diffing 0.10.5 → 0.12.0

package/dist/server-lock-BNI8FKV1.mjs

@@ -0,0 +1,427 @@
+import { f as getProjectStorageDir, h as getRepoRoot } from "./git-BGj31GX-.mjs";
+import { spawnSync } from "node:child_process";
+import { randomBytes, randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { getCookie } from "hono/cookie";
+//#region src/lib/server-auth.ts
+/** Header, HttpOnly cookie, or legacy query param carrying the per-session review API token. */
+const SESSION_TOKEN_HEADER = "x-diffing-token";
+const SESSION_TOKEN_QUERY = "token";
+const SESSION_TOKEN_COOKIE = "diffing-token";
+function generateSessionToken() {
+	return randomBytes(32).toString("hex");
+}
+function isLoopbackHost(host) {
+	const normalized = host.toLowerCase();
+	if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") return true;
+	const octets = normalized.split(".");
+	return octets.length === 4 && octets[0] === "127" && octets.every((part) => {
+		if (!/^\d{1,3}$/.test(part)) return false;
+		const value = Number(part);
+		return value >= 0 && value <= 255;
+	});
+}
+function isWildcardBindHost(host) {
+	const normalized = host.toLowerCase();
+	return normalized === "0.0.0.0" || normalized === "::";
+}
+function requestHostHeader(hostHeader) {
+	if (!hostHeader) return null;
+	const trimmed = hostHeader.trim();
+	if (!trimmed) return null;
+	if (trimmed.startsWith("[")) {
+		const end = trimmed.indexOf("]");
+		return end === -1 ? trimmed.toLowerCase() : trimmed.slice(1, end).toLowerCase();
+	}
+	return trimmed.split(":")[0].toLowerCase();
+}
+/** Reject non-loopback Host headers when the server binds loopback (DNS rebinding guard). */
+function isAllowedRequestHost(hostHeader, bindHost) {
+	if (!isLoopbackHost(bindHost)) return true;
+	const host = requestHostHeader(hostHeader);
+	if (!host) return true;
+	return isLoopbackHost(host);
+}
+function readSessionToken(c) {
+	const header = c.req.header(SESSION_TOKEN_HEADER);
+	if (header) return header;
+	const cookie = getCookie(c, SESSION_TOKEN_COOKIE);
+	if (cookie) return cookie;
+	return c.req.query("token") || null;
+}
+/** `Set-Cookie` value for the review session token (loopback http — no Secure). */
+function buildSessionTokenSetCookieValue(token) {
+	return `${SESSION_TOKEN_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Strict; HttpOnly`;
+}
+/** Escape a session token for embedding in a double-quoted JS string literal. */
+function escapeTokenForJsString(token) {
+	return token.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+}
+/** Inject `window.__DIFFING_SESSION_TOKEN__` into served HTML so deep links work without `?token=`. */
+function injectSessionTokenIntoHtml(html, authToken) {
+	if (!authToken) return html;
+	const script = `<script>window.__DIFFING_SESSION_TOKEN__="${escapeTokenForJsString(authToken)}";<\/script>`;
+	if (html.includes("</head>")) return html.replace("</head>", `${script}</head>`);
+	return `${script}${html}`;
+}
+function createServerAuthMiddleware(config) {
+	return async (c, next) => {
+		if (!c.req.path.startsWith("/api/")) {
+			await next();
+			return;
+		}
+		if (!isAllowedRequestHost(c.req.header("host"), config.bindHost)) return c.json({ error: "request Host header is not allowed for this bind address" }, 403);
+		if (!config.insecureNoAuth && config.authToken) {
+			if (readSessionToken(c) !== config.authToken) return c.json({ error: "invalid or missing review session token" }, 401);
+		}
+		await next();
+	};
+}
+//#endregion
+//#region src/lib/lock-probe.ts
+/** Map wildcard bind hosts to loopback for local probes. */
+function loopbackProbeHost(host) {
+	if (host === "0.0.0.0") return "127.0.0.1";
+	return host;
+}
+/**
+* Synchronous loopback probe: GET `/api/review/status` and expect a JSON body
+* with a numeric `round` field. Used to detect stale locks after PID reuse.
+*/
+function probeLockServerSync(lock) {
+	if (lock.port <= 0) return true;
+	const host = loopbackProbeHost(lock.host);
+	const headers = {};
+	if (lock.capability) headers["X-Diffing-Capability"] = lock.capability;
+	if (lock.authToken) headers[SESSION_TOKEN_HEADER] = lock.authToken;
+	const script = `
+import http from 'node:http';
+const host = ${JSON.stringify(host)};
+const port = ${lock.port};
+const headers = ${JSON.stringify(headers)};
+const req = http.request({
+  hostname: host,
+  port,
+  path: '/api/review/status',
+  method: 'GET',
+  headers,
+}, (res) => {
+  let data = '';
+  res.on('data', (chunk) => { data += chunk; });
+  res.on('end', () => { process.stdout.write(data); });
+});
+req.on('error', () => process.exit(2));
+req.setTimeout(400, () => { req.destroy(); process.exit(2); });
+req.end();
+`;
+	const result = spawnSync(process.execPath, [
+		"--input-type=module",
+		"-e",
+		script
+	], {
+		timeout: 900,
+		encoding: "utf8"
+	});
+	if (result.status !== 0) return false;
+	try {
+		return typeof JSON.parse(result.stdout.trim()).round === "number";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/lib/server-lock.ts
+const STARTUP_LEASE_STALE_MS = 3e4;
+/**
+* Produce a stable comparison key for the diff a server displays. Runtime-only
+* web options are excluded so `--port`/`--no-open` do not create false scope
+* mismatches between a user-started session and an MCP request.
+*/
+function diffScopeKey(options) {
+	const { port: _port, host: _host, noOpen: _noOpen, insecureNoAuth: _insecureNoAuth, reuseSession: _reuseSession, replaceSession: _replaceSession, help: _help, version: _version, outputMode: _outputMode, tui: _tui, gpu: _gpu, noExtDiff: _noExtDiff, ...scope } = options;
+	return JSON.stringify(scope);
+}
+function lockPath(repoRoot) {
+	return join(getProjectStorageDir(repoRoot), "server.json");
+}
+function sessionsPath(repoRoot) {
+	return join(getProjectStorageDir(repoRoot), "sessions");
+}
+/** Stable identity for both current and pre-registry lock records. */
+function serverSessionId(lock) {
+	return lock.sessionId ?? lock.ownerId ?? `${lock.mode ?? "web"}-${lock.pid}-${lock.startedAt}`;
+}
+function sameServerSession(left, right) {
+	if (left.sessionId && right.sessionId) return left.sessionId === right.sessionId;
+	return left.pid === right.pid && left.startedAt === right.startedAt && left.port === right.port;
+}
+function sessionPath(lock) {
+	return join(sessionsPath(lock.repoRoot), `${encodeURIComponent(serverSessionId(lock))}.json`);
+}
+function writeJsonAtomically(path, value) {
+	const parent = join(path, "..");
+	mkdirSync(parent, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(parent, 448);
+	} catch {}
+	const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	writeFileSync(temporary, JSON.stringify(value, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+	renameSync(temporary, path);
+	try {
+		chmodSync(path, 384);
+	} catch {}
+}
+function normalizedLock(lock) {
+	return lock.sessionId ? lock : {
+		...lock,
+		sessionId: serverSessionId(lock)
+	};
+}
+function writeSessionRecord(lock) {
+	const normalized = normalizedLock(lock);
+	writeJsonAtomically(sessionPath(normalized), normalized);
+	return normalized;
+}
+/**
+* Register a session and make it the active target for legacy clients. Before
+* replacing server.json, adopt a live pre-registry lock so an upgrade never
+* makes an already-running review disappear from the session manager.
+*/
+function writeServerLock(lock) {
+	const current = readServerLock(lock.repoRoot);
+	if (current && isLockAlive(current, lock.repoRoot) && !sameServerSession(current, lock)) writeSessionRecord(current);
+	const normalized = writeSessionRecord(lock);
+	try {
+		writeJsonAtomically(lockPath(lock.repoRoot), normalized);
+	} catch (error) {
+		rmSync(sessionPath(normalized), { force: true });
+		throw error;
+	}
+}
+function readServerLock(repoRoot) {
+	try {
+		const raw = readFileSync(lockPath(repoRoot), "utf-8");
+		const lock = JSON.parse(raw);
+		if (typeof lock.port !== "number" || typeof lock.pid !== "number") return null;
+		return lock;
+	} catch {
+		return null;
+	}
+}
+/** Return every live registered session, newest first, and prune stale entries. */
+function listServerLocks(repoRoot) {
+	let expectedRepoRoot;
+	try {
+		expectedRepoRoot = repoRoot ?? getRepoRoot();
+	} catch {
+		return [];
+	}
+	const sessions = /* @__PURE__ */ new Map();
+	const addIfLive = (candidate, stalePath) => {
+		if (candidate.repoRoot !== expectedRepoRoot || !isLockAlive(candidate, expectedRepoRoot)) {
+			if (stalePath) rmSync(stalePath, { force: true });
+			return;
+		}
+		const normalized = normalizedLock(candidate);
+		sessions.set(serverSessionId(normalized), normalized);
+	};
+	const active = readServerLock(expectedRepoRoot);
+	if (active) addIfLive(active);
+	const directory = sessionsPath(expectedRepoRoot);
+	try {
+		for (const entry of readdirSync(directory, { withFileTypes: true })) {
+			if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+			const path = join(directory, entry.name);
+			try {
+				const candidate = JSON.parse(readFileSync(path, "utf-8"));
+				if (typeof candidate.port !== "number" || typeof candidate.pid !== "number") {
+					rmSync(path, { force: true });
+					continue;
+				}
+				addIfLive(candidate, path);
+			} catch {
+				rmSync(path, { force: true });
+			}
+		}
+	} catch {}
+	return [...sessions.values()].sort((left, right) => right.startedAt - left.startedAt);
+}
+/** Resolve the active session, electing the newest live fallback when needed. */
+function resolveActiveServerLock(repoRoot) {
+	let expectedRepoRoot;
+	try {
+		expectedRepoRoot = repoRoot ?? getRepoRoot();
+	} catch {
+		return null;
+	}
+	const active = readServerLock(expectedRepoRoot);
+	if (active && isLockAlive(active, expectedRepoRoot)) {
+		const normalized = normalizedLock(active);
+		if (!existsSync(sessionPath(normalized))) writeSessionRecord(normalized);
+		if (!active.sessionId) writeJsonAtomically(lockPath(expectedRepoRoot), normalized);
+		return normalized;
+	}
+	const fallback = listServerLocks(expectedRepoRoot)[0];
+	if (!fallback) {
+		removeServerLock(expectedRepoRoot);
+		return null;
+	}
+	return activateServerLock(fallback);
+}
+/** Make an existing registered session the default target for CLI/MCP clients. */
+function activateServerLock(lock) {
+	const normalized = writeSessionRecord(lock);
+	writeJsonAtomically(lockPath(lock.repoRoot), normalized);
+	return normalized;
+}
+function isPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return (error && typeof error === "object" && "code" in error ? error.code : void 0) === "EPERM";
+	}
+}
+/**
+* True when the lock pid is alive, belongs to this repo, and the loopback port
+* still serves a diffing review status endpoint (detects PID reuse).
+*/
+function isLockAlive(lock, expectedRepoRoot) {
+	if (!isPidAlive(lock.pid)) return false;
+	try {
+		if (lock.repoRoot !== (expectedRepoRoot ?? getRepoRoot())) return false;
+	} catch {}
+	return probeLockServerSync(lock);
+}
+function removeServerLock(repoRoot) {
+	try {
+		rmSync(lockPath(repoRoot), { force: true });
+	} catch {}
+}
+/** Remove one registry entry and elect another live session if it was active. */
+function removeServerSession(lock) {
+	const normalized = normalizedLock(lock);
+	const path = sessionPath(normalized);
+	try {
+		if (sameServerSession(JSON.parse(readFileSync(path, "utf-8")), normalized)) rmSync(path, { force: true });
+	} catch {}
+	const active = readServerLock(lock.repoRoot);
+	if (!active || !sameServerSession(active, normalized)) return;
+	const fallback = listServerLocks(lock.repoRoot).find((candidate) => !sameServerSession(candidate, normalized));
+	if (fallback) activateServerLock(fallback);
+	else removeServerLock(lock.repoRoot);
+}
+/** Unregister live sessions owned by one exact CLI/MCP process identity. */
+function removeServerLockIfOwned(repoRoot, pid, ownerId) {
+	const cleanupLease = acquireServerStartupLease(repoRoot, `cleanup-${ownerId}`);
+	if (!cleanupLease) return false;
+	try {
+		const owned = listServerLocks(repoRoot).filter((lock) => lock.pid === pid && lock.ownerId === ownerId);
+		if (owned.length === 0) return false;
+		for (const lock of owned) removeServerSession(lock);
+		return true;
+	} finally {
+		cleanupLease.release();
+	}
+}
+/**
+* Atomically reserve server startup for one repository. The exclusive-create
+* directory is the cross-process serialization point; callers must re-read
+* server.json after acquiring it because another process may have completed
+* startup between their first lock check and this lease acquisition.
+*/
+function acquireServerStartupLease(repoRoot, ownerId, now = Date.now()) {
+	const path = join(getProjectStorageDir(repoRoot), "server-startup.lock");
+	const recordPath = join(path, "lease.json");
+	const ownerMarkerPath = join(path, `owner-${encodeURIComponent(ownerId)}`);
+	mkdirSync(join(path, ".."), { recursive: true });
+	const tryCreate = () => {
+		try {
+			mkdirSync(path, {
+				recursive: false,
+				mode: 448
+			});
+		} catch (error) {
+			if (error?.code === "EEXIST") return false;
+			throw error;
+		}
+		try {
+			writeFileSync(recordPath, JSON.stringify({
+				ownerId,
+				createdAt: now,
+				pid: process.pid
+			}), "utf-8");
+			writeFileSync(ownerMarkerPath, "", "utf-8");
+		} catch (error) {
+			rmSync(path, {
+				recursive: true,
+				force: true
+			});
+			throw error;
+		}
+		return true;
+	};
+	if (!tryCreate()) {
+		let reclaim = false;
+		let acquiredAfterRace = false;
+		try {
+			const record = JSON.parse(readFileSync(recordPath, "utf-8"));
+			if (typeof record.createdAt !== "number" || typeof record.pid !== "number") throw new Error("Malformed startup lease");
+			let ownerIsAlive = true;
+			try {
+				process.kill(record.pid, 0);
+			} catch (error) {
+				ownerIsAlive = error?.code !== "ESRCH";
+			}
+			reclaim = now - record.createdAt > STARTUP_LEASE_STALE_MS && !ownerIsAlive;
+			if (!reclaim) return null;
+		} catch {
+			try {
+				reclaim = now - statSync(path).mtimeMs > STARTUP_LEASE_STALE_MS;
+			} catch (statError) {
+				if (statError?.code !== "ENOENT") return null;
+				if (!tryCreate()) return null;
+				acquiredAfterRace = true;
+			}
+			if (!reclaim && !acquiredAfterRace) return null;
+		}
+		if (reclaim && !acquiredAfterRace) {
+			const stalePath = `${path}.stale-${process.pid}-${now}`;
+			try {
+				renameSync(path, stalePath);
+				rmSync(stalePath, {
+					recursive: true,
+					force: true
+				});
+			} catch (error) {
+				if (error?.code === "ENOENT") {
+					if (!tryCreate()) return null;
+					acquiredAfterRace = true;
+				} else return null;
+			}
+		}
+		if (!acquiredAfterRace && !tryCreate()) return null;
+	}
+	let released = false;
+	return {
+		ownerId,
+		release() {
+			if (released) return;
+			released = true;
+			try {
+				unlinkSync(ownerMarkerPath);
+				unlinkSync(recordPath);
+				rmdirSync(path);
+			} catch {}
+		}
+	};
+}
+//#endregion
+export { isWildcardBindHost as S, buildSessionTokenSetCookieValue as _, listServerLocks as a, injectSessionTokenIntoHtml as b, removeServerLockIfOwned as c, sameServerSession as d, serverSessionId as f, SESSION_TOKEN_QUERY as g, SESSION_TOKEN_HEADER as h, isLockAlive as i, removeServerSession as l, probeLockServerSync as m, activateServerLock as n, readServerLock as o, writeServerLock as p, diffScopeKey as r, removeServerLock as s, acquireServerStartupLease as t, resolveActiveServerLock as u, createServerAuthMiddleware as v, isLoopbackHost as x, generateSessionToken as y };

package/dist/session-conflict-Bqt1M4Mp.mjs

@@ -0,0 +1,96 @@
+import { a as loadSettings, i as reviewSessionUrl } from "./session-url-sr7lXXVc.mjs";
+import { l as removeServerSession, m as probeLockServerSync } from "./server-lock-BNI8FKV1.mjs";
+//#region src/lib/session-conflict.ts
+function sleepMs(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Loopback-safe review URL for web / gh-pr locks; null for TUI or invalid ports. */
+function existingSessionUrl(lock) {
+	return reviewSessionUrl(lock);
+}
+function defaultClearLock(lock) {
+	removeServerSession(lock);
+}
+function pidAlive(pid, kill) {
+	try {
+		kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Gracefully stop the process that owns `lock`, then clear a matching lockfile.
+* SIGTERM → wait → SIGKILL → wait → throw.
+*/
+async function stopLockOwner(lock, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	const killDeadlineMs = options.killDeadlineMs ?? 2e3;
+	const pollMs = options.pollMs ?? 100;
+	const kill = options.kill ?? ((pid, signal) => process.kill(pid, signal));
+	const sleep = options.sleep ?? sleepMs;
+	const now = options.now ?? Date.now;
+	const isAlive = options.isAlive ?? ((candidate) => pidAlive(candidate.pid, kill));
+	const clearLock = options.clearLock ?? defaultClearLock;
+	if (!await (options.lockMatches ?? ((candidate) => probeLockServerSync(candidate)))(lock)) {
+		clearLock(lock);
+		return;
+	}
+	if (!isAlive(lock)) {
+		clearLock(lock);
+		return;
+	}
+	try {
+		kill(lock.pid, "SIGTERM");
+	} catch {}
+	const termDeadline = now() + timeoutMs;
+	while (now() < termDeadline) {
+		if (!isAlive(lock)) {
+			clearLock(lock);
+			return;
+		}
+		await sleep(pollMs);
+	}
+	try {
+		kill(lock.pid, "SIGKILL");
+	} catch {}
+	const killDeadline = now() + killDeadlineMs;
+	while (now() < killDeadline) {
+		if (!isAlive(lock)) {
+			clearLock(lock);
+			return;
+		}
+		await sleep(pollMs);
+	}
+	throw new Error(`Timed out waiting for diffing pid ${lock.pid} to exit after SIGTERM/SIGKILL. End that process manually and try again.`);
+}
+/** Print and optionally open the existing web/gh-pr session; message-only for TUI. */
+async function openExistingSession(lock, options) {
+	if ((lock.mode ?? "web") === "tui") {
+		console.log(`A diffing TUI session is already open for this repository (pid ${lock.pid}). Use that terminal, or replace it with --replace-session.`);
+		return;
+	}
+	const url = existingSessionUrl(lock);
+	if (!url) {
+		console.log(`A diffing review is already running for this repository (pid ${lock.pid}).`);
+		return;
+	}
+	console.log(`Opening existing diffing session at ${url}`);
+	if (options.noOpen) return;
+	if (options.openUrl) {
+		await options.openUrl(url);
+		return;
+	}
+	try {
+		const settings = loadSettings();
+		const openModule = await import("open");
+		let appName;
+		if (settings.browser) appName = openModule.apps[settings.browser] || settings.browser;
+		const openOptions = appName ? { app: { name: appName } } : {};
+		await openModule.default(url, openOptions);
+	} catch (err) {
+		console.error("Failed to open browser:", err instanceof Error ? err.message : err);
+	}
+}
+//#endregion
+export { openExistingSession as n, stopLockOwner as r, existingSessionUrl as t };

package/dist/session-manager-BKSZQqDJ.mjs

@@ -0,0 +1,159 @@
+import { a as listServerLocks, d as sameServerSession, f as serverSessionId, n as activateServerLock, u as resolveActiveServerLock } from "./server-lock-BNI8FKV1.mjs";
+import { n as openExistingSession, r as stopLockOwner, t as existingSessionUrl } from "./session-conflict-Bqt1M4Mp.mjs";
+//#region src/lib/session-manager.ts
+const EXIT_OK = 0;
+const EXIT_NOT_FOUND = 4;
+const EXIT_USAGE = 5;
+function scopeLabel(lock) {
+	if (lock.prRef) return `PR ${lock.prRef}`;
+	if (lock.diffArgs?.length) return lock.diffArgs.join(" ");
+	if (!lock.scope) return "working tree";
+	try {
+		const scope = JSON.parse(lock.scope);
+		const parts = [];
+		if (scope.showMode) parts.push("show");
+		if (scope.staged) parts.push("staged");
+		if (scope.revisions?.length) parts.push(scope.revisions.join(" "));
+		if (scope.pathspecs?.length) parts.push(`-- ${scope.pathspecs.join(" ")}`);
+		return parts.join(" ") || "working tree";
+	} catch {
+		return "custom diff";
+	}
+}
+function summarize(lock, active) {
+	return {
+		id: serverSessionId(lock),
+		active: active ? sameServerSession(lock, active) : false,
+		mode: lock.mode ?? "web",
+		pid: lock.pid,
+		startedAt: lock.startedAt,
+		url: existingSessionUrl(lock),
+		scope: scopeLabel(lock)
+	};
+}
+function formatAge(startedAt) {
+	const seconds = Math.max(0, Math.floor((Date.now() - startedAt) / 1e3));
+	if (seconds < 60) return `${seconds}s`;
+	const minutes = Math.floor(seconds / 60);
+	if (minutes < 60) return `${minutes}m`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h`;
+	return `${Math.floor(hours / 24)}d`;
+}
+function printSessions(sessions, active) {
+	if (sessions.length === 0) {
+		console.log("No diffing sessions are running for this repository.");
+		return;
+	}
+	console.log("ACTIVE  ID        MODE   PID      AGE   SCOPE / URL");
+	for (const lock of sessions) {
+		const summary = summarize(lock, active);
+		const activeMark = summary.active ? "*" : "";
+		const target = summary.url ? `${summary.scope}  ${summary.url}` : summary.scope;
+		console.log(`${activeMark.padEnd(7)} ${summary.id.slice(0, 8).padEnd(9)} ${summary.mode.padEnd(6)} ${String(summary.pid).padEnd(8)} ${formatAge(summary.startedAt).padEnd(5)} ${target}`);
+	}
+	console.log("\nUse `diffing sessions use <id>` to retarget agent commands.");
+}
+function findSession(selector, sessions, active) {
+	if (selector === "active") {
+		if (active) return active;
+		throw new Error("No active diffing session is running.");
+	}
+	const matches = sessions.filter((lock) => serverSessionId(lock).startsWith(selector));
+	if (matches.length === 0) throw new Error(`No live diffing session matches ${JSON.stringify(selector)}.`);
+	if (matches.length > 1) throw new Error(`Session prefix ${JSON.stringify(selector)} is ambiguous.`);
+	return matches[0];
+}
+function usage() {
+	console.error(`Usage:
+  diffing sessions [list] [--json]
+  diffing sessions use <id>
+  diffing sessions open [<id>|active] [--no-open]
+  diffing sessions stop|kill <id>|active|all`);
+}
+/** Repository-local task manager for every live web, TUI, and PR session. */
+async function runSessionsCommand(args) {
+	if (args.includes("--help") || args.includes("-h")) {
+		usage();
+		return EXIT_OK;
+	}
+	const action = args[0] && !args[0].startsWith("-") ? args[0] : "list";
+	const rest = action === "list" && args[0] !== "list" ? args : args.slice(1);
+	const sessions = listServerLocks();
+	const active = resolveActiveServerLock();
+	if (action === "list") {
+		if (rest.filter((arg) => arg !== "--json").length > 0) {
+			usage();
+			return EXIT_USAGE;
+		}
+		if (rest.includes("--json")) process.stdout.write(JSON.stringify(sessions.map((lock) => summarize(lock, active)), null, 2) + "\n");
+		else printSessions(sessions, active);
+		return EXIT_OK;
+	}
+	if (action === "use") {
+		if (rest.length !== 1) {
+			usage();
+			return EXIT_USAGE;
+		}
+		try {
+			const selected = findSession(rest[0], sessions, active);
+			activateServerLock(selected);
+			console.log(`Active diffing session set to ${serverSessionId(selected).slice(0, 8)} (${selected.mode ?? "web"}).`);
+			return EXIT_OK;
+		} catch (error) {
+			console.error(error instanceof Error ? error.message : String(error));
+			return EXIT_NOT_FOUND;
+		}
+	}
+	if (action === "open") {
+		const noOpen = rest.includes("--no-open");
+		const positionals = rest.filter((arg) => arg !== "--no-open");
+		if (positionals.length > 1) {
+			usage();
+			return EXIT_USAGE;
+		}
+		try {
+			const selected = findSession(positionals[0] ?? "active", sessions, active);
+			activateServerLock(selected);
+			await openExistingSession(selected, { noOpen });
+			return EXIT_OK;
+		} catch (error) {
+			console.error(error instanceof Error ? error.message : String(error));
+			return EXIT_NOT_FOUND;
+		}
+	}
+	if (action === "stop" || action === "kill") {
+		if (rest.length !== 1) {
+			usage();
+			return EXIT_USAGE;
+		}
+		let targets;
+		try {
+			targets = rest[0] === "all" ? sessions : [findSession(rest[0], sessions, active)];
+		} catch (error) {
+			console.error(error instanceof Error ? error.message : String(error));
+			return EXIT_NOT_FOUND;
+		}
+		if (targets.length === 0) {
+			console.log("No diffing sessions are running for this repository.");
+			return EXIT_OK;
+		}
+		let failed = false;
+		for (const target of targets) {
+			const id = serverSessionId(target).slice(0, 8);
+			try {
+				console.error(`Stopping ${id} (${target.mode ?? "web"}, pid ${target.pid})…`);
+				await stopLockOwner(target);
+			} catch (error) {
+				failed = true;
+				console.error(error instanceof Error ? error.message : String(error));
+			}
+		}
+		if (!failed) console.log(`Stopped ${targets.length} diffing session${targets.length === 1 ? "" : "s"}.`);
+		return failed ? 1 : EXIT_OK;
+	}
+	usage();
+	return EXIT_USAGE;
+}
+//#endregion
+export { runSessionsCommand };