fix(web-shell): allow session refresh with daemon auth

packages/cli/src/serve/server.test.ts

@@ -3030,6 +3030,36 @@ describe('createServeApp', () => {
       expect(res.text).toContain('<div id="root">');
     });
 
+    it('serves session document deep links before bearer auth without exposing APIs', async () => {
+      const app = createServeApp({ ...baseOpts, token: 'secret' }, undefined, {
+        webShellDir,
+      });
+      const shell = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(shell.status).toBe(200);
+      expect(shell.text).toContain('<div id="root">');
+
+      const head = await request(app)
+        .head('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(head.status).toBe(200);
+
+      const nonNavigation = await request(app)
+        .get('/session/abc123')
+        .set('Host', host)
+        .set('Accept', 'application/json');
+      expect(nonNavigation.status).toBe(401);
+
+      const api = await request(app)
+        .get('/session/abc123/status')
+        .set('Host', host)
+        .set('Accept', 'text/html');
+      expect(api.status).toBe(401);
+    });
+
     it('leaves non-navigation API misses as JSON 404s', async () => {
       const app = createServeApp(baseOpts, undefined, { webShellDir });
       const res = await request(app)

packages/cli/src/serve/server.ts

@@ -1181,7 +1181,9 @@ export function createServeApp(
   // API calls still carry the bearer (getDaemonAuthHeaders) and every API
   // route below stays token-gated. The SPA deep-link fallback is registered
   // LATER (after all API routes, see mountWebShellSpaFallback) so authed
-  // routes win over the shell. The assets dir is resolved by the caller
+  // routes win over the shell. Exact `/session/:id` document navigations are
+  // mounted here too because a browser refresh cannot attach the bearer header
+  // before the shell loads. The assets dir is resolved by the caller
   // (runQwenServe) and injected via deps.webShellDir; `--no-web` sets
   // opts.serveWebShell=false to opt out.
   const webShellDir =

packages/cli/src/serve/web-shell-static.ts

@@ -149,6 +149,8 @@ function createSendIndex(
  *
  *  - `GET /assets/*` — hashed, immutable build chunks (long-cache).
  *  - `GET /` — the HTML shell, always (so `curl /` shows the UI too).
+ *  - `GET /session/:id` document navigations — the HTML shell, so a browser
+ *    refresh can load before the front-end adds its bearer header.
  *
  * Caller must have already verified `webShellDir` exists.
  */
@@ -183,10 +185,14 @@ export function mountWebShellAssets(
     res.status(404).type('text/plain').send('Not found');
   });
   app.get('/', (_req: Request, res: Response) => sendIndex(res));
+  app.get('/session/:id', (req: Request, res: Response, next: NextFunction) => {
+    if (!isDocumentNavigation(req)) return next();
+    sendIndex(res);
+  });
 }
 
 /**
- * Mount the SPA deep-link fallback (for navigations like `/session/<id>`).
+ * Mount the SPA deep-link fallback for routes not explicitly mounted above.
  * Registered AFTER all API routes — just before the error handler — so real
  * routes, INCLUDING their `bearerAuth` 401s, always win and only genuine 404
  * misses fall through to the shell.