@qwen-code/qwen-code 0.21.6 → 0.21.7-nightly.20260808.4ec0371e6

package/chunks/{server-46ZO2CLV.js → server-FS7KDELS.js}

@@ -21,13 +21,13 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-U4AF3QLU.js";
+} from "./chunk-L4OW63GW.js";
 import {
   deriveWebSocketBase,
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-WO2B5E5B.js";
+} from "./chunk-Q3JQ7OSU.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -39,15 +39,15 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-W5DXUTXD.js";
+} from "./chunk-LDY4J4G6.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-DYA25Y7U.js";
+} from "./chunk-OWMAZHIX.js";
+import "./chunk-O7VQ3F22.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-4NFY2S7N.js";
-import "./chunk-RFUHDCNF.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-EKTCKZV5.js";
@@ -98,7 +98,6 @@ import {
   parseOptionalWorkspaceCwd,
   parsePermissionVoteBody,
   requireSessionId,
-  require_express,
   resolveAcpHttpEnabled,
   resolveCdpMcpCommand,
   safeBody,
@@ -109,34 +108,46 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-YZQTA3ID.js";
+} from "./chunk-CE5UCTKO.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
 import "./chunk-HGCQ5SE7.js";
 import {
-  assertValidChannelSecretUpdates
-} from "./chunk-CJ5WLD5Y.js";
+  createTotalSessionAdmissionController
+} from "./chunk-AKA24BGO.js";
 import {
   WorkspaceGenerationClosedError,
   createSingleWorkspaceRegistry,
   createWorkspaceSessionOwnerIndex
 } from "./chunk-2M5N3DHY.js";
+import "./chunk-GRC5HGPI.js";
+import {
+  assertValidChannelSecretUpdates
+} from "./chunk-3HS6Y4UA.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-TGGEZINK.js";
+} from "./chunk-KKRGVSHC.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-5MJGUQU5.js";
+} from "./chunk-XIDHBXUI.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-WNU7TZTO.js";
+} from "./chunk-VT3VNFVW.js";
 import "./chunk-BGXZBI5B.js";
+import {
+  isServeDebugMode,
+  mountWebShellAssets,
+  mountWebShellSpaFallback
+} from "./chunk-SOORFWKY.js";
+import {
+  require_express
+} from "./chunk-GDXET5XU.js";
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-VNQCPBC2.js";
+} from "./chunk-B23P3YWE.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -150,14 +161,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-DVBEGGLG.js";
+} from "./chunk-VLFX3L3X.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-CA4UIDFU.js";
+} from "./chunk-DPH3MUAP.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -165,13 +176,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-O7V7N4G7.js";
+} from "./chunk-ACHMWGC5.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-C4CBJQKY.js";
-import "./chunk-JELIWHXD.js";
+} from "./chunk-LDUGDB5H.js";
+import "./chunk-AOHJKPKL.js";
 import "./chunk-Z4X5MTRT.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
@@ -179,15 +190,11 @@ import {
   WorkspaceSkillNotFoundError,
   WorkspaceSkillNotToggleableError
 } from "./chunk-OA4JVLSA.js";
-import {
-  createTotalSessionAdmissionController
-} from "./chunk-AKA24BGO.js";
-import "./chunk-GRC5HGPI.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-OWSW7EYP.js";
-import "./chunk-G5NNWEYE.js";
+} from "./chunk-JACAHYEN.js";
+import "./chunk-HY2INPTA.js";
 import "./chunk-57OAHC2Y.js";
 import {
   LIVE_HOST_BUNDLE_ID,
@@ -196,42 +203,42 @@ import {
 } from "./chunk-NKLP3DCK.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-SQOMTWQT.js";
+} from "./chunk-JSJTZ6GO.js";
 import "./chunk-VXZBKKQR.js";
-import "./chunk-K2B3X3E7.js";
+import "./chunk-26ISE5EG.js";
 import "./chunk-3SH53ANB.js";
 import {
   snapshotProcessEnv
-} from "./chunk-ULPQQSDN.js";
+} from "./chunk-TX3KSSDN.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-OP2OHZ7K.js";
+} from "./chunk-764F335K.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
   SubscriberLimitExceededError
-} from "./chunk-GLWP3FDB.js";
+} from "./chunk-MZSJ43WV.js";
 import "./chunk-XCGIMOLN.js";
 import "./chunk-OCPBI7J5.js";
-import "./chunk-SQC6K5HI.js";
+import "./chunk-RPWVIXDB.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-UGTWD35F.js";
+} from "./chunk-NLREQJFK.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-LAAFLUQV.js";
-import "./chunk-VWOVHOTT.js";
+} from "./chunk-P74TZRXD.js";
+import "./chunk-KJZ26VBX.js";
 import {
   supportedChannelCatalog
-} from "./chunk-EMYZIABH.js";
+} from "./chunk-VDS2WYM5.js";
 import "./chunk-V6WHFGST.js";
 import {
   MAX_REGISTERED_WORKSPACES,
@@ -240,7 +247,7 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-4JH77A2U.js";
+} from "./chunk-EZ53KMUN.js";
 import "./chunk-R574ATRM.js";
 import {
   BranchWhilePromptActiveError,
@@ -293,7 +300,7 @@ import {
 } from "./chunk-YP5KH5Y7.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-24ER7UV4.js";
+} from "./chunk-UFALT4LK.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -305,7 +312,7 @@ import {
 import "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-DIEFUBV6.js";
+} from "./chunk-DIWZNWZT.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -316,7 +323,7 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-PPUOYL77.js";
+} from "./chunk-77WOUGCA.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
@@ -325,14 +332,14 @@ import {
   detectSystemLanguage,
   resolveLanguageSetting,
   resolveSupportedLanguage
-} from "./chunk-KHUA3NQV.js";
-import "./chunk-RK2EE3T7.js";
-import "./chunk-6PEXNQTX.js";
-import "./chunk-YMBOEAF4.js";
+} from "./chunk-TAOSTUHI.js";
+import "./chunk-KPMB4JEZ.js";
+import "./chunk-ALFTV7GA.js";
+import "./chunk-Z6W3XDLN.js";
 import "./chunk-VJNBRRZG.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-ACZRB7AD.js";
+} from "./chunk-3ARO4N5G.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -353,6 +360,7 @@ import {
   MAX_LOG_LIMIT,
   ModelsConfig,
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
+  SESSION_TRANSCRIPT_MAX_EXPANDED_PAGE_BYTES,
   SESSION_TRANSCRIPT_MAX_INDEX_BYTES,
   SESSION_TRANSCRIPT_MAX_LIMIT,
   SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
@@ -411,7 +419,7 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-A4VTILZT.js";
+} from "./chunk-BFSQBXHV.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
@@ -419,12 +427,12 @@ import "./chunk-H6XPXXMH.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-Z7JILXGX.js";
-import "./chunk-T5U6IM4C.js";
-import "./chunk-TSERKWCX.js";
-import "./chunk-33FNCQSY.js";
+} from "./chunk-2UUMVNYT.js";
+import "./chunk-MVUQRLOH.js";
+import "./chunk-XCWO3SMQ.js";
+import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-DIT4V3XH.js";
+import "./chunk-RGTB44BO.js";
 import {
   nextFireTime,
   parseCron
@@ -437,32 +445,47 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-MOHAWIAW.js";
-import "./chunk-3PRJYMXC.js";
+} from "./chunk-GNPNYXJB.js";
+import "./chunk-HUWENAHO.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-4S4OEQ6U.js";
+import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-A5YZ3FA2.js";
-import "./chunk-YAVY33G4.js";
-import "./chunk-2UISUFHQ.js";
-import "./chunk-MBEMTXQT.js";
+import "./chunk-GM463R2B.js";
+import "./chunk-SEZ556DZ.js";
+import "./chunk-CJXIIILK.js";
+import "./chunk-3K7FH2KQ.js";
 import {
   APPROVAL_MODES
-} from "./chunk-6WBWIPBF.js";
+} from "./chunk-WAUGQKUU.js";
+import "./chunk-REHWPCG2.js";
+import {
+  addDaemonRequestAttribute,
+  captureDaemonTelemetryContext,
+  emitDaemonLog,
+  hashDaemonWorkspace,
+  recordDaemonBridgeError,
+  recordDaemonError,
+  recordDaemonHttpRequest,
+  recordDaemonHttpResponse,
+  runWithDaemonTelemetryContext,
+  withDaemonRequestSpan
+} from "./chunk-L4N6TIP7.js";
+import "./chunk-SAH4BD2J.js";
+import "./chunk-CPG6P4GG.js";
 import "./chunk-S6LOFUVP.js";
+import "./chunk-2J3OJGTL.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-WVAESIM6.js";
+} from "./chunk-IA7TGCN2.js";
 import "./chunk-K623ENWT.js";
 import {
   escapeXml
 } from "./chunk-AQ37AY7B.js";
-import "./chunk-432XCUHF.js";
-import "./chunk-HU5TUALO.js";
+import "./chunk-EQL65XGA.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -471,30 +494,18 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-XC656O42.js";
+} from "./chunk-22NBYCPD.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-QYPT3QUD.js";
-import "./chunk-QMBEW7EW.js";
+import "./chunk-3ULCB3NE.js";
+import "./chunk-BGG4MBYD.js";
+import "./chunk-P3QQPMQA.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
-import "./chunk-GLNBDYUX.js";
-import "./chunk-DJ2GSRLV.js";
-import "./chunk-QZKYZCN3.js";
-import {
-  addDaemonRequestAttribute,
-  emitDaemonLog,
-  hashDaemonWorkspace,
-  recordDaemonBridgeError,
-  recordDaemonError,
-  recordDaemonHttpRequest,
-  recordDaemonHttpResponse,
-  withDaemonRequestSpan
-} from "./chunk-MGSSJT27.js";
-import "./chunk-2J3OJGTL.js";
-import "./chunk-P3QQPMQA.js";
-import "./chunk-6O5DVH27.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-2DNKEBXY.js";
+import "./chunk-DJ2GSRLV.js";
+import "./chunk-EI3HZX6C.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-XWRJCPHC.js";
 import {
@@ -507,19 +518,19 @@ import {
   isWithinRoot,
   parseLineTolerant,
   read
-} from "./chunk-PX5DNLSA.js";
+} from "./chunk-XCG76UE6.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-E4WHKETF.js";
-import "./chunk-ZPPP6VCL.js";
-import "./chunk-D7D7RXIJ.js";
-import "./chunk-BOGOR4HB.js";
+import "./chunk-FVKHVJZQ.js";
+import "./chunk-6ZRFAKXK.js";
+import "./chunk-PYQADEFD.js";
+import "./chunk-P7HUJDBZ.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-BFHXDAR7.js";
-import "./chunk-TYERNYH4.js";
-import "./chunk-UH7Z7Y45.js";
-import "./chunk-5L6CQ4ZU.js";
+import "./chunk-KKBPOU75.js";
+import "./chunk-EUNWC2VS.js";
+import "./chunk-FOGU3LJX.js";
+import "./chunk-6M26GBKX.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-LKRMNRSN.js";
 import {
@@ -527,7 +538,7 @@ import {
   Storage,
   createDebugLogger,
   runWithoutDebugLogSession
-} from "./chunk-3RXUYQJI.js";
+} from "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
 import {
   writeStderrLine,
@@ -554,7 +565,7 @@ import {
 
 // packages/cli/src/serve/server.ts
 init_esbuild_shims();
-var import_express5 = __toESM(require_express(), 1);
+var import_express4 = __toESM(require_express(), 1);
 
 // packages/cli/src/serve/acp-http/index.ts
 init_esbuild_shims();
@@ -1171,11 +1182,11 @@ function decodeTextCursor(cursor) {
   return { off, size, dev, ino };
 }
 __name(decodeTextCursor, "decodeTextCursor");
-function assertCursorMatchesFile(cursor, stats, path15) {
+function assertCursorMatchesFile(cursor, stats, path14) {
   if (String(stats.dev) !== cursor.dev || String(stats.ino) !== cursor.ino || stats.size < cursor.size) {
     throw new FsError(
       "hash_mismatch",
-      `cursor no longer matches the file it was issued for: ${path15}`,
+      `cursor no longer matches the file it was issued for: ${path14}`,
       { hint: "re-read the file from the beginning to get a fresh cursor" }
     );
   }
@@ -5155,17 +5166,6 @@ __name(mountWorkspaceQualifiedMemoryRememberRoutes, "mountWorkspaceQualifiedMemo
 init_esbuild_shims();
 import { promises as fs2 } from "node:fs";
 import * as path8 from "node:path";
-
-// packages/cli/src/serve/debug-mode.ts
-init_esbuild_shims();
-function isServeDebugMode() {
-  const value = process.env["QWEN_SERVE_DEBUG"];
-  if (!value) return false;
-  return !["0", "false", "off", "no"].includes(value.trim().toLowerCase());
-}
-__name(isServeDebugMode, "isServeDebugMode");
-
-// packages/cli/src/serve/workspace-memory.ts
 function requireTrustedWorkspace2(deps, res) {
   if (deps.isWorkspaceTrusted?.() !== false) return true;
   res.status(403).json({
@@ -13937,7 +13937,7 @@ function mountAcpHttp(app, bridge, opts) {
   if (!enabled) return void 0;
   const daemonEnv = opts.daemonEnv ?? process.env;
   const getPrimaryEnv = /* @__PURE__ */ __name(() => opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv, "getPrimaryEnv");
-  const path15 = opts.path ?? "/acp";
+  const path14 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
   const rejectIfDisposed = /* @__PURE__ */ __name((res) => {
@@ -14109,7 +14109,7 @@ function mountAcpHttp(app, bridge, opts) {
   const primaryMount = {
     primary: true,
     workspaceCwd: opts.boundWorkspace,
-    routeLabel: logSafe(path15),
+    routeLabel: logSafe(path14),
     rateLimitScope: opts.workspaceRegistry?.primary.workspaceId ?? "primary",
     registry,
     dispatcher,
@@ -14263,7 +14263,7 @@ function mountAcpHttp(app, bridge, opts) {
     });
   }, "handleAcpPost");
   app.post(
-    path15,
+    path14,
     (req, res) => handleAcpPost(primaryMount, req, res)
   );
   const handleAcpGet = /* @__PURE__ */ __name((mount, req, res) => {
@@ -14361,10 +14361,10 @@ function mountAcpHttp(app, bridge, opts) {
       onPumpSettled();
     });
   }, "handleAcpGet");
-  app.get(path15, (req, res) => {
+  app.get(path14, (req, res) => {
     handleAcpGet(primaryMount, req, res);
   });
-  app.delete(path15, (req, res) => {
+  app.delete(path14, (req, res) => {
     handleAcpDelete(primaryMount, req, res);
   });
   const createSecondaryAcpMount = /* @__PURE__ */ __name((rt) => {
@@ -14566,7 +14566,7 @@ function mountAcpHttp(app, bridge, opts) {
       const isPluralAcpShape = pluralRawSelector !== null;
       const pluralVoiceRawSelector = opts.workspaceVoiceConnection ? pluralWorkspaceRawSelector(rawPath, PLURAL_VOICE_WS_SUFFIX) : null;
       const isPluralVoiceShape = pluralVoiceRawSelector !== null;
-      if (rawPath !== path15 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
+      if (rawPath !== path14 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
         logReject(`unknown-path ${logSafe(rawPath)}`);
         socket.destroy();
         return;
@@ -15103,7 +15103,7 @@ function mountAcpHttp(app, bridge, opts) {
       });
     }, "upgradeListener");
     httpServer.on("upgrade", upgradeListener);
-    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path15}`);
+    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path14}`);
   }
   __name(setupWebSocket, "setupWebSocket");
   return {
@@ -15287,6 +15287,7 @@ function buildModelsConfig(settings, env) {
   return new ModelsConfig({
     initialAuthType: selectedAuthType,
     modelProvidersConfig: merged.modelProviders,
+    providerProtocolConfig: merged.providerProtocol,
     generationConfig: resolvedCliConfig.generationConfig,
     generationConfigSources: resolvedCliConfig.sources
   });
@@ -15772,105 +15773,6 @@ var CdpTunnelRegistry = class {
   }
 };
 
-// packages/cli/src/serve/web-shell-static.ts
-init_esbuild_shims();
-var import_express2 = __toESM(require_express(), 1);
-import * as path9 from "node:path";
-var WEB_SHELL_CSP_DIRECTIVES = [
-  "default-src 'self'",
-  "script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'",
-  "style-src 'self' 'unsafe-inline'",
-  "font-src 'self' data:",
-  "img-src 'self' data: blob:",
-  "connect-src 'self'",
-  "worker-src 'self' blob:",
-  // base-uri does NOT fall back to default-src; lock it so an injected <base>
-  // (the SPA renders AI-generated markdown) cannot repoint relative URLs to an
-  // attacker origin.
-  "base-uri 'none'"
-];
-function buildWebShellCsp(frameAncestors = []) {
-  const fa = frameAncestors.length ? `frame-ancestors ${frameAncestors.join(" ")}` : "frame-ancestors 'none'";
-  return [...WEB_SHELL_CSP_DIRECTIVES, fa].join("; ");
-}
-__name(buildWebShellCsp, "buildWebShellCsp");
-var WEB_SHELL_CSP = buildWebShellCsp();
-function isDocumentNavigation(req) {
-  const fetchMode = req.headers["sec-fetch-mode"];
-  const fetchDest = req.headers["sec-fetch-dest"];
-  const accept = req.headers.accept ?? "";
-  return fetchMode === "navigate" || fetchDest === "document" || accept.trim().toLowerCase().startsWith("text/html");
-}
-__name(isDocumentNavigation, "isDocumentNavigation");
-function createSendIndex(webShellDir, frameAncestors = []) {
-  const indexPath = path9.join(webShellDir, "index.html");
-  const csp = buildWebShellCsp(frameAncestors);
-  return (res) => {
-    res.status(200).set("Content-Security-Policy", csp).set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "no-referrer").set(
-      // `microphone=(self)` lets the same-origin Web Shell document request
-      // the mic for voice dictation (the prompt won't even appear under an
-      // empty `microphone=()` allowlist). Still blocks cross-origin iframes;
-      // camera/geolocation/payment stay disabled (unused).
-      "Permissions-Policy",
-      "camera=(), microphone=(self), geolocation=(), payment=()"
-    ).set("Cache-Control", "no-cache");
-    if (frameAncestors.length === 0) {
-      res.set("X-Frame-Options", "DENY");
-    }
-    res.sendFile(
-      indexPath,
-      { cacheControl: false, dotfiles: "allow" },
-      (err) => {
-        if (!err) return;
-        writeStderrLine(
-          `qwen serve: Web Shell index send failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-        if (!res.headersSent) {
-          res.status(500).type("text/plain").send("Failed to load Web Shell");
-        } else {
-          res.end();
-        }
-      }
-    );
-  };
-}
-__name(createSendIndex, "createSendIndex");
-function mountWebShellAssets(app, webShellDir, frameAncestors = []) {
-  const sendIndex = createSendIndex(webShellDir, frameAncestors);
-  app.use(
-    "/assets",
-    import_express2.default.static(path9.join(webShellDir, "assets"), {
-      index: false,
-      immutable: true,
-      maxAge: "1y"
-    })
-  );
-  app.use("/assets", (req, res) => {
-    if (isServeDebugMode()) {
-      writeStderrLine(
-        `qwen serve: Web Shell asset not found: ${req.originalUrl}`
-      );
-    }
-    res.status(404).type("text/plain").send("Not found");
-  });
-  app.get("/", (_req, res) => sendIndex(res));
-}
-__name(mountWebShellAssets, "mountWebShellAssets");
-function mountWebShellSpaFallback(app, webShellDir, frameAncestors = []) {
-  const sendIndex = createSendIndex(webShellDir, frameAncestors);
-  app.use((req, res, next) => {
-    if (req.method !== "GET" && req.method !== "HEAD") return next();
-    if (!isDocumentNavigation(req)) return next();
-    if (isServeDebugMode()) {
-      writeStderrLine(
-        `qwen serve: Web Shell SPA fallback served for ${req.method} ${req.originalUrl}`
-      );
-    }
-    sendIndex(res);
-  });
-}
-__name(mountWebShellSpaFallback, "mountWebShellSpaFallback");
-
 // packages/cli/src/serve/workspace-generation.ts
 init_esbuild_shims();
 
@@ -16030,7 +15932,8 @@ function registerDaemonStatusRoutes(app, deps) {
           getChannelWorkerSnapshots: deps.getChannelWorkerSnapshots,
           getPerfSnapshot: deps.getPerfSnapshot,
           getMetricsSeries: deps.getMetricsSeries,
-          getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot
+          getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot,
+          getChildHeapPolicySnapshot: deps.getChildHeapPolicySnapshot
         })
       );
     } catch (err) {
@@ -20437,8 +20340,8 @@ function decodePathSegment(value) {
 }
 __name(decodePathSegment, "decodePathSegment");
 function matchLegacySessionTelemetryRoute(method, requestPath) {
-  const path15 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
-  const requestSegments = path15.split("/").slice(1);
+  const path14 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
+  const requestSegments = path14.split("/").slice(1);
   const prefix = requestSegments[0]?.toLowerCase();
   if (prefix !== "session" && prefix !== "sessions" && prefix !== "permission") {
     return void 0;
@@ -20490,23 +20393,23 @@ __name(setDaemonTelemetryWorkspace, "setDaemonTelemetryWorkspace");
 function resolveDaemonTelemetryRoute(req) {
   const legacyRoute = matchLegacySessionTelemetryRoute(req.method, req.path);
   if (legacyRoute) return legacyRoute;
-  const path15 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "GET" && path15 === "/daemon/status") {
+  const path14 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "GET" && path14 === "/daemon/status") {
     return { route: "GET /daemon/status" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path14)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path14)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path15)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path14)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path15)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path14)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  const workspaceTranscript = path15.match(
+  const workspaceTranscript = path14.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
   );
   if (workspaceTranscript?.[1] && req.method === "GET") {
@@ -20515,7 +20418,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceTranscript[1])
     };
   }
-  const workspaceExport = path15.match(
+  const workspaceExport = path14.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
   );
   if (workspaceExport?.[1] && req.method === "GET") {
@@ -20524,7 +20427,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceExport[1])
     };
   }
-  const workspaceArchivedExport = path15.match(
+  const workspaceArchivedExport = path14.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
   );
   if (workspaceArchivedExport?.[1] && req.method === "GET") {
@@ -20534,8 +20437,8 @@ function resolveDaemonTelemetryRoute(req) {
     };
   }
   const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
-  if (pluralWorkspacePrefix.test(path15)) {
-    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
+  if (pluralWorkspacePrefix.test(path14)) {
+    const suffix = path14.replace(pluralWorkspacePrefix, "/workspace");
     if (req.method === "GET") {
       if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
         return { route: `GET ${suffix}` };
@@ -20594,58 +20497,58 @@ function resolveDaemonTelemetryRoute(req) {
       return { route: "DELETE /workspace/session-groups/:groupId" };
     }
   }
-  if (req.method === "POST" && path15 === "/workspace/init") {
+  if (req.method === "POST" && path14 === "/workspace/init") {
     return { route: "POST /workspace/init" };
   }
-  if (req.method === "POST" && path15 === "/workspace/setup-github") {
+  if (req.method === "POST" && path14 === "/workspace/setup-github") {
     return { route: "POST /workspace/setup-github" };
   }
-  if (req.method === "POST" && path15 === "/workspace/reload") {
+  if (req.method === "POST" && path14 === "/workspace/reload") {
     return { route: "POST /workspace/reload" };
   }
-  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  const mcpRestart = path14.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
   if (mcpRestart?.[1] && req.method === "POST") {
     return { route: "POST /workspace/mcp/:server/restart" };
   }
-  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
+  if (req.method === "POST" && path14 === "/workspace/mcp/servers") {
     return { route: "POST /workspace/mcp/servers" };
   }
-  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  const mcpDelete = path14.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
   if (mcpDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/mcp/servers/:name" };
   }
-  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
+  if (req.method === "POST" && path14 === "/workspace/auth/device-flow") {
     return { route: "POST /workspace/auth/device-flow" };
   }
-  const deviceFlowDelete = path15.match(
+  const deviceFlowDelete = path14.match(
     /^\/workspace\/auth\/device-flow\/([^/]+)$/
   );
   if (deviceFlowDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/auth/device-flow/:id" };
   }
-  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  const toolEnable = path14.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
   if (toolEnable?.[1] && req.method === "POST") {
     return { route: "POST /workspace/tools/:name/enable" };
   }
-  if (path15 === "/workspace/settings") {
+  if (path14 === "/workspace/settings") {
     if (req.method === "GET") return { route: "GET /workspace/settings" };
     if (req.method === "POST") return { route: "POST /workspace/settings" };
   }
-  if (path15 === "/workspace/permissions") {
+  if (path14 === "/workspace/permissions") {
     if (req.method === "GET") return { route: "GET /workspace/permissions" };
     if (req.method === "POST") return { route: "POST /workspace/permissions" };
   }
-  if (path15 === "/workspace/trust") {
+  if (path14 === "/workspace/trust") {
     if (req.method === "GET") return { route: "GET /workspace/trust" };
   }
-  if (req.method === "POST" && path15 === "/workspace/trust/request") {
+  if (req.method === "POST" && path14 === "/workspace/trust/request") {
     return { route: "POST /workspace/trust/request" };
   }
-  if (path15 === "/workspace/voice") {
+  if (path14 === "/workspace/voice") {
     if (req.method === "GET") return { route: "GET /workspace/voice" };
     if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
+  if (req.method === "POST" && path14 === "/workspace/voice/transcribe") {
     return { route: "POST /workspace/voice/transcribe" };
   }
   return void 0;
@@ -20914,7 +20817,7 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 init_esbuild_shims();
 import * as crypto3 from "node:crypto";
 import * as fs5 from "node:fs";
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
 init_esbuild_shims();
@@ -22339,7 +22242,7 @@ var GIT_RESERVED_BRANCH = "HEAD";
 var MAX_BRANCH_NAME_BYTES = 1e3;
 var MAX_BRANCH_COMPONENT_BYTES = 200;
 var HTTP_SESSION_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
+var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 2 * SESSION_TRANSCRIPT_MAX_EXPANDED_PAGE_BYTES;
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
 var CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS = 6e4;
@@ -22682,7 +22585,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceParam = req.params[paramName] ?? "";
     const byId = workspaceRegistry.getByWorkspaceId(workspaceParam);
     if (byId) return byId;
-    if (!path10.isAbsolute(workspaceParam)) {
+    if (!path9.isAbsolute(workspaceParam)) {
       res.status(400).json({
         error: `\`:${paramName}\` must decode to a workspace id or absolute path`
       });
@@ -23573,7 +23476,7 @@ function registerSessionRoutes(app, deps) {
       if (worktreeMeta) {
         try {
           const createAllowedRoots = [
-            path10.join(workspaceCwd, ".qwen", "worktrees")
+            path9.join(workspaceCwd, ".qwen", "worktrees")
           ];
           let createRepoTop = null;
           try {
@@ -23584,7 +23487,7 @@ function registerSessionRoutes(app, deps) {
           }
           if (createRepoTop && createRepoTop !== workspaceCwd) {
             createAllowedRoots.push(
-              path10.join(createRepoTop, ".qwen", "worktrees")
+              path9.join(createRepoTop, ".qwen", "worktrees")
             );
           }
           await runtime.bridge.changeSessionCwd(session.sessionId, {
@@ -23883,7 +23786,7 @@ function registerSessionRoutes(app, deps) {
         if (sidecar) {
           let realTarget;
           const candidateRoots = [
-            path10.join(workspaceCwd, ".qwen", "worktrees")
+            path9.join(workspaceCwd, ".qwen", "worktrees")
           ];
           try {
             realTarget = fs5.realpathSync(sidecar.worktreePath);
@@ -23895,13 +23798,13 @@ function registerSessionRoutes(app, deps) {
             } catch {
             }
             if (repoTop && repoTop !== workspaceCwd) {
-              candidateRoots.push(path10.join(repoTop, ".qwen", "worktrees"));
+              candidateRoots.push(path9.join(repoTop, ".qwen", "worktrees"));
             }
             const contained = candidateRoots.some((root) => {
               try {
                 const realRoot = fs5.realpathSync(root);
-                const rel = path10.relative(realRoot, realTarget);
-                return !rel.startsWith("..") && !path10.isAbsolute(rel);
+                const rel = path9.relative(realRoot, realTarget);
+                return !rel.startsWith("..") && !path9.isAbsolute(rel);
               } catch {
                 return false;
               }
@@ -24217,7 +24120,7 @@ function registerSessionRoutes(app, deps) {
       async (req, res, sessionId, runtime) => {
         const body = safeBody(req);
         const targetPath = body["path"];
-        if (typeof targetPath !== "string" || targetPath.length === 0 || !path10.isAbsolute(targetPath)) {
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path9.isAbsolute(targetPath)) {
           res.status(400).json({
             error: "`path` is required and must be an absolute path",
             code: "invalid_path"
@@ -27251,7 +27154,7 @@ __name(registerUsageStatsRoutes, "registerUsageStatsRoutes");
 // packages/cli/src/serve/scheduled-task-keepalive.ts
 init_esbuild_shims();
 import * as fsSync from "node:fs";
-import * as path11 from "node:path";
+import * as path10 from "node:path";
 var log = createDebugLogger("SCHED_KEEPALIVE");
 function collectBoundSessionIds(tasks) {
   const seen = /* @__PURE__ */ new Set();
@@ -27477,8 +27380,8 @@ function startScheduledTaskKeepalive(opts) {
     opts.runtimeBaseDir,
     () => getCronFilePath(boundWorkspace)
   );
-  const cronDir = path11.dirname(cronFilePath);
-  const cronFileName = path11.basename(cronFilePath);
+  const cronDir = path10.dirname(cronFilePath);
+  const cronFileName = path10.basename(cronFilePath);
   let fileWatcher;
   try {
     fsSync.mkdirSync(cronDir, { recursive: true });
@@ -28942,6 +28845,8 @@ __name(registerWorkspaceQualifiedSettingsRoutes, "registerWorkspaceQualifiedSett
 
 // packages/cli/src/serve/routes/sse-events.ts
 init_esbuild_shims();
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { performance as performance2 } from "node:perf_hooks";
 
 // packages/cli/src/serve/server/error-response.ts
 init_esbuild_shims();
@@ -29526,6 +29431,39 @@ __name(errorPayload, "errorPayload");
 
 // packages/cli/src/serve/routes/sse-events.ts
 var activeSseCount = 0;
+var SSE_STREAM_ID_HEADER = "X-Qwen-SSE-Stream-Id";
+var SSE_STREAM_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var SSE_CONNECT_REASONS = [
+  "initial",
+  "resume",
+  "prompt_restart",
+  "stream_end",
+  "transport_error",
+  "state_resync",
+  "unknown"
+];
+var SSE_CONNECT_REASON_SET = new Set(
+  SSE_CONNECT_REASONS
+);
+function parseSseConnectReason(raw) {
+  return typeof raw === "string" && SSE_CONNECT_REASON_SET.has(raw) ? raw : "unknown";
+}
+__name(parseSseConnectReason, "parseSseConnectReason");
+function parsePreviousSseStreamId(raw) {
+  return typeof raw === "string" && SSE_STREAM_ID_RE.test(raw) ? raw.toLowerCase() : void 0;
+}
+__name(parsePreviousSseStreamId, "parsePreviousSseStreamId");
+function parseSseClientId(raw) {
+  return typeof raw === "string" && raw.length > 0 && raw.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(raw) ? raw : void 0;
+}
+__name(parseSseClientId, "parseSseClientId");
+function boundedDiagnosticString(value) {
+  return Array.from(value.slice(0, 256)).slice(0, 128).map((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 8232 || codePoint === 8233 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297 ? " " : character;
+  }).join("");
+}
+__name(boundedDiagnosticString, "boundedDiagnosticString");
 function getActiveSseCount() {
   return activeSseCount;
 }
@@ -29551,6 +29489,134 @@ function registerSseEventsRoutes(app, deps) {
   const { workspaceRegistry, daemonLog, sendBridgeError: sendBridgeError2, writerIdleTimeoutMs } = deps;
   app.get("/session/:id/events", async (req, res) => {
     const sessionId = req.params["id"];
+    const diagnosticSessionId = boundedDiagnosticString(sessionId);
+    const streamId = randomUUID7();
+    const clientId = parseSseClientId(req.headers["x-qwen-client-id"]);
+    const connectReason = parseSseConnectReason(req.query["connectReason"]);
+    const previousStreamId = parsePreviousSseStreamId(
+      req.query["previousStreamId"]
+    );
+    const telemetryContext = captureDaemonTelemetryContext();
+    const telemetryBaseAttributes = {
+      "session.id": sessionId,
+      "qwen-code.daemon.sse.stream_id": streamId,
+      "qwen-code.daemon.sse.client_reported_connect_reason": connectReason,
+      ...clientId ? { "qwen-code.client_id": clientId } : {},
+      ...previousStreamId ? {
+        "qwen-code.daemon.sse.client_reported_previous_stream_id": previousStreamId
+      } : {}
+    };
+    const emitLifecycleLog = /* @__PURE__ */ __name((eventName, body, attributes = {}) => {
+      void runWithDaemonTelemetryContext(telemetryContext, async () => {
+        emitDaemonLog(
+          body,
+          { ...telemetryBaseAttributes, ...attributes },
+          { eventName }
+        );
+      }).catch(() => {
+      });
+    }, "emitLifecycleLog");
+    let slowWarningCount = 0;
+    let eventBusEvictionReason;
+    const onSubscriberDiagnostic = /* @__PURE__ */ __name((diagnostic) => {
+      const triggerEventType = boundedDiagnosticString(
+        diagnostic.data.triggerEventType
+      );
+      const common = {
+        queueSize: diagnostic.data.queueSize,
+        maxQueued: diagnostic.data.maxQueued,
+        queuedBytes: diagnostic.data.queuedBytes,
+        maxQueuedBytes: diagnostic.data.maxQueuedBytes,
+        triggerEventType,
+        triggerEventBytes: diagnostic.data.triggerEventBytes
+      };
+      const telemetryCommon = {
+        "qwen-code.daemon.sse.queue_size": common.queueSize,
+        "qwen-code.daemon.sse.max_queued": common.maxQueued,
+        "qwen-code.daemon.sse.queued_bytes": common.queuedBytes,
+        "qwen-code.daemon.sse.max_queued_bytes": common.maxQueuedBytes,
+        "qwen-code.daemon.sse.trigger_event_type": common.triggerEventType,
+        "qwen-code.daemon.sse.trigger_event_bytes": common.triggerEventBytes
+      };
+      let handled = false;
+      if (diagnostic.type === "slow_client_warning") {
+        slowWarningCount += 1;
+        const context = {
+          sessionId: diagnosticSessionId,
+          clientId,
+          streamId,
+          connectReason,
+          previousStreamId,
+          ...common,
+          threshold: diagnostic.data.threshold,
+          lastEventId: diagnostic.data.lastEventId
+        };
+        try {
+          if (daemonLog) {
+            daemonLog.warn("SSE slow client warning", context);
+          } else {
+            writeStderrLine(
+              `qwen serve: SSE slow client warning ${JSON.stringify(context)}`
+            );
+          }
+          handled = true;
+        } catch {
+          handled = false;
+        }
+        emitLifecycleLog(
+          "qwen-code.daemon.sse.slow_client_warning",
+          "Daemon SSE slow client warning.",
+          {
+            ...telemetryCommon,
+            "qwen-code.daemon.sse.threshold": diagnostic.data.threshold,
+            "qwen-code.daemon.sse.last_event_id": diagnostic.data.lastEventId
+          }
+        );
+      } else {
+        eventBusEvictionReason = boundedDiagnosticString(
+          diagnostic.data.reason
+        );
+        const threshold = diagnostic.data.reason === "queue_bytes_overflow" ? "bytes" : "frames";
+        const context = {
+          sessionId: diagnosticSessionId,
+          clientId,
+          streamId,
+          connectReason,
+          previousStreamId,
+          ...common,
+          threshold,
+          reason: eventBusEvictionReason,
+          droppedAfter: diagnostic.data.droppedAfter,
+          ...diagnostic.data.eventBytes !== void 0 ? { eventBytes: diagnostic.data.eventBytes } : {}
+        };
+        try {
+          if (daemonLog) {
+            daemonLog.warn("SSE client evicted", context);
+          } else {
+            writeStderrLine(
+              `qwen serve: SSE client evicted ${JSON.stringify(context)}`
+            );
+          }
+          handled = true;
+        } catch {
+          handled = false;
+        }
+        emitLifecycleLog(
+          "qwen-code.daemon.sse.client_evicted",
+          "Daemon SSE client evicted.",
+          {
+            ...telemetryCommon,
+            "qwen-code.daemon.sse.threshold": threshold,
+            "qwen-code.daemon.sse.event_bus_eviction_reason": eventBusEvictionReason,
+            "qwen-code.daemon.sse.dropped_after_event_id": diagnostic.data.droppedAfter,
+            ...diagnostic.data.eventBytes !== void 0 ? {
+              "qwen-code.daemon.sse.rejected_event_bytes": diagnostic.data.eventBytes
+            } : {}
+          }
+        );
+      }
+      return handled;
+    }, "onSubscriberDiagnostic");
     const lastEventId = parseLastEventId(req.headers["last-event-id"]);
     const eventEpoch = parseEventEpochHeader(req.headers["x-qwen-event-epoch"]);
     const maxQueued = parseMaxQueuedQuery(req.query["maxQueued"], res);
@@ -29572,13 +29638,15 @@ function registerSseEventsRoutes(app, deps) {
       const iterable = virtualKey ? await deps.virtualSubagentSessions?.subscribe(runtime, sessionId, {
         signal: abort.signal,
         lastEventId,
-        ...maxQueued !== void 0 ? { maxQueued } : {}
+        ...maxQueued !== void 0 ? { maxQueued } : {},
+        onSubscriberDiagnostic
       }) : runtime.bridge.subscribeEvents(sessionId, {
         signal: abort.signal,
         lastEventId,
         ...eventEpoch !== void 0 ? { epoch: eventEpoch } : {},
         ...maxQueued !== void 0 ? { maxQueued } : {},
-        ...snapshot ? { snapshot: true } : {}
+        ...snapshot ? { snapshot: true } : {},
+        onSubscriberDiagnostic
       });
       if (!iterable) {
         res.status(404).json({
@@ -29599,7 +29667,7 @@ function registerSseEventsRoutes(app, deps) {
     } catch (err) {
       if (err instanceof SubscriberLimitExceededError) {
         writeStderrLine(
-          `qwen serve: subscriber limit reached for session ${sessionId} (limit=${err.limit}); rejecting new SSE client with 429`
+          `qwen serve: subscriber limit reached for session ${diagnosticSessionId} (limit=${err.limit}); rejecting new SSE client with 429`
         );
         res.setHeader("Retry-After", "5");
         res.status(429).json({
@@ -29615,21 +29683,84 @@ function registerSseEventsRoutes(app, deps) {
       });
       return;
     }
-    if (daemonLog) {
-      const sseOpenedAt = Date.now();
-      const sseClientId = req.headers["x-qwen-client-id"];
-      daemonLog.info("SSE stream opened", { sessionId, clientId: sseClientId });
-      res.on("close", () => {
-        try {
-          daemonLog.info("SSE stream closed", {
-            sessionId,
-            clientId: sseClientId,
-            durationMs: Date.now() - sseOpenedAt
-          });
-        } catch {
-        }
+    const openedAt = performance2.now();
+    let closeReason;
+    let terminalCandidate;
+    let terminalEventType;
+    let eventFramesWriteSettled = 0;
+    let lastEventIdWritten;
+    let backpressureCount = 0;
+    let maxDrainWaitMs = 0;
+    let activeDrainStartedAt;
+    let maxLivePublishToWriteSettledMs = 0;
+    let liveTimingEnabled = lastEventId === void 0;
+    let finalized = false;
+    let sseCounted = false;
+    const finalize = /* @__PURE__ */ __name(() => {
+      if (finalized) return;
+      finalized = true;
+      if (activeDrainStartedAt !== void 0) {
+        maxDrainWaitMs = Math.max(
+          maxDrainWaitMs,
+          performance2.now() - activeDrainStartedAt
+        );
+      }
+      const durationMs = Math.max(0, performance2.now() - openedAt);
+      const resolvedCloseReason = closeReason ?? terminalCandidate ?? "client_disconnect";
+      const closeAttributes = {
+        "qwen-code.daemon.sse.duration_ms": durationMs,
+        "qwen-code.daemon.sse.event_frames_write_settled": eventFramesWriteSettled,
+        "qwen-code.daemon.sse.backpressure_count": backpressureCount,
+        "qwen-code.daemon.sse.max_drain_wait_ms": maxDrainWaitMs,
+        "qwen-code.daemon.sse.max_live_publish_to_write_settled_ms": maxLivePublishToWriteSettledMs,
+        "qwen-code.daemon.sse.slow_warning_count": slowWarningCount,
+        "qwen-code.daemon.sse.close_reason": resolvedCloseReason,
+        ...lastEventIdWritten !== void 0 ? {
+          "qwen-code.daemon.sse.last_event_id_written": lastEventIdWritten
+        } : {},
+        ...eventBusEvictionReason ? {
+          "qwen-code.daemon.sse.event_bus_eviction_reason": eventBusEvictionReason
+        } : {},
+        ...terminalEventType ? {
+          "qwen-code.daemon.sse.terminal_event_type": terminalEventType
+        } : {}
+      };
+      void runWithDaemonTelemetryContext(telemetryContext, async () => {
+        for (const [key, value] of Object.entries(closeAttributes)) {
+          addDaemonRequestAttribute(key, value);
+        }
+        emitDaemonLog(
+          "Daemon SSE stream closed.",
+          { ...telemetryBaseAttributes, ...closeAttributes },
+          { eventName: "qwen-code.daemon.sse.closed" }
+        );
+      }).catch(() => {
       });
-    }
+      try {
+        daemonLog?.info("SSE stream closed", {
+          sessionId: diagnosticSessionId,
+          clientId,
+          streamId,
+          connectReason,
+          previousStreamId,
+          closeReason: resolvedCloseReason,
+          durationMs,
+          eventFramesWriteSettled,
+          lastEventIdWritten,
+          backpressureCount,
+          maxDrainWaitMs,
+          maxLivePublishToWriteSettledMs,
+          slowWarningCount,
+          eventBusEvictionReason,
+          terminalEventType
+        });
+      } catch {
+      }
+      if (sseCounted) {
+        sseCounted = false;
+        activeSseCount--;
+      }
+    }, "finalize");
     res.status(200);
     res.setHeader("Content-Type", "text/event-stream");
     res.setHeader("Cache-Control", "no-cache, no-transform");
@@ -29638,49 +29769,92 @@ function registerSseEventsRoutes(app, deps) {
     if (busEpoch !== void 0) {
       res.setHeader("X-Qwen-Event-Epoch", busEpoch);
     }
-    res.flushHeaders();
+    res.setHeader(SSE_STREAM_ID_HEADER, streamId);
+    res.prependOnceListener("finish", finalize);
+    res.prependOnceListener("close", finalize);
     activeSseCount++;
-    let sseCounted = true;
-    res.on("close", () => {
-      if (sseCounted) {
-        sseCounted = false;
-        activeSseCount--;
+    sseCounted = true;
+    for (const [key, value] of Object.entries(telemetryBaseAttributes)) {
+      addDaemonRequestAttribute(key, value);
+    }
+    try {
+      daemonLog?.info("SSE stream opened", {
+        sessionId: diagnosticSessionId,
+        clientId,
+        streamId,
+        connectReason,
+        previousStreamId,
+        lastEventId
+      });
+    } catch {
+    }
+    emitLifecycleLog(
+      "qwen-code.daemon.sse.opened",
+      "Daemon SSE stream opened.",
+      {
+        ...lastEventId !== void 0 ? { "qwen-code.daemon.sse.resume_from_event_id": lastEventId } : {}
       }
-    });
+    );
+    try {
+      res.flushHeaders();
+    } catch {
+      closeReason = "socket_error";
+      abort.abort();
+      finalize();
+      try {
+        if (!res.writableEnded) res.end();
+      } catch {
+      }
+      return;
+    }
     let writeChain = Promise.resolve();
     const trackWriterIdle = writerIdleTimeoutMs !== void 0 && writerIdleTimeoutMs > 0;
     let lastWriteAt = trackWriterIdle ? Date.now() : 0;
+    const settleDrainMeasurement = /* @__PURE__ */ __name(() => {
+      if (activeDrainStartedAt === void 0) return;
+      maxDrainWaitMs = Math.max(
+        maxDrainWaitMs,
+        performance2.now() - activeDrainStartedAt
+      );
+      activeDrainStartedAt = void 0;
+    }, "settleDrainMeasurement");
     const doWrite = /* @__PURE__ */ __name((chunk) => new Promise((resolve5, reject) => {
       if (res.writableEnded) {
-        resolve5();
+        resolve5("closed");
         return;
       }
       let ok;
       try {
         ok = res.write(chunk);
       } catch (err) {
+        if (!closeReason) closeReason = "socket_error";
         reject(err);
         return;
       }
       if (ok) {
         if (trackWriterIdle) lastWriteAt = Date.now();
-        resolve5();
+        resolve5("settled");
         return;
       }
+      backpressureCount += 1;
+      activeDrainStartedAt = performance2.now();
       const onDrain = /* @__PURE__ */ __name(() => {
         res.off("close", onClose);
         res.off("error", onError);
+        settleDrainMeasurement();
         if (trackWriterIdle) lastWriteAt = Date.now();
-        resolve5();
+        resolve5("settled");
       }, "onDrain");
       const onClose = /* @__PURE__ */ __name(() => {
         res.off("drain", onDrain);
         res.off("error", onError);
-        resolve5();
+        settleDrainMeasurement();
+        resolve5("closed");
       }, "onClose");
       const onError = /* @__PURE__ */ __name((err) => {
         res.off("drain", onDrain);
         res.off("close", onClose);
+        settleDrainMeasurement();
         reject(err);
       }, "onError");
       res.once("drain", onDrain);
@@ -29689,7 +29863,10 @@ function registerSseEventsRoutes(app, deps) {
     }), "doWrite");
     const writeWithBackpressure = /* @__PURE__ */ __name((chunk) => {
       const next = writeChain.then(() => doWrite(chunk));
-      writeChain = next.catch(() => void 0);
+      writeChain = next.then(
+        () => void 0,
+        () => void 0
+      );
       return next;
     }, "writeWithBackpressure");
     void writeWithBackpressure("retry: 3000\n\n").catch(() => {
@@ -29717,8 +29894,10 @@ function registerSseEventsRoutes(app, deps) {
         if (res.writableEnded) return;
         const idleForMs = Date.now() - lastWriteAt;
         if (idleForMs < writerIdleTimeoutMsValue) return;
+        closeReason = "writer_idle_timeout";
+        terminalEventType = "client_evicted";
         try {
-          res.write(
+          const settled = res.write(
             formatSseFrame({
               v: 1,
               type: "client_evicted",
@@ -29730,14 +29909,37 @@ function registerSseEventsRoutes(app, deps) {
               }
             })
           );
+          if (settled) eventFramesWriteSettled += 1;
         } catch {
         }
+        const idleContext = {
+          sessionId: diagnosticSessionId,
+          clientId,
+          streamId,
+          connectReason,
+          previousStreamId,
+          idleForMs,
+          timeoutMs: writerIdleTimeoutMsValue
+        };
         try {
-          writeStderrLine(
-            `qwen serve: evicting SSE client (session ${sessionId}) \u2014 writer idle for ${idleForMs}ms > ${writerIdleTimeoutMsValue}ms timeout`
-          );
+          if (daemonLog) {
+            daemonLog.warn("SSE writer idle timeout", idleContext);
+          } else {
+            writeStderrLine(
+              `qwen serve: evicting SSE client (session ${diagnosticSessionId}) \u2014 writer idle for ${idleForMs}ms > ${writerIdleTimeoutMsValue}ms timeout (streamId=${streamId}${clientId ? `, clientId=${clientId}` : ""})`
+            );
+          }
         } catch {
         }
+        emitLifecycleLog(
+          "qwen-code.daemon.sse.client_evicted",
+          "Daemon SSE client evicted by writer idle timeout.",
+          {
+            "qwen-code.daemon.sse.writer_idle_for_ms": idleForMs,
+            "qwen-code.daemon.sse.writer_idle_timeout_ms": writerIdleTimeoutMsValue,
+            "qwen-code.daemon.sse.eviction_reason": "writer_idle_timeout"
+          }
+        );
         cleanup();
         try {
           if (!res.writableEnded) res.end();
@@ -29748,33 +29950,123 @@ function registerSseEventsRoutes(app, deps) {
     }
     req.on("close", cleanup);
     res.on("error", (err) => {
-      writeStderrLine(
-        `qwen serve: SSE socket error (session ${sessionId}): ${err.message}`
-      );
+      if (!closeReason) closeReason = "socket_error";
+      try {
+        if (daemonLog) {
+          daemonLog.error("SSE socket error", err, {
+            sessionId: diagnosticSessionId,
+            clientId,
+            streamId,
+            connectReason,
+            previousStreamId
+          });
+        } else {
+          writeStderrLine(
+            `qwen serve: SSE socket error (session ${diagnosticSessionId}): ${err.message} (streamId=${streamId}${clientId ? `, clientId=${clientId}` : ""})`
+          );
+        }
+      } catch {
+      }
       cleanup();
     });
     void (async () => {
       try {
         while (true) {
           const next = await iter.next();
-          if (next.done) break;
+          if (next.done) {
+            if (!closeReason) {
+              closeReason = terminalCandidate ?? "source_complete";
+            }
+            break;
+          }
           if (res.writableEnded) break;
+          if (next.value.type === "client_evicted") {
+            terminalCandidate = "event_bus_evicted";
+            terminalEventType = next.value.type;
+            const reason = next.value.data?.reason;
+            if (typeof reason === "string") {
+              eventBusEvictionReason = boundedDiagnosticString(reason);
+            }
+          } else if (next.value.type === "session_died" || next.value.type === "session_closed") {
+            terminalCandidate = "session_terminal";
+            terminalEventType = next.value.type;
+          }
           if (next.value.type === "state_resync_required") {
             const data = next.value.data;
             const gap = typeof data.earliestAvailableId === "number" && typeof data.lastDeliveredId === "number" ? data.earliestAvailableId - data.lastDeliveredId - 1 : void 0;
-            writeStderrLine(
-              `qwen serve: SSE ring eviction detected (session ${sessionId}): lastEventId=${data.lastDeliveredId ?? "?"}, earliestInRing=${data.earliestAvailableId ?? "?"}, gap=${gap ?? "?"} events, reason=${data.reason ?? "?"}` + (typeof data.detail === "string" ? `, detail=${data.detail}` : "") + `. Consumer must call loadSession to recover.`
+            const reason = typeof data.reason === "string" ? boundedDiagnosticString(data.reason) : "unknown";
+            const detail = typeof data.detail === "string" ? boundedDiagnosticString(data.detail) : void 0;
+            const context = {
+              sessionId: diagnosticSessionId,
+              clientId,
+              streamId,
+              connectReason,
+              previousStreamId,
+              lastEventId: data.lastDeliveredId,
+              earliestInRing: data.earliestAvailableId,
+              gap,
+              reason,
+              detail
+            };
+            try {
+              if (daemonLog) {
+                daemonLog.warn(
+                  "SSE ring eviction detected; consumer must call loadSession to recover",
+                  context
+                );
+              } else {
+                writeStderrLine(
+                  `qwen serve: SSE ring eviction detected (session ${diagnosticSessionId}): lastEventId=${data.lastDeliveredId ?? "?"}, earliestInRing=${data.earliestAvailableId ?? "?"}, gap=${gap ?? "?"} events, reason=${typeof data.reason === "string" ? reason : "?"}` + (detail ? `, detail=${detail}` : "") + `, streamId=${streamId}` + (clientId ? `, clientId=${clientId}` : "") + `. Consumer must call loadSession to recover.`
+                );
+              }
+            } catch {
+            }
+            emitLifecycleLog(
+              "qwen-code.daemon.sse.state_resync_required",
+              "Daemon SSE state resync required.",
+              {
+                "qwen-code.daemon.sse.resync_reason": reason,
+                ...detail ? { "qwen-code.daemon.sse.resync_detail": detail } : {},
+                ...typeof data.lastDeliveredId === "number" ? {
+                  "qwen-code.daemon.sse.resync_last_delivered_id": data.lastDeliveredId
+                } : {},
+                ...typeof data.earliestAvailableId === "number" ? {
+                  "qwen-code.daemon.sse.resync_earliest_available_id": data.earliestAvailableId
+                } : {},
+                ...gap !== void 0 ? { "qwen-code.daemon.sse.resync_gap_events": gap } : {}
+              }
+            );
+          }
+          const liveEvent = liveTimingEnabled;
+          const serverTimestamp = next.value._meta?.["serverTimestamp"];
+          const outcome = await writeWithBackpressure(
+            formatSseFrame(next.value)
+          );
+          if (outcome === "closed") break;
+          eventFramesWriteSettled += 1;
+          if (typeof next.value.id === "number") {
+            lastEventIdWritten = next.value.id;
+          }
+          if (liveEvent && typeof serverTimestamp === "number" && Number.isFinite(serverTimestamp)) {
+            maxLivePublishToWriteSettledMs = Math.max(
+              maxLivePublishToWriteSettledMs,
+              Math.max(0, Date.now() - serverTimestamp)
             );
           }
-          await writeWithBackpressure(formatSseFrame(next.value));
+          if (next.value.type === "replay_complete") {
+            liveTimingEnabled = true;
+          }
         }
       } catch (err) {
-        if (!res.writableEnded) {
+        if (!closeReason) {
+          closeReason = "iterator_error";
+        }
+        if (!res.writableEnded && closeReason !== "socket_error") {
           const errorKind = mapDomainErrorToErrorKind(err);
           writeStderrLine(
-            `qwen serve: bridge iterator error (session ${sessionId}): ${errorMessage2(err)}` + (errorKind ? ` [${errorKind}]` : "")
+            `qwen serve: bridge iterator error (session ${diagnosticSessionId}): ${errorMessage2(err)}` + (errorKind ? ` [${errorKind}]` : "")
           );
-          await writeWithBackpressure(
+          const outcome = await writeWithBackpressure(
             formatSseFrame({
               v: 1,
               type: "stream_error",
@@ -29783,8 +30075,8 @@ function registerSseEventsRoutes(app, deps) {
                 ...errorKind ? { errorKind } : {}
               }
             })
-          ).catch(() => {
-          });
+          ).catch(() => "closed");
+          if (outcome === "settled") eventFramesWriteSettled += 1;
         }
       } finally {
         cleanup();
@@ -30034,7 +30326,7 @@ __name(registerWorkspaceModelsRoutes, "registerWorkspaceModelsRoutes");
 // packages/cli/src/serve/routes/a2ui-action.ts
 init_esbuild_shims();
 import * as fsp4 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path11 from "node:path";
 var A2UI_MIME = "application/a2ui+json";
 var ACTION_TOOL = "action";
 var CALL_TIMEOUT_MS = 15e3;
@@ -30057,7 +30349,7 @@ __name(usableServerConfig, "usableServerConfig");
 async function findFromSettingsFile(workspaceCwd) {
   try {
     const raw = await fsp4.readFile(
-      path12.join(workspaceCwd, ".qwen", "settings.json"),
+      path11.join(workspaceCwd, ".qwen", "settings.json"),
       "utf8"
     );
     const settings = JSON.parse(raw);
@@ -30218,7 +30510,7 @@ __name(registerA2uiActionRoutes, "registerA2uiActionRoutes");
 
 // packages/cli/src/serve/server/fs-factory.ts
 init_esbuild_shims();
-import * as path13 from "node:path";
+import * as path12 from "node:path";
 var IDE_WORKSPACE_PATH_ENV_VAR = "QWEN_CODE_IDE_WORKSPACE_PATH";
 function createDefaultFsAuditEmit() {
   const WARN_EVERY = 100;
@@ -30293,14 +30585,14 @@ function parseIdeWorkspacePathEnv(value) {
       const parsed = JSON.parse(value);
       if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
         return parsed.filter(
-          (workspace) => workspace.length > 0 && path13.isAbsolute(workspace)
+          (workspace) => workspace.length > 0 && path12.isAbsolute(workspace)
         );
       }
       throw new Error("IDE workspace path JSON must be a string array");
     } catch {
     }
   }
-  return value.split(path13.delimiter).filter((workspace) => workspace.length > 0 && path13.isAbsolute(workspace));
+  return value.split(path12.delimiter).filter((workspace) => workspace.length > 0 && path12.isAbsolute(workspace));
 }
 __name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
 function dropNestedWorkspacesPreservingPrimary(workspaces) {
@@ -30569,9 +30861,9 @@ __name(setupDeviceFlowRegistry, "setupDeviceFlowRegistry");
 
 // packages/cli/src/serve/server/error-handlers.ts
 init_esbuild_shims();
-var import_express3 = __toESM(require_express(), 1);
+var import_express2 = __toESM(require_express(), 1);
 function installJsonBodyParser(app) {
-  app.use(import_express3.default.json({ limit: "10mb" }));
+  app.use(import_express2.default.json({ limit: "10mb" }));
   app.use((err, _req, res, next) => {
     if (sendJsonBodyParserError(res, err)) return;
     next(err);
@@ -30625,10 +30917,10 @@ function installRateLimiter(app, opts, daemonLog, options = {}) {
         { tier, key: key.slice(0, 64) }
       );
     } : void 0,
-    onError: daemonLog ? (err, path15) => {
+    onError: daemonLog ? (err, path14) => {
       daemonLog.warn(
         `rate limiter error (fail-open): ${err instanceof Error ? err.message : String(err)}`,
-        { path: path15 }
+        { path: path14 }
       );
     } : void 0
   });
@@ -30824,7 +31116,7 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 init_esbuild_shims();
 import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
 import { realpathSync as realpathSync3 } from "node:fs";
-import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join8, resolve as resolve4, sep as sep3 } from "node:path";
+import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join7, resolve as resolve4, sep as sep3 } from "node:path";
 
 // packages/cli/src/serve/native-directory-picker.ts
 init_esbuild_shims();
@@ -31210,7 +31502,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
         return;
       }
       const endsWithSep = prefix.endsWith("/") || process.platform === "win32" && prefix.endsWith("\\");
-      const dir = endsWithSep ? join8(prefix, ".") : dirname4(prefix);
+      const dir = endsWithSep ? join7(prefix, ".") : dirname4(prefix);
       const filter = endsWithSep ? "" : basename4(prefix);
       const filterLower = filter.toLowerCase();
       const suggestions = [];
@@ -31226,7 +31518,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
           let isDir = entry.isDirectory();
           if (!isDir && entry.isSymbolicLink()) {
             try {
-              isDir = (await stat2(join8(dir, entry.name))).isDirectory();
+              isDir = (await stat2(join7(dir, entry.name))).isDirectory();
             } catch {
               continue;
             }
@@ -31236,7 +31528,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
             truncated = true;
             break;
           }
-          suggestions.push({ name: entry.name, path: join8(dir, entry.name) });
+          suggestions.push({ name: entry.name, path: join7(dir, entry.name) });
         }
       } catch {
       }
@@ -31256,11 +31548,11 @@ function registerWorkspaceManagementRoutes(app, deps) {
       const controller = new AbortController();
       res.on("close", () => controller.abort());
       try {
-        const path15 = await pickWorkspaceDirectory(controller.signal);
+        const path14 = await pickWorkspaceDirectory(controller.signal);
         res.status(200).json({
           kind: "workspace-directory-picker",
-          selected: path15 !== void 0,
-          ...path15 === void 0 ? {} : { path: path15 }
+          selected: path14 !== void 0,
+          ...path14 === void 0 ? {} : { path: path14 }
         });
       } catch (error2) {
         const detail = error2 instanceof Error ? error2.message : String(error2);
@@ -32317,8 +32609,8 @@ function buildDiffList(workspaceCwd, result) {
       hiddenCount: 0
     };
   }
-  const files = [...result.perFileStats.entries()].map(([path15, s]) => ({
-    path: path15,
+  const files = [...result.perFileStats.entries()].map(([path14, s]) => ({
+    path: path14,
     oldPath: s.oldPath,
     added: s.added,
     removed: s.removed,
@@ -34407,18 +34699,43 @@ function parsePairingCode(body, res) {
   return code.trim().toUpperCase();
 }
 __name(parsePairingCode, "parsePairingCode");
-function parsePairingSenderId(body, res) {
+function parsePairingApprovalSubject(body, res) {
   const senderId = body["senderId"];
-  if (typeof senderId !== "string" || senderId.length === 0) {
+  const groupId = body["groupId"];
+  if (senderId !== void 0 && groupId !== void 0) {
+    res.status(400).json({
+      error: "Provide exactly one of `senderId` or `groupId`.",
+      code: "invalid_channel_pairing_subject"
+    });
+    return void 0;
+  }
+  if (senderId !== void 0) {
+    if (typeof senderId === "string" && senderId.length > 0) {
+      return { type: "user", id: senderId };
+    }
     res.status(400).json({
       error: "`senderId` must be a non-empty string.",
       code: "invalid_channel_pairing_sender_id"
     });
     return void 0;
   }
-  return senderId;
+  if (groupId !== void 0) {
+    if (typeof groupId === "string" && groupId.length > 0) {
+      return { type: "group", id: groupId };
+    }
+    res.status(400).json({
+      error: "`groupId` must be a non-empty string.",
+      code: "invalid_channel_pairing_group_id"
+    });
+    return void 0;
+  }
+  res.status(400).json({
+    error: "Provide exactly one of `senderId` or `groupId`.",
+    code: "invalid_channel_pairing_subject"
+  });
+  return void 0;
 }
-__name(parsePairingSenderId, "parsePairingSenderId");
+__name(parsePairingApprovalSubject, "parsePairingApprovalSubject");
 function errorCode2(error2) {
   if (!error2 || typeof error2 !== "object") return void 0;
   try {
@@ -34592,11 +34909,11 @@ function registerWorkspaceChannelManagementRoutes(app, deps) {
         if (!resolved || !validateClient(req, res, resolved.runtime)) return;
         const name = parseInstanceName(req, res);
         if (!name) return;
-        const senderId = parsePairingSenderId(deps.safeBody(req), res);
-        if (!senderId) return;
+        const subject = parsePairingApprovalSubject(deps.safeBody(req), res);
+        if (!subject) return;
         try {
           noStore(res);
-          res.status(200).json(await resolved.service.revokePairingApproval(name, senderId));
+          res.status(200).json(await resolved.service.revokePairingApproval(name, subject));
         } catch (error2) {
           sendManagementError(res, error2);
         }
@@ -35200,7 +35517,7 @@ __name(registerWorkspaceQualifiedSkillsRoutes, "registerWorkspaceQualifiedSkills
 
 // packages/cli/src/serve/routes/channel-webhooks.ts
 init_esbuild_shims();
-var import_express4 = __toESM(require_express(), 1);
+var import_express3 = __toESM(require_express(), 1);
 import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
@@ -35249,7 +35566,7 @@ function registerChannelWebhookRoutes(app, deps) {
       locals.channelWebhook = { channelName, source, sourceConfig };
       next();
     },
-    import_express4.default.json({ limit: "1mb" }),
+    import_express3.default.json({ limit: "1mb" }),
     async (req, res) => {
       const locals = res.locals;
       const webhook = locals.channelWebhook;
@@ -35444,7 +35761,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/live/live-host-coordinator.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 var DEFAULT_HELLO_TIMEOUT_MS = 5e3;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
 var DEFAULT_HEARTBEAT_TIMEOUT_MS = 15e3;
@@ -35621,7 +35938,7 @@ __name(projectStatusForHost, "projectStatusForHost");
 var LiveHostCoordinator = class {
   constructor(options) {
     this.options = options;
-    this.daemonInstanceNonce = options.daemonInstanceNonce ?? randomUUID7();
+    this.daemonInstanceNonce = options.daemonInstanceNonce ?? randomUUID8();
     this.handlers = options.handlers ?? {};
     this.now = options.now ?? Date.now;
     this.helloTimeoutMs = options.helloTimeoutMs ?? DEFAULT_HELLO_TIMEOUT_MS;
@@ -35813,7 +36130,7 @@ var LiveHostCoordinator = class {
   startCall(mode) {
     const call = {
       epoch: ++this.nextEpoch,
-      callId: randomUUID7(),
+      callId: randomUUID8(),
       mode,
       state: "starting",
       pendingPermission: false,
@@ -35872,7 +36189,7 @@ var LiveHostCoordinator = class {
         new Error("Qwen Live Host must be connected to change the shortcut.")
       );
     }
-    const requestId = randomUUID7();
+    const requestId = randomUUID8();
     return new Promise((resolve5, reject) => {
       const timer = setTimeout(() => {
         this.rejectPendingShortcut(
@@ -35962,7 +36279,7 @@ var LiveHostCoordinator = class {
         )
       );
     }
-    const requestId = randomUUID7();
+    const requestId = randomUUID8();
     return new Promise((resolve5, reject) => {
       const timer = setTimeout(() => {
         this.pendingAppshots.delete(requestId);
@@ -36302,7 +36619,7 @@ var LiveHostCoordinator = class {
       this.disconnectHost(lease, 4008, "Live Host heartbeat timed out.");
       return;
     }
-    const pingId = randomUUID7();
+    const pingId = randomUUID8();
     lease.pingId = pingId;
     this.sendHost({ type: "host.ping", pingId });
   }
@@ -36564,7 +36881,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/live/live-setup-controller.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 
 // packages/cli/src/serve/live/provider-credentials.ts
 init_esbuild_shims();
@@ -36662,7 +36979,7 @@ __name(resolveLiveProviderCredential, "resolveLiveProviderCredential");
 
 // packages/cli/src/serve/live/qwen-realtime-session.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 var QWEN_REALTIME_LIMITS = {
   maxInputAudioFrameBytes: 64 * 1024,
   maxOutputAudioFrameBytes: 256 * 1024,
@@ -37077,7 +37394,7 @@ function openQwenRealtimeSession(config, callbacks = {}, deps = {}) {
     const sendJson = /* @__PURE__ */ __name((body) => {
       if (terminal || closedByClient || ws.readyState !== ws.OPEN) return false;
       try {
-        ws.send(JSON.stringify({ event_id: randomUUID8(), ...body }));
+        ws.send(JSON.stringify({ event_id: randomUUID9(), ...body }));
         return true;
       } catch (error2) {
         fail(
@@ -38440,7 +38757,7 @@ async function validateCredential(credential) {
     apiKey: credential.apiKey,
     model: credential.realtimeModel,
     voice: credential.voice,
-    callEpoch: `setup-${randomUUID9()}`
+    callEpoch: `setup-${randomUUID10()}`
   });
   session.close({ discardPendingInput: true });
 }
@@ -38747,11 +39064,11 @@ __name(registerLiveSetupRoutes, "registerLiveSetupRoutes");
 // packages/cli/src/serve/live/live-host-installer.ts
 init_esbuild_shims();
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash5, randomUUID as randomUUID10 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID11 } from "node:crypto";
 import * as fs6 from "node:fs";
 import * as fsp5 from "node:fs/promises";
 import * as os from "node:os";
-import * as path14 from "node:path";
+import * as path13 from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
@@ -38829,7 +39146,7 @@ async function readBundleValue(appPath, key) {
     "raw",
     "-o",
     "-",
-    path14.join(appPath, "Contents", "Info.plist")
+    path13.join(appPath, "Contents", "Info.plist")
   ]);
 }
 __name(readBundleValue, "readBundleValue");
@@ -38935,13 +39252,13 @@ async function installLatestHost(currentArchitecture, onStatus) {
   const manifest = await fetchManifest();
   const asset = manifest.assets[currentArchitecture];
   const temporaryDirectory = await fsp5.mkdtemp(
-    path14.join(os.tmpdir(), "qwen-live-host-")
+    path13.join(os.tmpdir(), "qwen-live-host-")
   );
-  const archivePath = path14.join(temporaryDirectory, asset.name);
-  const extractedPath = path14.join(temporaryDirectory, "extracted");
-  const candidatePath = path14.join(extractedPath, LIVE_HOST_APP_NAME);
-  const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID10()}.app`;
-  const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID10()}.app`;
+  const archivePath = path13.join(temporaryDirectory, asset.name);
+  const extractedPath = path13.join(temporaryDirectory, "extracted");
+  const candidatePath = path13.join(extractedPath, LIVE_HOST_APP_NAME);
+  const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID11()}.app`;
+  const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID11()}.app`;
   let movedExisting = false;
   let installedCandidate = false;
   try {
@@ -39085,15 +39402,15 @@ var LiveHostInstaller = class {
 
 // packages/cli/src/serve/live/live-session-coordinator.ts
 init_esbuild_shims();
-import { createHash as createHash6, randomUUID as randomUUID11 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join10 } from "node:path";
 
 // packages/cli/src/serve/live/realtime-startup-context.ts
 init_esbuild_shims();
 import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename as basename5, join as join10 } from "node:path";
+import { basename as basename5, join as join9 } from "node:path";
 var STARTUP_CONTEXT_HEADER = "Startup context from Qwen Code.\nThis is background context about recent work and machine/workspace layout. It may be incomplete or stale. Use it to inform responses, and do not repeat it back unless relevant.";
 var CURRENT_THREAD_SECTION_TOKEN_BUDGET = 1200;
 var RECENT_WORK_SECTION_TOKEN_BUDGET = 2200;
@@ -39335,7 +39652,7 @@ function collectTreeLines(directory, depth, lines) {
     const indent = "  ".repeat(depth);
     lines.push(`${indent}- ${entry.name}${entry.isDirectory() ? "/" : ""}`);
     if (entry.isDirectory()) {
-      collectTreeLines(join10(directory, entry.name), depth + 1, lines);
+      collectTreeLines(join9(directory, entry.name), depth + 1, lines);
     }
   }
   if (entries.length > DIR_ENTRY_LIMIT) {
@@ -39454,13 +39771,13 @@ function openLiveAudioCapture(source, identifier) {
   try {
     mkdirSync2(directory, { recursive: true, mode: 448 });
     const safeIdentifier = identifier.replace(/[^A-Za-z0-9_-]/g, "_");
-    const path15 = join11(
+    const path14 = join10(
       directory,
       `${source}-${Date.now()}-${safeIdentifier}.pcm`
     );
-    const stream = createWriteStream2(path15, { flags: "wx", mode: 384 });
+    const stream = createWriteStream2(path14, { flags: "wx", mode: 384 });
     stream.on("error", () => void 0);
-    return { source, path: path15, stream, hash: createHash6("sha256"), bytes: 0 };
+    return { source, path: path14, stream, hash: createHash6("sha256"), bytes: 0 };
   } catch {
     return void 0;
   }
@@ -39815,7 +40132,7 @@ var LiveSessionCoordinator = class {
         context.speechInProgress = true;
         context.inputCommitPending = true;
         context.inputAwaitingResponse = false;
-        const partialItemId = itemId ?? `partial:${randomUUID11()}`;
+        const partialItemId = itemId ?? `partial:${randomUUID12()}`;
         context.activePartialInputItemId = partialItemId;
         if (!context.partialInputTranscripts.has(partialItemId)) {
           context.partialInputTranscripts.set(partialItemId, "");
@@ -39845,7 +40162,7 @@ var LiveSessionCoordinator = class {
       }, "onInputCommitted"),
       onInputTranscriptDelta: /* @__PURE__ */ __name(({ itemId, text }) => {
         if (this.isCurrentSocket(context, generation)) {
-          const partialItemId = itemId ?? context.activePartialInputItemId ?? `partial:${randomUUID11()}`;
+          const partialItemId = itemId ?? context.activePartialInputItemId ?? `partial:${randomUUID12()}`;
           context.activePartialInputItemId = partialItemId;
           context.partialInputTranscripts.set(partialItemId, text);
           this.options.host.setTranscript?.(context.epoch, text);
@@ -39855,7 +40172,7 @@ var LiveSessionCoordinator = class {
         if (this.isCurrentSocket(context, generation)) {
           context.speechInProgress = false;
           context.inputCommitPending = false;
-          const completedItemId = itemId ?? context.activePartialInputItemId ?? `unattributed:${randomUUID11()}`;
+          const completedItemId = itemId ?? context.activePartialInputItemId ?? `unattributed:${randomUUID12()}`;
           context.partialInputTranscripts.delete(completedItemId);
           if (context.activePartialInputItemId === completedItemId) {
             context.activePartialInputItemId = void 0;
@@ -40569,7 +40886,7 @@ var LiveSessionCoordinator = class {
     const runtime = context.runtime;
     if (!runtime) throw new Error("Conversation workspace is unavailable.");
     const bridge = runtime.bridge;
-    const promptId = randomUUID11();
+    const promptId = randomUUID12();
     const lastEventId = bridge.getSessionLastEventId(locator.sessionId);
     const turnAbort = new AbortController();
     this.inFlightTurnAborts.add(turnAbort);
@@ -40886,7 +41203,7 @@ var LiveSessionCoordinator = class {
 
 // packages/cli/src/serve/live/live-task-service.ts
 init_esbuild_shims();
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 var DEFAULT_LIST_LIMIT = 20;
 var DEFAULT_READ_TURN_LIMIT = 3;
 var DEFAULT_WAIT_TIMEOUT_MS = 12e4;
@@ -41602,7 +41919,7 @@ var LiveTaskService = class {
       { sessionId, prompt: [{ type: "text", text: prompt }] },
       void 0,
       {
-        promptId: randomUUID12(),
+        promptId: randomUUID13(),
         onPromptAdmitted: /* @__PURE__ */ __name(() => {
           admitted = true;
           onAdmitted?.();
@@ -41826,7 +42143,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       "createServeApp: deps.workspaceRuntimeRemoval requires the matching deps.voiceCoordinator."
     );
   }
-  const app = (0, import_express5.default)();
+  const app = (0, import_express4.default)();
   const injectedWorkspaceRegistry = deps.workspaceRegistry;
   const boundWorkspace = injectedWorkspaceRegistry?.primary.workspaceCwd ?? deps.boundWorkspace ?? canonicalizeWorkspace(opts.workspace ?? process.cwd());
   if (injectedWorkspaceRegistry) {
@@ -42003,8 +42320,9 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     // Wire the production status provider so direct embeds / tests
     // that don't inject `deps.bridge` get daemon env + preflight cells.
     statusProvider,
-    // Wire the WorkspaceFileSystem adapter so ACP writeTextFile /
-    // readTextFile pick up trust / TOCTOU / audit.
+    delegateReadTextFileToClient: false,
+    // Final ACP text writes remain delegated through WorkspaceFileSystem.
+    // Unexpected delegated reads still fail closed at the WFS boundary.
     fileSystem: createBridgeFileSystemAdapter(fsFactory),
     // Reverse tool channel: answer the child's `client_mcp/message`
     // ext-method by reaching the WS connection that hosts the named server.
@@ -42541,7 +42859,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     getChannelWorkerSnapshots: deps.getChannelWorkerSnapshots,
     getPerfSnapshot: deps.getPerfSnapshot,
     getMetricsSeries: deps.getMetricsSeries,
-    getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot ?? totalSessionAdmission?.snapshot
+    getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot ?? totalSessionAdmission?.snapshot,
+    getChildHeapPolicySnapshot: deps.getChildHeapPolicySnapshot
   });
   if (liveVoiceEnabled) {
     app.use("/capabilities", (_req, _res, next) => {