false;
     if (group === "all") return true;
     if (group === "pinned") return session.isPinned === true;
     if (group === "ungrouped")
@@ -17821,7 +18832,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   const nextCursor = page.length < afterCursor.length ? encodeOrganizedCursor(
     getOrganizedCursorKey(activityTimeById, page[page.length - 1]),
     group,
-    archiveState
+    archiveState,
+    options.sourceType,
+    options.sourceId
   ) : void 0;
   return {
     sessions: page,
@@ -17831,7 +18844,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   };
 }
 __name(listOrganizedWorkspaceSessionsForResponse, "listOrganizedWorkspaceSessionsForResponse");
-async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, options, pageSize, parentSessionId, readOptions) {
+async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd, options, pageSize, filter, readOptions) {
   const archiveState = options.archiveState ?? "active";
   const sessionService = new SessionService(workspaceCwd);
   const bySessionId = /* @__PURE__ */ new Map();
@@ -17865,18 +18878,20 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     } catch (error2) {
       liveMergeFailed = true;
       writeStderrLine(
-        `qwen serve: session-by-parent live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
+        `qwen serve: session metadata filter live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
       );
     }
   }
-  const matches = [...bySessionId.values()].filter((session) => session.parentSessionId === parentSessionId).sort(
+  const matches = [...bySessionId.values()].filter(
+    (session) => (filter.parentSessionId === void 0 || session.parentSessionId === filter.parentSessionId) && matchesSessionMetadataSource(session, filter)
+  ).sort(
     (a, b) => compareLiveSessionCursorKeys(
       getLiveSessionCursorKey(a),
       getLiveSessionCursorKey(b)
     )
   );
-  const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseParentSessionCursor(options.cursor, {
-    parentSessionId,
+  const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseMetadataSessionCursor(options.cursor, {
+    ...filter,
     archiveState
   }) : void 0;
   const afterCursor = cursorKey === void 0 ? matches : matches.filter(
@@ -17886,9 +18901,9 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     ) < 0
   );
   const page = afterCursor.slice(0, pageSize);
-  const nextCursor = page.length < afterCursor.length ? encodeParentSessionCursor(
+  const nextCursor = page.length < afterCursor.length ? encodeMetadataSessionCursor(
     getLiveSessionCursorKey(page[page.length - 1]),
-    parentSessionId,
+    filter,
     archiveState
   ) : void 0;
   return {
@@ -17898,7 +18913,7 @@ async function listWorkspaceSessionsByParentForResponse(bridge, workspaceCwd, op
     ...persisted.truncated ? { truncated: true } : {}
   };
 }
-__name(listWorkspaceSessionsByParentForResponse, "listWorkspaceSessionsByParentForResponse");
+__name(listWorkspaceSessionsByMetadataForResponse, "listWorkspaceSessionsByMetadataForResponse");
 async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, readOptions = {}) {
   const rawSize = options?.size;
   const requestedSize = typeof rawSize === "number" && Number.isSafeInteger(rawSize) ? rawSize : DEFAULT_SESSION_PAGE_SIZE;
@@ -17912,13 +18927,17 @@ async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, r
       readOptions
     );
   }
-  if (options?.parentSessionId !== void 0) {
-    return listWorkspaceSessionsByParentForResponse(
+  if (options?.parentSessionId !== void 0 || options?.sourceType !== void 0) {
+    return listWorkspaceSessionsByMetadataForResponse(
       bridge,
       workspaceCwd,
       options,
       pageSize,
-      options.parentSessionId,
+      {
+        ...options.parentSessionId !== void 0 ? { parentSessionId: options.parentSessionId } : {},
+        ...options.sourceType !== void 0 ? { sourceType: options.sourceType } : {},
+        ...options.sourceId !== void 0 ? { sourceId: options.sourceId } : {}
+      },
       readOptions
     );
   }
@@ -17992,6 +19011,19 @@ function listLiveWorkspaceSessionsForResponse(bridge, workspaceCwd, options) {
   };
 }
 __name(listLiveWorkspaceSessionsForResponse, "listLiveWorkspaceSessionsForResponse");
+async function getWorkspaceSessionInfoForResponse(bridge, workspaceCwd, options = {}) {
+  const counts = await new SessionService(workspaceCwd).getSessionInfoCounts();
+  return {
+    active: counts.active,
+    archived: counts.archived,
+    total: counts.total,
+    ...options.includeLive === false ? {} : { live: bridge.listWorkspaceSessions(workspaceCwd).length },
+    expensive: true,
+    cost: "disk_scan",
+    ...counts.truncated ? { truncated: true } : {}
+  };
+}
+__name(getWorkspaceSessionInfoForResponse, "getWorkspaceSessionInfoForResponse");
 function parseSessionPageSizeQuery(raw) {
   if (typeof raw !== "string") return void 0;
   const trimmed = raw.trim();
@@ -18036,9 +19068,10 @@ function sessionExportFormatValues() {
 __name(sessionExportFormatValues, "sessionExportFormatValues");
 async function exportSessionTranscript(params) {
   const { workspaceCwd, sessionId, format } = params;
-  const sessionData = await new SessionService(workspaceCwd).loadSession(
-    sessionId
-  );
+  const service = new SessionService(workspaceCwd);
+  const sessionData = params.archiveState === "archived" ? await service.loadArchivedSession(sessionId, {
+    maxBytes: SESSION_TRANSCRIPT_MAX_INDEX_BYTES
+  }) : await service.loadSession(sessionId);
   if (!sessionData) {
     throw new SessionNotFoundError(sessionId);
   }
@@ -18063,10 +19096,63 @@ async function exportSessionTranscript(params) {
 __name(exportSessionTranscript, "exportSessionTranscript");
 
 // packages/cli/src/serve/routes/session.ts
-var WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
+var GENERATION_HEARTBEAT_MS = 15e3;
+var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
+  "POST /session/:id/branch",
+  "POST /session/:id/fork",
+  "POST /session/:id/cd"
+];
+function isPrimaryOnlyLiveSessionRoute(route) {
+  return PRIMARY_ONLY_LIVE_SESSION_ROUTES.includes(
+    route
+  );
+}
+__name(isPrimaryOnlyLiveSessionRoute, "isPrimaryOnlyLiveSessionRoute");
+function formatGenerationSse(event, data) {
+  return `event: ${event}
+data: ${JSON.stringify({ v: 1, ...data })}
+
+`;
+}
+__name(formatGenerationSse, "formatGenerationSse");
+function writeGenerationSseChunk(res, chunk) {
+  if (res.destroyed) {
+    return Promise.reject(new Error("Generation SSE connection destroyed"));
+  }
+  const writable = res.write(chunk);
+  const flush = res.flush;
+  flush?.call(res);
+  if (writable) {
+    return res.destroyed ? Promise.reject(new Error("Generation SSE connection destroyed")) : Promise.resolve();
+  }
+  return new Promise((resolve5, reject) => {
+    const cleanup = /* @__PURE__ */ __name(() => {
+      res.off("drain", onDrain);
+      res.off("close", onClose);
+      res.off("error", onError);
+    }, "cleanup");
+    const onDrain = /* @__PURE__ */ __name(() => {
+      cleanup();
+      resolve5();
+    }, "onDrain");
+    const onClose = /* @__PURE__ */ __name(() => {
+      cleanup();
+      reject(new Error("Generation SSE connection closed"));
+    }, "onClose");
+    const onError = /* @__PURE__ */ __name((error2) => {
+      cleanup();
+      reject(error2);
+    }, "onError");
+    res.once("drain", onDrain);
+    res.once("close", onClose);
+    res.once("error", onError);
+    if (res.destroyed) onClose();
+  });
+}
+__name(writeGenerationSseChunk, "writeGenerationSseChunk");
 function isReadOnlyWorkspaceInspection(runtime) {
   return !runtime.primary && !runtime.trusted;
 }
@@ -18153,6 +19239,32 @@ function parseTranscriptCursorQuery(rawCursor, res) {
   return rawCursor;
 }
 __name(parseTranscriptCursorQuery, "parseTranscriptCursorQuery");
+function parseTranscriptRecordBoundaryQuery(rawBoundary, res) {
+  if (rawBoundary === void 0) return void 0;
+  if (typeof rawBoundary !== "string" || rawBoundary.trim() === "" || rawBoundary.length > 200) {
+    res.status(400).json({
+      error: "`beforeRecordId` must be a non-empty record id",
+      code: "invalid_transcript_cursor"
+    });
+    return null;
+  }
+  return rawBoundary;
+}
+__name(parseTranscriptRecordBoundaryQuery, "parseTranscriptRecordBoundaryQuery");
+function parseHistoryPageSize(body, res) {
+  const value = body["historyPageSize"];
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 1 || value > SESSION_TRANSCRIPT_MAX_LIMIT) {
+    res.status(400).json({
+      error: `\`historyPageSize\` must be between 1 and ${SESSION_TRANSCRIPT_MAX_LIMIT}`,
+      code: "invalid_transcript_limit",
+      maxLimit: SESSION_TRANSCRIPT_MAX_LIMIT
+    });
+    return null;
+  }
+  return value;
+}
+__name(parseHistoryPageSize, "parseHistoryPageSize");
 function workspaceTranscriptCursorExceedsLimit(cursor, maxBytes = WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES) {
   return Buffer.byteLength(cursor) > maxBytes;
 }
@@ -18212,14 +19324,14 @@ function registerSessionRoutes(app, deps) {
     sessionShellCommandEnabled
   } = deps;
   const LANGUAGE_CODES = deps.languageCodes;
-  const transcriptCursorMasterKey = crypto2.randomBytes(32);
+  const transcriptCursorMasterKey = crypto3.randomBytes(32);
   const transcriptCursorCodecs = /* @__PURE__ */ new Map();
   const getTranscriptCursorCodec = /* @__PURE__ */ __name((runtime) => {
     const canonicalCwd = canonicalizeWorkspace(runtime.workspaceCwd);
     const cacheKey = `${runtime.workspaceId}\0${canonicalCwd}`;
     const cached = transcriptCursorCodecs.get(cacheKey);
     if (cached) return cached;
-    const derivedKey = crypto2.hkdfSync(
+    const derivedKey = crypto3.hkdfSync(
       "sha256",
       transcriptCursorMasterKey,
       Buffer.alloc(0),
@@ -18274,6 +19386,7 @@ function registerSessionRoutes(app, deps) {
       return void 0;
     }
     if (workspaceRegistry.list().length === 1) {
+      setDaemonTelemetryWorkspace(res, workspaceRegistry.primary.workspaceCwd);
       return {
         runtime: workspaceRegistry.primary,
         workspaceCwd: "cwd" in body ? key : workspaceRegistry.primary.workspaceCwd
@@ -18289,6 +19402,7 @@ function registerSessionRoutes(app, deps) {
       sendWorkspaceMismatch2(res, key);
       return void 0;
     }
+    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
     if (!runtime.primary && !runtime.trusted) {
       logSessionRoutingFailure("POST /session", "untrusted_workspace", {
         workspaceId: runtime.workspaceId,
@@ -18397,11 +19511,16 @@ function registerSessionRoutes(app, deps) {
       const result = await archiveCoordinator.runSharedMany(
         [sessionId],
         async () => {
-          await assertSessionLoadable(target.workspaceCwd, sessionId);
+          if (target.archiveState === "archived") {
+            await assertSessionArchived(target.workspaceCwd, sessionId);
+          } else {
+            await assertSessionLoadable(target.workspaceCwd, sessionId);
+          }
           return exportSessionTranscript({
             workspaceCwd: target.workspaceCwd,
             sessionId,
             format,
+            archiveState: target.archiveState,
             config: { getChannel: /* @__PURE__ */ __name(() => "daemon", "getChannel") }
           });
         }
@@ -18536,6 +19655,7 @@ function registerSessionRoutes(app, deps) {
       sendWorkspaceMismatch2(res, key);
       return void 0;
     }
+    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
     if (!runtime.primary && !runtime.trusted) {
       logSessionRoutingFailure(route, "untrusted_workspace", {
         workspaceId: runtime.workspaceId,
@@ -18573,7 +19693,7 @@ function registerSessionRoutes(app, deps) {
   }), "resolveLiveSessionRuntime");
   const sendNonPrimarySessionRouteUnsupported = /* @__PURE__ */ __name((res, route, sessionId, runtime) => {
     res.status(400).json({
-      error: `Route "${route}" is primary-only for non-primary workspace sessions in Phase 2a.`,
+      error: `Route "${route}" is only available for primary workspace sessions.`,
       code: "non_primary_session_route_not_supported",
       sessionId,
       workspaceId: runtime.workspaceId,
@@ -18621,6 +19741,7 @@ function registerSessionRoutes(app, deps) {
     }, "throwMissingActiveTranscript");
     if (workspaceRegistry.list().length === 1) {
       const runtime = workspaceRegistry.primary;
+      setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
       if (await activeInRuntime(runtime)) {
         return runtime;
       }
@@ -18632,6 +19753,7 @@ function registerSessionRoutes(app, deps) {
       return void 0;
     }
     if (liveOwner.kind === "found") {
+      setDaemonTelemetryWorkspace(res, liveOwner.runtime.workspaceCwd);
       if (!assertTrustedSessionOwner(res, route, sessionId, liveOwner.runtime)) {
         return void 0;
       }
@@ -18666,6 +19788,7 @@ function registerSessionRoutes(app, deps) {
     }
     if (activeRuntimes.length === 1) {
       const runtime = activeRuntimes[0];
+      setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
       if (!assertTrustedSessionOwner(res, route, sessionId, runtime)) {
         return void 0;
       }
@@ -18722,23 +19845,37 @@ function registerSessionRoutes(app, deps) {
     }
     return key;
   }, "resolveWorkspaceParam");
-  const withMutableSession = /* @__PURE__ */ __name((route, handler) => async (req, res) => {
-    const sessionId = requireSessionId(req, res);
-    if (sessionId === null) return;
-    const runtime = resolveLiveSessionRuntime(sessionId, res, route);
-    if (!runtime) return;
-    if (!runtime.primary) {
-      sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
-      return;
-    }
-    try {
-      await archiveCoordinator.runSharedMany([sessionId], async () => {
-        await handler(req, res, sessionId);
-      });
-    } catch (err) {
-      sendBridgeError2(res, err, { route, sessionId });
+  const withPrimaryOnlyMutableSession = /* @__PURE__ */ __name((route, handler) => {
+    if (!isPrimaryOnlyLiveSessionRoute(route)) {
+      throw new Error(`Unregistered primary-only session route: ${route}`);
     }
-  }, "withMutableSession");
+    return async (req, res) => {
+      const sessionId = requireSessionId(req, res);
+      if (sessionId === null) return;
+      const runtime = resolveLiveSessionRuntime(sessionId, res, route);
+      if (!runtime) return;
+      if (!runtime.primary) {
+        logSessionRoutingFailure(
+          route,
+          "non_primary_session_route_not_supported",
+          {
+            sessionId,
+            workspaceId: runtime.workspaceId,
+            workspaceCwd: runtime.workspaceCwd
+          }
+        );
+        sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
+        return;
+      }
+      try {
+        await archiveCoordinator.runSharedMany([sessionId], async () => {
+          await handler(req, res, sessionId);
+        });
+      } catch (err) {
+        sendBridgeError2(res, err, { route, sessionId });
+      }
+    };
+  }, "withPrimaryOnlyMutableSession");
   app.post("/session", mutate(), async (req, res) => {
     const body = safeBody(req);
     const resolvedRuntime = resolveRuntimeForSessionCreation(body, res);
@@ -18759,6 +19896,14 @@ function registerSessionRoutes(app, deps) {
     }
     const approvalMode = parseOptionalApprovalMode(body, res);
     if (approvalMode === null) return;
+    const source = parseSessionSource(body["sourceType"], body["sourceId"]);
+    if ("error" in source) {
+      res.status(400).json({
+        error: source.error,
+        code: "invalid_session_source"
+      });
+      return;
+    }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
@@ -18767,7 +19912,9 @@ function registerSessionRoutes(app, deps) {
         modelServiceId,
         ...clientId !== void 0 ? { clientId } : {},
         ...sessionScope !== void 0 ? { sessionScope } : {},
-        ...approvalMode !== void 0 ? { approvalMode } : {}
+        ...approvalMode !== void 0 ? { approvalMode } : {},
+        ...source.sourceType !== void 0 ? { sourceType: source.sourceType } : {},
+        ...source.sourceId !== void 0 ? { sourceId: source.sourceId } : {}
       });
       if (daemonLog) {
         daemonLog.info(
@@ -18786,8 +19933,17 @@ function registerSessionRoutes(app, deps) {
           );
         }
         if (!session.attached) {
-          runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
-          });
+          try {
+            const killed = await runtime.bridge.killSession(session.sessionId, {
+              requireZeroAttaches: true
+            });
+            if (killed) {
+              await new SessionService(runtime.workspaceCwd).removeSession(
+                session.sessionId
+              );
+            }
+          } catch {
+          }
         } else {
           runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
           });
@@ -18830,6 +19986,11 @@ function registerSessionRoutes(app, deps) {
       releaseRestoreOwner();
       return;
     }
+    const historyPageSize = action === "load" ? parseHistoryPageSize(body ?? {}, res) : void 0;
+    if (historyPageSize === null) {
+      releaseRestoreOwner();
+      return;
+    }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) {
       releaseRestoreOwner();
@@ -18840,22 +20001,23 @@ function registerSessionRoutes(app, deps) {
         [sessionId],
         async () => {
           await assertSessionLoadable(workspaceCwd, sessionId);
-          const parentSessionId = await new SessionService(
+          const metadata = await new SessionService(
             workspaceCwd
-          ).readParentSessionId(sessionId);
+          ).readCreationMetadata(sessionId);
           return action === "load" ? await runtime.bridge.loadSession({
             sessionId,
             workspaceCwd,
             historyReplay: "response",
+            ...historyPageSize !== void 0 ? { historyPageSize } : {},
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
-            ...parentSessionId !== void 0 ? { parentSessionId } : {}
+            ...metadata
           }) : await runtime.bridge.resumeSession({
             sessionId,
             workspaceCwd,
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
-            ...parentSessionId !== void 0 ? { parentSessionId } : {}
+            ...metadata
           });
         }
       );
@@ -18890,7 +20052,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/branch",
     mutate(),
-    withMutableSession(
+    withPrimaryOnlyMutableSession(
       "POST /session/:id/branch",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -18925,7 +20087,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/fork",
     mutate(),
-    withMutableSession(
+    withPrimaryOnlyMutableSession(
       "POST /session/:id/fork",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -18951,25 +20113,28 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/cd",
     mutate(),
-    withMutableSession("POST /session/:id/cd", async (req, res, sessionId) => {
-      const body = safeBody(req);
-      const targetPath = body["path"];
-      if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
-        res.status(400).json({
-          error: "`path` is required and must be an absolute path",
-          code: "invalid_path"
-        });
-        return;
+    withPrimaryOnlyMutableSession(
+      "POST /session/:id/cd",
+      async (req, res, sessionId) => {
+        const body = safeBody(req);
+        const targetPath = body["path"];
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
+          res.status(400).json({
+            error: "`path` is required and must be an absolute path",
+            code: "invalid_path"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const result = await bridge.changeSessionCwd(
+          sessionId,
+          { path: targetPath },
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json(result);
       }
-      const clientId = parseClientIdHeader(req, res);
-      if (clientId === null) return;
-      const result = await bridge.changeSessionCwd(
-        sessionId,
-        { path: targetPath },
-        clientId !== void 0 ? { clientId } : void 0
-      );
-      res.status(200).json(result);
-    })
+    )
   );
   app.get("/session/:id/status", (req, res) => {
     const sessionId = requireSessionId(req, res);
@@ -19005,6 +20170,20 @@ function registerSessionRoutes(app, deps) {
       workspaceQualified: true
     });
   });
+  app.get(
+    "/workspaces/:workspace/session/:id/archive/export",
+    async (req, res) => {
+      const route = "GET /workspaces/:workspace/session/:id/archive/export";
+      const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
+      if (!runtime) return;
+      await handleSessionExport(req, res, {
+        route,
+        workspaceCwd: runtime.workspaceCwd,
+        workspaceQualified: true,
+        archiveState: "archived"
+      });
+    }
+  );
   app.get("/session/:id/transcript", async (req, res) => {
     const route = "GET /session/:id/transcript";
     const sessionId = requireSessionId(req, res);
@@ -19013,6 +20192,18 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
+    const beforeRecordId = parseTranscriptRecordBoundaryQuery(
+      req.query["beforeRecordId"],
+      res
+    );
+    if (beforeRecordId === null) return;
+    if (cursor !== void 0 && beforeRecordId !== void 0) {
+      res.status(400).json({
+        error: "`cursor` and `beforeRecordId` are mutually exclusive",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
     try {
       const result = await archiveCoordinator.runSharedMany(
         [sessionId],
@@ -19027,7 +20218,8 @@ function registerSessionRoutes(app, deps) {
           return runtime.bridge.getSessionTranscriptPage({
             sessionId,
             ...limit !== void 0 ? { limit } : {},
-            ...cursor !== void 0 ? { cursor } : {}
+            ...cursor !== void 0 ? { cursor } : {},
+            ...beforeRecordId !== void 0 ? { beforeRecordId } : {}
           });
         }
       );
@@ -19062,6 +20254,18 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
+    const beforeRecordId = parseTranscriptRecordBoundaryQuery(
+      req.query["beforeRecordId"],
+      res
+    );
+    if (beforeRecordId === null) return;
+    if (cursor !== void 0 && beforeRecordId !== void 0) {
+      res.status(400).json({
+        error: "`cursor` and `beforeRecordId` are mutually exclusive",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
     if (cursor !== void 0 && workspaceTranscriptCursorExceedsLimit(cursor)) {
       res.status(400).json({
         error: "`cursor` exceeds the maximum size",
@@ -19086,7 +20290,8 @@ function registerSessionRoutes(app, deps) {
             page = await reader.readPage(sessionId, {
               ...limit !== void 0 ? { limit } : {},
               ...cursor !== void 0 ? { cursor } : {},
-              maxBytes: WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES
+              ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
+              maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
             });
           } catch (error2) {
             if (error2.code !== "ENOENT") {
@@ -19348,7 +20553,7 @@ function registerSessionRoutes(app, deps) {
       async (req, res, sessionId, runtime) => {
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const promptId = crypto2.randomUUID();
+        const promptId = crypto3.randomUUID();
         res.status(200).json(
           await runtime.bridge.continueSession(sessionId, {
             ...clientId !== void 0 ? { clientId } : {},
@@ -19395,7 +20600,7 @@ function registerSessionRoutes(app, deps) {
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const promptId = crypto2.randomUUID();
+        const promptId = crypto3.randomUUID();
         const forwardedBody = { ...body };
         delete forwardedBody["deadlineMs"];
         const lastEventId = ownerBridge.getSessionLastEventId(sessionId);
@@ -19496,6 +20701,88 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.post(
+    "/session/:id/generate",
+    mutate(),
+    withOwnerReadSession(
+      "POST /session/:id/generate",
+      async (req, res, sessionId, runtime) => {
+        const body = safeBody(req);
+        const prompt = body["prompt"];
+        if (typeof prompt !== "string" || prompt.trim().length === 0 || Buffer.byteLength(prompt, "utf8") > GENERATION_MAX_PROMPT_BYTES) {
+          res.status(400).json({
+            error: `\`prompt\` must be a non-empty string no larger than ${GENERATION_MAX_PROMPT_BYTES} UTF-8 bytes`,
+            code: "invalid_prompt"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        if (!runtime.bridge.generateSessionContent) {
+          res.status(501).json({
+            error: "Stateless generation is not supported by this bridge",
+            code: "generation_not_supported"
+          });
+          return;
+        }
+        const abort = new AbortController();
+        let completed = false;
+        const onClose = /* @__PURE__ */ __name(() => {
+          if (!completed) abort.abort();
+        }, "onClose");
+        res.once("close", onClose);
+        const stream = runtime.bridge.generateSessionContent(
+          sessionId,
+          prompt,
+          abort.signal,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.setHeader("X-Accel-Buffering", "no");
+        res.flushHeaders();
+        let writeChain = Promise.resolve();
+        const write = /* @__PURE__ */ __name((chunk) => {
+          writeChain = writeChain.then(
+            () => writeGenerationSseChunk(res, chunk)
+          );
+          return writeChain;
+        }, "write");
+        await write(": connected\n\n");
+        const heartbeat = setInterval(() => {
+          void write(": heartbeat\n\n").catch(() => abort.abort());
+        }, GENERATION_HEARTBEAT_MS);
+        heartbeat.unref();
+        try {
+          for await (const event of stream) {
+            await write(formatGenerationSse(event.type, event));
+          }
+        } catch (err) {
+          if (!abort.signal.aborted && !res.destroyed) {
+            daemonLog?.error(
+              "session generation failed",
+              err instanceof Error ? err : new Error(String(err)),
+              { sessionId, clientId }
+            );
+            await write(
+              formatGenerationSse("error", {
+                type: "error",
+                code: "generation_failed",
+                message: "Generation failed"
+              })
+            ).catch(() => void 0);
+          }
+        } finally {
+          completed = true;
+          clearInterval(heartbeat);
+          res.off("close", onClose);
+          if (!res.destroyed) res.end();
+        }
+      }
+    )
+  );
   app.post(
     "/session/:id/heartbeat",
     mutate(),
@@ -20064,16 +21351,28 @@ function registerSessionRoutes(app, deps) {
         }
         parentSessionId = rawParentSessionId;
       }
+      const parsedSource = parseSessionSource(
+        req.query["sourceType"],
+        req.query["sourceId"]
+      );
+      if ("error" in parsedSource) {
+        res.status(400).json({
+          error: parsedSource.error,
+          code: "invalid_session_source"
+        });
+        return;
+      }
       const options = {
         ...cursor !== void 0 ? { cursor } : {},
         ...size !== void 0 ? { size } : {},
         ...archiveState !== void 0 ? { archiveState } : {},
         ...view !== void 0 ? { view } : {},
         ...group !== void 0 ? { group } : {},
-        ...parentSessionId !== void 0 ? { parentSessionId } : {}
+        ...parentSessionId !== void 0 ? { parentSessionId } : {},
+        ...parsedSource
       };
-      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(key));
-      if (!usePersisted && (view !== void 0 || archiveState === "archived")) {
+      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(key));
+      if (!usePersisted && (view !== void 0 || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0)) {
         throw new Error(
           "session list live path received persisted-only options"
         );
@@ -20123,6 +21422,36 @@ function registerSessionRoutes(app, deps) {
     "/workspaces/:workspace/sessions",
     listWorkspaceSessionsHandler("workspace")
   );
+  const workspaceSessionInfoHandler = /* @__PURE__ */ __name((paramName) => async (req, res) => {
+    const route = paramName === "workspace" ? "GET /workspaces/:workspace/session-info" : "GET /workspace/:id/session-info";
+    const runtime = resolveRuntimeForCatalogRoute(req, res, paramName, route);
+    if (runtime === null) return;
+    const key = runtime.workspaceCwd;
+    try {
+      const info = await runWorkspaceInspectionWithLogPolicy(
+        runtime,
+        () => getWorkspaceSessionInfoForResponse(runtime.bridge, key, {
+          includeLive: !isReadOnlyWorkspaceInspection(runtime)
+        })
+      );
+      res.status(200).json(info);
+    } catch (err) {
+      writeStderrLine(
+        `qwen serve: failed to read session-info for workspace ${safeLogValue(
+          key
+        )}: ${safeLogValue(err instanceof Error ? err.message : String(err))}`
+      );
+      res.status(500).json({
+        error: "Failed to read session info",
+        code: "session_info_failed"
+      });
+    }
+  }, "workspaceSessionInfoHandler");
+  app.get("/workspace/:id/session-info", workspaceSessionInfoHandler("id"));
+  app.get(
+    "/workspaces/:workspace/session-info",
+    workspaceSessionInfoHandler("workspace")
+  );
   app.post(
     "/session/:id/model",
     mutate(),
@@ -20672,6 +22001,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     }
     const recurring = body["recurring"] !== false;
     const enabled = body["enabled"] !== false;
+    const taskId = generateCronTaskId();
     let boundSessionId;
     if (bridge) {
       try {
@@ -20687,7 +22017,9 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       try {
         const session = await bridge.spawnOrAttach({
           workspaceCwd,
-          sessionScope: "thread"
+          sessionScope: "thread",
+          sourceType: "scheduled_task",
+          sourceId: taskId
         });
         boundSessionId = session.sessionId;
         try {
@@ -20709,7 +22041,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     }
     const now = Date.now();
     const task = {
-      id: generateCronTaskId(),
+      id: taskId,
       cron,
       prompt,
       recurring,
@@ -21192,7 +22524,9 @@ async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawn
       binding.add(task.id);
       const rawSpawn = bridge.spawnOrAttach({
         workspaceCwd: boundWorkspace,
-        sessionScope: "thread"
+        sessionScope: "thread",
+        sourceType: "scheduled_task",
+        sourceId: task.id
       });
       let timedOut = false;
       rawSpawn.then(({ sessionId: sessionId2 }) => {
@@ -21301,12 +22635,16 @@ function startScheduledTaskKeepalive(opts) {
           continue;
         }
         log.debug("keepalive: recordHeartbeat failed for", sessionId, err);
+        reviving.add(sessionId);
+        const metadata = await new SessionService(
+          boundWorkspace
+        ).readCreationMetadata(sessionId);
         const load = bridge.loadSession({
           sessionId,
           workspaceCwd: boundWorkspace,
-          historyReplay: "response"
+          historyReplay: "response",
+          ...metadata
         });
-        reviving.add(sessionId);
         void load.catch(() => {
         }).finally(() => {
           reviving.delete(sessionId);
@@ -21417,10 +22755,14 @@ async function rehydrateScheduledTaskSessions(deps) {
   const loaded = [];
   const failed = [];
   const loadOne = /* @__PURE__ */ __name(async (sessionId) => {
+    const metadata = await new SessionService(
+      boundWorkspace
+    ).readCreationMetadata(sessionId);
     const load = bridge.loadSession({
       sessionId,
       workspaceCwd: boundWorkspace,
-      historyReplay: "response"
+      historyReplay: "response",
+      ...metadata
     });
     void load.catch(() => {
     });
@@ -21767,6 +23109,7 @@ function createServeFeatures(deps) {
     boundWorkspace,
     persistSettingAvailable,
     sessionArtifactsPersistenceAvailable,
+    sessionGenerationAvailable,
     reloadAvailable,
     channelReloadAvailable,
     channelControlAvailable,
@@ -21800,6 +23143,7 @@ function createServeFeatures(deps) {
       persistSettingAvailable,
       sessionShellCommandEnabled,
       sessionArtifactsPersistenceAvailable,
+      sessionGenerationAvailable: sessionGenerationAvailable(),
       rateLimit: opts.rateLimit === true,
       reloadAvailable,
       channelReloadAvailable: channelReloadAvailable(),
@@ -22089,6 +23433,7 @@ init_esbuild_shims();
 var TUI_ONLY_SETTINGS = /* @__PURE__ */ new Set([
   "general.vimMode",
   "general.terminalBell",
+  "general.notificationMode",
   "general.preferredEditor",
   "general.outputLanguage",
   "ide.enabled",
@@ -22099,9 +23444,14 @@ var TUI_ONLY_SETTINGS = /* @__PURE__ */ new Set([
   "ui.accessibility.enableLoadingPhrases",
   "ui.enableWelcomeBack"
 ]);
-var WEB_SHELL_SETTINGS = /* @__PURE__ */ new Set(["ui.compactMode", "voiceModel"]);
+var WEB_SHELL_SETTINGS = /* @__PURE__ */ new Set([
+  "ui.compactMode",
+  "voiceModel",
+  "mcpServers"
+]);
 var VALID_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace", "user"]);
 var QUALIFIED_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace"]);
+var mcpServerMutationQueues = /* @__PURE__ */ new Map();
 var SECURITY_SENSITIVE_SETTINGS = /* @__PURE__ */ new Set(["tools.approvalMode"]);
 function getAllowedKeys() {
   const keys = new Set(
@@ -22133,11 +23483,12 @@ function buildSettingsResponse(boundWorkspace, keys) {
       loaded.workspace.settings,
       key
     );
+    const publicValue = /* @__PURE__ */ __name((value) => key === "mcpServers" ? redactMcpServersSetting(value) : value, "publicValue");
     const values = {
-      effective: effective !== void 0 ? effective : def.default
+      effective: publicValue(effective !== void 0 ? effective : def.default)
     };
-    if (userVal !== void 0) values.user = userVal;
-    if (wsVal !== void 0) values.workspace = wsVal;
+    if (userVal !== void 0) values.user = publicValue(userVal);
+    if (wsVal !== void 0) values.workspace = publicValue(wsVal);
     settings.push({
       key,
       type: def.type,
@@ -22165,9 +23516,62 @@ function buildSettingsResponse(boundWorkspace, keys) {
 }
 __name(buildSettingsResponse, "buildSettingsResponse");
 var SCOPE_MAP = {
-  workspace: "Workspace" /* Workspace */,
-  user: "User" /* User */
+  user: "User" /* User */,
+  workspace: "Workspace" /* Workspace */
 };
+function prepareSettingWrite(workspace, scope, key, value, mcpServerMutation) {
+  if (key !== "mcpServers") {
+    return { persistedValue: value, publicValue: value };
+  }
+  const existing = loadSettings(workspace).forScope(scope).settings.mcpServers ?? {};
+  let nextValue = value;
+  if (mcpServerMutation) {
+    const servers = { ...existing };
+    if (mcpServerMutation.operation === "set") {
+      servers[mcpServerMutation.name] = value;
+    } else {
+      delete servers[mcpServerMutation.name];
+    }
+    nextValue = servers;
+  }
+  const persistedValue = restoreRedactedMcpServersSetting(nextValue, existing);
+  return {
+    persistedValue,
+    publicValue: redactMcpServersSetting(persistedValue)
+  };
+}
+__name(prepareSettingWrite, "prepareSettingWrite");
+function parseMcpServerMutation(key, value) {
+  if (value === void 0) return void 0;
+  if (key !== "mcpServers" || typeof value !== "object" || value === null) {
+    throw new Error("mcpServerMutation is only valid for mcpServers");
+  }
+  const operation = value["operation"];
+  const name = value["name"];
+  if (operation !== "set" && operation !== "remove" || typeof name !== "string" || !name.trim()) {
+    throw new Error("mcpServerMutation requires a valid operation and name");
+  }
+  return { operation, name };
+}
+__name(parseMcpServerMutation, "parseMcpServerMutation");
+async function withMcpServerMutationLock(workspace, scope, operation) {
+  const key = `${workspace}\0${scope}`;
+  const previous = mcpServerMutationQueues.get(key) ?? Promise.resolve();
+  const run = previous.catch(() => void 0).then(operation);
+  const tail = run.then(
+    () => void 0,
+    () => void 0
+  );
+  mcpServerMutationQueues.set(key, tail);
+  try {
+    return await run;
+  } finally {
+    if (mcpServerMutationQueues.get(key) === tail) {
+      mcpServerMutationQueues.delete(key);
+    }
+  }
+}
+__name(withMcpServerMutationLock, "withMcpServerMutationLock");
 function registerWorkspaceSettingsRoutes(app, deps) {
   const {
     boundWorkspace,
@@ -22200,6 +23604,19 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       const scope = body["scope"];
       const key = body["key"];
       const value = body["value"];
+      let mcpServerMutation;
+      try {
+        mcpServerMutation = parseMcpServerMutation(
+          typeof key === "string" ? key : "",
+          body["mcpServerMutation"]
+        );
+      } catch (error2) {
+        res.status(400).json({
+          error: error2 instanceof Error ? error2.message : String(error2),
+          code: "invalid_mcp_server_mutation"
+        });
+        return;
+      }
       if (typeof scope !== "string" || !VALID_WRITE_SCOPES.has(scope)) {
         res.status(400).json({
           error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
@@ -22246,16 +23663,41 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       }
       const clientId = parseAndValidateClientId(req, res);
       if (clientId === null) return;
+      const settingScope = SCOPE_MAP[scope];
+      if (!settingScope) {
+        res.status(400).json({
+          error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
+          code: "invalid_scope"
+        });
+        return;
+      }
+      let publicValue = value;
       try {
-        const settingScope = SCOPE_MAP[scope];
-        if (!settingScope) {
-          res.status(400).json({
-            error: `scope must be one of: ${[...VALID_WRITE_SCOPES].join(", ")}`,
-            code: "invalid_scope"
-          });
-          return;
+        const persist = /* @__PURE__ */ __name(async () => {
+          const prepared = prepareSettingWrite(
+            boundWorkspace,
+            settingScope,
+            key,
+            value,
+            mcpServerMutation
+          );
+          publicValue = prepared.publicValue;
+          await persistSetting(
+            boundWorkspace,
+            settingScope,
+            key,
+            prepared.persistedValue
+          );
+        }, "persist");
+        if (mcpServerMutation) {
+          await withMcpServerMutationLock(
+            boundWorkspace,
+            settingScope,
+            persist
+          );
+        } else {
+          await persist();
         }
-        await persistSetting(boundWorkspace, settingScope, key, value);
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspace/settings persist error (key=${key}, scope=${scope}, workspace=${boundWorkspace}): ${err instanceof Error ? err.message : String(err)}`
@@ -22267,7 +23709,7 @@ function registerWorkspaceSettingsRoutes(app, deps) {
         return;
       }
       try {
-        broadcastSettingsChanged(key, value, scope, clientId);
+        broadcastSettingsChanged(key, publicValue, scope, clientId);
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspace/settings broadcast error (key=${key}, scope=${scope}): ${err instanceof Error ? err.message : String(err)}`
@@ -22276,7 +23718,7 @@ function registerWorkspaceSettingsRoutes(app, deps) {
       res.status(200).json({
         key,
         scope,
-        value,
+        value: publicValue,
         requiresRestart: def.requiresRestart
       });
     }
@@ -22319,6 +23761,19 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
       const scope = body["scope"];
       const key = body["key"];
       const value = body["value"];
+      let mcpServerMutation;
+      try {
+        mcpServerMutation = parseMcpServerMutation(
+          typeof key === "string" ? key : "",
+          body["mcpServerMutation"]
+        );
+      } catch (error2) {
+        res.status(400).json({
+          error: error2 instanceof Error ? error2.message : String(error2),
+          code: "invalid_mcp_server_mutation"
+        });
+        return;
+      }
       if (typeof scope !== "string" || !QUALIFIED_WRITE_SCOPES.has(scope)) {
         res.status(400).json({
           error: `scope must be one of: ${[...QUALIFIED_WRITE_SCOPES].join(", ")}`,
@@ -22377,13 +23832,33 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
         });
         return;
       }
+      let publicValue = value;
       try {
-        await deps.persistSetting(
-          runtime.workspaceCwd,
-          settingScope,
-          key,
-          value
-        );
+        const persist = /* @__PURE__ */ __name(async () => {
+          const prepared = prepareSettingWrite(
+            runtime.workspaceCwd,
+            settingScope,
+            key,
+            value,
+            mcpServerMutation
+          );
+          publicValue = prepared.publicValue;
+          await deps.persistSetting(
+            runtime.workspaceCwd,
+            settingScope,
+            key,
+            prepared.persistedValue
+          );
+        }, "persist");
+        if (mcpServerMutation) {
+          await withMcpServerMutationLock(
+            runtime.workspaceCwd,
+            settingScope,
+            persist
+          );
+        } else {
+          await persist();
+        }
       } catch (err) {
         writeStderrLine(
           `qwen serve: POST /workspaces/:workspace/settings persist error (key=${key}, scope=${scope}, workspace=${runtime.workspaceCwd}): ${err instanceof Error ? err.message : String(err)}`
@@ -22397,13 +23872,13 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
       deps.invalidateServeFeaturesCache();
       runtime.bridge.publishWorkspaceEvent({
         type: "settings_changed",
-        data: { key, value, scope },
+        data: { key, value: publicValue, scope },
         ...clientId ? { originatorClientId: clientId } : {}
       });
       res.status(200).json({
         key,
         scope,
-        value,
+        value: publicValue,
         requiresRestart: def.requiresRestart
       });
     }
@@ -22479,7 +23954,7 @@ function sendBridgeError(res, err, ctx, daemonLog) {
   if (err instanceof WorkspaceSkillNotToggleableError) {
     res.status(409).json({
       error: err.message,
-      code: "skill_not_toggleable",
+      code: err.reason === "inactive_extension" ? "skill_inactive_extension" : "skill_not_toggleable",
       skillName: err.skillName,
       reason: err.reason,
       ...err.lockedScope ? { lockedScope: err.lockedScope } : {}
@@ -22621,6 +24096,14 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     });
     return;
   }
+  if (err instanceof SessionNotArchivedError) {
+    res.status(409).json({
+      error: err.message,
+      code: "session_not_archived",
+      sessionId: err.sessionId
+    });
+    return;
+  }
   if (err instanceof SessionConflictError) {
     res.status(409).json({
       error: err.message,
@@ -22674,7 +24157,7 @@ function sendBridgeError(res, err, ctx, daemonLog) {
   }
   if (err instanceof WorkspaceMismatchError) {
     writeStderrLine(
-      `qwen serve: workspace_mismatch (POST /session): daemon bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
+      `qwen serve: workspace_mismatch (POST /session): runtime bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
     );
     res.status(400).json({
       error: err.message,
@@ -22862,9 +24345,20 @@ function sendBridgeError(res, err, ctx, daemonLog) {
         const d = data;
         res.status(413).json({
           error: errorMessage2(err),
-          code: "transcript_too_large",
+          code: "transcript_too_large",
+          ...d.sessionId ? { sessionId: d.sessionId } : {},
+          ...typeof d.snapshotSize === "number" ? { snapshotSize: d.snapshotSize } : {},
+          ...typeof d.maxBytes === "number" ? { maxBytes: d.maxBytes } : {}
+        });
+        return;
+      }
+      if (kind === "transcript_page_too_large") {
+        const d = data;
+        res.status(413).json({
+          error: errorMessage2(err),
+          code: "transcript_page_too_large",
           ...d.sessionId ? { sessionId: d.sessionId } : {},
-          ...typeof d.snapshotSize === "number" ? { snapshotSize: d.snapshotSize } : {},
+          ...typeof d.pageBytes === "number" ? { pageBytes: d.pageBytes } : {},
           ...typeof d.maxBytes === "number" ? { maxBytes: d.maxBytes } : {}
         });
         return;
@@ -23635,320 +25129,26 @@ function parseIdeWorkspacePathEnv(value) {
   }
   return value.split(path14.delimiter).filter((workspace) => workspace.length > 0 && path14.isAbsolute(workspace));
 }
-__name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
-function dropNestedWorkspacesPreservingPrimary(workspaces) {
-  const primary = workspaces[0];
-  if (primary === void 0) return [];
-  const withoutPrimaryOverlaps = workspaces.filter(
-    (workspace, i) => i === 0 || workspace !== primary && !isWithinRoot2(workspace, primary) && !isWithinRoot2(primary, workspace)
-  );
-  const filtered = withoutPrimaryOverlaps.filter(
-    (workspace, i) => i === 0 || !withoutPrimaryOverlaps.some(
-      (other, j) => i !== j && j !== 0 && workspace !== other && isWithinRoot2(workspace, other)
-    )
-  );
-  if (filtered.length < workspaces.length) {
-    writeStderrLine(
-      "qwen serve: dropping nested IDE workspace roots (parent folders already cover children)"
-    );
-  }
-  return filtered;
-}
-__name(dropNestedWorkspacesPreservingPrimary, "dropNestedWorkspacesPreservingPrimary");
-
-// packages/cli/src/serve/server/telemetry.ts
-init_esbuild_shims();
-function decodePathSegment(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-}
-__name(decodePathSegment, "decodePathSegment");
-function resolveDaemonTelemetryRoute(req) {
-  const path15 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "POST" && path15 === "/session") {
-    return { route: "POST /session" };
-  }
-  if (req.method === "POST" && path15 === "/sessions/delete") {
-    return { route: "POST /sessions/delete" };
-  }
-  if (req.method === "GET" && path15 === "/daemon/status") {
-    return { route: "GET /daemon/status" };
-  }
-  const rewindSnapshots = path15.match(/^\/session\/([^/]+)\/rewind\/snapshots$/);
-  if (rewindSnapshots?.[1] && req.method === "GET") {
-    return {
-      route: "GET /session/:id/rewind/snapshots",
-      sessionId: rewindSnapshots[1]
-    };
-  }
-  const sessionAction = path15.match(
-    /^\/session\/([^/]+)\/(load|resume|prompt|cancel|recap|btw|mid-turn-message|model|shell|detach|rewind|approval-mode|language|a2ui-action)$/
-  );
-  const sessionActionId = sessionAction?.[1];
-  const sessionActionName = sessionAction?.[2];
-  if (sessionActionId && sessionActionName && req.method === "POST") {
-    return {
-      route: `POST /session/:id/${sessionActionName}`,
-      sessionId: sessionActionId
-    };
-  }
-  const sessionMetadata = path15.match(/^\/session\/([^/]+)\/metadata$/);
-  if (sessionMetadata?.[1] && req.method === "PATCH") {
-    return {
-      route: "PATCH /session/:id/metadata",
-      sessionId: sessionMetadata[1]
-    };
-  }
-  const sessionArtifacts = path15.match(/^\/session\/([^/]+)\/artifacts$/);
-  if (sessionArtifacts?.[1]) {
-    if (req.method === "GET") {
-      return {
-        route: "GET /session/:id/artifacts",
-        sessionId: sessionArtifacts[1]
-      };
-    }
-    if (req.method === "POST") {
-      return {
-        route: "POST /session/:id/artifacts",
-        sessionId: sessionArtifacts[1]
-      };
-    }
-  }
-  const sessionArtifact = path15.match(
-    /^\/session\/([^/]+)\/artifacts\/([^/]+)$/
-  );
-  if (sessionArtifact?.[1] && req.method === "DELETE") {
-    return {
-      route: "DELETE /session/:id/artifacts/:artifactId",
-      sessionId: sessionArtifact[1]
-    };
-  }
-  const sessionPermission = path15.match(
-    /^\/session\/([^/]+)\/permission\/([^/]+)$/
-  );
-  if (sessionPermission?.[1] && sessionPermission?.[2] && req.method === "POST") {
-    const rawRequestId = sessionPermission[2];
-    return {
-      route: "POST /session/:id/permission/:requestId",
-      sessionId: sessionPermission[1],
-      ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
-    };
-  }
-  const globalPermission = path15.match(/^\/permission\/([^/]+)$/);
-  if (globalPermission?.[1] && req.method === "POST") {
-    const rawRequestId = globalPermission[1];
-    return {
-      route: "POST /permission/:requestId",
-      ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
-    };
-  }
-  const deleteSession = path15.match(/^\/session\/([^/]+)$/);
-  const deleteSessionId = deleteSession?.[1];
-  if (deleteSessionId && req.method === "DELETE") {
-    return { route: "DELETE /session/:id", sessionId: deleteSessionId };
-  }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
-    return { route: "GET /workspace/:id/sessions" };
-  }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
-    return { route: "GET /workspace/:id/sessions" };
-  }
-  const workspaceTranscript = path15.match(
-    /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
-  );
-  if (workspaceTranscript?.[1] && req.method === "GET") {
-    return {
-      route: "GET /workspaces/:workspace/session/:id/transcript",
-      sessionId: workspaceTranscript[1]
-    };
-  }
-  const workspaceExport = path15.match(
-    /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
-  );
-  if (workspaceExport?.[1] && req.method === "GET") {
-    return {
-      route: "GET /workspaces/:workspace/session/:id/export",
-      sessionId: workspaceExport[1]
-    };
-  }
-  const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
-  if (pluralWorkspacePrefix.test(path15)) {
-    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
-    if (req.method === "GET") {
-      if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
-        return { route: `GET ${suffix}` };
-      }
-      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-        return { route: "GET /workspace/agents/:agentType" };
-      }
-      if (suffix === "/workspace/file") return { route: "GET /file" };
-      if (suffix === "/workspace/file/bytes") {
-        return { route: "GET /file/bytes" };
-      }
-      if (suffix === "/workspace/stat") return { route: "GET /stat" };
-      if (suffix === "/workspace/list") return { route: "GET /list" };
-      if (suffix === "/workspace/glob") return { route: "GET /glob" };
-      if (/^\/workspace\/mcp\/[^/]+\/tools$/.test(suffix)) {
-        return { route: "GET /workspace/mcp/:server/tools" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/resources$/.test(suffix)) {
-        return { route: "GET /workspace/mcp/:server/resources" };
-      }
-    }
-    if (req.method === "POST") {
-      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
-        return { route: `POST ${suffix}` };
-      }
-      if (/^\/workspace\/tools\/[^/]+\/enable$/.test(suffix)) {
-        return { route: "POST /workspace/tools/:name/enable" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/restart$/.test(suffix)) {
-        return { route: "POST /workspace/mcp/:server/restart" };
-      }
-      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-        return { route: "POST /workspace/agents/:agentType" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/(enable|disable|authenticate|clear-auth)$/.test(
-        suffix
-      )) {
-        return {
-          route: `POST /workspace/mcp/:server/${suffix.split("/").at(-1)}`
-        };
-      }
-    }
-    if (req.method === "DELETE" && /^\/workspace\/mcp\/servers\/[^/]+$/.test(suffix)) {
-      return { route: "DELETE /workspace/mcp/servers/:name" };
-    }
-    if (req.method === "DELETE" && /^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-      return { route: "DELETE /workspace/agents/:agentType" };
-    }
-    if (suffix === "/workspace/session-groups" && req.method === "GET") {
-      return { route: "GET /workspace/session-groups" };
-    }
-    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "PATCH") {
-      return { route: "PATCH /workspace/session-groups/:groupId" };
-    }
-    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "DELETE") {
-      return { route: "DELETE /workspace/session-groups/:groupId" };
-    }
-  }
-  if (req.method === "POST" && path15 === "/workspace/init") {
-    return { route: "POST /workspace/init" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/setup-github") {
-    return { route: "POST /workspace/setup-github" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/reload") {
-    return { route: "POST /workspace/reload" };
-  }
-  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
-  if (mcpRestart?.[1] && req.method === "POST") {
-    return { route: "POST /workspace/mcp/:server/restart" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
-    return { route: "POST /workspace/mcp/servers" };
-  }
-  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
-  if (mcpDelete?.[1] && req.method === "DELETE") {
-    return { route: "DELETE /workspace/mcp/servers/:name" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
-    return { route: "POST /workspace/auth/device-flow" };
-  }
-  const deviceFlowDelete = path15.match(
-    /^\/workspace\/auth\/device-flow\/([^/]+)$/
-  );
-  if (deviceFlowDelete?.[1] && req.method === "DELETE") {
-    return { route: "DELETE /workspace/auth/device-flow/:id" };
-  }
-  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
-  if (toolEnable?.[1] && req.method === "POST") {
-    return { route: "POST /workspace/tools/:name/enable" };
-  }
-  if (path15 === "/workspace/settings") {
-    if (req.method === "GET") return { route: "GET /workspace/settings" };
-    if (req.method === "POST") return { route: "POST /workspace/settings" };
-  }
-  if (path15 === "/workspace/permissions") {
-    if (req.method === "GET") return { route: "GET /workspace/permissions" };
-    if (req.method === "POST") return { route: "POST /workspace/permissions" };
-  }
-  if (path15 === "/workspace/trust") {
-    if (req.method === "GET") return { route: "GET /workspace/trust" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/trust/request") {
-    return { route: "POST /workspace/trust/request" };
-  }
-  if (path15 === "/workspace/voice") {
-    if (req.method === "GET") return { route: "GET /workspace/voice" };
-    if (req.method === "POST") return { route: "POST /workspace/voice" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
-    return { route: "POST /workspace/voice/transcribe" };
-  }
-  return void 0;
-}
-__name(resolveDaemonTelemetryRoute, "resolveDaemonTelemetryRoute");
-function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest, resolveSessionWorkspaceCwd) {
-  const workspaceHashByCwd = /* @__PURE__ */ new Map();
-  const resolveWorkspaceHash = /* @__PURE__ */ __name((workspaceCwd) => {
-    const existing = workspaceHashByCwd.get(workspaceCwd);
-    if (existing !== void 0) return existing;
-    const workspaceHash = hashDaemonWorkspace(workspaceCwd);
-    workspaceHashByCwd.set(workspaceCwd, workspaceHash);
-    return workspaceHash;
-  }, "resolveWorkspaceHash");
-  return (req, res, next) => {
-    const route = resolveDaemonTelemetryRoute(req);
-    if (!route) {
-      next();
-      return;
-    }
-    const resolveOwnerWorkspace = route.route === "GET /session/:id/rewind/snapshots" || route.route === "POST /session/:id/rewind" || route.route === "POST /session/:id/shell";
-    const sessionId = route.sessionId ? decodePathSegment(route.sessionId) : void 0;
-    const workspaceCwd = (resolveOwnerWorkspace && sessionId ? resolveSessionWorkspaceCwd?.(sessionId) : void 0) ?? resolveWorkspaceCwd(req);
-    const workspaceHash = resolveWorkspaceHash(workspaceCwd);
-    const rawClientId = req.get(CLIENT_ID_HEADER);
-    const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
-    const startMs = Date.now();
-    void withDaemonRequestSpan(
-      {
-        method: req.method,
-        route: route.route,
-        workspaceHash,
-        ...sessionId ? { sessionId } : {},
-        ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
-        ...clientId ? { clientId } : {}
-      },
-      async (span) => await new Promise((resolve5, reject) => {
-        let done = false;
-        const finish = /* @__PURE__ */ __name(() => {
-          if (done) return;
-          done = true;
-          recordDaemonHttpResponse(span, res.statusCode);
-          const durationMs = Date.now() - startMs;
-          recordDaemonHttpRequest(durationMs, route.route, res.statusCode);
-          if (route.route !== "GET /daemon/status") {
-            recordRequest?.(durationMs, res.statusCode);
-          }
-          resolve5();
-        }, "finish");
-        res.once("finish", finish);
-        res.once("close", finish);
-        try {
-          next();
-        } catch (error2) {
-          recordDaemonError(span, error2);
-          reject(error2);
-        }
-      })
-    ).catch(next);
-  };
+__name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
+function dropNestedWorkspacesPreservingPrimary(workspaces) {
+  const primary = workspaces[0];
+  if (primary === void 0) return [];
+  const withoutPrimaryOverlaps = workspaces.filter(
+    (workspace, i) => i === 0 || workspace !== primary && !isWithinRoot2(workspace, primary) && !isWithinRoot2(primary, workspace)
+  );
+  const filtered = withoutPrimaryOverlaps.filter(
+    (workspace, i) => i === 0 || !withoutPrimaryOverlaps.some(
+      (other, j) => i !== j && j !== 0 && workspace !== other && isWithinRoot2(workspace, other)
+    )
+  );
+  if (filtered.length < workspaces.length) {
+    writeStderrLine(
+      "qwen serve: dropping nested IDE workspace roots (parent folders already cover children)"
+    );
+  }
+  return filtered;
 }
-__name(daemonTelemetryMiddleware, "daemonTelemetryMiddleware");
+__name(dropNestedWorkspacesPreservingPrimary, "dropNestedWorkspacesPreservingPrimary");
 
 // packages/cli/src/serve/server/access-log.ts
 init_esbuild_shims();
@@ -24473,9 +25673,10 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 
 // packages/cli/src/serve/routes/workspace-management.ts
 init_esbuild_shims();
-import { stat } from "node:fs/promises";
+import { readdir, stat } from "node:fs/promises";
 import { realpathSync } from "node:fs";
-import { isAbsolute as isAbsolute7, resolve as resolve4 } from "node:path";
+import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join7, resolve as resolve4, sep as sep3 } from "node:path";
+var MAX_PATH_SUGGESTIONS = 50;
 function registerWorkspaceManagementRoutes(app, deps) {
   const {
     workspaceRegistry,
@@ -24505,6 +25706,72 @@ function registerWorkspaceManagementRoutes(app, deps) {
       code: "daemon_shutting_down"
     });
   }, "sendSealed");
+  app.get(
+    "/workspace-path-suggestions",
+    async (req, res) => {
+      const prefixRaw = req.query["prefix"];
+      if (typeof prefixRaw !== "string" || prefixRaw.trim().length === 0) {
+        res.status(400).json({
+          error: "`prefix` must be a non-empty string",
+          code: "invalid_prefix"
+        });
+        return;
+      }
+      const prefix = prefixRaw;
+      if (prefix.length > MAX_WORKSPACE_PATH_LENGTH) {
+        res.status(400).json({
+          error: `\`prefix\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`,
+          code: "invalid_prefix"
+        });
+        return;
+      }
+      if (!isAbsolute7(prefix)) {
+        res.status(400).json({
+          error: "`prefix` must be an absolute path",
+          code: "invalid_prefix"
+        });
+        return;
+      }
+      const endsWithSep = prefix.endsWith("/") || process.platform === "win32" && prefix.endsWith("\\");
+      const dir = endsWithSep ? join7(prefix, ".") : dirname4(prefix);
+      const filter = endsWithSep ? "" : basename4(prefix);
+      const filterLower = filter.toLowerCase();
+      const suggestions = [];
+      let truncated = false;
+      try {
+        const entries = await readdir(dir, { withFileTypes: true });
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+          if (entry.name.startsWith(".") && !filter.startsWith(".")) continue;
+          if (filter && !entry.name.toLowerCase().startsWith(filterLower)) {
+            continue;
+          }
+          let isDir = entry.isDirectory();
+          if (!isDir && entry.isSymbolicLink()) {
+            try {
+              isDir = (await stat(join7(dir, entry.name))).isDirectory();
+            } catch {
+              continue;
+            }
+          }
+          if (!isDir) continue;
+          if (suggestions.length >= MAX_PATH_SUGGESTIONS) {
+            truncated = true;
+            break;
+          }
+          suggestions.push({ name: entry.name, path: join7(dir, entry.name) });
+        }
+      } catch {
+      }
+      res.status(200).json({
+        kind: "workspace-path-suggestions",
+        dir,
+        sep: sep3,
+        suggestions,
+        truncated
+      });
+    }
+  );
   app.post(
     "/workspaces",
     mutate({ strict: true }),
@@ -25330,6 +26597,30 @@ function registerWorkspaceMcpControlRoutes(app, deps) {
     parseAndValidateClientId
   } = deps;
   const buildWorkspaceCtx = createBuildWorkspaceCtx(boundWorkspace);
+  app.post(
+    "/workspace/mcp/initialize",
+    mutate({ strict: true }),
+    async (_req, res) => {
+      try {
+        const result = await bridge.initializeWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        sendBridgeError2(res, err, { route: "POST /workspace/mcp/initialize" });
+      }
+    }
+  );
+  app.post(
+    "/workspace/mcp/reload",
+    mutate({ strict: true }),
+    async (_req, res) => {
+      try {
+        const result = await bridge.reloadWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        sendBridgeError2(res, err, { route: "POST /workspace/mcp/reload" });
+      }
+    }
+  );
   app.post(
     "/workspace/mcp/:server/restart",
     mutate({ strict: true }),
@@ -25384,6 +26675,7 @@ function registerWorkspaceMcpControlRoutes(app, deps) {
     }
   );
   for (const [routeAction, bridgeAction] of [
+    ["approve", "approve"],
     ["enable", "enable"],
     ["disable", "disable"],
     ["authenticate", "authenticate"],
@@ -25498,6 +26790,44 @@ function resolveTrustedMcpRuntime(registry, req, res) {
 }
 __name(resolveTrustedMcpRuntime, "resolveTrustedMcpRuntime");
 function registerWorkspaceQualifiedMcpControlRoutes(app, deps) {
+  app.post(
+    "/workspaces/:workspace/mcp/initialize",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveTrustedMcpRuntime(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime) return;
+      const route = "POST /workspaces/:workspace/mcp/initialize";
+      try {
+        const result = await runtime.bridge.initializeWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        deps.sendBridgeError(res, err, { route });
+      }
+    }
+  );
+  app.post(
+    "/workspaces/:workspace/mcp/reload",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveTrustedMcpRuntime(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime) return;
+      const route = "POST /workspaces/:workspace/mcp/reload";
+      try {
+        const result = await runtime.bridge.reloadWorkspaceMcp();
+        res.status(202).json(result);
+      } catch (err) {
+        deps.sendBridgeError(res, err, { route });
+      }
+    }
+  );
   app.post(
     "/workspaces/:workspace/mcp/:server/restart",
     deps.mutate({ strict: true }),
@@ -25561,6 +26891,7 @@ function registerWorkspaceQualifiedMcpControlRoutes(app, deps) {
     }
   );
   for (const [routeAction, bridgeAction] of [
+    ["approve", "approve"],
     ["enable", "enable"],
     ["disable", "disable"],
     ["authenticate", "authenticate"],
@@ -25752,11 +27083,84 @@ function parseSelection(body, res) {
   }
 }
 __name(parseSelection, "parseSelection");
+function sanitizeControlDiagnostic(value, maxLength) {
+  return sanitizeLogText(
+    redactLogCredentials(normalizeWorkerDiagnostic(value)),
+    maxLength
+  );
+}
+__name(sanitizeControlDiagnostic, "sanitizeControlDiagnostic");
+function startupFailureResponseFields(error2) {
+  if (!error2 || typeof error2 !== "object") return {};
+  let rawFailures;
+  let rawTruncated;
+  try {
+    rawFailures = Reflect.get(error2, "startupFailures");
+    rawTruncated = Reflect.get(error2, "startupFailuresTruncated");
+  } catch {
+    return {};
+  }
+  if (!Array.isArray(rawFailures)) return {};
+  let limitedFailures;
+  let rawFailureCount;
+  try {
+    limitedFailures = rawFailures.slice(0, MAX_CHANNEL_STARTUP_FAILURES);
+    rawFailureCount = rawFailures.length;
+  } catch {
+    return {};
+  }
+  const startupFailures = limitedFailures.flatMap((raw) => {
+    try {
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+      const failure = raw;
+      if (typeof failure["workspaceCwd"] !== "string" || failure["workspaceCwd"].length === 0 || typeof failure["channel"] !== "string" || failure["channel"].length === 0 || failure["phase"] !== "connect" || typeof failure["message"] !== "string" || failure["message"].length === 0 || failure["code"] !== void 0 && (typeof failure["code"] !== "string" || failure["code"].length === 0)) {
+        return [];
+      }
+      const workspaceCwd = sanitizeControlDiagnostic(
+        failure["workspaceCwd"],
+        MAX_WORKSPACE_PATH_LENGTH
+      );
+      const channel = sanitizeControlDiagnostic(
+        failure["channel"],
+        MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH
+      );
+      const message = sanitizeControlDiagnostic(
+        failure["message"],
+        MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH
+      );
+      const code = typeof failure["code"] === "string" ? sanitizeControlDiagnostic(
+        failure["code"],
+        MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH
+      ) : void 0;
+      if (!workspaceCwd || !channel || !message) return [];
+      return [
+        {
+          workspaceCwd,
+          channel,
+          phase: "connect",
+          ...code ? { code } : {},
+          message
+        }
+      ];
+    } catch {
+      return [];
+    }
+  });
+  if (startupFailures.length === 0) return {};
+  const truncated = rawTruncated === true || rawFailureCount > MAX_CHANNEL_STARTUP_FAILURES;
+  return {
+    startupFailures,
+    ...truncated ? { startupFailuresTruncated: true } : {}
+  };
+}
+__name(startupFailureResponseFields, "startupFailureResponseFields");
 function sendChannelControlError(res, error2, getState) {
   const code = error2 && typeof error2 === "object" && "code" in error2 ? error2.code : void 0;
-  const message = redactLogCredentials(
-    error2 instanceof Error ? error2.message : String(error2)
-  );
+  const rawMessage = error2 instanceof Error ? error2.message : String(error2);
+  const message = code === "channel_worker_start_failed" ? sanitizeControlDiagnostic(
+    rawMessage,
+    MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH
+  ) : redactLogCredentials(rawMessage);
   if (code === "channel_workspace_mismatch" || code === "ambiguous_channel_workspace") {
     res.status(400).json({ error: message, code });
     return true;
@@ -25792,7 +27196,13 @@ function sendChannelControlError(res, error2, getState) {
     error: message,
     code,
     ...typeof controlError.rolledBack === "boolean" ? { rolledBack: controlError.rolledBack } : {},
-    ...typeof controlError.rollbackError === "string" && controlError.rollbackError ? { rollbackError: redactLogCredentials(controlError.rollbackError) } : {},
+    ...typeof controlError.rollbackError === "string" && controlError.rollbackError ? {
+      rollbackError: sanitizeControlDiagnostic(
+        controlError.rollbackError,
+        512
+      )
+    } : {},
+    ...code === "channel_worker_start_failed" ? startupFailureResponseFields(error2) : {},
     state: getState()
   });
   return true;
@@ -26053,9 +27463,9 @@ function parseSkillToggleRequest(req, res, safeBody2) {
     });
     return void 0;
   }
-  if (skillName.length > MAX_SKILL_NAME_LENGTH) {
+  if (skillName.length > MAX_WORKSPACE_SKILL_NAME_LENGTH) {
     res.status(400).json({
-      error: `Skill name exceeds ${MAX_SKILL_NAME_LENGTH}-character limit`,
+      error: `Skill name exceeds ${MAX_WORKSPACE_SKILL_NAME_LENGTH}-character limit`,
       code: "invalid_skill_name"
     });
     return void 0;
@@ -26071,11 +27481,138 @@ function parseSkillToggleRequest(req, res, safeBody2) {
   return { skillName, enabled };
 }
 __name(parseSkillToggleRequest, "parseSkillToggleRequest");
+function parseSkillScope(value, res) {
+  if (value === "workspace" || value === "global") return value;
+  res.status(400).json({
+    error: '`scope` must be "workspace" or "global"',
+    code: "invalid_skill_scope"
+  });
+  return void 0;
+}
+__name(parseSkillScope, "parseSkillScope");
+function parseSkillInstallRequest(req, res, safeBody2) {
+  const body = safeBody2(req);
+  const name = body["name"];
+  if (typeof name !== "string" || !name.trim()) {
+    res.status(400).json({
+      error: "`name` is required and must be a string",
+      code: "invalid_skill_name"
+    });
+    return void 0;
+  }
+  if (name.trim().length > MAX_WORKSPACE_SKILL_NAME_LENGTH) {
+    res.status(400).json({
+      error: `Skill name exceeds ${MAX_WORKSPACE_SKILL_NAME_LENGTH}-character limit`,
+      code: "invalid_skill_name"
+    });
+    return void 0;
+  }
+  const scope = parseSkillScope(body["scope"], res);
+  if (!scope) return void 0;
+  const rawSource = body["source"];
+  if (!rawSource || typeof rawSource !== "object" || Array.isArray(rawSource)) {
+    res.status(400).json({
+      error: "`source` is required",
+      code: "invalid_skill_source"
+    });
+    return void 0;
+  }
+  const source = rawSource;
+  if (source["type"] === "github" && typeof source["url"] === "string") {
+    return { name, scope, source: { type: "github", url: source["url"] } };
+  }
+  if (source["type"] === "zip" && typeof source["contentBase64"] === "string") {
+    return {
+      name,
+      scope,
+      source: { type: "zip", contentBase64: source["contentBase64"] }
+    };
+  }
+  if (source["type"] === "folder" && typeof source["path"] === "string") {
+    return {
+      name,
+      scope,
+      source: { type: "folder", path: source["path"] }
+    };
+  }
+  res.status(400).json({
+    error: "Invalid Skill install source",
+    code: "invalid_skill_source"
+  });
+  return void 0;
+}
+__name(parseSkillInstallRequest, "parseSkillInstallRequest");
+function parseDeleteScope(req, res) {
+  return parseSkillScope(req.query["scope"], res);
+}
+__name(parseDeleteScope, "parseDeleteScope");
+function sendSkillManagementError(res, error2) {
+  if (!(error2 instanceof WorkspaceSkillManagementError)) return false;
+  res.status(error2.statusCode).json({
+    error: error2.message,
+    code: error2.code
+  });
+  return true;
+}
+__name(sendSkillManagementError, "sendSkillManagementError");
 function registerWorkspaceSkillsRoutes(app, deps) {
   const buildWorkspaceCtx = createBuildWorkspaceCtx(
     deps.workspaceRuntime.workspaceCwd
   );
   const route = "POST /workspace/skills/:name/enable";
+  app.post(
+    "/workspace/skills/install",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      if (!requireTrustedWorkspaceRuntime(deps.workspaceRuntime, res)) return;
+      const input = parseSkillInstallRequest(req, res, deps.safeBody);
+      if (!input) return;
+      const clientId = deps.parseAndValidateClientId(req, res);
+      if (clientId === null) return;
+      const installRoute = "POST /workspace/skills/install";
+      try {
+        const result = await deps.workspaceRuntime.workspaceService.installWorkspaceSkill(
+          buildWorkspaceCtx(installRoute, clientId),
+          input
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        if (!sendSkillManagementError(res, err))
+          deps.sendBridgeError(res, err, { route: installRoute });
+      }
+    }
+  );
+  app.delete(
+    "/workspace/skills/:name",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      if (!requireTrustedWorkspaceRuntime(deps.workspaceRuntime, res)) return;
+      const rawSkillName = req.params["name"];
+      const scope = parseDeleteScope(req, res);
+      if (!rawSkillName || !scope) return;
+      let skillName;
+      try {
+        skillName = validateWorkspaceSkillName(rawSkillName);
+      } catch (error2) {
+        sendSkillManagementError(res, error2);
+        return;
+      }
+      const clientId = deps.parseAndValidateClientId(req, res);
+      if (clientId === null) return;
+      const deleteRoute = "DELETE /workspace/skills/:name";
+      try {
+        const result = await deps.workspaceRuntime.workspaceService.deleteWorkspaceSkill(
+          buildWorkspaceCtx(deleteRoute, clientId),
+          skillName,
+          scope
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        if (!sendSkillManagementError(res, err))
+          deps.sendBridgeError(res, err, { route: deleteRoute });
+      }
+    }
+  );
   app.post(
     "/workspace/skills/:name/enable",
     deps.mutate({ strict: true }),
@@ -26101,6 +27638,77 @@ function registerWorkspaceSkillsRoutes(app, deps) {
 __name(registerWorkspaceSkillsRoutes, "registerWorkspaceSkillsRoutes");
 function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
   const route = "POST /workspaces/:workspace/skills/:name/enable";
+  app.post(
+    "/workspaces/:workspace/skills/install",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      const input = parseSkillInstallRequest(req, res, deps.safeBody);
+      if (!input) return;
+      const clientId = parseAndValidateWorkspaceClientId(
+        req,
+        res,
+        runtime.bridge
+      );
+      if (clientId === null) return;
+      const installRoute = "POST /workspaces/:workspace/skills/install";
+      try {
+        const result = await runtime.workspaceService.installWorkspaceSkill(
+          createBuildWorkspaceCtx(runtime.workspaceCwd)(installRoute, clientId),
+          input
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        if (!sendSkillManagementError(res, err))
+          deps.sendBridgeError(res, err, { route: installRoute });
+      }
+    }
+  );
+  app.delete(
+    "/workspaces/:workspace/skills/:name",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      const rawSkillName = req.params["name"];
+      const scope = parseDeleteScope(req, res);
+      if (!rawSkillName || !scope) return;
+      let skillName;
+      try {
+        skillName = validateWorkspaceSkillName(rawSkillName);
+      } catch (error2) {
+        sendSkillManagementError(res, error2);
+        return;
+      }
+      const clientId = parseAndValidateWorkspaceClientId(
+        req,
+        res,
+        runtime.bridge
+      );
+      if (clientId === null) return;
+      const deleteRoute = "DELETE /workspaces/:workspace/skills/:name";
+      try {
+        const result = await runtime.workspaceService.deleteWorkspaceSkill(
+          createBuildWorkspaceCtx(runtime.workspaceCwd)(deleteRoute, clientId),
+          skillName,
+          scope
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        if (!sendSkillManagementError(res, err))
+          deps.sendBridgeError(res, err, { route: deleteRoute });
+      }
+    }
+  );
   app.post(
     "/workspaces/:workspace/skills/:name/enable",
     deps.mutate({ strict: true }),
@@ -26525,6 +28133,12 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     boundWorkspace,
     persistSettingAvailable: deps.persistSetting !== void 0,
     sessionArtifactsPersistenceAvailable: deps.sessionArtifactsPersistenceAvailable !== false,
+    sessionGenerationAvailable: /* @__PURE__ */ __name(() => {
+      const runtimes = workspaceRegistry.list();
+      return runtimes.length > 0 && runtimes.every(
+        (runtime) => runtime.bridge.generateSessionContent !== void 0
+      );
+    }, "sessionGenerationAvailable"),
     // Registry injection supplies the primary workspace service through the
     // runtime, so it has the same reload surface as legacy deps.workspace.
     reloadAvailable: deps.workspace !== void 0 || injectedWorkspaceRegistry !== void 0,
@@ -26609,6 +28223,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       primaryEffectiveEnv ? { env: primaryEffectiveEnv } : {}
     ),
     workspaceSkillsStatusProvider: createWorkspaceSkillsStatusProvider(),
+    ...primaryEffectiveEnv ? { skillInstallEnv: primaryEffectiveEnv } : {},
     ...primaryEffectiveEnv ? { voiceEnv: primaryEffectiveEnv } : {},
     isChannelLive: /* @__PURE__ */ __name(() => bridge.isChannelLive(), "isChannelLive"),
     persistDisabledTools: deps.persistDisabledTools ?? (async () => {
@@ -26653,6 +28268,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   );
   app.locals.workspaceRegistry = workspaceRegistry;
   const primaryRuntime = workspaceRegistry.primary;
+  const daemonEnv = deps.daemonEnv ?? process.env;
+  const primaryRuntimeEffectiveEnv = getRuntimeEffectiveEnv(primaryRuntime.env) ?? daemonEnv;
   const voiceCoordinator = deps.voiceCoordinator ?? new WorkspaceVoiceCoordinator();
   const primaryBoundWorkspace = primaryRuntime.workspaceCwd;
   const primaryBridge = primaryRuntime.bridge;
@@ -26681,7 +28298,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   const healthDemoRoutes = createHealthDemoRoutes({
     opts,
     getPort,
-    bridge: primaryBridge,
+    workspaceRegistry,
     getActiveSseCount,
     getRateLimiter: /* @__PURE__ */ __name(() => rateLimiter, "getRateLimiter")
   });
@@ -26742,38 +28359,27 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     requireAuth: opts.requireAuth === true
   });
   app.use(
-    daemonTelemetryMiddleware(
-      (req) => {
-        const match = req.path.match(/^\/workspaces\/([^/]+)/);
-        const rawSelector = match?.[1];
-        if (rawSelector) {
-          try {
-            const selector = decodeURIComponent(rawSelector);
-            const byId = workspaceRegistry.getByWorkspaceId(selector);
-            if (byId) return byId.workspaceCwd;
-            if (isPortableAbsolutePath(selector)) {
-              const runtime = resolveRegisteredWorkspaceRuntimeByPathSelector(
-                workspaceRegistry,
-                selector
-              );
-              if (runtime) return runtime.workspaceCwd;
-            }
-          } catch {
-            return primaryBoundWorkspace;
-          }
-        }
-        return primaryBoundWorkspace;
-      },
-      deps.recordDaemonRequest,
-      (sessionId) => {
+    daemonTelemetryMiddleware((req) => {
+      const match = req.path.match(/^\/workspaces\/([^/]+)/);
+      const rawSelector = match?.[1];
+      if (rawSelector) {
         try {
-          const owner = workspaceRegistry.resolveLiveSessionOwner(sessionId);
-          return owner.kind === "found" ? owner.runtime.workspaceCwd : void 0;
+          const selector = decodeURIComponent(rawSelector);
+          const byId = workspaceRegistry.getByWorkspaceId(selector);
+          if (byId) return byId.workspaceCwd;
+          if (isPortableAbsolutePath(selector)) {
+            const runtime = resolveRegisteredWorkspaceRuntimeByPathSelector(
+              workspaceRegistry,
+              selector
+            );
+            if (runtime) return runtime.workspaceCwd;
+          }
         } catch {
-          return void 0;
+          return primaryBoundWorkspace;
         }
       }
-    )
+      return primaryBoundWorkspace;
+    }, deps.recordDaemonRequest)
   );
   const buildWorkspaceCtx = createBuildWorkspaceCtx(primaryBoundWorkspace);
   const acpHandleRef = {};
@@ -26915,6 +28521,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   registerWorkspaceSetupGithubRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
+    env: primaryRuntimeEffectiveEnv,
     mutate,
     parseClientId: parseClientIdHeader,
     safeBody
@@ -27211,6 +28818,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   });
   acpHandleRef.current = mountAcpHttp(app, primaryBridge, {
     boundWorkspace: primaryBoundWorkspace,
+    daemonEnv,
     // Phase 4 (issue #6378): pass the registry so `/workspaces/:workspace/acp`
     // mounts a per-runtime ACP dispatcher for each registered workspace.
     workspaceRegistry,
@@ -27282,6 +28890,7 @@ export {
   createServeApp,
   detectFromLoopback,
   getActiveSseCount,
+  getWorkspaceSessionInfoForResponse,
   listWorkspaceSessionsForResponse,
   resolveBoundWorkspacesFromIdeEnv,
   resolveBridgeFsFactory,