@qwen-code/qwen-code 0.23.1 → 0.23.2-nightly.20260909.2e212144d3

package/chunks/{server-YPNTJLX2.js → server-6RZJR5QF.js}

@@ -20,7 +20,7 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-XZ3Z43XL.js";
+} from "./chunk-FEEVHJOR.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -32,7 +32,7 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-TWWS7XUW.js";
+} from "./chunk-HWLLUDIA.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
@@ -52,6 +52,7 @@ import {
   ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_GLOBAL,
   ACP_PRE_ATTACH_MAX_PAYLOAD_BYTES_PER_CONNECTION,
   AcpPreAttachBudget,
+  AmbiguousLanInterfaceError,
   CAPABILITIES_SCHEMA_VERSION,
   ClientMcpSenderRegistry,
   CredentialStore,
@@ -60,9 +61,11 @@ import {
   MAX_CONCURRENT_VOICE_SESSIONS,
   MutableOriginAllowlist,
   NativeDirectoryPickerUnavailableError,
+  NoLanInterfaceError,
   PathMutexRegistry,
   QWEN_CDP_MCP_COMMAND_ENV,
   TooManyActiveDeviceFlowsError,
+  UnknownLanInterfaceError,
   UnsupportedDeviceFlowProviderError,
   UpstreamDeviceFlowError,
   VoiceLeaseAbortError,
@@ -84,6 +87,7 @@ import {
   getServeProtocolVersions,
   hostAllowlist,
   installAccessLogMiddleware,
+  installRemoteSelfOriginMiddleware,
   installSelfOriginStripMiddleware,
   installServeAppLifecycle,
   isBrowserAutomationMcpAvailable,
@@ -93,6 +97,7 @@ import {
   isNativeDirectoryPickerAvailable,
   isScratchRootCompatible,
   isTrustedLoopbackMode,
+  listLanCandidates,
   listenerIdentityOf,
   listenerIdentityOfSocket,
   openPathLocally,
@@ -104,12 +109,13 @@ import {
   resolveAcpHttpEnabled,
   resolveCdpMcpCommand,
   sanitizeForStderr,
+  selectLanAddress,
   setDeviceFlowRegistry,
   setRateLimiter,
   singleTokenCredentials,
   tagListener,
   unsafeRevealSecret
-} from "./chunk-M73KHGNR.js";
+} from "./chunk-VJJXG73H.js";
 import {
   ConversationDirectoryIdentityError,
   getConversationDirectoryName,
@@ -123,7 +129,7 @@ import {
 } from "./chunk-YI2YCNSP.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-LZGFVUWZ.js";
+} from "./chunk-UQOP2APG.js";
 import {
   AONE_MAX_MR_VIEW_CALLS_PER_RUN,
   DaemonDrainingError,
@@ -152,7 +158,7 @@ import {
   runWithWorkspaceRuntimeStorage,
   searchWorkspaceSessionsForResponse,
   unarchiveDaemonSessions
-} from "./chunk-ZPL2TZNA.js";
+} from "./chunk-7KZVXJ4U.js";
 import {
   LIVE_SESSION_SOURCE_PREFIX,
   isCompatibleLiveSessionSource,
@@ -192,10 +198,10 @@ import {
   isServeDebugMode,
   mountWebShellAssets,
   mountWebShellSpaFallback
-} from "./chunk-NFIDVZND.js";
+} from "./chunk-QB3KS3N3.js";
 import {
   require_express
-} from "./chunk-IRKQ4YYX.js";
+} from "./chunk-SVWWF5TZ.js";
 import "./chunk-FBX2SDQ4.js";
 import {
   formatHostForAuthority,
@@ -204,12 +210,12 @@ import {
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-EOET4H7C.js";
+} from "./chunk-EE5ZD4XU.js";
 import {
   readRecentPromptTerminals,
   reconcileDanglingPromptTerminals,
   withPromptTerminals
-} from "./chunk-IKG2YVRZ.js";
+} from "./chunk-BZUHZCUO.js";
 import {
   WorkspaceGenerationClosedError,
   createSingleWorkspaceRegistry,
@@ -240,11 +246,11 @@ import {
   sendUntrustedWorkspaceResponse,
   sendWorkspaceRuntimeUnavailable,
   setWorkspaceRouteContext
-} from "./chunk-B3EL44K3.js";
+} from "./chunk-EN3Q2S3J.js";
 import {
   normalizeChannelDelivery,
   parseChannelDelivery
-} from "./chunk-WAASYFPK.js";
+} from "./chunk-VJWJOKOQ.js";
 import {
   isValidSessionId,
   normalizeSessionIdForLookup,
@@ -281,14 +287,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-FWRRUITH.js";
+} from "./chunk-7WCJEY3A.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-CHVU543W.js";
+} from "./chunk-FN4KHWCL.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -305,9 +311,9 @@ import {
 import "./chunk-Y53DG2HA.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-OESZTXTG.js";
-import "./chunk-5IL2BZHW.js";
-import "./chunk-6QILGINT.js";
+} from "./chunk-E4LXNQAK.js";
+import "./chunk-O6BFERWN.js";
+import "./chunk-LOBKNYPR.js";
 import "./chunk-JS73NNWF.js";
 import {
   SessionArtifactAuthorizationError,
@@ -316,7 +322,7 @@ import {
   extractErrorCode,
   extractErrorMessage,
   parseSessionSource
-} from "./chunk-2TMJRF46.js";
+} from "./chunk-ZZ7RVOTU.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -329,21 +335,21 @@ import {
 } from "./chunk-KA5HR3G2.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-DO5SMV52.js";
+} from "./chunk-D7DFZAK2.js";
 import {
   PERSIST_REASONING_SELECTION_META_KEY,
   REASONING_SELECTION_PERSISTED_META_KEY
-} from "./chunk-JGDRB4FP.js";
+} from "./chunk-N3Z6Q7KC.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-ARYNBBBM.js";
+} from "./chunk-6GAYNM3F.js";
 import {
   snapshotProcessEnv
 } from "./chunk-6RZX2HIH.js";
 import {
   createWorkspaceSkillsStatusProvider
-} from "./chunk-QK4K76T6.js";
+} from "./chunk-MUF4UGPB.js";
 import "./chunk-BHTYRHJF.js";
 import {
   BridgeTimeoutError,
@@ -362,20 +368,20 @@ import {
   WorkspaceSkillNotFoundError,
   mapWorkspaceSkillToggleError
 } from "./chunk-FTJMWDND.js";
-import "./chunk-5WC2ECUK.js";
+import "./chunk-KECCLCXM.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-DZ6D4B3K.js";
-import "./chunk-EEKU6COG.js";
+} from "./chunk-EDSU3VUG.js";
+import "./chunk-6S7YYUUH.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-UXDVUFKU.js";
+} from "./chunk-JFAGT5YG.js";
 import {
   supportedChannelCatalog
-} from "./chunk-UHUT4IDM.js";
-import "./chunk-3BTHHXXE.js";
+} from "./chunk-7IDZFJAV.js";
+import "./chunk-AUTUFD5X.js";
 import "./chunk-V6WHFGST.js";
 import {
   assertLiveDiscoveryPublisher,
@@ -401,7 +407,7 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-QZOXVQPK.js";
+} from "./chunk-AXWTG6R7.js";
 import {
   CHANNEL_PROMPT_META_KEY,
   DAEMON_PROMPT_DISPLAY_TEXT_META_KEY,
@@ -464,7 +470,7 @@ import {
 } from "./chunk-STUJ7IMZ.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-GM44O6F7.js";
+} from "./chunk-DARWOZY6.js";
 import {
   QWEN_SERVER_TOKEN_ENV
 } from "./chunk-GYTKQYDB.js";
@@ -480,11 +486,11 @@ import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import "./chunk-3VUENPWF.js";
+import "./chunk-TGNNLRC3.js";
 import {
   sanitizeLogText
-} from "./chunk-XVTCSVBK.js";
+} from "./chunk-WDVV3LRM.js";
 import "./chunk-IW6RQPQB.js";
-import "./chunk-5HBA2Z7V.js";
 import {
   WORKSPACE_RESTRICTED_SETTING_KEYS,
   getDialogSettingKeys,
@@ -497,8 +503,8 @@ import {
   resolveOutputLanguageOrPreserveAuto,
   updateOutputLanguageFile,
   validateSettingValue
-} from "./chunk-66JBCTJF.js";
-import "./chunk-2ZFO5JD7.js";
+} from "./chunk-Y7YHAY32.js";
+import "./chunk-LOVGQ3HZ.js";
 import "./chunk-RKUWKYED.js";
 import "./chunk-BW4333PP.js";
 import "./chunk-IDS7MSUP.js";
@@ -512,19 +518,18 @@ import {
   SUPPORTED_LANGUAGES,
   resolveSupportedLanguage
 } from "./chunk-5EJZE3FP.js";
-import "./chunk-5CVY5Q2P.js";
+import "./chunk-43EUMPKQ.js";
 import "./chunk-QTNCGZHQ.js";
-import "./chunk-27LTEY6D.js";
+import "./chunk-ATBLEXXV.js";
 import "./chunk-W3N5XAZ6.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-3VDLQUR2.js";
+} from "./chunk-D6AGS266.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
   isWithinRoot as isWithinRoot2
 } from "./chunk-MR3PXB6E.js";
 import {
-  ALL_PROVIDERS,
   BTW_MAX_INPUT_LENGTH,
   ClientMcpRegistrar,
   IMAGE_CAPABILITY,
@@ -533,12 +538,11 @@ import {
   WorkspaceMemoryWriteTimeoutError,
   buildUsageDashboard,
   loadIgnoreRules,
-  shouldShowStep,
   writeWorkspaceContextFile
-} from "./chunk-ZU2T5JIS.js";
+} from "./chunk-ZEFWBG2C.js";
 import "./chunk-GELRJXE2.js";
 import "./chunk-32CM56LO.js";
-import "./chunk-WJDXKQIO.js";
+import "./chunk-3A2IMUDH.js";
 import "./chunk-2EKVPSIJ.js";
 import "./chunk-LJZSMWOH.js";
 import {
@@ -547,13 +551,17 @@ import {
   readWorktreeSessionStrict,
   writeWorktreeSession
 } from "./chunk-YZTGGCEE.js";
-import "./chunk-6SADVYQQ.js";
+import {
+  ALL_PROVIDERS,
+  shouldShowStep
+} from "./chunk-PLEBBGHL.js";
+import "./chunk-JGTMTJSQ.js";
 import "./chunk-DJXSOEFB.js";
-import "./chunk-25CBAK3H.js";
+import "./chunk-LKBOBUA2.js";
 import "./chunk-J3VZF2AL.js";
 import "./chunk-OWCFKIFQ.js";
 import "./chunk-ZPJWUGCS.js";
-import "./chunk-5Z4FCEPY.js";
+import "./chunk-7K4GGN3D.js";
 import "./chunk-BUQN5LTI.js";
 import {
   QwenOAuth2Client,
@@ -564,7 +572,7 @@ import {
   isDeviceTokenPending,
   isDeviceTokenSuccess
 } from "./chunk-XDNFODER.js";
-import "./chunk-YAC7H4K3.js";
+import "./chunk-SM66GFKJ.js";
 import "./chunk-VNOVK4I7.js";
 import {
   BuiltinAgentRegistry,
@@ -648,15 +656,15 @@ import {
   toSessionPrInfo,
   upsertSessionPr,
   watchRepoBranch
-} from "./chunk-PDUMGZ2P.js";
+} from "./chunk-BDAVT6K2.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-65I7S4Z3.js";
 import "./chunk-6HUXPLB5.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-YHDGABDC.js";
+import "./chunk-XKBFYTCD.js";
 import "./chunk-LYT2OU7D.js";
-import "./chunk-B54PFQS5.js";
+import "./chunk-7CLLH5TI.js";
 import {
   GitWorktreeService,
   WorktreeMarkerCommittedError,
@@ -666,7 +674,7 @@ import {
 } from "./chunk-HIXUUCGY.js";
 import "./chunk-6PVPNMXU.js";
 import "./chunk-565U2ANU.js";
-import "./chunk-FDOGGKAA.js";
+import "./chunk-GSFV5RQW.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
 import {
@@ -683,8 +691,8 @@ import "./chunk-N6S3NUYJ.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-CHEIIBT3.js";
 import "./chunk-QAZ2MGYT.js";
-import "./chunk-B44JBZBB.js";
-import "./chunk-BF3RUIVP.js";
+import "./chunk-F4SAL7WM.js";
+import "./chunk-CH2YDT6X.js";
 import {
   APPROVAL_MODES
 } from "./chunk-JX6XHPTX.js";
@@ -696,12 +704,12 @@ import {
 import "./chunk-ZSTCM3MX.js";
 import "./chunk-SOA4HKRJ.js";
 import "./chunk-MLXTMF7H.js";
-import "./chunk-3LPJ776W.js";
+import "./chunk-2HYOOFDS.js";
 import {
   findGitRoot
 } from "./chunk-3CZ2BQV6.js";
 import "./chunk-PQEISIKS.js";
-import "./chunk-VF6D6EGV.js";
+import "./chunk-HSO6D4KX.js";
 import "./chunk-H3Q3RSKZ.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-NAVJD2PQ.js";
@@ -709,7 +717,7 @@ import "./chunk-OFVAS4AR.js";
 import "./chunk-HNLMYDQE.js";
 import "./chunk-QHMLYMMS.js";
 import "./chunk-CFKIH3D3.js";
-import "./chunk-6YEOCHSE.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-DJ2GSRLV.js";
 import "./chunk-4ALNJDHL.js";
 import "./chunk-NOO4QFXM.js";
@@ -730,9 +738,9 @@ import "./chunk-XWRJCPHC.js";
 import {
   parseLineTolerant,
   read
-} from "./chunk-6QV7Z74P.js";
+} from "./chunk-FRS3P7MQ.js";
 import "./chunk-5ETULJLP.js";
-import "./chunk-XBVNNDPK.js";
+import "./chunk-GSYD7MYP.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   CursorNotAtLineBoundaryError,
@@ -746,9 +754,9 @@ import {
 import "./chunk-EDIDYZBT.js";
 import "./chunk-HD7O6WLV.js";
 import "./chunk-WZAD4ZNJ.js";
-import "./chunk-FPGTNKCP.js";
+import "./chunk-F3M6P6IQ.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-N7YQEKGX.js";
+import "./chunk-EOLGAQ25.js";
 import "./chunk-XFFRI3WM.js";
 import "./chunk-4HOEU2OR.js";
 import "./chunk-HHJLM3WQ.js";
@@ -808,93 +816,6 @@ import * as path18 from "node:path";
 // packages/cli/src/serve/local-control/index.ts
 init_esbuild_shims();
 
-// packages/cli/src/serve/local-control/lan-interfaces.ts
-init_esbuild_shims();
-import { networkInterfaces } from "node:os";
-function isLanIpv4(address) {
-  const octets = address.split(".").map((part) => Number(part));
-  if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o))) {
-    return false;
-  }
-  const [a, b] = octets;
-  if (a === 10) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 169 && b === 254) return true;
-  return false;
-}
-__name(isLanIpv4, "isLanIpv4");
-function isSoftwareNetwork(interfaceName) {
-  if (/vpn/i.test(interfaceName)) return true;
-  return /(^|[\s_.-])(utun|tun|tap|ppp|ipsec|wg|wireguard|tailscale|zerotier|zt[a-z0-9]*|hamachi|nordlynx|proton|wintun|docker|veth[0-9a-f]+|vmnet|vboxnet|vethernet|virtualbox|host[- ]only|podman|cni|lxcbr|lxdbr|flannel|virbr|br-[0-9a-f]+|bridge\d|anyconnect|globalprotect|pulse[\s-]secure|forticlient|fortinet|ivanti|cisco[\s_-]secure|citrix|sonicwall|cloudflare)(\d|[\s_.-]|$)/i.test(
-    interfaceName
-  );
-}
-__name(isSoftwareNetwork, "isSoftwareNetwork");
-function listLanCandidates(interfaces = networkInterfaces()) {
-  const candidates = [];
-  for (const [interfaceName, addresses] of Object.entries(interfaces).sort()) {
-    if (isSoftwareNetwork(interfaceName)) continue;
-    for (const address of addresses ?? []) {
-      if (address.family !== "IPv4" || address.internal) continue;
-      if (!isLanIpv4(address.address)) continue;
-      candidates.push({ interfaceName, address: address.address });
-    }
-  }
-  return candidates;
-}
-__name(listLanCandidates, "listLanCandidates");
-var NoLanInterfaceError = class extends Error {
-  static {
-    __name(this, "NoLanInterfaceError");
-  }
-  code = "no_lan_interface";
-  constructor() {
-    super(
-      "No private IPv4 address is available. Local Control needs the host to be on a local network (Wi-Fi or Ethernet)."
-    );
-    this.name = "NoLanInterfaceError";
-  }
-};
-var AmbiguousLanInterfaceError = class extends Error {
-  static {
-    __name(this, "AmbiguousLanInterfaceError");
-  }
-  code = "ambiguous_lan_interface";
-  candidates;
-  constructor(candidates) {
-    super(
-      "Multiple local networks are available; choose which one to expose: " + candidates.map((c) => `${c.interfaceName} (${c.address})`).join(", ")
-    );
-    this.name = "AmbiguousLanInterfaceError";
-    this.candidates = candidates;
-  }
-};
-var UnknownLanInterfaceError = class extends Error {
-  static {
-    __name(this, "UnknownLanInterfaceError");
-  }
-  code = "unknown_lan_interface";
-  constructor(requested) {
-    super(
-      `${requested} is not a private IPv4 address on this host right now. The network may have changed since the list was fetched.`
-    );
-    this.name = "UnknownLanInterfaceError";
-  }
-};
-function selectLanAddress(preferredAddress, interfaces = networkInterfaces()) {
-  const candidates = listLanCandidates(interfaces);
-  if (candidates.length === 0) throw new NoLanInterfaceError();
-  if (preferredAddress !== void 0) {
-    const match = candidates.find((c) => c.address === preferredAddress);
-    if (!match) throw new UnknownLanInterfaceError(preferredAddress);
-    return match;
-  }
-  if (candidates.length > 1) throw new AmbiguousLanInterfaceError(candidates);
-  return candidates[0];
-}
-__name(selectLanAddress, "selectLanAddress");
-
 // packages/cli/src/serve/local-control/service.ts
 init_esbuild_shims();
 import { randomBytes, randomUUID } from "node:crypto";
@@ -34200,6 +34121,7 @@ function registerSessionRoutes(app, deps) {
         const body = safeBody(req);
         const mode = body["mode"];
         const persist = body["persist"];
+        const planMode = body["planMode"];
         if (typeof mode !== "string" || !APPROVAL_MODES.includes(mode)) {
           res.status(400).json({
             error: "`mode` is required and must be one of the allowed values",
@@ -34215,12 +34137,22 @@ function registerSessionRoutes(app, deps) {
           });
           return;
         }
+        if (planMode !== void 0 && (typeof planMode !== "boolean" || mode === "plan")) {
+          res.status(400).json({
+            error: "`planMode` must be a boolean with a non-plan execution mode",
+            code: "invalid_plan_mode"
+          });
+          return;
+        }
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
         const response = await runtime.bridge.setSessionApprovalMode(
           sessionId,
           mode,
-          { persist: persist === true },
+          {
+            persist: persist === true,
+            ...typeof planMode === "boolean" ? { planMode } : {}
+          },
           clientId !== void 0 ? { clientId } : void 0
         );
         res.status(200).json(response);
@@ -38367,6 +38299,8 @@ function registerSseEventsRoutes(app, deps) {
     }, "emitLifecycleLog");
     let slowWarningCount = 0;
     let eventBusEvictionReason;
+    let closeReason;
+    let terminalEventType;
     const onSubscriberDiagnostic = /* @__PURE__ */ __name((diagnostic) => {
       const triggerEventType = boundedDiagnosticString(
         diagnostic.data.triggerEventType
@@ -38463,6 +38397,22 @@ function registerSseEventsRoutes(app, deps) {
             } : {}
           }
         );
+        closeReason = "event_bus_evicted";
+        terminalEventType = "client_evicted";
+        const evictionData = { ...diagnostic.data };
+        Reflect.deleteProperty(evictionData, "triggerEventType");
+        Reflect.deleteProperty(evictionData, "triggerEventBytes");
+        try {
+          res.write(
+            formatSseFrame({
+              v: 1,
+              type: "client_evicted",
+              data: evictionData
+            })
+          );
+        } catch {
+        }
+        res.destroy();
       }
       return handled;
     }, "onSubscriberDiagnostic");
@@ -38548,9 +38498,7 @@ function registerSseEventsRoutes(app, deps) {
       return;
     }
     const openedAt = performance3.now();
-    let closeReason;
     let terminalCandidate;
-    let terminalEventType;
     let eventFramesWriteSettled = 0;
     let lastEventIdWritten;
     let backpressureCount = 0;
@@ -38944,7 +38892,7 @@ function registerSseEventsRoutes(app, deps) {
         }
       } finally {
         cleanup();
-        if (!res.writableEnded) res.end();
+        if (!res.destroyed && !res.writableEnded) res.end();
       }
     })();
   });
@@ -51273,9 +51221,12 @@ var LiveSessionCoordinator = class {
           if (update?.["sessionUpdate"] === "agent_message_chunk") {
             const source = updateSource(update);
             if (source === "background_notification") {
-              announcement = updateText(update);
+              const text = updateText(update);
+              announcement = announcement ? appendBounded(announcement, `
+${text}`) : text;
               response = "";
-              backgroundTaskId = updateBackgroundTaskId(update);
+              const taskId = updateBackgroundTaskId(update);
+              if (taskId !== void 0) backgroundTaskId = taskId;
             } else if (source === "background_notification_response") {
               response = appendBounded(response, updateText(update));
             }
@@ -53691,14 +53642,17 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     );
   }
   const originAllowlist = new MutableOriginAllowlist(parsedAllowOrigins);
-  app.use(allowOriginCors(originAllowlist));
-  app.use(hostAllowlist(opts.hostname, getPort));
   const credentials = new CredentialStore(opts.token);
   const authenticate = bearerAuth(credentials);
   const rateLimiter = installRateLimiter(app, opts, daemonLog, {
     mount: false,
     workspaceQualifiedAcpEnabled
   });
+  installAccessLogMiddleware(app, daemonLog);
+  app.use(daemonInboundTraceIdCaptureMiddleware);
+  app.use(hostAllowlist(opts.hostname, getPort));
+  installRemoteSelfOriginMiddleware(app, opts.hostname, opts.token);
+  app.use(allowOriginCors(originAllowlist));
   const healthRoutes = createHealthRoutes({
     opts,
     workspaceRegistry,
@@ -53715,8 +53669,6 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     });
     healthRoutes.register(app);
   }
-  installAccessLogMiddleware(app, daemonLog);
-  app.use(daemonInboundTraceIdCaptureMiddleware);
   const webShellDir = opts.serveWebShell !== false ? deps.webShellDir : void 0;
   const webShellFrameAncestors = opts.allowOrigins && opts.allowOrigins.length > 0 ? [...parseAllowOriginPatterns(opts.allowOrigins).origins].filter(
     (o) => o.startsWith("chrome-extension://") || o.startsWith("moz-extension://")