@qwen-code/qwen-code 0.19.8 → 0.19.9

package/chunks/{run-qwen-serve-JK2DL7PI.js → run-qwen-serve-DMWV5N6L.js}

@@ -3,10 +3,10 @@
 import {
   DaemonMetricsRing,
   computeCpuPercent
-} from "./chunk-II73RK2S.js";
+} from "./chunk-YVEDCAUE.js";
 import {
-  findCliEntryPath
-} from "./chunk-AHNXYU4O.js";
+  RUNTIME_STARTUP_CANCELLED_MESSAGE
+} from "./chunk-QUPXZXLV.js";
 import {
   CAPABILITIES_SCHEMA_VERSION,
   ClientMcpSenderRegistry,
@@ -22,71 +22,75 @@ import {
   getRateLimiter,
   getServeProtocolVersions,
   hostAllowlist,
+  isBrowserAutomationMcpAvailable,
   listenerMaxConnections,
   parseAllowOriginPatterns,
   parseDaemonStatusDetail,
   positiveFiniteOrNull,
   require_express,
   resolveWebShellDir
-} from "./chunk-YKZIAK7C.js";
+} from "./chunk-KHUQZZJ6.js";
 import {
   isLoopbackBind
-} from "./chunk-RNBYOUGV.js";
-import "./chunk-3HX5LZ6R.js";
-import "./chunk-7RYW5LQV.js";
-import {
-  RUNTIME_STARTUP_CANCELLED_MESSAGE
-} from "./chunk-GHOTR7HL.js";
+} from "./chunk-RXFQM6FQ.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-AGHU5VRK.js";
+} from "./chunk-PZL23GTM.js";
+import {
+  canonicalizeWorkspace
+} from "./chunk-W7FJ3N32.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
   normalizeCompactedReplayMaxBytes
-} from "./chunk-GLE2YUPU.js";
-import {
-  canonicalizeWorkspace
-} from "./chunk-ER3BKOLB.js";
+} from "./chunk-COH43MRJ.js";
+import "./chunk-WBL3FJEU.js";
+import "./chunk-T2NCM2ET.js";
 import {
   loadServeFastPathSettings,
   preResolveServeFastPathHomeEnvOverrides
-} from "./chunk-FBET5XZ2.js";
+} from "./chunk-3SJSQXNS.js";
+import {
+  getGlobalQwenDirLite,
+  resolveConfigPathLite
+} from "./chunk-3BTRNWWD.js";
+import "./chunk-QRUIS3DN.js";
 import {
+  ChannelWebhookEnqueueError,
   QWEN_SERVER_TOKEN_ENV
-} from "./chunk-S6RLAIUR.js";
+} from "./chunk-X4NKFGFJ.js";
 import {
   channelSelectionNames
-} from "./chunk-MX2YXRER.js";
+} from "./chunk-TJTKSVIV.js";
 import {
-  getGlobalQwenDirLite,
-  resolveConfigPathLite
-} from "./chunk-O2YT7VB4.js";
-import "./chunk-Z3I3QJK3.js";
+  sanitizeLogText
+} from "./chunk-34Z3U5RQ.js";
+import "./chunk-UDXSXLER.js";
+import {
+  isWithinRoot
+} from "./chunk-RDJSGHZE.js";
 import {
   getCliVersion
-} from "./chunk-UXEW557D.js";
-import "./chunk-43W4YSO6.js";
+} from "./chunk-3AHXV67U.js";
+import "./chunk-VJNBRRZG.js";
 import {
   writeStderrLine,
   writeStdoutLine
-} from "./chunk-Y6Z2O3WR.js";
-import {
-  isWithinRoot
-} from "./chunk-QYUE6W3T.js";
-import "./chunk-5P5XGNYH.js";
-import "./chunk-SKAZWEV5.js";
-import "./chunk-UWCTAVOD.js";
-import "./chunk-SYCJMSIJ.js";
+} from "./chunk-YUZI3WAC.js";
+import "./chunk-CU3L64TP.js";
+import "./chunk-ZJE7NSL3.js";
+import "./chunk-H6XPXXMH.js";
+import "./chunk-CR3C7WXL.js";
+import "./chunk-XWRJCPHC.js";
 import {
   finalizeStartupProfile,
   profileCheckpoint
-} from "./chunk-ITOGNELQ.js";
-import "./chunk-FXGLL2HL.js";
-import "./chunk-QN5NZ3UQ.js";
-import "./chunk-BR4QREVK.js";
+} from "./chunk-QSWDGAIC.js";
+import "./chunk-Q7YDKOGY.js";
+import "./chunk-DMTGGOSA.js";
+import "./chunk-YQ3U5MUC.js";
 import {
   init_esbuild_shims
-} from "./chunk-A4BMJM77.js";
+} from "./chunk-5O2XNYP6.js";
 import {
   __name,
   __toESM
@@ -95,7 +99,7 @@ import {
 // packages/cli/src/serve/run-qwen-serve.ts
 init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
-import { X509Certificate } from "node:crypto";
+import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
 import * as https from "node:https";
 import * as path from "node:path";
@@ -1074,6 +1078,10 @@ function extractContextFilename(value) {
   return void 0;
 }
 __name(extractContextFilename, "extractContextFilename");
+function sessionArtifactsPersistenceAvailableFromSettings(settings) {
+  return settings?.general?.chatRecording !== false;
+}
+__name(sessionArtifactsPersistenceAvailableFromSettings, "sessionArtifactsPersistenceAvailableFromSettings");
 var settingsWriteLocks = /* @__PURE__ */ new Map();
 function withSettingsLock(workspace, fn) {
   const prev = settingsWriteLocks.get(workspace) ?? Promise.resolve();
@@ -1085,11 +1093,13 @@ __name(withSettingsLock, "withSettingsLock");
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-NZQUOEFJ.js"),
-    import("./pidfile-NZYSCFRK.js")
-  ]).then(([supervisor, pidfile]) => ({
+    import("./channel-worker-supervisor-WSOAAYUO.js"),
+    import("./pidfile-D4I4FTVA.js"),
+    import("./cli-entry-path-4VJ3Y6T2.js")
+  ]).then(([supervisor, pidfile, cliEntryPath]) => ({
     createChannelWorkerSupervisor: supervisor.createChannelWorkerSupervisor,
-    channelServicePidfile: pidfile
+    channelServicePidfile: pidfile,
+    findCliEntryPath: cliEntryPath.findCliEntryPath
   })).catch((err) => {
     channelWorkerRuntimePromise = void 0;
     throw err;
@@ -1108,9 +1118,18 @@ function createDisabledChannelWorkerSupervisor() {
     },
     async stop() {
     },
+    async restart() {
+      return { ...snapshot, channels: [] };
+    },
     killAllSync() {
     },
-    snapshot: /* @__PURE__ */ __name(() => ({ ...snapshot, channels: [] }), "snapshot")
+    snapshot: /* @__PURE__ */ __name(() => ({ ...snapshot, channels: [] }), "snapshot"),
+    async enqueueWebhookTask() {
+      throw new ChannelWebhookEnqueueError(
+        "channel_worker_unavailable",
+        "Channel worker is not running."
+      );
+    }
   };
 }
 __name(createDisabledChannelWorkerSupervisor, "createDisabledChannelWorkerSupervisor");
@@ -1157,7 +1176,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./src-BBQSM46M.js");
+  coreRuntimePromise ??= import("./src-G5UPLZSZ.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -1187,10 +1206,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-3MI4XXP6.js"),
-    import("./environment-ATFTYMLZ.js"),
-    import("./loadedSettingsAdapter-LL5PSFKX.js"),
-    import("./trustedFolders-LAZZPZ3D.js")
+    import("./settings-3EYN66GK.js"),
+    import("./environment-5HSSRMJ7.js"),
+    import("./loadedSettingsAdapter-NOWEGDYJ.js"),
+    import("./trustedFolders-EOGT3UVS.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -1200,6 +1219,21 @@ function loadSettingsRuntimeModules() {
   return settingsRuntimePromise;
 }
 __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
+var channelWebhookConfigRuntimePromise;
+function loadChannelWebhookConfigRuntime() {
+  channelWebhookConfigRuntimePromise ??= Promise.all([
+    import("./runtime-57WWRVHN.js"),
+    import("./config-utils-NV2SVGPB.js")
+  ]).then(([channelRuntime, configUtils]) => ({
+    loadChannelsConfig: channelRuntime.loadChannelsConfig,
+    parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
+  })).catch((err) => {
+    channelWebhookConfigRuntimePromise = void 0;
+    throw err;
+  });
+  return channelWebhookConfigRuntimePromise;
+}
+__name(loadChannelWebhookConfigRuntime, "loadChannelWebhookConfigRuntime");
 async function loadServeRuntimeModules() {
   const [
     serverModule,
@@ -1213,16 +1247,16 @@ async function loadServeRuntimeModules() {
     totalSessionAdmissionModule,
     workspaceRegistryModule
   ] = await Promise.all([
-    import("./server-SGNPKX2O.js"),
-    import("./bridge-NA3ZQQKJ.js"),
-    import("./spawnChannel-UNV6W4DU.js"),
-    import("./workspace-service-CZRQZ4Q4.js"),
-    import("./types-QX5C3CHJ.js"),
-    import("./daemon-status-provider-GJRXY5EN.js"),
-    import("./workspace-providers-status-3W7E7DFW.js"),
-    import("./workspace-skills-status-K7WFREPD.js"),
-    import("./total-session-admission-ULXJWXFV.js"),
-    import("./workspace-registry-SXJZNN3O.js")
+    import("./server-Z22GCAXP.js"),
+    import("./bridge-BCJQ7BBB.js"),
+    import("./spawnChannel-JD7G4VU6.js"),
+    import("./workspace-service-RVLBMSMZ.js"),
+    import("./types-JNKGKUJT.js"),
+    import("./daemon-status-provider-B2UTZUJ2.js"),
+    import("./workspace-providers-status-4KMGETOJ.js"),
+    import("./workspace-skills-status-DS4ZVFTO.js"),
+    import("./total-session-admission-JOKNRIIA.js"),
+    import("./workspace-registry-24QFLQYH.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -1237,7 +1271,8 @@ async function loadServeRuntimeModules() {
     createWorkspaceProvidersStatusProvider: workspaceProvidersStatusModule.createWorkspaceProvidersStatusProvider,
     createWorkspaceSkillsStatusProvider: workspaceSkillsStatusModule.createWorkspaceSkillsStatusProvider,
     createTotalSessionAdmissionController: totalSessionAdmissionModule.createTotalSessionAdmissionController,
-    createWorkspaceRegistry: workspaceRegistryModule.createWorkspaceRegistry
+    createWorkspaceRegistry: workspaceRegistryModule.createWorkspaceRegistry,
+    createWorkspaceSessionOwnerIndex: workspaceRegistryModule.createWorkspaceSessionOwnerIndex
   };
 }
 __name(loadServeRuntimeModules, "loadServeRuntimeModules");
@@ -1261,7 +1296,7 @@ function sessionIdleTimeoutMs(value) {
   return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_IDLE_TIMEOUT_MS;
 }
 __name(sessionIdleTimeoutMs, "sessionIdleTimeoutMs");
-function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled) {
+function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, env) {
   return getAdvertisedServeFeatures(void 0, {
     requireAuth: opts.requireAuth === true,
     mcpPoolActive: opts.mcpPoolActive !== false,
@@ -1270,12 +1305,15 @@ function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled) {
     ...opts.writerIdleTimeoutMs !== void 0 ? { writerIdleTimeoutMs: opts.writerIdleTimeoutMs } : {},
     persistSettingAvailable: true,
     sessionShellCommandEnabled,
+    sessionArtifactsPersistenceAvailable,
     rateLimit: opts.rateLimit === true,
     reloadAvailable: true,
+    channelReloadAvailable: opts.channelSelection !== void 0,
     // Advertise the same WS feature flags as the runtime path (serve-features.ts)
     // so the bootstrap `/capabilities` window doesn't briefly under-report them.
     clientMcpOverWsEnabled: opts.clientMcpOverWs === true,
-    cdpTunnelOverWsEnabled: opts.cdpTunnelOverWs === true
+    cdpTunnelOverWsEnabled: opts.cdpTunnelOverWs === true,
+    browserAutomationMcpAvailable: isBrowserAutomationMcpAvailable(opts, env)
   });
 }
 __name(currentServeFeaturesForRunQwenServe, "currentServeFeaturesForRunQwenServe");
@@ -1287,7 +1325,9 @@ function createBootstrapCapabilities(input) {
     mode: input.opts.mode,
     features: currentServeFeaturesForRunQwenServe(
       input.opts,
-      input.sessionShellCommandEnabled
+      input.sessionShellCommandEnabled,
+      input.sessionArtifactsPersistenceAvailable,
+      input.env
     ),
     modelServices: [],
     workspaceCwd: input.boundWorkspace,
@@ -1432,6 +1472,7 @@ function createBootstrapServeApp(input) {
     daemonLog,
     qwenCodeVersion,
     sessionShellCommandEnabled,
+    sessionArtifactsPersistenceAvailable,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime,
     getRuntimeError,
@@ -1487,7 +1528,9 @@ function createBootstrapServeApp(input) {
         boundWorkspace,
         qwenCodeVersion,
         sessionShellCommandEnabled,
-        permissionPolicy
+        sessionArtifactsPersistenceAvailable,
+        permissionPolicy,
+        env: process.env
       })
     );
   });
@@ -1558,7 +1601,9 @@ function createBootstrapServeApp(input) {
         protocolVersions: getServeProtocolVersions(),
         features: currentServeFeaturesForRunQwenServe(
           opts,
-          sessionShellCommandEnabled
+          sessionShellCommandEnabled,
+          sessionArtifactsPersistenceAvailable,
+          process.env
         )
       },
       runtime: {
@@ -1630,13 +1675,12 @@ function createDelegatingServeApp(bootstrapApp, getRuntimeApp, options = {}) {
     const dispatch = /* @__PURE__ */ __name(async () => {
       let target = getRuntimeApp();
       if (!target && options.waitForDeferredRuntimeRoutes === true && !isBootstrapServeRoute(req) && !isCorsPreflightRequest(req) && options.startRuntime && options.runtimeReady) {
-        if (options.authenticateDeferredRuntimeRequest && !runSynchronousRequestGate(
-          options.authenticateDeferredRuntimeRequest,
-          req,
-          res,
-          next
-        )) {
-          return;
+        const webhookRequest = isChannelWebhookRequest(req);
+        const authGate = webhookRequest ? options.authenticateDeferredChannelWebhookRequest ?? options.authenticateDeferredRuntimeRequest : options.authenticateDeferredRuntimeRequest;
+        if (authGate) {
+          if (!runSynchronousRequestGate(authGate, req, res, next)) {
+            return;
+          }
         }
         options.startRuntime();
         try {
@@ -1658,6 +1702,80 @@ function isBootstrapServeRoute(req) {
   return BOOTSTRAP_SERVE_PATHS.has(path2);
 }
 __name(isBootstrapServeRoute, "isBootstrapServeRoute");
+function isChannelWebhookRequest(req) {
+  return req.method === "POST" && /^\/channels\/[^/]+\/webhooks\/[^/]+\/?$/u.test(req.path);
+}
+__name(isChannelWebhookRequest, "isChannelWebhookRequest");
+function createDeferredChannelWebhookAuth(workspace, runtime, daemonLog) {
+  return (req, res, next) => {
+    const match = /^\/channels\/([^/]+)\/webhooks\/([^/]+)\/?$/u.exec(req.path);
+    const channelName = decodeDeferredWebhookPathSegment(match?.[1]);
+    const source = decodeDeferredWebhookPathSegment(match?.[2]);
+    if (!channelName || !source) {
+      daemonLog.warn("deferred webhook auth failed", {
+        channelName: channelName ?? "unknown",
+        source: source ?? "unknown",
+        reason: "invalid webhook path"
+      });
+      res.status(401).json({ error: "Invalid webhook secret" });
+      return;
+    }
+    const secret = readDeferredWebhookSecret(
+      runtime,
+      workspace,
+      channelName,
+      source
+    );
+    if (!matchesWebhookSecret(req.get("x-qwen-webhook-secret"), secret)) {
+      daemonLog.warn("deferred webhook auth failed", {
+        channelName,
+        source,
+        reason: secret ? "secret mismatch" : "source not configured"
+      });
+      res.status(401).json({ error: "Invalid webhook secret" });
+      return;
+    }
+    next();
+  };
+}
+__name(createDeferredChannelWebhookAuth, "createDeferredChannelWebhookAuth");
+function decodeDeferredWebhookPathSegment(segment) {
+  if (segment === void 0) return void 0;
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return void 0;
+  }
+}
+__name(decodeDeferredWebhookPathSegment, "decodeDeferredWebhookPathSegment");
+function readDeferredWebhookSecret(runtime, workspace, channelName, source) {
+  try {
+    const rawConfig = runtime.loadChannelsConfig(workspace)[channelName];
+    if (typeof rawConfig !== "object" || rawConfig === null) {
+      return void 0;
+    }
+    return runtime.parseChannelWebhookConfig(
+      channelName,
+      rawConfig
+    )?.sources[source]?.secret;
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    writeStderrLine(
+      `[webhook-secret] failed to read deferred webhook secret for ${sanitizeLogText(channelName, 128)}/${sanitizeLogText(source, 128)}: ${sanitizeLogText(reason, 512)}`
+    );
+    return void 0;
+  }
+}
+__name(readDeferredWebhookSecret, "readDeferredWebhookSecret");
+function matchesWebhookSecret(candidate, expected) {
+  if (typeof candidate !== "string" || typeof expected !== "string" || expected.length === 0) {
+    return false;
+  }
+  const expectedDigest = createHash2("sha256").update(expected).digest();
+  const candidateDigest = createHash2("sha256").update(candidate).digest();
+  return timingSafeEqual(expectedDigest, candidateDigest);
+}
+__name(matchesWebhookSecret, "matchesWebhookSecret");
 function isCorsPreflightRequest(req) {
   return req.method === "OPTIONS" && Boolean(req.headers.origin) && Boolean(
     req.headers["access-control-request-method"] || req.headers["access-control-request-headers"]
@@ -1933,8 +2051,10 @@ async function runQwenServe(optsIn, deps = {}) {
   let permissionPolicy;
   let permissionConsensusQuorum;
   let bootSettings;
+  let sessionArtifactsPersistenceAvailable = true;
   try {
     bootSettings = deps.bootSettings ?? loadServeFastPathSettings(boundWorkspace);
+    sessionArtifactsPersistenceAvailable = sessionArtifactsPersistenceAvailableFromSettings(bootSettings);
     contextFilenameForInit = extractContextFilename(
       bootSettings.context?.fileName
     );
@@ -2114,6 +2234,7 @@ async function runQwenServe(optsIn, deps = {}) {
   }, "disposeDaemonEventLoopMonitor");
   let channelWorker = createDisabledChannelWorkerSupervisor();
   const getChannelWorkerSnapshot = /* @__PURE__ */ __name(() => channelWorker.snapshot(), "getChannelWorkerSnapshot");
+  const reloadChannelWorker = /* @__PURE__ */ __name(() => channelWorker.restart(), "reloadChannelWorker");
   const writeChannelWorkerPidfile = /* @__PURE__ */ __name((snapshot = channelWorker.snapshot(), options = {}) => {
     if (!opts.channelSelection || !channelServicePidfile) return;
     try {
@@ -2414,6 +2535,7 @@ async function runQwenServe(optsIn, deps = {}) {
         getBridges: /* @__PURE__ */ __name(() => runtimeBridges.length > 0 ? runtimeBridges : bridgeRef ? [bridgeRef] : [], "getBridges")
       }
     );
+    const sessionOwnerIndex = runtime.createWorkspaceSessionOwnerIndex();
     const persistDisabledToolsFn = /* @__PURE__ */ __name((workspace, toolName, enabled) => withSettingsLock(workspace, async () => {
       const fresh = settingsRuntime.settings.loadSettings(workspace);
       const wsScope = fresh.forScope(WORKSPACE_SETTING_SCOPE).settings;
@@ -2460,12 +2582,19 @@ async function runQwenServe(optsIn, deps = {}) {
         );
       }
     }), "persistSettingsFn");
+    const { createSubSessionLauncher } = await import("./create-sub-session-KPRT7ECJ.js");
+    const subSessionLauncher = createSubSessionLauncher({
+      getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
+      boundWorkspace
+    });
     const bridge = deps.bridge ?? runtime.createAcpSessionBridge({
       // Reverse tool channel: let `BridgeClient.extMethod` reach the WS
       // connection that hosts a named client MCP server (#5626).
       clientMcpSender: clientMcpSenderRegistry.lookup,
+      onCreateSubSession: subSessionLauncher.launch,
       maxSessions: opts.maxSessions,
       freshSessionAdmission: totalSessionAdmission.admit,
+      sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
       ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
       ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
       ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
@@ -2504,6 +2633,7 @@ async function runQwenServe(optsIn, deps = {}) {
       persistDisabledTools: persistDisabledToolsFn,
       persistSetting: persistSettingFn,
       persistSettings: persistSettingsFn,
+      preheatAcpChild: /* @__PURE__ */ __name(() => bridge.preheat(), "preheatAcpChild"),
       reloadDaemonEnv: /* @__PURE__ */ __name((workspace) => withSettingsLock(workspace, async () => {
         const fresh = settingsRuntime.settings.loadSettings(workspace, {
           skipLoadEnvironment: true
@@ -2614,6 +2744,7 @@ async function runQwenServe(optsIn, deps = {}) {
         }
       };
     }, "createRuntimeEnvMetadata");
+    const subSessionStoppers = [];
     for (const workspaceInput of workspaceInputs.slice(1)) {
       let secondarySettings;
       try {
@@ -2667,10 +2798,17 @@ async function runQwenServe(optsIn, deps = {}) {
         ...opts.experimentalLsp === true ? { extraArgs: ["--experimental-lsp"] } : {}
       });
       const secondaryClientMcpSenderRegistry = new ClientMcpSenderRegistry();
+      let secondaryBridgeRef;
+      const secondarySubSessionLauncher = createSubSessionLauncher({
+        getBridge: /* @__PURE__ */ __name(() => secondaryBridgeRef, "getBridge"),
+        boundWorkspace: workspaceInput.cwd
+      });
       const secondaryBridge = runtime.createAcpSessionBridge({
         clientMcpSender: secondaryClientMcpSenderRegistry.lookup,
+        onCreateSubSession: secondarySubSessionLauncher.launch,
         maxSessions: opts.maxSessions,
         freshSessionAdmission: totalSessionAdmission.admit,
+        sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
         ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
         ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
         ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
@@ -2696,8 +2834,10 @@ async function runQwenServe(optsIn, deps = {}) {
           fresh.setValue(WORKSPACE_SETTING_SCOPE, "tools.approvalMode", mode);
         }), "persistApprovalMode")
       });
+      secondaryBridgeRef = secondaryBridge;
       runtimeBridges.push(secondaryBridge);
       internalRuntimeBridgesForCleanup.push(secondaryBridge);
+      subSessionStoppers.push(secondarySubSessionLauncher.stop);
       const secondaryWorkspaceService = runtime.createDaemonWorkspaceService({
         boundWorkspace: workspaceInput.cwd,
         contextFilename: contextFilenameForInit ?? "QWEN.md",
@@ -2707,6 +2847,7 @@ async function runQwenServe(optsIn, deps = {}) {
         }),
         workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider(),
         isChannelLive: /* @__PURE__ */ __name(() => secondaryBridge.isChannelLive(), "isChannelLive"),
+        preheatAcpChild: /* @__PURE__ */ __name(() => secondaryBridge.preheat(), "preheatAcpChild"),
         persistDisabledTools: persistDisabledToolsFn,
         persistSetting: persistSettingFn,
         persistSettings: persistSettingsFn,
@@ -2772,7 +2913,9 @@ async function runQwenServe(optsIn, deps = {}) {
         clientMcpSenderRegistry: secondaryClientMcpSenderRegistry
       });
     }
-    const workspaceRegistry = runtime.createWorkspaceRegistry(workspaceRuntimes);
+    const workspaceRegistry = runtime.createWorkspaceRegistry(workspaceRuntimes, {
+      sessionOwnerIndex
+    });
     core.registerDaemonGaugeCallbacks({
       sessionCount: /* @__PURE__ */ __name(() => workspaceRegistry.list().reduce((sum, item) => sum + item.bridge.sessionCount, 0), "sessionCount"),
       sseCount: /* @__PURE__ */ __name(() => runtime.getActiveSseCount(), "sseCount"),
@@ -2864,8 +3007,163 @@ async function runQwenServe(optsIn, deps = {}) {
         metricsLoopDelay.disable();
       }
     };
+    const createDynamicWorkspaceRuntime = /* @__PURE__ */ __name(async (cwd) => {
+      let wsSettings;
+      try {
+        wsSettings = settingsRuntime.settings.loadSettings(cwd);
+      } catch (err) {
+        writeStderrLine(
+          `qwen serve: could not read full settings for dynamic workspace ${cwd} (${err instanceof Error ? err.message : String(err)}); falling back to defaults.`
+        );
+      }
+      const trusted = wsSettings ? settingsRuntime.trustedFolders.getWorkspaceTrustStatus(
+        wsSettings.merged,
+        cwd
+      ).effective.state === "trusted" : false;
+      const wsEnv = createRuntimeEnvMetadata(cwd, wsSettings);
+      const wsHash = core.hashDaemonWorkspace(cwd);
+      const wsFsFactory = runtime.resolveBridgeFsFactory({
+        boundWorkspaces: [cwd],
+        trusted,
+        emit: deps.fsAuditEmit,
+        pathLocks: sharedPathLocks,
+        ...customIgnoreFiles !== void 0 ? { customIgnoreFiles } : {}
+      });
+      const wsChannelFactory = runtime.createSpawnChannelFactory({
+        sourceEnv: wsEnv.effectiveEnv,
+        onDiagnosticLine: diagnosticSink,
+        pipeHooks: {
+          onMessageSent: /* @__PURE__ */ __name((bytes) => recordPipeMessage("outbound", bytes), "onMessageSent"),
+          onMessageReceived: /* @__PURE__ */ __name((bytes) => recordPipeMessage("inbound", bytes), "onMessageReceived"),
+          onMessageObserved: /* @__PURE__ */ __name(({ direction, bytes, message }) => observeLargePipeFrame({
+            direction: daemonPipeDirection(direction),
+            bytes,
+            message
+          }), "onMessageObserved")
+        },
+        ...opts.experimentalLsp === true ? { extraArgs: ["--experimental-lsp"] } : {}
+      });
+      const wsClientMcpRegistry = new ClientMcpSenderRegistry();
+      let wsBridgeRef;
+      const wsSubSessionLauncher = createSubSessionLauncher({
+        getBridge: /* @__PURE__ */ __name(() => wsBridgeRef, "getBridge"),
+        boundWorkspace: cwd
+      });
+      const wsBridge = runtime.createAcpSessionBridge({
+        clientMcpSender: wsClientMcpRegistry.lookup,
+        onCreateSubSession: wsSubSessionLauncher.launch,
+        maxSessions: opts.maxSessions,
+        freshSessionAdmission: totalSessionAdmission.admit,
+        sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
+        ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
+        ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
+        ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
+        ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
+        ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
+        ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+        ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
+        boundWorkspace: cwd,
+        sessionShellCommandEnabled,
+        childEnvOverrides,
+        channelFactory: wsChannelFactory,
+        onDiagnosticLine: diagnosticSink,
+        telemetry: createRuntimeBridgeTelemetry(wsHash),
+        ...permissionPolicy !== void 0 ? { permissionPolicy } : {},
+        ...permissionConsensusQuorum !== void 0 ? { permissionConsensusQuorum } : {},
+        permissionAudit: permissionAuditPublisher,
+        statusProvider: runtime.createDaemonStatusProvider({
+          env: wsEnv.effectiveEnv
+        }),
+        fileSystem: createBridgeFileSystemAdapter(wsFsFactory),
+        persistApprovalMode: /* @__PURE__ */ __name((workspace, mode) => withSettingsLock(workspace, async () => {
+          const fresh = settingsRuntime.settings.loadSettings(workspace);
+          fresh.setValue(WORKSPACE_SETTING_SCOPE, "tools.approvalMode", mode);
+        }), "persistApprovalMode")
+      });
+      wsBridgeRef = wsBridge;
+      const wsService = runtime.createDaemonWorkspaceService({
+        boundWorkspace: cwd,
+        contextFilename: contextFilenameForInit ?? "QWEN.md",
+        statusProvider: runtime.createDaemonStatusProvider({
+          env: wsEnv.effectiveEnv
+        }),
+        workspaceProvidersStatusProvider: runtime.createWorkspaceProvidersStatusProvider({
+          env: wsEnv.effectiveEnv
+        }),
+        workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider(),
+        isChannelLive: /* @__PURE__ */ __name(() => wsBridge.isChannelLive(), "isChannelLive"),
+        preheatAcpChild: /* @__PURE__ */ __name(() => wsBridge.preheat(), "preheatAcpChild"),
+        persistDisabledTools: persistDisabledToolsFn,
+        persistSetting: persistSettingFn,
+        persistSettings: persistSettingsFn,
+        reloadDaemonEnv: /* @__PURE__ */ __name((workspace) => withSettingsLock(workspace, async () => {
+          const fresh = settingsRuntime.settings.loadSettings(workspace, {
+            skipLoadEnvironment: true
+          });
+          const result = settingsRuntime.settings.reloadEnvironment(
+            fresh.merged,
+            workspace
+          );
+          try {
+            const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+              fresh.merged,
+              workspace,
+              daemonRuntimeBaseEnv
+            );
+            logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+            wsEnv.replace(refreshedRuntimeEnv.effectiveEnv);
+            wsEnv.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
+            wsEnv.metadata.envFileReadFailures.splice(
+              0,
+              wsEnv.metadata.envFileReadFailures.length,
+              ...refreshedRuntimeEnv.envFileReadFailures
+            );
+            wsEnv.metadata.overlayKeys.splice(
+              0,
+              wsEnv.metadata.overlayKeys.length,
+              ...refreshedRuntimeEnv.overlayKeys
+            );
+            wsEnv.metadata.envFilePaths.splice(
+              0,
+              wsEnv.metadata.envFilePaths.length,
+              ...refreshedRuntimeEnv.envFilePaths
+            );
+            delete wsEnv.metadata.fallbackReason;
+          } catch (err) {
+            wsEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+            daemonLog.warn(
+              "failed to rebuild dynamic runtime env snapshot after daemon env reload; preserving previous runtime env",
+              {
+                workspace,
+                error: wsEnv.metadata.fallbackReason
+              }
+            );
+          }
+          return result;
+        }), "reloadDaemonEnv"),
+        queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => wsBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
+        invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => wsBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
+        refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => wsBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
+        publishWorkspaceEvent: /* @__PURE__ */ __name((event) => wsBridge.publishWorkspaceEvent(event), "publishWorkspaceEvent")
+      });
+      runtimeBridges.push(wsBridge);
+      internalRuntimeBridgesForCleanup.push(wsBridge);
+      subSessionStoppers.push(wsSubSessionLauncher.stop);
+      return {
+        workspaceId: wsHash,
+        workspaceCwd: cwd,
+        primary: false,
+        trusted,
+        env: wsEnv.metadata,
+        bridge: wsBridge,
+        workspaceService: wsService,
+        routeFileSystemFactory: wsFsFactory,
+        clientMcpSenderRegistry: wsClientMcpRegistry
+      };
+    }, "createDynamicWorkspaceRuntime");
     const app2 = runtime.createServeApp(opts, () => actualPort, {
       workspaceRegistry,
+      createWorkspaceRuntime: createDynamicWorkspaceRuntime,
       bridge,
       webShellDir,
       boundWorkspace,
@@ -2880,6 +3178,11 @@ async function runQwenServe(optsIn, deps = {}) {
       primaryRuntimeEnv,
       daemonLog,
       getChannelWorkerSnapshot,
+      enqueueChannelWebhookTask: /* @__PURE__ */ __name((task) => channelWorker.enqueueWebhookTask(task), "enqueueChannelWebhookTask"),
+      // Gate both the `channel_reload` capability and the reload route on the
+      // presence of this dep, so it is advertised only when a channel worker
+      // exists to reload.
+      ...opts.channelSelection ? { reloadChannelWorker } : {},
       getPerfSnapshot: /* @__PURE__ */ __name(() => ({
         eventLoop: currentDaemonEventLoopMonitor.snapshot(),
         promptQueueWait: {
@@ -2903,6 +3206,9 @@ async function runQwenServe(optsIn, deps = {}) {
       persistDisabledTools: persistDisabledToolsFn,
       persistSetting: persistSettingFn,
       persistSettings: persistSettingsFn,
+      sessionArtifactsPersistenceAvailable: sessionArtifactsPersistenceAvailableFromSettings(
+        runtimeBootSettings?.merged
+      ),
       installAuthProvider: /* @__PURE__ */ __name((req) => withSettingsLock(
         boundWorkspace,
         async () => {
@@ -2941,6 +3247,8 @@ async function runQwenServe(optsIn, deps = {}) {
         }
       ), "installAuthProvider")
     });
+    app2.locals.subSessionStoppers = subSessionStoppers;
+    subSessionStoppers.push(subSessionLauncher.stop);
     return { app: app2, bridge };
   }, "buildRuntime");
   if (deps.bridge) {
@@ -2962,17 +3270,24 @@ async function runQwenServe(optsIn, deps = {}) {
     daemonLog,
     qwenCodeVersion: cliVersion,
     sessionShellCommandEnabled,
+    sessionArtifactsPersistenceAvailable,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime: workspaceInputs.length > 1,
     getRuntimeError: /* @__PURE__ */ __name(() => runtimeStartupError, "getRuntimeError"),
     getChannelWorkerSnapshot,
     onHealthServed: deferRuntimeUntilFirstHealth ? () => startRuntimeAfterHealth?.() : void 0
   });
+  const deferredChannelWebhookAuth = deferRuntimeUntilFirstHealth ? createDeferredChannelWebhookAuth(
+    boundWorkspace,
+    await loadChannelWebhookConfigRuntime(),
+    daemonLog
+  ) : void 0;
   const app = runtimeApp ?? createDelegatingServeApp(bootstrapApp, () => runtimeApp, {
     waitForDeferredRuntimeRoutes: deferRuntimeUntilFirstHealth,
     startRuntime: /* @__PURE__ */ __name(() => startRuntimeForRequest?.(), "startRuntime"),
     runtimeReady,
-    authenticateDeferredRuntimeRequest: bearerAuth(opts.token)
+    authenticateDeferredRuntimeRequest: bearerAuth(opts.token),
+    authenticateDeferredChannelWebhookRequest: deferredChannelWebhookAuth
   });
   let listenHostname = opts.hostname;
   if (opts.hostname.startsWith("[")) {
@@ -3010,7 +3325,8 @@ async function runQwenServe(optsIn, deps = {}) {
       try {
         if (opts.channelSelection) {
           const createSupervisor = deps.channelWorkerSupervisorFactory ?? channelRuntime?.createChannelWorkerSupervisor;
-          if (!createSupervisor) {
+          const findCliEntryPath = channelRuntime?.findCliEntryPath;
+          if (!createSupervisor || !findCliEntryPath) {
             throw new Error(
               "Channel worker supervisor runtime is not available."
             );
@@ -3311,6 +3627,10 @@ async function runQwenServe(optsIn, deps = {}) {
           closePromise = new Promise((res, rej) => {
             shuttingDown = true;
             app.locals.stopScheduledTaskKeepalive?.();
+            const stoppers = app.locals.subSessionStoppers;
+            if (stoppers) {
+              for (const stop of stoppers) stop();
+            }
             clearRuntimeStartAfterHealthTimer();
             clearRuntimeStartFallbackTimer();
             cancelDeferredRuntimeStartup();
@@ -3512,6 +3832,7 @@ async function runQwenServe(optsIn, deps = {}) {
 __name(runQwenServe, "runQwenServe");
 export {
   InvalidPolicyConfigError,
+  createDisabledChannelWorkerSupervisor,
   createLazyBridgeProxy,
   extractContextFilename,
   formatChannelWorkerDaemonUrl,