@qwen-code/qwen-code 0.22.3 → 0.23.0

package/chunks/{run-qwen-serve-5X6IDZER.js → run-qwen-serve-OGTEEUR2.js}

@@ -3,6 +3,10 @@
 import {
   computeCpuPercent
 } from "./chunk-LBOVL47Y.js";
+import {
+  hostAssignsIpv6Loopback,
+  isOwnInterfaceAddress
+} from "./chunk-24FVUD5P.js";
 import {
   resolveServeToken
 } from "./chunk-ZELCTN6Y.js";
@@ -24,14 +28,20 @@ import {
   bearerAuth,
   createBridgeFileSystemAdapter,
   denyBrowserOriginCors,
+  findNonLoopbackHttpOrigin,
   getAdvertisedServeFeatures,
   getDeviceFlowRegistry,
   getRateLimiter,
   getServeProtocolVersions,
   hostAllowlist,
+  installSelfOriginStripMiddleware,
   isBrowserAutomationMcpAvailable,
   isDeepHealthQuery,
+  isLocalPathOpenAvailable,
+  isLocalTerminalAvailable,
   isManagedScratchChild,
+  isNativeDirectoryPickerAvailable,
+  isTrustedLoopbackMode,
   listenerMaxConnections,
   parseAllowOriginPatterns,
   parseDaemonStatusDetail,
@@ -39,7 +49,8 @@ import {
   prepareManagedScratchRoot,
   resolveAcpHttpEnabled,
   toDaemonStatusMemoryLimits
-} from "./chunk-4NDLQAY2.js";
+} from "./chunk-SI7WDR3U.js";
+import "./chunk-VGHZT6JR.js";
 import {
   ConversationDirectoryIdentityError,
   assertExactConversationRootIdentity,
@@ -51,10 +62,7 @@ import {
   isSameConversationDirectoryObject,
   materializeConversationDirectoryIdentity,
   revalidateConversationRootIdentity
-} from "./chunk-U54AYGEC.js";
-import {
-  isLoopbackBind
-} from "./chunk-RXFQM6FQ.js";
+} from "./chunk-PB7JBAHF.js";
 import {
   formatMemoryBudgetStderr,
   resolveDaemonMemoryBudget,
@@ -62,7 +70,7 @@ import {
 } from "./chunk-UXEO7E3V.js";
 import {
   setDeferredRuntimeRequestTiming
-} from "./chunk-SEONHUS3.js";
+} from "./chunk-LAUEEBDL.js";
 import {
   normalizeSessionIdForLookup
 } from "./chunk-ZEZKIS2K.js";
@@ -70,6 +78,9 @@ import "./chunk-NYWWQ437.js";
 import {
   resolveSessionRestoreTimeoutMs
 } from "./chunk-4JRM2BSM.js";
+import {
+  DEFAULT_RING_SIZE
+} from "./chunk-7U5G6JXI.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
   DEFAULT_MAX_JOURNAL_BYTES,
@@ -81,34 +92,38 @@ import {
 } from "./chunk-WCCLLK7X.js";
 import {
   require_express
-} from "./chunk-AYHQZBJ4.js";
+} from "./chunk-IRKQ4YYX.js";
 import {
   resolveWebShellDir
 } from "./chunk-FBX2SDQ4.js";
+import {
+  isLoopbackAddress,
+  isLoopbackBind
+} from "./chunk-DMEUXLSS.js";
 import {
   resolveChannelCwd
-} from "./chunk-HVC3PNVC.js";
+} from "./chunk-TSZSGQ3N.js";
 import {
   LIVE_HOST_PROTOCOL_VERSION
-} from "./chunk-NKLP3DCK.js";
+} from "./chunk-IQAFKVXS.js";
+import "./chunk-ZL4HFSL6.js";
 import "./chunk-K6KS3LTN.js";
-import "./chunk-HMJ2P3SV.js";
-import "./chunk-7E7UCJHS.js";
+import "./chunk-OSHQMOBS.js";
 import {
   consumeServeFastPathRejectedLoaderKeys,
   loadServeFastPathSettings,
   preResolveServeFastPathHomeEnvOverrides
-} from "./chunk-T7KMERIX.js";
+} from "./chunk-ADYN7P2Y.js";
 import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-TEBDFQBZ.js";
-import "./chunk-G6FECKTJ.js";
+} from "./chunk-BJXCYUGM.js";
+import "./chunk-G5PBOQWI.js";
 import {
   LOAD_REPLAY_META_KEY
-} from "./chunk-OZ6KS6KW.js";
-import "./chunk-ERFDKH32.js";
+} from "./chunk-ZGCKTAL5.js";
+import "./chunk-F47DITLZ.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
@@ -116,7 +131,7 @@ import {
 import {
   ExtraCaInspectionError,
   loadableCertificates
-} from "./chunk-ISKH4QX3.js";
+} from "./chunk-TQHPVKO6.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
@@ -128,7 +143,7 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-RFIDDFAL.js";
+} from "./chunk-M4KFODIP.js";
 import {
   channelSelectionNames
 } from "./chunk-ALMR3E6Q.js";
@@ -145,14 +160,14 @@ import {
   PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV
 } from "./chunk-3VUENPWF.js";
 import "./chunk-M5GB774H.js";
-import {
-  MAX_DAEMON_WORKSPACES
-} from "./chunk-5HBA2Z7V.js";
 import {
   sanitizeLogText
-} from "./chunk-ICURCKIU.js";
+} from "./chunk-U4DJ5XB3.js";
 import "./chunk-IW6RQPQB.js";
-import "./chunk-GOXKNSDZ.js";
+import {
+  MAX_DAEMON_WORKSPACES
+} from "./chunk-5HBA2Z7V.js";
+import "./chunk-O5CD7T4T.js";
 import {
   getGlobalQwenDirLite,
   resolveConfigPathLite
@@ -162,10 +177,10 @@ import {
   clearLoaderKeyRejectionReporterIfCurrent,
   scrubInheritedLoaderEnv,
   setLoaderKeyRejectionReporter
-} from "./chunk-MZCJWS5Y.js";
+} from "./chunk-2M3EWQNG.js";
 import {
   getCliVersion
-} from "./chunk-Q2MSPKIJ.js";
+} from "./chunk-VBWD6C27.js";
 import "./chunk-W3N5XAZ6.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
@@ -174,6 +189,7 @@ import {
 import "./chunk-LJZSMWOH.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
+import "./chunk-6HUXPLB5.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
 import {
@@ -210,6 +226,7 @@ init_esbuild_shims();
 var import_express = __toESM(require_express(), 1);
 import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto";
 import { execFile } from "node:child_process";
+import { lookup } from "node:dns/promises";
 import * as fs from "node:fs";
 import { createServer } from "node:http";
 import * as https from "node:https";
@@ -3091,8 +3108,8 @@ var RUNTIME_STARTUP_TIMEOUT_ENV = "QWEN_SERVE_RUNTIME_STARTUP_TIMEOUT_MS";
 var MAX_EVENT_RING_SIZE = 1e6;
 var DEFAULT_MAX_SESSIONS = 32;
 var DEFAULT_MAX_PENDING_PROMPTS_PER_SESSION = 5;
-var DEFAULT_EVENT_RING_SIZE = 8e3;
 var DEFAULT_SESSION_IDLE_TIMEOUT_MS = 30 * 6e4;
+var DEFAULT_SESSION_PROMPT_SETTLED_CLOSE_GRACE_MS = 0;
 var WORKSPACE_SETTING_SCOPE = "Workspace";
 function isPositiveIntegerMs(value) {
   return Number.isFinite(value) && Number.isInteger(value) && value > 0;
@@ -3226,15 +3243,52 @@ function workspaceRuntimeEffectiveEnv(runtime, daemonEnv) {
   return runtime.env.effectiveEnv ?? daemonEnv;
 }
 __name(workspaceRuntimeEffectiveEnv, "workspaceRuntimeEffectiveEnv");
-function formatChannelWorkerDaemonUrl(host, port, tls = false) {
+function canonicalIpLiteral(host) {
+  const inner = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  try {
+    const hostname = new URL(
+      `http://${inner.includes(":") ? `[${inner}]` : inner}`
+    ).hostname;
+    const canonical = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+    return isIP(canonical) === 0 ? void 0 : canonical;
+  } catch {
+    return void 0;
+  }
+}
+__name(canonicalIpLiteral, "canonicalIpLiteral");
+function formatChannelWorkerDaemonUrl(host, port, tls = false, boundFamily, ipv6LoopbackAssigned = hostAssignsIpv6Loopback()) {
   const scheme = tls ? "https" : "http";
   const normalized = host.trim().toLowerCase();
-  if (normalized === "" || normalized === "0.0.0.0" || normalized === "::" || normalized === "[::]") {
+  const canonicalIp = canonicalIpLiteral(normalized);
+  const v6Loopback = ipv6LoopbackAssigned ? `${scheme}://[::1]:${port}` : `${scheme}://127.0.0.1:${port}`;
+  if (normalized === "") {
+    return boundFamily === "IPv4" ? `${scheme}://127.0.0.1:${port}` : v6Loopback;
+  }
+  if (canonicalIp === "::") {
+    return v6Loopback;
+  }
+  if (canonicalIp === "0.0.0.0" || canonicalIp === "::ffff:0:0") {
     return `${scheme}://127.0.0.1:${port}`;
   }
   return `${scheme}://${formatHostForUrl(host)}:${port}`;
 }
 __name(formatChannelWorkerDaemonUrl, "formatChannelWorkerDaemonUrl");
+function assertChannelWorkerDaemonUrlIsLocal(workerDaemonUrl, hostname) {
+  let host;
+  try {
+    host = new URL(workerDaemonUrl).hostname;
+  } catch {
+    throw new Error(
+      `Channels cannot start: --hostname "${hostname}" cannot be carried in a worker URL (a zone-scoped address has no spelling the URL parser accepts). Bind to loopback, to the wildcard (0.0.0.0 / ::), or to a zone-less literal address of one of this machine's interfaces.`
+    );
+  }
+  if (isLoopbackBind(host)) return;
+  if (isOwnInterfaceAddress(host)) return;
+  throw new Error(
+    `Channels cannot start: --hostname "${hostname}" is not a loopback bind and does not name an address on this host, so channel workers have no local URL to reach the daemon on. Bind to loopback, to the wildcard (0.0.0.0 / ::), or to a literal address of one of this machine's interfaces.`
+  );
+}
+__name(assertChannelWorkerDaemonUrlIsLocal, "assertChannelWorkerDaemonUrlIsLocal");
 var WORKER_TLS_TRUST_PROBE = `
 import { isIP } from 'node:net';
 import * as tls from 'node:tls';
@@ -3353,9 +3407,11 @@ function describeWorkerTlsTrustGaps(opts) {
   );
   const leafHeldByWorkers = servingBlocks !== void 0 && servingBlocks.some((block) => block.fingerprint256 === x509.fingerprint256);
   const workerTrustStore = operatorChain && servingBlocks ? [...operatorChain, ...servingChain] : servingChain;
+  const now = Date.now();
   const anchorPath = walkWorkerAnchorPath(
     x509,
     workerTrustStore,
+    now,
     // The `servingBlocks === undefined` fallback prepends the leaf too, but
     // that file already reports its own gap below and the workers receive it
     // verbatim; only the partial-read case needs the distinction.
@@ -3411,7 +3467,6 @@ function describeWorkerTlsTrustGaps(opts) {
       `--tls-cert "${opts.certPath}" is issued by another CA (${x509.issuer.replace(/\r?\n/g, ", ")}), not self-signed, and ${!opts.operatorCaCertPath ? `no NODE_EXTRA_CA_CERTS is set` : opts.operatorCaCertReadError !== void 0 ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" could not be read, so whatever it carries reached nobody` : operatorDiscarded ? `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" was discarded together with the unloadable serving file above, whatever it carries` : `NODE_EXTRA_CA_CERTS "${opts.operatorCaCertPath}" does not carry a certificate that anchors it`}, so nothing in the channel workers' bundle anchors their trust \u2014 every worker handshake to the daemon will fail UNABLE_TO_VERIFY_LEAF_SIGNATURE unless the issuing CA is already in the workers' default trust store. ` + (operatorDiscarded ? `Re-export --tls-cert as described above and restart; NODE_EXTRA_CA_CERTS is not the file to change.` : opts.operatorCaCertReadError !== void 0 ? `Make NODE_EXTRA_CA_CERTS readable by the daemon as described above and restart.` : `Point NODE_EXTRA_CA_CERTS at the issuing CA (for mkcert: "$(mkcert -CAROOT)/rootCA.pem") and restart.`)
     );
   }
-  const now = Date.now();
   for (const member of anchorPath.path) {
     if (member.fingerprint256 === x509.fingerprint256) continue;
     const subject = member.subject.replace(/\r?\n/g, ", ");
@@ -3421,14 +3476,16 @@ function describeWorkerTlsTrustGaps(opts) {
       );
       continue;
     }
-    if (new Date(member.validTo).getTime() < now) {
-      gaps.push(
-        `--tls-cert "${opts.certPath}" chains through "${subject}", which expired on ${member.validTo} \u2014 every worker handshake to the daemon will fail CERT_HAS_EXPIRED. Renew that chain member and restart.`
-      );
-    } else if (new Date(member.validFrom).getTime() > now) {
-      gaps.push(
-        `--tls-cert "${opts.certPath}" chains through "${subject}", which is not yet valid (validFrom: ${member.validFrom}) \u2014 every worker handshake to the daemon will fail CERT_NOT_YET_VALID. Check that chain member's notBefore date or the system clock.`
-      );
+    if (!certValidAt(member, now)) {
+      if (new Date(member.validTo).getTime() < now) {
+        gaps.push(
+          `--tls-cert "${opts.certPath}" chains through "${subject}", which expired on ${member.validTo} \u2014 every worker handshake to the daemon will fail CERT_HAS_EXPIRED. Renew that chain member and restart.`
+        );
+      } else {
+        gaps.push(
+          `--tls-cert "${opts.certPath}" chains through "${subject}", which is not yet valid (validFrom: ${member.validFrom}) \u2014 every worker handshake to the daemon will fail CERT_NOT_YET_VALID. Check that chain member's notBefore date or the system clock.`
+        );
+      }
     }
   }
   const host = workerDialHost(opts.daemonUrl);
@@ -3549,6 +3606,10 @@ function cannotIssueCertificates(cert) {
   return !isV1Certificate(cert) && keyUsage === void 0;
 }
 __name(cannotIssueCertificates, "cannotIssueCertificates");
+function certValidAt(cert, now) {
+  return new Date(cert.validFrom).getTime() <= now && new Date(cert.validTo).getTime() >= now;
+}
+__name(certValidAt, "certValidAt");
 function isSelfSignedCert(x509) {
   if (x509.subject !== x509.issuer) return false;
   try {
@@ -3619,7 +3680,7 @@ function pathLengthConstraint(cert) {
   return length;
 }
 __name(pathLengthConstraint, "pathLengthConstraint");
-function walkWorkerAnchorPath(leaf, chain, leafHeldByWorkers = true) {
+function walkWorkerAnchorPath(leaf, chain, now, leafHeldByWorkers = true) {
   let next = leaf;
   const walked = /* @__PURE__ */ new Set();
   const path2 = [];
@@ -3644,9 +3705,10 @@ function walkWorkerAnchorPath(leaf, chain, leafHeldByWorkers = true) {
       return pathLengthViolation ? { anchored: false, path: path2, pathLengthViolation } : { anchored: true, path: path2 };
     }
     walked.add(current.fingerprint256);
-    const issuer = chain.find(
+    const issuers = chain.filter(
       (candidate) => !walked.has(candidate.fingerprint256) && certIssuedBy(current, candidate)
     );
+    const issuer = issuers.find((candidate) => certValidAt(candidate, now)) ?? issuers[0];
     if (issuer && !isSelfSignedCert(issuer) && !issuer.ca) {
       return { anchored: false, path: path2, incapableIssuer: issuer };
     }
@@ -3738,12 +3800,12 @@ __name(hasRetryableChannelWorkerShutdownError, "hasRetryableChannelWorkerShutdow
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-FKU7DIHJ.js"),
-    import("./pidfile-QOIQZFT2.js"),
-    import("./runtime-HK27GMPF.js"),
+    import("./channel-worker-supervisor-6VCLUXFE.js"),
+    import("./pidfile-ETHAZNMY.js"),
+    import("./runtime-LNBLEMZS.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-6NA6BBZV.js"),
-    import("./channel-worker-manager-NEZ2J6RK.js")
+    import("./channel-worker-group-47F4ISUZ.js"),
+    import("./channel-worker-manager-I5Y44GYR.js")
   ]).then(
     ([
       supervisor,
@@ -3849,13 +3911,13 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-AXB6SK5D.js");
+  coreRuntimePromise ??= import("./core-runtime-B4UKKIAQ.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
 var liveDiscoveryRuntimePromise;
 function loadLiveDiscoveryRuntime() {
-  liveDiscoveryRuntimePromise ??= import("./discovery-X2NV535U.js");
+  liveDiscoveryRuntimePromise ??= import("./discovery-TUM3ZQ6U.js");
   return liveDiscoveryRuntimePromise;
 }
 __name(loadLiveDiscoveryRuntime, "loadLiveDiscoveryRuntime");
@@ -3885,10 +3947,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-L6N54CU6.js"),
-    import("./environment-UANTR7A4.js"),
-    import("./loadedSettingsAdapter-KJCLZ3C4.js"),
-    import("./trustedFolders-FATSC4YI.js")
+    import("./settings-BHRGDASJ.js"),
+    import("./environment-VN6RXDVN.js"),
+    import("./loadedSettingsAdapter-KLLFZF3M.js"),
+    import("./trustedFolders-D2I3FDPB.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3901,8 +3963,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-HK27GMPF.js"),
-    import("./config-utils-R6M3TA34.js")
+    import("./runtime-LNBLEMZS.js"),
+    import("./config-utils-LVSYDLHZ.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3926,20 +3988,22 @@ async function loadServeRuntimeModules() {
     workspaceSkillsStatusModule,
     totalSessionAdmissionModule,
     workspaceRegistryModule,
+    workspaceRuntimeCoordinatorModule,
     promptLedgerModule
   ] = await Promise.all([
-    import("./server-GO2N5DH7.js"),
-    import("./bridge-ME6QXZNA.js"),
-    import("./spawnChannel-ZST6XJVJ.js"),
+    import("./server-AOYZVVOM.js"),
+    import("./bridge-IHSBI2YJ.js"),
+    import("./spawnChannel-N25MBB6F.js"),
     import("./process-registry-OAEG6WGC.js"),
-    import("./workspace-service-SIN67ITC.js"),
+    import("./workspace-service-G4ZNBOFH.js"),
     import("./types-HKLPXZB3.js"),
-    import("./daemon-status-provider-K3SJ5C2U.js"),
-    import("./workspace-providers-status-IJ4VHFMB.js"),
-    import("./workspace-skills-status-F3RKCUIX.js"),
-    import("./total-session-admission-PVN64JVV.js"),
-    import("./workspace-registry-BTGZIMPK.js"),
-    import("./prompt-terminal-ledger-FOMFTYOM.js")
+    import("./daemon-status-provider-GRRVCJFW.js"),
+    import("./workspace-providers-status-PCJK3RC7.js"),
+    import("./workspace-skills-status-FMTPPMWC.js"),
+    import("./total-session-admission-G4CGCSTG.js"),
+    import("./workspace-registry-YNIOB6HJ.js"),
+    import("./workspace-runtime-coordinator-WG2RNEN7.js"),
+    import("./prompt-terminal-ledger-GZ747VYE.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -3959,6 +4023,7 @@ async function loadServeRuntimeModules() {
     createWorkspaceRegistry: workspaceRegistryModule.createWorkspaceRegistry,
     createWorkspaceSessionOwnerIndex: workspaceRegistryModule.createWorkspaceSessionOwnerIndex,
     createWorkspaceGenerationGuard: workspaceRegistryModule.createWorkspaceGenerationGuard,
+    getWorkspaceRuntimeCoordinatorIfSupported: workspaceRuntimeCoordinatorModule.getWorkspaceRuntimeCoordinatorIfSupported,
     createPromptLedgerSink: promptLedgerModule.createPromptLedgerSink
   };
 }
@@ -3983,7 +4048,11 @@ function sessionIdleTimeoutMs(value) {
   return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_IDLE_TIMEOUT_MS;
 }
 __name(sessionIdleTimeoutMs, "sessionIdleTimeoutMs");
-function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, currentSessionSchedulingAvailable, env) {
+function sessionPromptSettledCloseGraceMs(value) {
+  return value !== void 0 ? channelIdleTimeoutMs(value) : DEFAULT_SESSION_PROMPT_SETTLED_CLOSE_GRACE_MS;
+}
+__name(sessionPromptSettledCloseGraceMs, "sessionPromptSettledCloseGraceMs");
+function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, sessionArtifactsPersistenceAvailable, workspaceRuntimeAvailable, currentSessionSchedulingAvailable, env, nativeDirectoryPickerAvailable, localPathOpenAvailable, localTerminalOpenAvailable) {
   return getAdvertisedServeFeatures(void 0, {
     requireAuth: opts.requireAuth === true,
     mcpPoolActive: opts.mcpPoolActive !== false,
@@ -4004,8 +4073,21 @@ function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, s
     channelManagementAvailable: true,
     persistentWorkspaceRegistrationAvailable: true,
     workspaceRuntimeRemovalAvailable: true,
-    // Advertise the same WS feature flags as the runtime path (serve-features.ts)
-    // so the bootstrap `/capabilities` window doesn't briefly under-report them.
+    // Advertise the same host-conditional and WS feature flags as the runtime
+    // path (serve-features.ts) so the bootstrap `/capabilities` window doesn't
+    // briefly under-report them.
+    nativeDirectoryPickerAvailable,
+    workspaceRuntimeAvailable,
+    localPathOpenAvailable,
+    localTerminalOpenAvailable,
+    // The production wiring below always registers these, so the bootstrap
+    // envelope must not under-report them either — the runtime envelope
+    // serves all five once the app is up.
+    dynamicWorkspaceRegistrationAvailable: true,
+    scratchWorkspaceRegistrationAvailable: true,
+    standaloneSessionsAvailable: true,
+    workspaceTrustHotReloadAvailable: true,
+    acpHttpEnabled: resolveAcpHttpEnabled(env),
     clientMcpOverWsEnabled: opts.clientMcpOverWs === true,
     cdpTunnelOverWsEnabled: opts.cdpTunnelOverWs === true,
     browserAutomationMcpAvailable: isBrowserAutomationMcpAvailable(opts, env)
@@ -4022,8 +4104,12 @@ function createBootstrapCapabilities(input) {
       input.opts,
       input.sessionShellCommandEnabled,
       input.sessionArtifactsPersistenceAvailable,
+      input.workspaceRuntimeAvailable,
       input.currentSessionSchedulingAvailable,
-      input.env
+      input.env,
+      input.nativeDirectoryPickerAvailable,
+      input.localPathOpenAvailable,
+      input.localTerminalOpenAvailable
     ),
     modelServices: [],
     workspaceCwd: input.boundWorkspace,
@@ -4058,45 +4144,6 @@ function validateRateLimitOptions(opts) {
   }
 }
 __name(validateRateLimitOptions, "validateRateLimitOptions");
-function installSameOriginOriginStrip(app, getPort) {
-  let cachedStripPort = -1;
-  let cachedSelfOrigins = /* @__PURE__ */ new Set();
-  app.use((req, _res, next) => {
-    const origin = req.headers.origin;
-    if (origin) {
-      const port = getPort();
-      if (port !== cachedStripPort) {
-        cachedStripPort = port;
-        cachedSelfOrigins = /* @__PURE__ */ new Set([
-          `http://127.0.0.1:${port}`,
-          `http://localhost:${port}`,
-          `http://[::1]:${port}`,
-          `http://host.docker.internal:${port}`,
-          `https://127.0.0.1:${port}`,
-          `https://localhost:${port}`,
-          `https://[::1]:${port}`,
-          `https://host.docker.internal:${port}`
-        ]);
-        if (port === 80 || port === 443) {
-          for (const host of [
-            "127.0.0.1",
-            "localhost",
-            "[::1]",
-            "host.docker.internal"
-          ]) {
-            cachedSelfOrigins.add(`http://${host}`);
-            cachedSelfOrigins.add(`https://${host}`);
-          }
-        }
-      }
-      if (cachedSelfOrigins.has(origin)) {
-        delete req.headers.origin;
-      }
-    }
-    next();
-  });
-}
-__name(installSameOriginOriginStrip, "installSameOriginOriginStrip");
 function createLazyBridgeProxy(getBridge, getStartupError = () => void 0) {
   return new Proxy(
     {},
@@ -4182,6 +4229,7 @@ function createBootstrapServeApp(input) {
     qwenCodeVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    workspaceRuntimeAvailable,
     currentSessionSchedulingAvailable,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime,
@@ -4191,7 +4239,10 @@ function createBootstrapServeApp(input) {
     onHealthServed
   } = input;
   const app = (0, import_express.default)();
-  installSameOriginOriginStrip(app, getPort);
+  const nativeDirectoryPickerAvailable = isNativeDirectoryPickerAvailable();
+  const localPathOpenAvailable = isLocalPathOpenAvailable();
+  const localTerminalOpenAvailable = isLocalTerminalAvailable();
+  installSelfOriginStripMiddleware(app, getPort, opts.hostname);
   if (opts.allowOrigins && opts.allowOrigins.length > 0) {
     app.use(allowOriginCors(parseAllowOriginPatterns(opts.allowOrigins)));
   } else {
@@ -4242,9 +4293,13 @@ function createBootstrapServeApp(input) {
         qwenCodeVersion,
         sessionShellCommandEnabled,
         sessionArtifactsPersistenceAvailable,
+        workspaceRuntimeAvailable,
         currentSessionSchedulingAvailable,
         permissionPolicy,
-        env: process.env
+        env: process.env,
+        nativeDirectoryPickerAvailable,
+        localPathOpenAvailable,
+        localTerminalOpenAvailable
       })
     );
   });
@@ -4326,7 +4381,7 @@ function createBootstrapServeApp(input) {
           opts.maxPendingPromptsPerSession
         ),
         listenerMaxConnections: listenerMaxConnections(opts.maxConnections),
-        eventRingSize: opts.eventRingSize ?? DEFAULT_EVENT_RING_SIZE,
+        eventRingSize: opts.eventRingSize ?? DEFAULT_RING_SIZE,
         compactedReplayMaxBytes: opts.compactedReplayMaxBytes ?? DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
         maxJournalEvents: opts.maxJournalEvents ?? DEFAULT_MAX_JOURNAL_EVENTS,
         maxJournalBytes: opts.maxJournalBytes ?? DEFAULT_MAX_JOURNAL_BYTES,
@@ -4334,6 +4389,9 @@ function createBootstrapServeApp(input) {
         writerIdleTimeoutMs: positiveFiniteOrNull(opts.writerIdleTimeoutMs),
         channelIdleTimeoutMs: channelIdleTimeoutMs(opts.channelIdleTimeoutMs),
         sessionIdleTimeoutMs: sessionIdleTimeoutMs(opts.sessionIdleTimeoutMs),
+        sessionPromptSettledCloseGraceMs: sessionPromptSettledCloseGraceMs(
+          opts.sessionPromptSettledCloseGraceMs
+        ),
         acpConnectionCap: null,
         acpPreAttachMaxFramesPerStream: null,
         acpPreAttachMaxFramesPerConnection: null,
@@ -4360,8 +4418,12 @@ function createBootstrapServeApp(input) {
           opts,
           sessionShellCommandEnabled,
           sessionArtifactsPersistenceAvailable,
+          workspaceRuntimeAvailable,
           currentSessionSchedulingAvailable,
-          process.env
+          process.env,
+          nativeDirectoryPickerAvailable,
+          localPathOpenAvailable,
+          localTerminalOpenAvailable
         )
       },
       runtime: {
@@ -4661,7 +4723,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const runStartedAt = performance2.now();
   delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
   const channelDeliveryAuthorizations = new ChannelDeliveryAuthorizationStore();
-  const shouldPreheat = !deps.bridge && shouldPreheatBridge(deps);
+  let shouldPreheat = !deps.bridge && shouldPreheatBridge(deps);
   const startup = {
     processStartedAt: new Date(
       Date.now() - Math.round(process.uptime() * 1e3)
@@ -4700,12 +4762,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }, "restoreScrubbedLoaderEnv");
   loggerLifecycle.scrubApplied(restoreScrubbedLoaderEnv);
   const token = resolveServeToken(optsIn.token);
+  const bindHostname = optsIn.hostname.toLowerCase() === "localhost" ? (await (deps.bindHostnameLookup ?? lookup)(optsIn.hostname)).address : optsIn.hostname;
+  const trustedLoopbackMode = isTrustedLoopbackMode({
+    loopbackBind: isLoopbackAddress(bindHostname),
+    tokenConfigured: token !== void 0,
+    requireAuth: optsIn.requireAuth === true
+  });
   const channelDeliveryDiagnosticRedaction = {
     workerEnv: daemonRuntimeBaseEnv,
     ...token ? { daemonToken: token } : {}
   };
-  const sessionShellCommandEnabled = optsIn.enableSessionShell === true && token !== void 0;
-  if (optsIn.enableSessionShell === true && token === void 0) {
+  const sessionShellCommandEnabled = optsIn.enableSessionShell === true && (token !== void 0 || trustedLoopbackMode);
+  if (optsIn.enableSessionShell === true && token === void 0 && !trustedLoopbackMode) {
     writeStderrLine(
       `qwen serve: --enable-session-shell ignored because no bearer token is configured. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token to enable direct session shell.`
     );
@@ -4727,6 +4795,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const rawWorkspace = rawWorkspaces[0];
   const opts = {
     ...optsIn,
+    hostname: bindHostname,
     token,
     promptDeadlineMs,
     writerIdleTimeoutMs,
@@ -4858,7 +4927,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   if (!isLoopbackBind(opts.hostname) && !token) {
     throw new Error(
-      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.1, localhost, ::1, or [::1]).`
+      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.0/8, localhost, ::1, or [::1]).`
     );
   }
   if (opts.requireAuth && !token) {
@@ -4873,8 +4942,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         `Refusing to start with --allow-origin '*' but no bearer token configured. '*' admits any cross-origin browser to the API; without a token, any local page can drive the daemon. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or list specific origins instead of '*'.`
       );
     }
+    const nonLoopbackHttpOrigin = findNonLoopbackHttpOrigin(parsed);
+    if (nonLoopbackHttpOrigin && !token) {
+      throw new Error(
+        `Refusing to start with --allow-origin ${JSON.stringify(
+          nonLoopbackHttpOrigin
+        )} but no bearer token configured. Non-loopback HTTP(S) browser origins can drive the full operator API, including code execution as the daemon user. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or use a loopback origin.`
+      );
+    }
     writeStderrLine(
-      `qwen serve: --allow-origin: ${opts.allowOrigins.join(", ")}` + (parsed.allowAny ? " (WARNING: `*` admits any cross-origin browser \u2014 bearer token gates API routes; the Web Shell static assets stay pre-auth in every mode unless --no-web, and /health stays pre-auth on loopback unless --require-auth is set)" : "")
+      `qwen serve: --allow-origin: ${opts.allowOrigins.join(", ")}` + (parsed.allowAny ? " (WARNING: `*` admits any cross-origin browser \u2014 bearer token gates API routes; the Web Shell static assets stay pre-auth in every mode unless --no-web, and /health stays pre-auth on loopback unless --require-auth is set)" : trustedLoopbackMode ? " (WARNING: these browser origins receive full API authority without a bearer token in trusted loopback mode and can execute code as the daemon user)" : "")
     );
   }
   if (opts.allowPrivateAuthBaseUrl) {
@@ -4984,7 +5061,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-SMJWI2AI.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-KQWVVW4Y.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -5218,6 +5295,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       );
     }
   }
+  if (opts.sessionPromptSettledCloseGraceMs !== void 0) {
+    if (!isNonNegativeIntegerMs(opts.sessionPromptSettledCloseGraceMs)) {
+      throw new TypeError(
+        `Invalid sessionPromptSettledCloseGraceMs: ${opts.sessionPromptSettledCloseGraceMs}. Must be a non-negative integer (milliseconds, 0 = disabled).`
+      );
+    }
+  }
   if (opts.initializeTimeoutMs !== void 0) {
     if (!isPositiveIntegerMs(opts.initializeTimeoutMs)) {
       throw new TypeError(
@@ -5268,7 +5352,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
-  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-IVAJJWYK.js");
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-O2HPOBAB.js");
   const daemonToolGuardHandler = createDaemonToolGuard(
     externalToolGuardHandler
   );
@@ -5331,6 +5415,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }, "markServeAppStartupFailed");
   let runtimeApp;
   let runtimeAppForCleanup;
+  let getWorkspaceRuntimeCoordinatorIfSupported;
   let bridgeRef = deps.bridge;
   let managedProcessRegistry;
   let managedChildHeapPolicy;
@@ -5614,8 +5699,9 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-DOR3YG62.js")
+      import("./daemon-trust-policy-YJL442BK.js")
     ]);
+    getWorkspaceRuntimeCoordinatorIfSupported = runtime.getWorkspaceRuntimeCoordinatorIfSupported;
     cliVersion = resolvedCliVersion;
     settingsRuntime.environment.preResolveHomeEnvOverrides();
     const bootTrustSnapshot = await trustPolicy.readDaemonTrustPolicySnapshot();
@@ -5625,6 +5711,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       boundWorkspace
     );
     const trustedWorkspace = deps.trustedWorkspace ?? bootPrimaryTrustDecision.targetTrusted;
+    if (shouldPreheat && !trustedWorkspace) {
+      shouldPreheat = false;
+      startup.preheat.status = "not_scheduled";
+    }
     const workspaceTrustHotReloadAvailable = deps.trustedWorkspace === void 0 && deps.bridge === void 0 && deps.fsFactory === void 0;
     let managedScratchRoot;
     try {
@@ -5707,10 +5797,6 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       runtimeBootSettings,
       runtimeEnvSnapshot.effectiveEnv
     );
-    const sessionAttachmentsRoot = /* @__PURE__ */ __name((workspace, runtimeBaseDir) => path.join(
-      new core.Storage(workspace, runtimeBaseDir).getProjectTempDir(),
-      "attachments"
-    ), "sessionAttachmentsRoot");
     const runtimeEffectiveEnv = {
       ...runtimeEnvSnapshot.effectiveEnv,
       QWEN_RUNTIME_DIR: primarySessionRuntimeBaseDir
@@ -5726,6 +5812,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       mode: "runtime-overlay",
       overlayKeys: [...runtimeEnvSnapshot.overlayKeys],
       effectiveEnv: runtimeEffectiveEnv,
+      workflowsEnabledBySettings: runtimeBootSettings?.merged.tools?.workflowsEnabled === true,
       envFilePaths: [...runtimeEnvSnapshot.envFilePaths],
       envFileReadFailed: runtimeEnvSnapshot.envFileReadFailed,
       envFileReadFailures: [...runtimeEnvSnapshot.envFileReadFailures]
@@ -5792,6 +5879,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       daemonLog,
       emitTelemetryLog: core.emitDaemonLog
     });
+    const warnAcpQueueSaturated = /* @__PURE__ */ __name((info) => {
+      daemonLog.warn("ACP NDJSON decoded queue saturated", {
+        requiredBytes: info.requiredBytes,
+        availableBytes: info.availableBytes,
+        maxQueuedMessages: info.maxQueuedMessages,
+        maxQueuedBytes: info.maxQueuedBytes,
+        queueSaturationGraceMs: info.graceMs
+      });
+    }, "warnAcpQueueSaturated");
     const recordPromptQueueWait = /* @__PURE__ */ __name((durationMs) => {
       promptQueueWaitStats.count += 1;
       promptQueueWaitStats.totalMs += durationMs;
@@ -5934,7 +6030,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           direction: daemonPipeDirection(direction),
           bytes,
           message
-        }), "onMessageObserved")
+        }), "onMessageObserved"),
+        onQueueSaturated: warnAcpQueueSaturated
       },
       ...acpChildExtraArgs(opts) ? { extraArgs: acpChildExtraArgs(opts) } : {}
     });
@@ -5950,6 +6047,30 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     });
     const clientMcpSenderRegistry = new ClientMcpSenderRegistry();
     const runtimeBridges = [];
+    const runtimeEpochSources = /* @__PURE__ */ new Map();
+    const runtimeEpochSourceFor = /* @__PURE__ */ __name((workspaceCwd) => {
+      let source = runtimeEpochSources.get(workspaceCwd);
+      if (!source) {
+        let epoch = 0;
+        source = {
+          current: /* @__PURE__ */ __name(() => epoch, "current"),
+          allocate: /* @__PURE__ */ __name(() => ++epoch, "allocate")
+        };
+        runtimeEpochSources.set(workspaceCwd, source);
+      }
+      return source;
+    }, "runtimeEpochSourceFor");
+    let mcpAuthenticationActive = false;
+    const acquireMcpAuthentication = /* @__PURE__ */ __name(() => {
+      if (mcpAuthenticationActive) return void 0;
+      mcpAuthenticationActive = true;
+      let released = false;
+      return () => {
+        if (released) return;
+        released = true;
+        mcpAuthenticationActive = false;
+      };
+    }, "acquireMcpAuthentication");
     const totalSessionAdmission = runtime.createTotalSessionAdmissionController(
       {
         maxTotalSessions: opts.maxTotalSessions,
@@ -5986,14 +6107,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledToolsFn");
     const persistDisabledSkillsFn = /* @__PURE__ */ __name((workspace, skillName, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const {
-        resolveSkillSettings,
-        skillSettingStrings,
-        updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-ZL4JY5UE.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-AKSP665O.js");
       const fresh = loadSettingsForPersistence(workspace);
-      const normalizedName = skillName.trim().toLowerCase();
-      const resolved = resolveSkillSettings(fresh);
       const workspaceDisabled = skillSettingStrings(
         fresh,
         WORKSPACE_SETTING_SCOPE,
@@ -6007,8 +6122,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const next = updateWorkspaceSkillSettingLists(
         { disabled: workspaceDisabled, enabled: workspaceEnabled },
         skillName,
-        enabled,
-        resolved.defaultDisabledNames.has(normalizedName) && !resolved.enabledNames.has(normalizedName)
+        enabled
       );
       const settingsChanges = [];
       if (JSON.stringify(next.disabled) !== JSON.stringify(workspaceDisabled)) {
@@ -6043,13 +6157,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledSkillsFn");
     const persistDisabledSkillsBatchFn = /* @__PURE__ */ __name((workspace, skillNames, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const {
-        resolveSkillSettings,
-        skillSettingStrings,
-        updateWorkspaceSkillSettingLists
-      } = await import("./skill-settings-ZL4JY5UE.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-AKSP665O.js");
       const fresh = loadSettingsForPersistence(workspace);
-      const resolved = resolveSkillSettings(fresh);
       const initialDisabled = skillSettingStrings(
         fresh,
         WORKSPACE_SETTING_SCOPE,
@@ -6063,12 +6172,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       let next = { disabled: initialDisabled, enabled: initialEnabled };
       const outcomes = [];
       for (const skillName of skillNames) {
-        const normalizedName = skillName.trim().toLowerCase();
         const updated = updateWorkspaceSkillSettingLists(
           next,
           skillName,
-          enabled,
-          resolved.defaultDisabledNames.has(normalizedName) && !resolved.enabledNames.has(normalizedName)
+          enabled
         );
         const changed = JSON.stringify(updated.disabled) !== JSON.stringify(next.disabled) || JSON.stringify(updated.enabled) !== JSON.stringify(next.enabled);
         next = updated;
@@ -6141,9 +6248,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
     }), "persistSettingsFn");
     const [{ createSubSessionLauncher }, scheduledTaskRoutes] = await Promise.all([
-      import("./create-sub-session-4QNE64MR.js"),
-      import("./scheduled-tasks-MN2ZZ5P6.js")
+      import("./create-sub-session-NJ24B4US.js"),
+      import("./scheduled-tasks-FLDYZQOF.js")
     ]);
+    const { sessionAttachmentsRoots } = await import("./session-attachments-root-ZCGXQQTR.js");
     const createCurrentSessionScheduledTaskHandler = /* @__PURE__ */ __name((workspaceCwd, runtimeBaseDir, getBridge, assertGenerationOpen) => async ({
       callerSessionId,
       cron,
@@ -6184,11 +6292,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         runtimeBootSettings?.merged.serve ?? {}
       )
     });
+    const attachmentsRoots = sessionAttachmentsRoots(
+      boundWorkspace,
+      primarySessionRuntimeBaseDir
+    );
     const bridge = deps.bridge ?? runtime.createAcpSessionBridge({
-      sessionAttachmentsRoot: sessionAttachmentsRoot(
-        boundWorkspace,
-        primarySessionRuntimeBaseDir
-      ),
+      sessionAttachmentsRoot: attachmentsRoots.root,
+      sessionAttachmentsFallbackRoot: attachmentsRoots.fallback,
       // Reverse tool channel: let `BridgeClient.extMethod` reach the WS
       // connection that hosts a named client MCP server (#5626).
       clientMcpSender: clientMcpSenderRegistry.lookup,
@@ -6230,8 +6340,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       sessionRestoreTimeoutMs,
       ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
       ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+      ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+        sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+      } : {},
       ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
       boundWorkspace,
+      runtimeEpochSource: runtimeEpochSourceFor(boundWorkspace),
+      acquireMcpAuthentication,
       // Prompt terminal ledger: persisted beside the transcript so a
       // restarted daemon can reconcile dangling prompts on cold load.
       promptLedger: runtime.createPromptLedgerSink(
@@ -6279,6 +6394,82 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     runtimeBridges.push(bridge);
     let invalidatePrimaryServeFeaturesCache = /* @__PURE__ */ __name(() => {
     }, "invalidatePrimaryServeFeaturesCache");
+    const reloadPrimaryDaemonEnv = /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = settingsRuntime.settings.loadSettings(workspace, {
+        skipLoadEnvironment: true,
+        skipWorkspaceSettings: !trustedWorkspace,
+        workspaceTrusted: trustedWorkspace
+      });
+      assertGenerationOpen?.();
+      let refreshedRuntimeEnv;
+      try {
+        refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+          fresh.merged,
+          workspace,
+          daemonRuntimeBaseEnv,
+          trustedWorkspace
+        );
+      } catch (err) {
+        const fallbackReason = err instanceof Error ? err.message : String(err);
+        primaryRuntimeEnv.fallbackReason = fallbackReason;
+        daemonLog.warn(
+          "failed to rebuild runtime env snapshot before daemon env reload; preserving previous runtime env",
+          {
+            error: fallbackReason
+          }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+      if (refreshedRuntimeEnv.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      const result = settingsRuntime.settings.reloadEnvironment(
+        fresh.merged,
+        workspace,
+        trustedWorkspace,
+        { failClosedOnEnvFileReadError: true }
+      );
+      if (result.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      replaceRuntimeEffectiveEnv(refreshedRuntimeEnv.effectiveEnv);
+      primaryRuntimeEnv.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
+      delete primaryRuntimeEnv.fallbackReason;
+      primaryRuntimeEnv.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
+      primaryRuntimeEnv.envFileReadFailures.splice(
+        0,
+        primaryRuntimeEnv.envFileReadFailures.length,
+        ...refreshedRuntimeEnv.envFileReadFailures
+      );
+      primaryRuntimeEnv.overlayKeys.splice(
+        0,
+        primaryRuntimeEnv.overlayKeys.length,
+        ...refreshedRuntimeEnv.overlayKeys
+      );
+      primaryRuntimeEnv.envFilePaths.splice(
+        0,
+        primaryRuntimeEnv.envFilePaths.length,
+        ...refreshedRuntimeEnv.envFilePaths
+      );
+      return {
+        ...result,
+        runtimeEnvironmentApplied: true
+      };
+    }), "reloadPrimaryDaemonEnv");
     const workspaceService = runtime.createDaemonWorkspaceService({
       boundWorkspace,
       isWorkspaceTrusted: /* @__PURE__ */ __name(() => trustedWorkspace, "isWorkspaceTrusted"),
@@ -6296,71 +6487,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       persistSetting: persistSettingFn,
       persistSettings: persistSettingsFn,
       preheatAcpChild: /* @__PURE__ */ __name(() => bridge.preheat(), "preheatAcpChild"),
-      reloadDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
-        assertGenerationOpen?.();
-        const fresh = settingsRuntime.settings.loadSettings(workspace, {
-          skipLoadEnvironment: true,
-          skipWorkspaceSettings: !trustedWorkspace,
-          workspaceTrusted: trustedWorkspace
-        });
-        assertGenerationOpen?.();
-        const result = settingsRuntime.settings.reloadEnvironment(
-          fresh.merged,
-          workspace,
-          trustedWorkspace
-        );
-        let refreshedRuntimeEnv;
-        let fallbackReason;
-        try {
-          refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
-            fresh.merged,
-            workspace,
-            daemonRuntimeBaseEnv,
-            trustedWorkspace
-          );
-        } catch (err) {
-          fallbackReason = err instanceof Error ? err.message : String(err);
-          daemonLog.warn(
-            "failed to rebuild runtime env snapshot after daemon env reload; preserving previous runtime env",
-            {
-              error: fallbackReason
-            }
-          );
-          refreshedRuntimeEnv = {
-            effectiveEnv: { ...runtimeEffectiveEnv },
-            overlayKeys: [...primaryRuntimeEnv.overlayKeys],
-            envFilePaths: [...primaryRuntimeEnv.envFilePaths],
-            envFileReadFailed: primaryRuntimeEnv.envFileReadFailed ?? false,
-            envFileReadFailures: [
-              ...primaryRuntimeEnv.envFileReadFailures ?? []
-            ]
-          };
-        }
-        logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
-        replaceRuntimeEffectiveEnv(refreshedRuntimeEnv.effectiveEnv);
-        if (fallbackReason) {
-          primaryRuntimeEnv.fallbackReason = fallbackReason;
-        } else {
-          delete primaryRuntimeEnv.fallbackReason;
-        }
-        primaryRuntimeEnv.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
-        primaryRuntimeEnv.envFileReadFailures.splice(
-          0,
-          primaryRuntimeEnv.envFileReadFailures.length,
-          ...refreshedRuntimeEnv.envFileReadFailures
-        );
-        primaryRuntimeEnv.overlayKeys.splice(
-          0,
-          primaryRuntimeEnv.overlayKeys.length,
-          ...refreshedRuntimeEnv.overlayKeys
-        );
-        primaryRuntimeEnv.envFilePaths.splice(
-          0,
-          primaryRuntimeEnv.envFilePaths.length,
-          ...refreshedRuntimeEnv.envFilePaths
-        );
-        return result;
-      }), "reloadDaemonEnv"),
+      reloadDaemonEnv: reloadPrimaryDaemonEnv,
       queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => bridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
       invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => bridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
       refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => bridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -6417,6 +6544,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         mode: "runtime-overlay",
         overlayKeys: [...snapshot.overlayKeys],
         effectiveEnv,
+        workflowsEnabledBySettings: settings?.merged.tools?.workflowsEnabled === true,
         envFilePaths: [...snapshot.envFilePaths],
         envFileReadFailed: snapshot.envFileReadFailed,
         envFileReadFailures: [...snapshot.envFileReadFailures]
@@ -6434,6 +6562,80 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         }
       };
     }, "createRuntimeEnvMetadata");
+    const reloadRuntimeOverlaySnapshotForModelProviders = /* @__PURE__ */ __name((workspace, trusted, env, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = settingsRuntime.settings.loadSettings(workspace, {
+        skipLoadEnvironment: true,
+        skipWorkspaceSettings: !trusted,
+        workspaceTrusted: trusted
+      });
+      assertGenerationOpen?.();
+      let refreshedRuntimeEnv;
+      try {
+        refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+          fresh.merged,
+          workspace,
+          daemonRuntimeBaseEnv,
+          trusted
+        );
+      } catch (err) {
+        env.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+        daemonLog.warn(
+          "failed to rebuild runtime overlay for model-provider reload; preserving previous runtime env",
+          { workspace, error: env.metadata.fallbackReason }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+      if (refreshedRuntimeEnv.envFileReadFailed) {
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+      assertGenerationOpen?.();
+      try {
+        env.replace(refreshedRuntimeEnv.effectiveEnv);
+        env.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
+        env.metadata.envFileReadFailures.splice(
+          0,
+          env.metadata.envFileReadFailures.length,
+          ...refreshedRuntimeEnv.envFileReadFailures
+        );
+        env.metadata.overlayKeys.splice(
+          0,
+          env.metadata.overlayKeys.length,
+          ...refreshedRuntimeEnv.overlayKeys
+        );
+        env.metadata.envFilePaths.splice(
+          0,
+          env.metadata.envFilePaths.length,
+          ...refreshedRuntimeEnv.envFilePaths
+        );
+        delete env.metadata.fallbackReason;
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: true
+        };
+      } catch (err) {
+        env.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+        daemonLog.warn(
+          "failed to apply runtime overlay for model-provider reload; preserving previous runtime env",
+          { workspace, error: env.metadata.fallbackReason }
+        );
+        return {
+          updatedKeys: [],
+          removedKeys: [],
+          runtimeEnvironmentApplied: false
+        };
+      }
+    }), "reloadRuntimeOverlaySnapshotForModelProviders");
     const readLiveConversationScheduledTasks = /* @__PURE__ */ __name(async () => {
       if (!fs.existsSync(liveConversationWorkspace.rootPath)) return [];
       const { canonicalRoot } = await liveConversationWorkspace.revalidate();
@@ -6524,7 +6726,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             direction: daemonPipeDirection(direction),
             bytes,
             message
-          }), "onMessageObserved")
+          }), "onMessageObserved"),
+          onQueueSaturated: warnAcpQueueSaturated
         },
         ...acpChildExtraArgs(opts) ? { extraArgs: acpChildExtraArgs(opts) } : {}
       });
@@ -6537,11 +6740,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           secondarySettings?.merged.serve ?? {}
         )
       });
+      const secondaryAttachmentsRoots = sessionAttachmentsRoots(
+        workspaceInput.cwd,
+        secondaryEnv.sessionRuntimeBaseDir
+      );
       const secondaryBridge = runtime.createAcpSessionBridge({
-        sessionAttachmentsRoot: sessionAttachmentsRoot(
-          workspaceInput.cwd,
-          secondaryEnv.sessionRuntimeBaseDir
-        ),
+        sessionAttachmentsRoot: secondaryAttachmentsRoots.root,
+        sessionAttachmentsFallbackRoot: secondaryAttachmentsRoots.fallback,
         clientMcpSender: secondaryClientMcpSenderRegistry.lookup,
         onCreateSubSession: secondarySubSessionLauncher.launch,
         onCreateCurrentSessionScheduledTask: createCurrentSessionScheduledTaskHandler(
@@ -6581,8 +6786,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         sessionRestoreTimeoutMs,
         ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
         ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+        ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+          sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+        } : {},
         ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
         boundWorkspace: workspaceInput.cwd,
+        runtimeEpochSource: runtimeEpochSourceFor(workspaceInput.cwd),
+        acquireMcpAuthentication,
         promptLedger: runtime.createPromptLedgerSink(
           workspaceInput.cwd,
           secondaryEnv.sessionRuntimeBaseDir
@@ -6658,20 +6868,54 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             workspaceTrusted: secondaryTrusted
           });
           assertGenerationOpen?.();
-          const result = settingsRuntime.settings.reloadEnvironment(
-            fresh.merged,
-            workspace,
-            secondaryTrusted
-          );
+          let runtimeEnvironmentApplied = false;
+          let refreshedRuntimeEnv;
           try {
-            const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+            refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
               fresh.merged,
               workspace,
               daemonRuntimeBaseEnv,
               secondaryTrusted
             );
-            logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+          } catch (err) {
+            secondaryEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+            daemonLog.warn(
+              "failed to rebuild secondary runtime env snapshot before daemon env reload; preserving previous runtime env",
+              {
+                workspace,
+                error: secondaryEnv.metadata.fallbackReason
+              }
+            );
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied
+            };
+          }
+          logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+          if (refreshedRuntimeEnv.envFileReadFailed) {
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied: false
+            };
+          }
+          const result = settingsRuntime.settings.reloadEnvironment(
+            fresh.merged,
+            workspace,
+            secondaryTrusted,
+            { failClosedOnEnvFileReadError: true }
+          );
+          if (result.envFileReadFailed) {
+            return {
+              updatedKeys: [],
+              removedKeys: [],
+              runtimeEnvironmentApplied: false
+            };
+          }
+          try {
             secondaryEnv.replace(refreshedRuntimeEnv.effectiveEnv);
+            secondaryEnv.metadata.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
             secondaryEnv.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
             secondaryEnv.metadata.envFileReadFailures.splice(
               0,
@@ -6689,18 +6933,26 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               ...refreshedRuntimeEnv.envFilePaths
             );
             delete secondaryEnv.metadata.fallbackReason;
+            runtimeEnvironmentApplied = true;
+            return { ...result, runtimeEnvironmentApplied };
           } catch (err) {
             secondaryEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
             daemonLog.warn(
-              "failed to rebuild secondary runtime env snapshot after daemon env reload; preserving previous runtime env",
+              "failed to apply secondary runtime env snapshot after daemon env reload; preserving previous runtime env",
               {
                 workspace,
                 error: secondaryEnv.metadata.fallbackReason
               }
             );
+            return { ...result, runtimeEnvironmentApplied };
           }
-          return result;
         }), "reloadDaemonEnv"),
+        reloadModelProvidersDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => reloadRuntimeOverlaySnapshotForModelProviders(
+          workspace,
+          secondaryTrusted,
+          secondaryEnv,
+          assertGenerationOpen
+        ), "reloadModelProvidersDaemonEnv"),
         queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => secondaryBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
         invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => secondaryBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
         refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => secondaryBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -6840,7 +7092,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     };
     sessionPrRefreshTimer?.dispose();
     const refreshGeneration = ++sessionPrRefreshGeneration;
-    void import("./session-pr-refresh-I3UBWMVP.js").then((mod) => {
+    void import("./session-pr-refresh-CT2INROL.js").then((mod) => {
       if (refreshGeneration !== sessionPrRefreshGeneration) return;
       sessionPrRefreshTimer = mod.startSessionPrRefreshTimer({
         workspaceRegistry,
@@ -6914,7 +7166,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             direction: daemonPipeDirection(direction),
             bytes,
             message
-          }), "onMessageObserved")
+          }), "onMessageObserved"),
+          onQueueSaturated: warnAcpQueueSaturated
         },
         ...acpChildExtraArgs(opts) ? { extraArgs: acpChildExtraArgs(opts) } : {}
       });
@@ -6941,11 +7194,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       });
       let wsBridge;
       try {
+        const wsAttachmentsRoots = sessionAttachmentsRoots(
+          cwd,
+          wsEnv.sessionRuntimeBaseDir
+        );
         wsBridge = runtime.createAcpSessionBridge({
-          sessionAttachmentsRoot: sessionAttachmentsRoot(
-            cwd,
-            wsEnv.sessionRuntimeBaseDir
-          ),
+          sessionAttachmentsRoot: wsAttachmentsRoots.root,
+          sessionAttachmentsFallbackRoot: wsAttachmentsRoots.fallback,
           clientMcpSender: wsClientMcpRegistry.lookup,
           onCreateSubSession: wsSubSessionLauncher.launch,
           onCreateCurrentSessionScheduledTask: createCurrentSessionScheduledTaskHandler(
@@ -6983,8 +7238,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           sessionRestoreTimeoutMs,
           ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
           ...opts.sessionIdleTimeoutMs !== void 0 ? { sessionIdleTimeoutMs: opts.sessionIdleTimeoutMs } : {},
+          ...opts.sessionPromptSettledCloseGraceMs !== void 0 ? {
+            sessionPromptSettledCloseGraceMs: opts.sessionPromptSettledCloseGraceMs
+          } : {},
           ...opts.permissionResponseTimeoutMs !== void 0 ? { permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs } : {},
           boundWorkspace: cwd,
+          runtimeEpochSource: runtimeEpochSourceFor(cwd),
+          acquireMcpAuthentication,
           // Live-conversation workspaces keep transcripts outside the
           // runtime storage layout, so no ledger sink is wired there.
           ...provenance === "live-conversation" ? {} : {
@@ -7071,20 +7331,54 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               workspaceTrusted: trusted
             });
             assertGenerationOpen?.();
-            const result = settingsRuntime.settings.reloadEnvironment(
-              fresh.merged,
-              workspace,
-              trusted
-            );
+            let runtimeEnvironmentApplied = false;
+            let refreshedRuntimeEnv;
             try {
-              const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
+              refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
                 fresh.merged,
                 workspace,
                 daemonRuntimeBaseEnv,
                 trusted
               );
-              logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+            } catch (err) {
+              wsEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
+              daemonLog.warn(
+                "failed to rebuild dynamic runtime env snapshot before daemon env reload; preserving previous runtime env",
+                {
+                  workspace,
+                  error: wsEnv.metadata.fallbackReason
+                }
+              );
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied
+              };
+            }
+            logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
+            if (refreshedRuntimeEnv.envFileReadFailed) {
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied: false
+              };
+            }
+            const result = settingsRuntime.settings.reloadEnvironment(
+              fresh.merged,
+              workspace,
+              trusted,
+              { failClosedOnEnvFileReadError: true }
+            );
+            if (result.envFileReadFailed) {
+              return {
+                updatedKeys: [],
+                removedKeys: [],
+                runtimeEnvironmentApplied: false
+              };
+            }
+            try {
               wsEnv.replace(refreshedRuntimeEnv.effectiveEnv);
+              wsEnv.metadata.workflowsEnabledBySettings = fresh.merged.tools?.workflowsEnabled === true;
               wsEnv.metadata.envFileReadFailed = refreshedRuntimeEnv.envFileReadFailed;
               wsEnv.metadata.envFileReadFailures.splice(
                 0,
@@ -7102,18 +7396,28 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                 ...refreshedRuntimeEnv.envFilePaths
               );
               delete wsEnv.metadata.fallbackReason;
+              runtimeEnvironmentApplied = true;
+              return { ...result, runtimeEnvironmentApplied };
             } catch (err) {
               wsEnv.metadata.fallbackReason = err instanceof Error ? err.message : String(err);
               daemonLog.warn(
-                "failed to rebuild dynamic runtime env snapshot after daemon env reload; preserving previous runtime env",
+                "failed to apply dynamic runtime env snapshot after daemon env reload; preserving previous runtime env",
                 {
                   workspace,
                   error: wsEnv.metadata.fallbackReason
                 }
               );
+              return { ...result, runtimeEnvironmentApplied };
             }
-            return result;
           }), "reloadDaemonEnv"),
+          ...buildOptions?.primary === true ? {} : {
+            reloadModelProvidersDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => reloadRuntimeOverlaySnapshotForModelProviders(
+              workspace,
+              trusted,
+              wsEnv,
+              assertGenerationOpen
+            ), "reloadModelProvidersDaemonEnv")
+          },
           queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => wsBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
           invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => wsBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
           refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => wsBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
@@ -7296,6 +7600,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         const existing = runtimeCleanupPromises.get(runtimeToDrain);
         if (existing) return existing;
         const cleanup = (async () => {
+          runtime.getWorkspaceRuntimeCoordinatorIfSupported(runtimeToDrain)?.dispose();
           const containmentErrors = [];
           try {
             await workspaceVoiceCoordinator.disposeRuntime(
@@ -7319,7 +7624,9 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           } catch {
           }
           if (reason !== "daemon_shutdown" && channelWorkerManager && runtimeToDrain.provenance !== "live-conversation") {
-            await channelWorkerManager.removeWorkspace(runtimeToDrain.workspaceCwd).catch((err) => {
+            await channelWorkerManager.removeWorkspace(runtimeToDrain.workspaceCwd, {
+              permanent: reason === "workspace_removed"
+            }).catch((err) => {
               daemonLog.error(
                 "workspace channel worker cleanup error",
                 err instanceof Error ? err : null
@@ -7449,8 +7756,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-HQ6KDS7C.js"),
-          import("./channel-settings-store-PEOI7XCG.js")
+          import("./channel-management-service-4MTCEGJB.js"),
+          import("./channel-settings-store-BVKWAI2T.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -7655,8 +7962,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-PLIDLJZX.js"),
-        import("./daemon-trust-policy-monitor-KGGROSIV.js")
+        import("./workspace-trust-reconciler-IBDFQBQS.js"),
+        import("./daemon-trust-policy-monitor-JL7F4Y4Q.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -7828,6 +8135,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     qwenCodeVersion: cliVersion,
     sessionShellCommandEnabled,
     sessionArtifactsPersistenceAvailable,
+    workspaceRuntimeAvailable: deps.bridge === void 0 || typeof deps.bridge.getWorkspaceRuntimeLifecycleSnapshot === "function",
     currentSessionSchedulingAvailable: false,
     permissionPolicy,
     multiWorkspaceCapabilitiesRequireRuntime: workspaceInputs.length > 1,
@@ -7852,7 +8160,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     // through (and start the runtime) exactly like the warm app would.
     // Dynamic import keeps web-shell-static out of the serve fast-path
     // static closure (see the import-boundary guards in fast-path.test.ts).
-    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-HNB4FDOE.js").then(
+    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-POZHGGXE.js").then(
       (webShellStatic) => webShellStatic.isPreAuthWebShellRequest(req)
     ) : void 0
   });
@@ -7872,7 +8180,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-DOR3YG62.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-YJL442BK.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -7996,7 +8304,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const addr = server.address();
       actualPort = typeof addr === "object" && addr ? addr.port : opts.port;
       const scheme = tlsOptions ? "https" : "http";
-      const url = `${scheme}://${formatHostForUrl(opts.hostname)}:${actualPort}`;
+      const url = `${scheme}://${formatHostForUrl(optsIn.hostname)}:${actualPort}`;
       const liveRuntimeBaseDir = path.dirname(daemonLogBaseDir);
       const liveDiscoveryOwners = [];
       const rememberLiveDiscoveryOwner = /* @__PURE__ */ __name((owner) => {
@@ -8425,11 +8733,14 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             );
           }
           const workerRuntime = await ensureChannelRuntime();
+          const workerHostname = tlsOptions ? optsIn.hostname : opts.hostname;
           const workerDaemonUrl = formatChannelWorkerDaemonUrl(
-            opts.hostname,
+            workerHostname,
             actualPort,
-            tlsOptions !== void 0
+            tlsOptions !== void 0,
+            typeof addr === "object" && addr && (addr.family === "IPv4" || addr.family === "IPv6") ? addr.family : void 0
           );
+          (deps.channelWorkerUrlCertifier ?? assertChannelWorkerDaemonUrlIsLocal)(workerDaemonUrl, workerHostname);
           if (tlsOptions && tlsCertPath && process.env["NODE_TLS_REJECT_UNAUTHORIZED"] === "0") {
             daemonLog.warn(
               `NODE_TLS_REJECT_UNAUTHORIZED=0 disables certificate verification for channel workers; skipping the worker TLS trust check.`
@@ -8729,6 +9040,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             cancelLiveDiscoveryRetry();
             channelControlDraining = true;
             const initiallyMountedApp = runtimeApp ?? runtimeAppForCleanup;
+            const beginRuntimeCoordinatorDrains = /* @__PURE__ */ __name((app2) => {
+              const registry = app2?.locals?.["workspaceRegistry"];
+              for (const workspaceRuntime of registry?.list() ?? []) {
+                getWorkspaceRuntimeCoordinatorIfSupported?.(
+                  workspaceRuntime
+                )?.beginDrain();
+              }
+            }, "beginRuntimeCoordinatorDrains");
+            beginRuntimeCoordinatorDrains(initiallyMountedApp);
             const initiallyMountedManagement = initiallyMountedApp?.locals?.["workspaceManagementHandle"];
             const initiallyMountedSessionMaintenance = initiallyMountedApp?.locals?.["sessionArchiveCoordinator"];
             const initiallyMountedConversationActivity = initiallyMountedApp?.locals?.["conversationRuntimeActivity"];
@@ -8857,6 +9177,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   err instanceof Error ? err : null
                 );
               });
+              beginRuntimeCoordinatorDrains(appForCleanup);
               startProcessRegistryShutdown();
               disposeRuntimeAppResources(appForCleanup);
               disposeDaemonEventLoopMonitor();
@@ -8966,7 +9287,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       );
       if (!token) {
         writeStderrLine(
-          `qwen serve: bearer auth disabled (loopback default). Set ${QWEN_SERVER_TOKEN_ENV} to enable.`
+          `qwen serve: trusted loopback mode; local callers have full API access without bearer authentication, including code execution as the daemon user. Use --require-auth with ${QWEN_SERVER_TOKEN_ENV} on shared or untrusted hosts.`
         );
         if (opts.clientMcpOverWs === true) {
           writeStderrLine(
@@ -9079,6 +9400,22 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     const tryListen = /* @__PURE__ */ __name((attemptPort, attempt) => {
       const handleListening = /* @__PURE__ */ __name(() => {
         server.removeListener("error", handleError);
+        const address = server.address();
+        if (trustedLoopbackMode && (typeof address !== "object" || address === null || !isLoopbackAddress(address.address))) {
+          const resolvedAddress = typeof address === "object" && address !== null ? address.address : String(address);
+          const error = new Error(
+            `Refusing trusted-loopback mode because ${opts.hostname} bound to non-loopback address ${resolvedAddress}. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or bind to an explicit loopback address.`
+          );
+          removeCurrentServePidfile();
+          markServeAppStartupFailed(error);
+          void serveAppLifecycle.close().then(
+            () => reject(error),
+            (closeError) => reject(
+              closeError instanceof Error ? new AggregateError([error, closeError], error.message) : error
+            )
+          );
+          return;
+        }
         onListening();
       }, "handleListening");
       const handleError = /* @__PURE__ */ __name((err) => {
@@ -9130,6 +9467,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
 __name(runQwenServeImpl, "runQwenServeImpl");
 export {
   InvalidPolicyConfigError,
+  assertChannelWorkerDaemonUrlIsLocal,
   createBoundChannelDeliveryHandler,
   createDisabledChannelWorkerSupervisor,
   createLazyBridgeProxy,