@qwen-code/qwen-code 0.19.11-nightly.20260718.767a32484 → 0.19.11

package/chunks/{server-LDY4YVU4.js → server-5ECMV4TM.js}

@@ -14,12 +14,12 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-IX7O5WI3.js";
+} from "./chunk-QOTQH4CB.js";
 import {
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-DPSHAB47.js";
+} from "./chunk-5VWYKIMW.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -30,8 +30,8 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-PWYLF7SS.js";
-import "./chunk-JBAQ5BYX.js";
+} from "./chunk-6Y6ORE2G.js";
+import "./chunk-CF5VJRGC.js";
 import "./chunk-SUARMD4Q.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-L573Z2QZ.js";
@@ -44,6 +44,7 @@ import {
   MAX_CLIENT_ID_LENGTH,
   MAX_CONCURRENT_VOICE_SESSIONS,
   MAX_SERVER_NAME_LENGTH,
+  MAX_SKILL_NAME_LENGTH,
   MAX_TOOL_NAME_LENGTH,
   PathMutexRegistry,
   QWEN_CDP_MCP_COMMAND_ENV,
@@ -64,7 +65,6 @@ import {
   denyBrowserOriginCors,
   detectFromLoopback,
   getAdvertisedServeFeatures,
-  getDeferredRuntimeRequestTiming,
   getServeProtocolVersions,
   hostAllowlist,
   isBrowserAutomationMcpAvailable,
@@ -89,51 +89,48 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-HQXQCIT2.js";
+} from "./chunk-KXYJPRT5.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-U6OPT4H2.js";
+} from "./chunk-6EDDYPI3.js";
 import "./chunk-LXXMOYPL.js";
-import "./chunk-K2GBHL73.js";
+import "./chunk-S63Z5V42.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-ECZFTRTP.js";
+} from "./chunk-7ZYHLN67.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-6Z5NRZVU.js";
+} from "./chunk-ZIXOTAPZ.js";
 import {
   snapshotProcessEnv
-} from "./chunk-2YSZE74N.js";
+} from "./chunk-SY7NEYX4.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-GG6RSNWS.js";
+} from "./chunk-JD44PNGJ.js";
 import "./chunk-2W3OOD4W.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
-  MAX_WORKSPACE_SKILL_NAME_LENGTH,
-  WorkspaceSkillManagementError,
   WorkspaceVoiceError,
   buildWorkspaceVoiceSettingsWrites,
   buildWorkspaceVoiceStatus,
   createDaemonWorkspaceService,
   hasConfiguredBatchVoiceTranscriptionModel,
   transcribeWorkspaceVoiceAudio,
-  validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-FSJGBUQI.js";
+} from "./chunk-4IJMTYCB.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-57RWF6R7.js";
+} from "./chunk-K7VD4XLT.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -141,13 +138,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-6ITLKEOZ.js";
+} from "./chunk-BUAXJVNP.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-AEKYFMYE.js";
-import "./chunk-F2RR4HO2.js";
+} from "./chunk-3M75MSVA.js";
+import "./chunk-FSA7ERJ2.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
   WorkspaceSettingsPartialPersistError,
@@ -156,19 +153,19 @@ import {
 } from "./chunk-OA4JVLSA.js";
 import {
   createTotalSessionAdmissionController
-} from "./chunk-R3VWUU2E.js";
+} from "./chunk-AVEOWVOM.js";
 import {
   createSingleWorkspaceRegistry,
   createWorkspaceSessionOwnerIndex
-} from "./chunk-W7H223ZZ.js";
+} from "./chunk-STZQCNN3.js";
 import "./chunk-GRC5HGPI.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-KEVDWH3U.js";
-import "./chunk-T3W4SDRB.js";
+} from "./chunk-574PTLMU.js";
+import "./chunk-PZL23GTM.js";
 import {
   EVENT_SCHEMA_VERSION,
   SubscriberLimitExceededError
@@ -205,30 +202,30 @@ import {
   WorkspaceInitRaceError,
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
-} from "./chunk-X6YQWCIJ.js";
+} from "./chunk-L4Y55KIS.js";
 import "./chunk-WBL3FJEU.js";
 import {
   loadChannelsConfig
-} from "./chunk-3CL5SEDT.js";
-import "./chunk-IVKLDHU6.js";
+} from "./chunk-7NMU22Q3.js";
+import "./chunk-YFVO2HOR.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-Y72B36CP.js";
-import "./chunk-FZRES4GK.js";
+} from "./chunk-5CNYZ7TN.js";
+import "./chunk-FNX3LGAK.js";
 import "./chunk-V6WHFGST.js";
-import "./chunk-O2K6BLPZ.js";
+import "./chunk-3AYLDB6B.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-URP6O2PP.js";
+} from "./chunk-VFX7EZIR.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceRegistrationStoreCommittedError,
   WorkspaceRegistrationStoreLimitError,
   workspaceRegistrationId
-} from "./chunk-JUVTV4NF.js";
+} from "./chunk-N5VIZTND.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
@@ -242,7 +239,7 @@ import {
   QWEN_SERVER_TOKEN_ENV,
   isChannelWebhookEnqueueError,
   normalizeWorkerDiagnostic
-} from "./chunk-JDIUK2Y3.js";
+} from "./chunk-KSZKSE23.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-TJTKSVIV.js";
@@ -253,7 +250,7 @@ import "./chunk-5HBA2Z7V.js";
 import "./chunk-T2NCM2ET.js";
 import {
   sanitizeLogText
-} from "./chunk-ATJ7H5AS.js";
+} from "./chunk-ZQIYGQCG.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -264,18 +261,18 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-C5NSOSF4.js";
+} from "./chunk-GNBBAQ6J.js";
 import "./chunk-RKUWKYED.js";
 import {
   SUPPORTED_LANGUAGES
-} from "./chunk-HIMIG6PI.js";
-import "./chunk-336KPNNV.js";
+} from "./chunk-4AGTGMCQ.js";
+import "./chunk-JWICTOXS.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import "./chunk-QRUIS3DN.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-LSFVUGXT.js";
+} from "./chunk-2OG646IN.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -283,7 +280,7 @@ import {
 import {
   writeStderrLine
 } from "./chunk-YUZI3WAC.js";
-import "./chunk-KTKETHMY.js";
+import "./chunk-GLNHPRZT.js";
 import "./chunk-VJNBRRZG.js";
 import {
   ALL_PROVIDERS,
@@ -299,7 +296,6 @@ import {
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
   SESSION_TRANSCRIPT_MAX_INDEX_BYTES,
   SESSION_TRANSCRIPT_MAX_LIMIT,
-  SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
   SessionOrganizationError,
   SessionOrganizationService,
   SessionService,
@@ -330,17 +326,17 @@ import {
   stripTerminalControlSequences,
   watchRepoBranch,
   writeWorkspaceContextFile
-} from "./chunk-3YJZ6WNY.js";
+} from "./chunk-NJOFRXTM.js";
 import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-LKR7QQ63.js";
-import "./chunk-4XCVGEEX.js";
-import "./chunk-XSPFQQRE.js";
-import "./chunk-4RPARQ5D.js";
+} from "./chunk-A2HWMJVO.js";
+import "./chunk-RCEEXIOO.js";
+import "./chunk-KKRTYONM.js";
+import "./chunk-TV6K2FB4.js";
 import "./chunk-E2UVIFI2.js";
 import {
   nextFireTime,
@@ -354,7 +350,7 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-J2MKYJKZ.js";
+} from "./chunk-SPJQO2CE.js";
 import "./chunk-SZRN75WQ.js";
 import "./chunk-HTO4JFDZ.js";
 import "./chunk-CPBF7KYF.js";
@@ -362,12 +358,12 @@ import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-VNN3JNYT.js";
+} from "./chunk-F333XEAU.js";
 import "./chunk-6AM5D4ME.js";
-import "./chunk-OSSDHJDU.js";
-import "./chunk-SGPFJMRP.js";
-import "./chunk-335ECZTA.js";
-import "./chunk-JCJPZMJV.js";
+import "./chunk-2Z5UX4KI.js";
+import "./chunk-ARKANCNX.js";
+import "./chunk-L5U3ELZX.js";
+import "./chunk-TYLOFD2U.js";
 import {
   addDaemonRequestAttribute,
   decodeBufferWithEncodingInfo,
@@ -381,15 +377,15 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-66IT3EY2.js";
+} from "./chunk-MQOVXZAF.js";
 import "./chunk-4WKAA4KS.js";
 import "./chunk-CR3C7WXL.js";
-import "./chunk-U2LNTX56.js";
+import "./chunk-RTV5TUYB.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-FUTHTZVV.js";
-import "./chunk-4CA4WUMS.js";
-import "./chunk-WEPXQKGP.js";
-import "./chunk-ANRANWVE.js";
+import "./chunk-FBU7WRZI.js";
+import "./chunk-Y66VOBRP.js";
+import "./chunk-WTNZ6DXB.js";
+import "./chunk-JGUT3LWZ.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -398,28 +394,28 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-G274ETR6.js";
-import "./chunk-Z2LBNX3R.js";
+} from "./chunk-OKAIGAYW.js";
+import "./chunk-ZPAHLFZU.js";
 import "./chunk-JESCGQM3.js";
-import "./chunk-VAJS2E2D.js";
+import "./chunk-WIEO4CWB.js";
 import "./chunk-XVNQMZ2I.js";
 import "./chunk-FEOZBUMT.js";
-import "./chunk-CMVFTMRD.js";
+import "./chunk-VRR65QYW.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
-import "./chunk-TYQMGACW.js";
+import "./chunk-4LD5APFL.js";
 import {
   import_websocket_server
 } from "./chunk-TYAMGABM.js";
 import "./chunk-FCMNKVXT.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-4CHDYDG3.js";
+import "./chunk-LQIDP6K5.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   runWithoutDebugLogSession
-} from "./chunk-UE5TZ55T.js";
+} from "./chunk-7NFB7LBQ.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -2915,7 +2911,7 @@ async function handleSetupGithub(req, res, deps) {
     const result = await setupGithub({
       cwd: deps.boundWorkspace,
       workspaceRoot: deps.boundWorkspace,
-      proxy: resolveSetupGithubProxy(deps.boundWorkspace, deps.env),
+      proxy: resolveSetupGithubProxy(deps.boundWorkspace),
       abortSignal: requestAbortSignal(req, res),
       fileOps: createSetupGithubFileOps(factory, ROUTE, originatorClientId)
     });
@@ -3133,14 +3129,14 @@ function setupGithubEventData(result) {
   };
 }
 __name(setupGithubEventData, "setupGithubEventData");
-function resolveSetupGithubProxy(boundWorkspace, env) {
+function resolveSetupGithubProxy(boundWorkspace) {
   const settings = loadSettings(boundWorkspace, { skipLoadEnvironment: true });
   const trustState = getWorkspaceTrustStatus(
     settingsForSetupGithubTrust(settings),
     boundWorkspace
   ).effective.state;
   const settingsProxy = trustState === "trusted" ? settings.merged.proxy : settings.user.settings.proxy || settings.system.settings.proxy || settings.systemDefaults.settings.proxy;
-  return settingsProxy || env["HTTPS_PROXY"] || env["https_proxy"] || env["HTTP_PROXY"] || env["http_proxy"];
+  return settingsProxy || process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env["http_proxy"];
 }
 __name(resolveSetupGithubProxy, "resolveSetupGithubProxy");
 function settingsForSetupGithubTrust(settings) {
@@ -6958,10 +6954,9 @@ function rpcErrorFrame(id, err) {
 __name(rpcErrorFrame, "rpcErrorFrame");
 var ACP_PROTOCOL_VERSION = 1;
 var AcpDispatcher = class {
-  constructor(bridge, boundWorkspace, env, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
+  constructor(bridge, boundWorkspace, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator()) {
     this.bridge = bridge;
     this.boundWorkspace = boundWorkspace;
-    this.env = env;
     this.workspace = workspace;
     this.workspaceRememberLane = workspaceRememberLane;
     this.fsFactory = fsFactory;
@@ -8338,7 +8333,7 @@ var AcpDispatcher = class {
             const result = await setupGithub({
               cwd: this.boundWorkspace,
               workspaceRoot: this.boundWorkspace,
-              proxy: resolveSetupGithubProxy(this.boundWorkspace, this.env),
+              proxy: resolveSetupGithubProxy(this.boundWorkspace),
               abortSignal: conn.abortSignal,
               fileOps: createSetupGithubFileOps(
                 this.fsFactory,
@@ -11809,11 +11804,11 @@ function delay(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 __name(delay, "delay");
-function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname, env) {
+function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname) {
   if (localPort === void 0 || !Number.isInteger(localPort) || localPort <= 0) {
     return void 0;
   }
-  const command = resolveCdpMcpCommand(env);
+  const command = resolveCdpMcpCommand(process.env);
   if (!command) {
     writeStderrLine(
       `qwen serve: set ${QWEN_CDP_MCP_COMMAND_ENV} to enable browser automation MCP (no adapter is bundled)`
@@ -11919,18 +11914,9 @@ function workspaceRateLimitKey(mount, clientKey) {
   return JSON.stringify([clientKey, mount.rateLimitScope]);
 }
 __name(workspaceRateLimitKey, "workspaceRateLimitKey");
-function runtimeEffectiveEnv(runtime, daemonEnv) {
-  if (runtime.env.mode === "runtime-overlay") {
-    return runtime.env.effectiveEnv ?? {};
-  }
-  return runtime.env.effectiveEnv ?? daemonEnv;
-}
-__name(runtimeEffectiveEnv, "runtimeEffectiveEnv");
 function mountAcpHttp(app, bridge, opts) {
   const enabled = opts.enabled ?? resolveAcpHttpEnabled();
   if (!enabled) return void 0;
-  const daemonEnv = opts.daemonEnv ?? process.env;
-  const primaryEnv = opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv;
   const path15 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
@@ -12020,8 +12006,7 @@ function mountAcpHttp(app, bridge, opts) {
     }
     const runtimeConfig = buildChromeDevToolsMcpRuntimeConfig(
       localPort,
-      opts.hostname,
-      daemonEnv
+      opts.hostname
     );
     if (!runtimeConfig) {
       cdpMcpTerminalSkipLogged = true;
@@ -12080,7 +12065,6 @@ function mountAcpHttp(app, bridge, opts) {
   const dispatcher = new AcpDispatcher(
     bridge,
     opts.boundWorkspace,
-    primaryEnv,
     opts.workspace,
     opts.workspaceRememberLane,
     opts.fsFactory,
@@ -12369,7 +12353,6 @@ function mountAcpHttp(app, bridge, opts) {
     const secondaryDispatcher = new AcpDispatcher(
       rt.bridge,
       rt.workspaceCwd,
-      runtimeEffectiveEnv(rt, daemonEnv),
       rt.workspaceService,
       workspaceRememberLane,
       rt.routeFileSystemFactory,
@@ -17731,810 +17714,195 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/routes/session-runtime.ts
 init_esbuild_shims();
-
-// packages/cli/src/serve/server/telemetry.ts
-init_esbuild_shims();
-var legacySessionTelemetryRoutes = [
-  {
-    method: "POST",
-    path: "/session",
-    attribution: "handler_resolved",
-    route: "POST /session"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/load",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/load"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/resume",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/resume"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/branch",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/branch"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/fork",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/fork"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/cd",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/cd"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/status",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/status"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/export",
-    attribution: "pre_resolved",
-    route: "GET /session/:id/export"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/transcript",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/transcript"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/context",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/context"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/context-usage",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/context-usage"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/stats",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/stats"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/supported-commands",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/supported-commands"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/tasks",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/tasks"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/lsp",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/lsp"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/hooks",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/hooks"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/artifacts",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/artifacts"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/artifacts",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/artifacts"
-  },
-  {
-    method: "DELETE",
-    path: "/session/:id/artifacts/:artifactId",
-    attribution: "handler_resolved",
-    route: "DELETE /session/:id/artifacts/:artifactId"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/tasks/:taskId/cancel",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/tasks/:taskId/cancel"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/goal/clear",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/goal/clear"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/continue",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/continue"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/prompt",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/prompt"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/generate",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/generate"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/heartbeat",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/heartbeat"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/detach",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/detach"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/cancel",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/cancel"
-  },
-  {
-    method: "DELETE",
-    path: "/session/:id",
-    attribution: "handler_resolved",
-    route: "DELETE /session/:id"
-  },
-  {
-    method: "POST",
-    path: "/sessions/delete",
-    attribution: "pre_resolved",
-    route: "POST /sessions/delete"
-  },
-  {
-    method: "POST",
-    path: "/sessions/archive",
-    attribution: "pre_resolved",
-    route: "POST /sessions/archive"
-  },
-  {
-    method: "POST",
-    path: "/sessions/unarchive",
-    attribution: "pre_resolved",
-    route: "POST /sessions/unarchive"
-  },
-  {
-    method: "PATCH",
-    path: "/session/:id/metadata",
-    attribution: "handler_resolved",
-    route: "PATCH /session/:id/metadata"
-  },
-  {
-    method: "PATCH",
-    path: "/session/:id/organization",
-    attribution: "pre_resolved",
-    route: "PATCH /session/:id/organization"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/model",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/model"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/recap",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/recap"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/btw",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/btw"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/mid-turn-message",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/mid-turn-message"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/pending-prompts",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/pending-prompts"
-  },
-  {
-    method: "DELETE",
-    path: "/session/:id/pending-prompts/:promptId",
-    attribution: "handler_resolved",
-    route: "DELETE /session/:id/pending-prompts/:promptId"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/shell",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/shell"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/rewind/snapshots",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/rewind/snapshots"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/rewind",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/rewind"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/approval-mode",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/approval-mode"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/language",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/language"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/permission/:requestId",
-    attribution: "handler_resolved",
-    route: "POST /session/:id/permission/:requestId"
-  },
-  {
-    method: "POST",
-    path: "/permission/:requestId",
-    attribution: "pre_resolved",
-    route: "POST /permission/:requestId"
-  },
-  {
-    method: "GET",
-    path: "/session/:id/events",
-    attribution: "handler_resolved",
-    route: "GET /session/:id/events"
-  },
-  {
-    method: "POST",
-    path: "/session/:id/a2ui-action",
-    attribution: "pre_resolved",
-    route: "POST /session/:id/a2ui-action"
+function requireSessionRuntime(opts) {
+  const {
+    sessionId,
+    route,
+    res,
+    workspaceRegistry,
+    daemonLog,
+    details = {}
+  } = opts;
+  if (workspaceRegistry.list().length === 1) {
+    return workspaceRegistry.primary;
   }
-];
-var daemonTelemetryResponseContext = Symbol("daemonTelemetryResponseContext");
-function decodePathSegment(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
+  const resolution = workspaceRegistry.resolveLiveSessionOwner(sessionId);
+  if (resolution.kind === "found") {
+    const runtime = resolution.runtime;
+    if (!runtime.primary && !runtime.trusted) {
+      daemonLog?.warn("session routing failed", {
+        route,
+        resolutionKind: "untrusted_workspace",
+        sessionId,
+        workspaceId: runtime.workspaceId,
+        workspaceCwd: runtime.workspaceCwd,
+        ...details
+      });
+      sendUntrustedWorkspaceResponse(res, {
+        sessionId,
+        workspaceCwd: runtime.workspaceCwd,
+        workspaceId: runtime.workspaceId
+      });
+      return void 0;
+    }
+    return runtime;
   }
-}
-__name(decodePathSegment, "decodePathSegment");
-function matchLegacySessionTelemetryRoute(method, requestPath) {
-  const path15 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
-  const requestSegments = path15.split("/").slice(1);
-  const prefix = requestSegments[0]?.toLowerCase();
-  if (prefix !== "session" && prefix !== "sessions" && prefix !== "permission") {
+  if (resolution.kind === "not_found") {
+    daemonLog?.warn("session routing failed", {
+      route,
+      resolutionKind: "not_found",
+      sessionId,
+      ...details
+    });
+    res.status(404).json({
+      error: `No session with id "${sessionId}"`,
+      code: "session_not_found",
+      sessionId
+    });
     return void 0;
   }
-  for (const entry of legacySessionTelemetryRoutes) {
-    if (entry.method !== method) continue;
-    const templateSegments = entry.path.split("/").slice(1);
-    if (templateSegments.length !== requestSegments.length) continue;
-    const params = /* @__PURE__ */ new Map();
-    let matched = true;
-    for (let index = 0; index < templateSegments.length; index += 1) {
-      const templateSegment = templateSegments[index];
-      const requestSegment = requestSegments[index];
-      if (templateSegment.startsWith(":")) {
-        if (requestSegment === "") {
-          matched = false;
-          break;
-        }
-        params.set(templateSegment.slice(1), requestSegment);
-      } else if (templateSegment.toLowerCase() !== requestSegment.toLowerCase()) {
-        matched = false;
-        break;
-      }
-    }
-    if (!matched) continue;
-    const rawSessionId = params.get("id");
-    const rawRequestId = params.get("requestId");
-    const requestId = rawRequestId !== void 0 ? decodePathSegment(rawRequestId) : void 0;
-    return {
-      route: entry.route,
-      attribution: entry.attribution,
-      ...rawSessionId ? { sessionId: decodePathSegment(rawSessionId) } : {},
-      ...requestId !== void 0 && requestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(requestId) ? { permissionRequestId: requestId } : {}
-    };
-  }
+  const workspaceIds = resolution.runtimes.map(
+    (runtime) => runtime.workspaceId
+  );
+  daemonLog?.warn("session routing failed", {
+    route,
+    resolutionKind: "ambiguous",
+    sessionId,
+    workspaceIds,
+    ...details
+  });
+  res.status(500).json({
+    error: `Session owner is ambiguous for "${sessionId}"`,
+    code: "ambiguous_session_owner",
+    sessionId,
+    route,
+    workspaceIds
+  });
   return void 0;
 }
-__name(matchLegacySessionTelemetryRoute, "matchLegacySessionTelemetryRoute");
-function setDaemonTelemetryWorkspace(res, workspaceCwd) {
-  try {
-    const context = res[daemonTelemetryResponseContext];
-    if (context && context.workspaceCwd === void 0) {
-      context.workspaceCwd = workspaceCwd;
+__name(requireSessionRuntime, "requireSessionRuntime");
+
+// packages/cli/src/serve/routes/permission.ts
+function registerPermissionRoutes(app, deps) {
+  const {
+    bridge,
+    workspaceRegistry,
+    daemonLog,
+    mutate,
+    sendPermissionVoteError: sendPermissionVoteError2
+  } = deps;
+  app.post("/session/:id/permission/:requestId", mutate(), (req, res) => {
+    const sessionId = req.params["id"];
+    const requestId = req.params["requestId"];
+    const response = parsePermissionVoteBody(req, res);
+    if (response === void 0) return;
+    const clientId = parseClientIdHeader(req, res);
+    if (clientId === null) return;
+    const fromLoopback = detectFromLoopback(req);
+    const context = {
+      ...clientId !== void 0 ? { clientId } : {},
+      fromLoopback
+    };
+    let accepted;
+    try {
+      const runtime = requireSessionRuntime({
+        sessionId,
+        route: "POST /session/:id/permission/:requestId",
+        res,
+        workspaceRegistry,
+        daemonLog,
+        details: { requestId }
+      });
+      if (!runtime) return;
+      accepted = runtime.bridge.respondToSessionPermission(
+        sessionId,
+        requestId,
+        response,
+        context
+      );
+    } catch (err) {
+      sendPermissionVoteError2(res, err, {
+        route: "POST /session/:id/permission/:requestId",
+        sessionId
+      });
+      return;
     }
-  } catch {
-  }
+    if (!accepted) {
+      res.status(404).json({
+        error: "No pending permission request for session",
+        sessionId,
+        requestId
+      });
+      return;
+    }
+    res.status(200).json({});
+  });
+  app.post("/permission/:requestId", mutate(), (req, res) => {
+    const requestId = req.params["requestId"];
+    const response = parsePermissionVoteBody(req, res);
+    if (response === void 0) return;
+    const clientId = parseClientIdHeader(req, res);
+    if (clientId === null) return;
+    const fromLoopback = detectFromLoopback(req);
+    const context = {
+      ...clientId !== void 0 ? { clientId } : {},
+      fromLoopback
+    };
+    let accepted;
+    try {
+      accepted = bridge.respondToPermission(requestId, response, context);
+    } catch (err) {
+      sendPermissionVoteError2(res, err, {
+        route: "POST /permission/:requestId"
+      });
+      return;
+    }
+    if (!accepted) {
+      res.status(404).json({ error: "No pending permission request", requestId });
+      return;
+    }
+    res.status(200).json({});
+  });
 }
-__name(setDaemonTelemetryWorkspace, "setDaemonTelemetryWorkspace");
-function resolveDaemonTelemetryRoute(req) {
-  const legacyRoute = matchLegacySessionTelemetryRoute(req.method, req.path);
-  if (legacyRoute) return legacyRoute;
-  const path15 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "GET" && path15 === "/daemon/status") {
-    return { route: "GET /daemon/status" };
+__name(registerPermissionRoutes, "registerPermissionRoutes");
+
+// packages/cli/src/serve/routes/session.ts
+init_esbuild_shims();
+import * as crypto3 from "node:crypto";
+import * as path11 from "node:path";
+
+// packages/cli/src/serve/server/prompt-deadline.ts
+init_esbuild_shims();
+var PromptDeadlineExceededError = class extends Error {
+  static {
+    __name(this, "PromptDeadlineExceededError");
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
-    return { route: "GET /workspace/:id/sessions" };
+  deadlineMs;
+  constructor(deadlineMs) {
+    super(`prompt exceeded the ${deadlineMs}ms deadline`);
+    this.name = "PromptDeadlineExceededError";
+    this.deadlineMs = deadlineMs;
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
-    return { route: "GET /workspace/:id/sessions" };
+};
+function resolvePromptDeadlineMs(serverMs, requestMs) {
+  if (serverMs === void 0 || !Number.isFinite(serverMs) || serverMs <= 0) {
+    return void 0;
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path15)) {
-    return { route: "GET /workspace/:id/session-info" };
+  if (requestMs === void 0 || !Number.isFinite(requestMs) || requestMs <= 0) {
+    return serverMs;
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path15)) {
-    return { route: "GET /workspace/:id/session-info" };
-  }
-  const workspaceTranscript = path15.match(
-    /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
-  );
-  if (workspaceTranscript?.[1] && req.method === "GET") {
-    return {
-      route: "GET /workspaces/:workspace/session/:id/transcript",
-      sessionId: decodePathSegment(workspaceTranscript[1])
-    };
-  }
-  const workspaceExport = path15.match(
-    /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
-  );
-  if (workspaceExport?.[1] && req.method === "GET") {
-    return {
-      route: "GET /workspaces/:workspace/session/:id/export",
-      sessionId: decodePathSegment(workspaceExport[1])
-    };
-  }
-  const workspaceArchivedExport = path15.match(
-    /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
-  );
-  if (workspaceArchivedExport?.[1] && req.method === "GET") {
-    return {
-      route: "GET /workspaces/:workspace/session/:id/archive/export",
-      sessionId: decodePathSegment(workspaceArchivedExport[1])
-    };
-  }
-  const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
-  if (pluralWorkspacePrefix.test(path15)) {
-    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
-    if (req.method === "GET") {
-      if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
-        return { route: `GET ${suffix}` };
-      }
-      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-        return { route: "GET /workspace/agents/:agentType" };
-      }
-      if (suffix === "/workspace/file") return { route: "GET /file" };
-      if (suffix === "/workspace/file/bytes") {
-        return { route: "GET /file/bytes" };
-      }
-      if (suffix === "/workspace/stat") return { route: "GET /stat" };
-      if (suffix === "/workspace/list") return { route: "GET /list" };
-      if (suffix === "/workspace/glob") return { route: "GET /glob" };
-      if (/^\/workspace\/mcp\/[^/]+\/tools$/.test(suffix)) {
-        return { route: "GET /workspace/mcp/:server/tools" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/resources$/.test(suffix)) {
-        return { route: "GET /workspace/mcp/:server/resources" };
-      }
-    }
-    if (req.method === "POST") {
-      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
-        return { route: `POST ${suffix}` };
-      }
-      if (/^\/workspace\/tools\/[^/]+\/enable$/.test(suffix)) {
-        return { route: "POST /workspace/tools/:name/enable" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/restart$/.test(suffix)) {
-        return { route: "POST /workspace/mcp/:server/restart" };
-      }
-      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-        return { route: "POST /workspace/agents/:agentType" };
-      }
-      if (/^\/workspace\/mcp\/[^/]+\/(approve|enable|disable|authenticate|clear-auth)$/.test(
-        suffix
-      )) {
-        return {
-          route: `POST /workspace/mcp/:server/${suffix.split("/").at(-1)}`
-        };
-      }
-    }
-    if (req.method === "DELETE" && /^\/workspace\/mcp\/servers\/[^/]+$/.test(suffix)) {
-      return { route: "DELETE /workspace/mcp/servers/:name" };
-    }
-    if (req.method === "DELETE" && /^\/workspace\/agents\/[^/]+$/.test(suffix)) {
-      return { route: "DELETE /workspace/agents/:agentType" };
-    }
-    if (suffix === "/workspace/session-groups" && req.method === "GET") {
-      return { route: "GET /workspace/session-groups" };
-    }
-    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "PATCH") {
-      return { route: "PATCH /workspace/session-groups/:groupId" };
-    }
-    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "DELETE") {
-      return { route: "DELETE /workspace/session-groups/:groupId" };
-    }
-  }
-  if (req.method === "POST" && path15 === "/workspace/init") {
-    return { route: "POST /workspace/init" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/setup-github") {
-    return { route: "POST /workspace/setup-github" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/reload") {
-    return { route: "POST /workspace/reload" };
-  }
-  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
-  if (mcpRestart?.[1] && req.method === "POST") {
-    return { route: "POST /workspace/mcp/:server/restart" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
-    return { route: "POST /workspace/mcp/servers" };
-  }
-  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
-  if (mcpDelete?.[1] && req.method === "DELETE") {
-    return { route: "DELETE /workspace/mcp/servers/:name" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
-    return { route: "POST /workspace/auth/device-flow" };
-  }
-  const deviceFlowDelete = path15.match(
-    /^\/workspace\/auth\/device-flow\/([^/]+)$/
-  );
-  if (deviceFlowDelete?.[1] && req.method === "DELETE") {
-    return { route: "DELETE /workspace/auth/device-flow/:id" };
-  }
-  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
-  if (toolEnable?.[1] && req.method === "POST") {
-    return { route: "POST /workspace/tools/:name/enable" };
-  }
-  if (path15 === "/workspace/settings") {
-    if (req.method === "GET") return { route: "GET /workspace/settings" };
-    if (req.method === "POST") return { route: "POST /workspace/settings" };
-  }
-  if (path15 === "/workspace/permissions") {
-    if (req.method === "GET") return { route: "GET /workspace/permissions" };
-    if (req.method === "POST") return { route: "POST /workspace/permissions" };
-  }
-  if (path15 === "/workspace/trust") {
-    if (req.method === "GET") return { route: "GET /workspace/trust" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/trust/request") {
-    return { route: "POST /workspace/trust/request" };
-  }
-  if (path15 === "/workspace/voice") {
-    if (req.method === "GET") return { route: "GET /workspace/voice" };
-    if (req.method === "POST") return { route: "POST /workspace/voice" };
-  }
-  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
-    return { route: "POST /workspace/voice/transcribe" };
-  }
-  return void 0;
-}
-__name(resolveDaemonTelemetryRoute, "resolveDaemonTelemetryRoute");
-function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest) {
-  const workspaceHashByCwd = /* @__PURE__ */ new Map();
-  const resolveWorkspaceHash = /* @__PURE__ */ __name((workspaceCwd) => {
-    const existing = workspaceHashByCwd.get(workspaceCwd);
-    if (existing !== void 0) return existing;
-    const workspaceHash = hashDaemonWorkspace(workspaceCwd);
-    workspaceHashByCwd.set(workspaceCwd, workspaceHash);
-    return workspaceHash;
-  }, "resolveWorkspaceHash");
-  return (req, res, next) => {
-    const route = resolveDaemonTelemetryRoute(req);
-    if (!route) {
-      next();
-      return;
-    }
-    const sessionId = route.sessionId;
-    let workspaceHash;
-    if (route.attribution !== "handler_resolved") {
-      try {
-        workspaceHash = resolveWorkspaceHash(resolveWorkspaceCwd(req));
-      } catch {
-      }
-    }
-    const rawClientId = req.get(CLIENT_ID_HEADER);
-    const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
-    const deferredRuntime = getDeferredRuntimeRequestTiming(req);
-    const startMs = deferredRuntime?.startedAt.getTime() ?? Date.now();
-    const telemetryRes = res;
-    if (route.attribution === "handler_resolved") {
-      try {
-        telemetryRes[daemonTelemetryResponseContext] = {};
-      } catch {
-      }
-    }
-    void withDaemonRequestSpan(
-      {
-        method: req.method,
-        route: route.route,
-        ...workspaceHash !== void 0 ? { workspaceHash } : {},
-        ...sessionId ? { sessionId } : {},
-        ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
-        ...clientId ? { clientId } : {},
-        ...deferredRuntime?.waitMs !== void 0 ? {
-          startTime: deferredRuntime.startedAt,
-          deferredRuntimeWaitMs: deferredRuntime.waitMs,
-          deferredRuntimePath: deferredRuntime.path
-        } : {}
-      },
-      async (span) => await new Promise((resolve5, reject) => {
-        let done = false;
-        const finish = /* @__PURE__ */ __name(() => {
-          if (done) return;
-          done = true;
-          try {
-            const context = telemetryRes[daemonTelemetryResponseContext];
-            delete telemetryRes[daemonTelemetryResponseContext];
-            if (context?.workspaceCwd !== void 0) {
-              span?.setAttribute(
-                "qwen-code.workspace.hash",
-                resolveWorkspaceHash(context.workspaceCwd)
-              );
-            }
-          } catch {
-          }
-          recordDaemonHttpResponse(span, res.statusCode);
-          const durationMs = Date.now() - startMs;
-          const successfulSse = route.route === "GET /session/:id/events" && res.statusCode === 200 && res.headersSent;
-          if (!successfulSse) {
-            recordDaemonHttpRequest(
-              durationMs,
-              route.route,
-              res.statusCode,
-              deferredRuntime?.path
-            );
-          }
-          if (!successfulSse && route.route !== "GET /daemon/status" && route.route !== "POST /session/:id/heartbeat") {
-            recordRequest?.(durationMs, res.statusCode);
-          }
-          resolve5();
-        }, "finish");
-        res.once("finish", finish);
-        res.once("close", finish);
-        try {
-          next();
-        } catch (error2) {
-          recordDaemonError(span, error2);
-          reject(error2);
-        }
-      })
-    ).catch(next);
-  };
-}
-__name(daemonTelemetryMiddleware, "daemonTelemetryMiddleware");
-
-// packages/cli/src/serve/routes/session-runtime.ts
-function requireSessionRuntime(opts) {
-  const {
-    sessionId,
-    route,
-    res,
-    workspaceRegistry,
-    daemonLog,
-    details = {}
-  } = opts;
-  if (workspaceRegistry.list().length === 1) {
-    const runtime = workspaceRegistry.primary;
-    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
-    return runtime;
-  }
-  const resolution = workspaceRegistry.resolveLiveSessionOwner(sessionId);
-  if (resolution.kind === "found") {
-    const runtime = resolution.runtime;
-    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
-    if (!runtime.primary && !runtime.trusted) {
-      daemonLog?.warn("session routing failed", {
-        route,
-        resolutionKind: "untrusted_workspace",
-        sessionId,
-        workspaceId: runtime.workspaceId,
-        workspaceCwd: runtime.workspaceCwd,
-        ...details
-      });
-      sendUntrustedWorkspaceResponse(res, {
-        sessionId,
-        workspaceCwd: runtime.workspaceCwd,
-        workspaceId: runtime.workspaceId
-      });
-      return void 0;
-    }
-    return runtime;
-  }
-  if (resolution.kind === "not_found") {
-    daemonLog?.warn("session routing failed", {
-      route,
-      resolutionKind: "not_found",
-      sessionId,
-      ...details
-    });
-    res.status(404).json({
-      error: `No session with id "${sessionId}"`,
-      code: "session_not_found",
-      sessionId
-    });
-    return void 0;
-  }
-  const workspaceIds = resolution.runtimes.map(
-    (runtime) => runtime.workspaceId
-  );
-  daemonLog?.warn("session routing failed", {
-    route,
-    resolutionKind: "ambiguous",
-    sessionId,
-    workspaceIds,
-    ...details
-  });
-  res.status(500).json({
-    error: `Session owner is ambiguous for "${sessionId}"`,
-    code: "ambiguous_session_owner",
-    sessionId,
-    route,
-    workspaceIds
-  });
-  return void 0;
-}
-__name(requireSessionRuntime, "requireSessionRuntime");
-
-// packages/cli/src/serve/routes/permission.ts
-function registerPermissionRoutes(app, deps) {
-  const {
-    bridge,
-    workspaceRegistry,
-    daemonLog,
-    mutate,
-    sendPermissionVoteError: sendPermissionVoteError2
-  } = deps;
-  app.post("/session/:id/permission/:requestId", mutate(), (req, res) => {
-    const sessionId = req.params["id"];
-    const requestId = req.params["requestId"];
-    const response = parsePermissionVoteBody(req, res);
-    if (response === void 0) return;
-    const clientId = parseClientIdHeader(req, res);
-    if (clientId === null) return;
-    const fromLoopback = detectFromLoopback(req);
-    const context = {
-      ...clientId !== void 0 ? { clientId } : {},
-      fromLoopback
-    };
-    let accepted;
-    try {
-      const runtime = requireSessionRuntime({
-        sessionId,
-        route: "POST /session/:id/permission/:requestId",
-        res,
-        workspaceRegistry,
-        daemonLog,
-        details: { requestId }
-      });
-      if (!runtime) return;
-      accepted = runtime.bridge.respondToSessionPermission(
-        sessionId,
-        requestId,
-        response,
-        context
-      );
-    } catch (err) {
-      sendPermissionVoteError2(res, err, {
-        route: "POST /session/:id/permission/:requestId",
-        sessionId
-      });
-      return;
-    }
-    if (!accepted) {
-      res.status(404).json({
-        error: "No pending permission request for session",
-        sessionId,
-        requestId
-      });
-      return;
-    }
-    res.status(200).json({});
-  });
-  app.post("/permission/:requestId", mutate(), (req, res) => {
-    const requestId = req.params["requestId"];
-    const response = parsePermissionVoteBody(req, res);
-    if (response === void 0) return;
-    const clientId = parseClientIdHeader(req, res);
-    if (clientId === null) return;
-    const fromLoopback = detectFromLoopback(req);
-    const context = {
-      ...clientId !== void 0 ? { clientId } : {},
-      fromLoopback
-    };
-    let accepted;
-    try {
-      accepted = bridge.respondToPermission(requestId, response, context);
-    } catch (err) {
-      sendPermissionVoteError2(res, err, {
-        route: "POST /permission/:requestId"
-      });
-      return;
-    }
-    if (!accepted) {
-      res.status(404).json({ error: "No pending permission request", requestId });
-      return;
-    }
-    res.status(200).json({});
-  });
-}
-__name(registerPermissionRoutes, "registerPermissionRoutes");
-
-// packages/cli/src/serve/routes/session.ts
-init_esbuild_shims();
-import * as crypto3 from "node:crypto";
-import * as path11 from "node:path";
-
-// packages/cli/src/serve/server/prompt-deadline.ts
-init_esbuild_shims();
-var PromptDeadlineExceededError = class extends Error {
-  static {
-    __name(this, "PromptDeadlineExceededError");
-  }
-  deadlineMs;
-  constructor(deadlineMs) {
-    super(`prompt exceeded the ${deadlineMs}ms deadline`);
-    this.name = "PromptDeadlineExceededError";
-    this.deadlineMs = deadlineMs;
-  }
-};
-function resolvePromptDeadlineMs(serverMs, requestMs) {
-  if (serverMs === void 0 || !Number.isFinite(serverMs) || serverMs <= 0) {
-    return void 0;
-  }
-  if (requestMs === void 0 || !Number.isFinite(requestMs) || requestMs <= 0) {
-    return serverMs;
-  }
-  return Math.min(serverMs, requestMs);
-}
-__name(resolvePromptDeadlineMs, "resolvePromptDeadlineMs");
-
-// packages/cli/src/serve/server/session-list.ts
-init_esbuild_shims();
-var DEFAULT_SESSION_PAGE_SIZE = 20;
-var MAX_SESSION_PAGE_SIZE = 100;
-var MAX_ORGANIZED_SESSIONS = 5e4;
-var InvalidCursorError = class extends Error {
-  static {
-    __name(this, "InvalidCursorError");
+  return Math.min(serverMs, requestMs);
+}
+__name(resolvePromptDeadlineMs, "resolvePromptDeadlineMs");
+
+// packages/cli/src/serve/server/session-list.ts
+init_esbuild_shims();
+var DEFAULT_SESSION_PAGE_SIZE = 20;
+var MAX_SESSION_PAGE_SIZE = 100;
+var MAX_ORGANIZED_SESSIONS = 5e4;
+var InvalidCursorError = class extends Error {
+  static {
+    __name(this, "InvalidCursorError");
   }
   constructor(cursor, kind = "numeric") {
     super(`Invalid cursor: "${cursor}" is not a valid ${kind} cursor`);
@@ -19011,19 +18379,6 @@ function listLiveWorkspaceSessionsForResponse(bridge, workspaceCwd, options) {
   };
 }
 __name(listLiveWorkspaceSessionsForResponse, "listLiveWorkspaceSessionsForResponse");
-async function getWorkspaceSessionInfoForResponse(bridge, workspaceCwd, options = {}) {
-  const counts = await new SessionService(workspaceCwd).getSessionInfoCounts();
-  return {
-    active: counts.active,
-    archived: counts.archived,
-    total: counts.total,
-    ...options.includeLive === false ? {} : { live: bridge.listWorkspaceSessions(workspaceCwd).length },
-    expensive: true,
-    cost: "disk_scan",
-    ...counts.truncated ? { truncated: true } : {}
-  };
-}
-__name(getWorkspaceSessionInfoForResponse, "getWorkspaceSessionInfoForResponse");
 function parseSessionPageSizeQuery(raw) {
   if (typeof raw !== "string") return void 0;
   const trimmed = raw.trim();
@@ -19096,21 +18451,11 @@ async function exportSessionTranscript(params) {
 __name(exportSessionTranscript, "exportSessionTranscript");
 
 // packages/cli/src/serve/routes/session.ts
+var WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
 var GENERATION_HEARTBEAT_MS = 15e3;
-var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
-  "POST /session/:id/branch",
-  "POST /session/:id/fork",
-  "POST /session/:id/cd"
-];
-function isPrimaryOnlyLiveSessionRoute(route) {
-  return PRIMARY_ONLY_LIVE_SESSION_ROUTES.includes(
-    route
-  );
-}
-__name(isPrimaryOnlyLiveSessionRoute, "isPrimaryOnlyLiveSessionRoute");
 function formatGenerationSse(event, data) {
   return `event: ${event}
 data: ${JSON.stringify({ v: 1, ...data })}
@@ -19239,32 +18584,6 @@ function parseTranscriptCursorQuery(rawCursor, res) {
   return rawCursor;
 }
 __name(parseTranscriptCursorQuery, "parseTranscriptCursorQuery");
-function parseTranscriptRecordBoundaryQuery(rawBoundary, res) {
-  if (rawBoundary === void 0) return void 0;
-  if (typeof rawBoundary !== "string" || rawBoundary.trim() === "" || rawBoundary.length > 200) {
-    res.status(400).json({
-      error: "`beforeRecordId` must be a non-empty record id",
-      code: "invalid_transcript_cursor"
-    });
-    return null;
-  }
-  return rawBoundary;
-}
-__name(parseTranscriptRecordBoundaryQuery, "parseTranscriptRecordBoundaryQuery");
-function parseHistoryPageSize(body, res) {
-  const value = body["historyPageSize"];
-  if (value === void 0) return void 0;
-  if (!Number.isSafeInteger(value) || value < 1 || value > SESSION_TRANSCRIPT_MAX_LIMIT) {
-    res.status(400).json({
-      error: `\`historyPageSize\` must be between 1 and ${SESSION_TRANSCRIPT_MAX_LIMIT}`,
-      code: "invalid_transcript_limit",
-      maxLimit: SESSION_TRANSCRIPT_MAX_LIMIT
-    });
-    return null;
-  }
-  return value;
-}
-__name(parseHistoryPageSize, "parseHistoryPageSize");
 function workspaceTranscriptCursorExceedsLimit(cursor, maxBytes = WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES) {
   return Buffer.byteLength(cursor) > maxBytes;
 }
@@ -19386,7 +18705,6 @@ function registerSessionRoutes(app, deps) {
       return void 0;
     }
     if (workspaceRegistry.list().length === 1) {
-      setDaemonTelemetryWorkspace(res, workspaceRegistry.primary.workspaceCwd);
       return {
         runtime: workspaceRegistry.primary,
         workspaceCwd: "cwd" in body ? key : workspaceRegistry.primary.workspaceCwd
@@ -19402,7 +18720,6 @@ function registerSessionRoutes(app, deps) {
       sendWorkspaceMismatch2(res, key);
       return void 0;
     }
-    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
     if (!runtime.primary && !runtime.trusted) {
       logSessionRoutingFailure("POST /session", "untrusted_workspace", {
         workspaceId: runtime.workspaceId,
@@ -19655,7 +18972,6 @@ function registerSessionRoutes(app, deps) {
       sendWorkspaceMismatch2(res, key);
       return void 0;
     }
-    setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
     if (!runtime.primary && !runtime.trusted) {
       logSessionRoutingFailure(route, "untrusted_workspace", {
         workspaceId: runtime.workspaceId,
@@ -19693,7 +19009,7 @@ function registerSessionRoutes(app, deps) {
   }), "resolveLiveSessionRuntime");
   const sendNonPrimarySessionRouteUnsupported = /* @__PURE__ */ __name((res, route, sessionId, runtime) => {
     res.status(400).json({
-      error: `Route "${route}" is only available for primary workspace sessions.`,
+      error: `Route "${route}" is primary-only for non-primary workspace sessions in Phase 2a.`,
       code: "non_primary_session_route_not_supported",
       sessionId,
       workspaceId: runtime.workspaceId,
@@ -19741,7 +19057,6 @@ function registerSessionRoutes(app, deps) {
     }, "throwMissingActiveTranscript");
     if (workspaceRegistry.list().length === 1) {
       const runtime = workspaceRegistry.primary;
-      setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
       if (await activeInRuntime(runtime)) {
         return runtime;
       }
@@ -19753,7 +19068,6 @@ function registerSessionRoutes(app, deps) {
       return void 0;
     }
     if (liveOwner.kind === "found") {
-      setDaemonTelemetryWorkspace(res, liveOwner.runtime.workspaceCwd);
       if (!assertTrustedSessionOwner(res, route, sessionId, liveOwner.runtime)) {
         return void 0;
       }
@@ -19788,7 +19102,6 @@ function registerSessionRoutes(app, deps) {
     }
     if (activeRuntimes.length === 1) {
       const runtime = activeRuntimes[0];
-      setDaemonTelemetryWorkspace(res, runtime.workspaceCwd);
       if (!assertTrustedSessionOwner(res, route, sessionId, runtime)) {
         return void 0;
       }
@@ -19845,37 +19158,23 @@ function registerSessionRoutes(app, deps) {
     }
     return key;
   }, "resolveWorkspaceParam");
-  const withPrimaryOnlyMutableSession = /* @__PURE__ */ __name((route, handler) => {
-    if (!isPrimaryOnlyLiveSessionRoute(route)) {
-      throw new Error(`Unregistered primary-only session route: ${route}`);
+  const withMutableSession = /* @__PURE__ */ __name((route, handler) => async (req, res) => {
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(sessionId, res, route);
+    if (!runtime) return;
+    if (!runtime.primary) {
+      sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
+      return;
     }
-    return async (req, res) => {
-      const sessionId = requireSessionId(req, res);
-      if (sessionId === null) return;
-      const runtime = resolveLiveSessionRuntime(sessionId, res, route);
-      if (!runtime) return;
-      if (!runtime.primary) {
-        logSessionRoutingFailure(
-          route,
-          "non_primary_session_route_not_supported",
-          {
-            sessionId,
-            workspaceId: runtime.workspaceId,
-            workspaceCwd: runtime.workspaceCwd
-          }
-        );
-        sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
-        return;
-      }
-      try {
-        await archiveCoordinator.runSharedMany([sessionId], async () => {
-          await handler(req, res, sessionId);
-        });
-      } catch (err) {
-        sendBridgeError2(res, err, { route, sessionId });
-      }
-    };
-  }, "withPrimaryOnlyMutableSession");
+    try {
+      await archiveCoordinator.runSharedMany([sessionId], async () => {
+        await handler(req, res, sessionId);
+      });
+    } catch (err) {
+      sendBridgeError2(res, err, { route, sessionId });
+    }
+  }, "withMutableSession");
   app.post("/session", mutate(), async (req, res) => {
     const body = safeBody(req);
     const resolvedRuntime = resolveRuntimeForSessionCreation(body, res);
@@ -19986,11 +19285,6 @@ function registerSessionRoutes(app, deps) {
       releaseRestoreOwner();
       return;
     }
-    const historyPageSize = action === "load" ? parseHistoryPageSize(body ?? {}, res) : void 0;
-    if (historyPageSize === null) {
-      releaseRestoreOwner();
-      return;
-    }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) {
       releaseRestoreOwner();
@@ -20008,7 +19302,6 @@ function registerSessionRoutes(app, deps) {
             sessionId,
             workspaceCwd,
             historyReplay: "response",
-            ...historyPageSize !== void 0 ? { historyPageSize } : {},
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
             ...metadata
@@ -20052,7 +19345,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/branch",
     mutate(),
-    withPrimaryOnlyMutableSession(
+    withMutableSession(
       "POST /session/:id/branch",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -20087,7 +19380,7 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/fork",
     mutate(),
-    withPrimaryOnlyMutableSession(
+    withMutableSession(
       "POST /session/:id/fork",
       async (req, res, sessionId) => {
         const body = safeBody(req);
@@ -20113,28 +19406,25 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/cd",
     mutate(),
-    withPrimaryOnlyMutableSession(
-      "POST /session/:id/cd",
-      async (req, res, sessionId) => {
-        const body = safeBody(req);
-        const targetPath = body["path"];
-        if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
-          res.status(400).json({
-            error: "`path` is required and must be an absolute path",
-            code: "invalid_path"
-          });
-          return;
-        }
-        const clientId = parseClientIdHeader(req, res);
-        if (clientId === null) return;
-        const result = await bridge.changeSessionCwd(
-          sessionId,
-          { path: targetPath },
-          clientId !== void 0 ? { clientId } : void 0
-        );
-        res.status(200).json(result);
+    withMutableSession("POST /session/:id/cd", async (req, res, sessionId) => {
+      const body = safeBody(req);
+      const targetPath = body["path"];
+      if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
+        res.status(400).json({
+          error: "`path` is required and must be an absolute path",
+          code: "invalid_path"
+        });
+        return;
       }
-    )
+      const clientId = parseClientIdHeader(req, res);
+      if (clientId === null) return;
+      const result = await bridge.changeSessionCwd(
+        sessionId,
+        { path: targetPath },
+        clientId !== void 0 ? { clientId } : void 0
+      );
+      res.status(200).json(result);
+    })
   );
   app.get("/session/:id/status", (req, res) => {
     const sessionId = requireSessionId(req, res);
@@ -20192,18 +19482,6 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
-    const beforeRecordId = parseTranscriptRecordBoundaryQuery(
-      req.query["beforeRecordId"],
-      res
-    );
-    if (beforeRecordId === null) return;
-    if (cursor !== void 0 && beforeRecordId !== void 0) {
-      res.status(400).json({
-        error: "`cursor` and `beforeRecordId` are mutually exclusive",
-        code: "invalid_transcript_cursor"
-      });
-      return;
-    }
     try {
       const result = await archiveCoordinator.runSharedMany(
         [sessionId],
@@ -20218,8 +19496,7 @@ function registerSessionRoutes(app, deps) {
           return runtime.bridge.getSessionTranscriptPage({
             sessionId,
             ...limit !== void 0 ? { limit } : {},
-            ...cursor !== void 0 ? { cursor } : {},
-            ...beforeRecordId !== void 0 ? { beforeRecordId } : {}
+            ...cursor !== void 0 ? { cursor } : {}
           });
         }
       );
@@ -20254,18 +19531,6 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
-    const beforeRecordId = parseTranscriptRecordBoundaryQuery(
-      req.query["beforeRecordId"],
-      res
-    );
-    if (beforeRecordId === null) return;
-    if (cursor !== void 0 && beforeRecordId !== void 0) {
-      res.status(400).json({
-        error: "`cursor` and `beforeRecordId` are mutually exclusive",
-        code: "invalid_transcript_cursor"
-      });
-      return;
-    }
     if (cursor !== void 0 && workspaceTranscriptCursorExceedsLimit(cursor)) {
       res.status(400).json({
         error: "`cursor` exceeds the maximum size",
@@ -20290,8 +19555,7 @@ function registerSessionRoutes(app, deps) {
             page = await reader.readPage(sessionId, {
               ...limit !== void 0 ? { limit } : {},
               ...cursor !== void 0 ? { cursor } : {},
-              ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
-              maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
+              maxBytes: WORKSPACE_TRANSCRIPT_PAGE_SOURCE_MAX_BYTES
             });
           } catch (error2) {
             if (error2.code !== "ENOENT") {
@@ -21404,53 +20668,23 @@ function registerSessionRoutes(app, deps) {
         )} (options=${safeLogValue(
           JSON.stringify({
             view: req.query["view"],
-            archiveState: req.query["archiveState"],
-            group: req.query["group"]
-          })
-        )}): ${safeLogValue(
-          err instanceof Error ? err.message : String(err)
-        )}`
-      );
-      res.status(500).json({
-        error: "Failed to list sessions",
-        code: "session_list_failed"
-      });
-    }
-  }, "listWorkspaceSessionsHandler");
-  app.get("/workspace/:id/sessions", listWorkspaceSessionsHandler("id"));
-  app.get(
-    "/workspaces/:workspace/sessions",
-    listWorkspaceSessionsHandler("workspace")
-  );
-  const workspaceSessionInfoHandler = /* @__PURE__ */ __name((paramName) => async (req, res) => {
-    const route = paramName === "workspace" ? "GET /workspaces/:workspace/session-info" : "GET /workspace/:id/session-info";
-    const runtime = resolveRuntimeForCatalogRoute(req, res, paramName, route);
-    if (runtime === null) return;
-    const key = runtime.workspaceCwd;
-    try {
-      const info = await runWorkspaceInspectionWithLogPolicy(
-        runtime,
-        () => getWorkspaceSessionInfoForResponse(runtime.bridge, key, {
-          includeLive: !isReadOnlyWorkspaceInspection(runtime)
-        })
-      );
-      res.status(200).json(info);
-    } catch (err) {
-      writeStderrLine(
-        `qwen serve: failed to read session-info for workspace ${safeLogValue(
-          key
-        )}: ${safeLogValue(err instanceof Error ? err.message : String(err))}`
+            archiveState: req.query["archiveState"],
+            group: req.query["group"]
+          })
+        )}): ${safeLogValue(
+          err instanceof Error ? err.message : String(err)
+        )}`
       );
       res.status(500).json({
-        error: "Failed to read session info",
-        code: "session_info_failed"
+        error: "Failed to list sessions",
+        code: "session_list_failed"
       });
     }
-  }, "workspaceSessionInfoHandler");
-  app.get("/workspace/:id/session-info", workspaceSessionInfoHandler("id"));
+  }, "listWorkspaceSessionsHandler");
+  app.get("/workspace/:id/sessions", listWorkspaceSessionsHandler("id"));
   app.get(
-    "/workspaces/:workspace/session-info",
-    workspaceSessionInfoHandler("workspace")
+    "/workspaces/:workspace/sessions",
+    listWorkspaceSessionsHandler("workspace")
   );
   app.post(
     "/session/:id/model",
@@ -23954,7 +23188,7 @@ function sendBridgeError(res, err, ctx, daemonLog) {
   if (err instanceof WorkspaceSkillNotToggleableError) {
     res.status(409).json({
       error: err.message,
-      code: err.reason === "inactive_extension" ? "skill_inactive_extension" : "skill_not_toggleable",
+      code: "skill_not_toggleable",
       skillName: err.skillName,
       reason: err.reason,
       ...err.lockedScope ? { lockedScope: err.lockedScope } : {}
@@ -24157,7 +23391,7 @@ function sendBridgeError(res, err, ctx, daemonLog) {
   }
   if (err instanceof WorkspaceMismatchError) {
     writeStderrLine(
-      `qwen serve: workspace_mismatch (POST /session): runtime bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
+      `qwen serve: workspace_mismatch (POST /session): daemon bound to ${JSON.stringify(err.bound)}, rejected ${JSON.stringify(err.requested)}`
     );
     res.status(400).json({
       error: err.message,
@@ -24352,17 +23586,6 @@ function sendBridgeError(res, err, ctx, daemonLog) {
         });
         return;
       }
-      if (kind === "transcript_page_too_large") {
-        const d = data;
-        res.status(413).json({
-          error: errorMessage2(err),
-          code: "transcript_page_too_large",
-          ...d.sessionId ? { sessionId: d.sessionId } : {},
-          ...typeof d.pageBytes === "number" ? { pageBytes: d.pageBytes } : {},
-          ...typeof d.maxBytes === "number" ? { maxBytes: d.maxBytes } : {}
-        });
-        return;
-      }
     }
   }
   recordDaemonBridgeError(err);
@@ -25100,55 +24323,358 @@ function resolveBoundWorkspacesFromIdeEnv(primaryWorkspace, ideWorkspacePath = p
       );
     }
   }
-  if (envCanonicals.length > 0 && !envCanonicals.some(
-    (workspace) => isWithinRoot2(primary, workspace) || isWithinRoot2(workspace, primary)
-  )) {
-    writeStderrLine(
-      "qwen serve: ignoring stale IDE workspace paths that do not overlap the selected workspace"
-    );
-    return [primary];
+  if (envCanonicals.length > 0 && !envCanonicals.some(
+    (workspace) => isWithinRoot2(primary, workspace) || isWithinRoot2(workspace, primary)
+  )) {
+    writeStderrLine(
+      "qwen serve: ignoring stale IDE workspace paths that do not overlap the selected workspace"
+    );
+    return [primary];
+  }
+  const workspaces = [primary, ...envCanonicals.filter((w) => w !== primary)];
+  const filteredWorkspaces = includeWorkspace === void 0 ? workspaces : workspaces.filter(includeWorkspace);
+  return dropNestedWorkspacesPreservingPrimary(filteredWorkspaces);
+}
+__name(resolveBoundWorkspacesFromIdeEnv, "resolveBoundWorkspacesFromIdeEnv");
+function parseIdeWorkspacePathEnv(value) {
+  if (value === void 0 || value.length === 0) return [];
+  if (value.trimStart().startsWith("[")) {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
+        return parsed.filter(
+          (workspace) => workspace.length > 0 && path14.isAbsolute(workspace)
+        );
+      }
+      throw new Error("IDE workspace path JSON must be a string array");
+    } catch {
+    }
+  }
+  return value.split(path14.delimiter).filter((workspace) => workspace.length > 0 && path14.isAbsolute(workspace));
+}
+__name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
+function dropNestedWorkspacesPreservingPrimary(workspaces) {
+  const primary = workspaces[0];
+  if (primary === void 0) return [];
+  const withoutPrimaryOverlaps = workspaces.filter(
+    (workspace, i) => i === 0 || workspace !== primary && !isWithinRoot2(workspace, primary) && !isWithinRoot2(primary, workspace)
+  );
+  const filtered = withoutPrimaryOverlaps.filter(
+    (workspace, i) => i === 0 || !withoutPrimaryOverlaps.some(
+      (other, j) => i !== j && j !== 0 && workspace !== other && isWithinRoot2(workspace, other)
+    )
+  );
+  if (filtered.length < workspaces.length) {
+    writeStderrLine(
+      "qwen serve: dropping nested IDE workspace roots (parent folders already cover children)"
+    );
+  }
+  return filtered;
+}
+__name(dropNestedWorkspacesPreservingPrimary, "dropNestedWorkspacesPreservingPrimary");
+
+// packages/cli/src/serve/server/telemetry.ts
+init_esbuild_shims();
+function decodePathSegment(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+__name(decodePathSegment, "decodePathSegment");
+function resolveDaemonTelemetryRoute(req) {
+  const path15 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "POST" && path15 === "/session") {
+    return { route: "POST /session" };
+  }
+  if (req.method === "POST" && path15 === "/sessions/delete") {
+    return { route: "POST /sessions/delete" };
+  }
+  if (req.method === "GET" && path15 === "/daemon/status") {
+    return { route: "GET /daemon/status" };
+  }
+  const rewindSnapshots = path15.match(/^\/session\/([^/]+)\/rewind\/snapshots$/);
+  if (rewindSnapshots?.[1] && req.method === "GET") {
+    return {
+      route: "GET /session/:id/rewind/snapshots",
+      sessionId: rewindSnapshots[1]
+    };
+  }
+  const sessionAction = path15.match(
+    /^\/session\/([^/]+)\/(load|resume|prompt|cancel|recap|btw|mid-turn-message|model|shell|detach|rewind|approval-mode|language|a2ui-action)$/
+  );
+  const sessionActionId = sessionAction?.[1];
+  const sessionActionName = sessionAction?.[2];
+  if (sessionActionId && sessionActionName && req.method === "POST") {
+    return {
+      route: `POST /session/:id/${sessionActionName}`,
+      sessionId: sessionActionId
+    };
+  }
+  const sessionMetadata = path15.match(/^\/session\/([^/]+)\/metadata$/);
+  if (sessionMetadata?.[1] && req.method === "PATCH") {
+    return {
+      route: "PATCH /session/:id/metadata",
+      sessionId: sessionMetadata[1]
+    };
+  }
+  const sessionArtifacts = path15.match(/^\/session\/([^/]+)\/artifacts$/);
+  if (sessionArtifacts?.[1]) {
+    if (req.method === "GET") {
+      return {
+        route: "GET /session/:id/artifacts",
+        sessionId: sessionArtifacts[1]
+      };
+    }
+    if (req.method === "POST") {
+      return {
+        route: "POST /session/:id/artifacts",
+        sessionId: sessionArtifacts[1]
+      };
+    }
+  }
+  const sessionArtifact = path15.match(
+    /^\/session\/([^/]+)\/artifacts\/([^/]+)$/
+  );
+  if (sessionArtifact?.[1] && req.method === "DELETE") {
+    return {
+      route: "DELETE /session/:id/artifacts/:artifactId",
+      sessionId: sessionArtifact[1]
+    };
+  }
+  const sessionPermission = path15.match(
+    /^\/session\/([^/]+)\/permission\/([^/]+)$/
+  );
+  if (sessionPermission?.[1] && sessionPermission?.[2] && req.method === "POST") {
+    const rawRequestId = sessionPermission[2];
+    return {
+      route: "POST /session/:id/permission/:requestId",
+      sessionId: sessionPermission[1],
+      ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
+    };
+  }
+  const globalPermission = path15.match(/^\/permission\/([^/]+)$/);
+  if (globalPermission?.[1] && req.method === "POST") {
+    const rawRequestId = globalPermission[1];
+    return {
+      route: "POST /permission/:requestId",
+      ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
+    };
+  }
+  const deleteSession = path15.match(/^\/session\/([^/]+)$/);
+  const deleteSessionId = deleteSession?.[1];
+  if (deleteSessionId && req.method === "DELETE") {
+    return { route: "DELETE /session/:id", sessionId: deleteSessionId };
+  }
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
+    return { route: "GET /workspace/:id/sessions" };
+  }
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
+    return { route: "GET /workspace/:id/sessions" };
+  }
+  const workspaceTranscript = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
+  );
+  if (workspaceTranscript?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/transcript",
+      sessionId: workspaceTranscript[1]
+    };
+  }
+  const workspaceExport = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
+  );
+  if (workspaceExport?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/export",
+      sessionId: workspaceExport[1]
+    };
+  }
+  const workspaceArchivedExport = path15.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
+  );
+  if (workspaceArchivedExport?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/archive/export",
+      sessionId: workspaceArchivedExport[1]
+    };
+  }
+  const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
+  if (pluralWorkspacePrefix.test(path15)) {
+    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
+    if (req.method === "GET") {
+      if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
+        return { route: `GET ${suffix}` };
+      }
+      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+        return { route: "GET /workspace/agents/:agentType" };
+      }
+      if (suffix === "/workspace/file") return { route: "GET /file" };
+      if (suffix === "/workspace/file/bytes") {
+        return { route: "GET /file/bytes" };
+      }
+      if (suffix === "/workspace/stat") return { route: "GET /stat" };
+      if (suffix === "/workspace/list") return { route: "GET /list" };
+      if (suffix === "/workspace/glob") return { route: "GET /glob" };
+      if (/^\/workspace\/mcp\/[^/]+\/tools$/.test(suffix)) {
+        return { route: "GET /workspace/mcp/:server/tools" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/resources$/.test(suffix)) {
+        return { route: "GET /workspace/mcp/:server/resources" };
+      }
+    }
+    if (req.method === "POST") {
+      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
+        return { route: `POST ${suffix}` };
+      }
+      if (/^\/workspace\/tools\/[^/]+\/enable$/.test(suffix)) {
+        return { route: "POST /workspace/tools/:name/enable" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/restart$/.test(suffix)) {
+        return { route: "POST /workspace/mcp/:server/restart" };
+      }
+      if (/^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+        return { route: "POST /workspace/agents/:agentType" };
+      }
+      if (/^\/workspace\/mcp\/[^/]+\/(approve|enable|disable|authenticate|clear-auth)$/.test(
+        suffix
+      )) {
+        return {
+          route: `POST /workspace/mcp/:server/${suffix.split("/").at(-1)}`
+        };
+      }
+    }
+    if (req.method === "DELETE" && /^\/workspace\/mcp\/servers\/[^/]+$/.test(suffix)) {
+      return { route: "DELETE /workspace/mcp/servers/:name" };
+    }
+    if (req.method === "DELETE" && /^\/workspace\/agents\/[^/]+$/.test(suffix)) {
+      return { route: "DELETE /workspace/agents/:agentType" };
+    }
+    if (suffix === "/workspace/session-groups" && req.method === "GET") {
+      return { route: "GET /workspace/session-groups" };
+    }
+    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "PATCH") {
+      return { route: "PATCH /workspace/session-groups/:groupId" };
+    }
+    if (/^\/workspace\/session-groups\/[^/]+$/.test(suffix) && req.method === "DELETE") {
+      return { route: "DELETE /workspace/session-groups/:groupId" };
+    }
+  }
+  if (req.method === "POST" && path15 === "/workspace/init") {
+    return { route: "POST /workspace/init" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/setup-github") {
+    return { route: "POST /workspace/setup-github" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/reload") {
+    return { route: "POST /workspace/reload" };
+  }
+  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  if (mcpRestart?.[1] && req.method === "POST") {
+    return { route: "POST /workspace/mcp/:server/restart" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
+    return { route: "POST /workspace/mcp/servers" };
+  }
+  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  if (mcpDelete?.[1] && req.method === "DELETE") {
+    return { route: "DELETE /workspace/mcp/servers/:name" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
+    return { route: "POST /workspace/auth/device-flow" };
+  }
+  const deviceFlowDelete = path15.match(
+    /^\/workspace\/auth\/device-flow\/([^/]+)$/
+  );
+  if (deviceFlowDelete?.[1] && req.method === "DELETE") {
+    return { route: "DELETE /workspace/auth/device-flow/:id" };
+  }
+  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  if (toolEnable?.[1] && req.method === "POST") {
+    return { route: "POST /workspace/tools/:name/enable" };
+  }
+  if (path15 === "/workspace/settings") {
+    if (req.method === "GET") return { route: "GET /workspace/settings" };
+    if (req.method === "POST") return { route: "POST /workspace/settings" };
+  }
+  if (path15 === "/workspace/permissions") {
+    if (req.method === "GET") return { route: "GET /workspace/permissions" };
+    if (req.method === "POST") return { route: "POST /workspace/permissions" };
+  }
+  if (path15 === "/workspace/trust") {
+    if (req.method === "GET") return { route: "GET /workspace/trust" };
+  }
+  if (req.method === "POST" && path15 === "/workspace/trust/request") {
+    return { route: "POST /workspace/trust/request" };
+  }
+  if (path15 === "/workspace/voice") {
+    if (req.method === "GET") return { route: "GET /workspace/voice" };
+    if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  const workspaces = [primary, ...envCanonicals.filter((w) => w !== primary)];
-  const filteredWorkspaces = includeWorkspace === void 0 ? workspaces : workspaces.filter(includeWorkspace);
-  return dropNestedWorkspacesPreservingPrimary(filteredWorkspaces);
-}
-__name(resolveBoundWorkspacesFromIdeEnv, "resolveBoundWorkspacesFromIdeEnv");
-function parseIdeWorkspacePathEnv(value) {
-  if (value === void 0 || value.length === 0) return [];
-  if (value.trimStart().startsWith("[")) {
-    try {
-      const parsed = JSON.parse(value);
-      if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
-        return parsed.filter(
-          (workspace) => workspace.length > 0 && path14.isAbsolute(workspace)
-        );
-      }
-      throw new Error("IDE workspace path JSON must be a string array");
-    } catch {
-    }
+  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
+    return { route: "POST /workspace/voice/transcribe" };
   }
-  return value.split(path14.delimiter).filter((workspace) => workspace.length > 0 && path14.isAbsolute(workspace));
+  return void 0;
 }
-__name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
-function dropNestedWorkspacesPreservingPrimary(workspaces) {
-  const primary = workspaces[0];
-  if (primary === void 0) return [];
-  const withoutPrimaryOverlaps = workspaces.filter(
-    (workspace, i) => i === 0 || workspace !== primary && !isWithinRoot2(workspace, primary) && !isWithinRoot2(primary, workspace)
-  );
-  const filtered = withoutPrimaryOverlaps.filter(
-    (workspace, i) => i === 0 || !withoutPrimaryOverlaps.some(
-      (other, j) => i !== j && j !== 0 && workspace !== other && isWithinRoot2(workspace, other)
-    )
-  );
-  if (filtered.length < workspaces.length) {
-    writeStderrLine(
-      "qwen serve: dropping nested IDE workspace roots (parent folders already cover children)"
-    );
-  }
-  return filtered;
+__name(resolveDaemonTelemetryRoute, "resolveDaemonTelemetryRoute");
+function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest, resolveSessionWorkspaceCwd) {
+  const workspaceHashByCwd = /* @__PURE__ */ new Map();
+  const resolveWorkspaceHash = /* @__PURE__ */ __name((workspaceCwd) => {
+    const existing = workspaceHashByCwd.get(workspaceCwd);
+    if (existing !== void 0) return existing;
+    const workspaceHash = hashDaemonWorkspace(workspaceCwd);
+    workspaceHashByCwd.set(workspaceCwd, workspaceHash);
+    return workspaceHash;
+  }, "resolveWorkspaceHash");
+  return (req, res, next) => {
+    const route = resolveDaemonTelemetryRoute(req);
+    if (!route) {
+      next();
+      return;
+    }
+    const resolveOwnerWorkspace = route.route === "GET /session/:id/rewind/snapshots" || route.route === "POST /session/:id/rewind" || route.route === "POST /session/:id/shell";
+    const sessionId = route.sessionId ? decodePathSegment(route.sessionId) : void 0;
+    const workspaceCwd = (resolveOwnerWorkspace && sessionId ? resolveSessionWorkspaceCwd?.(sessionId) : void 0) ?? resolveWorkspaceCwd(req);
+    const workspaceHash = resolveWorkspaceHash(workspaceCwd);
+    const rawClientId = req.get(CLIENT_ID_HEADER);
+    const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
+    const startMs = Date.now();
+    void withDaemonRequestSpan(
+      {
+        method: req.method,
+        route: route.route,
+        workspaceHash,
+        ...sessionId ? { sessionId } : {},
+        ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
+        ...clientId ? { clientId } : {}
+      },
+      async (span) => await new Promise((resolve5, reject) => {
+        let done = false;
+        const finish = /* @__PURE__ */ __name(() => {
+          if (done) return;
+          done = true;
+          recordDaemonHttpResponse(span, res.statusCode);
+          const durationMs = Date.now() - startMs;
+          recordDaemonHttpRequest(durationMs, route.route, res.statusCode);
+          if (route.route !== "GET /daemon/status") {
+            recordRequest?.(durationMs, res.statusCode);
+          }
+          resolve5();
+        }, "finish");
+        res.once("finish", finish);
+        res.once("close", finish);
+        try {
+          next();
+        } catch (error2) {
+          recordDaemonError(span, error2);
+          reject(error2);
+        }
+      })
+    ).catch(next);
+  };
 }
-__name(dropNestedWorkspacesPreservingPrimary, "dropNestedWorkspacesPreservingPrimary");
+__name(daemonTelemetryMiddleware, "daemonTelemetryMiddleware");
 
 // packages/cli/src/serve/server/access-log.ts
 init_esbuild_shims();
@@ -25673,10 +25199,9 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 
 // packages/cli/src/serve/routes/workspace-management.ts
 init_esbuild_shims();
-import { readdir, stat } from "node:fs/promises";
+import { stat } from "node:fs/promises";
 import { realpathSync } from "node:fs";
-import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join7, resolve as resolve4, sep as sep3 } from "node:path";
-var MAX_PATH_SUGGESTIONS = 50;
+import { isAbsolute as isAbsolute7, resolve as resolve4 } from "node:path";
 function registerWorkspaceManagementRoutes(app, deps) {
   const {
     workspaceRegistry,
@@ -25706,72 +25231,6 @@ function registerWorkspaceManagementRoutes(app, deps) {
       code: "daemon_shutting_down"
     });
   }, "sendSealed");
-  app.get(
-    "/workspace-path-suggestions",
-    async (req, res) => {
-      const prefixRaw = req.query["prefix"];
-      if (typeof prefixRaw !== "string" || prefixRaw.trim().length === 0) {
-        res.status(400).json({
-          error: "`prefix` must be a non-empty string",
-          code: "invalid_prefix"
-        });
-        return;
-      }
-      const prefix = prefixRaw;
-      if (prefix.length > MAX_WORKSPACE_PATH_LENGTH) {
-        res.status(400).json({
-          error: `\`prefix\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`,
-          code: "invalid_prefix"
-        });
-        return;
-      }
-      if (!isAbsolute7(prefix)) {
-        res.status(400).json({
-          error: "`prefix` must be an absolute path",
-          code: "invalid_prefix"
-        });
-        return;
-      }
-      const endsWithSep = prefix.endsWith("/") || process.platform === "win32" && prefix.endsWith("\\");
-      const dir = endsWithSep ? join7(prefix, ".") : dirname4(prefix);
-      const filter = endsWithSep ? "" : basename4(prefix);
-      const filterLower = filter.toLowerCase();
-      const suggestions = [];
-      let truncated = false;
-      try {
-        const entries = await readdir(dir, { withFileTypes: true });
-        entries.sort((a, b) => a.name.localeCompare(b.name));
-        for (const entry of entries) {
-          if (entry.name.startsWith(".") && !filter.startsWith(".")) continue;
-          if (filter && !entry.name.toLowerCase().startsWith(filterLower)) {
-            continue;
-          }
-          let isDir = entry.isDirectory();
-          if (!isDir && entry.isSymbolicLink()) {
-            try {
-              isDir = (await stat(join7(dir, entry.name))).isDirectory();
-            } catch {
-              continue;
-            }
-          }
-          if (!isDir) continue;
-          if (suggestions.length >= MAX_PATH_SUGGESTIONS) {
-            truncated = true;
-            break;
-          }
-          suggestions.push({ name: entry.name, path: join7(dir, entry.name) });
-        }
-      } catch {
-      }
-      res.status(200).json({
-        kind: "workspace-path-suggestions",
-        dir,
-        sep: sep3,
-        suggestions,
-        truncated
-      });
-    }
-  );
   app.post(
     "/workspaces",
     mutate({ strict: true }),
@@ -27463,9 +26922,9 @@ function parseSkillToggleRequest(req, res, safeBody2) {
     });
     return void 0;
   }
-  if (skillName.length > MAX_WORKSPACE_SKILL_NAME_LENGTH) {
+  if (skillName.length > MAX_SKILL_NAME_LENGTH) {
     res.status(400).json({
-      error: `Skill name exceeds ${MAX_WORKSPACE_SKILL_NAME_LENGTH}-character limit`,
+      error: `Skill name exceeds ${MAX_SKILL_NAME_LENGTH}-character limit`,
       code: "invalid_skill_name"
     });
     return void 0;
@@ -27481,138 +26940,11 @@ function parseSkillToggleRequest(req, res, safeBody2) {
   return { skillName, enabled };
 }
 __name(parseSkillToggleRequest, "parseSkillToggleRequest");
-function parseSkillScope(value, res) {
-  if (value === "workspace" || value === "global") return value;
-  res.status(400).json({
-    error: '`scope` must be "workspace" or "global"',
-    code: "invalid_skill_scope"
-  });
-  return void 0;
-}
-__name(parseSkillScope, "parseSkillScope");
-function parseSkillInstallRequest(req, res, safeBody2) {
-  const body = safeBody2(req);
-  const name = body["name"];
-  if (typeof name !== "string" || !name.trim()) {
-    res.status(400).json({
-      error: "`name` is required and must be a string",
-      code: "invalid_skill_name"
-    });
-    return void 0;
-  }
-  if (name.trim().length > MAX_WORKSPACE_SKILL_NAME_LENGTH) {
-    res.status(400).json({
-      error: `Skill name exceeds ${MAX_WORKSPACE_SKILL_NAME_LENGTH}-character limit`,
-      code: "invalid_skill_name"
-    });
-    return void 0;
-  }
-  const scope = parseSkillScope(body["scope"], res);
-  if (!scope) return void 0;
-  const rawSource = body["source"];
-  if (!rawSource || typeof rawSource !== "object" || Array.isArray(rawSource)) {
-    res.status(400).json({
-      error: "`source` is required",
-      code: "invalid_skill_source"
-    });
-    return void 0;
-  }
-  const source = rawSource;
-  if (source["type"] === "github" && typeof source["url"] === "string") {
-    return { name, scope, source: { type: "github", url: source["url"] } };
-  }
-  if (source["type"] === "zip" && typeof source["contentBase64"] === "string") {
-    return {
-      name,
-      scope,
-      source: { type: "zip", contentBase64: source["contentBase64"] }
-    };
-  }
-  if (source["type"] === "folder" && typeof source["path"] === "string") {
-    return {
-      name,
-      scope,
-      source: { type: "folder", path: source["path"] }
-    };
-  }
-  res.status(400).json({
-    error: "Invalid Skill install source",
-    code: "invalid_skill_source"
-  });
-  return void 0;
-}
-__name(parseSkillInstallRequest, "parseSkillInstallRequest");
-function parseDeleteScope(req, res) {
-  return parseSkillScope(req.query["scope"], res);
-}
-__name(parseDeleteScope, "parseDeleteScope");
-function sendSkillManagementError(res, error2) {
-  if (!(error2 instanceof WorkspaceSkillManagementError)) return false;
-  res.status(error2.statusCode).json({
-    error: error2.message,
-    code: error2.code
-  });
-  return true;
-}
-__name(sendSkillManagementError, "sendSkillManagementError");
 function registerWorkspaceSkillsRoutes(app, deps) {
   const buildWorkspaceCtx = createBuildWorkspaceCtx(
     deps.workspaceRuntime.workspaceCwd
   );
   const route = "POST /workspace/skills/:name/enable";
-  app.post(
-    "/workspace/skills/install",
-    deps.mutate({ strict: true }),
-    async (req, res) => {
-      if (!requireTrustedWorkspaceRuntime(deps.workspaceRuntime, res)) return;
-      const input = parseSkillInstallRequest(req, res, deps.safeBody);
-      if (!input) return;
-      const clientId = deps.parseAndValidateClientId(req, res);
-      if (clientId === null) return;
-      const installRoute = "POST /workspace/skills/install";
-      try {
-        const result = await deps.workspaceRuntime.workspaceService.installWorkspaceSkill(
-          buildWorkspaceCtx(installRoute, clientId),
-          input
-        );
-        res.status(200).json(result);
-      } catch (err) {
-        if (!sendSkillManagementError(res, err))
-          deps.sendBridgeError(res, err, { route: installRoute });
-      }
-    }
-  );
-  app.delete(
-    "/workspace/skills/:name",
-    deps.mutate({ strict: true }),
-    async (req, res) => {
-      if (!requireTrustedWorkspaceRuntime(deps.workspaceRuntime, res)) return;
-      const rawSkillName = req.params["name"];
-      const scope = parseDeleteScope(req, res);
-      if (!rawSkillName || !scope) return;
-      let skillName;
-      try {
-        skillName = validateWorkspaceSkillName(rawSkillName);
-      } catch (error2) {
-        sendSkillManagementError(res, error2);
-        return;
-      }
-      const clientId = deps.parseAndValidateClientId(req, res);
-      if (clientId === null) return;
-      const deleteRoute = "DELETE /workspace/skills/:name";
-      try {
-        const result = await deps.workspaceRuntime.workspaceService.deleteWorkspaceSkill(
-          buildWorkspaceCtx(deleteRoute, clientId),
-          skillName,
-          scope
-        );
-        res.status(200).json(result);
-      } catch (err) {
-        if (!sendSkillManagementError(res, err))
-          deps.sendBridgeError(res, err, { route: deleteRoute });
-      }
-    }
-  );
   app.post(
     "/workspace/skills/:name/enable",
     deps.mutate({ strict: true }),
@@ -27638,77 +26970,6 @@ function registerWorkspaceSkillsRoutes(app, deps) {
 __name(registerWorkspaceSkillsRoutes, "registerWorkspaceSkillsRoutes");
 function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
   const route = "POST /workspaces/:workspace/skills/:name/enable";
-  app.post(
-    "/workspaces/:workspace/skills/install",
-    deps.mutate({ strict: true }),
-    async (req, res) => {
-      const runtime = resolveWorkspaceRuntimeFromParam(
-        deps.workspaceRegistry,
-        req,
-        res
-      );
-      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
-      const input = parseSkillInstallRequest(req, res, deps.safeBody);
-      if (!input) return;
-      const clientId = parseAndValidateWorkspaceClientId(
-        req,
-        res,
-        runtime.bridge
-      );
-      if (clientId === null) return;
-      const installRoute = "POST /workspaces/:workspace/skills/install";
-      try {
-        const result = await runtime.workspaceService.installWorkspaceSkill(
-          createBuildWorkspaceCtx(runtime.workspaceCwd)(installRoute, clientId),
-          input
-        );
-        res.status(200).json(result);
-      } catch (err) {
-        if (!sendSkillManagementError(res, err))
-          deps.sendBridgeError(res, err, { route: installRoute });
-      }
-    }
-  );
-  app.delete(
-    "/workspaces/:workspace/skills/:name",
-    deps.mutate({ strict: true }),
-    async (req, res) => {
-      const runtime = resolveWorkspaceRuntimeFromParam(
-        deps.workspaceRegistry,
-        req,
-        res
-      );
-      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
-      const rawSkillName = req.params["name"];
-      const scope = parseDeleteScope(req, res);
-      if (!rawSkillName || !scope) return;
-      let skillName;
-      try {
-        skillName = validateWorkspaceSkillName(rawSkillName);
-      } catch (error2) {
-        sendSkillManagementError(res, error2);
-        return;
-      }
-      const clientId = parseAndValidateWorkspaceClientId(
-        req,
-        res,
-        runtime.bridge
-      );
-      if (clientId === null) return;
-      const deleteRoute = "DELETE /workspaces/:workspace/skills/:name";
-      try {
-        const result = await runtime.workspaceService.deleteWorkspaceSkill(
-          createBuildWorkspaceCtx(runtime.workspaceCwd)(deleteRoute, clientId),
-          skillName,
-          scope
-        );
-        res.status(200).json(result);
-      } catch (err) {
-        if (!sendSkillManagementError(res, err))
-          deps.sendBridgeError(res, err, { route: deleteRoute });
-      }
-    }
-  );
   app.post(
     "/workspaces/:workspace/skills/:name/enable",
     deps.mutate({ strict: true }),
@@ -28223,7 +27484,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       primaryEffectiveEnv ? { env: primaryEffectiveEnv } : {}
     ),
     workspaceSkillsStatusProvider: createWorkspaceSkillsStatusProvider(),
-    ...primaryEffectiveEnv ? { skillInstallEnv: primaryEffectiveEnv } : {},
     ...primaryEffectiveEnv ? { voiceEnv: primaryEffectiveEnv } : {},
     isChannelLive: /* @__PURE__ */ __name(() => bridge.isChannelLive(), "isChannelLive"),
     persistDisabledTools: deps.persistDisabledTools ?? (async () => {
@@ -28268,8 +27528,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   );
   app.locals.workspaceRegistry = workspaceRegistry;
   const primaryRuntime = workspaceRegistry.primary;
-  const daemonEnv = deps.daemonEnv ?? process.env;
-  const primaryRuntimeEffectiveEnv = getRuntimeEffectiveEnv(primaryRuntime.env) ?? daemonEnv;
   const voiceCoordinator = deps.voiceCoordinator ?? new WorkspaceVoiceCoordinator();
   const primaryBoundWorkspace = primaryRuntime.workspaceCwd;
   const primaryBridge = primaryRuntime.bridge;
@@ -28359,27 +27617,38 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     requireAuth: opts.requireAuth === true
   });
   app.use(
-    daemonTelemetryMiddleware((req) => {
-      const match = req.path.match(/^\/workspaces\/([^/]+)/);
-      const rawSelector = match?.[1];
-      if (rawSelector) {
-        try {
-          const selector = decodeURIComponent(rawSelector);
-          const byId = workspaceRegistry.getByWorkspaceId(selector);
-          if (byId) return byId.workspaceCwd;
-          if (isPortableAbsolutePath(selector)) {
-            const runtime = resolveRegisteredWorkspaceRuntimeByPathSelector(
-              workspaceRegistry,
-              selector
-            );
-            if (runtime) return runtime.workspaceCwd;
+    daemonTelemetryMiddleware(
+      (req) => {
+        const match = req.path.match(/^\/workspaces\/([^/]+)/);
+        const rawSelector = match?.[1];
+        if (rawSelector) {
+          try {
+            const selector = decodeURIComponent(rawSelector);
+            const byId = workspaceRegistry.getByWorkspaceId(selector);
+            if (byId) return byId.workspaceCwd;
+            if (isPortableAbsolutePath(selector)) {
+              const runtime = resolveRegisteredWorkspaceRuntimeByPathSelector(
+                workspaceRegistry,
+                selector
+              );
+              if (runtime) return runtime.workspaceCwd;
+            }
+          } catch {
+            return primaryBoundWorkspace;
           }
+        }
+        return primaryBoundWorkspace;
+      },
+      deps.recordDaemonRequest,
+      (sessionId) => {
+        try {
+          const owner = workspaceRegistry.resolveLiveSessionOwner(sessionId);
+          return owner.kind === "found" ? owner.runtime.workspaceCwd : void 0;
         } catch {
-          return primaryBoundWorkspace;
+          return void 0;
         }
       }
-      return primaryBoundWorkspace;
-    }, deps.recordDaemonRequest)
+    )
   );
   const buildWorkspaceCtx = createBuildWorkspaceCtx(primaryBoundWorkspace);
   const acpHandleRef = {};
@@ -28521,7 +27790,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   registerWorkspaceSetupGithubRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
-    env: primaryRuntimeEffectiveEnv,
     mutate,
     parseClientId: parseClientIdHeader,
     safeBody
@@ -28818,7 +28086,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   });
   acpHandleRef.current = mountAcpHttp(app, primaryBridge, {
     boundWorkspace: primaryBoundWorkspace,
-    daemonEnv,
     // Phase 4 (issue #6378): pass the registry so `/workspaces/:workspace/acp`
     // mounts a per-runtime ACP dispatcher for each registered workspace.
     workspaceRegistry,
@@ -28890,7 +28157,6 @@ export {
   createServeApp,
   detectFromLoopback,
   getActiveSseCount,
-  getWorkspaceSessionInfoForResponse,
   listWorkspaceSessionsForResponse,
   resolveBoundWorkspacesFromIdeEnv,
   resolveBridgeFsFactory,