@qwen-code/qwen-code 0.23.2-preview.0 → 0.23.2

package/chunks/{run-qwen-serve-OJYVH7N6.js → run-qwen-serve-WBSWWIRV.js}

@@ -8,8 +8,8 @@ import {
   isOwnInterfaceAddress
 } from "./chunk-24FVUD5P.js";
 import {
-  resolveServeToken
-} from "./chunk-ZELCTN6Y.js";
+  resolveRemoteServeToken
+} from "./chunk-F23YN37B.js";
 import {
   RUNTIME_STARTUP_CANCELLED_MESSAGE
 } from "./chunk-QUPXZXLV.js";
@@ -33,6 +33,7 @@ import {
   getRateLimiter,
   getServeProtocolVersions,
   hostAllowlist,
+  installRemoteSelfOriginMiddleware,
   installSelfOriginStripMiddleware,
   isBrowserAutomationMcpAvailable,
   isDeepHealthQuery,
@@ -40,7 +41,9 @@ import {
   isLocalTerminalAvailable,
   isManagedScratchChild,
   isNativeDirectoryPickerAvailable,
+  isSoftwareNetwork,
   isTrustedLoopbackMode,
+  listLanCandidates,
   listenerMaxConnections,
   parseAllowOriginPatterns,
   parseDaemonStatusDetail,
@@ -48,7 +51,7 @@ import {
   prepareManagedScratchRoot,
   resolveAcpHttpEnabled,
   toDaemonStatusMemoryLimits
-} from "./chunk-M73KHGNR.js";
+} from "./chunk-VJJXG73H.js";
 import {
   ConversationDirectoryIdentityError,
   assertExactConversationRootIdentity,
@@ -71,11 +74,12 @@ import {
 } from "./chunk-LAUEEBDL.js";
 import {
   require_express
-} from "./chunk-IRKQ4YYX.js";
+} from "./chunk-SVWWF5TZ.js";
 import {
   resolveWebShellDir
 } from "./chunk-FBX2SDQ4.js";
 import {
+  formatHostForAuthority,
   isLoopbackAddress,
   isLoopbackBind
 } from "./chunk-DMEUXLSS.js";
@@ -100,7 +104,7 @@ import {
 } from "./chunk-WCCLLK7X.js";
 import {
   resolveChannelCwd
-} from "./chunk-3BTHHXXE.js";
+} from "./chunk-AUTUFD5X.js";
 import {
   ConversationRuntimeOwnershipError,
   LIVE_HOST_PROTOCOL_VERSION
@@ -117,8 +121,8 @@ import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-WZS3X663.js";
-import "./chunk-EHTKOO6W.js";
+} from "./chunk-LWX4WDFF.js";
+import "./chunk-TRQNRP2H.js";
 import {
   LOAD_REPLAY_META_KEY
 } from "./chunk-PSPAM24S.js";
@@ -130,7 +134,7 @@ import {
 import {
   ExtraCaInspectionError,
   loadableCertificates
-} from "./chunk-CABDNUJ4.js";
+} from "./chunk-KEPC5BOL.js";
 import "./chunk-FYJ7W2PI.js";
 import "./chunk-Z7B6SRPM.js";
 import {
@@ -139,7 +143,7 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-GM44O6F7.js";
+} from "./chunk-DARWOZY6.js";
 import {
   QWEN_SERVER_TOKEN_ENV
 } from "./chunk-GYTKQYDB.js";
@@ -159,13 +163,11 @@ import {
   PRIVATE_EXTERNAL_TOOL_GUARD_ENV,
   PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV
 } from "./chunk-3VUENPWF.js";
+import "./chunk-TGNNLRC3.js";
 import {
   sanitizeLogText
-} from "./chunk-XVTCSVBK.js";
+} from "./chunk-WDVV3LRM.js";
 import "./chunk-IW6RQPQB.js";
-import {
-  MAX_DAEMON_WORKSPACES
-} from "./chunk-5HBA2Z7V.js";
 import "./chunk-BW4333PP.js";
 import {
   getGlobalQwenDirLite,
@@ -179,7 +181,7 @@ import {
 } from "./chunk-QTNCGZHQ.js";
 import {
   getCliVersion
-} from "./chunk-ISPBBKJN.js";
+} from "./chunk-MV5DTLJV.js";
 import "./chunk-W3N5XAZ6.js";
 import "./chunk-NPQ5ZKRP.js";
 import {
@@ -211,7 +213,8 @@ import {
 import "./chunk-JVEGA3MM.js";
 import {
   writeStderrLine,
-  writeStdoutLine
+  writeStdoutLine,
+  writeStdoutLineSafe
 } from "./chunk-7FA2II6K.js";
 import "./chunk-DMTGGOSA.js";
 import "./chunk-YQ3U5MUC.js";
@@ -251,10 +254,11 @@ init_esbuild_shims();
 var MIN_CHILD_HEAP_MB = 512;
 
 // packages/acp-bridge/dist/child-heap-policy.js
+var MAX_MODELED_ACP_CHILDREN = 25;
 function createChildHeapPolicy(options) {
   const { budget, mode } = options;
   let refusals = 0;
-  const admissible = Math.min(Math.floor(budget.childPoolMb / MIN_CHILD_HEAP_MB), MAX_DAEMON_WORKSPACES);
+  const admissible = Math.min(Math.floor(budget.childPoolMb / MIN_CHILD_HEAP_MB), MAX_MODELED_ACP_CHILDREN);
   const rawCeilingMb = admissible > 0 ? Math.min(Math.floor(budget.childPoolMb / admissible), budget.legacyChildCeilingMb) : null;
   const modelable = rawCeilingMb !== null && rawCeilingMb >= MIN_CHILD_HEAP_MB;
   const maxConcurrentChildren = modelable ? admissible : 0;
@@ -283,6 +287,125 @@ function createChildHeapPolicy(options) {
 }
 __name(createChildHeapPolicy, "createChildHeapPolicy");
 
+// packages/cli/src/serve/remote-quickstart.ts
+init_esbuild_shims();
+import { networkInterfaces } from "node:os";
+function isUlaIpv6(address) {
+  return /^(?:fc|fd)/iu.test(address);
+}
+__name(isUlaIpv6, "isUlaIpv6");
+function isLinkLocalIpv4(address) {
+  return address.startsWith("169.254.");
+}
+__name(isLinkLocalIpv4, "isLinkLocalIpv4");
+function quickstartPrintMode(boundAddress, generated) {
+  if (!isLoopbackAddress(boundAddress)) return "full";
+  return generated ? "token-only" : "silent";
+}
+__name(quickstartPrintMode, "quickstartPrintMode");
+function remoteQuickstartEntries(bind, boundAddress, port, tls, interfaces) {
+  const scheme = tls ? "https" : "http";
+  const url = /* @__PURE__ */ __name((host) => `${scheme}://${formatHostForAuthority(host)}:${port}`, "url");
+  const bound = boundAddress.trim().toLowerCase();
+  const ipv4Wildcard = bound === "0.0.0.0" || bound === "::ffff:0.0.0.0";
+  if (!ipv4Wildcard && bound !== "::") {
+    if (bind.trim().includes("%")) return [];
+    return [{ label: "Address", url: url(bind), address: bind }];
+  }
+  const localAddress = !ipv4Wildcard && hostAssignsIpv6Loopback(interfaces) ? "::1" : "127.0.0.1";
+  const addresses = [
+    { label: "Local", url: url(localAddress), address: localAddress }
+  ];
+  for (const candidate of listLanCandidates(interfaces)) {
+    addresses.push({
+      label: `Network (${candidate.interfaceName})`,
+      url: url(candidate.address),
+      address: candidate.address
+    });
+  }
+  if (!ipv4Wildcard) {
+    for (const [name, entries] of Object.entries(interfaces).sort()) {
+      if (isSoftwareNetwork(name)) continue;
+      for (const entry of entries ?? []) {
+        if (entry.internal || entry.family !== "IPv6") continue;
+        if (entry.address.includes("%") || !isUlaIpv6(entry.address)) continue;
+        addresses.push({
+          label: `Network (${name})`,
+          url: url(entry.address),
+          address: entry.address
+        });
+      }
+    }
+  }
+  return addresses;
+}
+__name(remoteQuickstartEntries, "remoteQuickstartEntries");
+async function printRemoteQuickstart(input) {
+  try {
+    const mode = quickstartPrintMode(input.boundAddress, input.generated);
+    if (mode === "silent") return;
+    if (mode === "token-only") {
+      writeStdoutLineSafe(
+        `Generated bearer token (secret; changes on restart): ${input.token}`
+      );
+      writeStdoutLineSafe(
+        "The listener bound loopback, so no network address or QR is printed; local clients must present this bearer."
+      );
+      return;
+    }
+    const addresses = remoteQuickstartEntries(
+      input.bind,
+      input.boundAddress,
+      input.port,
+      input.tls,
+      input.interfaces ?? networkInterfaces()
+    );
+    for (const address of addresses)
+      writeStdoutLineSafe(`${address.label}: ${address.url}`);
+    if (input.generated) {
+      writeStdoutLineSafe(
+        `Generated bearer token (secret; changes on restart): ${input.token}`
+      );
+    }
+    if (!input.tls)
+      writeStdoutLineSafe(
+        "HTTP is unencrypted. Use the existing TLS options for encrypted remote access."
+      );
+    if (!input.web) return;
+    const candidate = addresses.find(
+      (address) => address.label !== "Local" && !isLinkLocalIpv4(address.address)
+    ) ?? addresses.find((address) => address.label !== "Local");
+    if (!candidate) {
+      writeStdoutLineSafe(
+        "QR unavailable; enter the bearer token at the daemon address."
+      );
+      return;
+    }
+    if (!input.generated && !process.stdout.isTTY) return;
+    try {
+      const { default: qrcode } = await import("./main-PXAUXNF2.js");
+      qrcode.setErrorLevel("Q");
+      qrcode.generate(
+        `${candidate.url}/#token=${encodeURIComponent(input.token)}`,
+        { small: true },
+        (code) => {
+          writeStdoutLineSafe(
+            `Scan to open Web Shell: ${candidate.url} (${candidate.label})`
+          );
+          writeStdoutLineSafe("SECRET QR: grants daemon access. Do not share.");
+          writeStdoutLineSafe(code.trimEnd());
+        }
+      );
+    } catch {
+      writeStdoutLineSafe(
+        "QR unavailable; enter the bearer token at the daemon address."
+      );
+    }
+  } catch {
+  }
+}
+__name(printRemoteQuickstart, "printRemoteQuickstart");
+
 // packages/cli/src/serve/permission-audit.ts
 init_esbuild_shims();
 var DEFAULT_PERMISSION_AUDIT_RING_SIZE = 512;
@@ -3260,14 +3383,11 @@ function canonicalIpLiteral(host) {
   }
 }
 __name(canonicalIpLiteral, "canonicalIpLiteral");
-function formatChannelWorkerDaemonUrl(host, port, tls = false, boundFamily, ipv6LoopbackAssigned = hostAssignsIpv6Loopback()) {
+function formatChannelWorkerDaemonUrl(host, port, tls = false, ipv6LoopbackAssigned = hostAssignsIpv6Loopback()) {
   const scheme = tls ? "https" : "http";
   const normalized = host.trim().toLowerCase();
   const canonicalIp = canonicalIpLiteral(normalized);
   const v6Loopback = ipv6LoopbackAssigned ? `${scheme}://[::1]:${port}` : `${scheme}://127.0.0.1:${port}`;
-  if (normalized === "") {
-    return boundFamily === "IPv4" ? `${scheme}://127.0.0.1:${port}` : v6Loopback;
-  }
   if (canonicalIp === "::") {
     return v6Loopback;
   }
@@ -3804,12 +3924,12 @@ __name(hasRetryableChannelWorkerShutdownError, "hasRetryableChannelWorkerShutdow
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-XJPZZ3VK.js"),
-    import("./pidfile-KPIS6RIT.js"),
-    import("./runtime-KGMQQFJD.js"),
+    import("./channel-worker-supervisor-EMITFMCP.js"),
+    import("./pidfile-B7DZC4TP.js"),
+    import("./runtime-VRVBX2E5.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-PIYPVCTF.js"),
-    import("./channel-worker-manager-FQHEDTD2.js")
+    import("./channel-worker-group-SQ5FRWOH.js"),
+    import("./channel-worker-manager-TU4ZNWOE.js")
   ]).then(
     ([
       supervisor,
@@ -3915,7 +4035,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./core-runtime-6U4OXU5C.js");
+  coreRuntimePromise ??= import("./core-runtime-WKYKWVYU.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -3951,10 +4071,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-RKEQQDFC.js"),
-    import("./environment-BI6IBAZJ.js"),
-    import("./loadedSettingsAdapter-I3YQKMC4.js"),
-    import("./trustedFolders-C76KYROP.js")
+    import("./settings-D44YMZFT.js"),
+    import("./environment-HP3AXFTB.js"),
+    import("./loadedSettingsAdapter-DVKROEJD.js"),
+    import("./trustedFolders-OVAQKNV5.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -3967,8 +4087,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-KGMQQFJD.js"),
-    import("./config-utils-37FHWPTP.js")
+    import("./runtime-VRVBX2E5.js"),
+    import("./config-utils-GPLIABL2.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -3995,19 +4115,19 @@ async function loadServeRuntimeModules() {
     workspaceRuntimeCoordinatorModule,
     promptLedgerModule
   ] = await Promise.all([
-    import("./server-PJRALPJQ.js"),
-    import("./bridge-Q66BD62H.js"),
-    import("./spawnChannel-WM3DT2BF.js"),
+    import("./server-FLY5JERG.js"),
+    import("./bridge-AOX5IY44.js"),
+    import("./spawnChannel-T6MX2ZDN.js"),
     import("./process-registry-OAEG6WGC.js"),
-    import("./workspace-service-4MYO72MM.js"),
+    import("./workspace-service-5IFDCNN3.js"),
     import("./types-HKLPXZB3.js"),
-    import("./daemon-status-provider-7GMAKSTX.js"),
-    import("./workspace-providers-status-2FRLBZ5I.js"),
-    import("./workspace-skills-status-SU66TJLZ.js"),
-    import("./total-session-admission-FUUJH3QH.js"),
-    import("./workspace-registry-BNRP2ELW.js"),
-    import("./workspace-runtime-coordinator-WKGF7VHS.js"),
-    import("./prompt-terminal-ledger-D6HM6TV7.js")
+    import("./daemon-status-provider-OK7VONJG.js"),
+    import("./workspace-providers-status-MAM42IZS.js"),
+    import("./workspace-skills-status-FJ3HNH4H.js"),
+    import("./total-session-admission-3SNSJJ32.js"),
+    import("./workspace-registry-7RDDOBLN.js"),
+    import("./workspace-runtime-coordinator-LEPDPXJO.js"),
+    import("./prompt-terminal-ledger-FYYTAOXS.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -4247,12 +4367,13 @@ function createBootstrapServeApp(input) {
   const localPathOpenAvailable = isLocalPathOpenAvailable();
   const localTerminalOpenAvailable = isLocalTerminalAvailable();
   installSelfOriginStripMiddleware(app, getPort, opts.hostname);
+  app.use(hostAllowlist(opts.hostname, getPort));
+  installRemoteSelfOriginMiddleware(app, opts.hostname, opts.token);
   if (opts.allowOrigins && opts.allowOrigins.length > 0) {
     app.use(allowOriginCors(parseAllowOriginPatterns(opts.allowOrigins)));
   } else {
     app.use(denyBrowserOriginCors);
   }
-  app.use(hostAllowlist(opts.hostname, getPort));
   const healthHandler = /* @__PURE__ */ __name((req, res) => {
     const runtimeError = getRuntimeError();
     if (runtimeError !== void 0) {
@@ -4723,7 +4844,19 @@ async function runQwenServe(optsIn, deps = {}) {
   }
 }
 __name(runQwenServe, "runQwenServe");
+var brokenPipeGuardInstalled = false;
+function installServeBrokenPipeGuard() {
+  if (brokenPipeGuardInstalled) return;
+  brokenPipeGuardInstalled = true;
+  const ignoreEpipe = /* @__PURE__ */ __name((err) => {
+    if (err.code !== "EPIPE") throw err;
+  }, "ignoreEpipe");
+  process.stdout.on("error", ignoreEpipe);
+  process.stderr.on("error", ignoreEpipe);
+}
+__name(installServeBrokenPipeGuard, "installServeBrokenPipeGuard");
 async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
+  installServeBrokenPipeGuard();
   const runStartedAt = performance2.now();
   delete process.env[EXTERNAL_TOOL_GUARD_TOKEN_ENV];
   const channelDeliveryAuthorizations = new ChannelDeliveryAuthorizationStore();
@@ -4765,8 +4898,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     loaderEnvScrub.release();
   }, "restoreScrubbedLoaderEnv");
   loggerLifecycle.scrubApplied(restoreScrubbedLoaderEnv);
-  const token = resolveServeToken(optsIn.token);
+  if (!optsIn.hostname.trim()) {
+    throw new Error(
+      "Invalid --hostname: empty value binds every interface. Pass an explicit address (e.g. --hostname 0.0.0.0) or omit the flag."
+    );
+  }
   const bindHostname = optsIn.hostname.toLowerCase() === "localhost" ? (await (deps.bindHostnameLookup ?? lookup)(optsIn.hostname)).address : optsIn.hostname;
+  const { token, generated: generatedToken } = resolveRemoteServeToken(
+    optsIn.token,
+    isLoopbackBind(optsIn.hostname)
+  );
   const trustedLoopbackMode = isTrustedLoopbackMode({
     loopbackBind: isLoopbackAddress(bindHostname),
     tokenConfigured: token !== void 0,
@@ -4931,7 +5072,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   if (!isLoopbackBind(opts.hostname) && !token) {
     throw new Error(
-      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token. Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.0/8, localhost, ::1, or [::1]).`
+      `Refusing to bind ${opts.hostname}:${opts.port} without a bearer token (an explicitly empty --token or ${QWEN_SERVER_TOKEN_ENV} counts as none, since a blank source never generates one). Set ${QWEN_SERVER_TOKEN_ENV} or pass --token, or rebind to loopback (127.0.0.0/8, localhost, ::1, or [::1]).`
     );
   }
   if (opts.requireAuth && !token) {
@@ -5065,7 +5206,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-YL7HLYYI.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-HKLJEDQX.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -5356,7 +5497,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       "qwen serve: required external tool guard handshake succeeded."
     );
   }
-  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-O2UTNFJC.js");
+  const { createDaemonToolGuard } = await import("./daemon-git-worktree-guard-73ZWOLKL.js");
   const daemonToolGuardHandler = createDaemonToolGuard(
     externalToolGuardHandler
   );
@@ -5392,7 +5533,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
         if (!opts.allowOrigins || opts.allowOrigins.length === 0) {
           writeStderrLine(
-            "qwen serve: without --allow-origin the Web Shell is read-only on a non-loopback bind \u2014 same-origin POSTs are blocked by CORS (403). Pass --allow-origin <origin> or front it with a same-origin proxy."
+            "qwen serve: same-origin Web Shell HTTP requests work without --allow-origin, but WebSocket-backed features (terminal, voice) and browsers reaching the daemon through a TLS-terminating proxy still need --allow-origin <origin>. A plain-HTTP intermediary that rewrites the Host header (nginx default proxy_set_header, k8s Ingress) needs --allow-origin <origin> for the origin the browser sees, unless it forwards Host verbatim; port translation alone (ssh -L, docker -p) is fine."
           );
         }
       }
@@ -5707,7 +5848,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
       cliVersionPromise,
-      import("./daemon-trust-policy-VNP76VMO.js")
+      import("./daemon-trust-policy-CAUCREG2.js")
     ]);
     getWorkspaceRuntimeCoordinatorIfSupported = runtime.getWorkspaceRuntimeCoordinatorIfSupported;
     cliVersion = resolvedCliVersion;
@@ -6115,7 +6256,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledToolsFn");
     const persistDisabledSkillsFn = /* @__PURE__ */ __name((workspace, skillName, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-LZR5YRRW.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-VHEJMBFL.js");
       const fresh = loadSettingsForPersistence(workspace);
       const workspaceDisabled = skillSettingStrings(
         fresh,
@@ -6165,7 +6306,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }), "persistDisabledSkillsFn");
     const persistDisabledSkillsBatchFn = /* @__PURE__ */ __name((workspace, skillNames, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
       assertGenerationOpen?.();
-      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-LZR5YRRW.js");
+      const { skillSettingStrings, updateWorkspaceSkillSettingLists } = await import("./skill-settings-VHEJMBFL.js");
       const fresh = loadSettingsForPersistence(workspace);
       const initialDisabled = skillSettingStrings(
         fresh,
@@ -6256,10 +6397,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
     }), "persistSettingsFn");
     const [{ createSubSessionLauncher }, scheduledTaskRoutes] = await Promise.all([
-      import("./create-sub-session-LLUYAGZN.js"),
-      import("./scheduled-tasks-7H5HWHYD.js")
+      import("./create-sub-session-PPLXB3JJ.js"),
+      import("./scheduled-tasks-D65KJDA3.js")
     ]);
-    const { sessionAttachmentsRoots } = await import("./session-attachments-root-GQ2TUI3Y.js");
+    const { sessionAttachmentsRoots } = await import("./session-attachments-root-7ACGLHXA.js");
     const createCurrentSessionScheduledTaskHandler = /* @__PURE__ */ __name((workspaceCwd, runtimeBaseDir, getBridge, assertGenerationOpen) => async ({
       callerSessionId,
       cron,
@@ -7100,7 +7241,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     };
     sessionPrRefreshTimer?.dispose();
     const refreshGeneration = ++sessionPrRefreshGeneration;
-    void import("./session-pr-refresh-H43LULTE.js").then((mod) => {
+    void import("./session-pr-refresh-TQS57SDK.js").then((mod) => {
       if (refreshGeneration !== sessionPrRefreshGeneration) return;
       sessionPrRefreshTimer = mod.startSessionPrRefreshTimer({
         workspaceRegistry,
@@ -7770,8 +7911,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           { createChannelManagementService },
           { WorkspaceChannelSettingsStore }
         ] = await Promise.all([
-          import("./channel-management-service-TRTLQTSV.js"),
-          import("./channel-settings-store-R5STFWUW.js")
+          import("./channel-management-service-MWQGHPAS.js"),
+          import("./channel-settings-store-XZCGDGHW.js")
         ]);
         return createChannelManagementService({
           workspaceCwd: targetRuntime.workspaceCwd,
@@ -7976,8 +8117,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         { createWorkspaceTrustReconciler },
         { createDaemonTrustPolicyMonitor }
       ] = await Promise.all([
-        import("./workspace-trust-reconciler-D5QT7WQB.js"),
-        import("./daemon-trust-policy-monitor-TD5O3BZA.js")
+        import("./workspace-trust-reconciler-PQFHIWLR.js"),
+        import("./daemon-trust-policy-monitor-3Y36OOEQ.js")
       ]);
       const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
         const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
@@ -8174,7 +8315,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     // through (and start the runtime) exactly like the warm app would.
     // Dynamic import keeps web-shell-static out of the serve fast-path
     // static closure (see the import-boundary guards in fast-path.test.ts).
-    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-POZHGGXE.js").then(
+    isPreAuthRequest: webShellMounted ? (req) => import("./web-shell-static-BFDESDD4.js").then(
       (webShellStatic) => webShellStatic.isPreAuthWebShellRequest(req)
     ) : void 0
   });
@@ -8194,7 +8335,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
-  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-VNP76VMO.js") : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-CAUCREG2.js") : void 0;
   const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
@@ -8749,8 +8890,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           const workerDaemonUrl = formatChannelWorkerDaemonUrl(
             workerHostname,
             actualPort,
-            tlsOptions !== void 0,
-            typeof addr === "object" && addr && (addr.family === "IPv4" || addr.family === "IPv6") ? addr.family : void 0
+            tlsOptions !== void 0
           );
           (deps.channelWorkerUrlCertifier ?? assertChannelWorkerDaemonUrlIsLocal)(workerDaemonUrl, workerHostname);
           if (tlsOptions && tlsCertPath && process.env["NODE_TLS_REJECT_UNAUTHORIZED"] === "0") {
@@ -9291,6 +9431,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       writeStdoutLine(
         `qwen serve listening on ${url} (mode=${opts.mode}, workspace=${boundWorkspace})`
       );
+      const boundAddress = typeof addr === "object" && addr ? addr.address : opts.hostname;
+      if (token) {
+        void printRemoteQuickstart({
+          bind: opts.hostname,
+          boundAddress,
+          port: actualPort,
+          tls: Boolean(tlsOptions),
+          token,
+          generated: generatedToken,
+          web: webShellMounted
+        });
+      }
       writeStderrLine(
         `qwen serve: bound to workspace ${JSON.stringify(boundWorkspace)}`
       );