fix(web-shell): preserve token and base path in session URLs

packages/web-shell/client/config/daemon.ts

@@ -47,11 +47,9 @@ export function getDaemonToken(): string | undefined {
   const fromUrl =
     fromHash || new URLSearchParams(window.location.search).get('token') || '';
   if (fromUrl) {
-    // Persist per-tab so the token survives a page refresh (#7301):
-    // removeDaemonTokenFromUrl() deliberately strips it from the URL for
-    // history hygiene, which previously left a refreshed page with no
-    // credential at all. sessionStorage (not localStorage) keeps the token
-    // scoped to this tab and cleared when the tab closes.
+    // Persist per-tab so the token survives navigations that do not carry it.
+    // sessionStorage (not localStorage) keeps the token scoped to this tab and
+    // cleared when the tab closes.
     persistDaemonToken(fromUrl);
     cachedDaemonToken = fromUrl;
     return cachedDaemonToken;

packages/web-shell/client/main.tsx

@@ -13,6 +13,7 @@ import {
 } from './config/daemon';
 import { normalizeLanguage, type WebShellLanguage } from './i18n';
 import { WebShellThemeId, type WebShellTheme } from './themeContext';
+import { buildSessionPathname } from './utils/sessionPath';
 import 'katex/dist/katex.min.css';
 import './styles/standalone.css';
 
@@ -98,7 +99,7 @@ function replaceStandaloneSessionUrl(
   workspaceId?: string,
 ): void {
   const url = new URL(window.location.href);
-  url.pathname = sessionId ? `/session/${encodeURIComponent(sessionId)}` : '/';
+  url.pathname = buildSessionPathname(url.pathname, sessionId);
   if (sessionId && workspaceId) {
     url.searchParams.set('workspace', workspaceId);
   } else {

packages/web-shell/client/utils/sessionPath.test.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, it } from 'vitest';
+import { buildSessionPathname } from './sessionPath';
+
+describe('buildSessionPathname', () => {
+  it('replaces an existing session segment at the root', () => {
+    expect(buildSessionPathname('/session/old', 'new')).toBe('/session/new');
+  });
+
+  it('preserves a sub-path deployment base', () => {
+    expect(buildSessionPathname('/app/session/old', 'new')).toBe(
+      '/app/session/new',
+    );
+  });
+
+  it('appends a session under a base path with no existing session', () => {
+    expect(buildSessionPathname('/app', 'new')).toBe('/app/session/new');
+  });
+
+  it('appends a session at the root when there is no existing session', () => {
+    expect(buildSessionPathname('/', 'new')).toBe('/session/new');
+  });
+
+  it('strips a trailing slash from the base path', () => {
+    expect(buildSessionPathname('/app/', 'new')).toBe('/app/session/new');
+  });
+
+  it('encodes the session id', () => {
+    expect(buildSessionPathname('/', 'a b/c')).toBe('/session/a%20b%2Fc');
+  });
+
+  it('returns the base path when no session is given', () => {
+    expect(buildSessionPathname('/app/session/old', undefined)).toBe('/app');
+  });
+
+  it('returns "/" when no session is given at the root', () => {
+    expect(buildSessionPathname('/', undefined)).toBe('/');
+    expect(buildSessionPathname('/session/old', undefined)).toBe('/');
+  });
+});

packages/web-shell/client/utils/sessionPath.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Build the pathname for a standalone session URL while preserving any base
+ * path the app is deployed under (e.g. `/app/session/<id>` stays under
+ * `/app` instead of being reset to `/session/<id>`). With no session id,
+ * returns the base path (or `/` at the root).
+ */
+export function buildSessionPathname(
+  currentPathname: string,
+  sessionId: string | undefined,
+): string {
+  const sessionPath = currentPathname.match(/^(.*)\/session\/[^/]+\/?$/);
+  const basePath = sessionPath?.[1] ?? currentPathname.replace(/\/$/, '');
+  return sessionId
+    ? `${basePath}/session/${encodeURIComponent(sessionId)}`
+    : basePath || '/';
+}