mixdog 0.9.63 → 0.9.65

package/src/runtime/shared/config.mjs

@@ -294,7 +294,7 @@ export function updateConfig(updater) {
   return saved
 }
 
-export function writeSection(section, data) {
+function writeSection(section, data) {
   withConfigLock(() => {
     const all = readAllForRmW()
     all[section] = stripGeneratedMarker(data)
@@ -383,7 +383,7 @@ export function updateConfigAsync(updater) {
   })
 }
 
-export function writeSectionAsync(section, data) {
+function writeSectionAsync(section, data) {
   return trackConfigWrite(() => withConfigLockAsync(async () => {
     const all = readAllForRmW()
     all[section] = stripGeneratedMarker(data)
@@ -427,7 +427,7 @@ function readCapabilities() {
 // Convenience alias requested by B2 call-site plumbing. Returns the
 // same object shape as readCapabilities(); callers that only need a
 // boolean can read `.homeAccess` directly.
-export function getCapabilities() {
+function getCapabilities() {
   return readCapabilities()
 }
 
@@ -443,7 +443,7 @@ export const SECRET_ACCOUNTS = Object.freeze({
   opencodeGoAuthCookie: 'agent.opencode-go.authCookie',
 })
 
-export function isDiscordSnowflake(value) {
+function isDiscordSnowflake(value) {
   return /^\d{17,20}$/.test(String(value || '').trim())
 }
 

package/src/runtime/shared/launcher-control.mjs

@@ -47,12 +47,11 @@ const RECORD_SEP = '\x1e';
 
 // Names the env vars the launcher must set on the child so this module's
 // managedLaunchId() resolves inside the MCP server.
-export const LAUNCHER_ENV = Object.freeze({ ENV_LAUNCH_ID, ENV_MANAGED });
 
 // Mirror of channels/lib/runtime-paths.mjs RUNTIME_ROOT resolution so the
 // launcher and the MCP server agree on the queue location without importing
 // the channels layer into setup/.
-export function launcherRuntimeRoot() {
+function launcherRuntimeRoot() {
   return process.env.MIXDOG_RUNTIME_ROOT
     ? resolve(process.env.MIXDOG_RUNTIME_ROOT)
     : join(tmpdir(), 'mixdog');
@@ -62,7 +61,7 @@ function sanitize(value) {
   return String(value).replace(/[^a-zA-Z0-9._-]/g, '_');
 }
 
-export function launcherQueueDir(launchId) {
+function launcherQueueDir(launchId) {
   return join(launcherRuntimeRoot(), `launch-cmds-${sanitize(launchId)}`);
 }
 
@@ -118,7 +117,7 @@ function nativeLaunchPrebuiltPath() {
 }
 
 let _nativeBinCache; // undefined = unresolved, string|null = resolved
-export function nativeLaunchBin() {
+function nativeLaunchBin() {
   if (_nativeBinCache !== undefined) return _nativeBinCache;
   // Opt-out for tests / forced-JS parity checks.
   if (/^(0|false|no|off|js)$/i.test(String(process.env.MIXDOG_LAUNCH_NATIVE || ''))) {
@@ -141,7 +140,7 @@ export function nativeLaunchBin() {
 // Returns true when the native mixdog-launch binary's `bridge` subcommand is
 // available for this platform (exit 0). The launcher uses this to gate the
 // managed-launch interactive path — no JS stdin pipe bridge fallback.
-export function nativeBridgeAvailable() {
+function nativeBridgeAvailable() {
   const bin = nativeLaunchBin();
   if (!bin) return false;
   const r = spawnSync(bin, ['bridge', '--probe'], {
@@ -151,7 +150,7 @@ export function nativeBridgeAvailable() {
   return r.status === 0;
 }
 
-export function newLaunchId() {
+function newLaunchId() {
   return `${process.pid}-${randomUUID().slice(0, 8)}`;
 }
 
@@ -159,7 +158,7 @@ export function newLaunchId() {
 // `mixdog`-launched session that engaged the control bridge, else null. The
 // launcher only sets MIXDOG_LAUNCH_ID once the bridge is live, so presence is
 // sufficient — there is no half-managed state to disambiguate.
-export function managedLaunchId() {
+function managedLaunchId() {
   const id = process.env[ENV_LAUNCH_ID];
   return id && String(id).length > 0 ? String(id) : null;
 }
@@ -170,7 +169,7 @@ let enqueueSequence = 0;
 // launcher to deliver. Prefers the canonical Rust backend; the JS writer (temp
 // name + rename so the watcher never sees a partial file) is the fallback.
 // Returns the published path.
-export function enqueueLauncherCommand(launchId, command) {
+function enqueueLauncherCommand(launchId, command) {
   const dir = launcherQueueDir(launchId);
   mkdirSync(dir, { recursive: true });
   const bin = nativeLaunchBin();
@@ -196,7 +195,7 @@ export function enqueueLauncherCommand(launchId, command) {
 // Launcher side: drain queued commands oldest-first (lexical sort on the
 // timestamp-prefixed name), deleting each as it is read. Prefers the canonical
 // Rust backend; the JS reader is the fallback.
-export function drainLauncherCommands(launchId) {
+function drainLauncherCommands(launchId) {
   const dir = launcherQueueDir(launchId);
   const bin = nativeLaunchBin();
   if (bin) {
@@ -236,7 +235,7 @@ export function drainLauncherCommands(launchId) {
 // platforms (and miss atomic-rename publishes on some) that a short poll is the
 // robust choice for this low-rate control path. Returns a stop() that also
 // removes the queue directory.
-export function watchLauncherCommands(launchId, onCommand, { intervalMs = 150 } = {}) {
+function watchLauncherCommands(launchId, onCommand, { intervalMs = 150 } = {}) {
   mkdirSync(launcherQueueDir(launchId), { recursive: true });
   let stopped = false;
   const timer = setInterval(() => {

package/src/runtime/shared/llm/index.mjs

@@ -26,37 +26,22 @@ function loadAgentConfig() {
 /**
  * Resolve the maintenance model ROUTE for a given task from agent-config.
  *
- * Maintenance slots now store a direct `{provider, model, effort?, fast?}`
- * route (parity with `agents.<role>`). This returns that route object. For
- * backward compatibility a slot still holding a legacy preset-NAME string is
- * resolved against config.presets and returned as a route. Falls back to the
- * canonical DEFAULT_MAINTENANCE route. Returns null only when nothing resolves.
+ * Maintenance slots store a direct `{provider, model, effort?, fast?}` route
+ * (parity with `agents.<role>`). This returns that route object, falling back
+ * to the canonical DEFAULT_MAINTENANCE route. Returns null only when nothing
+ * resolves.
  *
  * The returned value is passed straight through as `opts.preset` to
- * makeAgentDispatch, whose resolveMaintenanceRoute()/maintenanceRouteToPreset()
- * accept either a route object or a legacy name string.
+ * makeAgentDispatch (resolveMaintenanceRoute()/maintenanceRouteToPreset()).
  */
 export function resolveMaintenancePreset(task, agentConfig) {
   const cfg = agentConfig || loadAgentConfig()
   const maint = cfg?.maintenance || {}
-  const presets = cfg?.presets || []
   const slot = maint[task]
-  // Preferred: slot already holds a direct route object.
   if (slot && typeof slot === 'object' && !Array.isArray(slot)
       && slot.provider && slot.model) {
     return { ...slot }
   }
-  // Legacy: slot holds a preset-NAME string — resolve it to a route.
-  const name = String(slot || '').trim()
-  if (name) {
-    const preset = presets.find(p => p && (p.id === name || p.name === name))
-    if (preset && preset.provider && preset.model) {
-      const route = { provider: preset.provider, model: preset.model }
-      if (preset.effort) route.effort = preset.effort
-      if (preset.fast === true) route.fast = true
-      return route
-    }
-  }
   // Canonical default route (DEFAULT_MAINTENANCE is now route-shaped).
   const def = DEFAULT_MAINTENANCE[task]
   if (def && def.provider && def.model) return { ...def }

package/src/runtime/shared/markdown-frontmatter.mjs

@@ -33,7 +33,7 @@ export function parseMarkdownFrontmatter(markdown) {
   return meta;
 }
 
-export function stripMarkdownFrontmatter(markdown) {
+function stripMarkdownFrontmatter(markdown) {
   return String(markdown || '').replace(FRONTMATTER_RE, '').trim();
 }
 

package/src/runtime/shared/memory-snapshot.mjs

@@ -14,7 +14,7 @@ import { withFileLock } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const execFileAsync = promisify(execFile);
-export const MEMORY_PRESSURE_SNAPSHOT_MAX_BYTES = 64 * 1024;
+const MEMORY_PRESSURE_SNAPSHOT_MAX_BYTES = 64 * 1024;
 const SNAPSHOT_NAME = 'memory-pressure.jsonl';
 const SNAPSHOT_INTERVAL_MS = 10 * 60 * 1000;
 const SNAPSHOT_INTERVAL_JITTER_MS = 60 * 1000;
@@ -196,7 +196,7 @@ function baseSnapshot(reason) {
  * Collect a full attribution snapshot. Process enumeration failures are
  * intentionally omitted from the record, rather than surfacing to callers.
  */
-export async function captureMemoryPressureSnapshot(reason = 'memory-pressure') {
+async function captureMemoryPressureSnapshot(reason = 'memory-pressure') {
   if (!enabled()) return false;
   const entry = baseSnapshot(reason);
   const processes = await topProcesses();
@@ -229,7 +229,7 @@ export function requestMemoryPressureSnapshot(reason) {
   }
 }
 
-export function armMemoryPressureSampling() {
+function armMemoryPressureSampling() {
   if (!enabled() || periodicTimer) return false;
   periodicTimer = setInterval(() => {
     void capturePeriodicMemorySnapshot().catch(() => {});
@@ -238,7 +238,7 @@ export function armMemoryPressureSampling() {
   return true;
 }
 
-export function memoryPressureSnapshotPath() {
+function memoryPressureSnapshotPath() {
   return snapshotPaths().snapshot;
 }
 

package/src/runtime/shared/pristine-execution.mjs

@@ -97,7 +97,7 @@ function cloneJson(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
-export function createSelectedProviderPristineLoader({
+function createSelectedProviderPristineLoader({
   config,
   provider,
   apiKey = null,

package/src/runtime/shared/process-lifecycle.mjs

@@ -22,7 +22,6 @@ import { resolvePluginData } from './plugin-paths.mjs';
 
 const execFileAsync = promisify(execFile);
 export const LIFECYCLE_LEDGER_MAX_BYTES = 64 * 1024;
-export const LIFECYCLE_LEDGER_KEEP_FILES = 2;
 const LEDGER_NAME = 'process-lifecycle.jsonl';
 const MARKER_DIR_NAME = 'process-lifecycle.active';
 const LEGACY_MARKER_NAME = 'process-lifecycle.active.json';

package/src/runtime/shared/process-shutdown.mjs

@@ -20,7 +20,7 @@ function writeStderr(line) {
   try { process.stderr.write(`${line}\n`); } catch {}
 }
 
-export function signalExitCode(signal, fallback = 1) {
+function signalExitCode(signal, fallback = 1) {
   return SIGNAL_EXIT_CODES[signal] || fallback;
 }
 

package/src/runtime/shared/resource-admission.mjs

@@ -50,7 +50,7 @@ function abortError(signal) {
     : new Error(String(signal?.reason || 'resource admission canceled'));
 }
 
-export class ResourcePressureError extends Error {
+class ResourcePressureError extends Error {
   constructor(message, details = {}) {
     super(`resource pressure: ${message}`);
     this.name = 'ResourcePressureError';
@@ -59,7 +59,7 @@ export class ResourcePressureError extends Error {
   }
 }
 
-export class ResourceAdmissionQueueFullError extends ResourcePressureError {
+class ResourceAdmissionQueueFullError extends ResourcePressureError {
   constructor(maxQueue) {
     super(`high-load admission queue full (maximum ${maxQueue}); retry after running work completes`, {
       maxQueue,

package/src/runtime/shared/schedule-session-run.mjs

@@ -12,7 +12,7 @@ import { askSession } from '../agent/orchestrator/session/manager/ask-session.mj
 import { parseScheduleModelRef } from './schedule-model-ref.mjs';
 
 /** Resolve schedule.model into a {provider,model,effort?,fast?} route. */
-export function scheduleRouteFromModelRef(modelRef, config = null) {
+function scheduleRouteFromModelRef(modelRef, config = null) {
   const ref = parseScheduleModelRef(modelRef);
   if (ref && typeof ref === 'object') return ref;
   const cfg = config || loadConfig({ secrets: false });

package/src/runtime/shared/schedules-db.mjs

@@ -220,7 +220,7 @@ export async function setSkippedUntil(name, ts, { dataDir } = {}) {
  * next_fire_at at/before `now`, and not currently deferred or skipped past
  * `now`.
  */
-export async function listDue(now = new Date(), { dataDir } = {}) {
+async function listDue(now = new Date(), { dataDir } = {}) {
   const db = await getDb(dataDir);
   const { rows } = await db.query(
     `SELECT ${COLS} FROM scheduler.schedules

package/src/runtime/shared/service-discovery.mjs

@@ -15,7 +15,7 @@ import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { writeJsonAtomicSync } from './atomic-file.mjs'
 
-export function discoveryRoot() {
+function discoveryRoot() {
   const root = process.env.MIXDOG_RUNTIME_ROOT
     ? resolve(process.env.MIXDOG_RUNTIME_ROOT)
     : join(tmpdir(), 'mixdog')
@@ -152,7 +152,7 @@ export function writeServiceAdvert(service, fields = {}) {
 // advertises a port, the file is removed (clean shutdown). Read-modify-write is
 // race-free enough for a genuine single owner (only the service's supervisor
 // writes its own file).
-export function patchServiceAdvert(service, fields = {}) {
+function patchServiceAdvert(service, fields = {}) {
   const cur = readServiceAdvert(service) ?? {}
   const merged = { ...cur }
   for (const [k, v] of Object.entries(fields)) {

package/src/runtime/shared/staged-update.mjs

@@ -116,7 +116,7 @@ export function unregisterLiveSession() {
   try { unlinkSync(selfPidFile()); } catch { /* already gone */ }
 }
 
-export function otherLiveSessionExists() {
+function otherLiveSessionExists() {
   let entries;
   try { entries = readdirSync(liveSessionsDir()); } catch { return false; }
   let alive = false;
@@ -278,7 +278,7 @@ export function spawnStagedInstall(version) {
  * bestStagedVersion(currentVersion) — highest completed staged version strictly
  * newer than current, with a valid self-contained package dir; else null.
  */
-export function bestStagedVersion(currentVersion) {
+function bestStagedVersion(currentVersion) {
   const cur = String(currentVersion || localPackageVersion());
   let best = null;
   let entries;
@@ -303,7 +303,7 @@ export function bestStagedVersion(currentVersion) {
  * success; on failure of the second rename the backup is rolled back into
  * place. Returns true only when the new version is live. Never throws.
  */
-export function swapStagedIntoGlobal({ globalPkgRoot, pkgDir, expectedVersion, _rename } = {}) {
+function swapStagedIntoGlobal({ globalPkgRoot, pkgDir, expectedVersion, _rename } = {}) {
   if (!globalPkgRoot || !pkgDir) return false;
   // `_rename` is a test seam; production always uses renameWithRetrySync.
   const rename = typeof _rename === 'function' ? _rename : renameWithRetrySync;
@@ -366,7 +366,7 @@ function globalPopulated(root) {
  * cleanupStaging(currentVersion) — remove superseded/stale staging dirs and any
  * leftover swap backups. Best-effort; never throws.
  */
-export function cleanupStaging(currentVersion) {
+function cleanupStaging(currentVersion) {
   const cur = String(currentVersion || localPackageVersion());
   try {
     for (const name of readdirSync(stagingRootDir())) {
@@ -458,7 +458,7 @@ export function performPendingSwap() {
 // present + size-stable package; otherwise print a one-line notice and
 // process.exit(1). Exported so the swap-safety proof can exercise the exact
 // production decision.
-export function ensureGlobalStableOrExit(root, timeoutMs = 3000) {
+function ensureGlobalStableOrExit(root, timeoutMs = 3000) {
   if (ensureGlobalStable(root, timeoutMs) && globalPopulated(root)) return true;
   process.stderr.write('mixdog: update in progress — retry in a moment.\n');
   process.exit(1);
@@ -479,7 +479,7 @@ function currentGlobalVersion() {
 // Block until the swap lock file disappears (owner finished) or the deadline
 // passes. A dead/abandoned owner is reaped and treated as cleared. Returns true
 // if the lock is gone, false if it timed out with a live owner still holding.
-export function waitForSwapLockClear(lock, timeoutMs) {
+function waitForSwapLockClear(lock, timeoutMs) {
   const deadline = Date.now() + Math.max(0, timeoutMs);
   while (Date.now() < deadline) {
     if (!existsSync(lock)) return true;

package/src/runtime/shared/tool-execution-contract.mjs

@@ -135,7 +135,7 @@ export function toolCompletionInstruction({ surface = 'tool', id, status, detail
   return `The async ${label} ${id || ''} has finished${statusText} - review this result in your next step.`;
 }
 
-export function toolCompletionMeta({
+function toolCompletionMeta({
   surface = 'tool',
   id,
   status,

package/src/runtime/shared/tool-primitives.mjs

@@ -37,7 +37,7 @@ export function isMcpToolName(name) {
 // (mcp__plugin_mixdog_mixdog__<tool>). Those must render as their stripped
 // builtin names, not as external "MCP" calls. Define the server id once here
 // and reuse everywhere a display path branches on MCP-ness.
-export const SELF_MCP_SERVER = 'plugin_mixdog_mixdog';
+const SELF_MCP_SERVER = 'plugin_mixdog_mixdog';
 
 export function isSelfMcpToolName(name) {
   const mcp = parseMcpToolName(name);

package/src/runtime/shared/tool-surface.mjs

@@ -317,7 +317,7 @@ export function formatToolSurface(name, args, opts = {}) {
 
 // ── Aggregate tool-card classification & formatting ──────────────
 
-export const CATEGORY_ORDER = [
+const CATEGORY_ORDER = [
   'Read', 'Search', 'Load', 'MCP', 'Skill', 'Web Research', 'Memory', 'Explore',
   'Patch', 'Shell', 'Agent', 'Task', 'Schedule', 'Channel', 'Setup', 'Other',
 ];
@@ -400,7 +400,7 @@ const CATEGORY_COPY = new Map([
 ]);
 
 /** Active gerund for a category (e.g. "Reading" for "Read"). */
-export function activeCategoryLabel(category) {
+function activeCategoryLabel(category) {
   return CATEGORY_COPY.get(category)?.active || category;
 }
 

package/src/runtime/shared/turn-snapshot.mjs

@@ -0,0 +1,184 @@
+// Turn-scoped worktree snapshots over a SHADOW git repository.
+//
+// A per-worktree bare repo lives under <data>/turn-snapshots/<hash>; `git
+// --git-dir <shadow> --work-tree <project>` add/write-tree captures the whole
+// worktree as a tree object WITHOUT touching the project's own git state (or
+// requiring the project to be a git repo at all). Diffing the turn-start tree
+// against the current tree therefore reports EVERYTHING a turn changed —
+// lead edits, subagent edits, background shell jobs, even external editors —
+// which transcript-parsed patches structurally cannot see.
+//
+// Costs: the first track() of a project hashes the worktree once (mitigated
+// by reusing the project's own .git objects via alternates); every later
+// track() is an index stat-scan. All entry points are best-effort and never
+// throw into the turn path. MIXDOG_TURN_SNAPSHOT=0 disables the feature.
+import { execFile } from 'child_process';
+import { createHash } from 'crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { join, resolve } from 'path';
+import { resolvePluginData } from './plugin-paths.mjs';
+
+const DISABLED = /^(0|false|off)$/i.test(String(process.env.MIXDOG_TURN_SNAPSHOT || ''));
+const GIT_TIMEOUT_MS = 120_000;
+const BEGIN_WAIT_CAP_MS = 1_500;
+const MAX_PATCH_BYTES = 2_000_000;
+const BASE_CACHE_MAX = 32;
+const FAILURE_BACKOFF_MS = 5 * 60_000;
+
+const _queues = new Map();        // gitdir → tail promise (serialize per repo)
+const _baseBySession = new Map(); // sessionId → { worktree, tree, at }
+const _failedUntil = new Map();   // gitdir → timestamp
+
+function _worktreeKey(worktree) {
+  const raw = String(worktree || '').trim();
+  if (!raw) return '';
+  const full = resolve(raw);
+  return process.platform === 'win32' ? full.toLowerCase() : full;
+}
+
+function _gitDirFor(worktreeKey) {
+  const hash = createHash('sha1').update(worktreeKey).digest('hex').slice(0, 20);
+  return join(resolvePluginData(), 'turn-snapshots', hash);
+}
+
+function _git(args, { cwd } = {}) {
+  return new Promise((resolveExec) => {
+    execFile('git', args, {
+      cwd: cwd || undefined,
+      windowsHide: true,
+      timeout: GIT_TIMEOUT_MS,
+      maxBuffer: 64 * 1024 * 1024,
+    }, (error, stdout, stderr) => {
+      resolveExec({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout || ''), stderr: String(stderr || '') });
+    });
+  });
+}
+
+// Serialize all git operations per shadow repo: concurrent index writes would
+// corrupt each other, and turn-start/track/diff can overlap freely otherwise.
+function _enqueue(gitdir, task) {
+  const tail = (_queues.get(gitdir) || Promise.resolve()).then(task, task);
+  _queues.set(gitdir, tail.catch(() => {}));
+  return tail;
+}
+
+async function _ensureRepo(worktree, gitdir) {
+  if (existsSync(join(gitdir, 'HEAD'))) return true;
+  mkdirSync(gitdir, { recursive: true });
+  const init = await _git(['init', '--bare', '--quiet', gitdir]);
+  if (init.code !== 0) return false;
+  // The shadow repo indexes the project via --work-tree; never let it descend
+  // into the project's real .git, and keep bytes stable/gc quiet.
+  await _git(['--git-dir', gitdir, 'config', 'core.bare', 'false']);
+  await _git(['--git-dir', gitdir, 'config', 'core.autocrlf', 'false']);
+  await _git(['--git-dir', gitdir, 'config', 'gc.auto', '0']);
+  try {
+    mkdirSync(join(gitdir, 'info'), { recursive: true });
+    writeFileSync(join(gitdir, 'info', 'exclude'), '.git/\n');
+    // First-snapshot cost: reuse the project's own git objects so unchanged
+    // blobs need no re-hash/store (the opencode chromium lesson).
+    const projectObjects = join(worktree, '.git', 'objects');
+    if (existsSync(projectObjects)) {
+      mkdirSync(join(gitdir, 'objects', 'info'), { recursive: true });
+      writeFileSync(join(gitdir, 'objects', 'info', 'alternates'), `${projectObjects}\n`);
+    }
+  } catch { /* exclusions/alternates are optimizations, not requirements */ }
+  return true;
+}
+
+// Capture the current worktree as a tree object; null on any failure.
+async function _trackTree(worktree) {
+  const key = _worktreeKey(worktree);
+  if (!key || !existsSync(key)) return null;
+  const gitdir = _gitDirFor(key);
+  const failedUntil = _failedUntil.get(gitdir) || 0;
+  if (Date.now() < failedUntil) return null;
+  return _enqueue(gitdir, async () => {
+    if (!(await _ensureRepo(key, gitdir))) {
+      _failedUntil.set(gitdir, Date.now() + FAILURE_BACKOFF_MS);
+      return null;
+    }
+    const base = ['--git-dir', gitdir, '--work-tree', key];
+    const add = await _git([...base, 'add', '-A', '--', '.'], { cwd: key });
+    if (add.code !== 0) {
+      _failedUntil.set(gitdir, Date.now() + FAILURE_BACKOFF_MS);
+      return null;
+    }
+    const tree = await _git([...base, 'write-tree'], { cwd: key });
+    if (tree.code !== 0) return null;
+    const hash = tree.stdout.trim();
+    return /^[0-9a-f]{40,64}$/.test(hash) ? hash : null;
+  });
+}
+
+/** Fire-and-forget shadow-repo warmup so a project's first turn never pays
+ *  the initial full snapshot inline. */
+export function prewarmTurnSnapshot(worktree) {
+  if (DISABLED || !worktree) return;
+  void _trackTree(worktree).catch(() => {});
+}
+
+/** Capture the turn base tree for a session. Waits at most BEGIN_WAIT_CAP_MS
+ *  so a cold first snapshot cannot stall the turn; a slower capture still
+ *  lands through the shared promise and applies to this turn retroactively. */
+export async function beginTurnSnapshot(worktree, sessionId) {
+  if (DISABLED || !worktree || !sessionId) return;
+  const key = _worktreeKey(worktree);
+  const capture = _trackTree(worktree).then((tree) => {
+    if (!tree) return;
+    _baseBySession.delete(sessionId);
+    _baseBySession.set(sessionId, { worktree: key, tree, at: Date.now() });
+    while (_baseBySession.size > BASE_CACHE_MAX) {
+      const oldest = _baseBySession.keys().next().value;
+      if (oldest === undefined) break;
+      _baseBySession.delete(oldest);
+    }
+  }).catch(() => {});
+  await Promise.race([capture, new Promise((r) => { const t = setTimeout(r, BEGIN_WAIT_CAP_MS); t.unref?.(); })]);
+}
+
+/** Diff the session's turn-start tree against the CURRENT worktree state.
+ *  Returns { supported, files:[{name, additions, deletions}], patch }. */
+export async function getTurnReviewDiff(worktree, sessionId) {
+  if (DISABLED) return { supported: false, files: [], patch: '' };
+  const key = _worktreeKey(worktree);
+  const base = sessionId ? _baseBySession.get(sessionId) : null;
+  if (!key) return { supported: false, files: [], patch: '' };
+  if (!base || base.worktree !== key) {
+    return { supported: true, files: [], patch: '', reason: 'no-base' };
+  }
+  const head = await _trackTree(worktree);
+  if (!head) return { supported: false, files: [], patch: '' };
+  if (head === base.tree) return { supported: true, files: [], patch: '', baseTree: base.tree, headTree: head };
+  const gitdir = _gitDirFor(key);
+  const argsBase = ['--git-dir', gitdir];
+  const [numstat, patch] = await Promise.all([
+    _git([...argsBase, 'diff-tree', '-r', '--numstat', '-z', base.tree, head]),
+    _git([...argsBase, 'diff-tree', '-r', '-p', '--no-color', base.tree, head]),
+  ]);
+  if (numstat.code !== 0) return { supported: false, files: [], patch: '' };
+  const files = [];
+  const fields = numstat.stdout.split('\0').filter(Boolean);
+  for (const row of fields) {
+    const match = row.match(/^(\d+|-)\t(\d+|-)\t([\s\S]+)$/);
+    if (!match) continue;
+    files.push({
+      name: match[3],
+      additions: match[1] === '-' ? 0 : Number(match[1]),
+      deletions: match[2] === '-' ? 0 : Number(match[2]),
+    });
+  }
+  let patchText = patch.code === 0 ? patch.stdout : '';
+  if (patchText.length > MAX_PATCH_BYTES) {
+    patchText = patchText.slice(0, MAX_PATCH_BYTES);
+    const cut = patchText.lastIndexOf('\ndiff --git ');
+    if (cut > 0) patchText = patchText.slice(0, cut + 1);
+  }
+  return { supported: true, files, patch: patchText, baseTree: base.tree, headTree: head };
+}
+
+export function _resetTurnSnapshotForTest() {
+  _queues.clear();
+  _baseBySession.clear();
+  _failedUntil.clear();
+}

package/src/runtime/shared/update-checker.mjs

@@ -252,7 +252,7 @@ export function npmCliJsPath() {
  * npm-cli.js cannot be located. Resolves once the child exits; never throws —
  * failures come back as {ok:false, error}.
  */
-export function runGlobalUpdate() {
+function runGlobalUpdate() {
   return new Promise((resolvePromise) => {
     let child;
     try {

package/src/runtime/shared/user-cwd.mjs

@@ -44,7 +44,7 @@ function _dataFile(name) {
 // back to the home dir: a missing session signal then surfaces as ENOENT
 // (absolute paths required) rather than a silent stale read. Invariant check
 // (exact path equality with the known root), not a path-substring heuristic.
-export function _safeProcessCwd() {
+function _safeProcessCwd() {
   const cwd = process.cwd()
   try { if (resolve(cwd) === resolve(mixdogRoot())) return homedir() } catch { /* fall through to cwd */ }
   return cwd
@@ -143,7 +143,7 @@ export function captureOriginalUserCwd() {
  * Used by the cwd-tool auto-init path to avoid self-reference when
  * deciding whether to seed MIXDOG_SESSION_CWD from disk.
  */
-export function rawUserCwd() {
+function rawUserCwd() {
   try {
     const txt = readFileSync(_dataFile('user-cwd.txt'), 'utf8').trim()
     return _normalizePlatformCwd(txt) || startRootCwd() || _safeProcessCwd()
@@ -208,7 +208,7 @@ export function readLastSessionCwd(keyPid) {
  * Run fn inside an async context where pwd() returns cwd.
  * All descendant async calls within fn see cwd as their working directory.
  */
-export function runWithCwdOverride(cwd, fn) {
+function runWithCwdOverride(cwd, fn) {
   return _cwdOverride.run(cwd, fn)
 }
 

package/src/runtime/shared/user-data-guard.mjs

@@ -23,7 +23,7 @@ function mixdogConfigBaseDir() {
   return process.env.MIXDOG_CONFIG_DIR || join(homedir(), '.mixdog');
 }
 
-export function getBackupRoot() {
+function getBackupRoot() {
   return process.env.MIXDOG_USER_DATA_BACKUP_ROOT
     || join(mixdogConfigBaseDir(), 'backups', 'user-data');
 }
@@ -64,7 +64,7 @@ export function hasUserDataInitMarker(dataDir) {
 }
 
 /** Skip single-section wipe remnants (e.g. `{ search: … }` only). */
-export function isStructurallyCompleteMixdogConfigBackup(parsed) {
+function isStructurallyCompleteMixdogConfigBackup(parsed) {
   if (!isPlainObject(parsed)) return false;
   if (Object.keys(parsed).length <= 1) return false;
   if (!parsed.agent && !parsed.channels) return false;
@@ -224,7 +224,7 @@ export async function backupUserDataAsync(dataDir, reason = 'snapshot') {
   return { dir: copied.length > 0 ? backupDir : null, copied };
 }
 
-export function shouldSeedMissingUserData(dataDir, rel) {
+function shouldSeedMissingUserData(dataDir, rel) {
   if (!dataDir) return true;
   if (existsSync(join(dataDir, rel))) {
     markUserDataInitialized(dataDir);
@@ -275,7 +275,7 @@ function normCase(p) {
  * @param {string} [ownedSubdir]  the single owned subdir name (default '.deps')
  * @returns {string}              the resolved owned path (only on allow)
  */
-export function assertSafeOwnedDir(targetDir, dataDir, op = 'destructive op', ownedSubdir = OWNED_SUBDIR) {
+function assertSafeOwnedDir(targetDir, dataDir, op = 'destructive op', ownedSubdir = OWNED_SUBDIR) {
   if (!targetDir) throw new Error(`[data-guard] ${op} refused: empty target dir`);
   if (!dataDir) throw new Error(`[data-guard] ${op} refused: empty data dir`);