@qwen-code/qwen-code 0.22.2 → 0.22.3-nightly.20260831.3a0c4c6108

package/chunks/{chunk-F6FV3C5K.js → chunk-MBZ5ORJB.js}

@@ -2,31 +2,26 @@
 "use strict";
 import {
   parseToolWriteOriginMeta
-} from "./chunk-T3WXYEZ4.js";
+} from "./chunk-VGHZT6JR.js";
 import {
   MAX_CHILD_HEAP_MB,
   MIN_CHILD_HEAP_MB,
   recommendedChildShareMb
 } from "./chunk-UXEO7E3V.js";
 import {
-  isLoopbackBind
-} from "./chunk-RXFQM6FQ.js";
-import {
-  normalizeSessionIdForLookup
-} from "./chunk-ZEZKIS2K.js";
+  CLIENT_ID_RE,
+  MAX_CLIENT_ID_LENGTH
+} from "./chunk-LAUEEBDL.js";
 import {
   isInternalWorkspaceRuntime
 } from "./chunk-NYWWQ437.js";
 import {
-  CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-OZ6KS6KW.js";
-import {
-  MAX_WORKSPACE_PATH_LENGTH,
-  translateAndCheckAbsoluteWorkspacePath
-} from "./chunk-6PLDPT2C.js";
+  formatHostForAuthority,
+  isLoopbackBind
+} from "./chunk-DMEUXLSS.js";
 import {
-  writeStderrLine
-} from "./chunk-KGJGEEVR.js";
+  CLIENT_MCP_OVER_WS_CONFIG_FLAG
+} from "./chunk-ZGCKTAL5.js";
 import {
   ROOT_CONTEXT,
   context,
@@ -779,8 +774,8 @@ var DeviceFlowRegistry = class {
   /**
    * For diagnostics / GET /workspace/auth/status: report only pending
    * flows. Terminal entries are an implementation detail of the SDK
-   * reconnect path and shouldn't be enumerated to all bearer-token
-   * holders.
+   * reconnect path and shouldn't be enumerated to all authorized status
+   * callers.
    */
   listPending() {
     const out = [];
@@ -925,6 +920,67 @@ function isDeepHealthQuery(raw) {
 }
 __name(isDeepHealthQuery, "isDeepHealthQuery");
 
+// packages/cli/src/serve/server/self-origin.ts
+init_esbuild_shims();
+function installSelfOriginStripMiddleware(app, getPort, bind) {
+  let cachedStripPort = -1;
+  let cachedSelfOrigins = /* @__PURE__ */ new Set();
+  const boundHost = isLoopbackBind(bind) ? formatHostForAuthority(bind) : void 0;
+  app.use((req, _res, next) => {
+    const origin = req.headers.origin;
+    if (origin) {
+      const port = getPort();
+      if (port !== cachedStripPort) {
+        cachedStripPort = port;
+        cachedSelfOrigins = /* @__PURE__ */ new Set([
+          `http://127.0.0.1:${port}`,
+          `http://localhost:${port}`,
+          `http://[::1]:${port}`,
+          `http://host.docker.internal:${port}`,
+          `https://127.0.0.1:${port}`,
+          `https://localhost:${port}`,
+          `https://[::1]:${port}`,
+          `https://host.docker.internal:${port}`
+        ]);
+        if (boundHost) {
+          cachedSelfOrigins.add(`http://${boundHost}:${port}`);
+          cachedSelfOrigins.add(`https://${boundHost}:${port}`);
+        }
+        if (port === 80) {
+          for (const host of [
+            "127.0.0.1",
+            "localhost",
+            "[::1]",
+            "host.docker.internal"
+          ]) {
+            cachedSelfOrigins.add(`http://${host}`);
+          }
+          if (boundHost) {
+            cachedSelfOrigins.add(`http://${boundHost}`);
+          }
+        } else if (port === 443) {
+          for (const host of [
+            "127.0.0.1",
+            "localhost",
+            "[::1]",
+            "host.docker.internal"
+          ]) {
+            cachedSelfOrigins.add(`https://${host}`);
+          }
+          if (boundHost) {
+            cachedSelfOrigins.add(`https://${boundHost}`);
+          }
+        }
+      }
+      if (cachedSelfOrigins.has(origin)) {
+        delete req.headers.origin;
+      }
+    }
+    next();
+  });
+}
+__name(installSelfOriginStripMiddleware, "installSelfOriginStripMiddleware");
+
 // packages/cli/src/serve/acp-child-extra-args.ts
 init_esbuild_shims();
 function acpChildExtraArgs(opts) {
@@ -1084,6 +1140,16 @@ function parseAllowOriginPatterns(raw) {
   return { allowAny, origins };
 }
 __name(parseAllowOriginPatterns, "parseAllowOriginPatterns");
+function findNonLoopbackHttpOrigin(patterns) {
+  for (const origin of patterns.origins) {
+    const parsed = new URL(origin);
+    if ((parsed.protocol === "http:" || parsed.protocol === "https:") && !isLoopbackBind(parsed.hostname)) {
+      return origin;
+    }
+  }
+  return void 0;
+}
+__name(findNonLoopbackHttpOrigin, "findNonLoopbackHttpOrigin");
 var MutableOriginAllowlist = class {
   static {
     __name(this, "MutableOriginAllowlist");
@@ -1179,6 +1245,7 @@ function buildPrimaryHostGate(bind, getPort) {
   }
   let cachedPort = -1;
   let cachedAllowed = /* @__PURE__ */ new Set();
+  const boundHost = formatHostForAuthority(bind);
   const allowedFor = /* @__PURE__ */ __name((port) => {
     if (port === cachedPort) return cachedAllowed;
     cachedPort = port;
@@ -1186,13 +1253,15 @@ function buildPrimaryHostGate(bind, getPort) {
       `localhost:${port}`,
       `127.0.0.1:${port}`,
       `[::1]:${port}`,
-      `host.docker.internal:${port}`
+      `host.docker.internal:${port}`,
+      `${boundHost}:${port}`
     ]);
     if (port === 80 || port === 443) {
       cachedAllowed.add("localhost");
       cachedAllowed.add("127.0.0.1");
       cachedAllowed.add("[::1]");
       cachedAllowed.add("host.docker.internal");
+      cachedAllowed.add(boundHost);
     }
     return cachedAllowed;
   }, "allowedFor");
@@ -1253,13 +1322,22 @@ function requestWasAuthenticated(req) {
   return req[AUTHENTICATED_REQUEST] === true;
 }
 __name(requestWasAuthenticated, "requestWasAuthenticated");
+function isTrustedLoopbackMode(input) {
+  return input.loopbackBind && !input.tokenConfigured && !input.requireAuth;
+}
+__name(isTrustedLoopbackMode, "isTrustedLoopbackMode");
+function requestHasOperatorAuthority(req, trustedLoopbackMode) {
+  return requestWasAuthenticated(req) || trustedLoopbackMode && listenerIdentityOf(req).kind === "primary";
+}
+__name(requestHasOperatorAuthority, "requestHasOperatorAuthority");
 function createMutationGate(deps) {
   const passthrough = /* @__PURE__ */ __name((_req, _res, next) => next(), "passthrough");
-  if (deps.requireAuth || deps.tokenConfigured) {
+  if (deps.tokenConfigured) {
     return () => passthrough;
   }
+  const trustedLoopbackMode = deps.trustedLoopbackMode === true && deps.requireAuth === false;
   const strictDenier = /* @__PURE__ */ __name((req, res, next) => {
-    if (requestWasAuthenticated(req)) {
+    if (requestHasOperatorAuthority(req, trustedLoopbackMode)) {
       next();
       return;
     }
@@ -1490,7 +1568,17 @@ var SERVE_CAPABILITY_REGISTRY = {
     since: "v1",
     modes: ["workspace", "clean"]
   },
+  // Explicit remember targets and scoped forget (`scope` parameter). Old
+  // daemons silently ignore an unknown `scope`, so the SDK pre-flights the
+  // matching tag before sending one. The sibling no-op behavior change — a
+  // zero-write remember now fails `remember_no_update` instead of completing
+  // with 'No memory files updated.' — is deliberately untagged: it changes a
+  // task's terminal outcome, not the surface shape, and every client sees it
+  // as a typed `failed` task status that cannot be mistaken for success.
+  workspace_memory_remember_project_scope: { since: "v1" },
+  workspace_memory_remember_user_scope: { since: "v1" },
   workspace_memory_forget: { since: "v1" },
+  workspace_memory_forget_scope: { since: "v1" },
   workspace_memory_dream: { since: "v1" },
   // Workspace agents CRUD (`GET/POST /workspace/agents` +
   // `GET/POST/DELETE /workspace/agents/:agentType`). Wraps
@@ -1516,6 +1604,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_metadata: { since: "v1" },
   session_organization: { since: "v1" },
   session_export: { since: "v1" },
+  standalone_sessions_v1: { since: "v1" },
   session_transcript: { since: "v1" },
   session_transcript_pagination: { since: "v1" },
   // Daemon supports the MCP client guardrail surface: an in-process
@@ -1582,8 +1671,8 @@ var SERVE_CAPABILITY_REGISTRY = {
   // unregistered — the toggle takes effect on the next ACP child spawn
   // (`tools.disabled` is consulted at `Config` construction time).
   workspace_tool_toggle: { since: "v1" },
-  workspace_skill_toggle: { since: "v1" },
-  workspace_skill_batch_toggle: { since: "v1" },
+  workspace_skill_settings_toggle: { since: "v1" },
+  workspace_skill_settings_batch_toggle: { since: "v1" },
   extension_batch_activation_v2: { since: "v1" },
   workspace_skill_manage: { since: "v1" },
   workspace_settings: { since: "v1" },
@@ -1601,13 +1690,12 @@ var SERVE_CAPABILITY_REGISTRY = {
   // Workspace trust policy changes rebuild the affected runtime generation
   // without restarting the daemon. V2 trust status exposes convergence.
   workspace_trust_hot_reload: { since: "v1" },
-  // `POST /workspace/init` scaffolds an empty
-  // `QWEN.md` (or whatever `getCurrentGeminiMdFilename()` returns) at
-  // the bound workspace root. Body: `{force?: boolean}`. Default
+  // `POST /workspace/init` scaffolds an empty `QWEN.md` (or the
+  // workspace `context.fileName` value injected as `contextFilename`)
+  // at the bound workspace root. Body: `{force?: boolean}`. Default
   // refuses with 409 when the file already exists; `force: true`
-  // overwrites. Mechanical only — does NOT call the LLM. To AI-fill
-  // the file, the caller should follow up with
-  // `POST /session/:id/prompt`.
+  // overwrites. Mechanical only — does NOT call the LLM. To AI-fill the
+  // file, the caller should follow up with `POST /session/:id/prompt`.
   workspace_init: { since: "v1" },
   // `POST /workspace/setup-github` installs the fixed
   // qwen-code-action workflow set into the bound workspace after
@@ -1651,8 +1739,8 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_btw: { since: "v1" },
   // Direct daemon-side shell execution for an existing session.
   // Advertised CONDITIONALLY: operators must explicitly enable it and
-  // configure bearer auth. Clients must still send a session-bound
-  // X-Qwen-Client-Id when calling the route.
+  // either configure bearer auth or use trusted-loopback mode. Clients must
+  // still send a session-bound X-Qwen-Client-Id when calling the route.
   session_shell_command: { since: "v1" },
   // Daemon hosts a workspace-shared MCP transport
   // pool (`QwenAgent.mcpPool`); `GET /workspace/mcp` reflects pool-level
@@ -1750,6 +1838,13 @@ var SERVE_CAPABILITY_REGISTRY = {
   workspace_display_name: { since: "v1" },
   scratch_workspace_registration: { since: "v1" },
   workspace_runtime_removal: { since: "v1" },
+  // A native OS directory picker can be opened on the daemon host
+  // (osascript on macOS, PowerShell on Windows, zenity on a Linux host
+  // with a display). Headless hosts omit the tag so clients hide the
+  // Browse affordance instead of surfacing a guaranteed picker failure.
+  native_directory_picker: { since: "v1" },
+  // Workspace-owned runtime lifecycle status and explicit on-demand startup.
+  workspace_runtime: { since: "v1" },
   // Workspace-qualified core REST routes under `/workspaces/:workspace/...`.
   // Covers core file read/write/upload, status/permissions/trust/lifecycle/MCP/tool,
   // memory, workspace agent CRUD, and persisted session organization surfaces.
@@ -1773,7 +1868,9 @@ var SERVE_CAPABILITY_REGISTRY = {
   // projections. This is additive to the legacy primary-workspace
   // `workspace_extensions` contract.
   extension_management_v2: { since: "v1" },
+  extension_state: { since: "v1" },
   extension_git_credentials: { since: "v1" },
+  extension_local_path_install: { since: "v1" },
   // Workspace-qualified, daemon-local persisted transcript paging. The tag is
   // unconditional because the route also serves a trusted single-workspace
   // primary; authorization is evaluated for the selected runtime per request.
@@ -1839,10 +1936,15 @@ var SERVE_CAPABILITY_REGISTRY = {
   // WebShell daemon with native Host integration and the hot-applied enabled
   // gate. `/live/status` remains the dynamic readiness surface for the Host,
   // permissions, self-checks, and provider reachability.
-  realtime_voice: { since: "v1" }
+  realtime_voice: { since: "v1" },
+  web_terminal: { since: "v1" }
 };
 var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
   ["require_auth", (toggles) => toggles.requireAuth === true],
+  [
+    "standalone_sessions_v1",
+    (toggles) => toggles.standaloneSessionsAvailable === true
+  ],
   ["mcp_workspace_pool", (toggles) => toggles.mcpPoolActive === true],
   ["mcp_pool_restart", (toggles) => toggles.mcpPoolActive === true],
   [
@@ -1924,6 +2026,14 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
     "workspace_runtime_removal",
     (toggles) => toggles.workspaceRuntimeRemovalAvailable === true
   ],
+  [
+    "native_directory_picker",
+    (toggles) => toggles.nativeDirectoryPickerAvailable === true
+  ],
+  [
+    "workspace_runtime",
+    (toggles) => toggles.workspaceRuntimeAvailable === true
+  ],
   [
     "workspace_qualified_acp",
     // The plural routes are pre-mounted for workspaces registered after app
@@ -1960,7 +2070,8 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
   [
     "realtime_voice",
     (toggles) => toggles.acpHttpEnabled === true && toggles.realtimeVoiceEnabled === true
-  ]
+  ],
+  ["web_terminal", (toggles) => toggles.acpHttpEnabled === true]
 ]);
 var SERVE_FEATURES = Object.freeze(
   Object.keys(SERVE_CAPABILITY_REGISTRY)
@@ -1990,6 +2101,118 @@ function getServeProtocolVersions() {
 }
 __name(getServeProtocolVersions, "getServeProtocolVersions");
 
+// packages/cli/src/serve/native-directory-picker.ts
+init_esbuild_shims();
+import { execFile } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { delimiter, join } from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var PICKER_TIMEOUT_MS = 3e5;
+var NativeDirectoryPickerUnavailableError = class extends Error {
+  static {
+    __name(this, "NativeDirectoryPickerUnavailableError");
+  }
+};
+function isNativeDirectoryPickerAvailable(env = process.env, macOsSessionUids = process.platform === "darwin" ? readMacOsSessionUids() : void 0) {
+  if (process.platform === "darwin") {
+    return macOsSessionUids?.processUid !== void 0 && macOsSessionUids.processUid > 0 && macOsSessionUids.consoleUid === macOsSessionUids.processUid && !env["SSH_CONNECTION"] && !env["SSH_TTY"];
+  }
+  if (process.platform === "win32") {
+    const sessionName = env["SESSIONNAME"]?.trim();
+    return Boolean(sessionName && sessionName.toLowerCase() !== "services");
+  }
+  if (process.platform !== "linux") return false;
+  if (!env["DISPLAY"] && !env["WAYLAND_DISPLAY"]) return false;
+  return (env["PATH"] ?? "").split(delimiter).some((dir) => dir !== "" && isExecutableFile(join(dir, "zenity")));
+}
+__name(isNativeDirectoryPickerAvailable, "isNativeDirectoryPickerAvailable");
+function readMacOsSessionUids() {
+  try {
+    return {
+      processUid: process.getuid?.(),
+      consoleUid: statSync("/dev/console").uid
+    };
+  } catch {
+    return {};
+  }
+}
+__name(readMacOsSessionUids, "readMacOsSessionUids");
+function isExecutableFile(file) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(isExecutableFile, "isExecutableFile");
+async function pickNativeDirectory(signal) {
+  try {
+    if (process.platform === "darwin") {
+      const script = [
+        "const app = Application.currentApplication();",
+        "app.includeStandardAdditions = true;",
+        "app.chooseFolder({",
+        'withPrompt: "Select a workspace folder",',
+        "}).toString();"
+      ].join(" ");
+      const { stdout } = await execFileAsync(
+        "osascript",
+        ["-l", "JavaScript", "-e", script],
+        { timeout: PICKER_TIMEOUT_MS, signal }
+      );
+      return stdout.trim() || void 0;
+    }
+    if (process.platform === "win32") {
+      const script = [
+        "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;",
+        "Add-Type -AssemblyName System.Windows.Forms;",
+        "$dialog = New-Object System.Windows.Forms.FolderBrowserDialog;",
+        "if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {",
+        "[Console]::Out.Write($dialog.SelectedPath)",
+        "}"
+      ].join(" ");
+      const { stdout } = await execFileAsync(
+        "powershell.exe",
+        ["-NoProfile", "-STA", "-Command", script],
+        { timeout: PICKER_TIMEOUT_MS, signal }
+      );
+      return stdout.trim() || void 0;
+    }
+    if (process.platform === "linux") {
+      const { stdout } = await execFileAsync(
+        "zenity",
+        [
+          "--file-selection",
+          "--directory",
+          "--title=Select a workspace folder"
+        ],
+        { timeout: PICKER_TIMEOUT_MS, signal }
+      );
+      return stdout.trim() || void 0;
+    }
+  } catch (error) {
+    const result = error;
+    if (result.killed) {
+      return void 0;
+    }
+    if (process.platform === "darwin" && (result.stderr?.includes("(-128)") || result.stderr?.includes("User canceled")) || // Zenity exits 1 both for a deliberate cancel and for "cannot open
+    // display" on headless Linux; only the former is a silent cancel.
+    process.platform === "linux" && result.code === 1 && !result.stderr?.includes("cannot open display")) {
+      return void 0;
+    }
+    throw new NativeDirectoryPickerUnavailableError(
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  throw new NativeDirectoryPickerUnavailableError(
+    `Native directory picker is not supported on ${process.platform}`
+  );
+}
+__name(pickNativeDirectory, "pickNativeDirectory");
+
 // packages/cli/src/serve/types.ts
 init_esbuild_shims();
 var CAPABILITIES_SCHEMA_VERSION = 1;
@@ -2002,7 +2225,7 @@ import {
   basename,
   dirname,
   isAbsolute,
-  join,
+  join as join2,
   relative,
   resolve
 } from "node:path";
@@ -2080,7 +2303,7 @@ async function revalidateManagedScratchRoot(root) {
 __name(revalidateManagedScratchRoot, "revalidateManagedScratchRoot");
 async function createManagedScratchDirectory(root) {
   await revalidateManagedScratchRoot(root);
-  const created = await mkdtemp(join(root.canonicalRoot, "scratch-"));
+  const created = await mkdtemp(join2(root.canonicalRoot, "scratch-"));
   const canonical = realpathSync.native(created);
   if (!isManagedScratchChild(canonical, root.canonicalRoot)) {
     throw new Error("Managed scratch directory escaped its accepted root");
@@ -2393,235 +2616,6 @@ function installServeAppLifecycle(app, lifecycle = new ServeAppLifecycleControll
 }
 __name(installServeAppLifecycle, "installServeAppLifecycle");
 
-// packages/cli/src/serve/server/request-helpers.ts
-init_esbuild_shims();
-function sendJsonBodyParserError(res, err) {
-  if (err instanceof SyntaxError && "status" in err && err.status === 400) {
-    res.status(400).json({ error: "Invalid JSON in request body" });
-    return true;
-  }
-  if (err && typeof err === "object" && "status" in err && err.status === 413) {
-    res.status(413).json({ error: "Request body too large (max 10 MB)" });
-    return true;
-  }
-  return false;
-}
-__name(sendJsonBodyParserError, "sendJsonBodyParserError");
-var PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-var CLIENT_ID_HEADER = "x-qwen-client-id";
-var MAX_CLIENT_ID_LENGTH = 128;
-var MAX_TOOL_NAME_LENGTH = 256;
-var MAX_SERVER_NAME_LENGTH = 256;
-var CLIENT_ID_RE = /^[A-Za-z0-9._:-]+$/;
-var INVALID_PERMISSION_OUTCOME_ERROR = '`outcome` must be `{ outcome: "cancelled" }` or `{ outcome: "selected", optionId: string }`';
-var deferredRuntimeTimingKey = Symbol(
-  "deferredRuntimeRequestTiming"
-);
-function setDeferredRuntimeRequestTiming(req, timing) {
-  req[deferredRuntimeTimingKey] = timing;
-}
-__name(setDeferredRuntimeRequestTiming, "setDeferredRuntimeRequestTiming");
-function getDeferredRuntimeRequestTiming(req) {
-  return req[deferredRuntimeTimingKey];
-}
-__name(getDeferredRuntimeRequestTiming, "getDeferredRuntimeRequestTiming");
-function safeBody(req) {
-  const raw = req.body;
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    return /* @__PURE__ */ Object.create(null);
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(raw)) {
-    if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-    out[key] = value;
-  }
-  return out;
-}
-__name(safeBody, "safeBody");
-function parseOptionalWorkspaceCwd(body, boundWorkspace, res) {
-  const hasCwd = "cwd" in body;
-  if (hasCwd && typeof body["cwd"] !== "string") {
-    res.status(400).json({ error: "`cwd` must be a string absolute path when provided" });
-    return void 0;
-  }
-  if (hasCwd && body["cwd"].length > MAX_WORKSPACE_PATH_LENGTH) {
-    res.status(400).json({
-      error: `\`cwd\` exceeds the ${MAX_WORKSPACE_PATH_LENGTH}-character limit`
-    });
-    return void 0;
-  }
-  const cwd = translateAndCheckAbsoluteWorkspacePath(
-    hasCwd ? body["cwd"] : boundWorkspace
-  );
-  if (cwd === null) {
-    res.status(400).json({ error: "`cwd` must be an absolute path when provided" });
-    return void 0;
-  }
-  return cwd;
-}
-__name(parseOptionalWorkspaceCwd, "parseOptionalWorkspaceCwd");
-function requireSessionId(req, res) {
-  const sessionId = req.params["id"];
-  if (!sessionId) {
-    res.status(400).json({ error: "`sessionId` route parameter is required" });
-    return null;
-  }
-  return normalizeSessionIdForLookup(sessionId);
-}
-__name(requireSessionId, "requireSessionId");
-function parseClientIdHeader(req, res) {
-  const raw = req.get(CLIENT_ID_HEADER);
-  if (raw === void 0 || raw === "") return void 0;
-  if (raw.length > MAX_CLIENT_ID_LENGTH || !CLIENT_ID_RE.test(raw)) {
-    res.status(400).json({
-      error: "`X-Qwen-Client-Id` must be a non-empty token of 128 characters or fewer",
-      code: "invalid_client_id"
-    });
-    return null;
-  }
-  return raw;
-}
-__name(parseClientIdHeader, "parseClientIdHeader");
-function detectFromLoopback(req) {
-  const addr = req.socket?.remoteAddress;
-  if (typeof addr !== "string") return false;
-  if (addr === "::1") return true;
-  if (addr.startsWith("127.")) return true;
-  if (addr.startsWith("::ffff:127.")) return true;
-  return false;
-}
-__name(detectFromLoopback, "detectFromLoopback");
-function validateMcpRuntimeServerName(name, res) {
-  if (typeof name !== "string" || name.length === 0) {
-    res.status(400).json({
-      error: "Server name is required and must be a non-empty string",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (name.length > MAX_SERVER_NAME_LENGTH) {
-    res.status(400).json({
-      error: `Server name exceeds ${MAX_SERVER_NAME_LENGTH}-character limit`,
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-    res.status(400).json({
-      error: "Server name must contain only alphanumeric characters, underscores, and hyphens",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  if (name === "__proto__" || name === "constructor" || name === "prototype") {
-    res.status(400).json({
-      error: "Server name must not be a reserved JS property name",
-      code: "invalid_server_name"
-    });
-    return false;
-  }
-  return true;
-}
-__name(validateMcpRuntimeServerName, "validateMcpRuntimeServerName");
-function parseAndValidateWorkspaceClientId(req, res, bridge) {
-  const raw = parseClientIdHeader(req, res);
-  if (raw === null || raw === void 0) return raw;
-  const bridges = Array.isArray(bridge) ? bridge : [bridge];
-  if (!bridges.some((candidate) => candidate.knownClientIds().has(raw))) {
-    res.status(400).json({
-      error: `Client id "${raw}" is not registered for this workspace`,
-      code: "invalid_client_id",
-      clientId: raw
-    });
-    return null;
-  }
-  return raw;
-}
-__name(parseAndValidateWorkspaceClientId, "parseAndValidateWorkspaceClientId");
-function createBuildWorkspaceCtx(boundWorkspace) {
-  return (route, clientId) => ({
-    originatorClientId: clientId,
-    route,
-    workspaceCwd: boundWorkspace
-  });
-}
-__name(createBuildWorkspaceCtx, "createBuildWorkspaceCtx");
-function parsePermissionVoteBody(req, res) {
-  const body = safeBody(req);
-  const outcome = body["outcome"];
-  if (!isValidOutcome(outcome)) {
-    res.status(400).json({ error: INVALID_PERMISSION_OUTCOME_ERROR });
-    return void 0;
-  }
-  return {
-    ...body,
-    outcome
-  };
-}
-__name(parsePermissionVoteBody, "parsePermissionVoteBody");
-function isValidOutcome(raw) {
-  if (typeof raw !== "object" || raw === null) return false;
-  const obj = raw;
-  if (obj["outcome"] === "cancelled") return true;
-  return obj["outcome"] === "selected" && typeof obj["optionId"] === "string" && obj["optionId"].length > 0;
-}
-__name(isValidOutcome, "isValidOutcome");
-var MIN_QUERY_MAX_QUEUED = 16;
-var MAX_QUERY_MAX_QUEUED = 2048;
-function parseMaxQueuedQuery(raw, res) {
-  if (raw === void 0) return void 0;
-  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
-    writeStderrLine(
-      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (not a decimal integer)`
-    );
-    res.status(400).json({
-      error: "`maxQueued` must be a decimal integer",
-      code: "invalid_max_queued"
-    });
-    return null;
-  }
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n < MIN_QUERY_MAX_QUEUED || n > MAX_QUERY_MAX_QUEUED) {
-    writeStderrLine(
-      `qwen serve: rejected ?maxQueued ${safeLogValue(raw)} (outside [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}])`
-    );
-    res.status(400).json({
-      error: `\`maxQueued\` must be in [${MIN_QUERY_MAX_QUEUED}, ${MAX_QUERY_MAX_QUEUED}]`,
-      code: "invalid_max_queued"
-    });
-    return null;
-  }
-  return n;
-}
-__name(parseMaxQueuedQuery, "parseMaxQueuedQuery");
-function safeLogValue(raw) {
-  return JSON.stringify(String(raw)).slice(0, 82);
-}
-__name(safeLogValue, "safeLogValue");
-function parseLastEventId(raw) {
-  if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
-    if (typeof raw === "string" && raw.length > 0) {
-      writeStderrLine(
-        `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (not a decimal integer)`
-      );
-    }
-    return void 0;
-  }
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n > Number.MAX_SAFE_INTEGER) {
-    writeStderrLine(
-      `qwen serve: rejected Last-Event-ID ${safeLogValue(raw)} (exceeds Number.MAX_SAFE_INTEGER)`
-    );
-    return void 0;
-  }
-  return n;
-}
-__name(parseLastEventId, "parseLastEventId");
-
 // packages/cli/src/serve/rate-limit.ts
 init_esbuild_shims();
 var MAX_BUCKETS = 1e4;
@@ -3281,6 +3275,7 @@ async function buildDaemonStatusResponse(detail, input) {
       writerIdleTimeoutMs: positiveFiniteOrNull(input.opts.writerIdleTimeoutMs),
       channelIdleTimeoutMs: bridgeSnapshot.limits.channelIdleTimeoutMs,
       sessionIdleTimeoutMs: bridgeSnapshot.limits.sessionIdleTimeoutMs,
+      sessionPromptSettledCloseGraceMs: bridgeSnapshot.limits.sessionPromptSettledCloseGraceMs,
       acpConnectionCap: acpSnapshot?.connectionCap ?? null,
       acpPreAttachMaxFramesPerStream: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_FRAMES_PER_STREAM : null,
       acpPreAttachMaxFramesPerConnection: acpSnapshot !== void 0 ? ACP_PRE_ATTACH_MAX_FRAMES_PER_CONNECTION : null,
@@ -4145,6 +4140,7 @@ export {
   createBridgeFileSystemAdapter,
   PathMutexRegistry,
   isDeepHealthQuery,
+  installSelfOriginStripMiddleware,
   acpChildExtraArgs,
   CredentialStore,
   singleTokenCredentials,
@@ -4153,17 +4149,22 @@ export {
   listenerIdentityOfSocket,
   denyBrowserOriginCors,
   parseAllowOriginPatterns,
+  findNonLoopbackHttpOrigin,
   MutableOriginAllowlist,
   allowOriginCors,
   hostAllowlist,
   bearerAuth,
-  requestWasAuthenticated,
+  isTrustedLoopbackMode,
+  requestHasOperatorAuthority,
   createMutationGate,
   ClientMcpSenderRegistry,
   createClientMcpServerProvider,
   SERVE_CAPABILITY_REGISTRY,
   getAdvertisedServeFeatures,
   getServeProtocolVersions,
+  NativeDirectoryPickerUnavailableError,
+  isNativeDirectoryPickerAvailable,
+  pickNativeDirectory,
   CAPABILITIES_SCHEMA_VERSION,
   isManagedScratchChild,
   isScratchRootCompatible,
@@ -4176,26 +4177,6 @@ export {
   conversationRootCompromisedError,
   ServeAppLifecycleController,
   installServeAppLifecycle,
-  sendJsonBodyParserError,
-  CLIENT_ID_HEADER,
-  MAX_CLIENT_ID_LENGTH,
-  MAX_TOOL_NAME_LENGTH,
-  MAX_SERVER_NAME_LENGTH,
-  CLIENT_ID_RE,
-  setDeferredRuntimeRequestTiming,
-  getDeferredRuntimeRequestTiming,
-  safeBody,
-  parseOptionalWorkspaceCwd,
-  requireSessionId,
-  parseClientIdHeader,
-  detectFromLoopback,
-  validateMcpRuntimeServerName,
-  parseAndValidateWorkspaceClientId,
-  createBuildWorkspaceCtx,
-  parsePermissionVoteBody,
-  parseMaxQueuedQuery,
-  safeLogValue,
-  parseLastEventId,
   createRateLimiter,
   setRateLimiter,
   getRateLimiter,