@qwen-code/qwen-code 0.21.6-preview.0 → 0.21.7

package/chunks/{run-qwen-serve-UYEMGPKA.js → run-qwen-serve-ZPKPKECF.js}

@@ -31,11 +31,10 @@ import {
   parseDaemonStatusDetail,
   positiveFiniteOrNull,
   prepareManagedScratchRoot,
-  require_express,
-  resolveWebShellDir,
+  resolveAcpHttpEnabled,
   setDeferredRuntimeRequestTiming,
   toDaemonStatusMemoryLimits
-} from "./chunk-XZCMQUOF.js";
+} from "./chunk-RGSBTHSU.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
@@ -43,6 +42,13 @@ import {
   formatMemoryBudgetStderr,
   resolveDaemonMemoryBudget
 } from "./chunk-HGCQ5SE7.js";
+import {
+  require_express,
+  resolveWebShellDir
+} from "./chunk-GDXET5XU.js";
+import {
+  LIVE_HOST_PROTOCOL_VERSION
+} from "./chunk-NKLP3DCK.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
   DEFAULT_MAX_JOURNAL_BYTES,
@@ -65,24 +71,24 @@ import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-WAOLM6SQ.js";
-import "./chunk-3DTM3RPU.js";
+} from "./chunk-P2AJ7FTI.js";
+import "./chunk-S7CV4KO6.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-UKZEXS6K.js";
+} from "./chunk-R574ATRM.js";
 import "./chunk-J26HHFI5.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-6PLDPT2C.js";
-import "./chunk-XNZBXQCG.js";
+import "./chunk-MKVZE4ZJ.js";
 import "./chunk-FYJ7W2PI.js";
 import {
   ChannelDeliveryError,
   ChannelWebhookEnqueueError,
   QWEN_SERVER_TOKEN_ENV,
   isChannelDeliveryError
-} from "./chunk-QONSRAEV.js";
+} from "./chunk-YP5KH5Y7.js";
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
@@ -90,7 +96,7 @@ import {
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
-import "./chunk-BK2UNYWD.js";
+import "./chunk-HIBNSEJE.js";
 import {
   EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
   EXTERNAL_TOOL_GUARD_TOKEN_ENV,
@@ -110,7 +116,7 @@ import {
 import "./chunk-6PEXNQTX.js";
 import {
   getCliVersion
-} from "./chunk-NKST54XA.js";
+} from "./chunk-FZBZSYKU.js";
 import "./chunk-VJNBRRZG.js";
 import "./chunk-ALGGS7UH.js";
 import {
@@ -133,7 +139,7 @@ import "./chunk-Q7YDKOGY.js";
 import {
   writeStderrLine,
   writeStdoutLine
-} from "./chunk-OWAK7LMW.js";
+} from "./chunk-KGJGEEVR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
 import {
@@ -147,7 +153,7 @@ import {
 // packages/cli/src/serve/run-qwen-serve.ts
 init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
-import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash as createHash3, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
 import * as https from "node:https";
 import * as path from "node:path";
@@ -1283,7 +1289,7 @@ function createConcreteLogger(input) {
         }
       });
       let timeout;
-      const deadline = new Promise((resolve2) => {
+      const deadline = new Promise((resolve3) => {
         timeout = setTimeout(() => {
           try {
             input.warnOnce(
@@ -1292,7 +1298,7 @@ function createConcreteLogger(input) {
             );
           } catch {
           } finally {
-            resolve2();
+            resolve3();
           }
         }, input.policy.closeDrainBudgetMs);
         timeout.unref();
@@ -1636,6 +1642,190 @@ ${capUtf8Record(
 }
 __name(initDaemonLogger, "initDaemonLogger");
 
+// packages/cli/src/serve/live/conversation-workspace.ts
+init_esbuild_shims();
+import { createHash as createHash2 } from "node:crypto";
+import { lstat, mkdir, realpath, rmdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join as join2, relative as relative2, resolve, sep } from "node:path";
+var isSamePath = /* @__PURE__ */ __name((left, right) => process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right, "isSamePath");
+function conversationDirectoryName(sessionId) {
+  if (sessionId.length === 0 || sessionId.length > 256) {
+    throw new Error("Live conversation session id is invalid");
+  }
+  return `conversation-${createHash2("sha256").update(sessionId).digest("hex")}`;
+}
+__name(conversationDirectoryName, "conversationDirectoryName");
+function validateRootStats(stats, label = "root") {
+  if (stats.isSymbolicLink() || !stats.isDirectory()) {
+    throw new Error(
+      `Live conversation ${label} must be a non-symlink directory`
+    );
+  }
+  if (process.platform !== "win32" && typeof process.getuid === "function" && stats.uid !== process.getuid()) {
+    throw new Error(
+      `Live conversation ${label} must be owned by the daemon user`
+    );
+  }
+  if (process.platform !== "win32" && (stats.mode & 63) !== 0) {
+    throw new Error(
+      `Live conversation ${label} must be accessible only to its owner`
+    );
+  }
+}
+__name(validateRootStats, "validateRootStats");
+function hasIdentity(stats, root) {
+  return stats.dev === root.device && stats.ino === root.inode;
+}
+__name(hasIdentity, "hasIdentity");
+async function validateConversationDirectory(root, name, candidate, parent = root.canonicalRoot) {
+  const before = await lstat(candidate);
+  validateRootStats(before, "directory");
+  const canonical = await realpath(candidate);
+  const after = await lstat(canonical);
+  validateRootStats(after, "directory");
+  const child = relative2(parent, canonical);
+  if (child !== name || child.includes(sep) || child.startsWith("..") || isAbsolute(child) || before.dev !== after.dev || before.ino !== after.ino) {
+    throw new Error(
+      "Live conversation directory must be an owned direct child"
+    );
+  }
+  await revalidateLiveConversationRoot(root);
+  return canonical;
+}
+__name(validateConversationDirectory, "validateConversationDirectory");
+function getLiveConversationRootPath(homeDir = homedir()) {
+  return resolve(homeDir, "Documents", "Qwen Code", "Conversations");
+}
+__name(getLiveConversationRootPath, "getLiveConversationRootPath");
+async function createRoot(configuredRoot) {
+  try {
+    await mkdir(configuredRoot, { recursive: true, mode: 448 });
+  } catch (error) {
+    let existing;
+    try {
+      existing = await lstat(configuredRoot);
+    } catch {
+      throw error;
+    }
+    validateRootStats(existing);
+    throw error;
+  }
+  const before = await lstat(configuredRoot);
+  validateRootStats(before);
+  const canonicalRoot = await realpath(configuredRoot);
+  const after = await lstat(canonicalRoot);
+  validateRootStats(after);
+  if (before.dev !== after.dev || before.ino !== after.ino) {
+    throw new Error(
+      "Live conversation root identity changed during validation"
+    );
+  }
+  return {
+    configuredRoot,
+    canonicalRoot,
+    device: after.dev,
+    inode: after.ino
+  };
+}
+__name(createRoot, "createRoot");
+async function revalidateLiveConversationRoot(root) {
+  const configuredStats = await lstat(root.configuredRoot);
+  validateRootStats(configuredStats);
+  if (!hasIdentity(configuredStats, root)) {
+    throw new Error("Live conversation root identity changed");
+  }
+  const canonical = await realpath(root.configuredRoot);
+  if (!isSamePath(canonical, root.canonicalRoot)) {
+    throw new Error("Live conversation root canonical path changed");
+  }
+  const canonicalStats = await lstat(root.canonicalRoot);
+  validateRootStats(canonicalStats);
+  if (!hasIdentity(canonicalStats, root)) {
+    throw new Error("Live conversation root identity changed");
+  }
+  return root;
+}
+__name(revalidateLiveConversationRoot, "revalidateLiveConversationRoot");
+async function assertExactLiveConversationRoot(root, candidate) {
+  await revalidateLiveConversationRoot(root);
+  const resolvedCandidate = resolve(candidate);
+  if (!isSamePath(resolvedCandidate, root.configuredRoot) && !isSamePath(resolvedCandidate, root.canonicalRoot)) {
+    throw new Error("Workspace must be the exact Live conversation root");
+  }
+  const stats = await lstat(resolvedCandidate);
+  validateRootStats(stats);
+  const canonical = await realpath(resolvedCandidate);
+  if (!isSamePath(canonical, root.canonicalRoot) || !hasIdentity(stats, root)) {
+    throw new Error("Workspace must be the exact Live conversation root");
+  }
+  return root;
+}
+__name(assertExactLiveConversationRoot, "assertExactLiveConversationRoot");
+var LiveConversationWorkspace = class {
+  static {
+    __name(this, "LiveConversationWorkspace");
+  }
+  rootPath;
+  rootPromise;
+  constructor(options = {}) {
+    this.rootPath = getLiveConversationRootPath(options.homeDir);
+  }
+  async getRoot() {
+    if (!this.rootPromise) {
+      const pending = createRoot(this.rootPath);
+      this.rootPromise = pending;
+      void pending.catch(() => {
+        if (this.rootPromise === pending) this.rootPromise = void 0;
+      });
+    }
+    return this.rootPromise;
+  }
+  async revalidate() {
+    return revalidateLiveConversationRoot(await this.getRoot());
+  }
+  async assertExactRoot(candidate) {
+    return assertExactLiveConversationRoot(await this.getRoot(), candidate);
+  }
+  async materializeConversationDirectory(sessionId) {
+    const root = await this.revalidate();
+    const name = conversationDirectoryName(sessionId);
+    const candidate = join2(root.canonicalRoot, name);
+    try {
+      await mkdir(candidate, { mode: 448 });
+    } catch (error) {
+      if (!error || typeof error !== "object" || error.code !== "EEXIST") {
+        throw error;
+      }
+    }
+    return validateConversationDirectory(root, name, candidate);
+  }
+  async discardEmptyConversationDirectory(sessionId) {
+    const root = await this.revalidate();
+    const name = conversationDirectoryName(sessionId);
+    const candidate = join2(root.canonicalRoot, name);
+    let canonical;
+    try {
+      canonical = await validateConversationDirectory(root, name, candidate);
+    } catch (error) {
+      if (error && typeof error === "object" && error.code === "ENOENT") {
+        return false;
+      }
+      throw error;
+    }
+    try {
+      await rmdir(canonical);
+    } catch (error) {
+      if (error && typeof error === "object" && (error.code === "ENOENT" || error.code === "ENOTEMPTY")) {
+        return false;
+      }
+      throw error;
+    }
+    await revalidateLiveConversationRoot(root);
+    return true;
+  }
+};
+
 // packages/cli/src/serve/daemon-metrics-ring.ts
 init_esbuild_shims();
 var MAX_SAMPLES_PER_WINDOW = 4096;
@@ -2292,7 +2482,10 @@ function rawChannelCwd(entry) {
 }
 __name(rawChannelCwd, "rawChannelCwd");
 function resolveChannelWorkspaceGroups(input) {
-  const { workspaces, selection, loadChannelsConfig } = input;
+  const { selection, loadChannelsConfig } = input;
+  const workspaces = input.workspaces.filter(
+    (workspace) => workspace.provenance !== "live-conversation"
+  );
   const primary = workspaces.find((workspace) => workspace.primary);
   if (!primary) {
     return {
@@ -2400,6 +2593,7 @@ var QWEN_SERVE_PROMPT_DEADLINE_MS_ENV = "QWEN_SERVE_PROMPT_DEADLINE_MS";
 var QWEN_SERVE_WRITER_IDLE_TIMEOUT_MS_ENV = "QWEN_SERVE_WRITER_IDLE_TIMEOUT_MS";
 var SHUTDOWN_FORCE_CLOSE_MS = 5e3;
 var DAEMON_LOG_FORCED_FLUSH_BUDGET_MS = 250;
+var DEFAULT_LIVE_DISCOVERY_RETRY_MS = 5e3;
 function channelDeliveryPublicError(code) {
   switch (code) {
     case "channel_worker_unavailable":
@@ -2490,8 +2684,8 @@ async function flushDaemonLogBounded(daemonLog, budgetMs) {
     await Promise.race([
       daemonLog.flush().catch(() => {
       }),
-      new Promise((resolve2) => {
-        timer = setTimeout(resolve2, budgetMs);
+      new Promise((resolve3) => {
+        timer = setTimeout(resolve3, budgetMs);
         timer.unref();
       })
     ]);
@@ -2738,12 +2932,12 @@ var retryableChannelWorkerShutdownErrors = /* @__PURE__ */ new WeakSet();
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-NUEDVHX4.js"),
-    import("./pidfile-I3CXJGQD.js"),
-    import("./runtime-CG3BKRFE.js"),
+    import("./channel-worker-supervisor-62YWUGP2.js"),
+    import("./pidfile-JOIIRN2C.js"),
+    import("./runtime-2FLNNM36.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-SVGPDH2C.js"),
-    import("./channel-worker-manager-72ZK2GTS.js")
+    import("./channel-worker-group-JWQK224X.js"),
+    import("./channel-worker-manager-77E3OXRQ.js")
   ]).then(
     ([
       supervisor,
@@ -2848,10 +3042,16 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-D2626QQU.js");
+  coreRuntimePromise ??= import("./core-runtime-QMJPWHCI.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
+var liveDiscoveryRuntimePromise;
+function loadLiveDiscoveryRuntime() {
+  liveDiscoveryRuntimePromise ??= import("./discovery-XLHITE74.js");
+  return liveDiscoveryRuntimePromise;
+}
+__name(loadLiveDiscoveryRuntime, "loadLiveDiscoveryRuntime");
 async function resolveDaemonLogBaseDirForRun(input) {
   if (input.deps.daemonLogBaseDir) {
     return input.deps.daemonLogBaseDir;
@@ -2878,10 +3078,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-NX4EUIE6.js"),
-    import("./environment-U6QP23VJ.js"),
-    import("./loadedSettingsAdapter-YK5SBHOT.js"),
-    import("./trustedFolders-Z2UAEG2V.js")
+    import("./settings-KULVPCQC.js"),
+    import("./environment-GJ2HWJOS.js"),
+    import("./loadedSettingsAdapter-QRYRJSWL.js"),
+    import("./trustedFolders-TJ5S26N7.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -2894,8 +3094,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-CG3BKRFE.js"),
-    import("./config-utils-LIRO7NSU.js")
+    import("./runtime-2FLNNM36.js"),
+    import("./config-utils-K7SCOWHD.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -2920,17 +3120,17 @@ async function loadServeRuntimeModules() {
     totalSessionAdmissionModule,
     workspaceRegistryModule
   ] = await Promise.all([
-    import("./server-WS7LWXPP.js"),
-    import("./bridge-TCFMLKHR.js"),
-    import("./spawnChannel-COLJMSA7.js"),
+    import("./server-XLJVLTYM.js"),
+    import("./bridge-NU6YEEHK.js"),
+    import("./spawnChannel-ZKS4Q5OU.js"),
     import("./process-registry-2CHQBXH5.js"),
-    import("./workspace-service-V47ZFJRX.js"),
+    import("./workspace-service-HFIFDMU7.js"),
     import("./types-ML3TRJQ5.js"),
-    import("./daemon-status-provider-2EHRZZVF.js"),
-    import("./workspace-providers-status-JZ3GPWNU.js"),
-    import("./workspace-skills-status-6ZQ45XKA.js"),
-    import("./total-session-admission-XAXOSE46.js"),
-    import("./workspace-registry-6W4ES7BJ.js")
+    import("./daemon-status-provider-FSWDPE2G.js"),
+    import("./workspace-providers-status-HZ474RA4.js"),
+    import("./workspace-skills-status-HAHEIHGK.js"),
+    import("./total-session-admission-MK4SINFK.js"),
+    import("./workspace-registry-R4APRRNC.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -3125,12 +3325,12 @@ async function waitForRuntimeStartingForShutdown(runtimeStarting, daemonLog, tim
   let timer;
   await Promise.race([
     runtimeStarting,
-    new Promise((resolve2) => {
+    new Promise((resolve3) => {
       timer = setTimeout(() => {
         daemonLog.warn(
           `${timeoutMs}ms runtime-startup wait reached during shutdown; continuing listener close`
         );
-        resolve2();
+        resolve3();
       }, timeoutMs);
       timer.unref();
     })
@@ -3147,6 +3347,18 @@ var BOOTSTRAP_SERVE_PATHS = /* @__PURE__ */ new Set([
   BOOTSTRAP_CAPABILITIES_PATH,
   BOOTSTRAP_DAEMON_STATUS_PATH
 ]);
+var RUNTIME_STARTUP_FAILED_ENVELOPE = {
+  error: "Daemon runtime failed to start",
+  code: "daemon_runtime_failed"
+};
+var RUNTIME_STARTUP_STARTING_ENVELOPE = {
+  error: "Daemon runtime is still starting",
+  code: "daemon_runtime_starting"
+};
+function runtimeStartupEnvelope(runtimeError) {
+  return runtimeError ? RUNTIME_STARTUP_FAILED_ENVELOPE : RUNTIME_STARTUP_STARTING_ENVELOPE;
+}
+__name(runtimeStartupEnvelope, "runtimeStartupEnvelope");
 function createBootstrapServeApp(input) {
   const {
     opts,
@@ -3206,10 +3418,7 @@ function createBootstrapServeApp(input) {
       if (runtimeError === void 0) {
         res.setHeader("Retry-After", "1");
       }
-      res.status(503).json({
-        error: runtimeError ? "Daemon runtime failed to start" : "Daemon runtime is still starting",
-        code: runtimeError ? "daemon_runtime_failed" : "daemon_runtime_starting"
-      });
+      res.status(503).json(runtimeStartupEnvelope(runtimeError));
       return;
     }
     res.status(200).json(
@@ -3372,11 +3581,7 @@ function createBootstrapServeApp(input) {
     res.status(200).json(response);
   });
   app.use((_req, res) => {
-    const runtimeError = getRuntimeError();
-    res.status(503).json({
-      error: runtimeError ? "Daemon runtime failed to start" : "Daemon runtime is still starting",
-      code: runtimeError ? "daemon_runtime_failed" : "daemon_runtime_starting"
-    });
+    res.status(503).json(runtimeStartupEnvelope(getRuntimeError()));
   });
   return app;
 }
@@ -3394,7 +3599,10 @@ function createDelegatingServeApp(bootstrapApp, getRuntimeApp, options = {}) {
         };
         const webhookRequest = isChannelWebhookRequest(req);
         const authGate = webhookRequest ? options.authenticateDeferredChannelWebhookRequest ?? options.authenticateDeferredRuntimeRequest : options.authenticateDeferredRuntimeRequest;
-        if (authGate) {
+        const preAuthExempted = authGate !== void 0 && await Promise.resolve(options.isPreAuthRequest?.(req)).catch(
+          () => false
+        ) === true;
+        if (authGate && !preAuthExempted) {
           if (!runSynchronousRequestGate(authGate, req, res, next)) {
             return;
           }
@@ -3406,6 +3614,10 @@ function createDelegatingServeApp(bootstrapApp, getRuntimeApp, options = {}) {
         try {
           await options.runtimeReady;
         } catch {
+          if (preAuthExempted) {
+            res.status(503).json(RUNTIME_STARTUP_FAILED_ENVELOPE);
+            return;
+          }
         } finally {
           timing.waitMs = Math.round((performance2.now() - waitStartedAt) * 100) / 100;
         }
@@ -3496,8 +3708,8 @@ function matchesWebhookSecret(candidate, expected) {
   if (typeof candidate !== "string" || typeof expected !== "string" || expected.length === 0) {
     return false;
   }
-  const expectedDigest = createHash2("sha256").update(expected).digest();
-  const candidateDigest = createHash2("sha256").update(candidate).digest();
+  const expectedDigest = createHash3("sha256").update(expected).digest();
+  const candidateDigest = createHash3("sha256").update(candidate).digest();
   return timingSafeEqual(expectedDigest, candidateDigest);
 }
 __name(matchesWebhookSecret, "matchesWebhookSecret");
@@ -3842,7 +4054,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-SM2PWB6L.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-6EUP4JXG.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -4125,8 +4337,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   let startRuntimeAfterHealth;
   let startRuntimeForRequest;
   const deferRuntimeUntilFirstHealth = deps.resolveOnListen === true && deps.deferRuntimeUntilFirstHealth === true;
-  const runtimeReady = new Promise((resolve2, reject) => {
-    markRuntimeReady = resolve2;
+  const runtimeReady = new Promise((resolve3, reject) => {
+    markRuntimeReady = resolve3;
     markRuntimeFailed = reject;
   });
   void runtimeReady.catch(() => {
@@ -4320,6 +4532,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }, "stopSafely");
     stopSafely("scheduled-task keepalive", locals.stopScheduledTaskKeepalive);
     stopSafely("workspace git state", locals.stopWorkspaceGitState);
+    stopSafely("Live Host coordinator", locals.stopLiveCoordinator);
     stopTrustPolicyMonitor(app2);
     for (const stop of locals.subSessionStoppers ?? []) {
       stopSafely("sub-session launcher", stop);
@@ -4379,7 +4592,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-B3EPDJDR.js")
+      import("./daemon-trust-policy-P5L5VFAY.js")
     ]);
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
@@ -4402,6 +4615,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         `qwen serve: managed scratch workspaces are unavailable: ${err instanceof Error ? err.message : String(err)}`
       );
     }
+    const liveConversationWorkspace = deps.liveConversationWorkspace ?? new LiveConversationWorkspace();
     let runtimeBootSettings;
     try {
       runtimeBootSettings = settingsRuntime.settings.loadSettings(
@@ -4744,7 +4958,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-T3JZ33T2.js");
+      } = await import("./skill-settings-NMY4JEJC.js");
       const fresh = loadSettingsForPersistence(workspace);
       const normalizedName = skillName.trim().toLowerCase();
       const resolved = resolveSkillSettings(fresh);
@@ -4843,7 +5057,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
       }
     }), "persistSettingsFn");
-    const { createSubSessionLauncher } = await import("./create-sub-session-MWUWNBM6.js");
+    const { createSubSessionLauncher } = await import("./create-sub-session-DJE6XICH.js");
     const subSessionLauncher = createSubSessionLauncher({
       getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
       boundWorkspace,
@@ -5434,9 +5648,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           "Managed scratch runtime must use an accepted direct child directory"
         );
       }
+      if (provenance === "live-conversation") {
+        await liveConversationWorkspace.assertExactRoot(cwd);
+      }
       const snapshot = buildOptions?.snapshot ?? await trustPolicy.readDaemonTrustPolicySnapshot();
       const decision = buildOptions?.decision ?? trustPolicy.evaluateDaemonWorkspaceTrust(snapshot, cwd);
-      const trusted = provenance === "managed-scratch" ? true : buildOptions?.trusted ?? decision.targetTrusted;
+      const trusted = provenance === "managed-scratch" || provenance === "live-conversation" ? true : buildOptions?.trusted ?? decision.targetTrusted;
       let wsSettings;
       try {
         wsSettings = settingsRuntime.settings.loadSettings(cwd, {
@@ -5491,6 +5708,17 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const wsSubSessionLauncher = createSubSessionLauncher({
         getBridge: /* @__PURE__ */ __name(() => wsBridgeRef, "getBridge"),
         boundWorkspace: cwd,
+        ...provenance === "live-conversation" ? {
+          notifySentCompletion: true,
+          isolatedWorkspace: {
+            materializeDirectory: /* @__PURE__ */ __name((sessionId) => liveConversationWorkspace.materializeConversationDirectory(
+              sessionId
+            ), "materializeDirectory"),
+            discardEmptyDirectory: /* @__PURE__ */ __name((sessionId) => liveConversationWorkspace.discardEmptyConversationDirectory(
+              sessionId
+            ), "discardEmptyDirectory")
+          }
+        } : {},
         ...subSessionConcurrencyCapsFromSettings(
           wsSettings?.merged.serve ?? {}
         )
@@ -5668,11 +5896,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         workspaceId: wsHash,
         workspaceCwd: cwd,
         sessionRuntimeBaseDir: wsEnv.sessionRuntimeBaseDir,
-        ...buildOptions?.displayName !== void 0 ? { displayName: buildOptions.displayName } : {},
+        ...buildOptions?.displayName !== void 0 ? { displayName: buildOptions.displayName } : provenance === "live-conversation" ? { displayName: "Conversations" } : {},
         primary: buildOptions?.primary ?? false,
         trusted,
         provenance,
-        removable: buildOptions?.removable ?? true,
+        removable: buildOptions?.removable ?? provenance !== "live-conversation",
         registrationIds: [...buildOptions?.registrationIds ?? []],
         env: wsEnv.metadata,
         bridge: wsBridge,
@@ -5686,7 +5914,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         })
       };
       subSessionStoppersByRuntime.set(wsRuntime, wsSubSessionLauncher.stop);
-      if (provenance !== "managed-scratch" && !buildOptions?.snapshot) {
+      if (provenance === "existing" && !buildOptions?.snapshot) {
         const latest = await trustPolicy.readDaemonTrustPolicySnapshot();
         if (latest.revision !== snapshot.revision) {
           generationGuard.close();
@@ -5718,6 +5946,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     const serveAppForRuntimeLifecycle = { current: void 0 };
     const workspaceRuntimeRemoval = {
       async runtimeAdded(runtimeAdded) {
+        if (runtimeAdded.provenance === "live-conversation") return;
         channelWebhookEnvByWorkspace.set(
           runtimeAdded.workspaceCwd,
           workspaceRuntimeEffectiveEnv(runtimeAdded, daemonRuntimeBaseEnv)
@@ -5750,7 +5979,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           invalidatePrimaryServeFeaturesCache();
         }
         totalSessionAdmission.beginWorkspaceDrain(runtimeToDrain.workspaceCwd);
-        channelWorkerManager?.beginWorkspaceDrain(runtimeToDrain.workspaceCwd);
+        if (runtimeToDrain.provenance !== "live-conversation") {
+          channelWorkerManager?.beginWorkspaceDrain(
+            runtimeToDrain.workspaceCwd
+          );
+        }
         workspaceVoiceCoordinator.beginWorkspaceDrain(runtimeToDrain);
         channelWebhookEnvByWorkspace.delete(runtimeToDrain.workspaceCwd);
         channelWebhookConfigVersion += 1;
@@ -5771,15 +6004,21 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           bridgeRef = runtimeToDrain.bridge;
           invalidatePrimaryServeFeaturesCache();
         }
-        channelWorkerManager?.cancelWorkspaceDrain(runtimeToDrain.workspaceCwd);
+        if (runtimeToDrain.provenance !== "live-conversation") {
+          channelWorkerManager?.cancelWorkspaceDrain(
+            runtimeToDrain.workspaceCwd
+          );
+        }
         totalSessionAdmission.cancelWorkspaceDrain(runtimeToDrain.workspaceCwd);
         workspaceVoiceCoordinator.cancelWorkspaceDrain(runtimeToDrain);
-        channelWebhookEnvByWorkspace.set(
-          runtimeToDrain.workspaceCwd,
-          workspaceRuntimeEffectiveEnv(runtimeToDrain, daemonRuntimeBaseEnv)
-        );
-        channelWebhookConfigVersion += 1;
-        refreshChannelWebhookConfigs?.();
+        if (runtimeToDrain.provenance !== "live-conversation") {
+          channelWebhookEnvByWorkspace.set(
+            runtimeToDrain.workspaceCwd,
+            workspaceRuntimeEffectiveEnv(runtimeToDrain, daemonRuntimeBaseEnv)
+          );
+          channelWebhookConfigVersion += 1;
+          refreshChannelWebhookConfigs?.();
+        }
         const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
         const startScheduledTaskKeepaliveForWorkspace = app3?.locals?.["startScheduledTaskKeepaliveForWorkspace"];
         try {
@@ -5802,7 +6041,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           pendingSessionStarts: totalSessionAdmission.snapshotForWorkspace(
             runtimeToDrain.workspaceCwd
           ).inFlight,
-          channelWorkers: channelWorkerManager?.workspaceActivity(
+          channelWorkers: runtimeToDrain.provenance === "live-conversation" ? 0 : channelWorkerManager?.workspaceActivity(
             runtimeToDrain.workspaceCwd
           ) ?? 0,
           voiceSessions: workspaceVoiceCoordinator.getWorkspaceActivity(runtimeToDrain)
@@ -5834,7 +6073,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             stopSubSessions?.();
           } catch {
           }
-          if (reason !== "daemon_shutdown" && channelWorkerManager) {
+          if (reason !== "daemon_shutdown" && channelWorkerManager && runtimeToDrain.provenance !== "live-conversation") {
             await channelWorkerManager.removeWorkspace(runtimeToDrain.workspaceCwd).catch((err) => {
               daemonLog.error(
                 "workspace channel worker cleanup error",
@@ -5956,8 +6195,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-5XPPTWUQ.js"),
-          import("./channel-settings-store-B4HNMNQV.js")
+          import("./channel-management-service-FSQ7SHYI.js"),
+          import("./channel-settings-store-35VQVUVV.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -6019,6 +6258,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         getWorkspaceTrustPolicySnapshot: /* @__PURE__ */ __name(() => latestTrustPolicySnapshot, "getWorkspaceTrustPolicySnapshot")
       } : {},
       managedScratchRoot,
+      liveConversationWorkspace,
       workspaceRegistrationStore,
       workspaceRuntimeRemoval,
       workspaceTrustHotReloadAvailable,
@@ -6036,6 +6276,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       primaryWorkspaceTrusted: trustedWorkspace,
       primaryRuntimeEnv,
       daemonEnv: daemonRuntimeBaseEnv,
+      runtimePlatform: deps.runtimePlatform,
       daemonLog,
       getChannelWorkerSnapshot,
       getChannelWorkerSnapshots,
@@ -6153,8 +6394,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-6V25LMCN.js"),
-        import("./daemon-trust-policy-monitor-MFM5X26G.js")
+        import("./workspace-trust-reconciler-65GTAGDK.js"),
+        import("./daemon-trust-policy-monitor-73JYN6ET.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -6249,7 +6490,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             handle?.disposeWorkspace(runtimeToDispose.workspaceId);
             const deadline = Date.now() + 1e3;
             while ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0 && Date.now() < deadline) {
-              await new Promise((resolve2) => setTimeout(resolve2, 25));
+              await new Promise((resolve3) => setTimeout(resolve3, 25));
             }
             if ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0) {
               throw new Error(
@@ -6343,7 +6584,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     startRuntime: /* @__PURE__ */ __name(() => startRuntimeForRequest?.() ?? false, "startRuntime"),
     runtimeReady,
     authenticateDeferredRuntimeRequest: bearerAuth(opts.token),
-    authenticateDeferredChannelWebhookRequest: deferredChannelWebhookAuth
+    authenticateDeferredChannelWebhookRequest: deferredChannelWebhookAuth,
+    // The runtime app serves these before bearerAuth; a browser navigation
+    // cannot attach the bearer header, so the cold gate must let them
+    // through (and start the runtime) exactly like the warm app would.
+    // Dynamic import keeps web-shell-static out of the serve fast-path
+    // static closure (see the import-boundary guards in fast-path.test.ts).
+    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-O73YPVVC.js").then(
+      (webShellStatic) => webShellStatic.isPreAuthWebShellRequest(req)
+    ) : void 0
   });
   let listenHostname = opts.hostname;
   if (opts.hostname.startsWith("[")) {
@@ -6361,7 +6610,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-B3EPDJDR.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-P5L5VFAY.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -6467,7 +6716,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   if (opts.channelSelection) {
     reserveChannelServicePidfile(opts.channelSelection);
   }
-  return await new Promise((resolve2, reject) => {
+  return await new Promise((resolve3, reject) => {
     const onListening = /* @__PURE__ */ __name((error) => {
       if (error) return;
       startup.listenerReadyAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -6485,6 +6734,168 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       actualPort = typeof addr === "object" && addr ? addr.port : opts.port;
       const scheme = tlsOptions ? "https" : "http";
       const url = `${scheme}://${formatHostForUrl(opts.hostname)}:${actualPort}`;
+      const liveRuntimeBaseDir = path.dirname(daemonLogBaseDir);
+      const liveDiscoveryOwners = [];
+      let liveDiscoveryPublish;
+      let liveDiscoveryRetryTimer;
+      let liveDiscoveryRetryTask;
+      let liveDiscoveryEnabled = false;
+      let liveDiscoveryShuttingDown = false;
+      let liveDiscoveryToggle = Promise.resolve();
+      let attemptPendingLiveDiscovery;
+      const pendingLiveDiscoveryBaseDirs = /* @__PURE__ */ new Set();
+      const warnedLiveDiscoveryOwners = /* @__PURE__ */ new Set();
+      const liveDiscoveryRetryDelayMs = deps.liveDiscoveryRetryDelayMs !== void 0 && Number.isFinite(deps.liveDiscoveryRetryDelayMs) && deps.liveDiscoveryRetryDelayMs >= 10 ? Math.min(deps.liveDiscoveryRetryDelayMs, 6e4) : DEFAULT_LIVE_DISCOVERY_RETRY_MS;
+      const scheduleLiveDiscoveryRetry = /* @__PURE__ */ __name(() => {
+        if (liveDiscoveryShuttingDown || !liveDiscoveryEnabled || liveDiscoveryRetryTimer || liveDiscoveryRetryTask || pendingLiveDiscoveryBaseDirs.size === 0 || !attemptPendingLiveDiscovery) {
+          return;
+        }
+        liveDiscoveryRetryTimer = setTimeout(() => {
+          liveDiscoveryRetryTimer = void 0;
+          if (liveDiscoveryShuttingDown || !liveDiscoveryEnabled || !attemptPendingLiveDiscovery) {
+            return;
+          }
+          const retry = attemptPendingLiveDiscovery().finally(() => {
+            if (liveDiscoveryRetryTask === retry) {
+              liveDiscoveryRetryTask = void 0;
+            }
+            scheduleLiveDiscoveryRetry();
+          });
+          liveDiscoveryRetryTask = retry;
+        }, liveDiscoveryRetryDelayMs);
+        liveDiscoveryRetryTimer.unref();
+      }, "scheduleLiveDiscoveryRetry");
+      const cancelLiveDiscoveryRetry = /* @__PURE__ */ __name(() => {
+        if (!liveDiscoveryRetryTimer) return;
+        clearTimeout(liveDiscoveryRetryTimer);
+        liveDiscoveryRetryTimer = void 0;
+      }, "cancelLiveDiscoveryRetry");
+      const publishLiveDiscovery = /* @__PURE__ */ __name((candidateApp) => {
+        if (liveDiscoveryShuttingDown) return Promise.resolve();
+        if (!resolveAcpHttpEnabled()) return Promise.resolve();
+        if (candidateApp.locals?.["liveVoiceEnabled"] !== true)
+          return Promise.resolve();
+        liveDiscoveryEnabled = true;
+        if (liveDiscoveryPublish) return liveDiscoveryPublish;
+        const coordinator = candidateApp.locals?.["liveCoordinator"];
+        const instanceNonce = coordinator?.daemonInstanceNonce;
+        if (typeof instanceNonce !== "string") return Promise.resolve();
+        liveDiscoveryPublish = loadLiveDiscoveryRuntime().then(
+          async ({
+            getStableLiveDiscoveryBaseDir,
+            LiveDiscoveryOwnerActiveError,
+            writeLiveDiscoveryFile
+          }) => {
+            if (liveDiscoveryShuttingDown || !liveDiscoveryEnabled) return;
+            const stableBaseDir = path.resolve(
+              deps.liveDiscoveryStableBaseDir ?? getStableLiveDiscoveryBaseDir()
+            );
+            const runtimeBaseDir = path.resolve(liveRuntimeBaseDir);
+            const targetBaseDirs = /* @__PURE__ */ new Set();
+            if (runtimeBaseDir !== stableBaseDir) {
+              targetBaseDirs.add(runtimeBaseDir);
+            }
+            targetBaseDirs.add(stableBaseDir);
+            for (const baseDir of targetBaseDirs) {
+              pendingLiveDiscoveryBaseDirs.add(baseDir);
+            }
+            const record = {
+              url,
+              ...token ? { token } : {},
+              protocolVersion: LIVE_HOST_PROTOCOL_VERSION,
+              pid: process.pid,
+              instanceNonce
+            };
+            attemptPendingLiveDiscovery = /* @__PURE__ */ __name(async () => {
+              for (const runtimeBaseDir2 of [
+                ...pendingLiveDiscoveryBaseDirs
+              ]) {
+                if (liveDiscoveryShuttingDown || !liveDiscoveryEnabled)
+                  return;
+                try {
+                  await writeLiveDiscoveryFile(runtimeBaseDir2, record);
+                  pendingLiveDiscoveryBaseDirs.delete(runtimeBaseDir2);
+                  warnedLiveDiscoveryOwners.delete(runtimeBaseDir2);
+                  liveDiscoveryOwners.push({
+                    runtimeBaseDir: runtimeBaseDir2,
+                    instanceNonce,
+                    pid: process.pid
+                  });
+                } catch (err) {
+                  if (err instanceof LiveDiscoveryOwnerActiveError) {
+                    if (!warnedLiveDiscoveryOwners.has(runtimeBaseDir2)) {
+                      warnedLiveDiscoveryOwners.add(runtimeBaseDir2);
+                      daemonLog.warn(
+                        `failed to publish Live Host discovery at ${runtimeBaseDir2}: ${err.message}`
+                      );
+                    }
+                    continue;
+                  }
+                  pendingLiveDiscoveryBaseDirs.delete(runtimeBaseDir2);
+                  daemonLog.warn(
+                    `failed to publish Live Host discovery at ${runtimeBaseDir2}: ${err instanceof Error ? err.message : String(err)}`
+                  );
+                }
+              }
+            }, "attemptPendingLiveDiscovery");
+            await attemptPendingLiveDiscovery();
+            scheduleLiveDiscoveryRetry();
+          }
+        ).catch((err) => {
+          daemonLog.warn(
+            `failed to publish Live Host discovery: ${err instanceof Error ? err.message : String(err)}`
+          );
+        });
+        return liveDiscoveryPublish;
+      }, "publishLiveDiscovery");
+      const removeLiveDiscoveryOwners = /* @__PURE__ */ __name(async () => {
+        const owners = liveDiscoveryOwners.splice(0);
+        if (owners.length === 0) return;
+        let removeLiveDiscoveryFile;
+        try {
+          ({ removeLiveDiscoveryFile } = await loadLiveDiscoveryRuntime());
+        } catch (err) {
+          daemonLog.warn(
+            `failed to load Live discovery runtime for cleanup: ${err instanceof Error ? err.message : String(err)}`
+          );
+          return;
+        }
+        for (const owner of owners) {
+          try {
+            await removeLiveDiscoveryFile(owner.runtimeBaseDir, owner);
+          } catch (err) {
+            daemonLog.warn(
+              `failed to remove Live Host discovery at ${owner.runtimeBaseDir}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      }, "removeLiveDiscoveryOwners");
+      const unpublishLiveDiscovery = /* @__PURE__ */ __name(async () => {
+        liveDiscoveryEnabled = false;
+        cancelLiveDiscoveryRetry();
+        pendingLiveDiscoveryBaseDirs.clear();
+        attemptPendingLiveDiscovery = void 0;
+        await liveDiscoveryPublish;
+        await liveDiscoveryRetryTask;
+        liveDiscoveryPublish = void 0;
+        liveDiscoveryRetryTask = void 0;
+        await removeLiveDiscoveryOwners();
+      }, "unpublishLiveDiscovery");
+      const attachLiveDiscoveryControl = /* @__PURE__ */ __name((candidateApp) => {
+        candidateApp.locals.setLiveDiscoveryEnabled = (enabled) => {
+          const operation = liveDiscoveryToggle.then(
+            () => enabled ? publishLiveDiscovery(candidateApp) : unpublishLiveDiscovery()
+          );
+          liveDiscoveryToggle = operation.catch(() => void 0);
+          return operation;
+        };
+      }, "attachLiveDiscoveryControl");
+      const cleanupLiveDiscovery = /* @__PURE__ */ __name(async () => {
+        liveDiscoveryShuttingDown = true;
+        cancelLiveDiscoveryRetry();
+        await liveDiscoveryToggle;
+        await unpublishLiveDiscovery();
+      }, "cleanupLiveDiscovery");
       try {
         channelWorkspaceGroups = resolveChannelWorkspaceGroupsAtListen();
       } catch (err) {
@@ -6622,7 +7033,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         daemonLog.error("runtime startup failed", error2);
         markRuntimeFailed(error2);
         if (closeServerAfterChannelWorkerStartupFailure && server.listening) {
-          runtimeFailureListenerClose = new Promise((resolve3) => {
+          runtimeFailureListenerClose = new Promise((resolve4) => {
             server.close((closeErr) => {
               if (closeErr) {
                 daemonLog.error(
@@ -6630,7 +7041,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   closeErr
                 );
               }
-              resolve3();
+              resolve4();
             });
           });
           server.closeAllConnections();
@@ -6661,7 +7072,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             "Workspace registry is not available for channel workers."
           );
         }
-        const runtimes = registry.list();
+        const runtimes = registry.list().filter((runtime) => runtime.provenance !== "live-conversation");
         if (runtimes.length <= 1 && operation === "initial") {
           const primary = registry.primary;
           if (!primary.trusted) {
@@ -6696,7 +7107,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             return {
               workspaceCwd: runtime.workspaceCwd,
               primary: runtime.primary,
-              trusted: runtime.trusted
+              trusted: runtime.trusted,
+              provenance: runtime.provenance
             };
           }),
           selection: channelSelection,
@@ -6808,6 +7220,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const completeRuntimeStartup = /* @__PURE__ */ __name(async (candidateApp) => {
         if (runtimeStartupSettled) return;
         runtimeApp = candidateApp;
+        attachLiveDiscoveryControl(candidateApp);
         const acpHandle = candidateApp.locals?.["acpHandle"];
         acpHandle?.attachServer?.(server);
         if (opts.channelSelection) {
@@ -6817,6 +7230,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           if (runtimeStartupSettled) return;
         }
         if (runtimeStartupSettled) return;
+        await publishLiveDiscovery(candidateApp);
         runtimeStartupSettled = true;
         clearRuntimeStartupTimer();
         markRuntimeReady();
@@ -6960,11 +7374,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           if (closePromise) return closePromise;
           closePromise = new Promise((res, rej) => {
             shuttingDown = true;
+            liveDiscoveryShuttingDown = true;
+            cancelLiveDiscoveryRetry();
             channelControlDraining = true;
             const initiallyMountedApp = runtimeApp ?? runtimeAppForCleanup;
             const initiallyMountedManagement = initiallyMountedApp?.locals?.["workspaceManagementHandle"];
             const initiallyMountedSessionMaintenance = initiallyMountedApp?.locals?.["sessionArchiveCoordinator"];
             const initialManagementWait = initiallyMountedManagement?.sealAndWait?.();
+            const initiallyMountedLive = initiallyMountedApp?.locals;
+            const initialLiveWait = initiallyMountedLive?.sealAndWaitLiveCoordinator?.();
             const initialSessionMaintenanceWait = initiallyMountedSessionMaintenance?.sealMaintenanceAndWait?.();
             let processRegistryShutdown;
             const startProcessRegistryShutdown = /* @__PURE__ */ __name(() => {
@@ -7014,6 +7432,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   rej(retryableError);
                   return;
                 }
+                await cleanupLiveDiscovery();
                 if (loggerPublished || loggerSignalOwned) {
                   writeDaemonLifecycleBestEffort(() => {
                     if (finalErr) {
@@ -7045,6 +7464,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               if (workspaceManagementHandle !== initiallyMountedManagement) {
                 await workspaceManagementHandle?.sealAndWait?.();
               }
+              const liveLifecycleHandle = appForCleanup?.locals;
+              await initialLiveWait;
+              if (liveLifecycleHandle !== initiallyMountedLive) {
+                await liveLifecycleHandle?.sealAndWaitLiveCoordinator?.();
+              }
               await initialSessionMaintenanceWait;
               if (sessionMaintenance !== initiallyMountedSessionMaintenance) {
                 await sessionMaintenance?.sealMaintenanceAndWait?.();
@@ -7158,6 +7582,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       });
       const preparedRuntimeApp = runtimeApp ?? runtimeAppForCleanup;
       if (preparedRuntimeApp && bridgeRef && deps.bridge) {
+        attachLiveDiscoveryControl(preparedRuntimeApp);
         if (shouldPreheat) {
           startBridgePreheat(bridgeRef);
         }
@@ -7169,6 +7594,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         } else {
           const acpHandle = preparedRuntimeApp.locals?.["acpHandle"];
           acpHandle?.attachServer?.(server);
+          void publishLiveDiscovery(preparedRuntimeApp);
         }
       } else if (deferRuntimeUntilFirstHealth) {
         scheduleRuntimeStartFallback();
@@ -7178,13 +7604,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       if (deps.resolveOnListen) {
         loggerPublished = true;
         loggerLifecycle.published();
-        resolve2(handle);
+        void (liveDiscoveryPublish ?? Promise.resolve()).then(
+          () => resolve3(handle)
+        );
       } else {
         void runtimeReady.then(
-          () => {
+          async () => {
+            await liveDiscoveryPublish;
             loggerPublished = true;
             loggerLifecycle.published();
-            resolve2(handle);
+            resolve3(handle);
           },
           (err) => {
             void handle.close().then(