@qwen-code/qwen-code 0.20.1 → 0.20.2-gdpval-vl-agent.0

package/chunks/{bridge-XAK7JKMD.js → bridge-4M77KUEV.js}

@@ -6,17 +6,17 @@ import {
   createHttpAcpBridge,
   extractErrorCode,
   extractErrorMessage
-} from "./chunk-R7MPKABX.js";
+} from "./chunk-RMY5SX7S.js";
 import "./chunk-6RLROE6G.js";
 import "./chunk-COH43MRJ.js";
 import "./chunk-QR6U5QPP.js";
 import "./chunk-UH3WSE5L.js";
-import "./chunk-JHFVJQRO.js";
-import "./chunk-BWQRDISK.js";
+import "./chunk-6HOCJNO5.js";
+import "./chunk-ESQHGKPJ.js";
+import "./chunk-2RFKHEXL.js";
 import "./chunk-M5GB774H.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-2RFKHEXL.js";
-import "./chunk-GEB2CGUV.js";
+import "./chunk-BLAEKN6K.js";
 import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5M6IDOMF.js";
@@ -24,13 +24,13 @@ import "./chunk-T2L47JJK.js";
 import "./chunk-GPSKDNEE.js";
 import "./chunk-X6N25LXS.js";
 import "./chunk-E2UVIFI2.js";
+import "./chunk-L5F3T6TQ.js";
 import "./chunk-Q2YKNMLS.js";
 import "./chunk-XU457J4V.js";
 import "./chunk-VDDGDZMA.js";
 import "./chunk-KHOVYUHX.js";
 import "./chunk-SZRN75WQ.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-PIHKWN7M.js";
 import "./chunk-CPBF7KYF.js";
 import "./chunk-NABLFI57.js";
 import "./chunk-QBUDF33N.js";
@@ -40,19 +40,18 @@ import "./chunk-6AM5D4ME.js";
 import "./chunk-JCW2R7WC.js";
 import "./chunk-57FIIFJN.js";
 import "./chunk-HTO4JFDZ.js";
+import "./chunk-2HGTVAOW.js";
+import "./chunk-JESCGQM3.js";
+import "./chunk-RC7A7SSL.js";
+import "./chunk-C3EXYVFX.js";
 import "./chunk-XVNQMZ2I.js";
 import "./chunk-FODK6UMO.js";
 import "./chunk-GLNBDYUX.js";
-import "./chunk-TXRKCFWS.js";
-import "./chunk-JESCGQM3.js";
-import "./chunk-EWXXMRMP.js";
-import "./chunk-PPIHLGNE.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-5I5BM454.js";
-import "./chunk-5G2SK2OO.js";
+import "./chunk-U6TQGUNB.js";
 import "./chunk-VGC4I5JJ.js";
 import "./chunk-4K56OJFJ.js";
-import "./chunk-JYS55H6Z.js";
+import "./chunk-CBOQ3HY7.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
 import "./chunk-QNLNLENL.js";
@@ -60,9 +59,9 @@ import "./chunk-6X4GWOPW.js";
 import "./chunk-TYQMGACW.js";
 import "./chunk-TYAMGABM.js";
 import "./chunk-FCMNKVXT.js";
-import "./chunk-IS2SBY6T.js";
+import "./chunk-RCUEYZDE.js";
 import "./chunk-HTR4WV6U.js";
-import "./chunk-M7WBGLYP.js";
+import "./chunk-BULDBTYC.js";
 import "./chunk-U7ZFW55U.js";
 import "./chunk-NPQDJGKU.js";
 import "./chunk-YM3SZTH4.js";

package/chunks/{channel-worker-group-LFBT7K64.js → channel-worker-group-QZV2SP5U.js}

@@ -3,14 +3,14 @@
 import {
   ChannelWorkerReconcileError,
   createChannelWorkerGroup
-} from "./chunk-KQQ757OQ.js";
-import "./chunk-D7WXIW7H.js";
+} from "./chunk-ACW3VNUE.js";
+import "./chunk-H24SOJIQ.js";
 import "./chunk-QKTHJXCS.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-RVLZCXEE.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-5HBA2Z7V.js";
 import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5O2XNYP6.js";

package/chunks/{channel-worker-manager-3RUPERG2.js → channel-worker-manager-3GMAU45H.js}

@@ -2,19 +2,19 @@
 "use strict";
 import {
   ChannelWorkerReconcileError
-} from "./chunk-KQQ757OQ.js";
+} from "./chunk-ACW3VNUE.js";
 import {
   ChannelWorkerStartupError,
   ChannelWorkerStopError
-} from "./chunk-D7WXIW7H.js";
+} from "./chunk-H24SOJIQ.js";
 import {
   ChannelWebhookEnqueueError
 } from "./chunk-QKTHJXCS.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-RVLZCXEE.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-5HBA2Z7V.js";
 import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import {

package/chunks/{channel-worker-supervisor-A3KVATD3.js → channel-worker-supervisor-QCXSXCRY.js}

@@ -4,13 +4,13 @@ import {
   ChannelWorkerStartupError,
   ChannelWorkerStopError,
   createChannelWorkerSupervisor
-} from "./chunk-D7WXIW7H.js";
+} from "./chunk-H24SOJIQ.js";
 import "./chunk-QKTHJXCS.js";
 import "./chunk-TJTKSVIV.js";
 import "./chunk-M5GB774H.js";
+import "./chunk-5HBA2Z7V.js";
 import "./chunk-RVLZCXEE.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-5HBA2Z7V.js";
 import "./chunk-T4TZQJ7W.js";
 import "./chunk-H6XPXXMH.js";
 import "./chunk-5O2XNYP6.js";

package/chunks/{chunk-TXRKCFWS.js → chunk-2HGTVAOW.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-JESCGQM3.js";
 import {
   formatFetchErrorForUser
-} from "./chunk-EWXXMRMP.js";
+} from "./chunk-RC7A7SSL.js";
 import {
   combineAbortSignals
 } from "./chunk-DJ2GSRLV.js";

package/chunks/{chunk-7LH6CHKG.js → chunk-2P6CNEHB.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   BaseJsonOutputAdapter
-} from "./chunk-Q3GGJDYN.js";
+} from "./chunk-HPQFGWOD.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-CHXKGIMK.js → chunk-3IABAQR6.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   runExitCleanup
-} from "./chunk-D6ZOVZLF.js";
+} from "./chunk-O4OT3DM3.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-3Z43GZUQ.js

@@ -0,0 +1,32 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/utils/load-undici.ts
+init_esbuild_shims();
+var undiciModulePromise;
+async function loadUndici() {
+  undiciModulePromise ??= import("./undici-PYHBDDPN.js").then((mod) => {
+    const keys = Object.keys(mod);
+    if (keys.length === 1 && keys[0] === "default") {
+      return mod.default;
+    }
+    return mod;
+  });
+  return undiciModulePromise;
+}
+__name(loadUndici, "loadUndici");
+
+export {
+  loadUndici
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-KDPIV6WC.js → chunk-4CTP6VR6.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   isGitRepository
-} from "./chunk-GEB2CGUV.js";
+} from "./chunk-BLAEKN6K.js";
 import {
   createDebugLogger
 } from "./chunk-OQB4EXO4.js";

package/chunks/{chunk-BKZEHVPV.js → chunk-5G3ZVADU.js}

@@ -9,13 +9,13 @@ import {
 import {
   require_lib
 } from "./chunk-WBL3FJEU.js";
-import {
-  require_mime_db
-} from "./chunk-T2NCM2ET.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-2RFKHEXL.js";
+import {
+  require_mime_db
+} from "./chunk-T2NCM2ET.js";
 import {
   writeStderrLine
 } from "./chunk-OWAK7LMW.js";
@@ -41,7 +41,7 @@ import {
 var require_depd = __commonJS({
   "node_modules/depd/index.js"(exports, module) {
     init_esbuild_shims();
-    var relative = __require("path").relative;
+    var relative2 = __require("path").relative;
     module.exports = depd;
     var basePath = process.cwd();
     function containsNamespace(str, namespace) {
@@ -247,7 +247,7 @@ var require_depd = __commonJS({
     }
     __name(formatColor, "formatColor");
     function formatLocation(callSite) {
-      return relative(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
+      return relative2(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
     }
     __name(formatLocation, "formatLocation");
     function getStack() {
@@ -4731,10 +4731,10 @@ var require_raw_body = __commonJS({
       if (done) {
         return readStream(stream, encoding, length, limit, wrap(done));
       }
-      return new Promise(/* @__PURE__ */ __name(function executor(resolve, reject) {
+      return new Promise(/* @__PURE__ */ __name(function executor(resolve2, reject) {
         readStream(stream, encoding, length, limit, /* @__PURE__ */ __name(function onRead(err, buf) {
           if (err) return reject(err);
-          resolve(buf);
+          resolve2(buf);
         }, "onRead"));
       }, "executor"));
     }
@@ -10207,11 +10207,11 @@ var require_view = __commonJS({
     var debug = require_src()("express:view");
     var path2 = __require("node:path");
     var fs = __require("node:fs");
-    var dirname2 = path2.dirname;
-    var basename2 = path2.basename;
+    var dirname3 = path2.dirname;
+    var basename3 = path2.basename;
     var extname = path2.extname;
-    var join2 = path2.join;
-    var resolve = path2.resolve;
+    var join3 = path2.join;
+    var resolve2 = path2.resolve;
     module.exports = View;
     function View(name, options) {
       var opts = options || {};
@@ -10246,9 +10246,9 @@ var require_view = __commonJS({
       debug('lookup "%s"', name);
       for (var i = 0; i < roots.length && !path3; i++) {
         var root = roots[i];
-        var loc = resolve(root, name);
-        var dir = dirname2(loc);
-        var file = basename2(loc);
+        var loc = resolve2(root, name);
+        var dir = dirname3(loc);
+        var file = basename3(loc);
         path3 = this.resolve(dir, file);
       }
       return path3;
@@ -10271,14 +10271,14 @@ var require_view = __commonJS({
       }, "onRender"));
       sync = false;
     }, "render");
-    View.prototype.resolve = /* @__PURE__ */ __name(function resolve2(dir, file) {
+    View.prototype.resolve = /* @__PURE__ */ __name(function resolve3(dir, file) {
       var ext = this.ext;
-      var path3 = join2(dir, file);
+      var path3 = join3(dir, file);
       var stat = tryStat(path3);
       if (stat && stat.isFile()) {
         return path3;
       }
-      path3 = join2(dir, basename2(file, ext), "index" + ext);
+      path3 = join3(dir, basename3(file, ext), "index" + ext);
       stat = tryStat(path3);
       if (stat && stat.isFile()) {
         return path3;
@@ -12515,7 +12515,7 @@ var require_application = __commonJS({
     var compileETag = require_utils2().compileETag;
     var compileQueryParser = require_utils2().compileQueryParser;
     var compileTrust = require_utils2().compileTrust;
-    var resolve = __require("node:path").resolve;
+    var resolve2 = __require("node:path").resolve;
     var once = require_once();
     var Router = require_router();
     var slice = Array.prototype.slice;
@@ -12569,7 +12569,7 @@ var require_application = __commonJS({
       this.mountpath = "/";
       this.locals.settings = this.settings;
       this.set("view", View);
-      this.set("views", resolve("views"));
+      this.set("views", resolve2("views"));
       this.set("jsonp callback name", "callback");
       if (env === "production") {
         this.enable("view cache");
@@ -13761,9 +13761,9 @@ var require_content_disposition = __commonJS({
       if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
         throw new TypeError("fallback must be ISO-8859-1 string");
       }
-      var name = basename2(filename);
+      var name = basename3(filename);
       var isQuotedString = TEXT_REGEXP.test(name);
-      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename2(fallback);
+      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename3(fallback);
       var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
       if (hasFallback || !isQuotedString || hasHexEscape(name)) {
         params["filename*"] = name;
@@ -13892,7 +13892,7 @@ var require_content_disposition = __commonJS({
       this.parameters = parameters;
     }
     __name(ContentDisposition, "ContentDisposition");
-    function basename2(path2) {
+    function basename3(path2) {
       const normalized = path2.replaceAll("\\", "/");
       let end = normalized.length;
       while (end > 0 && normalized[end - 1] === "/") {
@@ -13907,7 +13907,7 @@ var require_content_disposition = __commonJS({
       }
       return normalized.slice(start + 1, end);
     }
-    __name(basename2, "basename");
+    __name(basename3, "basename");
     function isHexDigit(char) {
       const code = char.charCodeAt(0);
       return code >= 48 && code <= 57 || // 0-9
@@ -14158,9 +14158,9 @@ var require_send = __commonJS({
     var Stream = __require("stream");
     var util = __require("util");
     var extname = path2.extname;
-    var join2 = path2.join;
+    var join3 = path2.join;
     var normalize = path2.normalize;
-    var resolve = path2.resolve;
+    var resolve2 = path2.resolve;
     var sep = path2.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
@@ -14190,7 +14190,7 @@ var require_send = __commonJS({
       this._maxage = opts.maxAge || opts.maxage;
       this._maxage = typeof this._maxage === "string" ? ms(this._maxage) : Number(this._maxage);
       this._maxage = !isNaN(this._maxage) ? Math.min(Math.max(0, this._maxage), MAX_MAXAGE) : 0;
-      this._root = opts.root ? resolve(opts.root) : null;
+      this._root = opts.root ? resolve2(opts.root) : null;
     }
     __name(SendStream, "SendStream");
     util.inherits(SendStream, Stream);
@@ -14332,7 +14332,7 @@ var require_send = __commonJS({
           return res;
         }
         parts = path3.split(sep);
-        path3 = normalize(join2(root, path3));
+        path3 = normalize(join3(root, path3));
       } else {
         if (UP_PATH_REGEXP.test(path3)) {
           debug('malicious path "%s"', path3);
@@ -14340,7 +14340,7 @@ var require_send = __commonJS({
           return res;
         }
         parts = normalize(path3).split(sep);
-        path3 = resolve(path3);
+        path3 = resolve2(path3);
       }
       if (containsDotFile(parts)) {
         debug('%s dotfile "%s"', this._dotfiles, path3);
@@ -14466,7 +14466,7 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join2(path3, self._index[i]);
+        var p = join3(path3, self._index[i]);
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -14738,7 +14738,7 @@ var require_response = __commonJS({
     var cookie = require_cookie();
     var send = require_send();
     var extname = path2.extname;
-    var resolve = path2.resolve;
+    var resolve2 = path2.resolve;
     var vary = require_vary();
     var { Buffer: Buffer2 } = __require("node:buffer");
     var res = Object.create(http.ServerResponse.prototype);
@@ -14944,7 +14944,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve(path3) : path3;
+      var fullPath = !opts.root ? resolve2(path3) : path3;
       return this.sendFile(fullPath, opts, done);
     }, "download");
     res.contentType = res.type = /* @__PURE__ */ __name(function contentType(type) {
@@ -15203,7 +15203,7 @@ var require_serve_static = __commonJS({
     var encodeUrl = require_encodeurl();
     var escapeHtml = require_escape_html();
     var parseUrl = require_parseurl();
-    var resolve = __require("path").resolve;
+    var resolve2 = __require("path").resolve;
     var send = require_send();
     var url = __require("url");
     module.exports = serveStatic;
@@ -15222,7 +15222,7 @@ var require_serve_static = __commonJS({
         throw new TypeError("option setHeaders must be function");
       }
       opts.maxage = opts.maxage || opts.maxAge || 0;
-      opts.root = resolve(root);
+      opts.root = resolve2(root);
       var onDirectory = redirect ? createRedirectDirectoryListener() : createNotFoundDirectoryListener();
       return /* @__PURE__ */ __name(function serveStatic2(req, res, next) {
         if (req.method !== "GET" && req.method !== "HEAD") {
@@ -15564,7 +15564,7 @@ var DeviceFlowRegistry = class {
     let startTimer;
     try {
       startResult = await new Promise(
-        (resolve, reject) => {
+        (resolve2, reject) => {
           startTimer = this.schedule(DEVICE_FLOW_START_TIMEOUT_MS, () => {
             try {
               cancelController.abort(new Error("device-flow start timeout"));
@@ -15576,7 +15576,7 @@ var DeviceFlowRegistry = class {
               )
             );
           });
-          provider.start({ signal: cancelController.signal }).then(resolve, reject);
+          provider.start({ signal: cancelController.signal }).then(resolve2, reject);
         }
       );
     } finally {
@@ -15728,7 +15728,7 @@ var DeviceFlowRegistry = class {
     let pollTimer;
     let providerPollPromise;
     try {
-      result = await new Promise((resolve, reject) => {
+      result = await new Promise((resolve2, reject) => {
         pollTimer = this.schedule(DEVICE_FLOW_POLL_TIMEOUT_MS, () => {
           const timeoutError = makeRegistryPollTimeoutError(
             DEVICE_FLOW_POLL_TIMEOUT_MS
@@ -15746,7 +15746,7 @@ var DeviceFlowRegistry = class {
           },
           { signal: entry.cancelController.signal }
         );
-        providerPollPromise.then(resolve, reject);
+        providerPollPromise.then(resolve2, reject);
       });
     } catch (err) {
       if (err instanceof DeviceFlowPollTimeoutError && err._isRegistryTimeout === true) {
@@ -15862,7 +15862,7 @@ var DeviceFlowRegistry = class {
         );
         if (persistError === void 0) {
           try {
-            metadata = await new Promise((resolve, reject) => {
+            metadata = await new Promise((resolve2, reject) => {
               persistTimer = this.schedule(
                 DEVICE_FLOW_PERSIST_TIMEOUT_MS,
                 () => {
@@ -15874,7 +15874,7 @@ var DeviceFlowRegistry = class {
                   reject(new Error("persist timeout"));
                 }
               );
-              persistTracker.then(resolve, reject);
+              persistTracker.then(resolve2, reject);
             });
           } catch (err) {
             persistError = err;
@@ -16199,8 +16199,8 @@ var PathMutexRegistry = class {
   async runExclusive(key, fn) {
     const previous = this.tails.get(key) ?? Promise.resolve();
     let release;
-    const current = new Promise((resolve) => {
-      release = resolve;
+    const current = new Promise((resolve2) => {
+      release = resolve2;
     });
     const tail = previous.catch(() => void 0).then(() => current);
     this.tails.set(key, tail);
@@ -16790,10 +16790,12 @@ var SERVE_CAPABILITY_REGISTRY = {
   multi_workspace_session_rewind: { since: "v1" },
   // Singular session shell routes resolve the owning live workspace runtime.
   multi_workspace_session_shell: { since: "v1" },
+  dynamic_workspace_registration: { since: "v1" },
   persistent_workspace_registration: { since: "v1" },
   // Optional presentation-only names and updates to those names for workspace
   // runtimes. Workspace ids and canonical paths remain the routing identities.
   workspace_display_name: { since: "v1" },
+  scratch_workspace_registration: { since: "v1" },
   workspace_runtime_removal: { since: "v1" },
   // Workspace-qualified core REST routes under `/workspaces/:workspace/...`.
   // Covers core file/status/permissions/trust/lifecycle/MCP/tool, memory,
@@ -16911,10 +16913,18 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
     "multi_workspace_session_shell",
     (toggles) => toggles.multiWorkspaceSessionsEnabled === true && toggles.sessionShellCommandEnabled === true
   ],
+  [
+    "dynamic_workspace_registration",
+    (toggles) => toggles.dynamicWorkspaceRegistrationAvailable === true
+  ],
   [
     "persistent_workspace_registration",
     (toggles) => toggles.persistentWorkspaceRegistrationAvailable === true
   ],
+  [
+    "scratch_workspace_registration",
+    (toggles) => toggles.scratchWorkspaceRegistrationAvailable === true
+  ],
   [
     "workspace_runtime_removal",
     (toggles) => toggles.workspaceRuntimeRemovalAvailable === true
@@ -16981,6 +16991,93 @@ __name(getServeProtocolVersions, "getServeProtocolVersions");
 init_esbuild_shims();
 var CAPABILITIES_SCHEMA_VERSION = 1;
 
+// packages/cli/src/serve/managed-scratch-workspace.ts
+init_esbuild_shims();
+import { lstatSync, mkdirSync, realpathSync } from "node:fs";
+import { lstat, mkdtemp } from "node:fs/promises";
+import {
+  basename as basename2,
+  dirname as dirname2,
+  isAbsolute,
+  join as join2,
+  relative,
+  resolve
+} from "node:path";
+var isSamePath = /* @__PURE__ */ __name((left, right) => process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right, "isSamePath");
+var isWithinRoot = /* @__PURE__ */ __name((candidate, root) => {
+  const rel = relative(root, candidate);
+  return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}, "isWithinRoot");
+function isManagedScratchChild(canonicalCwd, canonicalRoot) {
+  return isSamePath(dirname2(canonicalCwd), canonicalRoot) && /^scratch-.+/.test(basename2(canonicalCwd));
+}
+__name(isManagedScratchChild, "isManagedScratchChild");
+function isScratchRootCompatible(canonicalCwd, canonicalRoot) {
+  if (isSamePath(canonicalCwd, canonicalRoot)) return false;
+  if (isManagedScratchChild(canonicalCwd, canonicalRoot)) return true;
+  return !isWithinRoot(canonicalCwd, canonicalRoot) && !isWithinRoot(canonicalRoot, canonicalCwd);
+}
+__name(isScratchRootCompatible, "isScratchRootCompatible");
+function validateRootStats(stats) {
+  if (stats.isSymbolicLink() || !stats.isDirectory()) {
+    throw new Error("Managed scratch root must be a non-symlink directory");
+  }
+  if (process.platform !== "win32" && typeof process.getuid === "function" && stats.uid !== process.getuid()) {
+    throw new Error("Managed scratch root must be owned by the daemon user");
+  }
+  if (process.platform !== "win32" && (stats.mode & 63) !== 0) {
+    throw new Error(
+      "Managed scratch root must be accessible only to its owner"
+    );
+  }
+}
+__name(validateRootStats, "validateRootStats");
+function prepareManagedScratchRoot(root, startupWorkspaceCwds) {
+  mkdirSync(root, { recursive: true, mode: 448 });
+  const before = lstatSync(root);
+  validateRootStats(before);
+  const canonicalRoot = realpathSync.native(resolve(root));
+  const after = lstatSync(canonicalRoot);
+  validateRootStats(after);
+  if (before.dev !== after.dev || before.ino !== after.ino) {
+    throw new Error("Managed scratch root identity changed during validation");
+  }
+  if (startupWorkspaceCwds.some(
+    (cwd) => !isScratchRootCompatible(cwd, canonicalRoot)
+  )) {
+    throw new Error("Managed scratch root conflicts with a startup workspace");
+  }
+  return {
+    canonicalRoot,
+    device: after.dev,
+    inode: after.ino
+  };
+}
+__name(prepareManagedScratchRoot, "prepareManagedScratchRoot");
+async function revalidateManagedScratchRoot(root) {
+  const stats = await lstat(root.canonicalRoot);
+  validateRootStats(stats);
+  if (stats.dev !== root.device || stats.ino !== root.inode) {
+    throw new Error("Managed scratch root identity changed");
+  }
+  const canonical = realpathSync.native(root.canonicalRoot);
+  if (!isSamePath(canonical, root.canonicalRoot)) {
+    throw new Error("Managed scratch root canonical path changed");
+  }
+}
+__name(revalidateManagedScratchRoot, "revalidateManagedScratchRoot");
+async function createManagedScratchDirectory(root) {
+  await revalidateManagedScratchRoot(root);
+  const created = await mkdtemp(join2(root.canonicalRoot, "scratch-"));
+  const canonical = realpathSync.native(created);
+  if (!isManagedScratchChild(canonical, root.canonicalRoot)) {
+    throw new Error("Managed scratch directory escaped its accepted root");
+  }
+  await revalidateManagedScratchRoot(root);
+  return canonical;
+}
+__name(createManagedScratchDirectory, "createManagedScratchDirectory");
+
 // packages/cli/src/serve/server/request-helpers.ts
 init_esbuild_shims();
 function sendJsonBodyParserError(res, err) {
@@ -18219,19 +18316,19 @@ var WorkspaceVoiceCoordinator = class {
       return;
     }
     let resolveIdle;
-    const idle = new Promise((resolve) => {
-      resolveIdle = resolve;
-      state.idleWaiters.add(resolve);
+    const idle = new Promise((resolve2) => {
+      resolveIdle = resolve2;
+      state.idleWaiters.add(resolve2);
     });
     let timeout;
     let timedOut = false;
     try {
       await Promise.race([
         idle,
-        new Promise((resolve) => {
+        new Promise((resolve2) => {
           timeout = setTimeout(() => {
             timedOut = true;
-            resolve();
+            resolve2();
           }, DISPOSE_WAIT_MS);
           timeout.unref?.();
         })
@@ -18265,7 +18362,7 @@ var WorkspaceVoiceCoordinator = class {
     if (!state || !state.leases.delete(lease)) return;
     this.active--;
     if (state.leases.size === 0) {
-      for (const resolve of state.idleWaiters) resolve();
+      for (const resolve2 of state.idleWaiters) resolve2();
       state.idleWaiters.clear();
     }
     this.deleteIfIdle(runtime, state);
@@ -18434,6 +18531,10 @@ export {
   getAdvertisedServeFeatures,
   getServeProtocolVersions,
   CAPABILITIES_SCHEMA_VERSION,
+  isManagedScratchChild,
+  isScratchRootCompatible,
+  prepareManagedScratchRoot,
+  createManagedScratchDirectory,
   sendJsonBodyParserError,
   CLIENT_ID_HEADER,
   MAX_CLIENT_ID_LENGTH,

package/chunks/{chunk-BZAEENUV.js → chunk-6GEJX3LE.js}

@@ -2,13 +2,13 @@
 "use strict";
 import {
   useKeypress
-} from "./chunk-Q2V2ADXF.js";
+} from "./chunk-FTNI3D7D.js";
 import {
   require_react
 } from "./chunk-5QWWOFGG.js";
 import {
   t
-} from "./chunk-WCFTQD7H.js";
+} from "./chunk-YLSB23Y2.js";
 import {
   APPROVAL_MODES
 } from "./chunk-WHGVTP7Q.js";