@qwen-code/qwen-code 0.22.2 → 0.22.3-nightly.20260831.3a0c4c6108

package/chunks/{run-qwen-serve-TPHZMSXJ.js → run-qwen-serve-3LKV7KDC.js}

@@ -4,11 +4,15 @@ import {
   computeCpuPercent
 } from "./chunk-LBOVL47Y.js";
 import {
-  RUNTIME_STARTUP_CANCELLED_MESSAGE
-} from "./chunk-QUPXZXLV.js";
+  hostAssignsIpv6Loopback,
+  isOwnInterfaceAddress
+} from "./chunk-24FVUD5P.js";
 import {
   resolveServeToken
 } from "./chunk-ZELCTN6Y.js";
+import {
+  RUNTIME_STARTUP_CANCELLED_MESSAGE
+} from "./chunk-QUPXZXLV.js";
 import {
   ACCESS_LOG_CONTROLLER_LOCAL,
   CAPABILITIES_SCHEMA_VERSION,
@@ -24,39 +28,47 @@ import {
   bearerAuth,
   createBridgeFileSystemAdapter,
   denyBrowserOriginCors,
+  findNonLoopbackHttpOrigin,
   getAdvertisedServeFeatures,
   getDeviceFlowRegistry,
   getRateLimiter,
   getServeProtocolVersions,
   hostAllowlist,
+  installSelfOriginStripMiddleware,
   isBrowserAutomationMcpAvailable,
   isDeepHealthQuery,
   isManagedScratchChild,
+  isNativeDirectoryPickerAvailable,
+  isTrustedLoopbackMode,
   listenerMaxConnections,
   parseAllowOriginPatterns,
   parseDaemonStatusDetail,
   positiveFiniteOrNull,
   prepareManagedScratchRoot,
   resolveAcpHttpEnabled,
-  setDeferredRuntimeRequestTiming,
   toDaemonStatusMemoryLimits
-} from "./chunk-F6FV3C5K.js";
+} from "./chunk-MBZ5ORJB.js";
+import "./chunk-VGHZT6JR.js";
 import {
   ConversationDirectoryIdentityError,
   assertExactConversationRootIdentity,
   createConversationRootIdentity,
+  getConversationDirectoryName,
+  getConversationStagedDirectoryName,
   inspectConversationDirectoryIdentity,
+  inspectConversationStagedDirectoryIdentity,
+  isSameConversationDirectoryObject,
   materializeConversationDirectoryIdentity,
   revalidateConversationRootIdentity
-} from "./chunk-T3WXYEZ4.js";
+} from "./chunk-PB7JBAHF.js";
 import {
   formatMemoryBudgetStderr,
   resolveDaemonMemoryBudget,
   serveJournalGrowthPoolMb
 } from "./chunk-UXEO7E3V.js";
 import {
-  isLoopbackBind
-} from "./chunk-RXFQM6FQ.js";
+  setDeferredRuntimeRequestTiming
+} from "./chunk-LAUEEBDL.js";
 import {
   normalizeSessionIdForLookup
 } from "./chunk-ZEZKIS2K.js";
@@ -64,6 +76,9 @@ import "./chunk-NYWWQ437.js";
 import {
   resolveSessionRestoreTimeoutMs
 } from "./chunk-4JRM2BSM.js";
+import {
+  DEFAULT_RING_SIZE
+} from "./chunk-7U5G6JXI.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
   DEFAULT_MAX_JOURNAL_BYTES,
@@ -79,9 +94,13 @@ import {
 import {
   resolveWebShellDir
 } from "./chunk-FBX2SDQ4.js";
+import {
+  isLoopbackAddress,
+  isLoopbackBind
+} from "./chunk-DMEUXLSS.js";
 import {
   resolveChannelCwd
-} from "./chunk-7JPW6IYH.js";
+} from "./chunk-GN422P4J.js";
 import {
   LIVE_HOST_PROTOCOL_VERSION
 } from "./chunk-NKLP3DCK.js";
@@ -92,17 +111,17 @@ import {
   consumeServeFastPathRejectedLoaderKeys,
   loadServeFastPathSettings,
   preResolveServeFastPathHomeEnvOverrides
-} from "./chunk-TWSKM647.js";
+} from "./chunk-6VHIWUJP.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-77RG5SFQ.js";
-import "./chunk-43UYNAWX.js";
+} from "./chunk-RY7DL5IF.js";
+import "./chunk-T3TL6S3B.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-OZ6KS6KW.js";
-import "./chunk-ERFDKH32.js";
+} from "./chunk-ZGCKTAL5.js";
+import "./chunk-YPISTYEI.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
@@ -110,22 +129,22 @@ import {
 import {
   ExtraCaInspectionError,
   loadableCertificates
-} from "./chunk-4HV6HH33.js";
+} from "./chunk-FPMQT2YY.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
   ChannelWebhookEnqueueError
 } from "./chunk-STUJ7IMZ.js";
+import {
+  QWEN_SERVER_TOKEN_ENV
+} from "./chunk-GYTKQYDB.js";
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-JVPFTDBK.js";
+} from "./chunk-3EGEBDTW.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
-import {
-  QWEN_SERVER_TOKEN_ENV
-} from "./chunk-GYTKQYDB.js";
 import {
   ChannelDeliveryError,
   isChannelDeliveryError
@@ -144,7 +163,7 @@ import {
 } from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-E55H6BZ7.js";
+} from "./chunk-IXEZHTDR.js";
 import "./chunk-IW6RQPQB.js";
 import "./chunk-GOXKNSDZ.js";
 import {
@@ -156,10 +175,10 @@ import {
   clearLoaderKeyRejectionReporterIfCurrent,
   scrubInheritedLoaderEnv,
   setLoaderKeyRejectionReporter
-} from "./chunk-5PA6UEYA.js";
+} from "./chunk-3452WXOK.js";
 import {
   getCliVersion
-} from "./chunk-7UYV53BC.js";
+} from "./chunk-ZYPJ7HVZ.js";
 import "./chunk-W3N5XAZ6.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
@@ -168,6 +187,7 @@ import {
 import "./chunk-LJZSMWOH.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
+import "./chunk-6HUXPLB5.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
 import {
@@ -182,7 +202,7 @@ import "./chunk-JVEGA3MM.js";
 import {
   writeStderrLine,
   writeStdoutLine
-} from "./chunk-KGJGEEVR.js";
+} from "./chunk-7FA2II6K.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
 import {
@@ -204,6 +224,7 @@ init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
 import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto";
 import { execFile } from "node:child_process";
+import { lookup } from "node:dns/promises";
 import * as fs from "node:fs";
 import { createServer } from "node:http";
 import * as https from "node:https";
@@ -620,11 +641,11 @@ async function ensureRealDirectory(fs2, dirPath, mutationAllowed = () => true) {
 __name(ensureRealDirectory, "ensureRealDirectory");
 async function activeFileSize(fs2, activePath) {
   try {
-    const stat = await fs2.lstat(activePath);
-    if (!stat.isFile() || stat.isSymbolicLink()) {
+    const stat2 = await fs2.lstat(activePath);
+    if (!stat2.isFile() || stat2.isSymbolicLink()) {
       throw new Error(`${activePath} is not a regular file`);
     }
-    return stat.size;
+    return stat2.size;
   } catch (error) {
     if (isErrno(error, "ENOENT")) return 0;
     throw error;
@@ -1045,8 +1066,8 @@ __name(closeFallbackFamily, "closeFallbackFamily");
 async function cleanupFallbacksBestEffort(input) {
   const runsDir = nodePath.join(input.daemonDir, "runs");
   try {
-    const stat = await input.fs.lstat(runsDir);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    const stat2 = await input.fs.lstat(runsDir);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink()) {
       throw new Error(`${runsDir} is not a real directory`);
     }
   } catch (error) {
@@ -1768,9 +1789,10 @@ __name(initDaemonLogger, "initDaemonLogger");
 
 // packages/cli/src/serve/conversations/conversation-workspace.ts
 init_esbuild_shims();
-import { readdir, rmdir } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { open, readdir, rename, rm, rmdir, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { resolve } from "node:path";
+import { join as join2, resolve } from "node:path";
 function liveIdentityError(error, exactRoot = false, creatingRoot = false) {
   if (!(error instanceof ConversationDirectoryIdentityError)) throw error;
   if (error.reason === "io_error" && error.cause !== void 0) {
@@ -2012,6 +2034,171 @@ var ConversationWorkspace = class {
       throw error;
     }
   }
+  async inspectStandaloneDeletionPaths(storageSessionId, expected) {
+    const root = await this.revalidateStandaloneRoot();
+    try {
+      const normal = await inspectConversationDirectoryIdentity(
+        root,
+        storageSessionId
+      );
+      const staged = await inspectConversationStagedDirectoryIdentity(
+        root,
+        storageSessionId
+      );
+      if (normal && staged) {
+        throw new ConversationDirectoryIdentityError(
+          "child",
+          "unexpected_identity"
+        );
+      }
+      const identity = normal ?? staged;
+      if (identity && expected && !isSameConversationDirectoryObject(identity, expected)) {
+        throw new ConversationDirectoryIdentityError(
+          "child",
+          "unexpected_identity"
+        );
+      }
+      if (normal) return { status: "normal", identity: normal };
+      if (staged) return { status: "staged", identity: staged };
+      return { status: "absent" };
+    } catch (error) {
+      if (error instanceof ConversationDirectoryIdentityError && error.scope === "child") {
+        return { status: "compromised", error };
+      }
+      throw error;
+    }
+  }
+  async createStandaloneDeletionExpectation(storageSessionId, recorded) {
+    if (recorded.inodeVerifiable !== (recorded.inode !== 0)) {
+      throw new ConversationDirectoryIdentityError(
+        "child",
+        "unexpected_identity"
+      );
+    }
+    const root = await this.revalidateStandaloneRoot();
+    const name = getConversationDirectoryName(storageSessionId);
+    return {
+      root,
+      storageSessionId,
+      name,
+      canonicalPath: join2(root.canonicalRoot, name),
+      device: recorded.device,
+      inode: recorded.inode
+    };
+  }
+  async stageStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "normal") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const root = await this.revalidateStandaloneRoot();
+    await rename(
+      inspected.identity.canonicalPath,
+      join2(
+        root.canonicalRoot,
+        getConversationStagedDirectoryName(storageSessionId)
+      )
+    );
+    await revalidateConversationRootIdentity(root);
+    const staged = await inspectConversationStagedDirectoryIdentity(
+      root,
+      storageSessionId
+    );
+    if (!staged || !isSameConversationDirectoryObject(staged, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await this.syncStandaloneRoot(root);
+    return staged;
+  }
+  async restoreStagedStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "staged") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const root = await this.revalidateStandaloneRoot();
+    await rename(
+      inspected.identity.canonicalPath,
+      join2(root.canonicalRoot, getConversationDirectoryName(storageSessionId))
+    );
+    await revalidateConversationRootIdentity(root);
+    const restored = await inspectConversationDirectoryIdentity(
+      root,
+      storageSessionId
+    );
+    if (!restored || !isSameConversationDirectoryObject(restored, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await this.syncStandaloneRoot(root);
+    return restored;
+  }
+  async removeStagedStandaloneDirectory(storageSessionId, expected) {
+    const inspected = await this.inspectStandaloneDeletionPaths(
+      storageSessionId,
+      expected
+    );
+    if (inspected.status === "compromised") throw inspected.error;
+    if (inspected.status !== "staged") {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    const confirmed = await inspectConversationStagedDirectoryIdentity(
+      inspected.identity.root,
+      storageSessionId
+    );
+    if (!confirmed || !isSameConversationDirectoryObject(confirmed, inspected.identity)) {
+      throw new ConversationDirectoryIdentityError("child", "identity_changed");
+    }
+    await rm(confirmed.canonicalPath, { recursive: true });
+    await this.syncStandaloneRoot(confirmed.root);
+  }
+  async confirmStandaloneRootDurability(root) {
+    await this.syncStandaloneRoot(root);
+  }
+  async syncStandaloneRoot(root) {
+    await revalidateConversationRootIdentity(root);
+    let handle;
+    try {
+      handle = await open(
+        root.canonicalRoot,
+        fsConstants.O_RDONLY | (process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW ?? 0)
+      );
+      const stats = await handle.stat();
+      const inodeVerifiable = Number.isSafeInteger(stats.ino) && stats.ino > 0;
+      if (!stats.isDirectory() || stats.dev !== root.device || inodeVerifiable !== root.inodeVerifiable || root.inodeVerifiable && stats.ino !== root.inode) {
+        throw new ConversationDirectoryIdentityError(
+          "root",
+          "identity_changed"
+        );
+      }
+      try {
+        await handle.sync();
+      } catch (error) {
+        if (process.platform !== "win32" || !["EACCES", "EINVAL", "EPERM"].includes(
+          error.code ?? ""
+        )) {
+          throw error;
+        }
+      }
+      const current = await stat(root.canonicalRoot);
+      const currentInodeVerifiable = Number.isSafeInteger(current.ino) && current.ino > 0;
+      if (!current.isDirectory() || current.dev !== root.device || currentInodeVerifiable !== root.inodeVerifiable || root.inodeVerifiable && current.ino !== root.inode) {
+        throw new ConversationDirectoryIdentityError(
+          "root",
+          "identity_changed"
+        );
+      }
+    } finally {
+      await handle?.close().catch(() => void 0);
+    }
+    await revalidateConversationRootIdentity(root);
+  }
 };
 
 // packages/cli/src/serve/daemon-metrics-ring.ts
@@ -2919,8 +3106,8 @@ var RUNTIME_STARTUP_TIMEOUT_ENV = "QWEN_SERVE_RUNTIME_STARTUP_TIMEOUT_MS";
 var MAX_EVENT_RING_SIZE = 1e6;
 var DEFAULT_MAX_SESSIONS = 32;
 var DEFAULT_MAX_PENDING_PROMPTS_PER_SESSION = 5;
-var DEFAULT_EVENT_RING_SIZE = 8e3;
 var DEFAULT_SESSION_IDLE_TIMEOUT_MS = 30 * 6e4;
+var DEFAULT_SESSION_PROMPT_SETTLED_CLOSE_GRACE_MS = 0;
 var WORKSPACE_SETTING_SCOPE = "Workspace";
 function isPositiveIntegerMs(value) {
   return Number.isFinite(value) && Number.isInteger(value) && value > 0;
@@ -3054,15 +3241,52 @@ function workspaceRuntimeEffectiveEnv(runtime, daemonEnv) {
   return runtime.env.effectiveEnv ?? daemonEnv;
 }
 __name(workspaceRuntimeEffectiveEnv, "workspaceRuntimeEffectiveEnv");
-function formatChannelWorkerDaemonUrl(host, port, tls = false) {
+function canonicalIpLiteral(host) {
+  const inner = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  try {
+    const hostname = new URL(
+      `http://${inner.includes(":") ? `[${inner}]` : inner}`
+    ).hostname;
+    const canonical = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+    return isIP(canonical) === 0 ? void 0 : canonical;
+  } catch {
+    return void 0;
+  }
+}
+__name(canonicalIpLiteral, "canonicalIpLiteral");
+function formatChannelWorkerDaemonUrl(host, port, tls = false, boundFamily, ipv6LoopbackAssigned = hostAssignsIpv6Loopback()) {
   const scheme = tls ? "https" : "http";
   const normalized = host.trim().toLowerCase();
-  if (normalized === "" || normalized === "0.0.0.0" || normalized === "::" || normalized === "[::]") {
+  const canonicalIp = canonicalIpLiteral(normalized);
+  const v6Loopback = ipv6LoopbackAssigned ? `${scheme}://[::1]:${port}` : `${scheme}://127.0.0.1:${port}`;
+  if (normalized === "") {
+    return boundFamily === "IPv4" ? `${scheme}://127.0.0.1:${port}` : v6Loopback;
+  }
+  if (canonicalIp === "::") {
+    return v6Loopback;
+  }
+  if (canonicalIp === "0.0.0.0" || canonicalIp === "::ffff:0:0") {
     return `${scheme}://127.0.0.1:${port}`;
   }
   return `${scheme}://${formatHostForUrl(host)}:${port}`;
 }
 __name(formatChannelWorkerDaemonUrl, "formatChannelWorkerDaemonUrl");
+function assertChannelWorkerDaemonUrlIsLocal(workerDaemonUrl, hostname) {
+  let host;
+  try {
+    host = new URL(workerDaemonUrl).hostname;
+  } catch {
+    throw new Error(
+      `Channels cannot start: --hostname "${hostname}" cannot be carried in a worker URL (a zone-scoped address has no spelling the URL parser accepts). Bind to loopback, to the wildcard (0.0.0.0 / ::), or to a zone-less literal address of one of this machine's interfaces.`
+    );
+  }
+  if (isLoopbackBind(host)) return;
+  if (isOwnInterfaceAddress(host)) return;
+  throw new Error(
+    `Channels cannot start: --hostname "${hostname}" is not a loopback bind and does not name an address on this host, so channel workers have no local URL to reach the daemon on. Bind to loopback, to the wildcard (0.0.0.0 / ::), or to a literal address of one of this machine's interfaces.`
+  );
+}
+__name(assertChannelWorkerDaemonUrlIsLocal, "assertChannelWorkerDaemonUrlIsLocal");
 var WORKER_TLS_TRUST_PROBE = `
 import { isIP } from 'node:net';
 import * as tls from 'node:tls';
@@ -3181,9 +3405,11 @@ function describeWorkerTlsTrustGaps(opts) {
   );
   const leafHeldByWorkers = servingBlocks !== void 0 && servingBlocks.some((block) => block.fingerprint256 === x509.fingerprint256);
   const workerTrustStore = operatorChain && servingBlocks ? [...operatorChain, ...servingChain] : servingChain;
+  const now = Date.now();
   const anchorPath = walkWorkerAnchorPath(
     x509,
     workerTrustStore,
+    now,
     // The `servingBlocks === undefined` fallback prepends the leaf too, but
     // that file already reports its own gap below and the workers receive it
     // verbatim; only the partial-read case needs the distinction.
@@ -3239,7 +3465,6 @@ function describeWorkerTlsTrustGaps(opts) {
       `--tls-cert "${opts.certPath}" is issued by another CA (${x509.issuer.replace(/\r?\n/g, ", ")}), not self-signed, and ${!opts.operatorCaCertPath ? `no NODE_EXTRA_CA_CERTS is set` : opts.operatorCaCertReadError !== void 0 ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" could not be read, so whatever it carries reached nobody` : operatorDiscarded ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" was discarded together with the unloadable serving file above, whatever it carries` : `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" does not carry a certificate that anchors it`}, so nothing in the channel workers' bundle anchors their trust \u2014 every worker handshake to the daemon will fail UNABLE_TO_VERIFY_LEAF_SIGNATURE unless the issuing CA is already in the workers' default trust store. ` + (operatorDiscarded ? `Re-export --tls-cert as described above and restart; NODE_EXTRA_CA_CERTS is not the file to change.` : opts.operatorCaCertReadError !== void 0 ? `Make NODE_EXTRA_CA_CERTS readable by the daemon as described above and restart.` : `Point NODE_EXTRA_CA_CERTS at the issuing CA (for mkcert: "$(mkcert -CAROOT)/rootCA.pem") and restart.`)
     );
   }
-  const now = Date.now();
   for (const member of anchorPath.path) {
     if (member.fingerprint256 === x509.fingerprint256) continue;
     const subject = member.subject.replace(/\r?\n/g, ", ");
@@ -3249,14 +3474,16 @@ function describeWorkerTlsTrustGaps(opts) {
       );
       continue;
     }
-    if (new Date(member.validTo).getTime() < now) {
-      gaps.push(
-        `--tls-cert "${opts.certPath}" chains through "${subject}", which expired on ${member.validTo} \u2014 every worker handshake to the daemon will fail CERT_HAS_EXPIRED. Renew that chain member and restart.`
-      );
-    } else if (new Date(member.validFrom).getTime() > now) {
-      gaps.push(
-        `--tls-cert "${opts.certPath}" chains through "${subject}", which is not yet valid (validFrom: ${member.validFrom}) \u2014 every worker handshake to the daemon will fail CERT_NOT_YET_VALID. Check that chain member's notBefore date or the system clock.`
-      );
+    if (!certValidAt(member, now)) {
+      if (new Date(member.validTo).getTime() < now) {
+        gaps.push(
+          `--tls-cert "${opts.certPath}" chains through "${subject}", which expired on ${member.validTo} \u2014 every worker handshake to the daemon will fail CERT_HAS_EXPIRED. Renew that chain member and restart.`
+        );
+      } else {
+        gaps.push(
+          `--tls-cert "${opts.certPath}" chains through "${subject}", which is not yet valid (validFrom: ${member.validFrom}) \u2014 every worker handshake to the daemon will fail CERT_NOT_YET_VALID. Check that chain member's notBefore date or the system clock.`
+        );
+      }
     }
   }
   const host = workerDialHost(opts.daemonUrl);
@@ -3377,6 +3604,10 @@ function cannotIssueCertificates(cert) {
   return !isV1Certificate(cert) && keyUsage === void 0;
 }
 __name(cannotIssueCertificates, "cannotIssueCertificates");
+function certValidAt(cert, now) {
+  return new Date(cert.validFrom).getTime() <= now && new Date(cert.validTo).getTime() >= now;
+}
+__name(certValidAt, "certValidAt");
 function isSelfSignedCert(x509) {
   if (x509.subject !== x509.issuer) return false;
   try {
@@ -3447,7 +3678,7 @@ function pathLengthConstraint(cert) {
   return length;
 }
 __name(pathLengthConstraint, "pathLengthConstraint");
-function walkWorkerAnchorPath(leaf, chain, leafHeldByWorkers = true) {
+function walkWorkerAnchorPath(leaf, chain, now, leafHeldByWorkers = true) {
   let next = leaf;
   const walked = /* @__PURE__ */ new Set();
   const path2 = [];
@@ -3472,9 +3703,10 @@ function walkWorkerAnchorPath(leaf, chain, leafHeldByWorkers = true) {
       return pathLengthViolation ? { anchored: false, path: path2, pathLengthViolation } : { anchored: true, path: path2 };
     }
     walked.add(current.fingerprint256);
-    const issuer = chain.find(
+    const issuers = chain.filter(
       (candidate) => !walked.has(candidate.fingerprint256) && certIssuedBy(current, candidate)
     );
+    const issuer = issuers.find((candidate) => certValidAt(candidate, now)) ?? issuers[0];
     if (issuer && !isSelfSignedCert(issuer) && !issuer.ca) {
       return { anchored: false, path: path2, incapableIssuer: issuer };
     }
@@ -3566,12 +3798,12 @@ __name(hasRetryableChannelWorkerShutdownError, "hasRetryableChannelWorkerShutdow
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-UEW2WWCC.js"),
-    import("./pidfile-JMF2CLMY.js"),
-    import("./runtime-TTIGSBM4.js"),
+    import("./channel-worker-supervisor-HDVE4ADS.js"),
+    import("./pidfile-5ACKG2LI.js"),
+    import("./runtime-66F4W3IA.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-27HMGD5S.js"),
-    import("./channel-worker-manager-QEGX646Z.js")
+    import("./channel-worker-group-ZLP5SJHT.js"),
+    import("./channel-worker-manager-FG5377T2.js")
   ]).then(
     ([
       supervisor,
@@ -3677,7 +3909,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-677KFX6Q.js");
+  coreRuntimePromise ??= import("./core-runtime-NASPCSQX.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -3713,10 +3945,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-VOZYKLTT.js"),
-    import("./environment-MOZMPUHR.js"),
-    import("./loadedSettingsAdapter-7Y7IEI6T.js"),
-    import("./trustedFolders-7OCNMUQE.js")
+    import("./settings-ZOHIQWYK.js"),
+    import("./environment-25ADH4Y6.js"),
+    import("./loadedSettingsAdapter-2P7DFWUR.js"),
+    import("./trustedFolders-QJYEFMTU.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3729,8 +3961,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-TTIGSBM4.js"),
-    import("./config-utils-BBOCOGZW.js")
+    import("./runtime-66F4W3IA.js"),
+    import("./config-utils-NNUPVGEC.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3754,20 +3986,22 @@ async function loadServeRuntimeModules() {
     workspaceSkillsStatusModule,
     totalSessionAdmissionModule,
     workspaceRegistryModule,
+    workspaceRuntimeCoordinatorModule,
     promptLedgerModule
   ] = await Promise.all([
-    import("./server-DFUSSSHI.js"),
-    import("./bridge-FKZTVIS3.js"),
-    import("./spawnChannel-F6WVP723.js"),
-    import("./process-registry-PMJOA5CO.js"),
-    import("./workspace-service-MUYO2QIC.js"),
-    import("./types-WYCFCEHR.js"),
-    import("./daemon-status-provider-RFKZOK3S.js"),
-    import("./workspace-providers-status-PDFZWL5Q.js"),
-    import("./workspace-skills-status-IKECTOOQ.js"),
-    import("./total-session-admission-HTVTP4BS.js"),
-    import("./workspace-registry-23R7XRB5.js"),
-    import("./prompt-terminal-ledger-DCZO6S7C.js")
+    import("./server-7W6C3SOW.js"),
+    import("./bridge-EVURP4NO.js"),
+    import("./spawnChannel-ZP23JL6O.js"),
+    import("./process-registry-OAEG6WGC.js"),
+    import("./workspace-service-SETHN4WE.js"),
+    import("./types-HKLPXZB3.js"),
+    import("./daemon-status-provider-UI3GBTMO.js"),
+    import("./workspace-providers-status-5JM4CB6R.js"),
+    import("./workspace-skills-status-4D4EUEQU.js"),
+    import("./total-session-admission-MGV56XDK.js"),
+    import("./workspace-registry-6EULAPZC.js"),
+    import("./workspace-runtime-coordinator-IRI2DRCJ.js"),
+    import("./prompt-terminal-ledger-3RKW73A2.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -3780,7 +4014,6 @@ async function loadServeRuntimeModules() {
     ProcessRegistry: processRegistryModule.ProcessRegistry,
     createDaemonWorkspaceService: workspaceModule.createDaemonWorkspaceService,
     WorkspaceSettingsPartialPersistError: workspaceTypesModule.WorkspaceSettingsPartialPersistError,
-    WorkspaceSkillNotToggleableError: workspaceTypesModule.WorkspaceSkillNotToggleableError,
     createDaemonStatusProvider: daemonStatusProviderModule.createDaemonStatusProvider,
     createWorkspaceProvidersStatusProvider: workspaceProvidersStatusModule.createWorkspaceProvidersStatusProvider,
     createWorkspaceSkillsStatusProvider: workspaceSkillsStatusModule.createWorkspaceSkillsStatusProvider,
@@ -3788,6 +4021,7 @@ async function loadServeRuntimeModules() {
     createWorkspaceRegistry: workspaceRegistryModule.createWorkspaceRegistry,
     createWorkspaceSessionOwnerIndex: workspaceRegistryModule.createWorkspaceSessionOwnerIndex,
     createWorkspaceGenerationGuard: workspaceRegistryModule.createWorkspaceGenerationGuard,
+    getWorkspaceRuntimeCoordinatorIfSupported: workspaceRuntimeCoordinatorModule.getWorkspaceRuntimeCoordinatorIfSupported,
     createPromptLedgerSink: promptLedgerModule.createPromptLedgerSink
   };
 }
@@ -3812,7 +4046,11 @@ function sessionIdleTimeoutMs(value) {
   return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_IDLE_TIMEOUT_MS;
 }
 __name(sessionIdleTimeoutMs, "sessionIdleTimeoutMs");
-function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, currentSessionSchedulingAvailable, env) {
+function sessionPromptSettledCloseGraceMs(value) {
+  return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_PROMPT_SETTLED_CLOSE_GRACE_MS;
+}
+__name(sessionPromptSettledCloseGraceMs, "sessionPromptSettledCloseGraceMs");
+function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, workspaceRuntimeAvailable, currentSessionSchedulingAvailable, env, nativeDirectoryPickerAvailable) {
   return getAdvertisedServeFeatures(void 0, {
     requireAuth: opts.requireAuth === true,
     mcpPoolActive: opts.mcpPoolActive !== false,
@@ -3833,8 +4071,11 @@ function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, s
     channelManagementAvailable: true,
     persistentWorkspaceRegistrationAvailable: true,
     workspaceRuntimeRemovalAvailable: true,
-    // Advertise the same WS feature flags as the runtime path (serve-features.ts)
-    // so the bootstrap `/capabilities` window doesn't briefly under-report them.
+    // Advertise the same host-conditional and WS feature flags as the runtime
+    // path (serve-features.ts) so the bootstrap `/capabilities` window doesn't
+    // briefly under-report them.
+    nativeDirectoryPickerAvailable,
+    workspaceRuntimeAvailable,
     clientMcpOverWsEnabled: opts.clientMcpOverWs === true,
     cdpTunnelOverWsEnabled: opts.cdpTunnelOverWs === true,
     browserAutomationMcpAvailable: isBrowserAutomationMcpAvailable(opts, env)
@@ -3851,8 +4092,10 @@ function createBootstrapCapabilities(input) {
       input.opts,
       input.sessionShellCommandEnabled,
       input.sessionArtifactsPersistenceAvailable,
+      input.workspaceRuntimeAvailable,
       input.currentSessionSchedulingAvailable,
-      input.env
+      input.env,
+      input.nativeDirectoryPickerAvailable
     ),
     modelServices: [],
     workspaceCwd: input.boundWorkspace,
@@ -3887,45 +4130,6 @@ function validateRateLimitOptions(opts) {
   }
 }
 __name(validateRateLimitOptions, "validateRateLimitOptions");
-function installSameOriginOriginStrip(app, getPort) {
-  let cachedStripPort = -1;
-  let cachedSelfOrigins = /* @__PURE__ */ new Set();
-  app.use((req, _res, next) => {
-    const origin = req.headers.origin;
-    if (origin) {
-      const port = getPort();
-      if (port !== cachedStripPort) {
-        cachedStripPort = port;
-        cachedSelfOrigins = /* @__PURE__ */ new Set([
-          `http://127.0.0.1:${port}`,
-          `http://localhost:${port}`,
-          `http://[::1]:${port}`,
-          `http://host.docker.internal:${port}`,
-          `https://127.0.0.1:${port}`,
-          `https://localhost:${port}`,
-          `https://[::1]:${port}`,
-          `https://host.docker.internal:${port}`
-        ]);
-        if (port === 80 || port === 443) {
-          for (const host of [
-            "127.0.0.1",
-            "localhost",
-            "[::1]",
-            "host.docker.internal"
-          ]) {
-            cachedSelfOrigins.add(`http://${host}`);
-            cachedSelfOrigins.add(`https://${host}`);
-          }
-        }
-      }
-      if (cachedSelfOrigins.has(origin)) {
-        delete req.headers.origin;
-      }
-    }
-    next();
-  });
-}
-__name(installSameOriginOriginStrip, "installSameOriginOriginStrip");
 function createLazyBridgeProxy(getBridge, getStartupError = () => void 0) {
   return new Proxy(
     {},
@@ -4011,6 +4215,7 @@ function createBootstrapServeApp(input) {
     qwenCodeVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    workspaceRuntimeAvailable,
     currentSessionSchedulingAvailable,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime,
@@ -4020,7 +4225,8 @@ function createBootstrapServeApp(input) {
     onHealthServed
   } = input;
   const app = (0, import_express.default)();
-  installSameOriginOriginStrip(app, getPort);
+  const nativeDirectoryPickerAvailable = isNativeDirectoryPickerAvailable();
+  installSelfOriginStripMiddleware(app, getPort, opts.hostname);
   if (opts.allowOrigins && opts.allowOrigins.length > 0) {
     app.use(allowOriginCors(parseAllowOriginPatterns(opts.allowOrigins)));
   } else {
@@ -4071,9 +4277,11 @@ function createBootstrapServeApp(input) {
         qwenCodeVersion,
         sessionShellCommandEnabled,
         sessionArtifactsPersistenceAvailable,
+        workspaceRuntimeAvailable,
         currentSessionSchedulingAvailable,
         permissionPolicy,
-        env: process.env
+        env: process.env,
+        nativeDirectoryPickerAvailable
       })
     );
   });
@@ -4155,7 +4363,7 @@ function createBootstrapServeApp(input) {
           opts.maxPendingPromptsPerSession
         ),
         listenerMaxConnections: listenerMaxConnections(opts.maxConnections),
-        eventRingSize: opts.eventRingSize ?? DEFAULT_EVENT_RING_SIZE,
+        eventRingSize: opts.eventRingSize ?? DEFAULT_RING_SIZE,
         compactedReplayMaxBytes: opts.compactedReplayMaxBytes ?? DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
         maxJournalEvents: opts.maxJournalEvents ?? DEFAULT_MAX_JOURNAL_EVENTS,
         maxJournalBytes: opts.maxJournalBytes ?? DEFAULT_MAX_JOURNAL_BYTES,
@@ -4163,6 +4371,9 @@ function createBootstrapServeApp(input) {
         writerIdleTimeoutMs: positiveFiniteOrNull(opts.writerIdleTimeoutMs),
         channelIdleTimeoutMs: channelIdleTimeoutMs(opts.channelIdleTimeoutMs),
         sessionIdleTimeoutMs: sessionIdleTimeoutMs(opts.sessionIdleTimeoutMs),
+        sessionPromptSettledCloseGraceMs: sessionPromptSettledCloseGraceMs(
+          opts.sessionPromptSettledCloseGraceMs
+        ),
         acpConnectionCap: null,
         acpPreAttachMaxFramesPerStream: null,
         acpPreAttachMaxFramesPerConnection: null,
@@ -4189,8 +4400,10 @@ function createBootstrapServeApp(input) {
           opts,
           sessionShellCommandEnabled,
           sessionArtifactsPersistenceAvailable,
+          workspaceRuntimeAvailable,
           currentSessionSchedulingAvailable,
-          process.env
+          process.env,
+          nativeDirectoryPickerAvailable
         )
       },
       runtime: {
@@ -4490,7 +4703,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const runStartedAt = performance2.now();
   delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
   const channelDeliveryAuthorizations = new ChannelDeliveryAuthorizationStore();
-  const shouldPreheat = !deps.bridge && shouldPreheatBridge(deps);
+  let shouldPreheat = !deps.bridge && shouldPreheatBridge(deps);
   const startup = {
     processStartedAt: new Date(
       Date.now() - Math.round(process.uptime() * 1e3)
@@ -4529,12 +4742,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }, "restoreScrubbedLoaderEnv");
   loggerLifecycle.scrubApplied(restoreScrubbedLoaderEnv);
   const token = resolveServeToken(optsIn.token);
+  const bindHostname = optsIn.hostname.toLowerCase() === "localhost" ? (await (deps.bindHostnameLookup ?? lookup)(optsIn.hostname)).address : optsIn.hostname;
+  const trustedLoopbackMode = isTrustedLoopbackMode({
+    loopbackBind: isLoopbackAddress(bindHostname),
+    tokenConfigured: token !== void 0,
+    requireAuth: optsIn.requireAuth === true
+  });
   const channelDeliveryDiagnosticRedaction = {
     workerEnv: daemonRuntimeBaseEnv,
     ...token ? { daemonToken: token } : {}
   };
-  const sessionShellCommandEnabled = optsIn.enableSessionShell === true && token !== void 0;
-  if (optsIn.enableSessionShell === true && token === void 0) {
+  const sessionShellCommandEnabled = optsIn.enableSessionShell === true && (token !== void 0 || trustedLoopbackMode);
+  if (optsIn.enableSessionShell === true && token === void 0 && !trustedLoopbackMode) {
     writeStderrLine(
       `qwen serve: --enable-session-shell ignored because no bearer token is configured. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token to enable direct session shell.`
     );
@@ -4556,6 +4775,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const rawWorkspace = rawWorkspaces[0];
   const opts = {
     ...optsIn,
+    hostname: bindHostname,
     token,
     promptDeadlineMs,
     writerIdleTimeoutMs,
@@ -4687,7 +4907,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   if (!isLoopbackBind(opts.hostname) && !token) {
     throw new Error(
-      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.1, localhost, ::1, or [::1]).`
+      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.0/8, localhost, ::1, or [::1]).`
     );
   }
   if (opts.requireAuth && !token) {
@@ -4702,8 +4922,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         `Refusing to start with --allow-origin '*' but no bearer token configured. '*' admits any cross-origin browser to the API; without a token, any local page can drive the daemon. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or list specific origins instead of '*'.`
       );
     }
+    const nonLoopbackHttpOrigin = findNonLoopbackHttpOrigin(parsed);
+    if (nonLoopbackHttpOrigin && !token) {
+      throw new Error(
+        `Refusing to start with --allow-origin ${JSON.stringify(
+          nonLoopbackHttpOrigin
+        )} but no bearer token configured. Non-loopback HTTP(S) browser origins can drive the full operator API, including code execution as the daemon user. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or use a loopback origin.`
+      );
+    }
     writeStderrLine(
-      `qwen serve: --allow-origin: ${opts.allowOrigins.join(", ")}` + (parsed.allowAny ? " (WARNING: `*` admits any cross-origin browser \u2014 bearer token gates API routes; the Web Shell static assets stay pre-auth in every mode unless --no-web, and /health stays pre-auth on loopback unless --require-auth is set)" : "")
+      `qwen serve: --allow-origin: ${opts.allowOrigins.join(", ")}` + (parsed.allowAny ? " (WARNING: `*` admits any cross-origin browser \u2014 bearer token gates API routes; the Web Shell static assets stay pre-auth in every mode unless --no-web, and /health stays pre-auth on loopback unless --require-auth is set)" : trustedLoopbackMode ? " (WARNING: these browser origins receive full API authority without a bearer token in trusted loopback mode and can execute code as the daemon user)" : "")
     );
   }
   if (opts.allowPrivateAuthBaseUrl) {
@@ -4813,7 +5041,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-XKVW2YVH.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-RNMFVCH7.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -5047,6 +5275,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       );
     }
   }
+  if (opts.sessionPromptSettledCloseGraceMs !== void 0) {
+    if (!isNonNegativeIntegerMs(opts.sessionPromptSettledCloseGraceMs)) {
+      throw new TypeError(
+        `Invalid sessionPromptSettledCloseGraceMs: ${opts.sessionPromptSettledCloseGraceMs}. Must be a non-negative integer (milliseconds, 0 = disabled).`
+      );
+    }
+  }
   if (opts.initializeTimeoutMs !== void 0) {
     if (!isPositiveIntegerMs(opts.initializeTimeoutMs)) {
       throw new TypeError(
@@ -5097,7 +5332,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
-  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-6MVAAZZZ.js");
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-ATXVQPS3.js");
   const daemonToolGuardHandler = createDaemonToolGuard(
     externalToolGuardHandler
   );
@@ -5160,12 +5395,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }, "markServeAppStartupFailed");
   let runtimeApp;
   let runtimeAppForCleanup;
+  let getWorkspaceRuntimeCoordinatorIfSupported;
   let bridgeRef = deps.bridge;
   let managedProcessRegistry;
   let managedChildHeapPolicy;
   const internalRuntimeBridgesForCleanup = [];
   let daemonEventLoopMonitor;
   let daemonMetricsSampler;
+  let sessionPrRefreshTimer;
+  let sessionPrRefreshGeneration = 0;
   let runtimeStartupError;
   let runtimeStarting;
   let markRuntimeReady;
@@ -5185,6 +5423,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     daemonEventLoopMonitor = void 0;
     const metricsSampler = daemonMetricsSampler;
     daemonMetricsSampler = void 0;
+    const prRefreshTimer = sessionPrRefreshTimer;
+    sessionPrRefreshTimer = void 0;
+    sessionPrRefreshGeneration += 1;
+    prRefreshTimer?.dispose();
     try {
       eventLoopMonitor?.dispose();
     } catch (err) {
@@ -5369,6 +5611,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     stopSafely("scheduled-task keepalive", locals.stopScheduledTaskKeepalive);
     stopSafely("workspace git state", locals.stopWorkspaceGitState);
     stopSafely("Live Host coordinator", locals.stopLiveCoordinator);
+    stopSafely("web terminal registry", locals.stopWebTerminalRegistry);
     stopTrustPolicyMonitor(app2);
     for (const stop of locals.subSessionStoppers ?? []) {
       stopSafely("sub-session launcher", stop);
@@ -5436,8 +5679,9 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-DRZPFB4Q.js")
+      import("./daemon-trust-policy-SUCBJ2CA.js")
     ]);
+    getWorkspaceRuntimeCoordinatorIfSupported = runtime.getWorkspaceRuntimeCoordinatorIfSupported;
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
     const bootTrustSnapshot = await trustPolicy.readDaemonTrustPolicySnapshot();
@@ -5447,6 +5691,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       boundWorkspace
     );
     const trustedWorkspace = deps.trustedWorkspace ?? bootPrimaryTrustDecision.targetTrusted;
+    if (shouldPreheat && !trustedWorkspace) {
+      shouldPreheat = false;
+      startup.preheat.status = "not_scheduled";
+    }
     const workspaceTrustHotReloadAvailable = deps.trustedWorkspace === void 0 && deps.bridge === void 0 && deps.fsFactory === void 0;
     let managedScratchRoot;
     try {
@@ -5548,6 +5796,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       mode: "runtime-overlay",
       overlayKeys: [...runtimeEnvSnapshot.overlayKeys],
       effectiveEnv: runtimeEffectiveEnv,
+      workflowsEnabledBySettings: runtimeBootSettings?.merged.tools?.workflowsEnabled === true,
       envFilePaths: [...runtimeEnvSnapshot.envFilePaths],
       envFileReadFailed: runtimeEnvSnapshot.envFileReadFailed,
       envFileReadFailures: [...runtimeEnvSnapshot.envFileReadFailures]
@@ -5772,6 +6021,19 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     });
     const clientMcpSenderRegistry = new ClientMcpSenderRegistry();
     const runtimeBridges = [];
+    const runtimeEpochSources = /* @__PURE__ */ new Map();
+    const runtimeEpochSourceFor = /* @__PURE__ */ __name((workspaceCwd) => {
+      let source = runtimeEpochSources.get(workspaceCwd);
+      if (!source) {
+        let epoch = 0;
+        source = {
+          current: /* @__PURE__ */ __name(() => epoch, "current"),
+          allocate: /* @__PURE__ */ __name(() => ++epoch, "allocate")
+        };
+        runtimeEpochSources.set(workspaceCwd, source);
+      }
+      return source;
+    }, "runtimeEpochSourceFor");
     const totalSessionAdmission = runtime.createTotalSessionAdmissionController(
       {
         maxTotalSessions: opts.maxTotalSessions,
@@ -5808,22 +6070,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledToolsFn");
     const persistDisabledSkillsFn = /* @__PURE__ */ __name((workspace, skillName, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const {
-        resolveSkillSettings,
-        skillSettingStrings,
-        updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-VA4XVYVL.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-AKMIXFSJ.js");
       const fresh = loadSettingsForPersistence(workspace);
-      const normalizedName = skillName.trim().toLowerCase();
-      const resolved = resolveSkillSettings(fresh);
-      const disablement = resolved.disablements.get(normalizedName);
-      if (disablement?.reason === "hard" && disablement.lockedScope) {
-        throw new runtime.WorkspaceSkillNotToggleableError(
-          skillName,
-          "locked",
-          disablement.lockedScope
-        );
-      }
       const workspaceDisabled = skillSettingStrings(
         fresh,
         WORKSPACE_SETTING_SCOPE,
@@ -5837,8 +6085,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const next = updateWorkspaceSkillSettingLists(
         { disabled: workspaceDisabled, enabled: workspaceEnabled },
         skillName,
-        enabled,
-        resolved.defaultDisabledNames.has(normalizedName) && !resolved.enabledNames.has(normalizedName)
+        enabled
       );
       const settingsChanges = [];
       if (JSON.stringify(next.disabled) !== JSON.stringify(workspaceDisabled)) {
@@ -5873,13 +6120,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledSkillsFn");
     const persistDisabledSkillsBatchFn = /* @__PURE__ */ __name((workspace, skillNames, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const {
-        resolveSkillSettings,
-        skillSettingStrings,
-        updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-VA4XVYVL.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-AKMIXFSJ.js");
       const fresh = loadSettingsForPersistence(workspace);
-      const resolved = resolveSkillSettings(fresh);
       const initialDisabled = skillSettingStrings(
         fresh,
         WORKSPACE_SETTING_SCOPE,
@@ -5893,24 +6135,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       let next = { disabled: initialDisabled, enabled: initialEnabled };
       const outcomes = [];
       for (const skillName of skillNames) {
-        const normalizedName = skillName.trim().toLowerCase();
-        const disablement = resolved.disablements.get(normalizedName);
-        if (disablement?.reason === "hard" && disablement.lockedScope) {
-          outcomes.push({
-            skillName,
-            error: new runtime.WorkspaceSkillNotToggleableError(
-              skillName,
-              "locked",
-              disablement.lockedScope
-            )
-          });
-          continue;
-        }
         const updated = updateWorkspaceSkillSettingLists(
           next,
           skillName,
-          enabled,
-          resolved.defaultDisabledNames.has(normalizedName) && !resolved.enabledNames.has(normalizedName)
+          enabled
         );
         const changed = JSON.stringify(updated.disabled) !== JSON.stringify(next.disabled) || JSON.stringify(updated.enabled) !== JSON.stringify(next.enabled);
         next = updated;
@@ -5983,8 +6211,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
     }), "persistSettingsFn");
     const [{ createSubSessionLauncher }, scheduledTaskRoutes] = await Promise.all([
-      import("./create-sub-session-JKZAYZX7.js"),
-      import("./scheduled-tasks-QB4ZVUQS.js")
+      import("./create-sub-session-DS4BJLYZ.js"),
+      import("./scheduled-tasks-2NVKS5Q2.js")
     ]);
     const createCurrentSessionScheduledTaskHandler = /* @__PURE__ */ __name((workspaceCwd, runtimeBaseDir, getBridge, assertGenerationOpen) => async ({
       callerSessionId,
@@ -6072,8 +6300,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       sessionRestoreTimeoutMs,
       ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
       ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+      ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+        sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+      } : {},
       ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
       boundWorkspace,
+      runtimeEpochSource: runtimeEpochSourceFor(boundWorkspace),
       // Prompt terminal ledger: persisted beside the transcript so a
       // restarted daemon can reconcile dangling prompts on cold load.
       promptLedger: runtime.createPromptLedgerSink(
@@ -6121,6 +6353,82 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     runtimeBridges.push(bridge);
     let invalidatePrimaryServeFeaturesCache = /* @__PURE__ */ __name(() => {
     }, "invalidatePrimaryServeFeaturesCache");
+    const reloadPrimaryDaemonEnv = /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = settingsRuntime.settings.loadSettings(workspace, {
+        skipLoadEnvironment: true,
+        skipWorkspaceSettings: !trustedWorkspace,
+        workspaceTrusted: trustedWorkspace
+      });
+      assertGenerationOpen?.();
+      let refreshedRuntimeEnv;
+      try {
+        refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+          fresh.merged,
+          workspace,
+          daemonRuntimeBaseEnv,
+          trustedWorkspace
+        );
+      } catch (err) {
+        const fallbackReason = err instanceof Error ? err.message : String(err);
+        primaryRuntimeEnv.fallbackReason = fallbackReason;
+        daemonLog.warn(
+          "failed to rebuild runtime env snapshot before daemon env reload; preserving previous runtime env",
+          {
+            error: fallbackReason
+          }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+      if (refreshedRuntimeEnv.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      const result = settingsRuntime.settings.reloadEnvironment(
+        fresh.merged,
+        workspace,
+        trustedWorkspace,
+        { failClosedOnEnvFileReadError: true }
+      );
+      if (result.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      replaceRuntimeEffectiveEnv(refreshedRuntimeEnv.effectiveEnv);
+      primaryRuntimeEnv.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
+      delete primaryRuntimeEnv.fallbackReason;
+      primaryRuntimeEnv.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
+      primaryRuntimeEnv.envFileReadFailures.splice(
+        0,
+        primaryRuntimeEnv.envFileReadFailures.length,
+        ...refreshedRuntimeEnv.envFileReadFailures
+      );
+      primaryRuntimeEnv.overlayKeys.splice(
+        0,
+        primaryRuntimeEnv.overlayKeys.length,
+        ...refreshedRuntimeEnv.overlayKeys
+      );
+      primaryRuntimeEnv.envFilePaths.splice(
+        0,
+        primaryRuntimeEnv.envFilePaths.length,
+        ...refreshedRuntimeEnv.envFilePaths
+      );
+      return {
+        ...result,
+        runtimeEnvironmentApplied: true
+      };
+    }), "reloadPrimaryDaemonEnv");
     const workspaceService = runtime.createDaemonWorkspaceService({
       boundWorkspace,
       isWorkspaceTrusted: /* @__PURE__ */ __name(() => trustedWorkspace, "isWorkspaceTrusted"),
@@ -6138,71 +6446,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       persistSetting: persistSettingFn,
       persistSettings: persistSettingsFn,
       preheatAcpChild: /* @__PURE__ */ __name(() => bridge.preheat(), "preheatAcpChild"),
-      reloadDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
-        assertGenerationOpen?.();
-        const fresh = settingsRuntime.settings.loadSettings(workspace, {
-          skipLoadEnvironment: true,
-          skipWorkspaceSettings: !trustedWorkspace,
-          workspaceTrusted: trustedWorkspace
-        });
-        assertGenerationOpen?.();
-        const result = settingsRuntime.settings.reloadEnvironment(
-          fresh.merged,
-          workspace,
-          trustedWorkspace
-        );
-        let refreshedRuntimeEnv;
-        let fallbackReason;
-        try {
-          refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
-            fresh.merged,
-            workspace,
-            daemonRuntimeBaseEnv,
-            trustedWorkspace
-          );
-        } catch (err) {
-          fallbackReason = err instanceof Error ? err.message : String(err);
-          daemonLog.warn(
-            "failed to rebuild runtime env snapshot after daemon env reload; preserving previous runtime env",
-            {
-              error: fallbackReason
-            }
-          );
-          refreshedRuntimeEnv = {
-            effectiveEnv: { ...runtimeEffectiveEnv },
-            overlayKeys: [...primaryRuntimeEnv.overlayKeys],
-            envFilePaths: [...primaryRuntimeEnv.envFilePaths],
-            envFileReadFailed: primaryRuntimeEnv.envFileReadFailed ?? false,
-            envFileReadFailures: [
-              ...primaryRuntimeEnv.envFileReadFailures ?? []
-            ]
-          };
-        }
-        logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
-        replaceRuntimeEffectiveEnv(refreshedRuntimeEnv.effectiveEnv);
-        if (fallbackReason) {
-          primaryRuntimeEnv.fallbackReason = fallbackReason;
-        } else {
-          delete primaryRuntimeEnv.fallbackReason;
-        }
-        primaryRuntimeEnv.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
-        primaryRuntimeEnv.envFileReadFailures.splice(
-          0,
-          primaryRuntimeEnv.envFileReadFailures.length,
-          ...refreshedRuntimeEnv.envFileReadFailures
-        );
-        primaryRuntimeEnv.overlayKeys.splice(
-          0,
-          primaryRuntimeEnv.overlayKeys.length,
-          ...refreshedRuntimeEnv.overlayKeys
-        );
-        primaryRuntimeEnv.envFilePaths.splice(
-          0,
-          primaryRuntimeEnv.envFilePaths.length,
-          ...refreshedRuntimeEnv.envFilePaths
-        );
-        return result;
-      }), "reloadDaemonEnv"),
+      reloadDaemonEnv: reloadPrimaryDaemonEnv,
       queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => bridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
       invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => bridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
       refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => bridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -6259,6 +6503,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         mode: "runtime-overlay",
         overlayKeys: [...snapshot.overlayKeys],
         effectiveEnv,
+        workflowsEnabledBySettings: settings?.merged.tools?.workflowsEnabled === true,
         envFilePaths: [...snapshot.envFilePaths],
         envFileReadFailed: snapshot.envFileReadFailed,
         envFileReadFailures: [...snapshot.envFileReadFailures]
@@ -6276,6 +6521,80 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         }
       };
     }, "createRuntimeEnvMetadata");
+    const reloadRuntimeOverlaySnapshotForModelProviders = /* @__PURE__ */ __name((workspace, trusted, env, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = settingsRuntime.settings.loadSettings(workspace, {
+        skipLoadEnvironment: true,
+        skipWorkspaceSettings: !trusted,
+        workspaceTrusted: trusted
+      });
+      assertGenerationOpen?.();
+      let refreshedRuntimeEnv;
+      try {
+        refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+          fresh.merged,
+          workspace,
+          daemonRuntimeBaseEnv,
+          trusted
+        );
+      } catch (err) {
+        env.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+        daemonLog.warn(
+          "failed to rebuild runtime overlay for model-provider reload; preserving previous runtime env",
+          { workspace, error: env.metadata.fallbackReason }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+      if (refreshedRuntimeEnv.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      assertGenerationOpen?.();
+      try {
+        env.replace(refreshedRuntimeEnv.effectiveEnv);
+        env.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
+        env.metadata.envFileReadFailures.splice(
+          0,
+          env.metadata.envFileReadFailures.length,
+          ...refreshedRuntimeEnv.envFileReadFailures
+        );
+        env.metadata.overlayKeys.splice(
+          0,
+          env.metadata.overlayKeys.length,
+          ...refreshedRuntimeEnv.overlayKeys
+        );
+        env.metadata.envFilePaths.splice(
+          0,
+          env.metadata.envFilePaths.length,
+          ...refreshedRuntimeEnv.envFilePaths
+        );
+        delete env.metadata.fallbackReason;
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: true
+        };
+      } catch (err) {
+        env.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+        daemonLog.warn(
+          "failed to apply runtime overlay for model-provider reload; preserving previous runtime env",
+          { workspace, error: env.metadata.fallbackReason }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+    }), "reloadRuntimeOverlaySnapshotForModelProviders");
     const readLiveConversationScheduledTasks = /* @__PURE__ */ __name(async () => {
       if (!fs.existsSync(liveConversationWorkspace.rootPath)) return [];
       const { canonicalRoot } = await liveConversationWorkspace.revalidate();
@@ -6423,8 +6742,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         sessionRestoreTimeoutMs,
         ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
         ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+        ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+          sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+        } : {},
         ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
         boundWorkspace: workspaceInput.cwd,
+        runtimeEpochSource: runtimeEpochSourceFor(workspaceInput.cwd),
         promptLedger: runtime.createPromptLedgerSink(
           workspaceInput.cwd,
           secondaryEnv.sessionRuntimeBaseDir
@@ -6500,20 +6823,54 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             workspaceTrusted: secondaryTrusted
           });
           assertGenerationOpen?.();
-          const result = settingsRuntime.settings.reloadEnvironment(
-            fresh.merged,
-            workspace,
-            secondaryTrusted
-          );
+          let runtimeEnvironmentApplied = false;
+          let refreshedRuntimeEnv;
           try {
-            const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+            refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
               fresh.merged,
               workspace,
               daemonRuntimeBaseEnv,
               secondaryTrusted
             );
-            logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+          } catch (err) {
+            secondaryEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+            daemonLog.warn(
+              "failed to rebuild secondary runtime env snapshot before daemon env reload; preserving previous runtime env",
+              {
+                workspace,
+                error: secondaryEnv.metadata.fallbackReason
+              }
+            );
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied
+            };
+          }
+          logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+          if (refreshedRuntimeEnv.envFileReadFailed) {
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied: false
+            };
+          }
+          const result = settingsRuntime.settings.reloadEnvironment(
+            fresh.merged,
+            workspace,
+            secondaryTrusted,
+            { failClosedOnEnvFileReadError: true }
+          );
+          if (result.envFileReadFailed) {
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied: false
+            };
+          }
+          try {
             secondaryEnv.replace(refreshedRuntimeEnv.effectiveEnv);
+            secondaryEnv.metadata.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
             secondaryEnv.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
             secondaryEnv.metadata.envFileReadFailures.splice(
               0,
@@ -6531,18 +6888,26 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               ...refreshedRuntimeEnv.envFilePaths
             );
             delete secondaryEnv.metadata.fallbackReason;
+            runtimeEnvironmentApplied = true;
+            return { ...result, runtimeEnvironmentApplied };
           } catch (err) {
             secondaryEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
             daemonLog.warn(
-              "failed to rebuild secondary runtime env snapshot after daemon env reload; preserving previous runtime env",
+              "failed to apply secondary runtime env snapshot after daemon env reload; preserving previous runtime env",
               {
                 workspace,
                 error: secondaryEnv.metadata.fallbackReason
               }
             );
+            return { ...result, runtimeEnvironmentApplied };
           }
-          return result;
         }), "reloadDaemonEnv"),
+        reloadModelProvidersDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => reloadRuntimeOverlaySnapshotForModelProviders(
+          workspace,
+          secondaryTrusted,
+          secondaryEnv,
+          assertGenerationOpen
+        ), "reloadModelProvidersDaemonEnv"),
         queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => secondaryBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
         invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => secondaryBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
         refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => secondaryBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -6680,6 +7045,22 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         metricsLoopDelay.disable();
       }
     };
+    sessionPrRefreshTimer?.dispose();
+    const refreshGeneration = ++sessionPrRefreshGeneration;
+    void import("./session-pr-refresh-OIVL3U3Z.js").then((mod) => {
+      if (refreshGeneration !== sessionPrRefreshGeneration) return;
+      sessionPrRefreshTimer = mod.startSessionPrRefreshTimer({
+        workspaceRegistry,
+        // The coordinator lives on the serve app (createServeApp below),
+        // which is built after this timer starts; read it per tick like
+        // the metrics sampler reads `acpHandle`.
+        getArchiveCoordinator: /* @__PURE__ */ __name(() => app2.locals.sessionArchiveCoordinator, "getArchiveCoordinator")
+      });
+    }).catch((error) => {
+      daemonLog.warn(
+        `session-pr-refresh load failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    });
     const createDynamicWorkspaceRuntime = /* @__PURE__ */ __name(async (cwd, buildOptions) => {
       const provenance = buildOptions?.provenance ?? "existing";
       if (provenance === "managed-scratch" && (!managedScratchRoot || !isManagedScratchChild(cwd, managedScratchRoot.canonicalRoot))) {
@@ -6809,8 +7190,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           sessionRestoreTimeoutMs,
           ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
           ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+          ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+            sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+          } : {},
           ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
           boundWorkspace: cwd,
+          runtimeEpochSource: runtimeEpochSourceFor(cwd),
           // Live-conversation workspaces keep transcripts outside the
           // runtime storage layout, so no ledger sink is wired there.
           ...provenance === "live-conversation" ? {} : {
@@ -6897,20 +7282,54 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               workspaceTrusted: trusted
             });
             assertGenerationOpen?.();
-            const result = settingsRuntime.settings.reloadEnvironment(
-              fresh.merged,
-              workspace,
-              trusted
-            );
+            let runtimeEnvironmentApplied = false;
+            let refreshedRuntimeEnv;
             try {
-              const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+              refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
                 fresh.merged,
                 workspace,
                 daemonRuntimeBaseEnv,
                 trusted
               );
-              logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+            } catch (err) {
+              wsEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+              daemonLog.warn(
+                "failed to rebuild dynamic runtime env snapshot before daemon env reload; preserving previous runtime env",
+                {
+                  workspace,
+                  error: wsEnv.metadata.fallbackReason
+                }
+              );
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied
+              };
+            }
+            logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+            if (refreshedRuntimeEnv.envFileReadFailed) {
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied: false
+              };
+            }
+            const result = settingsRuntime.settings.reloadEnvironment(
+              fresh.merged,
+              workspace,
+              trusted,
+              { failClosedOnEnvFileReadError: true }
+            );
+            if (result.envFileReadFailed) {
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied: false
+              };
+            }
+            try {
               wsEnv.replace(refreshedRuntimeEnv.effectiveEnv);
+              wsEnv.metadata.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
               wsEnv.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
               wsEnv.metadata.envFileReadFailures.splice(
                 0,
@@ -6928,18 +7347,28 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                 ...refreshedRuntimeEnv.envFilePaths
               );
               delete wsEnv.metadata.fallbackReason;
+              runtimeEnvironmentApplied = true;
+              return { ...result, runtimeEnvironmentApplied };
             } catch (err) {
               wsEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
               daemonLog.warn(
-                "failed to rebuild dynamic runtime env snapshot after daemon env reload; preserving previous runtime env",
+                "failed to apply dynamic runtime env snapshot after daemon env reload; preserving previous runtime env",
                 {
                   workspace,
                   error: wsEnv.metadata.fallbackReason
                 }
               );
+              return { ...result, runtimeEnvironmentApplied };
             }
-            return result;
           }), "reloadDaemonEnv"),
+          ...buildOptions?.primary === true ? {} : {
+            reloadModelProvidersDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => reloadRuntimeOverlaySnapshotForModelProviders(
+              workspace,
+              trusted,
+              wsEnv,
+              assertGenerationOpen
+            ), "reloadModelProvidersDaemonEnv")
+          },
           queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => wsBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
           invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => wsBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
           refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => wsBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -7122,6 +7551,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         const existing = runtimeCleanupPromises.get(runtimeToDrain);
         if (existing) return existing;
         const cleanup = (async () => {
+          runtime.getWorkspaceRuntimeCoordinatorIfSupported(runtimeToDrain)?.dispose();
           const containmentErrors = [];
           try {
             await workspaceVoiceCoordinator.disposeRuntime(
@@ -7177,6 +7607,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
             const stopWorkspaceGitStateForWorkspace = app3?.locals?.["stopWorkspaceGitStateForWorkspace"];
             const stopScheduledTaskKeepaliveForWorkspace = app3?.locals?.["stopScheduledTaskKeepaliveForWorkspace"];
+            const releaseWebTerminalsForWorkspace = app3?.locals?.["releaseWebTerminalsForWorkspace"];
             try {
               stopWorkspaceGitStateForWorkspace?.(runtimeToDrain.workspaceCwd);
             } catch (err) {
@@ -7195,6 +7626,14 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                 err instanceof Error ? err : null
               );
             }
+            try {
+              releaseWebTerminalsForWorkspace?.(runtimeToDrain.workspaceCwd);
+            } catch (err) {
+              daemonLog.error(
+                "workspace web-terminal cleanup error",
+                err instanceof Error ? err : null
+              );
+            }
           }
           let bridgeStopped = false;
           try {
@@ -7266,8 +7705,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-X4AZ6IXX.js"),
-          import("./channel-settings-store-4UFCLBBG.js")
+          import("./channel-management-service-IDBNYSFW.js"),
+          import("./channel-settings-store-MZNXRKVI.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -7472,8 +7911,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-KLGOB53D.js"),
-        import("./daemon-trust-policy-monitor-B5U6TQX5.js")
+        import("./workspace-trust-reconciler-4LR3CDL4.js"),
+        import("./daemon-trust-policy-monitor-3LM5RQNS.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -7645,6 +8084,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     qwenCodeVersion: cliVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    workspaceRuntimeAvailable: deps.bridge === void 0 || typeof deps.bridge.getWorkspaceRuntimeLifecycleSnapshot === "function",
     currentSessionSchedulingAvailable: false,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime: workspaceInputs.length > 1,
@@ -7669,7 +8109,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     // through (and start the runtime) exactly like the warm app would.
     // Dynamic import keeps web-shell-static out of the serve fast-path
     // static closure (see the import-boundary guards in fast-path.test.ts).
-    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-A6QMUNNV.js").then(
+    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-PW7OEDQO.js").then(
       (webShellStatic) => webShellStatic.isPreAuthWebShellRequest(req)
     ) : void 0
   });
@@ -7689,7 +8129,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-DRZPFB4Q.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-SUCBJ2CA.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -7813,7 +8253,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const addr = server.address();
       actualPort = typeof addr === "object" && addr ? addr.port : opts.port;
       const scheme = tlsOptions ? "https" : "http";
-      const url = `${scheme}://${formatHostForUrl(opts.hostname)}:${actualPort}`;
+      const url = `${scheme}://${formatHostForUrl(optsIn.hostname)}:${actualPort}`;
       const liveRuntimeBaseDir = path.dirname(daemonLogBaseDir);
       const liveDiscoveryOwners = [];
       const rememberLiveDiscoveryOwner = /* @__PURE__ */ __name((owner) => {
@@ -8242,11 +8682,14 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             );
           }
           const workerRuntime = await ensureChannelRuntime();
+          const workerHostname = tlsOptions ? optsIn.hostname : opts.hostname;
           const workerDaemonUrl = formatChannelWorkerDaemonUrl(
-            opts.hostname,
+            workerHostname,
             actualPort,
-            tlsOptions !== void 0
+            tlsOptions !== void 0,
+            typeof addr === "object" && addr && (addr.family === "IPv4" || addr.family === "IPv6") ? addr.family : void 0
           );
+          (deps.channelWorkerUrlCertifier ?? assertChannelWorkerDaemonUrlIsLocal)(workerDaemonUrl, workerHostname);
           if (tlsOptions && tlsCertPath && process.env["NODE_TLS_REJECT_UNAUTHORIZED"] === "0") {
             daemonLog.warn(
               `NODE_TLS_REJECT_UNAUTHORIZED=0 disables certificate verification for channel workers; skipping the worker TLS trust check.`
@@ -8546,6 +8989,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             cancelLiveDiscoveryRetry();
             channelControlDraining = true;
             const initiallyMountedApp = runtimeApp ?? runtimeAppForCleanup;
+            const beginRuntimeCoordinatorDrains = /* @__PURE__ */ __name((app2) => {
+              const registry = app2?.locals?.["workspaceRegistry"];
+              for (const workspaceRuntime of registry?.list() ?? []) {
+                getWorkspaceRuntimeCoordinatorIfSupported?.(
+                  workspaceRuntime
+                )?.beginDrain();
+              }
+            }, "beginRuntimeCoordinatorDrains");
+            beginRuntimeCoordinatorDrains(initiallyMountedApp);
             const initiallyMountedManagement = initiallyMountedApp?.locals?.["workspaceManagementHandle"];
             const initiallyMountedSessionMaintenance = initiallyMountedApp?.locals?.["sessionArchiveCoordinator"];
             const initiallyMountedConversationActivity = initiallyMountedApp?.locals?.["conversationRuntimeActivity"];
@@ -8577,6 +9029,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               if (!preserveSignalHandlers) {
                 process.removeListener("SIGINT", onSignal);
                 process.removeListener("SIGTERM", onSignal);
+                process.removeListener("SIGHUP", onSignal);
               }
               process.removeListener(
                 "uncaughtExceptionMonitor",
@@ -8673,6 +9126,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   err instanceof Error ? err : null
                 );
               });
+              beginRuntimeCoordinatorDrains(appForCleanup);
               startProcessRegistryShutdown();
               disposeRuntimeAppResources(appForCleanup);
               disposeDaemonEventLoopMonitor();
@@ -8782,7 +9236,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       );
       if (!token) {
         writeStderrLine(
-          `qwen serve: bearer auth disabled (loopback default). Set ${QWEN_SERVER_TOKEN_ENV} to enable.`
+          `qwen serve: trusted loopback mode; local callers have full API access without bearer authentication, including code execution as the daemon user. Use --require-auth with ${QWEN_SERVER_TOKEN_ENV} on shared or untrusted hosts.`
         );
         if (opts.clientMcpOverWs === true) {
           writeStderrLine(
@@ -8796,6 +9250,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
       process.on("SIGINT", onSignal);
       process.on("SIGTERM", onSignal);
+      process.on("SIGHUP", onSignal);
       process.on("uncaughtExceptionMonitor", onUncaughtExceptionMonitor);
       server.on("error", (err) => {
         daemonLog.error("server error", err instanceof Error ? err : null);
@@ -8894,6 +9349,22 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     const tryListen = /* @__PURE__ */ __name((attemptPort, attempt) => {
       const handleListening = /* @__PURE__ */ __name(() => {
         server.removeListener("error", handleError);
+        const address = server.address();
+        if (trustedLoopbackMode && (typeof address !== "object" || address === null || !isLoopbackAddress(address.address))) {
+          const resolvedAddress = typeof address === "object" && address !== null ? address.address : String(address);
+          const error = new Error(
+            `Refusing trusted-loopback mode because ${opts.hostname} bound to non-loopback address ${resolvedAddress}. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or bind to an explicit loopback address.`
+          );
+          removeCurrentServePidfile();
+          markServeAppStartupFailed(error);
+          void serveAppLifecycle.close().then(
+            () => reject(error),
+            (closeError) => reject(
+              closeError instanceof Error ? new AggregateError([error, closeError], error.message) : error
+            )
+          );
+          return;
+        }
         onListening();
       }, "handleListening");
       const handleError = /* @__PURE__ */ __name((err) => {
@@ -8945,6 +9416,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
 __name(runQwenServeImpl, "runQwenServeImpl");
 export {
   InvalidPolicyConfigError,
+  assertChannelWorkerDaemonUrlIsLocal,
   createBoundChannelDeliveryHandler,
   createDisabledChannelWorkerSupervisor,
   createLazyBridgeProxy,