@qwen-code/qwen-code 0.21.12 → 0.21.14-preview.0

package/chunks/{chunk-HG3UBTJ4.js → chunk-UYDGFWIJ.js}

@@ -12,9 +12,12 @@ import {
   MIN_CHILD_HEAP_MB,
   recommendedChildShareMb
 } from "./chunk-UXEO7E3V.js";
+import {
+  isInternalWorkspaceRuntime
+} from "./chunk-NYWWQ437.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-FQDCO3CJ.js";
+} from "./chunk-WP4WIUOJ.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   translateAndCheckAbsoluteWorkspacePath
@@ -920,9 +923,107 @@ function isDeepHealthQuery(raw) {
 }
 __name(isDeepHealthQuery, "isDeepHealthQuery");
 
-// packages/cli/src/serve/auth.ts
+// packages/cli/src/serve/local-control/credentials.ts
 init_esbuild_shims();
 import { createHash, timingSafeEqual } from "node:crypto";
+var CredentialStore = class {
+  static {
+    __name(this, "CredentialStore");
+  }
+  #runtime;
+  /** Pairing id → sha256 of the pairing secret. */
+  #pairing = /* @__PURE__ */ new Map();
+  constructor(runtimeToken) {
+    this.#runtime = hashToken(runtimeToken);
+  }
+  addPairingToken(id, token) {
+    this.#pairing.set(id, createHash("sha256").update(token, "utf8").digest());
+  }
+  revokePairingToken(id) {
+    return this.#pairing.delete(id);
+  }
+  /**
+   * Is the gate open — i.e. may an unauthenticated request through?
+   *
+   * Only ever true on the primary listener of a no-token loopback daemon,
+   * preserving today's developer default. The LAN listener is never open: it
+   * exists only while a pairing token does, and it must not inherit the
+   * "operator chose the surface area" reasoning that governs `--hostname`.
+   */
+  isOpen(listener) {
+    if (listener.kind === "local-control") return false;
+    return this.#runtime === void 0;
+  }
+  /**
+   * Constant-time check of a presented credential against those valid for
+   * `listener`. Every candidate in scope is compared even after a match so the
+   * work is independent of which credential matched — with a handful of
+   * pairing tokens the cost is negligible and the timing signal is not worth
+   * reasoning about separately.
+   */
+  verify(credentials, listener) {
+    const candidate = createHash("sha256").update(credentials, "utf8").digest();
+    let matched = false;
+    if (listener.kind === "local-control") {
+      for (const expected of this.#pairing.values()) {
+        if (equalDigest(candidate, expected)) matched = true;
+      }
+      return matched;
+    }
+    return this.#runtime !== void 0 && equalDigest(candidate, this.#runtime);
+  }
+};
+function singleTokenCredentials(token) {
+  const expected = hashToken(token);
+  return {
+    isOpen: /* @__PURE__ */ __name((listener) => expected === void 0 && listener.kind !== "local-control", "isOpen"),
+    verify: /* @__PURE__ */ __name((candidate, listener) => {
+      if (expected === void 0 || listener.kind === "local-control") {
+        return false;
+      }
+      return equalDigest(
+        createHash("sha256").update(candidate, "utf8").digest(),
+        expected
+      );
+    }, "verify")
+  };
+}
+__name(singleTokenCredentials, "singleTokenCredentials");
+function hashToken(token) {
+  return token === void 0 || token === "" ? void 0 : createHash("sha256").update(token, "utf8").digest();
+}
+__name(hashToken, "hashToken");
+function equalDigest(a, b) {
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+__name(equalDigest, "equalDigest");
+
+// packages/cli/src/serve/local-control/listener-identity.ts
+init_esbuild_shims();
+var LISTENER_TAG = Symbol.for("qwen.serve.listenerIdentity");
+function tagListener(server, identity) {
+  server[LISTENER_TAG] = identity;
+}
+__name(tagListener, "tagListener");
+var PRIMARY = { kind: "primary" };
+function fromServer(server) {
+  if (!server || typeof server !== "object") return void 0;
+  return server[LISTENER_TAG];
+}
+__name(fromServer, "fromServer");
+function listenerIdentityOf(req) {
+  const socket = req.socket;
+  return fromServer(socket?.server) ?? PRIMARY;
+}
+__name(listenerIdentityOf, "listenerIdentityOf");
+function listenerIdentityOfSocket(socket) {
+  const withServer = socket;
+  return fromServer(withServer?.server) ?? PRIMARY;
+}
+__name(listenerIdentityOfSocket, "listenerIdentityOfSocket");
+
+// packages/cli/src/serve/auth.ts
+init_esbuild_shims();
 var denyBrowserOriginCors = /* @__PURE__ */ __name((req, res, next) => {
   if (req.headers.origin) {
     res.setHeader("Vary", "Origin");
@@ -970,7 +1071,42 @@ function parseAllowOriginPatterns(raw) {
   return { allowAny, origins };
 }
 __name(parseAllowOriginPatterns, "parseAllowOriginPatterns");
+var MutableOriginAllowlist = class {
+  static {
+    __name(this, "MutableOriginAllowlist");
+  }
+  #allowAny;
+  #static;
+  #dynamic = /* @__PURE__ */ new Map();
+  constructor(base) {
+    this.#allowAny = base.allowAny;
+    this.#static = new Set(base.origins);
+  }
+  allows(origin) {
+    if (this.#allowAny) return true;
+    const normalized = origin.toLowerCase();
+    if (this.#static.has(normalized)) return true;
+    for (const value of this.#dynamic.values()) {
+      if (value === normalized) return true;
+    }
+    return false;
+  }
+  /** Add a runtime origin under `key`; re-adding the same key replaces it. */
+  add(key, origin) {
+    this.#dynamic.set(key, origin.toLowerCase());
+  }
+  remove(key) {
+    this.#dynamic.delete(key);
+  }
+};
+function toMatcher(patterns) {
+  return "allows" in patterns ? patterns : {
+    allows: /* @__PURE__ */ __name((origin) => patterns.allowAny || patterns.origins.has(origin.toLowerCase()), "allows")
+  };
+}
+__name(toMatcher, "toMatcher");
 function allowOriginCors(patterns) {
+  const matcher = toMatcher(patterns);
   const allowedMethods = "GET, POST, PATCH, DELETE, OPTIONS";
   const allowedHeaders = "Authorization, Content-Type, X-Qwen-Client-Id, Last-Event-ID, X-Qwen-Event-Epoch";
   const maxAgeSeconds = "86400";
@@ -986,7 +1122,7 @@ function allowOriginCors(patterns) {
       res.status(403).json({ error: "Request denied by CORS policy" });
       return;
     }
-    const matched = patterns.allowAny || patterns.origins.has(origin.toLowerCase());
+    const matched = matcher.allows(origin);
     if (matched) {
       res.setHeader("Access-Control-Allow-Origin", origin);
       res.setHeader("Vary", "Origin");
@@ -1007,6 +1143,24 @@ function allowOriginCors(patterns) {
 }
 __name(allowOriginCors, "allowOriginCors");
 function hostAllowlist(bind, getPort) {
+  const primaryGate = buildPrimaryHostGate(bind, getPort);
+  return (req, res, next) => {
+    const listener = listenerIdentityOf(req);
+    if (listener.kind !== "local-control") {
+      primaryGate(req, res, next);
+      return;
+    }
+    const host = (req.headers.host || "").toLowerCase();
+    const browserHost = listener.origin === void 0 ? void 0 : new URL(listener.origin).host.toLowerCase();
+    if (listener.authority === void 0 || host !== listener.authority && host !== browserHost) {
+      res.status(403).json({ error: "Invalid Host header" });
+      return;
+    }
+    next();
+  };
+}
+__name(hostAllowlist, "hostAllowlist");
+function buildPrimaryHostGate(bind, getPort) {
   if (!isLoopbackBind(bind)) {
     return (_req, _res, next) => next();
   }
@@ -1039,13 +1193,15 @@ function hostAllowlist(bind, getPort) {
     next();
   };
 }
-__name(hostAllowlist, "hostAllowlist");
-function bearerAuth(token) {
-  if (!token) {
-    return (_req, _res, next) => next();
-  }
-  const expected = createHash("sha256").update(token, "utf8").digest();
+__name(buildPrimaryHostGate, "buildPrimaryHostGate");
+function bearerAuth(source) {
+  const credentials = typeof source === "object" && source !== null ? source : singleTokenCredentials(source);
   return (req, res, next) => {
+    const listener = listenerIdentityOf(req);
+    if (credentials.isOpen(listener)) {
+      next();
+      return;
+    }
     const header = req.headers.authorization;
     if (!header) {
       res.status(401).json({ error: "Unauthorized" });
@@ -1065,26 +1221,35 @@ function bearerAuth(token) {
     while (credStart < header.length && (header.charCodeAt(credStart) === 32 || header.charCodeAt(credStart) === 9)) {
       credStart++;
     }
-    const credentials = header.slice(credStart);
-    if (credentials.length === 0) {
+    const presented = header.slice(credStart);
+    if (presented.length === 0) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
-    const candidate = createHash("sha256").update(credentials, "utf8").digest();
-    if (!timingSafeEqual(candidate, expected)) {
+    if (!credentials.verify(presented, listener)) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
+    req[AUTHENTICATED_REQUEST] = true;
     next();
   };
 }
 __name(bearerAuth, "bearerAuth");
+var AUTHENTICATED_REQUEST = Symbol("qwen.serve.authenticatedRequest");
+function requestWasAuthenticated(req) {
+  return req[AUTHENTICATED_REQUEST] === true;
+}
+__name(requestWasAuthenticated, "requestWasAuthenticated");
 function createMutationGate(deps) {
   const passthrough = /* @__PURE__ */ __name((_req, _res, next) => next(), "passthrough");
   if (deps.requireAuth || deps.tokenConfigured) {
     return () => passthrough;
   }
-  const strictDenier = /* @__PURE__ */ __name((_req, res) => {
+  const strictDenier = /* @__PURE__ */ __name((req, res, next) => {
+    if (requestWasAuthenticated(req)) {
+      next();
+      return;
+    }
     res.status(401).json({
       error: "This route requires the daemon to be configured with a bearer token. Set QWEN_SERVER_TOKEN or pass --token to enable bearer auth.",
       code: "token_required"
@@ -1267,6 +1432,11 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_source_metadata: { since: "v1" },
   session_side_task: { since: "v1" },
   session_prompt: { since: "v1" },
+  session_turn_status: { since: "v1" },
+  // Prompts and mid-turn messages support session-scoped media uploaded once
+  // and referenced by `mediaId`. The bridge resolves bytes only when ACP input
+  // is dispatched, keeping base64 out of JSON and SSE payloads.
+  session_media: { since: "v1" },
   session_mid_turn_message_mutation: { since: "v1" },
   // Daemon-owned reconciliation surface for mid-turn messages:
   // `GET /session/:id/mid-turn-messages` returns the messages still waiting
@@ -1600,6 +1770,17 @@ var SERVE_CAPABILITY_REGISTRY = {
   // This remains independent from active export so older daemons cannot ignore
   // archive intent and return an active transcript with the same session id.
   workspace_archived_session_export: { since: "v1" },
+  // Workspace-qualified, memory-only session live-state snapshot plus the
+  // in-memory catalog version token
+  // (`GET /workspaces/:workspace/sessions/live-state`). Independent from
+  // `workspace_qualified_rest_core`: released daemons can advertise that tag
+  // without implementing this route, so clients must pre-flight it directly.
+  // The route stays subject to the per-workspace trust check even when the
+  // tag is advertised.
+  workspace_session_live_state: { since: "v1" },
+  // Workspace-qualified metadata updates for active, inactive, and archived
+  // persisted sessions.
+  workspace_session_metadata: { since: "v1" },
   // Workspace-qualified ACP transport (issue #6378 Phase 4):
   // `/workspaces/:workspace/acp` mounts a per-runtime ACP dispatcher (HTTP +
   // WebSocket) for each registered workspace, with per-runtime device-flow and
@@ -1880,6 +2061,309 @@ async function createManagedScratchDirectory(root) {
 }
 __name(createManagedScratchDirectory, "createManagedScratchDirectory");
 
+// packages/cli/src/serve/conversations/conversation-runtime-errors.ts
+init_esbuild_shims();
+var DEFAULT_MESSAGES = {
+  conversation_runtime_in_use: "The Conversations runtime is owned by another daemon.",
+  conversation_runtime_unavailable: "The Conversations runtime is temporarily unavailable.",
+  conversation_root_compromised: "The Conversations root could not be verified.",
+  conversation_runtime_ownership_compromised: "The Conversations runtime ownership state could not be verified."
+};
+var ConversationRuntimeOwnershipError = class extends Error {
+  constructor(code, retryable, options) {
+    super(DEFAULT_MESSAGES[code], options);
+    this.code = code;
+    this.retryable = retryable;
+    this.name = "ConversationRuntimeOwnershipError";
+  }
+  static {
+    __name(this, "ConversationRuntimeOwnershipError");
+  }
+  status = 503;
+};
+function conversationRuntimeInUseError() {
+  return new ConversationRuntimeOwnershipError(
+    "conversation_runtime_in_use",
+    true
+  );
+}
+__name(conversationRuntimeInUseError, "conversationRuntimeInUseError");
+function conversationRuntimeUnavailableError(cause) {
+  return new ConversationRuntimeOwnershipError(
+    "conversation_runtime_unavailable",
+    true,
+    { cause }
+  );
+}
+__name(conversationRuntimeUnavailableError, "conversationRuntimeUnavailableError");
+function conversationRuntimeOwnershipCompromisedError(cause) {
+  return new ConversationRuntimeOwnershipError(
+    "conversation_runtime_ownership_compromised",
+    false,
+    { cause }
+  );
+}
+__name(conversationRuntimeOwnershipCompromisedError, "conversationRuntimeOwnershipCompromisedError");
+function conversationRootCompromisedError(cause) {
+  return new ConversationRuntimeOwnershipError(
+    "conversation_root_compromised",
+    false,
+    { cause }
+  );
+}
+__name(conversationRootCompromisedError, "conversationRootCompromisedError");
+
+// packages/cli/src/serve/serve-app-lifecycle.ts
+init_esbuild_shims();
+var SERVE_APP_LIFECYCLE = Symbol("qwen.serveAppLifecycle");
+var DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+var SECONDARY_CLOSE_TIMEOUT_MS = 2e3;
+function deferred() {
+  let resolve2;
+  let reject;
+  const promise = new Promise((resolvePromise, rejectPromise) => {
+    resolve2 = resolvePromise;
+    reject = rejectPromise;
+  });
+  void promise.catch(() => void 0);
+  return { promise, resolve: resolve2, reject };
+}
+__name(deferred, "deferred");
+var ServeAppLifecycleController = class {
+  static {
+    __name(this, "ServeAppLifecycleController");
+  }
+  admission = deferred();
+  server;
+  startupReady = true;
+  listenerReady = false;
+  listenerClosed = false;
+  sealed = false;
+  closePending;
+  ownership;
+  appDrain;
+  hostDrain;
+  bootStarter;
+  bootPending;
+  bootStarted = false;
+  bindServer(server, options = {}) {
+    if (this.server || server.listening || this.bootStarted || this.sealed) {
+      throw new Error(
+        "Serve app lifecycle must bind one server before its first listen."
+      );
+    }
+    this.server = server;
+    this.hostDrain = options.drainHost;
+    this.startupReady = options.startupReady === void 0;
+    server.once("listening", () => {
+      this.listenerReady = true;
+      if (this.sealed) {
+        server.close();
+        server.closeAllConnections();
+        return;
+      }
+      this.openAdmissionIfReady();
+    });
+    server.on("close", () => {
+      this.listenerClosed = true;
+      this.seal();
+      void this.close().catch(() => void 0);
+    });
+    server.on("error", (error) => {
+      if (!this.listenerReady && options.startupReady === void 0) {
+        this.seal(error);
+        void this.close().catch(() => void 0);
+      }
+    });
+    if (options.startupReady) {
+      void options.startupReady.then(
+        () => {
+          this.startupReady = true;
+          this.openAdmissionIfReady();
+        },
+        (error) => {
+          this.seal(error instanceof Error ? error : new Error(String(error)));
+        }
+      );
+    }
+  }
+  close(options = {}) {
+    if (this.closePending) return this.closePending;
+    const pending = this.closeOnce(options);
+    this.closePending = pending;
+    void pending.catch(() => {
+      if (this.closePending === pending) this.closePending = void 0;
+    });
+    return pending;
+  }
+  setOwnership(ownership) {
+    if (this.ownership) {
+      throw new Error("Serve app lifecycle ownership is already configured.");
+    }
+    this.ownership = ownership;
+  }
+  setAppDrain(drain) {
+    this.appDrain = drain;
+  }
+  setBootStarter(starter) {
+    this.bootStarter = starter;
+    this.openAdmissionIfReady();
+  }
+  async awaitBootAdmission() {
+    if (!this.server || this.sealed) {
+      throw conversationRuntimeUnavailableError();
+    }
+    try {
+      await this.admission.promise;
+    } catch (error) {
+      throw conversationRuntimeUnavailableError(error);
+    }
+    if (this.sealed) {
+      throw conversationRuntimeUnavailableError();
+    }
+  }
+  async startBoot(starter = this.bootStarter) {
+    await this.awaitBootAdmission();
+    await this.beginBoot(starter);
+  }
+  getBootPromise() {
+    return this.bootPending;
+  }
+  isBootStarted() {
+    return this.bootStarted;
+  }
+  sealBoot() {
+    this.seal();
+  }
+  openAdmissionIfReady() {
+    if (this.sealed || !this.server || !this.listenerReady || !this.startupReady) {
+      return;
+    }
+    this.admission.resolve();
+    const bootStarter = this.bootStarter;
+    if (bootStarter && !this.bootStarted) {
+      void this.beginBoot(bootStarter)?.catch(() => void 0);
+    }
+  }
+  beginBoot(starter) {
+    if (!starter) return void 0;
+    if (this.sealed) {
+      return Promise.reject(conversationRuntimeUnavailableError());
+    }
+    if (this.bootPending) return this.bootPending;
+    this.bootStarted = true;
+    const pending = Promise.resolve().then(starter);
+    const tracked = pending.finally(() => {
+      if (this.bootPending === tracked) this.bootPending = void 0;
+    });
+    this.bootPending = tracked;
+    void tracked.catch(() => void 0);
+    return tracked;
+  }
+  seal(error) {
+    if (this.sealed) return;
+    this.sealed = true;
+    this.admission.reject(error ?? conversationRuntimeUnavailableError());
+  }
+  async closeOnce(options) {
+    this.seal();
+    const drains = [
+      this.startDrain(this.appDrain),
+      this.startDrain(this.hostDrain),
+      this.bootPending?.catch(() => void 0)
+    ].filter((value) => value !== void 0);
+    const listenerClose = this.closeListener(
+      options.timeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS
+    );
+    const results = await Promise.allSettled([...drains, listenerClose]);
+    const errors = results.filter(
+      (result) => result.status === "rejected"
+    ).map((result) => result.reason);
+    if (errors.length === 1) {
+      throw errors[0];
+    }
+    if (errors.length > 1) {
+      throw new AggregateError(errors, "Serve app shutdown is incomplete.");
+    }
+    await this.ownership?.release();
+  }
+  startDrain(drain) {
+    if (!drain) return void 0;
+    try {
+      return drain();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+  }
+  closeListener(timeoutMs) {
+    if (!this.server || this.listenerClosed || !this.listenerReady && !this.server.listening) {
+      return Promise.resolve();
+    }
+    const server = this.server;
+    if (!server.listening) {
+      return this.waitForClosingListener(server, timeoutMs);
+    }
+    return new Promise((resolve2, reject) => {
+      let secondaryTimer;
+      const forceTimer = setTimeout(
+        () => {
+          server.closeAllConnections();
+          secondaryTimer = setTimeout(() => {
+            reject(new Error("The serve listener did not confirm shutdown."));
+          }, SECONDARY_CLOSE_TIMEOUT_MS);
+          secondaryTimer.unref();
+        },
+        Math.max(0, timeoutMs)
+      );
+      forceTimer.unref();
+      server.close((error) => {
+        clearTimeout(forceTimer);
+        if (secondaryTimer) clearTimeout(secondaryTimer);
+        if (error) reject(error);
+        else {
+          this.listenerClosed = true;
+          resolve2();
+        }
+      });
+    });
+  }
+  waitForClosingListener(server, timeoutMs) {
+    return new Promise((resolve2, reject) => {
+      let secondaryTimer;
+      const onClose = /* @__PURE__ */ __name(() => {
+        server.off("close", onClose);
+        clearTimeout(forceTimer);
+        if (secondaryTimer) clearTimeout(secondaryTimer);
+        this.listenerClosed = true;
+        resolve2();
+      }, "onClose");
+      const forceTimer = setTimeout(
+        () => {
+          server.closeAllConnections();
+          secondaryTimer = setTimeout(() => {
+            server.off("close", onClose);
+            reject(new Error("The serve listener did not confirm shutdown."));
+          }, SECONDARY_CLOSE_TIMEOUT_MS);
+          secondaryTimer.unref();
+        },
+        Math.max(0, timeoutMs)
+      );
+      forceTimer.unref();
+      server.once("close", onClose);
+      if (this.listenerClosed) onClose();
+    });
+  }
+};
+function installServeAppLifecycle(app, lifecycle = new ServeAppLifecycleController()) {
+  const locals = app.locals;
+  if (locals[SERVE_APP_LIFECYCLE]) {
+    throw new Error("Serve app lifecycle is already installed.");
+  }
+  locals[SERVE_APP_LIFECYCLE] = lifecycle;
+  return lifecycle;
+}
+__name(installServeAppLifecycle, "installServeAppLifecycle");
+
 // packages/cli/src/serve/server/request-helpers.ts
 init_esbuild_shims();
 function sendJsonBodyParserError(res, err) {
@@ -2349,6 +2833,70 @@ __name(resolveAcpHttpEnabled, "resolveAcpHttpEnabled");
 // packages/cli/src/serve/daemon-status.ts
 init_esbuild_shims();
 
+// packages/cli/src/serve/acp-http/pre-attach-budget.ts
+init_esbuild_shims();
+var ACP_PRE_ATTACH_MAX_FRAMES_PER_STREAM = 256;
+var ACP_PRE_ATTACH_MAX_FRAMES_PER_CONNECTION = 1024;
+var ACP_PRE_ATTACH_MAX_FRAMES_GLOBAL = 4096;
+var ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_PER_CONNECTION = 64 * 1024 * 1024;
+var ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_GLOBAL = 256 * 1024 * 1024;
+var AcpPreAttachBudget = class {
+  constructor(limits = {
+    maxFrames: ACP_PRE_ATTACH_MAX_FRAMES_GLOBAL,
+    maxBytes: ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_GLOBAL
+  }) {
+    this.limits = limits;
+  }
+  static {
+    __name(this, "AcpPreAttachBudget");
+  }
+  usedFrames = 0;
+  usedBytes = 0;
+  pendingDeliveryFrames = 0;
+  highWaterFrames = 0;
+  highWaterBytes = 0;
+  guardFailures = 0;
+  tryReserve(bytes) {
+    if (this.usedFrames >= this.limits.maxFrames || bytes > this.limits.maxBytes - this.usedBytes) {
+      this.guardFailures += 1;
+      return void 0;
+    }
+    this.usedFrames += 1;
+    this.usedBytes += bytes;
+    this.highWaterFrames = Math.max(this.highWaterFrames, this.usedFrames);
+    this.highWaterBytes = Math.max(this.highWaterBytes, this.usedBytes);
+    let released = false;
+    let pendingDelivery = false;
+    return {
+      markPendingDelivery: /* @__PURE__ */ __name(() => {
+        if (released || pendingDelivery) return;
+        pendingDelivery = true;
+        this.pendingDeliveryFrames += 1;
+      }, "markPendingDelivery"),
+      release: /* @__PURE__ */ __name(() => {
+        if (released) return;
+        released = true;
+        if (pendingDelivery) this.pendingDeliveryFrames -= 1;
+        this.usedFrames -= 1;
+        this.usedBytes -= bytes;
+      }, "release")
+    };
+  }
+  recordGuardFailure() {
+    this.guardFailures += 1;
+  }
+  snapshot() {
+    return {
+      usedFrames: this.usedFrames,
+      usedBytes: this.usedBytes,
+      pendingDeliveryFrames: this.pendingDeliveryFrames,
+      highWaterFrames: this.highWaterFrames,
+      highWaterBytes: this.highWaterBytes,
+      guardFailures: this.guardFailures
+    };
+  }
+};
+
 // packages/cli/src/serve/daemon-memory-pressure.ts
 init_esbuild_shims();
 import { getHeapStatistics } from "node:v8";
@@ -2458,8 +3006,10 @@ async function buildDaemonStatusResponse(detail, input) {
   const bridgeSnapshot = input.bridge.getDaemonStatusSnapshot();
   const lastActivity = input.bridge.lastActivityAt ?? null;
   const workspaceRuntimes = input.workspaceRegistry?.list();
-  const workspaceSnapshots = workspaceRuntimes?.map((runtime) => ({
+  const aggregateRuntimes = input.workspaceRegistry?.listAll?.() ?? workspaceRuntimes;
+  const workspaceSnapshots = aggregateRuntimes?.map((runtime) => ({
     workspaceCwd: runtime.workspaceCwd,
+    internal: isInternalWorkspaceRuntime(runtime),
     snapshot: runtime.bridge === input.bridge ? bridgeSnapshot : runtime.bridge.getDaemonStatusSnapshot(),
     lastActivity: runtime.bridge === input.bridge ? lastActivity : runtime.bridge.lastActivityAt ?? null
   })) ?? [
@@ -2485,7 +3035,7 @@ async function buildDaemonStatusResponse(detail, input) {
   if (memoryBudget) {
     const managedRuntimes = input.workspaceRegistry?.listManaged();
     const activeAcpChildCount = managedRuntimes ? managedRuntimes.filter((runtime) => runtime.bridge.isChannelLive()).length : workspaceSnapshots.filter((item) => item.snapshot.channelLive).length;
-    const registeredWorkspaceCount = input.workspaceRegistry ? input.workspaceRegistry.listEntries().length : workspaceSnapshots.length;
+    const registeredWorkspaceCount = input.workspaceRegistry ? (input.workspaceRegistry.listAllEntries?.() ?? input.workspaceRegistry.listEntries()).length : workspaceSnapshots.length;
     let childRssBytesTotal = 0;
     let childRssSampled = 0;
     let oldestChildReadingAgeMs = null;
@@ -2558,7 +3108,7 @@ async function buildDaemonStatusResponse(detail, input) {
     }
     derivedQueuedPromptsByWorkspace[index] = derivedQueuedPromptsForWorkspace;
   }
-  const queuedPrompts = workspaceRuntimes?.reduce(
+  const queuedPrompts = aggregateRuntimes?.reduce(
     (sum, runtime, index) => sum + (runtime.bridge.pendingPromptTotal ?? derivedQueuedPromptsByWorkspace[index] ?? 0),
     0
   ) ?? input.bridge.pendingPromptTotal ?? derivedQueuedPrompts;
@@ -2616,7 +3166,7 @@ async function buildDaemonStatusResponse(detail, input) {
     full = await buildFullStatus(
       input,
       acpAggregate,
-      workspaceSnapshots.flatMap((item) => item.snapshot.sessions)
+      workspaceSnapshots.filter((item) => item.internal !== true).flatMap((item) => item.snapshot.sessions)
     );
     pushFullIssues(issues, full);
   }
@@ -2668,6 +3218,11 @@ async function buildDaemonStatusResponse(detail, input) {
       channelIdleTimeoutMs: bridgeSnapshot.limits.channelIdleTimeoutMs,
       sessionIdleTimeoutMs: bridgeSnapshot.limits.sessionIdleTimeoutMs,
       acpConnectionCap: acpSnapshot?.connectionCap ?? null,
+      acpPreAttachMaxFramesPerStream: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_FRAMES_PER_STREAM : null,
+      acpPreAttachMaxFramesPerConnection: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_FRAMES_PER_CONNECTION : null,
+      acpPreAttachMaxFramesGlobal: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_FRAMES_GLOBAL : null,
+      acpPreAttachMaxPayloadBytesPerConnection: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_PER_CONNECTION : null,
+      acpPreAttachMaxPayloadBytesGlobal: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_GLOBAL : null,
       memory: toDaemonStatusMemoryLimits(
         memoryBudget,
         input.getChildHeapPolicySnapshot?.(),
@@ -2712,7 +3267,17 @@ async function buildDaemonStatusResponse(detail, input) {
           sessionStreams: acpAggregate?.sessionStreams ?? 0,
           sseStreams: acpAggregate?.sseStreams ?? 0,
           wsStreams: acpAggregate?.wsStreams ?? 0,
-          pendingClientRequests: acpAggregate?.pendingClientRequests ?? 0
+          pendingClientRequests: acpAggregate?.pendingClientRequests ?? 0,
+          preAttach: {
+            bufferedConnectionFrames: acpAggregate?.bufferedConnectionFrames ?? 0,
+            bufferedSessionFrames: acpAggregate?.bufferedSessionFrames ?? 0,
+            pendingDeliveryFrames: acpAggregate?.pendingDeliveryFrames ?? 0,
+            usedFrames: acpAggregate?.preAttach.usedFrames ?? 0,
+            usedBytes: acpAggregate?.preAttach.usedBytes ?? 0,
+            highWaterFrames: acpAggregate?.preAttach.highWaterFrames ?? 0,
+            highWaterBytes: acpAggregate?.preAttach.highWaterBytes ?? 0,
+            guardFailures: acpAggregate?.preAttach.guardFailures ?? 0
+          }
         }
       },
       rateLimit: {
@@ -2722,7 +3287,7 @@ async function buildDaemonStatusResponse(detail, input) {
       ...input.getPerfSnapshot ? { perf: input.getPerfSnapshot() } : {},
       ...input.getMetricsSeries ? { metrics: { series: input.getMetricsSeries() } } : {},
       activity: {
-        activePrompts: workspaceRuntimes?.reduce(
+        activePrompts: aggregateRuntimes?.reduce(
           (sum, runtime) => sum + (runtime.bridge.activePromptCount ?? 0),
           0
         ) ?? input.bridge.activePromptCount ?? 0,
@@ -2793,6 +3358,7 @@ async function buildFullStatus(input, acpSnapshot, sessions) {
   ]);
   return {
     sessions,
+    acpMounts: acpSnapshot?.mounts ?? [],
     acpConnections: acpSnapshot?.connections ?? [],
     workspace: {
       mcp,
@@ -2851,12 +3417,12 @@ async function withTimeout(promise, section, timeoutMs) {
 }
 __name(withTimeout, "withTimeout");
 function pushRuntimeIssues(issues, acpSnapshot, acpAggregate, rateLimitHits, input, channelWorker, channelWorkers, totalAdmissionSnapshot, workspaceSnapshots) {
-  for (const { workspaceCwd, snapshot } of workspaceSnapshots) {
+  for (const { workspaceCwd, internal, snapshot } of workspaceSnapshots) {
     if (snapshot.limits.maxSessions !== null && snapshot.limits.maxSessions > 0 && snapshot.sessionCount / snapshot.limits.maxSessions >= CAPACITY_WARNING_RATIO) {
       issues.push({
         code: "session_capacity_high",
         severity: "warning",
-        message: workspaceSnapshots.length > 1 ? `Workspace ${workspaceCwd} active sessions are at ${snapshot.sessionCount}/${snapshot.limits.maxSessions}.` : `Active sessions are at ${snapshot.sessionCount}/${snapshot.limits.maxSessions}.`
+        message: workspaceSnapshots.length > 1 ? internal ? `An internal runtime's active sessions are at ${snapshot.sessionCount}/${snapshot.limits.maxSessions}.` : `Workspace ${workspaceCwd} active sessions are at ${snapshot.sessionCount}/${snapshot.limits.maxSessions}.` : `Active sessions are at ${snapshot.sessionCount}/${snapshot.limits.maxSessions}.`
       });
     }
   }
@@ -2907,7 +3473,7 @@ function pushRuntimeIssues(issues, acpSnapshot, acpAggregate, rateLimitHits, inp
     issues.push({
       code: "acp_channel_down",
       severity: "error",
-      message: downWorkspaces.length === 1 ? `Active sessions exist but the ACP channel is not live for ${downWorkspaces[0].workspaceCwd}.` : `Active sessions exist but the ACP channel is not live for ${downWorkspaces.length} workspace(s).`
+      message: downWorkspaces.length === 1 ? downWorkspaces[0].internal ? "Active sessions exist but the ACP channel is not live for an internal runtime." : `Active sessions exist but the ACP channel is not live for ${downWorkspaces[0].workspaceCwd}.` : `Active sessions exist but the ACP channel is not live for ${downWorkspaces.length} workspace(s).`
     });
   }
   if (input.opts.rateLimit === true && sumRateHits(rateLimitHits) > 0) {
@@ -3494,11 +4060,18 @@ export {
   createBridgeFileSystemAdapter,
   PathMutexRegistry,
   isDeepHealthQuery,
+  CredentialStore,
+  singleTokenCredentials,
+  tagListener,
+  listenerIdentityOf,
+  listenerIdentityOfSocket,
   denyBrowserOriginCors,
   parseAllowOriginPatterns,
+  MutableOriginAllowlist,
   allowOriginCors,
   hostAllowlist,
   bearerAuth,
+  requestWasAuthenticated,
   createMutationGate,
   ClientMcpSenderRegistry,
   createClientMcpServerProvider,
@@ -3510,6 +4083,13 @@ export {
   isScratchRootCompatible,
   prepareManagedScratchRoot,
   createManagedScratchDirectory,
+  ConversationRuntimeOwnershipError,
+  conversationRuntimeInUseError,
+  conversationRuntimeUnavailableError,
+  conversationRuntimeOwnershipCompromisedError,
+  conversationRootCompromisedError,
+  ServeAppLifecycleController,
+  installServeAppLifecycle,
   sendJsonBodyParserError,
   CLIENT_ID_HEADER,
   MAX_CLIENT_ID_LENGTH,
@@ -3534,6 +4114,12 @@ export {
   setRateLimiter,
   getRateLimiter,
   resolveAcpHttpEnabled,
+  ACP_PRE_ATTACH_MAX_FRAMES_PER_STREAM,
+  ACP_PRE_ATTACH_MAX_FRAMES_PER_CONNECTION,
+  ACP_PRE_ATTACH_MAX_FRAMES_GLOBAL,
+  ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_PER_CONNECTION,
+  ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_GLOBAL,
+  AcpPreAttachBudget,
   toDaemonStatusMemoryLimits,
   parseDaemonStatusDetail,
   buildDaemonStatusResponse,