@qwen-code/qwen-code 0.21.13 → 0.21.14-preview.0

package/chunks/{server-TC4A7AAZ.js → server-IZCKLIYQ.js}

@@ -20,13 +20,13 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-ZZO74WKW.js";
+} from "./chunk-ZXEAEZFN.js";
 import {
   deriveWebSocketBase,
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-AXN7UPYQ.js";
+} from "./chunk-WSSH2BNO.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -38,15 +38,15 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-RLKC46YT.js";
+} from "./chunk-EOCQCNV4.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-BZ263IKX.js";
+} from "./chunk-OVY67CYC.js";
 import {
   escapeAnsiCtrlCodes
-} from "./chunk-4NFY2S7N.js";
-import "./chunk-3U3VAL47.js";
+} from "./chunk-E7REAOTN.js";
+import "./chunk-57KOJ2KZ.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-3Z43GZUQ.js";
@@ -62,11 +62,13 @@ import {
   CLIENT_ID_RE,
   ClientMcpSenderRegistry,
   ConversationRuntimeOwnershipError,
+  CredentialStore,
   DeviceFlowRegistry,
   MAX_CLIENT_ID_LENGTH,
   MAX_CONCURRENT_VOICE_SESSIONS,
   MAX_SERVER_NAME_LENGTH,
   MAX_TOOL_NAME_LENGTH,
+  MutableOriginAllowlist,
   PathMutexRegistry,
   QWEN_CDP_MCP_COMMAND_ENV,
   TooManyActiveDeviceFlowsError,
@@ -88,7 +90,6 @@ import {
   createManagedScratchDirectory,
   createMutationGate,
   createRateLimiter,
-  denyBrowserOriginCors,
   detectFromLoopback,
   getAdvertisedServeFeatures,
   getDeferredRuntimeRequestTiming,
@@ -99,6 +100,8 @@ import {
   isBrowserAutomationMcpAvailable,
   isDeepHealthQuery,
   isScratchRootCompatible,
+  listenerIdentityOf,
+  listenerIdentityOfSocket,
   parseAllowOriginPatterns,
   parseAndValidateWorkspaceClientId,
   parseClientIdHeader,
@@ -107,6 +110,7 @@ import {
   parseMaxQueuedQuery,
   parseOptionalWorkspaceCwd,
   parsePermissionVoteBody,
+  requestWasAuthenticated,
   requireSessionId,
   resolveAcpHttpEnabled,
   resolveCdpMcpCommand,
@@ -116,9 +120,11 @@ import {
   sendJsonBodyParserError,
   setDeviceFlowRegistry,
   setRateLimiter,
+  singleTokenCredentials,
+  tagListener,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-O565M6A4.js";
+} from "./chunk-UYDGFWIJ.js";
 import "./chunk-VGHZT6JR.js";
 import {
   isLoopbackBind,
@@ -129,7 +135,7 @@ import "./chunk-UXEO7E3V.js";
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-XIT3GURH.js";
+} from "./chunk-S6CXQKDD.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -143,14 +149,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-EZ5RP345.js";
+} from "./chunk-E5RS7LF4.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-7UXUJ5T3.js";
+} from "./chunk-SBRIBTYN.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -158,12 +164,12 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-6ORZ2EDC.js";
+} from "./chunk-PPTM4O4R.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-QIH2HAEN.js";
+} from "./chunk-7OCSX7FC.js";
 import "./chunk-WGHHA7ZH.js";
 import {
   createTotalSessionAdmissionController
@@ -184,18 +190,18 @@ import {
 } from "./chunk-4JRM2BSM.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-PP4FUZNV.js";
+} from "./chunk-55PIFSP2.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-OOQUVWIG.js";
-import "./chunk-NTTBXH7U.js";
-import "./chunk-XHRY7BXD.js";
+} from "./chunk-6PDOHRN6.js";
+import "./chunk-UGK4K2N2.js";
+import "./chunk-G6FFFICU.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-LJQAUZMR.js";
+} from "./chunk-VGAAAMRD.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -205,17 +211,17 @@ import "./chunk-WCCLLK7X.js";
 import "./chunk-OCPBI7J5.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-YEYY7TEP.js";
+} from "./chunk-P425IVUK.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-ZYYTZUI2.js";
+} from "./chunk-ISRHAMNL.js";
 import {
   snapshotProcessEnv
-} from "./chunk-NM5V5OVW.js";
+} from "./chunk-GV3OIADZ.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-OY5RNSV4.js";
+} from "./chunk-OSAFWBNR.js";
 import "./chunk-BGXZBI5B.js";
 import "./chunk-Z4X5MTRT.js";
 import {
@@ -234,32 +240,32 @@ import {
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-TUGSVUJB.js";
-import "./chunk-QV5YN5YD.js";
+} from "./chunk-2JXDFSVE.js";
+import "./chunk-HGPMOXLZ.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-OD2WU5QY.js";
+} from "./chunk-NRPXRNN4.js";
 import "./chunk-45NQKMYB.js";
 import {
   supportedChannelCatalog
-} from "./chunk-A4QRWUDE.js";
+} from "./chunk-5IYS4WWR.js";
 import "./chunk-V6WHFGST.js";
 import {
   getStableLiveDiscoveryBaseDir
-} from "./chunk-TS6625XH.js";
+} from "./chunk-5MK45KZ3.js";
 import {
   LIVE_HOST_BUNDLE_ID,
   LIVE_HOST_PROTOCOL_VERSION,
   LIVE_INPUT_AUDIO_EPOCH_BYTES
 } from "./chunk-NKLP3DCK.js";
-import "./chunk-NHDR76JX.js";
+import "./chunk-BQWNIPTE.js";
 import {
   STATUS_SCHEMA_VERSION,
   SessionRestoreTimeoutError,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-QNQAPSN2.js";
+} from "./chunk-UC67T4SF.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
@@ -270,13 +276,13 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-JNDY2MDR.js";
+} from "./chunk-BOJNAPUE.js";
 import {
   CHANNEL_PROMPT_META_KEY,
   DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   REQUESTED_SESSION_ID_META_KEY,
   gradeActiveWorkCoverage
-} from "./chunk-S5DWMTHO.js";
+} from "./chunk-WP4WIUOJ.js";
 import {
   BranchWhilePromptActiveError,
   BridgeChannelQuarantinedError,
@@ -356,26 +362,26 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-A267JX7H.js";
+} from "./chunk-OLZSWUZR.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-E23IPNGS.js";
+import "./chunk-YFPZ3NNC.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import {
   detectSystemLanguage,
   resolveLanguageSetting
-} from "./chunk-HUTNYWBG.js";
+} from "./chunk-IOTPI425.js";
 import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-MC4TLKEI.js";
-import "./chunk-MS7GNABG.js";
-import "./chunk-CU6GJD55.js";
+import "./chunk-SGLPDKRT.js";
+import "./chunk-CXJHQVEK.js";
+import "./chunk-6DFPR7CS.js";
 import "./chunk-WZMH7II3.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-IWPYVAO2.js";
+} from "./chunk-YXC7JYUI.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -448,12 +454,13 @@ import {
   resolveBranchName,
   resolveProviderProtocol,
   shouldShowStep,
+  sleepInhibitor,
   stripTerminalControlSequences,
   watchRepoBranch,
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-4S5337WV.js";
+} from "./chunk-XC377TLN.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
@@ -461,12 +468,12 @@ import "./chunk-CQ35AJ4Z.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-DGZEMW5R.js";
-import "./chunk-WSH6GRKG.js";
-import "./chunk-CKSJECTU.js";
-import "./chunk-OVZPVYZB.js";
+} from "./chunk-FS5NGKWC.js";
+import "./chunk-SLILKYV2.js";
+import "./chunk-NVRMCWTP.js";
+import "./chunk-AKBOLMUF.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-5EYKMUUY.js";
+import "./chunk-SR2LYSMT.js";
 import {
   nextFireTime,
   parseCron
@@ -479,8 +486,8 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-Y3YCSWG5.js";
-import "./chunk-UPDOZBWO.js";
+} from "./chunk-OBJYN4MX.js";
+import "./chunk-2C6HJMG3.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
@@ -488,13 +495,13 @@ import "./chunk-CPBF7KYF.js";
 import {
   APPROVAL_MODES
 } from "./chunk-RWDNJBWN.js";
-import "./chunk-25EYDK42.js";
+import "./chunk-WPVUOVYX.js";
 import "./chunk-MIPFDQAF.js";
 import "./chunk-MLXTMF7H.js";
 import "./chunk-KV27IEHM.js";
 import "./chunk-E3DYKPYZ.js";
-import "./chunk-OMLJNPBE.js";
-import "./chunk-OXCMMLED.js";
+import "./chunk-4ZMS3JCR.js";
+import "./chunk-DGJ7O55J.js";
 import {
   addDaemonRequestAttribute,
   captureDaemonTelemetryContext,
@@ -506,7 +513,7 @@ import {
   recordDaemonHttpResponse,
   runWithDaemonTelemetryContext,
   withDaemonRequestSpan
-} from "./chunk-TIGA2IVL.js";
+} from "./chunk-OO4FKHLO.js";
 import "./chunk-SAH4BD2J.js";
 import "./chunk-XLLKYULU.js";
 import "./chunk-PT4I7NBA.js";
@@ -529,7 +536,7 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-GMIEIY3Y.js";
+} from "./chunk-I3N2Z25H.js";
 import "./chunk-NAVJD2PQ.js";
 import "./chunk-ROIYNTHJ.js";
 import "./chunk-2B2BF7P7.js";
@@ -537,13 +544,18 @@ import "./chunk-P3QQPMQA.js";
 import "./chunk-YZHRN3CF.js";
 import "./chunk-FAAUPSY2.js";
 import "./chunk-KM73TBQ4.js";
-import "./chunk-MPHPFVKK.js";
 import "./chunk-AXMWHKXA.js";
 import "./chunk-GLCZKT5V.js";
 import "./chunk-DJ2GSRLV.js";
 import "./chunk-QFJ5JHQR.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-XWRJCPHC.js";
+import {
+  parseLineTolerant,
+  read
+} from "./chunk-KC4WMLZO.js";
+import "./chunk-YRLW2MSX.js";
+import "./chunk-VGC4I5JJ.js";
 import {
   CursorNotAtLineBoundaryError,
   LargeNonUtf8TextError,
@@ -551,29 +563,26 @@ import {
   decodeBufferWithEncodingInfoAsync,
   getAllGeminiMdFilenames,
   isUtf8CompatibleEncoding,
-  isWithinRoot,
-  parseLineTolerant,
-  read
-} from "./chunk-RVOJ2FBP.js";
-import "./chunk-YRLW2MSX.js";
-import "./chunk-VGC4I5JJ.js";
+  isWithinRoot
+} from "./chunk-3PWCMXIR.js";
 import "./chunk-CHHABXPE.js";
 import "./chunk-MA2HEDVP.js";
 import "./chunk-XUJNK7Y6.js";
 import "./chunk-6HY6IF3Z.js";
-import "./chunk-4PKCUT7F.js";
+import "./chunk-QIHHJKXT.js";
 import "./chunk-F6WFNA7U.js";
-import "./chunk-46UV252V.js";
+import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
+import "./chunk-YHC2EYYG.js";
 import "./chunk-CPHEPGAO.js";
-import "./chunk-P7MPQI75.js";
-import "./chunk-FDGGZIYW.js";
+import "./chunk-DVR7XKO5.js";
+import "./chunk-YECDICIO.js";
 import {
   redactUrlCredentials,
   stripAnsiAndControl
-} from "./chunk-EL5SXY3T.js";
+} from "./chunk-XT4RKHVE.js";
 import "./chunk-HHJLM3WQ.js";
-import "./chunk-K5IDV3PC.js";
+import "./chunk-D34RDOLP.js";
 import {
   FatalConfigError,
   Storage,
@@ -584,7 +593,8 @@ import {
 import "./chunk-VOQXFAY5.js";
 import {
   writeStderrLine,
-  writeStderrLineSafe
+  writeStderrLineSafe,
+  writeStdoutLineSafe
 } from "./chunk-KGJGEEVR.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
@@ -607,12 +617,435 @@ import {
 
 // packages/cli/src/serve/server.ts
 init_esbuild_shims();
-var import_express6 = __toESM(require_express(), 1);
+var import_express7 = __toESM(require_express(), 1);
 import * as path18 from "node:path";
 
+// packages/cli/src/serve/local-control/index.ts
+init_esbuild_shims();
+
+// packages/cli/src/serve/local-control/lan-interfaces.ts
+init_esbuild_shims();
+import { networkInterfaces } from "node:os";
+function isLanIpv4(address) {
+  const octets = address.split(".").map((part) => Number(part));
+  if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o))) {
+    return false;
+  }
+  const [a, b] = octets;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
+}
+__name(isLanIpv4, "isLanIpv4");
+function isSoftwareNetwork(interfaceName) {
+  if (/vpn/i.test(interfaceName)) return true;
+  return /(^|[\s_.-])(utun|tun|tap|ppp|ipsec|wg|wireguard|tailscale|zerotier|zt[a-z0-9]*|hamachi|nordlynx|proton|wintun|docker|veth[0-9a-f]+|vmnet|vboxnet|vethernet|virtualbox|host[- ]only|podman|cni|lxcbr|lxdbr|flannel|virbr|br-[0-9a-f]+|bridge\d|anyconnect|globalprotect|pulse[\s-]secure|forticlient|fortinet|ivanti|cisco[\s_-]secure|citrix|sonicwall|cloudflare)(\d|[\s_.-]|$)/i.test(
+    interfaceName
+  );
+}
+__name(isSoftwareNetwork, "isSoftwareNetwork");
+function listLanCandidates(interfaces = networkInterfaces()) {
+  const candidates = [];
+  for (const [interfaceName, addresses] of Object.entries(interfaces).sort()) {
+    if (isSoftwareNetwork(interfaceName)) continue;
+    for (const address of addresses ?? []) {
+      if (address.family !== "IPv4" || address.internal) continue;
+      if (!isLanIpv4(address.address)) continue;
+      candidates.push({ interfaceName, address: address.address });
+    }
+  }
+  return candidates;
+}
+__name(listLanCandidates, "listLanCandidates");
+var NoLanInterfaceError = class extends Error {
+  static {
+    __name(this, "NoLanInterfaceError");
+  }
+  code = "no_lan_interface";
+  constructor() {
+    super(
+      "No private IPv4 address is available. Local Control needs the host to be on a local network (Wi-Fi or Ethernet)."
+    );
+    this.name = "NoLanInterfaceError";
+  }
+};
+var AmbiguousLanInterfaceError = class extends Error {
+  static {
+    __name(this, "AmbiguousLanInterfaceError");
+  }
+  code = "ambiguous_lan_interface";
+  candidates;
+  constructor(candidates) {
+    super(
+      "Multiple local networks are available; choose which one to expose: " + candidates.map((c) => `${c.interfaceName} (${c.address})`).join(", ")
+    );
+    this.name = "AmbiguousLanInterfaceError";
+    this.candidates = candidates;
+  }
+};
+var UnknownLanInterfaceError = class extends Error {
+  static {
+    __name(this, "UnknownLanInterfaceError");
+  }
+  code = "unknown_lan_interface";
+  constructor(requested) {
+    super(
+      `${requested} is not a private IPv4 address on this host right now. The network may have changed since the list was fetched.`
+    );
+    this.name = "UnknownLanInterfaceError";
+  }
+};
+function selectLanAddress(preferredAddress, interfaces = networkInterfaces()) {
+  const candidates = listLanCandidates(interfaces);
+  if (candidates.length === 0) throw new NoLanInterfaceError();
+  if (preferredAddress !== void 0) {
+    const match = candidates.find((c) => c.address === preferredAddress);
+    if (!match) throw new UnknownLanInterfaceError(preferredAddress);
+    return match;
+  }
+  if (candidates.length > 1) throw new AmbiguousLanInterfaceError(candidates);
+  return candidates[0];
+}
+__name(selectLanAddress, "selectLanAddress");
+
+// packages/cli/src/serve/local-control/service.ts
+init_esbuild_shims();
+import { randomBytes, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { createServer as createSecureServer } from "node:https";
+var CORS_KEY = "local-control";
+var MAX_CONNECTIONS = 64;
+var HEADERS_TIMEOUT_MS = 1e4;
+var KEEP_ALIVE_TIMEOUT_MS = 5e3;
+var REQUEST_TIMEOUT_MS = 30 * 6e4;
+var InvalidLocalControlTargetError = class extends Error {
+  static {
+    __name(this, "InvalidLocalControlTargetError");
+  }
+  code = "invalid_local_control_target";
+  constructor() {
+    super("Local Control target must be a valid URL target.");
+    this.name = "InvalidLocalControlTargetError";
+  }
+};
+var LocalControlService = class {
+  static {
+    __name(this, "LocalControlService");
+  }
+  #deps;
+  #server;
+  #token;
+  #selected;
+  #sleep;
+  #url;
+  #transition = Promise.resolve();
+  constructor(deps) {
+    this.#deps = deps;
+  }
+  get active() {
+    return this.#server !== void 0;
+  }
+  status() {
+    if (!this.#server || !this.#token || !this.#selected) {
+      return { active: false };
+    }
+    return {
+      active: true,
+      url: this.#url,
+      interfaceName: this.#selected.interfaceName,
+      address: this.#selected.address,
+      port: this.#deps.getPort(),
+      sleepInhibited: this.#sleep !== void 0 && sleepInhibitor.isRunning(),
+      encrypted: this.#deps.tlsPaths !== void 0
+    };
+  }
+  /**
+   * Bring the LAN listener up. Enabling while already active is a no-op that
+   * returns the existing status rather than re-minting: a second scan of the
+   * same QR must keep working, and silently invalidating the token the user is
+   * mid-pairing with would be indistinguishable from a bug.
+   */
+  async enable(options = {}) {
+    return this.#serialize(() => this.#enable(options));
+  }
+  async #enable(options) {
+    if (this.active) return this.status();
+    const selected = selectLanAddress(options.address);
+    const port = this.#deps.getPort();
+    const authority = `${selected.address}:${port}`;
+    const token = mintPairingToken();
+    const tls = this.#deps.tlsPaths;
+    const scheme = tls ? "https" : "http";
+    const origin = new URL(`${scheme}://${authority}`).origin;
+    const url = buildPairedUrl(scheme, authority, token.secret, options.target);
+    const server = tls ? createSecureServer(
+      { cert: readFileSync(tls.cert), key: readFileSync(tls.key) },
+      this.#deps.app
+    ) : createServer(this.#deps.app);
+    server.maxConnections = MAX_CONNECTIONS;
+    server.headersTimeout = HEADERS_TIMEOUT_MS;
+    server.requestTimeout = REQUEST_TIMEOUT_MS;
+    server.keepAliveTimeout = KEEP_ALIVE_TIMEOUT_MS;
+    tagListener(server, { kind: "local-control", authority, origin });
+    this.#deps.credentials.addPairingToken(token.id, token.secret);
+    this.#deps.originAllowlist.add(CORS_KEY, origin);
+    try {
+      this.#deps.attachWebSocket(server);
+      await listen(server, port, selected.address);
+    } catch (error2) {
+      this.#deps.detachWebSocket(server);
+      this.#deps.credentials.revokePairingToken(token.id);
+      this.#deps.originAllowlist.remove(CORS_KEY);
+      throw error2;
+    }
+    server.on("error", (error2) => {
+      writeStderrLine(
+        `qwen serve: Local Control listener error: ${error2.message}`
+      );
+    });
+    this.#server = server;
+    this.#token = token;
+    this.#selected = selected;
+    this.#url = url;
+    this.#sleep = sleepInhibitor.acquire("Qwen Code Local Control is active");
+    return this.status();
+  }
+  /**
+   * Take the LAN listener down and invalidate its credential.
+   *
+   * Revocation happens first and unconditionally. If closing the socket fails
+   * or hangs, the outcome is a listener that accepts connections no credential
+   * can authenticate — inert. The reverse order would leave a live, reachable
+   * listener with a valid token if teardown failed partway.
+   */
+  async disable() {
+    return this.#serialize(() => this.#disable());
+  }
+  async #disable() {
+    const server = this.#server;
+    const token = this.#token;
+    this.#server = void 0;
+    this.#token = void 0;
+    this.#selected = void 0;
+    this.#url = void 0;
+    if (token) this.#deps.credentials.revokePairingToken(token.id);
+    this.#deps.originAllowlist.remove(CORS_KEY);
+    this.#sleep?.release();
+    this.#sleep = void 0;
+    if (server) {
+      this.#deps.detachWebSocket(server);
+      await close(server);
+    }
+    return { active: false };
+  }
+  /**
+   * Called from the daemon's drain path. Local Control must not outlive the
+   * daemon that owns it: a listener surviving drain would hold the port and
+   * keep answering with a token nothing can revoke anymore.
+   */
+  async dispose() {
+    await this.disable();
+  }
+  async #serialize(operation) {
+    const previous = this.#transition;
+    let release;
+    this.#transition = new Promise((resolve7) => {
+      release = resolve7;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+};
+function mintPairingToken() {
+  const secret = randomBytes(32).toString("base64url");
+  return { id: randomUUID(), secret };
+}
+__name(mintPairingToken, "mintPairingToken");
+function buildPairedUrl(scheme, authority, secret, target) {
+  const url = new URL(`${scheme}://${authority}`);
+  if (target) {
+    let resolved;
+    try {
+      resolved = new URL(target, url);
+    } catch {
+      throw new InvalidLocalControlTargetError();
+    }
+    url.pathname = resolved.pathname;
+    url.search = resolved.search;
+  }
+  url.hash = `token=${encodeURIComponent(secret)}`;
+  return url.toString();
+}
+__name(buildPairedUrl, "buildPairedUrl");
+function listen(server, port, host) {
+  return new Promise((resolve7, reject) => {
+    const onError = /* @__PURE__ */ __name((error2) => {
+      server.removeListener("listening", onListening);
+      reject(error2);
+    }, "onError");
+    const onListening = /* @__PURE__ */ __name(() => {
+      server.removeListener("error", onError);
+      resolve7();
+    }, "onListening");
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, host);
+  });
+}
+__name(listen, "listen");
+function close(server) {
+  return new Promise((resolve7) => {
+    server.closeAllConnections?.();
+    server.close(() => resolve7());
+  });
+}
+__name(close, "close");
+
+// packages/cli/src/serve/routes/workspace-local-control.ts
+init_esbuild_shims();
+async function withUiData(status) {
+  let qrText;
+  if (status.url) {
+    try {
+      const { default: qrcode } = await import("./main-PXAUXNF2.js");
+      qrcode.setErrorLevel("Q");
+      qrcode.generate(status.url, { small: true }, (code) => {
+        qrText = code.trimEnd();
+      });
+    } catch {
+      qrText = void 0;
+    }
+  }
+  return { ...status, qrText, interfaces: listLanCandidates() };
+}
+__name(withUiData, "withUiData");
+function presentStatus(req, ui) {
+  if (requestWasAuthenticated(req)) return ui;
+  const { url: _url, qrText: _qrText, ...rest } = ui;
+  return { ...rest, urlRedacted: ui.url !== void 0 };
+}
+__name(presentStatus, "presentStatus");
+function requirePrimaryListener(req, res) {
+  if (listenerIdentityOf(req).kind === "primary") return true;
+  res.status(403).json({
+    error: "Local Control can only be enabled from the machine running the daemon.",
+    code: "local_control_remote_enable_denied"
+  });
+  return false;
+}
+__name(requirePrimaryListener, "requirePrimaryListener");
+function registerWorkspaceLocalControlRoutes(app, deps) {
+  app.get("/workspace/local-control", async (req, res) => {
+    res.status(200).json(presentStatus(req, await withUiData(deps.service.status())));
+  });
+  app.post(
+    "/workspace/local-control/enable",
+    deps.mutate(),
+    async (req, res) => {
+      if (!requirePrimaryListener(req, res)) return;
+      if (deps.webShellAvailable === false) {
+        res.status(409).json({
+          error: "Local Control requires the Web Shell.",
+          code: "local_control_web_shell_unavailable"
+        });
+        return;
+      }
+      if (deps.primaryBindHostname !== void 0 && !isLoopbackBind(deps.primaryBindHostname)) {
+        res.status(409).json({
+          error: "Local Control requires the daemon to be bound to loopback; restart it with --hostname 127.0.0.1.",
+          code: "local_control_non_loopback_bind"
+        });
+        return;
+      }
+      if (deps.isDaemonDraining?.()) {
+        res.status(503).json({
+          error: "Daemon is shutting down.",
+          code: "daemon_draining"
+        });
+        return;
+      }
+      const body = deps.safeBody(req) ?? {};
+      try {
+        const ui = await withUiData(
+          await deps.service.enable({
+            address: typeof body.address === "string" ? body.address : void 0,
+            target: typeof body.target === "string" ? body.target : void 0
+          })
+        );
+        if (!requestWasAuthenticated(req) && ui.url) {
+          writeStdoutLineSafe(
+            `qwen serve: Local Control pairing URL: ${ui.url}`
+          );
+        }
+        res.status(200).json(presentStatus(req, ui));
+      } catch (error2) {
+        sendEnableError(res, error2);
+      }
+    }
+  );
+  app.post(
+    "/workspace/local-control/disable",
+    deps.mutate(),
+    async (req, res) => {
+      if (listenerIdentityOf(req).kind === "local-control") {
+        queueMicrotask(() => {
+          void deps.service.disable().catch((error2) => {
+            writeStderrLine(
+              `qwen serve: Local Control disable failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+            );
+          });
+        });
+        res.status(200).json({ active: false });
+        return;
+      }
+      res.status(200).json(
+        presentStatus(req, await withUiData(await deps.service.disable()))
+      );
+    }
+  );
+}
+__name(registerWorkspaceLocalControlRoutes, "registerWorkspaceLocalControlRoutes");
+function sendEnableError(res, error2) {
+  if (error2 instanceof AmbiguousLanInterfaceError) {
+    res.status(409).json({
+      error: error2.message,
+      code: error2.code,
+      interfaces: error2.candidates
+    });
+    return;
+  }
+  if (error2 instanceof NoLanInterfaceError) {
+    res.status(409).json({ error: error2.message, code: error2.code });
+    return;
+  }
+  if (error2 instanceof UnknownLanInterfaceError) {
+    res.status(409).json({
+      error: error2.message,
+      code: error2.code,
+      interfaces: listLanCandidates()
+    });
+    return;
+  }
+  if (error2 instanceof InvalidLocalControlTargetError) {
+    res.status(400).json({ error: error2.message, code: error2.code });
+    return;
+  }
+  res.status(500).json({
+    error: error2 instanceof Error ? error2.message : String(error2),
+    code: "local_control_enable_failed"
+  });
+}
+__name(sendEnableError, "sendEnableError");
+
 // packages/cli/src/serve/acp-http/index.ts
 init_esbuild_shims();
-import { createHash as createHash3, timingSafeEqual } from "node:crypto";
 
 // packages/cli/src/serve/acp-http/dispatch.ts
 init_esbuild_shims();
@@ -1131,6 +1564,7 @@ function createAuditPublisher(deps) {
       if (record.sizeBytes !== void 0) payload.sizeBytes = record.sizeBytes;
       if (record.truncated) payload.truncated = true;
       if (record.matchedIgnore) payload.matchedIgnore = record.matchedIgnore;
+      if (record.operation !== void 0) payload.operation = record.operation;
       if (record.pattern !== void 0 && includeRawPaths) {
         payload.pattern = record.pattern;
       }
@@ -1177,7 +1611,7 @@ __name(createAuditPublisher, "createAuditPublisher");
 
 // packages/cli/src/serve/fs/workspace-file-system.ts
 init_esbuild_shims();
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 import { constants as fsConstants, promises as fsp2 } from "node:fs";
 import * as path4 from "node:path";
 
@@ -1238,6 +1672,11 @@ function assertCursorMatchesFile(cursor, stats, path19) {
 __name(assertCursorMatchesFile, "assertCursorMatchesFile");
 
 // packages/cli/src/serve/fs/workspace-file-system.ts
+var OWNER_ONLY_NEW_FILE_MODE = 384;
+function resolveNewFileModeBits(policy, umask) {
+  return policy === "system" ? 438 & ~(umask ?? process.umask()) : OWNER_ONLY_NEW_FILE_MODE;
+}
+__name(resolveNewFileModeBits, "resolveNewFileModeBits");
 function createWorkspaceFileSystemFactory(deps) {
   const boundWorkspaces = canonicalizeWorkspaces(deps.boundWorkspaces);
   if (boundWorkspaces.length === 0) {
@@ -1263,6 +1702,7 @@ function createWorkspaceFileSystemFactory(deps) {
   });
   const lowFs = new StandardFileSystemService();
   const pathLocks = deps.pathLocks ?? new PathMutexRegistry();
+  const newFileMode = deps.newFileMode ?? "owner";
   const forRequest = /* @__PURE__ */ __name((ctx) => new WorkspaceFileSystemImpl({
     primaryWorkspace,
     workspaces,
@@ -1271,7 +1711,8 @@ function createWorkspaceFileSystemFactory(deps) {
     ctx,
     lowFs,
     pathLocks,
-    generationGuard: deps.generationGuard
+    generationGuard: deps.generationGuard,
+    newFileMode
   }), "forRequest");
   return {
     assertCanWrite() {
@@ -1304,7 +1745,8 @@ function createWorkspaceFileSystemFactory(deps) {
             audit,
             ctx,
             pathLocks,
-            generationGuard: deps.generationGuard
+            generationGuard: deps.generationGuard,
+            newFileMode
           });
           return;
         } catch (outsideErr) {
@@ -1343,6 +1785,7 @@ async function writeSameHostToolTextOutsideWorkspace(deps) {
       content,
       mode: "overwrite",
       meta,
+      newFileModeBits: resolveNewFileModeBits(deps.newFileMode),
       assertGenerationOpen: /* @__PURE__ */ __name(() => deps.generationGuard?.assertOpen(), "assertGenerationOpen")
     });
     deps.audit.recordAccess(deps.ctx, {
@@ -1862,6 +2305,7 @@ var WorkspaceFileSystemImpl = class {
             mode: opts.mode,
             expectedHash: opts.expectedHash,
             meta,
+            newFileModeBits: resolveNewFileModeBits(this.deps.newFileMode),
             assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
           });
           const verdict = this.ignoreVerdict(p, "file");
@@ -1924,6 +2368,7 @@ var WorkspaceFileSystemImpl = class {
             content,
             mode: "overwrite",
             meta,
+            newFileModeBits: resolveNewFileModeBits(this.deps.newFileMode),
             assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
           });
           const verdict = this.ignoreVerdict(p, "file");
@@ -2035,6 +2480,7 @@ var WorkspaceFileSystemImpl = class {
             mode: "replace",
             expectedHash: opts.expectedHash,
             meta,
+            newFileModeBits: resolveNewFileModeBits(this.deps.newFileMode),
             assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
           });
           const verdict = this.ignoreVerdict(p, "file");
@@ -2098,6 +2544,7 @@ var WorkspaceFileSystemImpl = class {
           content: next,
           mode: "overwrite",
           meta: mergeWriteMeta(snapshot.meta, {}),
+          newFileModeBits: resolveNewFileModeBits(this.deps.newFileMode),
           assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
         });
         const verdict = this.ignoreVerdict(p, "file");
@@ -2149,6 +2596,36 @@ var WorkspaceFileSystemImpl = class {
       });
     }
   }
+  async mkdir(p, opts) {
+    const start = performance.now();
+    try {
+      this.deps.generationGuard?.assertOpen();
+      assertTrustedForIntent(this.deps.trusted, "write");
+      const out = await this.deps.pathLocks.runExclusive(
+        p,
+        async () => {
+          await ensureResolvedDirectory(p, {
+            recursive: opts?.recursive ?? false,
+            assertGenerationOpen: /* @__PURE__ */ __name(() => this.deps.generationGuard?.assertOpen(), "assertGenerationOpen")
+          });
+          this.deps.generationGuard?.assertOpen();
+          const verdict = this.ignoreVerdict(p, "directory");
+          this.deps.audit.recordAccess(this.deps.ctx, {
+            intent: "write",
+            absolute: p,
+            durationMs: performance.now() - start,
+            sizeBytes: 0,
+            operation: "mkdir",
+            matchedIgnore: verdict.ignored ? verdict.category : void 0
+          });
+          return void 0;
+        }
+      );
+      return out;
+    } catch (err) {
+      throw this.recordAndWrap(err, "write", p);
+    }
+  }
   /**
    * Coerce an arbitrary thrown value into an `FsError`, emit the
    * matching `fs.denied` audit event, and return the typed error
@@ -2632,10 +3109,82 @@ async function atomicWriteTextResolvedFile(input) {
     buf,
     mode: input.mode,
     expectedHash: input.expectedHash,
+    newFileModeBits: input.newFileModeBits,
     assertGenerationOpen: input.assertGenerationOpen
   });
 }
 __name(atomicWriteTextResolvedFile, "atomicWriteTextResolvedFile");
+async function ensureResolvedDirectory(target, opts) {
+  const assertRealDirectory = /* @__PURE__ */ __name(async (p) => {
+    const st = await fsp2.lstat(p);
+    if (st.isSymbolicLink()) {
+      throw new FsError("symlink_escape", `directory path is a symlink: ${p}`, {
+        hint: "re-resolve the target after detecting symlink swaps"
+      });
+    }
+    if (!st.isDirectory()) {
+      throw new FsError(
+        "parse_error",
+        `path exists and is not a directory: ${p}`
+      );
+    }
+  }, "assertRealDirectory");
+  const assertParentNotSymlink = /* @__PURE__ */ __name(async (p) => {
+    const parent = path4.dirname(p);
+    const st = await fsp2.lstat(parent);
+    if (st.isSymbolicLink()) {
+      throw new FsError(
+        "symlink_escape",
+        `directory parent is a symlink: ${parent}`,
+        { hint: "re-resolve the target after detecting symlink swaps" }
+      );
+    }
+  }, "assertParentNotSymlink");
+  try {
+    await assertRealDirectory(target);
+    return;
+  } catch (err) {
+    if (isFsError(err)) throw err;
+    if (err.code !== "ENOENT") throw err;
+  }
+  if (!opts.recursive) {
+    opts.assertGenerationOpen();
+    await assertParentNotSymlink(target);
+    try {
+      await fsp2.mkdir(target, { mode: 493 });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+    }
+    await assertRealDirectory(target);
+    return;
+  }
+  const missing = [];
+  let current = target;
+  while (true) {
+    try {
+      await assertRealDirectory(current);
+      break;
+    } catch (err) {
+      if (isFsError(err)) throw err;
+      if (err.code !== "ENOENT") throw err;
+      missing.push(current);
+      const parent = path4.dirname(current);
+      if (parent === current) throw err;
+      current = parent;
+    }
+  }
+  for (const entry of missing.reverse()) {
+    opts.assertGenerationOpen();
+    await assertParentNotSymlink(entry);
+    try {
+      await fsp2.mkdir(entry, { mode: 493 });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+    }
+    await assertRealDirectory(entry);
+  }
+}
+__name(ensureResolvedDirectory, "ensureResolvedDirectory");
 async function atomicPublishResolvedFile(input) {
   const target = input.target;
   const parent = path4.dirname(target);
@@ -2651,7 +3200,7 @@ async function atomicPublishResolvedFile(input) {
       `parent path is not a directory: ${parent}`
     );
   }
-  const tmpSuffix = `.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  const tmpSuffix = `.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
   const tmpNameMaxBytes = 255;
   const tmpBaseMaxBytes = tmpNameMaxBytes - 1 - Buffer.byteLength(tmpSuffix, "utf-8");
   let tmpBase = path4.basename(target);
@@ -2679,7 +3228,10 @@ async function atomicPublishResolvedFile(input) {
       mode: input.mode,
       expectedHash: input.expectedHash
     });
-    await chmodHandleBestEffort(tempHandle, targetState.mode ?? 384);
+    await chmodHandleBestEffort(
+      tempHandle,
+      targetState.mode ?? input.newFileModeBits ?? OWNER_ONLY_NEW_FILE_MODE
+    );
     await assertTempPathMatchesStat(tmpPath, tempStat);
     await tempHandle.close();
     tempHandle = void 0;
@@ -4658,7 +5210,7 @@ __name(registerWorkspaceQualifiedVoiceRoutes, "registerWorkspaceQualifiedVoiceRo
 
 // packages/cli/src/serve/workspace-remember.ts
 init_esbuild_shims();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var debugLogger = createDebugLogger("WORKSPACE_REMEMBER");
 function requireTrustedWorkspace(deps, res) {
   if (deps.isWorkspaceTrusted?.() !== false) return true;
@@ -4688,7 +5240,7 @@ function nowIso() {
 }
 __name(nowIso, "nowIso");
 function createMemoryTaskId(kind) {
-  return `${kind}-${randomUUID()}`;
+  return `${kind}-${randomUUID2()}`;
 }
 __name(createMemoryTaskId, "createMemoryTaskId");
 function touchedScopesFromTopics(topics) {
@@ -8114,6 +8666,7 @@ async function deleteDaemonSessionIfOrphan(params) {
   if (result.kind === "error") {
     throw result.error;
   }
+  bridge.markSessionCatalogChanged();
   return true;
 }
 __name(deleteDaemonSessionIfOrphan, "deleteDaemonSessionIfOrphan");
@@ -9231,11 +9784,20 @@ var AcpDispatcher = class {
       archiveStates
     });
   }
+  // Combined invalidate-and-mark for catalog mutations whose conservative
+  // finally-semantics match (delete/archive/unarchive). The revision advance
+  // always follows the cache invalidation so a newly exposed version never
+  // precedes it. Exact no-op paths (e.g. metadata rename) gate the mark on
+  // an actual change via the bridge instead of using this helper.
+  invalidateSessionListsAndMarkCatalog(archiveStates) {
+    this.invalidateSessionLists(archiveStates);
+    this.bridge.markSessionCatalogChanged();
+  }
   async runWithSessionListInvalidation(archiveStates, mutation) {
     try {
       return await mutation();
     } finally {
-      this.invalidateSessionLists(archiveStates);
+      this.invalidateSessionListsAndMarkCatalog(archiveStates);
     }
   }
   removeOrphanSession(sessionId, removePersistedSession = false, runtime = this.getSessionRuntimeContext()) {
@@ -10718,6 +11280,7 @@ var AcpDispatcher = class {
               ..."groupId" in params ? { groupId: params["groupId"] } : {},
               ..."color" in params ? { color: params["color"] } : {}
             });
+            this.invalidateSessionListsAndMarkCatalog(["active", "archived"]);
             this.replyConn(conn, id, { sessionId, ...organization });
           });
           return;
@@ -10736,6 +11299,7 @@ var AcpDispatcher = class {
             name: params["name"],
             color: params["color"]
           });
+          this.invalidateSessionListsAndMarkCatalog(["active", "archived"]);
           assertGenerationOpen?.();
           this.replyConn(conn, id, { group });
           return;
@@ -10753,6 +11317,7 @@ var AcpDispatcher = class {
             ..."color" in params ? { color: params["color"] } : {},
             ..."order" in params ? { order: params["order"] } : {}
           });
+          this.invalidateSessionListsAndMarkCatalog(["active", "archived"]);
           assertGenerationOpen?.();
           this.replyConn(conn, id, { group });
           return;
@@ -10766,6 +11331,9 @@ var AcpDispatcher = class {
           const deleted = await createSessionOrganizationService(workspaceCwd).deleteGroup(
             groupId
           );
+          if (deleted) {
+            this.invalidateSessionListsAndMarkCatalog(["active", "archived"]);
+          }
           assertGenerationOpen?.();
           this.replyConn(conn, id, { deleted });
           return;
@@ -12869,7 +13437,7 @@ var AcpDispatcher = class {
 
 // packages/cli/src/serve/acp-http/connection-registry.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var DEFAULT_MAX_CONNECTIONS = 64;
 var AcpConnection = class {
   constructor(connectionId, fromLoopback, onAbandonPending, onDetachSession, preAttachBudget = new AcpPreAttachBudget(), onFatalConnection, maxFramesPerConnection = ACP_PRE_ATTACH_MAX_FRAMES_PER_CONNECTION, maxPayloadBytesPerConnection = ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_PER_CONNECTION, onPreAttachGuardFailure) {
@@ -12880,8 +13448,8 @@ var AcpConnection = class {
     this.maxFramesPerConnection = maxFramesPerConnection;
     this.maxPayloadBytesPerConnection = maxPayloadBytesPerConnection;
     this.onPreAttachGuardFailure = onPreAttachGuardFailure;
-    this.connectionId = connectionId ?? randomUUID2();
-    this.clientId = randomUUID2();
+    this.connectionId = connectionId ?? randomUUID3();
+    this.clientId = randomUUID3();
     this.fromLoopback = fromLoopback;
   }
   static {
@@ -15985,9 +16553,15 @@ function mountAcpHttp(app, bridge, opts) {
   }
   let wss;
   let upgradeListener;
-  let upgradeServer;
+  const upgradeServers = /* @__PURE__ */ new Set();
+  const upgradeCredentials = opts.credentials ?? singleTokenCredentials(opts.token);
   function setupWebSocket(httpServer) {
-    if (disposed || wss) return;
+    if (disposed || upgradeServers.has(httpServer)) return;
+    if (wss) {
+      upgradeServers.add(httpServer);
+      httpServer.on("upgrade", upgradeListener);
+      return;
+    }
     wss = new import_websocket_server.default({
       noServer: true,
       maxPayload: 10 * 1024 * 1024,
@@ -16007,8 +16581,7 @@ function mountAcpHttp(app, bridge, opts) {
         return false;
       }, "handleProtocols")
     });
-    upgradeServer = httpServer;
-    const expectedTokenHash = opts.token ? createHash3("sha256").update(opts.token).digest() : void 0;
+    upgradeServers.add(httpServer);
     upgradeListener = /* @__PURE__ */ __name((req, socket, head) => {
       if (disposed) {
         socket.destroy();
@@ -16036,8 +16609,18 @@ function mountAcpHttp(app, bridge, opts) {
         return;
       }
       const fromLoopback = isLoopbackSocket(socket);
-      if (fromLoopback) {
-        const host = (req.headers["host"] ?? "").toLowerCase();
+      const upgradeListenerIdentity = listenerIdentityOfSocket(socket);
+      const host = (req.headers["host"] ?? "").toLowerCase();
+      if (upgradeListenerIdentity.kind === "local-control") {
+        const authority = upgradeListenerIdentity.authority;
+        const browserHost = upgradeListenerIdentity.origin === void 0 ? void 0 : new URL(upgradeListenerIdentity.origin).host.toLowerCase();
+        if (authority === void 0 || host !== authority && host !== browserHost) {
+          logReject(`host-not-allowed ${host || "(missing)"}`);
+          socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+          socket.destroy();
+          return;
+        }
+      } else if (fromLoopback) {
         const allowed = /* @__PURE__ */ new Set([
           `localhost:${localPort}`,
           `127.0.0.1:${localPort}`,
@@ -16062,7 +16645,8 @@ function mountAcpHttp(app, bridge, opts) {
         try {
           const isLoopbackOrigin = isSameLoopbackOrigin(origin, localPort);
           const isAllowlistedOrigin = opts.allowedOrigins !== void 0 && opts.allowedOrigins.origins.has(origin.toLowerCase());
-          if (!isLoopbackOrigin && !isAllowlistedOrigin) {
+          const isListenerOrigin = upgradeListenerIdentity.kind === "local-control" && upgradeListenerIdentity.origin === origin.toLowerCase();
+          if (!isLoopbackOrigin && !isAllowlistedOrigin && !isListenerOrigin) {
             logReject(`origin-not-allowed ${origin}`);
             socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
             socket.destroy();
@@ -16075,10 +16659,9 @@ function mountAcpHttp(app, bridge, opts) {
           return;
         }
       }
-      if (opts.token) {
-        const credentials = extractUpgradeBearer(req);
-        const actual = credentials ? createHash3("sha256").update(credentials).digest() : void 0;
-        if (!actual || !expectedTokenHash || actual.length !== expectedTokenHash.length || !timingSafeEqual(expectedTokenHash, actual)) {
+      if (!upgradeCredentials.isOpen(upgradeListenerIdentity)) {
+        const presented = extractUpgradeBearer(req);
+        if (!presented || !upgradeCredentials.verify(presented, upgradeListenerIdentity)) {
           logReject("auth-mismatch");
           socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
           socket.destroy();
@@ -16587,10 +17170,12 @@ function mountAcpHttp(app, bridge, opts) {
     dispose: /* @__PURE__ */ __name(() => {
       if (disposed) return;
       disposed = true;
-      if (upgradeServer && upgradeListener) {
-        upgradeServer.removeListener("upgrade", upgradeListener);
+      if (upgradeListener) {
+        for (const server of upgradeServers) {
+          server.removeListener("upgrade", upgradeListener);
+        }
+        upgradeServers.clear();
         upgradeListener = void 0;
-        upgradeServer = void 0;
       }
       registry.dispose();
       opts.workspaceRememberLane.dispose();
@@ -16730,6 +17315,17 @@ function mountAcpHttp(app, bridge, opts) {
     }, "getSnapshot"),
     attachServer(server) {
       setupWebSocket(server);
+    },
+    detachServer(server) {
+      if (!upgradeServers.delete(server)) return;
+      if (upgradeListener) server.removeListener("upgrade", upgradeListener);
+      if (!wss) return;
+      for (const client of wss.clients) {
+        const clientSocket = client._socket;
+        if (clientSocket?.server === server) {
+          client.terminate();
+        }
+      }
     }
   };
 }
@@ -20777,6 +21373,7 @@ __name(registerWorkspaceQualifiedFileWriteRoutes, "registerWorkspaceQualifiedFil
 var MAX_CONCURRENT_UPLOADS = 4;
 var MAX_UPLOAD_FILENAME_BYTES = 255;
 var NUMBERED_CANDIDATE_CAP = 1e3;
+var MAX_UPLOAD_DIR_DEPTH = 64;
 var uploadGateLeases = /* @__PURE__ */ new WeakMap();
 function createUploadConcurrencyGate(max = MAX_CONCURRENT_UPLOADS) {
   let active = 0;
@@ -20934,6 +21531,14 @@ function fileUploadAdmission(deps, opts) {
           sendParseError(res, ROUTE2, "`path` must name a file");
           return;
         }
+        if (dir.split("/").filter(Boolean).length > MAX_UPLOAD_DIR_DEPTH) {
+          sendParseError(
+            res,
+            ROUTE2,
+            `directory path exceeds ${MAX_UPLOAD_DIR_DEPTH} components`
+          );
+          return;
+        }
         if (queryPath.includes("\0")) {
           sendParseError(res, ROUTE2, "path must not contain null bytes");
           return;
@@ -20979,10 +21584,11 @@ function fileUploadAdmission(deps, opts) {
           dirStat = await fs9.stat(resolvedDir);
         } catch (err) {
           if (isFsError(err) && err.kind === "path_not_found") {
-            sendParseError(res, ROUTE2, "parent directory does not exist");
-            return;
+            await fs9.mkdir(resolvedDir, { recursive: true });
+            dirStat = await fs9.stat(resolvedDir);
+          } else {
+            throw err;
           }
-          throw err;
         }
         if (dirStat.kind !== "directory") {
           sendParseError(res, ROUTE2, "parent path is not a directory");
@@ -21531,6 +22137,24 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/continue"
   },
+  {
+    method: "POST",
+    path: "/session/:id/media",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/media"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/media/:mediaId",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/media/:mediaId"
+  },
+  {
+    method: "DELETE",
+    path: "/session/:id/media/:mediaId",
+    attribution: "handler_resolved",
+    route: "DELETE /session/:id/media/:mediaId"
+  },
   {
     method: "POST",
     path: "/session/:id/prompt",
@@ -21651,6 +22275,18 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "DELETE /session/:id/pending-prompts/:promptId"
   },
+  {
+    method: "GET",
+    path: "/session/:id/turns/current",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/turns/current"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/turns/:promptId",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/turns/:promptId"
+  },
   {
     method: "POST",
     path: "/session/:id/shell",
@@ -21779,6 +22415,9 @@ function resolveDaemonTelemetryRoute(req) {
   if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path19)) {
     return { route: "GET /workspace/:id/sessions" };
   }
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions\/live-state$/.test(path19)) {
+    return { route: "GET /workspaces/:workspace/sessions/live-state" };
+  }
   if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path19)) {
     return { route: "GET /workspace/:id/session-info" };
   }
@@ -22212,6 +22851,7 @@ init_esbuild_shims();
 import * as crypto3 from "node:crypto";
 import * as fs6 from "node:fs";
 import * as path12 from "node:path";
+var import_express4 = __toESM(require_express(), 1);
 
 // packages/cli/src/serve/server/prompt-deadline.ts
 init_esbuild_shims();
@@ -24036,6 +24676,45 @@ var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 2 * SESSION_TRANSCRIPT_MAX_EXPANDE
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
 var CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS = 6e4;
+var MEDIA_CONTENT_MAX_BLOCKS = 256;
+function isSvgMimeType(mimeType) {
+  return mimeType?.split(";", 1)[0]?.trim().toLowerCase() === "image/svg+xml";
+}
+__name(isSvgMimeType, "isSvgMimeType");
+function parseMediaContentBlock(block) {
+  if (typeof block !== "object" || block === null || Array.isArray(block)) {
+    return { valid: false, code: "not-object" };
+  }
+  const record = block;
+  const type = record["type"];
+  const data = record["data"];
+  const mediaId = record["mediaId"];
+  const mimeType = record["mimeType"];
+  const size = record["size"];
+  const inline = typeof data === "string" && data.length > 0;
+  const reference = typeof mediaId === "string" && mediaId.length > 0 && typeof size === "number" && Number.isSafeInteger(size) && size > 0;
+  if (type !== "image" || inline === reference || typeof mimeType !== "string" || !mimeType.startsWith(`${type}/`)) {
+    return { valid: false, code: "invalid-shape" };
+  }
+  if (isSvgMimeType(mimeType)) {
+    return { valid: false, code: "svg" };
+  }
+  return {
+    valid: true,
+    block: inline ? { type, data, mimeType } : { type, mediaId, mimeType, size }
+  };
+}
+__name(parseMediaContentBlock, "parseMediaContentBlock");
+function mediaBlockParseError(code, entryLabel) {
+  if (code === "not-object") {
+    return `each ${entryLabel} must be a media content block`;
+  }
+  if (code === "svg") {
+    return "SVG images are not supported";
+  }
+  return `each ${entryLabel} must be an image block with either \`data\`, or \`mediaId\` and \`size\`, plus a matching \`mimeType\``;
+}
+__name(mediaBlockParseError, "mediaBlockParseError");
 var PRIMARY_ONLY_LIVE_SESSION_ROUTES = ["POST /session/:id/cd"];
 var PRIMARY_OR_INTERNAL_LIVE_SESSION_ROUTES = [
   "POST /session/:id/branch",
@@ -24243,11 +24922,15 @@ function registerSessionRoutes(app, deps) {
       archiveStates
     });
   }, "invalidateSessionLists");
+  const invalidateSessionListsAndMarkCatalog = /* @__PURE__ */ __name((runtime, archiveStates) => {
+    invalidateSessionLists(runtime, archiveStates);
+    runtime.bridge.markSessionCatalogChanged();
+  }, "invalidateSessionListsAndMarkCatalog");
   const runWithSessionListInvalidation = /* @__PURE__ */ __name(async (runtime, archiveStates, mutation) => {
     try {
       return await mutation();
     } finally {
-      invalidateSessionLists(runtime, archiveStates);
+      invalidateSessionListsAndMarkCatalog(runtime, archiveStates);
     }
   }, "runWithSessionListInvalidation");
   const requestedSessionIdAdmission = deps.requestedSessionIdAdmission ?? createRequestedSessionIdAdmission({
@@ -26459,8 +27142,10 @@ function registerSessionRoutes(app, deps) {
           if (!result.attached) {
             const killed = await runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).catch(() => false);
             if (killed) {
-              await createWorkspaceRuntimeSessionService(runtime).removeSession(result.sessionId).catch(() => {
-              });
+              const removed = await createWorkspaceRuntimeSessionService(
+                runtime
+              ).removeSession(result.sessionId).catch(() => false);
+              if (removed) runtime.bridge.markSessionCatalogChanged();
             }
           } else {
             await runtime.bridge.detachClient(result.sessionId, result.clientId).catch(() => {
@@ -26470,11 +27155,12 @@ function registerSessionRoutes(app, deps) {
         }
         if (!res.writable) {
           if (!result.attached) {
-            runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).then((killed) => {
-              if (!killed) return void 0;
-              return createWorkspaceRuntimeSessionService(
+            runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).then(async (killed) => {
+              if (!killed) return;
+              const removed = await createWorkspaceRuntimeSessionService(
                 runtime
               ).removeSession(result.sessionId);
+              if (removed) runtime.bridge.markSessionCatalogChanged();
             }).catch(() => {
             });
           } else {
@@ -27061,6 +27747,103 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.post(
+    "/session/:id/media",
+    mutate(),
+    import_express4.default.raw({ type: "image/*", limit: "8mb" }),
+    (error2, _req, res, next) => {
+      if (error2 && typeof error2 === "object" && "status" in error2 && error2.status === 413) {
+        res.status(413).json({ error: "Request body too large (max 8 MiB)" });
+        return;
+      }
+      next(error2);
+    },
+    withOwnerMutableSession(
+      "POST /session/:id/media",
+      async (req, res, sessionId, runtime) => {
+        const contentType = req.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
+        if (isSvgMimeType(contentType)) {
+          res.status(415).json({ error: "SVG uploads are not supported" });
+          return;
+        }
+        if (!contentType || !contentType.startsWith("image/") || !Buffer.isBuffer(req.body) || req.body.byteLength === 0) {
+          res.status(400).json({
+            error: "request body must contain image/* bytes with a matching Content-Type"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        try {
+          const reference = await runtime.bridge.storeSessionMedia(
+            sessionId,
+            req.body,
+            contentType,
+            clientId !== void 0 ? { clientId } : void 0
+          );
+          res.status(201).json(reference);
+        } catch (error2) {
+          if (error2 instanceof RangeError) {
+            res.status(413).json({ error: error2.message });
+            return;
+          }
+          throw error2;
+        }
+      }
+    )
+  );
+  app.get(
+    "/session/:id/media/:mediaId",
+    withOwnerReadSession(
+      "GET /session/:id/media/:mediaId",
+      async (req, res, sessionId, runtime) => {
+        const mediaId = req.params["mediaId"];
+        if (!mediaId) {
+          res.status(400).json({ error: "`mediaId` is required" });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const media = await runtime.bridge.readSessionMedia(
+          sessionId,
+          mediaId,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        if (!media) {
+          res.status(404).json({ error: "session media not found" });
+          return;
+        }
+        res.setHeader("Content-Type", media.mimeType);
+        res.setHeader("Content-Length", String(media.data.byteLength));
+        res.setHeader("Cache-Control", "private, max-age=300");
+        res.setHeader("Content-Disposition", "attachment");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.status(200).send(media.data);
+      }
+    )
+  );
+  app.delete(
+    "/session/:id/media/:mediaId",
+    mutate(),
+    withOwnerMutableSession(
+      "DELETE /session/:id/media/:mediaId",
+      async (req, res, sessionId, runtime) => {
+        const mediaId = req.params["mediaId"];
+        if (!mediaId) {
+          res.status(400).json({ error: "`mediaId` is required" });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const removed = await runtime.bridge.removeSessionMedia(
+          sessionId,
+          mediaId,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json({ removed });
+      }
+    )
+  );
   app.post(
     "/session/:id/prompt",
     mutate(),
@@ -27084,6 +27867,25 @@ function registerSessionRoutes(app, deps) {
           });
           return;
         }
+        const mediaBlockCount = prompt.filter(
+          (item) => item["type"] !== "text"
+        ).length;
+        if (mediaBlockCount > MEDIA_CONTENT_MAX_BLOCKS) {
+          res.status(400).json({
+            error: `\`prompt\` must carry at most ${MEDIA_CONTENT_MAX_BLOCKS} media blocks`
+          });
+          return;
+        }
+        for (const item of prompt) {
+          if (item["type"] !== "image") continue;
+          const parsed = parseMediaContentBlock(item);
+          if (!parsed.valid) {
+            res.status(400).json({
+              error: mediaBlockParseError(parsed.code, "`prompt` image block")
+            });
+            return;
+          }
+        }
         const rawRequestDeadline = body["deadlineMs"];
         let requestDeadlineMs;
         if (rawRequestDeadline !== void 0 && rawRequestDeadline !== null) {
@@ -27638,6 +28440,113 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.patch(
+    "/workspaces/:workspace/session/:id/metadata",
+    mutate({ strict: true }),
+    async (req, res) => {
+      const route = "PATCH /workspaces/:workspace/session/:id/metadata";
+      const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
+      if (!runtime) return;
+      const sessionId = requireSessionId(req, res);
+      if (sessionId === null) return;
+      const clientId = parseClientIdHeader(req, res);
+      if (clientId === null) return;
+      const rawDisplayName = safeBody(req)["displayName"];
+      if (typeof rawDisplayName !== "string") {
+        res.status(400).json({
+          error: "`displayName` must be a string",
+          code: "invalid_metadata",
+          field: "displayName"
+        });
+        return;
+      }
+      try {
+        const displayName = rawDisplayName.slice(0, 256);
+        if (displayName.trim() === "") {
+          throw new InvalidSessionMetadataError(
+            "displayName",
+            "must not be empty"
+          );
+        }
+        if (Array.from(displayName).some((character) => {
+          const code = character.charCodeAt(0);
+          return code <= 31 || code === 127;
+        })) {
+          throw new InvalidSessionMetadataError(
+            "displayName",
+            "must not contain control characters"
+          );
+        }
+        await archiveCoordinator.runExclusiveMany([sessionId], async () => {
+          const assertRuntimeGenerationOpen = captureRuntimeGenerationAssertion(runtime);
+          assertRuntimeGenerationOpen?.();
+          const liveOwner = workspaceRegistry.resolveLiveSessionOwner(sessionId);
+          if (liveOwner.kind === "unavailable") {
+            sendWorkspaceRuntimeUnavailable(res);
+            return;
+          }
+          if (liveOwner.kind === "ambiguous") {
+            sendAmbiguousSessionOwner(
+              res,
+              route,
+              sessionId,
+              liveOwner.runtimes
+            );
+            return;
+          }
+          if (liveOwner.kind === "found" && liveOwner.runtime.workspaceCwd !== runtime.workspaceCwd) {
+            sendSessionWorkspaceConflict(
+              res,
+              route,
+              sessionId,
+              runtime,
+              liveOwner.runtime
+            );
+            return;
+          }
+          await runWithWorkspaceRuntimeStorage(runtime, async () => {
+            let effective;
+            try {
+              effective = runtime.bridge.updateSessionMetadata(
+                sessionId,
+                { displayName },
+                clientId !== void 0 ? { clientId } : void 0
+              );
+              assertRuntimeGenerationOpen?.();
+            } catch (err) {
+              if (!(err instanceof SessionNotFoundError)) throw err;
+              const service = createWorkspaceRuntimeSessionService(runtime);
+              const location = await service.getSessionLocation(sessionId);
+              assertRuntimeGenerationOpen?.();
+              if (location === "conflict") {
+                throw new SessionConflictError(sessionId);
+              }
+              const renamed = location ? await service.renameSession(
+                sessionId,
+                displayName,
+                "manual",
+                location
+              ) : false;
+              assertRuntimeGenerationOpen?.();
+              if (!renamed) {
+                throw new SessionNotFoundError(sessionId);
+              }
+              runtime.bridge.markSessionCatalogChanged();
+              effective = { displayName: displayName || void 0 };
+            }
+            invalidateSessionLists(runtime, ["active", "archived"]);
+            res.status(200).json({ sessionId, ...effective });
+          });
+        });
+      } catch (err) {
+        sendBridgeError2(res, err, {
+          route,
+          sessionId,
+          workspaceCwd: runtime.workspaceCwd
+        });
+      }
+    }
+  );
   const handleSessionOrganizationUpdate = /* @__PURE__ */ __name(async (req, res, target) => {
     const sessionId = requireSessionId(req, res);
     if (sessionId === null) return;
@@ -27705,6 +28614,10 @@ function registerSessionRoutes(app, deps) {
               ...rawGroupId !== void 0 ? { groupId: rawGroupId } : {},
               ...rawColor !== void 0 ? { color: rawColor } : {}
             });
+            invalidateSessionListsAndMarkCatalog(runtime, [
+              "active",
+              "archived"
+            ]);
             res.status(200).json({ sessionId, ...organization });
           });
         })()
@@ -27767,6 +28680,7 @@ function registerSessionRoutes(app, deps) {
           color: body["color"]
         })
       );
+      invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
       res.status(201).json({ group });
     } catch (err) {
       if (sendSessionOrganizationError(res, err)) return;
@@ -27794,6 +28708,7 @@ function registerSessionRoutes(app, deps) {
             }
           )
         );
+        invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
         res.status(200).json({ group });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -27816,6 +28731,9 @@ function registerSessionRoutes(app, deps) {
             req.params["groupId"] ?? ""
           )
         );
+        if (deleted) {
+          invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
+        }
         res.status(200).json({ deleted });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -27856,6 +28774,7 @@ function registerSessionRoutes(app, deps) {
             color: body["color"]
           })
         );
+        invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
         res.status(201).json({ group });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -27883,6 +28802,7 @@ function registerSessionRoutes(app, deps) {
             }
           )
         );
+        invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
         res.status(200).json({ group });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -27904,6 +28824,9 @@ function registerSessionRoutes(app, deps) {
             req.params["groupId"] ?? ""
           )
         );
+        if (deleted) {
+          invalidateSessionListsAndMarkCatalog(runtime, ["active", "archived"]);
+        }
         res.status(200).json({ deleted });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -28089,6 +29012,35 @@ function registerSessionRoutes(app, deps) {
     "/workspaces/:workspace/sessions",
     listWorkspaceSessionsHandler("workspace")
   );
+  const lastExposedCatalogVersions = /* @__PURE__ */ new WeakMap();
+  app.get("/workspaces/:workspace/sessions/live-state", async (req, res) => {
+    const route = "GET /workspaces/:workspace/sessions/live-state";
+    const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
+    if (runtime === null) return;
+    const assertRuntimeOpen = captureRuntimeGenerationAssertion(runtime);
+    const bridge = runtime.bridge;
+    try {
+      assertRuntimeOpen?.();
+      const catalogVersion = bridge.getSessionCatalogVersion();
+      const lastExposed = lastExposedCatalogVersions.get(bridge);
+      if (lastExposed === void 0 || lastExposed.generation !== catalogVersion.generation || lastExposed.revision !== catalogVersion.revision) {
+        invalidateSessionLists(runtime, ["active", "archived"]);
+      }
+      const sessions = bridge.listWorkspaceSessions(runtime.workspaceCwd).map((session) => ({
+        sessionId: session.sessionId,
+        clientCount: session.clientCount,
+        hasActivePrompt: session.hasActivePrompt,
+        isWaitingForPermission: session.isWaitingForPermission ?? false,
+        isWaitingForUserQuestion: session.isWaitingForUserQuestion ?? false
+      }));
+      assertRuntimeOpen?.();
+      lastExposedCatalogVersions.set(bridge, catalogVersion);
+      res.setHeader("Cache-Control", "no-store");
+      res.status(200).json({ v: 1, catalogVersion, sessions });
+    } catch (err) {
+      sendBridgeError2(res, err, { route });
+    }
+  });
   const workspaceSessionInfoHandler = /* @__PURE__ */ __name((paramName) => async (req, res) => {
     const route = paramName === "workspace" ? "GET /workspaces/:workspace/session-info" : "GET /workspace/:id/session-info";
     const runtime = resolveRuntimeForCatalogRoute(req, res, paramName, route);
@@ -28257,9 +29209,36 @@ function registerSessionRoutes(app, deps) {
         const message = body["message"];
         const messageId = body["messageId"];
         const trimmed = typeof message === "string" ? message.trim() : "";
-        if (trimmed.length === 0) {
+        const rawContent = body["content"];
+        let mediaBlocks;
+        if (rawContent !== void 0) {
+          if (!Array.isArray(rawContent) || rawContent.length === 0) {
+            res.status(400).json({
+              error: "`content` must be a non-empty array of media blocks"
+            });
+            return;
+          }
+          if (rawContent.length > MEDIA_CONTENT_MAX_BLOCKS) {
+            res.status(400).json({
+              error: `\`content\` must carry at most ${MEDIA_CONTENT_MAX_BLOCKS} media blocks`
+            });
+            return;
+          }
+          mediaBlocks = [];
+          for (const block of rawContent) {
+            const parsed = parseMediaContentBlock(block);
+            if (!parsed.valid) {
+              res.status(400).json({
+                error: mediaBlockParseError(parsed.code, "`content` entry")
+              });
+              return;
+            }
+            mediaBlocks.push(parsed.block);
+          }
+        }
+        if (trimmed.length === 0 && mediaBlocks === void 0) {
           res.status(400).json({
-            error: "`message` is required and must be a non-empty string"
+            error: "`message` must be a non-empty string, or `content` must carry at least one media block"
           });
           return;
         }
@@ -28281,7 +29260,8 @@ function registerSessionRoutes(app, deps) {
           sessionId,
           trimmed,
           clientId !== void 0 ? { clientId } : void 0,
-          typeof messageId === "string" ? messageId : void 0
+          typeof messageId === "string" ? messageId : void 0,
+          mediaBlocks ? { content: mediaBlocks } : void 0
         );
         res.status(200).json(result);
       }
@@ -28373,6 +29353,73 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.get("/session/:id/turns/current", (req, res) => {
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(
+      sessionId,
+      res,
+      "GET /session/:id/turns/current"
+    );
+    if (!runtime) return;
+    const clientId = parseClientIdHeader(req, res);
+    if (clientId === null) return;
+    void (async () => {
+      try {
+        const status = await runtime.bridge.getSessionTurnStatus(
+          sessionId,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json(status);
+      } catch (err) {
+        sendBridgeError2(res, err, {
+          route: "GET /session/:id/turns/current",
+          sessionId
+        });
+      }
+    })();
+  });
+  app.get("/session/:id/turns/:promptId", (req, res) => {
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(
+      sessionId,
+      res,
+      "GET /session/:id/turns/:promptId"
+    );
+    if (!runtime) return;
+    const promptId = req.params["promptId"];
+    if (!promptId) {
+      res.status(400).json({ error: "`promptId` route parameter is required" });
+      return;
+    }
+    const clientId = parseClientIdHeader(req, res);
+    if (clientId === null) return;
+    void (async () => {
+      try {
+        const status = await runtime.bridge.getSessionTurnStatus(
+          sessionId,
+          clientId !== void 0 ? { clientId } : void 0,
+          promptId
+        );
+        if (!status) {
+          res.status(404).json({
+            error: `Prompt ${promptId} not found in session ${sessionId}`,
+            code: "prompt_not_found",
+            sessionId,
+            promptId
+          });
+          return;
+        }
+        res.status(200).json(status);
+      } catch (err) {
+        sendBridgeError2(res, err, {
+          route: "GET /session/:id/turns/:promptId",
+          sessionId
+        });
+      }
+    })();
+  });
   app.post(
     "/session/:id/shell",
     mutate({ strict: true }),
@@ -28634,10 +29681,10 @@ async function teardownBoundSession(target, sessionId) {
   } else if (target.bridge) {
     await target.bridge.closeSession(sessionId).catch(() => {
     });
-    await new SessionService(target.workspaceCwd, {
+    const removed = await new SessionService(target.workspaceCwd, {
       runtimeBaseDir: target.runtimeBaseDir
-    }).removeSession(sessionId).catch(() => {
-    });
+    }).removeSession(sessionId).catch(() => false);
+    if (removed) target.bridge.markSessionCatalogChanged?.();
   }
 }
 __name(teardownBoundSession, "teardownBoundSession");
@@ -29523,7 +30570,7 @@ __name(parseNameField, "parseNameField");
 
 // packages/cli/src/serve/routes/channel-notify.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 function sendDeliveryError(res, error2) {
   if (!isChannelDeliveryError(error2)) {
     res.status(502).json({
@@ -29544,7 +30591,7 @@ function parseNotifyBody(body) {
     );
   }
   return normalizeChannelDelivery(
-    randomUUID6(),
+    randomUUID7(),
     parseChannelDelivery(body["delivery"]),
     body["text"]
   );
@@ -29863,9 +30910,10 @@ function startScheduledTaskKeepalive(opts) {
   const spawnTimeoutMs = opts.spawnTimeoutMs ?? KEEPALIVE_SPAWN_TIMEOUT_MS;
   const cleanupSession = opts.cleanupSession ?? (async (sessionId) => {
     await bridge.closeSession(sessionId);
-    await new SessionService(boundWorkspace, {
+    const removed = await new SessionService(boundWorkspace, {
       runtimeBaseDir: opts.runtimeBaseDir
     }).removeSession(sessionId);
+    if (removed) bridge.markSessionCatalogChanged?.();
   });
   const reviveState = /* @__PURE__ */ new Map();
   const reviving = /* @__PURE__ */ new Set();
@@ -31443,7 +32491,7 @@ __name(registerWorkspaceQualifiedSettingsRoutes, "registerWorkspaceQualifiedSett
 
 // packages/cli/src/serve/routes/sse-events.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { performance as performance2 } from "node:perf_hooks";
 
 // packages/cli/src/serve/server/error-response.ts
@@ -31561,6 +32609,10 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     return;
   }
   if (sendGenerationClosedError(res, err)) return;
+  if (err instanceof Error && "code" in err && (err.code === "session_media_gone" || err.code === "invalid_session_media_reference")) {
+    res.status(err.code === "session_media_gone" ? 410 : 400).json({ error: err.message, code: err.code });
+    return;
+  }
   if (err instanceof SessionWriterError) {
     res.status(err.httpStatus).json({
       error: err.message,
@@ -32132,7 +33184,7 @@ function registerSseEventsRoutes(app, deps) {
   app.get("/session/:id/events", async (req, res) => {
     const sessionId = req.params["id"];
     const diagnosticSessionId = boundedDiagnosticString(sessionId);
-    const streamId = randomUUID7();
+    const streamId = randomUUID8();
     const clientId = parseSseClientId(req.headers["x-qwen-client-id"]);
     const connectReason = parseSseConnectReason(req.query["connectReason"]);
     const previousStreamId = parsePreviousSseStreamId(
@@ -33154,6 +34206,19 @@ __name(registerA2uiActionRoutes, "registerA2uiActionRoutes");
 init_esbuild_shims();
 import * as path15 from "node:path";
 var IDE_WORKSPACE_PATH_ENV_VAR = "QWEN_CODE_IDE_WORKSPACE_PATH";
+var NEW_FILE_MODE_ENV_VAR = "QWEN_SERVE_NEW_FILE_MODE";
+function parseNewFileModePolicy(env = process.env) {
+  const raw = env[NEW_FILE_MODE_ENV_VAR];
+  if (raw === void 0 || raw.trim() === "") return "owner";
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "system") return "system";
+  if (normalized === "owner" || normalized === "0600") return "owner";
+  writeStderrLine(
+    `qwen serve: ignoring invalid ${NEW_FILE_MODE_ENV_VAR}=${raw} (expected 'system' or 'owner'); new files keep the 0600 default`
+  );
+  return "owner";
+}
+__name(parseNewFileModePolicy, "parseNewFileModePolicy");
 function createDefaultFsAuditEmit() {
   const WARN_EVERY = 100;
   let droppedCount = 0;
@@ -33181,6 +34246,7 @@ function resolveBridgeFsFactory(input) {
     emit: input.emit ?? createDefaultFsAuditEmit(),
     pathLocks: input.pathLocks,
     generationGuard: input.generationGuard,
+    newFileMode: input.newFileMode ?? parseNewFileModePolicy(),
     ...input.customIgnoreFiles !== void 0 ? { customIgnoreFiles: input.customIgnoreFiles } : {}
   });
 }
@@ -33503,9 +34569,9 @@ __name(setupDeviceFlowRegistry, "setupDeviceFlowRegistry");
 
 // packages/cli/src/serve/server/error-handlers.ts
 init_esbuild_shims();
-var import_express4 = __toESM(require_express(), 1);
+var import_express5 = __toESM(require_express(), 1);
 function installJsonBodyParser(app) {
-  app.use(import_express4.default.json({ limit: "10mb" }));
+  app.use(import_express5.default.json({ limit: "10mb" }));
   app.use((err, _req, res, next) => {
     if (sendJsonBodyParserError(res, err)) return;
     next(err);
@@ -38355,8 +39421,8 @@ __name(registerWorkspaceQualifiedSkillsRoutes, "registerWorkspaceQualifiedSkills
 
 // packages/cli/src/serve/routes/channel-webhooks.ts
 init_esbuild_shims();
-var import_express5 = __toESM(require_express(), 1);
-import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var import_express6 = __toESM(require_express(), 1);
+import { createHash as createHash3, timingSafeEqual } from "node:crypto";
 var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
   "constructor",
@@ -38404,7 +39470,7 @@ function registerChannelWebhookRoutes(app, deps) {
       locals.channelWebhook = { channelName, source, sourceConfig };
       next();
     },
-    import_express5.default.json({ limit: "1mb" }),
+    import_express6.default.json({ limit: "1mb" }),
     async (req, res) => {
       const locals = res.locals;
       const webhook = locals.channelWebhook;
@@ -38518,9 +39584,9 @@ function matchesWebhookSecret(candidate, expected) {
   if (typeof candidate !== "string") {
     return false;
   }
-  const expectedDigest = createHash4("sha256").update(expected).digest();
-  const candidateDigest = createHash4("sha256").update(candidate).digest();
-  return timingSafeEqual2(expectedDigest, candidateDigest);
+  const expectedDigest = createHash3("sha256").update(expected).digest();
+  const candidateDigest = createHash3("sha256").update(candidate).digest();
+  return timingSafeEqual(expectedDigest, candidateDigest);
 }
 __name(matchesWebhookSecret, "matchesWebhookSecret");
 function readPayload(body, res) {
@@ -38599,7 +39665,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/live/live-host-coordinator.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { randomUUID as randomUUID9, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var DEFAULT_HELLO_TIMEOUT_MS = 5e3;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
 var DEFAULT_HEARTBEAT_TIMEOUT_MS = 15e3;
@@ -38776,7 +39842,7 @@ __name(projectStatusForHost, "projectStatusForHost");
 var LiveHostCoordinator = class {
   constructor(options) {
     this.options = options;
-    this.daemonInstanceNonce = options.daemonInstanceNonce ?? randomUUID8();
+    this.daemonInstanceNonce = options.daemonInstanceNonce ?? randomUUID9();
     this.handlers = options.handlers ?? {};
     this.now = options.now ?? Date.now;
     this.helloTimeoutMs = options.helloTimeoutMs ?? DEFAULT_HELLO_TIMEOUT_MS;
@@ -38845,7 +39911,7 @@ var LiveHostCoordinator = class {
   attachHost(socket, daemonNonce) {
     const expectedNonce = Buffer.from(this.daemonInstanceNonce);
     const presentedNonce = Buffer.from(daemonNonce ?? "");
-    if (expectedNonce.byteLength !== presentedNonce.byteLength || !timingSafeEqual3(expectedNonce, presentedNonce)) {
+    if (expectedNonce.byteLength !== presentedNonce.byteLength || !timingSafeEqual2(expectedNonce, presentedNonce)) {
       socket.close(4003, "Invalid daemon instance nonce.");
       return;
     }
@@ -38968,7 +40034,7 @@ var LiveHostCoordinator = class {
   startCall(mode) {
     const call = {
       epoch: ++this.nextEpoch,
-      callId: randomUUID8(),
+      callId: randomUUID9(),
       mode,
       state: "starting",
       pendingPermission: false,
@@ -39027,7 +40093,7 @@ var LiveHostCoordinator = class {
         new Error("Qwen Live Host must be connected to change the shortcut.")
       );
     }
-    const requestId = randomUUID8();
+    const requestId = randomUUID9();
     return new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         this.rejectPendingShortcut(
@@ -39117,7 +40183,7 @@ var LiveHostCoordinator = class {
         )
       );
     }
-    const requestId = randomUUID8();
+    const requestId = randomUUID9();
     return new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         this.pendingAppshots.delete(requestId);
@@ -39457,7 +40523,7 @@ var LiveHostCoordinator = class {
       this.disconnectHost(lease, 4008, "Live Host heartbeat timed out.");
       return;
     }
-    const pingId = randomUUID8();
+    const pingId = randomUUID9();
     lease.pingId = pingId;
     this.sendHost({ type: "host.ping", pingId });
   }
@@ -39725,7 +40791,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/live/live-setup-controller.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 
 // packages/cli/src/serve/live/provider-credentials.ts
 init_esbuild_shims();
@@ -39823,7 +40889,7 @@ __name(resolveLiveProviderCredential, "resolveLiveProviderCredential");
 
 // packages/cli/src/serve/live/qwen-realtime-session.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 var QWEN_REALTIME_LIMITS = {
   maxInputAudioFrameBytes: 64 * 1024,
   maxOutputAudioFrameBytes: 256 * 1024,
@@ -40238,7 +41304,7 @@ function openQwenRealtimeSession(config, callbacks = {}, deps = {}) {
     const sendJson = /* @__PURE__ */ __name((body) => {
       if (terminal || closedByClient || ws.readyState !== ws.OPEN) return false;
       try {
-        ws.send(JSON.stringify({ event_id: randomUUID9(), ...body }));
+        ws.send(JSON.stringify({ event_id: randomUUID10(), ...body }));
         return true;
       } catch (error2) {
         fail(
@@ -41601,7 +42667,7 @@ async function validateCredential(credential) {
     apiKey: credential.apiKey,
     model: credential.realtimeModel,
     voice: credential.voice,
-    callEpoch: `setup-${randomUUID10()}`
+    callEpoch: `setup-${randomUUID11()}`
   });
   session.close({ discardPendingInput: true });
 }
@@ -41908,7 +42974,7 @@ __name(registerLiveSetupRoutes, "registerLiveSetupRoutes");
 // packages/cli/src/serve/live/live-host-installer.ts
 init_esbuild_shims();
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash5, randomUUID as randomUUID11 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID12 } from "node:crypto";
 import * as fs7 from "node:fs";
 import * as fsp5 from "node:fs/promises";
 import * as os2 from "node:os";
@@ -42083,7 +43149,7 @@ async function downloadAsset(asset, url, destination, onProgress, fetchImpl) {
     });
     throw new Error("Live Host download size does not match its manifest.");
   }
-  const hash = createHash5("sha256");
+  const hash = createHash4("sha256");
   let received = 0;
   const guard = new Transform({
     transform(chunk, _encoding, callback) {
@@ -42139,8 +43205,8 @@ async function installLatestHost(currentArchitecture, onStatus) {
   const archivePath = path16.join(temporaryDirectory, "Qwen-Live-Host.zip");
   const extractedPath = path16.join(temporaryDirectory, "extracted");
   const candidatePath = path16.join(extractedPath, LIVE_HOST_APP_NAME);
-  const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID11()}.app`;
-  const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID11()}.app`;
+  const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID12()}.app`;
+  const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID12()}.app`;
   let movedExisting = false;
   let installedCandidate = false;
   try {
@@ -42288,7 +43354,7 @@ var LiveHostInstaller = class {
 
 // packages/cli/src/serve/live/live-session-coordinator.ts
 init_esbuild_shims();
-import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID13 } from "node:crypto";
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join12 } from "node:path";
 
@@ -42663,7 +43729,7 @@ function openLiveAudioCapture(source, identifier) {
     );
     const stream = createWriteStream2(path19, { flags: "wx", mode: 384 });
     stream.on("error", () => void 0);
-    return { source, path: path19, stream, hash: createHash6("sha256"), bytes: 0 };
+    return { source, path: path19, stream, hash: createHash5("sha256"), bytes: 0 };
   } catch {
     return void 0;
   }
@@ -43018,7 +44084,7 @@ var LiveSessionCoordinator = class {
         context.speechInProgress = true;
         context.inputCommitPending = true;
         context.inputAwaitingResponse = false;
-        const partialItemId = itemId ?? `partial:${randomUUID12()}`;
+        const partialItemId = itemId ?? `partial:${randomUUID13()}`;
         context.activePartialInputItemId = partialItemId;
         if (!context.partialInputTranscripts.has(partialItemId)) {
           context.partialInputTranscripts.set(partialItemId, "");
@@ -43048,7 +44114,7 @@ var LiveSessionCoordinator = class {
       }, "onInputCommitted"),
       onInputTranscriptDelta: /* @__PURE__ */ __name(({ itemId, text }) => {
         if (this.isCurrentSocket(context, generation)) {
-          const partialItemId = itemId ?? context.activePartialInputItemId ?? `partial:${randomUUID12()}`;
+          const partialItemId = itemId ?? context.activePartialInputItemId ?? `partial:${randomUUID13()}`;
           context.activePartialInputItemId = partialItemId;
           context.partialInputTranscripts.set(partialItemId, text);
           this.options.host.setTranscript?.(context.epoch, text);
@@ -43058,7 +44124,7 @@ var LiveSessionCoordinator = class {
         if (this.isCurrentSocket(context, generation)) {
           context.speechInProgress = false;
           context.inputCommitPending = false;
-          const completedItemId = itemId ?? context.activePartialInputItemId ?? `unattributed:${randomUUID12()}`;
+          const completedItemId = itemId ?? context.activePartialInputItemId ?? `unattributed:${randomUUID13()}`;
           context.partialInputTranscripts.delete(completedItemId);
           if (context.activePartialInputItemId === completedItemId) {
             context.activePartialInputItemId = void 0;
@@ -43774,9 +44840,10 @@ var LiveSessionCoordinator = class {
     if (!sessionClosed) return;
     if (removeFreshTranscript) {
       try {
-        await new SessionService(runtime.workspaceCwd).removeSession(
-          session.sessionId
-        );
+        const transcriptRemoved = await new SessionService(
+          runtime.workspaceCwd
+        ).removeSession(session.sessionId);
+        if (transcriptRemoved) bridge.markSessionCatalogChanged();
       } catch {
       }
     }
@@ -43789,7 +44856,7 @@ var LiveSessionCoordinator = class {
     const runtime = context.runtime;
     if (!runtime) throw new Error("Conversation workspace is unavailable.");
     const bridge = runtime.bridge;
-    const promptId = randomUUID12();
+    const promptId = randomUUID13();
     const lastEventId = bridge.getSessionLastEventId(locator.sessionId);
     const turnAbort = new AbortController();
     this.inFlightTurnAborts.add(turnAbort);
@@ -44106,7 +45173,7 @@ var LiveSessionCoordinator = class {
 
 // packages/cli/src/serve/live/live-task-service.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 var DEFAULT_LIST_LIMIT = 20;
 var DEFAULT_READ_TURN_LIMIT = 3;
 var DEFAULT_WAIT_TIMEOUT_MS = 12e4;
@@ -44823,7 +45890,7 @@ var LiveTaskService = class {
       { sessionId, prompt: [{ type: "text", text: prompt }] },
       void 0,
       {
-        promptId: randomUUID13(),
+        promptId: randomUUID14(),
         onPromptAdmitted: /* @__PURE__ */ __name(() => {
           admitted = true;
           onAdmitted?.();
@@ -44889,10 +45956,11 @@ var LiveTaskService = class {
       removed = false;
     }
     if (removed) {
-      await runWithWorkspaceRuntimeStorage(
+      const persistedRemoved = await runWithWorkspaceRuntimeStorage(
         runtime,
-        () => createWorkspaceRuntimeSessionService(runtime).removeSession(session.sessionId).catch(() => void 0)
+        () => createWorkspaceRuntimeSessionService(runtime).removeSession(session.sessionId).catch(() => false)
       );
+      if (persistedRemoved) runtime.bridge.markSessionCatalogChanged();
     }
     if (projectless && removed) {
       await this.options.discardEmptyConversationDirectory(session.sessionId).catch(() => void 0);
@@ -45078,7 +46146,7 @@ var ConversationRuntimeManager = class {
 
 // packages/cli/src/serve/conversations/conversation-runtime-ownership.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import * as fs8 from "node:fs/promises";
 import * as path17 from "node:path";
@@ -45214,16 +46282,20 @@ async function readOwnerRecord(ownerPath) {
       process.platform === "win32" ? fsConstants2.O_RDONLY : fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW
     );
   } catch (error2) {
-    throw new UnsafeOwnershipStateError(void 0, { cause: error2 });
+    if (error2.code === "ELOOP") {
+      throw new UnsafeOwnershipStateError(void 0, { cause: error2 });
+    }
+    throw error2;
   }
   try {
     const handleStat = await handle.stat();
     if (!handleStat.isFile() || handleStat.nlink !== 1 || handleStat.dev !== pathStat.dev || handleStat.ino !== pathStat.ino || handleStat.size !== pathStat.size || process.platform !== "win32" && ((handleStat.mode & 511) !== 384 || typeof process.getuid === "function" && handleStat.uid !== process.getuid())) {
       throw new UnsafeOwnershipStateError();
     }
+    const serialized = await handle.readFile("utf8");
     let parsed;
     try {
-      parsed = JSON.parse(await handle.readFile("utf8"));
+      parsed = JSON.parse(serialized);
     } catch (error2) {
       throw new UnsafeOwnershipStateError(void 0, { cause: error2 });
     }
@@ -45349,7 +46421,7 @@ var FileConversationRuntimeOwnership = class {
           await this.commitRecord(identity, void 0);
         }
       }, "commitOwner");
-      const liveDiscovery = await import("./discovery-ORA5J7YP.js");
+      const liveDiscovery = await import("./discovery-X2NV535U.js");
       const handoff = await liveDiscovery.handoffLiveDiscoveryOwner(
         this.stableBaseDir,
         this.current,
@@ -45466,7 +46538,7 @@ var FileConversationRuntimeOwnership = class {
   async commitRecord(identity, expected) {
     const temporaryPath = path17.join(
       this.ownerDirectory,
-      `.runtime-owner.${this.current.pid}.${randomUUID14()}.tmp`
+      `.runtime-owner.${this.current.pid}.${randomUUID15()}.tmp`
     );
     let handle;
     let renamed = false;
@@ -45646,7 +46718,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       "createServeApp: runtime replacement/removal requires deps.getSessionBridges so session-id admission can inspect draining generations."
     );
   }
-  const app = (0, import_express6.default)();
+  const app = (0, import_express7.default)();
   const serveAppLifecycle = installServeAppLifecycle(
     app,
     deps.serveAppLifecycle
@@ -46307,18 +47379,17 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   app.locals.stopWorkspaceGitState = () => workspaceGitState.dispose();
   app.locals.stopWorkspaceGitStateForWorkspace = (workspaceCwd) => workspaceGitState.disposeWorkspace(workspaceCwd);
   const workspaceQualifiedAcpEnabled = acpHttpEnabledAtBoot;
-  if (opts.allowOrigins && opts.allowOrigins.length > 0) {
-    const parsedAllowOrigins = parseAllowOriginPatterns(opts.allowOrigins);
-    if (parsedAllowOrigins.allowAny && !opts.token) {
-      throw new Error(
-        `Refusing to start with --allow-origin '*' but no bearer token configured. '*' admits any cross-origin browser to the API; without a token, any local page can drive the daemon. Set a token or list specific origins instead of '*'.`
-      );
-    }
-    app.use(allowOriginCors(parsedAllowOrigins));
-  } else {
-    app.use(denyBrowserOriginCors);
+  const parsedAllowOrigins = parseAllowOriginPatterns(opts.allowOrigins ?? []);
+  if (parsedAllowOrigins.allowAny && !opts.token) {
+    throw new Error(
+      `Refusing to start with --allow-origin '*' but no bearer token configured. '*' admits any cross-origin browser to the API; without a token, any local page can drive the daemon. Set a token or list specific origins instead of '*'.`
+    );
   }
+  const originAllowlist = new MutableOriginAllowlist(parsedAllowOrigins);
+  app.use(allowOriginCors(originAllowlist));
   app.use(hostAllowlist(opts.hostname, getPort));
+  const credentials = new CredentialStore(opts.token);
+  const authenticate = bearerAuth(credentials);
   const rateLimiter = installRateLimiter(app, opts, daemonLog, {
     mount: false,
     workspaceQualifiedAcpEnabled
@@ -46330,6 +47401,13 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     getRateLimiter: /* @__PURE__ */ __name(() => rateLimiter, "getRateLimiter")
   });
   if (healthRoutes.exposeHealthPreAuth) {
+    app.use("/health", (req, res, next) => {
+      if (listenerIdentityOf(req).kind === "local-control") {
+        authenticate(req, res, next);
+        return;
+      }
+      next();
+    });
     healthRoutes.register(app);
   }
   installAccessLogMiddleware(app, daemonLog);
@@ -46373,7 +47451,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       daemonLog
     });
   }
-  app.use(bearerAuth(opts.token));
+  app.use(authenticate);
   if (rateLimiter) {
     app.use(rateLimiter.middleware);
   }
@@ -47151,6 +48229,10 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     fsFactory: primaryRouteFileSystemFactory,
     deviceFlowRegistry,
     token: opts.token,
+    // The WS upgrade bypasses Express middleware, so it needs the same
+    // listener-scoped credentials the REST gate uses — otherwise the
+    // `qwen-bearer.*` subprotocol would be a way around the scoping.
+    credentials,
     // Mirror the REST CORS allowlist onto the WS CSRF wall so an
     // explicitly permitted origin (e.g. the extension's
     // `chrome-extension://<id>`) can open the reverse tool channel.
@@ -47222,6 +48304,26 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   if (acpHandleRef.current) {
     app.locals["acpHandle"] = acpHandleRef.current;
   }
+  const localControlService = new LocalControlService({
+    app,
+    credentials,
+    originAllowlist,
+    // Resolved through the ref on each call rather than captured so Local
+    // Control cannot attach to a stale ACP mount.
+    attachWebSocket: /* @__PURE__ */ __name((server) => acpHandleRef.current?.attachServer(server), "attachWebSocket"),
+    detachWebSocket: /* @__PURE__ */ __name((server) => acpHandleRef.current?.detachServer(server), "detachWebSocket"),
+    getPort,
+    tlsPaths: opts.tlsCert && opts.tlsKey ? { cert: opts.tlsCert, key: opts.tlsKey } : void 0
+  });
+  app.locals["localControlService"] = localControlService;
+  registerWorkspaceLocalControlRoutes(app, {
+    service: localControlService,
+    mutate,
+    safeBody,
+    isDaemonDraining: deps.isChannelControlDraining,
+    webShellAvailable: Boolean(webShellDir),
+    primaryBindHostname: opts.hostname
+  });
   if (webShellDir) {
     mountWebShellSpaFallback(app, webShellDir, webShellFrameAncestors);
   }