@qwen-code/qwen-code 0.21.14 → 0.21.15

package/chunks/{server-YXB3DBN7.js → server-ZMZPHJEC.js}

@@ -10,6 +10,7 @@ import {
   formatWorkspaceMemoryForgetSummary,
   isCompatibleLiveSessionSource,
   isReservedLiveSessionSource,
+  isReservedStandaloneSessionSource,
   isValidServerName,
   normalizeChannelDelivery,
   parseChannelDelivery,
@@ -20,13 +21,13 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-73JUK3ZW.js";
+} from "./chunk-63AIQ2IZ.js";
 import {
   deriveWebSocketBase,
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-WSSH2BNO.js";
+} from "./chunk-FQZBD3PY.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -38,15 +39,15 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-K2Y45XXS.js";
+} from "./chunk-DFOKBPH5.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-OVY67CYC.js";
+} from "./chunk-G32ESUUC.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-E7REAOTN.js";
-import "./chunk-4SR45OM4.js";
+import "./chunk-Q5QDZXKL.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-3Z43GZUQ.js";
@@ -90,6 +91,8 @@ import {
   createManagedScratchDirectory,
   createMutationGate,
   createRateLimiter,
+  daemonInboundTraceIdContext,
+  daemonTelemetryResponseContext,
   detectFromLoopback,
   getAdvertisedServeFeatures,
   getDeferredRuntimeRequestTiming,
@@ -124,7 +127,7 @@ import {
   tagListener,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-UYDGFWIJ.js";
+} from "./chunk-NYN4RD3K.js";
 import "./chunk-VGHZT6JR.js";
 import {
   isLoopbackBind,
@@ -135,7 +138,12 @@ import "./chunk-UXEO7E3V.js";
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-QRVHGEVY.js";
+} from "./chunk-GCWILQKA.js";
+import {
+  readRecentPromptTerminals,
+  reconcileDanglingPromptTerminals,
+  withPromptTerminals
+} from "./chunk-W5YD3QRT.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -149,14 +157,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-W7EYJGN7.js";
+} from "./chunk-PWQPWISR.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-OJB5FYVK.js";
+} from "./chunk-4IOBHNV2.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -164,13 +172,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-H3SHU2XU.js";
+} from "./chunk-I3AB5DOZ.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-SFJMFZT5.js";
-import "./chunk-WGHHA7ZH.js";
+} from "./chunk-IBUXQJHH.js";
+import "./chunk-3C55EUJX.js";
 import {
   createTotalSessionAdmissionController
 } from "./chunk-X2UOOG5V.js";
@@ -190,18 +198,18 @@ import {
 } from "./chunk-4JRM2BSM.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-E5WQMF3K.js";
+} from "./chunk-67L6PVD6.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-FN6M5WUL.js";
-import "./chunk-UGK4K2N2.js";
-import "./chunk-MDIGJH5X.js";
+} from "./chunk-IFOR6I5C.js";
+import "./chunk-JS73NNWF.js";
+import "./chunk-ZL3HKVEQ.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-L3T4V5GZ.js";
+} from "./chunk-GYVB4P5B.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -211,17 +219,17 @@ import "./chunk-WCCLLK7X.js";
 import "./chunk-OCPBI7J5.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-N6RSOOWJ.js";
+} from "./chunk-AAG7I5CR.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-EOPBFLA5.js";
+} from "./chunk-AKN26LMT.js";
 import {
   snapshotProcessEnv
-} from "./chunk-CEXU72GE.js";
+} from "./chunk-5NAJDTVP.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-V6WEMZPD.js";
+} from "./chunk-B72KNVKO.js";
 import "./chunk-BGXZBI5B.js";
 import "./chunk-Z4X5MTRT.js";
 import {
@@ -240,16 +248,16 @@ import {
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-55VKMB7X.js";
-import "./chunk-U657UZJN.js";
+} from "./chunk-A7MIUCUQ.js";
+import "./chunk-5WEMSDPR.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-NRPXRNN4.js";
+} from "./chunk-WXFFCRKG.js";
 import "./chunk-45NQKMYB.js";
 import {
   supportedChannelCatalog
-} from "./chunk-5IYS4WWR.js";
+} from "./chunk-WAPL2PHU.js";
 import "./chunk-V6WHFGST.js";
 import {
   getStableLiveDiscoveryBaseDir
@@ -259,13 +267,13 @@ import {
   LIVE_HOST_PROTOCOL_VERSION,
   LIVE_INPUT_AUDIO_EPOCH_BYTES
 } from "./chunk-NKLP3DCK.js";
-import "./chunk-BQWNIPTE.js";
+import "./chunk-V4UBYT3Y.js";
 import {
   STATUS_SCHEMA_VERSION,
   SessionRestoreTimeoutError,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-UC67T4SF.js";
+} from "./chunk-AQFWV4YF.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
@@ -276,13 +284,13 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-SFTKAX4O.js";
+} from "./chunk-OFJ6OFIT.js";
 import {
   CHANNEL_PROMPT_META_KEY,
   DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   REQUESTED_SESSION_ID_META_KEY,
   gradeActiveWorkCoverage
-} from "./chunk-WP4WIUOJ.js";
+} from "./chunk-QQUVPMMZ.js";
 import {
   BranchWhilePromptActiveError,
   BridgeChannelQuarantinedError,
@@ -336,14 +344,14 @@ import {
   QWEN_SERVER_TOKEN_ENV,
   isChannelDeliveryError,
   isChannelWebhookEnqueueError
-} from "./chunk-YP5KH5Y7.js";
+} from "./chunk-ND7NOI4P.js";
 import {
   normalizeWorkerDiagnostic
 } from "./chunk-A6NRNRKE.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
-import "./chunk-HIBNSEJE.js";
+import "./chunk-UDG5EZJI.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
@@ -362,30 +370,31 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-VFP5YOHJ.js";
+} from "./chunk-PRIX4D6T.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-CZK622ZK.js";
+import "./chunk-6IFWBM24.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
 import {
   detectSystemLanguage,
   resolveLanguageSetting
-} from "./chunk-VTOLYFWM.js";
+} from "./chunk-W3M6P3UR.js";
 import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-MVHJZ3FZ.js";
+import "./chunk-DZNQHKZZ.js";
 import "./chunk-CXJHQVEK.js";
-import "./chunk-PCETXVVV.js";
+import "./chunk-3X6KVX37.js";
 import "./chunk-WZMH7II3.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-C3T6M24E.js";
+} from "./chunk-RLYXWNS3.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
 } from "./chunk-MR3PXB6E.js";
+import "./chunk-LJZSMWOH.js";
 import {
   ALL_PROVIDERS,
   BTW_MAX_INPUT_LENGTH,
@@ -394,6 +403,7 @@ import {
   ClientMcpRegistrar,
   DEFAULT_LOG_LIMIT,
   ExtensionManager,
+  ExtensionNotUpdatableError,
   GITHUB_PR_ERROR_MESSAGE_MAX,
   GROUP_COLOR_OPTIONS,
   GitWorktreeService,
@@ -407,6 +417,7 @@ import {
   SESSION_TRANSCRIPT_MAX_LIMIT,
   SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
   SESSION_WRITER_RPC_CODES,
+  SessionIdCaseConflictError,
   SessionOrganizationError,
   SessionOrganizationService,
   SessionService,
@@ -443,6 +454,7 @@ import {
   gitPull,
   gitPush,
   glob,
+  isSupportedArchiveUrl,
   isValidCheckoutRef,
   isValidRefName,
   loadIgnoreRules,
@@ -460,7 +472,7 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-OFTPCOGR.js";
+} from "./chunk-L7RG5PVT.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
@@ -468,12 +480,12 @@ import "./chunk-CQ35AJ4Z.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-FS5NGKWC.js";
-import "./chunk-SLILKYV2.js";
-import "./chunk-NVRMCWTP.js";
-import "./chunk-AKBOLMUF.js";
+} from "./chunk-F5JZDC4O.js";
+import "./chunk-T2LUUKRI.js";
+import "./chunk-A7NBZBGQ.js";
+import "./chunk-7S22SX2L.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-544KT7X4.js";
+import "./chunk-BBMVUTXO.js";
 import {
   nextFireTime,
   parseCron
@@ -486,48 +498,42 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-OBJYN4MX.js";
-import "./chunk-2C6HJMG3.js";
+} from "./chunk-G64PEZZ5.js";
+import "./chunk-O75QDGQF.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
 import {
   APPROVAL_MODES
-} from "./chunk-RWDNJBWN.js";
-import "./chunk-WPVUOVYX.js";
-import "./chunk-MIPFDQAF.js";
+} from "./chunk-ZUISK67X.js";
+import "./chunk-3EQHT3IC.js";
+import "./chunk-4W4BROUS.js";
 import "./chunk-MLXTMF7H.js";
-import "./chunk-KV27IEHM.js";
-import "./chunk-E3DYKPYZ.js";
-import "./chunk-4ZMS3JCR.js";
-import "./chunk-DGJ7O55J.js";
+import "./chunk-L5JHSPET.js";
+import "./chunk-X7EQHW5L.js";
+import {
+  parseGoalControlRequest
+} from "./chunk-JBSW7JA6.js";
+import "./chunk-O327G3QW.js";
 import {
-  addDaemonRequestAttribute,
-  captureDaemonTelemetryContext,
-  emitDaemonLog,
-  hashDaemonWorkspace,
   recordDaemonBridgeError,
-  recordDaemonError,
-  recordDaemonHttpRequest,
-  recordDaemonHttpResponse,
-  runWithDaemonTelemetryContext,
-  withDaemonRequestSpan
-} from "./chunk-OO4FKHLO.js";
+  recordDaemonHttpRequest
+} from "./chunk-2GM44E7D.js";
 import "./chunk-SAH4BD2J.js";
-import "./chunk-XLLKYULU.js";
-import "./chunk-PT4I7NBA.js";
+import "./chunk-ZWWU6KNS.js";
+import "./chunk-VX7TFATF.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-2J3OJGTL.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-SG7ZP5PG.js";
+} from "./chunk-HHNSO2Y4.js";
 import "./chunk-K623ENWT.js";
 import {
   escapeXml
 } from "./chunk-AQ37AY7B.js";
-import "./chunk-KBXKR5R2.js";
+import "./chunk-M5AIO24H.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -536,24 +542,36 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-I3N2Z25H.js";
+} from "./chunk-47VTGCYK.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-ROIYNTHJ.js";
-import "./chunk-2B2BF7P7.js";
+import "./chunk-MD7XDTW7.js";
+import "./chunk-FAIJ5UIU.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-YZHRN3CF.js";
-import "./chunk-FAAUPSY2.js";
+import "./chunk-SWOKDPS5.js";
+import "./chunk-HEMFCAHG.js";
 import "./chunk-KM73TBQ4.js";
 import "./chunk-AXMWHKXA.js";
 import "./chunk-GLCZKT5V.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-QFJ5JHQR.js";
+import "./chunk-PXOIRYE5.js";
 import "./chunk-CR3C7WXL.js";
+import {
+  addDaemonRequestAttribute,
+  captureDaemonTelemetryContext,
+  emitDaemonLog,
+  extractDaemonHttpTraceContext,
+  extractInboundTraceId,
+  hashDaemonWorkspace,
+  recordDaemonError,
+  recordDaemonHttpResponse,
+  runWithDaemonTelemetryContext,
+  withDaemonRequestSpan
+} from "./chunk-7NLDU6J2.js";
 import "./chunk-XWRJCPHC.js";
 import {
   parseLineTolerant,
   read
-} from "./chunk-KC4WMLZO.js";
+} from "./chunk-EXY6APEA.js";
 import "./chunk-YRLW2MSX.js";
 import "./chunk-VGC4I5JJ.js";
 import {
@@ -564,32 +582,32 @@ import {
   getAllGeminiMdFilenames,
   isUtf8CompatibleEncoding,
   isWithinRoot
-} from "./chunk-3PWCMXIR.js";
-import "./chunk-CHHABXPE.js";
-import "./chunk-MA2HEDVP.js";
-import "./chunk-XUJNK7Y6.js";
-import "./chunk-6HY6IF3Z.js";
-import "./chunk-2A6VQJYK.js";
+} from "./chunk-MGEWDLRO.js";
+import "./chunk-5AAW6E3C.js";
+import "./chunk-4CKU5K2R.js";
+import "./chunk-7WVB4FMG.js";
+import "./chunk-OUYRA764.js";
+import "./chunk-DK4HL3IB.js";
 import "./chunk-F6WFNA7U.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
 import "./chunk-YHC2EYYG.js";
-import "./chunk-CPHEPGAO.js";
-import "./chunk-DVR7XKO5.js";
-import "./chunk-YECDICIO.js";
+import "./chunk-722JBVVW.js";
+import "./chunk-B5LEKTE7.js";
+import "./chunk-Q6ETBOWF.js";
+import "./chunk-HHJLM3WQ.js";
 import {
+  isTelemetrySdkInitialized,
   redactUrlCredentials,
   stripAnsiAndControl
-} from "./chunk-XT4RKHVE.js";
-import "./chunk-HHJLM3WQ.js";
-import "./chunk-D34RDOLP.js";
+} from "./chunk-RZ4PE3ER.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   getErrorMessage,
   runWithoutDebugLogSession
-} from "./chunk-BUQDLC2G.js";
+} from "./chunk-XFRYCCVC.js";
 import "./chunk-VOQXFAY5.js";
 import {
   writeStderrLine,
@@ -606,7 +624,7 @@ import {
 } from "./chunk-TYAMGABM.js";
 import "./chunk-FCMNKVXT.js";
 import "./chunk-AMDSOFFV.js";
-import "./chunk-QUGAUQGJ.js";
+import "./chunk-GX2THELY.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -5998,11 +6016,13 @@ var RequestedSessionIdAdmissionError = class extends Error {
   name = "RequestedSessionIdAdmissionError";
 };
 async function persistedSessionExists(sessionService, sessionId) {
-  if (await sessionService.getSessionLocation(sessionId) !== void 0) {
-    return true;
-  }
-  if (await sessionService.findSessionIdIgnoringCase?.(sessionId) !== void 0) {
-    return true;
+  try {
+    if (await sessionService.findSessionIdIgnoringCase(sessionId) !== void 0) {
+      return true;
+    }
+  } catch (error2) {
+    if (error2 instanceof SessionIdCaseConflictError) return true;
+    throw error2;
   }
   for (const state of ["active", "archived"]) {
     try {
@@ -8311,8 +8331,13 @@ var SessionArchiveCoordinator = class {
   maintenanceSealed = false;
   activeMaintenance = 0;
   maintenanceDrain;
+  // Lock keys are canonicalized like every other session-id lookup: batch
+  // delete/archive/unarchive lock raw caller spellings while restore locks
+  // the request spelling, and on a case-insensitive filesystem both reach
+  // the same transcript file — uncanonicalized keys would let a differently
+  // cased caller id slip past a held guard and unlink it mid-restore.
   assertNotTransitioning(sessionId) {
-    if (this.exclusive.has(sessionId)) {
+    if (this.exclusive.has(normalizeSessionIdForLookup(sessionId))) {
       throw new SessionArchivingError(sessionId);
     }
   }
@@ -8320,7 +8345,9 @@ var SessionArchiveCoordinator = class {
     if (this.maintenanceSealed) {
       throw new DaemonDrainingError();
     }
-    const uniqueSessionIds = [...new Set(sessionIds)];
+    const uniqueSessionIds = [
+      ...new Set(sessionIds.map(normalizeSessionIdForLookup))
+    ];
     for (const sessionId of uniqueSessionIds) {
       this.assertNotTransitioning(sessionId);
       if ((this.shared.get(sessionId) ?? 0) > 0) {
@@ -8362,7 +8389,9 @@ var SessionArchiveCoordinator = class {
     if (this.maintenanceSealed) {
       throw new DaemonDrainingError();
     }
-    const uniqueSessionIds = [...new Set(sessionIds)];
+    const uniqueSessionIds = [
+      ...new Set(sessionIds.map(normalizeSessionIdForLookup))
+    ];
     for (const sessionId of uniqueSessionIds) {
       this.assertNotTransitioning(sessionId);
     }
@@ -8556,7 +8585,9 @@ async function deleteDaemonSessions(params) {
     coordinatorLockHeld = false,
     onError
   } = params;
-  const uniqueSessionIds = [...new Set(sessionIds)];
+  const uniqueSessionIds = [
+    ...new Set(sessionIds.map(normalizeSessionIdForLookup))
+  ];
   if (!coordinatorLockHeld) {
     for (const sessionId of uniqueSessionIds) {
       coordinator.assertNotTransitioning(sessionId);
@@ -8566,22 +8597,40 @@ async function deleteDaemonSessions(params) {
     uniqueSessionIds.map(async (sessionId) => {
       try {
         const mutateSession = /* @__PURE__ */ __name(async () => {
+          const removePersistedSession = /* @__PURE__ */ __name(async () => {
+            const result = await deletePersistedSessionWithLease(
+              service,
+              sessionId
+            );
+            if (result.kind === "error") {
+              onError?.({
+                phase: "remove",
+                sessionId,
+                error: errorMessage(result.error)
+              });
+              return result;
+            }
+            try {
+              await bridge.deleteSessionAttachments(sessionId);
+              return result;
+            } catch (error2) {
+              onError?.({
+                phase: "delete",
+                sessionId,
+                error: errorMessage(error2)
+              });
+              return {
+                kind: "error",
+                error: error2,
+                mutationApplied: result.mutationApplied
+              };
+            }
+          }, "removePersistedSession");
           try {
             await bridge.closeSession(sessionId);
           } catch (error2) {
             if (isSessionNotFoundError(error2)) {
-              const result2 = await deletePersistedSessionWithLease(
-                service,
-                sessionId
-              );
-              if (result2.kind === "error") {
-                onError?.({
-                  phase: "remove",
-                  sessionId,
-                  error: errorMessage(result2.error)
-                });
-              }
-              return result2;
+              return await removePersistedSession();
             }
             onError?.({
               phase: "close",
@@ -8594,18 +8643,7 @@ async function deleteDaemonSessions(params) {
               mutationApplied: false
             };
           }
-          const result = await deletePersistedSessionWithLease(
-            service,
-            sessionId
-          );
-          if (result.kind === "error") {
-            onError?.({
-              phase: "remove",
-              sessionId,
-              error: errorMessage(result.error)
-            });
-          }
-          return result;
+          return await removePersistedSession();
         }, "mutateSession");
         return await (coordinatorLockHeld ? mutateSession() : coordinator.runExclusiveMany([sessionId], mutateSession));
       } catch (error2) {
@@ -8746,7 +8784,9 @@ async function archiveDaemonSessions(params) {
     coordinator,
     coordinatorLockHeld = false
   } = params;
-  const uniqueSessionIds = [...new Set(sessionIds)];
+  const uniqueSessionIds = [
+    ...new Set(sessionIds.map(normalizeSessionIdForLookup))
+  ];
   if (!coordinatorLockHeld) {
     for (const sessionId of uniqueSessionIds) {
       coordinator.assertNotTransitioning(sessionId);
@@ -8888,7 +8928,9 @@ async function unarchiveDaemonSessions(params) {
     coordinator,
     coordinatorLockHeld = false
   } = params;
-  const uniqueSessionIds = [...new Set(sessionIds)];
+  const uniqueSessionIds = [
+    ...new Set(sessionIds.map(normalizeSessionIdForLookup))
+  ];
   if (!coordinatorLockHeld) {
     for (const sessionId of uniqueSessionIds) {
       coordinator.assertNotTransitioning(sessionId);
@@ -9676,6 +9718,15 @@ function toRpcError(err) {
           sessionId: err.sessionId
         }
       };
+    case "SessionIdCaseConflictError":
+      return {
+        code: RPC.INTERNAL_ERROR,
+        message: errMsg(err),
+        data: {
+          errorKind: "session_conflict",
+          sessionId: err.sessionId
+        }
+      };
     case "SessionArchivingError":
       return {
         code: RPC.INTERNAL_ERROR,
@@ -10272,6 +10323,19 @@ var AcpDispatcher = class {
             return;
           }
           const sessionRuntime = this.getSessionRuntimeContext();
+          if (isReservedStandaloneSessionSource({
+            sourceType: typeof params["sourceType"] === "string" ? params["sourceType"] : void 0
+          })) {
+            conn.sendConn(
+              error(
+                id,
+                RPC.INVALID_PARAMS,
+                "The requested session source is reserved for daemon-owned standalone sessions.",
+                { errorKind: "reserved_session_source" }
+              )
+            );
+            return;
+          }
           const source = parseSessionSource(
             params["sourceType"],
             params["sourceId"]
@@ -10405,23 +10469,54 @@ var AcpDispatcher = class {
             }
           );
           try {
+            const guardSessionService = new SessionService(cwd, {
+              runtimeBaseDir: sessionRuntime.sessionRuntimeBaseDir
+            });
+            let persistedGuardId;
+            try {
+              persistedGuardId = await guardSessionService.findSessionIdIgnoringCase(sessionId);
+            } catch (error2) {
+              if (error2 instanceof SessionIdCaseConflictError && await guardSessionService.getSessionLocation(
+                error2.candidateSessionId ?? sessionId
+              ) === "conflict") {
+                throw new SessionConflictError(sessionId);
+              }
+              throw error2;
+            }
             const restored = await this.archiveCoordinator.runSharedMany(
               [sessionId],
               async () => {
                 assertGenerationOpen?.();
+                const sessionService = new SessionService(cwd, {
+                  runtimeBaseDir: sessionRuntime.sessionRuntimeBaseDir
+                });
+                let storageSessionId = persistedGuardId ?? sessionId;
+                let persistedSessionId;
+                try {
+                  persistedSessionId = await sessionService.findSessionIdIgnoringCase(sessionId);
+                } catch (error2) {
+                  if (error2 instanceof SessionIdCaseConflictError && await sessionService.getSessionLocation(
+                    error2.candidateSessionId ?? sessionId
+                  ) === "conflict") {
+                    throw new SessionConflictError(sessionId);
+                  }
+                  throw error2;
+                }
+                if (persistedSessionId) {
+                  storageSessionId = persistedSessionId;
+                } else if (this.liveSessionIsolation) {
+                  throw new SessionNotFoundError(sessionId);
+                }
                 await assertSessionLoadable(
                   cwd,
-                  sessionId,
+                  storageSessionId,
                   sessionRuntime.sessionRuntimeBaseDir
                 );
-                const sessionService = new SessionService(cwd, {
-                  runtimeBaseDir: sessionRuntime.sessionRuntimeBaseDir
-                });
                 const metadata = this.liveSessionIsolation ? await readLoadableLiveConversationMetadata(
-                  sessionId,
-                  (candidateId) => sessionService.readCreationMetadata(candidateId)
-                ) : await sessionService.readCreationMetadata(sessionId);
-                if (metadata === void 0) {
+                  storageSessionId,
+                  sessionService
+                ) : await sessionService.readCreationMetadata(storageSessionId);
+                if (metadata === void 0 || this.liveSessionIsolation !== void 0 && isReservedStandaloneSessionSource(metadata)) {
                   throw new SessionNotFoundError(sessionId);
                 }
                 const liveConversationCwd = this.liveSessionIsolation ? await this.liveSessionIsolation.materializeConversationDirectory(
@@ -19348,7 +19443,7 @@ function createExtensionsController(deps) {
         version: ext.version,
         isActive: ext.isActive,
         path: ext.path,
-        ...ext.installMetadata?.source ? {
+        ...ext.installMetadata?.source && ext.installMetadata.type !== "snapshot" ? {
           source: redactExtensionDisplaySource(
             ext.installMetadata.source
           )
@@ -19357,7 +19452,8 @@ function createExtensionsController(deps) {
         ...ext.installMetadata?.originSource ? { originSource: ext.installMetadata.originSource } : {},
         ...ext.installMetadata?.ref ? { ref: ext.installMetadata.ref } : {},
         ...ext.installMetadata?.autoUpdate !== void 0 ? { autoUpdate: ext.installMetadata.autoUpdate } : {},
-        updateState: ext.installMetadata ? "unknown" : "not updatable",
+        ...ext.installMetadata?.type === "snapshot" ? { credentialPersistence: "one_time" } : ext.installMetadata?.credentialPersistence === "stored" ? { credentialPersistence: "stored" } : {},
+        updateState: ext.installMetadata?.type === "snapshot" ? "not updatable" : ext.installMetadata ? "unknown" : "not updatable",
         capabilities,
         details: {
           mcpServers: ext.mcpServers ? Object.keys(ext.mcpServers) : [],
@@ -19407,6 +19503,7 @@ var EXTENSION_INTERACTION_DEADLINE_MS = 10 * 6e4;
 var EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS = EXTENSION_PREPARE_DEADLINE_MS + EXTENSION_INTERACTION_DEADLINE_MS;
 var EXTENSION_UPDATE_CHECK_DEADLINE_MS = 2 * 6e4;
 var EXTENSION_ARCHIVE_UPLOAD_LIMIT = "10mb";
+var MAX_EXTENSION_BATCH_SIZE = 100;
 var extensionArchiveBodyParser = import_express2.default.raw({
   type: "application/octet-stream",
   limit: EXTENSION_ARCHIVE_UPLOAD_LIMIT
@@ -19447,6 +19544,32 @@ var parseExtensionScope = /* @__PURE__ */ __name((body, res) => {
   }
   return scope === "user" ? "User" /* User */ : "Workspace" /* Workspace */;
 }, "parseExtensionScope");
+var parseExtensionBatchNames = /* @__PURE__ */ __name((req, res, safeBody2) => {
+  const rawNames = safeBody2(req)["extensionNames"];
+  if (!Array.isArray(rawNames) || rawNames.length === 0 || rawNames.length > MAX_EXTENSION_BATCH_SIZE || !rawNames.every((name) => typeof name === "string")) {
+    res.status(400).json({
+      error: `\`extensionNames\` must be a non-empty string array (max ${MAX_EXTENSION_BATCH_SIZE})`,
+      code: "invalid_extension_names"
+    });
+    return void 0;
+  }
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of rawNames) {
+    if (!/^[a-zA-Z0-9-_.]+$/.test(name)) {
+      res.status(400).json({
+        error: `Invalid extension name "${name}"`,
+        code: "invalid_extension_name"
+      });
+      return void 0;
+    }
+    const normalizedName = name.toLowerCase();
+    if (seen.has(normalizedName)) continue;
+    seen.add(normalizedName);
+    names.push(name);
+  }
+  return names;
+}, "parseExtensionBatchNames");
 var parseExtensionRegistryUrl = /* @__PURE__ */ __name((value, res) => {
   let parsed;
   try {
@@ -19487,23 +19610,76 @@ var parsePotentialSourceUrl = /* @__PURE__ */ __name((source) => {
     }
   }
 }, "parsePotentialSourceUrl");
-var validateExtensionSourceHost = /* @__PURE__ */ __name((source, res) => {
+var parseExtensionInstallSource = /* @__PURE__ */ __name((source, persistence, res) => {
+  if (persistence !== void 0 && persistence !== "stored" && persistence !== "one_time") {
+    res.status(400).json({
+      error: '`credentialPersistence` must be "stored" or "one_time"'
+    });
+    return null;
+  }
   const parsed = parsePotentialSourceUrl(source);
-  if (!parsed) return true;
-  if (parsed.username || parsed.password) {
-    res.status(400).json({ error: "`source` must not include credentials" });
-    return false;
+  if (!parsed) {
+    if (persistence !== void 0) {
+      res.status(400).json({
+        error: "`credentialPersistence` requires source URL credentials"
+      });
+      return null;
+    }
+    return { source };
   }
   if (isBlockedAuthProviderHost(parsed.hostname)) {
     res.status(400).json({ error: "`source` host is not allowed" });
-    return false;
+    return null;
   }
   if (parsed.protocol !== "https:") {
     res.status(400).json({ error: "`source` must use https" });
-    return false;
+    return null;
   }
-  return true;
-}, "validateExtensionSourceHost");
+  const authority = /^[a-z][a-z\d+.-]*:\/\/([^/?#]*)/i.exec(source)?.[1];
+  const hasUserInfo = !!parsed.username || !!parsed.password || authority?.includes("@") === true;
+  if (!hasUserInfo) {
+    if (persistence !== void 0) {
+      res.status(400).json({
+        error: "`credentialPersistence` requires source URL credentials"
+      });
+      return null;
+    }
+    return { source };
+  }
+  const hasControlCharacter = /* @__PURE__ */ __name((value) => Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code >= 127 && code <= 159;
+  }), "hasControlCharacter");
+  if (hasControlCharacter(source)) {
+    res.status(400).json({ error: "`source` credentials are invalid" });
+    return null;
+  }
+  let username;
+  let password;
+  try {
+    username = decodeURIComponent(parsed.username);
+    password = decodeURIComponent(parsed.password);
+  } catch {
+    res.status(400).json({ error: "`source` credentials are invalid" });
+    return null;
+  }
+  const invalidText = /* @__PURE__ */ __name((value, maxBytes) => Buffer.byteLength(value, "utf8") > maxBytes || hasControlCharacter(value), "invalidText");
+  if (!username && !password || invalidText(username, 256) || invalidText(password, 4096)) {
+    res.status(400).json({ error: "`source` credentials are invalid" });
+    return null;
+  }
+  parsed.username = "";
+  parsed.password = "";
+  const credentialPersistence = persistence ?? "one_time";
+  return {
+    source: parsed.toString(),
+    gitCredential: {
+      username,
+      password,
+      persistence: credentialPersistence
+    }
+  };
+}, "parseExtensionInstallSource");
 var validateExtensionSourceMetadata = /* @__PURE__ */ __name((installMetadata) => {
   if (installMetadata.type !== "git") return true;
   const parsed = parsePotentialSourceUrl(installMetadata.source);
@@ -20020,6 +20196,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         const allowPreRelease = body["allowPreRelease"];
         const registry = body["registry"];
         const consent = body["consent"];
+        const credentialPersistence = body["credentialPersistence"];
         if (!source || typeof source !== "string") {
           res.status(400).json({ error: "Missing or invalid source" });
           return;
@@ -20044,7 +20221,6 @@ function registerWorkspaceExtensionRoutes(app, deps) {
           res.status(400).json({ error: "`registry` must be a string" });
           return;
         }
-        const sourceValue = source;
         const refValue = typeof ref === "string" ? ref : void 0;
         const autoUpdateValue = typeof autoUpdate === "boolean" ? autoUpdate : void 0;
         const allowPreReleaseValue = typeof allowPreRelease === "boolean" ? allowPreRelease : void 0;
@@ -20057,7 +20233,25 @@ function registerWorkspaceExtensionRoutes(app, deps) {
           });
           return;
         }
-        if (!validateExtensionSourceHost(sourceValue, res)) {
+        const parsedSource = parseExtensionInstallSource(
+          source,
+          credentialPersistence,
+          res
+        );
+        if (!parsedSource) return;
+        const sourceValue = parsedSource.source;
+        body["source"] = sourceValue;
+        const gitCredential = parsedSource.gitCredential;
+        if (gitCredential?.persistence === "one_time" && autoUpdateValue) {
+          res.status(400).json({
+            error: "`autoUpdate` is not supported with one-time credentials"
+          });
+          return;
+        }
+        if (gitCredential && isSupportedArchiveUrl(sourceValue)) {
+          res.status(400).json({
+            error: "Git credentials require an HTTPS Git install source."
+          });
           return;
         }
         const localSource = /^[A-Za-z]:[\\/]/.test(sourceValue) || sourceValue.startsWith("/") || sourceValue.startsWith(".");
@@ -20107,7 +20301,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         }
         ctrl.runQueuedExtensionMutation(
           "install",
-          { source: sourceValue },
+          gitCredential?.persistence === "one_time" ? {} : { source: sourceValue },
           res,
           async (extensionManager, _signal, context, operationId) => {
             const prepared = await context.prepare(async (signal) => {
@@ -20119,6 +20313,11 @@ function registerWorkspaceExtensionRoutes(app, deps) {
                   "Only GitHub, Git, and npm extension installs are supported over the daemon endpoint."
                 );
               }
+              if (gitCredential && installMetadata.type !== "git" && installMetadata.type !== "github-release") {
+                throw new Error(
+                  "Git credentials require an HTTPS Git install source."
+                );
+              }
               if (installMetadata.type === "npm" && refValue) {
                 throw new Error("--ref is not applicable for npm extensions.");
               }
@@ -20143,7 +20342,8 @@ function registerWorkspaceExtensionRoutes(app, deps) {
                 },
                 initialActivation: { scope: "user" },
                 requestConsent: /* @__PURE__ */ __name(() => Promise.resolve(), "requestConsent"),
-                signal
+                signal,
+                ...gitCredential ? { gitCredential } : {}
               });
             });
             try {
@@ -20155,9 +20355,13 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               );
               return {
                 status: "installed",
-                source: sourceValue,
+                ...gitCredential?.persistence === "one_time" ? {} : { source: sourceValue },
                 name: committed.identity.name,
-                version: committed.version
+                version: committed.version,
+                ...gitCredential ? {
+                  credentialPersistence: gitCredential.persistence,
+                  ...prepared.credentialStorage ? { credentialStorage: prepared.credentialStorage } : {}
+                } : {}
               };
             } finally {
               await extensionManager.disposePreparedExtension(prepared);
@@ -20530,6 +20734,17 @@ function registerWorkspaceExtensionRoutes(app, deps) {
     }
     return state;
   }, "parseActivationState");
+  const parseWorkspaceBatchActivationState = /* @__PURE__ */ __name((req, res) => {
+    const state = safeBody2(req)["state"];
+    if (state !== "enabled" && state !== "disabled" && state !== "inherit") {
+      res.status(400).json({
+        error: '`state` must be "enabled", "disabled", or "inherit"',
+        code: "invalid_extension_activation"
+      });
+      return null;
+    }
+    return state;
+  }, "parseWorkspaceBatchActivationState");
   const sendOperation = /* @__PURE__ */ __name((req, res, route, manager, operation, failureContext, run2, options = {}) => {
     if (!primaryController.validateExtensionMutationClient(req, res, {
       requireClientId: false,
@@ -20568,6 +20783,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
             name: extension.name,
             version: extension.version,
             ...extension.installMetadata?.type ? { installType: extension.installMetadata.type } : {},
+            ...extension.installMetadata?.type === "snapshot" ? { credentialPersistence: "one_time" } : extension.installMetadata?.credentialPersistence === "stored" ? { credentialPersistence: "stored" } : {},
             defaultActivation: policy?.defaultActivation ?? "enabled",
             workspaceOverrideCount: Object.values(
               policy?.workspaceOverrides ?? {}
@@ -20595,6 +20811,43 @@ function registerWorkspaceExtensionRoutes(app, deps) {
     }
     res.status(200).json(operation);
   });
+  app.put("/extensions/activation", mutate({ strict: true }), (req, res) => {
+    const names = parseExtensionBatchNames(req, res, safeBody2);
+    if (!names) return;
+    const state = parseActivationState(req, res);
+    if (!state) return;
+    const manager = primaryController.createExtensionManager(
+      boundWorkspace,
+      true
+    );
+    sendOperation(
+      req,
+      res,
+      "PUT /extensions/activation",
+      manager,
+      "set_default_activation_batch",
+      {},
+      async (extensionManager, _signal, context) => {
+        await context.commit(
+          async (onCommitted) => await extensionManager.setExtensionDefaultActivations(
+            names,
+            state,
+            onCommitted
+          )
+        );
+        return {
+          status: "updated",
+          results: names.map((name) => ({
+            name,
+            defaultActivation: state
+          }))
+        };
+      },
+      {
+        ...workspaceRegistry ? { refreshRuntimes: /* @__PURE__ */ __name(() => workspaceRegistry.listAll(), "refreshRuntimes") } : {}
+      }
+    );
+  });
   app.put(
     "/extensions/:extensionId/activation",
     mutate({ strict: true }),
@@ -20644,6 +20897,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
     const autoUpdate = body["autoUpdate"];
     const allowPreRelease = body["allowPreRelease"];
     const registry = body["registry"];
+    const credentialPersistence = body["credentialPersistence"];
     if (typeof source !== "string" || !source) {
       res.status(400).json({ error: "Missing or invalid source" });
       return;
@@ -20676,7 +20930,27 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       });
       return;
     }
-    if (!validateExtensionSourceHost(source, res)) return;
+    const parsedSource = parseExtensionInstallSource(
+      source,
+      credentialPersistence,
+      res
+    );
+    if (!parsedSource) return;
+    const sourceValue = parsedSource.source;
+    body["source"] = sourceValue;
+    const gitCredential = parsedSource.gitCredential;
+    if (gitCredential?.persistence === "one_time" && autoUpdate === true) {
+      res.status(400).json({
+        error: "`autoUpdate` is not supported with one-time credentials"
+      });
+      return;
+    }
+    if (gitCredential && isSupportedArchiveUrl(sourceValue)) {
+      res.status(400).json({
+        error: "Git credentials require an HTTPS Git install source."
+      });
+      return;
+    }
     if (!activation || typeof activation !== "object") {
       res.status(400).json({ error: "Missing initial activation" });
       return;
@@ -20715,10 +20989,10 @@ function registerWorkspaceExtensionRoutes(app, deps) {
       "POST /extensions/install",
       manager,
       "install",
-      { source },
+      gitCredential?.persistence === "one_time" ? {} : { source: sourceValue },
       async (extensionManager, _signal, context) => {
         const prepared = await context.prepare(async (signal) => {
-          const metadata = await parseInstallSource(source, {
+          const metadata = await parseInstallSource(sourceValue, {
             networkPolicy: "public"
           });
           if (metadata.type !== "git" && metadata.type !== "github-release" && metadata.type !== "npm") {
@@ -20726,6 +21000,11 @@ function registerWorkspaceExtensionRoutes(app, deps) {
               "Only GitHub, Git, and npm extension installs are supported over the daemon endpoint."
             );
           }
+          if (gitCredential && metadata.type !== "git" && metadata.type !== "github-release") {
+            throw new Error(
+              "Git credentials require an HTTPS Git install source."
+            );
+          }
           if (!validateExtensionSourceMetadata(metadata)) {
             throw new Error("`source` host is not allowed");
           }
@@ -20750,7 +21029,8 @@ function registerWorkspaceExtensionRoutes(app, deps) {
             requestConsent: /* @__PURE__ */ __name(() => Promise.resolve(), "requestConsent"),
             cwd: boundWorkspace,
             initialActivation,
-            signal
+            signal,
+            ...gitCredential ? { gitCredential } : {}
           });
         });
         try {
@@ -20762,9 +21042,13 @@ function registerWorkspaceExtensionRoutes(app, deps) {
           );
           return {
             status: "installed",
-            source,
+            ...gitCredential?.persistence === "one_time" ? {} : { source: sourceValue },
             name: committed.identity.name,
-            version: committed.version
+            version: committed.version,
+            ...gitCredential ? {
+              credentialPersistence: gitCredential.persistence,
+              ...prepared.credentialStorage ? { credentialStorage: prepared.credentialStorage } : {}
+            } : {}
           };
         } finally {
           await extensionManager.disposePreparedExtension(prepared);
@@ -20831,9 +21115,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
           if (!extension)
             throw new Error(`Extension "${extensionId}" not found`);
           if (extension.installMetadata?.type !== "git" && extension.installMetadata?.type !== "archive-url" && extension.installMetadata?.type !== "github-release" && extension.installMetadata?.type !== "npm") {
-            throw new Error(
-              `Extension "${extension.name}" is not remotely updatable.`
-            );
+            throw new ExtensionNotUpdatableError(extension.name);
           }
           const preparedResult = await context.prepare(
             async (signal) => await extensionManager.prepareExtensionUpdate({
@@ -20895,7 +21177,7 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         );
         const snapshot = await manager.getExtensionStoreSnapshot();
         const policy = snapshot.extensions[extensionId];
-        if (!policy) {
+        if (!policy || policy.declarationOnly) {
           res.status(204).end();
           return;
         }
@@ -20969,6 +21251,57 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         });
       }
     });
+    app.put(
+      "/workspaces/:workspace/extensions/activation",
+      mutate({ strict: true }),
+      (req, res) => {
+        const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
+        if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+        const names = parseExtensionBatchNames(req, res, safeBody2);
+        if (!names) return;
+        const state = parseWorkspaceBatchActivationState(req, res);
+        if (!state) return;
+        const manager = primaryController.createExtensionManager(
+          runtime.workspaceCwd,
+          true
+        );
+        sendOperation(
+          req,
+          res,
+          "PUT /workspaces/:workspace/extensions/activation",
+          manager,
+          "set_workspace_activation_batch",
+          {},
+          async (extensionManager, _signal, context) => {
+            const snapshot = await context.commit(
+              async (onCommitted) => await extensionManager.setExtensionWorkspaceActivations(
+                names,
+                runtime.workspaceCwd,
+                state,
+                onCommitted
+              )
+            );
+            return {
+              status: "updated",
+              updated: snapshot.updated,
+              results: names.map((name) => ({
+                name,
+                workspaceActivation: state === "inherit" ? null : state,
+                effectiveActivation: extensionManager.getExtensionActivationForNameFromSnapshot(
+                  name,
+                  snapshot,
+                  runtime.workspaceCwd
+                ).effective
+              }))
+            };
+          },
+          {
+            refreshRuntimes: [runtime],
+            assertGenerationOpen: /* @__PURE__ */ __name(() => runtime.generationGuard?.assertOpen(), "assertGenerationOpen")
+          }
+        );
+      }
+    );
     app.put(
       "/workspaces/:workspace/extensions/:extensionId/activation",
       mutate({ strict: true }),
@@ -21986,6 +22319,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/server/telemetry.ts
 init_esbuild_shims();
+import { performance as performance2 } from "node:perf_hooks";
 var legacySessionTelemetryRoutes = [
   {
     method: "POST",
@@ -22125,6 +22459,18 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/tasks/:taskId/cancel"
   },
+  {
+    method: "POST",
+    path: "/session/:id/goal",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/goal"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/goal",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/goal"
+  },
   {
     method: "POST",
     path: "/session/:id/goal/clear",
@@ -22139,21 +22485,21 @@ var legacySessionTelemetryRoutes = [
   },
   {
     method: "POST",
-    path: "/session/:id/media",
+    path: "/session/:id/attachments",
     attribution: "handler_resolved",
-    route: "POST /session/:id/media"
+    route: "POST /session/:id/attachments"
   },
   {
     method: "GET",
-    path: "/session/:id/media/:mediaId",
+    path: "/session/:id/attachments/:attachmentId",
     attribution: "handler_resolved",
-    route: "GET /session/:id/media/:mediaId"
+    route: "GET /session/:id/attachments/:attachmentId"
   },
   {
     method: "DELETE",
-    path: "/session/:id/media/:mediaId",
+    path: "/session/:id/attachments/:attachmentId",
     attribution: "handler_resolved",
-    route: "DELETE /session/:id/media/:mediaId"
+    route: "DELETE /session/:id/attachments/:attachmentId"
   },
   {
     method: "POST",
@@ -22342,7 +22688,6 @@ var legacySessionTelemetryRoutes = [
     route: "POST /session/:id/a2ui-action"
   }
 ];
-var daemonTelemetryResponseContext = Symbol("daemonTelemetryResponseContext");
 function decodePathSegment(value) {
   try {
     return decodeURIComponent(value);
@@ -22569,8 +22914,34 @@ function resolveDaemonTelemetryRoute(req) {
   return void 0;
 }
 __name(resolveDaemonTelemetryRoute, "resolveDaemonTelemetryRoute");
+var TRACEPARENT_BREADCRUMB_BURST = 60;
+var TRACEPARENT_BREADCRUMB_REFILL_PER_SECOND = 2;
+function daemonInboundTraceIdCaptureMiddleware(req, res, next) {
+  try {
+    const inboundTraceId = extractInboundTraceId(req.headers);
+    if (inboundTraceId !== void 0) {
+      res[daemonInboundTraceIdContext] = inboundTraceId;
+    }
+  } catch {
+  }
+  next();
+}
+__name(daemonInboundTraceIdCaptureMiddleware, "daemonInboundTraceIdCaptureMiddleware");
 function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest) {
   const workspaceHashByCwd = /* @__PURE__ */ new Map();
+  let breadcrumbTokens = TRACEPARENT_BREADCRUMB_BURST;
+  let breadcrumbRefillBaseline = performance2.now();
+  const acquireBreadcrumbToken = /* @__PURE__ */ __name(() => {
+    const now = Math.max(performance2.now(), breadcrumbRefillBaseline);
+    breadcrumbTokens = Math.min(
+      TRACEPARENT_BREADCRUMB_BURST,
+      breadcrumbTokens + (now - breadcrumbRefillBaseline) / 1e3 * TRACEPARENT_BREADCRUMB_REFILL_PER_SECOND
+    );
+    breadcrumbRefillBaseline = now;
+    if (breadcrumbTokens < 1) return false;
+    breadcrumbTokens -= 1;
+    return true;
+  }, "acquireBreadcrumbToken");
   const resolveWorkspaceHash = /* @__PURE__ */ __name((workspaceCwd) => {
     const existing = workspaceHashByCwd.get(workspaceCwd);
     if (existing !== void 0) return existing;
@@ -22599,10 +22970,39 @@ function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest) {
     const clientId = rawClientId !== void 0 && rawClientId !== "" && rawClientId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawClientId) ? rawClientId : void 0;
     const deferredRuntime = getDeferredRuntimeRequestTiming(req);
     const startMs = deferredRuntime?.startedAt.getTime() ?? Date.now();
+    let parentContext;
+    if (isTelemetrySdkInitialized()) {
+      try {
+        parentContext = extractDaemonHttpTraceContext(req.headers);
+      } catch {
+        parentContext = void 0;
+      }
+      try {
+        const inboundTraceparent = req.headers?.["traceparent"];
+        if (!parentContext && typeof inboundTraceparent === "string" && inboundTraceparent.length > 0 && acquireBreadcrumbToken()) {
+          emitDaemonLog(
+            "Rejected invalid inbound traceparent header.",
+            {
+              "http.route": route.route,
+              "http.request.header.traceparent": sanitizeLogText(
+                inboundTraceparent,
+                128
+              )
+            },
+            {
+              eventName: "qwen-code.daemon.traceparent.invalid",
+              severityNumber: 5
+              // SeverityNumber.DEBUG
+            }
+          );
+        }
+      } catch {
+      }
+    }
     const telemetryRes = res;
     if (route.attribution === "handler_resolved") {
       try {
-        telemetryRes[daemonTelemetryResponseContext] = {};
+        telemetryRes[daemonTelemetryResponseContext] ??= {};
       } catch {
       }
     }
@@ -22614,6 +23014,7 @@ function daemonTelemetryMiddleware(resolveWorkspaceCwd, recordRequest) {
         ...sessionId ? { sessionId } : {},
         ...route.permissionRequestId ? { permissionRequestId: route.permissionRequestId } : {},
         ...clientId ? { clientId } : {},
+        ...parentContext ? { parentContext } : {},
         ...deferredRuntime?.waitMs !== void 0 ? {
           startTime: deferredRuntime.startedAt,
           deferredRuntimeWaitMs: deferredRuntime.waitMs,
@@ -23049,10 +23450,27 @@ var PersistedSessionListCache = class {
   }
 };
 
+// packages/cli/src/serve/server/activity-timestamp.ts
+init_esbuild_shims();
+function laterActivityTimestamp(live, persisted) {
+  const liveTime = live === void 0 ? Number.NaN : Date.parse(live);
+  const persistedTime = persisted === void 0 ? Number.NaN : Date.parse(persisted);
+  const liveValid = Number.isFinite(liveTime);
+  const persistedValid = Number.isFinite(persistedTime);
+  if (liveValid && persistedValid) {
+    return liveTime >= persistedTime ? live : persisted;
+  }
+  if (liveValid) return live;
+  if (persistedValid) return persisted;
+  return live ?? persisted;
+}
+__name(laterActivityTimestamp, "laterActivityTimestamp");
+
 // packages/cli/src/serve/server/session-list.ts
 var DEFAULT_SESSION_PAGE_SIZE = 20;
 var MAX_SESSION_PAGE_SIZE = 100;
 var MAX_ORGANIZED_SESSIONS = 5e4;
+var MAX_EMITTED_CURSOR_SESSION_IDS = 64;
 var PERSISTED_SESSION_LIST_CACHE_TTL_MS = 2e3;
 var persistedSessionListCache = new PersistedSessionListCache(
   PERSISTED_SESSION_LIST_CACHE_TTL_MS,
@@ -23087,6 +23505,14 @@ function parseSessionCursor(cursor) {
   return parsed;
 }
 __name(parseSessionCursor, "parseSessionCursor");
+function parseEmittedSessionIds(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.length === 0)) {
+    return void 0;
+  }
+  return value;
+}
+__name(parseEmittedSessionIds, "parseEmittedSessionIds");
 function parseOrganizedCursor(cursor, expected) {
   if (cursor === "") return void 0;
   try {
@@ -23096,15 +23522,26 @@ function parseOrganizedCursor(cursor, expected) {
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.isPinned !== "boolean" || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.group !== expected.group || parsed.archiveState !== expected.archiveState || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId) {
       throw new Error("invalid organized cursor");
     }
-    return last;
+    const emitted = parseEmittedSessionIds(parsed.emitted);
+    if (emitted === void 0) {
+      throw new Error("invalid organized cursor");
+    }
+    return { last, emitted };
   } catch {
     throw new InvalidCursorError(cursor, "organized");
   }
 }
 __name(parseOrganizedCursor, "parseOrganizedCursor");
-function encodeOrganizedCursor(last, group, archiveState, sourceType, sourceId) {
+function encodeOrganizedCursor(last, group, archiveState, sourceType, sourceId, emitted = []) {
   return Buffer.from(
-    JSON.stringify({ group, archiveState, sourceType, sourceId, last }),
+    JSON.stringify({
+      group,
+      archiveState,
+      sourceType,
+      sourceId,
+      last,
+      ...emitted.length > 0 ? { emitted } : {}
+    }),
     "utf8"
   ).toString("base64url");
 }
@@ -23145,7 +23582,16 @@ function parseMetadataSessionCursor(cursor, expected) {
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof last !== "object" || last === null || Array.isArray(last) || typeof last.activityTime !== "number" || !Number.isFinite(last.activityTime) || typeof last.sessionId !== "string" || last.sessionId.length === 0 || parsed.parentSessionId !== expected.parentSessionId || parsed.sourceType !== expected.sourceType || parsed.sourceId !== expected.sourceId || parsed.archiveState !== expected.archiveState) {
       throw new Error("invalid metadata cursor");
     }
-    return { activityTime: last.activityTime, sessionId: last.sessionId };
+    const emitted = parseEmittedSessionIds(
+      parsed.emitted
+    );
+    if (emitted === void 0) {
+      throw new Error("invalid metadata cursor");
+    }
+    return {
+      last: { activityTime: last.activityTime, sessionId: last.sessionId },
+      emitted
+    };
   } catch {
     throw new InvalidCursorError(
       cursor,
@@ -23154,9 +23600,14 @@ function parseMetadataSessionCursor(cursor, expected) {
   }
 }
 __name(parseMetadataSessionCursor, "parseMetadataSessionCursor");
-function encodeMetadataSessionCursor(last, filter, archiveState) {
+function encodeMetadataSessionCursor(last, filter, archiveState, emitted = []) {
   return Buffer.from(
-    JSON.stringify({ ...filter, archiveState, last }),
+    JSON.stringify({
+      ...filter,
+      archiveState,
+      last,
+      ...emitted.length > 0 ? { emitted } : {}
+    }),
     "utf8"
   ).toString("base64url");
 }
@@ -23216,7 +23667,7 @@ function mergeLiveSessionSummary(existing, live) {
     parentSessionId: existing.parentSessionId ?? live.parentSessionId,
     sourceType: existing.sourceType ?? live.sourceType,
     sourceId: existing.sourceType !== void 0 ? existing.sourceId : live.sourceId,
-    updatedAt: live.updatedAt ?? existing.updatedAt,
+    updatedAt: laterActivityTimestamp(live.updatedAt, existing.updatedAt),
     clientCount: live.clientCount,
     hasActivePrompt: live.hasActivePrompt,
     isArchived: false
@@ -23366,6 +23817,36 @@ function compareOrganizedCursorKeys(a, b) {
   return a.sessionId.localeCompare(b.sessionId);
 }
 __name(compareOrganizedCursorKeys, "compareOrganizedCursorKeys");
+function nextEmittedSessionIds(options) {
+  const candidates = new Set(options.carried);
+  for (const row of options.page) {
+    if (options.liveSessionIds.has(row.sessionId)) {
+      candidates.add(row.sessionId);
+    }
+  }
+  const kept = [];
+  for (const sessionId of candidates) {
+    const row = options.listedById.get(sessionId);
+    if (!row) {
+      kept.push({ sessionId, persistedTime: Number.NEGATIVE_INFINITY });
+      continue;
+    }
+    const persistedTime = options.persistedTimeById.get(sessionId);
+    if (persistedTime === void 0) {
+      kept.push({ sessionId, persistedTime: Number.NEGATIVE_INFINITY });
+      continue;
+    }
+    if (options.reenters(row, persistedTime)) {
+      kept.push({ sessionId, persistedTime });
+    }
+  }
+  if (kept.length > MAX_EMITTED_CURSOR_SESSION_IDS) {
+    kept.sort((a, b) => a.persistedTime - b.persistedTime);
+    kept.length = MAX_EMITTED_CURSOR_SESSION_IDS;
+  }
+  return kept.map((entry) => entry.sessionId);
+}
+__name(nextEmittedSessionIds, "nextEmittedSessionIds");
 function applyOrganization(session, organization) {
   return {
     ...session,
@@ -23392,12 +23873,14 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
       "group"
     );
   }
-  const cursorKey = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, {
+  const cursor = options.cursor !== void 0 ? parseOrganizedCursor(options.cursor, {
     group,
     archiveState,
     sourceType: options.sourceType,
     sourceId: options.sourceId
   }) : void 0;
+  const cursorKey = cursor?.last;
+  const emittedBeforePage = new Set(cursor?.emitted ?? []);
   const isFirstPage = cursorKey === void 0;
   let liveMergeFailed = false;
   const bySessionId = /* @__PURE__ */ new Map();
@@ -23419,10 +23902,18 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
       )
     );
   }
-  if (readOptions.mergeLive !== false && archiveState !== "archived" && isFirstPage) {
+  const persistedTimeById = new Map(
+    persisted.sessions.map((session) => [
+      session.sessionId,
+      getSummaryActivityTime(session)
+    ])
+  );
+  const liveSessionIds = /* @__PURE__ */ new Set();
+  if (readOptions.mergeLive !== false && archiveState !== "archived") {
     try {
       const liveSessions = bridge.listWorkspaceSessions(workspaceCwd);
       for (const live of liveSessions) {
+        liveSessionIds.add(live.sessionId);
         const existing = bySessionId.get(live.sessionId);
         const organization = snapshot.sessions.get(live.sessionId);
         if (existing) {
@@ -23434,7 +23925,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
             )
           );
         } else if (
-          // `listAllPersistedSummaries` already scanned every persisted
+          // A live-only row has no persisted key to page by, so it stays a
+          // first-page-only insertion as before.
+          isFirstPage && // `listAllPersistedSummaries` already scanned every persisted
           // session when the scan wasn't truncated, so a `sessionId` missing
           // from `bySessionId` is definitively new — no disk re-check
           // needed. Re-checking here raced a session that persists its
@@ -23442,9 +23935,9 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
           // above and this point: `existing` stayed undefined but
           // `sessionExists` flipped to true, silently dropping the live
           // session from the response instead of merging it.
-          !persisted.truncated || !await (readOptions.signal ? sessionService.sessionExists(live.sessionId, {
+          (!persisted.truncated || !await (readOptions.signal ? sessionService.sessionExists(live.sessionId, {
             signal: readOptions.signal
-          }) : sessionService.sessionExists(live.sessionId))
+          }) : sessionService.sessionExists(live.sessionId)))
         ) {
           bySessionId.set(
             live.sessionId,
@@ -23487,19 +23980,52 @@ async function listOrganizedWorkspaceSessionsForResponse(bridge, workspaceCwd, o
   filtered.sort((a, b) => compareOrganizedSessions(activityTimeById, a, b));
   readOptions.signal?.throwIfAborted();
   const afterCursor = cursorKey === void 0 ? filtered : filtered.filter(
-    (session) => compareOrganizedCursorKeys(
-      cursorKey,
-      getOrganizedCursorKey(activityTimeById, session)
-    ) < 0
+    (session) => (
+      // A row already emitted at a live-derived key stays excluded even
+      // if its key regressed behind the cursor (live retirement, or a
+      // live-only row that persisted mid-pass).
+      !emittedBeforePage.has(session.sessionId) && compareOrganizedCursorKeys(
+        cursorKey,
+        getOrganizedCursorKey(activityTimeById, session)
+      ) < 0
+    )
   );
   const page = afterCursor.slice(0, pageSize);
-  const nextCursor = page.length < afterCursor.length ? encodeOrganizedCursor(
-    getOrganizedCursorKey(activityTimeById, page[page.length - 1]),
-    group,
-    archiveState,
-    options.sourceType,
-    options.sourceId
-  ) : void 0;
+  let nextCursor;
+  if (page.length < afterCursor.length) {
+    const boundary = getOrganizedCursorKey(
+      activityTimeById,
+      page[page.length - 1]
+    );
+    const emitted = nextEmittedSessionIds({
+      carried: emittedBeforePage,
+      page,
+      liveSessionIds,
+      listedById: new Map(
+        filtered.map((session) => [session.sessionId, session])
+      ),
+      persistedTimeById,
+      // `isPinned` is re-read from the organization snapshot on every page
+      // request, so a pin flip between fetches can move the persisted key
+      // across the pinned/unpinned blocks. Keep the identity while the key
+      // could re-enter under either state.
+      reenters: /* @__PURE__ */ __name((row, persistedTime) => [true, false].some(
+        (isPinned) => compareOrganizedCursorKeys(boundary, {
+          isPinned,
+          activityTime: persistedTime,
+          sessionId: row.sessionId
+        }) < 0
+      ), "reenters")
+    });
+    nextCursor = encodeOrganizedCursor(
+      boundary,
+      group,
+      archiveState,
+      options.sourceType,
+      options.sourceId,
+      emitted
+    );
+  }
   return {
     sessions: page,
     ...nextCursor !== void 0 ? { nextCursor } : {},
@@ -23524,10 +24050,18 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
   for (const session of persisted.sessions) {
     bySessionId.set(session.sessionId, clonePersistedSummary(session));
   }
+  const persistedTimeById = new Map(
+    persisted.sessions.map((session) => [
+      session.sessionId,
+      getSummaryActivityTime(session)
+    ])
+  );
+  const liveSessionIds = /* @__PURE__ */ new Set();
   let liveMergeFailed = false;
   if (readOptions.mergeLive !== false && archiveState !== "archived") {
     try {
       for (const live of bridge.listWorkspaceSessions(workspaceCwd)) {
+        liveSessionIds.add(live.sessionId);
         const existing = bySessionId.get(live.sessionId);
         if (existing) {
           bySessionId.set(
@@ -23569,22 +24103,46 @@ async function listWorkspaceSessionsByMetadataForResponse(bridge, workspaceCwd,
     )
   );
   readOptions.signal?.throwIfAborted();
-  const cursorKey = options.cursor !== void 0 && options.cursor !== "" ? parseMetadataSessionCursor(options.cursor, {
+  const cursor = options.cursor !== void 0 && options.cursor !== "" ? parseMetadataSessionCursor(options.cursor, {
     ...filter,
     archiveState
   }) : void 0;
+  const cursorKey = cursor?.last;
+  const emittedBeforePage = new Set(cursor?.emitted ?? []);
   const afterCursor = cursorKey === void 0 ? matches : matches.filter(
-    (session) => compareLiveSessionCursorKeys(
-      cursorKey,
-      getLiveSessionCursorKey(session)
-    ) < 0
+    (session) => (
+      // See the organized path: exclude rows already emitted at a
+      // live-derived key whose key regressed behind the cursor.
+      !emittedBeforePage.has(session.sessionId) && compareLiveSessionCursorKeys(
+        cursorKey,
+        getLiveSessionCursorKey(session)
+      ) < 0
+    )
   );
   const page = afterCursor.slice(0, pageSize);
-  const nextCursor = page.length < afterCursor.length ? encodeMetadataSessionCursor(
-    getLiveSessionCursorKey(page[page.length - 1]),
-    filter,
-    archiveState
-  ) : void 0;
+  let nextCursor;
+  if (page.length < afterCursor.length) {
+    const boundary = getLiveSessionCursorKey(page[page.length - 1]);
+    const emitted = nextEmittedSessionIds({
+      carried: emittedBeforePage,
+      page,
+      liveSessionIds,
+      listedById: new Map(
+        matches.map((session) => [session.sessionId, session])
+      ),
+      persistedTimeById,
+      reenters: /* @__PURE__ */ __name((row, persistedTime) => compareLiveSessionCursorKeys(boundary, {
+        activityTime: persistedTime,
+        sessionId: row.sessionId
+      }) < 0, "reenters")
+    });
+    nextCursor = encodeMetadataSessionCursor(
+      boundary,
+      filter,
+      archiveState,
+      emitted
+    );
+  }
   return {
     sessions: page,
     ...nextCursor !== void 0 ? { nextCursor } : {},
@@ -24688,20 +25246,33 @@ function parseMediaContentBlock(block) {
   const record = block;
   const type = record["type"];
   const data = record["data"];
-  const mediaId = record["mediaId"];
+  const attachmentId = record["attachmentId"];
   const mimeType = record["mimeType"];
   const size = record["size"];
   const inline = typeof data === "string" && data.length > 0;
-  const reference = typeof mediaId === "string" && mediaId.length > 0 && typeof size === "number" && Number.isSafeInteger(size) && size > 0;
-  if (type !== "image" || inline === reference || typeof mimeType !== "string" || !mimeType.startsWith(`${type}/`)) {
+  const reference = typeof attachmentId === "string" && attachmentId.length > 0 && typeof size === "number" && Number.isSafeInteger(size) && size >= 0 && (type !== "image" || size > 0);
+  if (type === "resource" && !reference) {
+    const resource = record["resource"];
+    if (typeof resource !== "object" || resource === null) {
+      return { valid: false, code: "invalid-shape" };
+    }
+    const value = resource;
+    const hasText = typeof value["text"] === "string";
+    const hasBlob = typeof value["blob"] === "string";
+    if (typeof value["uri"] !== "string" || value["uri"].length === 0 || hasText === hasBlob) {
+      return { valid: false, code: "invalid-shape" };
+    }
+    return { valid: true, block };
+  }
+  if (type !== "image" && type !== "resource" || (type === "image" ? inline === reference : inline || !reference) || typeof mimeType !== "string" || type === "image" && !mimeType.startsWith("image/")) {
     return { valid: false, code: "invalid-shape" };
   }
-  if (isSvgMimeType(mimeType)) {
+  if (type === "image" && isSvgMimeType(mimeType)) {
     return { valid: false, code: "svg" };
   }
   return {
     valid: true,
-    block: inline ? { type, data, mimeType } : { type, mediaId, mimeType, size }
+    block: inline ? { type, data, mimeType } : { type, attachmentId, mimeType, size }
   };
 }
 __name(parseMediaContentBlock, "parseMediaContentBlock");
@@ -24712,7 +25283,7 @@ function mediaBlockParseError(code, entryLabel) {
   if (code === "svg") {
     return "SVG images are not supported";
   }
-  return `each ${entryLabel} must be an image block with either \`data\`, or \`mediaId\` and \`size\`, plus a matching \`mimeType\``;
+  return `each ${entryLabel} must be an inline content block or carry \`attachmentId\`, \`size\`, and \`mimeType\``;
 }
 __name(mediaBlockParseError, "mediaBlockParseError");
 var PRIMARY_ONLY_LIVE_SESSION_ROUTES = ["POST /session/:id/cd"];
@@ -25300,7 +25871,7 @@ function registerSessionRoutes(app, deps) {
       }
       const metadata = await readLoadableLiveConversationMetadata(
         sessionId,
-        (candidateId) => service.readCreationMetadata(candidateId)
+        service
       );
       if (!metadata) throw new SessionNotFoundError(sessionId);
     }
@@ -25624,10 +26195,7 @@ function registerSessionRoutes(app, deps) {
       if (location !== "active") return false;
       if (!isInternalWorkspaceRuntime(runtime)) return true;
       const service = createWorkspaceRuntimeSessionService(runtime);
-      return await readLoadableLiveConversationMetadata(
-        sessionId,
-        (candidateId) => service.readCreationMetadata(candidateId)
-      ) !== void 0;
+      return await readLoadableLiveConversationMetadata(sessionId, service) !== void 0;
     }, "activeInRuntime");
     const throwMissingActiveTranscript = /* @__PURE__ */ __name(() => {
       if (hasCursor) {
@@ -25823,7 +26391,7 @@ function registerSessionRoutes(app, deps) {
       if (!exists) continue;
       const metadata = await readLoadableLiveConversationMetadata(
         sessionId,
-        (candidateId) => service.readCreationMetadata(candidateId)
+        service
       );
       if (!assertCurrentInternalGeneration(entry, generation, res)) {
         return void 0;
@@ -25910,7 +26478,7 @@ function registerSessionRoutes(app, deps) {
         if (!exists) continue;
         const metadata = await readLoadableLiveConversationMetadata(
           sessionId,
-          (candidateId) => service.readCreationMetadata(candidateId)
+          service
         );
         if (!assertCurrentInternalGeneration(entry, generation2, res)) {
           return void 0;
@@ -25964,7 +26532,7 @@ function registerSessionRoutes(app, deps) {
       }
       const metadata = await readLoadableLiveConversationMetadata(
         sessionId,
-        (candidateId) => service.readCreationMetadata(candidateId)
+        service
       );
       if (!metadata) {
         throw new SessionNotFoundError(sessionId);
@@ -26164,6 +26732,15 @@ function registerSessionRoutes(app, deps) {
     }
     const approvalMode = parseOptionalApprovalMode(body, res);
     if (approvalMode === null) return;
+    if (isReservedStandaloneSessionSource({
+      sourceType: typeof body["sourceType"] === "string" ? body["sourceType"] : void 0
+    })) {
+      res.status(400).json({
+        error: "The requested session source is reserved for daemon-owned standalone sessions.",
+        code: "reserved_session_source"
+      });
+      return;
+    }
     const source = parseSessionSource(body["sourceType"], body["sourceId"]);
     if ("error" in source) {
       res.status(400).json({
@@ -26734,24 +27311,54 @@ function registerSessionRoutes(app, deps) {
         throw error2;
       }
     }
+    let restoredStorageSessionId = sessionId;
     try {
+      const guardSessionService = createWorkspaceRuntimeSessionService(runtime);
+      try {
+        await guardSessionService.findSessionIdIgnoringCase(sessionId);
+      } catch (error2) {
+        if (error2 instanceof SessionIdCaseConflictError && await guardSessionService.getSessionLocation(
+          error2.candidateSessionId ?? sessionId
+        ) === "conflict") {
+          throw new SessionConflictError(sessionId);
+        }
+        throw error2;
+      }
       const session = await archiveCoordinator.runSharedMany(
         [sessionId],
         async () => {
+          const sessionService = createWorkspaceRuntimeSessionService(runtime);
+          let persistedSessionId;
+          try {
+            persistedSessionId = await sessionService.findSessionIdIgnoringCase(sessionId);
+          } catch (error2) {
+            if (error2 instanceof SessionIdCaseConflictError && await sessionService.getSessionLocation(
+              error2.candidateSessionId ?? sessionId
+            ) === "conflict") {
+              throw new SessionConflictError(sessionId);
+            }
+            throw error2;
+          }
+          if (persistedSessionId) {
+            restoredStorageSessionId = persistedSessionId;
+          } else if (isInternalWorkspaceRuntime(runtime)) {
+            throw new SessionNotFoundError(sessionId);
+          }
           const location = await assertSessionLoadable(
             workspaceCwd,
-            sessionId,
+            restoredStorageSessionId,
             runtime.sessionRuntimeBaseDir
           );
           if (location === void 0 && isInternalWorkspaceRuntime(runtime)) {
             throw new SessionNotFoundError(sessionId);
           }
-          const sessionService = createWorkspaceRuntimeSessionService(runtime);
           const metadata = runtime.provenance === "live-conversation" ? await readLoadableLiveConversationMetadata(
-            sessionId,
-            (candidateId) => sessionService.readCreationMetadata(candidateId)
-          ) : await sessionService.readCreationMetadata(sessionId);
-          if (metadata === void 0) {
+            restoredStorageSessionId,
+            sessionService
+          ) : await sessionService.readCreationMetadata(
+            restoredStorageSessionId
+          );
+          if (metadata === void 0 || isInternalWorkspaceRuntime(runtime) && isReservedStandaloneSessionSource(metadata)) {
             throw new SessionNotFoundError(sessionId);
           }
           assertRuntimeGenerationOpen?.();
@@ -26843,7 +27450,19 @@ function registerSessionRoutes(app, deps) {
               throw error2;
             }
           }
-          return restored;
+          if (action === "load" && !restored.attached && !restored.hasActivePrompt && runtime.provenance !== "live-conversation") {
+            try {
+              await reconcileDanglingPromptTerminals(
+                sessionService,
+                sessionId
+              );
+            } catch {
+            }
+          }
+          return withPromptTerminals(
+            restored,
+            action === "load" ? readRecentPromptTerminals(sessionService, sessionId) : void 0
+          );
         }
       );
       try {
@@ -26878,7 +27497,7 @@ function registerSessionRoutes(app, deps) {
         const sidecar = await readWorktreeSession(
           createWorkspaceRuntimeSessionService(
             runtime
-          ).getWorktreeSessionPath(sessionId)
+          ).getWorktreeSessionPath(restoredStorageSessionId)
         ).catch(() => null);
         if (sidecar) {
           let realTarget;
@@ -27713,6 +28332,42 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.post(
+    "/session/:id/goal",
+    mutate({ strict: true }),
+    withOwnerMutableSession(
+      "POST /session/:id/goal",
+      async (req, res, sessionId, runtime) => {
+        const request2 = parseGoalControlRequest(safeBody(req));
+        if (!request2) {
+          res.status(400).json({
+            error: "Invalid Goal control request",
+            code: "invalid_goal_control_request"
+          });
+          return;
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        res.status(200).json(
+          await runtime.bridge.controlSessionGoal(
+            sessionId,
+            request2,
+            clientId === void 0 ? void 0 : { clientId }
+          )
+        );
+      }
+    )
+  );
+  app.get(
+    "/session/:id/goal",
+    withOwnerReadSession(
+      "GET /session/:id/goal",
+      async (_req, res, sessionId, runtime) => {
+        const goal = await runtime.bridge.getSessionGoal(sessionId);
+        res.status(200).json({ snapshot: goal.snapshot });
+      }
+    )
+  );
   app.post(
     "/session/:id/goal/clear",
     mutate({ strict: true }),
@@ -27748,9 +28403,9 @@ function registerSessionRoutes(app, deps) {
     )
   );
   app.post(
-    "/session/:id/media",
+    "/session/:id/attachments",
     mutate(),
-    import_express4.default.raw({ type: "image/*", limit: "8mb" }),
+    import_express4.default.raw({ type: "*/*", limit: "8mb" }),
     (error2, _req, res, next) => {
       if (error2 && typeof error2 === "object" && "status" in error2 && error2.status === 413) {
         res.status(413).json({ error: "Request body too large (max 8 MiB)" });
@@ -27759,27 +28414,35 @@ function registerSessionRoutes(app, deps) {
       next(error2);
     },
     withOwnerMutableSession(
-      "POST /session/:id/media",
+      "POST /session/:id/attachments",
       async (req, res, sessionId, runtime) => {
+        const name = req.query["name"];
         const contentType = req.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
-        if (isSvgMimeType(contentType)) {
-          res.status(415).json({ error: "SVG uploads are not supported" });
-          return;
-        }
-        if (!contentType || !contentType.startsWith("image/") || !Buffer.isBuffer(req.body) || req.body.byteLength === 0) {
+        if (typeof name !== "string" || !contentType || !Buffer.isBuffer(req.body)) {
           res.status(400).json({
-            error: "request body must contain image/* bytes with a matching Content-Type"
+            error: "request body, Content-Type, and name query parameter are required"
           });
           return;
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
+        if (req.body.length === 0 && [
+          "image/bmp",
+          "image/gif",
+          "image/jpeg",
+          "image/png",
+          "image/webp"
+        ].includes(contentType)) {
+          res.status(400).json({ error: "Image attachments cannot be empty" });
+          return;
+        }
         try {
-          const reference = await runtime.bridge.storeSessionMedia(
+          const reference = await runtime.bridge.storeSessionAttachment(
             sessionId,
             req.body,
             contentType,
-            clientId !== void 0 ? { clientId } : void 0
+            clientId !== void 0 ? { clientId } : void 0,
+            name
           );
           res.status(201).json(reference);
         } catch (error2) {
@@ -27787,57 +28450,61 @@ function registerSessionRoutes(app, deps) {
             res.status(413).json({ error: error2.message });
             return;
           }
+          if (error2 instanceof TypeError) {
+            res.status(400).json({ error: error2.message });
+            return;
+          }
           throw error2;
         }
       }
     )
   );
   app.get(
-    "/session/:id/media/:mediaId",
+    "/session/:id/attachments/:attachmentId",
     withOwnerReadSession(
-      "GET /session/:id/media/:mediaId",
+      "GET /session/:id/attachments/:attachmentId",
       async (req, res, sessionId, runtime) => {
-        const mediaId = req.params["mediaId"];
-        if (!mediaId) {
-          res.status(400).json({ error: "`mediaId` is required" });
+        const attachmentId = req.params["attachmentId"];
+        if (!attachmentId) {
+          res.status(400).json({ error: "`attachmentId` is required" });
           return;
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const media = await runtime.bridge.readSessionMedia(
+        const attachment = await runtime.bridge.readSessionAttachment(
           sessionId,
-          mediaId,
+          attachmentId,
           clientId !== void 0 ? { clientId } : void 0
         );
-        if (!media) {
-          res.status(404).json({ error: "session media not found" });
+        if (!attachment) {
+          res.status(404).json({ error: "session attachment not found" });
           return;
         }
-        res.setHeader("Content-Type", media.mimeType);
-        res.setHeader("Content-Length", String(media.data.byteLength));
+        res.setHeader("Content-Type", attachment.mimeType);
+        res.setHeader("Content-Length", String(attachment.data.byteLength));
         res.setHeader("Cache-Control", "private, max-age=300");
         res.setHeader("Content-Disposition", "attachment");
         res.setHeader("X-Content-Type-Options", "nosniff");
-        res.status(200).send(media.data);
+        res.status(200).send(attachment.data);
       }
     )
   );
   app.delete(
-    "/session/:id/media/:mediaId",
+    "/session/:id/attachments/:attachmentId",
     mutate(),
     withOwnerMutableSession(
-      "DELETE /session/:id/media/:mediaId",
+      "DELETE /session/:id/attachments/:attachmentId",
       async (req, res, sessionId, runtime) => {
-        const mediaId = req.params["mediaId"];
-        if (!mediaId) {
-          res.status(400).json({ error: "`mediaId` is required" });
+        const attachmentId = req.params["attachmentId"];
+        if (!attachmentId) {
+          res.status(400).json({ error: "`attachmentId` is required" });
           return;
         }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        const removed = await runtime.bridge.removeSessionMedia(
+        const removed = await runtime.bridge.removeSessionAttachment(
           sessionId,
-          mediaId,
+          attachmentId,
           clientId !== void 0 ? { clientId } : void 0
         );
         res.status(200).json({ removed });
@@ -29031,7 +29698,11 @@ function registerSessionRoutes(app, deps) {
         clientCount: session.clientCount,
         hasActivePrompt: session.hasActivePrompt,
         isWaitingForPermission: session.isWaitingForPermission ?? false,
-        isWaitingForUserQuestion: session.isWaitingForUserQuestion ?? false
+        isWaitingForUserQuestion: session.isWaitingForUserQuestion ?? false,
+        // Bridge-local activity watermark, absent until a running prompt in
+        // this bridge publishes its first terminal. Reading it costs nothing
+        // extra: the summary is already in memory.
+        ...session.updatedAt !== void 0 ? { updatedAt: session.updatedAt } : {}
       }));
       assertRuntimeOpen?.();
       lastExposedCatalogVersions.set(bridge, catalogVersion);
@@ -29261,7 +29932,10 @@ function registerSessionRoutes(app, deps) {
           trimmed,
           clientId !== void 0 ? { clientId } : void 0,
           typeof messageId === "string" ? messageId : void 0,
-          mediaBlocks ? { content: mediaBlocks } : void 0
+          {
+            rejectIfIdle: true,
+            ...mediaBlocks ? { content: mediaBlocks } : {}
+          }
         );
         res.status(200).json(result);
       }
@@ -30696,15 +31370,17 @@ function registerGoalsRoutes(app, deps) {
           continue;
         }
         const { session, goal } = outcome.value;
-        if (!goal.active) continue;
+        const record = goal.snapshot.goal;
+        if (!record || record.status === "complete") continue;
         goals.push({
           sessionId: session.sessionId,
           displayName: session.displayName ?? null,
-          condition: goal.active.condition,
-          iterations: goal.active.iterations,
-          setAt: goal.active.setAt,
-          ...goal.active.lastReason !== void 0 ? { lastReason: goal.active.lastReason } : {},
-          hasActivePrompt: session.hasActivePrompt
+          condition: record.objective,
+          iterations: record.turnCount,
+          setAt: record.createdAt,
+          ...record.lastReason !== void 0 ? { lastReason: record.lastReason } : {},
+          hasActivePrompt: session.hasActivePrompt,
+          snapshot: goal.snapshot
         });
       }
       if (dropped.length > 0) {
@@ -32492,7 +33168,7 @@ __name(registerWorkspaceQualifiedSettingsRoutes, "registerWorkspaceQualifiedSett
 // packages/cli/src/serve/routes/sse-events.ts
 init_esbuild_shims();
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { performance as performance2 } from "node:perf_hooks";
+import { performance as performance3 } from "node:perf_hooks";
 
 // packages/cli/src/serve/server/error-response.ts
 init_esbuild_shims();
@@ -32609,8 +33285,8 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     return;
   }
   if (sendGenerationClosedError(res, err)) return;
-  if (err instanceof Error && "code" in err && (err.code === "session_media_gone" || err.code === "invalid_session_media_reference")) {
-    res.status(err.code === "session_media_gone" ? 410 : 400).json({ error: err.message, code: err.code });
+  if (err instanceof Error && "code" in err && (err.code === "session_attachment_gone" || err.code === "invalid_session_attachment_reference")) {
+    res.status(err.code === "session_attachment_gone" ? 410 : 400).json({ error: err.message, code: err.code });
     return;
   }
   if (err instanceof SessionWriterError) {
@@ -32777,6 +33453,14 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     });
     return;
   }
+  if (err instanceof SessionIdCaseConflictError) {
+    res.status(409).json({
+      error: err.message,
+      code: "session_conflict",
+      sessionId: err.sessionId
+    });
+    return;
+  }
   if (err instanceof SessionArchivingError) {
     res.set("Retry-After", "5");
     res.status(409).json({
@@ -32938,6 +33622,22 @@ function sendBridgeError(res, err, ctx, daemonLog) {
         });
         return;
       }
+      if (kind === "untrusted_workspace") {
+        res.status(403).json({
+          error: errorMessage2(err),
+          code: kind
+        });
+        return;
+      }
+      if (kind === "goal_conflict" || kind === "goal_invalid_transition" || kind === "goal_persist_failed") {
+        const d = data;
+        res.status(kind === "goal_persist_failed" ? 500 : 409).json({
+          error: errorMessage2(err),
+          code: kind,
+          ...d.current !== void 0 ? { current: d.current } : {}
+        });
+        return;
+      }
       if (kind === "branch_point_invalid") {
         res.status(409).json({
           error: errorMessage2(err),
@@ -33377,7 +34077,7 @@ function registerSseEventsRoutes(app, deps) {
       });
       return;
     }
-    const openedAt = performance2.now();
+    const openedAt = performance3.now();
     let closeReason;
     let terminalCandidate;
     let terminalEventType;
@@ -33396,10 +34096,10 @@ function registerSseEventsRoutes(app, deps) {
       if (activeDrainStartedAt !== void 0) {
         maxDrainWaitMs = Math.max(
           maxDrainWaitMs,
-          performance2.now() - activeDrainStartedAt
+          performance3.now() - activeDrainStartedAt
         );
       }
-      const durationMs = Math.max(0, performance2.now() - openedAt);
+      const durationMs = Math.max(0, performance3.now() - openedAt);
       const resolvedCloseReason = closeReason ?? terminalCandidate ?? "client_disconnect";
       const closeAttributes = {
         "qwen-code.daemon.sse.duration_ms": durationMs,
@@ -33508,7 +34208,7 @@ function registerSseEventsRoutes(app, deps) {
       if (activeDrainStartedAt === void 0) return;
       maxDrainWaitMs = Math.max(
         maxDrainWaitMs,
-        performance2.now() - activeDrainStartedAt
+        performance3.now() - activeDrainStartedAt
       );
       activeDrainStartedAt = void 0;
     }, "settleDrainMeasurement");
@@ -33531,7 +34231,7 @@ function registerSseEventsRoutes(app, deps) {
         return;
       }
       backpressureCount += 1;
-      activeDrainStartedAt = performance2.now();
+      activeDrainStartedAt = performance3.now();
       const onDrain = /* @__PURE__ */ __name(() => {
         res.off("close", onClose);
         res.off("error", onError);
@@ -34571,7 +35271,14 @@ __name(setupDeviceFlowRegistry, "setupDeviceFlowRegistry");
 init_esbuild_shims();
 var import_express5 = __toESM(require_express(), 1);
 function installJsonBodyParser(app) {
-  app.use(import_express5.default.json({ limit: "10mb" }));
+  const parseJson = import_express5.default.json({ limit: "10mb" });
+  app.use((req, res, next) => {
+    if (req.method === "POST" && /^\/session\/[^/]+\/attachments\/?$/i.test(req.path)) {
+      next();
+      return;
+    }
+    parseJson(req, res, next);
+  });
   app.use((err, _req, res, next) => {
     if (sendJsonBodyParserError(res, err)) return;
     next(err);
@@ -45605,7 +46312,10 @@ var LiveTaskService = class {
         cwd: located.summary.workspaceCwd,
         createdAt: epochSeconds(located.summary.createdAt),
         updatedAt: epochSeconds(
-          located.summary.updatedAt ?? located.persisted?.conversation.lastUpdated
+          laterActivityTimestamp(
+            located.summary.updatedAt,
+            located.persisted?.conversation.lastUpdated
+          )
         )
       },
       page: {
@@ -45744,7 +46454,10 @@ var LiveTaskService = class {
         ),
         eventId: task.runtime.bridge.getSessionLastEventId(target.threadId)
       } : {},
-      updatedAt: task.summary.updatedAt ?? task.persisted?.conversation.lastUpdated
+      updatedAt: laterActivityTimestamp(
+        task.summary.updatedAt,
+        task.persisted?.conversation.lastUpdated
+      )
     });
     const { reset: cursorReset } = decodeCursor(
       target.afterCursor,
@@ -45758,7 +46471,10 @@ var LiveTaskService = class {
     const completedAt = latestTurnRecords.at(-1)?.timestamp ?? task.persisted?.conversation.lastUpdated;
     const failed = task.summary.hasTurnError === true;
     const revision = task.summary.clientCount > 0 ? task.runtime.bridge.getSessionLastEventId(target.threadId) : epochSeconds(
-      task.summary.updatedAt ?? task.persisted?.conversation.lastUpdated ?? task.summary.createdAt
+      laterActivityTimestamp(
+        task.summary.updatedAt,
+        task.persisted?.conversation.lastUpdated
+      ) ?? task.summary.createdAt
     );
     return {
       schemaVersion: 1,
@@ -45910,7 +46626,7 @@ var LiveTaskService = class {
     const service = createWorkspaceRuntimeSessionService(task.runtime);
     const metadata = task.runtime.provenance === "live-conversation" ? await readLoadableLiveConversationMetadata(
       task.summary.sessionId,
-      (sessionId) => service.readCreationMetadata(sessionId)
+      service
     ) : await service.readCreationMetadata(task.summary.sessionId);
     if (metadata === void 0) {
       throw new SessionNotFoundError(task.summary.sessionId);
@@ -46882,6 +47598,10 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   }) : void 0;
   const defaultSessionOwnerIndex = !injectedWorkspaceRegistry ? createWorkspaceSessionOwnerIndex() : void 0;
   const bridge = injectedWorkspaceRegistry?.primary.bridge ?? deps.bridge ?? createAcpSessionBridge({
+    sessionAttachmentsRoot: path18.join(
+      new Storage(boundWorkspace).getProjectTempDir(),
+      "attachments"
+    ),
     maxSessions: opts.maxSessions,
     ...totalSessionAdmission ? { freshSessionAdmission: totalSessionAdmission.admit } : {},
     ...defaultSessionOwnerIndex ? {
@@ -47411,6 +48131,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     healthRoutes.register(app);
   }
   installAccessLogMiddleware(app, daemonLog);
+  app.use(daemonInboundTraceIdCaptureMiddleware);
   const webShellDir = opts.serveWebShell !== false ? deps.webShellDir : void 0;
   const webShellFrameAncestors = opts.allowOrigins && opts.allowOrigins.length > 0 ? [...parseAllowOriginPatterns(opts.allowOrigins).origins].filter(
     (o) => o.startsWith("chrome-extension://") || o.startsWith("moz-extension://")