@qwen-code/qwen-code 0.22.2-preview.1 → 0.22.3

package/chunks/{run-qwen-serve-WHWU7NZ6.js → run-qwen-serve-5X6IDZER.js}

@@ -3,12 +3,12 @@
 import {
   computeCpuPercent
 } from "./chunk-LBOVL47Y.js";
-import {
-  RUNTIME_STARTUP_CANCELLED_MESSAGE
-} from "./chunk-QUPXZXLV.js";
 import {
   resolveServeToken
 } from "./chunk-ZELCTN6Y.js";
+import {
+  RUNTIME_STARTUP_CANCELLED_MESSAGE
+} from "./chunk-QUPXZXLV.js";
 import {
   ACCESS_LOG_CONTROLLER_LOCAL,
   CAPABILITIES_SCHEMA_VERSION,
@@ -38,13 +38,20 @@ import {
   positiveFiniteOrNull,
   prepareManagedScratchRoot,
   resolveAcpHttpEnabled,
-  setDeferredRuntimeRequestTiming,
   toDaemonStatusMemoryLimits
-} from "./chunk-SQPOJ4ZI.js";
-import "./chunk-VGHZT6JR.js";
+} from "./chunk-4NDLQAY2.js";
 import {
-  normalizeSessionIdForLookup
-} from "./chunk-ZEZKIS2K.js";
+  ConversationDirectoryIdentityError,
+  assertExactConversationRootIdentity,
+  createConversationRootIdentity,
+  getConversationDirectoryName,
+  getConversationStagedDirectoryName,
+  inspectConversationDirectoryIdentity,
+  inspectConversationStagedDirectoryIdentity,
+  isSameConversationDirectoryObject,
+  materializeConversationDirectoryIdentity,
+  revalidateConversationRootIdentity
+} from "./chunk-U54AYGEC.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
@@ -53,6 +60,12 @@ import {
   resolveDaemonMemoryBudget,
   serveJournalGrowthPoolMb
 } from "./chunk-UXEO7E3V.js";
+import {
+  setDeferredRuntimeRequestTiming
+} from "./chunk-SEONHUS3.js";
+import {
+  normalizeSessionIdForLookup
+} from "./chunk-ZEZKIS2K.js";
 import "./chunk-NYWWQ437.js";
 import {
   resolveSessionRestoreTimeoutMs
@@ -74,7 +87,7 @@ import {
 } from "./chunk-FBX2SDQ4.js";
 import {
   resolveChannelCwd
-} from "./chunk-7JPW6IYH.js";
+} from "./chunk-HVC3PNVC.js";
 import {
   LIVE_HOST_PROTOCOL_VERSION
 } from "./chunk-NKLP3DCK.js";
@@ -85,17 +98,17 @@ import {
   consumeServeFastPathRejectedLoaderKeys,
   loadServeFastPathSettings,
   preResolveServeFastPathHomeEnvOverrides
-} from "./chunk-TWSKM647.js";
+} from "./chunk-T7KMERIX.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-5CMWFBML.js";
-import "./chunk-ZJG323IA.js";
+} from "./chunk-TEBDFQBZ.js";
+import "./chunk-G6FECKTJ.js";
 import {
   LOAD_REPLAY_META_KEY
 } from "./chunk-OZ6KS6KW.js";
-import "./chunk-624NHDGB.js";
+import "./chunk-ERFDKH32.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
@@ -103,26 +116,27 @@ import {
 import {
   ExtraCaInspectionError,
   loadableCertificates
-} from "./chunk-PAJGKZAA.js";
+} from "./chunk-ISKH4QX3.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
-  ChannelDeliveryError,
-  ChannelWebhookEnqueueError,
-  isChannelDeliveryError
-} from "./chunk-7CWEZQ6T.js";
-import {
-  normalizeWorkerDiagnostic,
-  sanitizeWorkerDiagnostic
-} from "./chunk-JVPFTDBK.js";
+  ChannelWebhookEnqueueError
+} from "./chunk-STUJ7IMZ.js";
 import {
   QWEN_SERVER_TOKEN_ENV
 } from "./chunk-GYTKQYDB.js";
+import {
+  normalizeWorkerDiagnostic,
+  sanitizeWorkerDiagnostic
+} from "./chunk-RFIDDFAL.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
+import {
+  ChannelDeliveryError,
+  isChannelDeliveryError
+} from "./chunk-RKFGE7JH.js";
 import "./chunk-UDG5EZJI.js";
-import "./chunk-M5GB774H.js";
 import {
   EXTERNAL_TOOL_GUARD_PROVIDER_ATTACHED_VALUE,
   EXTERNAL_TOOL_GUARD_REQUIRED_VALUE,
@@ -130,12 +144,13 @@ import {
   PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
   PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV
 } from "./chunk-3VUENPWF.js";
+import "./chunk-M5GB774H.js";
 import {
   MAX_DAEMON_WORKSPACES
 } from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-E55H6BZ7.js";
+} from "./chunk-ICURCKIU.js";
 import "./chunk-IW6RQPQB.js";
 import "./chunk-GOXKNSDZ.js";
 import {
@@ -147,10 +162,10 @@ import {
   clearLoaderKeyRejectionReporterIfCurrent,
   scrubInheritedLoaderEnv,
   setLoaderKeyRejectionReporter
-} from "./chunk-5PA6UEYA.js";
+} from "./chunk-MZCJWS5Y.js";
 import {
   getCliVersion
-} from "./chunk-H3HZ4AWW.js";
+} from "./chunk-Q2MSPKIJ.js";
 import "./chunk-W3N5XAZ6.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
@@ -173,7 +188,7 @@ import "./chunk-JVEGA3MM.js";
 import {
   writeStderrLine,
   writeStdoutLine
-} from "./chunk-KGJGEEVR.js";
+} from "./chunk-7FA2II6K.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
 import {
@@ -193,7 +208,7 @@ import {
 // packages/cli/src/serve/run-qwen-serve.ts
 init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
-import { X509Certificate, createHash as createHash3, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto";
 import { execFile } from "node:child_process";
 import * as fs from "node:fs";
 import { createServer } from "node:http";
@@ -611,11 +626,11 @@ async function ensureRealDirectory(fs2, dirPath, mutationAllowed = () => true) {
 __name(ensureRealDirectory, "ensureRealDirectory");
 async function activeFileSize(fs2, activePath) {
   try {
-    const stat = await fs2.lstat(activePath);
-    if (!stat.isFile() || stat.isSymbolicLink()) {
+    const stat2 = await fs2.lstat(activePath);
+    if (!stat2.isFile() || stat2.isSymbolicLink()) {
       throw new Error(`${activePath} is not a regular file`);
     }
-    return stat.size;
+    return stat2.size;
   } catch (error) {
     if (isErrno(error, "ENOENT")) return 0;
     throw error;
@@ -1036,8 +1051,8 @@ __name(closeFallbackFamily, "closeFallbackFamily");
 async function cleanupFallbacksBestEffort(input) {
   const runsDir = nodePath.join(input.daemonDir, "runs");
   try {
-    const stat = await input.fs.lstat(runsDir);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    const stat2 = await input.fs.lstat(runsDir);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink()) {
       throw new Error(`${runsDir} is not a real directory`);
     }
   } catch (error) {
@@ -1404,7 +1419,7 @@ function createConcreteLogger(input) {
         }
       });
       let timeout;
-      const deadline = new Promise((resolve4) => {
+      const deadline = new Promise((resolve3) => {
         timeout = setTimeout(() => {
           try {
             input.warnOnce(
@@ -1413,7 +1428,7 @@ function createConcreteLogger(input) {
             );
           } catch {
           } finally {
-            resolve4();
+            resolve3();
           }
         }, input.policy.closeDrainBudgetMs);
         timeout.unref();
@@ -1759,251 +1774,10 @@ __name(initDaemonLogger, "initDaemonLogger");
 
 // packages/cli/src/serve/conversations/conversation-workspace.ts
 init_esbuild_shims();
-import { readdir, rmdir } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { open, readdir, rename, rm, rmdir, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { resolve as resolve2 } from "node:path";
-
-// packages/cli/src/utils/conversation-directory-identity.ts
-init_esbuild_shims();
-import { createHash as createHash2 } from "node:crypto";
-import { lstat, mkdir, realpath } from "node:fs/promises";
-import { isAbsolute, join as join2, relative as relative2, resolve, sep } from "node:path";
-function hasVerifiableInode(ino) {
-  return Number(ino) !== 0;
-}
-__name(hasVerifiableInode, "hasVerifiableInode");
-var ConversationDirectoryIdentityError = class extends Error {
-  constructor(scope, reason, cause) {
-    super(
-      `Conversation ${scope} identity validation failed: ${reason}`,
-      cause !== void 0 ? { cause } : void 0
-    );
-    this.scope = scope;
-    this.reason = reason;
-  }
-  static {
-    __name(this, "ConversationDirectoryIdentityError");
-  }
-  name = "ConversationDirectoryIdentityError";
-};
-function throwIdentityIoError(scope, cause) {
-  throw new ConversationDirectoryIdentityError(scope, "io_error", cause);
-}
-__name(throwIdentityIoError, "throwIdentityIoError");
-var isSameConversationPath = /* @__PURE__ */ __name((left, right) => process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right, "isSameConversationPath");
-function getConversationDirectoryName(storageSessionId) {
-  if (storageSessionId.length === 0 || storageSessionId.length > 256) {
-    throw new ConversationDirectoryIdentityError("child", "invalid_session_id");
-  }
-  return `conversation-${createHash2("sha256").update(storageSessionId).digest("hex")}`;
-}
-__name(getConversationDirectoryName, "getConversationDirectoryName");
-function validateDirectoryStats(stats, scope) {
-  if (stats.isSymbolicLink() || !stats.isDirectory()) {
-    throw new ConversationDirectoryIdentityError(scope, "not_directory");
-  }
-  if (process.platform !== "win32" && typeof process.getuid === "function" && stats.uid !== process.getuid()) {
-    throw new ConversationDirectoryIdentityError(scope, "wrong_owner");
-  }
-  if (process.platform !== "win32" && (stats.mode & 63) !== 0) {
-    throw new ConversationDirectoryIdentityError(scope, "wrong_mode");
-  }
-}
-__name(validateDirectoryStats, "validateDirectoryStats");
-function hasRootIdentity(stats, root) {
-  if (!root.inodeVerifiable) return stats.dev === root.device;
-  return hasVerifiableInode(stats.ino) && stats.dev === root.device && stats.ino === root.inode;
-}
-__name(hasRootIdentity, "hasRootIdentity");
-function isSameDirectoryIdentity(before, after) {
-  if (!hasVerifiableInode(before.ino) || !hasVerifiableInode(after.ino)) {
-    return before.dev === after.dev;
-  }
-  return before.dev === after.dev && before.ino === after.ino;
-}
-__name(isSameDirectoryIdentity, "isSameDirectoryIdentity");
-function hasExpectedDirectoryIdentity(identity, expected) {
-  const inodesProvable = hasVerifiableInode(identity.inode) && hasVerifiableInode(expected.inode);
-  return identity.storageSessionId === expected.storageSessionId && identity.name === expected.name && isSameConversationPath(identity.canonicalPath, expected.canonicalPath) && identity.device === expected.device && (!inodesProvable || identity.inode === expected.inode) && isSameConversationPath(
-    identity.root.configuredRoot,
-    expected.root.configuredRoot
-  ) && isSameConversationPath(
-    identity.root.canonicalRoot,
-    expected.root.canonicalRoot
-  ) && identity.root.device === expected.root.device && (!identity.root.inodeVerifiable || !expected.root.inodeVerifiable || identity.root.inode === expected.root.inode);
-}
-__name(hasExpectedDirectoryIdentity, "hasExpectedDirectoryIdentity");
-async function createConversationRootIdentity(configuredRoot) {
-  try {
-    await mkdir(configuredRoot, { recursive: true, mode: 448 });
-  } catch (error) {
-    let existing;
-    try {
-      existing = await lstat(configuredRoot);
-    } catch {
-      throwIdentityIoError("root", error);
-    }
-    validateDirectoryStats(existing, "root");
-    throwIdentityIoError("root", error);
-  }
-  let before;
-  try {
-    before = await lstat(configuredRoot);
-  } catch (error) {
-    throwIdentityIoError("root", error);
-  }
-  validateDirectoryStats(before, "root");
-  let canonicalRoot;
-  let after;
-  try {
-    canonicalRoot = await realpath(configuredRoot);
-    after = await lstat(canonicalRoot);
-  } catch (error) {
-    throwIdentityIoError("root", error);
-  }
-  validateDirectoryStats(after, "root");
-  if (!isSameDirectoryIdentity(before, after)) {
-    throw new ConversationDirectoryIdentityError("root", "identity_changed");
-  }
-  return {
-    configuredRoot,
-    canonicalRoot,
-    device: after.dev,
-    inode: after.ino,
-    inodeVerifiable: hasVerifiableInode(after.ino)
-  };
-}
-__name(createConversationRootIdentity, "createConversationRootIdentity");
-async function revalidateConversationRootIdentity(root) {
-  let configuredStats;
-  try {
-    configuredStats = await lstat(root.configuredRoot);
-  } catch (error) {
-    throwIdentityIoError("root", error);
-  }
-  validateDirectoryStats(configuredStats, "root");
-  if (!hasRootIdentity(configuredStats, root)) {
-    throw new ConversationDirectoryIdentityError("root", "identity_changed");
-  }
-  let canonical;
-  try {
-    canonical = await realpath(root.configuredRoot);
-  } catch (error) {
-    throwIdentityIoError("root", error);
-  }
-  if (!isSameConversationPath(canonical, root.canonicalRoot)) {
-    throw new ConversationDirectoryIdentityError(
-      "root",
-      "canonical_path_changed"
-    );
-  }
-  let canonicalStats;
-  try {
-    canonicalStats = await lstat(root.canonicalRoot);
-  } catch (error) {
-    throwIdentityIoError("root", error);
-  }
-  validateDirectoryStats(canonicalStats, "root");
-  if (!hasRootIdentity(canonicalStats, root)) {
-    throw new ConversationDirectoryIdentityError("root", "identity_changed");
-  }
-  return root;
-}
-__name(revalidateConversationRootIdentity, "revalidateConversationRootIdentity");
-async function assertExactConversationRootIdentity(root, candidate) {
-  await revalidateConversationRootIdentity(root);
-  const resolvedCandidate = resolve(candidate);
-  if (!isSameConversationPath(resolvedCandidate, root.configuredRoot) && !isSameConversationPath(resolvedCandidate, root.canonicalRoot)) {
-    throw new ConversationDirectoryIdentityError("root", "unexpected_identity");
-  }
-  let stats;
-  let canonical;
-  try {
-    stats = await lstat(resolvedCandidate);
-    validateDirectoryStats(stats, "root");
-    canonical = await realpath(resolvedCandidate);
-  } catch (error) {
-    if (error instanceof ConversationDirectoryIdentityError) throw error;
-    throwIdentityIoError("root", error);
-  }
-  if (!isSameConversationPath(canonical, root.canonicalRoot) || !hasRootIdentity(stats, root)) {
-    throw new ConversationDirectoryIdentityError("root", "unexpected_identity");
-  }
-  return root;
-}
-__name(assertExactConversationRootIdentity, "assertExactConversationRootIdentity");
-async function inspectConversationDirectoryIdentity(root, storageSessionId, expected) {
-  await revalidateConversationRootIdentity(root);
-  const name = getConversationDirectoryName(storageSessionId);
-  const candidate = join2(root.canonicalRoot, name);
-  let before;
-  try {
-    before = await lstat(candidate);
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throwIdentityIoError("child", error);
-  }
-  validateDirectoryStats(before, "child");
-  let canonical;
-  let after;
-  try {
-    canonical = await realpath(candidate);
-    after = await lstat(canonical);
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throwIdentityIoError("child", error);
-  }
-  validateDirectoryStats(after, "child");
-  const child = relative2(root.canonicalRoot, canonical);
-  if (child !== name || child.includes(sep) || child.startsWith("..") || isAbsolute(child)) {
-    throw new ConversationDirectoryIdentityError("child", "not_direct_child");
-  }
-  if (!isSameDirectoryIdentity(before, after)) {
-    throw new ConversationDirectoryIdentityError("child", "identity_changed");
-  }
-  await revalidateConversationRootIdentity(root);
-  const identity = {
-    root,
-    storageSessionId,
-    name,
-    canonicalPath: canonical,
-    device: after.dev,
-    inode: after.ino
-  };
-  if (expected && !hasExpectedDirectoryIdentity(identity, expected)) {
-    throw new ConversationDirectoryIdentityError(
-      "child",
-      "unexpected_identity"
-    );
-  }
-  return identity;
-}
-__name(inspectConversationDirectoryIdentity, "inspectConversationDirectoryIdentity");
-async function materializeConversationDirectoryIdentity(root, storageSessionId) {
-  await revalidateConversationRootIdentity(root);
-  const name = getConversationDirectoryName(storageSessionId);
-  const candidate = join2(root.canonicalRoot, name);
-  let created = false;
-  try {
-    await mkdir(candidate, { mode: 448 });
-    created = true;
-  } catch (error) {
-    if (error.code !== "EEXIST") {
-      throwIdentityIoError("child", error);
-    }
-  }
-  const identity = await inspectConversationDirectoryIdentity(
-    root,
-    storageSessionId
-  );
-  if (!identity) {
-    throw new ConversationDirectoryIdentityError("child", "identity_changed");
-  }
-  return { identity, created };
-}
-__name(materializeConversationDirectoryIdentity, "materializeConversationDirectoryIdentity");
-
-// packages/cli/src/serve/conversations/conversation-workspace.ts
+import { join as join2, resolve } from "node:path";
 function liveIdentityError(error, exactRoot = false, creatingRoot = false) {
   if (!(error instanceof ConversationDirectoryIdentityError)) throw error;
   if (error.reason === "io_error" && error.cause !== void 0) {
@@ -2061,7 +1835,7 @@ function liveIdentityError(error, exactRoot = false, creatingRoot = false) {
 }
 __name(liveIdentityError, "liveIdentityError");
 function getConversationRootPath(homeDir = homedir()) {
-  return resolve2(homeDir, "Documents", "Qwen Code", "Conversations");
+  return resolve(homeDir, "Documents", "Qwen Code", "Conversations");
 }
 __name(getConversationRootPath, "getConversationRootPath");
 async function revalidateConversationRoot(root) {
@@ -2245,6 +2019,171 @@ var ConversationWorkspace = class {
       throw error;
     }
   }
+  async inspectStandaloneDeletionPaths(storageSessionId, expected) {
+    const root = await this.revalidateStandaloneRoot();
+    try {
+      const normal = await inspectConversationDirectoryIdentity(
+        root,
+        storageSessionId
+      );
+      const staged = await inspectConversationStagedDirectoryIdentity(
+        root,
+        storageSessionId
+      );
+      if (normal && staged) {
+        throw new ConversationDirectoryIdentityError(
+          "child",
+          "unexpected_identity"
+        );
+      }
+      const identity = normal ?? staged;
+      if (identity && expected && !isSameConversationDirectoryObject(identity, expected)) {
+        throw new ConversationDirectoryIdentityError(
+          "child",
+          "unexpected_identity"
+        );
+      }
+      if (normal) return { status: "normal", identity: normal };
+      if (staged) return { status: "staged", identity: staged };
+      return { status: "absent" };
+    } catch (error) {
+      if (error instanceof ConversationDirectoryIdentityError && error.scope === "child") {
+        return { status: "compromised", error };
+      }
+      throw error;
+    }
+  }
+  async createStandaloneDeletionExpectation(storageSessionId, recorded) {
+    if (recorded.inodeVerifiable !== (recorded.inode !== 0)) {
+      throw new ConversationDirectoryIdentityError(
+        "child",
+        "unexpected_identity"
+      );
+    }
+    const root = await this.revalidateStandaloneRoot();
+    const name = getConversationDirectoryName(storageSessionId);
+    return {
+      root,
+      storageSessionId,
+      name,
+      canonicalPath: join2(root.canonicalRoot, name),
+      device: recorded.device,
+      inode: recorded.inode
+    };
+  }
+  async stageStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "normal") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const root = await this.revalidateStandaloneRoot();
+    await rename(
+      inspected.identity.canonicalPath,
+      join2(
+        root.canonicalRoot,
+        getConversationStagedDirectoryName(storageSessionId)
+      )
+    );
+    await revalidateConversationRootIdentity(root);
+    const staged = await inspectConversationStagedDirectoryIdentity(
+      root,
+      storageSessionId
+    );
+    if (!staged || !isSameConversationDirectoryObject(staged, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await this.syncStandaloneRoot(root);
+    return staged;
+  }
+  async restoreStagedStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "staged") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const root = await this.revalidateStandaloneRoot();
+    await rename(
+      inspected.identity.canonicalPath,
+      join2(root.canonicalRoot, getConversationDirectoryName(storageSessionId))
+    );
+    await revalidateConversationRootIdentity(root);
+    const restored = await inspectConversationDirectoryIdentity(
+      root,
+      storageSessionId
+    );
+    if (!restored || !isSameConversationDirectoryObject(restored, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await this.syncStandaloneRoot(root);
+    return restored;
+  }
+  async removeStagedStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "staged") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const confirmed = await inspectConversationStagedDirectoryIdentity(
+      inspected.identity.root,
+      storageSessionId
+    );
+    if (!confirmed || !isSameConversationDirectoryObject(confirmed, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await rm(confirmed.canonicalPath, { recursive: true });
+    await this.syncStandaloneRoot(confirmed.root);
+  }
+  async confirmStandaloneRootDurability(root) {
+    await this.syncStandaloneRoot(root);
+  }
+  async syncStandaloneRoot(root) {
+    await revalidateConversationRootIdentity(root);
+    let handle;
+    try {
+      handle = await open(
+        root.canonicalRoot,
+        fsConstants.O_RDONLY | (process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW ?? 0)
+      );
+      const stats = await handle.stat();
+      const inodeVerifiable = Number.isSafeInteger(stats.ino) && stats.ino > 0;
+      if (!stats.isDirectory() || stats.dev !== root.device || inodeVerifiable !== root.inodeVerifiable || root.inodeVerifiable && stats.ino !== root.inode) {
+        throw new ConversationDirectoryIdentityError(
+          "root",
+          "identity_changed"
+        );
+      }
+      try {
+        await handle.sync();
+      } catch (error) {
+        if (process.platform !== "win32" || !["EACCES", "EINVAL", "EPERM"].includes(
+          error.code ?? ""
+        )) {
+          throw error;
+        }
+      }
+      const current = await stat(root.canonicalRoot);
+      const currentInodeVerifiable = Number.isSafeInteger(current.ino) && current.ino > 0;
+      if (!current.isDirectory() || current.dev !== root.device || currentInodeVerifiable !== root.inodeVerifiable || root.inodeVerifiable && current.ino !== root.inode) {
+        throw new ConversationDirectoryIdentityError(
+          "root",
+          "identity_changed"
+        );
+      }
+    } finally {
+      await handle?.close().catch(() => void 0);
+    }
+    await revalidateConversationRootIdentity(root);
+  }
 };
 
 // packages/cli/src/serve/daemon-metrics-ring.ts
@@ -3105,8 +3044,8 @@ async function flushDaemonLogBounded(daemonLog, budgetMs) {
     await Promise.race([
       daemonLog.flush().catch(() => {
       }),
-      new Promise((resolve4) => {
-        timer = setTimeout(resolve4, budgetMs);
+      new Promise((resolve3) => {
+        timer = setTimeout(resolve3, budgetMs);
         timer.unref();
       })
     ]);
@@ -3337,7 +3276,7 @@ try {
 `;
 async function verifyWorkerTlsTrust(opts) {
   const timeoutMs = opts.timeoutMs ?? 5e3;
-  return new Promise((resolve4) => {
+  return new Promise((resolve3) => {
     execFile(
       process.execPath,
       [
@@ -3358,10 +3297,10 @@ async function verifyWorkerTlsTrust(opts) {
       (error, stdout) => {
         try {
           const result = JSON.parse(stdout);
-          resolve4(result.ok ? void 0 : result);
+          resolve3(result.ok ? void 0 : result);
         } catch {
           const failure = error;
-          resolve4({
+          resolve3({
             code: failure?.code != null ? String(failure.code) : "WORKER_TLS_VERIFY_FAILED",
             message: failure?.message ?? "TLS verification probe failed."
           });
@@ -3799,12 +3738,12 @@ __name(hasRetryableChannelWorkerShutdownError, "hasRetryableChannelWorkerShutdow
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-YSKB5GVB.js"),
-    import("./pidfile-MSPQ255Y.js"),
-    import("./runtime-E7BSPWQP.js"),
+    import("./channel-worker-supervisor-FKU7DIHJ.js"),
+    import("./pidfile-QOIQZFT2.js"),
+    import("./runtime-HK27GMPF.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-EVDC2P4K.js"),
-    import("./channel-worker-manager-IJJZHGEI.js")
+    import("./channel-worker-group-6NA6BBZV.js"),
+    import("./channel-worker-manager-NEZ2J6RK.js")
   ]).then(
     ([
       supervisor,
@@ -3910,7 +3849,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-CEJRHCRF.js");
+  coreRuntimePromise ??= import("./core-runtime-AXB6SK5D.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -3946,10 +3885,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-B2PFJJN4.js"),
-    import("./environment-ZBJ23YVR.js"),
-    import("./loadedSettingsAdapter-5WZBXBCR.js"),
-    import("./trustedFolders-OILZCHRD.js")
+    import("./settings-L6N54CU6.js"),
+    import("./environment-UANTR7A4.js"),
+    import("./loadedSettingsAdapter-KJCLZ3C4.js"),
+    import("./trustedFolders-FATSC4YI.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3962,8 +3901,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-E7BSPWQP.js"),
-    import("./config-utils-PMX4QZ5Y.js")
+    import("./runtime-HK27GMPF.js"),
+    import("./config-utils-R6M3TA34.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3989,18 +3928,18 @@ async function loadServeRuntimeModules() {
     workspaceRegistryModule,
     promptLedgerModule
   ] = await Promise.all([
-    import("./server-AXCN7QBJ.js"),
-    import("./bridge-FRNYLYY7.js"),
-    import("./spawnChannel-NE43EEO3.js"),
-    import("./process-registry-PMJOA5CO.js"),
-    import("./workspace-service-5ZOBMMIB.js"),
-    import("./types-WYCFCEHR.js"),
-    import("./daemon-status-provider-FTTYZEKN.js"),
-    import("./workspace-providers-status-OCFEWIPQ.js"),
-    import("./workspace-skills-status-B6NJZD4B.js"),
-    import("./total-session-admission-L5RPEFZ2.js"),
-    import("./workspace-registry-WJLZPRTG.js"),
-    import("./prompt-terminal-ledger-YPGMNDXT.js")
+    import("./server-GO2N5DH7.js"),
+    import("./bridge-ME6QXZNA.js"),
+    import("./spawnChannel-ZST6XJVJ.js"),
+    import("./process-registry-OAEG6WGC.js"),
+    import("./workspace-service-SIN67ITC.js"),
+    import("./types-HKLPXZB3.js"),
+    import("./daemon-status-provider-K3SJ5C2U.js"),
+    import("./workspace-providers-status-IJ4VHFMB.js"),
+    import("./workspace-skills-status-F3RKCUIX.js"),
+    import("./total-session-admission-PVN64JVV.js"),
+    import("./workspace-registry-BTGZIMPK.js"),
+    import("./prompt-terminal-ledger-FOMFTYOM.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -4013,7 +3952,6 @@ async function loadServeRuntimeModules() {
     ProcessRegistry: processRegistryModule.ProcessRegistry,
     createDaemonWorkspaceService: workspaceModule.createDaemonWorkspaceService,
     WorkspaceSettingsPartialPersistError: workspaceTypesModule.WorkspaceSettingsPartialPersistError,
-    WorkspaceSkillNotToggleableError: workspaceTypesModule.WorkspaceSkillNotToggleableError,
     createDaemonStatusProvider: daemonStatusProviderModule.createDaemonStatusProvider,
     createWorkspaceProvidersStatusProvider: workspaceProvidersStatusModule.createWorkspaceProvidersStatusProvider,
     createWorkspaceSkillsStatusProvider: workspaceSkillsStatusModule.createWorkspaceSkillsStatusProvider,
@@ -4045,7 +3983,7 @@ function sessionIdleTimeoutMs(value) {
   return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_IDLE_TIMEOUT_MS;
 }
 __name(sessionIdleTimeoutMs, "sessionIdleTimeoutMs");
-function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, env) {
+function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, currentSessionSchedulingAvailable, env) {
   return getAdvertisedServeFeatures(void 0, {
     requireAuth: opts.requireAuth === true,
     mcpPoolActive: opts.mcpPoolActive !== false,
@@ -4057,6 +3995,7 @@ function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, s
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
     sessionGenerationAvailable: true,
+    currentSessionSchedulingAvailable,
     workspaceGenerationAvailable: true,
     rateLimit: opts.rateLimit === true,
     reloadAvailable: true,
@@ -4083,6 +4022,7 @@ function createBootstrapCapabilities(input) {
       input.opts,
       input.sessionShellCommandEnabled,
       input.sessionArtifactsPersistenceAvailable,
+      input.currentSessionSchedulingAvailable,
       input.env
     ),
     modelServices: [],
@@ -4198,12 +4138,12 @@ async function waitForRuntimeStartingForShutdown(runtimeStarting, daemonLog, tim
   let timer;
   await Promise.race([
     runtimeStarting,
-    new Promise((resolve4) => {
+    new Promise((resolve3) => {
       timer = setTimeout(() => {
         daemonLog.warn(
           `${timeoutMs}ms runtime-startup wait reached during shutdown; continuing listener close`
         );
-        resolve4();
+        resolve3();
       }, timeoutMs);
       timer.unref();
     })
@@ -4242,6 +4182,7 @@ function createBootstrapServeApp(input) {
     qwenCodeVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    currentSessionSchedulingAvailable,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime,
     getRuntimeError,
@@ -4301,6 +4242,7 @@ function createBootstrapServeApp(input) {
         qwenCodeVersion,
         sessionShellCommandEnabled,
         sessionArtifactsPersistenceAvailable,
+        currentSessionSchedulingAvailable,
         permissionPolicy,
         env: process.env
       })
@@ -4418,6 +4360,7 @@ function createBootstrapServeApp(input) {
           opts,
           sessionShellCommandEnabled,
           sessionArtifactsPersistenceAvailable,
+          currentSessionSchedulingAvailable,
           process.env
         )
       },
@@ -4614,8 +4557,8 @@ function matchesWebhookSecret(candidate, expected) {
   if (typeof candidate !== "string" || typeof expected !== "string" || expected.length === 0) {
     return false;
   }
-  const expectedDigest = createHash3("sha256").update(expected).digest();
-  const candidateDigest = createHash3("sha256").update(candidate).digest();
+  const expectedDigest = createHash2("sha256").update(expected).digest();
+  const candidateDigest = createHash2("sha256").update(candidate).digest();
   return timingSafeEqual(expectedDigest, candidateDigest);
 }
 __name(matchesWebhookSecret, "matchesWebhookSecret");
@@ -5041,7 +4984,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-CMMX7EPX.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-SMJWI2AI.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -5325,7 +5268,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
-  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-L6ZUFKF7.js");
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-IVAJJWYK.js");
   const daemonToolGuardHandler = createDaemonToolGuard(
     externalToolGuardHandler
   );
@@ -5371,8 +5314,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   let resolveServeAppStartup;
   let rejectServeAppStartup;
   let serveAppStartupSettled = false;
-  const serveAppStartupReady = new Promise((resolve4, reject) => {
-    resolveServeAppStartup = resolve4;
+  const serveAppStartupReady = new Promise((resolve3, reject) => {
+    resolveServeAppStartup = resolve3;
     rejectServeAppStartup = reject;
   });
   void serveAppStartupReady.catch(() => void 0);
@@ -5394,6 +5337,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const internalRuntimeBridgesForCleanup = [];
   let daemonEventLoopMonitor;
   let daemonMetricsSampler;
+  let sessionPrRefreshTimer;
+  let sessionPrRefreshGeneration = 0;
   let runtimeStartupError;
   let runtimeStarting;
   let markRuntimeReady;
@@ -5402,8 +5347,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   let startRuntimeAfterHealth;
   let startRuntimeForRequest;
   const deferRuntimeUntilFirstHealth = deps.resolveOnListen === true && deps.deferRuntimeUntilFirstHealth === true;
-  const runtimeReady = new Promise((resolve4, reject) => {
-    markRuntimeReady = resolve4;
+  const runtimeReady = new Promise((resolve3, reject) => {
+    markRuntimeReady = resolve3;
     markRuntimeFailed = reject;
   });
   void runtimeReady.catch(() => {
@@ -5413,6 +5358,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     daemonEventLoopMonitor = void 0;
     const metricsSampler = daemonMetricsSampler;
     daemonMetricsSampler = void 0;
+    const prRefreshTimer = sessionPrRefreshTimer;
+    sessionPrRefreshTimer = void 0;
+    sessionPrRefreshGeneration += 1;
+    prRefreshTimer?.dispose();
     try {
       eventLoopMonitor?.dispose();
     } catch (err) {
@@ -5597,6 +5546,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     stopSafely("scheduled-task keepalive", locals.stopScheduledTaskKeepalive);
     stopSafely("workspace git state", locals.stopWorkspaceGitState);
     stopSafely("Live Host coordinator", locals.stopLiveCoordinator);
+    stopSafely("web terminal registry", locals.stopWebTerminalRegistry);
     stopTrustPolicyMonitor(app2);
     for (const stop of locals.subSessionStoppers ?? []) {
       stopSafely("sub-session launcher", stop);
@@ -5664,7 +5614,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-WMGFPA3Z.js")
+      import("./daemon-trust-policy-DOR3YG62.js")
     ]);
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
@@ -6040,18 +5990,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-SKMN5YXC.js");
+      } = await import("./skill-settings-ZL4JY5UE.js");
       const fresh = loadSettingsForPersistence(workspace);
       const normalizedName = skillName.trim().toLowerCase();
       const resolved = resolveSkillSettings(fresh);
-      const disablement = resolved.disablements.get(normalizedName);
-      if (disablement?.reason === "hard" && disablement.lockedScope) {
-        throw new runtime.WorkspaceSkillNotToggleableError(
-          skillName,
-          "locked",
-          disablement.lockedScope
-        );
-      }
       const workspaceDisabled = skillSettingStrings(
         fresh,
         WORKSPACE_SETTING_SCOPE,
@@ -6105,7 +6047,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         resolveSkillSettings,
         skillSettingStrings,
         updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-SKMN5YXC.js");
+      } = await import("./skill-settings-ZL4JY5UE.js");
       const fresh = loadSettingsForPersistence(workspace);
       const resolved = resolveSkillSettings(fresh);
       const initialDisabled = skillSettingStrings(
@@ -6122,18 +6064,6 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const outcomes = [];
       for (const skillName of skillNames) {
         const normalizedName = skillName.trim().toLowerCase();
-        const disablement = resolved.disablements.get(normalizedName);
-        if (disablement?.reason === "hard" && disablement.lockedScope) {
-          outcomes.push({
-            skillName,
-            error: new runtime.WorkspaceSkillNotToggleableError(
-              skillName,
-              "locked",
-              disablement.lockedScope
-            )
-          });
-          continue;
-        }
         const updated = updateWorkspaceSkillSettingLists(
           next,
           skillName,
@@ -6210,7 +6140,43 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
       }
     }), "persistSettingsFn");
-    const { createSubSessionLauncher } = await import("./create-sub-session-DFZVIG56.js");
+    const [{ createSubSessionLauncher }, scheduledTaskRoutes] = await Promise.all([
+      import("./create-sub-session-4QNE64MR.js"),
+      import("./scheduled-tasks-MN2ZZ5P6.js")
+    ]);
+    const createCurrentSessionScheduledTaskHandler = /* @__PURE__ */ __name((workspaceCwd, runtimeBaseDir, getBridge, assertGenerationOpen) => async ({
+      callerSessionId,
+      cron,
+      prompt,
+      recurring,
+      assertCallerPromptActive
+    }) => {
+      const targetBridge = getBridge();
+      if (!targetBridge) {
+        throw new Error(
+          "Current-session scheduling is unavailable while the workspace runtime is starting."
+        );
+      }
+      const task = await scheduledTaskRoutes.createScheduledTaskWithExistingSession(
+        {
+          workspaceCwd,
+          runtimeBaseDir,
+          bridge: targetBridge,
+          assertGenerationOpen,
+          resolveLiveSessionOwner: /* @__PURE__ */ __name((sessionId) => workspaceRegistryForPersistence.current === void 0 ? { kind: "unavailable" } : workspaceRegistryForPersistence.current.resolveLiveSessionOwner(
+            sessionId
+          ), "resolveLiveSessionOwner")
+        },
+        {
+          sessionId: callerSessionId,
+          cron,
+          prompt,
+          recurring
+        },
+        { source: "cron-tool", assertCallerPromptActive }
+      );
+      return { id: task.id, cron: task.cron };
+    }, "createCurrentSessionScheduledTaskHandler");
     const subSessionLauncher = createSubSessionLauncher({
       getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
       boundWorkspace,
@@ -6227,6 +6193,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       // connection that hosts a named client MCP server (#5626).
       clientMcpSender: clientMcpSenderRegistry.lookup,
       onCreateSubSession: subSessionLauncher.launch,
+      onCreateCurrentSessionScheduledTask: createCurrentSessionScheduledTaskHandler(
+        boundWorkspace,
+        primarySessionRuntimeBaseDir,
+        () => bridgeRef,
+        () => primaryGenerationGuard.assertOpen()
+      ),
       onChannelDelivery: createBoundChannelDeliveryHandler(
         boundWorkspace,
         () => channelWorkerManager,
@@ -6572,6 +6544,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         ),
         clientMcpSender: secondaryClientMcpSenderRegistry.lookup,
         onCreateSubSession: secondarySubSessionLauncher.launch,
+        onCreateCurrentSessionScheduledTask: createCurrentSessionScheduledTaskHandler(
+          workspaceInput.cwd,
+          secondaryEnv.sessionRuntimeBaseDir,
+          () => secondaryBridgeRef,
+          () => secondaryGenerationGuard.assertOpen()
+        ),
         onChannelDelivery: createBoundChannelDeliveryHandler(
           workspaceInput.cwd,
           () => channelWorkerManager,
@@ -6860,6 +6838,22 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         metricsLoopDelay.disable();
       }
     };
+    sessionPrRefreshTimer?.dispose();
+    const refreshGeneration = ++sessionPrRefreshGeneration;
+    void import("./session-pr-refresh-I3UBWMVP.js").then((mod) => {
+      if (refreshGeneration !== sessionPrRefreshGeneration) return;
+      sessionPrRefreshTimer = mod.startSessionPrRefreshTimer({
+        workspaceRegistry,
+        // The coordinator lives on the serve app (createServeApp below),
+        // which is built after this timer starts; read it per tick like
+        // the metrics sampler reads `acpHandle`.
+        getArchiveCoordinator: /* @__PURE__ */ __name(() => app2.locals.sessionArchiveCoordinator, "getArchiveCoordinator")
+      });
+    }).catch((error) => {
+      daemonLog.warn(
+        `session-pr-refresh load failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    });
     const createDynamicWorkspaceRuntime = /* @__PURE__ */ __name(async (cwd, buildOptions) => {
       const provenance = buildOptions?.provenance ?? "existing";
       if (provenance === "managed-scratch" && (!managedScratchRoot || !isManagedScratchChild(cwd, managedScratchRoot.canonicalRoot))) {
@@ -6931,6 +6925,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         boundWorkspace: cwd,
         ...provenance === "live-conversation" ? {
           notifySentCompletion: true,
+          getStandaloneSessionService: /* @__PURE__ */ __name(() => (runtimeApp ?? runtimeAppForCleanup)?.locals?.["standaloneSessionService"], "getStandaloneSessionService"),
           isolatedWorkspace: {
             materializeDirectory: /* @__PURE__ */ __name((sessionId) => liveConversationWorkspace.materializeConversationDirectory(
               sessionId
@@ -6953,6 +6948,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           ),
           clientMcpSender: wsClientMcpRegistry.lookup,
           onCreateSubSession: wsSubSessionLauncher.launch,
+          onCreateCurrentSessionScheduledTask: createCurrentSessionScheduledTaskHandler(
+            cwd,
+            wsEnv.sessionRuntimeBaseDir,
+            () => wsBridgeRef,
+            () => generationGuard.assertOpen()
+          ),
           onChannelDelivery: createBoundChannelDeliveryHandler(
             cwd,
             () => channelWorkerManager,
@@ -7350,6 +7351,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
             const stopWorkspaceGitStateForWorkspace = app3?.locals?.["stopWorkspaceGitStateForWorkspace"];
             const stopScheduledTaskKeepaliveForWorkspace = app3?.locals?.["stopScheduledTaskKeepaliveForWorkspace"];
+            const releaseWebTerminalsForWorkspace = app3?.locals?.["releaseWebTerminalsForWorkspace"];
             try {
               stopWorkspaceGitStateForWorkspace?.(runtimeToDrain.workspaceCwd);
             } catch (err) {
@@ -7368,6 +7370,14 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                 err instanceof Error ? err : null
               );
             }
+            try {
+              releaseWebTerminalsForWorkspace?.(runtimeToDrain.workspaceCwd);
+            } catch (err) {
+              daemonLog.error(
+                "workspace web-terminal cleanup error",
+                err instanceof Error ? err : null
+              );
+            }
           }
           let bridgeStopped = false;
           try {
@@ -7439,8 +7449,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-HXXS3HOZ.js"),
-          import("./channel-settings-store-IV4KDL7N.js")
+          import("./channel-management-service-HQ6KDS7C.js"),
+          import("./channel-settings-store-PEOI7XCG.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -7520,6 +7530,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       // (keepalive) and reloads them on boot (rehydration). Off by default so
       // direct createServeApp embeds/tests don't spawn sessions.
       manageScheduledTaskSessions: true,
+      currentSessionSchedulingAvailable: deps.bridge === void 0,
       fsFactory: routeFsFactory,
       primaryWorkspaceTrusted: trustedWorkspace,
       primaryRuntimeEnv,
@@ -7644,8 +7655,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-PJDQUTJL.js"),
-        import("./daemon-trust-policy-monitor-2G3EKQEU.js")
+        import("./workspace-trust-reconciler-PLIDLJZX.js"),
+        import("./daemon-trust-policy-monitor-KGGROSIV.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -7740,7 +7751,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             handle?.disposeWorkspace(runtimeToDispose.workspaceId);
             const deadline = Date.now() + 1e3;
             while ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0 && Date.now() < deadline) {
-              await new Promise((resolve4) => setTimeout(resolve4, 25));
+              await new Promise((resolve3) => setTimeout(resolve3, 25));
             }
             if ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0) {
               throw new Error(
@@ -7817,6 +7828,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     qwenCodeVersion: cliVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    currentSessionSchedulingAvailable: false,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime: workspaceInputs.length > 1,
     getRuntimeError: /* @__PURE__ */ __name(() => runtimeStartupError, "getRuntimeError"),
@@ -7840,7 +7852,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     // through (and start the runtime) exactly like the warm app would.
     // Dynamic import keeps web-shell-static out of the serve fast-path
     // static closure (see the import-boundary guards in fast-path.test.ts).
-    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-A6QMUNNV.js").then(
+    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-HNB4FDOE.js").then(
       (webShellStatic) => webShellStatic.isPreAuthWebShellRequest(req)
     ) : void 0
   });
@@ -7860,7 +7872,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-WMGFPA3Z.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-DOR3YG62.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -7966,7 +7978,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   if (opts.channelSelection) {
     reserveChannelServicePidfile(opts.channelSelection);
   }
-  return await new Promise((resolve4, reject) => {
+  return await new Promise((resolve3, reject) => {
     let closeHost;
     const onListening = /* @__PURE__ */ __name((error) => {
       if (error) return;
@@ -8748,6 +8760,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               if (!preserveSignalHandlers) {
                 process.removeListener("SIGINT", onSignal);
                 process.removeListener("SIGTERM", onSignal);
+                process.removeListener("SIGHUP", onSignal);
               }
               process.removeListener(
                 "uncaughtExceptionMonitor",
@@ -8967,6 +8980,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
       process.on("SIGINT", onSignal);
       process.on("SIGTERM", onSignal);
+      process.on("SIGHUP", onSignal);
       process.on("uncaughtExceptionMonitor", onUncaughtExceptionMonitor);
       server.on("error", (err) => {
         daemonLog.error("server error", err instanceof Error ? err : null);
@@ -8997,7 +9011,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         loggerPublished = true;
         loggerLifecycle.published();
         void (liveDiscoveryPublish ?? Promise.resolve()).then(
-          () => resolve4(handle)
+          () => resolve3(handle)
         );
       } else {
         void runtimeReady.then(
@@ -9005,7 +9019,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             await liveDiscoveryPublish;
             loggerPublished = true;
             loggerLifecycle.published();
-            resolve4(handle);
+            resolve3(handle);
           },
           (err) => {
             void handle.close().then(
@@ -9054,10 +9068,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       drainHost: /* @__PURE__ */ __name(() => {
         if (closeHost) return closeHost();
         if (!server.listening) return Promise.resolve();
-        return new Promise((resolve5, rejectClose) => {
+        return new Promise((resolve4, rejectClose) => {
           server.close((error) => {
             if (error) rejectClose(error);
-            else resolve5();
+            else resolve4();
           });
         });
       }, "drainHost")