@qwen-code/qwen-code 0.21.11-preview.0 → 0.21.12-preview.1

package/chunks/{server-FTSWAHXF.js → server-WQ2ID4U7.js}

@@ -1,11 +1,5 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  deriveWebSocketBase,
-  openQwenAsrRealtimeStream,
-  openVoiceStream,
-  openVoiceStreamWithRetry
-} from "./chunk-Q3JQ7OSU.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   LIVE_SESSION_SOURCE_PREFIX,
@@ -26,7 +20,14 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-VVSMEI6C.js";
+} from "./chunk-5AWARYOK.js";
+import {
+  deriveWebSocketBase,
+  openQwenAsrRealtimeStream,
+  openVoiceStream,
+  openVoiceStreamWithRetry
+} from "./chunk-3XZYK76R.js";
+import "./chunk-ZBBVBZBR.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -38,18 +39,17 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-5C7FDVHB.js";
+} from "./chunk-7L64FSYQ.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-OWMAZHIX.js";
-import "./chunk-2Z6PYTOK.js";
+} from "./chunk-47FQVRCO.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-4NFY2S7N.js";
+import "./chunk-GQW6P73F.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
-import "./chunk-EKTCKZV5.js";
 import "./chunk-3Z43GZUQ.js";
 import {
   CAPABILITIES_SCHEMA_VERSION,
@@ -107,7 +107,7 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-ZZCWJWTF.js";
+} from "./chunk-KNQZXSLW.js";
 import "./chunk-VGHZT6JR.js";
 import {
   isLoopbackBind,
@@ -115,6 +115,10 @@ import {
   parseCallerSuppliedSessionId
 } from "./chunk-TQOF5KBL.js";
 import "./chunk-HGCQ5SE7.js";
+import {
+  evaluateDaemonWorkspaceTrust,
+  readDaemonTrustPolicySnapshot
+} from "./chunk-XAAL4IFG.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -128,14 +132,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-UHJ5S7DF.js";
+} from "./chunk-MMH3GO4Z.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-BCZ2TTSH.js";
+} from "./chunk-LCWRQA5U.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -143,13 +147,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-F32C6V5B.js";
+} from "./chunk-FLUYVAQZ.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-UXV3DYVT.js";
-import "./chunk-AOHJKPKL.js";
+} from "./chunk-SZ36WFVK.js";
+import "./chunk-IQFYO5BF.js";
 import {
   createTotalSessionAdmissionController
 } from "./chunk-X2UOOG5V.js";
@@ -166,26 +170,39 @@ import {
 } from "./chunk-4JRM2BSM.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-7WUUNAJP.js";
+} from "./chunk-FMLUVVQ6.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-5BRSWOSC.js";
+} from "./chunk-WFBG4MF5.js";
 import "./chunk-NTTBXH7U.js";
-import "./chunk-B7SQOICP.js";
+import "./chunk-ZIS5I56G.js";
 import "./chunk-3SH53ANB.js";
+import {
+  SessionArtifactAuthorizationError,
+  SessionArtifactValidationError,
+  createAcpSessionBridge,
+  parseSessionSource
+} from "./chunk-VUTOKX6F.js";
+import {
+  EVENT_SCHEMA_VERSION,
+  EventBus,
+  SubscriberLimitExceededError
+} from "./chunk-MZSJ43WV.js";
+import "./chunk-XCGIMOLN.js";
+import "./chunk-OCPBI7J5.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-LU7RJB2W.js";
+} from "./chunk-A7M57KOL.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-I7XTOGIS.js";
+} from "./chunk-5DDUYIY6.js";
 import {
   snapshotProcessEnv
-} from "./chunk-MTE6R5HF.js";
+} from "./chunk-VESDV72K.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-6S4NCX23.js";
+} from "./chunk-JO45C3OY.js";
 import "./chunk-BGXZBI5B.js";
 import "./chunk-Z4X5MTRT.js";
 import {
@@ -201,52 +218,35 @@ import {
 import {
   require_express
 } from "./chunk-GDXET5XU.js";
-import {
-  evaluateDaemonWorkspaceTrust,
-  readDaemonTrustPolicySnapshot
-} from "./chunk-PFWPBYL2.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-PDUIXSYP.js";
-import "./chunk-TG3IUQ6M.js";
+} from "./chunk-3SIXC6QC.js";
+import "./chunk-C2VGLLNA.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-LHEC5V6G.js";
-import "./chunk-67EWJE77.js";
+} from "./chunk-YTYPRVIZ.js";
+import "./chunk-ENEEQMGM.js";
 import {
   supportedChannelCatalog
-} from "./chunk-E2FPSSKP.js";
+} from "./chunk-DEG7R6Z6.js";
+import "./chunk-V6WHFGST.js";
 import {
   LIVE_HOST_BUNDLE_ID,
   LIVE_HOST_PROTOCOL_VERSION,
   LIVE_INPUT_AUDIO_EPOCH_BYTES
 } from "./chunk-NKLP3DCK.js";
-import {
-  SessionArtifactAuthorizationError,
-  SessionArtifactValidationError,
-  createAcpSessionBridge,
-  parseSessionSource
-} from "./chunk-E2XBEWAK.js";
-import {
-  EVENT_SCHEMA_VERSION,
-  EventBus,
-  SubscriberLimitExceededError
-} from "./chunk-MZSJ43WV.js";
-import "./chunk-XCGIMOLN.js";
-import "./chunk-OCPBI7J5.js";
-import "./chunk-EV3LZGGK.js";
+import "./chunk-TKAEODJR.js";
 import {
   STATUS_SCHEMA_VERSION,
   SessionRestoreTimeoutError,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-DA4HRSBW.js";
+} from "./chunk-OPBATTFQ.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
-import "./chunk-V6WHFGST.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceDisplayNameValidationError,
@@ -254,11 +254,12 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-PWYEWOZM.js";
+} from "./chunk-CX2MARRJ.js";
 import {
+  DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   REQUESTED_SESSION_ID_META_KEY,
   gradeActiveWorkCoverage
-} from "./chunk-W5UC37EE.js";
+} from "./chunk-HHGQGTJQ.js";
 import {
   BranchWhilePromptActiveError,
   BridgeChannelQuarantinedError,
@@ -299,6 +300,10 @@ import {
   canonicalizeWorkspaces,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-6PLDPT2C.js";
+import {
+  CHANNEL_WORKER_PROMPT_AUTHORIZATION_META_KEY,
+  isChannelWorkerPromptAuthorized
+} from "./chunk-Z7B6SRPM.js";
 import {
   ChannelDeliveryError,
   MAX_CHANNEL_STARTUP_FAILURES,
@@ -311,7 +316,7 @@ import {
 } from "./chunk-YP5KH5Y7.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-PBRVUF5B.js";
+} from "./chunk-K7JW6V5O.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -320,11 +325,11 @@ import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import "./chunk-BKHCW2BI.js";
-import "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-DX3RGJMS.js";
-import "./chunk-UDXSXLER.js";
+} from "./chunk-LT532KF4.js";
+import "./chunk-IW6RQPQB.js";
+import "./chunk-5HBA2Z7V.js";
 import {
   getDialogSettingKeys,
   getModelProvidersOwnerScope,
@@ -334,26 +339,26 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-SVY7G3WS.js";
-import "./chunk-HGBUHVFO.js";
+} from "./chunk-3ZLUA4GV.js";
 import "./chunk-RKUWKYED.js";
+import "./chunk-G4C5RLX6.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import {
   detectSystemLanguage,
   resolveLanguageSetting
-} from "./chunk-KHLBIO6M.js";
+} from "./chunk-6LK2QPIA.js";
 import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-V3KCCRKA.js";
-import "./chunk-VFMASYQA.js";
-import "./chunk-RKCPPZV6.js";
+import "./chunk-7N6WK2W6.js";
+import "./chunk-MS7GNABG.js";
+import "./chunk-DGM2XA3R.js";
 import "./chunk-VJNBRRZG.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-P6RBCBBE.js";
+} from "./chunk-M2S67TPJ.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -433,20 +438,20 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-O3VWAZLP.js";
+} from "./chunk-INQN4KIA.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
-import "./chunk-H6XPXXMH.js";
+import "./chunk-CQ35AJ4Z.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-2UUMVNYT.js";
-import "./chunk-MVUQRLOH.js";
-import "./chunk-XCWO3SMQ.js";
-import "./chunk-7MH4J33A.js";
+} from "./chunk-QTI7SRXI.js";
+import "./chunk-KT4OWAAZ.js";
+import "./chunk-IX7CFQGA.js";
+import "./chunk-N7NBMAMW.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-TCRQD7F6.js";
+import "./chunk-U6LT3QBF.js";
 import {
   nextFireTime,
   parseCron
@@ -459,22 +464,22 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-GNPNYXJB.js";
-import "./chunk-HUWENAHO.js";
+} from "./chunk-XLQS3VI6.js";
+import "./chunk-NWPO6I7V.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-J6SZID63.js";
-import "./chunk-KRXPRVGL.js";
-import "./chunk-GM463R2B.js";
-import "./chunk-SEZ556DZ.js";
-import "./chunk-2FRY5CRX.js";
-import "./chunk-QUI267ZP.js";
 import {
   APPROVAL_MODES
-} from "./chunk-WAUGQKUU.js";
-import "./chunk-DZUO626D.js";
+} from "./chunk-6LYDH7VT.js";
+import "./chunk-2AZMF6G5.js";
+import "./chunk-KRXPRVGL.js";
+import "./chunk-GZGDJ4E6.js";
+import "./chunk-T6W4KACQ.js";
+import "./chunk-MWZYNOCG.js";
+import "./chunk-SAQHDAUJ.js";
+import "./chunk-6XZERB6P.js";
 import {
   addDaemonRequestAttribute,
   captureDaemonTelemetryContext,
@@ -486,20 +491,39 @@ import {
   recordDaemonHttpResponse,
   runWithDaemonTelemetryContext,
   withDaemonRequestSpan
-} from "./chunk-4TRQPFDP.js";
+} from "./chunk-O5AZPHYZ.js";
 import "./chunk-SAH4BD2J.js";
-import "./chunk-CPG6P4GG.js";
+import "./chunk-5PWLQ7SK.js";
+import "./chunk-EYS3GGM3.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-2J3OJGTL.js";
+import {
+  CursorNotAtLineBoundaryError,
+  LargeNonUtf8TextError,
+  TextScanBudgetExceededError,
+  decodeBufferWithEncodingInfoAsync,
+  getAllGeminiMdFilenames,
+  isUtf8CompatibleEncoding,
+  isWithinRoot,
+  parseLineTolerant,
+  read
+} from "./chunk-HB6QW4LM.js";
+import "./chunk-YRLW2MSX.js";
+import "./chunk-VGC4I5JJ.js";
+import "./chunk-732MOPEM.js";
+import "./chunk-CTQE2NB2.js";
+import "./chunk-NC4O6UE6.js";
+import "./chunk-IEP44U2R.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-IA7TGCN2.js";
+} from "./chunk-ZV4XVYL3.js";
 import "./chunk-K623ENWT.js";
 import {
   escapeXml
 } from "./chunk-AQ37AY7B.js";
-import "./chunk-EQL65XGA.js";
+import "./chunk-V3LXMASR.js";
+import "./chunk-XTH2OMDS.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -508,56 +532,38 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-3P2LV43B.js";
+} from "./chunk-TBVNYG5B.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-HV76SFIA.js";
-import "./chunk-4PYCZH2V.js";
+import "./chunk-5HBFERG5.js";
+import "./chunk-EYW54TBD.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-SR7RZ4MS.js";
-import "./chunk-M6HMMKVG.js";
+import "./chunk-O4BBDP2G.js";
+import "./chunk-KPVVWKF3.js";
+import "./chunk-LOJO2RPW.js";
+import "./chunk-F6WFNA7U.js";
+import "./chunk-F6AOBFUN.js";
 import "./chunk-KM73TBQ4.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-AXMWHKXA.js";
 import "./chunk-GLCZKT5V.js";
+import "./chunk-GJJQV4PY.js";
+import "./chunk-46UV252V.js";
+import "./chunk-FPGTNKCP.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-EI3HZX6C.js";
+import "./chunk-EFIMD5VA.js";
+import "./chunk-E5BWLU5J.js";
 import "./chunk-CR3C7WXL.js";
-import "./chunk-XWRJCPHC.js";
-import {
-  CursorNotAtLineBoundaryError,
-  LargeNonUtf8TextError,
-  TextScanBudgetExceededError,
-  decodeBufferWithEncodingInfoAsync,
-  getAllGeminiMdFilenames,
-  isUtf8CompatibleEncoding,
-  isWithinRoot,
-  parseLineTolerant,
-  read
-} from "./chunk-YGT2AUJ7.js";
-import "./chunk-WOJZWRAZ.js";
-import "./chunk-VGC4I5JJ.js";
-import "./chunk-FVKHVJZQ.js";
-import "./chunk-COBO5EBO.js";
-import "./chunk-6ZRFAKXK.js";
-import "./chunk-PYQADEFD.js";
-import "./chunk-3WOZVMGJ.js";
-import "./chunk-F6WFNA7U.js";
-import "./chunk-46UV252V.js";
-import "./chunk-ZBVS26BY.js";
-import "./chunk-KKBPOU75.js";
-import "./chunk-EUNWC2VS.js";
-import "./chunk-FOGU3LJX.js";
-import "./chunk-L2AFWWJE.js";
-import "./chunk-W4RQUHY3.js";
-import "./chunk-PDPFQ2FO.js";
+import "./chunk-HHJLM3WQ.js";
+import "./chunk-L2GTEEEU.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   getErrorMessage,
   runWithoutDebugLogSession
-} from "./chunk-OIVKILPI.js";
+} from "./chunk-MPBRV3UU.js";
 import "./chunk-VOQXFAY5.js";
+import "./chunk-XWRJCPHC.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -565,13 +571,13 @@ import {
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
+import "./chunk-AMDSOFFV.js";
 import {
   import_websocket,
   import_websocket_server,
   wrapper_default
-} from "./chunk-TYAMGABM.js";
+} from "./chunk-E3GLDLYB.js";
 import "./chunk-FCMNKVXT.js";
-import "./chunk-AMDSOFFV.js";
 import "./chunk-QUGAUQGJ.js";
 import {
   init_esbuild_shims
@@ -583,7 +589,7 @@ import {
 
 // packages/cli/src/serve/server.ts
 init_esbuild_shims();
-var import_express5 = __toESM(require_express(), 1);
+var import_express6 = __toESM(require_express(), 1);
 
 // packages/cli/src/serve/acp-http/index.ts
 init_esbuild_shims();
@@ -1001,6 +1007,7 @@ import * as path2 from "node:path";
 var MAX_READ_BYTES = 256 * 1024;
 var MAX_TEXT_SCAN_BYTES = 8 * 1024 * 1024;
 var MAX_WRITE_BYTES = 5 * 1024 * 1024;
+var MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 var BINARY_PROBE_BYTES = 4096;
 function shouldIgnore(absolute, boundWorkspace, ignore, kind = "file") {
   const rel = path2.relative(boundWorkspace, absolute);
@@ -1200,11 +1207,11 @@ function decodeTextCursor(cursor) {
   return { off, size, dev, ino };
 }
 __name(decodeTextCursor, "decodeTextCursor");
-function assertCursorMatchesFile(cursor, stats, path16) {
+function assertCursorMatchesFile(cursor, stats, path17) {
   if (String(stats.dev) !== cursor.dev || String(stats.ino) !== cursor.ino || stats.size < cursor.size) {
     throw new FsError(
       "hash_mismatch",
-      `cursor no longer matches the file it was issued for: ${path16}`,
+      `cursor no longer matches the file it was issued for: ${path17}`,
       { hint: "re-read the file from the beginning to get a fresh cursor" }
     );
   }
@@ -2088,6 +2095,41 @@ var WorkspaceFileSystemImpl = class {
       throw this.recordAndWrap(err, "edit", p);
     }
   }
+  async writeBytesAtomic(p, data) {
+    const start = performance.now();
+    try {
+      this.deps.generationGuard?.assertOpen();
+      assertTrustedForIntent(this.deps.trusted, "write");
+      enforceWriteSize(data.length, MAX_UPLOAD_BYTES);
+      const out = await this.deps.pathLocks.runExclusive(
+        p,
+        async () => {
+          await assertCreateTargetAbsent(p);
+          this.deps.generationGuard?.assertOpen();
+          const result = await atomicPublishResolvedFile({
+            target: p,
+            buf: data,
+            mode: "create",
+            assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
+          });
+          const verdict = this.ignoreVerdict(p, "file");
+          this.deps.audit.recordAccess(this.deps.ctx, {
+            intent: "write",
+            absolute: p,
+            durationMs: performance.now() - start,
+            sizeBytes: result.sizeBytes,
+            matchedIgnore: verdict.ignored ? verdict.category : void 0
+          });
+          return { sizeBytes: result.sizeBytes, hash: result.hash };
+        }
+      );
+      return out;
+    } catch (err) {
+      throw this.recordAndWrap(err, "write", p, {
+        audit: !(isFsError(err) && err.kind === "file_already_exists")
+      });
+    }
+  }
   /**
    * Coerce an arbitrary thrown value into an `FsError`, emit the
    * matching `fs.denied` audit event, and return the typed error
@@ -2101,11 +2143,14 @@ var WorkspaceFileSystemImpl = class {
    *   - routes can still rely on `instanceof FsError`
    *     for their `sendFsError` serializer.
    */
-  recordAndWrap(err, intent, input) {
+  recordAndWrap(err, intent, input, opts) {
     if (err instanceof Error && "code" in err && err.code === "workspace_generation_closed") {
       return err;
     }
     const fs8 = wrapAsFsError(err);
+    if (opts?.audit === false) {
+      return fs8;
+    }
     this.deps.audit.recordDenied(this.deps.ctx, {
       intent,
       input,
@@ -2557,6 +2602,22 @@ function mergeWriteMeta(existing, opts) {
 }
 __name(mergeWriteMeta, "mergeWriteMeta");
 async function atomicWriteTextResolvedFile(input) {
+  const buf = await encodeTextFileContentAsync(
+    input.target,
+    input.content,
+    buildWriteMeta(input.meta)
+  );
+  enforceWriteSize(buf.length);
+  return atomicPublishResolvedFile({
+    target: input.target,
+    buf,
+    mode: input.mode,
+    expectedHash: input.expectedHash,
+    assertGenerationOpen: input.assertGenerationOpen
+  });
+}
+__name(atomicWriteTextResolvedFile, "atomicWriteTextResolvedFile");
+async function atomicPublishResolvedFile(input) {
   const target = input.target;
   const parent = path4.dirname(target);
   const parentStat = await fsp2.lstat(parent);
@@ -2571,24 +2632,29 @@ async function atomicWriteTextResolvedFile(input) {
       `parent path is not a directory: ${parent}`
     );
   }
-  const tmpPath = path4.join(
-    parent,
-    `.${path4.basename(target)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`
-  );
+  const tmpSuffix = `.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  const tmpNameMaxBytes = 255;
+  const tmpBaseMaxBytes = tmpNameMaxBytes - 1 - Buffer.byteLength(tmpSuffix, "utf-8");
+  let tmpBase = path4.basename(target);
+  if (Buffer.byteLength(tmpBase, "utf-8") > tmpBaseMaxBytes) {
+    tmpBase = safeUtf8Truncate(
+      Buffer.from(tmpBase, "utf-8"),
+      tmpBaseMaxBytes
+    ).toString("utf-8");
+  }
+  const tmpPath = path4.join(parent, `.${tmpBase}${tmpSuffix}`);
   let tempLive = false;
   let tempHandle;
   let tempStat;
   try {
     tempHandle = await reserveTempFile(tmpPath);
     tempLive = true;
-    const encoded = await writeEncodedTextTemp({
-      targetPath: target,
+    const written = await writeBufferToTemp({
       tmpPath,
-      content: input.content,
-      meta: input.meta,
+      buf: input.buf,
       handle: tempHandle
     });
-    tempStat = encoded.stat;
+    tempStat = written.stat;
     const targetState = await assertAtomicTargetPrecondition({
       target,
       mode: input.mode,
@@ -2607,7 +2673,7 @@ async function atomicWriteTextResolvedFile(input) {
     }
     tempLive = false;
     await fsyncParentDirBestEffort(parent);
-    return encoded;
+    return written;
   } catch (err) {
     await tempHandle?.close().catch(() => void 0);
     if (tempLive) {
@@ -2619,19 +2685,13 @@ async function atomicWriteTextResolvedFile(input) {
     throw err;
   }
 }
-__name(atomicWriteTextResolvedFile, "atomicWriteTextResolvedFile");
+__name(atomicPublishResolvedFile, "atomicPublishResolvedFile");
 async function reserveTempFile(tmpPath) {
   return fsp2.open(tmpPath, "wx", 384);
 }
 __name(reserveTempFile, "reserveTempFile");
-async function writeEncodedTextTemp(input) {
-  const buf = await encodeTextFileContentAsync(
-    input.targetPath,
-    input.content,
-    buildWriteMeta(input.meta)
-  );
-  enforceWriteSize(buf.length);
-  await input.handle.writeFile(buf);
+async function writeBufferToTemp(input) {
+  await input.handle.writeFile(input.buf);
   await syncHandleBestEffort(input.handle);
   const st = await fsp2.lstat(input.tmpPath);
   const opened = await input.handle.stat();
@@ -2649,9 +2709,9 @@ async function writeEncodedTextTemp(input) {
       `temporary path is not a regular file: ${input.tmpPath}`
     );
   }
-  return { sizeBytes: buf.length, hash: hashBuffer(buf), stat: st };
+  return { sizeBytes: input.buf.length, hash: hashBuffer(input.buf), stat: st };
 }
-__name(writeEncodedTextTemp, "writeEncodedTextTemp");
+__name(writeBufferToTemp, "writeBufferToTemp");
 async function assertCreateTargetAbsent(target) {
   try {
     const st = await fsp2.lstat(target);
@@ -9839,20 +9899,31 @@ var AcpDispatcher = class {
           if ("error" in parsedSource) {
             throw new AcpParamError(parsedSource.error);
           }
-          const result = await listWorkspaceSessionsForResponse(
-            this.bridge,
-            workspaceCwd,
-            {
-              cursor,
-              size: metaSize,
-              archiveState,
-              view,
-              group,
-              parentSessionId,
-              ...parsedSource
-            },
-            { runtimeBaseDir: this.sessionRuntimeBaseDir }
-          );
+          let result;
+          try {
+            conn.abortSignal.throwIfAborted();
+            result = await listWorkspaceSessionsForResponse(
+              this.bridge,
+              workspaceCwd,
+              {
+                cursor,
+                size: metaSize,
+                archiveState,
+                view,
+                group,
+                parentSessionId,
+                ...parsedSource
+              },
+              {
+                runtimeBaseDir: this.sessionRuntimeBaseDir,
+                signal: conn.abortSignal
+              }
+            );
+            conn.abortSignal.throwIfAborted();
+          } catch (error2) {
+            if (conn.abortSignal.aborted) return;
+            throw error2;
+          }
           this.replyConn(conn, id, {
             sessions: result.sessions.map((s) => ({
               sessionId: s.sessionId,
@@ -14570,7 +14641,7 @@ function mountAcpHttp(app, bridge, opts) {
   const archiveCoordinator = opts.archiveCoordinator ?? new SessionArchiveCoordinator();
   const requestedSessionIdAdmission = opts.requestedSessionIdAdmission;
   const getPrimaryEnv = /* @__PURE__ */ __name(() => opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv, "getPrimaryEnv");
-  const path16 = opts.path ?? "/acp";
+  const path17 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
   const rejectIfDisposed = /* @__PURE__ */ __name((res) => {
@@ -14754,7 +14825,7 @@ function mountAcpHttp(app, bridge, opts) {
   const primaryMount = {
     primary: true,
     workspaceCwd: opts.boundWorkspace,
-    routeLabel: logSafe(path16),
+    routeLabel: logSafe(path17),
     rateLimitScope: opts.workspaceRegistry?.primary.workspaceId ?? "primary",
     registry,
     dispatcher,
@@ -14908,7 +14979,7 @@ function mountAcpHttp(app, bridge, opts) {
     });
   }, "handleAcpPost");
   app.post(
-    path16,
+    path17,
     (req, res) => handleAcpPost(primaryMount, req, res)
   );
   const handleAcpGet = /* @__PURE__ */ __name((mount, req, res) => {
@@ -15007,10 +15078,10 @@ function mountAcpHttp(app, bridge, opts) {
       onPumpSettled();
     });
   }, "handleAcpGet");
-  app.get(path16, (req, res) => {
+  app.get(path17, (req, res) => {
     handleAcpGet(primaryMount, req, res);
   });
-  app.delete(path16, (req, res) => {
+  app.delete(path17, (req, res) => {
     handleAcpDelete(primaryMount, req, res);
   });
   const createSecondaryAcpMount = /* @__PURE__ */ __name((rt) => {
@@ -15219,7 +15290,7 @@ function mountAcpHttp(app, bridge, opts) {
       const isPluralAcpShape = pluralRawSelector !== null;
       const pluralVoiceRawSelector = opts.workspaceVoiceConnection ? pluralWorkspaceRawSelector(rawPath, PLURAL_VOICE_WS_SUFFIX) : null;
       const isPluralVoiceShape = pluralVoiceRawSelector !== null;
-      if (rawPath !== path16 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
+      if (rawPath !== path17 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
         logReject(`unknown-path ${logSafe(rawPath)}`);
         socket.destroy();
         return;
@@ -15757,7 +15828,7 @@ function mountAcpHttp(app, bridge, opts) {
       });
     }, "upgradeListener");
     httpServer.on("upgrade", upgradeListener);
-    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path16}`);
+    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path17}`);
   }
   __name(setupWebSocket, "setupWebSocket");
   return {
@@ -19657,6 +19728,8 @@ __name(registerWorkspaceExtensionRoutes, "registerWorkspaceExtensionRoutes");
 
 // packages/cli/src/serve/routes/workspace-file-write.ts
 init_esbuild_shims();
+var import_express3 = __toESM(require_express(), 1);
+import * as path10 from "node:path";
 function getFsFactory3(req, res) {
   const context = getWorkspaceRouteContext(req);
   if (context) return context.runtime.routeFileSystemFactory;
@@ -19934,6 +20007,351 @@ function registerWorkspaceQualifiedFileWriteRoutes(app, deps) {
   );
 }
 __name(registerWorkspaceQualifiedFileWriteRoutes, "registerWorkspaceQualifiedFileWriteRoutes");
+var MAX_CONCURRENT_UPLOADS = 4;
+var MAX_UPLOAD_FILENAME_BYTES = 255;
+var NUMBERED_CANDIDATE_CAP = 1e3;
+var uploadGateLeases = /* @__PURE__ */ new WeakMap();
+function createUploadConcurrencyGate(max = MAX_CONCURRENT_UPLOADS) {
+  let active = 0;
+  return {
+    tryAcquire() {
+      if (active >= max) return false;
+      active += 1;
+      return true;
+    },
+    release() {
+      if (active > 0) active -= 1;
+    }
+  };
+}
+__name(createUploadConcurrencyGate, "createUploadConcurrencyGate");
+var uploadAdmissions = /* @__PURE__ */ new WeakMap();
+function splitStemExtension(basename7) {
+  const lastDot = basename7.lastIndexOf(".");
+  if (lastDot <= 0) return { stem: basename7, ext: "" };
+  return { stem: basename7.slice(0, lastDot), ext: basename7.slice(lastDot) };
+}
+__name(splitStemExtension, "splitStemExtension");
+function fitFilenameToByteCap(stem, suffix, ext, capBytes) {
+  if (Buffer.byteLength(suffix + ext, "utf-8") > capBytes) return null;
+  let chars = Array.from(stem);
+  while (Buffer.byteLength(chars.join("") + suffix + ext, "utf-8") > capBytes) {
+    if (chars.length === 0) return null;
+    chars = chars.slice(0, -1);
+  }
+  return chars.join("") + suffix + ext;
+}
+__name(fitFilenameToByteCap, "fitFilenameToByteCap");
+function sendUploadTooLarge(res) {
+  applyReadHeaders(res);
+  res.status(413).json({
+    errorKind: "file_too_large",
+    error: `Request body too large (max ${MAX_UPLOAD_BYTES / (1024 * 1024)} MiB)`,
+    status: 413,
+    maxBytes: MAX_UPLOAD_BYTES
+  });
+}
+__name(sendUploadTooLarge, "sendUploadTooLarge");
+function fileUploadConcurrencyGate(gate) {
+  return (req, res, next) => {
+    if (!gate.tryAcquire()) {
+      applyReadHeaders(res);
+      res.status(429).set("Retry-After", "1").json({
+        errorKind: "upload_busy",
+        error: "Too many uploads in progress",
+        status: 429,
+        retryAfterSeconds: 1
+      });
+      return;
+    }
+    let released = false;
+    const release = /* @__PURE__ */ __name(() => {
+      if (released) return;
+      released = true;
+      gate.release();
+      res.off("finish", releaseBeforeHandler);
+      res.off("close", releaseBeforeHandler);
+      uploadGateLeases.delete(req);
+    }, "release");
+    const releaseBeforeHandler = /* @__PURE__ */ __name(() => {
+      if (!lease.handlerStarted) release();
+    }, "releaseBeforeHandler");
+    const lease = { handlerStarted: false, release };
+    uploadGateLeases.set(req, lease);
+    res.once("finish", releaseBeforeHandler);
+    res.once("close", releaseBeforeHandler);
+    next();
+  };
+}
+__name(fileUploadConcurrencyGate, "fileUploadConcurrencyGate");
+function fileUploadBodyParser() {
+  const raw = import_express3.default.raw({
+    type: "application/octet-stream",
+    limit: MAX_UPLOAD_BYTES,
+    // The endpoint contract is raw octets: decoding a Content-Encoding would
+    // publish bytes the client never sent (and hash/size of the decoded form).
+    inflate: false
+  });
+  return (req, res, next) => {
+    raw(req, res, (err) => {
+      if (err) {
+        const status = err.status;
+        if (status === 413) {
+          sendUploadTooLarge(res);
+          return;
+        }
+        if (status === 415) {
+          applyReadHeaders(res);
+          res.status(415).json({
+            errorKind: "unsupported_media_type",
+            error: "File uploads do not support encoded request bodies",
+            status: 415
+          });
+          return;
+        }
+        if (err.code === "ECONNABORTED" || req.aborted) {
+          return;
+        }
+        next(err);
+        return;
+      }
+      next();
+    });
+  };
+}
+__name(fileUploadBodyParser, "fileUploadBodyParser");
+function fileUploadAdmission(deps, opts) {
+  return (req, res, next) => {
+    void (async () => {
+      const ROUTE2 = opts.qualified ? "POST /workspaces/:workspace/file/upload" : "POST /file/upload";
+      try {
+        if (opts.qualified) {
+          const registry = deps.workspaceRegistry;
+          if (!registry) {
+            throw new Error("workspace registry is not configured");
+          }
+          const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
+          if (!runtime) return;
+          if (!requireTrustedWorkspaceRuntime(runtime, res)) return;
+          setWorkspaceRouteContext(req, {
+            runtime,
+            routePrefix: "POST /workspaces/:workspace"
+          });
+        } else if (opts.isWorkspaceTrusted?.() === false) {
+          applyReadHeaders(res);
+          res.status(403).json({
+            errorKind: "untrusted_workspace",
+            error: "workspace is not trusted; write operations are forbidden",
+            status: 403
+          });
+          return;
+        }
+        const contentType = (req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+        if (contentType !== "application/octet-stream") {
+          applyReadHeaders(res);
+          res.status(415).json({
+            errorKind: "unsupported_media_type",
+            error: "File uploads require application/octet-stream",
+            status: 415
+          });
+          return;
+        }
+        const queryPath = req.query["path"];
+        if (typeof queryPath !== "string" || queryPath.length === 0) {
+          sendParseError(res, ROUTE2, "`path` query parameter is required");
+          return;
+        }
+        const dir = path10.dirname(queryPath);
+        const basename7 = path10.basename(queryPath);
+        if (queryPath.endsWith("/") || basename7.length === 0 || basename7 === "." || basename7 === "..") {
+          sendParseError(res, ROUTE2, "`path` must name a file");
+          return;
+        }
+        if (queryPath.includes("\0")) {
+          sendParseError(res, ROUTE2, "path must not contain null bytes");
+          return;
+        }
+        if (hasSuspiciousPathPattern(basename7)) {
+          sendParseError(res, ROUTE2, "filename contains a suspicious pattern");
+          return;
+        }
+        if (Buffer.byteLength(basename7, "utf-8") > MAX_UPLOAD_FILENAME_BYTES) {
+          sendParseError(
+            res,
+            ROUTE2,
+            `filename exceeds ${MAX_UPLOAD_FILENAME_BYTES} bytes`
+          );
+          return;
+        }
+        const contentLength = req.headers["content-length"];
+        if (contentLength !== void 0) {
+          const declared = Number(contentLength);
+          if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) {
+            sendUploadTooLarge(res);
+            return;
+          }
+        }
+        const clientId = deps.parseClientId(req, res);
+        if (clientId === null) return;
+        const originatorClientId = resolveOriginatorClientId2(
+          clientId,
+          deps,
+          res,
+          req
+        );
+        if (originatorClientId === null) return;
+        const factory = getFsFactory3(req, res);
+        if (!factory) return;
+        const fs8 = factory.forRequest({
+          originatorClientId,
+          route: ROUTE2
+        });
+        const resolvedDir = await fs8.resolve(dir, "write");
+        let dirStat;
+        try {
+          dirStat = await fs8.stat(resolvedDir);
+        } catch (err) {
+          if (isFsError(err) && err.kind === "path_not_found") {
+            sendParseError(res, ROUTE2, "parent directory does not exist");
+            return;
+          }
+          throw err;
+        }
+        if (dirStat.kind !== "directory") {
+          sendParseError(res, ROUTE2, "parent path is not a directory");
+          return;
+        }
+        uploadAdmissions.set(req, {
+          route: ROUTE2,
+          fs: fs8,
+          basename: basename7,
+          resolvedDir,
+          queryDir: dir
+        });
+        next();
+      } catch (err) {
+        sendFsError(
+          res,
+          err,
+          opts.qualified ? "POST /workspaces/:workspace/file/upload" : "POST /file/upload"
+        );
+      }
+    })();
+  };
+}
+__name(fileUploadAdmission, "fileUploadAdmission");
+async function handlePostFileUpload(req, res) {
+  const admission = uploadAdmissions.get(req);
+  if (!admission) {
+    applyReadHeaders(res);
+    res.status(500).json({
+      errorKind: "internal_error",
+      error: "upload admission context is missing",
+      status: 500
+    });
+    return;
+  }
+  const { route, fs: fs8, basename: basename7, resolvedDir, queryDir } = admission;
+  const { stem, ext } = splitStemExtension(basename7);
+  const lease = uploadGateLeases.get(req);
+  if (lease) lease.handlerStarted = true;
+  try {
+    if (req.aborted || res.closed) return;
+    const body = req.body;
+    const data = body === void 0 || body === null ? Buffer.alloc(0) : body;
+    for (let n = 0; n < NUMBERED_CANDIDATE_CAP; n++) {
+      const candidateBasename = n === 0 ? basename7 : fitFilenameToByteCap(
+        stem,
+        ` (${n})`,
+        ext,
+        MAX_UPLOAD_FILENAME_BYTES
+      );
+      if (candidateBasename === null) {
+        sendParseError(
+          res,
+          route,
+          `filename cannot fit within ${MAX_UPLOAD_FILENAME_BYTES} bytes`
+        );
+        return;
+      }
+      const candidateAbs = path10.join(resolvedDir, candidateBasename);
+      let resolved;
+      try {
+        resolved = await fs8.resolve(
+          path10.join(queryDir, candidateBasename),
+          "write"
+        );
+      } catch (err) {
+        if (isFsError(err) && err.kind === "symlink_escape" && err.cause?.code === "ELOOP") {
+          continue;
+        }
+        sendFsError(res, err, route);
+        return;
+      }
+      if (resolved !== candidateAbs) {
+        continue;
+      }
+      try {
+        const out = await fs8.writeBytesAtomic(resolved, data);
+        applyReadHeaders(res);
+        res.status(201).json({
+          kind: "file_upload",
+          path: workspaceRelative(req, resolved),
+          sizeBytes: out.sizeBytes,
+          hash: out.hash
+        });
+        return;
+      } catch (err) {
+        if (isFsError(err) && err.kind === "file_already_exists") {
+          continue;
+        }
+        sendFsError(res, err, route);
+        return;
+      }
+    }
+    applyReadHeaders(res);
+    res.status(409).json({
+      errorKind: "file_already_exists",
+      error: `could not allocate a free filename for "${basename7}"`,
+      status: 409
+    });
+  } catch (err) {
+    sendFsError(res, err, route);
+  } finally {
+    uploadAdmissions.delete(req);
+    lease?.release();
+  }
+}
+__name(handlePostFileUpload, "handlePostFileUpload");
+function registerWorkspaceFileUploadRoutes(app, deps) {
+  app.post(
+    "/file/upload",
+    deps.mutate({ strict: true }),
+    fileUploadAdmission(deps, {
+      qualified: false,
+      isWorkspaceTrusted: deps.isWorkspaceTrusted
+    }),
+    fileUploadConcurrencyGate(deps.uploadGate),
+    fileUploadBodyParser(),
+    (req, res) => {
+      void handlePostFileUpload(req, res);
+    }
+  );
+}
+__name(registerWorkspaceFileUploadRoutes, "registerWorkspaceFileUploadRoutes");
+function registerWorkspaceQualifiedFileUploadRoutes(app, deps) {
+  app.post(
+    "/workspaces/:workspace/file/upload",
+    deps.mutate({ strict: true }),
+    fileUploadAdmission(deps, { qualified: true }),
+    fileUploadConcurrencyGate(deps.uploadGate),
+    fileUploadBodyParser(),
+    (req, res) => {
+      void handlePostFileUpload(req, res);
+    }
+  );
+}
+__name(registerWorkspaceQualifiedFileUploadRoutes, "registerWorkspaceQualifiedFileUploadRoutes");
 
 // packages/cli/src/serve/routes/workspace-trust.ts
 init_esbuild_shims();
@@ -20288,15 +20706,15 @@ var legacySessionTelemetryRoutes = [
   },
   {
     method: "GET",
-    path: "/session/:id/subagents/:toolCallId",
+    path: "/session/:id/subagents/:subagentRef",
     attribution: "handler_resolved",
-    route: "GET /session/:id/subagents/:toolCallId"
+    route: "GET /session/:id/subagents/:subagentRef"
   },
   {
     method: "POST",
-    path: "/session/:id/subagents/:toolCallId/cancel",
+    path: "/session/:id/subagents/:subagentRef/cancel",
     attribution: "handler_resolved",
-    route: "POST /session/:id/subagents/:toolCallId/cancel"
+    route: "POST /session/:id/subagents/:subagentRef/cancel"
   },
   {
     method: "GET",
@@ -20418,6 +20836,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/model"
   },
+  {
+    method: "POST",
+    path: "/session/:id/config-option",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/config-option"
+  },
   {
     method: "POST",
     path: "/session/:id/recap",
@@ -20525,8 +20949,8 @@ function decodePathSegment(value) {
 }
 __name(decodePathSegment, "decodePathSegment");
 function matchLegacySessionTelemetryRoute(method, requestPath) {
-  const path16 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
-  const requestSegments = path16.split("/").slice(1);
+  const path17 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
+  const requestSegments = path17.split("/").slice(1);
   const prefix = requestSegments[0]?.toLowerCase();
   if (prefix !== "session" && prefix !== "sessions" && prefix !== "permission") {
     return void 0;
@@ -20578,23 +21002,23 @@ __name(setDaemonTelemetryWorkspace, "setDaemonTelemetryWorkspace");
 function resolveDaemonTelemetryRoute(req) {
   const legacyRoute = matchLegacySessionTelemetryRoute(req.method, req.path);
   if (legacyRoute) return legacyRoute;
-  const path16 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "GET" && path16 === "/daemon/status") {
+  const path17 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "GET" && path17 === "/daemon/status") {
     return { route: "GET /daemon/status" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path16)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path17)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path16)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path17)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path16)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path17)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path16)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path17)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  const workspaceTranscript = path16.match(
+  const workspaceTranscript = path17.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
   );
   if (workspaceTranscript?.[1] && req.method === "GET") {
@@ -20603,7 +21027,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceTranscript[1])
     };
   }
-  const workspaceExport = path16.match(
+  const workspaceExport = path17.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
   );
   if (workspaceExport?.[1] && req.method === "GET") {
@@ -20612,7 +21036,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceExport[1])
     };
   }
-  const workspaceArchivedExport = path16.match(
+  const workspaceArchivedExport = path17.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
   );
   if (workspaceArchivedExport?.[1] && req.method === "GET") {
@@ -20622,8 +21046,8 @@ function resolveDaemonTelemetryRoute(req) {
     };
   }
   const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
-  if (pluralWorkspacePrefix.test(path16)) {
-    const suffix = path16.replace(pluralWorkspacePrefix, "/workspace");
+  if (pluralWorkspacePrefix.test(path17)) {
+    const suffix = path17.replace(pluralWorkspacePrefix, "/workspace");
     if (req.method === "GET") {
       if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
         return { route: `GET ${suffix}` };
@@ -20646,7 +21070,7 @@ function resolveDaemonTelemetryRoute(req) {
       }
     }
     if (req.method === "POST") {
-      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
+      if (suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/voice/transcribe" || suffix === "/workspace/permissions" || suffix === "/workspace/trust/request" || suffix === "/workspace/init" || suffix === "/workspace/reload" || suffix === "/workspace/file/write" || suffix === "/workspace/file/edit" || suffix === "/workspace/file/upload" || suffix === "/workspace/mcp/servers" || suffix === "/workspace/memory" || suffix === "/workspace/agents" || suffix === "/workspace/sessions/delete" || suffix === "/workspace/sessions/archive" || suffix === "/workspace/sessions/unarchive" || suffix === "/workspace/session-groups") {
         return { route: `POST ${suffix}` };
       }
       if (/^\/workspace\/tools\/[^/]+\/enable$/.test(suffix)) {
@@ -20682,58 +21106,58 @@ function resolveDaemonTelemetryRoute(req) {
       return { route: "DELETE /workspace/session-groups/:groupId" };
     }
   }
-  if (req.method === "POST" && path16 === "/workspace/init") {
+  if (req.method === "POST" && path17 === "/workspace/init") {
     return { route: "POST /workspace/init" };
   }
-  if (req.method === "POST" && path16 === "/workspace/setup-github") {
+  if (req.method === "POST" && path17 === "/workspace/setup-github") {
     return { route: "POST /workspace/setup-github" };
   }
-  if (req.method === "POST" && path16 === "/workspace/reload") {
+  if (req.method === "POST" && path17 === "/workspace/reload") {
     return { route: "POST /workspace/reload" };
   }
-  const mcpRestart = path16.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  const mcpRestart = path17.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
   if (mcpRestart?.[1] && req.method === "POST") {
     return { route: "POST /workspace/mcp/:server/restart" };
   }
-  if (req.method === "POST" && path16 === "/workspace/mcp/servers") {
+  if (req.method === "POST" && path17 === "/workspace/mcp/servers") {
     return { route: "POST /workspace/mcp/servers" };
   }
-  const mcpDelete = path16.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  const mcpDelete = path17.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
   if (mcpDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/mcp/servers/:name" };
   }
-  if (req.method === "POST" && path16 === "/workspace/auth/device-flow") {
+  if (req.method === "POST" && path17 === "/workspace/auth/device-flow") {
     return { route: "POST /workspace/auth/device-flow" };
   }
-  const deviceFlowDelete = path16.match(
+  const deviceFlowDelete = path17.match(
     /^\/workspace\/auth\/device-flow\/([^/]+)$/
   );
   if (deviceFlowDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/auth/device-flow/:id" };
   }
-  const toolEnable = path16.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  const toolEnable = path17.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
   if (toolEnable?.[1] && req.method === "POST") {
     return { route: "POST /workspace/tools/:name/enable" };
   }
-  if (path16 === "/workspace/settings") {
+  if (path17 === "/workspace/settings") {
     if (req.method === "GET") return { route: "GET /workspace/settings" };
     if (req.method === "POST") return { route: "POST /workspace/settings" };
   }
-  if (path16 === "/workspace/permissions") {
+  if (path17 === "/workspace/permissions") {
     if (req.method === "GET") return { route: "GET /workspace/permissions" };
     if (req.method === "POST") return { route: "POST /workspace/permissions" };
   }
-  if (path16 === "/workspace/trust") {
+  if (path17 === "/workspace/trust") {
     if (req.method === "GET") return { route: "GET /workspace/trust" };
   }
-  if (req.method === "POST" && path16 === "/workspace/trust/request") {
+  if (req.method === "POST" && path17 === "/workspace/trust/request") {
     return { route: "POST /workspace/trust/request" };
   }
-  if (path16 === "/workspace/voice") {
+  if (path17 === "/workspace/voice") {
     if (req.method === "GET") return { route: "GET /workspace/voice" };
     if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  if (req.method === "POST" && path16 === "/workspace/voice/transcribe") {
+  if (req.method === "POST" && path17 === "/workspace/voice/transcribe") {
     return { route: "POST /workspace/voice/transcribe" };
   }
   return void 0;
@@ -21002,7 +21426,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 init_esbuild_shims();
 import * as crypto3 from "node:crypto";
 import * as fs6 from "node:fs";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
 init_esbuild_shims();
@@ -21022,7 +21446,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/server/persisted-session-list-cache.ts
 init_esbuild_shims();
-import path10 from "node:path";
+import path11 from "node:path";
 var PersistedSessionListCache = class {
   constructor(ttlMs, maxRetainedSummaries) {
     this.ttlMs = ttlMs;
@@ -21033,7 +21457,8 @@ var PersistedSessionListCache = class {
   }
   slots = /* @__PURE__ */ new Map();
   retainedSummaries = 0;
-  lookup(scope, loader) {
+  lookup(scope, loader, options = {}) {
+    options.signal?.throwIfAborted();
     const key = this.key(scope);
     let slot = this.slots.get(key);
     if (!slot) {
@@ -21044,27 +21469,43 @@ var PersistedSessionListCache = class {
     if (slot.value) {
       const cacheAgeMs = Math.max(0, now - slot.value.completedAt);
       if (cacheAgeMs < this.ttlMs) {
+        const snapshot = slot.value.snapshot;
         return {
           status: "cache_hit",
-          promise: Promise.resolve(slot.value.snapshot),
+          promise: Promise.resolve().then(() => {
+            options.signal?.throwIfAborted();
+            return snapshot;
+          }),
           cacheAgeMs
         };
       }
       this.removeValue(slot);
     }
-    if (slot.inFlight !== void 0 && slot.inFlight.generation === slot.generation) {
+    if (slot.inFlight !== void 0 && slot.inFlight.generation === slot.generation && !slot.inFlight.controller.signal.aborted) {
       return {
         status: "single_flight",
-        promise: slot.inFlight.promise
+        promise: this.attachWaiter(key, slot, slot.inFlight, options.signal)
       };
     }
     const generation = slot.generation;
-    const managed = Promise.resolve().then(loader).then(
+    const controller = new AbortController();
+    const load = {
+      generation,
+      controller,
+      promise: void 0,
+      waiterCount: 0,
+      settled: false
+    };
+    const managed = Promise.resolve().then(() => {
+      controller.signal.throwIfAborted();
+      return loader(controller.signal);
+    }).then(
       (snapshot) => {
+        load.settled = true;
         const current = this.slots.get(key);
-        if (current === slot && current.inFlight?.promise === managed) {
+        if (current === slot && current.inFlight === load) {
           current.inFlight = void 0;
-          if (current.generation === generation && snapshot.sessions.length <= this.maxRetainedSummaries) {
+          if (current.generation === generation && !controller.signal.aborted && snapshot.sessions.length <= this.maxRetainedSummaries) {
             this.installValue(key, current, snapshot);
           } else if (current.value === void 0) {
             this.slots.delete(key);
@@ -21073,16 +21514,21 @@ var PersistedSessionListCache = class {
         return snapshot;
       },
       (error2) => {
+        load.settled = true;
         const current = this.slots.get(key);
-        if (current === slot && current.inFlight?.promise === managed) {
+        if (current === slot && current.inFlight === load) {
           current.inFlight = void 0;
           if (current.value === void 0) this.slots.delete(key);
         }
         throw error2;
       }
     );
-    slot.inFlight = { generation, promise: managed };
-    return { status: "scan", promise: managed };
+    load.promise = managed;
+    slot.inFlight = load;
+    return {
+      status: "scan",
+      promise: this.attachWaiter(key, slot, load, options.signal)
+    };
   }
   invalidate(scope) {
     const key = this.key(scope);
@@ -21136,9 +21582,42 @@ var PersistedSessionListCache = class {
     this.retainedSummaries -= value.snapshot.sessions.length;
     slot.value = void 0;
   }
+  attachWaiter(key, slot, load, signal) {
+    load.waiterCount += 1;
+    return new Promise((resolve5, reject) => {
+      let settled = false;
+      const settle = /* @__PURE__ */ __name((finish) => {
+        if (settled) return;
+        settled = true;
+        signal?.removeEventListener("abort", onAbort);
+        load.waiterCount -= 1;
+        if (load.waiterCount === 0 && !load.settled) {
+          load.controller.abort(
+            new DOMException("No active session list waiters", "AbortError")
+          );
+          const current = this.slots.get(key);
+          if (current === slot && current.inFlight === load) {
+            current.inFlight = void 0;
+            if (current.value === void 0) this.slots.delete(key);
+          }
+        }
+        finish();
+      }, "settle");
+      const onAbort = /* @__PURE__ */ __name(() => {
+        if (load.settled) return;
+        settle(() => reject(signal?.reason));
+      }, "onAbort");
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) onAbort();
+      void load.promise.then(
+        (snapshot) => settle(() => resolve5(snapshot)),
+        (error2) => settle(() => reject(error2))
+      );
+    });
+  }
   key(scope) {
     return JSON.stringify([
-      path10.resolve(scope.runtimeBaseDir),
+      path11.resolve(scope.runtimeBaseDir),
       scope.workspaceCwd,
       scope.archiveState
     ]);
@@ -21257,15 +21736,21 @@ function encodeMetadataSessionCursor(last, filter, archiveState) {
   ).toString("base64url");
 }
 __name(encodeMetadataSessionCursor, "encodeMetadataSessionCursor");
-async function enrichWorktreeSidecars(bySessionId, sessionService, archiveState = "active") {
+async function enrichWorktreeSidecars(bySessionId, sessionService, archiveState = "active", signal) {
   for (const [sessionId, summary] of bySessionId) {
+    signal?.throwIfAborted();
     if (summary.worktree) continue;
-    const sidecar = await readWorktreeSession(
-      sessionService.getWorktreeSessionPathForArchiveState(
+    let sidecar;
+    try {
+      const sidecarPath = sessionService.getWorktreeSessionPathForArchiveState(
         sessionId,
         archiveState
-      )
-    ).catch(() => null);
+      );
+      sidecar = signal ? await readWorktreeSession(sidecarPath, { signal }) : await readWorktreeSession(sidecarPath);
+    } catch {
+      signal?.throwIfAborted();
+      sidecar = null;
+    }
     if (sidecar) {
       bySessionId.set(sessionId, {
         ...summary,
@@ -21320,8 +21805,9 @@ function clonePersistedSummary(session) {
   };
 }
 __name(clonePersistedSummary, "clonePersistedSummary");
-async function loadAllPersistedSummaries(sessionService, archiveState) {
+async function loadAllPersistedSummaries(sessionService, archiveState, signal) {
   const scanStartedAt = performance.now();
+  signal.throwIfAborted();
   const sessions = [];
   let truncated = false;
   let scanPages = 0;
@@ -21331,8 +21817,10 @@ async function loadAllPersistedSummaries(sessionService, archiveState) {
     const page = await sessionService.listSessions({
       cursor,
       size: 1e4,
-      archiveState
+      archiveState,
+      signal
     });
+    signal.throwIfAborted();
     const remaining = MAX_ORGANIZED_SESSIONS - sessions.length;
     sessions.push(...page.items.slice(0, remaining).map(toSummary2));
     cursor = page.nextCursor;
@@ -21350,7 +21838,13 @@ async function loadAllPersistedSummaries(sessionService, archiveState) {
   const bySessionId = new Map(
     sessions.map((session) => [session.sessionId, session])
   );
-  await enrichWorktreeSidecars(bySessionId, sessionService, archiveState);
+  await enrichWorktreeSidecars(
+    bySessionId,
+    sessionService,
+    archiveState,
+    signal
+  );
+  signal.throwIfAborted();
   return {
     sessions: [...bySessionId.values()],
     truncated,
@@ -21359,10 +21853,11 @@ async function loadAllPersistedSummaries(sessionService, archiveState) {
   };
 }
 __name(loadAllPersistedSummaries, "loadAllPersistedSummaries");
-async function listAllPersistedSummaries(sessionService, workspaceCwd, archiveState, runtimeBaseDir, queryKind) {
+async function listAllPersistedSummaries(sessionService, workspaceCwd, archiveState, runtimeBaseDir, queryKind, signal) {
   const lookup = persistedSessionListCache.lookup(
     { runtimeBaseDir, workspaceCwd, archiveState },
-    () => loadAllPersistedSummaries(sessionService, archiveState)
+    (loadSignal) => loadAllPersistedSummaries(sessionService, archiveState, loadSignal),
+    { signal }
   );
   addDaemonRequestAttribute(
     "qwen-code.daemon.session_list.cache_status",
@@ -21383,6 +21878,7 @@ async function listAllPersistedSummaries(sessionService, workspaceCwd, archiveSt
     );
   }
   const snapshot = await lookup.promise;
+  signal?.throwIfAborted();
   addDaemonRequestAttribute(
     "qwen-code.daemon.session_list.persisted_sessions",
     snapshot.sessions.length
@@ -21395,7 +21891,7 @@ async function listAllPersistedSummaries(sessionService, workspaceCwd, archiveSt
     "qwen-code.daemon.session_list.truncated",
     snapshot.truncated
   );
-  if (lookup.status === "scan") {
+  if (lookup.status !== "cache_hit") {
     addDaemonRequestAttribute(
       "qwen-code.daemon.session_list.scan_duration_ms",
       snapshot.scanDurationMs
@@ -21459,7 +21955,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   const archiveState = options.archiveState ?? "active";
   const sessionService = new SessionService(workspaceCwd);
   const organizationService = createSessionOrganizationService(workspaceCwd);
+  readOptions.signal?.throwIfAborted();
   const snapshot = await organizationService.readSnapshot();
+  readOptions.signal?.throwIfAborted();
   const knownGroupIds = new Set(snapshot.groups.map((group2) => group2.id));
   const group = options.group ?? "all";
   if (group !== "all" && group !== "pinned" && group !== "ungrouped" && !knownGroupIds.has(group)) {
@@ -21483,8 +21981,10 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
     workspaceCwd,
     archiveState,
     readOptions.runtimeBaseDir,
-    "organized"
+    "organized",
+    readOptions.signal
   );
+  readOptions.signal?.throwIfAborted();
   for (const session of persisted.sessions) {
     bySessionId.set(
       session.sessionId,
@@ -21517,7 +22017,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
           // above and this point: `existing` stayed undefined but
           // `sessionExists` flipped to true, silently dropping the live
           // session from the response instead of merging it.
-          !persisted.truncated || !await sessionService.sessionExists(live.sessionId)
+          !persisted.truncated || !await (readOptions.signal ? sessionService.sessionExists(live.sessionId, {
+            signal: readOptions.signal
+          }) : sessionService.sessionExists(live.sessionId))
         ) {
           bySessionId.set(
             live.sessionId,
@@ -21535,6 +22037,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
         }
       }
     } catch (error2) {
+      readOptions.signal?.throwIfAborted();
       liveMergeFailed = true;
       writeStderrLine(
         `qwen serve: organized session list live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
@@ -21549,6 +22052,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
       return session.groupId == null && session.color == null;
     return session.color == null && session.groupId === group;
   });
+  readOptions.signal?.throwIfAborted();
   const activityTimeById = new Map(
     filtered.map((session) => [
       session.sessionId,
@@ -21556,6 +22060,7 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
     ])
   );
   filtered.sort((a, b) => compareOrganizedSessions(activityTimeById, a, b));
+  readOptions.signal?.throwIfAborted();
   const afterCursor = cursorKey === void 0 ? filtered : filtered.filter(
     (session) => compareOrganizedCursorKeys(
       cursorKey,
@@ -21587,8 +22092,10 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
     workspaceCwd,
     archiveState,
     readOptions.runtimeBaseDir,
-    "metadata"
+    "metadata",
+    readOptions.signal
   );
+  readOptions.signal?.throwIfAborted();
   for (const session of persisted.sessions) {
     bySessionId.set(session.sessionId, clonePersistedSummary(session));
   }
@@ -21607,7 +22114,9 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
           // `listOrganizedWorkspaceSessionsForResponse`: an untruncated scan
           // already covers every persisted session, so skip the racy
           // re-check when nothing was truncated.
-          !persisted.truncated || !await sessionService.sessionExists(live.sessionId)
+          !persisted.truncated || !await (readOptions.signal ? sessionService.sessionExists(live.sessionId, {
+            signal: readOptions.signal
+          }) : sessionService.sessionExists(live.sessionId))
         ) {
           bySessionId.set(live.sessionId, {
             ...live,
@@ -21619,6 +22128,7 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
         }
       }
     } catch (error2) {
+      readOptions.signal?.throwIfAborted();
       liveMergeFailed = true;
       writeStderrLine(
         `qwen serve: session metadata filter live merge failed; using persisted sessions only: ${error2 instanceof Error ? error2.message : String(error2)}`
@@ -21633,6 +22143,7 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
       getLiveSessionCursorKey(b)
     )
   );
+  readOptions.signal?.throwIfAborted();
   const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseMetadataSessionCursor(options.cursor, {
     ...filter,
     archiveState
@@ -21658,20 +22169,25 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
 }
 __name(listWorkspaceSessionsByMetadataForResponse, "listWorkspaceSessionsByMetadataForResponse");
 async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options, readOptions = {}) {
+  readOptions.signal?.throwIfAborted();
   const runtimeBaseDir = new Storage(
     workspaceCwd,
     readOptions.runtimeBaseDir
   ).getRuntimeBaseDir();
-  return Storage.runWithResolvedRuntimeBaseDir(
+  const result = await Storage.runWithResolvedRuntimeBaseDir(
     runtimeBaseDir,
     () => listWorkspaceSessionsForResponseInRuntime(bridge, workspaceCwd, options, {
       ...readOptions.mergeLive !== void 0 ? { mergeLive: readOptions.mergeLive } : {},
+      ...readOptions.signal !== void 0 ? { signal: readOptions.signal } : {},
       runtimeBaseDir
     })
   );
+  readOptions.signal?.throwIfAborted();
+  return result;
 }
 __name(listWorkspaceSessionsForResponse, "listWorkspaceSessionsForResponse");
 async function listWorkspaceSessionsForResponseInRuntime(bridge, workspaceCwd, options, readOptions) {
+  readOptions.signal?.throwIfAborted();
   const rawSize = options?.size;
   const requestedSize = typeof rawSize === "number" && Number.isSafeInteger(rawSize) ? rawSize : DEFAULT_SESSION_PAGE_SIZE;
   const pageSize = Math.min(Math.max(requestedSize, 1), MAX_SESSION_PAGE_SIZE);
@@ -21708,13 +22224,21 @@ async function listWorkspaceSessionsForResponseInRuntime(bridge, workspaceCwd, o
   const persisted = await sessionService.listSessions({
     cursor: numericCursor,
     size: pageSize,
-    archiveState
+    archiveState,
+    ...readOptions.signal ? { signal: readOptions.signal } : {}
   });
+  readOptions.signal?.throwIfAborted();
   const bySessionId = /* @__PURE__ */ new Map();
   for (const item of persisted.items) {
     bySessionId.set(item.sessionId, toSummary2(item));
   }
-  await enrichWorktreeSidecars(bySessionId, sessionService, archiveState);
+  await enrichWorktreeSidecars(
+    bySessionId,
+    sessionService,
+    archiveState,
+    readOptions.signal
+  );
+  readOptions.signal?.throwIfAborted();
   if (archiveState === "archived" || readOptions.mergeLive === false) {
     const sessions2 = [...bySessionId.values()];
     const nextCursor2 = persisted.nextCursor != null ? String(persisted.nextCursor) : void 0;
@@ -21732,7 +22256,9 @@ async function listWorkspaceSessionsForResponseInRuntime(bridge, workspaceCwd, o
     // `existing` stayed undefined but `sessionExists` flipped to true,
     // silently dropping the live session from the response instead of
     // merging it.
-    (persisted.nextCursor == null || !await sessionService.sessionExists(live.sessionId))) {
+    (persisted.nextCursor == null || !await (readOptions.signal ? sessionService.sessionExists(live.sessionId, {
+      signal: readOptions.signal
+    }) : sessionService.sessionExists(live.sessionId)))) {
       bySessionId.set(live.sessionId, {
         ...live,
         createdAt: live.createdAt,
@@ -21747,6 +22273,7 @@ async function listWorkspaceSessionsForResponseInRuntime(bridge, workspaceCwd, o
     const bTime = Date.parse(b.updatedAt ?? b.createdAt);
     return bTime - aTime;
   });
+  readOptions.signal?.throwIfAborted();
   const nextCursor = persisted.nextCursor != null ? String(persisted.nextCursor) : void 0;
   return { sessions, nextCursor };
 }
@@ -21927,6 +22454,8 @@ import * as fs5 from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import readline from "node:readline";
 var PREFIX = "subagent.";
+var MAX_VIRTUAL_SESSION_ID_PART_LENGTH = 500;
+var MAX_VIRTUAL_SESSION_ID_LENGTH = 2e3;
 var POLL_INTERVAL_MS = 250;
 var TARGET_RETENTION_MS = 6e4;
 async function readFirstUserText(filePath) {
@@ -22015,26 +22544,40 @@ function decodePart(value) {
   }
 }
 __name(decodePart, "decodePart");
-function isValidVirtualSessionPart(value) {
-  return /^[a-zA-Z0-9_-]{1,500}$/.test(value);
+function isValidVirtualParentSessionId(value) {
+  return value.length > 0 && value.length <= MAX_VIRTUAL_SESSION_ID_PART_LENGTH && /^[a-zA-Z0-9_-]+$/.test(value);
 }
-__name(isValidVirtualSessionPart, "isValidVirtualSessionPart");
+__name(isValidVirtualParentSessionId, "isValidVirtualParentSessionId");
+function isValidVirtualAgentId(value) {
+  return value.length > 0 && value.length <= MAX_VIRTUAL_SESSION_ID_PART_LENGTH && // Round-trip rejects lone surrogates: UTF-8 maps them to U+FFFD, so two
+  // distinct agent ids would otherwise encode to the same session id.
+  decodePart(encodePart(value)) === value;
+}
+__name(isValidVirtualAgentId, "isValidVirtualAgentId");
 function createVirtualSubagentSessionId(parentSessionId, agentId) {
-  if (!isValidVirtualSessionPart(parentSessionId) || !isValidVirtualSessionPart(agentId)) {
+  if (!isValidVirtualParentSessionId(parentSessionId) || !isValidVirtualAgentId(agentId)) {
     throw new Error("Virtual subagent session ids require valid id parts");
   }
-  return `${PREFIX}${encodePart(parentSessionId)}.${encodePart(agentId)}`;
+  const sessionId = `${PREFIX}${encodePart(parentSessionId)}.${encodePart(agentId)}`;
+  if (sessionId.length > MAX_VIRTUAL_SESSION_ID_LENGTH) {
+    throw new Error(
+      `Virtual subagent session id exceeds ${MAX_VIRTUAL_SESSION_ID_LENGTH} characters`
+    );
+  }
+  return sessionId;
 }
 __name(createVirtualSubagentSessionId, "createVirtualSubagentSessionId");
 function parseVirtualSubagentSessionId(sessionId) {
-  if (!sessionId.startsWith(PREFIX) || sessionId.length > 2e3) {
+  if (!sessionId.startsWith(PREFIX) || sessionId.length > MAX_VIRTUAL_SESSION_ID_LENGTH) {
     return void 0;
   }
   const parts = sessionId.slice(PREFIX.length).split(".");
   if (parts.length !== 2) return void 0;
-  const parentSessionId = decodePart(parts[0]);
-  const agentId = decodePart(parts[1]);
-  if (!parentSessionId || !agentId || !isValidVirtualSessionPart(parentSessionId) || !isValidVirtualSessionPart(agentId)) {
+  const parentPart = parts[0];
+  const agentPart = parts[1];
+  const parentSessionId = decodePart(parentPart);
+  const agentId = decodePart(agentPart);
+  if (!parentSessionId || !agentId || !isValidVirtualParentSessionId(parentSessionId) || !isValidVirtualAgentId(agentId) || encodePart(parentSessionId) !== parentPart || encodePart(agentId) !== agentPart) {
     return void 0;
   }
   return { parentSessionId, agentId };
@@ -23033,7 +23576,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceParam = req.params[paramName] ?? "";
     const byId = workspaceRegistry.getByWorkspaceId(workspaceParam);
     if (byId) return byId;
-    if (!path11.isAbsolute(workspaceParam)) {
+    if (!path12.isAbsolute(workspaceParam)) {
       res.status(400).json({
         error: `\`:${paramName}\` must decode to a workspace id or absolute path`
       });
@@ -23090,16 +23633,19 @@ function registerSessionRoutes(app, deps) {
     }
     return runtime;
   }, "resolveLegacyPrimaryRuntimeFromParam");
-  const hasActivePersistedSessions = /* @__PURE__ */ __name(async (runtime) => {
+  const hasActivePersistedSessions = /* @__PURE__ */ __name(async (runtime, signal) => {
     try {
       const page = await createWorkspaceRuntimeSessionService(
         runtime
       ).listSessions({
         archiveState: "active",
-        size: 1
+        size: 1,
+        signal
       });
+      signal.throwIfAborted();
       return page.items.length > 0;
     } catch {
+      signal.throwIfAborted();
       return false;
     }
   }, "hasActivePersistedSessions");
@@ -23890,7 +24436,7 @@ function registerSessionRoutes(app, deps) {
       if (worktreeMeta) {
         try {
           const createAllowedRoots = [
-            path11.join(workspaceCwd, ".qwen", "worktrees")
+            path12.join(workspaceCwd, ".qwen", "worktrees")
           ];
           let createRepoTop = null;
           try {
@@ -23901,7 +24447,7 @@ function registerSessionRoutes(app, deps) {
           }
           if (createRepoTop && createRepoTop !== workspaceCwd) {
             createAllowedRoots.push(
-              path11.join(createRepoTop, ".qwen", "worktrees")
+              path12.join(createRepoTop, ".qwen", "worktrees")
             );
           }
           await runtime.bridge.changeSessionCwd(session.sessionId, {
@@ -24200,7 +24746,7 @@ function registerSessionRoutes(app, deps) {
         if (sidecar) {
           let realTarget;
           const candidateRoots = [
-            path11.join(workspaceCwd, ".qwen", "worktrees")
+            path12.join(workspaceCwd, ".qwen", "worktrees")
           ];
           try {
             realTarget = fs6.realpathSync(sidecar.worktreePath);
@@ -24212,13 +24758,13 @@ function registerSessionRoutes(app, deps) {
             } catch {
             }
             if (repoTop && repoTop !== workspaceCwd) {
-              candidateRoots.push(path11.join(repoTop, ".qwen", "worktrees"));
+              candidateRoots.push(path12.join(repoTop, ".qwen", "worktrees"));
             }
             const contained = candidateRoots.some((root) => {
               try {
                 const realRoot = fs6.realpathSync(root);
-                const rel = path11.relative(realRoot, realTarget);
-                return !rel.startsWith("..") && !path11.isAbsolute(rel);
+                const rel = path12.relative(realRoot, realTarget);
+                return !rel.startsWith("..") && !path12.isAbsolute(rel);
               } catch {
                 return false;
               }
@@ -24271,8 +24817,8 @@ function registerSessionRoutes(app, deps) {
   }, "restoreSessionHandler");
   app.post("/session/:id/load", mutate(), restoreSessionHandler("load"));
   app.post("/session/:id/resume", mutate(), restoreSessionHandler("resume"));
-  app.get("/session/:id/subagents/:toolCallId", async (req, res) => {
-    const route = "GET /session/:id/subagents/:toolCallId";
+  app.get("/session/:id/subagents/:subagentRef", async (req, res) => {
+    const route = "GET /session/:id/subagents/:subagentRef";
     const sessionId = requireSessionId(req, res);
     if (!sessionId) return;
     if (!virtualSubagentSessions) {
@@ -24283,11 +24829,11 @@ function registerSessionRoutes(app, deps) {
       });
       return;
     }
-    const toolCallId = req.params["toolCallId"];
-    if (!toolCallId || toolCallId.length > 500) {
+    const subagentRef = req.params["subagentRef"];
+    if (!subagentRef || subagentRef.length > MAX_VIRTUAL_SESSION_ID_PART_LENGTH) {
       res.status(400).json({
-        error: "`toolCallId` must be a non-empty tool call id",
-        code: "invalid_tool_call_id"
+        error: "`subagentRef` must be a non-empty subagent reference",
+        code: "invalid_subagent_ref"
       });
       return;
     }
@@ -24303,14 +24849,14 @@ function registerSessionRoutes(app, deps) {
       const resolved = await virtualSubagentSessions.resolve(
         runtime,
         sessionId,
-        toolCallId
+        subagentRef
       );
       if (!resolved) {
         res.status(404).json({
           error: "Subagent session not found",
           code: "session_not_found",
           sessionId,
-          toolCallId
+          subagentRef
         });
         return;
       }
@@ -24320,10 +24866,10 @@ function registerSessionRoutes(app, deps) {
     }
   });
   app.post(
-    "/session/:id/subagents/:toolCallId/cancel",
+    "/session/:id/subagents/:subagentRef/cancel",
     mutate(),
     async (req, res) => {
-      const route = "POST /session/:id/subagents/:toolCallId/cancel";
+      const route = "POST /session/:id/subagents/:subagentRef/cancel";
       const sessionId = requireSessionId(req, res);
       if (!sessionId) return;
       if (!virtualSubagentSessions) {
@@ -24334,11 +24880,11 @@ function registerSessionRoutes(app, deps) {
         });
         return;
       }
-      const toolCallId = req.params["toolCallId"];
-      if (!toolCallId || toolCallId.length > 500) {
+      const subagentRef = req.params["subagentRef"];
+      if (!subagentRef || subagentRef.length > MAX_VIRTUAL_SESSION_ID_PART_LENGTH) {
         res.status(400).json({
-          error: "`toolCallId` must be a non-empty tool call id",
-          code: "invalid_tool_call_id"
+          error: "`subagentRef` must be a non-empty subagent reference",
+          code: "invalid_subagent_ref"
         });
         return;
       }
@@ -24354,14 +24900,14 @@ function registerSessionRoutes(app, deps) {
         const resolved = await virtualSubagentSessions.resolve(
           runtime,
           sessionId,
-          toolCallId
+          subagentRef
         );
         if (!resolved) {
           res.status(404).json({
             error: "Subagent session not found",
             code: "session_not_found",
             sessionId,
-            toolCallId
+            subagentRef
           });
           return;
         }
@@ -24534,7 +25080,7 @@ function registerSessionRoutes(app, deps) {
       async (req, res, sessionId, runtime) => {
         const body = safeBody(req);
         const targetPath = body["path"];
-        if (typeof targetPath !== "string" || targetPath.length === 0 || !path11.isAbsolute(targetPath)) {
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path12.isAbsolute(targetPath)) {
           res.status(400).json({
             error: "`path` is required and must be an absolute path",
             code: "invalid_path"
@@ -25110,6 +25656,22 @@ function registerSessionRoutes(app, deps) {
         const forwardedBody = { ...body };
         delete forwardedBody["deadlineMs"];
         delete forwardedBody["delivery"];
+        const forwardedMeta = typeof forwardedBody["_meta"] === "object" && forwardedBody["_meta"] !== null && !Array.isArray(forwardedBody["_meta"]) ? { ...forwardedBody["_meta"] } : void 0;
+        const promptAuthorization = forwardedMeta?.[CHANNEL_WORKER_PROMPT_AUTHORIZATION_META_KEY];
+        const promptDisplayText = forwardedMeta?.[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
+        if (forwardedMeta) {
+          delete forwardedMeta[CHANNEL_WORKER_PROMPT_AUTHORIZATION_META_KEY];
+          delete forwardedMeta[DAEMON_PROMPT_DISPLAY_TEXT_META_KEY];
+          if (Object.keys(forwardedMeta).length > 0) {
+            forwardedBody["_meta"] = forwardedMeta;
+          } else {
+            delete forwardedBody["_meta"];
+          }
+        }
+        const trustedPromptDisplayText = typeof promptDisplayText === "string" && isChannelWorkerPromptAuthorized(
+          promptAuthorization,
+          runtime.workspaceCwd
+        ) ? promptDisplayText : void 0;
         const lastEventId = ownerBridge.getSessionLastEventId(sessionId);
         const eventEpoch = ownerBridge.getSessionEventEpoch(sessionId);
         addDaemonRequestAttribute("qwen-code.prompt_id", promptId);
@@ -25142,6 +25704,7 @@ function registerSessionRoutes(app, deps) {
               ...clientId !== void 0 ? { clientId } : {},
               promptId,
               ...effectiveDeadlineMs !== void 0 ? { deadlineMs: effectiveDeadlineMs } : {},
+              ...trustedPromptDisplayText !== void 0 ? { promptDisplayText: trustedPromptDisplayText } : {},
               ...delivery !== void 0 ? {
                 channelDelivery: {
                   deliveryId: promptId,
@@ -26020,25 +26583,54 @@ function registerSessionRoutes(app, deps) {
         ...parentSessionId !== void 0 ? { parentSessionId } : {},
         ...parsedSource
       };
-      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(runtime));
-      if (!usePersisted && (view !== void 0 || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0)) {
-        throw new Error(
-          "session list live path received persisted-only options"
+      const controller = new AbortController();
+      const onRequestAborted = /* @__PURE__ */ __name(() => {
+        controller.abort(new DOMException("Request aborted", "AbortError"));
+      }, "onRequestAborted");
+      const onResponseClosed = /* @__PURE__ */ __name(() => {
+        if (!res.writableEnded) {
+          controller.abort(new DOMException("Response closed", "AbortError"));
+        }
+      }, "onResponseClosed");
+      req.once("aborted", onRequestAborted);
+      res.once("close", onResponseClosed);
+      if (req.aborted || res.destroyed) onRequestAborted();
+      try {
+        const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(runtime, controller.signal));
+        if (!usePersisted && (view !== void 0 || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0)) {
+          throw new Error(
+            "session list live path received persisted-only options"
+          );
+        }
+        const result = usePersisted ? await runWorkspaceInspectionWithLogPolicy(
+          runtime,
+          () => listWorkspaceSessionsForResponse(runtime.bridge, key, options, {
+            mergeLive: !readOnlySecondary,
+            runtimeBaseDir: runtime.sessionRuntimeBaseDir,
+            signal: controller.signal
+          })
+        ) : listLiveWorkspaceSessionsForResponse(
+          runtime.bridge,
+          key,
+          options
         );
+        controller.signal.throwIfAborted();
+        if (res.destroyed) return;
+        res.status(200).json({
+          sessions: result.sessions,
+          ...result.nextCursor != null ? { nextCursor: result.nextCursor } : {},
+          ...result.liveMergeFailed ? { liveMergeFailed: true } : {},
+          ...result.truncated ? { truncated: true } : {}
+        });
+      } catch (err) {
+        if (controller.signal.aborted || res.destroyed) {
+          return;
+        }
+        throw err;
+      } finally {
+        req.off("aborted", onRequestAborted);
+        res.off("close", onResponseClosed);
       }
-      const result = usePersisted ? await runWorkspaceInspectionWithLogPolicy(
-        runtime,
-        () => listWorkspaceSessionsForResponse(runtime.bridge, key, options, {
-          mergeLive: !readOnlySecondary,
-          runtimeBaseDir: runtime.sessionRuntimeBaseDir
-        })
-      ) : listLiveWorkspaceSessionsForResponse(runtime.bridge, key, options);
-      res.status(200).json({
-        sessions: result.sessions,
-        ...result.nextCursor != null ? { nextCursor: result.nextCursor } : {},
-        ...result.liveMergeFailed ? { liveMergeFailed: true } : {},
-        ...result.truncated ? { truncated: true } : {}
-      });
     } catch (err) {
       if (err instanceof InvalidCursorError) {
         res.status(400).json({
@@ -26131,6 +26723,35 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.post(
+    "/session/:id/config-option",
+    mutate(),
+    withOwnerMutableSession(
+      "POST /session/:id/config-option",
+      async (req, res, sessionId, runtime) => {
+        const body = safeBody(req);
+        const configId = body["configId"];
+        const value = body["value"];
+        if (configId !== "reasoning_effort") {
+          res.status(400).json({
+            error: "`configId` must be reasoning_effort"
+          });
+          return;
+        }
+        if (typeof value !== "string" || !value) {
+          res.status(400).json({
+            error: "`value` is required and must be a non-empty string"
+          });
+          return;
+        }
+        const response = await runtime.bridge.setSessionConfigOption(
+          sessionId,
+          { sessionId, configId, value }
+        );
+        res.status(200).json(response);
+      }
+    )
+  );
   app.post(
     "/session/:id/recap",
     mutate(),
@@ -27634,7 +28255,7 @@ __name(registerUsageStatsRoutes, "registerUsageStatsRoutes");
 // packages/cli/src/serve/scheduled-task-keepalive.ts
 init_esbuild_shims();
 import * as fsSync from "node:fs";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 var log = createDebugLogger("SCHED_KEEPALIVE");
 function collectBoundSessionIds(tasks) {
   const seen = /* @__PURE__ */ new Set();
@@ -27860,8 +28481,8 @@ function startScheduledTaskKeepalive(opts) {
     opts.runtimeBaseDir,
     () => getCronFilePath(boundWorkspace)
   );
-  const cronDir = path12.dirname(cronFilePath);
-  const cronFileName = path12.basename(cronFilePath);
+  const cronDir = path13.dirname(cronFilePath);
+  const cronFileName = path13.basename(cronFilePath);
   let fileWatcher;
   try {
     fsSync.mkdirSync(cronDir, { recursive: true });
@@ -28525,6 +29146,7 @@ function registerCapabilitiesRoutes(app, deps) {
           deps.maxPendingPromptsPerSession
         ),
         sessionRestoreTimeoutMs: deps.sessionRestoreTimeoutMs,
+        ...features.includes("workspace_file_upload") ? { maxWorkspaceFileUploadBytes: MAX_UPLOAD_BYTES } : {},
         ...multiWorkspace ? {
           maxSessionsPerWorkspace: advertisedMaxSessions(
             deps.maxSessionsPerWorkspace
@@ -30843,7 +31465,7 @@ __name(registerWorkspaceModelsRoutes, "registerWorkspaceModelsRoutes");
 // packages/cli/src/serve/routes/a2ui-action.ts
 init_esbuild_shims();
 import * as fsp4 from "node:fs/promises";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var A2UI_MIME = "application/a2ui+json";
 var ACTION_TOOL = "action";
 var CALL_TIMEOUT_MS = 15e3;
@@ -30866,7 +31488,7 @@ __name(usableServerConfig, "usableServerConfig");
 async function findFromSettingsFile(workspaceCwd) {
   try {
     const raw = await fsp4.readFile(
-      path13.join(workspaceCwd, ".qwen", "settings.json"),
+      path14.join(workspaceCwd, ".qwen", "settings.json"),
       "utf8"
     );
     const settings = JSON.parse(raw);
@@ -31027,7 +31649,7 @@ __name(registerA2uiActionRoutes, "registerA2uiActionRoutes");
 
 // packages/cli/src/serve/server/fs-factory.ts
 init_esbuild_shims();
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 var IDE_WORKSPACE_PATH_ENV_VAR = "QWEN_CODE_IDE_WORKSPACE_PATH";
 function createDefaultFsAuditEmit() {
   const WARN_EVERY = 100;
@@ -31102,14 +31724,14 @@ function parseIdeWorkspacePathEnv(value) {
       const parsed = JSON.parse(value);
       if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
         return parsed.filter(
-          (workspace) => workspace.length > 0 && path14.isAbsolute(workspace)
+          (workspace) => workspace.length > 0 && path15.isAbsolute(workspace)
         );
       }
       throw new Error("IDE workspace path JSON must be a string array");
     } catch {
     }
   }
-  return value.split(path14.delimiter).filter((workspace) => workspace.length > 0 && path14.isAbsolute(workspace));
+  return value.split(path15.delimiter).filter((workspace) => workspace.length > 0 && path15.isAbsolute(workspace));
 }
 __name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
 function dropNestedWorkspacesPreservingPrimary(workspaces) {
@@ -31378,9 +32000,9 @@ __name(setupDeviceFlowRegistry, "setupDeviceFlowRegistry");
 
 // packages/cli/src/serve/server/error-handlers.ts
 init_esbuild_shims();
-var import_express3 = __toESM(require_express(), 1);
+var import_express4 = __toESM(require_express(), 1);
 function installJsonBodyParser(app) {
-  app.use(import_express3.default.json({ limit: "10mb" }));
+  app.use(import_express4.default.json({ limit: "10mb" }));
   app.use((err, _req, res, next) => {
     if (sendJsonBodyParserError(res, err)) return;
     next(err);
@@ -31434,10 +32056,10 @@ function installRateLimiter(app, opts, daemonLog, options = {}) {
         { tier, key: key.slice(0, 64) }
       );
     } : void 0,
-    onError: daemonLog ? (err, path16) => {
+    onError: daemonLog ? (err, path17) => {
       daemonLog.warn(
         `rate limiter error (fail-open): ${err instanceof Error ? err.message : String(err)}`,
-        { path: path16 }
+        { path: path17 }
       );
     } : void 0
   });
@@ -31633,7 +32255,7 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 init_esbuild_shims();
 import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
 import { realpathSync as realpathSync3 } from "node:fs";
-import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join8, resolve as resolve4, sep as sep3 } from "node:path";
+import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute7, join as join9, resolve as resolve4, sep as sep3 } from "node:path";
 
 // packages/cli/src/serve/native-directory-picker.ts
 init_esbuild_shims();
@@ -32019,8 +32641,8 @@ function registerWorkspaceManagementRoutes(app, deps) {
         return;
       }
       const endsWithSep = prefix.endsWith("/") || process.platform === "win32" && prefix.endsWith("\\");
-      const dir = endsWithSep ? join8(prefix, ".") : dirname4(prefix);
-      const filter = endsWithSep ? "" : basename4(prefix);
+      const dir = endsWithSep ? join9(prefix, ".") : dirname5(prefix);
+      const filter = endsWithSep ? "" : basename5(prefix);
       const filterLower = filter.toLowerCase();
       const suggestions = [];
       let truncated = false;
@@ -32035,7 +32657,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
           let isDir = entry.isDirectory();
           if (!isDir && entry.isSymbolicLink()) {
             try {
-              isDir = (await stat2(join8(dir, entry.name))).isDirectory();
+              isDir = (await stat2(join9(dir, entry.name))).isDirectory();
             } catch {
               continue;
             }
@@ -32045,7 +32667,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
             truncated = true;
             break;
           }
-          suggestions.push({ name: entry.name, path: join8(dir, entry.name) });
+          suggestions.push({ name: entry.name, path: join9(dir, entry.name) });
         }
       } catch {
       }
@@ -32065,11 +32687,11 @@ function registerWorkspaceManagementRoutes(app, deps) {
       const controller = new AbortController();
       res.on("close", () => controller.abort());
       try {
-        const path16 = await pickWorkspaceDirectory(controller.signal);
+        const path17 = await pickWorkspaceDirectory(controller.signal);
         res.status(200).json({
           kind: "workspace-directory-picker",
-          selected: path16 !== void 0,
-          ...path16 === void 0 ? {} : { path: path16 }
+          selected: path17 !== void 0,
+          ...path17 === void 0 ? {} : { path: path17 }
         });
       } catch (error2) {
         const detail = error2 instanceof Error ? error2.message : String(error2);
@@ -33126,8 +33748,8 @@ function buildDiffList(workspaceCwd, result) {
       hiddenCount: 0
     };
   }
-  const files = [...result.perFileStats.entries()].map(([path16, s]) => ({
-    path: path16,
+  const files = [...result.perFileStats.entries()].map(([path17, s]) => ({
+    path: path17,
     oldPath: s.oldPath,
     added: s.added,
     removed: s.removed,
@@ -36119,7 +36741,7 @@ __name(registerWorkspaceQualifiedSkillsRoutes, "registerWorkspaceQualifiedSkills
 
 // packages/cli/src/serve/routes/channel-webhooks.ts
 init_esbuild_shims();
-var import_express4 = __toESM(require_express(), 1);
+var import_express5 = __toESM(require_express(), 1);
 import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
@@ -36168,7 +36790,7 @@ function registerChannelWebhookRoutes(app, deps) {
       locals.channelWebhook = { channelName, source, sourceConfig };
       next();
     },
-    import_express4.default.json({ limit: "1mb" }),
+    import_express5.default.json({ limit: "1mb" }),
     async (req, res) => {
       const locals = res.locals;
       const webhook = locals.channelWebhook;
@@ -39670,7 +40292,7 @@ import { createHash as createHash5, randomUUID as randomUUID11 } from "node:cryp
 import * as fs7 from "node:fs";
 import * as fsp5 from "node:fs/promises";
 import * as os2 from "node:os";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
@@ -39750,7 +40372,7 @@ async function readBundleValue(appPath, key) {
     "raw",
     "-o",
     "-",
-    path15.join(appPath, "Contents", "Info.plist")
+    path16.join(appPath, "Contents", "Info.plist")
   ]);
 }
 __name(readBundleValue, "readBundleValue");
@@ -39892,11 +40514,11 @@ async function downloadLiveHostRelease(currentArchitecture, destination, onProgr
 __name(downloadLiveHostRelease, "downloadLiveHostRelease");
 async function installLatestHost(currentArchitecture, onStatus) {
   const temporaryDirectory = await fsp5.mkdtemp(
-    path15.join(os2.tmpdir(), "qwen-live-host-")
+    path16.join(os2.tmpdir(), "qwen-live-host-")
   );
-  const archivePath = path15.join(temporaryDirectory, "Qwen-Live-Host.zip");
-  const extractedPath = path15.join(temporaryDirectory, "extracted");
-  const candidatePath = path15.join(extractedPath, LIVE_HOST_APP_NAME);
+  const archivePath = path16.join(temporaryDirectory, "Qwen-Live-Host.zip");
+  const extractedPath = path16.join(temporaryDirectory, "extracted");
+  const candidatePath = path16.join(extractedPath, LIVE_HOST_APP_NAME);
   const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID11()}.app`;
   const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID11()}.app`;
   let movedExisting = false;
@@ -40048,13 +40670,13 @@ var LiveHostInstaller = class {
 init_esbuild_shims();
 import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // packages/cli/src/serve/live/realtime-startup-context.ts
 init_esbuild_shims();
 import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename as basename5, join as join10 } from "node:path";
+import { basename as basename6, join as join11 } from "node:path";
 var STARTUP_CONTEXT_HEADER = "Startup context from Qwen Code.\nThis is background context about recent work and machine/workspace layout. It may be incomplete or stale. Use it to inform responses, and do not repeat it back unless relevant.";
 var CURRENT_THREAD_SECTION_TOKEN_BUDGET = 1200;
 var RECENT_WORK_SECTION_TOKEN_BUDGET = 2200;
@@ -40296,7 +40918,7 @@ function collectTreeLines(directory, depth, lines) {
     const indent = "  ".repeat(depth);
     lines.push(`${indent}- ${entry.name}${entry.isDirectory() ? "/" : ""}`);
     if (entry.isDirectory()) {
-      collectTreeLines(join10(directory, entry.name), depth + 1, lines);
+      collectTreeLines(join11(directory, entry.name), depth + 1, lines);
     }
   }
   if (entries.length > DIR_ENTRY_LIMIT) {
@@ -40320,11 +40942,11 @@ function buildWorkspaceSection(currentCwd, userRoot) {
   if (!cwdTree && !gitRoot && !userRootTree) return void 0;
   const lines = [
     `Current working directory: ${currentCwd}`,
-    `Working directory name: ${basename5(currentCwd) || currentCwd}`
+    `Working directory name: ${basename6(currentCwd) || currentCwd}`
   ];
   if (gitRoot) {
     lines.push(`Git root: ${gitRoot}`);
-    lines.push(`Git project: ${basename5(gitRoot) || gitRoot}`);
+    lines.push(`Git project: ${basename6(gitRoot) || gitRoot}`);
   }
   if (userRoot) lines.push(`User root: ${userRoot}`);
   if (cwdTree) lines.push("", "Working directory tree:", ...cwdTree);
@@ -40415,13 +41037,13 @@ function openLiveAudioCapture(source, identifier) {
   try {
     mkdirSync2(directory, { recursive: true, mode: 448 });
     const safeIdentifier = identifier.replace(/[^A-Za-z0-9_-]/g, "_");
-    const path16 = join11(
+    const path17 = join12(
       directory,
       `${source}-${Date.now()}-${safeIdentifier}.pcm`
     );
-    const stream = createWriteStream2(path16, { flags: "wx", mode: 384 });
+    const stream = createWriteStream2(path17, { flags: "wx", mode: 384 });
     stream.on("error", () => void 0);
-    return { source, path: path16, stream, hash: createHash6("sha256"), bytes: 0 };
+    return { source, path: path17, stream, hash: createHash6("sha256"), bytes: 0 };
   } catch {
     return void 0;
   }
@@ -42817,7 +43439,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       "createServeApp: runtime replacement/removal requires deps.getSessionBridges so session-id admission can inspect draining generations."
     );
   }
-  const app = (0, import_express5.default)();
+  const app = (0, import_express6.default)();
   const injectedWorkspaceRegistry = deps.workspaceRegistry;
   const boundWorkspace = injectedWorkspaceRegistry?.primary.workspaceCwd ?? deps.boundWorkspace ?? canonicalizeWorkspace(opts.workspace ?? process.cwd());
   if (injectedWorkspaceRegistry) {
@@ -43816,6 +44438,23 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     safeBody,
     workspaceRegistry
   });
+  const uploadGate = createUploadConcurrencyGate();
+  registerWorkspaceFileUploadRoutes(app, {
+    bridge: primaryBridge,
+    mutate,
+    parseClientId: parseClientIdHeader,
+    safeBody,
+    uploadGate,
+    ...primaryRuntimeTrustAuthoritative ? { isWorkspaceTrusted: isPrimaryWorkspaceTrusted } : {}
+  });
+  registerWorkspaceQualifiedFileUploadRoutes(app, {
+    bridge: primaryBridge,
+    mutate,
+    parseClientId: parseClientIdHeader,
+    safeBody,
+    uploadGate,
+    workspaceRegistry
+  });
   registerWorkspaceSetupGithubRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,