fix(web-shell): preserve token and base path in session URLs

packages/web-shell/client/config/daemon.ts

@@ -47,11 +47,9 @@ export function getDaemonToken(): string | undefined {
   const fromUrl =
     fromHash || new URLSearchParams(window.location.search).get('token') || '';
   if (fromUrl) {
-    // Persist per-tab so the token survives a page refresh (#7301):
-    // removeDaemonTokenFromUrl() deliberately strips it from the URL for
-    // history hygiene, which previously left a refreshed page with no
-    // credential at all. sessionStorage (not localStorage) keeps the token
-    // scoped to this tab and cleared when the tab closes.
+    // Persist per-tab so the token survives navigations that do not carry it.
+    // sessionStorage (not localStorage) keeps the token scoped to this tab and
+    // cleared when the tab closes.
     persistDaemonToken(fromUrl);
     cachedDaemonToken = fromUrl;
     return cachedDaemonToken;

packages/web-shell/client/main.tsx

@@ -13,6 +13,7 @@ import {
 } from './config/daemon';
 import { normalizeLanguage, type WebShellLanguage } from './i18n';
 import { WebShellThemeId, type WebShellTheme } from './themeContext';
+import { buildSessionPathname, parseSessionId } from './utils/sessionPath';
 import 'katex/dist/katex.min.css';
 import './styles/standalone.css';
 
@@ -78,13 +79,7 @@ function getInitialLanguage(): WebShellLanguage {
 }
 
 function getSessionIdFromUrl(): string | undefined {
-  const match = window.location.pathname.match(/\/session\/([^/]+)/);
-  if (!match) return undefined;
-  try {
-    return decodeURIComponent(match[1]);
-  } catch {
-    return undefined;
-  }
+  return parseSessionId(window.location.pathname);
 }
 
 function getWorkspaceIdFromUrl(): string | undefined {
@@ -98,7 +93,7 @@ function replaceStandaloneSessionUrl(
   workspaceId?: string,
 ): void {
   const url = new URL(window.location.href);
-  url.pathname = sessionId ? `/session/${encodeURIComponent(sessionId)}` : '/';
+  url.pathname = buildSessionPathname(url.pathname, sessionId);
   if (sessionId && workspaceId) {
     url.searchParams.set('workspace', workspaceId);
   } else {

packages/web-shell/client/utils/sessionPath.test.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it } from 'vitest';
+import { buildSessionPathname, parseSessionId } from './sessionPath';
+
+describe('buildSessionPathname', () => {
+  it('replaces an existing session segment at the root', () => {
+    expect(buildSessionPathname('/session/old', 'new')).toBe('/session/new');
+  });
+
+  it('preserves a sub-path deployment base', () => {
+    expect(buildSessionPathname('/app/session/old', 'new')).toBe(
+      '/app/session/new',
+    );
+  });
+
+  it('appends a session under a base path with no existing session', () => {
+    expect(buildSessionPathname('/app', 'new')).toBe('/app/session/new');
+  });
+
+  it('appends a session at the root when there is no existing session', () => {
+    expect(buildSessionPathname('/', 'new')).toBe('/session/new');
+  });
+
+  it('strips a trailing slash from the base path', () => {
+    expect(buildSessionPathname('/app/', 'new')).toBe('/app/session/new');
+  });
+
+  it('strips a trailing slash after an existing session id', () => {
+    expect(buildSessionPathname('/session/old/', 'new')).toBe('/session/new');
+    expect(buildSessionPathname('/app/session/old/', 'new')).toBe(
+      '/app/session/new',
+    );
+  });
+
+  it('encodes the session id', () => {
+    expect(buildSessionPathname('/', 'a b/c')).toBe('/session/a%20b%2Fc');
+  });
+
+  it('returns the base path when no session is given', () => {
+    expect(buildSessionPathname('/app/session/old', undefined)).toBe('/app');
+  });
+
+  it('returns "/" when no session is given at the root', () => {
+    expect(buildSessionPathname('/', undefined)).toBe('/');
+    expect(buildSessionPathname('/session/old', undefined)).toBe('/');
+  });
+});
+
+describe('parseSessionId', () => {
+  it('reads the session id at the root', () => {
+    expect(parseSessionId('/session/abc')).toBe('abc');
+  });
+
+  it('reads the last session segment under a base path', () => {
+    expect(parseSessionId('/app/session/abc')).toBe('abc');
+  });
+
+  it('ignores a trailing slash', () => {
+    expect(parseSessionId('/session/abc/')).toBe('abc');
+  });
+
+  it('decodes the session id', () => {
+    expect(parseSessionId('/session/a%20b%2Fc')).toBe('a b/c');
+  });
+
+  it('returns undefined for malformed percent-encoding', () => {
+    expect(parseSessionId('/session/%E0%A4%A')).toBeUndefined();
+  });
+
+  it('returns undefined when there is no session segment', () => {
+    expect(parseSessionId('/')).toBeUndefined();
+    expect(parseSessionId('/app')).toBeUndefined();
+  });
+
+  it('returns undefined for an empty session id', () => {
+    expect(parseSessionId('/app/session/')).toBeUndefined();
+  });
+});
+
+describe('build/parse round-trip', () => {
+  it('reads back the written session id', () => {
+    for (const base of ['/', '/app', '/app/', '/app/session/old']) {
+      expect(parseSessionId(buildSessionPathname(base, 'real-id'))).toBe(
+        'real-id',
+      );
+    }
+  });
+
+  it('reads back the written id when the base path ends in a session segment', () => {
+    const pathname = buildSessionPathname('/app/session/', 'real-id');
+    expect(parseSessionId(pathname)).toBe('real-id');
+  });
+});

packages/web-shell/client/utils/sessionPath.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Build the pathname for a standalone session URL while preserving any base
+ * path the app is deployed under (e.g. `/app/session/<id>` stays under
+ * `/app` instead of being reset to `/session/<id>`). With no session id,
+ * returns the base path (or `/` at the root).
+ */
+export function buildSessionPathname(
+  currentPathname: string,
+  sessionId: string | undefined,
+): string {
+  const sessionPath = currentPathname.match(/^(.*)\/session\/[^/]+\/?$/);
+  const basePath = sessionPath?.[1] ?? currentPathname.replace(/\/$/, '');
+  return sessionId
+    ? `${basePath}/session/${encodeURIComponent(sessionId)}`
+    : basePath || '/';
+}
+
+/**
+ * Extract the session id from a standalone pathname. Anchored to the last
+ * `/session/<id>` segment so it agrees with `buildSessionPathname`'s greedy
+ * writer; a first-match parse would read the literal `session` segment when
+ * the base path itself ends in `/session` (e.g. `/app/session/session/<id>`).
+ */
+export function parseSessionId(pathname: string): string | undefined {
+  const match = pathname.match(/\/session\/([^/]+)\/?$/);
+  if (!match) return undefined;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return undefined;
+  }
+}

packages/web-shell/client/utils/splitUrl.test.ts

@@ -31,12 +31,18 @@ describe('buildSplitUrl', () => {
     expect(url).toContain('split=s1%2Cs2');
   });
 
-  it('resets the path so no single-session deep-link competes', () => {
+  it('strips the session deep-link so no single session competes', () => {
     expect(
       new URL(buildSplitUrl(['a'], 'https://host/session/x')).pathname,
     ).toBe('/');
   });
 
+  it('preserves the deployment base path while stripping the session', () => {
+    expect(
+      new URL(buildSplitUrl(['a'], 'https://host/app/session/x')).pathname,
+    ).toBe('/app');
+  });
+
   it('carries the daemon token in the fragment when provided', () => {
     const url = new URL(
       buildSplitUrl(['a', 'b'], 'https://host/', 'secret-tok'),

packages/web-shell/client/utils/splitUrl.ts

@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { buildSessionPathname } from './sessionPath';
+
 /**
  * URL helpers for opening the split view (2+ sessions side by side) in its own
  * browser tab. A `?split=<id>,<id>` query tells the app to enter the split view
@@ -24,16 +26,17 @@ export const MAX_SPLIT_PANES = 6;
 /**
  * Build an absolute URL that opens the app straight into the split view for the
  * given sessions. Derived from the current location so it inherits the origin
- * and any `?daemon=`/`?token=` query a dev deployment relies on; the path is
- * reset to `/` so no single `/session/<id>` deep-link competes with the split.
+ * and any `?daemon=`/`?token=` query a dev deployment relies on; the trailing
+ * `/session/<id>` deep-link is stripped while preserving any deployment base
+ * path, so no single session competes with the split.
  */
 export function buildSplitUrl(
   sessionIds: string[],
   currentHref: string,
   token?: string,
 ): string {
   const url = new URL(currentHref);
-  url.pathname = '/';
+  url.pathname = buildSessionPathname(url.pathname, undefined);
   url.searchParams.set(SPLIT_PARAM, sessionIds.join(','));
   // The current tab already stripped the daemon token from its URL, so carry it
   // into the new tab's fragment (never sent to the server / logs) — otherwise a