@qwen-code/qwen-code 0.20.2-headless-image-routing.1 → 0.21.0

package/chunks/{server-E4N4AI6Z.js → server-4UMH7OIZ.js}

@@ -8,21 +8,24 @@ import {
   formatWorkspaceMemoryDreamSummary,
   formatWorkspaceMemoryForgetSummary,
   isValidServerName,
+  normalizeChannelDelivery,
+  parseChannelDelivery,
   redactMcpServersSetting,
   replayTranscriptRecordPage,
   restoreRedactedMcpServersSetting,
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-TJDW42MV.js";
+} from "./chunk-RIBKPMRP.js";
 import {
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-ZHERRXZJ.js";
+} from "./chunk-BJX6ZSUK.js";
 import {
   SetupGithubError,
   collectSessionData,
+  createTranscriptMessageUpdate,
   generateExportFilename,
   normalizeSessionData,
   setupGithub,
@@ -30,21 +33,66 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-JC26SJ5Y.js";
+} from "./chunk-EBJQ6AXW.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-4K7VDKAD.js";
-import "./chunk-LNDD3IML.js";
-import "./chunk-RS7MT2QG.js";
-import "./chunk-H2XVO6NE.js";
+} from "./chunk-RHLZR4E5.js";
+import "./chunk-IPUUTYMV.js";
+import "./chunk-WCXCRJYB.js";
+import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-QTERJVPZ.js";
 import "./chunk-3Z43GZUQ.js";
+import {
+  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
+  MAX_WORKSPACE_SKILL_NAME_LENGTH,
+  WorkspaceSkillManagementError,
+  WorkspaceVoiceError,
+  buildWorkspaceVoiceSettingsWrites,
+  buildWorkspaceVoiceStatus,
+  createDaemonWorkspaceService,
+  hasConfiguredBatchVoiceTranscriptionModel,
+  transcribeWorkspaceVoiceAudio,
+  validateWorkspaceSkillName,
+  validateWorkspaceVoiceState,
+  voiceSettingsScopeToWire
+} from "./chunk-TGILQ3YH.js";
+import {
+  PermissionRulesValidationError,
+  buildPermissionSettings,
+  isPermissionRuleType,
+  normalizePermissionRules,
+  readPermissionRuleSet
+} from "./chunk-VRYUBFMC.js";
+import {
+  assertVoiceBaseUrlNetworkAllowed,
+  isStreamingVoiceModel,
+  resolveVoiceStreamConfig,
+  resolveVoiceTranscriptionConfig,
+  sanitizeVoiceErrorMessage,
+  transcribeVoiceAudio
+} from "./chunk-H4SBPHSA.js";
+import {
+  isVoiceEnabled,
+  isVoiceMode,
+  readVoiceModel
+} from "./chunk-YBL3QUDD.js";
+import "./chunk-ZD6UTE4A.js";
+import {
+  WorkspacePermissionRulesSessionRequiredError,
+  WorkspaceSettingsPartialPersistError,
+  WorkspaceSkillNotFoundError,
+  WorkspaceSkillNotToggleableError
+} from "./chunk-OA4JVLSA.js";
+import {
+  createTotalSessionAdmissionController
+} from "./chunk-VYPFXUCB.js";
 import {
   createSingleWorkspaceRegistry,
   createWorkspaceSessionOwnerIndex
 } from "./chunk-UGYMA4EI.js";
+import "./chunk-GRC5HGPI.js";
 import {
   CAPABILITIES_SCHEMA_VERSION,
   CLIENT_ID_HEADER,
@@ -102,87 +150,33 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-5G3ZVADU.js";
+} from "./chunk-IJTOWOD7.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
+import {
+  daemonObservedContactsPath,
+  loadChannelsConfig
+} from "./chunk-PSOO6YXD.js";
+import "./chunk-PC6JANNU.js";
+import "./chunk-57OAHC2Y.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-46DK772E.js";
+} from "./chunk-J24WCGIN.js";
 import "./chunk-LXXMOYPL.js";
-import "./chunk-3HFNGB2O.js";
+import "./chunk-MVSUYZDT.js";
 import "./chunk-E5Z2AVNV.js";
-import {
-  createWorkspaceProvidersStatusProvider
-} from "./chunk-NWZY2SPY.js";
-import {
-  getAuthTypeFromEnv,
-  resolveCliGenerationConfig
-} from "./chunk-JZSM2IZ3.js";
-import {
-  snapshotProcessEnv
-} from "./chunk-FUFCALSJ.js";
-import {
-  createWorkspaceSkillsStatusProvider
-} from "./chunk-YO2XRXY6.js";
-import "./chunk-2W3OOD4W.js";
-import {
-  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
-  MAX_WORKSPACE_SKILL_NAME_LENGTH,
-  WorkspaceSkillManagementError,
-  WorkspaceVoiceError,
-  buildWorkspaceVoiceSettingsWrites,
-  buildWorkspaceVoiceStatus,
-  createDaemonWorkspaceService,
-  hasConfiguredBatchVoiceTranscriptionModel,
-  transcribeWorkspaceVoiceAudio,
-  validateWorkspaceSkillName,
-  validateWorkspaceVoiceState,
-  voiceSettingsScopeToWire
-} from "./chunk-PQIVAWXN.js";
-import {
-  PermissionRulesValidationError,
-  buildPermissionSettings,
-  isPermissionRuleType,
-  normalizePermissionRules,
-  readPermissionRuleSet
-} from "./chunk-EBXZ2YGV.js";
-import {
-  assertVoiceBaseUrlNetworkAllowed,
-  isStreamingVoiceModel,
-  resolveVoiceStreamConfig,
-  resolveVoiceTranscriptionConfig,
-  sanitizeVoiceErrorMessage,
-  transcribeVoiceAudio
-} from "./chunk-MLYGPZGU.js";
-import {
-  isVoiceEnabled,
-  isVoiceMode,
-  readVoiceModel
-} from "./chunk-7NR2AIK6.js";
-import "./chunk-QLJUC7TG.js";
-import {
-  WorkspacePermissionRulesSessionRequiredError,
-  WorkspaceSettingsPartialPersistError,
-  WorkspaceSkillNotFoundError,
-  WorkspaceSkillNotToggleableError
-} from "./chunk-OA4JVLSA.js";
-import {
-  createTotalSessionAdmissionController
-} from "./chunk-VYPFXUCB.js";
-import "./chunk-GRC5HGPI.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-QOZOIPSF.js";
+} from "./chunk-KIM5GUMA.js";
 import {
   EVENT_SCHEMA_VERSION,
+  EventBus,
   SubscriberLimitExceededError
-} from "./chunk-6RLROE6G.js";
-import "./chunk-COH43MRJ.js";
-import "./chunk-QR6U5QPP.js";
+} from "./chunk-GLWP3FDB.js";
 import {
   BranchWhilePromptActiveError,
   CancelSentinelCollisionError,
@@ -216,24 +210,35 @@ import {
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
 } from "./chunk-UH3WSE5L.js";
-import "./chunk-WBL3FJEU.js";
+import "./chunk-COH43MRJ.js";
+import "./chunk-3SJ43L4W.js";
+import "./chunk-7JURR4JT.js";
 import {
-  daemonObservedContactsPath,
-  loadChannelsConfig
-} from "./chunk-RECUEJ7B.js";
-import "./chunk-7THPNISK.js";
-import "./chunk-57OAHC2Y.js";
+  createWorkspaceProvidersStatusProvider
+} from "./chunk-FSITMZJH.js";
 import {
-  parseChannelWebhookConfigLenient
-} from "./chunk-GHRSKGHF.js";
-import "./chunk-6ZBPS62S.js";
-import "./chunk-V6WHFGST.js";
-import "./chunk-FZPTCQY7.js";
+  getAuthTypeFromEnv,
+  resolveCliGenerationConfig
+} from "./chunk-KMQ33DO4.js";
+import {
+  snapshotProcessEnv
+} from "./chunk-ETSW4KLJ.js";
+import {
+  createWorkspaceSkillsStatusProvider
+} from "./chunk-ACY3A37B.js";
+import "./chunk-2W3OOD4W.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-O4BHWVUD.js";
+} from "./chunk-VIA5XA4U.js";
+import "./chunk-WBL3FJEU.js";
+import "./chunk-T2NCM2ET.js";
+import {
+  parseChannelWebhookConfigLenient
+} from "./chunk-4WIZGAH3.js";
+import "./chunk-7ZCNENPP.js";
+import "./chunk-V6WHFGST.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceDisplayNameValidationError,
@@ -241,7 +246,7 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-7AUH6A4T.js";
+} from "./chunk-Q4M4MDQ4.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
@@ -249,26 +254,28 @@ import {
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-2RFKHEXL.js";
 import {
+  ChannelDeliveryError,
   MAX_CHANNEL_STARTUP_FAILURES,
   MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
   QWEN_SERVER_TOKEN_ENV,
+  isChannelDeliveryError,
   isChannelWebhookEnqueueError,
   normalizeWorkerDiagnostic
-} from "./chunk-QKTHJXCS.js";
+} from "./chunk-LK7CHLVP.js";
 import {
   normalizeServeChannelSelection
-} from "./chunk-TJTKSVIV.js";
+} from "./chunk-JLU636DO.js";
+import "./chunk-BK2UNYWD.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
-import "./chunk-5HBA2Z7V.js";
-import "./chunk-T2NCM2ET.js";
 import {
   sanitizeLogText
-} from "./chunk-RVLZCXEE.js";
+} from "./chunk-RWTEFFPU.js";
 import "./chunk-UDXSXLER.js";
+import "./chunk-5HBA2Z7V.js";
 import {
   getDialogSettingKeys,
   getModelProvidersOwnerScope,
@@ -278,23 +285,23 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-XCXYRDHB.js";
+} from "./chunk-TEHGS6UP.js";
 import "./chunk-RKUWKYED.js";
+import "./chunk-GOXKNSDZ.js";
+import "./chunk-IDS7MSUP.js";
 import {
   SUPPORTED_LANGUAGES,
   detectSystemLanguage,
   resolveLanguageSetting,
   resolveSupportedLanguage
-} from "./chunk-VRRF3GW5.js";
-import "./chunk-RWV32G2M.js";
-import "./chunk-GOXKNSDZ.js";
-import "./chunk-IDS7MSUP.js";
-import "./chunk-QRUIS3DN.js";
-import "./chunk-3EK5ZOUQ.js";
+} from "./chunk-LKEJ26GS.js";
+import "./chunk-LH2BYDQ5.js";
+import "./chunk-6PEXNQTX.js";
+import "./chunk-YX324OPW.js";
 import "./chunk-VJNBRRZG.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-4PTLZ3NX.js";
+} from "./chunk-Z2BC6UJ5.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -345,10 +352,12 @@ import {
   fetchGitDiffHunksForFile,
   fetchGitLog,
   getGitWorkingTreeStatus,
+  getSubagentSessionDir,
   glob,
   loadIgnoreRules,
   loadUsageHistoryWithLive,
   parseInstallSource,
+  readAgentMeta,
   readWorktreeSession,
   redactUrlCredentials,
   resolveBranchName,
@@ -360,23 +369,19 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-OTQ6PSZC.js";
-import "./chunk-T4TZQJ7W.js";
-import "./chunk-H6XPXXMH.js";
+} from "./chunk-PHOF65IG.js";
 import "./chunk-5M6IDOMF.js";
-import "./chunk-T2L47JJK.js";
-import "./chunk-GPSKDNEE.js";
-import "./chunk-X6N25LXS.js";
-import "./chunk-E2UVIFI2.js";
-import "./chunk-T5IO6FZ4.js";
+import "./chunk-TWPJO254.js";
+import "./chunk-H6XPXXMH.js";
+import "./chunk-K4XWPEWB.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-Q2YKNMLS.js";
+} from "./chunk-TOFQCPDC.js";
 import {
   nextFireTime,
   parseCron
-} from "./chunk-XU457J4V.js";
+} from "./chunk-IRH27ZC2.js";
 import "./chunk-VDDGDZMA.js";
 import {
   appendCronRun,
@@ -385,22 +390,27 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-KHOVYUHX.js";
-import "./chunk-SZRN75WQ.js";
+} from "./chunk-FNQ6T3CV.js";
+import "./chunk-ZOIFNCKL.js";
+import "./chunk-PWTZEM3C.js";
+import "./chunk-KRXPRVGL.js";
 import "./chunk-6PVPNMXU.js";
+import "./chunk-MZAXJAUM.js";
+import "./chunk-SZRN75WQ.js";
+import "./chunk-HTO4JFDZ.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-NABLFI57.js";
-import "./chunk-QBUDF33N.js";
-import "./chunk-LIZRAKPB.js";
 import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-WHGVTP7Q.js";
+} from "./chunk-L26JL52R.js";
 import "./chunk-6AM5D4ME.js";
+import "./chunk-JZA3JUDJ.js";
+import "./chunk-3QMGYBFN.js";
 import "./chunk-JCW2R7WC.js";
-import "./chunk-57FIIFJN.js";
-import "./chunk-HTO4JFDZ.js";
+import "./chunk-M5JM7OSF.js";
+import "./chunk-OHNBB4XR.js";
+import "./chunk-E5TUC6CA.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -409,57 +419,69 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-RCWKCN2Z.js";
+} from "./chunk-EPDRMGT4.js";
 import "./chunk-JESCGQM3.js";
-import "./chunk-QKNXKTZX.js";
-import "./chunk-LW2FUYBN.js";
+import "./chunk-NH6KE4JX.js";
+import "./chunk-USTWD7QV.js";
 import "./chunk-XVNQMZ2I.js";
-import "./chunk-CR3C7WXL.js";
 import "./chunk-FODK6UMO.js";
 import "./chunk-GLNBDYUX.js";
 import "./chunk-DJ2GSRLV.js";
+import "./chunk-ZJHVAS7M.js";
 import {
   addDaemonRequestAttribute,
-  decodeBufferWithEncodingInfo,
   emitDaemonLog,
-  getAllGeminiMdFilenames,
   hashDaemonWorkspace,
-  isBinaryFile,
-  isWithinRoot,
   recordDaemonBridgeError,
   recordDaemonError,
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-ZDP2Y2AL.js";
+} from "./chunk-NIBLUX3Y.js";
+import "./chunk-BPJSQIJX.js";
+import "./chunk-P3QQPMQA.js";
+import "./chunk-6FGBXPWM.js";
+import "./chunk-LS77BEZP.js";
+import "./chunk-CR3C7WXL.js";
+import {
+  decodeBufferWithEncodingInfo,
+  getAllGeminiMdFilenames,
+  isBinaryFile,
+  isWithinRoot,
+  parseLineTolerant,
+  read
+} from "./chunk-CIKQ7KKO.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-4K56OJFJ.js";
-import "./chunk-CBOQ3HY7.js";
+import "./chunk-MUP3T3AD.js";
+import "./chunk-IKCX4CCL.js";
+import "./chunk-46UV252V.js";
 import "./chunk-A4UCTEB5.js";
 import "./chunk-XWRJCPHC.js";
-import "./chunk-QNLNLENL.js";
-import "./chunk-6X4GWOPW.js";
-import "./chunk-TYQMGACW.js";
-import {
-  import_websocket_server
-} from "./chunk-TYAMGABM.js";
-import "./chunk-FCMNKVXT.js";
-import "./chunk-7362QS5B.js";
+import "./chunk-UW5EOVUN.js";
+import "./chunk-2JZBVYTU.js";
+import "./chunk-5I2IWRSH.js";
+import "./chunk-A5L3JMUA.js";
+import "./chunk-MB4MZHMJ.js";
 import "./chunk-HTR4WV6U.js";
-import "./chunk-M7WBGLYP.js";
+import "./chunk-BULDBTYC.js";
 import "./chunk-U7ZFW55U.js";
-import "./chunk-NPQDJGKU.js";
-import "./chunk-YM3SZTH4.js";
+import "./chunk-UUUTRMI2.js";
+import "./chunk-PR75REBZ.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   runWithoutDebugLogSession
-} from "./chunk-OQB4EXO4.js";
+} from "./chunk-NL7LTRLR.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
-import "./chunk-THJNPLI4.js";
+import {
+  import_websocket_server
+} from "./chunk-TYAMGABM.js";
+import "./chunk-FCMNKVXT.js";
+import "./chunk-AMDSOFFV.js";
+import "./chunk-TARRHLLG.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -651,9 +673,9 @@ async function findExistingAncestor(absolute) {
   let current = absolute;
   const tailParts = [];
   for (let i = 0; i < MAX_ANCESTOR_HOPS; i++) {
-    let stat2 = null;
+    let stat3 = null;
     try {
-      stat2 = await fsp.stat(current);
+      stat3 = await fsp.stat(current);
     } catch (err) {
       const code = err?.code;
       if (code === "ENOENT" || code === "ENOTDIR") {
@@ -661,8 +683,8 @@ async function findExistingAncestor(absolute) {
         throw err;
       }
     }
-    if (stat2) {
-      if (tailParts.length > 0 && !stat2.isDirectory()) {
+    if (stat3) {
+      if (tailParts.length > 0 && !stat3.isDirectory()) {
         throw new FsError(
           "parse_error",
           `path component is not a directory: ${absolute}`,
@@ -735,7 +757,7 @@ async function resolveWithinWorkspace(input, boundWorkspaces, intent) {
             boundCanonicals
           );
           if (boundCanonical !== void 0) {
-            const finalPathIsSymlink = await fsp.lstat(absolute).then((stat2) => stat2.isSymbolicLink()).catch((lstatErr) => {
+            const finalPathIsSymlink = await fsp.lstat(absolute).then((stat3) => stat3.isSymbolicLink()).catch((lstatErr) => {
               if (lstatErr.code === "ENOENT" || lstatErr.code === "ENOTDIR") {
                 return false;
               }
@@ -1226,8 +1248,8 @@ var WorkspaceFileSystemImpl = class {
         const toRead = Math.min(maxBytes, available);
         buf = Buffer.allocUnsafe(toRead);
         if (toRead > 0) {
-          const read = await fh.read(buf, 0, toRead, offset);
-          buf = read.bytesRead === toRead ? buf : buf.subarray(0, read.bytesRead);
+          const read2 = await fh.read(buf, 0, toRead, offset);
+          buf = read2.bytesRead === toRead ? buf : buf.subarray(0, read2.bytesRead);
         }
         const afterRead = await fh.stat();
         assertSameFile(st, afterRead, p, "read");
@@ -1768,17 +1790,17 @@ var WorkspaceFileSystemImpl = class {
    *     for their `sendFsError` serializer.
    */
   recordAndWrap(err, intent, input) {
-    const fs5 = wrapAsFsError(err);
+    const fs6 = wrapAsFsError(err);
     this.deps.audit.recordDenied(this.deps.ctx, {
       intent,
       input,
-      errorKind: fs5.kind,
-      hint: fs5.hint,
+      errorKind: fs6.kind,
+      hint: fs6.hint,
       // Quote the underlying OS / FsError message so audit
       // consumers debugging a production incident can see the
       // actual cause (errno text, byte counts, glob pattern,
       // etc.) rather than just `errorKind` + `hint`.
-      message: fs5.message,
+      message: fs6.message,
       // For glob denials (parse_error pattern rejection,
       // catastrophic walk failures) the input IS the pattern
       // already; surfacing it on the dedicated `pattern` field
@@ -1787,7 +1809,7 @@ var WorkspaceFileSystemImpl = class {
       // branching on intent.
       pattern: intent === "glob" ? input : void 0
     });
-    return fs5;
+    return fs6;
   }
 };
 var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
@@ -1895,9 +1917,9 @@ async function readStableRegularFileBuffer(p, pre) {
     const out = Buffer.alloc(opened.size);
     let offset = 0;
     while (offset < opened.size) {
-      const read = await fh.read(out, offset, opened.size - offset, offset);
-      if (read.bytesRead === 0) break;
-      offset += read.bytesRead;
+      const read2 = await fh.read(out, offset, opened.size - offset, offset);
+      if (read2.bytesRead === 0) break;
+      offset += read2.bytesRead;
     }
     const afterRead = await fh.stat();
     assertSameFile(opened, afterRead, p, "read");
@@ -2152,15 +2174,15 @@ async function hashRegularFileAtPath(p, pre) {
     const buf = Buffer.allocUnsafe(64 * 1024);
     let offset = 0;
     while (offset < opened.size) {
-      const read = await fh.read(
+      const read2 = await fh.read(
         buf,
         0,
         Math.min(buf.length, opened.size - offset),
         offset
       );
-      if (read.bytesRead === 0) break;
-      hash.update(buf.subarray(0, read.bytesRead));
-      offset += read.bytesRead;
+      if (read2.bytesRead === 0) break;
+      hash.update(buf.subarray(0, read2.bytesRead));
+      offset += read2.bytesRead;
     }
   } finally {
     await fh.close();
@@ -2524,12 +2546,12 @@ __name(applyReadHeaders, "applyReadHeaders");
 function sendFsError(res, err, route) {
   applyReadHeaders(res);
   if (isFsError(err)) {
-    const fs5 = err;
-    res.status(fs5.status).json({
-      errorKind: fs5.kind,
-      error: fs5.message,
-      hint: fs5.hint,
-      status: fs5.status
+    const fs6 = err;
+    res.status(fs6.status).json({
+      errorKind: fs6.kind,
+      error: fs6.message,
+      hint: fs6.hint,
+      status: fs6.status
     });
     return;
   }
@@ -2631,13 +2653,13 @@ async function handleGetFile(req, res, deps) {
     });
     return;
   }
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "read");
-    const out = await fs5.readText(resolved, { maxBytes, line, limit });
+    const resolved = await fs6.resolve(queryPath, "read");
+    const out = await fs6.readText(resolved, { maxBytes, line, limit });
     const returnedBytes = Buffer.byteLength(out.content, "utf-8");
     applyReadHeaders(res);
     res.status(200).json({
@@ -2691,13 +2713,13 @@ async function handleGetFileBytes(req, res, deps) {
     });
     return;
   }
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "read");
-    const out = await fs5.readBytesWindow(resolved, {
+    const resolved = await fs6.resolve(queryPath, "read");
+    const out = await fs6.readBytesWindow(resolved, {
       offset: offset ?? 0,
       maxBytes: maxBytes ?? DEFAULT_FILE_BYTES_MAX_BYTES
     });
@@ -2725,13 +2747,13 @@ async function handleGetStat(req, res, deps) {
   if (clientId === null) return;
   const queryPath = requireStringQuery(res, req.query["path"], "path", ROUTE2);
   if (queryPath === null) return;
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "stat");
-    const st = await fs5.stat(resolved);
+    const resolved = await fs6.resolve(queryPath, "stat");
+    const st = await fs6.stat(resolved);
     applyReadHeaders(res);
     res.status(200).json({
       kind: "stat",
@@ -2754,13 +2776,13 @@ async function handleGetList(req, res, deps) {
   const queryPath = requireStringQuery(res, req.query["path"], "path", ROUTE2);
   if (queryPath === null) return;
   const includeIgnored = parseBoolFlag(req.query["includeIgnored"]);
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "list");
-    const entries = await fs5.list(resolved, {
+    const resolved = await fs6.resolve(queryPath, "list");
+    const entries = await fs6.list(resolved, {
       includeIgnored,
       maxEntries: MAX_LIST_ENTRIES + 1
     });
@@ -2813,15 +2835,15 @@ async function handleGetGlob(req, res, deps) {
   }
   const cwdRaw = req.query["cwd"];
   const cwdString = typeof cwdRaw === "string" && cwdRaw.length > 0 ? cwdRaw : void 0;
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   const start = performance.now();
   try {
-    const cwdResolved = cwdString ? await fs5.resolve(cwdString, "list") : void 0;
+    const cwdResolved = cwdString ? await fs6.resolve(cwdString, "list") : void 0;
     const cap = maxResults ?? DEFAULT_GLOB_MAX_RESULTS;
-    const probe = await fs5.glob(pattern, {
+    const probe = await fs6.glob(pattern, {
       cwd: cwdResolved,
       includeIgnored,
       maxResults: cap + 1
@@ -2995,7 +3017,7 @@ function validateClientId(clientId, deps, res) {
 }
 __name(validateClientId, "validateClientId");
 function createSetupGithubFileOps(factory, route, originatorClientId) {
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     route,
     ...originatorClientId ? { originatorClientId } : {}
   });
@@ -3018,14 +3040,14 @@ function createSetupGithubFileOps(factory, route, originatorClientId) {
       ]);
     },
     async writeTextFile(_gitRepoRoot, relativePath, content) {
-      const resolved = await fs5.resolve(relativePath, "write");
-      const out = await fs5.writeTextOverwrite(resolved, content);
+      const resolved = await fs6.resolve(relativePath, "write");
+      const out = await fs6.writeTextOverwrite(resolved, content);
       return { sizeBytes: out.sizeBytes };
     },
     async readTextFile(_gitRepoRoot, relativePath) {
       try {
-        const resolved = await fs5.resolve(relativePath, "read");
-        const out = await fs5.readText(resolved);
+        const resolved = await fs6.resolve(relativePath, "read");
+        const out = await fs6.readText(resolved);
         return out.content;
       } catch (error2) {
         if (isFsError(error2) && error2.kind === "path_not_found") {
@@ -3046,15 +3068,15 @@ async function ensureDirectoryWithoutSymlink(root, segments) {
     checkedSegments.push(segment);
     const label = `Workspace path "${checkedSegments.join("/")}"`;
     try {
-      const stat2 = await fsp3.lstat(current);
-      if (stat2.isSymbolicLink()) {
+      const stat3 = await fsp3.lstat(current);
+      if (stat3.isSymbolicLink()) {
         throw new SetupGithubError(
           "github_setup_invalid_workspace",
           `${label} must not be a symlink.`,
           400
         );
       }
-      if (!stat2.isDirectory()) {
+      if (!stat3.isDirectory()) {
         throw new SetupGithubError(
           "github_setup_invalid_workspace",
           `${label} must be a directory.`,
@@ -3091,15 +3113,15 @@ async function ensureDirectoryWithoutSymlink(root, segments) {
 }
 __name(ensureDirectoryWithoutSymlink, "ensureDirectoryWithoutSymlink");
 async function assertDirectoryWithoutSymlink(target, label) {
-  const stat2 = await fsp3.lstat(target);
-  if (stat2.isSymbolicLink()) {
+  const stat3 = await fsp3.lstat(target);
+  if (stat3.isSymbolicLink()) {
     throw new SetupGithubError(
       "github_setup_invalid_workspace",
       `${label} must not be a symlink.`,
       400
     );
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new SetupGithubError(
       "github_setup_invalid_workspace",
       `${label} must be a directory.`,
@@ -4740,12 +4762,12 @@ async function collectWorkspaceMemoryStatus(boundWorkspace) {
   for (const filename of filenames) {
     const candidate = path8.join(globalDir, filename);
     try {
-      const stat2 = await fs.stat(candidate);
-      if (stat2.isFile()) {
+      const stat3 = await fs.stat(candidate);
+      if (stat3.isFile()) {
         files.push({
           absolutePath: candidate,
           scope: "global",
-          bytes: stat2.size
+          bytes: stat3.size
         });
       }
     } catch (err) {
@@ -4789,12 +4811,12 @@ async function walkWorkspaceForMemory(start, filenames, errors) {
   for (const filename of filenames) {
     const candidate = path8.join(start, filename);
     try {
-      const stat2 = await fs.stat(candidate);
-      if (stat2.isFile()) {
+      const stat3 = await fs.stat(candidate);
+      if (stat3.isFile()) {
         out.push({
           absolutePath: candidate,
           scope: "workspace",
-          bytes: stat2.size
+          bytes: stat3.size
         });
       }
     } catch (err) {
@@ -4820,6 +4842,7 @@ __name(isEnoent, "isEnoent");
 // packages/cli/src/serve/workspace-agents.ts
 init_esbuild_shims();
 import { promises as fs2 } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
 var AGENT_TYPE_PATTERN = /^[\p{L}\p{N}_-]+$/u;
 var AGENT_TYPE_MAX_LENGTH = 64;
 var AGENT_TYPE_MIN_LENGTH = 2;
@@ -4827,6 +4850,27 @@ var MAX_DESCRIPTION_BYTES = 256 * 1024;
 var MAX_SYSTEM_PROMPT_BYTES = 256 * 1024;
 var MAX_TOOLS_ENTRIES = 256;
 var MAX_TOOL_ID_LENGTH = 256;
+var MAX_RECORD_ENTRIES = 128;
+var SUBAGENT_APPROVAL_MODES = [...APPROVAL_MODES, "bubble"];
+var SUBAGENT_PERMISSION_MODES = [
+  "acceptEdits",
+  "auto",
+  "bypassPermissions",
+  "default",
+  "dontAsk",
+  "plan"
+];
+var SUBAGENT_COLORS = [
+  "auto",
+  "red",
+  "blue",
+  "green",
+  "yellow",
+  "purple",
+  "orange",
+  "pink",
+  "cyan"
+];
 function mountWorkspaceAgentsRoutes(app, deps) {
   const manager = createDaemonSubagentManager(deps.boundWorkspace);
   app.get("/workspace/agents", async (_req, res) => {
@@ -4865,7 +4909,11 @@ function mountWorkspaceAgentsRoutes(app, deps) {
         return;
       }
       const level = scope === "workspace" ? "project" : "user";
-      const config = parseAgentConfig(body, level, res);
+      const config = parseAgentConfig(
+        restoreAgentMcpServerSecrets(body, deps.boundWorkspace, level),
+        level,
+        res
+      );
       if (!config) return;
       const collision = await manager.loadSubagent(config.name, level);
       if (collision) {
@@ -4981,7 +5029,9 @@ function mountWorkspaceAgentsRoutes(app, deps) {
     const agentType = validateAgentType(req, res);
     if (agentType === null) return;
     try {
-      const config = await manager.loadSubagent(agentType);
+      const scopedLevel = parseScopeQuery(req, res);
+      if (scopedLevel === null) return;
+      const config = await manager.loadSubagent(agentType, scopedLevel);
       if (!config) {
         res.status(404).json({
           error: `Subagent "${agentType}" not found`,
@@ -5010,9 +5060,6 @@ function mountWorkspaceAgentsRoutes(app, deps) {
       const clientIdResult = resolveOriginatorClientId(deps, req, res);
       if (clientIdResult === null) return;
       const originatorClientId = clientIdResult;
-      const body = deps.safeBody(req);
-      const updates = parseAgentUpdates(body, res);
-      if (!updates) return;
       const preferredLevel = parseScopeQuery(req, res);
       if (preferredLevel === null) return;
       const existing = await manager.loadSubagent(agentType, preferredLevel);
@@ -5027,6 +5074,14 @@ function mountWorkspaceAgentsRoutes(app, deps) {
       if (assertMutableLevel(existing, agentType, res)) {
         return;
       }
+      const body = restoreAgentMcpServerSecrets(
+        deps.safeBody(req),
+        deps.boundWorkspace,
+        existing.level,
+        existing.mcpServers
+      );
+      const updates = parseAgentUpdates(body, res);
+      if (!updates) return;
       if (Object.keys(updates).length === 0) {
         res.status(400).json({
           error: "`POST /workspace/agents/:agentType` requires at least one updatable field in the body",
@@ -5270,7 +5325,11 @@ function mountWorkspaceQualifiedAgentsRoutes(app, deps) {
       const level = parseWorkspaceOnlyAgentBodyScope(body, res);
       if (level === null) return;
       const manager = createDaemonSubagentManager(runtime.workspaceCwd);
-      const config = parseAgentConfig(body, level, res);
+      const config = parseAgentConfig(
+        restoreAgentMcpServerSecrets(body, runtime.workspaceCwd, level),
+        level,
+        res
+      );
       if (!config) return;
       const collision = await manager.loadSubagent(config.name, level);
       if (collision) {
@@ -5359,9 +5418,6 @@ function mountWorkspaceQualifiedAgentsRoutes(app, deps) {
       const clientIdResult = resolveOriginatorClientId(routeDeps, req, res);
       if (clientIdResult === null) return;
       const originatorClientId = clientIdResult;
-      const body = deps.safeBody(req);
-      const updates = parseAgentUpdates(body, res);
-      if (!updates) return;
       const manager = createDaemonSubagentManager(runtime.workspaceCwd);
       const existing = await manager.loadSubagent(agentType, scopedLevel);
       if (!existing) {
@@ -5373,6 +5429,14 @@ function mountWorkspaceQualifiedAgentsRoutes(app, deps) {
         return;
       }
       if (assertMutableLevel(existing, agentType, res)) return;
+      const body = restoreAgentMcpServerSecrets(
+        deps.safeBody(req),
+        runtime.workspaceCwd,
+        existing.level,
+        existing.mcpServers
+      );
+      const updates = parseAgentUpdates(body, res);
+      if (!updates) return;
       if (Object.keys(updates).length === 0) {
         res.status(400).json({
           error: "`POST /workspaces/:workspace/agents/:agentType` requires at least one updatable field in the body",
@@ -5628,6 +5692,22 @@ function rejectWorkspaceQualifiedAgentScope(scope, res) {
   return null;
 }
 __name(rejectWorkspaceQualifiedAgentScope, "rejectWorkspaceQualifiedAgentScope");
+function restoreAgentMcpServerSecrets(body, workspace, level, currentAgentServers) {
+  const incoming = body["mcpServers"];
+  if (typeof incoming !== "object" || incoming === null || Array.isArray(incoming)) {
+    return body;
+  }
+  const settings = loadSettings(workspace);
+  const configuredServers = level === "user" ? settings.user.settings.mcpServers ?? {} : settings.merged.mcpServers ?? {};
+  return {
+    ...body,
+    mcpServers: restoreRedactedMcpServersSetting(incoming, {
+      ...configuredServers,
+      ...currentAgentServers
+    })
+  };
+}
+__name(restoreAgentMcpServerSecrets, "restoreAgentMcpServerSecrets");
 function sendCreateAgentError(res, err, name) {
   if (!(err instanceof SubagentError)) return false;
   if (err.code === SubagentErrorCode.ALREADY_EXISTS) {
@@ -5769,22 +5849,73 @@ function parseAgentConfig(body, level, res) {
   if (tools !== void 0) config.tools = tools;
   if (disallowedTools !== void 0) config.disallowedTools = disallowedTools;
   if (rejectIfPresentWrongType(body, "model", "string", res)) return void 0;
-  if (typeof body["model"] === "string") config.model = body["model"];
+  if (typeof body["model"] === "string") {
+    if (!body["model"].trim()) {
+      return sendInvalidConfig(res, "`model` must not be empty when provided");
+    }
+    config.model = body["model"].trim();
+  }
   if (rejectIfPresentWrongType(body, "color", "string", res)) return void 0;
-  if (typeof body["color"] === "string") config.color = body["color"];
+  if (typeof body["color"] === "string") {
+    if (!SUBAGENT_COLORS.includes(body["color"])) {
+      return sendInvalidConfig(
+        res,
+        `\`color\` must be one of ${JSON.stringify(SUBAGENT_COLORS)}`
+      );
+    }
+    config.color = body["color"];
+  }
   if (rejectIfPresentWrongType(body, "approvalMode", "string", res)) {
     return void 0;
   }
   if (typeof body["approvalMode"] === "string") {
-    if (!APPROVAL_MODES.includes(body["approvalMode"])) {
-      res.status(422).json({
-        error: `\`approvalMode\` must be one of ${JSON.stringify(APPROVAL_MODES)}`,
-        code: "invalid_config"
-      });
-      return void 0;
+    if (!SUBAGENT_APPROVAL_MODES.includes(body["approvalMode"])) {
+      return sendInvalidConfig(
+        res,
+        `\`approvalMode\` must be one of ${JSON.stringify(SUBAGENT_APPROVAL_MODES)}`
+      );
     }
     config.approvalMode = body["approvalMode"];
   }
+  if (rejectIfPresentWrongType(body, "permissionMode", "string", res)) {
+    return void 0;
+  }
+  if (typeof body["permissionMode"] === "string") {
+    if (!SUBAGENT_PERMISSION_MODES.includes(body["permissionMode"])) {
+      return sendInvalidConfig(
+        res,
+        `\`permissionMode\` must be one of ${JSON.stringify(SUBAGENT_PERMISSION_MODES)}`
+      );
+    }
+    config.permissionMode = body["permissionMode"];
+  }
+  if ("maxTurns" in body) {
+    const maxTurns = parseMaxTurns(body["maxTurns"], res);
+    if (maxTurns === null) return void 0;
+    config.maxTurns = maxTurns;
+  }
+  if ("mcpServers" in body) {
+    const mcpServers = parseRecordField(
+      body["mcpServers"],
+      "mcpServers",
+      (value) => typeof value === "object" && value !== null && !Array.isArray(value),
+      "an object of server names to server configuration objects",
+      res
+    );
+    if (mcpServers === null) return void 0;
+    if (Object.keys(mcpServers).length > 0) config.mcpServers = mcpServers;
+  }
+  if ("hooks" in body) {
+    const hooks = parseRecordField(
+      body["hooks"],
+      "hooks",
+      Array.isArray,
+      "an object of hook event names to matcher arrays",
+      res
+    );
+    if (hooks === null) return void 0;
+    if (Object.keys(hooks).length > 0) config.hooks = hooks;
+  }
   if (rejectIfPresentWrongType(body, "background", "boolean", res)) {
     return void 0;
   }
@@ -5854,23 +5985,86 @@ function parseAgentUpdates(body, res) {
       updates.disallowedTools = disallowedTools;
     }
   }
-  if (rejectIfPresentWrongType(body, "model", "string", res)) return void 0;
-  if (typeof body["model"] === "string") updates.model = body["model"];
-  if (rejectIfPresentWrongType(body, "color", "string", res)) return void 0;
-  if (typeof body["color"] === "string") updates.color = body["color"];
-  if (rejectIfPresentWrongType(body, "approvalMode", "string", res)) {
+  if (body["model"] === null) {
+    updates.model = void 0;
+  } else if (rejectIfPresentWrongType(body, "model", "string", res)) {
     return void 0;
+  } else if (typeof body["model"] === "string") {
+    if (!body["model"].trim()) {
+      return sendInvalidConfig(res, "`model` must not be empty when provided");
+    }
+    updates.model = body["model"].trim();
   }
-  if (typeof body["approvalMode"] === "string") {
-    if (!APPROVAL_MODES.includes(body["approvalMode"])) {
-      res.status(422).json({
-        error: `\`approvalMode\` must be one of ${JSON.stringify(APPROVAL_MODES)}`,
-        code: "invalid_config"
-      });
-      return void 0;
+  if (body["color"] === null) {
+    updates.color = void 0;
+  } else if (rejectIfPresentWrongType(body, "color", "string", res)) {
+    return void 0;
+  } else if (typeof body["color"] === "string") {
+    if (!SUBAGENT_COLORS.includes(body["color"])) {
+      return sendInvalidConfig(
+        res,
+        `\`color\` must be one of ${JSON.stringify(SUBAGENT_COLORS)}`
+      );
+    }
+    updates.color = body["color"];
+  }
+  if (body["approvalMode"] === null) {
+    updates.approvalMode = void 0;
+  } else if (rejectIfPresentWrongType(body, "approvalMode", "string", res)) {
+    return void 0;
+  } else if (typeof body["approvalMode"] === "string") {
+    if (!SUBAGENT_APPROVAL_MODES.includes(body["approvalMode"])) {
+      return sendInvalidConfig(
+        res,
+        `\`approvalMode\` must be one of ${JSON.stringify(SUBAGENT_APPROVAL_MODES)}`
+      );
     }
     updates.approvalMode = body["approvalMode"];
   }
+  if (body["permissionMode"] === null) {
+    updates.permissionMode = void 0;
+  } else if (rejectIfPresentWrongType(body, "permissionMode", "string", res)) {
+    return void 0;
+  } else if (typeof body["permissionMode"] === "string") {
+    if (!SUBAGENT_PERMISSION_MODES.includes(body["permissionMode"])) {
+      return sendInvalidConfig(
+        res,
+        `\`permissionMode\` must be one of ${JSON.stringify(SUBAGENT_PERMISSION_MODES)}`
+      );
+    }
+    updates.permissionMode = body["permissionMode"];
+  }
+  if ("maxTurns" in body) {
+    if (body["maxTurns"] === null) {
+      updates.maxTurns = void 0;
+    } else {
+      const maxTurns = parseMaxTurns(body["maxTurns"], res);
+      if (maxTurns === null) return void 0;
+      updates.maxTurns = maxTurns;
+    }
+  }
+  if ("mcpServers" in body) {
+    const mcpServers = parseRecordField(
+      body["mcpServers"],
+      "mcpServers",
+      (value) => typeof value === "object" && value !== null && !Array.isArray(value),
+      "an object of server names to server configuration objects",
+      res
+    );
+    if (mcpServers === null) return void 0;
+    updates.mcpServers = mcpServers;
+  }
+  if ("hooks" in body) {
+    const hooks = parseRecordField(
+      body["hooks"],
+      "hooks",
+      Array.isArray,
+      "an object of hook event names to matcher arrays",
+      res
+    );
+    if (hooks === null) return void 0;
+    updates.hooks = hooks;
+  }
   if (rejectIfPresentWrongType(body, "background", "boolean", res)) {
     return void 0;
   }
@@ -5911,6 +6105,43 @@ function parseStringArray(value, field, res) {
   return value;
 }
 __name(parseStringArray, "parseStringArray");
+function sendInvalidConfig(res, error2) {
+  res.status(422).json({ error: error2, code: "invalid_config" });
+  return void 0;
+}
+__name(sendInvalidConfig, "sendInvalidConfig");
+function parseMaxTurns(value, res) {
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) {
+    sendInvalidConfig(res, "`maxTurns` must be a positive integer");
+    return null;
+  }
+  return value;
+}
+__name(parseMaxTurns, "parseMaxTurns");
+function parseRecordField(value, field, isValidEntry, expected, res) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    sendInvalidConfig(res, `\`${field}\` must be ${expected}`);
+    return null;
+  }
+  const entries = Object.entries(value);
+  if (entries.length > MAX_RECORD_ENTRIES) {
+    sendInvalidConfig(
+      res,
+      `\`${field}\` exceeds the ${MAX_RECORD_ENTRIES}-entry limit`
+    );
+    return null;
+  }
+  const output = {};
+  for (const [key, entry] of entries) {
+    if (!key || key.length > MAX_TOOL_ID_LENGTH || key === "__proto__" || key === "constructor" || key === "prototype" || !isValidEntry(entry)) {
+      sendInvalidConfig(res, `\`${field}\` must be ${expected}`);
+      return null;
+    }
+    output[key] = entry;
+  }
+  return output;
+}
+__name(parseRecordField, "parseRecordField");
 function rejectIfPresentWrongType(body, key, expected, res) {
   if (!(key in body)) return false;
   if (typeof body[key] === expected) return false;
@@ -5934,13 +6165,31 @@ function isNoOpUpdate(existing, updates) {
   if (updates.disallowedTools !== void 0 && !shallowArrayEqual(updates.disallowedTools, existing.disallowedTools)) {
     return false;
   }
-  if (updates.model !== void 0 && updates.model !== existing.model) {
+  if ("model" in updates && updates.model !== existing.model) {
+    return false;
+  }
+  if ("color" in updates && updates.color !== existing.color) {
+    return false;
+  }
+  if ("approvalMode" in updates && updates.approvalMode !== existing.approvalMode) {
+    return false;
+  }
+  if ("permissionMode" in updates && updates.permissionMode !== existing.permissionMode) {
+    return false;
+  }
+  if ("maxTurns" in updates && updates.maxTurns !== existing.maxTurns) {
     return false;
   }
-  if (updates.color !== void 0 && updates.color !== existing.color) {
+  if (updates.mcpServers !== void 0 && !isDeepStrictEqual(
+    normalizedRecord(updates.mcpServers),
+    normalizedRecord(existing.mcpServers)
+  )) {
     return false;
   }
-  if (updates.approvalMode !== void 0 && updates.approvalMode !== existing.approvalMode) {
+  if (updates.hooks !== void 0 && !isDeepStrictEqual(
+    normalizedRecord(updates.hooks),
+    normalizedRecord(existing.hooks)
+  )) {
     return false;
   }
   if (updates.background !== void 0 && updates.background !== existing.background) {
@@ -5959,7 +6208,20 @@ function isNoOpUpdate(existing, updates) {
   return true;
 }
 __name(isNoOpUpdate, "isNoOpUpdate");
-function shallowArrayEqual(a, b) {
+function normalizedRecord(value) {
+  if (!value || Object.keys(value).length === 0) return void 0;
+  return normalizeRecordValue(value);
+}
+__name(normalizedRecord, "normalizedRecord");
+function normalizeRecordValue(value) {
+  if (Array.isArray(value)) return value.map(normalizeRecordValue);
+  if (typeof value !== "object" || value === null) return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== void 0).map(([key, entry]) => [key, normalizeRecordValue(entry)])
+  );
+}
+__name(normalizeRecordValue, "normalizeRecordValue");
+function shallowArrayEqual(a, b) {
   if (a === b) return true;
   if (!a || !b) return false;
   if (a.length !== b.length) return false;
@@ -6011,10 +6273,30 @@ function toSummary(config) {
     isBuiltin: config.isBuiltin === true || config.level === "builtin",
     hasTools: Array.isArray(config.tools) && config.tools.length > 0
   };
+  if (config.tools) summary.tools = [...config.tools];
+  if (config.disallowedTools) {
+    summary.disallowedTools = [...config.disallowedTools];
+  }
   if (config.model) summary.model = config.model;
   if (config.color) summary.color = config.color;
   if (config.background !== void 0) summary.background = config.background;
   if (config.approvalMode) summary.approvalMode = config.approvalMode;
+  if (config.permissionMode) summary.permissionMode = config.permissionMode;
+  if (config.maxTurns !== void 0) summary.maxTurns = config.maxTurns;
+  if (config.mcpServers) {
+    summary.mcpServerNames = Object.keys(config.mcpServers);
+  }
+  if (config.hooks) summary.hookEvents = Object.keys(config.hooks);
+  if (config.runConfig) {
+    const runConfig = {};
+    if (typeof config.runConfig.max_time_minutes === "number") {
+      runConfig.max_time_minutes = config.runConfig.max_time_minutes;
+    }
+    if (typeof config.runConfig.max_turns === "number") {
+      runConfig.max_turns = config.runConfig.max_turns;
+    }
+    summary.runConfig = runConfig;
+  }
   if (config.extensionName) summary.extensionName = config.extensionName;
   if (config.filePath) summary.filePath = config.filePath;
   return summary;
@@ -6025,20 +6307,10 @@ function toDetail(config) {
     ...toSummary(config),
     systemPrompt: config.systemPrompt
   };
-  if (config.tools) detail.tools = [...config.tools];
-  if (config.disallowedTools) {
-    detail.disallowedTools = [...config.disallowedTools];
-  }
-  if (config.runConfig) {
-    const runConfig = {};
-    if (typeof config.runConfig.max_time_minutes === "number") {
-      runConfig.max_time_minutes = config.runConfig.max_time_minutes;
-    }
-    if (typeof config.runConfig.max_turns === "number") {
-      runConfig.max_turns = config.runConfig.max_turns;
-    }
-    detail.runConfig = runConfig;
+  if (config.mcpServers) {
+    detail.mcpServers = redactMcpServersSetting(config.mcpServers);
   }
+  if (config.hooks) detail.hooks = config.hooks;
   return detail;
 }
 __name(toDetail, "toDetail");
@@ -9046,7 +9318,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -9098,8 +9370,8 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const resolved = await fs5.resolve(p, "read");
-          const out = await fs5.readText(resolved, { maxBytes, line, limit });
+          const resolved = await fs6.resolve(p, "read");
+          const out = await fs6.readText(resolved, { maxBytes, line, limit });
           this.replyConn(conn, id, {
             path: p,
             content: out.content,
@@ -9121,7 +9393,7 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -9157,8 +9429,8 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const resolved = await fs5.resolve(p, "read");
-          const buf = await fs5.readBytesWindow(resolved, { offset, maxBytes });
+          const resolved = await fs6.resolve(p, "read");
+          const buf = await fs6.readBytesWindow(resolved, { offset, maxBytes });
           this.replyConn(conn, id, { path: p, ...buf });
           return;
         }
@@ -9176,12 +9448,12 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs5.resolve(p, "read");
-          const result = await fs5.stat(resolved);
+          const resolved = await fs6.resolve(p, "read");
+          const result = await fs6.stat(resolved);
           this.replyConn(conn, id, { path: p, ...result });
           return;
         }
@@ -9199,13 +9471,13 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs5.resolve(p, "read");
+          const resolved = await fs6.resolve(p, "read");
           const MAX_LIST = 2e3;
-          const entries = await fs5.list(resolved, { maxEntries: MAX_LIST + 1 });
+          const entries = await fs6.list(resolved, { maxEntries: MAX_LIST + 1 });
           const truncated = entries.length > MAX_LIST;
           this.replyConn(conn, id, {
             path: p,
@@ -9230,7 +9502,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -9250,7 +9522,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const matches = await fs5.glob(pattern, {
+          const matches = await fs6.glob(pattern, {
             maxResults: maxResults + 1
           });
           const truncated = matches.length > maxResults;
@@ -9282,11 +9554,11 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs5.resolve(p, "write");
+          const resolved = await fs6.resolve(p, "write");
           if (Buffer.byteLength(params["content"], "utf8") > 10 * 1024 * 1024) {
             if (id !== void 0)
               conn.sendConn(
@@ -9294,7 +9566,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          await fs5.writeTextOverwrite(resolved, params["content"]);
+          await fs6.writeTextOverwrite(resolved, params["content"]);
           this.replyConn(conn, id, { ok: true, path: p });
           return;
         }
@@ -9323,12 +9595,12 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs5 = this.fsFactory.forRequest({
+          const fs6 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs5.resolve(p, "write");
-          const result = await fs5.edit(
+          const resolved = await fs6.resolve(p, "write");
+          const result = await fs6.edit(
             resolved,
             params["oldText"],
             params["newText"]
@@ -9872,11 +10144,24 @@ var AcpDispatcher = class {
       }
     }
   }
+  /**
+   * Current epoch token of the session's event bus, or `undefined` when
+   * the session is unknown (torn down between ownership check and header
+   * write). The `/acp` GET route advertises it as `X-Qwen-Event-Epoch`
+   * BEFORE `stream.open()` flushes headers (DAEMON-001).
+   */
+  getSessionEventEpoch(sessionId) {
+    try {
+      return this.bridge.getSessionEventEpoch(sessionId);
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Bind a session-scoped SSE stream to the bridge's event stream,
    * translating each `BridgeEvent` into a JSON-RPC frame (design §4.2).
    */
-  async pumpSessionEvents(conn, sessionId, signal, lastEventId) {
+  async pumpSessionEvents(conn, sessionId, signal, lastEventId, epoch) {
     try {
       let lastDeliveredId = lastEventId ?? 0;
       let sawEviction = false;
@@ -9884,6 +10169,11 @@ var AcpDispatcher = class {
       if (conn.hasInitialReplayPending(sessionId)) {
         const snapshot = this.bridge.getSessionReplaySnapshot(sessionId);
         if (snapshot) {
+          if (snapshot.degraded) {
+            writeStderrLine(
+              `qwen serve: /acp initial replay used a DEGRADED snapshot (compaction failure) session=${logSafe(sessionId)}; replay may be incomplete`
+            );
+          }
           const snapshotEvents = [
             ...snapshot.compactedTurns,
             ...snapshot.liveJournal
@@ -9916,7 +10206,8 @@ var AcpDispatcher = class {
       }
       const iterable = this.bridge.subscribeEvents(sessionId, {
         signal,
-        ...subscribeFromEventId !== void 0 ? { lastEventId: subscribeFromEventId } : {}
+        ...subscribeFromEventId !== void 0 ? { lastEventId: subscribeFromEventId } : {},
+        ...epoch !== void 0 ? { epoch } : {}
       });
       for await (const event of iterable) {
         if (signal.aborted) break;
@@ -11029,6 +11320,17 @@ function parseLastEventId2(raw, logPrefix = "") {
   return n;
 }
 __name(parseLastEventId2, "parseLastEventId");
+function parseEventEpochHeader(raw, logPrefix = "") {
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  if (raw.length > 64 || !/^[\w-]+$/.test(raw)) {
+    writeStderrLine(
+      `qwen serve: ${logPrefix}rejected X-Qwen-Event-Epoch ${safeLogValue2(raw)} (expected [A-Za-z0-9_-]{1,64})`
+    );
+    return void 0;
+  }
+  return raw;
+}
+__name(parseEventEpochHeader, "parseEventEpochHeader");
 
 // packages/cli/src/serve/acp-http/client-mcp-ws.ts
 init_esbuild_shims();
@@ -12392,11 +12694,19 @@ function mountAcpHttp(app, bridge, opts) {
       },
       () => conn.touch()
     );
-    stream.open();
     const lastEventId = parseLastEventId2(
       headerOf(req, "last-event-id"),
       "/acp "
     );
+    const eventEpoch = parseEventEpochHeader(
+      headerOf(req, "x-qwen-event-epoch"),
+      "/acp "
+    );
+    const busEpoch = mount.dispatcher.getSessionEventEpoch(sessionId);
+    if (busEpoch !== void 0) {
+      res.setHeader("X-Qwen-Event-Epoch", busEpoch);
+    }
+    stream.open();
     conn.attachSessionStream(sessionId, stream, ac, lastEventId);
     const onPumpSettled = /* @__PURE__ */ __name(() => {
       if (stream.isClosed) {
@@ -12412,7 +12722,7 @@ function mountAcpHttp(app, bridge, opts) {
         );
       }
     }, "onPumpSettled");
-    void mount.dispatcher.pumpSessionEvents(conn, sessionId, ac.signal, lastEventId).then(onPumpSettled, (err) => {
+    void mount.dispatcher.pumpSessionEvents(conn, sessionId, ac.signal, lastEventId, eventEpoch).then(onPumpSettled, (err) => {
       writeStderrLine(
         `qwen serve: ${mount.routeLabel} event pump error (${logSafe(sessionId)}, lastEventId=${lastEventId ?? "none"}): ${logSafe(err instanceof Error ? err.message : String(err))}`
       );
@@ -13865,6 +14175,130 @@ function mountWebShellSpaFallback(app, webShellDir, frameAncestors = []) {
 }
 __name(mountWebShellSpaFallback, "mountWebShellSpaFallback");
 
+// packages/cli/src/serve/workspace-generation.ts
+init_esbuild_shims();
+
+// packages/cli/src/serve/generation-sse.ts
+init_esbuild_shims();
+var GENERATION_HEARTBEAT_MS = 15e3;
+function formatGenerationSse(event, data) {
+  return `event: ${event}
+data: ${JSON.stringify({ v: 1, ...data })}
+
+`;
+}
+__name(formatGenerationSse, "formatGenerationSse");
+function writeGenerationSseChunk(res, chunk) {
+  if (res.destroyed) {
+    return Promise.reject(new Error("Generation SSE connection destroyed"));
+  }
+  const writable = res.write(chunk);
+  const flush = res.flush;
+  flush?.call(res);
+  if (writable) {
+    return res.destroyed ? Promise.reject(new Error("Generation SSE connection destroyed")) : Promise.resolve();
+  }
+  return new Promise((resolve6, reject) => {
+    const cleanup = /* @__PURE__ */ __name(() => {
+      res.off("drain", onDrain);
+      res.off("close", onClose);
+      res.off("error", onError);
+    }, "cleanup");
+    const onDrain = /* @__PURE__ */ __name(() => {
+      cleanup();
+      resolve6();
+    }, "onDrain");
+    const onClose = /* @__PURE__ */ __name(() => {
+      cleanup();
+      reject(new Error("Generation SSE connection closed"));
+    }, "onClose");
+    const onError = /* @__PURE__ */ __name((error2) => {
+      cleanup();
+      reject(error2);
+    }, "onError");
+    res.once("drain", onDrain);
+    res.once("close", onClose);
+    res.once("error", onError);
+    if (res.destroyed) onClose();
+  });
+}
+__name(writeGenerationSseChunk, "writeGenerationSseChunk");
+
+// packages/cli/src/serve/workspace-generation.ts
+function mountWorkspaceGenerationRoutes(app, deps) {
+  app.post("/workspace/generate", deps.mutate(), async (req, res) => {
+    const body = deps.safeBody(req);
+    const prompt = body["prompt"];
+    if (typeof prompt !== "string" || prompt.trim().length === 0 || Buffer.byteLength(prompt, "utf8") > GENERATION_MAX_PROMPT_BYTES) {
+      res.status(400).json({
+        error: `\`prompt\` must be a non-empty string no larger than ${GENERATION_MAX_PROMPT_BYTES} UTF-8 bytes`,
+        code: "invalid_prompt"
+      });
+      return;
+    }
+    const clientId = deps.parseClientId(req, res);
+    if (clientId === null) return;
+    if (!deps.bridge.generateWorkspaceContent) {
+      res.status(501).json({
+        error: "Workspace generation is not supported by this bridge",
+        code: "generation_not_supported"
+      });
+      return;
+    }
+    const abort = new AbortController();
+    let completed = false;
+    const onClose = /* @__PURE__ */ __name(() => {
+      if (!completed) abort.abort();
+    }, "onClose");
+    res.once("close", onClose);
+    const stream = deps.bridge.generateWorkspaceContent(
+      prompt.trim(),
+      abort.signal,
+      clientId
+    );
+    res.status(200);
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache, no-transform");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+    res.flushHeaders();
+    let writeChain = Promise.resolve();
+    const write = /* @__PURE__ */ __name((chunk) => {
+      writeChain = writeChain.then(() => writeGenerationSseChunk(res, chunk));
+      return writeChain;
+    }, "write");
+    await write(": connected\n\n");
+    const heartbeat = setInterval(() => {
+      void write(": heartbeat\n\n").catch(() => abort.abort());
+    }, GENERATION_HEARTBEAT_MS);
+    heartbeat.unref();
+    try {
+      for await (const event of stream) {
+        await write(formatGenerationSse(event.type, event));
+      }
+    } catch (error2) {
+      if (!abort.signal.aborted && !res.destroyed) {
+        writeStderrLine(
+          `qwen serve: POST /workspace/generate failed: ${error2 instanceof Error ? error2.stack ?? error2.message : String(error2)}`
+        );
+        await write(
+          formatGenerationSse("error", {
+            type: "error",
+            code: "generation_failed",
+            message: "Generation failed"
+          })
+        ).catch(() => void 0);
+      }
+    } finally {
+      completed = true;
+      clearInterval(heartbeat);
+      res.off("close", onClose);
+      if (!res.destroyed) res.end();
+    }
+  });
+}
+__name(mountWorkspaceGenerationRoutes, "mountWorkspaceGenerationRoutes");
+
 // packages/cli/src/serve/routes/daemon-status.ts
 init_esbuild_shims();
 function registerDaemonStatusRoutes(app, deps) {
@@ -17519,13 +17953,13 @@ async function handlePostFileWrite(req, res, deps) {
     req
   );
   if (originatorClientId === null) return;
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "write");
-    const out = await fs5.writeTextAtomic(resolved, content, {
+    const resolved = await fs6.resolve(queryPath, "write");
+    const out = await fs6.writeTextAtomic(resolved, content, {
       mode,
       ...expectedHash ? { expectedHash } : {},
       ...bom !== void 0 ? { bom } : {},
@@ -17578,13 +18012,13 @@ async function handlePostFileEdit(req, res, deps) {
     req
   );
   if (originatorClientId === null) return;
-  const fs5 = factory.forRequest({
+  const fs6 = factory.forRequest({
     originatorClientId,
     route: ROUTE2
   });
   try {
-    const resolved = await fs5.resolve(queryPath, "edit");
-    const out = await fs5.editAtomic(resolved, oldText, newText, {
+    const resolved = await fs6.resolve(queryPath, "edit");
+    const out = await fs6.editAtomic(resolved, oldText, newText, {
       expectedHash
     });
     applyReadHeaders(res);
@@ -17912,6 +18346,18 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "GET /session/:id/tasks"
   },
+  {
+    method: "GET",
+    path: "/session/:id/subagents/:toolCallId",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/subagents/:toolCallId"
+  },
+  {
+    method: "POST",
+    path: "/session/:id/subagents/:toolCallId/cancel",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/subagents/:toolCallId/cancel"
+  },
   {
     method: "GET",
     path: "/session/:id/lsp",
@@ -18594,7 +19040,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 // packages/cli/src/serve/routes/session.ts
 init_esbuild_shims();
 import * as crypto3 from "node:crypto";
-import * as fs3 from "node:fs";
+import * as fs4 from "node:fs";
 import * as path10 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
@@ -18887,7 +19333,17 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
               organization
             )
           );
-        } else if (!await sessionService.sessionExists(live.sessionId)) {
+        } else if (
+          // `listAllPersistedSummaries` already scanned every persisted
+          // session when the scan wasn't truncated, so a `sessionId` missing
+          // from `bySessionId` is definitively new — no disk re-check
+          // needed. Re-checking here raced a session that persists its
+          // first write (e.g. a `displayName` update) between the scan
+          // above and this point: `existing` stayed undefined but
+          // `sessionExists` flipped to true, silently dropping the live
+          // session from the response instead of merging it.
+          !persisted.truncated || !await sessionService.sessionExists(live.sessionId)
+        ) {
           bySessionId.set(
             live.sessionId,
             applyOrganization(
@@ -18969,7 +19425,13 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
             live.sessionId,
             mergeLiveSessionSummary(existing, live)
           );
-        } else if (!await sessionService.sessionExists(live.sessionId)) {
+        } else if (
+          // See the matching comment in
+          // `listOrganizedWorkspaceSessionsForResponse`: an untruncated scan
+          // already covers every persisted session, so skip the racy
+          // re-check when nothing was truncated.
+          !persisted.truncated || !await sessionService.sessionExists(live.sessionId)
+        ) {
           bySessionId.set(live.sessionId, {
             ...live,
             createdAt: live.createdAt,
@@ -19072,7 +19534,14 @@ async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, r
     const existing = bySessionId.get(live.sessionId);
     if (existing) {
       bySessionId.set(live.sessionId, mergeLiveSessionSummary(existing, live));
-    } else if (isFirstPage && !await sessionService.sessionExists(live.sessionId)) {
+    } else if (isFirstPage && // If this is a complete scan (no further pages), a missing
+    // `sessionId` here is definitively new — no disk re-check needed.
+    // Re-checking raced a session that persists its first write (e.g. a
+    // `displayName` update) between the scan above and this point:
+    // `existing` stayed undefined but `sessionExists` flipped to true,
+    // silently dropping the live session from the response instead of
+    // merging it.
+    (persisted.nextCursor == null || !await sessionService.sessionExists(live.sessionId))) {
       bySessionId.set(live.sessionId, {
         ...live,
         createdAt: live.createdAt,
@@ -19200,108 +19669,846 @@ async function exportSessionTranscript(params) {
 }
 __name(exportSessionTranscript, "exportSessionTranscript");
 
-// packages/cli/src/serve/routes/session.ts
-var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
-var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
-var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
-var GENERATION_HEARTBEAT_MS = 15e3;
-var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
-  "POST /session/:id/branch",
-  "POST /session/:id/fork",
-  "POST /session/:id/cd"
-];
-function isPrimaryOnlyLiveSessionRoute(route) {
-  return PRIMARY_ONLY_LIVE_SESSION_ROUTES.includes(
-    route
-  );
-}
-__name(isPrimaryOnlyLiveSessionRoute, "isPrimaryOnlyLiveSessionRoute");
-function formatGenerationSse(event, data) {
-  return `event: ${event}
-data: ${JSON.stringify({ v: 1, ...data })}
-
-`;
-}
-__name(formatGenerationSse, "formatGenerationSse");
-function writeGenerationSseChunk(res, chunk) {
-  if (res.destroyed) {
-    return Promise.reject(new Error("Generation SSE connection destroyed"));
-  }
-  const writable = res.write(chunk);
-  const flush = res.flush;
-  flush?.call(res);
-  if (writable) {
-    return res.destroyed ? Promise.reject(new Error("Generation SSE connection destroyed")) : Promise.resolve();
+// packages/cli/src/serve/server/git-branch-ops.ts
+init_esbuild_shims();
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var GIT_BRANCH_TIMEOUT_MS = 3e4;
+async function branchExists(cwd, name) {
+  try {
+    await execFileAsync(
+      "git",
+      ["rev-parse", "--verify", `refs/heads/${name}`],
+      { cwd, timeout: GIT_BRANCH_TIMEOUT_MS }
+    );
+    return true;
+  } catch {
+    return false;
   }
-  return new Promise((resolve6, reject) => {
-    const cleanup = /* @__PURE__ */ __name(() => {
-      res.off("drain", onDrain);
-      res.off("close", onClose);
-      res.off("error", onError);
-    }, "cleanup");
-    const onDrain = /* @__PURE__ */ __name(() => {
-      cleanup();
-      resolve6();
-    }, "onDrain");
-    const onClose = /* @__PURE__ */ __name(() => {
-      cleanup();
-      reject(new Error("Generation SSE connection closed"));
-    }, "onClose");
-    const onError = /* @__PURE__ */ __name((error2) => {
-      cleanup();
-      reject(error2);
-    }, "onError");
-    res.once("drain", onDrain);
-    res.once("close", onClose);
-    res.once("error", onError);
-    if (res.destroyed) onClose();
+}
+__name(branchExists, "branchExists");
+async function isDirtyTree(cwd) {
+  const { stdout } = await execFileAsync(
+    "git",
+    ["status", "--porcelain", "--untracked-files=no"],
+    {
+      cwd,
+      maxBuffer: 10 * 1024 * 1024,
+      timeout: GIT_BRANCH_TIMEOUT_MS
+    }
+  );
+  return stdout.trim().length > 0;
+}
+__name(isDirtyTree, "isDirtyTree");
+async function getHeadCommit(cwd) {
+  return execFileAsync("git", ["rev-parse", "HEAD"], {
+    cwd,
+    timeout: GIT_BRANCH_TIMEOUT_MS
+  }).then(({ stdout }) => stdout.trim()).catch(() => void 0);
+}
+__name(getHeadCommit, "getHeadCommit");
+async function createBranch(cwd, name) {
+  await execFileAsync("git", ["checkout", "-b", name], {
+    cwd,
+    timeout: GIT_BRANCH_TIMEOUT_MS
   });
 }
-__name(writeGenerationSseChunk, "writeGenerationSseChunk");
-function isReadOnlyWorkspaceInspection(runtime) {
-  return !runtime.primary && !runtime.trusted;
+__name(createBranch, "createBranch");
+async function checkoutRef(cwd, ref) {
+  await execFileAsync("git", ["checkout", ref], {
+    cwd,
+    timeout: GIT_BRANCH_TIMEOUT_MS
+  });
 }
-__name(isReadOnlyWorkspaceInspection, "isReadOnlyWorkspaceInspection");
-function runWorkspaceInspectionWithLogPolicy(runtime, read) {
-  return isReadOnlyWorkspaceInspection(runtime) ? runWithoutDebugLogSession(read) : read();
+__name(checkoutRef, "checkoutRef");
+async function deleteBranch(cwd, name) {
+  await execFileAsync("git", ["branch", "-D", name], {
+    cwd,
+    timeout: GIT_BRANCH_TIMEOUT_MS
+  });
 }
-__name(runWorkspaceInspectionWithLogPolicy, "runWorkspaceInspectionWithLogPolicy");
-function requireSessionArtifactClientId(clientId, res) {
-  if (clientId !== void 0) return true;
-  res.status(403).json({
-    error: "Session artifact access requires a session-bound client id",
-    code: "client_id_required",
-    errorKind: "client_id_required"
+__name(deleteBranch, "deleteBranch");
+
+// packages/cli/src/serve/virtual-subagent-sessions.ts
+init_esbuild_shims();
+import * as fs3 from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import readline from "node:readline";
+var PREFIX = "subagent.";
+var POLL_INTERVAL_MS = 250;
+var TARGET_RETENTION_MS = 6e4;
+async function readFirstUserText(filePath) {
+  const stream = createReadStream(filePath);
+  const lines = readline.createInterface({
+    input: stream,
+    crlfDelay: Infinity
   });
-  return false;
+  try {
+    for await (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      for (const record of parseLineTolerant(trimmed, filePath)) {
+        if (record.type !== "user") continue;
+        return record.message?.parts?.find(
+          (part) => typeof part.text === "string"
+        )?.text;
+      }
+    }
+    return void 0;
+  } catch (error2) {
+    if (error2.code === "ENOENT") return void 0;
+    throw error2;
+  } finally {
+    lines.close();
+    stream.destroy();
+  }
+}
+__name(readFirstUserText, "readFirstUserText");
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+__name(asRecord, "asRecord");
+function finiteNonNegative(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+__name(finiteNonNegative, "finiteNonNegative");
+function normalizeTaskStatus(status) {
+  if (typeof status !== "string") return void 0;
+  if (status === "success") return "completed";
+  if (status === "error") return "failed";
+  if (status === "background") return "running";
+  return status;
+}
+__name(normalizeTaskStatus, "normalizeTaskStatus");
+function isTerminalTaskStatus(status) {
+  return status === "completed" || status === "failed" || status === "cancelled" || status === "canceled";
+}
+__name(isTerminalTaskStatus, "isTerminalTaskStatus");
+function preferTerminalTaskStatus(metricsStatus, selectedStatus) {
+  return !isTerminalTaskStatus(metricsStatus) && isTerminalTaskStatus(selectedStatus) ? selectedStatus : metricsStatus ?? selectedStatus;
+}
+__name(preferTerminalTaskStatus, "preferTerminalTaskStatus");
+function durationBetween(start, end) {
+  if (!end) return void 0;
+  const startTime = Date.parse(start);
+  const endTime = Date.parse(end);
+  return Number.isFinite(startTime) && Number.isFinite(endTime) ? Math.max(0, endTime - startTime) : void 0;
+}
+__name(durationBetween, "durationBetween");
+function findToolCallMetrics(records, toolCallId) {
+  const toolResult = records.find(
+    (record) => record.toolCallResult?.callId === toolCallId
+  )?.toolCallResult;
+  const display = asRecord(toolResult?.resultDisplay);
+  const summary = asRecord(display?.["executionSummary"]);
+  return {
+    status: normalizeTaskStatus(display?.["status"]) ?? normalizeTaskStatus(toolResult?.status),
+    durationMs: finiteNonNegative(summary?.["totalDurationMs"]),
+    totalTokens: finiteNonNegative(summary?.["totalTokens"]) ?? finiteNonNegative(display?.["tokenCount"]),
+    inputTokens: finiteNonNegative(summary?.["inputTokens"]),
+    outputTokens: finiteNonNegative(summary?.["outputTokens"]),
+    cachedTokens: finiteNonNegative(summary?.["cachedTokens"])
+  };
 }
-__name(requireSessionArtifactClientId, "requireSessionArtifactClientId");
-function sendArtifactValidationError(res, err) {
-  if (!(err instanceof SessionArtifactValidationError)) {
-    return false;
+__name(findToolCallMetrics, "findToolCallMetrics");
+function encodePart(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+__name(encodePart, "encodePart");
+function decodePart(value) {
+  try {
+    return Buffer.from(value, "base64url").toString("utf8");
+  } catch {
+    return void 0;
   }
-  res.status(400).json({
-    v: 1,
-    error: {
-      code: err.code,
-      message: err.message,
-      ...err.field ? { field: err.field } : {}
-    }
-  });
-  return true;
 }
-__name(sendArtifactValidationError, "sendArtifactValidationError");
-function sendSessionOrganizationError(res, err) {
-  if (!(err instanceof SessionOrganizationError)) {
-    return false;
+__name(decodePart, "decodePart");
+function isValidVirtualSessionPart(value) {
+  return /^[a-zA-Z0-9_-]{1,500}$/.test(value);
+}
+__name(isValidVirtualSessionPart, "isValidVirtualSessionPart");
+function createVirtualSubagentSessionId(parentSessionId, agentId) {
+  if (!isValidVirtualSessionPart(parentSessionId) || !isValidVirtualSessionPart(agentId)) {
+    throw new Error("Virtual subagent session ids require valid id parts");
   }
-  const status = err.code === "group_name_conflict" ? 409 : err.code === "group_not_found" ? 404 : err.code === "session_organization_store_unreadable" ? 500 : 400;
-  res.status(status).json({
-    error: err.message,
-    code: err.code,
-    ...err.field !== void 0 ? { field: err.field } : {}
-  });
-  return true;
+  return `${PREFIX}${encodePart(parentSessionId)}.${encodePart(agentId)}`;
+}
+__name(createVirtualSubagentSessionId, "createVirtualSubagentSessionId");
+function parseVirtualSubagentSessionId(sessionId) {
+  if (!sessionId.startsWith(PREFIX) || sessionId.length > 2e3) {
+    return void 0;
+  }
+  const parts = sessionId.slice(PREFIX.length).split(".");
+  if (parts.length !== 2) return void 0;
+  const parentSessionId = decodePart(parts[0]);
+  const agentId = decodePart(parts[1]);
+  if (!parentSessionId || !agentId || !isValidVirtualSessionPart(parentSessionId) || !isValidVirtualSessionPart(agentId)) {
+    return void 0;
+  }
+  return { parentSessionId, agentId };
+}
+__name(parseVirtualSubagentSessionId, "parseVirtualSubagentSessionId");
+function replayCursorState(sessionId, position, leafUuid, startTime, lastUpdated) {
+  return {
+    v: 1,
+    sessionId,
+    fileIdentity: { dev: 0, ino: 0 },
+    snapshotSize: position,
+    position,
+    leafUuid,
+    startTime,
+    lastUpdated
+  };
+}
+__name(replayCursorState, "replayCursorState");
+var VirtualSubagentTarget = class _VirtualSubagentTarget {
+  constructor(sessionId, parentSessionId, task, workspaceCwd, onExpired) {
+    this.sessionId = sessionId;
+    this.parentSessionId = parentSessionId;
+    this.task = task;
+    this.workspaceCwd = workspaceCwd;
+    this.onExpired = onExpired;
+  }
+  static {
+    __name(this, "VirtualSubagentTarget");
+  }
+  bus = new EventBus(1024, 8);
+  events = [];
+  snapshotDelivered = false;
+  offset = 0;
+  transcriptIdentity;
+  streamOffset = 0;
+  streamIdentity;
+  streamReady = false;
+  canonicalThroughTimestamp = 0;
+  completedStreamRounds = /* @__PURE__ */ new Set();
+  streamedRounds = /* @__PURE__ */ new Set();
+  streamRunIds = /* @__PURE__ */ new Set();
+  legacyStreamedSinceCanonical = false;
+  replayState;
+  initialized = false;
+  refreshPromise = Promise.resolve();
+  snapshotPromise = Promise.resolve();
+  pollTimer;
+  subscribers = 0;
+  retentionTimer;
+  updateStatus(status) {
+    const wasRunning = this.task.status === "running";
+    this.task.status = status;
+    if (status !== "running" && this.pollTimer) {
+      clearInterval(this.pollTimer);
+      this.pollTimer = void 0;
+    }
+    if (wasRunning && status !== "running") {
+      void this.refreshLive().catch(() => void 0);
+    }
+  }
+  rememberEvent(event) {
+    if (event && !this.snapshotDelivered) this.events.push(event);
+  }
+  resetCanonicalState() {
+    this.offset = 0;
+    this.replayState = void 0;
+    this.canonicalThroughTimestamp = 0;
+    this.completedStreamRounds.clear();
+    this.streamRunIds.clear();
+    this.streamedRounds.clear();
+    this.legacyStreamedSinceCanonical = false;
+  }
+  resetStreamState() {
+    this.streamOffset = 0;
+    this.completedStreamRounds.clear();
+    this.streamRunIds.clear();
+    this.streamedRounds.clear();
+    this.legacyStreamedSinceCanonical = false;
+  }
+  async readNewRecords(endOffset) {
+    let handle;
+    try {
+      handle = await fs3.open(this.task.outputFile, "r");
+      const stat3 = await handle.stat();
+      const identity = `${stat3.dev}:${stat3.ino}`;
+      if (this.transcriptIdentity !== void 0 && this.transcriptIdentity !== identity || stat3.size < this.offset) {
+        this.resetCanonicalState();
+      }
+      this.transcriptIdentity = identity;
+      const size = Math.min(stat3.size, endOffset ?? stat3.size);
+      if (size <= this.offset) return [];
+      const bytes = Buffer.alloc(size - this.offset);
+      const { bytesRead } = await handle.read(
+        bytes,
+        0,
+        bytes.length,
+        this.offset
+      );
+      const chunk = bytes.subarray(0, bytesRead);
+      const lastNewline = chunk.lastIndexOf(10);
+      if (lastNewline < 0) return [];
+      const complete = chunk.subarray(0, lastNewline + 1);
+      this.offset += complete.length;
+      return complete.toString("utf8").split("\n").flatMap((line) => {
+        const trimmed = line.trim();
+        return trimmed ? parseLineTolerant(trimmed, this.task.outputFile) : [];
+      });
+    } catch (error2) {
+      if (error2.code === "ENOENT") {
+        if (this.transcriptIdentity !== void 0) {
+          this.transcriptIdentity = void 0;
+          this.resetCanonicalState();
+        }
+        return [];
+      }
+      throw error2;
+    } finally {
+      await handle?.close();
+    }
+  }
+  async readStreamUpdates(endOffset) {
+    const replayingExisting = !this.streamReady;
+    this.streamReady = true;
+    const filePath = `${this.task.outputFile}.stream`;
+    let handle;
+    try {
+      handle = await fs3.open(filePath, "r");
+      const stat3 = await handle.stat();
+      const identity = `${stat3.dev}:${stat3.ino}`;
+      if (this.streamIdentity !== void 0 && this.streamIdentity !== identity) {
+        this.resetStreamState();
+      }
+      this.streamIdentity = identity;
+      if (stat3.size < this.streamOffset) this.resetStreamState();
+      const size = Math.min(stat3.size, endOffset ?? stat3.size);
+      if (size <= this.streamOffset) return;
+      const bytes = Buffer.alloc(size - this.streamOffset);
+      const { bytesRead } = await handle.read(
+        bytes,
+        0,
+        bytes.length,
+        this.streamOffset
+      );
+      const chunk = bytes.subarray(0, bytesRead);
+      const lastNewline = chunk.lastIndexOf(10);
+      if (lastNewline < 0) return;
+      const complete = chunk.subarray(0, lastNewline + 1);
+      this.streamOffset += complete.length;
+      const records = complete.toString("utf8").split("\n").flatMap((line) => {
+        const trimmed = line.trim();
+        return trimmed ? parseLineTolerant(trimmed, filePath) : [];
+      });
+      for (const record of records) {
+        if (record.v !== 1 || typeof record.text !== "string" || typeof record.timestamp !== "number") {
+          continue;
+        }
+        const roundKey = typeof record.runId === "string" && typeof record.round === "number" ? `${record.runId}:${record.round}` : void 0;
+        if (typeof record.runId === "string") {
+          this.streamRunIds.add(record.runId);
+        }
+        if ((roundKey ? this.completedStreamRounds.has(roundKey) : record.timestamp <= this.canonicalThroughTimestamp) || replayingExisting && typeof record.round !== "number") {
+          continue;
+        }
+        const event = this.bus.publish({
+          type: "session_update",
+          data: createTranscriptMessageUpdate({
+            role: "assistant",
+            text: record.text,
+            timestamp: record.timestamp,
+            ...record.thought ? { thought: true } : {}
+          })
+        });
+        this.rememberEvent(event);
+        if (roundKey) this.streamedRounds.add(roundKey);
+        else this.legacyStreamedSinceCanonical = true;
+      }
+      for (const completed of this.completedStreamRounds) {
+        const runId = completed.slice(0, completed.lastIndexOf(":"));
+        if (!this.streamRunIds.has(runId)) {
+          this.completedStreamRounds.delete(completed);
+        }
+      }
+    } catch (error2) {
+      if (error2.code !== "ENOENT") throw error2;
+      this.streamIdentity = void 0;
+      this.streamOffset = 0;
+      this.streamRunIds.clear();
+      this.streamedRounds.clear();
+      this.legacyStreamedSinceCanonical = false;
+    } finally {
+      await handle?.close();
+    }
+  }
+  refreshOnce = /* @__PURE__ */ __name(async (endOffset) => {
+    let records = await this.readNewRecords(endOffset);
+    if (records.length === 0) {
+      this.initialized = true;
+      return;
+    }
+    for (const record of records) {
+      if (record.type === "assistant" && (record.usageMetadata !== void 0 || record.message?.parts?.some((part) => typeof part.text === "string"))) {
+        if (typeof record.agentRunId === "string" && typeof record.agentRound === "number") {
+          this.completedStreamRounds.add(
+            `${record.agentRunId}:${record.agentRound}`
+          );
+        }
+        const timestamp = Date.parse(record.timestamp);
+        if (Number.isFinite(timestamp)) {
+          this.canonicalThroughTimestamp = Math.max(
+            this.canonicalThroughTimestamp,
+            timestamp
+          );
+        }
+      }
+    }
+    if (this.streamedRounds.size > 0 || this.legacyStreamedSinceCanonical) {
+      records = records.filter((record) => {
+        const roundKey = typeof record.agentRunId === "string" && typeof record.agentRound === "number" ? `${record.agentRunId}:${record.agentRound}` : void 0;
+        if (roundKey && this.streamedRounds.delete(roundKey)) return false;
+        if (!this.legacyStreamedSinceCanonical || record.type !== "assistant" || record.message?.parts?.some((part) => part.functionCall)) {
+          return true;
+        }
+        this.legacyStreamedSinceCanonical = false;
+        return false;
+      });
+      if (records.length === 0) {
+        this.initialized = true;
+        return;
+      }
+    }
+    const startTime = records[0]?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+    const lastUpdated = records[records.length - 1]?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+    const page = {
+      sessionId: this.sessionId,
+      filePath: this.task.outputFile,
+      records,
+      gaps: [],
+      hasMore: true,
+      replay: this.replayState,
+      startTime,
+      lastUpdated,
+      nextCursorState: replayCursorState(
+        this.sessionId,
+        this.offset,
+        records[records.length - 1]?.uuid ?? "",
+        startTime,
+        lastUpdated
+      )
+    };
+    let nextReplayState;
+    const replay = await replayTranscriptRecordPage({
+      sessionId: this.sessionId,
+      page,
+      encodeCursor: /* @__PURE__ */ __name((state) => {
+        nextReplayState = state.replay;
+        return "virtual-subagent-replay";
+      }, "encodeCursor")
+    });
+    this.replayState = nextReplayState;
+    const inputs = replay.updates.map((update) => ({
+      type: "session_update",
+      data: update
+    }));
+    const published = this.initialized ? inputs.flatMap((input) => {
+      const event = this.bus.publish(input);
+      return event ? [event] : [];
+    }) : this.bus.seedReplayEvents(inputs);
+    if (!this.snapshotDelivered) this.events.push(...published);
+    this.initialized = true;
+  }, "refreshOnce");
+  refreshAt(bounds) {
+    return this.refreshOnce(bounds?.transcript).then(async () => {
+      if (this.task.status === "running") {
+        await this.readStreamUpdates(bounds?.stream);
+      }
+    });
+  }
+  enqueueRefresh(work) {
+    const result = this.refreshPromise.catch(() => void 0).then(work);
+    this.refreshPromise = result.then(
+      () => void 0,
+      () => void 0
+    );
+    return result;
+  }
+  refreshLive() {
+    return this.enqueueRefresh(() => this.refreshAt());
+  }
+  async captureReadBounds() {
+    const size = /* @__PURE__ */ __name(async (filePath) => {
+      try {
+        return (await fs3.stat(filePath)).size;
+      } catch (error2) {
+        if (error2.code === "ENOENT") return 0;
+        throw error2;
+      }
+    }, "size");
+    const [transcript, stream] = await Promise.all([
+      size(this.task.outputFile),
+      size(`${this.task.outputFile}.stream`)
+    ]);
+    return { transcript, stream };
+  }
+  async createSnapshotOnce() {
+    if (!this.snapshotDelivered) {
+      await this.refreshLive();
+      const snapshot = [...this.events];
+      this.events.length = 0;
+      this.snapshotDelivered = true;
+      return { events: snapshot, lastEventId: this.bus.lastEventId };
+    }
+    return this.enqueueRefresh(async () => {
+      const bounds = await this.captureReadBounds();
+      const target = new _VirtualSubagentTarget(
+        this.sessionId,
+        this.parentSessionId,
+        this.task,
+        this.workspaceCwd,
+        () => void 0
+      );
+      await target.refreshAt(bounds);
+      await this.refreshAt(bounds);
+      return {
+        events: [...target.events],
+        lastEventId: this.bus.lastEventId
+      };
+    });
+  }
+  createSnapshot() {
+    const snapshot = this.snapshotPromise.then(() => this.createSnapshotOnce());
+    this.snapshotPromise = snapshot.then(
+      () => void 0,
+      () => void 0
+    );
+    return snapshot;
+  }
+  async load(clientId) {
+    const snapshot = await this.createSnapshot();
+    if (this.subscribers === 0) this.scheduleRetention();
+    return {
+      sessionId: this.sessionId,
+      workspaceCwd: this.workspaceCwd,
+      attached: true,
+      ...clientId ? { clientId } : {},
+      createdAt: new Date(this.task.startTime).toISOString(),
+      hasActivePrompt: this.task.status === "running",
+      state: {},
+      compactedReplay: snapshot.events,
+      liveJournal: [],
+      historyHasMore: false,
+      lastEventId: snapshot.lastEventId
+    };
+  }
+  async *iterate(opts) {
+    if (this.retentionTimer) {
+      clearTimeout(this.retentionTimer);
+      this.retentionTimer = void 0;
+    }
+    this.subscribers++;
+    try {
+      await this.refreshLive();
+      if (!this.snapshotDelivered) {
+        this.events.length = 0;
+        this.snapshotDelivered = true;
+      }
+      if (this.task.status === "running" && !this.pollTimer) {
+        this.pollTimer = setInterval(() => {
+          void this.refreshLive().catch(() => void 0);
+        }, POLL_INTERVAL_MS);
+        this.pollTimer.unref();
+      }
+      yield* this.bus.subscribe(opts);
+    } finally {
+      this.subscribers--;
+      if (this.subscribers === 0) {
+        if (this.pollTimer) clearInterval(this.pollTimer);
+        this.pollTimer = void 0;
+        this.scheduleRetention();
+      }
+    }
+  }
+  subscribe(opts) {
+    return {
+      [Symbol.asyncIterator]: () => this.iterate(opts)
+    };
+  }
+  scheduleRetention() {
+    if (this.retentionTimer) clearTimeout(this.retentionTimer);
+    this.retentionTimer = setTimeout(this.onExpired, TARGET_RETENTION_MS);
+    this.retentionTimer.unref();
+  }
+};
+var VirtualSubagentSessions = class {
+  static {
+    __name(this, "VirtualSubagentSessions");
+  }
+  targets = /* @__PURE__ */ new Map();
+  async findTask(runtime, parentSessionId, predicate) {
+    const status = await runtime.bridge.getSessionTasksStatus(parentSessionId);
+    const task = status.tasks.find(
+      (candidate) => candidate.kind === "agent" && typeof candidate.outputFile === "string" && predicate(candidate)
+    );
+    if (task?.kind === "agent" && task.outputFile) {
+      return {
+        id: task.id,
+        title: task.label,
+        outputFile: task.outputFile,
+        status: task.status,
+        startTime: task.startTime,
+        durationMs: task.stats?.durationMs ?? (task.endTime === void 0 ? void 0 : Math.max(0, task.endTime - task.startTime)),
+        totalTokens: task.stats?.totalTokens
+      };
+    }
+    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
+    const projectDir = Storage.runWithRuntimeBaseDir(
+      runtimeDir,
+      runtime.workspaceCwd,
+      () => new Storage(runtime.workspaceCwd).getProjectDir()
+    );
+    const sessionDir = getSubagentSessionDir(projectDir, parentSessionId);
+    let names;
+    try {
+      names = await fs3.readdir(sessionDir);
+    } catch (error2) {
+      if (error2.code === "ENOENT") return void 0;
+      throw error2;
+    }
+    for (const name of names) {
+      if (!name.endsWith(".meta.json")) continue;
+      const metaPath = `${sessionDir}/${name}`;
+      const meta = readAgentMeta(metaPath);
+      if (!meta || !predicate({
+        kind: "agent",
+        id: meta.agentId,
+        toolUseId: meta.toolUseId,
+        outputFile: metaPath.slice(0, -".meta.json".length) + ".jsonl"
+      })) {
+        continue;
+      }
+      return {
+        id: meta.agentId,
+        title: meta.description || meta.agentType,
+        outputFile: metaPath.slice(0, -".meta.json".length) + ".jsonl",
+        status: meta.status ?? "completed",
+        startTime: Number.isFinite(Date.parse(meta.createdAt)) ? Date.parse(meta.createdAt) : Date.now(),
+        durationMs: durationBetween(meta.createdAt, meta.lastUpdatedAt)
+      };
+    }
+    return void 0;
+  }
+  async findLegacyTaskByToolCall(runtime, parentSessionId, toolCallId) {
+    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
+    const projectDir = Storage.runWithRuntimeBaseDir(
+      runtimeDir,
+      runtime.workspaceCwd,
+      () => new Storage(runtime.workspaceCwd).getProjectDir()
+    );
+    const parentRecords = await read(
+      `${projectDir}/chats/${parentSessionId}.jsonl`
+    );
+    let root;
+    for (const record of parentRecords) {
+      for (const part of record.message?.parts ?? []) {
+        const call = part.functionCall;
+        if (call?.id !== toolCallId || call.name !== "agent") continue;
+        const args = call.args;
+        root = {
+          timestamp: Date.parse(record.timestamp),
+          ...typeof args?.["description"] === "string" ? { description: args["description"] } : {},
+          ...typeof args?.["prompt"] === "string" ? { prompt: args["prompt"] } : {},
+          ...typeof args?.["subagent_type"] === "string" ? { agentType: args["subagent_type"] } : {}
+        };
+        break;
+      }
+      if (root) break;
+    }
+    if (!root) return void 0;
+    const sessionDir = getSubagentSessionDir(projectDir, parentSessionId);
+    let names;
+    try {
+      names = await fs3.readdir(sessionDir);
+    } catch (error2) {
+      if (error2.code === "ENOENT") return void 0;
+      throw error2;
+    }
+    const candidates = [];
+    for (const name of names) {
+      if (!name.endsWith(".meta.json")) continue;
+      const metaPath = `${sessionDir}/${name}`;
+      const meta = readAgentMeta(metaPath);
+      if (!meta) continue;
+      const outputFile = metaPath.slice(0, -".meta.json".length) + ".jsonl";
+      const launchPrompt = await readFirstUserText(outputFile);
+      let score = 0;
+      if (root.prompt && launchPrompt === root.prompt) score += 8;
+      if (root.description && meta.description === root.description) score += 4;
+      if (root.agentType && meta.agentType === root.agentType) score += 2;
+      const startTime = Date.parse(meta.createdAt);
+      const delta = Math.abs(startTime - root.timestamp);
+      if (Number.isFinite(delta) && delta <= 6e4) score += 1;
+      if (score === 0) continue;
+      candidates.push({
+        id: meta.agentId,
+        title: meta.description || meta.agentType,
+        outputFile,
+        status: meta.status ?? "completed",
+        startTime: Number.isFinite(startTime) ? startTime : Date.now(),
+        durationMs: durationBetween(meta.createdAt, meta.lastUpdatedAt),
+        score,
+        delta
+      });
+    }
+    candidates.sort((a, b) => b.score - a.score || a.delta - b.delta);
+    const selected = candidates[0];
+    if (!selected) return void 0;
+    const metrics = findToolCallMetrics(parentRecords, toolCallId);
+    return {
+      ...selected,
+      status: preferTerminalTaskStatus(metrics.status, selected.status),
+      durationMs: metrics.durationMs ?? selected.durationMs,
+      totalTokens: metrics.totalTokens ?? selected.totalTokens,
+      inputTokens: metrics.inputTokens ?? selected.inputTokens,
+      outputTokens: metrics.outputTokens ?? selected.outputTokens,
+      cachedTokens: metrics.cachedTokens ?? selected.cachedTokens
+    };
+  }
+  async readParentToolCallMetrics(runtime, parentSessionId, toolCallId) {
+    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
+    const projectDir = Storage.runWithRuntimeBaseDir(
+      runtimeDir,
+      runtime.workspaceCwd,
+      () => new Storage(runtime.workspaceCwd).getProjectDir()
+    );
+    const records = await read(
+      `${projectDir}/chats/${parentSessionId}.jsonl`
+    );
+    return findToolCallMetrics(records, toolCallId);
+  }
+  async resolve(runtime, parentSessionId, toolCallId) {
+    let task = await this.findTask(
+      runtime,
+      parentSessionId,
+      (candidate) => candidate.toolUseId === toolCallId || candidate.id.endsWith(`-${toolCallId}`)
+    );
+    const metrics = task && task.status !== "running" ? await this.readParentToolCallMetrics(
+      runtime,
+      parentSessionId,
+      toolCallId
+    ) : void 0;
+    task ??= await this.findLegacyTaskByToolCall(
+      runtime,
+      parentSessionId,
+      toolCallId
+    );
+    if (!task) return void 0;
+    const sessionId = createVirtualSubagentSessionId(parentSessionId, task.id);
+    const status = task.status;
+    this.targets.get(`${runtime.workspaceId}:${sessionId}`)?.updateStatus(status);
+    return {
+      sessionId,
+      taskId: task.id,
+      title: task.title,
+      status,
+      durationMs: metrics?.durationMs ?? task.durationMs,
+      totalTokens: metrics?.totalTokens ?? task.totalTokens,
+      inputTokens: metrics?.inputTokens ?? task.inputTokens,
+      outputTokens: metrics?.outputTokens ?? task.outputTokens,
+      cachedTokens: metrics?.cachedTokens ?? task.cachedTokens
+    };
+  }
+  async getTarget(runtime, sessionId) {
+    const targetKey = `${runtime.workspaceId}:${sessionId}`;
+    const cached = this.targets.get(targetKey);
+    if (cached) return cached;
+    const key = parseVirtualSubagentSessionId(sessionId);
+    if (!key) return void 0;
+    const task = await this.findTask(
+      runtime,
+      key.parentSessionId,
+      (candidate) => candidate.id === key.agentId
+    );
+    if (!task) return void 0;
+    const existing = this.targets.get(targetKey);
+    if (existing) return existing;
+    const target = new VirtualSubagentTarget(
+      sessionId,
+      key.parentSessionId,
+      task,
+      runtime.workspaceCwd,
+      () => this.targets.delete(targetKey)
+    );
+    this.targets.set(targetKey, target);
+    return target;
+  }
+  async load(runtime, sessionId, clientId) {
+    return (await this.getTarget(runtime, sessionId))?.load(clientId);
+  }
+  async subscribe(runtime, sessionId, opts) {
+    return (await this.getTarget(runtime, sessionId))?.subscribe(opts);
+  }
+};
+
+// packages/cli/src/serve/routes/session.ts
+var GIT_RESERVED_BRANCH = "HEAD";
+var MAX_BRANCH_NAME_BYTES = 1e3;
+var MAX_BRANCH_COMPONENT_BYTES = 200;
+var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
+var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
+var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
+var CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS = 6e4;
+var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
+  "POST /session/:id/branch",
+  "POST /session/:id/fork",
+  "POST /session/:id/cd"
+];
+function isPrimaryOnlyLiveSessionRoute(route) {
+  return PRIMARY_ONLY_LIVE_SESSION_ROUTES.includes(
+    route
+  );
+}
+__name(isPrimaryOnlyLiveSessionRoute, "isPrimaryOnlyLiveSessionRoute");
+function isReadOnlyWorkspaceInspection(runtime) {
+  return !runtime.primary && !runtime.trusted;
+}
+__name(isReadOnlyWorkspaceInspection, "isReadOnlyWorkspaceInspection");
+function runWorkspaceInspectionWithLogPolicy(runtime, read2) {
+  return isReadOnlyWorkspaceInspection(runtime) ? runWithoutDebugLogSession(read2) : read2();
+}
+__name(runWorkspaceInspectionWithLogPolicy, "runWorkspaceInspectionWithLogPolicy");
+function requireSessionArtifactClientId(clientId, res) {
+  if (clientId !== void 0) return true;
+  res.status(403).json({
+    error: "Session artifact access requires a session-bound client id",
+    code: "client_id_required",
+    errorKind: "client_id_required"
+  });
+  return false;
+}
+__name(requireSessionArtifactClientId, "requireSessionArtifactClientId");
+function sendArtifactValidationError(res, err) {
+  if (!(err instanceof SessionArtifactValidationError)) {
+    return false;
+  }
+  res.status(400).json({
+    v: 1,
+    error: {
+      code: err.code,
+      message: err.message,
+      ...err.field ? { field: err.field } : {}
+    }
+  });
+  return true;
+}
+__name(sendArtifactValidationError, "sendArtifactValidationError");
+function sendSessionOrganizationError(res, err) {
+  if (!(err instanceof SessionOrganizationError)) {
+    return false;
+  }
+  const status = err.code === "group_name_conflict" ? 409 : err.code === "group_not_found" ? 404 : err.code === "session_organization_store_unreadable" ? 500 : 400;
+  res.status(status).json({
+    error: err.message,
+    code: err.code,
+    ...err.field !== void 0 ? { field: err.field } : {}
+  });
+  return true;
 }
 __name(sendSessionOrganizationError, "sendSessionOrganizationError");
 function parseTranscriptLimitQuery(rawLimit, res) {
@@ -19426,11 +20633,40 @@ function registerSessionRoutes(app, deps) {
     sendBridgeError: sendBridgeError2,
     daemonLog,
     promptDeadlineMs,
-    sessionShellCommandEnabled
+    sessionShellCommandEnabled,
+    virtualSubagentSessions
   } = deps;
   const LANGUAGE_CODES = deps.languageCodes;
   const transcriptCursorMasterKey = crypto3.randomBytes(32);
   const transcriptCursorCodecs = /* @__PURE__ */ new Map();
+  const activeBranchSessions = /* @__PURE__ */ new Map();
+  const inFlightBranchWorkspaces = /* @__PURE__ */ new Set();
+  const clearBranchSessionEntry = /* @__PURE__ */ __name((sessionId) => {
+    for (const [cwd, sid] of activeBranchSessions) {
+      if (sid === sessionId) {
+        activeBranchSessions.delete(cwd);
+      }
+    }
+  }, "clearBranchSessionEntry");
+  const rollbackBranchCreation = /* @__PURE__ */ __name(async (cwd, meta, baseCommit, log2) => {
+    activeBranchSessions.delete(cwd);
+    inFlightBranchWorkspaces.delete(cwd);
+    const baseRestored = await checkoutRef(
+      cwd,
+      meta.baseBranch === "HEAD" && baseCommit ? baseCommit : meta.baseBranch
+    ).then(() => true).catch((rollbackErr) => {
+      log2?.warn("branch rollback checkout failed", {
+        error: rollbackErr
+      });
+      return false;
+    });
+    if (!baseRestored) return;
+    await deleteBranch(cwd, meta.name).catch((rollbackErr) => {
+      log2?.warn("branch rollback delete failed", {
+        error: rollbackErr
+      });
+    });
+  }, "rollbackBranchCreation");
   const getTranscriptCursorCodec = /* @__PURE__ */ __name((runtime) => {
     const canonicalCwd = canonicalizeWorkspace(runtime.workspaceCwd);
     const cacheKey = `${runtime.workspaceId}\0${canonicalCwd}`;
@@ -20011,6 +21247,138 @@ function registerSessionRoutes(app, deps) {
     }
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
+    let branchMeta;
+    let branchBaseCommit;
+    const rawBranch = body["branch"];
+    if (rawBranch !== void 0 && rawBranch !== null) {
+      if (body["worktree"] !== void 0 && body["worktree"] !== null) {
+        res.status(400).json({
+          error: "`branch` and `worktree` are mutually exclusive",
+          code: "branch_and_worktree_conflict"
+        });
+        return;
+      }
+      if (typeof rawBranch !== "object" || Array.isArray(rawBranch)) {
+        res.status(400).json({
+          error: '`branch` must be an object (e.g. `{"name":"feat/my-feature"}`)',
+          code: "invalid_branch"
+        });
+        return;
+      }
+      const branchReq = rawBranch;
+      const branchName = branchReq["name"];
+      if (typeof branchName !== "string" || branchName.length === 0) {
+        res.status(400).json({
+          error: "`branch.name` must be a non-empty string",
+          code: "branch_invalid_name"
+        });
+        return;
+      }
+      if (/[^\p{L}\p{N}._/-]/u.test(branchName) || branchName.includes("..") || branchName.includes("//") || branchName.startsWith(".") || branchName.startsWith("-") || branchName.startsWith("/") || branchName.endsWith("/") || branchName.endsWith(".") || branchName.endsWith(".git") || branchName.includes("@{") || branchName.split("/").some((c) => c.startsWith(".") || c.endsWith(".lock")) || branchName.toUpperCase() === GIT_RESERVED_BRANCH || Buffer.byteLength(branchName, "utf8") > MAX_BRANCH_NAME_BYTES || branchName.split("/").some(
+        (c) => Buffer.byteLength(c, "utf8") > MAX_BRANCH_COMPONENT_BYTES
+      )) {
+        res.status(400).json({
+          error: `Invalid branch name: ${branchName}`,
+          code: "branch_invalid_name"
+        });
+        return;
+      }
+      const existingBranchSession = activeBranchSessions.get(workspaceCwd);
+      if (existingBranchSession) {
+        try {
+          runtime.bridge.getSessionSummary(existingBranchSession);
+          res.status(409).json({
+            error: "A branch session is already active for this workspace",
+            code: "branch_session_conflict",
+            existingSessionId: existingBranchSession
+          });
+          return;
+        } catch {
+          activeBranchSessions.delete(workspaceCwd);
+        }
+      }
+      const sharedCheckoutSession = runtime.bridge.listWorkspaceSessions(workspaceCwd).find((session) => !session.worktree && session.clientCount > 0);
+      if (sharedCheckoutSession) {
+        res.status(409).json({
+          error: "Another session is already active in this workspace; creating a branch would move its shared checkout",
+          code: "branch_session_conflict",
+          existingSessionId: sharedCheckoutSession.sessionId
+        });
+        return;
+      }
+      let wtService;
+      try {
+        wtService = new GitWorktreeService(workspaceCwd);
+      } catch {
+        res.status(500).json({
+          error: "Failed to initialize git service",
+          code: "branch_init_failed"
+        });
+        return;
+      }
+      if (!await wtService.isGitRepository()) {
+        res.status(400).json({
+          error: "Branch creation requires a git repository",
+          code: "branch_not_git_repo"
+        });
+        return;
+      }
+      if (await branchExists(workspaceCwd, branchName)) {
+        res.status(409).json({
+          error: `Branch "${branchName}" already exists`,
+          code: "branch_already_exists"
+        });
+        return;
+      }
+      let dirty;
+      try {
+        dirty = await isDirtyTree(workspaceCwd);
+      } catch {
+        res.status(500).json({
+          error: "Failed to check working tree status",
+          code: "branch_status_failed"
+        });
+        return;
+      }
+      if (dirty) {
+        res.status(409).json({
+          error: "Uncommitted changes detected. Commit or stash first.",
+          code: "branch_dirty_tree"
+        });
+        return;
+      }
+      const baseCommit = await getHeadCommit(workspaceCwd);
+      const baseBranch = await wtService.getCurrentBranch().catch(() => "HEAD");
+      if (inFlightBranchWorkspaces.has(workspaceCwd) || activeBranchSessions.has(workspaceCwd)) {
+        res.status(409).json({
+          error: "A branch session is already being created for this workspace",
+          code: "branch_session_conflict"
+        });
+        return;
+      }
+      inFlightBranchWorkspaces.add(workspaceCwd);
+      try {
+        await createBranch(workspaceCwd, branchName);
+      } catch (checkoutErr) {
+        daemonLog?.warn("branch checkout failed", {
+          error: checkoutErr instanceof Error ? checkoutErr.message : String(checkoutErr)
+        });
+        await rollbackBranchCreation(
+          workspaceCwd,
+          { name: branchName, baseBranch },
+          baseCommit,
+          daemonLog
+        );
+        res.status(500).json({
+          error: "Failed to create branch",
+          code: "branch_checkout_failed"
+        });
+        return;
+      }
+      branchMeta = { name: branchName, baseBranch };
+      branchBaseCommit = baseCommit;
+      sessionScope = "thread";
+    }
     let worktreeMeta;
     const rawWorktree = body["worktree"];
     if (rawWorktree !== void 0 && rawWorktree !== null) {
@@ -20082,7 +21450,8 @@ function registerSessionRoutes(app, deps) {
         ...approvalMode !== void 0 ? { approvalMode } : {},
         ...source.sourceType !== void 0 ? { sourceType: source.sourceType } : {},
         ...source.sourceId !== void 0 ? { sourceId: source.sourceId } : {},
-        ...worktreeMeta ? { worktree: worktreeMeta } : {}
+        ...worktreeMeta ? { worktree: worktreeMeta } : {},
+        ...branchMeta ? { branch: branchMeta } : {}
       });
       if (daemonLog) {
         daemonLog.info(
@@ -20113,12 +21482,30 @@ function registerSessionRoutes(app, deps) {
                 await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
                 });
               }
+              if (branchMeta) {
+                await rollbackBranchCreation(
+                  workspaceCwd,
+                  branchMeta,
+                  branchBaseCommit,
+                  daemonLog
+                );
+              }
+            } else if (branchMeta) {
+              activeBranchSessions.set(workspaceCwd, session.sessionId);
+              inFlightBranchWorkspaces.delete(workspaceCwd);
             }
           } catch {
+            if (branchMeta) {
+              activeBranchSessions.set(workspaceCwd, session.sessionId);
+              inFlightBranchWorkspaces.delete(workspaceCwd);
+            }
           }
         } else {
           runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
           });
+          if (branchMeta) {
+            inFlightBranchWorkspaces.delete(workspaceCwd);
+          }
         }
         return;
       }
@@ -20183,18 +21570,79 @@ function registerSessionRoutes(app, deps) {
           return;
         }
       }
+      if (branchMeta) {
+        activeBranchSessions.set(workspaceCwd, session.sessionId);
+        inFlightBranchWorkspaces.delete(workspaceCwd);
+      }
       res.status(200).json(session);
     } catch (err) {
       if (worktreeMeta) {
         await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
         });
       }
+      if (branchMeta) {
+        await rollbackBranchCreation(
+          workspaceCwd,
+          branchMeta,
+          branchBaseCommit,
+          daemonLog
+        );
+      }
       sendBridgeError2(res, err, { route: "POST /session" });
     }
   });
   const restoreSessionHandler = /* @__PURE__ */ __name((action) => async (req, res) => {
     const sessionId = requireSessionId(req, res);
     if (!sessionId) return;
+    const virtualKey = parseVirtualSubagentSessionId(sessionId);
+    if (virtualKey) {
+      const route2 = `POST /session/:id/${action}`;
+      if (action !== "load") {
+        res.status(400).json({
+          error: `Virtual subagent sessions do not support ${action}`,
+          code: "unsupported_action",
+          sessionId
+        });
+        return;
+      }
+      if (!virtualSubagentSessions) {
+        res.status(404).json({
+          error: `No session with id "${sessionId}"`,
+          code: "session_not_found",
+          sessionId
+        });
+        return;
+      }
+      const runtime2 = requireSessionRuntime({
+        sessionId: virtualKey.parentSessionId,
+        route: route2,
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime2) return;
+      const clientId2 = parseClientIdHeader(req, res);
+      if (clientId2 === null) return;
+      try {
+        const session = await virtualSubagentSessions.load(
+          runtime2,
+          sessionId,
+          clientId2
+        );
+        if (!session) {
+          res.status(404).json({
+            error: "Subagent session not found",
+            code: "session_not_found",
+            sessionId
+          });
+          return;
+        }
+        res.status(200).json(session);
+      } catch (err) {
+        sendBridgeError2(res, err, { route: route2, sessionId });
+      }
+      return;
+    }
     const body = safeBody(req);
     const route = `POST /session/:id/${action}`;
     let resolvedRuntime;
@@ -20284,7 +21732,7 @@ function registerSessionRoutes(app, deps) {
             path10.join(workspaceCwd, ".qwen", "worktrees")
           ];
           try {
-            realTarget = fs3.realpathSync(sidecar.worktreePath);
+            realTarget = fs4.realpathSync(sidecar.worktreePath);
             let repoTop = null;
             try {
               repoTop = await new GitWorktreeService(
@@ -20297,7 +21745,7 @@ function registerSessionRoutes(app, deps) {
             }
             const contained = candidateRoots.some((root) => {
               try {
-                const realRoot = fs3.realpathSync(root);
+                const realRoot = fs4.realpathSync(root);
                 const rel = path10.relative(realRoot, realTarget);
                 return !rel.startsWith("..") && !path10.isAbsolute(rel);
               } catch {
@@ -20340,18 +21788,124 @@ function registerSessionRoutes(app, deps) {
           }
         }
       }
-      res.status(200).json(session);
+      res.status(200).json(session);
+    } catch (err) {
+      sendBridgeError2(res, err, {
+        route,
+        sessionId
+      });
+    } finally {
+      releaseRestoreOwner();
+    }
+  }, "restoreSessionHandler");
+  app.post("/session/:id/load", mutate(), restoreSessionHandler("load"));
+  app.post("/session/:id/resume", mutate(), restoreSessionHandler("resume"));
+  app.get("/session/:id/subagents/:toolCallId", async (req, res) => {
+    const route = "GET /session/:id/subagents/:toolCallId";
+    const sessionId = requireSessionId(req, res);
+    if (!sessionId) return;
+    if (!virtualSubagentSessions) {
+      res.status(404).json({
+        error: `No session with id "${sessionId}"`,
+        code: "session_not_found",
+        sessionId
+      });
+      return;
+    }
+    const toolCallId = req.params["toolCallId"];
+    if (!toolCallId || toolCallId.length > 500) {
+      res.status(400).json({
+        error: "`toolCallId` must be a non-empty tool call id",
+        code: "invalid_tool_call_id"
+      });
+      return;
+    }
+    const runtime = requireSessionRuntime({
+      sessionId,
+      route,
+      res,
+      workspaceRegistry,
+      daemonLog
+    });
+    if (!runtime) return;
+    try {
+      const resolved = await virtualSubagentSessions.resolve(
+        runtime,
+        sessionId,
+        toolCallId
+      );
+      if (!resolved) {
+        res.status(404).json({
+          error: "Subagent session not found",
+          code: "session_not_found",
+          sessionId,
+          toolCallId
+        });
+        return;
+      }
+      res.status(200).set("Cache-Control", "no-store").json(resolved);
     } catch (err) {
-      sendBridgeError2(res, err, {
+      sendBridgeError2(res, err, { route, sessionId });
+    }
+  });
+  app.post(
+    "/session/:id/subagents/:toolCallId/cancel",
+    mutate(),
+    async (req, res) => {
+      const route = "POST /session/:id/subagents/:toolCallId/cancel";
+      const sessionId = requireSessionId(req, res);
+      if (!sessionId) return;
+      if (!virtualSubagentSessions) {
+        res.status(404).json({
+          error: `No session with id "${sessionId}"`,
+          code: "session_not_found",
+          sessionId
+        });
+        return;
+      }
+      const toolCallId = req.params["toolCallId"];
+      if (!toolCallId || toolCallId.length > 500) {
+        res.status(400).json({
+          error: "`toolCallId` must be a non-empty tool call id",
+          code: "invalid_tool_call_id"
+        });
+        return;
+      }
+      const runtime = requireSessionRuntime({
+        sessionId,
         route,
-        sessionId
+        res,
+        workspaceRegistry,
+        daemonLog
       });
-    } finally {
-      releaseRestoreOwner();
+      if (!runtime) return;
+      try {
+        const resolved = await virtualSubagentSessions.resolve(
+          runtime,
+          sessionId,
+          toolCallId
+        );
+        if (!resolved) {
+          res.status(404).json({
+            error: "Subagent session not found",
+            code: "session_not_found",
+            sessionId,
+            toolCallId
+          });
+          return;
+        }
+        res.status(200).json(
+          await runtime.bridge.cancelSessionTask(
+            sessionId,
+            resolved.taskId,
+            "agent"
+          )
+        );
+      } catch (err) {
+        sendBridgeError2(res, err, { route, sessionId });
+      }
     }
-  }, "restoreSessionHandler");
-  app.post("/session/:id/load", mutate(), restoreSessionHandler("load"));
-  app.post("/session/:id/resume", mutate(), restoreSessionHandler("resume"));
+  );
   app.post(
     "/session/:id/branch",
     mutate(),
@@ -20651,6 +22205,28 @@ function registerSessionRoutes(app, deps) {
   });
   app.get(
     "/session/:id/context",
+    (req, res, next) => {
+      const sessionId = req.params["id"];
+      const key = sessionId ? parseVirtualSubagentSessionId(sessionId) : void 0;
+      if (!sessionId || !key) {
+        next();
+        return;
+      }
+      const runtime = requireSessionRuntime({
+        sessionId: key.parentSessionId,
+        route: "GET /session/:id/context",
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime) return;
+      res.status(200).json({
+        v: 1,
+        sessionId,
+        workspaceCwd: runtime.workspaceCwd,
+        state: {}
+      });
+    },
     withOwnerReadSession(
       "GET /session/:id/context",
       async (_req, res, sessionId, runtime) => {
@@ -20682,6 +22258,28 @@ function registerSessionRoutes(app, deps) {
   );
   app.get(
     "/session/:id/supported-commands",
+    (req, res, next) => {
+      const sessionId = req.params["id"];
+      const key = sessionId ? parseVirtualSubagentSessionId(sessionId) : void 0;
+      if (!sessionId || !key) {
+        next();
+        return;
+      }
+      const runtime = requireSessionRuntime({
+        sessionId: key.parentSessionId,
+        route: "GET /session/:id/supported-commands",
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime) return;
+      res.status(200).json({
+        v: 1,
+        sessionId,
+        availableCommands: [],
+        availableSkills: []
+      });
+    },
     withOwnerReadSession(
       "GET /session/:id/supported-commands",
       async (_req, res, sessionId, runtime) => {
@@ -20903,10 +22501,32 @@ function registerSessionRoutes(app, deps) {
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
+        let delivery;
+        if (body["delivery"] !== void 0) {
+          try {
+            delivery = parseChannelDelivery(body["delivery"]);
+          } catch (err) {
+            if (!isChannelDeliveryError(err)) throw err;
+            res.status(400).json({ error: err.message, code: err.code });
+            return;
+          }
+        }
         const promptId = crypto3.randomUUID();
+        if (delivery && deps.channelDeliveryAuthorizations) {
+          deps.channelDeliveryAuthorizations.authorizePrompt(
+            runtime.workspaceCwd,
+            {
+              sessionId,
+              deliveryId: promptId,
+              target: delivery.target
+            }
+          );
+        }
         const forwardedBody = { ...body };
         delete forwardedBody["deadlineMs"];
+        delete forwardedBody["delivery"];
         const lastEventId = ownerBridge.getSessionLastEventId(sessionId);
+        const eventEpoch = ownerBridge.getSessionEventEpoch(sessionId);
         addDaemonRequestAttribute("qwen-code.prompt_id", promptId);
         const abort = new AbortController();
         let responseFinished = false;
@@ -20936,10 +22556,21 @@ function registerSessionRoutes(app, deps) {
             {
               ...clientId !== void 0 ? { clientId } : {},
               promptId,
-              ...effectiveDeadlineMs !== void 0 ? { deadlineMs: effectiveDeadlineMs } : {}
+              ...effectiveDeadlineMs !== void 0 ? { deadlineMs: effectiveDeadlineMs } : {},
+              ...delivery !== void 0 ? {
+                channelDelivery: {
+                  deliveryId: promptId,
+                  target: delivery.target
+                }
+              } : {}
             }
           );
         } catch (err) {
+          deps.channelDeliveryAuthorizations?.revokePrompt(
+            runtime.workspaceCwd,
+            sessionId,
+            promptId
+          );
           res.off("close", onResClose);
           res.off("finish", onResFinish);
           if (daemonLog && err instanceof PromptQueueFullError) {
@@ -20984,12 +22615,23 @@ function registerSessionRoutes(app, deps) {
               );
             }
           }
-        ).catch(() => {
+        ).finally(() => {
+          if (delivery && deps.channelDeliveryAuthorizations) {
+            const revokeTimer = setTimeout(() => {
+              deps.channelDeliveryAuthorizations?.revokePrompt(
+                runtime.workspaceCwd,
+                sessionId,
+                promptId
+              );
+            }, CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS);
+            revokeTimer.unref();
+          }
+        }).catch(() => {
         });
         if (daemonLog) {
           daemonLog.info("prompt enqueued", { sessionId, promptId, clientId });
         }
-        res.status(202).json({ promptId, lastEventId });
+        res.status(202).json({ promptId, lastEventId, eventEpoch });
       }
     )
   );
@@ -21078,6 +22720,29 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/heartbeat",
     mutate(),
+    (req, res, next) => {
+      const sessionId = req.params["id"];
+      const key = sessionId ? parseVirtualSubagentSessionId(sessionId) : void 0;
+      if (!sessionId || !key) {
+        next();
+        return;
+      }
+      const runtime = requireSessionRuntime({
+        sessionId: key.parentSessionId,
+        route: "POST /session/:id/heartbeat",
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime) return;
+      const clientId = parseClientIdHeader(req, res);
+      if (clientId === null) return;
+      res.status(200).json({
+        sessionId,
+        ...clientId ? { clientId } : {},
+        lastSeenAt: Date.now()
+      });
+    },
     withOwnerMutableSession(
       "POST /session/:id/heartbeat",
       (req, res, sessionId, runtime) => {
@@ -21094,6 +22759,25 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/detach",
     mutate(),
+    (req, res, next) => {
+      const sessionId = req.params["id"];
+      const key = sessionId ? parseVirtualSubagentSessionId(sessionId) : void 0;
+      if (!sessionId || !key) {
+        next();
+        return;
+      }
+      const runtime = requireSessionRuntime({
+        sessionId: key.parentSessionId,
+        route: "POST /session/:id/detach",
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime) return;
+      const clientId = parseClientIdHeader(req, res);
+      if (clientId === null) return;
+      res.status(204).end();
+    },
     withOwnerMutableSession(
       "POST /session/:id/detach",
       async (req, res, sessionId, runtime) => {
@@ -21146,6 +22830,7 @@ function registerSessionRoutes(app, deps) {
           clientId !== void 0 ? { clientId } : void 0
         )
       );
+      clearBranchSessionEntry(sessionId);
       res.status(204).end();
     } catch (err) {
       sendBridgeError2(res, err, {
@@ -21172,6 +22857,9 @@ function registerSessionRoutes(app, deps) {
           );
         }, "onError")
       });
+      for (const removedId of result.removed) {
+        clearBranchSessionEntry(removedId);
+      }
       res.status(200).json(result);
     } catch (err) {
       sendBridgeError2(res, err, { route: "POST /sessions/delete" });
@@ -21246,6 +22934,9 @@ function registerSessionRoutes(app, deps) {
             );
           }, "onError")
         });
+        for (const removedId of result.removed) {
+          clearBranchSessionEntry(removedId);
+        }
         res.status(200).json(result);
       } catch (err) {
         sendBridgeError2(res, err, { route });
@@ -22176,7 +23867,8 @@ function toView(task) {
     sessionId: typeof task.sessionId === "string" && task.sessionId.length > 0 ? task.sessionId : null,
     // Absent runs (tool-created / never-fired) normalizes to [] so the client
     // never special-cases undefined.
-    runs: Array.isArray(task.runs) ? task.runs : []
+    runs: Array.isArray(task.runs) ? task.runs : [],
+    ...task.delivery !== void 0 ? { delivery: task.delivery } : {}
   };
 }
 __name(toView, "toView");
@@ -22209,7 +23901,13 @@ function canonicalCron(cron) {
 }
 __name(canonicalCron, "canonicalCron");
 function registerScheduledTaskCrudRoutes(app, deps) {
-  const { prefix, resolveTarget, mutate, safeBody: safeBody2 } = deps;
+  const {
+    prefix,
+    resolveTarget,
+    mutate,
+    safeBody: safeBody2,
+    channelDeliveryAuthorizations
+  } = deps;
   const base = `${prefix}/scheduled-tasks`;
   app.get(base, async (req, res) => {
     const target = resolveTarget(req, res);
@@ -22286,6 +23984,16 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       });
       return;
     }
+    let delivery;
+    if (body["delivery"] !== void 0) {
+      try {
+        delivery = parseChannelDelivery(body["delivery"]);
+      } catch (err) {
+        if (!isChannelDeliveryError(err)) throw err;
+        res.status(400).json({ error: err.message, code: err.code });
+        return;
+      }
+    }
     const removedField = findRemovedTaskField(body);
     if (removedField) {
       res.status(400).json(removedFieldError(removedField));
@@ -22342,6 +24050,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       // minute the task was created — same guard cronScheduler.create uses.
       lastFiredAt: now - now % 6e4,
       enabled,
+      ...delivery !== void 0 ? { delivery } : {},
       ...boundSessionId !== void 0 ? { sessionId: boundSessionId } : {},
       ...nameResult.value !== void 0 ? { name: nameResult.value } : {}
     };
@@ -22381,6 +24090,15 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       });
       return;
     }
+    if (task.delivery && task.sessionId) {
+      channelDeliveryAuthorizations?.registerScheduledTask(workspaceCwd, {
+        sessionId: task.sessionId,
+        taskId: task.id,
+        target: task.delivery.target,
+        recurring: task.recurring,
+        lastFiredAt: task.lastFiredAt ?? void 0
+      });
+    }
     res.status(201).json(toView(task));
   });
   app.patch(`${base}/:id`, mutate(), async (req, res) => {
@@ -22395,6 +24113,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     const body = safeBody2(req);
     const patch = {};
     let clearName = false;
+    let clearDelivery = false;
     const removedPatchField = findRemovedTaskField(body);
     if (removedPatchField) {
       res.status(400).json(removedFieldError(removedPatchField));
@@ -22459,7 +24178,20 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       }
       patch.enabled = body["enabled"];
     }
-    if (Object.keys(patch).length === 0 && !clearName) {
+    if ("delivery" in body) {
+      if (body["delivery"] === null) {
+        clearDelivery = true;
+      } else {
+        try {
+          patch.delivery = parseChannelDelivery(body["delivery"]);
+        } catch (err) {
+          if (!isChannelDeliveryError(err)) throw err;
+          res.status(400).json({ error: err.message, code: err.code });
+          return;
+        }
+      }
+    }
+    if (Object.keys(patch).length === 0 && !clearName && !clearDelivery) {
       res.status(400).json({
         error: "No updatable fields provided",
         code: "empty_patch"
@@ -22486,6 +24218,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         }
         const next = { ...current, ...patch };
         if (clearName) delete next.name;
+        if (clearDelivery) delete next.delivery;
         const justReEnabled = current.enabled === false && patch.enabled === true;
         const cronChanged = patch.cron !== void 0 && canonicalCron(patch.cron) !== canonicalCron(current.cron);
         const becameRecurring = patch.recurring === true && current.recurring !== true;
@@ -22540,6 +24273,22 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       } catch {
       }
     }
+    if (updated.delivery && updated.sessionId) {
+      channelDeliveryAuthorizations?.registerScheduledTask(workspaceCwd, {
+        sessionId: updated.sessionId,
+        taskId: updated.id,
+        target: updated.delivery.target,
+        recurring: updated.recurring,
+        lastFiredAt: updated.lastFiredAt ?? void 0
+      });
+    }
+    if (clearDelivery && updated.sessionId) {
+      channelDeliveryAuthorizations?.revokeScheduledTask(
+        workspaceCwd,
+        updated.sessionId,
+        updated.id
+      );
+    }
     res.status(200).json(toView(updated));
   });
   app.delete(`${base}/:id`, mutate(), async (req, res) => {
@@ -22582,6 +24331,13 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       await bridge.closeSession(boundSessionId).catch(() => {
       });
     }
+    if (boundSessionId) {
+      channelDeliveryAuthorizations?.revokeScheduledTask(
+        workspaceCwd,
+        boundSessionId,
+        id
+      );
+    }
     res.status(200).json({ deleted: true, id });
   });
   app.post(`${base}/:id/run`, mutate(), async (req, res) => {
@@ -22662,17 +24418,30 @@ function registerScheduledTaskCrudRoutes(app, deps) {
 }
 __name(registerScheduledTaskCrudRoutes, "registerScheduledTaskCrudRoutes");
 function registerScheduledTasksRoutes(app, deps) {
-  const { boundWorkspace, mutate, safeBody: safeBody2, bridge } = deps;
+  const {
+    boundWorkspace,
+    mutate,
+    safeBody: safeBody2,
+    bridge,
+    channelDeliveryAuthorizations
+  } = deps;
   registerScheduledTaskCrudRoutes(app, {
     prefix: "",
     resolveTarget: /* @__PURE__ */ __name(() => ({ workspaceCwd: boundWorkspace, bridge }), "resolveTarget"),
     mutate,
-    safeBody: safeBody2
+    safeBody: safeBody2,
+    channelDeliveryAuthorizations
   });
 }
 __name(registerScheduledTasksRoutes, "registerScheduledTasksRoutes");
 function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
-  const { workspaceRegistry, mutate, safeBody: safeBody2, manageScheduledTaskSessions } = deps;
+  const {
+    workspaceRegistry,
+    mutate,
+    safeBody: safeBody2,
+    manageScheduledTaskSessions,
+    channelDeliveryAuthorizations
+  } = deps;
   registerScheduledTaskCrudRoutes(app, {
     prefix: "/workspaces/:workspace",
     resolveTarget: /* @__PURE__ */ __name((req, res) => {
@@ -22691,7 +24460,8 @@ function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
       };
     }, "resolveTarget"),
     mutate,
-    safeBody: safeBody2
+    safeBody: safeBody2,
+    channelDeliveryAuthorizations
   });
 }
 __name(registerWorkspaceQualifiedScheduledTasksRoutes, "registerWorkspaceQualifiedScheduledTasksRoutes");
@@ -22721,6 +24491,77 @@ function parseNameField(raw) {
 }
 __name(parseNameField, "parseNameField");
 
+// packages/cli/src/serve/routes/channel-notify.ts
+init_esbuild_shims();
+import { randomUUID as randomUUID6 } from "node:crypto";
+function sendDeliveryError(res, error2) {
+  if (!isChannelDeliveryError(error2)) {
+    res.status(502).json({
+      error: "Channel delivery failed.",
+      code: "channel_delivery_failed"
+    });
+    return;
+  }
+  const status = error2.code === "channel_delivery_invalid" ? 400 : error2.code === "channel_delivery_timeout" ? 504 : error2.code === "channel_worker_unavailable" || error2.code === "channel_delivery_queue_full" ? 503 : 502;
+  res.status(status).json({ error: error2.message, code: error2.code });
+}
+__name(sendDeliveryError, "sendDeliveryError");
+function parseNotifyBody(body) {
+  if (!Object.keys(body).every((key) => key === "text" || key === "delivery")) {
+    throw new ChannelDeliveryError(
+      "channel_delivery_invalid",
+      "Invalid channel notification."
+    );
+  }
+  return normalizeChannelDelivery(
+    randomUUID6(),
+    parseChannelDelivery(body["delivery"]),
+    body["text"]
+  );
+}
+__name(parseNotifyBody, "parseNotifyBody");
+function registerChannelNotifyRoutes(app, deps) {
+  const deliver = /* @__PURE__ */ __name(async (workspaceCwd, req, res) => {
+    try {
+      if (!deps.deliverChannelMessage) {
+        throw new ChannelDeliveryError(
+          "channel_worker_unavailable",
+          "Channel worker is not running."
+        );
+      }
+      const request2 = parseNotifyBody(deps.safeBody(req));
+      await deps.deliverChannelMessage(workspaceCwd, request2);
+      res.status(200).json({ delivered: true, deliveryId: request2.deliveryId });
+    } catch (error2) {
+      sendDeliveryError(res, error2);
+    }
+  }, "deliver");
+  app.post(
+    "/workspace/notify",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      if (!requireTrustedWorkspaceRuntime(deps.workspaceRegistry.primary, res)) {
+        return;
+      }
+      await deliver(deps.boundWorkspace, req, res);
+    }
+  );
+  app.post(
+    "/workspaces/:workspace/notify",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      await deliver(runtime.workspaceCwd, req, res);
+    }
+  );
+}
+__name(registerChannelNotifyRoutes, "registerChannelNotifyRoutes");
+
 // packages/cli/src/serve/routes/goals.ts
 init_esbuild_shims();
 var PROBE_CONCURRENCY = 10;
@@ -22989,6 +24830,11 @@ function startScheduledTaskKeepalive(opts) {
       log.debug("keepalive: readCronTasks failed, skipping this pass", err);
       return;
     }
+    try {
+      opts.onTasksRead?.(tasks);
+    } catch (err) {
+      log.debug("keepalive: onTasksRead failed", err);
+    }
     for (const sessionId of collectBoundSessionIds(tasks)) {
       try {
         bridge.recordHeartbeat(sessionId);
@@ -23118,6 +24964,11 @@ async function rehydrateScheduledTaskSessions(deps) {
     log.debug("rehydrate: readCronTasks failed", err);
     return { loaded: [], failed: [] };
   }
+  try {
+    deps.onTasksRead?.(tasks);
+  } catch (err) {
+    log.debug("rehydrate: onTasksRead failed", err);
+  }
   const sessionIds = collectBoundSessionIds(tasks);
   const loaded = [];
   const failed = [];
@@ -23477,6 +25328,7 @@ function createServeFeatures(deps) {
     persistSettingAvailable,
     sessionArtifactsPersistenceAvailable,
     sessionGenerationAvailable,
+    workspaceGenerationAvailable,
     reloadAvailable,
     channelReloadAvailable,
     channelControlAvailable,
@@ -23513,6 +25365,7 @@ function createServeFeatures(deps) {
       sessionShellCommandEnabled,
       sessionArtifactsPersistenceAvailable,
       sessionGenerationAvailable: sessionGenerationAvailable(),
+      workspaceGenerationAvailable: workspaceGenerationAvailable(),
       rateLimit: opts.rateLimit === true,
       reloadAvailable,
       channelReloadAvailable: channelReloadAvailable(),
@@ -24858,16 +26711,19 @@ data: ${dataJson}
 __name(formatSseFrame, "formatSseFrame");
 function registerSseEventsRoutes(app, deps) {
   const { workspaceRegistry, daemonLog, sendBridgeError: sendBridgeError2, writerIdleTimeoutMs } = deps;
-  app.get("/session/:id/events", (req, res) => {
+  app.get("/session/:id/events", async (req, res) => {
     const sessionId = req.params["id"];
     const lastEventId = parseLastEventId(req.headers["last-event-id"]);
+    const eventEpoch = parseEventEpochHeader(req.headers["x-qwen-event-epoch"]);
     const maxQueued = parseMaxQueuedQuery(req.query["maxQueued"], res);
     if (maxQueued === null) return;
     let iter;
+    let busEpoch;
     const abort = new AbortController();
     try {
+      const virtualKey = parseVirtualSubagentSessionId(sessionId);
       const runtime = requireSessionRuntime({
-        sessionId,
+        sessionId: virtualKey?.parentSessionId ?? sessionId,
         route: "GET /session/:id/events",
         res,
         workspaceRegistry,
@@ -24875,13 +26731,33 @@ function registerSseEventsRoutes(app, deps) {
       });
       if (!runtime) return;
       const snapshot = req.query["snapshot"] === "1";
-      const iterable = runtime.bridge.subscribeEvents(sessionId, {
+      const iterable = virtualKey ? await deps.virtualSubagentSessions?.subscribe(runtime, sessionId, {
         signal: abort.signal,
         lastEventId,
+        ...maxQueued !== void 0 ? { maxQueued } : {}
+      }) : runtime.bridge.subscribeEvents(sessionId, {
+        signal: abort.signal,
+        lastEventId,
+        ...eventEpoch !== void 0 ? { epoch: eventEpoch } : {},
         ...maxQueued !== void 0 ? { maxQueued } : {},
         ...snapshot ? { snapshot: true } : {}
       });
+      if (!iterable) {
+        res.status(404).json({
+          error: "Subagent session not found",
+          code: "session_not_found",
+          sessionId
+        });
+        return;
+      }
       iter = iterable[Symbol.asyncIterator]();
+      if (!virtualKey) {
+        try {
+          busEpoch = runtime.bridge.getSessionEventEpoch(sessionId);
+        } catch {
+          busEpoch = void 0;
+        }
+      }
     } catch (err) {
       if (err instanceof SubscriberLimitExceededError) {
         writeStderrLine(
@@ -24921,6 +26797,9 @@ function registerSseEventsRoutes(app, deps) {
     res.setHeader("Cache-Control", "no-cache, no-transform");
     res.setHeader("Connection", "keep-alive");
     res.setHeader("X-Accel-Buffering", "no");
+    if (busEpoch !== void 0) {
+      res.setHeader("X-Qwen-Event-Epoch", busEpoch);
+    }
     res.flushHeaders();
     activeSseCount++;
     let sseCounted = true;
@@ -25046,7 +26925,7 @@ function registerSseEventsRoutes(app, deps) {
             const data = next.value.data;
             const gap = typeof data.earliestAvailableId === "number" && typeof data.lastDeliveredId === "number" ? data.earliestAvailableId - data.lastDeliveredId - 1 : void 0;
             writeStderrLine(
-              `qwen serve: SSE ring eviction detected (session ${sessionId}): lastEventId=${data.lastDeliveredId ?? "?"}, earliestInRing=${data.earliestAvailableId ?? "?"}, gap=${gap ?? "?"} events, reason=${data.reason ?? "?"}. Consumer must call loadSession to recover.`
+              `qwen serve: SSE ring eviction detected (session ${sessionId}): lastEventId=${data.lastDeliveredId ?? "?"}, earliestInRing=${data.earliestAvailableId ?? "?"}, gap=${gap ?? "?"} events, reason=${data.reason ?? "?"}` + (typeof data.detail === "string" ? `, detail=${data.detail}` : "") + `. Consumer must call loadSession to recover.`
             );
           }
           await writeWithBackpressure(formatSseFrame(next.value));
@@ -26034,7 +27913,7 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 
 // packages/cli/src/serve/routes/workspace-management.ts
 init_esbuild_shims();
-import { readdir, stat } from "node:fs/promises";
+import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
 import { realpathSync as realpathSync2 } from "node:fs";
 import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join8, resolve as resolve4, sep as sep3 } from "node:path";
 var MAX_PATH_SUGGESTIONS = 50;
@@ -26256,7 +28135,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
       const suggestions = [];
       let truncated = false;
       try {
-        const entries = await readdir(dir, { withFileTypes: true });
+        const entries = await readdir2(dir, { withFileTypes: true });
         entries.sort((a, b) => a.name.localeCompare(b.name));
         for (const entry of entries) {
           if (entry.name.startsWith(".") && !filter.startsWith(".")) continue;
@@ -26266,7 +28145,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
           let isDir = entry.isDirectory();
           if (!isDir && entry.isSymbolicLink()) {
             try {
-              isDir = (await stat(join8(dir, entry.name))).isDirectory();
+              isDir = (await stat2(join8(dir, entry.name))).isDirectory();
             } catch {
               continue;
             }
@@ -26386,7 +28265,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
         return;
       }
       try {
-        const s = await stat(canonical);
+        const s = await stat2(canonical);
         if (!s.isDirectory()) {
           res.status(400).json({
             error: "Path is not a directory",
@@ -27189,7 +29068,7 @@ __name(registerWorkspaceManagementRoutes, "registerWorkspaceManagementRoutes");
 
 // packages/cli/src/serve/routes/workspace-git.ts
 init_esbuild_shims();
-import * as fs4 from "node:fs";
+import * as fs5 from "node:fs";
 import * as path14 from "node:path";
 function registerWorkspaceGitRoutes(app, deps) {
   app.get("/workspace/git", async (_req, res) => {
@@ -27216,8 +29095,8 @@ function registerWorkspaceQualifiedGitRoutes(app, deps) {
     let gitCwd = runtime.workspaceCwd;
     if (typeof rawCwd === "string" && rawCwd.length > 0) {
       try {
-        const resolved = fs4.realpathSync(path14.resolve(rawCwd));
-        const root = fs4.realpathSync(runtime.workspaceCwd);
+        const resolved = fs5.realpathSync(path14.resolve(rawCwd));
+        const root = fs5.realpathSync(runtime.workspaceCwd);
         const rel = path14.relative(root, resolved);
         if (!rel.startsWith("..") && !path14.isAbsolute(rel)) {
           gitCwd = resolved;
@@ -27641,6 +29520,38 @@ var WorkspaceGitState = class {
 
 // packages/cli/src/serve/routes/workspace-mcp-control.ts
 init_esbuild_shims();
+function parseMcpReloadOptions(body, res) {
+  const forceReconnectAll = body["forceReconnectAll"];
+  if (forceReconnectAll !== void 0 && typeof forceReconnectAll !== "boolean") {
+    res.status(400).json({
+      error: "`forceReconnectAll` must be a boolean",
+      code: "invalid_force_reconnect_all_flag"
+    });
+    return null;
+  }
+  const forceReconnectWhich = body["forceReconnectWhich"];
+  if (forceReconnectWhich !== void 0 && (!Array.isArray(forceReconnectWhich) || forceReconnectWhich.some(
+    (serverName) => typeof serverName !== "string" || serverName.length === 0
+  ))) {
+    res.status(400).json({
+      error: "`forceReconnectWhich` must be an array of server names",
+      code: "invalid_force_reconnect_which"
+    });
+    return null;
+  }
+  if (forceReconnectAll === true && forceReconnectWhich !== void 0) {
+    res.status(400).json({
+      error: "`forceReconnectAll` and `forceReconnectWhich` cannot be used together",
+      code: "conflicting_force_reconnect_options"
+    });
+    return null;
+  }
+  return {
+    forceReconnectAll,
+    forceReconnectWhich
+  };
+}
+__name(parseMcpReloadOptions, "parseMcpReloadOptions");
 function registerWorkspaceMcpControlRoutes(app, deps) {
   const {
     boundWorkspace,
@@ -27667,9 +29578,11 @@ function registerWorkspaceMcpControlRoutes(app, deps) {
   app.post(
     "/workspace/mcp/reload",
     mutate({ strict: true }),
-    async (_req, res) => {
+    async (req, res) => {
+      const options = parseMcpReloadOptions(safeBody2(req), res);
+      if (!options) return;
       try {
-        const result = await bridge.reloadWorkspaceMcp();
+        const result = await bridge.reloadWorkspaceMcp(options);
         res.status(202).json(result);
       } catch (err) {
         sendBridgeError2(res, err, { route: "POST /workspace/mcp/reload" });
@@ -27874,9 +29787,11 @@ function registerWorkspaceQualifiedMcpControlRoutes(app, deps) {
         res
       );
       if (!runtime) return;
+      const options = parseMcpReloadOptions(deps.safeBody(req), res);
+      if (!options) return;
       const route = "POST /workspaces/:workspace/mcp/reload";
       try {
-        const result = await runtime.bridge.reloadWorkspaceMcp();
+        const result = await runtime.bridge.reloadWorkspaceMcp(options);
         res.status(202).json(result);
       } catch (err) {
         deps.sendBridgeError(res, err, { route });
@@ -29251,6 +31166,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
         (runtime) => runtime.bridge.generateSessionContent !== void 0
       );
     }, "sessionGenerationAvailable"),
+    workspaceGenerationAvailable: /* @__PURE__ */ __name(() => primaryBridge.generateWorkspaceContent !== void 0, "workspaceGenerationAvailable"),
     // Registry injection supplies the primary workspace service through the
     // runtime, so it has the same reload surface as legacy deps.workspace.
     reloadAvailable: deps.workspace !== void 0 || injectedWorkspaceRegistry !== void 0,
@@ -29544,6 +31460,13 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession,
     languageCodes
   });
+  registerChannelNotifyRoutes(app, {
+    boundWorkspace: primaryBoundWorkspace,
+    workspaceRegistry,
+    mutate,
+    safeBody,
+    deliverChannelMessage: deps.deliverChannelMessage
+  });
   registerWorkspaceStatusRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
@@ -29609,6 +31532,12 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     parseClientId: parseClientIdHeader,
     safeBody
   });
+  mountWorkspaceGenerationRoutes(app, {
+    bridge: primaryBridge,
+    mutate,
+    parseClientId: parseClientIdHeader,
+    safeBody
+  });
   mountWorkspaceQualifiedAgentsRoutes(app, {
     workspaceRegistry,
     mutate,
@@ -29785,6 +31714,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     allowPrivateAuthBaseUrl: opts.allowPrivateAuthBaseUrl === true,
     installAuthProvider: deps.installAuthProvider
   });
+  const virtualSubagentSessions = new VirtualSubagentSessions();
   registerSessionRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
@@ -29793,9 +31723,11 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     mutate,
     sendBridgeError: sendBridgeError2,
     daemonLog,
+    channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations,
     promptDeadlineMs: opts.promptDeadlineMs,
     sessionShellCommandEnabled,
-    languageCodes
+    languageCodes,
+    virtualSubagentSessions
   });
   registerWorkspaceMcpControlRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
@@ -29887,7 +31819,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     boundWorkspace: primaryBoundWorkspace,
     mutate,
     safeBody,
-    bridge: deps.manageScheduledTaskSessions ? bridge : void 0
+    bridge: deps.manageScheduledTaskSessions ? bridge : void 0,
+    channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations
   });
   registerGoalsRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
@@ -29897,16 +31830,32 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     workspaceRegistry,
     mutate,
     safeBody,
-    manageScheduledTaskSessions: deps.manageScheduledTaskSessions === true
+    manageScheduledTaskSessions: deps.manageScheduledTaskSessions === true,
+    channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations
   });
   registerUsageStatsRoutes(app);
   if (deps.manageScheduledTaskSessions) {
+    const registerScheduledTaskAuthorizations = /* @__PURE__ */ __name((workspaceCwd, tasks) => {
+      const authorizations = deps.channelDeliveryAuthorizations;
+      if (!authorizations) return;
+      for (const task of tasks) {
+        if (!task.delivery || !task.sessionId) continue;
+        authorizations.registerScheduledTask(workspaceCwd, {
+          sessionId: task.sessionId,
+          taskId: task.id,
+          target: task.delivery.target,
+          recurring: task.recurring,
+          ...typeof task.lastFiredAt === "number" ? { lastFiredAt: task.lastFiredAt } : {}
+        });
+      }
+    }, "registerScheduledTaskAuthorizations");
     const idleTimeoutMs = opts.sessionIdleTimeoutMs ?? DEFAULT_SESSION_IDLE_TIMEOUT_MS;
     const keepaliveIntervalMs = computeKeepaliveIntervalMs(idleTimeoutMs);
     const rehydrateWorkspace = /* @__PURE__ */ __name((taskBridge, workspaceCwd) => {
       void rehydrateScheduledTaskSessions({
         bridge: taskBridge,
         boundWorkspace: workspaceCwd,
+        onTasksRead: /* @__PURE__ */ __name((tasks) => registerScheduledTaskAuthorizations(workspaceCwd, tasks), "onTasksRead"),
         onError: /* @__PURE__ */ __name((sessionId, err) => {
           process.stderr.write(
             `qwen serve: failed to rehydrate scheduled-task session ${sessionId}: ${err instanceof Error ? err.message : String(err)}
@@ -29931,7 +31880,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       const keepalive = startScheduledTaskKeepalive({
         bridge: runtime.bridge,
         boundWorkspace: runtime.workspaceCwd,
-        intervalMs: keepaliveIntervalMs
+        intervalMs: keepaliveIntervalMs,
+        onTasksRead: /* @__PURE__ */ __name((tasks) => registerScheduledTaskAuthorizations(runtime.workspaceCwd, tasks), "onTasksRead")
       });
       rehydrateWorkspace(runtime.bridge, runtime.workspaceCwd);
       keepaliveStops.set(runtime.workspaceCwd, keepalive.stop);
@@ -29961,7 +31911,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     workspaceRegistry,
     daemonLog,
     writerIdleTimeoutMs: opts.writerIdleTimeoutMs,
-    sendBridgeError: sendBridgeError2
+    sendBridgeError: sendBridgeError2,
+    virtualSubagentSessions
   });
   acpHandleRef.current = mountAcpHttp(app, primaryBridge, {
     boundWorkspace: primaryBoundWorkspace,