@zubriq/code 0.19.8-2 → 0.19.9-1

package/dist/chunks/{server-KOSHCREY.js → server-FVGFFVZ4.js}

@@ -11,7 +11,7 @@ import {
   openQwenAsrRealtimeStream,
   openVoiceStream,
   openVoiceStreamWithRetry
-} from "./chunk-HXVVCTID.js";
+} from "./chunk-HPQIVXSP.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -22,61 +22,10 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-6N76CE6T.js";
+} from "./chunk-FHTUTVIQ.js";
+import "./chunk-2MDC5WDB.js";
+import "./chunk-LGFAYIKX.js";
 import "./chunk-54YZOP7P.js";
-import "./chunk-AKSRZ5BA.js";
-import {
-  createDaemonStatusProvider
-} from "./chunk-UMU5USBC.js";
-import "./chunk-GKUVMLJH.js";
-import "./chunk-KHDZHZMH.js";
-import {
-  createWorkspaceProvidersStatusProvider
-} from "./chunk-AXYGF5SX.js";
-import {
-  getAuthTypeFromEnv,
-  resolveCliGenerationConfig
-} from "./chunk-VEDR5V7H.js";
-import {
-  createWorkspaceSkillsStatusProvider
-} from "./chunk-3Y2SRVRF.js";
-import "./chunk-6IAWPIQ6.js";
-import {
-  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
-  WorkspaceVoiceError,
-  buildWorkspaceVoiceSettingsWrites,
-  buildWorkspaceVoiceStatus,
-  createDaemonWorkspaceService,
-  hasConfiguredBatchVoiceTranscriptionModel,
-  transcribeWorkspaceVoiceAudio,
-  validateWorkspaceVoiceState,
-  voiceSettingsScopeToWire
-} from "./chunk-A6XKBVOM.js";
-import {
-  PermissionRulesValidationError,
-  buildPermissionSettings,
-  isPermissionRuleType,
-  normalizePermissionRules,
-  readPermissionRuleSet
-} from "./chunk-46IFEQDM.js";
-import {
-  assertVoiceBaseUrlNetworkAllowed,
-  isStreamingVoiceModel,
-  resolveVoiceStreamConfig,
-  resolveVoiceTranscriptionConfig,
-  sanitizeVoiceErrorMessage,
-  transcribeVoiceAudio
-} from "./chunk-PY6PG4BL.js";
-import {
-  isVoiceEnabled,
-  isVoiceMode,
-  readVoiceModel
-} from "./chunk-SWHGVEH5.js";
-import "./chunk-E7KNELIZ.js";
-import {
-  WorkspacePermissionRulesSessionRequiredError,
-  WorkspaceSettingsPartialPersistError
-} from "./chunk-BMFMJINR.js";
 import {
   CAPABILITIES_SCHEMA_VERSION,
   CLIENT_ID_HEADER,
@@ -122,28 +71,84 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-RFIL6REB.js";
+} from "./chunk-YKZIAK7C.js";
 import {
   isLoopbackBind
 } from "./chunk-RNBYOUGV.js";
 import "./chunk-3HX5LZ6R.js";
 import "./chunk-7RYW5LQV.js";
 import {
-  getDialogSettingKeys,
-  getNestedProperty,
-  getSettingDefinition,
-  loadSettings,
-  validateSettingValue
-} from "./chunk-7SZJYZPR.js";
+  createDaemonStatusProvider
+} from "./chunk-PCWYMX57.js";
+import "./chunk-2PRSBVPI.js";
+import "./chunk-KHDZHZMH.js";
 import {
-  SUPPORTED_LANGUAGES
-} from "./chunk-COPJASIO.js";
-import "./chunk-TLRYABYP.js";
-import "./chunk-4RQIB5UZ.js";
+  createWorkspaceProvidersStatusProvider
+} from "./chunk-BYUA6YYS.js";
+import {
+  getAuthTypeFromEnv,
+  resolveCliGenerationConfig
+} from "./chunk-XWDHZP7P.js";
+import {
+  snapshotProcessEnv
+} from "./chunk-FII3C4E7.js";
+import {
+  createWorkspaceSkillsStatusProvider
+} from "./chunk-YJWMOGGZ.js";
+import "./chunk-6IAWPIQ6.js";
+import {
+  EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
+  WorkspaceVoiceError,
+  buildWorkspaceVoiceSettingsWrites,
+  buildWorkspaceVoiceStatus,
+  createDaemonWorkspaceService,
+  hasConfiguredBatchVoiceTranscriptionModel,
+  transcribeWorkspaceVoiceAudio,
+  validateWorkspaceVoiceState,
+  voiceSettingsScopeToWire
+} from "./chunk-74E6VVF6.js";
+import {
+  PermissionRulesValidationError,
+  buildPermissionSettings,
+  isPermissionRuleType,
+  normalizePermissionRules,
+  readPermissionRuleSet
+} from "./chunk-3F22JT4E.js";
+import {
+  assertVoiceBaseUrlNetworkAllowed,
+  isStreamingVoiceModel,
+  resolveVoiceStreamConfig,
+  resolveVoiceTranscriptionConfig,
+  sanitizeVoiceErrorMessage,
+  transcribeVoiceAudio
+} from "./chunk-EZTNYRHH.js";
+import {
+  isVoiceEnabled,
+  isVoiceMode,
+  readVoiceModel
+} from "./chunk-SUCRVT5L.js";
+import "./chunk-E7KNELIZ.js";
+import {
+  WorkspacePermissionRulesSessionRequiredError,
+  WorkspaceSettingsPartialPersistError
+} from "./chunk-BMFMJINR.js";
+import {
+  createTotalSessionAdmissionController
+} from "./chunk-ZL5HN75Q.js";
+import {
+  createSingleWorkspaceRegistry
+} from "./chunk-XNXVCNAT.js";
+import "./chunk-V35MD7KN.js";
 import {
   SessionArtifactValidationError,
   createAcpSessionBridge
-} from "./chunk-PADAEB6D.js";
+} from "./chunk-FAATDXYS.js";
+import "./chunk-AGHU5VRK.js";
+import {
+  EVENT_SCHEMA_VERSION,
+  SubscriberLimitExceededError
+} from "./chunk-3UP777ZS.js";
+import "./chunk-GLE2YUPU.js";
 import "./chunk-P7M4GA57.js";
 import {
   BranchWhilePromptActiveError,
@@ -168,35 +173,49 @@ import {
   SessionNotFoundError,
   SessionShellClientRequiredError,
   SessionShellDisabledError,
+  TotalSessionLimitExceededError,
   WorkspaceInitConflictError,
   WorkspaceInitPathEscapeError,
   WorkspaceInitRaceError,
   WorkspaceInitSymlinkError,
   WorkspaceMismatchError
-} from "./chunk-B34OV7K2.js";
-import "./chunk-AGHU5VRK.js";
+} from "./chunk-GGQQA4JW.js";
 import {
   MAX_WORKSPACE_PATH_LENGTH,
   canonicalizeWorkspace,
   canonicalizeWorkspaces
 } from "./chunk-ER3BKOLB.js";
 import {
-  EVENT_SCHEMA_VERSION,
-  SubscriberLimitExceededError
-} from "./chunk-G7ZG7CA6.js";
+  QWEN_SERVER_TOKEN_ENV
+} from "./chunk-S6RLAIUR.js";
 import "./chunk-VRDMOSQS.js";
-import "./chunk-PMMJS5AM.js";
+import {
+  getDialogSettingKeys,
+  getNestedProperty,
+  getSettingDefinition,
+  loadSettings,
+  validateSettingValue
+} from "./chunk-WJAW2O5H.js";
+import {
+  SUPPORTED_LANGUAGES
+} from "./chunk-MA4AZNP7.js";
+import "./chunk-TLRYABYP.js";
+import "./chunk-XQPMKWSV.js";
+import "./chunk-O2YT7VB4.js";
+import "./chunk-Z3I3QJK3.js";
+import "./chunk-EJP6Z7NU.js";
 import "./chunk-EXPMGZZV.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-Z33V6JSK.js";
+} from "./chunk-Q3PQ5VGJ.js";
 import "./chunk-HLKG6CZN.js";
-import "./chunk-TYOF23VK.js";
+import "./chunk-V2TYBEWU.js";
+import "./chunk-43W4YSO6.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-Z3VQSA4A.js";
+} from "./chunk-VR3KCBHH.js";
 import {
   writeStderrLine
 } from "./chunk-Y6Z2O3WR.js";
@@ -230,18 +249,20 @@ import {
   encodeTextFileContent,
   glob,
   loadIgnoreRules,
-  loadUsageHistory,
+  loadUsageHistoryWithLive,
   parseInstallSource,
   redactUrlCredentials,
   shouldShowStep,
+  stripTerminalControlSequences,
   writeWorkspaceContextFile
-} from "./chunk-FACTYQFS.js";
+} from "./chunk-5MRUKUOG.js";
 import "./chunk-5P5XGNYH.js";
 import "./chunk-SKAZWEV5.js";
 import "./chunk-K5PGHDBN.js";
 import {
-  MAX_JOBS
-} from "./chunk-FVMWEHWU.js";
+  MAX_JOBS,
+  nextDurableFireMs
+} from "./chunk-3B26UVCX.js";
 import "./chunk-W7EEOR7D.js";
 import "./chunk-42XGFRJS.js";
 import "./chunk-X2XNQQJI.js";
@@ -252,11 +273,12 @@ import {
 } from "./chunk-2MPVVENX.js";
 import "./chunk-ZTQ26VBE.js";
 import {
+  appendCronRun,
   generateCronTaskId,
+  getCronFilePath,
   readCronTasks,
-  removeCronTasks,
   updateCronTasks
-} from "./chunk-2NL7ED5Q.js";
+} from "./chunk-FV7425LN.js";
 import "./chunk-MLZQVCF3.js";
 import "./chunk-LQ7TMOCE.js";
 import "./chunk-E5A7LHNN.js";
@@ -264,7 +286,7 @@ import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-VEB3NYSO.js";
+} from "./chunk-5MBO76SL.js";
 import "./chunk-GO6LNQXT.js";
 import "./chunk-NQKLOAVJ.js";
 import "./chunk-WMPVYQ4P.js";
@@ -283,12 +305,12 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-O3DVJ2JO.js";
+} from "./chunk-27AYMAL6.js";
 import "./chunk-E6US47KI.js";
 import "./chunk-UWCTAVOD.js";
 import "./chunk-OFEVLU4C.js";
 import "./chunk-OMX7CUOE.js";
-import "./chunk-4KJ2BPIT.js";
+import "./chunk-OACJLMLD.js";
 import "./chunk-SUAKHHK7.js";
 import "./chunk-FEJ2FZ3U.js";
 import "./chunk-X3YGAX7V.js";
@@ -305,8 +327,8 @@ import "./chunk-AHNJGLFV.js";
 import "./chunk-22IFUCVR.js";
 import "./chunk-7LTB54MK.js";
 import "./chunk-SIUQ3YYX.js";
-import "./chunk-PIORL4OD.js";
-import "./chunk-NCFY7PWS.js";
+import "./chunk-UKV3D7WB.js";
+import "./chunk-CCGOFQV3.js";
 import "./chunk-IRJWHZWU.js";
 import "./chunk-SYCJMSIJ.js";
 import "./chunk-55ZMG67I.js";
@@ -345,9 +367,6 @@ import { createHash as createHash3, timingSafeEqual } from "node:crypto";
 init_esbuild_shims();
 import path8 from "node:path";
 
-// packages/cli/src/serve/acp-session-bridge.ts
-init_esbuild_shims();
-
 // packages/cli/src/serve/fs/errors.ts
 init_esbuild_shims();
 var DEFAULT_STATUS_BY_KIND = {
@@ -3247,7 +3266,8 @@ function cloneTask(task) {
         removedEntries: task.result.removedEntries.map((entry) => ({
           ...entry
         })),
-        touchedTopics: [...task.result.touchedTopics]
+        touchedTopics: [...task.result.touchedTopics],
+        touchedScopes: [...task.result.touchedScopes]
       } : void 0
     };
   }
@@ -3452,7 +3472,8 @@ var WorkspaceRememberTaskLane = class _WorkspaceRememberTaskLane {
         task.result = {
           summary: result.summary ?? formatWorkspaceMemoryForgetSummary(result.removedEntries.length),
           removedEntries: result.removedEntries,
-          touchedTopics: result.touchedTopics
+          touchedTopics: result.touchedTopics,
+          touchedScopes: result.touchedScopes
         };
         task.updatedAt = nowIso();
       } catch (err) {
@@ -3474,7 +3495,7 @@ var WorkspaceRememberTaskLane = class _WorkspaceRememberTaskLane {
           this.publishManagedMemoryChanged({
             source: "workspace_memory_forget",
             taskId: task.taskId,
-            touchedScopes: touchedScopesFromTopics(task.result.touchedTopics),
+            touchedScopes: task.result.touchedScopes,
             ...params.originatorClientId ? { originatorClientId: params.originatorClientId } : {}
           });
         }
@@ -4893,6 +4914,67 @@ __name(createSessionOrganizationService, "createSessionOrganizationService");
 
 // packages/cli/src/serve/server/session-archive.ts
 init_esbuild_shims();
+
+// packages/cli/src/serve/scheduled-task-session-lifecycle.ts
+init_esbuild_shims();
+function isBoundTask(task) {
+  return typeof task.sessionId === "string" && task.sessionId.length > 0;
+}
+__name(isBoundTask, "isBoundTask");
+async function disableTasksForSessions(projectRoot, sessionIds) {
+  if (sessionIds.length === 0) return;
+  const targets = new Set(sessionIds);
+  await updateCronTasks(projectRoot, (tasks) => {
+    let changed = false;
+    const next = tasks.map((task) => {
+      if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled !== false) {
+        changed = true;
+        return { ...task, enabled: false, disabledByArchive: true };
+      }
+      return task;
+    });
+    return changed ? next : tasks;
+  });
+}
+__name(disableTasksForSessions, "disableTasksForSessions");
+async function enableTasksForSessions(projectRoot, sessionIds, now = Date.now()) {
+  if (sessionIds.length === 0) return;
+  const targets = new Set(sessionIds);
+  await updateCronTasks(projectRoot, (tasks) => {
+    let changed = false;
+    const next = tasks.map((task) => {
+      if (isBoundTask(task) && targets.has(task.sessionId) && task.enabled === false && task.disabledByArchive === true) {
+        changed = true;
+        const resumed = { ...task, enabled: true };
+        delete resumed.disabledByArchive;
+        const minute = now - now % 6e4;
+        if (resumed.recurring) {
+          resumed.lastFiredAt = minute;
+        } else {
+          resumed.createdAt = now;
+          resumed.lastFiredAt = minute;
+        }
+        return resumed;
+      }
+      return task;
+    });
+    return changed ? next : tasks;
+  });
+}
+__name(enableTasksForSessions, "enableTasksForSessions");
+async function removeTasksForSessions(projectRoot, sessionIds) {
+  if (sessionIds.length === 0) return;
+  const targets = new Set(sessionIds);
+  await updateCronTasks(projectRoot, (tasks) => {
+    const next = tasks.filter(
+      (task) => !isBoundTask(task) || !targets.has(task.sessionId)
+    );
+    return next.length === tasks.length ? tasks : next;
+  });
+}
+__name(removeTasksForSessions, "removeTasksForSessions");
+
+// packages/cli/src/serve/server/session-archive.ts
 var SessionArchiveCoordinator = class {
   static {
     __name(this, "SessionArchiveCoordinator");
@@ -4995,6 +5077,13 @@ async function deleteDaemonSessions(params) {
       }
     })
   );
+  await removeTasksForSessions(service.getProjectRoot(), removed).catch(
+    (err) => {
+      logSessionArchiveWarning(
+        `removeTasksForSessions failed for [${removed.join(", ")}]: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  );
   return { removed, notFound, errors: [...closeErrors, ...removeErrors] };
 }
 __name(deleteDaemonSessions, "deleteDaemonSessions");
@@ -5151,6 +5240,13 @@ async function archiveDaemonSessions(params) {
     notFound,
     errors
   });
+  await disableTasksForSessions(service.getProjectRoot(), archived).catch(
+    (err) => {
+      logSessionArchiveWarning(
+        `disableTasksForSessions failed for [${archived.join(", ")}]: ${err instanceof Error ? err.message : String(err)} \u2014 bound tasks may keep firing until reconciled`
+      );
+    }
+  );
   return { archived, alreadyArchived, notFound, errors };
 }
 __name(archiveDaemonSessions, "archiveDaemonSessions");
@@ -5197,6 +5293,17 @@ async function unarchiveDaemonSessions(params) {
     notFound,
     errors
   });
+  const resumeSessionIds = [.../* @__PURE__ */ new Set([...unarchived, ...alreadyActive])];
+  try {
+    await enableTasksForSessions(service.getProjectRoot(), resumeSessionIds);
+  } catch (err) {
+    logSessionArchiveWarning(
+      `enableTasksForSessions failed for [${resumeSessionIds.join(", ")}]: ${err instanceof Error ? err.message : String(err)}`
+    );
+    for (const sessionId of resumeSessionIds) {
+      errors.push({ sessionId, error: err });
+    }
+  }
   return { unarchived, alreadyActive, notFound, errors };
 }
 __name(unarchiveDaemonSessions, "unarchiveDaemonSessions");
@@ -5629,7 +5736,27 @@ function toRpcError(err) {
     case "InvalidClientIdError":
       return { code: RPC.INVALID_PARAMS, message: errMsg(err) };
     case "SessionLimitExceededError":
-      return { code: RPC.INTERNAL_ERROR, message: errMsg(err) };
+      return {
+        code: RPC.INTERNAL_ERROR,
+        message: errMsg(err),
+        data: {
+          errorKind: "session_limit_exceeded",
+          limit: err.limit,
+          scope: "workspace",
+          retryable: true
+        }
+      };
+    case "TotalSessionLimitExceededError":
+      return {
+        code: RPC.INTERNAL_ERROR,
+        message: errMsg(err),
+        data: {
+          errorKind: "session_limit_exceeded",
+          limit: err.limit,
+          scope: err.scope,
+          retryable: true
+        }
+      };
     case "PromptQueueFullError": {
       const promptErr = err;
       return {
@@ -9798,10 +9925,10 @@ function isCdpInboundFrame(frame) {
 }
 __name(isCdpInboundFrame, "isCdpInboundFrame");
 var CdpReverseLink = class {
-  constructor(sendToExtension, commandTimeoutMs = DEFAULT_COMMAND_TIMEOUT_MS, log) {
+  constructor(sendToExtension, commandTimeoutMs = DEFAULT_COMMAND_TIMEOUT_MS, log2) {
     this.sendToExtension = sendToExtension;
     this.commandTimeoutMs = commandTimeoutMs;
-    this.log = log;
+    this.log = log2;
   }
   static {
     __name(this, "CdpReverseLink");
@@ -10243,10 +10370,10 @@ var CdpBrowserEmulator = class {
 var CLOSE_NO_BRIDGE = 1011;
 var CLOSE_NORMAL = 1e3;
 var CDP_WS_HEARTBEAT_MS = 15e3;
-function attachCdpClient(ws, registry, log) {
+function attachCdpClient(ws, registry, log2) {
   const bridge = registry.getActive();
   if (!bridge) {
-    log("qwen serve: /cdp rejected \u2014 no extension bridge connected");
+    log2("qwen serve: /cdp rejected \u2014 no extension bridge connected");
     try {
       ws.close(
         CLOSE_NO_BRIDGE,
@@ -10257,7 +10384,7 @@ function attachCdpClient(ws, registry, log) {
     return;
   }
   if (bridge.cdpBound) {
-    log("qwen serve: /cdp rejected \u2014 a puppeteer client is already bound");
+    log2("qwen serve: /cdp rejected \u2014 a puppeteer client is already bound");
     try {
       ws.close(CLOSE_NO_BRIDGE, "A CDP client is already connected");
     } catch {
@@ -10268,19 +10395,19 @@ function attachCdpClient(ws, registry, log) {
   const link = new CdpReverseLink(
     (frame) => bridge.send(frame),
     void 0,
-    log
+    log2
   );
   const emulator = new CdpBrowserEmulator({
     reply: /* @__PURE__ */ __name((frame) => {
       safeWsSend(ws, JSON.stringify(frame), "CDP");
     }, "reply"),
     forwardToTab: link.forwardToTab,
-    log
+    log: log2
   });
   link.bindEmulator(emulator);
   bridge.routeInbound = (frame) => link.handleInbound(frame);
   link.onDetach = (reason) => {
-    log(`qwen serve: /cdp tab detached (${reason}); closing puppeteer socket`);
+    log2(`qwen serve: /cdp tab detached (${reason}); closing puppeteer socket`);
     try {
       ws.close(CLOSE_NORMAL, `tab detached: ${reason}`);
     } catch {
@@ -10291,7 +10418,7 @@ function attachCdpClient(ws, registry, log) {
   const heartbeat = setInterval(() => {
     if (disposed) return;
     if (!heartbeatAlive) {
-      log("qwen serve: /cdp heartbeat missed; closing puppeteer socket");
+      log2("qwen serve: /cdp heartbeat missed; closing puppeteer socket");
       dispose("puppeteer /cdp heartbeat missed");
       try {
         ws.close(CLOSE_NORMAL, "cdp heartbeat missed");
@@ -10303,7 +10430,7 @@ function attachCdpClient(ws, registry, log) {
     try {
       ws.ping();
     } catch (err) {
-      log(
+      log2(
         `qwen serve: /cdp heartbeat ping failed: ${err instanceof Error ? err.message : String(err)}`
       );
       dispose("puppeteer /cdp heartbeat ping failed");
@@ -10321,11 +10448,11 @@ function attachCdpClient(ws, registry, log) {
     if (notifyExtension && registry.getActive() === bridge) {
       try {
         bridge.send({ type: CDP_FRAME_TYPES.release });
-        log(
+        log2(
           `qwen serve: /cdp sent release to extension (puppeteer disconnected: ${reason})`
         );
       } catch (err) {
-        log(
+        log2(
           `qwen serve: /cdp release send failed: ${err instanceof Error ? err.message : String(err)}`
         );
       }
@@ -10338,7 +10465,7 @@ function attachCdpClient(ws, registry, log) {
     }
   }, "dispose");
   link.onAttachFailure = (reason) => {
-    log(`qwen serve: /cdp attach failed (${reason}); closing puppeteer socket`);
+    log2(`qwen serve: /cdp attach failed (${reason}); closing puppeteer socket`);
     dispose(`cdp_attach failed: ${reason}`, false);
     try {
       ws.close(CLOSE_NO_BRIDGE, "cdp attach failed");
@@ -10349,7 +10476,7 @@ function attachCdpClient(ws, registry, log) {
     heartbeatAlive = true;
   });
   bridge.onExtensionGone = () => {
-    log("qwen serve: extension /acp dropped; closing puppeteer /cdp socket");
+    log2("qwen serve: extension /acp dropped; closing puppeteer /cdp socket");
     dispose("extension /acp disconnected", false);
     try {
       ws.close(CLOSE_NORMAL, "extension disconnected");
@@ -10365,19 +10492,19 @@ function attachCdpClient(ws, registry, log) {
       return;
     }
     void emulator.handleFromClient(frame).catch((err) => {
-      log(
+      log2(
         `qwen serve: /cdp emulator error: ${err instanceof Error ? err.message : String(err)}`
       );
     });
   });
   ws.on("close", () => dispose("puppeteer /cdp socket closed"));
   ws.on("error", (err) => {
-    log(
+    log2(
       `qwen serve: /cdp WS error: ${err instanceof Error ? err.message : String(err)}`
     );
     dispose("puppeteer /cdp socket error");
   });
-  log("qwen serve: /cdp puppeteer client bound to extension bridge");
+  log2("qwen serve: /cdp puppeteer client bound to extension bridge");
 }
 __name(attachCdpClient, "attachCdpClient");
 
@@ -10516,7 +10643,7 @@ var MAX_INFLIGHT_MCP_DISPATCH = 8;
 function mountAcpHttp(app, bridge, opts) {
   const enabled = opts.enabled ?? process.env["QWEN_SERVE_ACP_HTTP"] !== "0";
   if (!enabled) return void 0;
-  const path13 = opts.path ?? "/acp";
+  const path14 = opts.path ?? "/acp";
   const dispatcherRef = {};
   const registry = new ConnectionRegistry(
     (req, clientId) => {
@@ -10653,7 +10780,7 @@ function mountAcpHttp(app, bridge, opts) {
     opts.archiveCoordinator ?? new SessionArchiveCoordinator()
   );
   dispatcherRef.current = dispatcher;
-  app.post(path13, async (req, res) => {
+  app.post(path14, async (req, res) => {
     const ct = req.headers["content-type"];
     if (!ct || !ct.startsWith("application/json")) {
       res.status(415).json({ error: "Content-Type must be application/json" });
@@ -10757,7 +10884,7 @@ function mountAcpHttp(app, bridge, opts) {
       );
     });
   });
-  app.get(path13, (req, res) => {
+  app.get(path14, (req, res) => {
     const accept = req.headers["accept"] ?? "";
     if (!accept.includes("text/event-stream")) {
       res.status(406).json({ error: "Accept header must include text/event-stream" });
@@ -10843,7 +10970,7 @@ function mountAcpHttp(app, bridge, opts) {
       onPumpSettled();
     });
   });
-  app.delete(path13, (req, res) => {
+  app.delete(path14, (req, res) => {
     const connectionId = headerOf(req, ACP_CONNECTION_HEADER);
     if (!connectionId) {
       res.status(400).json({ error: "Missing Acp-Connection-Id" });
@@ -10906,7 +11033,7 @@ function mountAcpHttp(app, bridge, opts) {
       const extraRoute = opts.extraWsRoutes?.find(
         (route) => route.path === url.pathname
       );
-      if (url.pathname !== path13 && !isCdpPath && !extraRoute) {
+      if (url.pathname !== path14 && !isCdpPath && !extraRoute) {
         logReject(`unknown-path ${url.pathname}`);
         socket.destroy();
         return;
@@ -11303,7 +11430,7 @@ function mountAcpHttp(app, bridge, opts) {
       });
     }, "upgradeListener");
     httpServer.on("upgrade", upgradeListener);
-    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path13}`);
+    writeStderrLine(`qwen serve: /acp WebSocket transport enabled on ${path14}`);
   }
   __name(setupWebSocket, "setupWebSocket");
   return {
@@ -11356,14 +11483,14 @@ function readVoiceModel2(settings) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 __name(readVoiceModel2, "readVoiceModel");
-function buildModelsConfig(settings) {
+function buildModelsConfig(settings, env) {
   const merged = settings.merged;
-  const selectedAuthType = merged.security?.auth?.selectedType ?? getAuthTypeFromEnv();
+  const selectedAuthType = merged.security?.auth?.selectedType ?? getAuthTypeFromEnv(env);
   const resolvedCliConfig = resolveCliGenerationConfig({
     argv: {},
     settings: merged,
     selectedAuthType,
-    env: process.env
+    env
   });
   return new ModelsConfig({
     initialAuthType: selectedAuthType,
@@ -11373,17 +11500,29 @@ function buildModelsConfig(settings) {
   });
 }
 __name(buildModelsConfig, "buildModelsConfig");
-function loadDaemonVoiceContext(workspaceCwd) {
-  const settings = loadSettings(workspaceCwd);
+function loadDaemonVoiceContext(workspaceCwd, options = {}) {
+  const settings = loadSettings(
+    workspaceCwd,
+    options.env ? { skipLoadEnvironment: true } : true
+  );
   const voiceModel = readVoiceModel2(settings);
   if (!voiceModel) {
     throw new Error("No voice model is configured for this workspace.");
   }
-  const models = buildModelsConfig(settings);
-  resolveVoiceTranscriptionConfig({ config: models, settings, voiceModel });
+  const models = buildModelsConfig(
+    settings,
+    options.env ?? snapshotProcessEnv()
+  );
+  resolveVoiceTranscriptionConfig({
+    config: models,
+    settings,
+    voiceModel,
+    env: options.env
+  });
   return {
     settings,
     models,
+    ...options.env ? { env: options.env } : {},
     voiceModel,
     streaming: isStreamingVoiceModel(voiceModel)
   };
@@ -11423,7 +11562,8 @@ async function defaultOpenStream(ctx, callbacks) {
     const cfg = resolveVoiceStreamConfig({
       config: ctx.models,
       settings: ctx.settings,
-      voiceModel: ctx.voiceModel
+      voiceModel: ctx.voiceModel,
+      env: ctx.env
     });
     await assertVoiceBaseUrlNetworkAllowed(cfg);
     return await openVoiceStreamWithRetry(
@@ -11438,7 +11578,12 @@ __name(defaultOpenStream, "defaultOpenStream");
 function defaultTranscribe(ctx, pcm) {
   return transcribeVoiceAudio(
     { data: encodeWav(pcm), mimeType: "audio/wav" },
-    { config: ctx.models, settings: ctx.settings, voiceModel: ctx.voiceModel }
+    {
+      config: ctx.models,
+      settings: ctx.settings,
+      voiceModel: ctx.voiceModel,
+      env: ctx.env
+    }
   ).catch((error2) => {
     debugLogger3.debug(
       `[voice-ws] batch transcription error: ${errMessage(error2)}`
@@ -11477,7 +11622,7 @@ function parseControl(text) {
 }
 __name(parseControl, "parseControl");
 function createVoiceWsConnectionHandler(boundWorkspace, deps = {}) {
-  const loadContext = deps.loadContext ?? loadDaemonVoiceContext;
+  const loadContext = deps.loadContext ?? ((workspaceCwd) => loadDaemonVoiceContext(workspaceCwd, { env: deps.env }));
   const openStream = deps.openStream ?? defaultOpenStream;
   const transcribe = deps.transcribe ?? defaultTranscribe;
   let activeSessions = 0;
@@ -11885,6 +12030,7 @@ function registerDaemonStatusRoutes(app, deps) {
           opts: deps.opts,
           boundWorkspace: deps.boundWorkspace,
           bridge: deps.bridge,
+          workspaceRegistry: deps.workspaceRegistry,
           workspace: deps.workspace,
           daemonLog: deps.daemonLog,
           startup: deps.startup,
@@ -11899,7 +12045,8 @@ function registerDaemonStatusRoutes(app, deps) {
           sessionShellCommandEnabled: deps.sessionShellCommandEnabled,
           getChannelWorkerSnapshot: deps.getChannelWorkerSnapshot,
           getPerfSnapshot: deps.getPerfSnapshot,
-          getMetricsSeries: deps.getMetricsSeries
+          getMetricsSeries: deps.getMetricsSeries,
+          getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot
         })
       );
     } catch (err) {
@@ -14185,8 +14332,88 @@ __name(registerWorkspaceTrustRoutes, "registerWorkspaceTrustRoutes");
 
 // packages/cli/src/serve/routes/permission.ts
 init_esbuild_shims();
+
+// packages/cli/src/serve/routes/session-runtime.ts
+init_esbuild_shims();
+function requireSessionRuntime(opts) {
+  const {
+    sessionId,
+    route,
+    res,
+    workspaceRegistry,
+    daemonLog,
+    details = {}
+  } = opts;
+  if (workspaceRegistry.list().length === 1) {
+    return workspaceRegistry.primary;
+  }
+  const resolution = workspaceRegistry.resolveLiveSessionOwner(sessionId);
+  if (resolution.kind === "found") {
+    const runtime = resolution.runtime;
+    if (!runtime.primary && !runtime.trusted) {
+      daemonLog?.warn("session routing failed", {
+        route,
+        resolutionKind: "untrusted_workspace",
+        sessionId,
+        workspaceId: runtime.workspaceId,
+        workspaceCwd: runtime.workspaceCwd,
+        ...details
+      });
+      res.status(403).json({
+        error: `Workspace "${runtime.workspaceCwd}" is not trusted.`,
+        code: "untrusted_workspace",
+        sessionId,
+        workspaceId: runtime.workspaceId,
+        workspaceCwd: runtime.workspaceCwd
+      });
+      return void 0;
+    }
+    return runtime;
+  }
+  if (resolution.kind === "not_found") {
+    daemonLog?.warn("session routing failed", {
+      route,
+      resolutionKind: "not_found",
+      sessionId,
+      ...details
+    });
+    res.status(404).json({
+      error: `No session with id "${sessionId}"`,
+      code: "session_not_found",
+      sessionId
+    });
+    return void 0;
+  }
+  const workspaceIds = resolution.runtimes.map(
+    (runtime) => runtime.workspaceId
+  );
+  daemonLog?.warn("session routing failed", {
+    route,
+    resolutionKind: "ambiguous",
+    sessionId,
+    workspaceIds,
+    ...details
+  });
+  res.status(500).json({
+    error: `Session owner is ambiguous for "${sessionId}"`,
+    code: "ambiguous_session_owner",
+    sessionId,
+    route,
+    workspaceIds
+  });
+  return void 0;
+}
+__name(requireSessionRuntime, "requireSessionRuntime");
+
+// packages/cli/src/serve/routes/permission.ts
 function registerPermissionRoutes(app, deps) {
-  const { bridge, mutate, sendPermissionVoteError: sendPermissionVoteError2 } = deps;
+  const {
+    bridge,
+    workspaceRegistry,
+    daemonLog,
+    mutate,
+    sendPermissionVoteError: sendPermissionVoteError2
+  } = deps;
   app.post("/session/:id/permission/:requestId", mutate(), (req, res) => {
     const sessionId = req.params["id"];
     const requestId = req.params["requestId"];
@@ -14201,7 +14428,16 @@ function registerPermissionRoutes(app, deps) {
     };
     let accepted;
     try {
-      accepted = bridge.respondToSessionPermission(
+      const runtime = requireSessionRuntime({
+        sessionId,
+        route: "POST /session/:id/permission/:requestId",
+        res,
+        workspaceRegistry,
+        daemonLog,
+        details: { requestId }
+      });
+      if (!runtime) return;
+      accepted = runtime.bridge.respondToSessionPermission(
         sessionId,
         requestId,
         response,
@@ -14328,6 +14564,25 @@ function encodeOrganizedCursor(last, group, archiveState) {
   ).toString("base64url");
 }
 __name(encodeOrganizedCursor, "encodeOrganizedCursor");
+function parseLiveSessionCursor(cursor) {
+  if (cursor === "") return void 0;
+  try {
+    const parsed = JSON.parse(
+      Buffer.from(cursor, "base64url").toString("utf8")
+    );
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof parsed.activityTime !== "number" || !Number.isFinite(parsed.activityTime) || typeof parsed.sessionId !== "string" || parsed.sessionId.length === 0) {
+      throw new Error("invalid live cursor");
+    }
+    return parsed;
+  } catch {
+    throw new InvalidCursorError(cursor, "live");
+  }
+}
+__name(parseLiveSessionCursor, "parseLiveSessionCursor");
+function encodeLiveSessionCursor(last) {
+  return Buffer.from(JSON.stringify(last), "utf8").toString("base64url");
+}
+__name(encodeLiveSessionCursor, "encodeLiveSessionCursor");
 function toSummary2(item) {
   return {
     sessionId: item.sessionId,
@@ -14373,6 +14628,19 @@ function getSummaryActivityTime(session) {
   return Number.isFinite(time) ? time : 0;
 }
 __name(getSummaryActivityTime, "getSummaryActivityTime");
+function getLiveSessionCursorKey(session) {
+  return {
+    activityTime: getSummaryActivityTime(session),
+    sessionId: session.sessionId
+  };
+}
+__name(getLiveSessionCursorKey, "getLiveSessionCursorKey");
+function compareLiveSessionCursorKeys(a, b) {
+  const byTime = b.activityTime - a.activityTime;
+  if (byTime !== 0) return byTime;
+  return a.sessionId.localeCompare(b.sessionId);
+}
+__name(compareLiveSessionCursorKeys, "compareLiveSessionCursorKeys");
 function compareOrganizedSessions(activityTimeById, a, b) {
   return compareOrganizedCursorKeys(
     getOrganizedCursorKey(activityTimeById, a),
@@ -14580,6 +14848,31 @@ async function listWorkspaceSessionsForResponse(bridge, workspaceCwd, options) {
   return { sessions, nextCursor };
 }
 __name(listWorkspaceSessionsForResponse, "listWorkspaceSessionsForResponse");
+function listLiveWorkspaceSessionsForResponse(bridge, workspaceCwd, options) {
+  const rawSize = options?.size;
+  const requestedSize = typeof rawSize === "number" && Number.isSafeInteger(rawSize) ? rawSize : DEFAULT_SESSION_PAGE_SIZE;
+  const pageSize = Math.min(Math.max(requestedSize, 1), MAX_SESSION_PAGE_SIZE);
+  const cursorKey = options?.cursor !== void 0 ? parseLiveSessionCursor(options.cursor) : void 0;
+  const sessions = bridge.listWorkspaceSessions(workspaceCwd).sort(
+    (a, b) => compareLiveSessionCursorKeys(
+      getLiveSessionCursorKey(a),
+      getLiveSessionCursorKey(b)
+    )
+  );
+  const afterCursor = cursorKey === void 0 ? sessions : sessions.filter(
+    (session) => compareLiveSessionCursorKeys(
+      cursorKey,
+      getLiveSessionCursorKey(session)
+    ) < 0
+  );
+  const page = afterCursor.slice(0, pageSize);
+  const nextCursor = page.length < afterCursor.length ? encodeLiveSessionCursor(getLiveSessionCursorKey(page[page.length - 1])) : void 0;
+  return {
+    sessions: page,
+    ...nextCursor !== void 0 ? { nextCursor } : {}
+  };
+}
+__name(listLiveWorkspaceSessionsForResponse, "listLiveWorkspaceSessionsForResponse");
 function parseSessionPageSizeQuery(raw) {
   if (typeof raw !== "string") return void 0;
   const trimmed = raw.trim();
@@ -14683,6 +14976,7 @@ function registerSessionRoutes(app, deps) {
   const {
     boundWorkspace,
     bridge,
+    workspaceRegistry,
     archiveCoordinator,
     mutate,
     sendBridgeError: sendBridgeError2,
@@ -14691,23 +14985,175 @@ function registerSessionRoutes(app, deps) {
     sessionShellCommandEnabled
   } = deps;
   const LANGUAGE_CODES = deps.languageCodes;
-  const parseSessionIdsBody = /* @__PURE__ */ __name((req, res) => {
-    const body = safeBody(req);
-    const sessionIds = body["sessionIds"];
-    if (!Array.isArray(sessionIds) || sessionIds.length === 0 || sessionIds.length > 100 || !sessionIds.every((id) => typeof id === "string")) {
+  const logSessionRoutingFailure = /* @__PURE__ */ __name((route, resolutionKind, details = {}) => {
+    daemonLog?.warn("session routing failed", {
+      route,
+      resolutionKind,
+      ...details
+    });
+  }, "logSessionRoutingFailure");
+  const sendWorkspaceMismatch = /* @__PURE__ */ __name((res, requestedWorkspace) => {
+    const runtimes = workspaceRegistry.list();
+    if (runtimes.length > 1) {
       res.status(400).json({
-        error: "`sessionIds` must be a non-empty string array (max 100)",
-        code: "invalid_request"
+        error: `Workspace mismatch: daemon is bound to ${runtimes.length} workspaces; none matched the requested workspace.`,
+        code: "workspace_mismatch",
+        boundWorkspace,
+        workspaceCount: runtimes.length,
+        requestedWorkspace
       });
-      return void 0;
+      return;
     }
-    return [...new Set(sessionIds)];
-  }, "parseSessionIdsBody");
-  const serializeSessionErrors = /* @__PURE__ */ __name((errors) => errors.map((e) => ({
-    sessionId: e.sessionId,
-    error: e.error instanceof Error ? e.error.message : String(e.error)
-  })), "serializeSessionErrors");
-  const resolveWorkspaceParam = /* @__PURE__ */ __name((req, res) => {
+    res.status(400).json({
+      error: `Workspace mismatch: daemon is bound to "${boundWorkspace}"`,
+      code: "workspace_mismatch",
+      boundWorkspace,
+      requestedWorkspace
+    });
+  }, "sendWorkspaceMismatch");
+  const resolveRuntimeForSessionCreation = /* @__PURE__ */ __name((body, res) => {
+    const cwd = parseOptionalWorkspaceCwd(body, boundWorkspace, res);
+    if (cwd === void 0) return void 0;
+    let key;
+    try {
+      key = canonicalizeWorkspace(cwd);
+    } catch (err) {
+      if (workspaceRegistry.list().length > 1 && "cwd" in body) {
+        logSessionRoutingFailure("POST /session", "workspace_mismatch", {
+          requestedWorkspace: cwd
+        });
+        sendWorkspaceMismatch(res, cwd);
+        return void 0;
+      }
+      sendBridgeError2(res, err, { route: "POST /session" });
+      return void 0;
+    }
+    if (workspaceRegistry.list().length === 1) {
+      return {
+        runtime: workspaceRegistry.primary,
+        workspaceCwd: "cwd" in body ? key : workspaceRegistry.primary.workspaceCwd
+      };
+    }
+    const runtime = workspaceRegistry.resolveWorkspaceCwd(
+      "cwd" in body ? key : void 0
+    );
+    if (!runtime) {
+      logSessionRoutingFailure("POST /session", "workspace_mismatch", {
+        requestedWorkspace: key
+      });
+      sendWorkspaceMismatch(res, key);
+      return void 0;
+    }
+    if (!runtime.primary && !runtime.trusted) {
+      logSessionRoutingFailure("POST /session", "untrusted_workspace", {
+        workspaceId: runtime.workspaceId,
+        workspaceCwd: runtime.workspaceCwd
+      });
+      res.status(403).json({
+        error: `Workspace "${runtime.workspaceCwd}" is not trusted.`,
+        code: "untrusted_workspace",
+        workspaceCwd: runtime.workspaceCwd
+      });
+      return void 0;
+    }
+    return { runtime, workspaceCwd: runtime.workspaceCwd };
+  }, "resolveRuntimeForSessionCreation");
+  const resolveRuntimeFromWorkspaceParam = /* @__PURE__ */ __name((req, res) => {
+    const workspaceParam = req.params["id"] ?? "";
+    const byId = workspaceRegistry.getByWorkspaceId(workspaceParam);
+    if (byId) return byId;
+    if (!path10.isAbsolute(workspaceParam)) {
+      res.status(400).json({
+        error: "`:id` must decode to a workspace id or absolute path"
+      });
+      return null;
+    }
+    let key;
+    try {
+      key = canonicalizeWorkspace(workspaceParam);
+    } catch {
+      sendWorkspaceMismatch(res, workspaceParam);
+      return null;
+    }
+    const runtime = workspaceRegistry.getByWorkspaceCwd(key);
+    if (!runtime) {
+      sendWorkspaceMismatch(res, key);
+      return null;
+    }
+    return runtime;
+  }, "resolveRuntimeFromWorkspaceParam");
+  const resolvePrimaryOnlyWorkspaceCwd = /* @__PURE__ */ __name((cwd, res, route) => {
+    let key;
+    try {
+      key = canonicalizeWorkspace(cwd);
+    } catch (err) {
+      sendBridgeError2(res, err, { route });
+      return void 0;
+    }
+    if (key !== boundWorkspace) {
+      const runtime = workspaceRegistry.getByWorkspaceCwd(key);
+      if (runtime && !runtime.primary) {
+        res.status(400).json({
+          error: "Non-primary persisted session load/resume is not supported in Phase 2a.",
+          code: "secondary_workspace_load_not_supported",
+          workspaceCwd: runtime.workspaceCwd,
+          workspaceId: runtime.workspaceId,
+          route
+        });
+        return void 0;
+      }
+      sendWorkspaceMismatch(res, key);
+      return void 0;
+    }
+    return key;
+  }, "resolvePrimaryOnlyWorkspaceCwd");
+  const resolveLiveSessionRuntime = /* @__PURE__ */ __name((sessionId, res, route) => requireSessionRuntime({
+    sessionId,
+    route,
+    res,
+    workspaceRegistry,
+    daemonLog
+  }), "resolveLiveSessionRuntime");
+  const sendNonPrimarySessionRouteUnsupported = /* @__PURE__ */ __name((res, route, sessionId, runtime) => {
+    res.status(400).json({
+      error: `Route "${route}" is primary-only for non-primary workspace sessions in Phase 2a.`,
+      code: "non_primary_session_route_not_supported",
+      sessionId,
+      workspaceId: runtime.workspaceId,
+      workspaceCwd: runtime.workspaceCwd,
+      route
+    });
+  }, "sendNonPrimarySessionRouteUnsupported");
+  const withOwnerMutableSession = /* @__PURE__ */ __name((route, handler) => async (req, res) => {
+    const sessionId = requireSessionId(req, res);
+    if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(sessionId, res, route);
+    if (!runtime) return;
+    try {
+      await archiveCoordinator.runSharedMany([sessionId], async () => {
+        await handler(req, res, sessionId, runtime);
+      });
+    } catch (err) {
+      sendBridgeError2(res, err, { route, sessionId });
+    }
+  }, "withOwnerMutableSession");
+  const parseSessionIdsBody = /* @__PURE__ */ __name((req, res) => {
+    const body = safeBody(req);
+    const sessionIds = body["sessionIds"];
+    if (!Array.isArray(sessionIds) || sessionIds.length === 0 || sessionIds.length > 100 || !sessionIds.every((id) => typeof id === "string")) {
+      res.status(400).json({
+        error: "`sessionIds` must be a non-empty string array (max 100)",
+        code: "invalid_request"
+      });
+      return void 0;
+    }
+    return [...new Set(sessionIds)];
+  }, "parseSessionIdsBody");
+  const serializeSessionErrors = /* @__PURE__ */ __name((errors) => errors.map((e) => ({
+    sessionId: e.sessionId,
+    error: e.error instanceof Error ? e.error.message : String(e.error)
+  })), "serializeSessionErrors");
+  const resolveWorkspaceParam = /* @__PURE__ */ __name((req, res) => {
     const workspaceCwd = req.params["id"] ?? "";
     if (!path10.isAbsolute(workspaceCwd)) {
       res.status(400).json({ error: "`:id` must decode to an absolute workspace path" });
@@ -14728,6 +15174,12 @@ function registerSessionRoutes(app, deps) {
   const withMutableSession = /* @__PURE__ */ __name((route, handler) => async (req, res) => {
     const sessionId = requireSessionId(req, res);
     if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(sessionId, res, route);
+    if (!runtime) return;
+    if (!runtime.primary) {
+      sendNonPrimarySessionRouteUnsupported(res, route, sessionId, runtime);
+      return;
+    }
     try {
       await archiveCoordinator.runSharedMany([sessionId], async () => {
         await handler(req, res, sessionId);
@@ -14738,8 +15190,9 @@ function registerSessionRoutes(app, deps) {
   }, "withMutableSession");
   app.post("/session", mutate(), async (req, res) => {
     const body = safeBody(req);
-    const cwd = parseOptionalWorkspaceCwd(body, boundWorkspace, res);
-    if (cwd === void 0) return;
+    const resolvedRuntime = resolveRuntimeForSessionCreation(body, res);
+    if (resolvedRuntime === void 0) return;
+    const { runtime, workspaceCwd } = resolvedRuntime;
     const modelServiceId = typeof body["modelServiceId"] === "string" ? body["modelServiceId"] : void 0;
     const rawSessionScope = body["sessionScope"];
     let sessionScope;
@@ -14756,8 +15209,8 @@ function registerSessionRoutes(app, deps) {
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
-      const session = await bridge.spawnOrAttach({
-        workspaceCwd: cwd,
+      const session = await runtime.bridge.spawnOrAttach({
+        workspaceCwd,
         modelServiceId,
         ...clientId !== void 0 ? { clientId } : {},
         ...sessionScope !== void 0 ? { sessionScope } : {}
@@ -14779,10 +15232,10 @@ function registerSessionRoutes(app, deps) {
           );
         }
         if (!session.attached) {
-          bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
+          runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => {
           });
         } else {
-          bridge.detachClient(session.sessionId, session.clientId).catch(() => {
+          runtime.bridge.detachClient(session.sessionId, session.clientId).catch(() => {
           });
         }
         return;
@@ -14798,21 +15251,27 @@ function registerSessionRoutes(app, deps) {
     const body = safeBody(req);
     const cwd = parseOptionalWorkspaceCwd(body, boundWorkspace, res);
     if (cwd === void 0) return;
+    const primaryCwd = resolvePrimaryOnlyWorkspaceCwd(
+      cwd,
+      res,
+      `POST /session/:id/${action}`
+    );
+    if (primaryCwd === void 0) return;
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
       const session = await archiveCoordinator.runSharedMany(
         [sessionId],
         async () => {
-          await assertSessionLoadable(cwd, sessionId);
+          await assertSessionLoadable(primaryCwd, sessionId);
           return action === "load" ? await bridge.loadSession({
             sessionId,
-            workspaceCwd: cwd,
+            workspaceCwd: primaryCwd,
             historyReplay: "response",
             ...clientId !== void 0 ? { clientId } : {}
           }) : await bridge.resumeSession({
             sessionId,
-            workspaceCwd: cwd,
+            workspaceCwd: primaryCwd,
             ...clientId !== void 0 ? { clientId } : {}
           });
         }
@@ -14930,8 +15389,14 @@ function registerSessionRoutes(app, deps) {
   app.get("/session/:id/status", (req, res) => {
     const sessionId = requireSessionId(req, res);
     if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(
+      sessionId,
+      res,
+      "GET /session/:id/status"
+    );
+    if (!runtime) return;
     try {
-      res.status(200).json(bridge.getSessionSummary(sessionId));
+      res.status(200).json(runtime.bridge.getSessionSummary(sessionId));
     } catch (err) {
       sendBridgeError2(res, err, {
         route: "GET /session/:id/status",
@@ -15200,9 +15665,10 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/prompt",
     mutate(),
-    withMutableSession(
+    withOwnerMutableSession(
       "POST /session/:id/prompt",
-      async (req, res, sessionId) => {
+      async (req, res, sessionId, runtime) => {
+        const ownerBridge = runtime.bridge;
         const body = safeBody(req);
         const prompt = body["prompt"];
         if (!Array.isArray(prompt) || prompt.length === 0) {
@@ -15236,7 +15702,7 @@ function registerSessionRoutes(app, deps) {
         const promptId = crypto2.randomUUID();
         const forwardedBody = { ...body };
         delete forwardedBody["deadlineMs"];
-        const lastEventId = bridge.getSessionLastEventId(sessionId);
+        const lastEventId = ownerBridge.getSessionLastEventId(sessionId);
         addDaemonRequestAttribute("qwen-code.prompt_id", promptId);
         const abort = new AbortController();
         let responseFinished = false;
@@ -15264,7 +15730,7 @@ function registerSessionRoutes(app, deps) {
         }
         let promptPromise;
         try {
-          promptPromise = bridge.sendPrompt(
+          promptPromise = ownerBridge.sendPrompt(
             sessionId,
             {
               ...forwardedBody,
@@ -15337,25 +15803,28 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/heartbeat",
     mutate(),
-    withMutableSession("POST /session/:id/heartbeat", (req, res, sessionId) => {
-      const clientId = parseClientIdHeader(req, res);
-      if (clientId === null) return;
-      const result = bridge.recordHeartbeat(
-        sessionId,
-        clientId !== void 0 ? { clientId } : void 0
-      );
-      res.status(200).json(result);
-    })
+    withOwnerMutableSession(
+      "POST /session/:id/heartbeat",
+      (req, res, sessionId, runtime) => {
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const result = runtime.bridge.recordHeartbeat(
+          sessionId,
+          clientId !== void 0 ? { clientId } : void 0
+        );
+        res.status(200).json(result);
+      }
+    )
   );
   app.post(
     "/session/:id/detach",
     mutate(),
-    withMutableSession(
+    withOwnerMutableSession(
       "POST /session/:id/detach",
-      async (req, res, sessionId) => {
+      async (req, res, sessionId, runtime) => {
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        await bridge.detachClient(sessionId, clientId);
+        await runtime.bridge.detachClient(sessionId, clientId);
         res.status(204).end();
       }
     )
@@ -15363,13 +15832,13 @@ function registerSessionRoutes(app, deps) {
   app.post(
     "/session/:id/cancel",
     mutate(),
-    withMutableSession(
+    withOwnerMutableSession(
       "POST /session/:id/cancel",
-      async (req, res, sessionId) => {
+      async (req, res, sessionId, runtime) => {
         const body = safeBody(req);
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
-        await bridge.cancelSession(
+        await runtime.bridge.cancelSession(
           sessionId,
           {
             ...body,
@@ -15388,10 +15857,16 @@ function registerSessionRoutes(app, deps) {
     const sessionId = req.params["id"];
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
+    const runtime = resolveLiveSessionRuntime(
+      sessionId,
+      res,
+      "DELETE /session/:id"
+    );
+    if (!runtime) return;
     try {
       await archiveCoordinator.runExclusiveMany(
         [sessionId],
-        async () => bridge.closeSession(
+        async () => runtime.bridge.closeSession(
           sessionId,
           clientId !== void 0 ? { clientId } : void 0
         )
@@ -15637,21 +16112,9 @@ function registerSessionRoutes(app, deps) {
     }
   );
   app.get("/workspace/:id/sessions", async (req, res) => {
-    const workspaceCwd = req.params["id"] ?? "";
-    if (!path10.isAbsolute(workspaceCwd)) {
-      res.status(400).json({ error: "`:id` must decode to an absolute workspace path" });
-      return;
-    }
-    const key = canonicalizeWorkspace(workspaceCwd);
-    if (key !== boundWorkspace) {
-      res.status(400).json({
-        error: `Workspace mismatch: daemon is bound to "${boundWorkspace}"`,
-        code: "workspace_mismatch",
-        boundWorkspace,
-        requestedWorkspace: key
-      });
-      return;
-    }
+    const runtime = resolveRuntimeFromWorkspaceParam(req, res);
+    if (runtime === null) return;
+    const key = runtime.workspaceCwd;
     try {
       const cursor = typeof req.query["cursor"] === "string" ? req.query["cursor"] : void 0;
       const size = parseSessionPageSizeQuery(req.query["size"]);
@@ -15687,13 +16150,21 @@ function registerSessionRoutes(app, deps) {
         }
         archiveState = rawArchiveState;
       }
-      const result = await listWorkspaceSessionsForResponse(bridge, key, {
+      if (!runtime.primary && (archiveState === "archived" || view)) {
+        res.status(400).json({
+          error: "Non-primary workspace session listing is live-only in Phase 2a.",
+          code: "non_primary_live_sessions_only"
+        });
+        return;
+      }
+      const options = {
         ...cursor !== void 0 ? { cursor } : {},
         ...size !== void 0 ? { size } : {},
         ...archiveState !== void 0 ? { archiveState } : {},
         ...view !== void 0 ? { view } : {},
         ...group !== void 0 ? { group } : {}
-      });
+      };
+      const result = runtime.primary ? await listWorkspaceSessionsForResponse(runtime.bridge, key, options) : listLiveWorkspaceSessionsForResponse(runtime.bridge, key, options);
       res.status(200).json({
         sessions: result.sessions,
         ...result.nextCursor != null ? { nextCursor: result.nextCursor } : {},
@@ -15851,10 +16322,16 @@ function registerSessionRoutes(app, deps) {
   app.get("/session/:id/pending-prompts", (req, res) => {
     const sessionId = requireSessionId(req, res);
     if (sessionId === null) return;
+    const runtime = resolveLiveSessionRuntime(
+      sessionId,
+      res,
+      "GET /session/:id/pending-prompts"
+    );
+    if (!runtime) return;
     const clientId = parseClientIdHeader(req, res);
     if (clientId === null) return;
     try {
-      const pendingPrompts = bridge.getPendingPrompts(
+      const pendingPrompts = runtime.bridge.getPendingPrompts(
         sessionId,
         clientId !== void 0 ? { clientId } : void 0
       );
@@ -15869,9 +16346,9 @@ function registerSessionRoutes(app, deps) {
   app.delete(
     "/session/:id/pending-prompts/:promptId",
     mutate(),
-    withMutableSession(
+    withOwnerMutableSession(
       "DELETE /session/:id/pending-prompts/:promptId",
-      (req, res, sessionId) => {
+      (req, res, sessionId, runtime) => {
         const clientId = parseClientIdHeader(req, res);
         if (clientId === null) return;
         const promptId = req.params["promptId"];
@@ -15879,7 +16356,7 @@ function registerSessionRoutes(app, deps) {
           res.status(400).json({ error: "`promptId` route parameter is required" });
           return;
         }
-        const result = bridge.removePendingPrompt(
+        const result = runtime.bridge.removePendingPrompt(
           sessionId,
           promptId,
           clientId !== void 0 ? { clientId } : void 0
@@ -15997,7 +16474,7 @@ function registerSessionRoutes(app, deps) {
   );
   app.post(
     "/session/:id/approval-mode",
-    mutate({ strict: true }),
+    mutate(),
     withMutableSession(
       "POST /session/:id/approval-mode",
       async (req, res, sessionId) => {
@@ -16078,6 +16555,24 @@ var MAX_SCHEDULED_TASKS = MAX_JOBS;
 var MAX_PROMPT_LENGTH = 1e5;
 var MAX_NAME_LENGTH2 = 200;
 var MAX_CRON_LENGTH = 200;
+var MAX_SESSION_NAME_LENGTH = 60;
+function scheduledTaskSessionName(label) {
+  const cleaned = stripTerminalControlSequences(label).replace(/[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "").trim().replace(/\s+/g, " ");
+  let short = cleaned;
+  if (cleaned.length > MAX_SESSION_NAME_LENGTH) {
+    let cut = MAX_SESSION_NAME_LENGTH - 1;
+    const boundary = cleaned.charCodeAt(cut - 1);
+    if (boundary >= 55296 && boundary <= 56319) cut -= 1;
+    short = `${cleaned.slice(0, cut)}\u2026`;
+  }
+  return `\u23F0 ${short}`;
+}
+__name(scheduledTaskSessionName, "scheduledTaskSessionName");
+function computeNextRunAt(task) {
+  if (task.enabled === false) return null;
+  return nextDurableFireMs(task);
+}
+__name(computeNextRunAt, "computeNextRunAt");
 function toView(task) {
   return {
     id: task.id,
@@ -16088,7 +16583,14 @@ function toView(task) {
     // Absent enabled defaults to enabled — tool-created tasks never write it.
     enabled: task.enabled !== false,
     createdAt: task.createdAt,
-    lastFiredAt: task.lastFiredAt
+    lastFiredAt: task.lastFiredAt,
+    nextRunAt: computeNextRunAt(task),
+    // The task's bound session (its run-history transcript), or null for an
+    // unbound tool-created/legacy task.
+    sessionId: typeof task.sessionId === "string" && task.sessionId.length > 0 ? task.sessionId : null,
+    // Absent runs (tool-created / never-fired) normalizes to [] so the client
+    // never special-cases undefined.
+    runs: Array.isArray(task.runs) ? task.runs : []
   };
 }
 __name(toView, "toView");
@@ -16102,8 +16604,26 @@ function validateCron(cron) {
   }
 }
 __name(validateCron, "validateCron");
+function canonicalCron(cron) {
+  try {
+    const f = parseCron(cron);
+    const s = /* @__PURE__ */ __name((set) => [...set].sort((a, b) => a - b).join(","), "s");
+    return [
+      s(f.minute),
+      s(f.hour),
+      s(f.dayOfMonth),
+      s(f.month),
+      s(f.dayOfWeek),
+      f.domIsWild ? "W" : "",
+      f.dowIsWild ? "W" : ""
+    ].join("|");
+  } catch {
+    return null;
+  }
+}
+__name(canonicalCron, "canonicalCron");
 function registerScheduledTasksRoutes(app, deps) {
-  const { boundWorkspace, mutate, safeBody: safeBody2 } = deps;
+  const { boundWorkspace, mutate, safeBody: safeBody2, bridge } = deps;
   app.get("/scheduled-tasks", async (_req, res) => {
     try {
       const tasks = await readCronTasks(boundWorkspace);
@@ -16176,6 +16696,41 @@ function registerScheduledTasksRoutes(app, deps) {
     }
     const recurring = body["recurring"] !== false;
     const enabled = body["enabled"] !== false;
+    let boundSessionId;
+    if (bridge) {
+      try {
+        if ((await readCronTasks(boundWorkspace)).length >= MAX_SCHEDULED_TASKS) {
+          res.status(409).json({
+            error: `Maximum number of scheduled tasks (${MAX_SCHEDULED_TASKS}) reached`,
+            code: "max_tasks_reached"
+          });
+          return;
+        }
+      } catch {
+      }
+      try {
+        const session = await bridge.spawnOrAttach({
+          workspaceCwd: boundWorkspace,
+          sessionScope: "thread"
+        });
+        boundSessionId = session.sessionId;
+        try {
+          bridge.updateSessionMetadata(boundSessionId, {
+            displayName: scheduledTaskSessionName(nameResult.value ?? prompt)
+          });
+        } catch {
+        }
+      } catch (err) {
+        writeStderrLine(
+          `qwen serve: POST /scheduled-tasks failed to create the task's session: ${err instanceof Error ? err.message : String(err)}`
+        );
+        res.status(500).json({
+          error: "Failed to create the task's session",
+          code: "scheduled_tasks_session_failed"
+        });
+        return;
+      }
+    }
     const now = Date.now();
     const task = {
       id: generateCronTaskId(),
@@ -16187,8 +16742,17 @@ function registerScheduledTasksRoutes(app, deps) {
       // minute the task was created — same guard cronScheduler.create uses.
       lastFiredAt: now - now % 6e4,
       enabled,
+      ...boundSessionId !== void 0 ? { sessionId: boundSessionId } : {},
       ...nameResult.value !== void 0 ? { name: nameResult.value } : {}
     };
+    const rollbackSession = /* @__PURE__ */ __name(async () => {
+      if (boundSessionId !== void 0 && bridge) {
+        await bridge.closeSession(boundSessionId).catch(() => {
+        });
+        await new SessionService(boundWorkspace).removeSession(boundSessionId).catch(() => {
+        });
+      }
+    }, "rollbackSession");
     let overCap = false;
     try {
       await updateCronTasks(boundWorkspace, (tasks) => {
@@ -16199,6 +16763,7 @@ function registerScheduledTasksRoutes(app, deps) {
         return [...tasks, task];
       });
     } catch (err) {
+      await rollbackSession();
       writeStderrLine(
         `qwen serve: POST /scheduled-tasks failed: ${err instanceof Error ? err.message : String(err)}`
       );
@@ -16209,6 +16774,7 @@ function registerScheduledTasksRoutes(app, deps) {
       return;
     }
     if (overCap) {
+      await rollbackSession();
       res.status(409).json({
         error: `Maximum number of scheduled tasks (${MAX_SCHEDULED_TASKS}) reached`,
         code: "max_tasks_reached"
@@ -16294,17 +16860,32 @@ function registerScheduledTasksRoutes(app, deps) {
     }
     let found = false;
     let updated;
+    let blockedByArchive = false;
     try {
       await updateCronTasks(boundWorkspace, (tasks) => {
         const idx = tasks.findIndex((t) => t.id === id);
         if (idx === -1) return tasks;
         found = true;
         const current = tasks[idx];
+        if (patch.enabled === true && current.disabledByArchive === true) {
+          blockedByArchive = true;
+          return tasks;
+        }
         const next = { ...current, ...patch };
         if (clearName) delete next.name;
-        if (current.enabled === false && patch.enabled === true && next.recurring) {
+        const justReEnabled = current.enabled === false && patch.enabled === true;
+        const cronChanged = patch.cron !== void 0 && canonicalCron(patch.cron) !== canonicalCron(current.cron);
+        const becameRecurring = patch.recurring === true && current.recurring !== true;
+        const becameOneShot = patch.recurring === false && current.recurring !== false;
+        {
           const now = Date.now();
-          next.lastFiredAt = now - now % 6e4;
+          const minute = now - now % 6e4;
+          if (next.recurring && (justReEnabled || cronChanged || becameRecurring)) {
+            next.lastFiredAt = minute;
+          } else if (!next.recurring && (justReEnabled || cronChanged || becameOneShot)) {
+            next.createdAt = now;
+            next.lastFiredAt = minute;
+          }
         }
         updated = next;
         return tasks.map((t, i) => i === idx ? next : t);
@@ -16319,10 +16900,26 @@ function registerScheduledTasksRoutes(app, deps) {
       });
       return;
     }
+    if (blockedByArchive) {
+      res.status(409).json({
+        error: "This task was disabled by archiving its session; unarchive the session to re-enable it.",
+        code: "task_session_archived"
+      });
+      return;
+    }
     if (!found || !updated) {
       res.status(404).json({ error: "Task not found", code: "task_not_found" });
       return;
     }
+    const effectiveLabelChanged = patch.name !== void 0 || clearName || patch.prompt !== void 0 && updated.name === void 0;
+    if (bridge && updated.sessionId && effectiveLabelChanged) {
+      try {
+        bridge.updateSessionMetadata(updated.sessionId, {
+          displayName: scheduledTaskSessionName(updated.name ?? updated.prompt)
+        });
+      } catch {
+      }
+    }
     res.status(200).json(toView(updated));
   });
   app.delete("/scheduled-tasks/:id", mutate(), async (req, res) => {
@@ -16331,9 +16928,19 @@ function registerScheduledTasksRoutes(app, deps) {
       res.status(400).json({ error: "Task id is required", code: "invalid_id" });
       return;
     }
-    let removed;
+    let boundSessionId;
+    let removed = false;
     try {
-      removed = await removeCronTasks(boundWorkspace, [id]);
+      await updateCronTasks(boundWorkspace, (tasks) => {
+        const idx = tasks.findIndex((t) => t.id === id);
+        if (idx === -1) return tasks;
+        const match = tasks[idx].sessionId;
+        if (typeof match === "string" && match.length > 0) {
+          boundSessionId = match;
+        }
+        removed = true;
+        return tasks.filter((_, i) => i !== idx);
+      });
     } catch (err) {
       writeStderrLine(
         `qwen serve: DELETE /scheduled-tasks/${id} failed: ${err instanceof Error ? err.message : String(err)}`
@@ -16344,12 +16951,76 @@ function registerScheduledTasksRoutes(app, deps) {
       });
       return;
     }
-    if (removed === 0) {
+    if (!removed) {
       res.status(404).json({ error: "Task not found", code: "task_not_found" });
       return;
     }
+    if (boundSessionId && bridge) {
+      await bridge.closeSession(boundSessionId).catch(() => {
+      });
+    }
     res.status(200).json({ deleted: true, id });
   });
+  app.post("/scheduled-tasks/:id/run", mutate(), async (req, res) => {
+    const id = typeof req.params["id"] === "string" ? req.params["id"] : "";
+    if (id.length === 0) {
+      res.status(400).json({ error: "Task id is required", code: "invalid_id" });
+      return;
+    }
+    const now = Date.now();
+    let found = false;
+    let blockedDisabled = false;
+    let updated;
+    try {
+      await updateCronTasks(boundWorkspace, (tasks) => {
+        const idx = tasks.findIndex((t) => t.id === id);
+        if (idx === -1) return tasks;
+        found = true;
+        const current = tasks[idx];
+        if (current.enabled === false) {
+          blockedDisabled = true;
+          return tasks;
+        }
+        const next = {
+          ...current,
+          lastFiredAt: now,
+          runs: appendCronRun(current.runs, {
+            at: now,
+            kind: "manual",
+            ...current.sessionId ? { sessionId: current.sessionId } : {}
+          })
+        };
+        updated = next;
+        if (!current.recurring) {
+          return tasks.filter((_, i) => i !== idx);
+        }
+        return tasks.map((t, i) => i === idx ? next : t);
+      });
+    } catch (err) {
+      writeStderrLine(
+        `qwen serve: POST /scheduled-tasks/${id}/run failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      res.status(500).json({
+        error: "Failed to record scheduled task run",
+        code: "scheduled_tasks_write_failed"
+      });
+      return;
+    }
+    if (blockedDisabled) {
+      res.status(409).json({
+        error: "Cannot run a disabled task; enable it first (unarchive its session if it was archived).",
+        code: "task_disabled"
+      });
+      return;
+    }
+    if (!found || !updated) {
+      res.status(404).json({ error: "Task not found", code: "task_not_found" });
+      return;
+    }
+    const view = toView(updated);
+    if (!updated.recurring) view.nextRunAt = null;
+    res.status(200).json(view);
+  });
 }
 __name(registerScheduledTasksRoutes, "registerScheduledTasksRoutes");
 function parseNameField(raw) {
@@ -16384,7 +17055,7 @@ function parseHeatmapDays(raw) {
 }
 __name(parseHeatmapDays, "parseHeatmapDays");
 function registerUsageStatsRoutes(app, deps = {}) {
-  const loadHistory = deps.loadHistory ?? (() => loadUsageHistory(void 0, { persistRebuild: false }));
+  const loadHistory = deps.loadHistory ?? (() => loadUsageHistoryWithLive());
   const ttlMs = deps.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
   let cache = null;
   const getRecords = /* @__PURE__ */ __name(() => {
@@ -16424,6 +17095,320 @@ function registerUsageStatsRoutes(app, deps = {}) {
 }
 __name(registerUsageStatsRoutes, "registerUsageStatsRoutes");
 
+// packages/cli/src/serve/scheduled-task-keepalive.ts
+init_esbuild_shims();
+import * as fsSync from "node:fs";
+import * as path11 from "node:path";
+var log = createDebugLogger("SCHED_KEEPALIVE");
+function collectBoundSessionIds(tasks) {
+  const seen = /* @__PURE__ */ new Set();
+  const ids = [];
+  for (const task of tasks) {
+    const sessionId = task.sessionId;
+    if (task.enabled === false || // disabled (e.g. archived) — let it be reaped
+    typeof sessionId !== "string" || sessionId.length === 0 || seen.has(sessionId)) {
+      continue;
+    }
+    seen.add(sessionId);
+    ids.push(sessionId);
+  }
+  return ids;
+}
+__name(collectBoundSessionIds, "collectBoundSessionIds");
+var KEEPALIVE_REVIVE_TIMEOUT_MS = 3e4;
+var KEEPALIVE_SPAWN_TIMEOUT_MS = 3e4;
+var MAX_REVIVE_BACKOFF_MS = 30 * 6e4;
+async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawnTimeoutMs, binding) {
+  const unbound = tasks.filter(
+    (t) => !t.sessionId && t.enabled !== false && !binding.has(t.id)
+  );
+  const needsName = tasks.filter(
+    (t) => t.sessionId && t.enabled !== false && !renamed.has(t.sessionId)
+  );
+  for (const task of unbound) {
+    let spawnedSessionId;
+    try {
+      binding.add(task.id);
+      const rawSpawn = bridge.spawnOrAttach({
+        workspaceCwd: boundWorkspace,
+        sessionScope: "thread"
+      });
+      let timedOut = false;
+      rawSpawn.then(({ sessionId: sessionId2 }) => {
+        if (timedOut) {
+          log.debug(
+            "keepalive: late spawn resolved, cleaning up",
+            task.id,
+            sessionId2
+          );
+          bridge.closeSession(sessionId2).catch(() => {
+          });
+          new SessionService(boundWorkspace).removeSession(sessionId2).catch(() => {
+          });
+        }
+      }).catch(() => {
+      }).finally(() => {
+        binding.delete(task.id);
+      });
+      const { sessionId } = await withTimeout(
+        rawSpawn,
+        spawnTimeoutMs,
+        `spawnOrAttach(${task.id})`
+      ).catch((err) => {
+        timedOut = true;
+        throw err;
+      });
+      spawnedSessionId = sessionId;
+      try {
+        bridge.updateSessionMetadata(sessionId, {
+          displayName: scheduledTaskSessionName(task.prompt)
+        });
+        renamed.add(sessionId);
+      } catch {
+      }
+      let matched = false;
+      await updateCronTasks(boundWorkspace, (list) => {
+        if (!list.some(
+          (t) => t.id === task.id && !t.sessionId && t.enabled !== false
+        )) {
+          return list;
+        }
+        const result = list.map(
+          (t) => t.id === task.id && !t.sessionId && t.enabled !== false ? { ...t, sessionId } : t
+        );
+        matched = true;
+        return result;
+      });
+      if (!matched) {
+        throw new Error(`task ${task.id} no longer on disk`);
+      }
+      log.debug(
+        "keepalive: bound task",
+        task.id,
+        "to dedicated session",
+        sessionId
+      );
+    } catch (err) {
+      log.debug("keepalive: failed to bind task", task.id, err);
+      if (spawnedSessionId !== void 0) {
+        await bridge.closeSession(spawnedSessionId).catch(() => {
+        });
+        await new SessionService(boundWorkspace).removeSession(spawnedSessionId).catch(() => {
+        });
+      }
+    }
+  }
+  for (const task of needsName) {
+    const sessionId = task.sessionId;
+    try {
+      bridge.updateSessionMetadata(sessionId, {
+        displayName: scheduledTaskSessionName(task.prompt)
+      });
+      renamed.add(sessionId);
+    } catch (err) {
+      log.debug("keepalive: failed to name session", sessionId, err);
+    }
+  }
+}
+__name(bindAndNameSessions, "bindAndNameSessions");
+function startScheduledTaskKeepalive(opts) {
+  const { bridge, boundWorkspace, intervalMs } = opts;
+  const reviveTimeoutMs = opts.reviveTimeoutMs ?? KEEPALIVE_REVIVE_TIMEOUT_MS;
+  const spawnTimeoutMs = opts.spawnTimeoutMs ?? KEEPALIVE_SPAWN_TIMEOUT_MS;
+  const reviveState = /* @__PURE__ */ new Map();
+  const reviving = /* @__PURE__ */ new Set();
+  const binding = /* @__PURE__ */ new Set();
+  const renamed = /* @__PURE__ */ new Set();
+  const tick = /* @__PURE__ */ __name(async () => {
+    let tasks;
+    try {
+      tasks = await readCronTasks(boundWorkspace);
+    } catch (err) {
+      log.debug("keepalive: readCronTasks failed, skipping this pass", err);
+      return;
+    }
+    for (const sessionId of collectBoundSessionIds(tasks)) {
+      try {
+        bridge.recordHeartbeat(sessionId);
+        reviveState.delete(sessionId);
+      } catch (err) {
+        const state = reviveState.get(sessionId);
+        if (reviving.has(sessionId)) {
+          continue;
+        }
+        if (state && Date.now() < state.nextAttemptAt) {
+          continue;
+        }
+        log.debug("keepalive: recordHeartbeat failed for", sessionId, err);
+        const load = bridge.loadSession({
+          sessionId,
+          workspaceCwd: boundWorkspace,
+          historyReplay: "response"
+        });
+        reviving.add(sessionId);
+        void load.catch(() => {
+        }).finally(() => {
+          reviving.delete(sessionId);
+        });
+        try {
+          await withTimeout(load, reviveTimeoutMs, `loadSession(${sessionId})`);
+          log.debug("keepalive: revived non-resident session", sessionId);
+          reviveState.delete(sessionId);
+        } catch (loadErr) {
+          const failures = (state?.failures ?? 0) + 1;
+          const backoff = Math.min(
+            intervalMs * 2 ** Math.min(failures - 1, 6),
+            MAX_REVIVE_BACKOFF_MS
+          );
+          reviveState.set(sessionId, {
+            failures,
+            nextAttemptAt: Date.now() + backoff
+          });
+          log.debug(
+            "keepalive: failed to revive session",
+            sessionId,
+            `(failure ${failures}, next retry in ${backoff}ms)`,
+            loadErr
+          );
+        }
+      }
+    }
+    if (reviveState.size > 0 || renamed.size > 0) {
+      const live = new Set(tasks.map((t) => t.sessionId));
+      for (const id of reviveState.keys()) {
+        if (!live.has(id)) reviveState.delete(id);
+      }
+      for (const id of renamed) {
+        if (!live.has(id)) renamed.delete(id);
+      }
+    }
+    await bindAndNameSessions(
+      bridge,
+      boundWorkspace,
+      tasks,
+      renamed,
+      spawnTimeoutMs,
+      binding
+    );
+  }, "tick");
+  let running = false;
+  const timer = setInterval(() => {
+    if (running) return;
+    running = true;
+    void tick().finally(() => {
+      running = false;
+    });
+  }, intervalMs);
+  timer.unref?.();
+  let bindDebounce;
+  const cronFilePath = getCronFilePath(boundWorkspace);
+  const cronDir = path11.dirname(cronFilePath);
+  const cronFileName = path11.basename(cronFilePath);
+  let fileWatcher;
+  try {
+    fsSync.mkdirSync(cronDir, { recursive: true });
+    fileWatcher = fsSync.watch(
+      cronDir,
+      { persistent: false },
+      (_event, filename) => {
+        if (filename !== null && filename !== cronFileName) return;
+        if (bindDebounce) clearTimeout(bindDebounce);
+        bindDebounce = setTimeout(() => {
+          if (running) return;
+          running = true;
+          void tick().finally(() => {
+            running = false;
+          });
+        }, 500);
+        bindDebounce.unref?.();
+      }
+    );
+    fileWatcher.on("error", () => {
+    });
+  } catch {
+  }
+  let stopped = false;
+  return {
+    stop: /* @__PURE__ */ __name(() => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(timer);
+      if (bindDebounce) clearTimeout(bindDebounce);
+      fileWatcher?.close();
+    }, "stop"),
+    tick
+  };
+}
+__name(startScheduledTaskKeepalive, "startScheduledTaskKeepalive");
+var REHYDRATE_LOAD_TIMEOUT_MS = 3e4;
+var REHYDRATE_MAX_CONCURRENCY = 4;
+async function rehydrateScheduledTaskSessions(deps) {
+  const { bridge, boundWorkspace } = deps;
+  const timeoutMs = deps.loadTimeoutMs ?? REHYDRATE_LOAD_TIMEOUT_MS;
+  let tasks;
+  try {
+    tasks = await readCronTasks(boundWorkspace);
+  } catch (err) {
+    log.debug("rehydrate: readCronTasks failed", err);
+    return { loaded: [], failed: [] };
+  }
+  const sessionIds = collectBoundSessionIds(tasks);
+  const loaded = [];
+  const failed = [];
+  const loadOne = /* @__PURE__ */ __name(async (sessionId) => {
+    const load = bridge.loadSession({
+      sessionId,
+      workspaceCwd: boundWorkspace,
+      historyReplay: "response"
+    });
+    void load.catch(() => {
+    });
+    try {
+      await withTimeout(load, timeoutMs, `loadSession(${sessionId})`);
+      loaded.push(sessionId);
+    } catch (err) {
+      failed.push(sessionId);
+      try {
+        deps.onError?.(sessionId, err);
+      } catch {
+      }
+    }
+  }, "loadOne");
+  const queue = sessionIds.slice();
+  const worker = /* @__PURE__ */ __name(async () => {
+    for (let sessionId = queue.shift(); sessionId !== void 0; sessionId = queue.shift()) {
+      await loadOne(sessionId);
+    }
+  }, "worker");
+  await Promise.all(
+    Array.from(
+      { length: Math.min(REHYDRATE_MAX_CONCURRENCY, queue.length) },
+      () => worker()
+    )
+  );
+  return { loaded, failed };
+}
+__name(rehydrateScheduledTaskSessions, "rehydrateScheduledTaskSessions");
+function withTimeout(p, ms, label) {
+  return new Promise((resolve4, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${ms}ms`));
+    }, ms);
+    if (typeof timer.unref === "function") timer.unref();
+    p.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve4(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+__name(withTimeout, "withTimeout");
+
 // packages/cli/src/serve/routes/workspace-status.ts
 init_esbuild_shims();
 function registerWorkspaceStatusRoutes(app, deps) {
@@ -16543,6 +17528,7 @@ init_esbuild_shims();
 
 // packages/cli/src/serve/server/serve-features.ts
 init_esbuild_shims();
+var DEFAULT_MAX_SESSIONS = 20;
 var DEFAULT_MAX_PENDING_PROMPTS_PER_SESSION = 5;
 var SERVE_LANGUAGE_CODES = [
   ...SUPPORTED_LANGUAGES.map((language) => language.code),
@@ -16554,13 +17540,20 @@ function advertisedMaxPendingPromptsPerSession(value) {
   return value;
 }
 __name(advertisedMaxPendingPromptsPerSession, "advertisedMaxPendingPromptsPerSession");
+function advertisedMaxSessions(value) {
+  if (value === void 0) return DEFAULT_MAX_SESSIONS;
+  if (value === 0 || value === Number.POSITIVE_INFINITY) return null;
+  return value;
+}
+__name(advertisedMaxSessions, "advertisedMaxSessions");
 function createServeFeatures(deps) {
   const {
     opts,
     boundWorkspace,
     persistSettingAvailable,
     reloadAvailable,
-    sessionShellCommandEnabled
+    sessionShellCommandEnabled,
+    multiWorkspaceSessionsEnabled
   } = deps;
   let cachedVoiceTranscriptionAvailable;
   const invalidateServeFeaturesCache = /* @__PURE__ */ __name(() => {
@@ -16583,6 +17576,7 @@ function createServeFeatures(deps) {
       sessionShellCommandEnabled,
       rateLimit: opts.rateLimit === true,
       reloadAvailable,
+      multiWorkspaceSessionsEnabled,
       clientMcpOverWsEnabled: opts.clientMcpOverWs === true,
       cdpTunnelOverWsEnabled: opts.cdpTunnelOverWs === true,
       voiceTranscriptionAvailable: getCachedVoiceTranscriptionAvailable(),
@@ -16612,6 +17606,8 @@ __name(isWorkspaceVoiceTranscriptionAvailable, "isWorkspaceVoiceTranscriptionAva
 // packages/cli/src/serve/routes/capabilities.ts
 function registerCapabilitiesRoutes(app, deps) {
   app.get("/capabilities", (_req, res) => {
+    const runtimes = deps.workspaceRegistry.list();
+    const multiWorkspace = runtimes.length > 1;
     const envelope = {
       v: CAPABILITIES_SCHEMA_VERSION,
       protocolVersions: getServeProtocolVersions(),
@@ -16619,8 +17615,8 @@ function registerCapabilitiesRoutes(app, deps) {
       mode: deps.mode,
       features: deps.currentServeFeatures(),
       modelServices: [],
-      // Surface the bound workspace so clients can detect mismatch pre-flight
-      // and omit `cwd` on `POST /session`.
+      // Surface the primary workspace so clients can omit `cwd` on
+      // `POST /session`; multi-workspace clients use `workspaces[]`.
       workspaceCwd: deps.boundWorkspace,
       // Advertise supported transport families so SDK clients can
       // auto-negotiate the best available transport via negotiateTransport().
@@ -16630,8 +17626,22 @@ function registerCapabilitiesRoutes(app, deps) {
       limits: {
         maxPendingPromptsPerSession: advertisedMaxPendingPromptsPerSession(
           deps.maxPendingPromptsPerSession
-        )
+        ),
+        ...multiWorkspace ? {
+          maxSessionsPerWorkspace: advertisedMaxSessions(
+            deps.maxSessionsPerWorkspace
+          ),
+          maxTotalSessions: deps.maxTotalSessions === void 0 || deps.maxTotalSessions === 0 || deps.maxTotalSessions === Number.POSITIVE_INFINITY ? null : deps.maxTotalSessions
+        } : {}
       },
+      ...multiWorkspace ? {
+        workspaces: runtimes.map((runtime) => ({
+          id: runtime.workspaceId,
+          cwd: runtime.workspaceCwd,
+          primary: runtime.primary,
+          trusted: runtime.trusted
+        }))
+      } : {},
       supportedLanguages: deps.languageCodes
     };
     res.status(200).json(envelope);
@@ -17155,7 +18165,28 @@ function sendBridgeError(res, err, ctx, daemonLog) {
     res.status(503).json({
       error: err.message,
       code: "session_limit_exceeded",
-      limit: err.limit
+      limit: err.limit,
+      scope: "workspace"
+    });
+    return;
+  }
+  if (err instanceof TotalSessionLimitExceededError) {
+    const totalSessionError = err;
+    daemonLog?.warn("total session admission rejected", {
+      ...ctx?.route ? { route: ctx.route } : {},
+      ...ctx?.sessionId ? { sessionId: ctx.sessionId } : {},
+      limit: totalSessionError.limit,
+      scope: totalSessionError.scope,
+      ...totalSessionError.operation ? { operation: totalSessionError.operation } : {},
+      ...totalSessionError.workspaceCwd ? { workspaceCwd: totalSessionError.workspaceCwd } : {},
+      ...totalSessionError.sourceSessionId ? { sourceSessionId: totalSessionError.sourceSessionId } : {}
+    });
+    res.set("Retry-After", "5");
+    res.status(503).json({
+      error: err.message,
+      code: "session_limit_exceeded",
+      limit: err.limit,
+      scope: err.scope
     });
     return;
   }
@@ -17357,7 +18388,7 @@ data: ${dataJson}
 }
 __name(formatSseFrame, "formatSseFrame");
 function registerSseEventsRoutes(app, deps) {
-  const { bridge, daemonLog, sendBridgeError: sendBridgeError2, writerIdleTimeoutMs } = deps;
+  const { workspaceRegistry, daemonLog, sendBridgeError: sendBridgeError2, writerIdleTimeoutMs } = deps;
   app.get("/session/:id/events", (req, res) => {
     const sessionId = req.params["id"];
     const lastEventId = parseLastEventId(req.headers["last-event-id"]);
@@ -17366,8 +18397,16 @@ function registerSseEventsRoutes(app, deps) {
     let iter;
     const abort = new AbortController();
     try {
+      const runtime = requireSessionRuntime({
+        sessionId,
+        route: "GET /session/:id/events",
+        res,
+        workspaceRegistry,
+        daemonLog
+      });
+      if (!runtime) return;
       const snapshot = req.query["snapshot"] === "1";
-      const iterable = bridge.subscribeEvents(sessionId, {
+      const iterable = runtime.bridge.subscribeEvents(sessionId, {
         signal: abort.signal,
         lastEventId,
         ...maxQueued !== void 0 ? { maxQueued } : {},
@@ -17573,10 +18612,13 @@ __name(registerSseEventsRoutes, "registerSseEventsRoutes");
 // packages/cli/src/serve/routes/a2ui-action.ts
 init_esbuild_shims();
 import * as fsp4 from "node:fs/promises";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var A2UI_MIME = "application/a2ui+json";
 var ACTION_TOOL = "action";
 var CALL_TIMEOUT_MS = 15e3;
+var SCRUBBED_STDIO_ENV_KEYS = /* @__PURE__ */ new Set([
+  QWEN_SERVER_TOKEN_ENV
+]);
 function usableServerConfig(cfg) {
   if (!cfg) return false;
   if (typeof cfg.httpUrl === "string") {
@@ -17593,7 +18635,7 @@ __name(usableServerConfig, "usableServerConfig");
 async function findFromSettingsFile(workspaceCwd) {
   try {
     const raw = await fsp4.readFile(
-      path11.join(workspaceCwd, ".qwen", "settings.json"),
+      path12.join(workspaceCwd, ".qwen", "settings.json"),
       "utf8"
     );
     const settings = JSON.parse(raw);
@@ -17607,22 +18649,34 @@ async function findFromSettingsFile(workspaceCwd) {
   return null;
 }
 __name(findFromSettingsFile, "findFromSettingsFile");
-function buildTransport(cfg) {
+function buildTransport(cfg, baseEnv = snapshotProcessEnv()) {
   if (typeof cfg.httpUrl === "string") {
     return new StreamableHTTPClientTransport(new URL(cfg.httpUrl));
   }
   return new StdioClientTransport({
     command: cfg.command,
     args: cfg.args ?? [],
-    // spawn() treats `env` as a complete replacement, not a merge — a partial
-    // env (e.g. {API_KEY}) would strip PATH/HOME and break the child. Merge
-    // over process.env like packages/core/src/tools/mcp-client.ts does; when
-    // unset, let the SDK apply its safe default environment.
-    ...cfg.env ? { env: { ...process.env, ...cfg.env } } : {},
+    // Passing `env` prevents the SDK from reading live process.env while
+    // keeping daemon MCP stdio behavior aligned with the core CLI client.
+    env: buildStdioServerEnv(baseEnv, cfg.env),
     cwd: cfg.cwd
   });
 }
 __name(buildTransport, "buildTransport");
+function buildStdioServerEnv(baseEnv, serverEnv) {
+  const env = {};
+  for (const [key, value] of Object.entries(baseEnv)) {
+    if (value !== void 0 && !key.startsWith("BASH_FUNC_") && !value.startsWith("()") && !SCRUBBED_STDIO_ENV_KEYS.has(key)) {
+      env[key] = value;
+    }
+  }
+  const merged = { ...env, ...serverEnv ?? {} };
+  for (const key of SCRUBBED_STDIO_ENV_KEYS) {
+    delete merged[key];
+  }
+  return merged;
+}
+__name(buildStdioServerEnv, "buildStdioServerEnv");
 function extractA2uiActionResult(result) {
   if (result.isError) {
     const errMsg2 = (result.content ?? []).filter(
@@ -17648,8 +18702,8 @@ function extractA2uiActionResult(result) {
   return { commands, fallback };
 }
 __name(extractA2uiActionResult, "extractA2uiActionResult");
-async function callA2uiAction(cfg, args) {
-  const transport = buildTransport(cfg);
+async function callA2uiAction(cfg, args, env) {
+  const transport = buildTransport(cfg, env);
   const client = new Client({ name: "qwen-serve-a2ui", version: "0.0.1" });
   try {
     await client.connect(transport, { timeout: CALL_TIMEOUT_MS });
@@ -17669,7 +18723,7 @@ async function callA2uiAction(cfg, args) {
 __name(callA2uiAction, "callA2uiAction");
 function registerA2uiActionRoutes(app, opts) {
   const { boundWorkspace, mutate, safeBody: safeBody2, getMcpServers } = opts;
-  const callAction = opts.callAction ?? callA2uiAction;
+  const callAction = opts.callAction ?? ((cfg, args) => callA2uiAction(cfg, args, opts.env));
   app.post(
     "/session/:id/a2ui-action",
     mutate(),
@@ -17718,7 +18772,7 @@ __name(registerA2uiActionRoutes, "registerA2uiActionRoutes");
 
 // packages/cli/src/serve/server/fs-factory.ts
 init_esbuild_shims();
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 var IDE_WORKSPACE_PATH_ENV_VAR = "QWEN_CODE_IDE_WORKSPACE_PATH";
 function createDefaultFsAuditEmit() {
   const WARN_EVERY = 100;
@@ -17792,14 +18846,14 @@ function parseIdeWorkspacePathEnv(value) {
       const parsed = JSON.parse(value);
       if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
         return parsed.filter(
-          (workspace) => workspace.length > 0 && path12.isAbsolute(workspace)
+          (workspace) => workspace.length > 0 && path13.isAbsolute(workspace)
         );
       }
       throw new Error("IDE workspace path JSON must be a string array");
     } catch {
     }
   }
-  return value.split(path12.delimiter).filter((workspace) => workspace.length > 0 && path12.isAbsolute(workspace));
+  return value.split(path13.delimiter).filter((workspace) => workspace.length > 0 && path13.isAbsolute(workspace));
 }
 __name(parseIdeWorkspacePathEnv, "parseIdeWorkspacePathEnv");
 function dropNestedWorkspacesPreservingPrimary(workspaces) {
@@ -17825,17 +18879,17 @@ __name(dropNestedWorkspacesPreservingPrimary, "dropNestedWorkspacesPreservingPri
 // packages/cli/src/serve/server/telemetry.ts
 init_esbuild_shims();
 function resolveDaemonTelemetryRoute(req) {
-  const path13 = req.path.replace(/\/$/, "") || "/";
-  if (req.method === "POST" && path13 === "/session") {
+  const path14 = req.path.replace(/\/$/, "") || "/";
+  if (req.method === "POST" && path14 === "/session") {
     return { route: "POST /session" };
   }
-  if (req.method === "POST" && path13 === "/sessions/delete") {
+  if (req.method === "POST" && path14 === "/sessions/delete") {
     return { route: "POST /sessions/delete" };
   }
-  if (req.method === "GET" && path13 === "/daemon/status") {
+  if (req.method === "GET" && path14 === "/daemon/status") {
     return { route: "GET /daemon/status" };
   }
-  const sessionAction = path13.match(
+  const sessionAction = path14.match(
     /^\/session\/([^/]+)\/(load|resume|prompt|cancel|recap|btw|mid-turn-message|model|shell|detach|rewind|approval-mode|language|a2ui-action)$/
   );
   const sessionActionId = sessionAction?.[1];
@@ -17846,14 +18900,14 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: sessionActionId
     };
   }
-  const sessionMetadata = path13.match(/^\/session\/([^/]+)\/metadata$/);
+  const sessionMetadata = path14.match(/^\/session\/([^/]+)\/metadata$/);
   if (sessionMetadata?.[1] && req.method === "PATCH") {
     return {
       route: "PATCH /session/:id/metadata",
       sessionId: sessionMetadata[1]
     };
   }
-  const sessionArtifacts = path13.match(/^\/session\/([^/]+)\/artifacts$/);
+  const sessionArtifacts = path14.match(/^\/session\/([^/]+)\/artifacts$/);
   if (sessionArtifacts?.[1]) {
     if (req.method === "GET") {
       return {
@@ -17868,7 +18922,7 @@ function resolveDaemonTelemetryRoute(req) {
       };
     }
   }
-  const sessionArtifact = path13.match(
+  const sessionArtifact = path14.match(
     /^\/session\/([^/]+)\/artifacts\/([^/]+)$/
   );
   if (sessionArtifact?.[1] && req.method === "DELETE") {
@@ -17877,7 +18931,7 @@ function resolveDaemonTelemetryRoute(req) {
       sessionId: sessionArtifact[1]
     };
   }
-  const sessionPermission = path13.match(
+  const sessionPermission = path14.match(
     /^\/session\/([^/]+)\/permission\/([^/]+)$/
   );
   if (sessionPermission?.[1] && sessionPermission?.[2] && req.method === "POST") {
@@ -17888,7 +18942,7 @@ function resolveDaemonTelemetryRoute(req) {
       ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
     };
   }
-  const globalPermission = path13.match(/^\/permission\/([^/]+)$/);
+  const globalPermission = path14.match(/^\/permission\/([^/]+)$/);
   if (globalPermission?.[1] && req.method === "POST") {
     const rawRequestId = globalPermission[1];
     return {
@@ -17896,66 +18950,66 @@ function resolveDaemonTelemetryRoute(req) {
       ...rawRequestId.length <= MAX_CLIENT_ID_LENGTH && CLIENT_ID_RE.test(rawRequestId) ? { permissionRequestId: rawRequestId } : {}
     };
   }
-  const deleteSession = path13.match(/^\/session\/([^/]+)$/);
+  const deleteSession = path14.match(/^\/session\/([^/]+)$/);
   const deleteSessionId = deleteSession?.[1];
   if (deleteSessionId && req.method === "DELETE") {
     return { route: "DELETE /session/:id", sessionId: deleteSessionId };
   }
-  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path13)) {
+  if (req.method === "GET" && /^\/workspace\/[^/]+\/sessions$/.test(path14)) {
     return { route: "GET /workspace/:id/sessions" };
   }
-  if (req.method === "POST" && path13 === "/workspace/init") {
+  if (req.method === "POST" && path14 === "/workspace/init") {
     return { route: "POST /workspace/init" };
   }
-  if (req.method === "POST" && path13 === "/workspace/setup-github") {
+  if (req.method === "POST" && path14 === "/workspace/setup-github") {
     return { route: "POST /workspace/setup-github" };
   }
-  if (req.method === "POST" && path13 === "/workspace/reload") {
+  if (req.method === "POST" && path14 === "/workspace/reload") {
     return { route: "POST /workspace/reload" };
   }
-  const mcpRestart = path13.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
+  const mcpRestart = path14.match(/^\/workspace\/mcp\/([^/]+)\/restart$/);
   if (mcpRestart?.[1] && req.method === "POST") {
     return { route: "POST /workspace/mcp/:server/restart" };
   }
-  if (req.method === "POST" && path13 === "/workspace/mcp/servers") {
+  if (req.method === "POST" && path14 === "/workspace/mcp/servers") {
     return { route: "POST /workspace/mcp/servers" };
   }
-  const mcpDelete = path13.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
+  const mcpDelete = path14.match(/^\/workspace\/mcp\/servers\/([^/]+)$/);
   if (mcpDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/mcp/servers/:name" };
   }
-  if (req.method === "POST" && path13 === "/workspace/auth/device-flow") {
+  if (req.method === "POST" && path14 === "/workspace/auth/device-flow") {
     return { route: "POST /workspace/auth/device-flow" };
   }
-  const deviceFlowDelete = path13.match(
+  const deviceFlowDelete = path14.match(
     /^\/workspace\/auth\/device-flow\/([^/]+)$/
   );
   if (deviceFlowDelete?.[1] && req.method === "DELETE") {
     return { route: "DELETE /workspace/auth/device-flow/:id" };
   }
-  const toolEnable = path13.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
+  const toolEnable = path14.match(/^\/workspace\/tools\/([^/]+)\/enable$/);
   if (toolEnable?.[1] && req.method === "POST") {
     return { route: "POST /workspace/tools/:name/enable" };
   }
-  if (path13 === "/workspace/settings") {
+  if (path14 === "/workspace/settings") {
     if (req.method === "GET") return { route: "GET /workspace/settings" };
     if (req.method === "POST") return { route: "POST /workspace/settings" };
   }
-  if (path13 === "/workspace/permissions") {
+  if (path14 === "/workspace/permissions") {
     if (req.method === "GET") return { route: "GET /workspace/permissions" };
     if (req.method === "POST") return { route: "POST /workspace/permissions" };
   }
-  if (path13 === "/workspace/trust") {
+  if (path14 === "/workspace/trust") {
     if (req.method === "GET") return { route: "GET /workspace/trust" };
   }
-  if (req.method === "POST" && path13 === "/workspace/trust/request") {
+  if (req.method === "POST" && path14 === "/workspace/trust/request") {
     return { route: "POST /workspace/trust/request" };
   }
-  if (path13 === "/workspace/voice") {
+  if (path14 === "/workspace/voice") {
     if (req.method === "GET") return { route: "GET /workspace/voice" };
     if (req.method === "POST") return { route: "POST /workspace/voice" };
   }
-  if (req.method === "POST" && path13 === "/workspace/voice/transcribe") {
+  if (req.method === "POST" && path14 === "/workspace/voice/transcribe") {
     return { route: "POST /workspace/voice/transcribe" };
   }
   return void 0;
@@ -18323,10 +19377,10 @@ function installRateLimiter(app, opts, daemonLog) {
         { tier, key: key.slice(0, 64) }
       );
     } : void 0,
-    onError: daemonLog ? (err, path13) => {
+    onError: daemonLog ? (err, path14) => {
       daemonLog.warn(
         `rate limiter error (fail-open): ${err instanceof Error ? err.message : String(err)}`,
-        { path: path13 }
+        { path: path14 }
       );
     } : void 0
   });
@@ -18377,73 +19431,6 @@ function installSelfOriginStripMiddleware(app, getPort) {
 }
 __name(installSelfOriginStripMiddleware, "installSelfOriginStripMiddleware");
 
-// packages/cli/src/serve/workspace-registry.ts
-init_esbuild_shims();
-function createWorkspaceRegistry(inputRuntimes) {
-  if (inputRuntimes.length === 0) {
-    throw new Error(
-      "WorkspaceRegistry requires at least one workspace runtime."
-    );
-  }
-  const primaryRuntimes = inputRuntimes.filter((runtime) => runtime.primary);
-  if (primaryRuntimes.length !== 1) {
-    throw new Error(
-      "WorkspaceRegistry requires exactly one primary workspace runtime."
-    );
-  }
-  const byCwd = /* @__PURE__ */ new Map();
-  const byId = /* @__PURE__ */ new Map();
-  for (const runtime of inputRuntimes) {
-    if (byCwd.has(runtime.workspaceCwd)) {
-      throw new Error(
-        `Duplicate workspace runtime cwd ${JSON.stringify(
-          runtime.workspaceCwd
-        )}.`
-      );
-    }
-    byCwd.set(runtime.workspaceCwd, runtime);
-    if (byId.has(runtime.workspaceId)) {
-      throw new Error(
-        `Duplicate workspace runtime id ${JSON.stringify(
-          runtime.workspaceId
-        )}.`
-      );
-    }
-    byId.set(runtime.workspaceId, runtime);
-  }
-  const runtimes = Object.freeze([...inputRuntimes]);
-  const primary = primaryRuntimes[0];
-  return {
-    primary,
-    list: /* @__PURE__ */ __name(() => runtimes, "list"),
-    getByWorkspaceCwd: /* @__PURE__ */ __name((workspaceCwd) => byCwd.get(workspaceCwd), "getByWorkspaceCwd"),
-    getByWorkspaceId: /* @__PURE__ */ __name((workspaceId) => byId.get(workspaceId), "getByWorkspaceId"),
-    resolveWorkspaceCwd: /* @__PURE__ */ __name((workspaceCwd) => workspaceCwd === void 0 ? primary : byCwd.get(workspaceCwd), "resolveWorkspaceCwd"),
-    resolveLiveSessionOwner: /* @__PURE__ */ __name((sessionId) => {
-      const matches = [];
-      for (const runtime of runtimes) {
-        try {
-          runtime.bridge.getSessionSummary(sessionId);
-          matches.push(runtime);
-        } catch (err) {
-          if (err instanceof SessionNotFoundError) continue;
-          throw err;
-        }
-      }
-      if (matches.length === 0) return { kind: "not_found" };
-      if (matches.length === 1) {
-        return { kind: "found", runtime: matches[0] };
-      }
-      return { kind: "ambiguous", runtimes: matches };
-    }, "resolveLiveSessionOwner")
-  };
-}
-__name(createWorkspaceRegistry, "createWorkspaceRegistry");
-function createSingleWorkspaceRegistry(runtime) {
-  return createWorkspaceRegistry([runtime]);
-}
-__name(createSingleWorkspaceRegistry, "createSingleWorkspaceRegistry");
-
 // packages/cli/src/serve/routes/workspace-lifecycle.ts
 init_esbuild_shims();
 function registerWorkspaceLifecycleRoutes(app, deps) {
@@ -18746,6 +19733,22 @@ function describeRegistryPrimaryForConflict(registry) {
   return `registry primary cwd=${JSON.stringify(registry.primary.workspaceCwd)}, workspaceId=${JSON.stringify(registry.primary.workspaceId)}`;
 }
 __name(describeRegistryPrimaryForConflict, "describeRegistryPrimaryForConflict");
+function getRuntimeEffectiveEnv(metadata) {
+  return metadata?.effectiveEnv;
+}
+__name(getRuntimeEffectiveEnv, "getRuntimeEffectiveEnv");
+var DEFAULT_SESSION_IDLE_TIMEOUT_MS = 30 * 6e4;
+var KEEPALIVE_MIN_INTERVAL_MS = 3e4;
+var KEEPALIVE_MAX_INTERVAL_MS = 10 * 6e4;
+function computeKeepaliveIntervalMs(idleTimeoutMs) {
+  if (idleTimeoutMs <= 0) return KEEPALIVE_MAX_INTERVAL_MS;
+  const target = Math.min(
+    Math.max(KEEPALIVE_MIN_INTERVAL_MS, Math.floor(idleTimeoutMs / 3)),
+    KEEPALIVE_MAX_INTERVAL_MS
+  );
+  return Math.max(1, Math.min(target, Math.floor(idleTimeoutMs / 2)));
+}
+__name(computeKeepaliveIntervalMs, "computeKeepaliveIntervalMs");
 function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   const app = (0, import_express4.default)();
   const injectedWorkspaceRegistry = deps.workspaceRegistry;
@@ -18814,6 +19817,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     );
   }
   const clientMcpSenderRegistry = injectedWorkspaceRegistry?.primary.clientMcpSenderRegistry ?? deps.clientMcpSenderRegistry ?? new ClientMcpSenderRegistry();
+  const primaryRuntimeEnvMetadata = injectedWorkspaceRegistry?.primary.env ?? deps.primaryRuntimeEnv;
+  const primaryEffectiveEnv = getRuntimeEffectiveEnv(primaryRuntimeEnvMetadata);
   const { languageCodes, currentServeFeatures, invalidateServeFeaturesCache } = createServeFeatures({
     opts,
     boundWorkspace,
@@ -18821,13 +19826,23 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     // Registry injection supplies the primary workspace service through the
     // runtime, so it has the same reload surface as legacy deps.workspace.
     reloadAvailable: deps.workspace !== void 0 || injectedWorkspaceRegistry !== void 0,
-    sessionShellCommandEnabled
+    sessionShellCommandEnabled,
+    multiWorkspaceSessionsEnabled: (injectedWorkspaceRegistry?.list().length ?? 1) > 1
   });
-  const statusProvider = deps.statusProvider ?? createDaemonStatusProvider();
+  const statusProvider = deps.statusProvider ?? createDaemonStatusProvider(
+    primaryEffectiveEnv ? { env: primaryEffectiveEnv } : {}
+  );
+  let defaultBridgeForAdmission;
+  const totalSessionAdmission = !deps.bridge && !injectedWorkspaceRegistry ? createTotalSessionAdmissionController({
+    maxTotalSessions: opts.maxTotalSessions,
+    getBridges: /* @__PURE__ */ __name(() => defaultBridgeForAdmission ? [defaultBridgeForAdmission] : [], "getBridges")
+  }) : void 0;
   const bridge = injectedWorkspaceRegistry?.primary.bridge ?? deps.bridge ?? createAcpSessionBridge({
     maxSessions: opts.maxSessions,
+    ...totalSessionAdmission ? { freshSessionAdmission: totalSessionAdmission.admit } : {},
     maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession,
     eventRingSize: opts.eventRingSize,
+    compactedReplayMaxBytes: opts.compactedReplayMaxBytes,
     permissionResponseTimeoutMs: opts.permissionResponseTimeoutMs,
     boundWorkspace,
     sessionShellCommandEnabled,
@@ -18841,6 +19856,9 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     // ext-method by reaching the WS connection that hosts the named server.
     clientMcpSender: clientMcpSenderRegistry.lookup
   });
+  if (!injectedWorkspaceRegistry && !deps.bridge) {
+    defaultBridgeForAdmission = bridge;
+  }
   const archiveCoordinator = new SessionArchiveCoordinator();
   installSelfOriginStripMiddleware(app, getPort);
   app.locals.fsFactory = fsFactory;
@@ -18858,7 +19876,9 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     boundWorkspace,
     contextFilename: deps.contextFilename ?? "QWEN.md",
     statusProvider,
-    workspaceProvidersStatusProvider: createWorkspaceProvidersStatusProvider(),
+    workspaceProvidersStatusProvider: createWorkspaceProvidersStatusProvider(
+      primaryEffectiveEnv ? { env: primaryEffectiveEnv } : {}
+    ),
     workspaceSkillsStatusProvider: createWorkspaceSkillsStatusProvider(),
     isChannelLive: /* @__PURE__ */ __name(() => bridge.isChannelLive(), "isChannelLive"),
     persistDisabledTools: deps.persistDisabledTools ?? (async () => {
@@ -18883,7 +19903,10 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     workspaceCwd: boundWorkspace,
     primary: true,
     trusted: deps.primaryWorkspaceTrusted ?? false,
-    env: { mode: "parent-process", overlayKeys: [] },
+    env: primaryRuntimeEnvMetadata ?? {
+      mode: "parent-process",
+      overlayKeys: []
+    },
     bridge,
     workspaceService: workspace,
     routeFileSystemFactory: fsFactory,
@@ -18949,6 +19972,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     opts,
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
+    workspaceRegistry,
     workspace: primaryWorkspace,
     daemonLog,
     startup: deps.startup,
@@ -18962,14 +19986,18 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     sessionShellCommandEnabled,
     getChannelWorkerSnapshot: deps.getChannelWorkerSnapshot,
     getPerfSnapshot: deps.getPerfSnapshot,
-    getMetricsSeries: deps.getMetricsSeries
+    getMetricsSeries: deps.getMetricsSeries,
+    getTotalSessionAdmissionSnapshot: deps.getTotalSessionAdmissionSnapshot ?? totalSessionAdmission?.snapshot
   });
   registerCapabilitiesRoutes(app, {
     qwenCodeVersion: deps.qwenCodeVersion,
     mode: opts.mode,
     currentServeFeatures,
     boundWorkspace: primaryBoundWorkspace,
+    workspaceRegistry,
     permissionPolicy: primaryBridge.permissionPolicy,
+    maxSessionsPerWorkspace: opts.maxSessions,
+    maxTotalSessions: opts.maxTotalSessions,
     maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession,
     languageCodes
   });
@@ -19080,6 +20108,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     boundWorkspace: primaryBoundWorkspace,
     mutate,
     safeBody,
+    env: getRuntimeEffectiveEnv(primaryRuntime.env),
     // UI-server discovery uses the daemon's workspace MCP status, which
     // includes servers registered at runtime.
     getMcpServers: /* @__PURE__ */ __name(async () => {
@@ -19100,6 +20129,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   registerSessionRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     bridge: primaryBridge,
+    workspaceRegistry,
     archiveCoordinator,
     mutate,
     sendBridgeError: sendBridgeError2,
@@ -19137,16 +20167,49 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
   registerScheduledTasksRoutes(app, {
     boundWorkspace: primaryBoundWorkspace,
     mutate,
-    safeBody
+    safeBody,
+    bridge: deps.manageScheduledTaskSessions ? bridge : void 0
   });
   registerUsageStatsRoutes(app);
+  if (deps.manageScheduledTaskSessions) {
+    const idleTimeoutMs = opts.sessionIdleTimeoutMs ?? DEFAULT_SESSION_IDLE_TIMEOUT_MS;
+    const keepalive = startScheduledTaskKeepalive({
+      bridge,
+      boundWorkspace,
+      intervalMs: computeKeepaliveIntervalMs(idleTimeoutMs)
+    });
+    app.locals.stopScheduledTaskKeepalive = keepalive.stop;
+    void rehydrateScheduledTaskSessions({
+      bridge,
+      boundWorkspace,
+      onError: /* @__PURE__ */ __name((sessionId, err) => {
+        process.stderr.write(
+          `qwen serve: failed to rehydrate scheduled-task session ${sessionId}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }, "onError")
+      // Outer catch is defense-in-depth: rehydrateScheduledTaskSessions already
+      // catches readCronTasks failures and per-session load errors internally
+      // (returning { loaded, failed }), so this only guards an unexpected throw
+      // from the function entry itself. Log rather than swallow it — a silent
+      // failure here leaves every bound task dormant with no diagnostic.
+    }).catch((err) => {
+      process.stderr.write(
+        `qwen serve: unexpected scheduled-task rehydration failure: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    });
+  }
   registerPermissionRoutes(app, {
     bridge: primaryBridge,
+    workspaceRegistry,
+    daemonLog,
     mutate,
     sendPermissionVoteError: sendPermissionVoteError2
   });
   registerSseEventsRoutes(app, {
     bridge: primaryBridge,
+    workspaceRegistry,
     daemonLog,
     writerIdleTimeoutMs: opts.writerIdleTimeoutMs,
     sendBridgeError: sendBridgeError2
@@ -19189,7 +20252,9 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     extraWsRoutes: [
       {
         path: "/voice/stream",
-        onConnection: createVoiceWsConnectionHandler(primaryBoundWorkspace)
+        onConnection: createVoiceWsConnectionHandler(primaryBoundWorkspace, {
+          env: getRuntimeEffectiveEnv(primaryRuntime.env)
+        })
       }
     ]
   });
@@ -19209,6 +20274,7 @@ __name(createServeApp, "createServeApp");
 export {
   InvalidCursorError,
   PromptDeadlineExceededError,
+  computeKeepaliveIntervalMs,
   createDefaultFsAuditEmit,
   createServeApp,
   detectFromLoopback,