@qwen-code/qwen-code 0.23.2-preview.0 → 0.23.3-nightly.20260910.c46cb85cf2

package/chunks/{chunk-M73KHGNR.js → chunk-B2TGBZXY.js}

@@ -9,6 +9,9 @@ import {
   CLIENT_ID_RE,
   MAX_CLIENT_ID_LENGTH
 } from "./chunk-LAUEEBDL.js";
+import {
+  isPreAuthWebShellRequest
+} from "./chunk-SVWWF5TZ.js";
 import {
   formatHostForAuthority,
   isLoopbackBind
@@ -21,7 +24,10 @@ import {
 } from "./chunk-2Z3T52OC.js";
 import {
   CLIENT_MCP_OVER_WS_CONFIG_FLAG
-} from "./chunk-PSPAM24S.js";
+} from "./chunk-YKK2XXHF.js";
+import {
+  MAX_REGISTERED_WORKSPACES
+} from "./chunk-SNZWDV67.js";
 import {
   parseToolWriteOriginMeta
 } from "./chunk-GELRJXE2.js";
@@ -923,78 +929,6 @@ function isDeepHealthQuery(raw) {
 }
 __name(isDeepHealthQuery, "isDeepHealthQuery");
 
-// packages/cli/src/serve/server/self-origin.ts
-init_esbuild_shims();
-function installSelfOriginStripMiddleware(app, getPort, bind) {
-  let cachedStripPort = -1;
-  let cachedSelfOrigins = /* @__PURE__ */ new Set();
-  const boundHost = isLoopbackBind(bind) ? formatHostForAuthority(bind) : void 0;
-  app.use((req, _res, next) => {
-    const origin = req.headers.origin;
-    if (origin) {
-      const port = getPort();
-      if (port !== cachedStripPort) {
-        cachedStripPort = port;
-        cachedSelfOrigins = /* @__PURE__ */ new Set([
-          `http://127.0.0.1:${port}`,
-          `http://localhost:${port}`,
-          `http://[::1]:${port}`,
-          `http://host.docker.internal:${port}`,
-          `https://127.0.0.1:${port}`,
-          `https://localhost:${port}`,
-          `https://[::1]:${port}`,
-          `https://host.docker.internal:${port}`
-        ]);
-        if (boundHost) {
-          cachedSelfOrigins.add(`http://${boundHost}:${port}`);
-          cachedSelfOrigins.add(`https://${boundHost}:${port}`);
-        }
-        if (port === 80) {
-          for (const host of [
-            "127.0.0.1",
-            "localhost",
-            "[::1]",
-            "host.docker.internal"
-          ]) {
-            cachedSelfOrigins.add(`http://${host}`);
-          }
-          if (boundHost) {
-            cachedSelfOrigins.add(`http://${boundHost}`);
-          }
-        } else if (port === 443) {
-          for (const host of [
-            "127.0.0.1",
-            "localhost",
-            "[::1]",
-            "host.docker.internal"
-          ]) {
-            cachedSelfOrigins.add(`https://${host}`);
-          }
-          if (boundHost) {
-            cachedSelfOrigins.add(`https://${boundHost}`);
-          }
-        }
-      }
-      if (cachedSelfOrigins.has(origin)) {
-        delete req.headers.origin;
-      }
-    }
-    next();
-  });
-}
-__name(installSelfOriginStripMiddleware, "installSelfOriginStripMiddleware");
-
-// packages/cli/src/serve/acp-child-extra-args.ts
-init_esbuild_shims();
-function acpChildExtraArgs(opts) {
-  const extraArgs = [
-    ...opts.experimentalLsp === true ? ["--experimental-lsp"] : [],
-    ...opts.restoreAskUserQuestion === true ? ["--restore-ask-user-question"] : []
-  ];
-  return extraArgs.length > 0 ? extraArgs : void 0;
-}
-__name(acpChildExtraArgs, "acpChildExtraArgs");
-
 // packages/cli/src/serve/local-control/credentials.ts
 init_esbuild_shims();
 import { createHash, timingSafeEqual } from "node:crypto";
@@ -1094,11 +1028,203 @@ function listenerIdentityOfSocket(socket) {
 }
 __name(listenerIdentityOfSocket, "listenerIdentityOfSocket");
 
+// packages/cli/src/serve/server/access-log.ts
+init_esbuild_shims();
+init_esm();
+import { performance } from "node:perf_hooks";
+
+// packages/cli/src/serve/server/telemetry-context.ts
+init_esbuild_shims();
+var daemonTelemetryResponseContext = Symbol(
+  "daemonTelemetryResponseContext"
+);
+var daemonInboundTraceIdContext = Symbol(
+  "daemonInboundTraceIdContext"
+);
+function getDaemonTelemetryInboundTraceId(res) {
+  try {
+    return res[daemonInboundTraceIdContext];
+  } catch {
+    return void 0;
+  }
+}
+__name(getDaemonTelemetryInboundTraceId, "getDaemonTelemetryInboundTraceId");
+
+// packages/cli/src/serve/server/access-log.ts
+var SESSION_ID_RE = /\/session\/([^/]+)/;
+var ACCESS_LOG_BURST = 60;
+var ACCESS_LOG_REFILL_PER_SECOND = 2;
+var ACCESS_LOG_REJECT_BURST = 30;
+var ACCESS_LOG_REJECT_REFILL_PER_SECOND = 1;
+var ROUTE_MAX_BYTES = 2 * 1024;
+var SESSION_ID_MAX_BYTES = 256;
+var CLIENT_ID_MAX_BYTES = 256;
+var ACCESS_LOG_CONTROLLER_LOCAL = "accessLogController";
+var ACCESS_LOG_REJECT_LOCAL = "accessLogPreAuthReject";
+function emptySuppressedCounts() {
+  return {
+    suppressed: 0,
+    status2xx: 0,
+    status3xx: 0,
+    status4xx: 0,
+    status5xx: 0,
+    statusOther: 0
+  };
+}
+__name(emptySuppressedCounts, "emptySuppressedCounts");
+function countSuppressed(counts, status) {
+  counts.suppressed += 1;
+  if (status >= 200 && status < 300) counts.status2xx += 1;
+  else if (status >= 300 && status < 400) counts.status3xx += 1;
+  else if (status >= 400 && status < 500) counts.status4xx += 1;
+  else if (status >= 500 && status < 600) counts.status5xx += 1;
+  else counts.statusOther += 1;
+}
+__name(countSuppressed, "countSuppressed");
+function firstRawHeader(rawHeaders, targetName) {
+  for (let i = 0; i + 1 < rawHeaders.length; i += 2) {
+    if (rawHeaders[i]?.toLowerCase() === targetName) return rawHeaders[i + 1];
+  }
+  return void 0;
+}
+__name(firstRawHeader, "firstRawHeader");
+function truncateUtf8(value, maxBytes) {
+  const bytes = Buffer.from(value, "utf8");
+  if (bytes.length <= maxBytes) return { value };
+  let end = maxBytes;
+  while (end > 0 && (bytes[end] & 192) === 128) end -= 1;
+  return {
+    value: bytes.subarray(0, end).toString("utf8"),
+    originalBytes: bytes.length
+  };
+}
+__name(truncateUtf8, "truncateUtf8");
+function installAccessLogMiddleware(app, daemonLog, monotonicNow = () => performance.now()) {
+  let sealed = false;
+  let tokens = ACCESS_LOG_BURST;
+  let refillBaseline = monotonicNow();
+  let rejectTokens = ACCESS_LOG_REJECT_BURST;
+  let rejectRefillBaseline = refillBaseline;
+  const suppressed = emptySuppressedCounts();
+  const suppressedRejects = emptySuppressedCounts();
+  const refill = /* @__PURE__ */ __name(() => {
+    const now = Math.max(monotonicNow(), refillBaseline);
+    tokens = Math.min(
+      ACCESS_LOG_BURST,
+      tokens + (now - refillBaseline) / 1e3 * ACCESS_LOG_REFILL_PER_SECOND
+    );
+    refillBaseline = now;
+  }, "refill");
+  const refillReject = /* @__PURE__ */ __name(() => {
+    const now = Math.max(monotonicNow(), rejectRefillBaseline);
+    rejectTokens = Math.min(
+      ACCESS_LOG_REJECT_BURST,
+      rejectTokens + (now - rejectRefillBaseline) / 1e3 * ACCESS_LOG_REJECT_REFILL_PER_SECOND
+    );
+    rejectRefillBaseline = now;
+  }, "refillReject");
+  const flushSuppressed = /* @__PURE__ */ __name((counts) => {
+    if (!daemonLog || counts.suppressed === 0) return false;
+    context.with(ROOT_CONTEXT, () => {
+      daemonLog.warn("access logs suppressed", { ...counts });
+    });
+    Object.assign(counts, emptySuppressedCounts());
+    return true;
+  }, "flushSuppressed");
+  const controller = {
+    sealAndFlushSuppressed: /* @__PURE__ */ __name(() => {
+      if (sealed) return;
+      sealed = true;
+      try {
+        flushSuppressed(suppressed);
+        flushSuppressed(suppressedRejects);
+      } catch {
+      }
+    }, "sealAndFlushSuppressed")
+  };
+  app.locals[ACCESS_LOG_CONTROLLER_LOCAL] = controller;
+  if (!daemonLog) return controller;
+  app.use((req, res, next) => {
+    const { method, path: reqPath } = req;
+    if (method === "GET" && reqPath === "/health" || method === "POST" && reqPath.endsWith("/heartbeat")) {
+      return next();
+    }
+    const startMs = monotonicNow();
+    res.on("finish", () => {
+      try {
+        if (sealed) return;
+        const status = res.statusCode;
+        if (method === "GET" && reqPath.endsWith("/events") && status === 200) {
+          return;
+        }
+        refill();
+        refillReject();
+        const isPreAuthReject = Boolean(
+          res.locals?.[ACCESS_LOG_REJECT_LOCAL]
+        );
+        if (isPreAuthReject) {
+          if (suppressedRejects.suppressed > 0 && rejectTokens >= 1) {
+            rejectTokens -= 1;
+            flushSuppressed(suppressedRejects);
+          }
+          if (rejectTokens < 1) {
+            countSuppressed(suppressedRejects, status);
+            return;
+          }
+          rejectTokens -= 1;
+        } else {
+          if (suppressed.suppressed > 0 && tokens >= 1) {
+            tokens -= 1;
+            flushSuppressed(suppressed);
+          }
+          if (tokens < 1) {
+            countSuppressed(suppressed, status);
+            return;
+          }
+          tokens -= 1;
+        }
+        const route = truncateUtf8(`${method} ${reqPath}`, ROUTE_MAX_BYTES);
+        const sessionMatch = reqPath.match(SESSION_ID_RE);
+        const sessionId = sessionMatch?.[1] ? truncateUtf8(sessionMatch[1], SESSION_ID_MAX_BYTES) : void 0;
+        const rawClientId = firstRawHeader(req.rawHeaders, "x-qwen-client-id");
+        const clientId = rawClientId ? truncateUtf8(rawClientId, CLIENT_ID_MAX_BYTES) : void 0;
+        const inboundTraceId = getDaemonTelemetryInboundTraceId(res);
+        const ctx = {
+          route: route.value,
+          ...route.originalBytes ? { routeOriginalBytes: route.originalBytes } : {},
+          ...sessionId ? {
+            sessionId: sessionId.value,
+            ...sessionId.originalBytes ? { sessionIdOriginalBytes: sessionId.originalBytes } : {}
+          } : {},
+          ...clientId ? {
+            clientId: clientId.value,
+            ...clientId.originalBytes ? { clientIdOriginalBytes: clientId.originalBytes } : {}
+          } : {},
+          ...inboundTraceId ? { traceId: inboundTraceId } : {},
+          status,
+          durationMs: Math.max(0, Math.round(monotonicNow() - startMs))
+        };
+        if (status >= 400) daemonLog.warn("request completed", ctx);
+        else daemonLog.info("request completed", ctx);
+      } catch {
+      }
+    });
+    next();
+  });
+  return controller;
+}
+__name(installAccessLogMiddleware, "installAccessLogMiddleware");
+
 // packages/cli/src/serve/auth.ts
 init_esbuild_shims();
+function markPreAuthReject(res) {
+  (res.locals ??= {})[ACCESS_LOG_REJECT_LOCAL] = true;
+}
+__name(markPreAuthReject, "markPreAuthReject");
 var denyBrowserOriginCors = /* @__PURE__ */ __name((req, res, next) => {
   if (req.headers.origin) {
     res.setHeader("Vary", "Origin");
+    markPreAuthReject(res);
     res.status(403).json({ error: "Request denied by CORS policy" });
     return;
   }
@@ -1201,6 +1327,7 @@ function allowOriginCors(patterns) {
     }
     if (origin === "null") {
       res.setHeader("Vary", "Origin");
+      markPreAuthReject(res);
       res.status(403).json({ error: "Request denied by CORS policy" });
       return;
     }
@@ -1220,6 +1347,7 @@ function allowOriginCors(patterns) {
       return;
     }
     res.setHeader("Vary", "Origin");
+    markPreAuthReject(res);
     res.status(403).json({ error: "Request denied by CORS policy" });
   };
 }
@@ -1235,6 +1363,7 @@ function hostAllowlist(bind, getPort) {
     const host = (req.headers.host || "").toLowerCase();
     const browserHost = listener.origin === void 0 ? void 0 : new URL(listener.origin).host.toLowerCase();
     if (listener.authority === void 0 || host !== listener.authority && host !== browserHost) {
+      markPreAuthReject(res);
       res.status(403).json({ error: "Invalid Host header" });
       return;
     }
@@ -1272,6 +1401,7 @@ function buildPrimaryHostGate(bind, getPort) {
     const port = getPort();
     const host = (req.headers.host || "").toLowerCase();
     if (!allowedFor(port).has(host)) {
+      markPreAuthReject(res);
       res.status(403).json({ error: "Invalid Host header" });
       return;
     }
@@ -1353,6 +1483,119 @@ function createMutationGate(deps) {
 }
 __name(createMutationGate, "createMutationGate");
 
+// packages/cli/src/serve/server/self-origin.ts
+init_esbuild_shims();
+import { TLSSocket } from "node:tls";
+function installRemoteSelfOriginMiddleware(app, bind, token) {
+  if (isLoopbackBind(bind) || !token) return;
+  const authenticate = bearerAuth(token);
+  app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    const host = req.headers.host;
+    if (!origin || !host || listenerIdentityOf(req).kind !== "primary") {
+      next();
+      return;
+    }
+    const scheme = req.socket instanceof TLSSocket && req.socket.encrypted ? "https" : "http";
+    let authority = host.toLowerCase();
+    if (scheme === "http" && authority.endsWith(":80"))
+      authority = authority.slice(0, -3);
+    else if (scheme === "https" && authority.endsWith(":443"))
+      authority = authority.slice(0, -4);
+    if (origin !== `${scheme}://${authority}`) {
+      next();
+      return;
+    }
+    try {
+      if (new URL(origin).origin !== origin) {
+        next();
+        return;
+      }
+    } catch {
+      next();
+      return;
+    }
+    (res.locals ??= {})[ACCESS_LOG_REJECT_LOCAL] = true;
+    const allow = /* @__PURE__ */ __name(() => {
+      delete res.locals[ACCESS_LOG_REJECT_LOCAL];
+      delete req.headers.origin;
+      next();
+    }, "allow");
+    if (isPreAuthWebShellRequest(req)) allow();
+    else authenticate(req, res, allow);
+  });
+}
+__name(installRemoteSelfOriginMiddleware, "installRemoteSelfOriginMiddleware");
+function installSelfOriginStripMiddleware(app, getPort, bind) {
+  let cachedStripPort = -1;
+  let cachedSelfOrigins = /* @__PURE__ */ new Set();
+  const boundHost = isLoopbackBind(bind) ? formatHostForAuthority(bind) : void 0;
+  app.use((req, _res, next) => {
+    const origin = req.headers.origin;
+    if (origin) {
+      const port = getPort();
+      if (port !== cachedStripPort) {
+        cachedStripPort = port;
+        cachedSelfOrigins = /* @__PURE__ */ new Set([
+          `http://127.0.0.1:${port}`,
+          `http://localhost:${port}`,
+          `http://[::1]:${port}`,
+          `http://host.docker.internal:${port}`,
+          `https://127.0.0.1:${port}`,
+          `https://localhost:${port}`,
+          `https://[::1]:${port}`,
+          `https://host.docker.internal:${port}`
+        ]);
+        if (boundHost) {
+          cachedSelfOrigins.add(`http://${boundHost}:${port}`);
+          cachedSelfOrigins.add(`https://${boundHost}:${port}`);
+        }
+        if (port === 80) {
+          for (const host of [
+            "127.0.0.1",
+            "localhost",
+            "[::1]",
+            "host.docker.internal"
+          ]) {
+            cachedSelfOrigins.add(`http://${host}`);
+          }
+          if (boundHost) {
+            cachedSelfOrigins.add(`http://${boundHost}`);
+          }
+        } else if (port === 443) {
+          for (const host of [
+            "127.0.0.1",
+            "localhost",
+            "[::1]",
+            "host.docker.internal"
+          ]) {
+            cachedSelfOrigins.add(`https://${host}`);
+          }
+          if (boundHost) {
+            cachedSelfOrigins.add(`https://${boundHost}`);
+          }
+        }
+      }
+      if (cachedSelfOrigins.has(origin)) {
+        delete req.headers.origin;
+      }
+    }
+    next();
+  });
+}
+__name(installSelfOriginStripMiddleware, "installSelfOriginStripMiddleware");
+
+// packages/cli/src/serve/acp-child-extra-args.ts
+init_esbuild_shims();
+function acpChildExtraArgs(opts) {
+  const extraArgs = [
+    ...opts.experimentalLsp === true ? ["--experimental-lsp"] : [],
+    ...opts.restoreAskUserQuestion === true ? ["--restore-ask-user-question"] : []
+  ];
+  return extraArgs.length > 0 ? extraArgs : void 0;
+}
+__name(acpChildExtraArgs, "acpChildExtraArgs");
+
 // packages/cli/src/serve/acp-http/client-mcp-sender-registry.ts
 init_esbuild_shims();
 var ClientMcpSenderRegistry = class {
@@ -1645,6 +1888,7 @@ var SERVE_CAPABILITY_REGISTRY = {
   session_events: { since: "v1" },
   session_artifacts: { since: "v1" },
   session_artifacts_persistence: { since: "v1" },
+  session_sources: { since: "v1" },
   // Daemon emits `slow_client_warning` synthetic frames at 75% queue
   // fill and honors `?maxQueued=N` (range [16, 2048]) on
   // `GET /session/:id/events`. Old daemons silently lack both — SDK
@@ -1791,6 +2035,11 @@ var SERVE_CAPABILITY_REGISTRY = {
   // operation after the activation operation commits.
   extension_activation_explicit_refresh: { since: "v1" },
   workspace_skill_manage: { since: "v1" },
+  // `GET /brand` — the Web Shell's product name and logo, resolved from the
+  // operator settings scopes. Unconditional because the route is registered
+  // unconditionally. Advertised so a host can preflight rather than issue the
+  // request and swallow a 404 from a daemon too old to have it.
+  web_shell_brand: { since: "v1" },
   workspace_settings: { since: "v1" },
   // `GET /workspace/permissions` is always available when this tag is
   // advertised. `POST /workspace/permissions` updates the active ACP
@@ -2121,6 +2370,10 @@ var CONDITIONAL_SERVE_FEATURES = /* @__PURE__ */ new Map([
     "session_artifacts_persistence",
     (toggles) => toggles.sessionArtifactsPersistenceAvailable === true
   ],
+  [
+    "session_sources",
+    (toggles) => toggles.sessionArtifactsPersistenceAvailable === true
+  ],
   [
     "session_generation",
     (toggles) => toggles.sessionGenerationAvailable === true
@@ -3604,6 +3857,8 @@ async function buildDaemonStatusResponse(detail, input) {
       sessionShellCommandEnabled: input.sessionShellCommandEnabled
     },
     limits: {
+      maxRegisteredWorkspaces: input.opts.maxRegisteredWorkspaces ?? MAX_REGISTERED_WORKSPACES,
+      ...input.maxChannelControlWorkspaces !== void 0 ? { maxChannelControlWorkspaces: input.maxChannelControlWorkspaces } : {},
       maxSessions: bridgeSnapshot.limits.maxSessions,
       maxTotalSessions: positiveFiniteOrNull(input.opts.maxTotalSessions),
       maxPendingPromptsPerSession: bridgeSnapshot.limits.maxPendingPromptsPerSession,
@@ -4312,161 +4567,92 @@ var WorkspaceVoiceCoordinator = class {
   }
 };
 
-// packages/cli/src/serve/server/access-log.ts
-init_esbuild_shims();
-init_esm();
-import { performance } from "node:perf_hooks";
-
-// packages/cli/src/serve/server/telemetry-context.ts
+// packages/cli/src/serve/local-control/lan-interfaces.ts
 init_esbuild_shims();
-var daemonTelemetryResponseContext = Symbol(
-  "daemonTelemetryResponseContext"
-);
-var daemonInboundTraceIdContext = Symbol(
-  "daemonInboundTraceIdContext"
-);
-function getDaemonTelemetryInboundTraceId(res) {
-  try {
-    return res[daemonInboundTraceIdContext];
-  } catch {
-    return void 0;
+import { networkInterfaces } from "node:os";
+function isLanIpv4(address) {
+  const octets = address.split(".").map((part) => Number(part));
+  if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o))) {
+    return false;
   }
+  const [a, b] = octets;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
 }
-__name(getDaemonTelemetryInboundTraceId, "getDaemonTelemetryInboundTraceId");
-
-// packages/cli/src/serve/server/access-log.ts
-var SESSION_ID_RE = /\/session\/([^/]+)/;
-var ACCESS_LOG_BURST = 60;
-var ACCESS_LOG_REFILL_PER_SECOND = 2;
-var ROUTE_MAX_BYTES = 2 * 1024;
-var SESSION_ID_MAX_BYTES = 256;
-var CLIENT_ID_MAX_BYTES = 256;
-var ACCESS_LOG_CONTROLLER_LOCAL = "accessLogController";
-function emptySuppressedCounts() {
-  return {
-    suppressed: 0,
-    status2xx: 0,
-    status3xx: 0,
-    status4xx: 0,
-    status5xx: 0,
-    statusOther: 0
-  };
-}
-__name(emptySuppressedCounts, "emptySuppressedCounts");
-function countSuppressed(counts, status) {
-  counts.suppressed += 1;
-  if (status >= 200 && status < 300) counts.status2xx += 1;
-  else if (status >= 300 && status < 400) counts.status3xx += 1;
-  else if (status >= 400 && status < 500) counts.status4xx += 1;
-  else if (status >= 500 && status < 600) counts.status5xx += 1;
-  else counts.statusOther += 1;
+__name(isLanIpv4, "isLanIpv4");
+function isSoftwareNetwork(interfaceName) {
+  if (/vpn/i.test(interfaceName)) return true;
+  return /(^|[\s_.-])(utun|tun|tap|ppp|ipsec|wg|wireguard|tailscale|zerotier|zt[a-z0-9]*|hamachi|nordlynx|proton|wintun|docker|veth[0-9a-f]+|vmnet|vboxnet|vethernet|virtualbox|host[- ]only|podman|cni|lxcbr|lxdbr|flannel|virbr|br-[0-9a-f]+|bridge\d|anyconnect|globalprotect|pulse[\s-]secure|forticlient|fortinet|ivanti|cisco[\s_-]secure|citrix|sonicwall|cloudflare)(\d|[\s_.-]|$)/i.test(
+    interfaceName
+  );
 }
-__name(countSuppressed, "countSuppressed");
-function firstRawHeader(rawHeaders, targetName) {
-  for (let i = 0; i + 1 < rawHeaders.length; i += 2) {
-    if (rawHeaders[i]?.toLowerCase() === targetName) return rawHeaders[i + 1];
+__name(isSoftwareNetwork, "isSoftwareNetwork");
+function listLanCandidates(interfaces = networkInterfaces()) {
+  const candidates = [];
+  for (const [interfaceName, addresses] of Object.entries(interfaces).sort()) {
+    if (isSoftwareNetwork(interfaceName)) continue;
+    for (const address of addresses ?? []) {
+      if (address.family !== "IPv4" || address.internal) continue;
+      if (!isLanIpv4(address.address)) continue;
+      candidates.push({ interfaceName, address: address.address });
+    }
   }
-  return void 0;
+  return candidates;
 }
-__name(firstRawHeader, "firstRawHeader");
-function truncateUtf8(value, maxBytes) {
-  const bytes = Buffer.from(value, "utf8");
-  if (bytes.length <= maxBytes) return { value };
-  let end = maxBytes;
-  while (end > 0 && (bytes[end] & 192) === 128) end -= 1;
-  return {
-    value: bytes.subarray(0, end).toString("utf8"),
-    originalBytes: bytes.length
-  };
-}
-__name(truncateUtf8, "truncateUtf8");
-function installAccessLogMiddleware(app, daemonLog, monotonicNow = () => performance.now()) {
-  let sealed = false;
-  let tokens = ACCESS_LOG_BURST;
-  let refillBaseline = monotonicNow();
-  let suppressed = emptySuppressedCounts();
-  const refill = /* @__PURE__ */ __name(() => {
-    const now = Math.max(monotonicNow(), refillBaseline);
-    tokens = Math.min(
-      ACCESS_LOG_BURST,
-      tokens + (now - refillBaseline) / 1e3 * ACCESS_LOG_REFILL_PER_SECOND
+__name(listLanCandidates, "listLanCandidates");
+var NoLanInterfaceError = class extends Error {
+  static {
+    __name(this, "NoLanInterfaceError");
+  }
+  code = "no_lan_interface";
+  constructor() {
+    super(
+      "No private IPv4 address is available. Local Control needs the host to be on a local network (Wi-Fi or Ethernet)."
     );
-    refillBaseline = now;
-  }, "refill");
-  const flushSuppressed = /* @__PURE__ */ __name(() => {
-    if (!daemonLog || suppressed.suppressed === 0) return false;
-    context.with(ROOT_CONTEXT, () => {
-      daemonLog.warn("access logs suppressed", suppressed);
-    });
-    suppressed = emptySuppressedCounts();
-    return true;
-  }, "flushSuppressed");
-  const controller = {
-    sealAndFlushSuppressed: /* @__PURE__ */ __name(() => {
-      if (sealed) return;
-      sealed = true;
-      try {
-        flushSuppressed();
-      } catch {
-      }
-    }, "sealAndFlushSuppressed")
-  };
-  app.locals[ACCESS_LOG_CONTROLLER_LOCAL] = controller;
-  if (!daemonLog) return controller;
-  app.use((req, res, next) => {
-    const { method, path: reqPath } = req;
-    if (method === "GET" && reqPath === "/health" || method === "POST" && reqPath.endsWith("/heartbeat")) {
-      return next();
-    }
-    const startMs = monotonicNow();
-    res.on("finish", () => {
-      try {
-        if (sealed) return;
-        const status = res.statusCode;
-        if (method === "GET" && reqPath.endsWith("/events") && status === 200) {
-          return;
-        }
-        refill();
-        if (suppressed.suppressed > 0 && tokens >= 1) {
-          tokens -= 1;
-          flushSuppressed();
-        }
-        if (tokens < 1) {
-          countSuppressed(suppressed, status);
-          return;
-        }
-        tokens -= 1;
-        const route = truncateUtf8(`${method} ${reqPath}`, ROUTE_MAX_BYTES);
-        const sessionMatch = reqPath.match(SESSION_ID_RE);
-        const sessionId = sessionMatch?.[1] ? truncateUtf8(sessionMatch[1], SESSION_ID_MAX_BYTES) : void 0;
-        const rawClientId = firstRawHeader(req.rawHeaders, "x-qwen-client-id");
-        const clientId = rawClientId ? truncateUtf8(rawClientId, CLIENT_ID_MAX_BYTES) : void 0;
-        const inboundTraceId = getDaemonTelemetryInboundTraceId(res);
-        const ctx = {
-          route: route.value,
-          ...route.originalBytes ? { routeOriginalBytes: route.originalBytes } : {},
-          ...sessionId ? {
-            sessionId: sessionId.value,
-            ...sessionId.originalBytes ? { sessionIdOriginalBytes: sessionId.originalBytes } : {}
-          } : {},
-          ...clientId ? {
-            clientId: clientId.value,
-            ...clientId.originalBytes ? { clientIdOriginalBytes: clientId.originalBytes } : {}
-          } : {},
-          ...inboundTraceId ? { traceId: inboundTraceId } : {},
-          status,
-          durationMs: Math.max(0, Math.round(monotonicNow() - startMs))
-        };
-        if (status >= 400) daemonLog.warn("request completed", ctx);
-        else daemonLog.info("request completed", ctx);
-      } catch {
-      }
-    });
-    next();
-  });
-  return controller;
+    this.name = "NoLanInterfaceError";
+  }
+};
+var AmbiguousLanInterfaceError = class extends Error {
+  static {
+    __name(this, "AmbiguousLanInterfaceError");
+  }
+  code = "ambiguous_lan_interface";
+  candidates;
+  constructor(candidates) {
+    super(
+      "Multiple local networks are available; choose which one to expose: " + candidates.map((c) => `${c.interfaceName} (${c.address})`).join(", ")
+    );
+    this.name = "AmbiguousLanInterfaceError";
+    this.candidates = candidates;
+  }
+};
+var UnknownLanInterfaceError = class extends Error {
+  static {
+    __name(this, "UnknownLanInterfaceError");
+  }
+  code = "unknown_lan_interface";
+  constructor(requested) {
+    super(
+      `${requested} is not a private IPv4 address on this host right now. The network may have changed since the list was fetched.`
+    );
+    this.name = "UnknownLanInterfaceError";
+  }
+};
+function selectLanAddress(preferredAddress, interfaces = networkInterfaces()) {
+  const candidates = listLanCandidates(interfaces);
+  if (candidates.length === 0) throw new NoLanInterfaceError();
+  if (preferredAddress !== void 0) {
+    const match = candidates.find((c) => c.address === preferredAddress);
+    if (!match) throw new UnknownLanInterfaceError(preferredAddress);
+    return match;
+  }
+  if (candidates.length > 1) throw new AmbiguousLanInterfaceError(candidates);
+  return candidates[0];
 }
-__name(installAccessLogMiddleware, "installAccessLogMiddleware");
+__name(selectLanAddress, "selectLanAddress");
 
 export {
   sanitizeForStderr,
@@ -4481,13 +4667,15 @@ export {
   createBridgeFileSystemAdapter,
   PathMutexRegistry,
   isDeepHealthQuery,
-  installSelfOriginStripMiddleware,
-  acpChildExtraArgs,
   CredentialStore,
   singleTokenCredentials,
   tagListener,
   listenerIdentityOf,
   listenerIdentityOfSocket,
+  daemonTelemetryResponseContext,
+  daemonInboundTraceIdContext,
+  ACCESS_LOG_CONTROLLER_LOCAL,
+  installAccessLogMiddleware,
   denyBrowserOriginCors,
   parseAllowOriginPatterns,
   findNonLoopbackHttpOrigin,
@@ -4498,6 +4686,15 @@ export {
   isTrustedLoopbackMode,
   requestHasOperatorAuthority,
   createMutationGate,
+  installRemoteSelfOriginMiddleware,
+  installSelfOriginStripMiddleware,
+  isSoftwareNetwork,
+  listLanCandidates,
+  NoLanInterfaceError,
+  AmbiguousLanInterfaceError,
+  UnknownLanInterfaceError,
+  selectLanAddress,
+  acpChildExtraArgs,
   ClientMcpSenderRegistry,
   createClientMcpServerProvider,
   SERVE_CAPABILITY_REGISTRY,
@@ -4539,11 +4736,7 @@ export {
   isBrowserAutomationMcpAvailable,
   MAX_CONCURRENT_VOICE_SESSIONS,
   VoiceLeaseAbortError,
-  WorkspaceVoiceCoordinator,
-  daemonTelemetryResponseContext,
-  daemonInboundTraceIdContext,
-  ACCESS_LOG_CONTROLLER_LOCAL,
-  installAccessLogMiddleware
+  WorkspaceVoiceCoordinator
 };
 /**
  * @license