@qwen-code/qwen-code 0.19.2 → 0.19.3-nightly.20260630.e00fe6a27

package/chunks/{chunk-FPACXT7T.js → chunk-MTJVHQDP.js}

@@ -6,6 +6,15 @@ import {
 import {
   require_mime_db
 } from "./chunk-7RYW5LQV.js";
+import {
+  CLIENT_MCP_OVER_WS_CONFIG_FLAG
+} from "./chunk-EWALXUAD.js";
+import {
+  MAX_WORKSPACE_PATH_LENGTH
+} from "./chunk-SEZC2725.js";
+import {
+  writeStderrLine
+} from "./chunk-Y6Z2O3WR.js";
 import {
   require_once
 } from "./chunk-5P5XGNYH.js";
@@ -9060,11 +9069,11 @@ var require_mime_types = __commonJS({
       return exts[0];
     }
     __name(extension, "extension");
-    function lookup(path2) {
-      if (!path2 || typeof path2 !== "string") {
+    function lookup(path3) {
+      if (!path3 || typeof path3 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path2).toLowerCase().slice(1);
+      var extension2 = extname("x." + path3).toLowerCase().slice(1);
       if (!extension2) {
         return false;
       }
@@ -10195,13 +10204,13 @@ var require_view = __commonJS({
     "use strict";
     init_esbuild_shims();
     var debug = require_src()("express:view");
-    var path2 = __require("node:path");
+    var path3 = __require("node:path");
     var fs = __require("node:fs");
-    var dirname2 = path2.dirname;
-    var basename2 = path2.basename;
-    var extname = path2.extname;
-    var join2 = path2.join;
-    var resolve = path2.resolve;
+    var dirname2 = path3.dirname;
+    var basename2 = path3.basename;
+    var extname = path3.extname;
+    var join2 = path3.join;
+    var resolve = path3.resolve;
     module.exports = View;
     function View(name, options) {
       var opts = options || {};
@@ -10231,17 +10240,17 @@ var require_view = __commonJS({
     }
     __name(View, "View");
     View.prototype.lookup = /* @__PURE__ */ __name(function lookup(name) {
-      var path3;
+      var path4;
       var roots = [].concat(this.root);
       debug('lookup "%s"', name);
-      for (var i = 0; i < roots.length && !path3; i++) {
+      for (var i = 0; i < roots.length && !path4; i++) {
         var root = roots[i];
         var loc = resolve(root, name);
         var dir = dirname2(loc);
         var file = basename2(loc);
-        path3 = this.resolve(dir, file);
+        path4 = this.resolve(dir, file);
       }
-      return path3;
+      return path4;
     }, "lookup");
     View.prototype.render = /* @__PURE__ */ __name(function render(options, callback) {
       var sync = true;
@@ -10263,21 +10272,21 @@ var require_view = __commonJS({
     }, "render");
     View.prototype.resolve = /* @__PURE__ */ __name(function resolve2(dir, file) {
       var ext = this.ext;
-      var path3 = join2(dir, file);
-      var stat = tryStat(path3);
+      var path4 = join2(dir, file);
+      var stat = tryStat(path4);
       if (stat && stat.isFile()) {
-        return path3;
+        return path4;
       }
-      path3 = join2(dir, basename2(file, ext), "index" + ext);
-      stat = tryStat(path3);
+      path4 = join2(dir, basename2(file, ext), "index" + ext);
+      stat = tryStat(path4);
       if (stat && stat.isFile()) {
-        return path3;
+        return path4;
       }
     }, "resolve");
-    function tryStat(path3) {
-      debug('stat "%s"', path3);
+    function tryStat(path4) {
+      debug('stat "%s"', path4);
       try {
-        return fs.statSync(path3);
+        return fs.statSync(path4);
       } catch (e) {
         return void 0;
       }
@@ -11467,9 +11476,9 @@ var require_dist2 = __commonJS({
       function consume(endType) {
         const tokens2 = [];
         while (true) {
-          const path2 = it.text();
-          if (path2)
-            tokens2.push({ type: "text", value: encodePath(path2) });
+          const path3 = it.text();
+          if (path3)
+            tokens2.push({ type: "text", value: encodePath(path3) });
           const param = it.tryConsume("PARAM");
           if (param) {
             tokens2.push({
@@ -11503,16 +11512,16 @@ var require_dist2 = __commonJS({
       return new TokenData(tokens);
     }
     __name(parse, "parse");
-    function compile(path2, options = {}) {
+    function compile(path3, options = {}) {
       const { encode = encodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const data = path2 instanceof TokenData ? path2 : parse(path2, options);
+      const data = path3 instanceof TokenData ? path3 : parse(path3, options);
       const fn = tokensToFunction(data.tokens, delimiter, encode);
-      return /* @__PURE__ */ __name(function path3(data2 = {}) {
-        const [path4, ...missing] = fn(data2);
+      return /* @__PURE__ */ __name(function path4(data2 = {}) {
+        const [path5, ...missing] = fn(data2);
         if (missing.length) {
           throw new TypeError(`Missing parameters: ${missing.join(", ")}`);
         }
-        return path4;
+        return path5;
       }, "path");
     }
     __name(compile, "compile");
@@ -11571,9 +11580,9 @@ var require_dist2 = __commonJS({
       };
     }
     __name(tokenToFunction, "tokenToFunction");
-    function match(path2, options = {}) {
+    function match(path3, options = {}) {
       const { decode = decodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const { regexp, keys } = pathToRegexp(path2, options);
+      const { regexp, keys } = pathToRegexp(path3, options);
       const decoders = keys.map((key) => {
         if (decode === false)
           return NOOP_VALUE;
@@ -11585,7 +11594,7 @@ var require_dist2 = __commonJS({
         const m = regexp.exec(input);
         if (!m)
           return false;
-        const path3 = m[0];
+        const path4 = m[0];
         const params = /* @__PURE__ */ Object.create(null);
         for (let i = 1; i < m.length; i++) {
           if (m[i] === void 0)
@@ -11594,17 +11603,17 @@ var require_dist2 = __commonJS({
           const decoder = decoders[i - 1];
           params[key.name] = decoder(m[i]);
         }
-        return { path: path3, params };
+        return { path: path4, params };
       }, "match");
     }
     __name(match, "match");
-    function pathToRegexp(path2, options = {}) {
+    function pathToRegexp(path3, options = {}) {
       const { delimiter = DEFAULT_DELIMITER, end = true, sensitive = false, trailing = true } = options;
       const keys = [];
       const sources = [];
       const flags = sensitive ? "" : "i";
-      const paths = Array.isArray(path2) ? path2 : [path2];
-      const items = paths.map((path3) => path3 instanceof TokenData ? path3 : parse(path3, options));
+      const paths = Array.isArray(path3) ? path3 : [path3];
+      const items = paths.map((path4) => path4 instanceof TokenData ? path4 : parse(path4, options));
       for (const { tokens } of items) {
         for (const seq of flatten(tokens, 0, [])) {
           const regexp2 = sequenceToRegExp(seq, delimiter, keys);
@@ -11722,18 +11731,18 @@ var require_layer = __commonJS({
     var TRAILING_SLASH_REGEXP = /\/+$/;
     var MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g;
     module.exports = Layer;
-    function Layer(path2, options, fn) {
+    function Layer(path3, options, fn) {
       if (!(this instanceof Layer)) {
-        return new Layer(path2, options, fn);
+        return new Layer(path3, options, fn);
       }
-      debug("new %o", path2);
+      debug("new %o", path3);
       const opts = options || {};
       this.handle = fn;
       this.keys = [];
       this.name = fn.name || "<anonymous>";
       this.params = void 0;
       this.path = void 0;
-      this.slash = path2 === "/" && opts.end === false;
+      this.slash = path3 === "/" && opts.end === false;
       function matcher(_path) {
         if (_path instanceof RegExp) {
           const keys = [];
@@ -11773,7 +11782,7 @@ var require_layer = __commonJS({
         });
       }
       __name(matcher, "matcher");
-      this.matchers = Array.isArray(path2) ? path2.map(matcher) : [matcher(path2)];
+      this.matchers = Array.isArray(path3) ? path3.map(matcher) : [matcher(path3)];
     }
     __name(Layer, "Layer");
     Layer.prototype.handleError = /* @__PURE__ */ __name(function handleError(error, req, res, next) {
@@ -11814,9 +11823,9 @@ var require_layer = __commonJS({
         next(err);
       }
     }, "handleRequest");
-    Layer.prototype.match = /* @__PURE__ */ __name(function match(path2) {
+    Layer.prototype.match = /* @__PURE__ */ __name(function match(path3) {
       let match2;
-      if (path2 != null) {
+      if (path3 != null) {
         if (this.slash) {
           this.params = {};
           this.path = "";
@@ -11824,7 +11833,7 @@ var require_layer = __commonJS({
         }
         let i = 0;
         while (!match2 && i < this.matchers.length) {
-          match2 = this.matchers[i](path2);
+          match2 = this.matchers[i](path3);
           i++;
         }
       }
@@ -11853,13 +11862,13 @@ var require_layer = __commonJS({
       }
     }
     __name(decodeParam, "decodeParam");
-    function loosen(path2) {
-      if (path2 instanceof RegExp || path2 === "/") {
-        return path2;
+    function loosen(path3) {
+      if (path3 instanceof RegExp || path3 === "/") {
+        return path3;
       }
-      return Array.isArray(path2) ? path2.map(function(p) {
+      return Array.isArray(path3) ? path3.map(function(p) {
         return loosen(p);
-      }) : String(path2).replace(TRAILING_SLASH_REGEXP, "");
+      }) : String(path3).replace(TRAILING_SLASH_REGEXP, "");
     }
     __name(loosen, "loosen");
   }
@@ -11877,9 +11886,9 @@ var require_route = __commonJS({
     var flatten = Array.prototype.flat;
     var methods = METHODS.map((method) => method.toLowerCase());
     module.exports = Route;
-    function Route(path2) {
-      debug("new %o", path2);
-      this.path = path2;
+    function Route(path3) {
+      debug("new %o", path3);
+      this.path = path3;
       this.stack = [];
       this.methods = /* @__PURE__ */ Object.create(null);
     }
@@ -12092,8 +12101,8 @@ var require_router = __commonJS({
         if (++sync > 100) {
           return setImmediate(next, err);
         }
-        const path2 = getPathname(req);
-        if (path2 == null) {
+        const path3 = getPathname(req);
+        if (path3 == null) {
           return done(layerError);
         }
         let layer;
@@ -12101,7 +12110,7 @@ var require_router = __commonJS({
         let route;
         while (match !== true && idx < stack.length) {
           layer = stack[idx++];
-          match = matchLayer(layer, path2);
+          match = matchLayer(layer, path3);
           route = layer.route;
           if (typeof match !== "boolean") {
             layerError = layerError || match;
@@ -12139,19 +12148,19 @@ var require_router = __commonJS({
           } else if (route) {
             layer.handleRequest(req, res, next);
           } else {
-            trimPrefix(layer, layerError, layerPath, path2);
+            trimPrefix(layer, layerError, layerPath, path3);
           }
           sync = 0;
         });
       }
       __name(next, "next");
-      function trimPrefix(layer, layerError, layerPath, path2) {
+      function trimPrefix(layer, layerError, layerPath, path3) {
         if (layerPath.length !== 0) {
-          if (layerPath !== path2.substring(0, layerPath.length)) {
+          if (layerPath !== path3.substring(0, layerPath.length)) {
             next(layerError);
             return;
           }
-          const c = path2[layerPath.length];
+          const c = path3[layerPath.length];
           if (c && c !== "/") {
             next(layerError);
             return;
@@ -12176,7 +12185,7 @@ var require_router = __commonJS({
     }, "handle");
     Router.prototype.use = /* @__PURE__ */ __name(function use(handler) {
       let offset = 0;
-      let path2 = "/";
+      let path3 = "/";
       if (typeof handler !== "function") {
         let arg = handler;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -12184,7 +12193,7 @@ var require_router = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path2 = handler;
+          path3 = handler;
         }
       }
       const callbacks = flatten.call(slice.call(arguments, offset), Infinity);
@@ -12196,8 +12205,8 @@ var require_router = __commonJS({
         if (typeof fn !== "function") {
           throw new TypeError("argument handler must be a function");
         }
-        debug("use %o %s", path2, fn.name || "<anonymous>");
-        const layer = new Layer(path2, {
+        debug("use %o %s", path3, fn.name || "<anonymous>");
+        const layer = new Layer(path3, {
           sensitive: this.caseSensitive,
           strict: false,
           end: false
@@ -12207,9 +12216,9 @@ var require_router = __commonJS({
       }
       return this;
     }, "use");
-    Router.prototype.route = /* @__PURE__ */ __name(function route(path2) {
-      const route2 = new Route(path2);
-      const layer = new Layer(path2, {
+    Router.prototype.route = /* @__PURE__ */ __name(function route(path3) {
+      const route2 = new Route(path3);
+      const layer = new Layer(path3, {
         sensitive: this.caseSensitive,
         strict: this.strict,
         end: true
@@ -12223,8 +12232,8 @@ var require_router = __commonJS({
       return route2;
     }, "route");
     methods.concat("all").forEach(function(method) {
-      Router.prototype[method] = function(path2) {
-        const route = this.route(path2);
+      Router.prototype[method] = function(path3) {
+        const route = this.route(path3);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
@@ -12256,9 +12265,9 @@ var require_router = __commonJS({
       return fqdnIndex !== -1 ? url.substring(0, url.indexOf("/", 3 + fqdnIndex)) : void 0;
     }
     __name(getProtohost, "getProtohost");
-    function matchLayer(layer, path2) {
+    function matchLayer(layer, path3) {
       try {
-        return layer.match(path2);
+        return layer.match(path3);
       } catch (err) {
         return err;
       }
@@ -12496,7 +12505,7 @@ var require_application = __commonJS({
     }, "handle");
     app.use = /* @__PURE__ */ __name(function use(fn) {
       var offset = 0;
-      var path2 = "/";
+      var path3 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -12504,7 +12513,7 @@ var require_application = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path2 = fn;
+          path3 = fn;
         }
       }
       var fns = flatten.call(slice.call(arguments, offset), Infinity);
@@ -12514,12 +12523,12 @@ var require_application = __commonJS({
       var router = this.router;
       fns.forEach(function(fn2) {
         if (!fn2 || !fn2.handle || !fn2.set) {
-          return router.use(path2, fn2);
+          return router.use(path3, fn2);
         }
-        debug(".use app under %s", path2);
-        fn2.mountpath = path2;
+        debug(".use app under %s", path3);
+        fn2.mountpath = path3;
         fn2.parent = this;
-        router.use(path2, /* @__PURE__ */ __name(function mounted_app(req, res, next) {
+        router.use(path3, /* @__PURE__ */ __name(function mounted_app(req, res, next) {
           var orig = req.app;
           fn2.handle(req, res, function(err) {
             Object.setPrototypeOf(req, orig.request);
@@ -12531,8 +12540,8 @@ var require_application = __commonJS({
       }, this);
       return this;
     }, "use");
-    app.route = /* @__PURE__ */ __name(function route(path2) {
-      return this.router.route(path2);
+    app.route = /* @__PURE__ */ __name(function route(path3) {
+      return this.router.route(path3);
     }, "route");
     app.engine = /* @__PURE__ */ __name(function engine(ext, fn) {
       if (typeof fn !== "function") {
@@ -12575,7 +12584,7 @@ var require_application = __commonJS({
       }
       return this;
     }, "set");
-    app.path = /* @__PURE__ */ __name(function path2() {
+    app.path = /* @__PURE__ */ __name(function path3() {
       return this.parent ? this.parent.path() + this.mountpath : "";
     }, "path");
     app.enabled = /* @__PURE__ */ __name(function enabled(setting) {
@@ -12591,17 +12600,17 @@ var require_application = __commonJS({
       return this.set(setting, false);
     }, "disable");
     methods.forEach(function(method) {
-      app[method] = function(path2) {
+      app[method] = function(path3) {
         if (method === "get" && arguments.length === 1) {
-          return this.set(path2);
+          return this.set(path3);
         }
-        var route = this.route(path2);
+        var route = this.route(path3);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
     });
-    app.all = /* @__PURE__ */ __name(function all(path2) {
-      var route = this.route(path2);
+    app.all = /* @__PURE__ */ __name(function all(path3) {
+      var route = this.route(path3);
       var args = slice.call(arguments, 1);
       for (var i = 0; i < methods.length; i++) {
         route[methods[i]].apply(route, args);
@@ -13571,7 +13580,7 @@ var require_request = __commonJS({
       var subdomains2 = !isIP(hostname) ? hostname.split(".").reverse() : [hostname];
       return subdomains2.slice(offset);
     }, "subdomains"));
-    defineGetter(req, "path", /* @__PURE__ */ __name(function path2() {
+    defineGetter(req, "path", /* @__PURE__ */ __name(function path3() {
       return parse(this).pathname;
     }, "path"));
     defineGetter(req, "host", /* @__PURE__ */ __name(function host() {
@@ -13794,8 +13803,8 @@ var require_content_disposition = __commonJS({
       this.parameters = parameters;
     }
     __name(ContentDisposition, "ContentDisposition");
-    function basename2(path2) {
-      const normalized = path2.replaceAll("\\", "/");
+    function basename2(path3) {
+      const normalized = path3.replaceAll("\\", "/");
       let end = normalized.length;
       while (end > 0 && normalized[end - 1] === "/") {
         end--;
@@ -14055,28 +14064,28 @@ var require_send = __commonJS({
     var ms = require_ms();
     var onFinished = require_on_finished();
     var parseRange = require_range_parser();
-    var path2 = __require("path");
+    var path3 = __require("path");
     var statuses = require_statuses();
     var Stream = __require("stream");
     var util = __require("util");
-    var extname = path2.extname;
-    var join2 = path2.join;
-    var normalize = path2.normalize;
-    var resolve = path2.resolve;
-    var sep = path2.sep;
+    var extname = path3.extname;
+    var join2 = path3.join;
+    var normalize = path3.normalize;
+    var resolve = path3.resolve;
+    var sep = path3.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
     module.exports = send;
-    function send(req, path3, options) {
-      return new SendStream(req, path3, options);
+    function send(req, path4, options) {
+      return new SendStream(req, path4, options);
     }
     __name(send, "send");
-    function SendStream(req, path3, options) {
+    function SendStream(req, path4, options) {
       Stream.call(this);
       var opts = options || {};
       this.options = opts;
-      this.path = path3;
+      this.path = path4;
       this.req = req;
       this._acceptRanges = opts.acceptRanges !== void 0 ? Boolean(opts.acceptRanges) : true;
       this._cacheControl = opts.cacheControl !== void 0 ? Boolean(opts.cacheControl) : true;
@@ -14191,10 +14200,10 @@ var require_send = __commonJS({
       var lastModified = this.res.getHeader("Last-Modified");
       return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
     }, "isRangeFresh");
-    SendStream.prototype.redirect = /* @__PURE__ */ __name(function redirect(path3) {
+    SendStream.prototype.redirect = /* @__PURE__ */ __name(function redirect(path4) {
       var res = this.res;
       if (hasListeners(this, "directory")) {
-        this.emit("directory", res, path3);
+        this.emit("directory", res, path4);
         return;
       }
       if (this.hasTrailingSlash()) {
@@ -14214,38 +14223,38 @@ var require_send = __commonJS({
     SendStream.prototype.pipe = /* @__PURE__ */ __name(function pipe(res) {
       var root = this._root;
       this.res = res;
-      var path3 = decode(this.path);
-      if (path3 === -1) {
+      var path4 = decode(this.path);
+      if (path4 === -1) {
         this.error(400);
         return res;
       }
-      if (~path3.indexOf("\0")) {
+      if (~path4.indexOf("\0")) {
         this.error(400);
         return res;
       }
       var parts;
       if (root !== null) {
-        if (path3) {
-          path3 = normalize("." + sep + path3);
+        if (path4) {
+          path4 = normalize("." + sep + path4);
         }
-        if (UP_PATH_REGEXP.test(path3)) {
-          debug('malicious path "%s"', path3);
+        if (UP_PATH_REGEXP.test(path4)) {
+          debug('malicious path "%s"', path4);
           this.error(403);
           return res;
         }
-        parts = path3.split(sep);
-        path3 = normalize(join2(root, path3));
+        parts = path4.split(sep);
+        path4 = normalize(join2(root, path4));
       } else {
-        if (UP_PATH_REGEXP.test(path3)) {
-          debug('malicious path "%s"', path3);
+        if (UP_PATH_REGEXP.test(path4)) {
+          debug('malicious path "%s"', path4);
           this.error(403);
           return res;
         }
-        parts = normalize(path3).split(sep);
-        path3 = resolve(path3);
+        parts = normalize(path4).split(sep);
+        path4 = resolve(path4);
       }
       if (containsDotFile(parts)) {
-        debug('%s dotfile "%s"', this._dotfiles, path3);
+        debug('%s dotfile "%s"', this._dotfiles, path4);
         switch (this._dotfiles) {
           case "allow":
             break;
@@ -14259,13 +14268,13 @@ var require_send = __commonJS({
         }
       }
       if (this._index.length && this.hasTrailingSlash()) {
-        this.sendIndex(path3);
+        this.sendIndex(path4);
         return res;
       }
-      this.sendFile(path3);
+      this.sendFile(path4);
       return res;
     }, "pipe");
-    SendStream.prototype.send = /* @__PURE__ */ __name(function send2(path3, stat) {
+    SendStream.prototype.send = /* @__PURE__ */ __name(function send2(path4, stat) {
       var len = stat.size;
       var options = this.options;
       var opts = {};
@@ -14277,9 +14286,9 @@ var require_send = __commonJS({
         this.headersAlreadySent();
         return;
       }
-      debug('pipe "%s"', path3);
-      this.setHeader(path3, stat);
-      this.type(path3);
+      debug('pipe "%s"', path4);
+      this.setHeader(path4, stat);
+      this.type(path4);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
           this.error(412);
@@ -14328,28 +14337,28 @@ var require_send = __commonJS({
         res.end();
         return;
       }
-      this.stream(path3, opts);
+      this.stream(path4, opts);
     }, "send");
-    SendStream.prototype.sendFile = /* @__PURE__ */ __name(function sendFile(path3) {
+    SendStream.prototype.sendFile = /* @__PURE__ */ __name(function sendFile(path4) {
       var i = 0;
       var self = this;
-      debug('stat "%s"', path3);
-      fs.stat(path3, /* @__PURE__ */ __name(function onstat(err, stat) {
-        var pathEndsWithSep = path3[path3.length - 1] === sep;
-        if (err && err.code === "ENOENT" && !extname(path3) && !pathEndsWithSep) {
+      debug('stat "%s"', path4);
+      fs.stat(path4, /* @__PURE__ */ __name(function onstat(err, stat) {
+        var pathEndsWithSep = path4[path4.length - 1] === sep;
+        if (err && err.code === "ENOENT" && !extname(path4) && !pathEndsWithSep) {
           return next(err);
         }
         if (err) return self.onStatError(err);
-        if (stat.isDirectory()) return self.redirect(path3);
+        if (stat.isDirectory()) return self.redirect(path4);
         if (pathEndsWithSep) return self.error(404);
-        self.emit("file", path3, stat);
-        self.send(path3, stat);
+        self.emit("file", path4, stat);
+        self.send(path4, stat);
       }, "onstat"));
       function next(err) {
         if (self._extensions.length <= i) {
           return err ? self.onStatError(err) : self.error(404);
         }
-        var p = path3 + "." + self._extensions[i++];
+        var p = path4 + "." + self._extensions[i++];
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -14360,7 +14369,7 @@ var require_send = __commonJS({
       }
       __name(next, "next");
     }, "sendFile");
-    SendStream.prototype.sendIndex = /* @__PURE__ */ __name(function sendIndex(path3) {
+    SendStream.prototype.sendIndex = /* @__PURE__ */ __name(function sendIndex(path4) {
       var i = -1;
       var self = this;
       function next(err) {
@@ -14368,7 +14377,7 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join2(path3, self._index[i]);
+        var p = join2(path4, self._index[i]);
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -14380,10 +14389,10 @@ var require_send = __commonJS({
       __name(next, "next");
       next();
     }, "sendIndex");
-    SendStream.prototype.stream = /* @__PURE__ */ __name(function stream(path3, options) {
+    SendStream.prototype.stream = /* @__PURE__ */ __name(function stream(path4, options) {
       var self = this;
       var res = this.res;
-      var stream2 = fs.createReadStream(path3, options);
+      var stream2 = fs.createReadStream(path4, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -14399,17 +14408,17 @@ var require_send = __commonJS({
         self.emit("end");
       }, "onend"));
     }, "stream");
-    SendStream.prototype.type = /* @__PURE__ */ __name(function type(path3) {
+    SendStream.prototype.type = /* @__PURE__ */ __name(function type(path4) {
       var res = this.res;
       if (res.getHeader("Content-Type")) return;
-      var ext = extname(path3);
+      var ext = extname(path4);
       var type2 = mime.contentType(ext) || "application/octet-stream";
       debug("content-type %s", type2);
       res.setHeader("Content-Type", type2);
     }, "type");
-    SendStream.prototype.setHeader = /* @__PURE__ */ __name(function setHeader(path3, stat) {
+    SendStream.prototype.setHeader = /* @__PURE__ */ __name(function setHeader(path4, stat) {
       var res = this.res;
-      this.emit("headers", res, path3, stat);
+      this.emit("headers", res, path4, stat);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -14473,9 +14482,9 @@ var require_send = __commonJS({
       return err instanceof Error ? createError(status, err, { expose: false }) : createError(status, err);
     }
     __name(createHttpError, "createHttpError");
-    function decode(path3) {
+    function decode(path4) {
       try {
-        return decodeURIComponent(path3);
+        return decodeURIComponent(path4);
       } catch (err) {
         return -1;
       }
@@ -14630,7 +14639,7 @@ var require_response = __commonJS({
     var http = __require("node:http");
     var onFinished = require_on_finished();
     var mime = require_mime_types();
-    var path2 = __require("node:path");
+    var path3 = __require("node:path");
     var pathIsAbsolute = __require("node:path").isAbsolute;
     var statuses = require_statuses();
     var sign = require_cookie_signature().sign;
@@ -14639,8 +14648,8 @@ var require_response = __commonJS({
     var setCharset = require_utils2().setCharset;
     var cookie = require_cookie();
     var send = require_send();
-    var extname = path2.extname;
-    var resolve = path2.resolve;
+    var extname = path3.extname;
+    var resolve = path3.resolve;
     var vary = require_vary();
     var { Buffer: Buffer2 } = __require("node:buffer");
     var res = Object.create(http.ServerResponse.prototype);
@@ -14786,26 +14795,26 @@ var require_response = __commonJS({
       this.type("txt");
       return this.send(body);
     }, "sendStatus");
-    res.sendFile = /* @__PURE__ */ __name(function sendFile(path3, options, callback) {
+    res.sendFile = /* @__PURE__ */ __name(function sendFile(path4, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
       var next = req.next;
       var opts = options || {};
-      if (!path3) {
+      if (!path4) {
         throw new TypeError("path argument is required to res.sendFile");
       }
-      if (typeof path3 !== "string") {
+      if (typeof path4 !== "string") {
         throw new TypeError("path must be a string to res.sendFile");
       }
       if (typeof options === "function") {
         done = options;
         opts = {};
       }
-      if (!opts.root && !pathIsAbsolute(path3)) {
+      if (!opts.root && !pathIsAbsolute(path4)) {
         throw new TypeError("path must be absolute or specify root to res.sendFile");
       }
-      var pathname = encodeURI(path3);
+      var pathname = encodeURI(path4);
       opts.etag = this.app.enabled("etag");
       var file = send(req, pathname, opts);
       sendfile(res2, file, opts, function(err) {
@@ -14816,7 +14825,7 @@ var require_response = __commonJS({
         }
       });
     }, "sendFile");
-    res.download = /* @__PURE__ */ __name(function download(path3, filename, options, callback) {
+    res.download = /* @__PURE__ */ __name(function download(path4, filename, options, callback) {
       var done = callback;
       var name = filename;
       var opts = options || null;
@@ -14833,7 +14842,7 @@ var require_response = __commonJS({
         opts = filename;
       }
       var headers = {
-        "Content-Disposition": contentDisposition(name || path3)
+        "Content-Disposition": contentDisposition(name || path4)
       };
       if (opts && opts.headers) {
         var keys = Object.keys(opts.headers);
@@ -14846,7 +14855,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve(path3) : path3;
+      var fullPath = !opts.root ? resolve(path4) : path4;
       return this.sendFile(fullPath, opts, done);
     }, "download");
     res.contentType = res.type = /* @__PURE__ */ __name(function contentType(type) {
@@ -15139,11 +15148,11 @@ var require_serve_static = __commonJS({
         }
         var forwardError = !fallthrough;
         var originalUrl = parseUrl.original(req);
-        var path2 = parseUrl(req).pathname;
-        if (path2 === "/" && originalUrl.pathname.substr(-1) !== "/") {
-          path2 = "";
+        var path3 = parseUrl(req).pathname;
+        if (path3 === "/" && originalUrl.pathname.substr(-1) !== "/") {
+          path3 = "";
         }
-        var stream = send(req, path2, opts);
+        var stream = send(req, path3, opts);
         stream.on("directory", onDirectory);
         if (setHeaders) {
           stream.on("headers", setHeaders);
@@ -16173,13 +16182,14 @@ function parseAllowOriginPatterns(raw) {
     } catch {
       throw new InvalidAllowOriginPatternError(entry, "not a parseable URL");
     }
-    if (parsed.origin !== entry) {
+    const canonical = parsed.origin === "null" ? `${parsed.protocol}//${parsed.host}` : parsed.origin;
+    if (canonical !== entry) {
       throw new InvalidAllowOriginPatternError(
         entry,
-        `expected the canonical origin ${JSON.stringify(parsed.origin)} without trailing slash, path, userinfo, or query`
+        `expected the canonical origin ${JSON.stringify(canonical)} without trailing slash, path, userinfo, or query`
       );
     }
-    origins.add(parsed.origin.toLowerCase());
+    origins.add(canonical.toLowerCase());
   }
   return { allowAny, origins };
 }
@@ -16308,6 +16318,98 @@ function createMutationGate(deps) {
 }
 __name(createMutationGate, "createMutationGate");
 
+// packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
+init_esbuild_shims();
+var ClientMcpSenderRegistry = class {
+  static {
+    __name(this, "ClientMcpSenderRegistry");
+  }
+  senders = /* @__PURE__ */ new Map();
+  /**
+   * Record a server's WS sender, owned by `owner` (the registering
+   * connection's stable client id). Idempotent; last writer wins and takes
+   * ownership, so the new owner's `delete` is the one that takes effect.
+   */
+  set(serverName, sender, owner) {
+    this.senders.set(serverName, { sender, owner });
+  }
+  /**
+   * Forget a server's WS sender — but only when `owner` still owns the entry.
+   * Idempotent. The ownership guard stops a disconnecting connection from
+   * clobbering an entry a later connection re-registered under the same name.
+   */
+  delete(serverName, owner) {
+    if (this.senders.get(serverName)?.owner === owner) {
+      this.senders.delete(serverName);
+    }
+  }
+  /** Whether `owner` currently owns the entry for `serverName`. */
+  owns(serverName, owner) {
+    return this.senders.get(serverName)?.owner === owner;
+  }
+  /** Currently-registered server names (tests / accounting). */
+  serverNames() {
+    return [...this.senders.keys()];
+  }
+  /**
+   * The {@link ClientMcpMessageSender} the bridge consumes. Returns a
+   * `(payload) => Promise<payload>` bound to the named server, or `undefined`
+   * when no client currently hosts it. The bridge passes a `JSONRPCMessage` as
+   * `payload`; we keep the public type `unknown` to match the bridge's
+   * SDK-free contract.
+   */
+  lookup = /* @__PURE__ */ __name((serverName) => {
+    const entry = this.senders.get(serverName);
+    if (!entry) return void 0;
+    return (payload) => entry.sender(serverName, payload);
+  }, "lookup");
+};
+function createClientMcpServerProvider(registry, bridge, originatorClientId) {
+  return {
+    async registerClientMcpServer(serverName, sendSdkMcpMessage) {
+      registry.set(serverName, sendSdkMcpMessage, originatorClientId);
+      try {
+        const runtimeConfig = {
+          // SDK-type so the child binds `SdkControlClientTransport`
+          // (`isSdkMcpServerConfig`); the flag tells the child to KEEP the
+          // type and bind `sendSdkMcpMessage` to the reverse ext-method.
+          type: "sdk",
+          [CLIENT_MCP_OVER_WS_CONFIG_FLAG]: true
+        };
+        const result = await bridge.addRuntimeMcpServer(
+          serverName,
+          runtimeConfig,
+          originatorClientId
+        );
+        if (result.skipped) {
+          registry.delete(serverName, originatorClientId);
+          throw new Error(
+            `runtime MCP add skipped: ${result.reason ?? "unknown"}`
+          );
+        }
+        if (result.shadowedSettings) {
+          await bridge.removeRuntimeMcpServer(serverName, originatorClientId).catch(() => {
+          });
+          throw new Error(
+            `client MCP server '${serverName}' conflicts with a configured MCP server`
+          );
+        }
+        return { toolCount: result.toolCount };
+      } catch (err) {
+        registry.delete(serverName, originatorClientId);
+        throw err;
+      }
+    },
+    async unregisterClientMcpServer(serverName) {
+      if (!registry.owns(serverName, originatorClientId)) return;
+      registry.delete(serverName, originatorClientId);
+      await bridge.removeRuntimeMcpServer(serverName, originatorClientId).catch(() => {
+      });
+    }
+  };
+}
+__name(createClientMcpServerProvider, "createClientMcpServerProvider");
+
 // packages/cli/src/serve/capabilities.ts
 init_esbuild_shims();
 var SERVE_PROTOCOL_VERSION = "v1";
@@ -16367,6 +16469,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_tasks: { since: "v1" },
   session_stats: { since: "v1" },
   session_lsp: { since: "v1" },
+  session_status: { since: "v1" },
   session_close: { since: "v1" },
   session_metadata: { since: "v1" },
   // Daemon supports the MCP client guardrail surface: an in-process
@@ -16416,7 +16519,17 @@ var SERVE_CAPABILITY_REGISTRY = {
   // (`tools.disabled` is consulted at `Config` construction time).
   workspace_tool_toggle: { since: "v1" },
   workspace_settings: { since: "v1" },
+  // `GET /workspace/permissions` is always available when this tag is
+  // advertised. `POST /workspace/permissions` updates the active ACP
+  // child and returns `permission_session_required` when no live ACP
+  // session exists; the tag means the route contract exists, not that
+  // the current daemon state can accept a write.
   workspace_permissions: { since: "v1" },
+  workspace_voice: { since: "v1" },
+  workspace_voice_transcription: { since: "v1", modes: ["batch"] },
+  // Inspect bound workspace trust and request local operator action.
+  // Remote clients cannot directly write trustedFolders.json.
+  workspace_trust: { since: "v1" },
   // `POST /workspace/init` scaffolds an empty
   // `QWEN.md` (or whatever `getCurrentGeminiMdFilename()` returns) at
   // the bound workspace root. Body: `{force?: boolean}`. Default
@@ -16425,6 +16538,11 @@ var SERVE_CAPABILITY_REGISTRY = {
   // the file, the caller should follow up with
   // `POST /session/:id/prompt`.
   workspace_init: { since: "v1" },
+  // `POST /workspace/setup-github` installs the fixed
+  // qwen-code-action workflow set into the bound workspace after
+  // explicit consent. The route reuses the interactive `/setup-github`
+  // release lookup, workflow download, and `.gitignore` update logic.
+  workspace_github_setup: { since: "v1" },
   // `POST /workspace/mcp/:server/restart` performs
   // a single-server MCP restart (disconnect + reconnect + rediscover)
   // through the ACP child's `McpClientManager`. Pre-checks the live
@@ -16517,6 +16635,21 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_branch: { since: "v1" },
   rate_limit: { since: "v1" },
   workspace_reload: { since: "v1" },
+  // Phase 2 "reverse tool channel" (issue #5626). A connected WS client (e.g.
+  // the Chrome extension) can host an MCP server that the daemon's agent
+  // calls by carrying `mcp_message` JSON-RPC frames over the daemon WS,
+  // reusing the SDK-MCP-server control-plane pattern. Inbound WS frame types:
+  // `mcp_register` { server }, `mcp_message` { id, server, payload }
+  // (bidirectional, request/response correlated by `id`), `mcp_unregister`
+  // { server }. Advertised CONDITIONALLY — only when the operator opts in
+  // (the public contract is still settling per #5626), so clients pre-flight
+  // this tag before attempting to register a client-hosted server.
+  client_mcp_over_ws: { since: "v1" },
+  // Plan C "CDP tunnel" (issue #5626): the daemon exposes a `/cdp` WebSocket
+  // where a loopback puppeteer client (chrome-devtools-mcp) drives ONE real tab
+  // via the extension's `chrome.debugger`, tunneled over `/acp` as `cdp_*`
+  // frames. Advertised only when the operator opts in (contract still settling).
+  cdp_tunnel_over_ws: { since: "v1" },
   // Daemon hosts the `/voice/stream` WebSocket: the browser captures audio and
   // streams raw PCM, the daemon transcribes server-side via the configured
   // `voiceModel` (credentials never reach the client). Advertised
@@ -16542,9 +16675,10 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
     (toggles) => typeof toggles.writerIdleTimeoutMs === "number" && toggles.writerIdleTimeoutMs > 0
   ],
   ["workspace_settings", (toggles) => toggles.persistSettingAvailable === true],
+  ["workspace_voice", (toggles) => toggles.persistSettingAvailable === true],
   [
-    "workspace_permissions",
-    (toggles) => toggles.persistSettingAvailable === true
+    "workspace_voice_transcription",
+    (toggles) => toggles.voiceTranscriptionAvailable === true
   ],
   [
     "session_shell_command",
@@ -16552,6 +16686,8 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
   ],
   ["rate_limit", (toggles) => toggles.rateLimit === true],
   ["workspace_reload", (toggles) => toggles.reloadAvailable === true],
+  ["client_mcp_over_ws", (toggles) => toggles.clientMcpOverWsEnabled === true],
+  ["cdp_tunnel_over_ws", (toggles) => toggles.cdpTunnelOverWsEnabled === true],
   [
     // Advertised whenever the `/voice/stream` WS endpoint exists. A configured
     // token (or `--require-auth`) no longer suppresses it: browsers can't set
@@ -16594,13 +16730,229 @@ __name(getServeProtocolVersions, "getServeProtocolVersions");
 init_esbuild_shims();
 var CAPABILITIES_SCHEMA_VERSION = 1;
 
+// packages/cli/src/serve/server/request-helpers.ts
+init_esbuild_shims();
+import * as path2 from "node:path";
+function sendJsonBodyParserError(res, err) {
+  if (err instanceof SyntaxError && "status" in err && err.status === 400) {
+    res.status(400).json({ error: "Invalid JSON in request body" });
+    return true;
+  }
+  if (err && typeof err === "object" && "status" in err && err.status === 413) {
+    res.status(413).json({ error: "Request body too large (max 10 MB)" });
+    return true;
+  }
+  return false;
+}
+__name(sendJsonBodyParserError, "sendJsonBodyParserError");
+var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var CLIENT_ID_HEADER = "x-qwen-client-id";
+var MAX_CLIENT_ID_LENGTH = 128;
+var MAX_TOOL_NAME_LENGTH = 256;
+var MAX_SERVER_NAME_LENGTH = 256;
+var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
+var INVALID_PERMISSION_OUTCOME_ERROR = '`outcome` must be `{ outcome: "cancelled" }` or `{ outcome: "selected", optionId: string }`';
+function safeBody(req) {
+  const raw = req.body;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return /* @__PURE__ */ Object.create(null);
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(raw)) {
+    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+__name(safeBody, "safeBody");
+function parseOptionalWorkspaceCwd(body, boundWorkspace, res) {
+  const hasCwd = "cwd" in body;
+  if (hasCwd && typeof body["cwd"] !== "string") {
+    res.status(400).json({ error: "`cwd` must be a string absolute path when provided" });
+    return void 0;
+  }
+  if (hasCwd && body["cwd"].length > MAX_WORKSPACE_PATH_LENGTH) {
+    res.status(400).json({
+      error: `\`cwd\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`
+    });
+    return void 0;
+  }
+  const cwd = hasCwd ? body["cwd"] : boundWorkspace;
+  if (!path2.isAbsolute(cwd)) {
+    res.status(400).json({ error: "`cwd` must be an absolute path when provided" });
+    return void 0;
+  }
+  return cwd;
+}
+__name(parseOptionalWorkspaceCwd, "parseOptionalWorkspaceCwd");
+function requireSessionId(req, res) {
+  const sessionId = req.params["id"];
+  if (!sessionId) {
+    res.status(400).json({ error: "`sessionId` route parameter is required" });
+    return null;
+  }
+  return sessionId;
+}
+__name(requireSessionId, "requireSessionId");
+function parseClientIdHeader(req, res) {
+  const raw = req.get(CLIENT_ID_HEADER);
+  if (raw === void 0 || raw === "") return void 0;
+  if (raw.length > MAX_CLIENT_ID_LENGTH || !CLIENT_ID_RE.test(raw)) {
+    res.status(400).json({
+      error: "`X-Qwen-Client-Id` must be a non-empty token of 128 characters or fewer",
+      code: "invalid_client_id"
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseClientIdHeader, "parseClientIdHeader");
+function detectFromLoopback(req) {
+  const addr = req.socket?.remoteAddress;
+  if (typeof addr !== "string") return false;
+  if (addr === "::1") return true;
+  if (addr.startsWith("127.")) return true;
+  if (addr.startsWith("::ffff:127.")) return true;
+  return false;
+}
+__name(detectFromLoopback, "detectFromLoopback");
+function validateMcpRuntimeServerName(name, res) {
+  if (typeof name !== "string" || name.length === 0) {
+    res.status(400).json({
+      error: "Server name is required and must be a non-empty string",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name.length > MAX_SERVER_NAME_LENGTH) {
+    res.status(400).json({
+      error: `Server name exceeds ${MAX_SERVER_NAME_LENGTH}-character limit`,
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+    res.status(400).json({
+      error: "Server name must contain only alphanumeric characters, underscores, and hyphens",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  if (name === "__proto__" || name === "constructor" || name === "prototype") {
+    res.status(400).json({
+      error: "Server name must not be a reserved JS property name",
+      code: "invalid_server_name"
+    });
+    return false;
+  }
+  return true;
+}
+__name(validateMcpRuntimeServerName, "validateMcpRuntimeServerName");
+function parseAndValidateWorkspaceClientId(req, res, bridge) {
+  const raw = parseClientIdHeader(req, res);
+  if (raw === null || raw === void 0) return raw;
+  if (!bridge.knownClientIds().has(raw)) {
+    res.status(400).json({
+      error: `Client id "${raw}" is not registered for this workspace`,
+      code: "invalid_client_id",
+      clientId: raw
+    });
+    return null;
+  }
+  return raw;
+}
+__name(parseAndValidateWorkspaceClientId, "parseAndValidateWorkspaceClientId");
+function createBuildWorkspaceCtx(boundWorkspace) {
+  return (route, clientId) => ({
+    originatorClientId: clientId,
+    route,
+    workspaceCwd: boundWorkspace
+  });
+}
+__name(createBuildWorkspaceCtx, "createBuildWorkspaceCtx");
+function parsePermissionVoteBody(req, res) {
+  const body = safeBody(req);
+  const outcome = body["outcome"];
+  if (!isValidOutcome(outcome)) {
+    res.status(400).json({ error: INVALID_PERMISSION_OUTCOME_ERROR });
+    return void 0;
+  }
+  return {
+    ...body,
+    outcome
+  };
+}
+__name(parsePermissionVoteBody, "parsePermissionVoteBody");
+function isValidOutcome(raw) {
+  if (typeof raw !== "object" || raw === null) return false;
+  const obj = raw;
+  if (obj["outcome"] === "cancelled") return true;
+  return obj["outcome"] === "selected" && typeof obj["optionId"] === "string" && obj["optionId"].length > 0;
+}
+__name(isValidOutcome, "isValidOutcome");
+var MIN_QUERY_MAX_QUEUED = 16;
+var MAX_QUERY_MAX_QUEUED = 2048;
+function parseMaxQueuedQuery(raw, res) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (not a decimal integer)`
+    );
+    res.status(400).json({
+      error: "`maxQueued` must be a decimal integer",
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < MIN_QUERY_MAX_QUEUED || n > MAX_QUERY_MAX_QUEUED) {
+    writeStderrLine(
+      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (outside [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}])`
+    );
+    res.status(400).json({
+      error: `\`maxQueued\` must be in [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}]`,
+      code: "invalid_max_queued"
+    });
+    return null;
+  }
+  return n;
+}
+__name(parseMaxQueuedQuery, "parseMaxQueuedQuery");
+function safeLogValue(raw) {
+  return JSON.stringify(String(raw)).slice(0, 82);
+}
+__name(safeLogValue, "safeLogValue");
+function parseLastEventId(raw) {
+  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+    if (typeof raw === "string" && raw.length > 0) {
+      writeStderrLine(
+        `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (not a decimal integer)`
+      );
+    }
+    return void 0;
+  }
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n > Number.MAX_SAFE_INTEGER) {
+    writeStderrLine(
+      `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (exceeds Number.MAX_SAFE_INTEGER)`
+    );
+    return void 0;
+  }
+  return n;
+}
+__name(parseLastEventId, "parseLastEventId");
+
 // packages/cli/src/serve/rate-limit.ts
 init_esbuild_shims();
 var MAX_BUCKETS = 1e4;
 var GC_REQUEST_INTERVAL = 1e3;
 var GC_TIMER_INTERVAL_MS = 5 * 60 * 1e3;
-function resolveTier(method, path2) {
-  const p = path2.endsWith("/") && path2.length > 1 ? path2.slice(0, -1) : path2;
+function resolveTier(method, path3) {
+  const p = path3.endsWith("/") && path3.length > 1 ? path3.slice(0, -1) : path3;
   if (method === "OPTIONS") return null;
   if ((method === "GET" || method === "HEAD") && (p === "/health" || p === "/demo"))
     return null;
@@ -16615,8 +16967,6 @@ function resolveTier(method, path2) {
   return "read";
 }
 __name(resolveTier, "resolveTier");
-var MAX_CLIENT_ID_LENGTH = 128;
-var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
 function normalizeIp(raw) {
   if (raw.startsWith("::ffff:")) {
     return raw.slice(7);
@@ -17288,10 +17638,30 @@ export {
   hostAllowlist,
   bearerAuth,
   createMutationGate,
+  ClientMcpSenderRegistry,
+  createClientMcpServerProvider,
   SERVE_CAPABILITY_REGISTRY,
   getAdvertisedServeFeatures,
   getServeProtocolVersions,
   CAPABILITIES_SCHEMA_VERSION,
+  sendJsonBodyParserError,
+  CLIENT_ID_HEADER,
+  MAX_CLIENT_ID_LENGTH,
+  MAX_TOOL_NAME_LENGTH,
+  MAX_SERVER_NAME_LENGTH,
+  CLIENT_ID_RE,
+  safeBody,
+  parseOptionalWorkspaceCwd,
+  requireSessionId,
+  parseClientIdHeader,
+  detectFromLoopback,
+  validateMcpRuntimeServerName,
+  parseAndValidateWorkspaceClientId,
+  createBuildWorkspaceCtx,
+  parsePermissionVoteBody,
+  parseMaxQueuedQuery,
+  safeLogValue,
+  parseLastEventId,
   createRateLimiter,
   setRateLimiter,
   getRateLimiter,