@qwen-code/qwen-code 0.21.7 → 0.21.8

package/chunks/{server-XLJVLTYM.js → server-OWMEMAKR.js}

@@ -21,7 +21,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-TRLYP7OF.js";
+} from "./chunk-ZPLALRXZ.js";
 import {
   deriveWebSocketBase,
   openQwenAsrRealtimeStream,
@@ -39,12 +39,12 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-6XJMFJ4D.js";
+} from "./chunk-2M4K4KYS.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
 } from "./chunk-OWMAZHIX.js";
-import "./chunk-KXSDEOFU.js";
+import "./chunk-4ALIARFY.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-4NFY2S7N.js";
@@ -108,7 +108,7 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-RGSBTHSU.js";
+} from "./chunk-KAQCJO6Y.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
@@ -124,17 +124,17 @@ import {
 import "./chunk-GRC5HGPI.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-H2UQ2M5Z.js";
+} from "./chunk-4WU6NY7F.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-W4B7UBUS.js";
+} from "./chunk-XZKQT2B2.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-CSZEXZBE.js";
+} from "./chunk-GBDINRIL.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-P3LEG54R.js";
+} from "./chunk-DX5W5AON.js";
 import "./chunk-BGXZBI5B.js";
 import {
   isServeDebugMode,
@@ -147,7 +147,7 @@ import {
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-OMKQH5C5.js";
+} from "./chunk-SNRT2TJJ.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -161,14 +161,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-RERATVSK.js";
+} from "./chunk-IBYULW65.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-6GONZVLS.js";
+} from "./chunk-KKDVZLGL.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -176,12 +176,12 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-AE77C5ZU.js";
+} from "./chunk-DQSDACD2.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-55LYDVPU.js";
+} from "./chunk-C5VWPTGT.js";
 import "./chunk-AOHJKPKL.js";
 import "./chunk-Z4X5MTRT.js";
 import {
@@ -193,8 +193,8 @@ import {
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-EUQTXRKZ.js";
-import "./chunk-OHJLEW5J.js";
+} from "./chunk-E4ZBKMSF.js";
+import "./chunk-QQWD7LZV.js";
 import "./chunk-57OAHC2Y.js";
 import {
   LIVE_HOST_BUNDLE_ID,
@@ -203,19 +203,19 @@ import {
 } from "./chunk-NKLP3DCK.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-YJQCUTT2.js";
+} from "./chunk-VWMUDKLC.js";
 import "./chunk-VXZBKKQR.js";
-import "./chunk-SPMY6CX6.js";
+import "./chunk-3SE7J4DR.js";
 import "./chunk-3SH53ANB.js";
 import {
   snapshotProcessEnv
-} from "./chunk-TYKC75AX.js";
+} from "./chunk-S3Y3GBFD.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-LA7YLSR6.js";
+} from "./chunk-FYAXKJK7.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -223,7 +223,7 @@ import {
 } from "./chunk-MZSJ43WV.js";
 import "./chunk-XCGIMOLN.js";
 import "./chunk-OCPBI7J5.js";
-import "./chunk-E33LOKRA.js";
+import "./chunk-RPWVIXDB.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
@@ -234,11 +234,11 @@ import "./chunk-FC4KQFCS.js";
 import "./chunk-T3CHYWJZ.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-ZXU5UHMI.js";
-import "./chunk-VWOVHOTT.js";
+} from "./chunk-QXVSWG66.js";
+import "./chunk-KJZ26VBX.js";
 import {
   supportedChannelCatalog
-} from "./chunk-IUFV6FYU.js";
+} from "./chunk-NGYI5EF5.js";
 import "./chunk-V6WHFGST.js";
 import {
   MAX_REGISTERED_WORKSPACES,
@@ -247,8 +247,10 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-P2AJ7FTI.js";
-import "./chunk-R574ATRM.js";
+} from "./chunk-757GB46F.js";
+import {
+  gradeActiveWorkCoverage
+} from "./chunk-M2PNLYGY.js";
 import {
   BranchWhilePromptActiveError,
   CancelSentinelCollisionError,
@@ -300,7 +302,7 @@ import {
 } from "./chunk-YP5KH5Y7.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-24ER7UV4.js";
+} from "./chunk-UFALT4LK.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -312,7 +314,7 @@ import {
 import "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-DIEFUBV6.js";
+} from "./chunk-DIWZNWZT.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -323,7 +325,7 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-PQBHU2IA.js";
+} from "./chunk-OHKJVAKG.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-GOXKNSDZ.js";
 import "./chunk-IDS7MSUP.js";
@@ -332,15 +334,15 @@ import {
   detectSystemLanguage,
   resolveLanguageSetting,
   resolveSupportedLanguage
-} from "./chunk-DBOFL3LQ.js";
-import "./chunk-VOARQPTA.js";
-import "./chunk-6PEXNQTX.js";
-import "./chunk-FZBZSYKU.js";
+} from "./chunk-PG62DFWD.js";
+import "./chunk-B52AWKBB.js";
+import "./chunk-UA5H3DS2.js";
+import "./chunk-FN6YXJOP.js";
 import "./chunk-VJNBRRZG.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-6XU3PH66.js";
-import "./chunk-ALGGS7UH.js";
+} from "./chunk-HA3SAB64.js";
+import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
 } from "./chunk-MR3PXB6E.js";
@@ -360,6 +362,7 @@ import {
   MAX_LOG_LIMIT,
   ModelsConfig,
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
+  SESSION_TRANSCRIPT_MAX_EXPANDED_PAGE_BYTES,
   SESSION_TRANSCRIPT_MAX_INDEX_BYTES,
   SESSION_TRANSCRIPT_MAX_LIMIT,
   SESSION_TRANSCRIPT_MAX_PAGE_BYTES,
@@ -418,7 +421,7 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-Y7E5LNLO.js";
+} from "./chunk-GXSNGY5M.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
@@ -426,12 +429,12 @@ import "./chunk-H6XPXXMH.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-CNIID3TV.js";
+} from "./chunk-2UUMVNYT.js";
 import "./chunk-MVUQRLOH.js";
 import "./chunk-XCWO3SMQ.js";
 import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-RMH5OWLD.js";
+import "./chunk-VXZ5HAOV.js";
 import {
   nextFireTime,
   parseCron
@@ -445,7 +448,7 @@ import {
   taskHasLegacyCondition,
   updateCronTasks
 } from "./chunk-GNPNYXJB.js";
-import "./chunk-Y4NGLFGJ.js";
+import "./chunk-HUWENAHO.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
@@ -454,22 +457,37 @@ import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
 import "./chunk-GM463R2B.js";
 import "./chunk-SEZ556DZ.js";
-import "./chunk-CJXIIILK.js";
-import "./chunk-3K7FH2KQ.js";
+import "./chunk-2FRY5CRX.js";
+import "./chunk-67N6HB5H.js";
 import {
   APPROVAL_MODES
-} from "./chunk-BVWVWGLE.js";
+} from "./chunk-WAUGQKUU.js";
+import "./chunk-PLFATELK.js";
+import {
+  addDaemonRequestAttribute,
+  captureDaemonTelemetryContext,
+  emitDaemonLog,
+  hashDaemonWorkspace,
+  recordDaemonBridgeError,
+  recordDaemonError,
+  recordDaemonHttpRequest,
+  recordDaemonHttpResponse,
+  runWithDaemonTelemetryContext,
+  withDaemonRequestSpan
+} from "./chunk-L4N6TIP7.js";
+import "./chunk-SAH4BD2J.js";
+import "./chunk-CPG6P4GG.js";
 import "./chunk-S6LOFUVP.js";
+import "./chunk-2J3OJGTL.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-LZC3B5N2.js";
+} from "./chunk-IA7TGCN2.js";
 import "./chunk-K623ENWT.js";
 import {
   escapeXml
 } from "./chunk-AQ37AY7B.js";
 import "./chunk-EQL65XGA.js";
-import "./chunk-IIJEYBNH.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -478,31 +496,18 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-22NBYCPD.js";
+} from "./chunk-3P2LV43B.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-3ULCB3NE.js";
-import "./chunk-BGG4MBYD.js";
+import "./chunk-HV76SFIA.js";
+import "./chunk-4PYCZH2V.js";
+import "./chunk-P3QQPMQA.js";
+import "./chunk-SR7RZ4MS.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-AXMWHKXA.js";
-import "./chunk-DJ2GSRLV.js";
-import "./chunk-33ACCIIY.js";
-import {
-  addDaemonRequestAttribute,
-  captureDaemonTelemetryContext,
-  emitDaemonLog,
-  hashDaemonWorkspace,
-  recordDaemonBridgeError,
-  recordDaemonError,
-  recordDaemonHttpRequest,
-  recordDaemonHttpResponse,
-  runWithDaemonTelemetryContext,
-  withDaemonRequestSpan
-} from "./chunk-L4N6TIP7.js";
-import "./chunk-2J3OJGTL.js";
-import "./chunk-P3QQPMQA.js";
-import "./chunk-M6HMMKVG.js";
 import "./chunk-GLCZKT5V.js";
+import "./chunk-DJ2GSRLV.js";
 import "./chunk-EI3HZX6C.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-XWRJCPHC.js";
@@ -516,13 +521,15 @@ import {
   isWithinRoot,
   parseLineTolerant,
   read
-} from "./chunk-2U3WZGZG.js";
+} from "./chunk-3PY4LPJF.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
 import "./chunk-FVKHVJZQ.js";
-import "./chunk-NG2R4N5O.js";
-import "./chunk-IC4Z6LX6.js";
-import "./chunk-6EOI4HOK.js";
+import "./chunk-COBO5EBO.js";
+import "./chunk-6ZRFAKXK.js";
+import "./chunk-PYQADEFD.js";
+import "./chunk-M3STHEMM.js";
+import "./chunk-F6WFNA7U.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
 import "./chunk-KKBPOU75.js";
@@ -535,6 +542,7 @@ import {
   FatalConfigError,
   Storage,
   createDebugLogger,
+  getErrorMessage,
   runWithoutDebugLogSession
 } from "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
@@ -563,7 +571,7 @@ import {
 
 // packages/cli/src/serve/server.ts
 init_esbuild_shims();
-var import_express4 = __toESM(require_express(), 1);
+var import_express5 = __toESM(require_express(), 1);
 
 // packages/cli/src/serve/acp-http/index.ts
 init_esbuild_shims();
@@ -1180,11 +1188,11 @@ function decodeTextCursor(cursor) {
   return { off, size, dev, ino };
 }
 __name(decodeTextCursor, "decodeTextCursor");
-function assertCursorMatchesFile(cursor, stats, path14) {
+function assertCursorMatchesFile(cursor, stats, path15) {
   if (String(stats.dev) !== cursor.dev || String(stats.ino) !== cursor.ino || stats.size < cursor.size) {
     throw new FsError(
       "hash_mismatch",
-      `cursor no longer matches the file it was issued for: ${path14}`,
+      `cursor no longer matches the file it was issued for: ${path15}`,
       { hint: "re-read the file from the beginning to get a fresh cursor" }
     );
   }
@@ -1946,17 +1954,17 @@ var WorkspaceFileSystemImpl = class {
     if (err instanceof Error && "code" in err && err.code === "workspace_generation_closed") {
       return err;
     }
-    const fs7 = wrapAsFsError(err);
+    const fs8 = wrapAsFsError(err);
     this.deps.audit.recordDenied(this.deps.ctx, {
       intent,
       input,
-      errorKind: fs7.kind,
-      hint: fs7.hint,
+      errorKind: fs8.kind,
+      hint: fs8.hint,
       // Quote the underlying OS / FsError message so audit
       // consumers debugging a production incident can see the
       // actual cause (errno text, byte counts, glob pattern,
       // etc.) rather than just `errorKind` + `hint`.
-      message: fs7.message,
+      message: fs8.message,
       // For glob denials (parse_error pattern rejection,
       // catastrophic walk failures) the input IS the pattern
       // already; surfacing it on the dedicated `pattern` field
@@ -1965,7 +1973,7 @@ var WorkspaceFileSystemImpl = class {
       // branching on intent.
       pattern: intent === "glob" ? input : void 0
     });
-    return fs7;
+    return fs8;
   }
 };
 var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
@@ -3041,12 +3049,12 @@ function sendFsError(res, err, route) {
   applyReadHeaders(res);
   if (sendGenerationClosedError(res, err)) return;
   if (isFsError(err)) {
-    const fs7 = err;
-    res.status(fs7.status).json({
-      errorKind: fs7.kind,
-      error: fs7.message,
-      hint: fs7.hint,
-      status: fs7.status
+    const fs8 = err;
+    res.status(fs8.status).json({
+      errorKind: fs8.kind,
+      error: fs8.message,
+      hint: fs8.hint,
+      status: fs8.status
     });
     return;
   }
@@ -3159,13 +3167,13 @@ async function handleGetFile(req, res, deps) {
     return;
   }
   const cursor = rawCursor;
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "read");
-    const out = await fs7.readText(resolved, {
+    const resolved = await fs8.resolve(queryPath, "read");
+    const out = await fs8.readText(resolved, {
       maxBytes,
       line,
       limit,
@@ -3226,13 +3234,13 @@ async function handleGetFileBytes(req, res, deps) {
     });
     return;
   }
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "read");
-    const out = await fs7.readBytesWindow(resolved, {
+    const resolved = await fs8.resolve(queryPath, "read");
+    const out = await fs8.readBytesWindow(resolved, {
       offset: offset ?? 0,
       maxBytes: maxBytes ?? DEFAULT_FILE_BYTES_MAX_BYTES
     });
@@ -3260,13 +3268,13 @@ async function handleGetStat(req, res, deps) {
   if (clientId === null) return;
   const queryPath = requireStringQuery(res, req.query["path"], "path", ROUTE2);
   if (queryPath === null) return;
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "stat");
-    const st = await fs7.stat(resolved);
+    const resolved = await fs8.resolve(queryPath, "stat");
+    const st = await fs8.stat(resolved);
     applyReadHeaders(res);
     res.status(200).json({
       kind: "stat",
@@ -3289,13 +3297,13 @@ async function handleGetList(req, res, deps) {
   const queryPath = requireStringQuery(res, req.query["path"], "path", ROUTE2);
   if (queryPath === null) return;
   const includeIgnored = parseBoolFlag(req.query["includeIgnored"]);
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "list");
-    const entries = await fs7.list(resolved, {
+    const resolved = await fs8.resolve(queryPath, "list");
+    const entries = await fs8.list(resolved, {
       includeIgnored,
       maxEntries: MAX_LIST_ENTRIES + 1
     });
@@ -3348,15 +3356,15 @@ async function handleGetGlob(req, res, deps) {
   }
   const cwdRaw = req.query["cwd"];
   const cwdString = typeof cwdRaw === "string" && cwdRaw.length > 0 ? cwdRaw : void 0;
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   const start = performance.now();
   try {
-    const cwdResolved = cwdString ? await fs7.resolve(cwdString, "list") : void 0;
+    const cwdResolved = cwdString ? await fs8.resolve(cwdString, "list") : void 0;
     const cap = maxResults ?? DEFAULT_GLOB_MAX_RESULTS;
-    const probe = await fs7.glob(pattern, {
+    const probe = await fs8.glob(pattern, {
       cwd: cwdResolved,
       includeIgnored,
       maxResults: cap + 1
@@ -3544,7 +3552,7 @@ function validateClientId(clientId, deps, res) {
 }
 __name(validateClientId, "validateClientId");
 function createSetupGithubFileOps(factory, route, originatorClientId, assertGenerationOpen) {
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     route,
     ...originatorClientId ? { originatorClientId } : {}
   });
@@ -3572,14 +3580,14 @@ function createSetupGithubFileOps(factory, route, originatorClientId, assertGene
       );
     },
     async writeTextFile(_gitRepoRoot, relativePath, content) {
-      const resolved = await fs7.resolve(relativePath, "write");
-      const out = await fs7.writeTextOverwrite(resolved, content);
+      const resolved = await fs8.resolve(relativePath, "write");
+      const out = await fs8.writeTextOverwrite(resolved, content);
       return { sizeBytes: out.sizeBytes };
     },
     async readTextFile(_gitRepoRoot, relativePath) {
       try {
-        const resolved = await fs7.resolve(relativePath, "read");
-        const out = await fs7.readText(resolved);
+        const resolved = await fs8.resolve(relativePath, "read");
+        const out = await fs8.readText(resolved);
         return out.content;
       } catch (error2) {
         if (isFsError(error2) && error2.kind === "path_not_found") {
@@ -10791,7 +10799,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -10856,8 +10864,8 @@ var AcpDispatcher = class {
             return;
           }
           const cursor = rawCursor;
-          const resolved = await fs7.resolve(p, "read");
-          const out = await fs7.readText(resolved, {
+          const resolved = await fs8.resolve(p, "read");
+          const out = await fs8.readText(resolved, {
             maxBytes,
             line,
             limit,
@@ -10884,7 +10892,7 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -10920,8 +10928,8 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const resolved = await fs7.resolve(p, "read");
-          const buf = await fs7.readBytesWindow(resolved, { offset, maxBytes });
+          const resolved = await fs8.resolve(p, "read");
+          const buf = await fs8.readBytesWindow(resolved, { offset, maxBytes });
           this.replyConn(conn, id, { path: p, ...buf });
           return;
         }
@@ -10939,12 +10947,12 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs7.resolve(p, "read");
-          const result = await fs7.stat(resolved);
+          const resolved = await fs8.resolve(p, "read");
+          const result = await fs8.stat(resolved);
           this.replyConn(conn, id, { path: p, ...result });
           return;
         }
@@ -10962,13 +10970,13 @@ var AcpDispatcher = class {
               conn.sendConn(error(id, RPC.INVALID_PARAMS, "`path` required"));
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs7.resolve(p, "read");
+          const resolved = await fs8.resolve(p, "read");
           const MAX_LIST = 2e3;
-          const entries = await fs7.list(resolved, { maxEntries: MAX_LIST + 1 });
+          const entries = await fs8.list(resolved, { maxEntries: MAX_LIST + 1 });
           const truncated = entries.length > MAX_LIST;
           this.replyConn(conn, id, {
             path: p,
@@ -10993,7 +11001,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
@@ -11013,7 +11021,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const matches = await fs7.glob(pattern, {
+          const matches = await fs8.glob(pattern, {
             maxResults: maxResults + 1
           });
           const truncated = matches.length > maxResults;
@@ -11045,11 +11053,11 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs7.resolve(p, "write");
+          const resolved = await fs8.resolve(p, "write");
           if (Buffer.byteLength(params["content"], "utf8") > 10 * 1024 * 1024) {
             if (id !== void 0)
               conn.sendConn(
@@ -11057,7 +11065,7 @@ var AcpDispatcher = class {
               );
             return;
           }
-          await fs7.writeTextOverwrite(resolved, params["content"]);
+          await fs8.writeTextOverwrite(resolved, params["content"]);
           assertGenerationOpen?.();
           this.replyConn(conn, id, { ok: true, path: p });
           return;
@@ -11087,12 +11095,12 @@ var AcpDispatcher = class {
               );
             return;
           }
-          const fs7 = this.fsFactory.forRequest({
+          const fs8 = this.fsFactory.forRequest({
             originatorClientId: conn.clientId,
             route: `ACP ${method}`
           });
-          const resolved = await fs7.resolve(p, "write");
-          const result = await fs7.edit(
+          const resolved = await fs8.resolve(p, "write");
+          const result = await fs8.edit(
             resolved,
             params["oldText"],
             params["newText"]
@@ -13935,7 +13943,7 @@ function mountAcpHttp(app, bridge, opts) {
   if (!enabled) return void 0;
   const daemonEnv = opts.daemonEnv ?? process.env;
   const getPrimaryEnv = /* @__PURE__ */ __name(() => opts.workspaceRegistry ? runtimeEffectiveEnv(opts.workspaceRegistry.primary, daemonEnv) : daemonEnv, "getPrimaryEnv");
-  const path14 = opts.path ?? "/acp";
+  const path15 = opts.path ?? "/acp";
   const dispatcherRef = {};
   let disposed = false;
   const rejectIfDisposed = /* @__PURE__ */ __name((res) => {
@@ -14107,7 +14115,7 @@ function mountAcpHttp(app, bridge, opts) {
   const primaryMount = {
     primary: true,
     workspaceCwd: opts.boundWorkspace,
-    routeLabel: logSafe(path14),
+    routeLabel: logSafe(path15),
     rateLimitScope: opts.workspaceRegistry?.primary.workspaceId ?? "primary",
     registry,
     dispatcher,
@@ -14261,7 +14269,7 @@ function mountAcpHttp(app, bridge, opts) {
     });
   }, "handleAcpPost");
   app.post(
-    path14,
+    path15,
     (req, res) => handleAcpPost(primaryMount, req, res)
   );
   const handleAcpGet = /* @__PURE__ */ __name((mount, req, res) => {
@@ -14359,10 +14367,10 @@ function mountAcpHttp(app, bridge, opts) {
       onPumpSettled();
     });
   }, "handleAcpGet");
-  app.get(path14, (req, res) => {
+  app.get(path15, (req, res) => {
     handleAcpGet(primaryMount, req, res);
   });
-  app.delete(path14, (req, res) => {
+  app.delete(path15, (req, res) => {
     handleAcpDelete(primaryMount, req, res);
   });
   const createSecondaryAcpMount = /* @__PURE__ */ __name((rt) => {
@@ -14564,7 +14572,7 @@ function mountAcpHttp(app, bridge, opts) {
       const isPluralAcpShape = pluralRawSelector !== null;
       const pluralVoiceRawSelector = opts.workspaceVoiceConnection ? pluralWorkspaceRawSelector(rawPath, PLURAL_VOICE_WS_SUFFIX) : null;
       const isPluralVoiceShape = pluralVoiceRawSelector !== null;
-      if (rawPath !== path14 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
+      if (rawPath !== path15 && !isCdpPath && !extraRoute && !isPluralAcpShape && !isPluralVoiceShape) {
         logReject(`unknown-path ${logSafe(rawPath)}`);
         socket.destroy();
         return;
@@ -15101,7 +15109,7 @@ function mountAcpHttp(app, bridge, opts) {
       });
     }, "upgradeListener");
     httpServer.on("upgrade", upgradeListener);
-    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path14}`);
+    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path15}`);
   }
   __name(setupWebSocket, "setupWebSocket");
   return {
@@ -15930,7 +15938,8 @@ function registerDaemonStatusRoutes(app, deps) {
           getChannelWorkerSnapshots: deps.getChannelWorkerSnapshots,
           getPerfSnapshot: deps.getPerfSnapshot,
           getMetricsSeries: deps.getMetricsSeries,
-          getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot
+          getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot,
+          getChildHeapPolicySnapshot: deps.getChildHeapPolicySnapshot
         })
       );
     } catch (err) {
@@ -16625,19 +16634,32 @@ function createHealthDemoRoutes(deps) {
       let sessions = 0;
       let pendingPermissions = 0;
       let activePrompts = 0;
+      let activeWork = false;
       let channelAlive = false;
       let lastActivity = null;
+      let coveredSessions = 0;
+      let sessionsOnNegotiatedChannel = 0;
+      let oldestReportAt = null;
       for (const runtime of runtimes) {
         failedWorkspaceId = runtime.workspaceId;
         const bridge = runtime.bridge;
         const runtimeSessions = bridge.sessionCount;
         const runtimePendingPermissions = bridge.pendingPermissionCount;
         const runtimeActivePrompts = bridge.activePromptCount;
+        const runtimeActiveWork = bridge.activeWork;
+        const runtimeCoverage = bridge.activeWorkCoverage;
+        const runtimeOldestReportAt = runtimeCoverage.oldestCoveredReportAt;
         const runtimeChannelAlive = bridge.isChannelLive();
         const runtimeLastActivity = bridge.lastActivityAt;
         sessions += runtimeSessions;
         pendingPermissions += runtimePendingPermissions;
         activePrompts += runtimeActivePrompts;
+        activeWork = activeWork || runtimeActiveWork;
+        coveredSessions += runtimeCoverage.covered;
+        sessionsOnNegotiatedChannel += runtimeCoverage.onNegotiatedChannel;
+        if (runtimeOldestReportAt !== null && (oldestReportAt === null || runtimeOldestReportAt < oldestReportAt)) {
+          oldestReportAt = runtimeOldestReportAt;
+        }
         channelAlive = channelAlive || runtimeChannelAlive;
         if (runtimeLastActivity !== null && (lastActivity === null || runtimeLastActivity > lastActivity)) {
           lastActivity = runtimeLastActivity;
@@ -16652,6 +16674,17 @@ function createHealthDemoRoutes(deps) {
         sessions,
         pendingPermissions,
         activePrompts,
+        activeWork,
+        activeWorkReporting: gradeActiveWorkCoverage({
+          total: sessions,
+          covered: coveredSessions,
+          onNegotiatedChannel: sessionsOnNegotiatedChannel
+        }),
+        // 0 rather than null when nothing is covered: an idle daemon with no
+        // sessions must not read as infinitely stale to a controller applying
+        // its own freshness floor. `oldestReportAt` is the oldest *covered*
+        // report, so this never disagrees with the grade above.
+        activeWorkStaleMs: oldestReportAt === null ? 0 : now - oldestReportAt,
         connectedClients: getActiveSseCount2(),
         channelAlive,
         lastActivityAt: lastActivity !== null ? new Date(lastActivity).toISOString() : null,
@@ -17177,6 +17210,10 @@ __name(registerWorkspaceAuthRoutes, "registerWorkspaceAuthRoutes");
 // packages/cli/src/serve/routes/workspace-extensions.ts
 init_esbuild_shims();
 import * as crypto2 from "node:crypto";
+import * as fs4 from "node:fs/promises";
+import * as os from "node:os";
+import * as path9 from "node:path";
+var import_express2 = __toESM(require_express(), 1);
 
 // packages/cli/src/serve/extension-operation-scheduler.ts
 init_esbuild_shims();
@@ -17258,6 +17295,7 @@ var MAX_UNFINISHED_EXTENSION_OPERATIONS = 10;
 var sanitizeDaemonMessage = /* @__PURE__ */ __name((message) => redactUrlCredentials(stripAnsiAndControl(message)), "sanitizeDaemonMessage");
 var redactExtensionDisplaySource = /* @__PURE__ */ __name((source) => {
   const redacted = redactUrlCredentials(source);
+  if (redacted.startsWith("upload:")) return redacted;
   if (/^[A-Za-z]:[\\/]/.test(redacted)) return redacted;
   try {
     const url = new URL(redacted);
@@ -17947,6 +17985,39 @@ var EXTENSION_PREPARE_DEADLINE_MS = 10 * 6e4;
 var EXTENSION_INTERACTION_DEADLINE_MS = 10 * 6e4;
 var EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS = EXTENSION_PREPARE_DEADLINE_MS + EXTENSION_INTERACTION_DEADLINE_MS;
 var EXTENSION_UPDATE_CHECK_DEADLINE_MS = 2 * 6e4;
+var EXTENSION_ARCHIVE_UPLOAD_LIMIT = "10mb";
+var extensionArchiveBodyParser = import_express2.default.raw({
+  type: "application/octet-stream",
+  limit: EXTENSION_ARCHIVE_UPLOAD_LIMIT
+});
+var parseExtensionArchiveFilename = /* @__PURE__ */ __name((value) => {
+  const invalidCharacter = typeof value === "string" && Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return character === "/" || character === "\\" || code < 32 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || Buffer.byteLength(value, "utf8") > 255 || invalidCharacter) {
+    return null;
+  }
+  const lower = value.toLowerCase();
+  if (lower.endsWith(".tar.gz")) return { filename: value, suffix: ".tar.gz" };
+  if (lower.endsWith(".zip")) return { filename: value, suffix: ".zip" };
+  return null;
+}, "parseExtensionArchiveFilename");
+var extensionArchiveUploadMetadata = /* @__PURE__ */ __name((req, res, next) => {
+  if (req.query["consent"] !== "true") {
+    res.status(400).json({
+      error: "Extension installation requires explicit consent"
+    });
+    return;
+  }
+  if (!parseExtensionArchiveFilename(req.query["filename"])) {
+    res.status(400).json({
+      error: "`filename` must name a .zip or .tar.gz archive"
+    });
+    return;
+  }
+  next();
+}, "extensionArchiveUploadMetadata");
 var parseExtensionScope = /* @__PURE__ */ __name((body, res) => {
   const scope = body["scope"];
   if (scope !== "user" && scope !== "workspace") {
@@ -18388,6 +18459,127 @@ function registerWorkspaceExtensionRoutes(app, deps) {
         }
       }
     );
+    app.post(
+      `${base}/install-archive`,
+      mutate({ strict: true }),
+      extensionArchiveUploadMetadata,
+      extensionArchiveBodyParser,
+      async (req, res) => {
+        const ctrl = resolve5(req, res, true);
+        if (!ctrl) return;
+        try {
+          if (!ctrl.validateExtensionMutationClient(req, res, {
+            requireClientId: false
+          })) {
+            return;
+          }
+          const archiveName = parseExtensionArchiveFilename(
+            req.query["filename"]
+          );
+          if (!req.is("application/octet-stream")) {
+            res.status(415).json({
+              error: "Extension archive uploads require application/octet-stream"
+            });
+            return;
+          }
+          if (!Buffer.isBuffer(req.body) || req.body.length === 0) {
+            res.status(400).json({ error: "Extension archive is empty" });
+            return;
+          }
+          let archive = req.body;
+          const source = `upload:v1:${crypto2.randomUUID()}:${archiveName.filename}`;
+          ctrl.runQueuedExtensionMutation(
+            "install",
+            { source },
+            res,
+            async (extensionManager, _signal, context, operationId) => {
+              let uploadDir;
+              const sanitizeUploadError = /* @__PURE__ */ __name((error2) => {
+                const sanitized = new Error(
+                  uploadDir ? getErrorMessage(error2).replaceAll(
+                    uploadDir,
+                    "<extension-upload-dir>"
+                  ) : "Could not create the temporary extension upload directory"
+                );
+                const code = typeof error2 === "object" && error2 !== null && "code" in error2 && typeof error2.code === "string" ? error2.code : void 0;
+                if (code) Object.assign(sanitized, { code });
+                return sanitized;
+              }, "sanitizeUploadError");
+              let result;
+              let failure;
+              try {
+                uploadDir = await fs4.mkdtemp(
+                  path9.join(os.tmpdir(), "qwen-extension-upload-")
+                );
+                const archivePath = path9.join(
+                  uploadDir,
+                  `extension${archiveName.suffix}`
+                );
+                await fs4.writeFile(archivePath, archive);
+                archive = void 0;
+                const prepared = await context.prepare(async (signal) => {
+                  supersedeActiveInstallOperations(ctrl, operationId);
+                  return await extensionManager.prepareExtensionInstall({
+                    installMetadata: { type: "local", source },
+                    localSourcePath: archivePath,
+                    initialActivation: { scope: "user" },
+                    requestConsent: /* @__PURE__ */ __name(() => Promise.resolve(), "requestConsent"),
+                    signal
+                  });
+                });
+                try {
+                  const committed = await context.commit(
+                    async (onCommitted) => await extensionManager.commitPreparedExtension(
+                      prepared,
+                      onCommitted
+                    )
+                  );
+                  result = {
+                    status: "installed",
+                    source,
+                    name: committed.identity.name,
+                    version: committed.version
+                  };
+                } finally {
+                  await extensionManager.disposePreparedExtension(prepared);
+                }
+              } catch (error2) {
+                failure = sanitizeUploadError(error2);
+              }
+              if (uploadDir) {
+                try {
+                  await fs4.rm(uploadDir, { recursive: true, force: true });
+                } catch (error2) {
+                  failure ??= sanitizeUploadError(error2);
+                }
+              }
+              if (failure) throw failure;
+              return result;
+            },
+            {
+              createManager: /* @__PURE__ */ __name((operationId) => ctrl.createExtensionManager(
+                void 0,
+                void 0,
+                extensionInteractionHandlers(ctrl, operationId)
+              ), "createManager"),
+              onSettled: /* @__PURE__ */ __name((operationId) => {
+                supersededInstallOperations.delete(operationId);
+                cancelPendingExtensionInteraction(
+                  operationId,
+                  "Extension operation ended"
+                );
+              }, "onSettled"),
+              deadlineMs: EXTENSION_INTERACTIVE_PREPARE_DEADLINE_MS,
+              ...globalReconciliationOptions()
+            }
+          );
+        } catch (err) {
+          sendBridgeError2(res, err, {
+            route: `POST ${base}/install-archive`
+          });
+        }
+      }
+    );
     app.post(`${base}/install`, mutate({ strict: true }), async (req, res) => {
       const ctrl = resolve5(req, res, true);
       if (!ctrl) return;
@@ -19621,13 +19813,13 @@ async function handlePostFileWrite(req, res, deps) {
     req
   );
   if (originatorClientId === null) return;
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "write");
-    const out = await fs7.writeTextAtomic(resolved, content, {
+    const resolved = await fs8.resolve(queryPath, "write");
+    const out = await fs8.writeTextAtomic(resolved, content, {
       mode,
       ...expectedHash ? { expectedHash } : {},
       ...bom !== void 0 ? { bom } : {},
@@ -19680,13 +19872,13 @@ async function handlePostFileEdit(req, res, deps) {
     req
   );
   if (originatorClientId === null) return;
-  const fs7 = factory.forRequest({
+  const fs8 = factory.forRequest({
     originatorClientId,
     route: ROUTE2
   });
   try {
-    const resolved = await fs7.resolve(queryPath, "edit");
-    const out = await fs7.editAtomic(resolved, oldText, newText, {
+    const resolved = await fs8.resolve(queryPath, "edit");
+    const out = await fs8.editAtomic(resolved, oldText, newText, {
       expectedHash
     });
     applyReadHeaders(res);
@@ -20337,8 +20529,8 @@ function decodePathSegment(value) {
 }
 __name(decodePathSegment, "decodePathSegment");
 function matchLegacySessionTelemetryRoute(method, requestPath) {
-  const path14 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
-  const requestSegments = path14.split("/").slice(1);
+  const path15 = requestPath.length > 1 && requestPath.endsWith("/") ? requestPath.slice(0, -1) : requestPath;
+  const requestSegments = path15.split("/").slice(1);
   const prefix = requestSegments[0]?.toLowerCase();
   if (prefix !== "session" && prefix !== "sessions" && prefix !== "permission") {
     return void 0;
@@ -20390,23 +20582,23 @@ __name(setDaemonTelemetryWorkspace, "setDaemonTelemetryWorkspace");
 function resolveDaemonTelemetryRoute(req) {
   const legacyRoute = matchLegacySessionTelemetryRoute(req.method, req.path);
   if (legacyRoute) return legacyRoute;
-  const path14 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "GET" && path14 === "/daemon/status") {
+  const path15 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "GET" && path15 === "/daemon/status") {
     return { route: "GET /daemon/status" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path14)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path15)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path14)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/sessions$/.test(path15)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path14)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/session-info$/.test(path15)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path14)) {
+  if (req.method === "GET" && /^\/workspaces\/[^/]+\/session-info$/.test(path15)) {
     return { route: "GET /workspace/:id/session-info" };
   }
-  const workspaceTranscript = path14.match(
+  const workspaceTranscript = path15.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/transcript$/
   );
   if (workspaceTranscript?.[1] && req.method === "GET") {
@@ -20415,7 +20607,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceTranscript[1])
     };
   }
-  const workspaceExport = path14.match(
+  const workspaceExport = path15.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
   );
   if (workspaceExport?.[1] && req.method === "GET") {
@@ -20424,7 +20616,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceExport[1])
     };
   }
-  const workspaceArchivedExport = path14.match(
+  const workspaceArchivedExport = path15.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/archive\/export$/
   );
   if (workspaceArchivedExport?.[1] && req.method === "GET") {
@@ -20434,8 +20626,8 @@ function resolveDaemonTelemetryRoute(req) {
     };
   }
   const pluralWorkspacePrefix = /^\/workspaces\/[^/]+/;
-  if (pluralWorkspacePrefix.test(path14)) {
-    const suffix = path14.replace(pluralWorkspacePrefix, "/workspace");
+  if (pluralWorkspacePrefix.test(path15)) {
+    const suffix = path15.replace(pluralWorkspacePrefix, "/workspace");
     if (req.method === "GET") {
       if (suffix === "/workspace/mcp" || suffix === "/workspace/skills" || suffix === "/workspace/tools" || suffix === "/workspace/providers" || suffix === "/workspace/env" || suffix === "/workspace/preflight" || suffix === "/workspace/hooks" || suffix === "/workspace/settings" || suffix === "/workspace/voice" || suffix === "/workspace/permissions" || suffix === "/workspace/trust" || suffix === "/workspace/memory" || suffix === "/workspace/agents") {
         return { route: `GET ${suffix}` };
@@ -20494,58 +20686,58 @@ function resolveDaemonTelemetryRoute(req) {
       return { route: "DELETE /workspace/session-groups/:groupId" };
     }
   }
-  if (req.method === "POST" && path14 === "/workspace/init") {
+  if (req.method === "POST" && path15 === "/workspace/init") {
     return { route: "POST /workspace/init" };
   }
-  if (req.method === "POST" && path14 === "/workspace/setup-github") {
+  if (req.method === "POST" && path15 === "/workspace/setup-github") {
     return { route: "POST /workspace/setup-github" };
   }
-  if (req.method === "POST" && path14 === "/workspace/reload") {
+  if (req.method === "POST" && path15 === "/workspace/reload") {
     return { route: "POST /workspace/reload" };
   }
-  const mcpRestart = path14.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  const mcpRestart = path15.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
   if (mcpRestart?.[1] && req.method === "POST") {
     return { route: "POST /workspace/mcp/:server/restart" };
   }
-  if (req.method === "POST" && path14 === "/workspace/mcp/servers") {
+  if (req.method === "POST" && path15 === "/workspace/mcp/servers") {
     return { route: "POST /workspace/mcp/servers" };
   }
-  const mcpDelete = path14.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  const mcpDelete = path15.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
   if (mcpDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/mcp/servers/:name" };
   }
-  if (req.method === "POST" && path14 === "/workspace/auth/device-flow") {
+  if (req.method === "POST" && path15 === "/workspace/auth/device-flow") {
     return { route: "POST /workspace/auth/device-flow" };
   }
-  const deviceFlowDelete = path14.match(
+  const deviceFlowDelete = path15.match(
     /^\/workspace\/auth\/device-flow\/([^/]+)$/
   );
   if (deviceFlowDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/auth/device-flow/:id" };
   }
-  const toolEnable = path14.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  const toolEnable = path15.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
   if (toolEnable?.[1] && req.method === "POST") {
     return { route: "POST /workspace/tools/:name/enable" };
   }
-  if (path14 === "/workspace/settings") {
+  if (path15 === "/workspace/settings") {
     if (req.method === "GET") return { route: "GET /workspace/settings" };
     if (req.method === "POST") return { route: "POST /workspace/settings" };
   }
-  if (path14 === "/workspace/permissions") {
+  if (path15 === "/workspace/permissions") {
     if (req.method === "GET") return { route: "GET /workspace/permissions" };
     if (req.method === "POST") return { route: "POST /workspace/permissions" };
   }
-  if (path14 === "/workspace/trust") {
+  if (path15 === "/workspace/trust") {
     if (req.method === "GET") return { route: "GET /workspace/trust" };
   }
-  if (req.method === "POST" && path14 === "/workspace/trust/request") {
+  if (req.method === "POST" && path15 === "/workspace/trust/request") {
     return { route: "POST /workspace/trust/request" };
   }
-  if (path14 === "/workspace/voice") {
+  if (path15 === "/workspace/voice") {
     if (req.method === "GET") return { route: "GET /workspace/voice" };
     if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  if (req.method === "POST" && path14 === "/workspace/voice/transcribe") {
+  if (req.method === "POST" && path15 === "/workspace/voice/transcribe") {
     return { route: "POST /workspace/voice/transcribe" };
   }
   return void 0;
@@ -20813,8 +21005,8 @@ __name(registerPermissionRoutes, "registerPermissionRoutes");
 // packages/cli/src/serve/routes/session.ts
 init_esbuild_shims();
 import * as crypto3 from "node:crypto";
-import * as fs5 from "node:fs";
-import * as path9 from "node:path";
+import * as fs6 from "node:fs";
+import * as path10 from "node:path";
 
 // packages/cli/src/serve/server/prompt-deadline.ts
 init_esbuild_shims();
@@ -21505,7 +21697,7 @@ __name(deleteBranch, "deleteBranch");
 
 // packages/cli/src/serve/virtual-subagent-sessions.ts
 init_esbuild_shims();
-import * as fs4 from "node:fs/promises";
+import * as fs5 from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import readline from "node:readline";
 var PREFIX = "subagent.";
@@ -21699,7 +21891,7 @@ var VirtualSubagentTarget = class _VirtualSubagentTarget {
   async readNewRecords(endOffset) {
     let handle;
     try {
-      handle = await fs4.open(this.task.outputFile, "r");
+      handle = await fs5.open(this.task.outputFile, "r");
       const stat3 = await handle.stat();
       const identity = `${stat3.dev}:${stat3.ino}`;
       if (this.transcriptIdentity !== void 0 && this.transcriptIdentity !== identity || stat3.size < this.offset) {
@@ -21743,7 +21935,7 @@ var VirtualSubagentTarget = class _VirtualSubagentTarget {
     const filePath = `${this.task.outputFile}.stream`;
     let handle;
     try {
-      handle = await fs4.open(filePath, "r");
+      handle = await fs5.open(filePath, "r");
       const stat3 = await handle.stat();
       const identity = `${stat3.dev}:${stat3.ino}`;
       if (this.streamIdentity !== void 0 && this.streamIdentity !== identity) {
@@ -21908,7 +22100,7 @@ var VirtualSubagentTarget = class _VirtualSubagentTarget {
   async captureReadBounds() {
     const size = /* @__PURE__ */ __name(async (filePath) => {
       try {
-        return (await fs4.stat(filePath)).size;
+        return (await fs5.stat(filePath)).size;
       } catch (error2) {
         if (error2.code === "ENOENT") return 0;
         throw error2;
@@ -22037,7 +22229,7 @@ var VirtualSubagentSessions = class {
     const sessionDir = getSubagentSessionDir(projectDir, parentSessionId);
     let names;
     try {
-      names = await fs4.readdir(sessionDir);
+      names = await fs5.readdir(sessionDir);
     } catch (error2) {
       if (error2.code === "ENOENT") return void 0;
       throw error2;
@@ -22093,7 +22285,7 @@ var VirtualSubagentSessions = class {
     const sessionDir = getSubagentSessionDir(projectDir, parentSessionId);
     let names;
     try {
-      names = await fs4.readdir(sessionDir);
+      names = await fs5.readdir(sessionDir);
     } catch (error2) {
       if (error2.code === "ENOENT") return void 0;
       throw error2;
@@ -22239,7 +22431,7 @@ var GIT_RESERVED_BRANCH = "HEAD";
 var MAX_BRANCH_NAME_BYTES = 1e3;
 var MAX_BRANCH_COMPONENT_BYTES = 200;
 var HTTP_SESSION_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
+var WORKSPACE_TRANSCRIPT_RESPONSE_MAX_BYTES = 2 * SESSION_TRANSCRIPT_MAX_EXPANDED_PAGE_BYTES;
 var WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES = 64 * 1024;
 var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exceeds the safe limit";
 var CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS = 6e4;
@@ -22582,7 +22774,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceParam = req.params[paramName] ?? "";
     const byId = workspaceRegistry.getByWorkspaceId(workspaceParam);
     if (byId) return byId;
-    if (!path9.isAbsolute(workspaceParam)) {
+    if (!path10.isAbsolute(workspaceParam)) {
       res.status(400).json({
         error: `\`:${paramName}\` must decode to a workspace id or absolute path`
       });
@@ -23473,7 +23665,7 @@ function registerSessionRoutes(app, deps) {
       if (worktreeMeta) {
         try {
           const createAllowedRoots = [
-            path9.join(workspaceCwd, ".qwen", "worktrees")
+            path10.join(workspaceCwd, ".qwen", "worktrees")
           ];
           let createRepoTop = null;
           try {
@@ -23484,7 +23676,7 @@ function registerSessionRoutes(app, deps) {
           }
           if (createRepoTop && createRepoTop !== workspaceCwd) {
             createAllowedRoots.push(
-              path9.join(createRepoTop, ".qwen", "worktrees")
+              path10.join(createRepoTop, ".qwen", "worktrees")
             );
           }
           await runtime.bridge.changeSessionCwd(session.sessionId, {
@@ -23783,10 +23975,10 @@ function registerSessionRoutes(app, deps) {
         if (sidecar) {
           let realTarget;
           const candidateRoots = [
-            path9.join(workspaceCwd, ".qwen", "worktrees")
+            path10.join(workspaceCwd, ".qwen", "worktrees")
           ];
           try {
-            realTarget = fs5.realpathSync(sidecar.worktreePath);
+            realTarget = fs6.realpathSync(sidecar.worktreePath);
             let repoTop = null;
             try {
               repoTop = await new GitWorktreeService(
@@ -23795,13 +23987,13 @@ function registerSessionRoutes(app, deps) {
             } catch {
             }
             if (repoTop && repoTop !== workspaceCwd) {
-              candidateRoots.push(path9.join(repoTop, ".qwen", "worktrees"));
+              candidateRoots.push(path10.join(repoTop, ".qwen", "worktrees"));
             }
             const contained = candidateRoots.some((root) => {
               try {
-                const realRoot = fs5.realpathSync(root);
-                const rel = path9.relative(realRoot, realTarget);
-                return !rel.startsWith("..") && !path9.isAbsolute(rel);
+                const realRoot = fs6.realpathSync(root);
+                const rel = path10.relative(realRoot, realTarget);
+                return !rel.startsWith("..") && !path10.isAbsolute(rel);
               } catch {
                 return false;
               }
@@ -24117,7 +24309,7 @@ function registerSessionRoutes(app, deps) {
       async (req, res, sessionId, runtime) => {
         const body = safeBody(req);
         const targetPath = body["path"];
-        if (typeof targetPath !== "string" || targetPath.length === 0 || !path9.isAbsolute(targetPath)) {
+        if (typeof targetPath !== "string" || targetPath.length === 0 || !path10.isAbsolute(targetPath)) {
           res.status(400).json({
             error: "`path` is required and must be an absolute path",
             code: "invalid_path"
@@ -27151,7 +27343,7 @@ __name(registerUsageStatsRoutes, "registerUsageStatsRoutes");
 // packages/cli/src/serve/scheduled-task-keepalive.ts
 init_esbuild_shims();
 import * as fsSync from "node:fs";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var log = createDebugLogger("SCHED_KEEPALIVE");
 function collectBoundSessionIds(tasks) {
   const seen = /* @__PURE__ */ new Set();
@@ -27377,8 +27569,8 @@ function startScheduledTaskKeepalive(opts) {
     opts.runtimeBaseDir,
     () => getCronFilePath(boundWorkspace)
   );
-  const cronDir = path10.dirname(cronFilePath);
-  const cronFileName = path10.basename(cronFilePath);
+  const cronDir = path11.dirname(cronFilePath);
+  const cronFileName = path11.basename(cronFilePath);
   let fileWatcher;
   try {
     fsSync.mkdirSync(cronDir, { recursive: true });
@@ -30323,7 +30515,7 @@ __name(registerWorkspaceModelsRoutes, "registerWorkspaceModelsRoutes");
 // packages/cli/src/serve/routes/a2ui-action.ts
 init_esbuild_shims();
 import * as fsp4 from "node:fs/promises";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var A2UI_MIME = "application/a2ui+json";
 var ACTION_TOOL = "action";
 var CALL_TIMEOUT_MS = 15e3;
@@ -30346,7 +30538,7 @@ __name(usableServerConfig, "usableServerConfig");
 async function findFromSettingsFile(workspaceCwd) {
   try {
     const raw = await fsp4.readFile(
-      path11.join(workspaceCwd, ".qwen", "settings.json"),
+      path12.join(workspaceCwd, ".qwen", "settings.json"),
       "utf8"
     );
     const settings = JSON.parse(raw);
@@ -30507,7 +30699,7 @@ __name(registerA2uiActionRoutes, "registerA2uiActionRoutes");
 
 // packages/cli/src/serve/server/fs-factory.ts
 init_esbuild_shims();
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 var IDE_WORKSPACE_PATH_ENV_VAR = "QWEN_CODE_IDE_WORKSPACE_PATH";
 function createDefaultFsAuditEmit() {
   const WARN_EVERY = 100;
@@ -30582,14 +30774,14 @@ function parseIdeWorkspacePathEnv(value) {
       const parsed = JSON.parse(value);
       if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
         return parsed.filter(
-          (workspace) => workspace.length > 0 && path12.isAbsolute(workspace)
+          (workspace) => workspace.length > 0 && path13.isAbsolute(workspace)
         );
       }
       throw new Error("IDE workspace path JSON must be a string array");
     } catch {
     }
   }
-  return value.split(path12.delimiter).filter((workspace) => workspace.length > 0 && path12.isAbsolute(workspace));
+  return value.split(path13.delimiter).filter((workspace) => workspace.length > 0 && path13.isAbsolute(workspace));
 }
 __name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
 function dropNestedWorkspacesPreservingPrimary(workspaces) {
@@ -30858,9 +31050,9 @@ __name(setupDeviceFlowRegistry, "setupDeviceFlowRegistry");
 
 // packages/cli/src/serve/server/error-handlers.ts
 init_esbuild_shims();
-var import_express2 = __toESM(require_express(), 1);
+var import_express3 = __toESM(require_express(), 1);
 function installJsonBodyParser(app) {
-  app.use(import_express2.default.json({ limit: "10mb" }));
+  app.use(import_express3.default.json({ limit: "10mb" }));
   app.use((err, _req, res, next) => {
     if (sendJsonBodyParserError(res, err)) return;
     next(err);
@@ -30914,10 +31106,10 @@ function installRateLimiter(app, opts, daemonLog, options = {}) {
         { tier, key: key.slice(0, 64) }
       );
     } : void 0,
-    onError: daemonLog ? (err, path14) => {
+    onError: daemonLog ? (err, path15) => {
       daemonLog.warn(
         `rate limiter error (fail-open): ${err instanceof Error ? err.message : String(err)}`,
-        { path: path14 }
+        { path: path15 }
       );
     } : void 0
   });
@@ -31113,7 +31305,7 @@ __name(registerWorkspaceQualifiedLifecycleRoutes, "registerWorkspaceQualifiedLif
 init_esbuild_shims();
 import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
 import { realpathSync as realpathSync3 } from "node:fs";
-import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join7, resolve as resolve4, sep as sep3 } from "node:path";
+import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute7, join as join8, resolve as resolve4, sep as sep3 } from "node:path";
 
 // packages/cli/src/serve/native-directory-picker.ts
 init_esbuild_shims();
@@ -31499,7 +31691,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
         return;
       }
       const endsWithSep = prefix.endsWith("/") || process.platform === "win32" && prefix.endsWith("\\");
-      const dir = endsWithSep ? join7(prefix, ".") : dirname4(prefix);
+      const dir = endsWithSep ? join8(prefix, ".") : dirname4(prefix);
       const filter = endsWithSep ? "" : basename4(prefix);
       const filterLower = filter.toLowerCase();
       const suggestions = [];
@@ -31515,7 +31707,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
           let isDir = entry.isDirectory();
           if (!isDir && entry.isSymbolicLink()) {
             try {
-              isDir = (await stat2(join7(dir, entry.name))).isDirectory();
+              isDir = (await stat2(join8(dir, entry.name))).isDirectory();
             } catch {
               continue;
             }
@@ -31525,7 +31717,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
             truncated = true;
             break;
           }
-          suggestions.push({ name: entry.name, path: join7(dir, entry.name) });
+          suggestions.push({ name: entry.name, path: join8(dir, entry.name) });
         }
       } catch {
       }
@@ -31545,11 +31737,11 @@ function registerWorkspaceManagementRoutes(app, deps) {
       const controller = new AbortController();
       res.on("close", () => controller.abort());
       try {
-        const path14 = await pickWorkspaceDirectory(controller.signal);
+        const path15 = await pickWorkspaceDirectory(controller.signal);
         res.status(200).json({
           kind: "workspace-directory-picker",
-          selected: path14 !== void 0,
-          ...path14 === void 0 ? {} : { path: path14 }
+          selected: path15 !== void 0,
+          ...path15 === void 0 ? {} : { path: path15 }
         });
       } catch (error2) {
         const detail = error2 instanceof Error ? error2.message : String(error2);
@@ -32606,8 +32798,8 @@ function buildDiffList(workspaceCwd, result) {
       hiddenCount: 0
     };
   }
-  const files = [...result.perFileStats.entries()].map(([path14, s]) => ({
-    path: path14,
+  const files = [...result.perFileStats.entries()].map(([path15, s]) => ({
+    path: path15,
     oldPath: s.oldPath,
     added: s.added,
     removed: s.removed,
@@ -34696,18 +34888,43 @@ function parsePairingCode(body, res) {
   return code.trim().toUpperCase();
 }
 __name(parsePairingCode, "parsePairingCode");
-function parsePairingSenderId(body, res) {
+function parsePairingApprovalSubject(body, res) {
   const senderId = body["senderId"];
-  if (typeof senderId !== "string" || senderId.length === 0) {
+  const groupId = body["groupId"];
+  if (senderId !== void 0 && groupId !== void 0) {
+    res.status(400).json({
+      error: "Provide exactly one of `senderId` or `groupId`.",
+      code: "invalid_channel_pairing_subject"
+    });
+    return void 0;
+  }
+  if (senderId !== void 0) {
+    if (typeof senderId === "string" && senderId.length > 0) {
+      return { type: "user", id: senderId };
+    }
     res.status(400).json({
       error: "`senderId` must be a non-empty string.",
       code: "invalid_channel_pairing_sender_id"
     });
     return void 0;
   }
-  return senderId;
+  if (groupId !== void 0) {
+    if (typeof groupId === "string" && groupId.length > 0) {
+      return { type: "group", id: groupId };
+    }
+    res.status(400).json({
+      error: "`groupId` must be a non-empty string.",
+      code: "invalid_channel_pairing_group_id"
+    });
+    return void 0;
+  }
+  res.status(400).json({
+    error: "Provide exactly one of `senderId` or `groupId`.",
+    code: "invalid_channel_pairing_subject"
+  });
+  return void 0;
 }
-__name(parsePairingSenderId, "parsePairingSenderId");
+__name(parsePairingApprovalSubject, "parsePairingApprovalSubject");
 function errorCode2(error2) {
   if (!error2 || typeof error2 !== "object") return void 0;
   try {
@@ -34881,11 +35098,11 @@ function registerWorkspaceChannelManagementRoutes(app, deps) {
         if (!resolved || !validateClient(req, res, resolved.runtime)) return;
         const name = parseInstanceName(req, res);
         if (!name) return;
-        const senderId = parsePairingSenderId(deps.safeBody(req), res);
-        if (!senderId) return;
+        const subject = parsePairingApprovalSubject(deps.safeBody(req), res);
+        if (!subject) return;
         try {
           noStore(res);
-          res.status(200).json(await resolved.service.revokePairingApproval(name, senderId));
+          res.status(200).json(await resolved.service.revokePairingApproval(name, subject));
         } catch (error2) {
           sendManagementError(res, error2);
         }
@@ -35489,7 +35706,7 @@ __name(registerWorkspaceQualifiedSkillsRoutes, "registerWorkspaceQualifiedSkills
 
 // packages/cli/src/serve/routes/channel-webhooks.ts
 init_esbuild_shims();
-var import_express3 = __toESM(require_express(), 1);
+var import_express4 = __toESM(require_express(), 1);
 import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
@@ -35538,7 +35755,7 @@ function registerChannelWebhookRoutes(app, deps) {
       locals.channelWebhook = { channelName, source, sourceConfig };
       next();
     },
-    import_express3.default.json({ limit: "1mb" }),
+    import_express4.default.json({ limit: "1mb" }),
     async (req, res) => {
       const locals = res.locals;
       const webhook = locals.channelWebhook;
@@ -39037,10 +39254,10 @@ __name(registerLiveSetupRoutes, "registerLiveSetupRoutes");
 init_esbuild_shims();
 import { execFile as execFile3 } from "node:child_process";
 import { createHash as createHash5, randomUUID as randomUUID11 } from "node:crypto";
-import * as fs6 from "node:fs";
+import * as fs7 from "node:fs";
 import * as fsp5 from "node:fs/promises";
-import * as os from "node:os";
-import * as path13 from "node:path";
+import * as os2 from "node:os";
+import * as path14 from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
@@ -39118,7 +39335,7 @@ async function readBundleValue(appPath, key) {
     "raw",
     "-o",
     "-",
-    path13.join(appPath, "Contents", "Info.plist")
+    path14.join(appPath, "Contents", "Info.plist")
   ]);
 }
 __name(readBundleValue, "readBundleValue");
@@ -39213,7 +39430,7 @@ async function downloadAsset(asset, destination, onProgress) {
   await pipeline(
     Readable.fromWeb(response.body),
     guard,
-    fs6.createWriteStream(destination, { flags: "wx", mode: 384 })
+    fs7.createWriteStream(destination, { flags: "wx", mode: 384 })
   );
   if (received !== asset.size || hash.digest("hex") !== asset.sha256) {
     throw new Error("Live Host checksum verification failed.");
@@ -39224,11 +39441,11 @@ async function installLatestHost(currentArchitecture, onStatus) {
   const manifest = await fetchManifest();
   const asset = manifest.assets[currentArchitecture];
   const temporaryDirectory = await fsp5.mkdtemp(
-    path13.join(os.tmpdir(), "qwen-live-host-")
+    path14.join(os2.tmpdir(), "qwen-live-host-")
   );
-  const archivePath = path13.join(temporaryDirectory, asset.name);
-  const extractedPath = path13.join(temporaryDirectory, "extracted");
-  const candidatePath = path13.join(extractedPath, LIVE_HOST_APP_NAME);
+  const archivePath = path14.join(temporaryDirectory, asset.name);
+  const extractedPath = path14.join(temporaryDirectory, "extracted");
+  const candidatePath = path14.join(extractedPath, LIVE_HOST_APP_NAME);
   const stagingPath = `/Applications/.Qwen Live Host.install-${randomUUID11()}.app`;
   const backupPath = `/Applications/.Qwen Live Host.backup-${randomUUID11()}.app`;
   let movedExisting = false;
@@ -39376,13 +39593,13 @@ var LiveHostInstaller = class {
 init_esbuild_shims();
 import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // packages/cli/src/serve/live/realtime-startup-context.ts
 init_esbuild_shims();
 import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename as basename5, join as join9 } from "node:path";
+import { basename as basename5, join as join10 } from "node:path";
 var STARTUP_CONTEXT_HEADER = "Startup context from Qwen Code.\nThis is background context about recent work and machine/workspace layout. It may be incomplete or stale. Use it to inform responses, and do not repeat it back unless relevant.";
 var CURRENT_THREAD_SECTION_TOKEN_BUDGET = 1200;
 var RECENT_WORK_SECTION_TOKEN_BUDGET = 2200;
@@ -39624,7 +39841,7 @@ function collectTreeLines(directory, depth, lines) {
     const indent = "  ".repeat(depth);
     lines.push(`${indent}- ${entry.name}${entry.isDirectory() ? "/" : ""}`);
     if (entry.isDirectory()) {
-      collectTreeLines(join9(directory, entry.name), depth + 1, lines);
+      collectTreeLines(join10(directory, entry.name), depth + 1, lines);
     }
   }
   if (entries.length > DIR_ENTRY_LIMIT) {
@@ -39743,13 +39960,13 @@ function openLiveAudioCapture(source, identifier) {
   try {
     mkdirSync2(directory, { recursive: true, mode: 448 });
     const safeIdentifier = identifier.replace(/[^A-Za-z0-9_-]/g, "_");
-    const path14 = join10(
+    const path15 = join11(
       directory,
       `${source}-${Date.now()}-${safeIdentifier}.pcm`
     );
-    const stream = createWriteStream2(path14, { flags: "wx", mode: 384 });
+    const stream = createWriteStream2(path15, { flags: "wx", mode: 384 });
     stream.on("error", () => void 0);
-    return { source, path: path14, stream, hash: createHash6("sha256"), bytes: 0 };
+    return { source, path: path15, stream, hash: createHash6("sha256"), bytes: 0 };
   } catch {
     return void 0;
   }
@@ -42115,7 +42332,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
       "createServeApp: deps.workspaceRuntimeRemoval requires the matching deps.voiceCoordinator."
     );
   }
-  const app = (0, import_express4.default)();
+  const app = (0, import_express5.default)();
   const injectedWorkspaceRegistry = deps.workspaceRegistry;
   const boundWorkspace = injectedWorkspaceRegistry?.primary.workspaceCwd ?? deps.boundWorkspace ?? canonicalizeWorkspace(opts.workspace ?? process.cwd());
   if (injectedWorkspaceRegistry) {
@@ -42292,8 +42509,9 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     // Wire the production status provider so direct embeds / tests
     // that don't inject `deps.bridge` get daemon env + preflight cells.
     statusProvider,
-    // Wire the WorkspaceFileSystem adapter so ACP writeTextFile /
-    // readTextFile pick up trust / TOCTOU / audit.
+    delegateReadTextFileToClient: false,
+    // Final ACP text writes remain delegated through WorkspaceFileSystem.
+    // Unexpected delegated reads still fail closed at the WFS boundary.
     fileSystem: createBridgeFileSystemAdapter(fsFactory),
     // Reverse tool channel: answer the child's `client_mcp/message`
     // ext-method by reaching the WS connection that hosts the named server.
@@ -42830,7 +43048,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     getChannelWorkerSnapshots: deps.getChannelWorkerSnapshots,
     getPerfSnapshot: deps.getPerfSnapshot,
     getMetricsSeries: deps.getMetricsSeries,
-    getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot ?? totalSessionAdmission?.snapshot
+    getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot ?? totalSessionAdmission?.snapshot,
+    getChildHeapPolicySnapshot: deps.getChildHeapPolicySnapshot
   });
   if (liveVoiceEnabled) {
     app.use("/capabilities", (_req, _res, next) => {