@qwen-code/qwen-code 0.23.0 → 0.23.1-preview.1

package/chunks/{server-AOYZVVOM.js → server-KNDY6K5F.js}

@@ -5,7 +5,7 @@ import {
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-XLXAZLDR.js";
+} from "./chunk-Q2SAQTEJ.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   MAX_REMEMBER_CONTENT_BYTES,
@@ -20,7 +20,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-WP4AX3XD.js";
+} from "./chunk-PTFFWTTO.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -32,12 +32,13 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-QI27MKNQ.js";
+} from "./chunk-KK2GZGBK.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-XEAAO654.js";
-import "./chunk-NRL5CUZT.js";
+} from "./chunk-M3JGHRMQ.js";
+import "./chunk-VFFQAOPR.js";
+import "./chunk-ZTAVGFKA.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-47ECGEJC.js";
@@ -113,8 +114,7 @@ import {
   singleTokenCredentials,
   tagListener,
   unsafeRevealSecret
-} from "./chunk-SI7WDR3U.js";
-import "./chunk-VGHZT6JR.js";
+} from "./chunk-32YDNYXP.js";
 import {
   ConversationDirectoryIdentityError,
   getConversationDirectoryName,
@@ -123,9 +123,12 @@ import {
   normalizedInode
 } from "./chunk-PB7JBAHF.js";
 import "./chunk-UXEO7E3V.js";
+import {
+  createTotalSessionAdmissionController
+} from "./chunk-7IKXTGZT.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-7RB56BRJ.js";
+} from "./chunk-SAZS4IWW.js";
 import {
   AONE_MAX_MR_VIEW_CALLS_PER_RUN,
   DaemonDrainingError,
@@ -153,7 +156,7 @@ import {
   runWithWorkspaceRuntimeStorage,
   searchWorkspaceSessionsForResponse,
   unarchiveDaemonSessions
-} from "./chunk-EVFDRBUM.js";
+} from "./chunk-URSCX7S7.js";
 import {
   LIVE_SESSION_SOURCE_PREFIX,
   isCompatibleLiveSessionSource,
@@ -189,15 +192,28 @@ import {
   STANDALONE_SESSION_SOURCE_TYPE,
   isReservedStandaloneSessionSourceType
 } from "./chunk-N4QWUPDM.js";
+import {
+  isServeDebugMode,
+  mountWebShellAssets,
+  mountWebShellSpaFallback
+} from "./chunk-NFIDVZND.js";
+import {
+  require_express
+} from "./chunk-IRKQ4YYX.js";
+import "./chunk-FBX2SDQ4.js";
+import {
+  formatHostForAuthority,
+  isLoopbackBind
+} from "./chunk-DMEUXLSS.js";
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-YPWZTR7F.js";
+} from "./chunk-IFD3BTEA.js";
 import {
   readRecentPromptTerminals,
   reconcileDanglingPromptTerminals,
   withPromptTerminals
-} from "./chunk-UPFRILIL.js";
+} from "./chunk-CWNC7M73.js";
 import {
   WorkspaceGenerationClosedError,
   createSingleWorkspaceRegistry,
@@ -205,7 +221,7 @@ import {
 } from "./chunk-QJVZLILI.js";
 import {
   sessionAttachmentsRoots
-} from "./chunk-NUHOLAQ6.js";
+} from "./chunk-XWJFDJZK.js";
 import {
   getWorkspaceRouteContext,
   isGenerationClosedError,
@@ -228,11 +244,11 @@ import {
   sendUntrustedWorkspaceResponse,
   sendWorkspaceRuntimeUnavailable,
   setWorkspaceRouteContext
-} from "./chunk-3L724BJ5.js";
+} from "./chunk-CZACBHAW.js";
 import {
   normalizeChannelDelivery,
   parseChannelDelivery
-} from "./chunk-DTVQSSNM.js";
+} from "./chunk-PZUOHCWI.js";
 import {
   isValidSessionId,
   normalizeSessionIdForLookup,
@@ -247,7 +263,13 @@ import {
   getWorkspaceRuntimeCoordinator,
   getWorkspaceRuntimeCoordinatorIfSupported,
   supportsWorkspaceRuntimeLifecycle
-} from "./chunk-P6UIF2OW.js";
+} from "./chunk-GCFZ2LAX.js";
+import "./chunk-OIBUG24X.js";
+import {
+  MAX_SESSION_RESTORE_TIMEOUT_MS,
+  resolveSessionRestoreTimeoutMs,
+  restoreRetryAfterSeconds
+} from "./chunk-4JRM2BSM.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -256,19 +278,21 @@ import {
   buildWorkspaceVoiceSettingsWrites,
   buildWorkspaceVoiceStatus,
   createDaemonWorkspaceService,
+  deleteWorkspaceSkill,
   hasConfiguredBatchVoiceTranscriptionModel,
+  installWorkspaceSkill,
   transcribeWorkspaceVoiceAudio,
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-4M24B5J5.js";
+} from "./chunk-KJJPJYHI.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-I5N4EAS6.js";
+} from "./chunk-MWHY26G3.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -276,27 +300,18 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-LEPCWS5A.js";
+} from "./chunk-4MCY33Y2.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-BA4WJC4L.js";
-import "./chunk-QAK5475D.js";
-import {
-  createTotalSessionAdmissionController
-} from "./chunk-7IKXTGZT.js";
-import "./chunk-OIBUG24X.js";
-import {
-  MAX_SESSION_RESTORE_TIMEOUT_MS,
-  resolveSessionRestoreTimeoutMs,
-  restoreRetryAfterSeconds
-} from "./chunk-4JRM2BSM.js";
+} from "./chunk-XOVVCGZX.js";
+import "./chunk-Y53DG2HA.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-RM4WT2XB.js";
-import "./chunk-RN3YGDCA.js";
-import "./chunk-3JQZVCBI.js";
+} from "./chunk-LPBQODMR.js";
+import "./chunk-P6LATTDG.js";
+import "./chunk-YCDL2SAS.js";
 import "./chunk-JS73NNWF.js";
 import {
   SessionArtifactAuthorizationError,
@@ -305,7 +320,7 @@ import {
   extractErrorCode,
   extractErrorMessage,
   parseSessionSource
-} from "./chunk-DSX7KQPM.js";
+} from "./chunk-NAKALAL4.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -315,10 +330,10 @@ import "./chunk-WCCLLK7X.js";
 import "./chunk-OCPBI7J5.js";
 import {
   createSpawnChannelFactory
-} from "./chunk-4HVH57J3.js";
+} from "./chunk-LMJQSPWB.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-EBDGRBZX.js";
+} from "./chunk-D4CU6DKR.js";
 import {
   PERSIST_REASONING_SELECTION_META_KEY,
   REASONING_SELECTION_PERSISTED_META_KEY
@@ -326,13 +341,13 @@ import {
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-6A2D4QSO.js";
+} from "./chunk-O2GG7H4C.js";
 import {
   snapshotProcessEnv
-} from "./chunk-KMU3ZHH4.js";
+} from "./chunk-4HC4DYKN.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-4BGDFKQE.js";
+} from "./chunk-J3O5I5ZD.js";
 import "./chunk-BHTYRHJF.js";
 import {
   BridgeTimeoutError,
@@ -341,41 +356,30 @@ import {
   SessionRestoreTimeoutError,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-64QH2UC6.js";
+} from "./chunk-KPXRFTT7.js";
 import {
   resolveSkillSettings
 } from "./chunk-HWVUSYSN.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
   WorkspaceSettingsPartialPersistError,
+  WorkspaceSkillNotFoundError,
   mapWorkspaceSkillToggleError
 } from "./chunk-FTJMWDND.js";
-import {
-  isServeDebugMode,
-  mountWebShellAssets,
-  mountWebShellSpaFallback
-} from "./chunk-NFIDVZND.js";
-import {
-  require_express
-} from "./chunk-IRKQ4YYX.js";
-import "./chunk-FBX2SDQ4.js";
-import {
-  formatHostForAuthority,
-  isLoopbackBind
-} from "./chunk-DMEUXLSS.js";
+import "./chunk-537SQ2AI.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-F7NF2IOE.js";
-import "./chunk-AZJLY2XZ.js";
+} from "./chunk-IXSGOSEG.js";
+import "./chunk-AHBLRVD5.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-PCRBLMIN.js";
+} from "./chunk-TMWB67LS.js";
 import {
   supportedChannelCatalog
-} from "./chunk-NXKOVOM5.js";
-import "./chunk-TSZSGQ3N.js";
+} from "./chunk-4IQKBLTQ.js";
+import "./chunk-WXC6OAWD.js";
 import "./chunk-V6WHFGST.js";
 import {
   getStableLiveDiscoveryBaseDir
@@ -395,13 +399,13 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-BJXCYUGM.js";
+} from "./chunk-5YY5MZT6.js";
 import {
   CHANNEL_PROMPT_META_KEY,
   DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
   REQUESTED_SESSION_ID_META_KEY,
   gradeActiveWorkCoverage
-} from "./chunk-ZGCKTAL5.js";
+} from "./chunk-WEXA2DNG.js";
 import {
   BranchWhilePromptActiveError,
   BridgeChannelQuarantinedError,
@@ -455,12 +459,12 @@ import {
   MAX_CHANNEL_STARTUP_FAILURE_MESSAGE_LENGTH,
   isChannelWebhookEnqueueError
 } from "./chunk-STUJ7IMZ.js";
+import {
+  normalizeWorkerDiagnostic
+} from "./chunk-4JAGXZR3.js";
 import {
   QWEN_SERVER_TOKEN_ENV
 } from "./chunk-GYTKQYDB.js";
-import {
-  normalizeWorkerDiagnostic
-} from "./chunk-M4KFODIP.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -469,13 +473,13 @@ import {
   isChannelDeliveryError
 } from "./chunk-RKFGE7JH.js";
 import "./chunk-UDG5EZJI.js";
-import "./chunk-3VUENPWF.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
+import "./chunk-3VUENPWF.js";
 import {
   sanitizeLogText
-} from "./chunk-U4DJ5XB3.js";
+} from "./chunk-VDXYYVCD.js";
 import "./chunk-IW6RQPQB.js";
 import "./chunk-5HBA2Z7V.js";
 import {
@@ -490,28 +494,28 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   validateSettingValue
-} from "./chunk-VWTSRH6C.js";
-import "./chunk-NQ4L2CMD.js";
+} from "./chunk-AQ5NAGWI.js";
+import "./chunk-ER273QE6.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-O5CD7T4T.js";
+import "./chunk-BW4333PP.js";
 import "./chunk-IDS7MSUP.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   resolveLanguageSetting,
   setLanguageAsync
-} from "./chunk-I4NRYS6A.js";
+} from "./chunk-MUZCSTOO.js";
 import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-C4TIXFDZ.js";
-import "./chunk-2M3EWQNG.js";
-import "./chunk-VBWD6C27.js";
+import "./chunk-H3UDNQLO.js";
+import "./chunk-NUQFUXOG.js";
+import "./chunk-XUSOYE2I.js";
 import "./chunk-W3N5XAZ6.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-65HWLGA7.js";
+} from "./chunk-XY3USGFE.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
@@ -528,22 +532,25 @@ import {
   loadIgnoreRules,
   shouldShowStep,
   writeWorkspaceContextFile
-} from "./chunk-JUARRUMA.js";
-import "./chunk-I2TMJPCV.js";
-import "./chunk-JR42V4UY.js";
+} from "./chunk-UEZOXZNI.js";
+import "./chunk-GELRJXE2.js";
+import "./chunk-32CM56LO.js";
+import "./chunk-JPEAQJNS.js";
+import "./chunk-WTW36TJ3.js";
 import "./chunk-LJZSMWOH.js";
 import {
   readWorktreeSession,
+  readWorktreeSessionStrict,
   writeWorktreeSession
-} from "./chunk-RAFQIHN2.js";
-import "./chunk-L26ONV2Y.js";
-import "./chunk-47RYEQW5.js";
-import "./chunk-IG4W5SJR.js";
+} from "./chunk-VUSSAGKI.js";
+import "./chunk-O45WBTNS.js";
+import "./chunk-DJXSOEFB.js";
+import "./chunk-2WGJG2KW.js";
+import "./chunk-QMFOYPGV.js";
+import "./chunk-LDS57224.js";
 import "./chunk-ZPJWUGCS.js";
-import "./chunk-4UANMABT.js";
-import "./chunk-ZKFTS3OV.js";
-import "./chunk-ENYUKMFK.js";
-import "./chunk-UKYXYWI2.js";
+import "./chunk-HFTB354P.js";
+import "./chunk-BUQN5LTI.js";
 import {
   QwenOAuth2Client,
   QwenOAuthPollError,
@@ -552,8 +559,8 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-3AKCBZVW.js";
-import "./chunk-SULZPKTA.js";
+} from "./chunk-VU7O7CGQ.js";
+import "./chunk-QSC5YOEC.js";
 import "./chunk-VNOVK4I7.js";
 import {
   BuiltinAgentRegistry,
@@ -565,6 +572,7 @@ import {
   GROUP_COLOR_OPTIONS,
   GitPullFailure,
   InvalidSessionTranscriptCursorError,
+  InvalidSessionTranscriptTurnAnchorError,
   MAX_LOG_LIMIT,
   ModelsConfig,
   RUNTIME_MCP_IF_ABSENT_CONFIG_FLAG,
@@ -636,22 +644,23 @@ import {
   toSessionPrInfo,
   upsertSessionPr,
   watchRepoBranch
-} from "./chunk-4F7GQGXB.js";
+} from "./chunk-I72PHOKL.js";
 import "./chunk-GOFAQQZA.js";
-import "./chunk-5M6IDOMF.js";
+import "./chunk-3K65MUKD.js";
 import "./chunk-6HUXPLB5.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-NSUKQ4DN.js";
-import "./chunk-DQCKVAF5.js";
-import "./chunk-AI35S34R.js";
+import "./chunk-YHDGABDC.js";
+import "./chunk-RDKXZ2LS.js";
+import "./chunk-B54PFQS5.js";
 import {
   GitWorktreeService,
-  writeWorktreeSessionMarker
-} from "./chunk-KM3XVTMO.js";
+  createWorktreeSessionMarkerExclusive,
+  readWorktreeSessionMarkerStrict
+} from "./chunk-43NOB5NM.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-OKTNXDVO.js";
-import "./chunk-EFTPIZIC.js";
+import "./chunk-565U2ANU.js";
+import "./chunk-FDOGGKAA.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
 import {
@@ -659,46 +668,47 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-UJ4DUYIH.js";
+} from "./chunk-F53KKZUD.js";
+import "./chunk-PZV2FASB.js";
 import {
   glob
 } from "./chunk-QJNDUTOL.js";
+import "./chunk-OECNP26L.js";
 import "./chunk-O6GEWCJA.js";
-import "./chunk-OSSTATJF.js";
+import "./chunk-CHEIIBT3.js";
+import "./chunk-UKKYOIVT.js";
+import "./chunk-B44JBZBB.js";
+import "./chunk-BF3RUIVP.js";
 import {
-  findGitRoot
-} from "./chunk-ZHO2CW6D.js";
-import "./chunk-CVX63TFJ.js";
-import "./chunk-373DQUVA.js";
+  APPROVAL_MODES
+} from "./chunk-JX6XHPTX.js";
 import {
   recordDaemonBridgeError,
   recordDaemonHttpRequest,
   validateSkillName
-} from "./chunk-H43PSPYS.js";
-import "./chunk-U6D2PPMN.js";
-import "./chunk-VYIUNFEA.js";
-import "./chunk-KGV55H53.js";
-import "./chunk-7TBU7PU2.js";
-import "./chunk-E4JNFXNI.js";
-import "./chunk-CHEIIBT3.js";
-import "./chunk-TJYRTS4S.js";
-import {
-  APPROVAL_MODES
-} from "./chunk-JX6XHPTX.js";
+} from "./chunk-R355CUNQ.js";
+import "./chunk-4VUVBN3Y.js";
+import "./chunk-ZSTCM3MX.js";
+import "./chunk-NXWYCSPL.js";
 import "./chunk-MLXTMF7H.js";
+import "./chunk-GXZHYPHZ.js";
+import {
+  findGitRoot
+} from "./chunk-3CZ2BQV6.js";
 import "./chunk-PQEISIKS.js";
-import "./chunk-FD5SJOWT.js";
-import "./chunk-4LIFGNI4.js";
+import "./chunk-3K456UJF.js";
+import "./chunk-VEFRT7NX.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-KFN2IZYR.js";
-import "./chunk-GB4UKWY5.js";
+import "./chunk-UKADFFL2.js";
+import "./chunk-EJNYBDYC.js";
 import "./chunk-QHMLYMMS.js";
 import "./chunk-CFKIH3D3.js";
 import "./chunk-2LD5U7Q3.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-S2T7H5MI.js";
-import "./chunk-LKODFJRD.js";
+import "./chunk-W4LL5RZO.js";
+import "./chunk-3UMWOKJC.js";
+import "./chunk-KFFCDLKV.js";
 import {
   addDaemonRequestAttribute,
   captureDaemonTelemetryContext,
@@ -710,12 +720,13 @@ import {
   recordDaemonHttpResponse,
   runWithDaemonTelemetryContext,
   withDaemonRequestSpan
-} from "./chunk-LB3WQQJK.js";
+} from "./chunk-7OCIQNKX.js";
 import "./chunk-XWRJCPHC.js";
 import {
   parseLineTolerant,
   read
-} from "./chunk-GH2S4GD5.js";
+} from "./chunk-P5LDR7FI.js";
+import "./chunk-5ETULJLP.js";
 import "./chunk-XBVNNDPK.js";
 import "./chunk-VGC4I5JJ.js";
 import {
@@ -726,39 +737,40 @@ import {
   getAllMemoryFilenames,
   isUtf8CompatibleEncoding,
   isWithinRoot
-} from "./chunk-DYTW3QVG.js";
-import "./chunk-HT5S5TRQ.js";
+} from "./chunk-J6MB5ZHZ.js";
+import "./chunk-EDIDYZBT.js";
+import "./chunk-HD7O6WLV.js";
 import "./chunk-WZAD4ZNJ.js";
 import "./chunk-FPGTNKCP.js";
-import "./chunk-EIJT2PQ6.js";
-import "./chunk-BFY33IB4.js";
-import "./chunk-KHP66DFN.js";
-import "./chunk-22UH7VTP.js";
+import "./chunk-TIGXX4PA.js";
+import "./chunk-5MTARK4Y.js";
+import "./chunk-XFFRI3WM.js";
+import "./chunk-4HOEU2OR.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   isTelemetrySdkInitialized,
   redactUrlCredentials,
   stripAnsiAndControl
-} from "./chunk-QKDNS6FU.js";
+} from "./chunk-7VEYUF3N.js";
 import "./chunk-74TONY4F.js";
-import "./chunk-ZDFQGHZH.js";
+import "./chunk-GMNLYQOS.js";
 import {
   SubagentError,
   SubagentErrorCode
-} from "./chunk-G7HBEEX7.js";
-import "./chunk-QQD2GART.js";
+} from "./chunk-D6PIMKY3.js";
+import "./chunk-NGX4NUNP.js";
 import {
   escapeXml
-} from "./chunk-AQ37AY7B.js";
-import "./chunk-ODZF64DM.js";
-import "./chunk-7JMGTOH7.js";
+} from "./chunk-FKJM6JKY.js";
+import "./chunk-IZ2U57NY.js";
+import "./chunk-RPBMP6BN.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   getErrorMessage,
   runWithoutDebugLogSession
-} from "./chunk-EAHOJF6V.js";
+} from "./chunk-ZAFYHRVY.js";
 import {
   writeStderrLine,
   writeStderrLineSafe,
@@ -767,7 +779,7 @@ import {
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
-import "./chunk-AMDSOFFV.js";
+import "./chunk-MATEIJZF.js";
 import {
   import_websocket,
   import_websocket_server,
@@ -6268,7 +6280,10 @@ async function exportSessionTranscript(params) {
     format,
     filename: generateExportFilename(format),
     mimeType: formatDefinition.mimeType,
-    content: formatDefinition.render(normalized)
+    content: formatDefinition.render(
+      normalized,
+      sessionData.conversation.messages
+    )
   };
 }
 __name(exportSessionTranscript, "exportSessionTranscript");
@@ -8140,7 +8155,7 @@ var StandaloneSessionService = class {
     }
     const leaseOptions = {
       processKind: "daemon",
-      reclaimPolicy: "never",
+      reclaimPolicy: "local",
       takeoverPolicy: "certified"
     };
     try {
@@ -8258,6 +8273,9 @@ var StandaloneSessionService = class {
     if (error2 instanceof StandaloneSessionServiceError) {
       return { sessionId, code: error2.code, message: error2.message };
     }
+    if (error2 instanceof SessionWriterError) {
+      return { sessionId, code: error2.errorKind, message: error2.message };
+    }
     const mapped = serviceError(
       "standalone_session_operation_failed",
       sessionId
@@ -8549,7 +8567,7 @@ var StandaloneSessionService = class {
         const transcriptParent = await service.getSessionTranscriptParentIdentityForLifecycle(
           locked.location
         );
-        const pinned = this.directoryStates.get(sessionId)?.pinned;
+        const pinned = this.effectiveDirectoryPin(runtime, sessionId);
         const paths = await this.options.workspace.inspectStandaloneDeletionPaths(
           sessionId,
           pinned
@@ -8849,6 +8867,7 @@ var StandaloneSessionService = class {
               throw serviceError("standalone_session_conflict", sessionId);
             }
             const prepared = await this.prepareRestoreDirectory(
+              runtime,
               sessionId,
               async () => {
                 if (!existing) return;
@@ -9344,17 +9363,49 @@ var StandaloneSessionService = class {
     }
     return result;
   }
-  async prepareRestoreDirectory(sessionId, beforeRecreate) {
-    const previous = this.directoryStates.get(sessionId);
+  /**
+   * A pin is authoritative only while its matching local bridge session
+   * generation remains resident. A bare pin left by a terminal close, an
+   * entry whose session an idle reap dropped, or a replaced event epoch is
+   * daemon-local history: discard it rather than condemning a directory
+   * another participant may have legitimately recreated. An indeterminate
+   * bridge probe fails closed by propagating.
+   */
+  effectiveDirectoryPin(runtime, sessionId) {
+    const state = this.directoryStates.get(sessionId);
+    if (!state) return void 0;
+    const bound = state.agentBound;
+    if (!bound) {
+      this.directoryStates.delete(sessionId);
+      return void 0;
+    }
+    let eventEpoch;
+    try {
+      eventEpoch = runtime.bridge.getSessionEventEpoch(sessionId);
+    } catch (error2) {
+      if (error2 instanceof SessionNotFoundError) {
+        this.directoryStates.delete(sessionId);
+        return void 0;
+      }
+      throw error2;
+    }
+    if (eventEpoch !== bound.eventEpoch) {
+      this.directoryStates.delete(sessionId);
+      return void 0;
+    }
+    return state.pinned;
+  }
+  async prepareRestoreDirectory(runtime, sessionId, beforeRecreate) {
+    const expected = this.effectiveDirectoryPin(runtime, sessionId);
     const inspected = await this.options.workspace.inspectStandaloneDirectory(
       sessionId,
-      previous?.pinned
+      expected
     );
     if (inspected.status === "compromised") {
       throw serviceError("working_directory_compromised", sessionId);
     }
     if (inspected.status === "ready") {
-      if (!previous) {
+      if (!this.directoryStates.get(sessionId)) {
         this.directoryStates.set(sessionId, { pinned: inspected.identity });
       }
       return { identity: inspected.identity, state: "ready" };
@@ -9362,7 +9413,7 @@ var StandaloneSessionService = class {
     await beforeRecreate?.();
     const ensured = await this.options.workspace.ensureStandaloneDirectory(
       sessionId,
-      previous?.pinned
+      expected
     );
     if (ensured.status === "compromised") {
       throw serviceError("working_directory_compromised", sessionId);
@@ -11736,9 +11787,13 @@ var ALL_QWEN_VENDOR_METHODS = [
   `${QWEN_METHOD_NS}session/detach`,
   `${QWEN_METHOD_NS}session/context_usage`,
   `${QWEN_METHOD_NS}session/tasks`,
+  `${QWEN_METHOD_NS}session/agents`,
+  `${QWEN_METHOD_NS}session/agent_trace`,
+  `${QWEN_METHOD_NS}session/attachments`,
   `${QWEN_METHOD_NS}session/tasks/cancel`,
   `${QWEN_METHOD_NS}session/tasks/workflow_action`,
   `${QWEN_METHOD_NS}session/lsp`,
+  `${QWEN_METHOD_NS}session/saved_workflow`,
   `${QWEN_METHOD_NS}session/artifacts`,
   `${QWEN_METHOD_NS}session/artifacts/add`,
   `${QWEN_METHOD_NS}session/artifacts/remove`,
@@ -14523,6 +14578,42 @@ var AcpDispatcher = class {
           this.replyConn(conn, id, result);
           return;
         }
+        case `${QWEN_METHOD_NS}session/agents`: {
+          const sessionId = String(params["sessionId"] ?? "");
+          if (!this.requireOwned(conn, sessionId, id)) return;
+          const result = await this.bridge.getSessionAgentsStatus(sessionId);
+          this.replyConn(conn, id, result);
+          return;
+        }
+        case `${QWEN_METHOD_NS}session/agent_trace`: {
+          const sessionId = String(params["sessionId"] ?? "");
+          if (!this.requireOwned(conn, sessionId, id)) return;
+          const rootAgentId = params["rootAgentId"];
+          if (rootAgentId !== void 0 && (typeof rootAgentId !== "string" || rootAgentId.length === 0 || rootAgentId.length > 500)) {
+            if (id !== void 0) {
+              conn.sendConn(
+                error(id, RPC.INVALID_PARAMS, "Invalid rootAgentId")
+              );
+            }
+            return;
+          }
+          const result = await this.bridge.getSessionAgentTrace(
+            sessionId,
+            rootAgentId
+          );
+          this.replyConn(conn, id, result);
+          return;
+        }
+        case `${QWEN_METHOD_NS}session/attachments`: {
+          const sessionId = String(params["sessionId"] ?? "");
+          if (!this.requireOwned(conn, sessionId, id)) return;
+          const attachments = await this.bridge.listSessionAttachments(
+            sessionId,
+            this.sessionCtx(conn, sessionId, loopback)
+          );
+          this.replyConn(conn, id, { attachments });
+          return;
+        }
         case `${QWEN_METHOD_NS}session/tasks/cancel`: {
           const sessionId = String(params["sessionId"] ?? "");
           await this.withMutableOwned(conn, sessionId, id, async () => {
@@ -14611,6 +14702,22 @@ var AcpDispatcher = class {
           this.replyConn(conn, id, result);
           return;
         }
+        case `${QWEN_METHOD_NS}session/saved_workflow`: {
+          const sessionId = String(params["sessionId"] ?? "");
+          if (!this.requireOwned(conn, sessionId, id)) return;
+          const name = String(params["name"] ?? "");
+          if (!name) {
+            if (id !== void 0) {
+              conn.sendConn(
+                error(id, RPC.INVALID_PARAMS, "`name` is required")
+              );
+            }
+            return;
+          }
+          const result = this.isWorkspaceTrusted() ? await this.bridge.getSessionSavedWorkflow(sessionId, name) : { v: 1, sessionId, name, workflow: null };
+          this.replyConn(conn, id, result);
+          return;
+        }
         case `${QWEN_METHOD_NS}session/artifacts`: {
           const sessionId = String(params["sessionId"] ?? "");
           if (!this.requireOwned(conn, sessionId, id)) return;
@@ -17719,6 +17826,18 @@ var ClientMcpWsConnection = class {
   }
   registrar;
   disposed = false;
+  /**
+   * The scope each server was registered with, so unregister / dispose tear
+   * down the SAME registration. A session-scoped server removed without its
+   * session id would either miss the session's copy or hit the workspace path.
+   */
+  serverScopes = /* @__PURE__ */ new Map();
+  /**
+   * Identity of the in-flight register per server name, so a stale late-failing
+   * register cannot roll back the registrar advertisement and scope entry a
+   * newer register of the same name on this connection installed.
+   */
+  registerAttemptIds = /* @__PURE__ */ new Map();
   /**
    * Route a parsed inbound frame. Returns a structured result the WS layer can
    * turn into an ack/error reply (or ignore). Never throws — protocol errors
@@ -17730,7 +17849,7 @@ var ClientMcpWsConnection = class {
     }
     switch (frame.type) {
       case CLIENT_MCP_FRAME_TYPES.register:
-        return this.handleRegister(frame.server);
+        return this.handleRegister(frame.server, frame.sessionId);
       case CLIENT_MCP_FRAME_TYPES.unregister:
         return this.handleUnregister(frame.server);
       case CLIENT_MCP_FRAME_TYPES.message:
@@ -17746,7 +17865,7 @@ var ClientMcpWsConnection = class {
   static isClientMcpFrameType(type) {
     return type === CLIENT_MCP_FRAME_TYPES.register || type === CLIENT_MCP_FRAME_TYPES.message || type === CLIENT_MCP_FRAME_TYPES.unregister;
   }
-  async handleRegister(server) {
+  async handleRegister(server, sessionId) {
     if (!isValidServerName(server)) {
       return {
         kind: "error",
@@ -17754,6 +17873,17 @@ var ClientMcpWsConnection = class {
         message: "server must be \u2264256 chars, alphanumeric + underscore/hyphen, and not a reserved JS property name"
       };
     }
+    let scope;
+    if (sessionId !== void 0) {
+      if (typeof sessionId !== "string" || sessionId.length === 0) {
+        return {
+          kind: "error",
+          code: "invalid_session_id",
+          message: "`sessionId` must be a non-empty string when provided"
+        };
+      }
+      scope = { sessionId };
+    }
     if (this.registrar.hasServer(server)) {
       return {
         kind: "error",
@@ -17776,23 +17906,43 @@ var ClientMcpWsConnection = class {
       };
     }
     this.registrar.registerServer(server);
+    if (scope) this.serverScopes.set(server, scope);
+    const attempt = {};
+    this.registerAttemptIds.set(server, attempt);
     try {
       const { toolCount } = await this.provider.registerClientMcpServer(
         server,
-        this.registrar.sendSdkMcpMessage
+        this.registrar.sendSdkMcpMessage,
+        scope
       );
       if (this.disposed) {
-        this.registrar.unregisterServer(server);
-        await this.provider.unregisterClientMcpServer(server);
+        if (this.registerAttemptIds.get(server) === attempt) {
+          this.registrar.unregisterServer(server);
+          this.serverScopes.delete(server);
+          this.registerAttemptIds.delete(server);
+        }
+        await this.provider.unregisterClientMcpServer(server, scope);
         return {
           kind: "error",
           code: "closed",
           message: "connection disposed during register"
         };
       }
+      this.registerAttemptIds.delete(server);
       return { kind: "registered", server, toolCount };
     } catch (err) {
-      this.registrar.unregisterServer(server);
+      if (this.registerAttemptIds.get(server) === attempt) {
+        this.registrar.unregisterServer(server);
+        this.serverScopes.delete(server);
+        this.registerAttemptIds.delete(server);
+      }
+      if (this.disposed) {
+        return {
+          kind: "error",
+          code: "closed",
+          message: "connection disposed during register"
+        };
+      }
       return {
         kind: "error",
         code: "register_failed",
@@ -17811,10 +17961,12 @@ var ClientMcpWsConnection = class {
         message: "server name is invalid"
       };
     }
+    const scope = this.serverScopes.get(server);
     const existed = this.registrar.unregisterServer(server);
+    this.serverScopes.delete(server);
     if (existed && this.provider) {
       try {
-        await this.provider.unregisterClientMcpServer(server);
+        await this.provider.unregisterClientMcpServer(server, scope);
       } catch {
       }
     }
@@ -17861,10 +18013,14 @@ var ClientMcpWsConnection = class {
     if (this.provider) {
       await Promise.allSettled(
         servers.map(
-          (server) => this.provider.unregisterClientMcpServer(server)
+          (server) => this.provider.unregisterClientMcpServer(
+            server,
+            this.serverScopes.get(server)
+          )
         )
       );
     }
+    this.serverScopes.clear();
   }
 };
 
@@ -18710,7 +18866,11 @@ var WS_READ_METHODS = /* @__PURE__ */ new Set([
   "_qwen/session/supported_commands",
   "_qwen/session/context_usage",
   "_qwen/session/tasks",
+  "_qwen/session/agents",
+  "_qwen/session/agent_trace",
+  "_qwen/session/attachments",
   "_qwen/session/lsp",
+  "_qwen/session/saved_workflow",
   "_qwen/session/artifacts",
   "_qwen/workspace/mcp",
   "_qwen/workspace/skills",
@@ -25784,6 +25944,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "GET /session/:id/transcript"
   },
+  {
+    method: "GET",
+    path: "/session/:id/turn-index",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/turn-index"
+  },
   {
     method: "GET",
     path: "/session/:id/context",
@@ -25814,6 +25980,18 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "GET /session/:id/tasks"
   },
+  {
+    method: "GET",
+    path: "/session/:id/agents",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/agents"
+  },
+  {
+    method: "GET",
+    path: "/session/:id/agent-trace",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/agent-trace"
+  },
   {
     method: "GET",
     path: "/session/:id/subagents/:subagentRef",
@@ -25832,6 +26010,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "GET /session/:id/lsp"
   },
+  {
+    method: "GET",
+    path: "/session/:id/resources",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/resources"
+  },
   {
     method: "GET",
     path: "/session/:id/hooks",
@@ -25868,6 +26052,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/tasks/:taskId/workflow-action"
   },
+  {
+    method: "GET",
+    path: "/session/:id/saved-workflows/:name",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/saved-workflows/:name"
+  },
   {
     method: "POST",
     path: "/session/:id/goal",
@@ -25898,6 +26088,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/attachments"
   },
+  {
+    method: "GET",
+    path: "/session/:id/attachments",
+    attribution: "handler_resolved",
+    route: "GET /session/:id/attachments"
+  },
   {
     method: "GET",
     path: "/session/:id/attachments/:attachmentId",
@@ -26187,6 +26383,15 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: decodePathSegment(workspaceTranscript[1])
     };
   }
+  const workspaceTurnIndex = path19.match(
+    /^\/workspaces\/[^/]+\/session\/([^/]+)\/turn-index$/
+  );
+  if (workspaceTurnIndex?.[1] && req.method === "GET") {
+    return {
+      route: "GET /workspaces/:workspace/session/:id/turn-index",
+      sessionId: decodePathSegment(workspaceTurnIndex[1])
+    };
+  }
   const workspaceExport = path19.match(
     /^\/workspaces\/[^/]+\/session\/([^/]+)\/export$/
   );
@@ -27712,6 +27917,50 @@ function parseTranscriptCursorQuery(rawCursor, res) {
   return rawCursor;
 }
 __name(parseTranscriptCursorQuery, "parseTranscriptCursorQuery");
+function parseTranscriptDirectionQuery(rawDirection, res) {
+  if (rawDirection === void 0) return void 0;
+  if (rawDirection !== "backward") {
+    res.status(400).json({
+      error: "`direction` must be `backward`",
+      code: "invalid_transcript_cursor"
+    });
+    return null;
+  }
+  return rawDirection;
+}
+__name(parseTranscriptDirectionQuery, "parseTranscriptDirectionQuery");
+function parseTranscriptSnapshotQuery(rawSnapshot, res) {
+  if (rawSnapshot === void 0) return void 0;
+  if (typeof rawSnapshot !== "string" || rawSnapshot.trim() === "") {
+    res.status(400).json({
+      error: "`snapshot` must be a non-empty string",
+      code: "invalid_transcript_cursor"
+    });
+    return null;
+  }
+  return rawSnapshot;
+}
+__name(parseTranscriptSnapshotQuery, "parseTranscriptSnapshotQuery");
+function parseTranscriptStartQuery(rawStart, res) {
+  if (rawStart === void 0) return void 0;
+  if (typeof rawStart !== "string" || !/^\d+$/.test(rawStart)) {
+    res.status(400).json({
+      error: "`start` must be a non-negative integer",
+      code: "invalid_transcript_cursor"
+    });
+    return null;
+  }
+  const start = Number(rawStart);
+  if (!Number.isSafeInteger(start)) {
+    res.status(400).json({
+      error: "`start` must be a non-negative safe integer",
+      code: "invalid_transcript_cursor"
+    });
+    return null;
+  }
+  return start;
+}
+__name(parseTranscriptStartQuery, "parseTranscriptStartQuery");
 function parseTranscriptRecordBoundaryQuery(rawBoundary, res) {
   if (rawBoundary === void 0) return void 0;
   if (typeof rawBoundary !== "string" || rawBoundary.trim() === "" || rawBoundary.length > 200) {
@@ -27724,6 +27973,18 @@ function parseTranscriptRecordBoundaryQuery(rawBoundary, res) {
   return rawBoundary;
 }
 __name(parseTranscriptRecordBoundaryQuery, "parseTranscriptRecordBoundaryQuery");
+function parseTranscriptTurnAnchorQuery(rawAnchor, res) {
+  if (rawAnchor === void 0) return void 0;
+  if (typeof rawAnchor !== "string" || rawAnchor.trim() === "" || rawAnchor.length > 200) {
+    res.status(400).json({
+      error: "`atRecordId` must be a non-empty record id",
+      code: "invalid_turn_anchor"
+    });
+    return null;
+  }
+  return rawAnchor;
+}
+__name(parseTranscriptTurnAnchorQuery, "parseTranscriptTurnAnchorQuery");
 function parseHistoryPageSize(body, res) {
   const value = body["historyPageSize"];
   if (value === void 0) return void 0;
@@ -27874,6 +28135,34 @@ function registerSessionRoutes(app, deps) {
   const LANGUAGE_CODES = deps.languageCodes;
   const transcriptCursorMasterKey = crypto3.randomBytes(32);
   const transcriptCursorCodecs = /* @__PURE__ */ new Map();
+  const worktreeRestoreTails = /* @__PURE__ */ new WeakMap();
+  const acquireWorktreeRestore = /* @__PURE__ */ __name(async (bridge, sessionId) => {
+    let tails = worktreeRestoreTails.get(bridge);
+    if (!tails) {
+      tails = /* @__PURE__ */ new Map();
+      worktreeRestoreTails.set(bridge, tails);
+    }
+    const key = normalizeSessionIdForLookup(sessionId);
+    const previous = tails.get(key);
+    let releaseGate;
+    const gate = new Promise((resolve7) => {
+      releaseGate = resolve7;
+    });
+    const tail = (previous ?? Promise.resolve()).then(() => gate);
+    tails.set(key, tail);
+    if (previous) {
+      await previous;
+    }
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      releaseGate();
+      if (tails.get(key) === tail) {
+        tails.delete(key);
+      }
+    };
+  }, "acquireWorktreeRestore");
   const activeBranchSessions = /* @__PURE__ */ new Map();
   const inFlightBranchWorkspaces = /* @__PURE__ */ new Set();
   const clearBranchSessionEntry = /* @__PURE__ */ __name((sessionId) => {
@@ -29355,6 +29644,8 @@ function registerSessionRoutes(app, deps) {
     let branchMeta;
     let branchBaseCommit;
     let worktreeMeta;
+    let worktreeDurablyAttached = false;
+    let spawnCompleted = false;
     try {
       assertRuntimeGenerationOpen?.();
       const rawBranch = body["branch"];
@@ -29566,6 +29857,7 @@ function registerSessionRoutes(app, deps) {
         ...branchMeta ? { branch: branchMeta } : {},
         ...requestedSessionId !== void 0 ? { sessionId: requestedSessionId } : {}
       });
+      spawnCompleted = true;
       if (requestedSessionId !== void 0 && session.sessionId !== requestedSessionId) {
         if (daemonLog) {
           daemonLog.warn("session id not honored by agent", {
@@ -29709,29 +30001,21 @@ function registerSessionRoutes(app, deps) {
               path12.join(createRepoTop, ".qwen", "worktrees")
             );
           }
-          await runtime.bridge.changeSessionCwd(session.sessionId, {
-            path: worktreeMeta.path,
-            allowedRoots: createAllowedRoots
-          });
-          await writeWorktreeSessionMarker(
-            worktreeMeta.path,
-            session.sessionId
-          ).catch(() => {
-          });
-          await writeWorktreeSession(
-            createWorkspaceRuntimeSessionService(
-              runtime
-            ).getWorktreeSessionPath(session.sessionId),
+          const expectedWorktreePath = fs7.realpathSync(worktreeMeta.path);
+          const changed = await runtime.bridge.changeSessionCwd(
+            session.sessionId,
             {
-              slug: worktreeMeta.slug,
-              worktreePath: worktreeMeta.path,
-              worktreeBranch: worktreeMeta.branch,
-              originalCwd: workspaceCwd,
-              originalBranch: "",
-              originalHeadCommit: ""
+              path: worktreeMeta.path,
+              allowedRoots: createAllowedRoots
             }
-          ).catch(() => {
-          });
+          );
+          if (changed.newCwd !== expectedWorktreePath) {
+            throw new Error("Worktree relocation returned an unexpected path");
+          }
+          worktreeMeta = { ...worktreeMeta, path: expectedWorktreePath };
+          runtime.bridge.setSessionWorktree(session.sessionId, worktreeMeta);
+          session.worktree = worktreeMeta;
+          session.currentCwd = changed.newCwd;
         } catch (cdErr) {
           if (daemonLog) {
             daemonLog.warn("worktree cd failed, rolling back", {
@@ -29739,7 +30023,7 @@ function registerSessionRoutes(app, deps) {
               error: cdErr instanceof Error ? cdErr.message : String(cdErr)
             });
           }
-          await runWithWorkspaceRuntimeStorage(
+          const removedSession = await runWithWorkspaceRuntimeStorage(
             runtime,
             () => deleteDaemonSessionIfOrphan({
               sessionId: session.sessionId,
@@ -29748,14 +30032,76 @@ function registerSessionRoutes(app, deps) {
               coordinator: archiveCoordinator
             })
           ).catch(() => false);
-          await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
-          });
+          if (removedSession) {
+            await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
+            });
+          }
           res.status(500).json({
             error: "Failed to relocate session into worktree",
             code: "worktree_relocate_failed"
           });
           return;
         }
+        try {
+          await createWorktreeSessionMarkerExclusive(
+            worktreeMeta.path,
+            session.sessionId
+          );
+          await writeWorktreeSession(
+            createWorkspaceRuntimeSessionService(
+              runtime
+            ).getWorktreeSessionPath(session.sessionId),
+            {
+              slug: worktreeMeta.slug,
+              worktreePath: worktreeMeta.path,
+              worktreeBranch: worktreeMeta.branch,
+              originalCwd: workspaceCwd,
+              workspaceCwd,
+              originalBranch: "",
+              originalHeadCommit: ""
+            }
+          );
+          assertRuntimeGenerationOpen?.();
+          session.worktreeState = "persisted-v1";
+          worktreeDurablyAttached = true;
+        } catch (persistErr) {
+          daemonLog?.warn("worktree persistence failed after relocation", {
+            sessionId: session.sessionId,
+            error: persistErr instanceof Error ? persistErr.message : String(persistErr)
+          });
+          let removed = false;
+          try {
+            removed = await runWithWorkspaceRuntimeStorage(
+              runtime,
+              () => deleteDaemonSessionIfOrphan({
+                sessionId: session.sessionId,
+                service: createWorkspaceRuntimeSessionService(runtime),
+                bridge: runtime.bridge,
+                coordinator: archiveCoordinator
+              })
+            );
+          } catch {
+          }
+          if (removed) {
+            await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
+            });
+          } else {
+            daemonLog?.warn(
+              "worktree preserved after persistence cleanup was inconclusive",
+              {
+                sessionId: session.sessionId,
+                slug: worktreeMeta.slug,
+                worktreePath: worktreeMeta.path,
+                branch: worktreeMeta.branch
+              }
+            );
+          }
+          res.status(500).json({
+            error: "Failed to persist worktree session ownership",
+            code: "worktree_persistence_failed"
+          });
+          return;
+        }
       }
       if (branchMeta) {
         activeBranchSessions.set(workspaceCwd, session.sessionId);
@@ -29763,7 +30109,7 @@ function registerSessionRoutes(app, deps) {
       }
       res.status(200).json(session);
     } catch (err) {
-      if (worktreeMeta) {
+      if (worktreeMeta && !worktreeDurablyAttached && !spawnCompleted) {
         await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
         });
       }
@@ -29957,6 +30303,9 @@ function registerSessionRoutes(app, deps) {
       }
     }
     let restoredStorageSessionId = sessionId;
+    let suppressWorktreeContextRestore = false;
+    let deferRestoreAskUserQuestionPrompt = false;
+    let releaseWorktreeRestore;
     try {
       const session = await archiveCoordinator.runSharedMany(
         [sessionId],
@@ -30000,6 +30349,24 @@ function registerSessionRoutes(app, deps) {
             ...restoreMetadata,
             ...hasPersistedSource || isInternalWorkspaceRuntime(runtime) ? {} : restoreSource
           };
+          const isChannelRestore = restoreRequestMetadata.sourceType === "channel";
+          let isPart4AWorktreeRestore = false;
+          if (isChannelRestore && runtime.provenance !== "live-conversation") {
+            const sidecarBeforeRestore = await readWorktreeSessionStrict(
+              sessionService.getWorktreeSessionPath(restoredStorageSessionId)
+            );
+            isPart4AWorktreeRestore = sidecarBeforeRestore.state === "valid" && sidecarBeforeRestore.session.workspaceCwd !== void 0;
+            suppressWorktreeContextRestore = !(sidecarBeforeRestore.state === "valid" && sidecarBeforeRestore.session.workspaceCwd === void 0);
+          } else {
+            suppressWorktreeContextRestore = isChannelRestore;
+          }
+          deferRestoreAskUserQuestionPrompt = suppressWorktreeContextRestore && runtime.bridge.fireDeferredRestoreAskUserQuestionPrompt !== void 0 && runtime.bridge.discardDeferredRestoreAskUserQuestionPrompt !== void 0;
+          if (deferRestoreAskUserQuestionPrompt && isPart4AWorktreeRestore) {
+            releaseWorktreeRestore = await acquireWorktreeRestore(
+              runtime.bridge,
+              sessionId
+            );
+          }
           assertRuntimeGenerationOpen?.();
           if (isInternalWorkspaceRuntime(runtime)) {
             sessionIdReservation = requestedSessionIdAdmission.reserveRestore(
@@ -30024,6 +30391,10 @@ function registerSessionRoutes(app, deps) {
           const restored = action === "load" ? await runtime.bridge.loadSession({
             sessionId,
             workspaceCwd,
+            ...suppressWorktreeContextRestore ? {
+              suppressWorktreeContextRestore: true,
+              ...deferRestoreAskUserQuestionPrompt ? { deferRestoreAskUserQuestionPrompt: true } : {}
+            } : {},
             historyReplay: "response",
             ...historyPageSize !== void 0 ? { historyPageSize } : {},
             ...liveReplayMode !== void 0 ? { liveReplayMode } : {},
@@ -30033,6 +30404,10 @@ function registerSessionRoutes(app, deps) {
           }) : await runtime.bridge.resumeSession({
             sessionId,
             workspaceCwd,
+            ...suppressWorktreeContextRestore ? {
+              suppressWorktreeContextRestore: true,
+              ...deferRestoreAskUserQuestionPrompt ? { deferRestoreAskUserQuestionPrompt: true } : {}
+            } : {},
             ...clientId !== void 0 ? { clientId } : {},
             ...approvalMode !== void 0 ? { approvalMode } : {},
             ...restoreRequestMetadata
@@ -30089,7 +30464,7 @@ function registerSessionRoutes(app, deps) {
               throw error2;
             }
           }
-          if (action === "load" && !restored.attached && !restored.hasActivePrompt && runtime.provenance !== "live-conversation") {
+          if (action === "load" && !restored.attached && !restored.hasActivePrompt && !deferRestoreAskUserQuestionPrompt && runtime.provenance !== "live-conversation") {
             try {
               await reconcileDanglingPromptTerminals(
                 sessionService,
@@ -30098,53 +30473,46 @@ function registerSessionRoutes(app, deps) {
             } catch {
             }
           }
-          return withPromptTerminals(
-            restored,
-            action === "load" ? readRecentPromptTerminals(sessionService, sessionId) : void 0
-          );
+          return restored;
         }
       );
-      try {
-        assertRuntimeGenerationOpen?.();
-      } catch (error2) {
-        if (!session.attached) {
-          await runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
+      const cleanupRestoredSession = /* @__PURE__ */ __name(async () => {
+        if (deferRestoreAskUserQuestionPrompt) {
+          runtime.bridge.discardDeferredRestoreAskUserQuestionPrompt?.(
+            session.sessionId,
+            session.clientId
+          );
+        }
+        if (session.attached) {
+          await runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
           });
         } else {
-          await runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
+          await runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
           });
         }
+      }, "cleanupRestoredSession");
+      try {
+        assertRuntimeGenerationOpen?.();
+      } catch (error2) {
+        await cleanupRestoredSession();
         throw error2;
       }
-      if (daemonLog) {
-        daemonLog.info(
-          `session ${action}${session.attached ? " (attached)" : ""}`,
-          { sessionId: session.sessionId, clientId: session.clientId }
-        );
-      }
       if (!res.writable) {
-        if (!session.attached) {
-          runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
-          });
-        } else {
-          runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
-          });
-        }
+        void cleanupRestoredSession();
         return;
       }
-      if (runtime.provenance !== "live-conversation" && !session.worktree) {
-        const sidecar = await readWorktreeSession(
-          createWorkspaceRuntimeSessionService(
-            runtime
-          ).getWorktreeSessionPath(restoredStorageSessionId)
-        ).catch(() => null);
-        if (sidecar) {
+      if (runtime.provenance !== "live-conversation") {
+        const sidecarPath = createWorkspaceRuntimeSessionService(
+          runtime
+        ).getWorktreeSessionPath(restoredStorageSessionId);
+        const sidecarResult = await readWorktreeSessionStrict(sidecarPath);
+        if (sidecarResult.state === "valid" && sidecarResult.session.workspaceCwd === void 0) {
+          const sidecar = sidecarResult.session;
           let realTarget;
-          const candidateRoots = [
-            path12.join(workspaceCwd, ".qwen", "worktrees")
-          ];
+          let candidateRoots = [];
+          let validationError;
           try {
-            realTarget = fs7.realpathSync(sidecar.worktreePath);
+            const workspaceRoots = [fs7.realpathSync(workspaceCwd)];
             let repoTop = null;
             try {
               repoTop = await new GitWorktreeService(
@@ -30152,31 +30520,44 @@ function registerSessionRoutes(app, deps) {
               ).getRepoTopLevel();
             } catch {
             }
-            if (repoTop && repoTop !== workspaceCwd) {
-              candidateRoots.push(path12.join(repoTop, ".qwen", "worktrees"));
+            if (repoTop) {
+              const realRepoTop = fs7.realpathSync(repoTop);
+              if (!workspaceRoots.includes(realRepoTop)) {
+                workspaceRoots.push(realRepoTop);
+              }
+            }
+            const realOriginalCwd = fs7.realpathSync(sidecar.originalCwd);
+            if (!workspaceRoots.includes(realOriginalCwd)) {
+              throw new Error("legacy sidecar belongs to another workspace");
             }
+            candidateRoots = workspaceRoots.map(
+              (root) => path12.join(root, ".qwen", "worktrees")
+            );
+            realTarget = fs7.realpathSync(sidecar.worktreePath);
             const contained = candidateRoots.some((root) => {
               try {
                 const realRoot = fs7.realpathSync(root);
-                const rel = path12.relative(realRoot, realTarget);
-                return !rel.startsWith("..") && !path12.isAbsolute(rel);
+                const relative5 = path12.relative(realRoot, realTarget);
+                return relative5.length > 0 && !relative5.startsWith("..") && !path12.isAbsolute(relative5);
               } catch {
                 return false;
               }
             });
             if (!contained) {
-              realTarget = void 0;
+              throw new Error("worktree sidecar path failed containment");
             }
-          } catch {
+          } catch (error2) {
+            validationError = error2;
             realTarget = void 0;
           }
           if (!realTarget) {
             daemonLog?.warn("worktree sidecar path failed containment", {
               sessionId,
-              path: sidecar.worktreePath
+              path: sidecar.worktreePath,
+              error: validationError instanceof Error ? validationError.message : String(validationError)
             });
           } else {
-            const wt = {
+            const worktree = {
               slug: sidecar.slug,
               path: realTarget,
               branch: sidecar.worktreeBranch
@@ -30184,23 +30565,176 @@ function registerSessionRoutes(app, deps) {
             try {
               if (!session.hasActivePrompt) {
                 await runtime.bridge.changeSessionCwd(sessionId, {
-                  path: wt.path,
+                  path: worktree.path,
                   allowedRoots: candidateRoots
                 });
               }
-              runtime.bridge.setSessionWorktree(sessionId, wt);
-              session.worktree = wt;
+              runtime.bridge.setSessionWorktree(sessionId, worktree);
+              session.worktree = worktree;
             } catch (restoreErr) {
               daemonLog?.warn("worktree restore failed on load/resume", {
                 sessionId,
-                worktreePath: wt.path,
+                worktreePath: worktree.path,
                 error: restoreErr instanceof Error ? restoreErr.message : String(restoreErr)
               });
             }
           }
+        } else if (sidecarResult.state !== "missing") {
+          try {
+            if (sidecarResult.state !== "valid") {
+              throw new Error("Worktree sidecar is missing or invalid");
+            }
+            const sidecar = sidecarResult.session;
+            const realWorkspace = fs7.realpathSync(workspaceCwd);
+            if (sidecar.workspaceCwd !== void 0) {
+              let realSidecarWorkspace;
+              try {
+                realSidecarWorkspace = fs7.realpathSync(sidecar.workspaceCwd);
+              } catch {
+                throw new Error(
+                  "Worktree sidecar workspace is missing or inaccessible"
+                );
+              }
+              if (realSidecarWorkspace !== realWorkspace) {
+                throw new Error(
+                  "Worktree sidecar belongs to another workspace"
+                );
+              }
+            }
+            const workspaceRoots = [realWorkspace];
+            let repoTop = null;
+            try {
+              repoTop = await new GitWorktreeService(
+                realWorkspace
+              ).getRepoTopLevel();
+            } catch {
+            }
+            if (repoTop && repoTop !== realWorkspace) {
+              workspaceRoots.push(fs7.realpathSync(repoTop));
+            }
+            let realOriginalCwd;
+            try {
+              realOriginalCwd = fs7.realpathSync(sidecar.originalCwd);
+            } catch {
+              throw new Error(
+                "Worktree sidecar workspace is missing or inaccessible"
+              );
+            }
+            if (!workspaceRoots.includes(realOriginalCwd)) {
+              throw new Error(
+                "Worktree sidecar belongs to another workspace"
+              );
+            }
+            const candidateRoots = workspaceRoots.map(
+              (root) => path12.join(root, ".qwen", "worktrees")
+            );
+            let realTarget;
+            try {
+              realTarget = fs7.realpathSync(sidecar.worktreePath);
+            } catch {
+              throw new Error("Worktree checkout is missing or inaccessible");
+            }
+            const contained = candidateRoots.some((root) => {
+              try {
+                const realRoot = fs7.realpathSync(root);
+                const relative5 = path12.relative(realRoot, realTarget);
+                return relative5.length > 0 && !relative5.startsWith("..") && !path12.isAbsolute(relative5);
+              } catch {
+                return false;
+              }
+            });
+            if (!contained) {
+              throw new Error("Worktree sidecar path failed containment");
+            }
+            const marker = await readWorktreeSessionMarkerStrict(realTarget);
+            if (marker.state !== "valid" || marker.sessionId !== restoredStorageSessionId) {
+              throw new Error("Worktree marker ownership is invalid");
+            }
+            const worktree = {
+              slug: sidecar.slug,
+              path: realTarget,
+              branch: sidecar.worktreeBranch
+            };
+            const hasUnlocatedRestoredPrompt = session.hasActivePrompt && !session.attached && session.currentCwd === void 0;
+            if (hasUnlocatedRestoredPrompt) {
+              runtime.bridge.setSessionWorktree(sessionId, worktree);
+              session.worktree = worktree;
+            } else if (session.hasActivePrompt) {
+              if (session.currentCwd !== realTarget) {
+                throw new Error("Active session is outside its worktree");
+              }
+            } else {
+              const changed = await runtime.bridge.changeSessionCwd(
+                sessionId,
+                {
+                  path: realTarget,
+                  allowedRoots: candidateRoots
+                }
+              );
+              if (changed.newCwd !== realTarget) {
+                throw new Error("Worktree relocation was rejected");
+              }
+              session.currentCwd = changed.newCwd;
+            }
+            if (!hasUnlocatedRestoredPrompt) {
+              runtime.bridge.setSessionWorktree(sessionId, worktree);
+              assertRuntimeGenerationOpen?.();
+              session.worktree = worktree;
+              session.worktreeState = "persisted-v1";
+            }
+          } catch (restoreErr) {
+            daemonLog?.warn("worktree integrity validation failed", {
+              sessionId: session.sessionId,
+              error: restoreErr instanceof Error ? restoreErr.message : String(restoreErr)
+            });
+            await cleanupRestoredSession();
+            throw restoreErr;
+          }
         }
       }
-      res.status(200).json(redactSdkSurfaceReplay(session, runtime.trusted));
+      if (!res.writable) {
+        await cleanupRestoredSession();
+        return;
+      }
+      try {
+        assertRuntimeGenerationOpen?.();
+      } catch (error2) {
+        await cleanupRestoredSession();
+        throw error2;
+      }
+      const deferredRestorePromptAdmitted = deferRestoreAskUserQuestionPrompt && (runtime.bridge.fireDeferredRestoreAskUserQuestionPrompt?.(
+        session.sessionId,
+        session.clientId
+      ) ?? false);
+      if (deferredRestorePromptAdmitted) {
+        session.hasActivePrompt = true;
+      } else if (deferRestoreAskUserQuestionPrompt && action === "load" && !session.attached && !session.hasActivePrompt && runtime.provenance !== "live-conversation") {
+        try {
+          await reconcileDanglingPromptTerminals(
+            createWorkspaceRuntimeSessionService(runtime),
+            sessionId
+          );
+        } catch {
+        }
+      }
+      try {
+        assertRuntimeGenerationOpen?.();
+      } catch (error2) {
+        await cleanupRestoredSession();
+        throw error2;
+      }
+      daemonLog?.info(
+        `session ${action}${session.attached ? " (attached)" : ""}`,
+        { sessionId: session.sessionId, clientId: session.clientId }
+      );
+      const responseSession = withPromptTerminals(
+        session,
+        action === "load" ? readRecentPromptTerminals(
+          createWorkspaceRuntimeSessionService(runtime),
+          sessionId
+        ) : void 0
+      );
+      res.status(200).json(redactSdkSurfaceReplay(responseSession, runtime.trusted));
     } catch (err) {
       if (err instanceof RequestedSessionIdAdmissionError) {
         sendRequestedSessionIdAdmissionError(res, err, route);
@@ -30212,6 +30746,7 @@ function registerSessionRoutes(app, deps) {
       });
     } finally {
       sessionIdReservation?.release();
+      releaseWorktreeRestore?.();
     }
   }, "restoreSessionHandler");
   app.post("/session/:id/load", mutate(), restoreSessionHandler("load"));
@@ -30560,14 +31095,33 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
+    const direction = parseTranscriptDirectionQuery(
+      req.query["direction"],
+      res
+    );
+    if (direction === null) return;
     const beforeRecordId = parseTranscriptRecordBoundaryQuery(
       req.query["beforeRecordId"],
       res
     );
     if (beforeRecordId === null) return;
-    if (cursor !== void 0 && beforeRecordId !== void 0) {
+    const atRecordId = parseTranscriptTurnAnchorQuery(
+      req.query["atRecordId"],
+      res
+    );
+    if (atRecordId === null) return;
+    const snapshot = parseTranscriptSnapshotQuery(req.query["snapshot"], res);
+    if (snapshot === null) return;
+    if (direction !== void 0 && (cursor !== void 0 || beforeRecordId !== void 0 || atRecordId !== void 0 || snapshot !== void 0) || cursor !== void 0 && (beforeRecordId !== void 0 || atRecordId !== void 0 || snapshot !== void 0) || atRecordId !== void 0 && (beforeRecordId !== void 0 || snapshot === void 0) || snapshot !== void 0 && atRecordId === void 0 && beforeRecordId === void 0) {
       res.status(400).json({
-        error: "`cursor` and `beforeRecordId` are mutually exclusive",
+        error: "Invalid transcript cursor and anchor combination",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
+    if (cursor !== void 0 && workspaceTranscriptCursorExceedsLimit(cursor) || snapshot !== void 0 && workspaceTranscriptCursorExceedsLimit(snapshot)) {
+      res.status(400).json({
+        error: "Transcript cursor or snapshot exceeds the maximum size",
         code: "invalid_transcript_cursor"
       });
       return;
@@ -30581,26 +31135,36 @@ function registerSessionRoutes(app, deps) {
             res,
             route,
             sessionId,
-            cursor !== void 0
+            cursor !== void 0 || snapshot !== void 0
           );
           if (!runtime) return void 0;
           workspaceTrusted = runtime.trusted;
-          captureRuntimeGenerationAssertion(runtime)?.();
-          return runtime.bridge.getSessionTranscriptPage({
+          const assertRuntimeGenerationOpen = captureRuntimeGenerationAssertion(runtime);
+          assertRuntimeGenerationOpen?.();
+          const page = await runtime.bridge.getSessionTranscriptPage({
             sessionId,
             ...limit !== void 0 ? { limit } : {},
             ...cursor !== void 0 ? { cursor } : {},
-            ...beforeRecordId !== void 0 ? { beforeRecordId } : {}
+            ...direction !== void 0 ? { direction } : {},
+            ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
+            ...atRecordId !== void 0 ? { atRecordId } : {},
+            ...snapshot !== void 0 ? { snapshot } : {}
           });
+          assertRuntimeGenerationOpen?.();
+          return page;
         }
       );
       if (result === void 0) return;
-      res.status(200).set("Cache-Control", "no-store").json({
-        ...result,
-        events: (result.events ?? []).map(
-          (event) => redactSdkSurfaceEvent(event, workspaceTrusted)
-        )
-      });
+      const serialized = serializeWorkspaceTranscriptResponse(
+        {
+          ...result,
+          events: (result.events ?? []).map(
+            (event) => redactSdkSurfaceEvent(event, workspaceTrusted)
+          )
+        },
+        sessionId
+      );
+      res.status(200).set("Cache-Control", "no-store").type("application/json").send(serialized);
     } catch (err) {
       sendBridgeError2(res, err, {
         route,
@@ -30621,21 +31185,33 @@ function registerSessionRoutes(app, deps) {
     if (limit === null) return;
     const cursor = parseTranscriptCursorQuery(req.query["cursor"], res);
     if (cursor === null) return;
+    const direction = parseTranscriptDirectionQuery(
+      req.query["direction"],
+      res
+    );
+    if (direction === null) return;
     const beforeRecordId = parseTranscriptRecordBoundaryQuery(
       req.query["beforeRecordId"],
       res
     );
     if (beforeRecordId === null) return;
-    if (cursor !== void 0 && beforeRecordId !== void 0) {
+    const atRecordId = parseTranscriptTurnAnchorQuery(
+      req.query["atRecordId"],
+      res
+    );
+    if (atRecordId === null) return;
+    const snapshot = parseTranscriptSnapshotQuery(req.query["snapshot"], res);
+    if (snapshot === null) return;
+    if (direction !== void 0 && (cursor !== void 0 || beforeRecordId !== void 0 || atRecordId !== void 0 || snapshot !== void 0) || cursor !== void 0 && (beforeRecordId !== void 0 || atRecordId !== void 0 || snapshot !== void 0) || atRecordId !== void 0 && (beforeRecordId !== void 0 || snapshot === void 0) || snapshot !== void 0 && atRecordId === void 0 && beforeRecordId === void 0) {
       res.status(400).json({
-        error: "`cursor` and `beforeRecordId` are mutually exclusive",
+        error: "Invalid transcript cursor and anchor combination",
         code: "invalid_transcript_cursor"
       });
       return;
     }
-    if (cursor !== void 0 && workspaceTranscriptCursorExceedsLimit(cursor)) {
+    if (cursor !== void 0 && workspaceTranscriptCursorExceedsLimit(cursor) || snapshot !== void 0 && workspaceTranscriptCursorExceedsLimit(snapshot)) {
       res.status(400).json({
-        error: "`cursor` exceeds the maximum size",
+        error: "Transcript cursor or snapshot exceeds the maximum size",
         code: "invalid_transcript_cursor"
       });
       return;
@@ -30668,28 +31244,51 @@ function registerSessionRoutes(app, deps) {
               runtime.workspaceCwd,
               codec
             );
-            const hasActivePrompt = /* @__PURE__ */ __name(() => {
+            const getLivePromptState = /* @__PURE__ */ __name(() => {
               try {
-                return runtime.bridge.getSessionSummary(sessionId).hasActivePrompt;
+                return {
+                  live: true,
+                  activePrompt: runtime.bridge.getSessionSummary(sessionId).hasActivePrompt
+                };
               } catch (error2) {
-                if (error2 instanceof SessionNotFoundError) return false;
+                if (error2 instanceof SessionNotFoundError) {
+                  return { live: false, activePrompt: false };
+                }
                 throw error2;
               }
-            }, "hasActivePrompt");
-            const activePromptBeforeRead = hasActivePrompt();
+            }, "getLivePromptState");
+            const promptStateBeforeRead = getLivePromptState();
+            if (cursor === void 0 && direction === "backward" && promptStateBeforeRead.live) {
+              try {
+                if (runtime.bridge.flushSessionTranscript) {
+                  await runtime.bridge.flushSessionTranscript(sessionId);
+                } else {
+                  await runtime.bridge.getSessionTranscriptPage({
+                    sessionId,
+                    direction,
+                    limit: 1
+                  });
+                }
+              } catch (error2) {
+                if (!(error2 instanceof SessionNotFoundError)) throw error2;
+              }
+            }
             let page;
             try {
               page = await reader.readPage(sessionId, {
                 ...limit !== void 0 ? { limit } : {},
                 ...cursor !== void 0 ? { cursor } : {},
+                ...direction !== void 0 ? { direction } : {},
                 ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
+                ...atRecordId !== void 0 ? { atRecordId } : {},
+                ...snapshot !== void 0 ? { snapshot } : {},
                 maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
               });
             } catch (error2) {
               if (error2.code !== "ENOENT") {
                 throw error2;
               }
-              if (cursor !== void 0) {
+              if (cursor !== void 0 || snapshot !== void 0) {
                 throw new SessionTranscriptSnapshotUnavailableError(sessionId);
               }
               const location = await service.getSessionLocation(sessionId);
@@ -30704,11 +31303,11 @@ function registerSessionRoutes(app, deps) {
             if (page.records.some((record) => record.sessionId !== sessionId)) {
               throw new SessionTranscriptSnapshotUnavailableError(sessionId);
             }
-            const activePromptAfterRead = hasActivePrompt();
+            const activePromptAfterRead = getLivePromptState().activePrompt;
             const replay = await replayTranscriptRecordPage({
               sessionId,
               page,
-              finalizeDangling: !activePromptBeforeRead && !activePromptAfterRead,
+              finalizeDangling: !promptStateBeforeRead.activePrompt && !activePromptAfterRead,
               encodeCursor: /* @__PURE__ */ __name((state) => codec.encode(state), "encodeCursor")
             });
             assertRuntimeGenerationOpen?.();
@@ -30733,7 +31332,9 @@ function registerSessionRoutes(app, deps) {
               ...replay.partial || cursorTooLarge ? {
                 partial: true,
                 replayError: cursorTooLarge ? TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR : replay.replayError
-              } : {}
+              } : {},
+              ...page.targetRecordId ? { targetRecordId: page.targetRecordId } : {},
+              ...page.hasOlder !== void 0 ? { hasOlder: page.hasOlder } : {}
             };
           });
         })
@@ -30748,6 +31349,155 @@ function registerSessionRoutes(app, deps) {
       sendBridgeError2(res, err, { route, sessionId });
     }
   });
+  app.get("/session/:id/turn-index", async (req, res) => {
+    const route = "GET /session/:id/turn-index";
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const limit = parseTranscriptLimitQuery(req.query["limit"], res);
+    if (limit === null) return;
+    const snapshot = parseTranscriptSnapshotQuery(req.query["snapshot"], res);
+    if (snapshot === null) return;
+    const start = parseTranscriptStartQuery(req.query["start"], res);
+    if (start === null) return;
+    if (start !== void 0 && snapshot === void 0) {
+      res.status(400).json({
+        error: "`start` requires `snapshot`",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
+    if (snapshot !== void 0 && workspaceTranscriptCursorExceedsLimit(snapshot)) {
+      res.status(400).json({
+        error: "`snapshot` exceeds the maximum size",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
+    try {
+      const result = await archiveCoordinator.runSharedMany(
+        [sessionId],
+        async () => {
+          const runtime = await resolveTranscriptSessionRuntime(
+            res,
+            route,
+            sessionId,
+            snapshot !== void 0
+          );
+          if (!runtime) return void 0;
+          const assertRuntimeGenerationOpen = captureRuntimeGenerationAssertion(runtime);
+          assertRuntimeGenerationOpen?.();
+          const page = await runtime.bridge.getSessionTurnIndexPage({
+            sessionId,
+            ...snapshot !== void 0 ? { snapshot } : {},
+            ...start !== void 0 ? { start } : {},
+            ...limit !== void 0 ? { limit } : {}
+          });
+          assertRuntimeGenerationOpen?.();
+          return page;
+        }
+      );
+      if (result === void 0) return;
+      const serialized = serializeWorkspaceTranscriptResponse(
+        result,
+        sessionId
+      );
+      res.status(200).set("Cache-Control", "no-store").type("application/json").send(serialized);
+    } catch (err) {
+      sendBridgeError2(res, err, { route, sessionId });
+    }
+  });
+  app.get("/workspaces/:workspace/session/:id/turn-index", async (req, res) => {
+    const route = "GET /workspaces/:workspace/session/:id/turn-index";
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const qualifiedTarget = resolveQualifiedSessionTarget(req, res, {
+      allowUntrustedSecondary: true
+    });
+    if (!qualifiedTarget) return;
+    const preResolvedRuntime = qualifiedTarget.kind === "ordinary" ? qualifiedTarget.runtime : void 0;
+    const limit = parseTranscriptLimitQuery(req.query["limit"], res);
+    if (limit === null) return;
+    const snapshot = parseTranscriptSnapshotQuery(req.query["snapshot"], res);
+    if (snapshot === null) return;
+    const start = parseTranscriptStartQuery(req.query["start"], res);
+    if (start === null) return;
+    if (start !== void 0 && snapshot === void 0) {
+      res.status(400).json({
+        error: "`start` requires `snapshot`",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
+    if (snapshot !== void 0 && workspaceTranscriptCursorExceedsLimit(snapshot)) {
+      res.status(400).json({
+        error: "`snapshot` exceeds the maximum size",
+        code: "invalid_transcript_cursor"
+      });
+      return;
+    }
+    try {
+      const result = await runWithoutDebugLogSession(
+        () => archiveCoordinator.runSharedMany([sessionId], async () => {
+          const runtime = preResolvedRuntime ?? await resolveQualifiedSessionRuntime(
+            req,
+            res,
+            route,
+            [sessionId],
+            "active"
+          );
+          if (!runtime) return void 0;
+          const assertRuntimeGenerationOpen = captureRuntimeGenerationAssertion(runtime);
+          assertRuntimeGenerationOpen?.();
+          return runWithWorkspaceRuntimeStorage(runtime, async () => {
+            if (snapshot === void 0) {
+              await assertSessionLoadable(
+                runtime.workspaceCwd,
+                sessionId,
+                runtime.sessionRuntimeBaseDir,
+                { allowActiveConflict: true }
+              );
+            }
+            try {
+              const page = await new SessionTranscriptReader(
+                runtime.workspaceCwd,
+                getTranscriptCursorCodec(runtime)
+              ).readTurnIndexPage(sessionId, {
+                ...snapshot !== void 0 ? { snapshot } : {},
+                ...start !== void 0 ? { start } : {},
+                ...limit !== void 0 ? { limit } : {}
+              });
+              assertRuntimeGenerationOpen?.();
+              return page;
+            } catch (error2) {
+              if (error2.code !== "ENOENT") {
+                throw error2;
+              }
+              if (snapshot !== void 0) {
+                throw new SessionTranscriptSnapshotUnavailableError(sessionId);
+              }
+              const service = createWorkspaceRuntimeSessionService(runtime);
+              const location = await service.getSessionLocation(sessionId);
+              if (location === "archived") {
+                throw new SessionArchivedError(sessionId);
+              }
+              if (location === "conflict") {
+                throw new SessionConflictError(sessionId);
+              }
+              throw new SessionNotFoundError(sessionId);
+            }
+          });
+        })
+      );
+      if (result === void 0) return;
+      const serialized = serializeWorkspaceTranscriptResponse(
+        result,
+        sessionId
+      );
+      res.status(200).set("Cache-Control", "no-store").type("application/json").send(serialized);
+    } catch (err) {
+      sendBridgeError2(res, err, { route, sessionId });
+    }
+  });
   app.get(
     "/session/:id/context",
     async (req, res, next) => {
@@ -30869,6 +31619,52 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.get(
+    "/session/:id/agents",
+    withOwnerReadSession(
+      "GET /session/:id/agents",
+      async (_req, res, sessionId, runtime) => {
+        res.status(200).json(await runtime.bridge.getSessionAgentsStatus(sessionId));
+      }
+    )
+  );
+  app.get(
+    "/session/:id/agent-trace",
+    withOwnerReadSession(
+      "GET /session/:id/agent-trace",
+      async (req, res, sessionId, runtime) => {
+        const rootAgentId = req.query["rootAgentId"];
+        if (rootAgentId !== void 0 && (typeof rootAgentId !== "string" || rootAgentId.length === 0 || rootAgentId.length > MAX_VIRTUAL_SESSION_ID_PART_LENGTH)) {
+          res.status(400).json({
+            error: "`rootAgentId` must be a non-empty agent id",
+            code: "invalid_root_agent_id"
+          });
+          return;
+        }
+        res.status(200).json(
+          await runtime.bridge.getSessionAgentTrace(sessionId, rootAgentId)
+        );
+      }
+    )
+  );
+  app.get(
+    "/session/:id/saved-workflows/:name",
+    withOwnerReadSession(
+      "GET /session/:id/saved-workflows/:name",
+      async (req, res, sessionId, runtime) => {
+        const name = req.params["name"];
+        if (!name) {
+          res.status(400).json({
+            error: "`name` route parameter is required"
+          });
+          return;
+        }
+        res.status(200).json(
+          runtime.trusted ? await runtime.bridge.getSessionSavedWorkflow(sessionId, name) : { v: 1, sessionId, name, workflow: null }
+        );
+      }
+    )
+  );
   app.get(
     "/session/:id/lsp",
     withOwnerReadSession(
@@ -30878,6 +31674,15 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.get(
+    "/session/:id/resources",
+    withOwnerReadSession(
+      "GET /session/:id/resources",
+      async (_req, res, sessionId, runtime) => {
+        res.status(200).json(await runtime.bridge.getSessionResourcesStatus(sessionId));
+      }
+    )
+  );
   app.get(
     "/session/:id/hooks",
     withOwnerReadSession(
@@ -31187,6 +31992,21 @@ function registerSessionRoutes(app, deps) {
       }
     )
   );
+  app.get(
+    "/session/:id/attachments",
+    withOwnerReadSession(
+      "GET /session/:id/attachments",
+      async (req, res, sessionId, runtime) => {
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const attachments = await runtime.bridge.listSessionAttachments(
+          sessionId,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json({ attachments });
+      }
+    )
+  );
   app.get(
     "/session/:id/attachments/:attachmentId",
     withOwnerReadSession(
@@ -35656,6 +36476,7 @@ var TUI_ONLY_SETTINGS = /* @__PURE__ */ new Set([
   "general.outputLanguage",
   "ide.enabled",
   "ui.showLineNumbers",
+  "ui.showToolCallArgs",
   "ui.renderMode",
   "ui.useTerminalBuffer",
   "ui.mouseTracking",
@@ -35679,13 +36500,15 @@ var QUALIFIED_WRITE_SCOPES = /* @__PURE__ */ new Set(["workspace"]);
 var mcpServerMutationQueues = /* @__PURE__ */ new Map();
 var SECURITY_SENSITIVE_SETTINGS = /* @__PURE__ */ new Set(["tools.approvalMode"]);
 function rejectWorkspaceRestrictedWrite(res, scope, key) {
-  if (scope !== "workspace" || !WORKSPACE_RESTRICTED_SETTING_KEYS.includes(key))
-    return false;
-  res.status(400).json({
-    error: `Setting "${key}" is not honored from workspace scope; set it at user scope instead`,
-    code: "workspace_restricted_setting"
-  });
-  return true;
+  if (scope !== "workspace") return false;
+  if (WORKSPACE_RESTRICTED_SETTING_KEYS.includes(key)) {
+    res.status(400).json({
+      error: `Setting "${key}" is not honored from workspace scope; set it at user scope instead`,
+      code: "workspace_restricted_setting"
+    });
+    return true;
+  }
+  return false;
 }
 __name(rejectWorkspaceRestrictedWrite, "rejectWorkspaceRestrictedWrite");
 function getAllowedKeys(includeLiveVoice = false) {
@@ -36678,6 +37501,14 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     });
     return;
   }
+  if (err instanceof InvalidSessionTranscriptTurnAnchorError) {
+    res.status(400).json({
+      error: err.message,
+      code: "invalid_turn_anchor",
+      ...ctx?.sessionId ? { sessionId: ctx.sessionId } : {}
+    });
+    return;
+  }
   if (err instanceof SessionTranscriptSnapshotUnavailableError) {
     res.status(409).json({
       error: err.message,
@@ -37124,6 +37955,13 @@ function sendBridgeError(res, err, ctx, daemonLog) {
         });
         return;
       }
+      if (kind === "invalid_turn_anchor") {
+        res.status(400).json({
+          error: errorMessage(err),
+          code: "invalid_turn_anchor"
+        });
+        return;
+      }
       if (kind === "transcript_snapshot_unavailable") {
         const d = data;
         res.status(409).json({
@@ -39146,6 +39984,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
         }
         try {
           workspaceRegistry.completeDrain(runtime);
+          deps.onWorkspaceRemoved?.(runtime.workspaceCwd);
         } catch (error2) {
           failures.push(error2);
         }
@@ -40078,6 +40917,7 @@ function registerWorkspaceManagementRoutes(app, deps) {
         }
         try {
           workspaceRegistry.completeDrain(runtime);
+          deps.onWorkspaceRemoved?.(runtime.workspaceCwd);
         } catch (err) {
           logCleanupFailure(
             `qwen serve: failed to complete workspace registry drain: ${err instanceof Error ? err.message : String(err)}`
@@ -43759,6 +44599,48 @@ __name(registerWorkspaceQualifiedToolsRoutes, "registerWorkspaceQualifiedToolsRo
 // packages/cli/src/serve/routes/workspace-skills.ts
 init_esbuild_shims();
 var MAX_WORKSPACE_SKILL_BATCH_SIZE = 100;
+var skillConfigMutationLocks = new PathMutexRegistry();
+function reconcileSkills(runtimes) {
+  let reconciling = false;
+  for (const runtime of runtimes) {
+    runtime.workspaceService.invalidateWorkspaceSkillsStatus();
+    if (!runtime.trusted) continue;
+    const coordinator = getWorkspaceRuntimeCoordinatorIfSupported(runtime);
+    if (coordinator?.reconcileSkillsConfiguration() === "reconciling") {
+      reconciling = true;
+    }
+  }
+  return reconciling ? "reconciling" : "deferred";
+}
+__name(reconcileSkills, "reconcileSkills");
+function rejectQualifiedGlobalScope(scope, res) {
+  if (scope !== "global") return false;
+  res.status(400).json({
+    error: "Global Skill scope must use /workspace/config/skills",
+    code: "global_scope_requires_singular_owner"
+  });
+  return true;
+}
+__name(rejectQualifiedGlobalScope, "rejectQualifiedGlobalScope");
+function rejectSingularWorkspaceScope(scope, res) {
+  if (scope !== "workspace") return false;
+  res.status(400).json({
+    error: "Workspace Skill scope must use /workspaces/:workspace/config/skills",
+    code: "workspace_scope_requires_qualified_workspace"
+  });
+  return true;
+}
+__name(rejectSingularWorkspaceScope, "rejectSingularWorkspaceScope");
+function requireRuntimeCoordinator3(runtime, res) {
+  const coordinator = getWorkspaceRuntimeCoordinatorIfSupported(runtime);
+  if (coordinator) return coordinator;
+  res.status(501).json({
+    error: "Workspace runtime lifecycle is not supported",
+    code: "workspace_runtime_not_supported"
+  });
+  return null;
+}
+__name(requireRuntimeCoordinator3, "requireRuntimeCoordinator");
 function rejectSkillNameTooLong(skillName, res) {
   if (skillName.length <= MAX_WORKSPACE_SKILL_NAME_LENGTH) return false;
   res.status(400).json({
@@ -43891,6 +44773,10 @@ function parseDeleteScope(req, res) {
 }
 __name(parseDeleteScope, "parseDeleteScope");
 function sendSkillManagementError(res, error2) {
+  if (error2 instanceof WorkspaceSkillNotFoundError) {
+    res.status(404).json({ error: error2.message, code: "skill_not_found" });
+    return true;
+  }
   if (!(error2 instanceof WorkspaceSkillManagementError)) return false;
   res.status(error2.statusCode).json({
     error: error2.message,
@@ -43899,10 +44785,179 @@ function sendSkillManagementError(res, error2) {
   return true;
 }
 __name(sendSkillManagementError, "sendSkillManagementError");
+async function deleteConfiguredSkill(deps, workspaceCwd, trusted, skillName, scope) {
+  deps.invalidateSkillsConfigStatus(workspaceCwd);
+  const status = await deps.getSkillsConfigStatus(workspaceCwd, trusted);
+  if (!status.initialized || status.errors?.length) {
+    throw new WorkspaceSkillManagementError(
+      "skills_config_unavailable",
+      "Skills configuration could not be enumerated",
+      503
+    );
+  }
+  const normalizedName = skillName.trim().toLowerCase();
+  const matches = status.skills.filter(
+    (candidate) => candidate.name.trim().toLowerCase() === normalizedName
+  );
+  if (matches.length === 0) {
+    throw new WorkspaceSkillManagementError(
+      "skill_not_found",
+      `Skill not found: ${skillName}`,
+      404
+    );
+  }
+  const expectedLevel = scope === "workspace" ? "project" : "user";
+  const scopedMatches = matches.filter(
+    (candidate) => candidate.level === expectedLevel
+  );
+  const skill = scopedMatches.find((candidate) => candidate.name === skillName.trim()) ?? (scopedMatches.length === 1 ? scopedMatches[0] : void 0);
+  if (!skill?.installedPath) {
+    throw new WorkspaceSkillManagementError(
+      "skill_not_managed",
+      "Skill is not managed in the requested scope",
+      409
+    );
+  }
+  try {
+    return await deps.deleteSkillConfig(
+      workspaceCwd,
+      scope,
+      skill.name,
+      skill.installedPath
+    );
+  } catch (error2) {
+    if (error2.code === "ENOENT") {
+      throw new WorkspaceSkillManagementError(
+        "skill_not_found",
+        `Skill not found: ${skillName}`,
+        404
+      );
+    }
+    throw error2;
+  }
+}
+__name(deleteConfiguredSkill, "deleteConfiguredSkill");
 function registerWorkspaceSkillsRoutes(app, deps) {
   const buildWorkspaceCtx = createBuildWorkspaceCtx(
     deps.workspaceRuntime.workspaceCwd
   );
+  const globalConfigOwner = /* @__PURE__ */ __name(() => {
+    const entry = deps.workspaceRegistry?.primaryEntry;
+    return {
+      workspaceCwd: entry?.workspaceCwd ?? deps.workspaceRuntime.workspaceCwd,
+      trusted: entry ? entry.state === "active" && entry.current?.runtime.trusted === true : deps.workspaceRuntime.trusted
+    };
+  }, "globalConfigOwner");
+  const invalidateGlobalConfigStatus = /* @__PURE__ */ __name((ownerWorkspaceCwd) => {
+    const entries = deps.workspaceRegistry?.listAllEntries();
+    if (!entries) {
+      deps.invalidateSkillsConfigStatus(ownerWorkspaceCwd);
+      return;
+    }
+    for (const entry of entries) {
+      deps.invalidateSkillsConfigStatus(entry.workspaceCwd);
+    }
+  }, "invalidateGlobalConfigStatus");
+  app.get("/workspace/config/skills", async (_req, res) => {
+    const configRoute = "GET /workspace/config/skills";
+    try {
+      const owner = globalConfigOwner();
+      res.status(200).json(
+        await deps.getSkillsConfigStatus(owner.workspaceCwd, owner.trusted)
+      );
+    } catch (error2) {
+      deps.sendBridgeError(res, error2, { route: configRoute });
+    }
+  });
+  app.get("/workspace/runtime/skills", async (_req, res) => {
+    if (!requireTrustedWorkspaceRuntime(deps.workspaceRuntime, res)) return;
+    const runtimeRoute = "GET /workspace/runtime/skills";
+    try {
+      res.status(200).json(
+        await deps.workspaceRuntime.workspaceService.getWorkspaceSkillsRuntimeStatus(
+          buildWorkspaceCtx(runtimeRoute)
+        )
+      );
+    } catch (error2) {
+      deps.sendBridgeError(res, error2, { route: runtimeRoute });
+    }
+  });
+  app.post(
+    "/workspace/config/skills/install",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const owner = globalConfigOwner();
+      if (!owner.trusted) {
+        sendUntrustedWorkspaceResponse(res);
+        return;
+      }
+      const input = parseSkillInstallRequest(req, res, deps.safeBody);
+      if (!input || rejectSingularWorkspaceScope(input.scope, res)) return;
+      const configRoute = "POST /workspace/config/skills/install";
+      try {
+        const result = await skillConfigMutationLocks.runExclusive(
+          `global\0${input.name.trim().toLowerCase()}`,
+          () => deps.installSkillConfig(owner.workspaceCwd, input)
+        );
+        invalidateGlobalConfigStatus(owner.workspaceCwd);
+        const runtimes = deps.workspaceRegistry?.listManaged() ?? [
+          deps.workspaceRuntime
+        ];
+        res.status(200).json({
+          ...result,
+          activation: reconcileSkills(runtimes)
+        });
+      } catch (error2) {
+        invalidateGlobalConfigStatus(owner.workspaceCwd);
+        if (!sendSkillManagementError(res, error2)) {
+          deps.sendBridgeError(res, error2, { route: configRoute });
+        }
+      }
+    }
+  );
+  app.delete(
+    "/workspace/config/skills/:name",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const owner = globalConfigOwner();
+      if (!owner.trusted) {
+        sendUntrustedWorkspaceResponse(res);
+        return;
+      }
+      const scope = parseDeleteScope(req, res);
+      const rawSkillName = req.params["name"];
+      if (!rawSkillName || !scope || rejectSingularWorkspaceScope(scope, res)) {
+        return;
+      }
+      const configRoute = "DELETE /workspace/config/skills/:name";
+      try {
+        const skillName = validateWorkspaceSkillName(rawSkillName);
+        const result = await skillConfigMutationLocks.runExclusive(
+          `global\0${skillName.toLowerCase()}`,
+          () => deleteConfiguredSkill(
+            deps,
+            owner.workspaceCwd,
+            owner.trusted,
+            skillName,
+            scope
+          )
+        );
+        invalidateGlobalConfigStatus(owner.workspaceCwd);
+        const runtimes = deps.workspaceRegistry?.listManaged() ?? [
+          deps.workspaceRuntime
+        ];
+        res.status(200).json({
+          ...result,
+          activation: reconcileSkills(runtimes)
+        });
+      } catch (error2) {
+        invalidateGlobalConfigStatus(owner.workspaceCwd);
+        if (!sendSkillManagementError(res, error2)) {
+          deps.sendBridgeError(res, error2, { route: configRoute });
+        }
+      }
+    }
+  );
   const route = "POST /workspace/skills/:name/enable";
   const batchRoute = "POST /workspace/skills/enable";
   app.post(
@@ -43916,12 +44971,17 @@ function registerWorkspaceSkillsRoutes(app, deps) {
       if (clientId === null) return;
       const installRoute = "POST /workspace/skills/install";
       try {
-        const result = await deps.workspaceRuntime.workspaceService.installWorkspaceSkill(
-          buildWorkspaceCtx(installRoute, clientId),
-          input
+        const result = await skillConfigMutationLocks.runExclusive(
+          input.scope === "global" ? `global\0${input.name.trim().toLowerCase()}` : `workspace\0${deps.workspaceRuntime.workspaceCwd}\0${input.name.trim().toLowerCase()}`,
+          () => deps.workspaceRuntime.workspaceService.installWorkspaceSkill(
+            buildWorkspaceCtx(installRoute, clientId),
+            input
+          )
         );
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         res.status(200).json(result);
       } catch (err) {
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         if (!sendSkillManagementError(res, err))
           deps.sendBridgeError(res, err, { route: installRoute });
       }
@@ -43946,13 +45006,18 @@ function registerWorkspaceSkillsRoutes(app, deps) {
       if (clientId === null) return;
       const deleteRoute = "DELETE /workspace/skills/:name";
       try {
-        const result = await deps.workspaceRuntime.workspaceService.deleteWorkspaceSkill(
-          buildWorkspaceCtx(deleteRoute, clientId),
-          skillName,
-          scope
+        const result = await skillConfigMutationLocks.runExclusive(
+          scope === "global" ? `global\0${skillName.toLowerCase()}` : `workspace\0${deps.workspaceRuntime.workspaceCwd}\0${skillName.toLowerCase()}`,
+          () => deps.workspaceRuntime.workspaceService.deleteWorkspaceSkill(
+            buildWorkspaceCtx(deleteRoute, clientId),
+            skillName,
+            scope
+          )
         );
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         res.status(200).json(result);
       } catch (err) {
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         if (!sendSkillManagementError(res, err))
           deps.sendBridgeError(res, err, { route: deleteRoute });
       }
@@ -43973,8 +45038,10 @@ function registerWorkspaceSkillsRoutes(app, deps) {
           input.skillNames,
           input.enabled
         );
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         res.status(200).json(result);
       } catch (err) {
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         deps.sendBridgeError(res, err, { route: batchRoute });
       }
     }
@@ -43994,8 +45061,10 @@ function registerWorkspaceSkillsRoutes(app, deps) {
           input.skillName,
           input.enabled
         );
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         res.status(200).json(result);
       } catch (err) {
+        invalidateGlobalConfigStatus(deps.workspaceRuntime.workspaceCwd);
         deps.sendBridgeError(res, err, { route });
       }
     }
@@ -44003,6 +45072,179 @@ function registerWorkspaceSkillsRoutes(app, deps) {
 }
 __name(registerWorkspaceSkillsRoutes, "registerWorkspaceSkillsRoutes");
 function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
+  const invalidateConfigStatus = /* @__PURE__ */ __name((runtime, scope = "workspace") => {
+    if (scope === "workspace") {
+      deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+      return;
+    }
+    for (const entry of deps.workspaceRegistry.listAllEntries()) {
+      deps.invalidateSkillsConfigStatus(entry.workspaceCwd);
+    }
+  }, "invalidateConfigStatus");
+  app.get("/workspaces/:workspace/config/skills", async (req, res) => {
+    const entry = resolveWorkspaceEntryFromParam(
+      deps.workspaceRegistry,
+      req,
+      res
+    );
+    if (!entry) return;
+    const configRoute = "GET /workspaces/:workspace/config/skills";
+    try {
+      res.status(200).json(
+        await deps.getSkillsConfigStatus(
+          entry.workspaceCwd,
+          entry.state === "active" && entry.current?.runtime.trusted === true
+        )
+      );
+    } catch (error2) {
+      deps.sendBridgeError(res, error2, { route: configRoute });
+    }
+  });
+  app.get("/workspaces/:workspace/runtime/skills", async (req, res) => {
+    const runtime = resolveWorkspaceRuntimeFromParam(
+      deps.workspaceRegistry,
+      req,
+      res
+    );
+    if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+    const runtimeRoute = "GET /workspaces/:workspace/runtime/skills";
+    try {
+      res.status(200).json(
+        await runtime.workspaceService.getWorkspaceSkillsRuntimeStatus(
+          createBuildWorkspaceCtx(runtime.workspaceCwd)(runtimeRoute)
+        )
+      );
+    } catch (error2) {
+      deps.sendBridgeError(res, error2, { route: runtimeRoute });
+    }
+  });
+  app.post(
+    "/workspaces/:workspace/config/skills/install",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      const input = parseSkillInstallRequest(req, res, deps.safeBody);
+      if (!input || rejectQualifiedGlobalScope(input.scope, res)) return;
+      const coordinator = requireRuntimeCoordinator3(runtime, res);
+      if (!coordinator) return;
+      const configRoute = "POST /workspaces/:workspace/config/skills/install";
+      try {
+        const result = await skillConfigMutationLocks.runExclusive(
+          `workspace\0${runtime.workspaceCwd}\0${input.name.trim().toLowerCase()}`,
+          () => coordinator.runManagementOperation(
+            () => runtime.workspaceService.installWorkspaceSkill(
+              createBuildWorkspaceCtx(runtime.workspaceCwd)(configRoute),
+              input,
+              { refreshRuntime: false }
+            )
+          )
+        );
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        res.status(200).json({
+          ...result,
+          activation: reconcileSkills([runtime])
+        });
+      } catch (error2) {
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        if (!sendSkillManagementError(res, error2)) {
+          deps.sendBridgeError(res, error2, { route: configRoute });
+        }
+      }
+    }
+  );
+  app.delete(
+    "/workspaces/:workspace/config/skills/:name",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      const scope = parseDeleteScope(req, res);
+      const rawSkillName = req.params["name"];
+      if (!rawSkillName || !scope || rejectQualifiedGlobalScope(scope, res)) {
+        return;
+      }
+      const coordinator = requireRuntimeCoordinator3(runtime, res);
+      if (!coordinator) return;
+      const configRoute = "DELETE /workspaces/:workspace/config/skills/:name";
+      try {
+        const skillName = validateWorkspaceSkillName(rawSkillName);
+        const result = await skillConfigMutationLocks.runExclusive(
+          `workspace\0${runtime.workspaceCwd}\0${skillName.toLowerCase()}`,
+          () => coordinator.runManagementOperation(
+            () => runtime.workspaceService.deleteWorkspaceSkill(
+              createBuildWorkspaceCtx(runtime.workspaceCwd)(configRoute),
+              skillName,
+              scope,
+              { refreshRuntime: false }
+            )
+          )
+        );
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        res.status(200).json({
+          ...result,
+          activation: reconcileSkills([runtime])
+        });
+      } catch (error2) {
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        if (!sendSkillManagementError(res, error2)) {
+          deps.sendBridgeError(res, error2, { route: configRoute });
+        }
+      }
+    }
+  );
+  app.post(
+    "/workspaces/:workspace/config/skills/:name/enable",
+    deps.mutate({ strict: true }),
+    async (req, res) => {
+      const runtime = resolveWorkspaceRuntimeFromParam(
+        deps.workspaceRegistry,
+        req,
+        res
+      );
+      if (!runtime || !requireTrustedWorkspaceRuntime(runtime, res)) return;
+      const input = parseSkillToggleRequest(req, res, deps.safeBody);
+      if (!input) return;
+      const clientId = parseAndValidateWorkspaceClientId(
+        req,
+        res,
+        runtime.bridge
+      );
+      if (clientId === null) return;
+      const coordinator = requireRuntimeCoordinator3(runtime, res);
+      if (!coordinator) return;
+      const configRoute = "POST /workspaces/:workspace/config/skills/:name/enable";
+      try {
+        const result = await coordinator.runManagementOperation(
+          () => runtime.workspaceService.setWorkspaceSkillEnabled(
+            createBuildWorkspaceCtx(runtime.workspaceCwd)(
+              configRoute,
+              clientId
+            ),
+            input.skillName,
+            input.enabled,
+            { refreshRuntime: false }
+          )
+        );
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        res.status(200).json({
+          ...result,
+          activation: result.changed ? reconcileSkills([runtime]) : result.activation
+        });
+      } catch (error2) {
+        deps.invalidateSkillsConfigStatus(runtime.workspaceCwd);
+        deps.sendBridgeError(res, error2, { route: configRoute });
+      }
+    }
+  );
   const route = "POST /workspaces/:workspace/skills/:name/enable";
   const batchRoute = "POST /workspaces/:workspace/skills/enable";
   app.post(
@@ -44025,12 +45267,20 @@ function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
       if (clientId === null) return;
       const installRoute = "POST /workspaces/:workspace/skills/install";
       try {
-        const result = await runtime.workspaceService.installWorkspaceSkill(
-          createBuildWorkspaceCtx(runtime.workspaceCwd)(installRoute, clientId),
-          input
+        const result = await skillConfigMutationLocks.runExclusive(
+          input.scope === "global" ? `global\0${input.name.trim().toLowerCase()}` : `workspace\0${runtime.workspaceCwd}\0${input.name.trim().toLowerCase()}`,
+          () => runtime.workspaceService.installWorkspaceSkill(
+            createBuildWorkspaceCtx(runtime.workspaceCwd)(
+              installRoute,
+              clientId
+            ),
+            input
+          )
         );
+        invalidateConfigStatus(runtime, input.scope);
         res.status(200).json(result);
       } catch (err) {
+        invalidateConfigStatus(runtime, input.scope);
         if (!sendSkillManagementError(res, err))
           deps.sendBridgeError(res, err, { route: installRoute });
       }
@@ -44064,13 +45314,21 @@ function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
       if (clientId === null) return;
       const deleteRoute = "DELETE /workspaces/:workspace/skills/:name";
       try {
-        const result = await runtime.workspaceService.deleteWorkspaceSkill(
-          createBuildWorkspaceCtx(runtime.workspaceCwd)(deleteRoute, clientId),
-          skillName,
-          scope
+        const result = await skillConfigMutationLocks.runExclusive(
+          scope === "global" ? `global\0${skillName.toLowerCase()}` : `workspace\0${runtime.workspaceCwd}\0${skillName.toLowerCase()}`,
+          () => runtime.workspaceService.deleteWorkspaceSkill(
+            createBuildWorkspaceCtx(runtime.workspaceCwd)(
+              deleteRoute,
+              clientId
+            ),
+            skillName,
+            scope
+          )
         );
+        invalidateConfigStatus(runtime, scope);
         res.status(200).json(result);
       } catch (err) {
+        invalidateConfigStatus(runtime, scope);
         if (!sendSkillManagementError(res, err))
           deps.sendBridgeError(res, err, { route: deleteRoute });
       }
@@ -44100,8 +45358,10 @@ function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
           input.skillNames,
           input.enabled
         );
+        invalidateConfigStatus(runtime);
         res.status(200).json(result);
       } catch (err) {
+        invalidateConfigStatus(runtime);
         deps.sendBridgeError(res, err, { route: batchRoute });
       }
     }
@@ -44130,8 +45390,10 @@ function registerWorkspaceQualifiedSkillsRoutes(app, deps) {
           input.skillName,
           input.enabled
         );
+        invalidateConfigStatus(runtime);
         res.status(200).json(result);
       } catch (err) {
+        invalidateConfigStatus(runtime);
         deps.sendBridgeError(res, err, { route });
       }
     }
@@ -50860,10 +52122,13 @@ var ConversationRuntimeManager = class {
   runtime;
   pending;
   terminalRuntime;
+  terminalError;
   quarantinePromise;
   ensure() {
     if (this.terminalRuntime) {
-      return Promise.reject(conversationRuntimeUnavailableError());
+      return Promise.reject(
+        this.terminalError ?? conversationRuntimeUnavailableError()
+      );
     }
     if (this.pending) return this.pending;
     const pending = this.ensureOnce().finally(() => {
@@ -50884,12 +52149,17 @@ var ConversationRuntimeManager = class {
     if (this.terminalRuntime === expectedRuntime && this.quarantinePromise) {
       return this.quarantinePromise;
     }
-    if (this.terminalRuntime) throw conversationRuntimeUnavailableError();
+    if (this.terminalRuntime) {
+      throw this.terminalError ?? conversationRuntimeUnavailableError();
+    }
     if (this.runtime !== expectedRuntime) {
       throw conversationRuntimeUnavailableError();
     }
     this.assertActiveRuntime(expectedRuntime.workspaceCwd, expectedRuntime);
     this.terminalRuntime = expectedRuntime;
+    if (reason === "missing_mandatory_lease_attestation") {
+      this.terminalError = conversationRootCompromisedError();
+    }
     try {
       this.options.onTerminalQuarantine?.(expectedRuntime, reason);
     } catch {
@@ -50930,6 +52200,15 @@ var ConversationRuntimeManager = class {
       await this.assertExactRoot(existing.workspaceCwd);
       this.assertActiveRuntime(root.canonicalRoot, existing);
       this.runtime = existing;
+      try {
+        this.assertMandatoryLeaseAttestation(existing);
+      } catch (error2) {
+        await this.quarantine(
+          existing,
+          "missing_mandatory_lease_attestation"
+        ).catch(() => void 0);
+        throw error2;
+      }
       this.assertNotTerminal();
       return existing;
     }
@@ -50940,6 +52219,7 @@ var ConversationRuntimeManager = class {
         async (candidate) => {
           await this.assertExactRoot(candidate.workspaceCwd);
           this.assertOwnedRuntime(candidate);
+          this.assertMandatoryLeaseAttestation(candidate);
         }
       );
     } catch (error2) {
@@ -50952,7 +52232,9 @@ var ConversationRuntimeManager = class {
     return created;
   }
   assertNotTerminal() {
-    if (this.terminalRuntime) throw conversationRuntimeUnavailableError();
+    if (this.terminalRuntime) {
+      throw this.terminalError ?? conversationRuntimeUnavailableError();
+    }
   }
   async revalidateRoot() {
     try {
@@ -50980,6 +52262,11 @@ var ConversationRuntimeManager = class {
       throw conversationRootCompromisedError();
     }
   }
+  assertMandatoryLeaseAttestation(runtime) {
+    if (runtime.bridge.mandatoryLeaseAttested !== true) {
+      throw conversationRootCompromisedError();
+    }
+  }
 };
 
 // packages/cli/src/serve/server.ts
@@ -51180,6 +52467,21 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   const primaryEffectiveEnv = getRuntimeEffectiveEnv(primaryRuntimeEnvMetadata);
   const daemonEnv = deps.daemonEnv ?? process.env;
   const daemonEnvAtBoot = Object.freeze({ ...daemonEnv });
+  const trustedSkillsConfigStatus = createWorkspaceSkillsStatusProvider({
+    workspaceTrusted: true
+  });
+  const untrustedSkillsConfigStatus = createWorkspaceSkillsStatusProvider({
+    workspaceTrusted: false,
+    includeUntrustedSkills: true
+  });
+  const getSkillsConfigStatus = /* @__PURE__ */ __name((workspaceCwd, trusted) => {
+    const provider = trusted ? trustedSkillsConfigStatus : untrustedSkillsConfigStatus;
+    return provider(workspaceCwd);
+  }, "getSkillsConfigStatus");
+  const invalidateSkillsConfigStatus = /* @__PURE__ */ __name((workspaceCwd) => {
+    trustedSkillsConfigStatus.invalidate?.(workspaceCwd);
+    untrustedSkillsConfigStatus.invalidate?.(workspaceCwd);
+  }, "invalidateSkillsConfigStatus");
   const webTerminalRegistry = new WebTerminalRegistry();
   const webTerminalLocals = app.locals;
   webTerminalLocals.stopWebTerminalRegistry = () => webTerminalRegistry.dispose();
@@ -52439,6 +53741,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     workspaceRegistrationStore: deps.workspaceRegistrationStore,
     getAcpHandle: /* @__PURE__ */ __name(() => acpHandleRef.current, "getAcpHandle"),
     runtimeRemoval: deps.workspaceRuntimeRemoval,
+    onWorkspaceRemoved: invalidateSkillsConfigStatus,
     ...deps.liveConversationWorkspace ? { reservedWorkspaceRoots: [deps.liveConversationWorkspace.rootPath] } : {}
   });
   app.locals.workspaceManagementHandle = workspaceManagementHandle;
@@ -52760,16 +54063,34 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   });
   registerWorkspaceSkillsRoutes(app, {
     workspaceRuntime: primaryRuntime,
+    workspaceRegistry,
     mutate,
     safeBody,
     sendBridgeError: sendBridgeError2,
+    getSkillsConfigStatus,
+    invalidateSkillsConfigStatus,
+    installSkillConfig: /* @__PURE__ */ __name((workspaceCwd, request2) => installWorkspaceSkill(
+      workspaceCwd,
+      request2,
+      primaryEffectiveEnv?.["GH_TOKEN"] ?? primaryEffectiveEnv?.["GITHUB_TOKEN"] ?? daemonEnvAtBoot["GH_TOKEN"] ?? daemonEnvAtBoot["GITHUB_TOKEN"],
+      capturePrimaryGenerationAssertion()
+    ), "installSkillConfig"),
+    deleteSkillConfig: /* @__PURE__ */ __name((workspaceCwd, scope, skillName, installedPath) => deleteWorkspaceSkill(
+      workspaceCwd,
+      scope,
+      skillName,
+      installedPath,
+      capturePrimaryGenerationAssertion()
+    ), "deleteSkillConfig"),
     parseAndValidateClientId: /* @__PURE__ */ __name((req, res) => parseAndValidateWorkspaceClientId(req, res, primaryBridge), "parseAndValidateClientId")
   });
   registerWorkspaceQualifiedSkillsRoutes(app, {
     workspaceRegistry,
     mutate,
     safeBody,
-    sendBridgeError: sendBridgeError2
+    sendBridgeError: sendBridgeError2,
+    getSkillsConfigStatus,
+    invalidateSkillsConfigStatus
   });
   registerScheduledTasksRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,