@qwen-code/qwen-code 0.22.0 → 0.22.2-preview.0

package/chunks/{server-74ONDK62.js → server-PSN5OOSX.js}

@@ -21,13 +21,13 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-WS7PAXXR.js";
+} from "./chunk-4N6UAPD3.js";
 import {
   deriveWebSocketBase,
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-WU5E4HMO.js";
+} from "./chunk-CPPYZHBN.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -39,15 +39,15 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-MQP3MHWN.js";
+} from "./chunk-JJJD6QCC.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-UZPYR3EV.js";
-import "./chunk-A5F63FEW.js";
+} from "./chunk-4TPAG3O7.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-E7REAOTN.js";
+import "./chunk-L436XFLJ.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-TXASDT2M.js";
@@ -128,47 +128,22 @@ import {
   tagListener,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-UUQFJILB.js";
+} from "./chunk-SQPOJ4ZI.js";
 import "./chunk-VGHZT6JR.js";
 import {
-  isLoopbackBind,
   isValidSessionId,
   normalizeSessionIdForLookup,
   parseCallerSuppliedSessionId
-} from "./chunk-TQOF5KBL.js";
-import "./chunk-UXEO7E3V.js";
-import {
-  WorkspaceGenerationClosedError,
-  createSingleWorkspaceRegistry,
-  createWorkspaceSessionOwnerIndex
-} from "./chunk-K3LPAED5.js";
+} from "./chunk-ZEZKIS2K.js";
 import {
-  isInternalWorkspaceRuntime
-} from "./chunk-NYWWQ437.js";
-import {
-  assertValidChannelSecretUpdates
-} from "./chunk-MHG6NDS6.js";
-import {
-  createWorkspaceSkillsStatusProvider
-} from "./chunk-P47E4SJC.js";
-import "./chunk-BGXZBI5B.js";
-import {
-  isServeDebugMode,
-  mountWebShellAssets,
-  mountWebShellSpaFallback
-} from "./chunk-KSPRQSB4.js";
-import {
-  require_express
-} from "./chunk-O5Z7EB6Y.js";
-import {
-  evaluateDaemonWorkspaceTrust,
-  readDaemonTrustPolicySnapshot
-} from "./chunk-7HFULI45.js";
+  isLoopbackBind
+} from "./chunk-RXFQM6FQ.js";
+import "./chunk-UXEO7E3V.js";
 import {
   readRecentPromptTerminals,
   reconcileDanglingPromptTerminals,
   withPromptTerminals
-} from "./chunk-XYQHT3AW.js";
+} from "./chunk-4Z3PSHN4.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -182,14 +157,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-FYZMB6DB.js";
+} from "./chunk-LKOSBI2M.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-ZS5BHEPD.js";
+} from "./chunk-VLY6XOBY.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -197,22 +172,24 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-ZZUVC6RI.js";
+} from "./chunk-76WGY6LW.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-QJHPWLZC.js";
-import "./chunk-Z3JMO2CH.js";
-import "./chunk-Z4X5MTRT.js";
-import {
-  WorkspacePermissionRulesSessionRequiredError,
-  WorkspaceSettingsPartialPersistError,
-  mapWorkspaceSkillToggleError
-} from "./chunk-Z7VOMGDC.js";
+} from "./chunk-2MHGD7EE.js";
+import "./chunk-2SERYG4T.js";
 import {
   createTotalSessionAdmissionController
 } from "./chunk-X2UOOG5V.js";
+import {
+  WorkspaceGenerationClosedError,
+  createSingleWorkspaceRegistry,
+  createWorkspaceSessionOwnerIndex
+} from "./chunk-K3LPAED5.js";
+import {
+  isInternalWorkspaceRuntime
+} from "./chunk-NYWWQ437.js";
 import "./chunk-OIBUG24X.js";
 import {
   MAX_SESSION_RESTORE_TIMEOUT_MS,
@@ -220,24 +197,20 @@ import {
   restoreRetryAfterSeconds
 } from "./chunk-4JRM2BSM.js";
 import {
-  getStableLiveDiscoveryBaseDir
-} from "./chunk-5MK45KZ3.js";
-import {
-  LIVE_HOST_BUNDLE_ID,
-  LIVE_HOST_PROTOCOL_VERSION,
-  LIVE_INPUT_AUDIO_EPOCH_BYTES
-} from "./chunk-NKLP3DCK.js";
+  assertValidChannelSecretUpdates
+} from "./chunk-MB4OCRQ2.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-NW35NVFN.js";
+} from "./chunk-K6FURWIX.js";
 import "./chunk-JS73NNWF.js";
-import "./chunk-PHJJ3RVO.js";
+import "./chunk-7XKW4CVK.js";
+import "./chunk-UVDOONRU.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-X7V3N6YH.js";
+} from "./chunk-7JJUFI36.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -245,40 +218,74 @@ import {
 } from "./chunk-7U5G6JXI.js";
 import "./chunk-WCCLLK7X.js";
 import "./chunk-OCPBI7J5.js";
-import {
-  createSpawnChannelFactory
-} from "./chunk-VMJL7RH6.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-MPHLIJYL.js";
+} from "./chunk-QB5DD75E.js";
+import "./chunk-4K7NQDCG.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-FVBVJEBG.js";
+} from "./chunk-HOANA6GC.js";
 import {
   snapshotProcessEnv
-} from "./chunk-U2UYQMM6.js";
+} from "./chunk-5NV2AN56.js";
 import {
-  STATUS_SCHEMA_VERSION,
-  SessionRestoreTimeoutError,
-  createIdleWorkspaceMemoryStatus,
-  mapDomainErrorToErrorKind
-} from "./chunk-URN2JIAQ.js";
-import "./chunk-HMJ2P3SV.js";
+  createWorkspaceSkillsStatusProvider
+} from "./chunk-DWRFOH3G.js";
+import "./chunk-BGXZBI5B.js";
+import "./chunk-Z4X5MTRT.js";
+import {
+  WorkspacePermissionRulesSessionRequiredError,
+  WorkspaceSettingsPartialPersistError,
+  mapWorkspaceSkillToggleError
+} from "./chunk-Z7VOMGDC.js";
+import {
+  isServeDebugMode,
+  mountWebShellAssets,
+  mountWebShellSpaFallback
+} from "./chunk-DIMEPKCW.js";
+import {
+  require_express
+} from "./chunk-AYHQZBJ4.js";
+import "./chunk-FBX2SDQ4.js";
+import {
+  evaluateDaemonWorkspaceTrust,
+  readDaemonTrustPolicySnapshot
+} from "./chunk-TQYZG5DU.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-ZRFUT5VV.js";
-import "./chunk-S4C4JJKE.js";
+} from "./chunk-OAAPGZVH.js";
+import "./chunk-3UXJFOB3.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-5XUTPXQU.js";
-import "./chunk-45NQKMYB.js";
+} from "./chunk-EAV3TENS.js";
+import "./chunk-7JPW6IYH.js";
 import {
   supportedChannelCatalog
-} from "./chunk-QS4ENGVF.js";
+} from "./chunk-IKN3IUJP.js";
 import "./chunk-V6WHFGST.js";
+import {
+  getStableLiveDiscoveryBaseDir
+} from "./chunk-5MK45KZ3.js";
+import {
+  LIVE_HOST_BUNDLE_ID,
+  LIVE_HOST_PROTOCOL_VERSION,
+  LIVE_INPUT_AUDIO_EPOCH_BYTES
+} from "./chunk-NKLP3DCK.js";
+import {
+  createSpawnChannelFactory
+} from "./chunk-GZJUCMH4.js";
+import {
+  STATUS_SCHEMA_VERSION,
+  SessionRestoreTimeoutError,
+  createIdleWorkspaceMemoryStatus,
+  mapDomainErrorToErrorKind
+} from "./chunk-CITGRGCM.js";
+import "./chunk-K6KS3LTN.js";
+import "./chunk-HMJ2P3SV.js";
+import "./chunk-7E7UCJHS.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   WorkspaceDisplayNameValidationError,
@@ -286,13 +293,13 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-BUGYW6FB.js";
+} from "./chunk-4IDJQOCO.js";
 import {
   CHANNEL_PROMPT_META_KEY,
   DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   REQUESTED_SESSION_ID_META_KEY,
   gradeActiveWorkCoverage
-} from "./chunk-LURJYO2T.js";
+} from "./chunk-OZ6KS6KW.js";
 import {
   BranchWhilePromptActiveError,
   BridgeChannelQuarantinedError,
@@ -343,29 +350,30 @@ import {
   MAX_CHANNEL_STARTUP_FAILURE_CHANNEL_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_CODE_LENGTH,
   MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
-  QWEN_SERVER_TOKEN_ENV,
   isChannelDeliveryError,
   isChannelWebhookEnqueueError
-} from "./chunk-ND7NOI4P.js";
+} from "./chunk-7CWEZQ6T.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-A6NRNRKE.js";
+} from "./chunk-JVPFTDBK.js";
+import {
+  QWEN_SERVER_TOKEN_ENV
+} from "./chunk-GYTKQYDB.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
 import "./chunk-UDG5EZJI.js";
-import "./chunk-3VUENPWF.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
+import "./chunk-3VUENPWF.js";
 import "./chunk-5HBA2Z7V.js";
-import "./chunk-K6KS3LTN.js";
-import "./chunk-7E7UCJHS.js";
 import {
   sanitizeLogText
-} from "./chunk-AW27A43Y.js";
+} from "./chunk-E55H6BZ7.js";
 import "./chunk-IW6RQPQB.js";
 import {
+  WORKSPACE_RESTRICTED_SETTING_KEYS,
   getDialogSettingKeys,
   getModelProvidersOwnerScope,
   getNestedProperty,
@@ -374,26 +382,26 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-6UQSU7CQ.js";
-import "./chunk-7DMTAQJ6.js";
+} from "./chunk-C2BAEV64.js";
 import "./chunk-RKUWKYED.js";
+import "./chunk-GXWY24QS.js";
+import "./chunk-GOXKNSDZ.js";
+import "./chunk-IDS7MSUP.js";
 import {
   detectSystemLanguage,
   resolveLanguageSetting
-} from "./chunk-OE52YHCZ.js";
+} from "./chunk-W2WRNJKX.js";
 import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-OVH5Y7KS.js";
-import "./chunk-GOXKNSDZ.js";
-import "./chunk-IDS7MSUP.js";
-import "./chunk-CXJHQVEK.js";
-import "./chunk-RDG44S5I.js";
-import "./chunk-YLFLHKDL.js";
+import "./chunk-IN66KO3N.js";
+import "./chunk-5PA6UEYA.js";
+import "./chunk-H4JK2A2V.js";
+import "./chunk-W3N5XAZ6.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-L4HVF7LM.js";
+} from "./chunk-RQ5ASDFQ.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -423,18 +431,20 @@ import {
   shouldShowStep,
   watchRepoBranch,
   writeWorkspaceContextFile
-} from "./chunk-62JOGZL5.js";
+} from "./chunk-RUQBJS34.js";
+import "./chunk-LRLMDV5X.js";
+import "./chunk-LRKMQPMD.js";
 import "./chunk-LJZSMWOH.js";
-import "./chunk-5HJUPACR.js";
-import "./chunk-2GXYDNXP.js";
-import "./chunk-TBVSALA3.js";
+import "./chunk-H2MDBYLL.js";
+import "./chunk-JLGFGPZJ.js";
+import "./chunk-SKNVVYIJ.js";
 import {
   readWorktreeSession,
   writeWorktreeSession
-} from "./chunk-7NBVNAJJ.js";
-import "./chunk-MZKWFWVG.js";
-import "./chunk-2Z6LSQMF.js";
-import "./chunk-RDQ7QB4Y.js";
+} from "./chunk-UCSV2IZW.js";
+import "./chunk-T2HMXHYA.js";
+import "./chunk-3FSBMAYD.js";
+import "./chunk-XJS54K4A.js";
 import "./chunk-ZPJWUGCS.js";
 import {
   QwenOAuth2Client,
@@ -444,9 +454,8 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-O5BDEWBC.js";
-import "./chunk-KM73TBQ4.js";
-import "./chunk-EFB657PR.js";
+} from "./chunk-ZWKGZB2K.js";
+import "./chunk-OX44MOAN.js";
 import {
   BuiltinAgentRegistry,
   Client,
@@ -468,12 +477,16 @@ import {
   SessionOrganizationError,
   SessionOrganizationService,
   SessionService,
+  SessionStorageEntryError,
+  SessionTranscriptChangedError,
   SessionTranscriptCursorCodec,
+  SessionTranscriptIdentityUnavailableError,
   SessionTranscriptPageTooLargeError,
   SessionTranscriptReader,
   SessionTranscriptSnapshotUnavailableError,
   SessionTranscriptTooLargeError,
   SessionWriterError,
+  SessionWriterUnavailableError,
   StandardFileSystemService,
   StdioClientTransport,
   StreamableHTTPClientTransport,
@@ -497,20 +510,20 @@ import {
   sleepInhibitor,
   stripTerminalControlSequences,
   upsertSessionPr
-} from "./chunk-T6XLJRQY.js";
+} from "./chunk-D6XO27Z5.js";
 import "./chunk-GOFAQQZA.js";
+import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-5M6IDOMF.js";
-import "./chunk-KVGR4MCF.js";
-import "./chunk-XZJKSETB.js";
-import "./chunk-YMVFIYHV.js";
-import "./chunk-6PVPNMXU.js";
-import "./chunk-7DYNJFES.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-DJEHYM4H.js";
+} from "./chunk-3UZCLCXR.js";
+import "./chunk-TOF4UZHH.js";
+import "./chunk-O3BUXIPM.js";
+import "./chunk-ZLTEQYNC.js";
+import "./chunk-6PVPNMXU.js";
+import "./chunk-AYVIGUUK.js";
 import {
   nextFireTime,
   parseCron
@@ -523,38 +536,39 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-AZF6SME3.js";
+} from "./chunk-JECO75XD.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import {
   GitWorktreeService,
   writeWorktreeSessionMarker
-} from "./chunk-GIWB5QLV.js";
+} from "./chunk-LJP2BBMK.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-VUMLT7E5.js";
-import "./chunk-ISJMN3ML.js";
-import "./chunk-XLDFW44M.js";
+import "./chunk-5Y2JCJAH.js";
+import "./chunk-T2CRBIDJ.js";
+import "./chunk-77TOMRBG.js";
 import {
   findGitRoot,
   glob
-} from "./chunk-Q54XG7IX.js";
-import "./chunk-FEMQ6Y7W.js";
-import "./chunk-2TRNCJK4.js";
-import "./chunk-NUGZAFR2.js";
+} from "./chunk-DEYPMJPD.js";
+import "./chunk-T6OODF2U.js";
+import "./chunk-27ONXAFY.js";
+import "./chunk-ZEADBZLO.js";
 import {
   parseGoalControlRequest
-} from "./chunk-LDGWX737.js";
+} from "./chunk-FN5C6C7G.js";
 import {
   APPROVAL_MODES
-} from "./chunk-VLRBJ24J.js";
+} from "./chunk-BVE5EMIG.js";
 import "./chunk-MLXTMF7H.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-WRT324N6.js";
-import "./chunk-YDJRMQU4.js";
+import "./chunk-FVDQ5E67.js";
+import "./chunk-V3GINY6K.js";
+import "./chunk-QHMLYMMS.js";
 import {
   recordDaemonBridgeError,
   recordDaemonHttpRequest
-} from "./chunk-SJ4HB27T.js";
+} from "./chunk-SDVF6A42.js";
 import "./chunk-P3QQPMQA.js";
 import {
   addDaemonRequestAttribute,
@@ -567,24 +581,24 @@ import {
   recordDaemonHttpResponse,
   runWithDaemonTelemetryContext,
   withDaemonRequestSpan
-} from "./chunk-2UZJWSVD.js";
+} from "./chunk-ILPXSKGQ.js";
 import "./chunk-XWRJCPHC.js";
 import "./chunk-VNOVK4I7.js";
 import "./chunk-SAH4BD2J.js";
-import "./chunk-VSNPOSDN.js";
-import "./chunk-I432KXWD.js";
+import "./chunk-ZKAZP2ZG.js";
+import "./chunk-DP7LABIB.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-7IV52LTO.js";
-import "./chunk-AXMWHKXA.js";
+import "./chunk-2LD5U7Q3.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-2J3OJGTL.js";
-import "./chunk-LI4YHTQK.js";
-import "./chunk-QKBYFU2Q.js";
-import "./chunk-C72BXMJ5.js";
+import "./chunk-I6VVOZDK.js";
+import "./chunk-K2OJUPOE.js";
+import "./chunk-CFKIH3D3.js";
+import "./chunk-EB4VDXNI.js";
+import "./chunk-FJWICLG7.js";
 import {
   parseLineTolerant,
   read
-} from "./chunk-FDD2IUEL.js";
+} from "./chunk-UX3IFLJM.js";
 import "./chunk-YRLW2MSX.js";
 import "./chunk-VGC4I5JJ.js";
 import {
@@ -595,42 +609,41 @@ import {
   getAllGeminiMdFilenames,
   isUtf8CompatibleEncoding,
   isWithinRoot
-} from "./chunk-IWOWEENB.js";
-import "./chunk-HIK2OF33.js";
-import "./chunk-ZRYQMWEP.js";
-import "./chunk-2E3V7G6Y.js";
-import "./chunk-F6WFNA7U.js";
+} from "./chunk-WBT3STGU.js";
+import "./chunk-PVBT5QPD.js";
+import "./chunk-IPQA4SR5.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
-import "./chunk-YHC2EYYG.js";
-import "./chunk-PZRUV52H.js";
-import "./chunk-JGUBDRBC.js";
-import "./chunk-HDKCKCYO.js";
+import "./chunk-SLEWBQWM.js";
+import "./chunk-4X5GYZFO.js";
+import "./chunk-XZA32HII.js";
+import "./chunk-7QGEJI7M.js";
+import "./chunk-GTUKW3I6.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   isTelemetrySdkInitialized,
   redactUrlCredentials,
   stripAnsiAndControl
-} from "./chunk-GAHYKJPV.js";
+} from "./chunk-6US7BF3G.js";
 import "./chunk-74TONY4F.js";
-import "./chunk-XL5K4SVK.js";
+import "./chunk-VL4YX3FH.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-WZDM44SB.js";
-import "./chunk-K623ENWT.js";
+} from "./chunk-JUIJ3FXC.js";
+import "./chunk-E6FGMDFQ.js";
 import {
   escapeXml
 } from "./chunk-AQ37AY7B.js";
-import "./chunk-K52PZNU4.js";
-import "./chunk-6NFAEG54.js";
+import "./chunk-RRKNX553.js";
+import "./chunk-KOJ6MHD5.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   getErrorMessage,
   runWithoutDebugLogSession
-} from "./chunk-A5F2YNO6.js";
+} from "./chunk-2NNTE2ED.js";
 import {
   writeStderrLine,
   writeStderrLineSafe,
@@ -3745,6 +3758,17 @@ function resolveWorkspaceRuntimeFromParam(registry, req, res, paramName = "works
   return runtime;
 }
 __name(resolveWorkspaceRuntimeFromParam, "resolveWorkspaceRuntimeFromParam");
+function resolveTrustedRuntime(registry, req, res, paramName = "workspace") {
+  const runtime = resolveWorkspaceRuntimeFromParam(
+    registry,
+    req,
+    res,
+    paramName
+  );
+  if (!runtime) return null;
+  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
+}
+__name(resolveTrustedRuntime, "resolveTrustedRuntime");
 function resolveWorkspaceRuntimeWithLiveCompatibilityFromParam(registry, req, res, paramName = "workspace") {
   if (typeof registry.getManagedEntryByWorkspaceId !== "function" || typeof registry.getManagedEntryByWorkspaceCwd !== "function") {
     return resolveWorkspaceRuntimeFromParam(registry, req, res, paramName);
@@ -8280,56 +8304,68 @@ function isBoundTask(task) {
   return typeof task.sessionId === "string" && task.sessionId.length > 0;
 }
 __name(isBoundTask, "isBoundTask");
-async function disableTasksForSessions(projectRoot, sessionIds) {
+async function disableTasksForSessions(projectRoot, sessionIds, options = {}) {
   if (sessionIds.length === 0) return;
   const targets = new Set(sessionIds);
-  await updateCronTasks(projectRoot, (tasks) => {
-    let changed = false;
-    const next = tasks.map((task) => {
-      if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled !== false) {
-        changed = true;
-        return { ...task, enabled: false, disabledByArchive: true };
-      }
-      return task;
-    });
-    return changed ? next : tasks;
-  });
+  await updateCronTasks(
+    projectRoot,
+    (tasks) => {
+      let changed = false;
+      const next = tasks.map((task) => {
+        if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled !== false) {
+          changed = true;
+          return { ...task, enabled: false, disabledByArchive: true };
+        }
+        return task;
+      });
+      return changed ? next : tasks;
+    },
+    options
+  );
 }
 __name(disableTasksForSessions, "disableTasksForSessions");
-async function enableTasksForSessions(projectRoot, sessionIds, now = Date.now()) {
+async function enableTasksForSessions(projectRoot, sessionIds, now = Date.now(), options = {}) {
   if (sessionIds.length === 0) return;
   const targets = new Set(sessionIds);
-  await updateCronTasks(projectRoot, (tasks) => {
-    let changed = false;
-    const next = tasks.map((task) => {
-      if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled === false && task.disabledByArchive === true) {
-        changed = true;
-        const resumed = { ...task, enabled: true };
-        delete resumed.disabledByArchive;
-        const minute = now - now % 6e4;
-        if (resumed.recurring) {
-          resumed.lastFiredAt = minute;
-        } else {
-          resumed.createdAt = now;
-          resumed.lastFiredAt = minute;
+  await updateCronTasks(
+    projectRoot,
+    (tasks) => {
+      let changed = false;
+      const next = tasks.map((task) => {
+        if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled === false && task.disabledByArchive === true) {
+          changed = true;
+          const resumed = { ...task, enabled: true };
+          delete resumed.disabledByArchive;
+          const minute = now - now % 6e4;
+          if (resumed.recurring) {
+            resumed.lastFiredAt = minute;
+          } else {
+            resumed.createdAt = now;
+            resumed.lastFiredAt = minute;
+          }
+          return resumed;
         }
-        return resumed;
-      }
-      return task;
-    });
-    return changed ? next : tasks;
-  });
+        return task;
+      });
+      return changed ? next : tasks;
+    },
+    options
+  );
 }
 __name(enableTasksForSessions, "enableTasksForSessions");
-async function removeTasksForSessions(projectRoot, sessionIds) {
+async function removeTasksForSessions(projectRoot, sessionIds, options = {}) {
   if (sessionIds.length === 0) return;
   const targets = new Set(sessionIds);
-  await updateCronTasks(projectRoot, (tasks) => {
-    const next = tasks.filter(
-      (task) => !isBoundTask(task) || !targets.has(task.sessionId)
-    );
-    return next.length === tasks.length ? tasks : next;
-  });
+  await updateCronTasks(
+    projectRoot,
+    (tasks) => {
+      const next = tasks.filter(
+        (task) => !isBoundTask(task) || !targets.has(task.sessionId)
+      );
+      return next.length === tasks.length ? tasks : next;
+    },
+    options
+  );
 }
 __name(removeTasksForSessions, "removeTasksForSessions");
 
@@ -8451,10 +8487,22 @@ async function runWithDaemonWriterLease(params) {
   } = params;
   let lease;
   try {
-    lease = await service.acquireSessionWriterLease(sessionId, {
+    const leaseOptions = {
       processKind: "daemon",
-      reclaimPolicy: "never"
-    });
+      reclaimPolicy: "never",
+      takeoverPolicy: "certified"
+    };
+    try {
+      lease = await service.acquireSessionWriterLease(sessionId, leaseOptions);
+    } catch (error2) {
+      if (!(error2 instanceof SessionWriterUnavailableError) && !(error2 instanceof SessionTranscriptChangedError)) {
+        throw error2;
+      }
+      lease = await service.acquireSessionMaintenanceLease(
+        sessionId,
+        leaseOptions
+      );
+    }
   } catch (error2) {
     return { mutationApplied: false, error: error2 };
   }
@@ -8531,27 +8579,61 @@ function logMaintenanceLeaseReleaseFailure(params) {
 }
 __name(logMaintenanceLeaseReleaseFailure, "logMaintenanceLeaseReleaseFailure");
 async function classifySessionLocation(service, sessionId) {
-  return service.getSessionLocation(sessionId);
+  return service.getMaintainableSessionLocation(sessionId);
 }
 __name(classifySessionLocation, "classifySessionLocation");
 function sessionLocationError(sessionId) {
-  return new Error(`Session archive conflict: ${sessionId}`);
+  const error2 = new SessionConflictError(sessionId);
+  error2.message = `Session "${sessionId}" exists in both active and archived directories. Retry with resolveConflicts: true to keep one copy.`;
+  return error2;
 }
 __name(sessionLocationError, "sessionLocationError");
-function updateScheduledTaskForMaintenance(service, sessionId, action) {
+function updateScheduledTaskForMaintenance(service, sessionId, action, assertCanMutate) {
   if (action === "archive") {
-    return disableTasksForSessions(service.getProjectRoot(), [sessionId]);
+    return disableTasksForSessions(service.getProjectRoot(), [sessionId], {
+      assertCanCommit: assertCanMutate
+    });
   }
   if (action === "unarchive") {
-    return enableTasksForSessions(service.getProjectRoot(), [sessionId]);
+    return enableTasksForSessions(
+      service.getProjectRoot(),
+      [sessionId],
+      Date.now(),
+      { assertCanCommit: assertCanMutate }
+    );
   }
-  return removeTasksForSessions(service.getProjectRoot(), [sessionId]);
+  return removeTasksForSessions(service.getProjectRoot(), [sessionId], {
+    assertCanCommit: assertCanMutate
+  });
 }
 __name(updateScheduledTaskForMaintenance, "updateScheduledTaskForMaintenance");
-async function deletePersistedSessionWithLease(service, sessionId) {
+async function deletePersistedSessionWithLease(service, sessionId, assertCanMutate) {
   const initialLocation = await classifySessionLocation(service, sessionId);
   if (initialLocation === void 0) {
-    return { kind: "notFound", mutationApplied: false };
+    let maintenanceError;
+    try {
+      assertCanMutate?.();
+      await updateScheduledTaskForMaintenance(
+        service,
+        sessionId,
+        "delete",
+        assertCanMutate
+      );
+    } catch (error2) {
+      maintenanceError = error2;
+      logSessionArchiveWarning(
+        `scheduled task lifecycle update failed action=delete workspace=${safeLogValue(
+          service.getProjectRoot()
+        )} session=${safeLogValue(sessionId)} error=${safeLogValue(
+          errorMessage(error2)
+        )}`
+      );
+    }
+    return {
+      kind: "notFound",
+      mutationApplied: false,
+      maintenanceError
+    };
   }
   const mutation = await runWithDaemonWriterLease({
     action: "delete",
@@ -8565,26 +8647,38 @@ async function deletePersistedSessionWithLease(service, sessionId) {
           mutationApplied: false
         };
       }
-      await assertOwnedAndUnchanged();
-      const removed = await service.removeSession(sessionId);
+      const removed = await service.removeSession(sessionId, {
+        assertStorageUnchanged: assertOwnedAndUnchanged,
+        assertCanMutate
+      });
       return {
         value: removed ? "removed" : "notFound",
         mutationApplied: removed
       };
     }, "mutate"),
     mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === void 0, "mutationAppliedAfterError"),
-    afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(service, sessionId, "delete"), "afterMutationApplied")
+    afterMutationApplied: /* @__PURE__ */ __name(async () => {
+      assertCanMutate?.();
+      await updateScheduledTaskForMaintenance(
+        service,
+        sessionId,
+        "delete",
+        assertCanMutate
+      );
+    }, "afterMutationApplied")
   });
   if (mutation.error !== void 0) {
     return {
       kind: "error",
       error: mutation.error,
-      mutationApplied: mutation.mutationApplied
+      mutationApplied: mutation.mutationApplied,
+      maintenanceError: mutation.maintenanceError
     };
   }
   return {
     kind: mutation.value ?? "notFound",
-    mutationApplied: mutation.mutationApplied
+    mutationApplied: mutation.mutationApplied,
+    maintenanceError: mutation.maintenanceError
   };
 }
 __name(deletePersistedSessionWithLease, "deletePersistedSessionWithLease");
@@ -8595,6 +8689,7 @@ async function deleteDaemonSessions(params) {
     bridge,
     coordinator,
     coordinatorLockHeld = false,
+    assertCanMutate,
     onError
   } = params;
   const uniqueSessionIds = [
@@ -8609,10 +8704,12 @@ async function deleteDaemonSessions(params) {
     uniqueSessionIds.map(async (sessionId) => {
       try {
         const mutateSession = /* @__PURE__ */ __name(async () => {
+          assertCanMutate?.();
           const removePersistedSession = /* @__PURE__ */ __name(async () => {
             const result = await deletePersistedSessionWithLease(
               service,
-              sessionId
+              sessionId,
+              assertCanMutate
             );
             if (result.kind === "error") {
               onError?.({
@@ -8623,7 +8720,13 @@ async function deleteDaemonSessions(params) {
               return result;
             }
             try {
-              await bridge.deleteSessionAttachments(sessionId);
+              if (assertCanMutate) {
+                await bridge.deleteSessionAttachments(sessionId, {
+                  assertCanCommit: assertCanMutate
+                });
+              } else {
+                await bridge.deleteSessionAttachments(sessionId);
+              }
               return result;
             } catch (error2) {
               onError?.({
@@ -8634,7 +8737,8 @@ async function deleteDaemonSessions(params) {
               return {
                 kind: "error",
                 error: error2,
-                mutationApplied: result.mutationApplied
+                mutationApplied: result.mutationApplied,
+                maintenanceError: result.maintenanceError
               };
             }
           }, "removePersistedSession");
@@ -8688,6 +8792,12 @@ async function deleteDaemonSessions(params) {
     } else {
       errors.push({ sessionId, error: errorMessage(result.error) });
     }
+    if (result.maintenanceError !== void 0) {
+      errors.push({
+        sessionId,
+        error: "Scheduled task lifecycle update failed."
+      });
+    }
   }
   return { removed, notFound, errors };
 }
@@ -8833,7 +8943,9 @@ async function archiveDaemonSessions(params) {
     service,
     bridge,
     coordinator,
-    coordinatorLockHeld = false
+    coordinatorLockHeld = false,
+    resolveConflicts = false,
+    assertCanMutate
   } = params;
   const uniqueSessionIds = [
     ...new Set(sessionIds.map(normalizeSessionIdForLookup))
@@ -8847,6 +8959,7 @@ async function archiveDaemonSessions(params) {
     uniqueSessionIds.map(async (sessionId) => {
       try {
         const mutateSession = /* @__PURE__ */ __name(async () => {
+          assertCanMutate?.();
           try {
             await bridge.closeSession(sessionId, void 0, {
               requireAgentClose: true
@@ -8868,12 +8981,31 @@ async function archiveDaemonSessions(params) {
             return { kind: "notFound", mutationApplied: false };
           }
           if (initialLocation === "archived") {
+            let maintenanceError;
+            try {
+              await updateScheduledTaskForMaintenance(
+                service,
+                sessionId,
+                "archive",
+                assertCanMutate
+              );
+            } catch (error2) {
+              maintenanceError = error2;
+              logSessionArchiveWarning(
+                `scheduled task lifecycle update failed action=archive workspace=${safeLogValue(
+                  service.getProjectRoot()
+                )} session=${safeLogValue(sessionId)} error=${safeLogValue(
+                  errorMessage(error2)
+                )}`
+              );
+            }
             return {
               kind: "alreadyArchived",
-              mutationApplied: false
+              mutationApplied: false,
+              maintenanceError
             };
           }
-          if (initialLocation === "conflict") {
+          if (initialLocation === "conflict" && !resolveConflicts) {
             return {
               kind: "error",
               error: sessionLocationError(sessionId),
@@ -8901,17 +9033,18 @@ async function archiveDaemonSessions(params) {
                   mutationApplied: false
                 };
               }
-              if (lockedLocation === "conflict") {
+              if (lockedLocation === "conflict" && !resolveConflicts) {
                 throw sessionLocationError(sessionId);
               }
-              await assertOwnedAndUnchanged();
               const result = await service.archiveSessions([sessionId], {
-                knownLocation: "active"
+                resolveConflicts,
+                assertStorageUnchanged: assertOwnedAndUnchanged,
+                assertCanMutate
               });
               if (result.errors[0]) throw result.errors[0].error;
               if (result.archived.length > 0) {
                 return {
-                  value: "archived",
+                  value: result.resolvedConflicts.length ? "resolvedConflict" : "archived",
                   mutationApplied: true
                 };
               }
@@ -8921,18 +9054,28 @@ async function archiveDaemonSessions(params) {
               };
             }, "mutate"),
             mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === "archived", "mutationAppliedAfterError"),
-            afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(service, sessionId, "archive"), "afterMutationApplied")
+            afterMutationApplied: /* @__PURE__ */ __name(async () => {
+              assertCanMutate?.();
+              await updateScheduledTaskForMaintenance(
+                service,
+                sessionId,
+                "archive",
+                assertCanMutate
+              );
+            }, "afterMutationApplied")
           });
           if (mutation.error !== void 0) {
             return {
               kind: "error",
               error: mutation.error,
-              mutationApplied: mutation.mutationApplied
+              mutationApplied: mutation.mutationApplied,
+              maintenanceError: mutation.maintenanceError
             };
           }
           return {
             kind: mutation.value ?? "notFound",
-            mutationApplied: mutation.mutationApplied
+            mutationApplied: mutation.mutationApplied,
+            maintenanceError: mutation.maintenanceError
           };
         }, "mutateSession");
         return await (coordinatorLockHeld ? mutateSession() : coordinator.runExclusiveMany([sessionId], mutateSession));
@@ -8951,16 +9094,23 @@ async function archiveDaemonSessions(params) {
   );
   const archived = [];
   const alreadyArchived = [];
+  const resolvedConflicts = [];
   const notFound = [];
   const errors = [];
   for (let i = 0; i < results.length; i++) {
     const sessionId = uniqueSessionIds[i];
     const result = results[i];
     if (result.kind === "archived") archived.push(sessionId);
-    else if (result.kind === "alreadyArchived") {
+    else if (result.kind === "resolvedConflict") {
+      archived.push(sessionId);
+      resolvedConflicts.push(sessionId);
+    } else if (result.kind === "alreadyArchived") {
       alreadyArchived.push(sessionId);
     } else if (result.kind === "notFound") notFound.push(sessionId);
     else errors.push({ sessionId, error: result.error });
+    if ("maintenanceError" in result && result.maintenanceError !== void 0) {
+      errors.push({ sessionId, error: result.maintenanceError });
+    }
   }
   logSessionArchiveResult("archive", {
     requested: uniqueSessionIds,
@@ -8969,7 +9119,13 @@ async function archiveDaemonSessions(params) {
     notFound,
     errors
   });
-  return { archived, alreadyArchived, notFound, errors };
+  return {
+    archived,
+    alreadyArchived,
+    resolvedConflicts,
+    notFound,
+    errors
+  };
 }
 __name(archiveDaemonSessions, "archiveDaemonSessions");
 async function unarchiveDaemonSessions(params) {
@@ -8977,7 +9133,9 @@ async function unarchiveDaemonSessions(params) {
     sessionIds,
     service,
     coordinator,
-    coordinatorLockHeld = false
+    coordinatorLockHeld = false,
+    resolveConflicts = false,
+    assertCanMutate
   } = params;
   const uniqueSessionIds = [
     ...new Set(sessionIds.map(normalizeSessionIdForLookup))
@@ -8991,6 +9149,7 @@ async function unarchiveDaemonSessions(params) {
     uniqueSessionIds.map(async (sessionId) => {
       try {
         const mutateSession = /* @__PURE__ */ __name(async () => {
+          assertCanMutate?.();
           const initialLocation = await classifySessionLocation(
             service,
             sessionId
@@ -9004,7 +9163,8 @@ async function unarchiveDaemonSessions(params) {
               await updateScheduledTaskForMaintenance(
                 service,
                 sessionId,
-                "unarchive"
+                "unarchive",
+                assertCanMutate
               );
             } catch (error2) {
               maintenanceError = error2;
@@ -9022,7 +9182,7 @@ async function unarchiveDaemonSessions(params) {
               maintenanceError
             };
           }
-          if (initialLocation === "conflict") {
+          if (initialLocation === "conflict" && !resolveConflicts) {
             return {
               kind: "error",
               error: sessionLocationError(sessionId),
@@ -9050,17 +9210,18 @@ async function unarchiveDaemonSessions(params) {
                   mutationApplied: false
                 };
               }
-              if (lockedLocation === "conflict") {
+              if (lockedLocation === "conflict" && !resolveConflicts) {
                 throw sessionLocationError(sessionId);
               }
-              await assertOwnedAndUnchanged();
               const result = await service.unarchiveSessions([sessionId], {
-                knownLocation: "archived"
+                resolveConflicts,
+                assertStorageUnchanged: assertOwnedAndUnchanged,
+                assertCanMutate
               });
               if (result.errors[0]) throw result.errors[0].error;
               if (result.unarchived.length > 0) {
                 return {
-                  value: "unarchived",
+                  value: result.resolvedConflicts.length ? "resolvedConflict" : "unarchived",
                   mutationApplied: true
                 };
               }
@@ -9070,17 +9231,22 @@ async function unarchiveDaemonSessions(params) {
               };
             }, "mutate"),
             mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === "active", "mutationAppliedAfterError"),
-            afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(
-              service,
-              sessionId,
-              "unarchive"
-            ), "afterMutationApplied")
+            afterMutationApplied: /* @__PURE__ */ __name(async () => {
+              assertCanMutate?.();
+              await updateScheduledTaskForMaintenance(
+                service,
+                sessionId,
+                "unarchive",
+                assertCanMutate
+              );
+            }, "afterMutationApplied")
           });
           if (mutation.error !== void 0) {
             return {
               kind: "error",
               error: mutation.error,
-              mutationApplied: mutation.mutationApplied
+              mutationApplied: mutation.mutationApplied,
+              maintenanceError: mutation.maintenanceError
             };
           }
           return {
@@ -9105,13 +9271,17 @@ async function unarchiveDaemonSessions(params) {
   );
   const unarchived = [];
   const alreadyActive = [];
+  const resolvedConflicts = [];
   const notFound = [];
   const errors = [];
   for (let i = 0; i < results.length; i++) {
     const sessionId = uniqueSessionIds[i];
     const result = results[i];
     if (result.kind === "unarchived") unarchived.push(sessionId);
-    else if (result.kind === "alreadyActive") alreadyActive.push(sessionId);
+    else if (result.kind === "resolvedConflict") {
+      unarchived.push(sessionId);
+      resolvedConflicts.push(sessionId);
+    } else if (result.kind === "alreadyActive") alreadyActive.push(sessionId);
     else if (result.kind === "notFound") notFound.push(sessionId);
     else errors.push({ sessionId, error: result.error });
     if (result.maintenanceError !== void 0) {
@@ -9125,7 +9295,13 @@ async function unarchiveDaemonSessions(params) {
     notFound,
     errors
   });
-  return { unarchived, alreadyActive, notFound, errors };
+  return {
+    unarchived,
+    alreadyActive,
+    resolvedConflicts,
+    notFound,
+    errors
+  };
 }
 __name(unarchiveDaemonSessions, "unarchiveDaemonSessions");
 
@@ -9357,6 +9533,9 @@ var TRUSTED_WORKSPACE_METHODS = /* @__PURE__ */ new Set([
   `${QWEN_METHOD_NS}workspace/mcp/resources`,
   `${QWEN_METHOD_NS}workspace/mcp/servers/add`,
   `${QWEN_METHOD_NS}workspace/mcp/servers/remove`,
+  `${QWEN_METHOD_NS}sessions/delete`,
+  `${QWEN_METHOD_NS}sessions/archive`,
+  `${QWEN_METHOD_NS}sessions/unarchive`,
   `${QWEN_METHOD_NS}workspace/agents/list`,
   `${QWEN_METHOD_NS}workspace/agents/get`,
   `${QWEN_METHOD_NS}workspace/agents/create`,
@@ -9386,6 +9565,9 @@ var WORKSPACE_GENERATION_MUTATION_METHODS = /* @__PURE__ */ new Set([
   `${QWEN_METHOD_NS}file/edit`,
   `${QWEN_METHOD_NS}workspace/mcp/servers/add`,
   `${QWEN_METHOD_NS}workspace/mcp/servers/remove`,
+  `${QWEN_METHOD_NS}sessions/delete`,
+  `${QWEN_METHOD_NS}sessions/archive`,
+  `${QWEN_METHOD_NS}sessions/unarchive`,
   `${QWEN_METHOD_NS}workspace/agents/create`,
   `${QWEN_METHOD_NS}workspace/agents/update`,
   `${QWEN_METHOD_NS}workspace/agents/delete`,
@@ -10049,6 +10231,14 @@ var AcpDispatcher = class {
     }
     return [...new Set(sessionIds)];
   }
+  parseResolveConflicts(params) {
+    const value = params["resolveConflicts"];
+    if (value === void 0) return false;
+    if (typeof value !== "boolean") {
+      throw new AcpParamError("`resolveConflicts` must be a boolean");
+    }
+    return value;
+  }
   rejectActiveLiveSessionMutation(conn, id, sessionIds) {
     const activeSessionId = sessionIds.find(
       (sessionId) => this.liveSessionIsolation?.isSessionActive?.(sessionId)
@@ -12938,6 +13128,7 @@ var AcpDispatcher = class {
               service: svc,
               bridge: this.bridge,
               coordinator: this.archiveCoordinator,
+              assertCanMutate: assertGenerationOpen,
               onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
                 const safeSessionId = logSafe(sessionId.slice(0, 8));
                 const safeMessage = logSafe(error2);
@@ -12947,11 +13138,13 @@ var AcpDispatcher = class {
               }, "onError")
             })
           );
+          assertGenerationOpen?.();
           this.replyConn(conn, id, result);
           return;
         }
         case `${QWEN_METHOD_NS}sessions/archive`: {
           const ids = this.parseSessionIds(params);
+          const resolveConflicts = this.parseResolveConflicts(params);
           if (this.rejectActiveLiveSessionMutation(conn, id, ids)) return;
           const svc = new SessionService(this.boundWorkspace, {
             onWarning: logSessionArchiveWarning
@@ -12962,12 +13155,16 @@ var AcpDispatcher = class {
               sessionIds: ids,
               service: svc,
               bridge: this.bridge,
-              coordinator: this.archiveCoordinator
+              coordinator: this.archiveCoordinator,
+              resolveConflicts,
+              assertCanMutate: assertGenerationOpen
             })
           );
+          assertGenerationOpen?.();
           this.replyConn(conn, id, {
             archived: result.archived,
             alreadyArchived: result.alreadyArchived,
+            resolvedConflicts: result.resolvedConflicts,
             notFound: result.notFound,
             errors: this.serializeSessionErrors(result.errors)
           });
@@ -12975,6 +13172,7 @@ var AcpDispatcher = class {
         }
         case `${QWEN_METHOD_NS}sessions/unarchive`: {
           const ids = this.parseSessionIds(params);
+          const resolveConflicts = this.parseResolveConflicts(params);
           const svc = new SessionService(this.boundWorkspace, {
             onWarning: logSessionArchiveWarning
           });
@@ -12983,12 +13181,16 @@ var AcpDispatcher = class {
             () => unarchiveDaemonSessions({
               sessionIds: ids,
               service: svc,
-              coordinator: this.archiveCoordinator
+              coordinator: this.archiveCoordinator,
+              resolveConflicts,
+              assertCanMutate: assertGenerationOpen
             })
           );
+          assertGenerationOpen?.();
           this.replyConn(conn, id, {
             unarchived: result.unarchived,
             alreadyActive: result.alreadyActive,
+            resolvedConflicts: result.resolvedConflicts,
             notFound: result.notFound,
             errors: this.serializeSessionErrors(result.errors)
           });
@@ -18025,6 +18227,109 @@ var CdpTunnelRegistry = class {
   }
 };
 
+// packages/cli/src/serve/mcp-app-sandbox.ts
+init_esbuild_shims();
+var MAX_CSP_QUERY_LENGTH = 8192;
+var CSP_SOURCE_PATTERN = /^(?:https?|wss?):\/\/(?:\*\.)?[a-z0-9.-]+(?::\d+)?$/i;
+function sanitizeCspDomains(domains) {
+  if (!Array.isArray(domains)) return [];
+  return domains.filter(
+    (domain) => typeof domain === "string" && CSP_SOURCE_PATTERN.test(domain)
+  );
+}
+__name(sanitizeCspDomains, "sanitizeCspDomains");
+function parseMcpAppCsp(value) {
+  if (typeof value !== "string" || value.length > MAX_CSP_QUERY_LENGTH) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return {
+      connectDomains: sanitizeCspDomains(parsed["connectDomains"]),
+      resourceDomains: sanitizeCspDomains(parsed["resourceDomains"]),
+      frameDomains: sanitizeCspDomains(parsed["frameDomains"]),
+      baseUriDomains: sanitizeCspDomains(parsed["baseUriDomains"])
+    };
+  } catch {
+    return void 0;
+  }
+}
+__name(parseMcpAppCsp, "parseMcpAppCsp");
+function buildMcpAppCsp(csp) {
+  const resources = sanitizeCspDomains(csp?.resourceDomains).join(" ");
+  const connections = sanitizeCspDomains(csp?.connectDomains).join(" ");
+  const frames = sanitizeCspDomains(csp?.frameDomains).join(" ");
+  const baseUris = sanitizeCspDomains(csp?.baseUriDomains).join(" ");
+  return [
+    "default-src 'self' 'unsafe-inline'",
+    `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ${resources}`.trim(),
+    `style-src 'self' 'unsafe-inline' blob: data: ${resources}`.trim(),
+    `img-src 'self' data: blob: ${resources}`.trim(),
+    `font-src 'self' data: blob: ${resources}`.trim(),
+    `media-src 'self' data: blob: ${resources}`.trim(),
+    `connect-src 'self' ${connections}`.trim(),
+    `worker-src 'self' blob: ${resources}`.trim(),
+    frames ? `frame-src ${frames}` : "frame-src 'none'",
+    "form-action 'none'",
+    "object-src 'none'",
+    baseUris ? `base-uri ${baseUris}` : "base-uri 'none'"
+  ].join("; ");
+}
+__name(buildMcpAppCsp, "buildMcpAppCsp");
+var MCP_APP_SANDBOX_HTML = String.raw`<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <style>html,body,iframe{box-sizing:border-box;width:100%;height:100%;margin:0;border:0;background:transparent}</style>
+  </head>
+  <body>
+    <script>
+      (() => {
+        if (window.self === window.top) return;
+        const configuredHostOrigin = new URL(window.location.href).searchParams.get('hostOrigin');
+        const hostUrl = new URL(configuredHostOrigin || document.referrer);
+        if (!['localhost', '127.0.0.1', '[::1]'].includes(hostUrl.hostname)) return;
+        const hostOrigin = hostUrl.origin;
+        const inner = document.createElement('iframe');
+        inner.setAttribute('sandbox', 'allow-scripts allow-forms');
+        inner.style.cssText = 'width:100%;height:100%;border:0;background:transparent';
+        document.body.appendChild(inner);
+
+        window.addEventListener('message', (event) => {
+          if (event.source === window.parent) {
+            if (event.origin !== hostOrigin) return;
+            if (event.data?.method === 'ui/notifications/sandbox-resource-ready') {
+              const params = event.data.params || {};
+              if (typeof params.html === 'string') {
+                inner.srcdoc = params.html;
+              }
+              return;
+            }
+            inner.contentWindow?.postMessage(event.data, '*');
+            return;
+          }
+          if (event.source === inner.contentWindow && event.origin === 'null') {
+            window.parent.postMessage(event.data, hostOrigin);
+          }
+        });
+        window.parent.postMessage({
+          jsonrpc: '2.0',
+          method: 'ui/notifications/sandbox-proxy-ready',
+          params: {},
+        }, hostOrigin);
+      })();
+    </script>
+  </body>
+</html>`;
+function mountMcpAppSandbox(app) {
+  app.get("/mcp-app-sandbox", (req, res) => {
+    const csp = parseMcpAppCsp(req.query["csp"]);
+    res.status(200).set("Content-Security-Policy", buildMcpAppCsp(csp)).set("Cache-Control", "no-cache, no-store, must-revalidate").set("X-Content-Type-Options", "nosniff").set("Referrer-Policy", "strict-origin-when-cross-origin").type("html").send(MCP_APP_SANDBOX_HTML);
+  });
+}
+__name(mountMcpAppSandbox, "mountMcpAppSandbox");
+
 // packages/cli/src/serve/workspace-generation.ts
 init_esbuild_shims();
 
@@ -25963,7 +26268,26 @@ function registerSessionRoutes(app, deps) {
     generation.guard.assertOpen();
     return true;
   }, "assertCurrentInternalGeneration");
-  const resolveQualifiedSessionRuntime = /* @__PURE__ */ __name(async (req, res, route, sessionIds, archiveState) => {
+  const hasLifecycleStorageEvidence = /* @__PURE__ */ __name(async (service, sessionId) => {
+    try {
+      return await service.getMaintainableSessionLocation(sessionId) !== void 0;
+    } catch (error2) {
+      if (error2 instanceof SessionStorageEntryError) {
+        return error2.reason !== "foreign_project";
+      }
+      if (error2 instanceof SessionTranscriptIdentityUnavailableError) {
+        return true;
+      }
+      if (error2 instanceof SessionTranscriptChangedError) {
+        return true;
+      }
+      if (error2 !== null && typeof error2 === "object" && typeof error2.code === "string") {
+        return true;
+      }
+      throw error2;
+    }
+  }, "hasLifecycleStorageEvidence");
+  const resolveQualifiedSessionRuntime = /* @__PURE__ */ __name(async (req, res, route, sessionIds, archiveState, options = {}) => {
     const target = resolveQualifiedSessionTarget(req, res);
     if (!target) return void 0;
     if (target.kind === "ordinary") return target.runtime;
@@ -25976,6 +26300,12 @@ function registerSessionRoutes(app, deps) {
     const runtime = generation.runtime;
     const service = createWorkspaceRuntimeSessionService(runtime);
     for (const sessionId of sessionIds) {
+      if (options.lifecycleMaintenance) {
+        if (!await hasLifecycleStorageEvidence(service, sessionId)) {
+          throw new SessionNotFoundError(sessionId);
+        }
+        continue;
+      }
       const location = await service.getSessionLocation(sessionId);
       if (location === "conflict") {
         if (archiveState !== "active") {
@@ -26568,20 +26898,42 @@ function registerSessionRoutes(app, deps) {
   }, "resolveSessionAnyStateRuntime");
   const resolveSessionBatchRuntime = /* @__PURE__ */ __name(async (req, res, route, sessionIds) => {
     if (req) {
-      return resolveQualifiedSessionRuntime(req, res, route, sessionIds, "any");
+      return resolveQualifiedSessionRuntime(
+        req,
+        res,
+        route,
+        sessionIds,
+        "any",
+        { lifecycleMaintenance: true }
+      );
     }
     let internalRuntime;
     let hasInternalSession = false;
-    const hasOrdinarySession = /* @__PURE__ */ __name(async (sessionId) => {
-      for (const runtime of workspaceRegistry.list()) {
-        if (await createWorkspaceRuntimeSessionService(
-          runtime
-        ).sessionExistsInAnyState(sessionId)) {
-          return true;
+    let hasOrdinaryLiveSession = false;
+    const findOrdinarySessions = /* @__PURE__ */ __name(async (sessionId) => {
+      const runtimes = /* @__PURE__ */ new Set();
+      for (const entry of workspaceRegistry.listAllEntries()) {
+        const generation2 = entry.current;
+        if (entry.internal || !generation2) continue;
+        if (entry.state !== "active" || entry.current !== generation2 || generation2.guard.closed) {
+          sendWorkspaceRuntimeUnavailable(res);
+          return void 0;
         }
+        generation2.guard.assertOpen();
+        const exists = await hasLifecycleStorageEvidence(
+          createWorkspaceRuntimeSessionService(generation2.runtime),
+          sessionId
+        );
+        if (entry.state !== "active" || entry.current !== generation2 || generation2.guard.closed) {
+          sendWorkspaceRuntimeUnavailable(res);
+          return void 0;
+        }
+        if (!exists) continue;
+        generation2.guard.assertOpen();
+        runtimes.add(generation2.runtime);
       }
-      return false;
-    }, "hasOrdinarySession");
+      return runtimes;
+    }, "findOrdinarySessions");
     const sendBatchWorkspaceConflict = /* @__PURE__ */ __name(() => {
       res.status(409).json({
         error: "All sessions in this operation must share one workspace.",
@@ -26590,17 +26942,28 @@ function registerSessionRoutes(app, deps) {
     }, "sendBatchWorkspaceConflict");
     for (const sessionId of sessionIds) {
       const candidates = /* @__PURE__ */ new Set();
+      const ordinaryLiveCandidates = /* @__PURE__ */ new Set();
       const owner = workspaceRegistry.resolveLiveSessionOwner(sessionId);
       if (owner.kind === "unavailable") {
         sendWorkspaceRuntimeUnavailable(res);
         return void 0;
       }
-      if (owner.kind === "found" && isInternalWorkspaceRuntime(owner.runtime)) {
-        candidates.add(owner.runtime);
+      if (owner.kind === "found") {
+        if (isInternalWorkspaceRuntime(owner.runtime)) {
+          candidates.add(owner.runtime);
+        } else {
+          ordinaryLiveCandidates.add(owner.runtime);
+          hasOrdinaryLiveSession = true;
+        }
       }
       if (owner.kind === "ambiguous") {
         for (const runtime of owner.runtimes) {
-          if (isInternalWorkspaceRuntime(runtime)) candidates.add(runtime);
+          if (isInternalWorkspaceRuntime(runtime)) {
+            candidates.add(runtime);
+          } else {
+            ordinaryLiveCandidates.add(runtime);
+            hasOrdinaryLiveSession = true;
+          }
         }
       }
       for (const entry of workspaceRegistry.listAllEntries()) {
@@ -26611,32 +26974,32 @@ function registerSessionRoutes(app, deps) {
         }
         const runtime = generation2.runtime;
         const service = createWorkspaceRuntimeSessionService(runtime);
-        const exists = await service.sessionExistsInAnyState(sessionId);
+        const exists = await hasLifecycleStorageEvidence(service, sessionId);
         if (!assertCurrentInternalGeneration(entry, generation2, res)) {
           return void 0;
         }
         if (!exists) continue;
-        const metadata = await readLoadableLiveConversationMetadata(
-          sessionId,
-          service
-        );
-        if (!assertCurrentInternalGeneration(entry, generation2, res)) {
-          return void 0;
-        }
-        if (!metadata) continue;
         candidates.add(runtime);
       }
-      if (candidates.size > 0) {
-        for (const runtime of workspaceRegistry.list()) {
-          const service = createWorkspaceRuntimeSessionService(runtime);
-          if (await service.sessionExistsInAnyState(sessionId)) {
-            candidates.add(runtime);
-          }
+      if (candidates.size > 0 || hasInternalSession) {
+        if (hasOrdinaryLiveSession && ordinaryLiveCandidates.size === 0) {
+          sendBatchWorkspaceConflict();
+          return void 0;
+        }
+        for (const runtime of ordinaryLiveCandidates) {
+          candidates.add(runtime);
+        }
+        const ordinarySessions = await findOrdinarySessions(sessionId);
+        if (!ordinarySessions) return void 0;
+        for (const runtime of ordinarySessions) {
+          candidates.add(runtime);
         }
       }
       if (candidates.size === 0) {
         if (hasInternalSession) {
-          if (await hasOrdinarySession(sessionId)) {
+          const ordinarySessions = await findOrdinarySessions(sessionId);
+          if (!ordinarySessions) return void 0;
+          if (ordinarySessions.size > 0) {
             sendBatchWorkspaceConflict();
             return void 0;
           }
@@ -26663,20 +27026,15 @@ function registerSessionRoutes(app, deps) {
     }
     for (const sessionId of sessionIds) {
       const service = createWorkspaceRuntimeSessionService(internalRuntime);
-      if (!await service.sessionExistsInAnyState(sessionId)) {
-        if (await hasOrdinarySession(sessionId)) {
+      if (!await hasLifecycleStorageEvidence(service, sessionId)) {
+        const ordinarySessions = await findOrdinarySessions(sessionId);
+        if (!ordinarySessions) return void 0;
+        if (ordinarySessions.size > 0) {
           sendBatchWorkspaceConflict();
           return void 0;
         }
         throw new SessionNotFoundError(sessionId);
       }
-      const metadata = await readLoadableLiveConversationMetadata(
-        sessionId,
-        service
-      );
-      if (!metadata) {
-        throw new SessionNotFoundError(sessionId);
-      }
     }
     const internalEntry = workspaceRegistry.getManagedEntryByWorkspaceCwd(
       internalRuntime.workspaceCwd
@@ -26709,6 +27067,16 @@ function registerSessionRoutes(app, deps) {
     }
     return [...new Set(sessionIds)];
   }, "parseSessionIdsBody");
+  const parseResolveConflicts = /* @__PURE__ */ __name((req, res) => {
+    const value = safeBody(req)["resolveConflicts"];
+    if (value === void 0) return false;
+    if (typeof value === "boolean") return value;
+    res.status(400).json({
+      error: "`resolveConflicts` must be a boolean",
+      code: "invalid_request"
+    });
+    return void 0;
+  }, "parseResolveConflicts");
   const hasControlCharacter = /* @__PURE__ */ __name((value) => Array.from(value).some((character) => {
     const code = character.charCodeAt(0);
     return code <= 31 || code === 127;
@@ -26733,7 +27101,7 @@ function registerSessionRoutes(app, deps) {
   }, "parseSessionPrBody");
   const serializeSessionErrors = /* @__PURE__ */ __name((errors, redactDetails = false) => errors.map((e) => ({
     sessionId: e.sessionId,
-    error: redactDetails ? "Session operation failed." : e.error instanceof Error ? e.error.message : String(e.error)
+    error: redactDetails && !(e.error instanceof SessionConflictError) ? "Session operation failed." : e.error instanceof Error ? e.error.message : String(e.error)
   })), "serializeSessionErrors");
   const runResolvedSessionBatch = /* @__PURE__ */ __name(async (params) => {
     const { req, res, route, sessionIds, run: run2 } = params;
@@ -26759,14 +27127,18 @@ function registerSessionRoutes(app, deps) {
         sendWorkspaceRuntimeUnavailable(res);
         return void 0;
       }
-      return { result: await run2(verifiedRuntime, true), internal: true };
+      return {
+        result: await run2(verifiedRuntime, true),
+        internal: isInternalWorkspaceRuntime(verifiedRuntime)
+      };
     });
   }, "runResolvedSessionBatch");
   const deleteSessions = /* @__PURE__ */ __name((req, res, route, sessionIds) => {
     const run2 = /* @__PURE__ */ __name(async (runtime, coordinatorLockHeld) => {
-      captureRuntimeGenerationAssertion(runtime)?.();
+      const assertCanMutate = captureRuntimeGenerationAssertion(runtime);
+      assertCanMutate?.();
       const service = createWorkspaceRuntimeSessionService(runtime);
-      return runWithSessionListInvalidation(
+      const result = await runWithSessionListInvalidation(
         runtime,
         ["active", "archived"],
         () => runWithWorkspaceRuntimeStorage(
@@ -26777,6 +27149,7 @@ function registerSessionRoutes(app, deps) {
             bridge: runtime.bridge,
             coordinator: archiveCoordinator,
             coordinatorLockHeld,
+            assertCanMutate,
             onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
               writeStderrLine(
                 `qwen serve: ${phase}Session failed for ${safeLogValue(sessionId)}: ${safeLogValue(error2)}`
@@ -26785,16 +27158,19 @@ function registerSessionRoutes(app, deps) {
           })
         )
       );
+      assertCanMutate?.();
+      return result;
     }, "run");
     return runResolvedSessionBatch({ req, res, route, sessionIds, run: run2 });
   }, "deleteSessions");
-  const archiveSessions = /* @__PURE__ */ __name((req, res, route, sessionIds) => {
+  const archiveSessions = /* @__PURE__ */ __name((req, res, route, sessionIds, resolveConflicts = false) => {
     const run2 = /* @__PURE__ */ __name(async (runtime, coordinatorLockHeld) => {
-      captureRuntimeGenerationAssertion(runtime)?.();
+      const assertCanMutate = captureRuntimeGenerationAssertion(runtime);
+      assertCanMutate?.();
       const service = createWorkspaceRuntimeSessionService(runtime, {
         onWarning: logSessionArchiveWarning
       });
-      return runWithSessionListInvalidation(
+      const result = await runWithSessionListInvalidation(
         runtime,
         ["active", "archived"],
         () => runWithWorkspaceRuntimeStorage(
@@ -26804,20 +27180,25 @@ function registerSessionRoutes(app, deps) {
             service,
             bridge: runtime.bridge,
             coordinator: archiveCoordinator,
-            coordinatorLockHeld
+            coordinatorLockHeld,
+            resolveConflicts,
+            assertCanMutate
           })
         )
       );
+      assertCanMutate?.();
+      return result;
     }, "run");
     return runResolvedSessionBatch({ req, res, route, sessionIds, run: run2 });
   }, "archiveSessions");
-  const unarchiveSessions = /* @__PURE__ */ __name((req, res, route, sessionIds) => {
+  const unarchiveSessions = /* @__PURE__ */ __name((req, res, route, sessionIds, resolveConflicts = false) => {
     const run2 = /* @__PURE__ */ __name(async (runtime, coordinatorLockHeld) => {
-      captureRuntimeGenerationAssertion(runtime)?.();
+      const assertCanMutate = captureRuntimeGenerationAssertion(runtime);
+      assertCanMutate?.();
       const service = createWorkspaceRuntimeSessionService(runtime, {
         onWarning: logSessionArchiveWarning
       });
-      return runWithSessionListInvalidation(
+      const result = await runWithSessionListInvalidation(
         runtime,
         ["active", "archived"],
         () => runWithWorkspaceRuntimeStorage(
@@ -26826,10 +27207,14 @@ function registerSessionRoutes(app, deps) {
             sessionIds,
             service,
             coordinator: archiveCoordinator,
-            coordinatorLockHeld
+            coordinatorLockHeld,
+            resolveConflicts,
+            assertCanMutate
           })
         )
       );
+      assertCanMutate?.();
+      return result;
     }, "run");
     return runResolvedSessionBatch({ req, res, route, sessionIds, run: run2 });
   }, "unarchiveSessions");
@@ -29107,19 +29492,23 @@ function registerSessionRoutes(app, deps) {
   app.post("/sessions/archive", mutate(), async (req, res) => {
     const uniqueIds = parseSessionIdsBody(req, res);
     if (uniqueIds === void 0) return;
+    const resolveConflicts = parseResolveConflicts(req, res);
+    if (resolveConflicts === void 0) return;
     if (rejectActiveLiveSessionMutation(res, uniqueIds)) return;
     try {
       const operation = await archiveSessions(
         void 0,
         res,
         "POST /sessions/archive",
-        uniqueIds
+        uniqueIds,
+        resolveConflicts
       );
       if (!operation) return;
       const { result } = operation;
       res.status(200).json({
         archived: result.archived,
         alreadyArchived: result.alreadyArchived,
+        resolvedConflicts: result.resolvedConflicts,
         notFound: result.notFound,
         errors: serializeSessionErrors(result.errors, operation.internal)
       });
@@ -29130,18 +29519,22 @@ function registerSessionRoutes(app, deps) {
   app.post("/sessions/unarchive", mutate(), async (req, res) => {
     const uniqueIds = parseSessionIdsBody(req, res);
     if (uniqueIds === void 0) return;
+    const resolveConflicts = parseResolveConflicts(req, res);
+    if (resolveConflicts === void 0) return;
     try {
       const operation = await unarchiveSessions(
         void 0,
         res,
         "POST /sessions/unarchive",
-        uniqueIds
+        uniqueIds,
+        resolveConflicts
       );
       if (!operation) return;
       const { result } = operation;
       res.status(200).json({
         unarchived: result.unarchived,
         alreadyActive: result.alreadyActive,
+        resolvedConflicts: result.resolvedConflicts,
         notFound: result.notFound,
         errors: serializeSessionErrors(result.errors, operation.internal)
       });
@@ -29182,14 +29575,23 @@ function registerSessionRoutes(app, deps) {
       const route = "POST /workspaces/:workspace/sessions/archive";
       const uniqueIds = parseSessionIdsBody(req, res);
       if (uniqueIds === void 0) return;
+      const resolveConflicts = parseResolveConflicts(req, res);
+      if (resolveConflicts === void 0) return;
       if (rejectActiveLiveSessionMutation(res, uniqueIds)) return;
       try {
-        const operation = await archiveSessions(req, res, route, uniqueIds);
+        const operation = await archiveSessions(
+          req,
+          res,
+          route,
+          uniqueIds,
+          resolveConflicts
+        );
         if (!operation) return;
         const { result } = operation;
         res.status(200).json({
           archived: result.archived,
           alreadyArchived: result.alreadyArchived,
+          resolvedConflicts: result.resolvedConflicts,
           notFound: result.notFound,
           errors: serializeSessionErrors(result.errors, operation.internal)
         });
@@ -29205,13 +29607,22 @@ function registerSessionRoutes(app, deps) {
       const route = "POST /workspaces/:workspace/sessions/unarchive";
       const uniqueIds = parseSessionIdsBody(req, res);
       if (uniqueIds === void 0) return;
+      const resolveConflicts = parseResolveConflicts(req, res);
+      if (resolveConflicts === void 0) return;
       try {
-        const operation = await unarchiveSessions(req, res, route, uniqueIds);
+        const operation = await unarchiveSessions(
+          req,
+          res,
+          route,
+          uniqueIds,
+          resolveConflicts
+        );
         if (!operation) return;
         const { result } = operation;
         res.status(200).json({
           unarchived: result.unarchived,
           alreadyActive: result.alreadyActive,
+          resolvedConflicts: result.resolvedConflicts,
           notFound: result.notFound,
           errors: serializeSessionErrors(result.errors, operation.internal)
         });
@@ -30788,6 +31199,15 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         });
         return;
       }
+      const parsedSessionId = parseCallerSuppliedSessionId(body["sessionId"]);
+      if (parsedSessionId.kind === "invalid") {
+        res.status(400).json({
+          error: '`sessionId` must be an RFC UUID v1-v5 (e.g. "550e8400-e29b-41d4-a716-446655440000")',
+          code: "invalid_session_id"
+        });
+        return;
+      }
+      const providedSessionId = parsedSessionId.kind === "valid" ? parsedSessionId.sessionId : void 0;
       let delivery;
       if (body["delivery"] !== void 0) {
         try {
@@ -30807,12 +31227,82 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       const enabled = body["enabled"] !== false;
       const taskId = generateCronTaskId();
       let boundSessionId;
+      let sessionMintedHere = false;
+      if (providedSessionId !== void 0 && !bridge) {
+        res.status(409).json({
+          error: "Session management is not available for this workspace",
+          code: "session_binding_unavailable"
+        });
+        return;
+      }
       if (bridge) {
+        if (providedSessionId !== void 0) {
+          try {
+            const owner = target.resolveLiveSessionOwner?.(providedSessionId);
+            if (owner?.kind === "unavailable") {
+              sendWorkspaceRuntimeUnavailable(res);
+              return;
+            }
+            if (owner?.kind === "ambiguous") {
+              res.status(500).json({
+                error: `Session owner is ambiguous for "${providedSessionId}"`,
+                code: "ambiguous_session_owner"
+              });
+              return;
+            }
+            if (owner?.kind === "found" && owner.runtime.workspaceCwd !== workspaceCwd) {
+              res.status(400).json({
+                error: "The requested session belongs to a different workspace; use that workspace's scheduled-task endpoint",
+                code: "session_workspace_mismatch"
+              });
+              return;
+            }
+            const summary = bridge.getSessionSummary(providedSessionId);
+            if (summary.workspaceCwd !== workspaceCwd) {
+              res.status(400).json({
+                error: "The requested session belongs to a different workspace; use that workspace's scheduled-task endpoint",
+                code: "session_workspace_mismatch"
+              });
+              return;
+            }
+            if (summary.hasActivePrompt) {
+              res.status(409).json({
+                error: "The requested session is busy; wait for its active prompt to finish before binding it to a task",
+                code: "session_busy"
+              });
+              return;
+            }
+            if (summary.sourceType === "scheduled_task") {
+              res.status(409).json({
+                error: "The requested session is already reserved for a scheduled task",
+                code: "session_already_bound"
+              });
+              return;
+            }
+          } catch (err) {
+            if (err instanceof SessionNotFoundError) {
+              res.status(404).json({
+                error: `Session '${providedSessionId}' was not found`,
+                code: "session_not_found"
+              });
+              return;
+            }
+            writeStderrLine(
+              `qwen serve: POST ${base} failed to look up session '${providedSessionId}': ${err instanceof Error ? err.message : String(err)}`
+            );
+            res.status(500).json({
+              error: "Failed to look up the requested session",
+              code: "scheduled_tasks_session_failed"
+            });
+            return;
+          }
+        }
         try {
-          if ((await runWithScheduledTaskTarget(
+          const tasks = await runWithScheduledTaskTarget(
             target,
             () => readCronTasks(workspaceCwd)
-          )).length >= MAX_SCHEDULED_TASKS) {
+          );
+          if (tasks.length >= MAX_SCHEDULED_TASKS) {
             res.status(409).json({
               error: `Maximum number of scheduled tasks (${MAX_SCHEDULED_TASKS}) reached`,
               code: "max_tasks_reached"
@@ -30822,43 +31312,48 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         } catch {
         }
         if (!requireOpenGeneration2(target, res)) return;
-        try {
-          const session = await runWithScheduledTaskTarget(
-            target,
-            () => bridge.spawnOrAttach({
-              workspaceCwd,
-              sessionScope: "thread",
-              sourceType: "scheduled_task",
-              sourceId: taskId
-            })
-          );
-          boundSessionId = session.sessionId;
-          if (!requireOpenGeneration2(target, res)) {
-            await teardownBoundSession(target, boundSessionId);
-            return;
-          }
+        if (providedSessionId !== void 0) {
+          boundSessionId = providedSessionId;
+        } else {
           try {
-            await runWithScheduledTaskTarget(
+            const session = await runWithScheduledTaskTarget(
               target,
-              async () => bridge.updateSessionMetadata(boundSessionId, {
-                displayName: scheduledTaskSessionName(
-                  nameResult.value ?? prompt
-                )
+              () => bridge.spawnOrAttach({
+                workspaceCwd,
+                sessionScope: "thread",
+                sourceType: "scheduled_task",
+                sourceId: taskId
               })
             );
-          } catch {
+            boundSessionId = session.sessionId;
+            sessionMintedHere = true;
+            if (!requireOpenGeneration2(target, res)) {
+              await teardownBoundSession(target, boundSessionId);
+              return;
+            }
+            try {
+              await runWithScheduledTaskTarget(
+                target,
+                async () => bridge.updateSessionMetadata(boundSessionId, {
+                  displayName: scheduledTaskSessionName(
+                    nameResult.value ?? prompt
+                  )
+                })
+              );
+            } catch {
+            }
+          } catch (err) {
+            if (sendActivityGateError(res, err)) return;
+            if (sendGenerationClosedError(res, err)) return;
+            writeStderrLine(
+              `qwen serve: POST ${base} failed to create the task's session: ${err instanceof Error ? err.message : String(err)}`
+            );
+            res.status(500).json({
+              error: "Failed to create the task's session",
+              code: "scheduled_tasks_session_failed"
+            });
+            return;
           }
-        } catch (err) {
-          if (sendActivityGateError(res, err)) return;
-          if (sendGenerationClosedError(res, err)) return;
-          writeStderrLine(
-            `qwen serve: POST ${base} failed to create the task's session: ${err instanceof Error ? err.message : String(err)}`
-          );
-          res.status(500).json({
-            error: "Failed to create the task's session",
-            code: "scheduled_tasks_session_failed"
-          });
-          return;
         }
       }
       const now = Date.now();
@@ -30873,15 +31368,20 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         lastFiredAt: now - now % 6e4,
         enabled,
         ...delivery !== void 0 ? { delivery } : {},
-        ...boundSessionId !== void 0 ? { sessionId: boundSessionId } : {},
+        ...boundSessionId !== void 0 ? {
+          sessionId: boundSessionId,
+          ...providedSessionId !== void 0 ? { sessionOwnedByTask: false } : {}
+        } : {},
         ...nameResult.value !== void 0 ? { name: nameResult.value } : {}
       };
       const rollbackSession = /* @__PURE__ */ __name(async () => {
-        if (boundSessionId !== void 0) {
+        if (boundSessionId !== void 0 && sessionMintedHere) {
           await teardownBoundSession(target, boundSessionId);
         }
       }, "rollbackSession");
       let overCap = false;
+      let alreadyBound = false;
+      let sessionNoLongerLive = false;
       let rollbackBefore;
       let rollbackAfter;
       try {
@@ -30890,6 +31390,24 @@ function registerScheduledTaskCrudRoutes(app, deps) {
           () => updateCronTasks(
             workspaceCwd,
             (tasks) => {
+              if (providedSessionId !== void 0 && tasks.some((task2) => task2.sessionId === providedSessionId)) {
+                alreadyBound = true;
+                return tasks;
+              }
+              if (providedSessionId !== void 0 && bridge) {
+                try {
+                  if (bridge.getSessionSummary(providedSessionId).sourceType === "scheduled_task") {
+                    alreadyBound = true;
+                    return tasks;
+                  }
+                } catch (err) {
+                  if (err instanceof SessionNotFoundError) {
+                    sessionNoLongerLive = true;
+                    return tasks;
+                  }
+                  throw err;
+                }
+              }
               if (tasks.length >= MAX_SCHEDULED_TASKS) {
                 overCap = true;
                 return tasks;
@@ -30937,6 +31455,20 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         });
         return;
       }
+      if (alreadyBound) {
+        res.status(409).json({
+          error: "The requested session is already bound to another scheduled task",
+          code: "session_already_bound"
+        });
+        return;
+      }
+      if (sessionNoLongerLive) {
+        res.status(404).json({
+          error: `Session '${providedSessionId}' was not found`,
+          code: "session_not_found"
+        });
+        return;
+      }
       if (task.delivery && task.sessionId) {
         channelDeliveryAuthorizations?.registerScheduledTask(workspaceCwd, {
           sessionId: task.sessionId,
@@ -31141,7 +31673,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         return;
       }
       const effectiveLabelChanged = patch.name !== void 0 || clearName || patch.prompt !== void 0 && updated.name === void 0;
-      if (bridge && updated.sessionId && effectiveLabelChanged) {
+      if (bridge && updated.sessionId && updated.sessionOwnedByTask !== false && effectiveLabelChanged) {
         try {
           bridge.updateSessionMetadata(updated.sessionId, {
             displayName: scheduledTaskSessionName(
@@ -31181,6 +31713,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         return;
       }
       let boundSessionId;
+      let sessionOwnedByTask = true;
       let removed = false;
       let rollbackBefore;
       let rollbackAfter;
@@ -31195,6 +31728,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
               const match = tasks[idx].sessionId;
               if (typeof match === "string" && match.length > 0) {
                 boundSessionId = match;
+                sessionOwnedByTask = tasks[idx].sessionOwnedByTask !== false;
               }
               removed = true;
               rollbackBefore = tasks;
@@ -31234,7 +31768,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         res.status(404).json({ error: "Task not found", code: "task_not_found" });
         return;
       }
-      if (boundSessionId && bridge) {
+      if (boundSessionId && sessionOwnedByTask && bridge) {
         try {
           await runWithScheduledTaskTarget(
             target,
@@ -31394,9 +31928,17 @@ function registerScheduledTasksRoutes(app, deps) {
             cleanupSession: /* @__PURE__ */ __name((sessionId) => deps.cleanupSession(runtime, sessionId), "cleanupSession")
           } : {}
         } : {},
-        bridge: runtime?.bridge ?? bridge,
+        // The runtime bridge only refines an ENABLED deps bridge; it must never
+        // re-enable binding when deps `bridge` is undefined. server.ts passes
+        // the bridge only when resident task-session management is on, and a
+        // bound task must always have something to keep it resident + rehydrate
+        // it — the same gate the qualified surface enforces below.
+        bridge: bridge === void 0 ? void 0 : runtime?.bridge ?? bridge,
         ...runtime?.generationGuard ? {
           assertGenerationOpen: /* @__PURE__ */ __name(() => runtime.generationGuard?.assertOpen(), "assertGenerationOpen")
+        } : {},
+        ...deps.workspaceRegistry ? {
+          resolveLiveSessionOwner: /* @__PURE__ */ __name((sessionId) => deps.workspaceRegistry.resolveLiveSessionOwner(sessionId), "resolveLiveSessionOwner")
         } : {}
       };
     }, "resolveTarget"),
@@ -31429,7 +31971,7 @@ function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
         sendConversationRuntimeUnavailable(res);
         return null;
       }
-      if (runtime.provenance === "live-conversation" && req.method === "POST" && req.params["id"] === void 0) {
+      if (runtime.provenance === "live-conversation" && req.method === "POST" && req.params["id"] === void 0 && parseCallerSuppliedSessionId(safeBody2(req)["sessionId"]).kind === "absent") {
         res.status(400).json({
           error: "Generic scheduled tasks cannot create sessions in the Conversations workspace.",
           code: "live_session_creation_reserved"
@@ -31448,7 +31990,8 @@ function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
         bridge: manageScheduledTaskSessions ? runtime.bridge : void 0,
         ...runtime.generationGuard ? {
           assertGenerationOpen: /* @__PURE__ */ __name(() => runtime.generationGuard?.assertOpen(), "assertGenerationOpen")
-        } : {}
+        } : {},
+        resolveLiveSessionOwner: /* @__PURE__ */ __name((sessionId) => workspaceRegistry.resolveLiveSessionOwner(sessionId), "resolveLiveSessionOwner")
       };
     }, "resolveTarget"),
     mutate,
@@ -31735,7 +32278,7 @@ async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawn
     (t) => !t.sessionId && t.enabled !== false && !taskHasLegacyCondition(t) && !binding.has(t.id)
   );
   const needsName = tasks.filter(
-    (t) => t.sessionId && t.enabled !== false && !taskHasLegacyCondition(t) && !renamed.has(t.sessionId)
+    (t) => t.sessionId && t.sessionOwnedByTask !== false && t.enabled !== false && !taskHasLegacyCondition(t) && !renamed.has(t.sessionId)
   );
   for (const task of unbound) {
     let spawnedSessionId;
@@ -32222,12 +32765,6 @@ function registerWorkspaceStatusRoutes(app, deps) {
   });
 }
 __name(registerWorkspaceStatusRoutes, "registerWorkspaceStatusRoutes");
-function resolveTrustedRuntime(registry, req, res) {
-  const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
-  if (!runtime) return null;
-  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
-}
-__name(resolveTrustedRuntime, "resolveTrustedRuntime");
 function registerWorkspaceQualifiedStatusRoutes(app, deps) {
   const { workspaceRegistry, sendBridgeError: sendBridgeError2 } = deps;
   app.get("/workspaces/:workspace/mcp", async (req, res) => {
@@ -32900,6 +33437,16 @@ var VALID_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace", "user"]);
 var QUALIFIED_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace"]);
 var mcpServerMutationQueues = /* @__PURE__ */ new Map();
 var SECURITY_SENSITIVE_SETTINGS = /* @__PURE__ */ new Set(["tools.approvalMode"]);
+function rejectWorkspaceRestrictedWrite(res, scope, key) {
+  if (scope !== "workspace" || !WORKSPACE_RESTRICTED_SETTING_KEYS.includes(key))
+    return false;
+  res.status(400).json({
+    error: `Setting "${key}" is not honored from workspace scope; set it at user scope instead`,
+    code: "workspace_restricted_setting"
+  });
+  return true;
+}
+__name(rejectWorkspaceRestrictedWrite, "rejectWorkspaceRestrictedWrite");
 function getAllowedKeys(includeLiveVoice = false) {
   const keys = new Set(
     getDialogSettingKeys().filter(
@@ -33116,6 +33663,7 @@ function registerWorkspaceSettingsRoutes(app, deps) {
         });
         return;
       }
+      if (rejectWorkspaceRestrictedWrite(res, scope, key)) return;
       if (LIVE_MANAGED_SETTINGS.has(key)) {
         res.status(400).json({
           error: `Setting "${key}" must be changed through the Live setup API`,
@@ -33298,6 +33846,7 @@ function registerWorkspaceQualifiedSettingsRoutes(app, deps) {
         });
         return;
       }
+      if (rejectWorkspaceRestrictedWrite(res, scope, key)) return;
       if (LIVE_MANAGED_SETTINGS.has(key)) {
         res.status(400).json({
           error: `Setting "${key}" must be changed through the Live setup API`,
@@ -37239,15 +37788,9 @@ function registerWorkspaceGitRoutes(app, deps) {
   });
 }
 __name(registerWorkspaceGitRoutes, "registerWorkspaceGitRoutes");
-function resolveTrustedRuntime2(registry, req, res) {
-  const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
-  if (!runtime) return null;
-  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
-}
-__name(resolveTrustedRuntime2, "resolveTrustedRuntime");
 function registerWorkspaceQualifiedGitRoutes(app, deps) {
   app.get("/workspaces/:workspace/git", async (req, res) => {
-    const runtime = resolveTrustedRuntime2(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     const route = "GET /workspaces/:workspace/git";
     try {
@@ -37423,15 +37966,9 @@ function registerWorkspaceGitDiffRoutes(app, deps) {
   });
 }
 __name(registerWorkspaceGitDiffRoutes, "registerWorkspaceGitDiffRoutes");
-function resolveTrustedRuntime3(registry, req, res) {
-  const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
-  if (!runtime) return null;
-  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
-}
-__name(resolveTrustedRuntime3, "resolveTrustedRuntime");
 function registerWorkspaceQualifiedGitDiffRoutes(app, deps) {
   app.get("/workspaces/:workspace/git/diff", (req, res) => {
-    const runtime = resolveTrustedRuntime3(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     void handleDiffList(
       res,
@@ -37442,7 +37979,7 @@ function registerWorkspaceQualifiedGitDiffRoutes(app, deps) {
     );
   });
   app.get("/workspaces/:workspace/git/diff/file", (req, res) => {
-    const runtime = resolveTrustedRuntime3(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     void handleDiffFile(
       req,
@@ -37583,15 +38120,9 @@ function registerWorkspaceGitLogRoutes(app, deps) {
   });
 }
 __name(registerWorkspaceGitLogRoutes, "registerWorkspaceGitLogRoutes");
-function resolveTrustedRuntime4(registry, req, res) {
-  const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
-  if (!runtime) return null;
-  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
-}
-__name(resolveTrustedRuntime4, "resolveTrustedRuntime");
 function registerWorkspaceQualifiedGitLogRoutes(app, deps) {
   app.get("/workspaces/:workspace/git/log", (req, res) => {
-    const runtime = resolveTrustedRuntime4(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     void handleLogList(
       req,
@@ -37602,7 +38133,7 @@ function registerWorkspaceQualifiedGitLogRoutes(app, deps) {
     );
   });
   app.get("/workspaces/:workspace/git/log/commit", (req, res) => {
-    const runtime = resolveTrustedRuntime4(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     void handleCommitDetail(
       req,
@@ -37618,12 +38149,6 @@ __name(registerWorkspaceQualifiedGitLogRoutes, "registerWorkspaceQualifiedGitLog
 // packages/cli/src/serve/routes/workspace-git-branches.ts
 init_esbuild_shims();
 var GIT_ERROR_MESSAGE_MAX = 512;
-function resolveTrustedRuntime5(registry, req, res) {
-  const runtime = resolveWorkspaceRuntimeFromParam(registry, req, res);
-  if (!runtime) return null;
-  return requireTrustedWorkspaceRuntime(runtime, res) ? runtime : null;
-}
-__name(resolveTrustedRuntime5, "resolveTrustedRuntime");
 function sendGitError(res, err, route, sendBridgeError2, cwd) {
   let detail;
   if (err && typeof err === "object" && ("stdout" in err || "stderr" in err)) {
@@ -37932,7 +38457,7 @@ function registerWorkspaceGitBranchRoutes(app, deps) {
 __name(registerWorkspaceGitBranchRoutes, "registerWorkspaceGitBranchRoutes");
 function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
   app.get("/workspaces/:workspace/git/branches", (req, res) => {
-    const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+    const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
     if (!runtime) return;
     void handleBranches(
       res,
@@ -37947,7 +38472,7 @@ function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
     "/workspaces/:workspace/git/checkout",
     deps.mutate({ strict: true }),
     (req, res) => {
-      const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+      const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
       if (!runtime) return;
       try {
         runtime.generationGuard?.assertOpen();
@@ -37980,7 +38505,7 @@ function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
     "/workspaces/:workspace/git/branch",
     deps.mutate({ strict: true }),
     (req, res) => {
-      const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+      const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
       if (!runtime) return;
       try {
         runtime.generationGuard?.assertOpen();
@@ -38013,7 +38538,7 @@ function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
     "/workspaces/:workspace/git/push",
     deps.mutate({ strict: true }),
     (req, res) => {
-      const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+      const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
       if (!runtime) return;
       try {
         runtime.generationGuard?.assertOpen();
@@ -38046,7 +38571,7 @@ function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
     "/workspaces/:workspace/git/pull",
     deps.mutate({ strict: true }),
     (req, res) => {
-      const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+      const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
       if (!runtime) return;
       try {
         runtime.generationGuard?.assertOpen();
@@ -38079,7 +38604,7 @@ function registerWorkspaceQualifiedGitBranchRoutes(app, deps) {
     "/workspaces/:workspace/git/commit",
     deps.mutate({ strict: true }),
     (req, res) => {
-      const runtime = resolveTrustedRuntime5(deps.workspaceRegistry, req, res);
+      const runtime = resolveTrustedRuntime(deps.workspaceRegistry, req, res);
       if (!runtime) return;
       try {
         runtime.generationGuard?.assertOpen();
@@ -45651,7 +46176,7 @@ var LiveSessionCoordinator = class {
     if (candidate) {
       try {
         const resumed = await runtime.bridge.resumeSession({
-          sessionId: candidate.sessionId,
+          sessionId: normalizeSessionIdForLookup(candidate.sessionId),
           workspaceCwd: runtime.workspaceCwd,
           ...candidate.parentSessionId ? { parentSessionId: candidate.parentSessionId } : {},
           ...candidate.sourceType ? { sourceType: candidate.sourceType } : {},
@@ -46668,9 +47193,9 @@ var LiveTaskService = class {
   }
   async waitForTarget(target, task, signal) {
     const { cursor } = decodeCursor(target.afterCursor, target.threadId);
-    const lastEventId = cursor.eventEpoch === task.runtime.bridge.getSessionEventEpoch(target.threadId) ? cursor.eventId : task.runtime.bridge.getSessionLastEventId(target.threadId);
+    const lastEventId = cursor.eventEpoch === task.runtime.bridge.getSessionEventEpoch(task.bridgeSessionId) ? cursor.eventId : task.runtime.bridge.getSessionLastEventId(task.bridgeSessionId);
     for await (const event of task.runtime.bridge.subscribeEvents(
-      target.threadId,
+      task.bridgeSessionId,
       { lastEventId, signal }
     )) {
       const reason = eventWakeReason(event);
@@ -46691,9 +47216,11 @@ var LiveTaskService = class {
       threadId: target.threadId,
       ...task.summary.clientCount > 0 ? {
         eventEpoch: task.runtime.bridge.getSessionEventEpoch(
-          target.threadId
+          task.bridgeSessionId
         ),
-        eventId: task.runtime.bridge.getSessionLastEventId(target.threadId)
+        eventId: task.runtime.bridge.getSessionLastEventId(
+          task.bridgeSessionId
+        )
       } : {},
       updatedAt: laterActivityTimestamp(
         task.summary.updatedAt,
@@ -46711,7 +47238,7 @@ var LiveTaskService = class {
     const startedAt = latestTurnRecords[0]?.timestamp ?? task.persisted?.conversation.startTime;
     const completedAt = latestTurnRecords.at(-1)?.timestamp ?? task.persisted?.conversation.lastUpdated;
     const failed = task.summary.hasTurnError === true;
-    const revision = task.summary.clientCount > 0 ? task.runtime.bridge.getSessionLastEventId(target.threadId) : epochSeconds(
+    const revision = task.summary.clientCount > 0 ? task.runtime.bridge.getSessionLastEventId(task.bridgeSessionId) : epochSeconds(
       laterActivityTimestamp(
         task.summary.updatedAt,
         task.persisted?.conversation.lastUpdated
@@ -46760,7 +47287,7 @@ var LiveTaskService = class {
     };
   }
   latestTurnId(task) {
-    return [...task.persisted?.conversation.messages ?? []].reverse().find((record) => record.type === "user")?.uuid ?? task.summary.sessionId;
+    return [...task.persisted?.conversation.messages ?? []].reverse().find((record) => record.type === "user")?.uuid ?? task.threadId;
   }
   async sendMessage(args) {
     const threadId = boundedString(args["threadId"], "threadId", 256);
@@ -46768,7 +47295,11 @@ var LiveTaskService = class {
     localHost(args["hostId"]);
     const located = await this.locateTask(threadId);
     await this.ensureResident(located);
-    await this.dispatchPrompt(located.runtime.bridge, threadId, prompt);
+    await this.dispatchPrompt(
+      located.runtime.bridge,
+      located.bridgeSessionId,
+      prompt
+    );
     return { threadId };
   }
   async createThread(args) {
@@ -46859,30 +47390,27 @@ var LiveTaskService = class {
   }
   async ensureResident(task) {
     try {
-      task.runtime.bridge.getSessionSummary(task.summary.sessionId);
+      task.runtime.bridge.getSessionSummary(task.bridgeSessionId);
       return;
     } catch (error2) {
       if (!(error2 instanceof SessionNotFoundError)) throw error2;
     }
     const service = createWorkspaceRuntimeSessionService(task.runtime);
-    const metadata = task.runtime.provenance === "live-conversation" ? await readLoadableLiveConversationMetadata(
-      task.summary.sessionId,
-      service
-    ) : await service.readCreationMetadata(task.summary.sessionId);
+    const metadata = task.runtime.provenance === "live-conversation" ? await readLoadableLiveConversationMetadata(task.threadId, service) : await service.readCreationMetadata(task.threadId);
     if (metadata === void 0) {
-      throw new SessionNotFoundError(task.summary.sessionId);
+      throw new SessionNotFoundError(task.bridgeSessionId);
     }
     await task.runtime.bridge.resumeSession({
-      sessionId: task.summary.sessionId,
+      sessionId: task.bridgeSessionId,
       workspaceCwd: task.runtime.workspaceCwd,
       ...metadata
     });
     if (task.runtime.provenance === "live-conversation") {
       const directory = await this.options.materializeConversationDirectory(
-        task.summary.sessionId
+        task.bridgeSessionId
       );
       const changed = await task.runtime.bridge.changeSessionCwd(
-        task.summary.sessionId,
+        task.bridgeSessionId,
         {
           path: directory,
           allowedRoots: [task.runtime.workspaceCwd],
@@ -46924,21 +47452,27 @@ var LiveTaskService = class {
     }
   }
   async locateTask(threadId) {
-    const live = this.options.workspaceRegistry.resolveLiveSessionOwner(threadId);
+    const bridgeSessionId = normalizeSessionIdForLookup(threadId);
+    const storedRuntimes = bridgeSessionId === threadId ? void 0 : await this.findStoredTaskRuntimes(threadId);
+    if (storedRuntimes && storedRuntimes.length > 1) {
+      throw new Error(`Task id is ambiguous: ${threadId}`);
+    }
+    const live = this.options.workspaceRegistry.resolveLiveSessionOwner(bridgeSessionId);
     if (live.kind === "ambiguous") {
       throw new Error(`Task id is ambiguous: ${threadId}`);
     }
     if (live.kind === "unavailable") {
       throw conversationRuntimeUnavailableError();
     }
-    const runtimes = live.kind === "found" ? [live.runtime] : (await Promise.all(
-      (this.options.workspaceRegistry.listAll?.() ?? this.options.workspaceRegistry.list()).map(async (runtime2) => ({
-        runtime: runtime2,
-        exists: await createWorkspaceRuntimeSessionService(
-          runtime2
-        ).sessionExists(threadId)
-      }))
-    )).filter((entry) => entry.exists).map((entry) => entry.runtime);
+    if (storedRuntimes?.length === 1 && live.kind === "found" && storedRuntimes[0] !== live.runtime) {
+      throw new Error(`Task id is ambiguous: ${threadId}`);
+    }
+    let runtimes = storedRuntimes;
+    if (runtimes === void 0) {
+      runtimes = live.kind === "found" ? [live.runtime] : await this.findStoredTaskRuntimes(threadId);
+    } else if (runtimes.length === 0 && live.kind === "found") {
+      runtimes = [live.runtime];
+    }
     if (runtimes.length === 0) throw new SessionNotFoundError(threadId);
     if (runtimes.length > 1)
       throw new Error(`Task id is ambiguous: ${threadId}`);
@@ -46947,7 +47481,7 @@ var LiveTaskService = class {
     const persisted = await service.loadSession(threadId);
     let summary;
     try {
-      summary = runtime.bridge.getSessionSummary(threadId);
+      summary = runtime.bridge.getSessionSummary(bridgeSessionId);
     } catch (error2) {
       if (!(error2 instanceof SessionNotFoundError) && !(error2 instanceof SessionArchivedError)) {
         throw error2;
@@ -46970,7 +47504,18 @@ var LiveTaskService = class {
       if (!found) throw new SessionNotFoundError(threadId);
       summary = found;
     }
-    return { runtime, persisted, summary };
+    return { runtime, threadId, bridgeSessionId, persisted, summary };
+  }
+  async findStoredTaskRuntimes(threadId) {
+    const entries = await Promise.all(
+      (this.options.workspaceRegistry.listAll?.() ?? this.options.workspaceRegistry.list()).map(async (runtime) => ({
+        runtime,
+        exists: await createWorkspaceRuntimeSessionService(runtime).sessionExists(
+          threadId
+        )
+      }))
+    );
+    return entries.filter((entry) => entry.exists).map((entry) => entry.runtime);
   }
 };
 
@@ -48200,6 +48745,20 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   if (liveVoiceEnabled) {
     serveAppLifecycle.setBootStarter(startConversationRuntimeBoot);
   }
+  if (deps.manageScheduledTaskSessions && deps.liveConversationWorkspace) {
+    const readTasks = deps.readLiveConversationScheduledTasks ?? (() => readCronTasks(deps.liveConversationWorkspace.rootPath));
+    void readTasks().then((tasks) => {
+      if (collectBoundSessionIds(tasks).length > 0) {
+        return startConversationRuntimeBoot();
+      }
+      return void 0;
+    }).catch((error2) => {
+      process.stderr.write(
+        `qwen serve: failed to restore the Conversations runtime for scheduled tasks: ${error2 instanceof Error ? error2.message : String(error2)}
+`
+      );
+    });
+  }
   const ensureConversationRuntimeWithLifecycle = /* @__PURE__ */ __name(async () => {
     await serveAppLifecycle.startBoot(startConversationRuntimeBoot);
     if (!liveRuntimeBootResult) {
@@ -48386,6 +48945,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   ) : [];
   if (webShellDir) {
     mountWebShellAssets(app, webShellDir, webShellFrameAncestors);
+    mountMcpAppSandbox(app);
   }
   if (deps.enqueueChannelWebhookTask) {
     let channelWebhookConfigVersion = -1;
@@ -49076,6 +49636,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     bridge: deps.manageScheduledTaskSessions ? primaryBridge : void 0,
     getRuntime: /* @__PURE__ */ __name(() => workspaceRegistry.primaryEntry.state === "active" ? workspaceRegistry.primaryEntry.current?.runtime : void 0, "getRuntime"),
     cleanupSession,
+    workspaceRegistry,
     channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations
   });
   registerGoalsRoutes(app, {
@@ -49140,7 +49701,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     }, "rehydrateWorkspace");
     const keepaliveStops = /* @__PURE__ */ new Map();
     const startKeepaliveForWorkspace = /* @__PURE__ */ __name((runtime) => {
-      if (runtime.provenance === "live-conversation") return;
       const trusted = runtime.primary ? isPrimaryWorkspaceTrusted() : runtime.trusted;
       if (!trusted) return;
       if (keepaliveStops.has(runtime.workspaceCwd)) return;