@qwen-code/qwen-code 0.22.0 → 0.22.1

package/chunks/{chunk-4F5WV4RF.js → chunk-PAJGKZAA.js}

@@ -12,10 +12,8 @@ import {
   revokeChannelWorkerPromptAuthorization
 } from "./chunk-Z7B6SRPM.js";
 import {
-  CHANNEL_DAEMON_WORKER_SENTINEL,
   CHANNEL_DELIVERY_IPC_TIMEOUT_MS,
   CHANNEL_WEBHOOK_TASK_IPC_TIMEOUT_MS,
-  CHANNEL_WORKER_HEARTBEAT_INTERVAL_MS,
   ChannelDeliveryError,
   ChannelWebhookEnqueueError,
   MAX_CHANNEL_DELIVERIES_IN_FLIGHT,
@@ -23,10 +21,6 @@ import {
   MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
-  QWEN_DAEMON_TOKEN_ENV,
-  QWEN_DAEMON_URL_ENV,
-  QWEN_DAEMON_WORKSPACE_ENV,
-  QWEN_SERVER_TOKEN_ENV,
   createChannelDeliveryMessage,
   createChannelWebhookTaskMessage,
   isChannelDeliveryResultMessage,
@@ -34,12 +28,20 @@ import {
   isChannelStartupReportType,
   isChannelWebhookEnqueueErrorCode,
   isChannelWebhookTaskResultMessage
-} from "./chunk-ND7NOI4P.js";
+} from "./chunk-7CWEZQ6T.js";
 import {
   createWorkerDiagnosticRedactor,
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-A6NRNRKE.js";
+} from "./chunk-JVPFTDBK.js";
+import {
+  CHANNEL_DAEMON_WORKER_SENTINEL,
+  CHANNEL_WORKER_HEARTBEAT_INTERVAL_MS,
+  QWEN_DAEMON_TOKEN_ENV,
+  QWEN_DAEMON_URL_ENV,
+  QWEN_DAEMON_WORKSPACE_ENV,
+  QWEN_SERVER_TOKEN_ENV
+} from "./chunk-GYTKQYDB.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
@@ -53,7 +55,7 @@ import {
 } from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-AW27A43Y.js";
+} from "./chunk-E55H6BZ7.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -65,6 +67,124 @@ import {
 init_esbuild_shims();
 import { fork } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+// packages/cli/src/serve/pem-certificate-blocks.ts
+init_esbuild_shims();
+import { spawnSync } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var NODE_EXTRA_CA_CERTS_ENV = "NODE_EXTRA_CA_CERTS";
+var ORACLE_TIMEOUT_MS = 1e4;
+var ORACLE_MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+var ORACLE_SOURCE = `
+const tls = require('node:tls');
+if (typeof tls.getCACertificates === 'function') {
+  process.stdout.write(JSON.stringify({
+    certificates: tls.getCACertificates('extra'),
+  }));
+} else {
+  tls.createSecureContext();
+  process.stdout.write(JSON.stringify({ legacy: true }));
+}
+`;
+var ExtraCaInspectionError = class extends Error {
+  static {
+    __name(this, "ExtraCaInspectionError");
+  }
+};
+var LegacyExtraCaInspectionError = class extends ExtraCaInspectionError {
+  static {
+    __name(this, "LegacyExtraCaInspectionError");
+  }
+  constructor() {
+    super("Inspecting NODE_EXTRA_CA_CERTS requires Node.js 22.15.0 or newer.");
+  }
+};
+var FailedExtraCaInspectionError = class extends ExtraCaInspectionError {
+  static {
+    __name(this, "FailedExtraCaInspectionError");
+  }
+  constructor() {
+    super(
+      "Inspecting NODE_EXTRA_CA_CERTS failed before its contents could be judged."
+    );
+  }
+};
+function scanCertificateBlocks(contents, sourcePath) {
+  let dir;
+  try {
+    dir = sourcePath ? void 0 : mkdtempSync(join(tmpdir(), "qwen-ca-oracle-"));
+    const certPath = sourcePath ?? join(dir, "extra-ca.pem");
+    if (dir) writeFileSync(certPath, contents, { mode: 384 });
+    const oracleEnv = {
+      ...process.env,
+      [NODE_EXTRA_CA_CERTS_ENV]: certPath
+    };
+    for (const key of Object.keys(oracleEnv)) {
+      if (key.toUpperCase() === "NODE_OPTIONS") delete oracleEnv[key];
+    }
+    const result = spawnSync(
+      process.execPath,
+      ["--no-deprecation", "--input-type=commonjs", "-e", ORACLE_SOURCE],
+      {
+        encoding: "utf8",
+        env: oracleEnv,
+        maxBuffer: ORACLE_MAX_BUFFER_BYTES,
+        timeout: ORACLE_TIMEOUT_MS,
+        windowsHide: true
+      }
+    );
+    if (result.error || result.status !== 0) {
+      throw new FailedExtraCaInspectionError();
+    }
+    const parsed = JSON.parse(result.stdout);
+    if (typeof parsed !== "object" || parsed === null) {
+      throw new FailedExtraCaInspectionError();
+    }
+    const certificates = Reflect.get(parsed, "certificates");
+    if (certificates !== void 0) {
+      if (!Array.isArray(certificates) || !certificates.every((item) => typeof item === "string")) {
+        throw new FailedExtraCaInspectionError();
+      }
+      return certificates.map((block) => ({
+        block: block.trimEnd(),
+        certificate: new X509Certificate(block)
+      }));
+    }
+    if (Reflect.get(parsed, "legacy") !== true) {
+      throw new FailedExtraCaInspectionError();
+    }
+    throw new LegacyExtraCaInspectionError();
+  } catch (error) {
+    if (error instanceof ExtraCaInspectionError) throw error;
+    throw new FailedExtraCaInspectionError();
+  } finally {
+    if (dir) {
+      try {
+        rmSync(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+__name(scanCertificateBlocks, "scanCertificateBlocks");
+function extractCertificateBlocks(contents, sourcePath) {
+  const scanned = scanCertificateBlocks(contents, sourcePath);
+  return scanned.length > 0 ? scanned.map((entry) => entry.block) : void 0;
+}
+__name(extractCertificateBlocks, "extractCertificateBlocks");
+function loadableCertificates(contents, sourcePath) {
+  const scanned = scanCertificateBlocks(contents, sourcePath);
+  return scanned.length > 0 ? scanned.map((entry) => entry.certificate) : void 0;
+}
+__name(loadableCertificates, "loadableCertificates");
+
+// packages/cli/src/serve/channel-worker-supervisor.ts
 var DEFAULT_CHANNEL_WORKER_HEARTBEAT_TIMEOUT_MS = 45e3;
 var MAX_WORKER_LOG_LINE_LENGTH = 4096;
 var MAX_WORKER_LOG_BUFFER_LENGTH = 64 * 1024;
@@ -181,10 +301,151 @@ function hasObservedExit(snapshot) {
   return snapshot.exitCode !== void 0 || snapshot.signal !== void 0;
 }
 __name(hasObservedExit, "hasObservedExit");
+var NODE_EXTRA_CA_CERTS_ENV2 = "NODE_EXTRA_CA_CERTS";
+var mergedWorkerCaBundles = /* @__PURE__ */ new Map();
+function sourceStamp(filePath) {
+  const stat = fs.statSync(filePath);
+  return `${stat.mtimeMs}:${stat.size}`;
+}
+__name(sourceStamp, "sourceStamp");
+var warnedWorkerCaMergeFallbacks = /* @__PURE__ */ new Set();
+var WORKER_CA_MERGE_FALLBACK_FAMILIES = [
+  "read-error",
+  "inspection-failed",
+  "no-operator-blocks",
+  "no-daemon-blocks"
+];
+function workerCaMergeFallbackKey(operatorCaPath, daemonCertPath, family) {
+  return `${operatorCaPath}\0${daemonCertPath}\0${family}`;
+}
+__name(workerCaMergeFallbackKey, "workerCaMergeFallbackKey");
+function warnWorkerCaMergeFallback(operatorCaPath, daemonCertPath, family, reason) {
+  const key = workerCaMergeFallbackKey(operatorCaPath, daemonCertPath, family);
+  if (warnedWorkerCaMergeFallbacks.has(key)) return;
+  warnedWorkerCaMergeFallbacks.add(key);
+  process.emitWarning(
+    `qwen: failed to merge ${NODE_EXTRA_CA_CERTS_ENV2} "${operatorCaPath}" with the daemon cert "${daemonCertPath}": ${reason}; channel workers will trust only the daemon cert`
+  );
+}
+__name(warnWorkerCaMergeFallback, "warnWorkerCaMergeFallback");
+var mintedWorkerCaBundleDirs = /* @__PURE__ */ new Set();
+var workerCaBundleExitHookRegistered = false;
+function cleanupWorkerCaBundleDir(dir) {
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
+__name(cleanupWorkerCaBundleDir, "cleanupWorkerCaBundleDir");
+function writeMergedWorkerCaBundle(contents) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "qwen-worker-ca-"));
+  mintedWorkerCaBundleDirs.add(dir);
+  if (!workerCaBundleExitHookRegistered) {
+    workerCaBundleExitHookRegistered = true;
+    process.once("exit", cleanupMintedWorkerCaBundleDirs);
+  }
+  const bundlePath = path.join(dir, "ca-bundle.pem");
+  fs.writeFileSync(bundlePath, contents, { mode: 384 });
+  return bundlePath;
+}
+__name(writeMergedWorkerCaBundle, "writeMergedWorkerCaBundle");
+function cleanupMintedWorkerCaBundleDirs() {
+  const swept = [...mintedWorkerCaBundleDirs];
+  for (const minted of swept) {
+    cleanupWorkerCaBundleDir(minted);
+  }
+  mintedWorkerCaBundleDirs.clear();
+  return swept;
+}
+__name(cleanupMintedWorkerCaBundleDirs, "cleanupMintedWorkerCaBundleDirs");
+function resolveWorkerCaCertPath(daemonCertPath, existing) {
+  if (!existing || existing === daemonCertPath) return daemonCertPath;
+  const cacheKey = `${existing}\0${daemonCertPath}`;
+  const sources = [existing, daemonCertPath];
+  const cached = mergedWorkerCaBundles.get(cacheKey);
+  if (cached) {
+    try {
+      fs.statSync(cached.bundlePath);
+      if (sources.every((src, i) => sourceStamp(src) === cached.sourceStamps[i])) {
+        return cached.bundlePath;
+      }
+    } catch {
+    }
+  }
+  try {
+    const sourceStamps = sources.map(sourceStamp);
+    const operatorBlocks = extractCertificateBlocks(
+      fs.readFileSync(existing, "utf8"),
+      existing
+    );
+    if (!operatorBlocks) {
+      warnWorkerCaMergeFallback(
+        existing,
+        daemonCertPath,
+        "no-operator-blocks",
+        // Three causes reject a file, not one: markers, decoding, and DER.
+        // Blaming markers alone tells an operator whose CA is truncated or
+        // hand-edited to fix lines that are already correct — and after boot
+        // this warning is the only diagnostic they get, so it has to name the
+        // same three the boot-time check does.
+        "it holds no PEM certificate block Node can load (every -----BEGIN/END CERTIFICATE----- marker must sit alone on its own line and every block must decode, and a DER file is never read at all)"
+      );
+      return daemonCertPath;
+    }
+    const daemonBlocks = extractCertificateBlocks(
+      fs.readFileSync(daemonCertPath, "utf8"),
+      daemonCertPath
+    );
+    if (!daemonBlocks) {
+      warnWorkerCaMergeFallback(
+        existing,
+        daemonCertPath,
+        "no-daemon-blocks",
+        "the daemon cert holds no PEM certificate block to merge into"
+      );
+      return daemonCertPath;
+    }
+    const bundlePath = writeMergedWorkerCaBundle(
+      `${[...operatorBlocks, ...daemonBlocks].join("\n")}
+`
+    );
+    const superseded = mergedWorkerCaBundles.get(cacheKey);
+    mergedWorkerCaBundles.set(cacheKey, { bundlePath, sourceStamps });
+    if (superseded) {
+      const dir = path.dirname(superseded.bundlePath);
+      mintedWorkerCaBundleDirs.delete(dir);
+      cleanupWorkerCaBundleDir(dir);
+    }
+    for (const family of WORKER_CA_MERGE_FALLBACK_FAMILIES) {
+      warnedWorkerCaMergeFallbacks.delete(
+        workerCaMergeFallbackKey(existing, daemonCertPath, family)
+      );
+    }
+    return bundlePath;
+  } catch (err) {
+    warnWorkerCaMergeFallback(
+      existing,
+      daemonCertPath,
+      // An inspection that could not run blames nothing about the file's
+      // contents; sharing the read-error family would let a first ENOENT
+      // silence the later, now-accurate inspection-failure diagnosis.
+      err instanceof ExtraCaInspectionError ? "inspection-failed" : "read-error",
+      err instanceof Error ? err.message : String(err)
+    );
+    return daemonCertPath;
+  }
+}
+__name(resolveWorkerCaCertPath, "resolveWorkerCaCertPath");
 function createWorkerEnv(opts) {
   const env = { ...opts.baseEnv ?? process.env };
   env["QWEN_CODE_NO_RELAUNCH"] = "true";
   env["QWEN_CODE_SERVE"] = "1";
+  if (opts.tlsCaCertPath) {
+    env[NODE_EXTRA_CA_CERTS_ENV2] = resolveWorkerCaCertPath(
+      opts.tlsCaCertPath,
+      env[NODE_EXTRA_CA_CERTS_ENV2]
+    );
+  }
   env[CHANNEL_DAEMON_WORKER_SENTINEL] = randomUUID();
   env[QWEN_DAEMON_URL_ENV] = opts.daemonUrl;
   env[QWEN_DAEMON_WORKSPACE_ENV] = opts.workspace;
@@ -505,7 +766,8 @@ function createChannelWorkerSupervisor(opts) {
       daemonUrl: opts.daemonUrl,
       workspace: opts.workspace,
       ...opts.daemonToken ? { daemonToken: opts.daemonToken } : {},
-      ...opts.workerBaseEnv ? { baseEnv: opts.workerBaseEnv } : {}
+      ...opts.workerBaseEnv ? { baseEnv: opts.workerBaseEnv } : {},
+      ...opts.tlsCaCertPath ? { tlsCaCertPath: opts.tlsCaCertPath } : {}
     });
     const promptAuthorization = env[CHANNEL_DAEMON_WORKER_SENTINEL];
     registerChannelWorkerPromptAuthorization(
@@ -1205,7 +1467,16 @@ function createChannelWorkerSupervisor(opts) {
 __name(createChannelWorkerSupervisor, "createChannelWorkerSupervisor");
 
 export {
+  ExtraCaInspectionError,
+  loadableCertificates,
   ChannelWorkerStopError,
   ChannelWorkerStartupError,
+  cleanupMintedWorkerCaBundleDirs,
+  resolveWorkerCaCertPath,
   createChannelWorkerSupervisor
 };
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-HIK2OF33.js → chunk-PVBT5QPD.js}

@@ -6,7 +6,7 @@ import {
   realpathNearestExisting,
   resolvePath,
   sanitizeCwd
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-QHMLYMMS.js

@@ -0,0 +1,32 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/core/stream-transport-retry.ts
+init_esbuild_shims();
+var RETRYABLE_STREAM_TRANSPORT_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function isRetryableStreamTransportError(classification) {
+  return classification.kind === "transport" && classification.transportCode !== void 0 && RETRYABLE_STREAM_TRANSPORT_CODES.has(classification.transportCode);
+}
+__name(isRetryableStreamTransportError, "isRetryableStreamTransportError");
+
+export {
+  isRetryableStreamTransportError
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-U2UYQMM6.js → chunk-R2ZJH3FV.js}

@@ -2,14 +2,14 @@
 "use strict";
 import {
   STATUS_SCHEMA_VERSION
-} from "./chunk-URN2JIAQ.js";
+} from "./chunk-CITGRGCM.js";
 import {
   formatMemoryUsage
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-XYX474JQ.js";
 import {
   detectRuntime,
   redactProxyCredentials
-} from "./chunk-PZRUV52H.js";
+} from "./chunk-GTUKW3I6.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-K52PZNU4.js → chunk-RRKNX553.js}

@@ -3,7 +3,7 @@
 import {
   createDebugLogger,
   isNodeError
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -907,7 +907,7 @@ var QwenIgnoreParser = class {
   }
 };
 
-// packages/core/src/config/constants.ts
+// packages/core/src/utils/file-filtering-options.ts
 init_esbuild_shims();
 var DEFAULT_MEMORY_FILE_FILTERING_OPTIONS = {
   respectGitIgnore: false,

package/chunks/chunk-RXFQM6FQ.js

@@ -0,0 +1,42 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/loopback-binds.ts
+init_esbuild_shims();
+var LOOPBACK_BINDS = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "localhost",
+  "::1",
+  "[::1]"
+]);
+function isIpv4Loopback(hostname) {
+  const octets = hostname.split(".");
+  if (octets.length !== 4) return false;
+  const [first, ...rest] = octets;
+  return first === "127" && rest.every((octet) => {
+    if (!/^\d+$/.test(octet)) return false;
+    const value = Number(octet);
+    return value >= 0 && value <= 255;
+  });
+}
+__name(isIpv4Loopback, "isIpv4Loopback");
+function isLoopbackBind(hostname) {
+  const normalized = hostname.toLowerCase();
+  return LOOPBACK_BINDS.has(normalized) || isIpv4Loopback(normalized);
+}
+__name(isLoopbackBind, "isLoopbackBind");
+
+export {
+  isLoopbackBind
+};
+/**
+ * @license
+ * Copyright 2025 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-SJ4HB27T.js → chunk-SDVF6A42.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   stringifyGenAiJson
-} from "./chunk-C72BXMJ5.js";
+} from "./chunk-FJWICLG7.js";
 import {
   DEFAULT_SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH,
   SENSITIVE_SPAN_ATTRIBUTE_MAX_LENGTH_LIMIT,
@@ -10,11 +10,11 @@ import {
   getMeter,
   isTelemetrySdkInitialized,
   isValidSensitiveSpanAttributeMaxLength
-} from "./chunk-GAHYKJPV.js";
+} from "./chunk-6US7BF3G.js";
 import {
   FatalConfigError,
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   ValueType,
   diag,

package/chunks/{chunk-TBVSALA3.js → chunk-SKNVVYIJ.js}

@@ -2,16 +2,16 @@
 "use strict";
 import {
   isWithinRoot
-} from "./chunk-IWOWEENB.js";
+} from "./chunk-WBT3STGU.js";
 import {
   BaseDeclarativeTool,
   BaseToolInvocation,
   ToolDisplayNames,
   ToolNames
-} from "./chunk-6NFAEG54.js";
+} from "./chunk-KOJ6MHD5.js";
 import {
   isNodeError
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/{chunk-JGUBDRBC.js → chunk-SLEWBQWM.js}

@@ -2,11 +2,11 @@
 "use strict";
 import {
   atomicWriteFileSync
-} from "./chunk-HDKCKCYO.js";
+} from "./chunk-7QGEJI7M.js";
 import {
   Storage,
   createDebugLogger
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -14,7 +14,7 @@ import {
   __name
 } from "./chunk-J2S4EL5Y.js";
 
-// packages/core/src/utils/installationManager.ts
+// packages/core/src/config/installationManager.ts
 init_esbuild_shims();
 import * as fs from "node:fs";
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-ZRFUT5VV.js → chunk-SM7ZVKTF.js}

@@ -2,26 +2,26 @@
 "use strict";
 import {
   getExtensionManager
-} from "./chunk-S4C4JJKE.js";
+} from "./chunk-A7X32SCT.js";
 import {
   parseChannelConfig
-} from "./chunk-5XUTPXQU.js";
+} from "./chunk-EAV3TENS.js";
 import {
   getPlugin,
   registerPlugin
-} from "./chunk-QS4ENGVF.js";
+} from "./chunk-IKN3IUJP.js";
 import {
   sanitizeLogText
-} from "./chunk-AW27A43Y.js";
+} from "./chunk-E55H6BZ7.js";
 import {
   loadSettings
-} from "./chunk-6UQSU7CQ.js";
+} from "./chunk-MDZO5V2O.js";
 import {
   hashDaemonWorkspace
-} from "./chunk-2UZJWSVD.js";
+} from "./chunk-ILPXSKGQ.js";
 import {
   Storage
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   writeStderrLine,
   writeStdoutLine

package/chunks/{chunk-UUQFJILB.js → chunk-SQPOJ4ZI.js}

@@ -4,9 +4,11 @@ import {
   parseToolWriteOriginMeta
 } from "./chunk-VGHZT6JR.js";
 import {
-  isLoopbackBind,
   normalizeSessionIdForLookup
-} from "./chunk-TQOF5KBL.js";
+} from "./chunk-ZEZKIS2K.js";
+import {
+  isLoopbackBind
+} from "./chunk-RXFQM6FQ.js";
 import {
   MAX_CHILD_HEAP_MB,
   MIN_CHILD_HEAP_MB,
@@ -17,7 +19,7 @@ import {
 } from "./chunk-NYWWQ437.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-LURJYO2T.js";
+} from "./chunk-OZ6KS6KW.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   translateAndCheckAbsoluteWorkspacePath
@@ -1509,6 +1511,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_status: { since: "v1" },
   session_close: { since: "v1" },
   session_archive: { since: "v1" },
+  session_storage_conflict_repair: { since: "v1" },
   session_metadata: { since: "v1" },
   session_organization: { since: "v1" },
   session_export: { since: "v1" },
@@ -2027,6 +2030,10 @@ function validateRootStats(stats) {
   }
 }
 __name(validateRootStats, "validateRootStats");
+function hasVerifiableInode(ino) {
+  return Number(ino) !== 0;
+}
+__name(hasVerifiableInode, "hasVerifiableInode");
 function prepareManagedScratchRoot(root, startupWorkspaceCwds) {
   mkdirSync(root, { recursive: true, mode: 448 });
   const before = lstatSync(root);
@@ -2034,6 +2041,11 @@ function prepareManagedScratchRoot(root, startupWorkspaceCwds) {
   const canonicalRoot = realpathSync.native(resolve(root));
   const after = lstatSync(canonicalRoot);
   validateRootStats(after);
+  if (!hasVerifiableInode(after.ino)) {
+    throw new Error(
+      "Managed scratch root identity cannot be verified on this volume"
+    );
+  }
   if (before.dev !== after.dev || before.ino !== after.ino) {
     throw new Error("Managed scratch root identity changed during validation");
   }