@qwen-code/qwen-code 0.21.12-preview.3 → 0.21.12

package/chunks/{run-qwen-serve-GVMMX3IU.js → run-qwen-serve-GZW7B4WK.js}

@@ -34,36 +34,38 @@ import {
   resolveAcpHttpEnabled,
   setDeferredRuntimeRequestTiming,
   toDaemonStatusMemoryLimits
-} from "./chunk-KNQZXSLW.js";
+} from "./chunk-HG3UBTJ4.js";
 import "./chunk-VGHZT6JR.js";
 import {
   isLoopbackBind
 } from "./chunk-TQOF5KBL.js";
 import {
   formatMemoryBudgetStderr,
-  resolveDaemonMemoryBudget
-} from "./chunk-HGCQ5SE7.js";
+  resolveDaemonMemoryBudget,
+  serveJournalGrowthPoolMb
+} from "./chunk-UXEO7E3V.js";
 import {
   resolveSessionRestoreTimeoutMs
 } from "./chunk-4JRM2BSM.js";
-import {
-  DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
-  DEFAULT_MAX_JOURNAL_BYTES,
-  DEFAULT_MAX_JOURNAL_EVENTS,
-  normalizeCompactedReplayMaxBytes,
-  normalizeMaxJournalBytes,
-  normalizeMaxJournalEvents
-} from "./chunk-XCGIMOLN.js";
 import {
   require_express,
   resolveWebShellDir
 } from "./chunk-GDXET5XU.js";
 import {
   resolveChannelCwd
-} from "./chunk-ENEEQMGM.js";
+} from "./chunk-45NQKMYB.js";
 import {
   LIVE_HOST_PROTOCOL_VERSION
 } from "./chunk-NKLP3DCK.js";
+import {
+  DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
+  DEFAULT_MAX_JOURNAL_BYTES,
+  DEFAULT_MAX_JOURNAL_EVENTS,
+  JOURNAL_GROWTH_HARD_CAP_BYTES,
+  normalizeCompactedReplayMaxBytes,
+  normalizeMaxJournalBytes,
+  normalizeMaxJournalEvents
+} from "./chunk-WCCLLK7X.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
@@ -76,17 +78,17 @@ import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-JL3LC3CQ.js";
-import "./chunk-5TXOGH4I.js";
+} from "./chunk-WCEI6J56.js";
+import "./chunk-LUISTZXI.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-HHGQGTJQ.js";
+} from "./chunk-FQDCO3CJ.js";
 import "./chunk-624NHDGB.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-6PLDPT2C.js";
-import "./chunk-ZGWY4YUB.js";
+import "./chunk-SYHXR6WM.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
@@ -98,24 +100,26 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-K7JW6V5O.js";
+} from "./chunk-A6NRNRKE.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
 import "./chunk-HIBNSEJE.js";
 import "./chunk-M5GB774H.js";
 import {
+  EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE,
   EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
   EXTERNAL_TOOL_GUARD_TOKEN_ENV,
-  PRIVATE_EXTERNAL_TOOL_GUARD_ENV
-} from "./chunk-BKHCW2BI.js";
-import {
-  sanitizeLogText
-} from "./chunk-LT532KF4.js";
-import "./chunk-IW6RQPQB.js";
+  PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
+  PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV
+} from "./chunk-3VUENPWF.js";
 import {
   MAX_DAEMON_WORKSPACES
 } from "./chunk-5HBA2Z7V.js";
+import {
+  sanitizeLogText
+} from "./chunk-AW27A43Y.js";
+import "./chunk-IW6RQPQB.js";
 import "./chunk-GOXKNSDZ.js";
 import {
   getGlobalQwenDirLite,
@@ -129,8 +133,8 @@ import {
 } from "./chunk-MS7GNABG.js";
 import {
   getCliVersion
-} from "./chunk-M2PY7CNK.js";
-import "./chunk-VJNBRRZG.js";
+} from "./chunk-OWXFBIB6.js";
+import "./chunk-WZMH7II3.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot
@@ -147,14 +151,20 @@ import "./chunk-XWRJCPHC.js";
 import {
   finalizeStartupProfile,
   profileCheckpoint
-} from "./chunk-QSWDGAIC.js";
-import "./chunk-Q7YDKOGY.js";
+} from "./chunk-QILD6R27.js";
+import "./chunk-JVEGA3MM.js";
 import {
   writeStderrLine,
   writeStdoutLine
 } from "./chunk-KGJGEEVR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
+import {
+  TraceFlags,
+  init_esm,
+  isSpanContextValid,
+  trace
+} from "./chunk-QUGAUQGJ.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -336,6 +346,7 @@ __name(createPermissionAuditPublisher, "createPermissionAuditPublisher");
 
 // packages/cli/src/serve/daemon-logger.ts
 init_esbuild_shims();
+init_esm();
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 import * as nodeFs from "node:fs";
 import * as nodePath from "node:path";
@@ -349,6 +360,10 @@ var FIXED_CTX_ORDER = [
   "channelId"
 ];
 var FIXED_CTX_SET = new Set(FIXED_CTX_ORDER);
+var RESERVED_TRACE_CTX_KEYS = /* @__PURE__ */ new Set([
+  "trace_id",
+  "span_id"
+]);
 var ISSUE_ORDER = [
   "init_failed",
   "rotation_failed",
@@ -389,7 +404,7 @@ function renderCtx(ctx) {
     }
   }
   const extraKeys = Object.keys(ctx).filter(
-    (key) => !FIXED_CTX_SET.has(key) && ctx[key] !== void 0 && ctx[key] !== null
+    (key) => !FIXED_CTX_SET.has(key) && !RESERVED_TRACE_CTX_KEYS.has(key) && ctx[key] !== void 0 && ctx[key] !== null
   ).sort();
   for (const key of extraKeys) {
     parts.push(`${key}=${renderCtxValue(ctx[key])}`);
@@ -397,27 +412,50 @@ function renderCtx(ctx) {
   return parts.length > 0 ? parts.join(" ") + " " : "";
 }
 __name(renderCtx, "renderCtx");
+function getActiveTraceContext() {
+  try {
+    const span = trace.getActiveSpan();
+    if (!span?.isRecording()) return void 0;
+    const spanContext = span.spanContext();
+    if (!isSpanContextValid(spanContext) || (spanContext.traceFlags & TraceFlags.SAMPLED) === 0) {
+      return void 0;
+    }
+    return {
+      traceId: spanContext.traceId,
+      spanId: spanContext.spanId
+    };
+  } catch {
+    return void 0;
+  }
+}
+__name(getActiveTraceContext, "getActiveTraceContext");
+function renderTraceContext(traceContext) {
+  return traceContext ? `[trace_id=${traceContext.traceId} span_id=${traceContext.spanId}] ` : "";
+}
+__name(renderTraceContext, "renderTraceContext");
 function renderErr(err) {
   if (!err) return "";
   const body = err.stack ?? `${err.name ?? "Error"}: ${err.message}`;
   return body.split("\n").map((line) => `  ${line}`).join("\n") + "\n";
 }
 __name(renderErr, "renderErr");
-function buildDaemonLogLine(args) {
+function formatDaemonLogLine(args) {
   const ts = args.now.toISOString();
+  const traceStr = renderTraceContext(args.traceContext);
   const ctxStr = renderCtx(args.ctx);
-  return `${ts} [${args.level}] [DAEMON] ${ctxStr}${args.message}
+  return `${ts} [${args.level}] [DAEMON] ${traceStr}${ctxStr}${args.message}
 ${renderErr(args.err)}`;
 }
-__name(buildDaemonLogLine, "buildDaemonLogLine");
+__name(formatDaemonLogLine, "formatDaemonLogLine");
 function buildDaemonFileLogLine(args, runId, pid) {
   const callerCtx = args.ctx ? Object.fromEntries(
     Object.entries(args.ctx).filter(
       ([key]) => key !== "runId" && key !== "pid"
     )
   ) : void 0;
+  const traceStr = renderTraceContext(args.traceContext);
   const ctxStr = renderCtx(callerCtx);
-  return `${args.now.toISOString()} [${args.level}] [DAEMON] runId=${runId} pid=${pid} ${ctxStr}${args.message}
+  return `${args.now.toISOString()} [${args.level}] [DAEMON] runId=${runId} pid=${pid} ${traceStr}${ctxStr}${args.message}
 ${renderErr(args.err)}`;
 }
 __name(buildDaemonFileLogLine, "buildDaemonFileLogLine");
@@ -488,13 +526,15 @@ function statusSnapshot(runId, mode, issues, droppedRecords, droppedBytes) {
 __name(statusSnapshot, "statusSnapshot");
 function createStderrOnlyLogger(input) {
   const tee = /* @__PURE__ */ __name((level, message, ctx, err) => {
+    const traceContext = getActiveTraceContext();
     input.stderr(
-      buildDaemonLogLine({
+      formatDaemonLogLine({
         level,
         message,
         now: input.now(),
         ctx,
-        err
+        err,
+        traceContext
       }).trimEnd()
     );
   }, "tee");
@@ -1256,19 +1296,21 @@ function createConcreteLogger(input) {
   }, "submitFileRecord");
   const tee = /* @__PURE__ */ __name((level, message, ctx, err) => {
     const timestamp = input.now();
+    const traceContext = getActiveTraceContext();
     input.stderr(
-      buildDaemonLogLine({
+      formatDaemonLogLine({
         level,
         message,
         now: timestamp,
         ctx,
-        err
+        err,
+        traceContext
       }).trimEnd()
     );
     submitFileRecord(
       capUtf8Record(
         buildDaemonFileLogLine(
-          { level, message, now: timestamp, ctx, err },
+          { level, message, now: timestamp, ctx, err, traceContext },
           input.runId,
           input.pid
         ),
@@ -1695,7 +1737,7 @@ ${capUtf8Record(
 }
 __name(initDaemonLogger, "initDaemonLogger");
 
-// packages/cli/src/serve/live/conversation-workspace.ts
+// packages/cli/src/serve/conversations/conversation-workspace.ts
 init_esbuild_shims();
 import { createHash as createHash2 } from "node:crypto";
 import { lstat, mkdir, realpath, rmdir } from "node:fs/promises";
@@ -1743,14 +1785,14 @@ async function validateConversationDirectory(root, name, candidate, parent = roo
       "Live conversation directory must be an owned direct child"
     );
   }
-  await revalidateLiveConversationRoot(root);
+  await revalidateConversationRoot(root);
   return canonical;
 }
 __name(validateConversationDirectory, "validateConversationDirectory");
-function getLiveConversationRootPath(homeDir = homedir()) {
+function getConversationRootPath(homeDir = homedir()) {
   return resolve(homeDir, "Documents", "Qwen Code", "Conversations");
 }
-__name(getLiveConversationRootPath, "getLiveConversationRootPath");
+__name(getConversationRootPath, "getConversationRootPath");
 async function createRoot(configuredRoot) {
   try {
     await mkdir(configuredRoot, { recursive: true, mode: 448 });
@@ -1782,7 +1824,7 @@ async function createRoot(configuredRoot) {
   };
 }
 __name(createRoot, "createRoot");
-async function revalidateLiveConversationRoot(root) {
+async function revalidateConversationRoot(root) {
   const configuredStats = await lstat(root.configuredRoot);
   validateRootStats(configuredStats);
   if (!hasIdentity(configuredStats, root)) {
@@ -1799,9 +1841,9 @@ async function revalidateLiveConversationRoot(root) {
   }
   return root;
 }
-__name(revalidateLiveConversationRoot, "revalidateLiveConversationRoot");
-async function assertExactLiveConversationRoot(root, candidate) {
-  await revalidateLiveConversationRoot(root);
+__name(revalidateConversationRoot, "revalidateConversationRoot");
+async function assertExactConversationRoot(root, candidate) {
+  await revalidateConversationRoot(root);
   const resolvedCandidate = resolve(candidate);
   if (!isSamePath(resolvedCandidate, root.configuredRoot) && !isSamePath(resolvedCandidate, root.canonicalRoot)) {
     throw new Error("Workspace must be the exact Live conversation root");
@@ -1814,15 +1856,15 @@ async function assertExactLiveConversationRoot(root, candidate) {
   }
   return root;
 }
-__name(assertExactLiveConversationRoot, "assertExactLiveConversationRoot");
-var LiveConversationWorkspace = class {
+__name(assertExactConversationRoot, "assertExactConversationRoot");
+var ConversationWorkspace = class {
   static {
-    __name(this, "LiveConversationWorkspace");
+    __name(this, "ConversationWorkspace");
   }
   rootPath;
   rootPromise;
   constructor(options = {}) {
-    this.rootPath = getLiveConversationRootPath(options.homeDir);
+    this.rootPath = getConversationRootPath(options.homeDir);
   }
   async getRoot() {
     if (!this.rootPromise) {
@@ -1835,10 +1877,10 @@ var LiveConversationWorkspace = class {
     return this.rootPromise;
   }
   async revalidate() {
-    return revalidateLiveConversationRoot(await this.getRoot());
+    return revalidateConversationRoot(await this.getRoot());
   }
   async assertExactRoot(candidate) {
-    return assertExactLiveConversationRoot(await this.getRoot(), candidate);
+    return assertExactConversationRoot(await this.getRoot(), candidate);
   }
   async materializeConversationDirectory(sessionId) {
     const root = await this.revalidate();
@@ -1874,7 +1916,7 @@ var LiveConversationWorkspace = class {
       }
       throw error;
     }
-    await revalidateLiveConversationRoot(root);
+    await revalidateConversationRoot(root);
     return true;
   }
 };
@@ -2985,12 +3027,12 @@ var retryableChannelWorkerShutdownErrors = /* @__PURE__ */ new WeakSet();
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-DZKHYFHV.js"),
-    import("./pidfile-SUNYCAA4.js"),
-    import("./runtime-RNBZ5FDD.js"),
+    import("./channel-worker-supervisor-ZJIIWM4I.js"),
+    import("./pidfile-RQGZBNXT.js"),
+    import("./runtime-MYRXEO2E.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-YPTB5ASD.js"),
-    import("./channel-worker-manager-4EHJSPRH.js")
+    import("./channel-worker-group-IHBIHQ45.js"),
+    import("./channel-worker-manager-GEHYJ5AE.js")
   ]).then(
     ([
       supervisor,
@@ -3095,7 +3137,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-IAQ4DD4Y.js");
+  coreRuntimePromise ??= import("./core-runtime-H5CZDN3A.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -3131,10 +3173,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-GUJ3TN2J.js"),
-    import("./environment-Z6OMA34I.js"),
-    import("./loadedSettingsAdapter-IRUANLS2.js"),
-    import("./trustedFolders-2XST7U5C.js")
+    import("./settings-CSYVIP2R.js"),
+    import("./environment-WOAJXJDJ.js"),
+    import("./loadedSettingsAdapter-5O2TDS3I.js"),
+    import("./trustedFolders-MQS46LIU.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3147,8 +3189,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-RNBZ5FDD.js"),
-    import("./config-utils-TXVKR27S.js")
+    import("./runtime-MYRXEO2E.js"),
+    import("./config-utils-Z3OW3IQG.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3173,17 +3215,17 @@ async function loadServeRuntimeModules() {
     totalSessionAdmissionModule,
     workspaceRegistryModule
   ] = await Promise.all([
-    import("./server-SUXD2F3C.js"),
-    import("./bridge-DEAYNDCI.js"),
-    import("./spawnChannel-UUUUK734.js"),
+    import("./server-AWQHKXLG.js"),
+    import("./bridge-NPBV53UA.js"),
+    import("./spawnChannel-PQSZIOLY.js"),
     import("./process-registry-PMJOA5CO.js"),
-    import("./workspace-service-QZXQHX2F.js"),
+    import("./workspace-service-LOXYKYTR.js"),
     import("./types-WYCFCEHR.js"),
-    import("./daemon-status-provider-LPYR2GXY.js"),
-    import("./workspace-providers-status-U4EYXA4K.js"),
-    import("./workspace-skills-status-VRBHEX5O.js"),
-    import("./total-session-admission-MQLBJ5WL.js"),
-    import("./workspace-registry-WSHWQRQQ.js")
+    import("./daemon-status-provider-QYM57Z44.js"),
+    import("./workspace-providers-status-PDDMI6ST.js"),
+    import("./workspace-skills-status-IJ5FOQI6.js"),
+    import("./total-session-admission-N4E5SFBO.js"),
+    import("./workspace-registry-L4NCJ34K.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -3498,6 +3540,11 @@ function createBootstrapServeApp(input) {
       return;
     }
     const runtimeError = getRuntimeError();
+    const bootstrapJournalGrowthPoolMb = opts.daemonMemoryBudget !== void 0 ? serveJournalGrowthPoolMb({
+      budget: opts.daemonMemoryBudget,
+      maxJournalEvents: opts.maxJournalEvents,
+      maxJournalBytes: opts.maxJournalBytes
+    }) : 0;
     const channelWorker = getChannelWorkerSnapshot();
     const channelWorkers = getChannelWorkerSnapshots();
     const runtimeFailed = runtimeError !== void 0;
@@ -3573,7 +3620,16 @@ function createBootstrapServeApp(input) {
         // No child-heap policy during bootstrap: it is built with the
         // runtime, so `enforced` is correctly false and `childHeap` null in
         // this window even when the flag says `enforce`.
-        memory: toDaemonStatusMemoryLimits(opts.daemonMemoryBudget)
+        memory: toDaemonStatusMemoryLimits(
+          opts.daemonMemoryBudget,
+          void 0,
+          bootstrapJournalGrowthPoolMb > 0 ? {
+            poolBytes: bootstrapJournalGrowthPoolMb * 1024 * 1024,
+            hardCapBytes: JOURNAL_GROWTH_HARD_CAP_BYTES,
+            baselineMaxEvents: opts.maxJournalEvents ?? DEFAULT_MAX_JOURNAL_EVENTS,
+            baselineMaxBytes: opts.maxJournalBytes ?? DEFAULT_MAX_JOURNAL_BYTES
+          } : null
+        )
       },
       capabilities: {
         protocolVersions: getServeProtocolVersions(),
@@ -4139,9 +4195,29 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   if (opts.daemonMemoryBudget.budgetSource === "flag" || opts.daemonMemoryBudget.insufficientMemory) {
     writeStderrLine(formatMemoryBudgetStderr(opts.daemonMemoryBudget));
   }
+  const journalGrowthPoolMbValue = opts.daemonMemoryBudget !== void 0 ? serveJournalGrowthPoolMb({
+    budget: opts.daemonMemoryBudget,
+    maxJournalEvents: opts.maxJournalEvents,
+    maxJournalBytes: opts.maxJournalBytes
+  }) : 0;
+  const journalGrowthPoolBytes = journalGrowthPoolMbValue > 0 ? journalGrowthPoolMbValue * 1024 * 1024 : void 0;
+  const journalGrowthSessionLimitProviders = /* @__PURE__ */ new Set();
+  const journalGrowthSessionLimits = /* @__PURE__ */ __name(() => {
+    const limits = [];
+    for (const provider of journalGrowthSessionLimitProviders) {
+      limits.push(...provider());
+    }
+    return limits;
+  }, "journalGrowthSessionLimits");
+  const registerJournalGrowthSessionLimits = /* @__PURE__ */ __name((provider) => {
+    journalGrowthSessionLimitProviders.add(provider);
+    return () => {
+      journalGrowthSessionLimitProviders.delete(provider);
+    };
+  }, "registerJournalGrowthSessionLimits");
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-OG66U3CB.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-BGRKKIYR.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -4397,7 +4473,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         "Required external tool guarding cannot be combined with an injected bridge."
       );
     }
-    const { RequiredExternalToolGuard } = await import("./external-tool-guard-provider-5HTGOPGU.js");
+    const { RequiredExternalToolGuard } = await import("./external-tool-guard-provider-TE4DRY36.js");
     const provider = new RequiredExternalToolGuard({
       endpoint: opts.externalToolGuard.endpoint,
       token: opts.externalToolGuard.token,
@@ -4409,11 +4485,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-LZDCNJGV.js");
+  const daemonToolGuardHandler = createDaemonToolGuard(
+    externalToolGuardHandler
+  );
   const childEnvOverrides = {
     QWEN_SERVE_MCP_CLIENT_BUDGET: opts.mcpClientBudget !== void 0 ? String(opts.mcpClientBudget) : void 0,
     QWEN_SERVE_MCP_BUDGET_MODE: opts.mcpBudgetMode,
     QWEN_SERVE_CDP_TUNNEL_OVER_WS: opts.cdpTunnelOverWs ? "1" : void 0,
-    [PRIVATE_EXTERNAL_TOOL_GUARD_ENV]: externalToolGuardHandler ? EXTERNAL_TOOL_GUARD_REQUIRED_VALUE : void 0
+    [PRIVATE_EXTERNAL_TOOL_GUARD_ENV]: EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
+    [PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV]: externalToolGuardHandler ? EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE : void 0
   };
   const cliVersionPromise = getCliVersion();
   let cliVersion;
@@ -4711,7 +4792,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-7JOBVFH3.js")
+      import("./daemon-trust-policy-TSRVEYZR.js")
     ]);
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
@@ -4734,7 +4815,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         `qwen serve: managed scratch workspaces are unavailable: ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    const liveConversationWorkspace = deps.liveConversationWorkspace ?? new LiveConversationWorkspace();
+    const liveConversationWorkspace = deps.liveConversationWorkspace ?? new ConversationWorkspace();
     let runtimeBootSettings;
     try {
       runtimeBootSettings = settingsRuntime.settings.loadSettings(
@@ -5084,7 +5165,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-Y2BU27XM.js");
+      } = await import("./skill-settings-YOE7LBHE.js");
       const fresh = loadSettingsForPersistence(workspace);
       const normalizedName = skillName.trim().toLowerCase();
       const resolved = resolveSkillSettings(fresh);
@@ -5149,7 +5230,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-Y2BU27XM.js");
+      } = await import("./skill-settings-YOE7LBHE.js");
       const fresh = loadSettingsForPersistence(workspace);
       const resolved = resolveSkillSettings(fresh);
       const initialDisabled = skillSettingStrings(
@@ -5254,7 +5335,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
       }
     }), "persistSettingsFn");
-    const { createSubSessionLauncher } = await import("./create-sub-session-EKHKXJAA.js");
+    const { createSubSessionLauncher } = await import("./create-sub-session-PA7MFTHK.js");
     const subSessionLauncher = createSubSessionLauncher({
       getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
       boundWorkspace,
@@ -5287,6 +5368,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
       ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
       ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
+      ...journalGrowthPoolBytes !== void 0 ? {
+        journalGrowthPoolBytes,
+        journalGrowthSessionLimits,
+        registerJournalGrowthSessionLimits
+      } : {},
       ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
       ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
       sessionRestoreTimeoutMs,
@@ -5297,7 +5383,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       sessionShellCommandEnabled,
       childEnvOverrides,
       channelFactory,
-      ...externalToolGuardHandler ? { externalToolGuard: externalToolGuardHandler } : {},
+      externalToolGuard: daemonToolGuardHandler,
       onDiagnosticLine: diagnosticSink,
       telemetry: daemonTelemetry,
       ...permissionPolicy !== void 0 ? { permissionPolicy } : {},
@@ -5595,6 +5681,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
         ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
         ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
+        ...journalGrowthPoolBytes !== void 0 ? {
+          journalGrowthPoolBytes,
+          journalGrowthSessionLimits,
+          registerJournalGrowthSessionLimits
+        } : {},
         ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
         ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
         sessionRestoreTimeoutMs,
@@ -5605,7 +5696,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         sessionShellCommandEnabled,
         childEnvOverrides,
         channelFactory: secondaryChannelFactory,
-        ...externalToolGuardHandler ? { externalToolGuard: externalToolGuardHandler } : {},
+        externalToolGuard: daemonToolGuardHandler,
         onDiagnosticLine: diagnosticSink,
         telemetry: createRuntimeBridgeTelemetry(secondaryWorkspaceHash),
         ...permissionPolicy !== void 0 ? { permissionPolicy } : {},
@@ -5960,6 +6051,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
           ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
           ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
+          ...journalGrowthPoolBytes !== void 0 ? {
+            journalGrowthPoolBytes,
+            journalGrowthSessionLimits,
+            registerJournalGrowthSessionLimits
+          } : {},
           ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
           ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
           sessionRestoreTimeoutMs,
@@ -5970,7 +6066,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           sessionShellCommandEnabled,
           childEnvOverrides,
           channelFactory: wsChannelFactory,
-          ...externalToolGuardHandler ? { externalToolGuard: externalToolGuardHandler } : {},
+          externalToolGuard: daemonToolGuardHandler,
           onDiagnosticLine: diagnosticSink,
           telemetry: createRuntimeBridgeTelemetry(wsHash),
           ...permissionPolicy !== void 0 ? { permissionPolicy } : {},
@@ -6414,8 +6510,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-SKAN6NOB.js"),
-          import("./channel-settings-store-UIGYER6R.js")
+          import("./channel-management-service-OADNGQM3.js"),
+          import("./channel-settings-store-4ODLJ4X2.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -6616,8 +6712,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-FCRIUIOF.js"),
-        import("./daemon-trust-policy-monitor-OU3NRHAR.js")
+        import("./workspace-trust-reconciler-H36TCR2S.js"),
+        import("./daemon-trust-policy-monitor-2K2YETMT.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -6832,7 +6928,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-7JOBVFH3.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-TSRVEYZR.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {