@qwen-code/qwen-code 0.22.0-nightly.20260825.22bb5e8b9f → 0.22.1

package/chunks/{run-qwen-serve-IAVPTDB7.js → run-qwen-serve-IWGPZADI.js}

@@ -3,12 +3,12 @@
 import {
   computeCpuPercent
 } from "./chunk-LBOVL47Y.js";
-import {
-  resolveServeToken
-} from "./chunk-ZELCTN6Y.js";
 import {
   RUNTIME_STARTUP_CANCELLED_MESSAGE
 } from "./chunk-QUPXZXLV.js";
+import {
+  resolveServeToken
+} from "./chunk-ZELCTN6Y.js";
 import {
   ACCESS_LOG_CONTROLLER_LOCAL,
   CAPABILITIES_SCHEMA_VERSION,
@@ -40,7 +40,7 @@ import {
   resolveAcpHttpEnabled,
   setDeferredRuntimeRequestTiming,
   toDaemonStatusMemoryLimits
-} from "./chunk-3N7EFOOM.js";
+} from "./chunk-SQPOJ4ZI.js";
 import "./chunk-VGHZT6JR.js";
 import {
   normalizeSessionIdForLookup
@@ -57,15 +57,6 @@ import "./chunk-NYWWQ437.js";
 import {
   resolveSessionRestoreTimeoutMs
 } from "./chunk-4JRM2BSM.js";
-import {
-  require_express
-} from "./chunk-AYHQZBJ4.js";
-import {
-  resolveWebShellDir
-} from "./chunk-FBX2SDQ4.js";
-import {
-  LIVE_HOST_PROTOCOL_VERSION
-} from "./chunk-NKLP3DCK.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
   DEFAULT_MAX_JOURNAL_BYTES,
@@ -75,12 +66,21 @@ import {
   normalizeMaxJournalBytes,
   normalizeMaxJournalEvents
 } from "./chunk-WCCLLK7X.js";
+import {
+  require_express
+} from "./chunk-AYHQZBJ4.js";
+import {
+  resolveWebShellDir
+} from "./chunk-FBX2SDQ4.js";
+import {
+  resolveChannelCwd
+} from "./chunk-7JPW6IYH.js";
+import {
+  LIVE_HOST_PROTOCOL_VERSION
+} from "./chunk-NKLP3DCK.js";
 import "./chunk-K6KS3LTN.js";
 import "./chunk-HMJ2P3SV.js";
 import "./chunk-7E7UCJHS.js";
-import {
-  resolveChannelCwd
-} from "./chunk-XQNWTA4Y.js";
 import {
   consumeServeFastPathRejectedLoaderKeys,
   loadServeFastPathSettings,
@@ -90,17 +90,20 @@ import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-ENZMDVCM.js";
-import "./chunk-SNJOBGQV.js";
+} from "./chunk-OQ6LTSX3.js";
+import "./chunk-ZJG323IA.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-LURJYO2T.js";
+} from "./chunk-OZ6KS6KW.js";
 import "./chunk-624NHDGB.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-6PLDPT2C.js";
-import "./chunk-D2IGZJA7.js";
+import {
+  ExtraCaInspectionError,
+  loadableCertificates
+} from "./chunk-PAJGKZAA.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
@@ -111,7 +114,7 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-IFWUT4GY.js";
+} from "./chunk-JVPFTDBK.js";
 import {
   QWEN_SERVER_TOKEN_ENV
 } from "./chunk-GYTKQYDB.js";
@@ -132,7 +135,7 @@ import {
 } from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-NFDTDV37.js";
+} from "./chunk-E55H6BZ7.js";
 import "./chunk-IW6RQPQB.js";
 import "./chunk-GOXKNSDZ.js";
 import {
@@ -145,14 +148,14 @@ import {
   scrubInheritedLoaderEnv,
   setLoaderKeyRejectionReporter
 } from "./chunk-5PA6UEYA.js";
+import {
+  getCliVersion
+} from "./chunk-6KS24S3X.js";
+import "./chunk-W3N5XAZ6.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot
 } from "./chunk-MR3PXB6E.js";
-import {
-  getCliVersion
-} from "./chunk-MGEXTDBI.js";
-import "./chunk-YLFLHKDL.js";
 import "./chunk-LJZSMWOH.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
@@ -191,9 +194,11 @@ import {
 init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
 import { X509Certificate, createHash as createHash3, timingSafeEqual } from "node:crypto";
+import { execFile } from "node:child_process";
 import * as fs from "node:fs";
 import { createServer } from "node:http";
 import * as https from "node:https";
+import { isIP } from "node:net";
 import * as path from "node:path";
 import * as os from "node:os";
 import { monitorEventLoopDelay, performance as performance2 } from "node:perf_hooks";
@@ -3282,14 +3287,453 @@ function workspaceRuntimeEffectiveEnv(runtime, daemonEnv) {
   return runtime.env.effectiveEnv ?? daemonEnv;
 }
 __name(workspaceRuntimeEffectiveEnv, "workspaceRuntimeEffectiveEnv");
-function formatChannelWorkerDaemonUrl(host, port) {
+function formatChannelWorkerDaemonUrl(host, port, tls = false) {
+  const scheme = tls ? "https" : "http";
   const normalized = host.trim().toLowerCase();
   if (normalized === "" || normalized === "0.0.0.0" || normalized === "::" || normalized === "[::]") {
-    return `http://127.0.0.1:${port}`;
+    return `${scheme}://127.0.0.1:${port}`;
   }
-  return `http://${formatHostForUrl(host)}:${port}`;
+  return `${scheme}://${formatHostForUrl(host)}:${port}`;
 }
 __name(formatChannelWorkerDaemonUrl, "formatChannelWorkerDaemonUrl");
+var WORKER_TLS_TRUST_PROBE = `
+import { isIP } from 'node:net';
+import * as tls from 'node:tls';
+const url = new URL(process.argv[1]);
+const timeoutMs = Number(process.argv[2]);
+const hostname = url.hostname.replace(/^\\[|\\]$/g, '');
+let socket;
+let settled = false;
+const finish = (result) => {
+  if (settled) return;
+  settled = true;
+  process.stdout.write(JSON.stringify(result));
+  socket?.destroy();
+};
+try {
+  socket = tls.connect({
+    host: hostname,
+    port: Number(url.port || '443'),
+    rejectUnauthorized: true,
+    ...(isIP(hostname) === 0 ? { servername: hostname } : {}),
+  }, () => finish({ ok: true }));
+  socket.once('error', (error) => finish({
+    ok: false,
+    code: error.code ?? 'WORKER_TLS_VERIFY_FAILED',
+    message: error.message,
+  }));
+  socket.setTimeout(timeoutMs, () => finish({
+    ok: false,
+    code: 'WORKER_TLS_VERIFY_TIMEOUT',
+    message: 'TLS verification probe timed out.',
+  }));
+} catch (error) {
+  finish({
+    ok: false,
+    code: error.code ?? 'WORKER_TLS_VERIFY_FAILED',
+    message: error.message,
+  });
+}
+`;
+async function verifyWorkerTlsTrust(opts) {
+  const timeoutMs = opts.timeoutMs ?? 5e3;
+  return new Promise((resolve4) => {
+    execFile(
+      process.execPath,
+      [
+        "--input-type=module",
+        "--eval",
+        WORKER_TLS_TRUST_PROBE,
+        opts.daemonUrl,
+        String(timeoutMs)
+      ],
+      {
+        env: {
+          ...process.env,
+          NODE_EXTRA_CA_CERTS: opts.caCertPath
+        },
+        encoding: "utf8",
+        timeout: timeoutMs + 1e3
+      },
+      (error, stdout) => {
+        try {
+          const result = JSON.parse(stdout);
+          resolve4(result.ok ? void 0 : result);
+        } catch {
+          const failure = error;
+          resolve4({
+            code: failure?.code != null ? String(failure.code) : "WORKER_TLS_VERIFY_FAILED",
+            message: failure?.message ?? "TLS verification probe failed."
+          });
+        }
+      }
+    );
+  });
+}
+__name(verifyWorkerTlsTrust, "verifyWorkerTlsTrust");
+function describeWorkerTlsTrustGaps(opts) {
+  const chain = parseCertChain(opts.cert);
+  const x509 = bootParsedLeaf(opts.cert);
+  if (!x509) {
+    return [];
+  }
+  const gaps = [];
+  const operatorChain = opts.operatorCaCert ? loadableCertificates(
+    opts.operatorCaCert.toString("utf8"),
+    opts.operatorCaCertSourcePath
+  ) : void 0;
+  const servingBlocks = loadableCertificates(
+    opts.cert.toString("utf8"),
+    opts.certSourcePath
+  );
+  const operatorDiscarded = !servingBlocks && operatorChain !== void 0;
+  const servingChain = servingBlocks === void 0 ? [
+    x509,
+    ...chain.filter(
+      (member) => member.fingerprint256 !== x509.fingerprint256
+    )
+  ] : (
+    // The loader can read blocks out of the file and still not read the
+    // block the daemon SERVES — a leaf exported by `openssl x509
+    // -trustout` carries the `TRUSTED CERTIFICATE` label, which is not one
+    // the loader takes a certificate from, so a `trusted leaf + plain root`
+    // serving file yields `servingBlocks = [root]`. Starting the walk at
+    // that root put it at depth 0, where the leaf-depth exemption below
+    // waives the CA-capability check, and the walk returned anchored with
+    // zero gaps: measured `gaps: []` at boot for a CA:FALSE root
+    // (handshake INVALID_PURPOSE) and for a CA:TRUE root without
+    // keyCertSign (handshake UNSPECIFIED), while `createSecureContext`
+    // accepts the file and the daemon boots green and silent.
+    //
+    // So anchor the walk at the certificate boot parsed, the way the
+    // `servingBlocks === undefined` fallback above already does; the
+    // remaining blocks supply the rest of the chain.
+    servingBlocks.some(
+      (block) => block.fingerprint256 === x509.fingerprint256
+    ) ? servingBlocks : [x509, ...servingBlocks]
+  );
+  const leafHeldByWorkers = servingBlocks !== void 0 && servingBlocks.some((block) => block.fingerprint256 === x509.fingerprint256);
+  const workerTrustStore = operatorChain && servingBlocks ? [...operatorChain, ...servingChain] : servingChain;
+  const anchorPath = walkWorkerAnchorPath(
+    x509,
+    workerTrustStore,
+    // The `servingBlocks === undefined` fallback prepends the leaf too, but
+    // that file already reports its own gap below and the workers receive it
+    // verbatim; only the partial-read case needs the distinction.
+    servingBlocks === void 0 || leafHeldByWorkers
+  );
+  if (opts.operatorCaCertReadError !== void 0) {
+    const servingFallbackAnchors = anchorPath.anchored && servingBlocks !== void 0;
+    gaps.push(
+      `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" could not be read by the daemon (${opts.operatorCaCertReadError}), so channel workers receive no CA from it \u2014 a root-owned or mode-600 file is the usual cause, and its contents are not the problem. ` + (servingFallbackAnchors ? `--tls-cert "${opts.certPath}" carries an anchor of its own, and that file is what the workers fall back to, so their trust does not rest on this one today \u2014 whatever it was meant to add reaches nobody. Fix that file's permissions or path and restart.` : servingBlocks === void 0 ? `--tls-cert "${opts.certPath}" itself holds no block the workers' loader can read, so their fallback bundle is that file alone and it anchors nothing \u2014 fixing this CA file's permissions changes nothing; re-export the serving file as the gap below describes and restart.` : `Every worker handshake to the daemon will fail UNABLE_TO_VERIFY_LEAF_SIGNATURE unless the issuing CA is already in the workers' default trust store. Fix that file's permissions or path and restart.`)
+    );
+  } else if (opts.operatorCaCert && !operatorChain) {
+    gaps.push(
+      `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" holds no PEM certificate block Node's loader can read \u2014 every -----BEGIN/END CERTIFICATE----- marker must sit alone on its own line and every block must decode, and a DER file is never read at all. Channel workers therefore receive the daemon cert alone and anchor nothing through this file. Re-export it as PEM and restart.`
+    );
+  }
+  if (!servingBlocks) {
+    gaps.push(
+      `--tls-cert "${opts.certPath}" holds no PEM certificate block Node's loader can read, so ` + (operatorDiscarded ? `the channel workers' bundle cannot be merged: they receive that file alone and NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" is discarded. ` : `the channel workers receive a bundle their loader takes nothing from. `) + `Every worker handshake to the daemon will fail UNABLE_TO_VERIFY_LEAF_SIGNATURE. Re-export --tls-cert as PEM with every -----BEGIN/END CERTIFICATE----- marker alone on its own line and restart.`
+    );
+  }
+  const leafPurposeDefect = tlsServerPurposeDefect(x509);
+  if (leafPurposeDefect) {
+    gaps.push(
+      `--tls-cert "${opts.certPath}" cannot be used as a TLS server certificate because ${leafPurposeDefect}. Every worker handshake to the daemon will fail INVALID_PURPOSE. Reissue the leaf with a TLS-server keyUsage and serverAuth extendedKeyUsage, then restart.`
+    );
+  }
+  if (anchorPath.nonCaTerminator) {
+    const terminatorSubject = anchorPath.nonCaTerminator.subject.replace(
+      /\r?\n/g,
+      ", "
+    );
+    gaps.push(
+      issuerRefusedForKeyUsage(anchorPath.nonCaTerminator) ? `--tls-cert "${opts.certPath}" chains up to "${terminatorSubject}", which is self-signed but whose keyUsage does not include keyCertSign, so OpenSSL refuses to let it issue the certificates below it however its basicConstraints reads. Every worker handshake to the daemon will fail "key usage does not include certificate signing" even though the chain terminates on a self-signed certificate. Reissue that certificate with keyCertSign in its keyUsage and restart \u2014 CA:TRUE alone does not fix it, and no NODE_EXTRA_CA_CERTS can anchor a self-signed certificate through anything but itself.` : `--tls-cert "${opts.certPath}" chains up to "${terminatorSubject}", which is self-signed but is not a CA \u2014 it carries basicConstraints CA:FALSE or, as an X.509 v3 certificate, no basicConstraints at all, and OpenSSL refuses to let it issue the certificates below it, so every worker handshake to the daemon will fail INVALID_PURPOSE ("unsuitable certificate purpose"). Reissue that certificate with CA:TRUE, or point NODE_EXTRA_CA_CERTS at a real CA that anchors the chain, and restart.`
+    );
+  } else if (anchorPath.incapableIssuer) {
+    const keyUsageIsTheCause = issuerRefusedForKeyUsage(
+      anchorPath.incapableIssuer
+    );
+    gaps.push(
+      `--tls-cert "${opts.certPath}" chains through "${anchorPath.incapableIssuer.subject.replace(/\r?\n/g, ", ")}", ` + (keyUsageIsTheCause ? `whose keyUsage does not include keyCertSign, so OpenSSL refuses to let it issue the certificate below it however its basicConstraints reads. Every worker handshake to the daemon will fail with an invalid-CA error even though the chain looks complete, and the issuing CA IS in their bundle. Reissue that intermediate with keyCertSign in its keyUsage and restart \u2014 pointing NODE_EXTRA_CA_CERTS elsewhere cannot fix it.` : `which is not a CA \u2014 it carries basicConstraints CA:FALSE or, as an X.509 v3 certificate, no basicConstraints at all, and OpenSSL refuses to let it issue the certificate below it. Every worker handshake to the daemon will fail INVALID_PURPOSE or INVALID_CA even though the chain looks complete. Reissue that intermediate with CA:TRUE, or point NODE_EXTRA_CA_CERTS at a chain whose intermediates are real CAs, and restart.`)
+    );
+  } else if (anchorPath.pathLengthViolation) {
+    const { cert, constraint } = anchorPath.pathLengthViolation;
+    gaps.push(
+      `--tls-cert "${opts.certPath}" chains through "${cert.subject.replace(/\r?\n/g, ", ")}", whose basicConstraints carries pathlen:${constraint} \u2014 it permits at most ${constraint} intermediate CA${constraint === 1 ? "" : "s"} below it, and this chain has more. Every worker handshake to the daemon will fail PATH_LENGTH_EXCEEDED even though every certificate in the bundle verifies. Reissue that CA with a pathlen that covers the chain, or shorten the chain, and restart.`
+    );
+  } else if (anchorPath.unheldSelfSignedLeaf) {
+    gaps.push(
+      `--tls-cert "${opts.certPath}" serves a self-signed certificate whose own PEM block is not one Node's NODE_EXTRA_CA_CERTS loader takes (a -----BEGIN TRUSTED CERTIFICATE----- block, as \`openssl x509 -trustout\` writes, is the usual cause), so the channel workers never receive that certificate \u2014 and a self-signed certificate verifies only when it is itself in the trust store. The daemon serves it fine, but every worker handshake will fail DEPTH_ZERO_SELF_SIGNED_CERT with nothing logged. Re-export --tls-cert with a plain -----BEGIN CERTIFICATE----- block and restart.`
+    );
+  } else if (!anchorPath.anchored) {
+    gaps.push(
+      `--tls-cert "${opts.certPath}" is issued by another CA (${x509.issuer.replace(/\r?\n/g, ", ")}), not self-signed, and ${!opts.operatorCaCertPath ? `no NODE_EXTRA_CA_CERTS is set` : opts.operatorCaCertReadError !== void 0 ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" could not be read, so whatever it carries reached nobody` : operatorDiscarded ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" was discarded together with the unloadable serving file above, whatever it carries` : `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" does not carry a certificate that anchors it`}, so nothing in the channel workers' bundle anchors their trust \u2014 every worker handshake to the daemon will fail UNABLE_TO_VERIFY_LEAF_SIGNATURE unless the issuing CA is already in the workers' default trust store. ` + (operatorDiscarded ? `Re-export --tls-cert as described above and restart; NODE_EXTRA_CA_CERTS is not the file to change.` : opts.operatorCaCertReadError !== void 0 ? `Make NODE_EXTRA_CA_CERTS readable by the daemon as described above and restart.` : `Point NODE_EXTRA_CA_CERTS at the issuing CA (for mkcert: "$(mkcert -CAROOT)/rootCA.pem") and restart.`)
+    );
+  }
+  const now = Date.now();
+  for (const member of anchorPath.path) {
+    if (member.fingerprint256 === x509.fingerprint256) continue;
+    const subject = member.subject.replace(/\r?\n/g, ", ");
+    if (member.keyUsage && !member.keyUsage.includes(TLS_SERVER_AUTH_OID)) {
+      gaps.push(
+        `--tls-cert "${opts.certPath}" chains through "${subject}", whose extendedKeyUsage does not include serverAuth \u2014 every worker handshake to the daemon will fail INVALID_PURPOSE. Reissue that chain member with serverAuth in its extendedKeyUsage and restart.`
+      );
+      continue;
+    }
+    if (new Date(member.validTo).getTime() < now) {
+      gaps.push(
+        `--tls-cert "${opts.certPath}" chains through "${subject}", which expired on ${member.validTo} \u2014 every worker handshake to the daemon will fail CERT_HAS_EXPIRED. Renew that chain member and restart.`
+      );
+    } else if (new Date(member.validFrom).getTime() > now) {
+      gaps.push(
+        `--tls-cert "${opts.certPath}" chains through "${subject}", which is not yet valid (validFrom: ${member.validFrom}) \u2014 every worker handshake to the daemon will fail CERT_NOT_YET_VALID. Check that chain member's notBefore date or the system clock.`
+      );
+    }
+  }
+  const host = workerDialHost(opts.daemonUrl);
+  if (host && !certCoversHost(x509, host)) {
+    gaps.push(
+      `--tls-cert "${opts.certPath}" has no subjectAltName covering "${host}", the host channel workers dial \u2014 every worker handshake will fail ERR_TLS_CERT_ALTNAME_INVALID. Reissue the certificate with that host in its SANs and restart.`
+    );
+  }
+  return gaps;
+}
+__name(describeWorkerTlsTrustGaps, "describeWorkerTlsTrustGaps");
+var BASIC_CONSTRAINTS_OID = Buffer.from([85, 29, 19]);
+var KEY_USAGE_OID = Buffer.from([85, 29, 15]);
+var KEY_CERT_SIGN_MASK = 4;
+var TLS_SERVER_KEY_USAGE_MASK = 168;
+var TLS_SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+var VERSION_TAG = 160;
+var EXTENSIONS_TAG = 163;
+var SEQUENCE_TAG = 48;
+var BOOLEAN_TAG = 1;
+var INTEGER_TAG = 2;
+function derElementAt(der, at) {
+  const tag = der[at];
+  const header = der[at + 1];
+  if (tag === void 0 || header === void 0) return void 0;
+  let start = at + 2;
+  let length = header & 127;
+  if ((header & 128) !== 0) {
+    if (length === 0 || length > 4) return void 0;
+    let value = 0;
+    for (let index = 0; index < length; index += 1) {
+      const byte = der[start + index];
+      if (byte === void 0) return void 0;
+      value = value * 256 + byte;
+    }
+    start += length;
+    length = value;
+  }
+  const end = start + length;
+  return end <= der.length ? { tag, start, end } : void 0;
+}
+__name(derElementAt, "derElementAt");
+function tbsCertificateOf(cert) {
+  const certificate = derElementAt(cert.raw, 0);
+  if (certificate?.tag !== SEQUENCE_TAG) return void 0;
+  const tbs = derElementAt(cert.raw, certificate.start);
+  return tbs?.tag === SEQUENCE_TAG ? tbs : void 0;
+}
+__name(tbsCertificateOf, "tbsCertificateOf");
+function certificateExtension(cert, oid) {
+  const der = cert.raw;
+  const tbs = tbsCertificateOf(cert);
+  if (!tbs) return void 0;
+  let at = tbs.start;
+  while (at < tbs.end) {
+    const member = derElementAt(der, at);
+    if (!member) return void 0;
+    if (member.tag !== EXTENSIONS_TAG) {
+      at = member.end;
+      continue;
+    }
+    const list = derElementAt(der, member.start);
+    if (list?.tag !== SEQUENCE_TAG) return void 0;
+    let entry = list.start;
+    while (entry < list.end) {
+      const extension = derElementAt(der, entry);
+      if (extension?.tag !== SEQUENCE_TAG) return void 0;
+      const id = derElementAt(der, extension.start);
+      if (!id) return void 0;
+      let valueAt = id.end;
+      const critical = derElementAt(der, valueAt);
+      if (critical?.tag === BOOLEAN_TAG) valueAt = critical.end;
+      const value = derElementAt(der, valueAt);
+      if (!value) return void 0;
+      if (der.subarray(id.start, id.end).equals(oid)) {
+        return der.subarray(value.start, value.end);
+      }
+      entry = extension.end;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+__name(certificateExtension, "certificateExtension");
+function keyUsageAllowsCertSign(der) {
+  const bits = derElementAt(der, 0);
+  if (!bits) return false;
+  const first = der[bits.start + 1];
+  return first !== void 0 && (first & KEY_CERT_SIGN_MASK) !== 0;
+}
+__name(keyUsageAllowsCertSign, "keyUsageAllowsCertSign");
+function tlsServerPurposeDefect(cert) {
+  const keyUsage = certificateExtension(cert, KEY_USAGE_OID);
+  if (keyUsage !== void 0) {
+    const bits = derElementAt(keyUsage, 0);
+    const first = bits ? keyUsage[bits.start + 1] : void 0;
+    if (first === void 0 || (first & TLS_SERVER_KEY_USAGE_MASK) === 0) {
+      return "its keyUsage permits none of digitalSignature, keyEncipherment, or keyAgreement";
+    }
+  }
+  if (cert.keyUsage && !cert.keyUsage.includes(TLS_SERVER_AUTH_OID)) {
+    return "its extendedKeyUsage does not include serverAuth";
+  }
+  return void 0;
+}
+__name(tlsServerPurposeDefect, "tlsServerPurposeDefect");
+function isV1Certificate(cert) {
+  const tbs = tbsCertificateOf(cert);
+  return tbs !== void 0 && cert.raw[tbs.start] !== VERSION_TAG;
+}
+__name(isV1Certificate, "isV1Certificate");
+function cannotIssueCertificates(cert) {
+  const keyUsage = certificateExtension(cert, KEY_USAGE_OID);
+  if (keyUsage !== void 0 && !keyUsageAllowsCertSign(keyUsage)) return true;
+  if (certificateExtension(cert, BASIC_CONSTRAINTS_OID) !== void 0) {
+    return !cert.ca;
+  }
+  return !isV1Certificate(cert) && keyUsage === void 0;
+}
+__name(cannotIssueCertificates, "cannotIssueCertificates");
+function isSelfSignedCert(x509) {
+  if (x509.subject !== x509.issuer) return false;
+  try {
+    return x509.verify(x509.publicKey);
+  } catch {
+    return true;
+  }
+}
+__name(isSelfSignedCert, "isSelfSignedCert");
+var PEM_CERTIFICATE_BLOCK = /-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----/g;
+function parseCertChain(cert) {
+  const blocks = cert.toString("utf8").match(PEM_CERTIFICATE_BLOCK);
+  if (!blocks) {
+    try {
+      return [new X509Certificate(cert)];
+    } catch {
+      return [];
+    }
+  }
+  const chain = [];
+  for (const block of blocks) {
+    try {
+      chain.push(new X509Certificate(block));
+    } catch {
+    }
+  }
+  return chain;
+}
+__name(parseCertChain, "parseCertChain");
+function bootParsedLeaf(cert) {
+  try {
+    return new X509Certificate(cert);
+  } catch {
+    return void 0;
+  }
+}
+__name(bootParsedLeaf, "bootParsedLeaf");
+function certIssuedBy(cert, issuer) {
+  try {
+    return cert.issuer === issuer.subject && cert.verify(issuer.publicKey);
+  } catch {
+    return false;
+  }
+}
+__name(certIssuedBy, "certIssuedBy");
+function issuerRefusedForKeyUsage(cert) {
+  const keyUsage = certificateExtension(cert, KEY_USAGE_OID);
+  return keyUsage !== void 0 && !keyUsageAllowsCertSign(keyUsage);
+}
+__name(issuerRefusedForKeyUsage, "issuerRefusedForKeyUsage");
+function pathLengthConstraint(cert) {
+  const value = certificateExtension(cert, BASIC_CONSTRAINTS_OID);
+  if (!value) return void 0;
+  const sequence = derElementAt(value, 0);
+  if (sequence?.tag !== SEQUENCE_TAG) return void 0;
+  let at = sequence.start;
+  const first = derElementAt(value, at);
+  if (!first) return void 0;
+  if (first.tag === BOOLEAN_TAG) at = first.end;
+  const integer = derElementAt(value, at);
+  if (integer?.tag !== INTEGER_TAG) return void 0;
+  let length = 0;
+  for (let index = integer.start; index < integer.end; index += 1) {
+    const byte = value[index];
+    if (byte === void 0) return void 0;
+    length = length * 256 + byte;
+  }
+  return length;
+}
+__name(pathLengthConstraint, "pathLengthConstraint");
+function walkWorkerAnchorPath(leaf, chain, leafHeldByWorkers = true) {
+  let next = leaf;
+  const walked = /* @__PURE__ */ new Set();
+  const path2 = [];
+  let pathLengthViolation;
+  while (next) {
+    const current = next;
+    path2.push(current);
+    if (path2.length > 1 && pathLengthViolation === void 0) {
+      const constraint = pathLengthConstraint(current);
+      const intermediatesBelow = path2.length - 2;
+      if (constraint !== void 0 && intermediatesBelow > constraint) {
+        pathLengthViolation = { cert: current, constraint };
+      }
+    }
+    if (isSelfSignedCert(current)) {
+      if (path2.length > 1 && cannotIssueCertificates(current)) {
+        return { anchored: false, path: path2, nonCaTerminator: current };
+      }
+      if (path2.length === 1 && !leafHeldByWorkers) {
+        return { anchored: false, path: path2, unheldSelfSignedLeaf: current };
+      }
+      return pathLengthViolation ? { anchored: false, path: path2, pathLengthViolation } : { anchored: true, path: path2 };
+    }
+    walked.add(current.fingerprint256);
+    const issuer = chain.find(
+      (candidate) => !walked.has(candidate.fingerprint256) && certIssuedBy(current, candidate)
+    );
+    if (issuer && !isSelfSignedCert(issuer) && !issuer.ca) {
+      return { anchored: false, path: path2, incapableIssuer: issuer };
+    }
+    next = issuer;
+  }
+  return pathLengthViolation ? { anchored: false, path: path2, pathLengthViolation } : { anchored: false, path: path2 };
+}
+__name(walkWorkerAnchorPath, "walkWorkerAnchorPath");
+function workerDialHost(daemonUrl) {
+  try {
+    const hostname = new URL(daemonUrl).hostname;
+    if (!hostname) return void 0;
+    return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  } catch {
+    return void 0;
+  }
+}
+__name(workerDialHost, "workerDialHost");
+function certCoversHost(x509, host) {
+  try {
+    return isIP(host) ? Boolean(x509.checkIP(host)) : Boolean(x509.checkHost(host));
+  } catch {
+    return true;
+  }
+}
+__name(certCoversHost, "certCoversHost");
 function extractContextFilename(value) {
   if (typeof value === "string") {
     const trimmed = value.trim();
@@ -3355,12 +3799,12 @@ __name(hasRetryableChannelWorkerShutdownError, "hasRetryableChannelWorkerShutdow
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-NI6JEY4Q.js"),
-    import("./pidfile-SIEQM3X5.js"),
-    import("./runtime-ZICTJKT5.js"),
+    import("./channel-worker-supervisor-YSKB5GVB.js"),
+    import("./pidfile-DHV2Y7UD.js"),
+    import("./runtime-I76HPFUE.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-GIXIF4VT.js"),
-    import("./channel-worker-manager-ZBSYXJEB.js")
+    import("./channel-worker-group-EVDC2P4K.js"),
+    import("./channel-worker-manager-IJJZHGEI.js")
   ]).then(
     ([
       supervisor,
@@ -3371,6 +3815,7 @@ async function loadChannelWorkerRuntime() {
       workerManager
     ]) => ({
       createChannelWorkerSupervisor: supervisor.createChannelWorkerSupervisor,
+      resolveWorkerCaCertPath: supervisor.resolveWorkerCaCertPath,
       channelServicePidfile: pidfile,
       loadChannelsConfig: channelRuntime.loadChannelsConfig,
       createChannelWorkerGroup: workerGroup.createChannelWorkerGroup,
@@ -3465,7 +3910,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-SZFD2YQA.js");
+  coreRuntimePromise ??= import("./core-runtime-PKNQ63VL.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -3501,10 +3946,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-F7IXLQQW.js"),
-    import("./environment-4QYNT2L3.js"),
-    import("./loadedSettingsAdapter-7OBB7B6J.js"),
-    import("./trustedFolders-BKQ2UXIB.js")
+    import("./settings-IX5HOOCG.js"),
+    import("./environment-JXOSW25V.js"),
+    import("./loadedSettingsAdapter-IK7H5JRK.js"),
+    import("./trustedFolders-YKK67IP3.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3517,8 +3962,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-ZICTJKT5.js"),
-    import("./config-utils-WXWWMH2D.js")
+    import("./runtime-I76HPFUE.js"),
+    import("./config-utils-7M6PCTLT.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3544,18 +3989,18 @@ async function loadServeRuntimeModules() {
     workspaceRegistryModule,
     promptLedgerModule
   ] = await Promise.all([
-    import("./server-7LKYWHCE.js"),
-    import("./bridge-MBOVCHXN.js"),
-    import("./spawnChannel-JLKWUMTV.js"),
+    import("./server-TWXRRREO.js"),
+    import("./bridge-DFX2FFH4.js"),
+    import("./spawnChannel-TMC6VXGN.js"),
     import("./process-registry-PMJOA5CO.js"),
-    import("./workspace-service-MPGLZJF6.js"),
+    import("./workspace-service-4FGTUJLA.js"),
     import("./types-WYCFCEHR.js"),
-    import("./daemon-status-provider-D2HNWRDK.js"),
-    import("./workspace-providers-status-ZYXLTCJ5.js"),
-    import("./workspace-skills-status-ZVFYCT5C.js"),
-    import("./total-session-admission-JMM73HNK.js"),
-    import("./workspace-registry-QWPFWGEF.js"),
-    import("./prompt-terminal-ledger-YIAGDBHG.js")
+    import("./daemon-status-provider-F5FEHVVG.js"),
+    import("./workspace-providers-status-H6TG34YV.js"),
+    import("./workspace-skills-status-7VOLUDT6.js"),
+    import("./total-session-admission-TQI7TCTL.js"),
+    import("./workspace-registry-2PWNIYNI.js"),
+    import("./prompt-terminal-ledger-LDZ6QVYA.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -4423,6 +4868,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   let tlsOptions;
+  let tlsCertPath;
   if (opts.tlsCert && !opts.tlsKey || !opts.tlsCert && opts.tlsKey) {
     throw new Error(
       `--tls-cert and --tls-key must be provided together (got only --tls-${opts.tlsCert ? "cert" : "key"}).`
@@ -4465,6 +4911,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       );
     }
     tlsOptions = { cert, key };
+    tlsCertPath = path.resolve(opts.tlsCert);
   }
   if (!isLoopbackBind(opts.hostname) && !token) {
     throw new Error(
@@ -4594,7 +5041,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-LCB4GHNP.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-I4U3V5LL.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -4878,7 +5325,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
-  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-EAVTZ6CE.js");
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-LDBJXH2U.js");
   const daemonToolGuardHandler = createDaemonToolGuard(
     externalToolGuardHandler
   );
@@ -5217,7 +5664,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-F4JM5CKX.js")
+      import("./daemon-trust-policy-C6YTU5CQ.js")
     ]);
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
@@ -5593,7 +6040,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-ZOHS4J2E.js");
+      } = await import("./skill-settings-5U7FTJIK.js");
       const fresh = loadSettingsForPersistence(workspace);
       const normalizedName = skillName.trim().toLowerCase();
       const resolved = resolveSkillSettings(fresh);
@@ -5658,7 +6105,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-ZOHS4J2E.js");
+      } = await import("./skill-settings-5U7FTJIK.js");
       const fresh = loadSettingsForPersistence(workspace);
       const resolved = resolveSkillSettings(fresh);
       const initialDisabled = skillSettingStrings(
@@ -5763,7 +6210,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
       }
     }), "persistSettingsFn");
-    const { createSubSessionLauncher } = await import("./create-sub-session-OXESCUS7.js");
+    const { createSubSessionLauncher } = await import("./create-sub-session-PLGPY6TV.js");
     const subSessionLauncher = createSubSessionLauncher({
       getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
       boundWorkspace,
@@ -6992,8 +7439,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-XGGL6PLF.js"),
-          import("./channel-settings-store-DD6W3EJQ.js")
+          import("./channel-management-service-HXXS3HOZ.js"),
+          import("./channel-settings-store-ELLH2M4M.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -7197,8 +7644,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-4QDDGBQZ.js"),
-        import("./daemon-trust-policy-monitor-ITF54474.js")
+        import("./workspace-trust-reconciler-GJ466KCE.js"),
+        import("./daemon-trust-policy-monitor-IGEJPHQ4.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -7413,7 +7860,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-F4JM5CKX.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-C6YTU5CQ.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -7966,6 +8413,69 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             );
           }
           const workerRuntime = await ensureChannelRuntime();
+          const workerDaemonUrl = formatChannelWorkerDaemonUrl(
+            opts.hostname,
+            actualPort,
+            tlsOptions !== void 0
+          );
+          if (tlsOptions && tlsCertPath && process.env["NODE_TLS_REJECT_UNAUTHORIZED"] === "0") {
+            daemonLog.warn(
+              `NODE_TLS_REJECT_UNAUTHORIZED=0 disables certificate verification for channel workers; skipping the worker TLS trust check.`
+            );
+          } else if (tlsOptions && tlsCertPath) {
+            const operatorCaCertPath = process.env["NODE_EXTRA_CA_CERTS"];
+            let operatorCaCert;
+            let operatorCaCertReadError;
+            if (operatorCaCertPath) {
+              try {
+                operatorCaCert = fs.readFileSync(operatorCaCertPath);
+              } catch (error2) {
+                operatorCaCertReadError = error2?.code ?? "read failed";
+              }
+            }
+            let predictedGaps = [];
+            try {
+              predictedGaps = describeWorkerTlsTrustGaps({
+                cert: tlsOptions.cert,
+                certPath: tlsCertPath,
+                certSourcePath: tlsCertPath,
+                daemonUrl: workerDaemonUrl,
+                ...operatorCaCertPath ? { operatorCaCertPath } : {},
+                ...operatorCaCert ? {
+                  operatorCaCert,
+                  operatorCaCertSourcePath: operatorCaCertPath
+                } : {},
+                ...operatorCaCertReadError ? { operatorCaCertReadError } : {}
+              });
+            } catch (error2) {
+              if (!(error2 instanceof ExtraCaInspectionError)) throw error2;
+              daemonLog.warn(
+                `Channel worker TLS trust-gap inspection could not run: ${error2.message} Continuing with the live handshake probe only.`
+              );
+            }
+            const workerCaCertPath = workerRuntime.resolveWorkerCaCertPath(
+              tlsCertPath,
+              operatorCaCertPath
+            );
+            const trustFailure = await (deps.workerTlsTrustVerifier ?? verifyWorkerTlsTrust)({
+              daemonUrl: workerDaemonUrl,
+              caCertPath: workerCaCertPath
+            });
+            if (shuttingDown || runtimeStartupError !== void 0) {
+              throw new Error(
+                "Daemon stopped while the channel worker TLS trust check was running."
+              );
+            }
+            if (trustFailure) {
+              if (predictedGaps.length > 0) {
+                for (const gap of predictedGaps) daemonLog.warn(gap);
+              } else {
+                daemonLog.warn(
+                  `Channel worker TLS verification failed against the exact CA bundle workers receive (${sanitizeLogText(normalizeWorkerDiagnostic(trustFailure.code), 80)}): ${sanitizeLogText(normalizeWorkerDiagnostic(trustFailure.message), 300)}`
+                );
+              }
+            }
+          }
           const createSupervisor = deps.channelWorkerSupervisorFactory ?? workerRuntime.createChannelWorkerSupervisor;
           const createGroup = /* @__PURE__ */ __name((groups) => workerRuntime.createChannelWorkerGroup({
             groups,
@@ -7973,11 +8483,9 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             createSupervisor,
             shared: {
               cliEntryPath: workerRuntime.findCliEntryPath(),
-              daemonUrl: formatChannelWorkerDaemonUrl(
-                opts.hostname,
-                actualPort
-              ),
-              ...token ? { daemonToken: token } : {}
+              daemonUrl: workerDaemonUrl,
+              ...token ? { daemonToken: token } : {},
+              ...tlsCertPath ? { workerTlsCaCertPath: tlsCertPath } : {}
             },
             onReady: /* @__PURE__ */ __name((snapshot) => {
               if (runtimeStartupError !== void 0) return;
@@ -8611,6 +9119,7 @@ export {
   createBoundChannelDeliveryHandler,
   createDisabledChannelWorkerSupervisor,
   createLazyBridgeProxy,
+  describeWorkerTlsTrustGaps,
   extractContextFilename,
   formatChannelWorkerDaemonUrl,
   resolveRuntimeStartupTimeoutMs,
@@ -8618,6 +9127,7 @@ export {
   subSessionConcurrencyCapsFromSettings,
   validateAndCanonicalizeWorkspaceInput,
   validatePolicyConfig,
+  verifyWorkerTlsTrust,
   waitForRuntimeStartingForShutdown
 };
 /**