@qwen-code/qwen-code 0.19.4 → 0.19.5-nightly.20260703.b16baf1ff

package/chunks/{server-4AGEK2HC.js → server-MFMOYMEB.js}

@@ -9,13 +9,60 @@ import {
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-CUGEBAKG.js";
+} from "./chunk-C47IJLUT.js";
 import {
   SetupGithubError,
   setupGithub
 } from "./chunk-L7QPM2YD.js";
 import "./chunk-54YZOP7P.js";
-import "./chunk-HRZB5CSC.js";
+import "./chunk-ZRHHQFV4.js";
+import {
+  createWorkspaceProvidersStatusProvider
+} from "./chunk-4UEWG5AS.js";
+import {
+  getAuthTypeFromEnv,
+  resolveCliGenerationConfig
+} from "./chunk-KFO6YNQT.js";
+import {
+  createWorkspaceSkillsStatusProvider
+} from "./chunk-LOEYAC6N.js";
+import "./chunk-CXBG27SF.js";
+import {
+  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
+  WorkspaceVoiceError,
+  buildWorkspaceVoiceSettingsWrites,
+  buildWorkspaceVoiceStatus,
+  createDaemonWorkspaceService,
+  hasConfiguredBatchVoiceTranscriptionModel,
+  transcribeWorkspaceVoiceAudio,
+  validateWorkspaceVoiceState,
+  voiceSettingsScopeToWire
+} from "./chunk-FEPEMQR4.js";
+import {
+  PermissionRulesValidationError,
+  buildPermissionSettings,
+  isPermissionRuleType,
+  normalizePermissionRules,
+  readPermissionRuleSet
+} from "./chunk-4JWM2UGC.js";
+import {
+  assertVoiceBaseUrlNetworkAllowed,
+  isStreamingVoiceModel,
+  resolveVoiceStreamConfig,
+  resolveVoiceTranscriptionConfig,
+  sanitizeVoiceErrorMessage,
+  transcribeVoiceAudio
+} from "./chunk-AYUVPH6L.js";
+import {
+  isVoiceEnabled,
+  isVoiceMode,
+  readVoiceModel
+} from "./chunk-7K4G2H2H.js";
+import "./chunk-NIOPRZNN.js";
+import {
+  WorkspacePermissionRulesSessionRequiredError,
+  WorkspaceSettingsPartialPersistError
+} from "./chunk-BMFMJINR.js";
 import {
   CAPABILITIES_SCHEMA_VERSION,
   CLIENT_ID_HEADER,
@@ -60,7 +107,7 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-B7KGXIPZ.js";
+} from "./chunk-YCU7QV7Q.js";
 import {
   isLoopbackBind
 } from "./chunk-RNBYOUGV.js";
@@ -68,58 +115,12 @@ import "./chunk-3HX5LZ6R.js";
 import "./chunk-7RYW5LQV.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-6CIIP6OE.js";
-import "./chunk-W2ZOAX7F.js";
+} from "./chunk-O2EZ4VRP.js";
+import "./chunk-26UO4PLG.js";
 import "./chunk-KHDZHZMH.js";
-import "./chunk-W6X4FGWX.js";
 import {
   createAcpSessionBridge
-} from "./chunk-KVPFPC4J.js";
-import "./chunk-EWALXUAD.js";
-import {
-  EVENT_SCHEMA_VERSION,
-  SubscriberLimitExceededError
-} from "./chunk-ALX6BUYW.js";
-import "./chunk-YBDZ63KI.js";
-import {
-  createWorkspaceProvidersStatusProvider
-} from "./chunk-L7VH7HQA.js";
-import {
-  getAuthTypeFromEnv,
-  resolveCliGenerationConfig
-} from "./chunk-BQNJBEUA.js";
-import {
-  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
-  WorkspaceVoiceError,
-  buildWorkspaceVoiceSettingsWrites,
-  buildWorkspaceVoiceStatus,
-  createDaemonWorkspaceService,
-  hasConfiguredBatchVoiceTranscriptionModel,
-  transcribeWorkspaceVoiceAudio,
-  validateWorkspaceVoiceState,
-  voiceSettingsScopeToWire
-} from "./chunk-UT5JU5DJ.js";
-import {
-  PermissionRulesValidationError,
-  buildPermissionSettings,
-  isPermissionRuleType,
-  normalizePermissionRules,
-  readPermissionRuleSet
-} from "./chunk-QAFQLTXG.js";
-import {
-  assertVoiceBaseUrlNetworkAllowed,
-  isStreamingVoiceModel,
-  resolveVoiceStreamConfig,
-  resolveVoiceTranscriptionConfig,
-  sanitizeVoiceErrorMessage,
-  transcribeVoiceAudio
-} from "./chunk-BNJLLAQ7.js";
-import {
-  isVoiceEnabled,
-  isVoiceMode,
-  readVoiceModel
-} from "./chunk-Q7VHIRDD.js";
-import "./chunk-NIOPRZNN.js";
+} from "./chunk-WSAAEPPQ.js";
 import "./chunk-P7M4GA57.js";
 import {
   BranchWhilePromptActiveError,
@@ -150,42 +151,45 @@ import {
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
 } from "./chunk-T22H4V4R.js";
+import "./chunk-EWALXUAD.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace
 } from "./chunk-SEZC2725.js";
+import {
+  EVENT_SCHEMA_VERSION,
+  SubscriberLimitExceededError
+} from "./chunk-ALX6BUYW.js";
+import "./chunk-FVRLDQ7T.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-GICCHL2Q.js";
-import {
-  WorkspacePermissionRulesSessionRequiredError,
-  WorkspaceSettingsPartialPersistError
-} from "./chunk-BMFMJINR.js";
+} from "./chunk-STP6AYKH.js";
+import "./chunk-2Z43HUXT.js";
+import "./chunk-UFC57OYT.js";
 import {
   getDialogSettingKeys,
   getNestedProperty,
   getSettingDefinition,
   loadSettings,
   validateSettingValue
-} from "./chunk-MKHC4BYZ.js";
+} from "./chunk-XAVV2JAM.js";
 import {
   SUPPORTED_LANGUAGES
-} from "./chunk-UQYOMM6J.js";
+} from "./chunk-L4CYPEA7.js";
 import "./chunk-TLRYABYP.js";
-import "./chunk-UFC57OYT.js";
-import "./chunk-PPFWEV7G.js";
+import "./chunk-4RQIB5UZ.js";
+import "./chunk-7XS7CMSU.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-ZJP5T7IA.js";
+} from "./chunk-ODPWORQZ.js";
 import {
   writeStderrLine
 } from "./chunk-Y6Z2O3WR.js";
 import "./chunk-QYUE6W3T.js";
 import {
   ALL_PROVIDERS,
-  APPROVAL_MODES,
   BTW_MAX_INPUT_LENGTH,
   BuiltinAgentRegistry,
   Client,
@@ -212,22 +216,24 @@ import {
   redactUrlCredentials,
   shouldShowStep,
   writeWorkspaceContextFile
-} from "./chunk-BFG6OZN7.js";
+} from "./chunk-WWOVV2PW.js";
 import "./chunk-5P5XGNYH.js";
-import "./chunk-K5PGHDBN.js";
 import "./chunk-SKAZWEV5.js";
+import "./chunk-K5PGHDBN.js";
 import "./chunk-QOMAHFYI.js";
 import "./chunk-G7OQ3RFJ.js";
 import "./chunk-LKWAVAB5.js";
-import "./chunk-MEQWZGK5.js";
-import "./chunk-UANCYOOQ.js";
+import "./chunk-L7OJ3ZO3.js";
+import "./chunk-R6RI2HIC.js";
 import "./chunk-2MPVVENX.js";
 import "./chunk-ZTQ26VBE.js";
 import "./chunk-SJBIFVD2.js";
 import "./chunk-MLZQVCF3.js";
-import "./chunk-S5EQPDTM.js";
 import "./chunk-LQ7TMOCE.js";
 import "./chunk-E5A7LHNN.js";
+import {
+  APPROVAL_MODES
+} from "./chunk-BPFJQGY7.js";
 import "./chunk-GO6LNQXT.js";
 import "./chunk-B236XPGF.js";
 import "./chunk-YXK4GPYO.js";
@@ -246,15 +252,15 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-HJDF3ZVU.js";
+} from "./chunk-UEGNXWAX.js";
 import "./chunk-E6US47KI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";
 import "./chunk-OMX7CUOE.js";
 import "./chunk-MOUXUCXQ.js";
 import "./chunk-BZHLWC6T.js";
-import "./chunk-UQFP2FEF.js";
-import "./chunk-4VZH35PN.js";
+import "./chunk-DG573EOO.js";
+import "./chunk-MTNTVOJR.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -267,6 +273,7 @@ import {
 import "./chunk-GLPV75ES.js";
 import "./chunk-22IFUCVR.js";
 import "./chunk-T42ACHFI.js";
+import "./chunk-SIUQ3YYX.js";
 import "./chunk-YTFBURQD.js";
 import "./chunk-YPCPZSZB.js";
 import "./chunk-IRJWHZWU.js";
@@ -302,8 +309,6 @@ var import_express4 = __toESM(require_express(), 1);
 // packages/cli/src/serve/acp-http/index.ts
 init_esbuild_shims();
 import { createHash as createHash3, timingSafeEqual } from "node:crypto";
-import { createRequire } from "node:module";
-import * as path9 from "node:path";
 
 // packages/cli/src/serve/acp-http/dispatch.ts
 init_esbuild_shims();
@@ -1512,8 +1517,8 @@ var PathMutexRegistry = class {
   async runExclusive(key, fn) {
     const previous = this.tails.get(key) ?? Promise.resolve();
     let release;
-    const current = new Promise((resolve5) => {
-      release = resolve5;
+    const current = new Promise((resolve4) => {
+      release = resolve4;
     });
     const tail = previous.catch(() => void 0).then(() => current);
     this.tails.set(key, tail);
@@ -2000,7 +2005,7 @@ async function renameWithRetryLocal(src, dest, retries, delayMs) {
       const retryable = code === "EPERM" || code === "EACCES";
       if (!retryable || attempt === retries) throw err;
       await new Promise(
-        (resolve5) => setTimeout(resolve5, delayMs * 2 ** attempt)
+        (resolve4) => setTimeout(resolve4, delayMs * 2 ** attempt)
       );
     }
   }
@@ -8266,9 +8271,9 @@ var SseStream = class {
     return next;
   }
   doWrite(chunk) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve4, reject) => {
       if (this.closed || this.res.writableEnded) {
-        resolve5();
+        resolve4();
         return;
       }
       let ok;
@@ -8279,7 +8284,7 @@ var SseStream = class {
         return;
       }
       if (ok) {
-        resolve5();
+        resolve4();
         return;
       }
       const cleanup = /* @__PURE__ */ __name(() => {
@@ -8289,11 +8294,11 @@ var SseStream = class {
       }, "cleanup");
       const onDrain = /* @__PURE__ */ __name(() => {
         cleanup();
-        resolve5();
+        resolve4();
       }, "onDrain");
       const onCloseEv = /* @__PURE__ */ __name(() => {
         cleanup();
-        resolve5();
+        resolve4();
       }, "onCloseEv");
       const onErrorEv = /* @__PURE__ */ __name((err) => {
         cleanup();
@@ -8355,14 +8360,14 @@ var WsStream = class {
   send(message, _id) {
     const data = JSON.stringify(message);
     const next = this.writeChain.then(
-      () => new Promise((resolve5, reject) => {
+      () => new Promise((resolve4, reject) => {
         if (this._closed) {
-          resolve5();
+          resolve4();
           return;
         }
         this.ws.send(data, (err) => {
           if (err) reject(err);
-          else resolve5();
+          else resolve4();
         });
       })
     );
@@ -8667,7 +8672,7 @@ var CdpReverseLink = class {
       throw { code: -32e3, message: "CDP tunnel closed" };
     }
     await this.attach();
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve4, reject) => {
       if (this.disposed) {
         reject({ code: -32e3, message: "CDP tunnel closed" });
         return;
@@ -8678,7 +8683,7 @@ var CdpReverseLink = class {
         `CDP command id=${id} method=${method} timed out after ${this.commandTimeoutMs}ms`
       );
       const progressTimer = this.armProgressLog(id, method);
-      this.pending.set(id, { resolve: resolve5, reject, timer, progressTimer });
+      this.pending.set(id, { resolve: resolve4, reject, timer, progressTimer });
       try {
         this.log?.(
           `qwen serve: /cdp forwarded command id=${id} method=${method} to extension`
@@ -8705,7 +8710,7 @@ var CdpReverseLink = class {
     if (this.attached) return Promise.resolve({});
     if (this.attachPromise) return this.attachPromise;
     this.attachPromise = new Promise(
-      (resolve5, reject) => {
+      (resolve4, reject) => {
         if (this.disposed) {
           reject({ code: -32e3, message: "CDP tunnel closed" });
           return;
@@ -8715,7 +8720,7 @@ var CdpReverseLink = class {
         this.pendingAttach = {
           id,
           pending: {
-            resolve: /* @__PURE__ */ __name((result) => resolve5(result ?? {}), "resolve"),
+            resolve: /* @__PURE__ */ __name((result) => resolve4(result ?? {}), "resolve"),
             reject,
             timer
           }
@@ -9223,9 +9228,9 @@ var ACP_SESSION_HEADER = "acp-session-id";
 var CDP_PATH = "/cdp";
 var CDP_BRIDGE_CLIENT_NAME = "qwen-cdp-bridge";
 var CHROME_DEVTOOLS_MCP_SERVER_NAME = "chrome-devtools";
+var CDP_MCP_COMMAND_ENV = "QWEN_CDP_MCP_COMMAND";
 var RUNTIME_MCP_RETRY_DELAY_MS = 250;
 var RUNTIME_MCP_RETRY_ATTEMPTS = 20;
-var requireFromHere = createRequire(import.meta.url);
 function formatCdpEndpointHost(hostname) {
   const host = hostname?.trim() || "127.0.0.1";
   if (host === "0.0.0.0" || host === "::" || host === "[::]") {
@@ -9240,25 +9245,23 @@ function isAcpChannelUnavailable(err) {
 }
 __name(isAcpChannelUnavailable, "isAcpChannelUnavailable");
 function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 __name(delay, "delay");
-function buildChromeDevToolsMcpRuntimeConfigFromPackage(localPort, pkgJsonPath, pkgBin, hostname) {
+function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname) {
   if (localPort === void 0 || !Number.isInteger(localPort) || localPort <= 0) {
     return void 0;
   }
-  const binRel = typeof pkgBin === "string" ? pkgBin : Object.values(pkgBin ?? {})[0];
-  if (!binRel) return void 0;
-  const pkgDir = path9.dirname(pkgJsonPath);
-  const binPath = path9.resolve(pkgDir, binRel);
-  const binRelToPkg = path9.relative(pkgDir, binPath);
-  if (binRelToPkg.startsWith("..") || path9.isAbsolute(binRelToPkg)) {
+  const command = process.env[CDP_MCP_COMMAND_ENV]?.trim();
+  if (!command) {
+    writeStderrLine(
+      `qwen serve: set ${CDP_MCP_COMMAND_ENV} to enable browser automation MCP (chrome-devtools-mcp is no longer bundled)`
+    );
     return void 0;
   }
   return {
-    command: process.execPath,
+    command,
     args: [
-      binPath,
       "--wsEndpoint",
       `ws://${formatCdpEndpointHost(hostname)}:${localPort}/cdp`
     ],
@@ -9266,26 +9269,6 @@ function buildChromeDevToolsMcpRuntimeConfigFromPackage(localPort, pkgJsonPath,
     [RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG]: true
   };
 }
-__name(buildChromeDevToolsMcpRuntimeConfigFromPackage, "buildChromeDevToolsMcpRuntimeConfigFromPackage");
-function buildChromeDevToolsMcpRuntimeConfig(localPort, hostname) {
-  try {
-    const pkgJsonPath = requireFromHere.resolve(
-      "chrome-devtools-mcp/package.json"
-    );
-    const pkg = requireFromHere("chrome-devtools-mcp/package.json");
-    return buildChromeDevToolsMcpRuntimeConfigFromPackage(
-      localPort,
-      pkgJsonPath,
-      pkg.bin,
-      hostname
-    );
-  } catch (err) {
-    writeStderrLine(
-      `qwen serve: chrome-devtools-mcp package not resolvable: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return void 0;
-  }
-}
 __name(buildChromeDevToolsMcpRuntimeConfig, "buildChromeDevToolsMcpRuntimeConfig");
 var WS_BEARER_SUBPROTOCOL_PREFIX = "qwen-bearer.";
 function extractUpgradeBearer(req) {
@@ -9352,8 +9335,17 @@ function isSameLoopbackOrigin(origin, localPort) {
   const allowed = /* @__PURE__ */ new Set([
     `http://localhost:${localPort}`,
     `http://127.0.0.1:${localPort}`,
-    `http://[::1]:${localPort}`
+    `http://[::1]:${localPort}`,
+    `https://localhost:${localPort}`,
+    `https://127.0.0.1:${localPort}`,
+    `https://[::1]:${localPort}`
   ]);
+  if (localPort === 80 || localPort === 443) {
+    for (const host of ["localhost", "127.0.0.1", "[::1]"]) {
+      allowed.add(`http://${host}`);
+      allowed.add(`https://${host}`);
+    }
+  }
   return allowed.has(parsed.origin.toLowerCase());
 }
 __name(isSameLoopbackOrigin, "isSameLoopbackOrigin");
@@ -9361,7 +9353,7 @@ var MAX_INFLIGHT_MCP_DISPATCH = 8;
 function mountAcpHttp(app, bridge, opts) {
   const enabled = opts.enabled ?? process.env["QWEN_SERVE_ACP_HTTP"] !== "0";
   if (!enabled) return void 0;
-  const path13 = opts.path ?? "/acp";
+  const path12 = opts.path ?? "/acp";
   const dispatcherRef = {};
   const registry = new ConnectionRegistry(
     (req, clientId) => {
@@ -9498,7 +9490,7 @@ function mountAcpHttp(app, bridge, opts) {
     opts.archiveCoordinator ?? new SessionArchiveCoordinator()
   );
   dispatcherRef.current = dispatcher;
-  app.post(path13, async (req, res) => {
+  app.post(path12, async (req, res) => {
     const ct = req.headers["content-type"];
     if (!ct || !ct.startsWith("application/json")) {
       res.status(415).json({ error: "Content-Type must be application/json" });
@@ -9602,7 +9594,7 @@ function mountAcpHttp(app, bridge, opts) {
       );
     });
   });
-  app.get(path13, (req, res) => {
+  app.get(path12, (req, res) => {
     const accept = req.headers["accept"] ?? "";
     if (!accept.includes("text/event-stream")) {
       res.status(406).json({ error: "Accept header must include text/event-stream" });
@@ -9688,7 +9680,7 @@ function mountAcpHttp(app, bridge, opts) {
       onPumpSettled();
     });
   });
-  app.delete(path13, (req, res) => {
+  app.delete(path12, (req, res) => {
     const connectionId = headerOf(req, ACP_CONNECTION_HEADER);
     if (!connectionId) {
       res.status(400).json({ error: "Missing Acp-Connection-Id" });
@@ -9751,7 +9743,7 @@ function mountAcpHttp(app, bridge, opts) {
       const extraRoute = opts.extraWsRoutes?.find(
         (route) => route.path === url.pathname
       );
-      if (url.pathname !== path13 && !isCdpPath && !extraRoute) {
+      if (url.pathname !== path12 && !isCdpPath && !extraRoute) {
         logReject(`unknown-path ${url.pathname}`);
         socket.destroy();
         return;
@@ -9765,6 +9757,12 @@ function mountAcpHttp(app, bridge, opts) {
           `[::1]:${localPort}`,
           `host.docker.internal:${localPort}`
         ]);
+        if (localPort === 80 || localPort === 443) {
+          allowed.add("localhost");
+          allowed.add("127.0.0.1");
+          allowed.add("[::1]");
+          allowed.add("host.docker.internal");
+        }
         if (!allowed.has(host)) {
           logReject(`host-not-allowed ${host || "(missing)"}`);
           socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
@@ -10142,7 +10140,7 @@ function mountAcpHttp(app, bridge, opts) {
       });
     }, "upgradeListener");
     httpServer.on("upgrade", upgradeListener);
-    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path13}`);
+    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path12}`);
   }
   __name(setupWebSocket, "setupWebSocket");
   return {
@@ -10610,7 +10608,7 @@ var CdpTunnelRegistry = class {
 // packages/cli/src/serve/web-shell-static.ts
 init_esbuild_shims();
 var import_express2 = __toESM(require_express(), 1);
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 var WEB_SHELL_CSP_DIRECTIVES = [
   "default-src 'self'",
   "script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",
@@ -10638,7 +10636,7 @@ function isDocumentNavigation(req) {
 }
 __name(isDocumentNavigation, "isDocumentNavigation");
 function createSendIndex(webShellDir, frameAncestors = []) {
-  const indexPath = path10.join(webShellDir, "index.html");
+  const indexPath = path9.join(webShellDir, "index.html");
   const csp = buildWebShellCsp(frameAncestors);
   return (res) => {
     res.status(200).set("Content-Security-Policy", csp).set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "no-referrer").set(
@@ -10674,7 +10672,7 @@ function mountWebShellAssets(app, webShellDir, frameAncestors = []) {
   const sendIndex = createSendIndex(webShellDir, frameAncestors);
   app.use(
     "/assets",
-    import_express2.default.static(path10.join(webShellDir, "assets"), {
+    import_express2.default.static(path9.join(webShellDir, "assets"), {
       index: false,
       immutable: true,
       maxAge: "1y"
@@ -12233,14 +12231,14 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       code: "extension_queue_full"
     });
   }, "sendExtensionQueueFull");
-  const withExtensionTimeout = /* @__PURE__ */ __name(async (promise, timeoutMs, operation) => await new Promise((resolve5, reject) => {
+  const withExtensionTimeout = /* @__PURE__ */ __name(async (promise, timeoutMs, operation) => await new Promise((resolve4, reject) => {
     const timeout = setTimeout(() => {
       reject(new Error(`${operation} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timeout);
-        resolve5(value);
+        resolve4(value);
       },
       (err) => {
         clearTimeout(timeout);
@@ -13356,7 +13354,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 // packages/cli/src/serve/routes/session.ts
 init_esbuild_shims();
 import * as crypto2 from "node:crypto";
-import * as path11 from "node:path";
+import * as path10 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
 init_esbuild_shims();
@@ -13696,7 +13694,7 @@ function registerSessionRoutes(app, deps) {
     withMutableSession("POST /session/:id/cd", async (req, res, sessionId) => {
       const body = safeBody(req);
       const targetPath = body["path"];
-      if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
+      if (typeof targetPath !== "string" || targetPath.length === 0 || !path10.isAbsolute(targetPath)) {
         res.status(400).json({
           error: "`path` is required and must be an absolute path",
           code: "invalid_path"
@@ -14162,7 +14160,7 @@ function registerSessionRoutes(app, deps) {
   );
   app.get("/workspace/:id/sessions", async (req, res) => {
     const workspaceCwd = req.params["id"] ?? "";
-    if (!path11.isAbsolute(workspaceCwd)) {
+    if (!path10.isAbsolute(workspaceCwd)) {
       res.status(400).json({ error: "`:id` must decode to an absolute workspace path" });
       return;
     }
@@ -15572,9 +15570,9 @@ function registerSseEventsRoutes(app, deps) {
     let writeChain = Promise.resolve();
     const trackWriterIdle = writerIdleTimeoutMs !== void 0 && writerIdleTimeoutMs > 0;
     let lastWriteAt = trackWriterIdle ? Date.now() : 0;
-    const doWrite = /* @__PURE__ */ __name((chunk) => new Promise((resolve5, reject) => {
+    const doWrite = /* @__PURE__ */ __name((chunk) => new Promise((resolve4, reject) => {
       if (res.writableEnded) {
-        resolve5();
+        resolve4();
         return;
       }
       let ok;
@@ -15586,19 +15584,19 @@ function registerSseEventsRoutes(app, deps) {
       }
       if (ok) {
         if (trackWriterIdle) lastWriteAt = Date.now();
-        resolve5();
+        resolve4();
         return;
       }
       const onDrain = /* @__PURE__ */ __name(() => {
         res.off("close", onClose);
         res.off("error", onError);
         if (trackWriterIdle) lastWriteAt = Date.now();
-        resolve5();
+        resolve4();
       }, "onDrain");
       const onClose = /* @__PURE__ */ __name(() => {
         res.off("drain", onDrain);
         res.off("error", onError);
-        resolve5();
+        resolve4();
       }, "onClose");
       const onError = /* @__PURE__ */ __name((err) => {
         res.off("drain", onDrain);
@@ -15720,7 +15718,7 @@ __name(registerSseEventsRoutes, "registerSseEventsRoutes");
 // packages/cli/src/serve/routes/a2ui-action.ts
 init_esbuild_shims();
 import * as fsp4 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path11 from "node:path";
 var A2UI_MIME = "application/a2ui+json";
 var ACTION_TOOL = "action";
 var CALL_TIMEOUT_MS = 15e3;
@@ -15740,7 +15738,7 @@ __name(usableServerConfig, "usableServerConfig");
 async function findFromSettingsFile(workspaceCwd) {
   try {
     const raw = await fsp4.readFile(
-      path12.join(workspaceCwd, ".qwen", "settings.json"),
+      path11.join(workspaceCwd, ".qwen", "settings.json"),
       "utf8"
     );
     const settings = JSON.parse(raw);
@@ -15898,17 +15896,17 @@ __name(resolveBridgeFsFactory, "resolveBridgeFsFactory");
 // packages/cli/src/serve/server/telemetry.ts
 init_esbuild_shims();
 function resolveDaemonTelemetryRoute(req) {
-  const path13 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "POST" && path13 === "/session") {
+  const path12 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "POST" && path12 === "/session") {
     return { route: "POST /session" };
   }
-  if (req.method === "POST" && path13 === "/sessions/delete") {
+  if (req.method === "POST" && path12 === "/sessions/delete") {
     return { route: "POST /sessions/delete" };
   }
-  if (req.method === "GET" && path13 === "/daemon/status") {
+  if (req.method === "GET" && path12 === "/daemon/status") {
     return { route: "GET /daemon/status" };
   }
-  const sessionAction = path13.match(
+  const sessionAction = path12.match(
     /^\/session\/([^/]+)\/(load|resume|prompt|cancel|recap|btw|mid-turn-message|model|shell|detach|rewind|approval-mode|language|a2ui-action)$/
   );
   const sessionActionId = sessionAction?.[1];
@@ -15919,14 +15917,14 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: sessionActionId
     };
   }
-  const sessionMetadata = path13.match(/^\/session\/([^/]+)\/metadata$/);
+  const sessionMetadata = path12.match(/^\/session\/([^/]+)\/metadata$/);
   if (sessionMetadata?.[1] && req.method === "PATCH") {
     return {
       route: "PATCH /session/:id/metadata",
       sessionId: sessionMetadata[1]
     };
   }
-  const sessionPermission = path13.match(
+  const sessionPermission = path12.match(
     /^\/session\/([^/]+)\/permission\/([^/]+)$/
   );
   if (sessionPermission?.[1] && sessionPermission?.[2] && req.method === "POST") {
@@ -15937,7 +15935,7 @@ function resolveDaemonTelemetryRoute(req) {
       ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
     };
   }
-  const globalPermission = path13.match(/^\/permission\/([^/]+)$/);
+  const globalPermission = path12.match(/^\/permission\/([^/]+)$/);
   if (globalPermission?.[1] && req.method === "POST") {
     const rawRequestId = globalPermission[1];
     return {
@@ -15945,66 +15943,66 @@ function resolveDaemonTelemetryRoute(req) {
       ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
     };
   }
-  const deleteSession = path13.match(/^\/session\/([^/]+)$/);
+  const deleteSession = path12.match(/^\/session\/([^/]+)$/);
   const deleteSessionId = deleteSession?.[1];
   if (deleteSessionId && req.method === "DELETE") {
     return { route: "DELETE /session/:id", sessionId: deleteSessionId };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path13)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path12)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "POST" && path13 === "/workspace/init") {
+  if (req.method === "POST" && path12 === "/workspace/init") {
     return { route: "POST /workspace/init" };
   }
-  if (req.method === "POST" && path13 === "/workspace/setup-github") {
+  if (req.method === "POST" && path12 === "/workspace/setup-github") {
     return { route: "POST /workspace/setup-github" };
   }
-  if (req.method === "POST" && path13 === "/workspace/reload") {
+  if (req.method === "POST" && path12 === "/workspace/reload") {
     return { route: "POST /workspace/reload" };
   }
-  const mcpRestart = path13.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  const mcpRestart = path12.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
   if (mcpRestart?.[1] && req.method === "POST") {
     return { route: "POST /workspace/mcp/:server/restart" };
   }
-  if (req.method === "POST" && path13 === "/workspace/mcp/servers") {
+  if (req.method === "POST" && path12 === "/workspace/mcp/servers") {
     return { route: "POST /workspace/mcp/servers" };
   }
-  const mcpDelete = path13.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  const mcpDelete = path12.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
   if (mcpDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/mcp/servers/:name" };
   }
-  if (req.method === "POST" && path13 === "/workspace/auth/device-flow") {
+  if (req.method === "POST" && path12 === "/workspace/auth/device-flow") {
     return { route: "POST /workspace/auth/device-flow" };
   }
-  const deviceFlowDelete = path13.match(
+  const deviceFlowDelete = path12.match(
     /^\/workspace\/auth\/device-flow\/([^/]+)$/
   );
   if (deviceFlowDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/auth/device-flow/:id" };
   }
-  const toolEnable = path13.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  const toolEnable = path12.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
   if (toolEnable?.[1] && req.method === "POST") {
     return { route: "POST /workspace/tools/:name/enable" };
   }
-  if (path13 === "/workspace/settings") {
+  if (path12 === "/workspace/settings") {
     if (req.method === "GET") return { route: "GET /workspace/settings" };
     if (req.method === "POST") return { route: "POST /workspace/settings" };
   }
-  if (path13 === "/workspace/permissions") {
+  if (path12 === "/workspace/permissions") {
     if (req.method === "GET") return { route: "GET /workspace/permissions" };
     if (req.method === "POST") return { route: "POST /workspace/permissions" };
   }
-  if (path13 === "/workspace/trust") {
+  if (path12 === "/workspace/trust") {
     if (req.method === "GET") return { route: "GET /workspace/trust" };
   }
-  if (req.method === "POST" && path13 === "/workspace/trust/request") {
+  if (req.method === "POST" && path12 === "/workspace/trust/request") {
     return { route: "POST /workspace/trust/request" };
   }
-  if (path13 === "/workspace/voice") {
+  if (path12 === "/workspace/voice") {
     if (req.method === "GET") return { route: "GET /workspace/voice" };
     if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  if (req.method === "POST" && path13 === "/workspace/voice/transcribe") {
+  if (req.method === "POST" && path12 === "/workspace/voice/transcribe") {
     return { route: "POST /workspace/voice/transcribe" };
   }
   return void 0;
@@ -16030,7 +16028,7 @@ function daemonTelemetryMiddleware(boundWorkspace) {
         ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
         ...clientId ? { clientId } : {}
       },
-      async (span) => await new Promise((resolve5, reject) => {
+      async (span) => await new Promise((resolve4, reject) => {
         let done = false;
         const finish = /* @__PURE__ */ __name(() => {
           if (done) return;
@@ -16041,7 +16039,7 @@ function daemonTelemetryMiddleware(boundWorkspace) {
             route.route,
             res.statusCode
           );
-          resolve5();
+          resolve4();
         }, "finish");
         res.once("finish", finish);
         res.once("close", finish);
@@ -16364,10 +16362,10 @@ function installRateLimiter(app, opts, daemonLog) {
         { tier, key: key.slice(0, 64) }
       );
     } : void 0,
-    onError: daemonLog ? (err, path13) => {
+    onError: daemonLog ? (err, path12) => {
       daemonLog.warn(
         `rate limiter error (fail-open): ${err instanceof Error ? err.message : String(err)}`,
-        { path: path13 }
+        { path: path12 }
       );
     } : void 0
   });
@@ -16391,8 +16389,23 @@ function installSelfOriginStripMiddleware(app, getPort) {
           `http://127.0.0.1:${port}`,
           `http://localhost:${port}`,
           `http://[::1]:${port}`,
-          `http://host.docker.internal:${port}`
+          `http://host.docker.internal:${port}`,
+          `https://127.0.0.1:${port}`,
+          `https://localhost:${port}`,
+          `https://[::1]:${port}`,
+          `https://host.docker.internal:${port}`
         ]);
+        if (port === 80 || port === 443) {
+          for (const host of [
+            "127.0.0.1",
+            "localhost",
+            "[::1]",
+            "host.docker.internal"
+          ]) {
+            cachedSelfOrigins.add(`http://${host}`);
+            cachedSelfOrigins.add(`https://${host}`);
+          }
+        }
       }
       if (cachedSelfOrigins.has(origin)) {
         delete req.headers.origin;
@@ -16766,6 +16779,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     contextFilename: deps.contextFilename ?? "QWEN.md",
     statusProvider,
     workspaceProvidersStatusProvider: createWorkspaceProvidersStatusProvider(),
+    workspaceSkillsStatusProvider: createWorkspaceSkillsStatusProvider(),
     isChannelLive: /* @__PURE__ */ __name(() => bridge.isChannelLive(), "isChannelLive"),
     persistDisabledTools: deps.persistDisabledTools ?? (async () => {
       throw new Error(
@@ -17129,7 +17143,7 @@ export {
  *
  * CDP browser-level emulation layer for the Plan C "CDP tunnel" (issue #5626).
  *
- * A puppeteer client (chrome-devtools-mcp) connects to the daemon's `/cdp`
+ * A CDP client connects to the daemon's `/cdp`
  * WebSocket expecting a browser-level CDP endpoint, but behind the tunnel is a
  * single real tab driven via `chrome.debugger` (page-level only). This class
  * synthesizes the missing browser-level topology so puppeteer connects and gets
@@ -17153,7 +17167,7 @@ export {
  *
  * `/cdp` endpoint glue for the Plan C "CDP tunnel" (issue #5626).
  *
- * Per puppeteer connection (chrome-devtools-mcp) this wires:
+ * Per CDP client connection this wires:
  *
  *   puppeteer  --raw CDP-->  CdpBrowserEmulator  --forwardToTab-->  CdpReverseLink
  *                                                                        |