mixdog 1.1.2 → 1.2.0

package/src/session-runtime/workspace/workspace-state.mjs

@@ -0,0 +1,112 @@
+/**
+ * Session workspace record helpers: reading the durable `workspace` field,
+ * keeping it consistent when the cwd tool switches Projects, restoring it on
+ * resume (missing worktree → recovery), and carrying the Project's memory
+ * identity into a new worktree.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { isWorktreeBound, nextRevision, normalizeSessionWorkspace } from '../../runtime/shared/worktrees/contract.mjs';
+import { isWithin, samePath } from '../../runtime/shared/worktrees/paths.mjs';
+import { resolveProjectId } from '../../runtime/memory/lib/project-id-resolver.mjs';
+import { setWorkspaceCwdLock } from './admission-gate.mjs';
+
+/** The session's persisted workspace, or null when absent or malformed. */
+export function readSessionWorkspace(session) {
+  if (!session?.workspace) return null;
+  try {
+    return normalizeSessionWorkspace(session.workspace);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A manual Project selection (cwd tool / setCwd) while a workspace record
+ * exists. Moving inside the bound worktree keeps the record; any other
+ * directory is a Project switch and leaves the worktree (still retained) at a
+ * new revision. Returns the record to store and the Project path the desktop
+ * metadata must carry.
+ * @returns {{ workspace: object|null, projectPath: string }}
+ */
+export function workspaceForProjectSelection(session, cwd) {
+  const current = readSessionWorkspace(session);
+  if (!current) return { workspace: session?.workspace ?? null, projectPath: cwd };
+  if (isWorktreeBound(current) && isWithin(current.cwd, cwd)) {
+    return { workspace: session.workspace, projectPath: current.projectPath };
+  }
+  if (!isWorktreeBound(current) && samePath(current.cwd, cwd)) {
+    return { workspace: session.workspace, projectPath: cwd };
+  }
+  return {
+    workspace: normalizeSessionWorkspace({ projectPath: cwd, cwd, revision: nextRevision(current) }),
+    projectPath: cwd,
+  };
+}
+
+/**
+ * Where a session that replaces `session` (/new, /clear) starts: the Project
+ * folder when `session` is bound to a worktree — that worktree belongs to the
+ * session being left — else null (keep the current cwd).
+ * @returns {string|null}
+ */
+export function replacementSessionCwd(session) {
+  const workspace = readSessionWorkspace(session);
+  return isWorktreeBound(workspace) ? workspace.projectPath : null;
+}
+
+/**
+ * Execution root of a worktree-bound session for resume: the worktree when it
+ * exists, else the Project folder flagged `missing`. Null when not bound.
+ * @returns {{ cwd: string, missing: boolean }|null}
+ */
+export function boundWorkspaceCwd(session) {
+  const workspace = readSessionWorkspace(session);
+  if (!isWorktreeBound(workspace)) return null;
+  if (existsSync(workspace.cwd)) return { cwd: workspace.cwd, missing: false };
+  return { cwd: workspace.projectPath, missing: true };
+}
+
+/**
+ * After a resume: a bound session whose worktree vanished enters `recovery`
+ * (turns are refused with WORKTREE_MISSING until the user picks a branch or
+ * removes the worktree); an intact one re-locks its workers to the worktree.
+ */
+export function restoreWorkspaceAfterResume(session) {
+  const workspace = readSessionWorkspace(session);
+  if (!session?.id) return workspace;
+  if (!isWorktreeBound(workspace)) {
+    setWorkspaceCwdLock(session.id, null);
+    return workspace;
+  }
+  if (existsSync(workspace.cwd)) {
+    setWorkspaceCwdLock(session.id, workspace.cwd);
+    if (workspace.transition.state !== 'idle') {
+      session.workspace = normalizeSessionWorkspace({ ...workspace, transition: { state: 'idle', txId: null } });
+    }
+    return session.workspace;
+  }
+  setWorkspaceCwdLock(session.id, null);
+  session.workspace = normalizeSessionWorkspace({
+    ...workspace,
+    transition: { state: 'recovery', txId: `recovery:${workspace.worktreeId}` },
+  });
+  return session.workspace;
+}
+
+/**
+ * Carry the Project's memory identity into a worktree that lives outside the
+ * Project tree. Runs before anything resolves memory for the worktree (the
+ * resolver memoizes per root). No-op when the checkout already has the file
+ * or the Project has no identity.
+ * @returns {boolean} Whether a file was written.
+ */
+export function copyProjectIdentity(projectPath, worktreePath) {
+  const target = join(worktreePath, '.mixdog', 'project.id');
+  if (existsSync(target)) return false;
+  const id = resolveProjectId(projectPath);
+  if (!id) return false;
+  mkdirSync(dirname(target), { recursive: true });
+  writeFileSync(target, `${id}\n`, 'utf8');
+  return true;
+}

package/src/standalone/channel-transport/http-routes.mjs

@@ -20,6 +20,7 @@ export function createChannelRoutes({
   onClientsEmpty,
   registry,
   dispatch,
+  admitWork = () => true,
 }) {
   const { clients } = state;
 
@@ -27,6 +28,16 @@ export function createChannelRoutes({
     sendError(res, `daemon is draining: ${state.drainingReason}`, 503);
   }
 
+  // Checked on every register/call/agent dispatch, first and again right
+  // before the work is handed on (the lease may have been fenced while the
+  // body was still arriving): a daemon that lost (or cannot re-verify) its
+  // owner lease serves nothing.
+  function refuseUnadmitted(res) {
+    if (admitWork()) return false;
+    sendError(res, 'daemon owner lease is not held', 503);
+    return true;
+  }
+
   function health(res) {
     sendJson(res, {
       status: 'ok',
@@ -43,8 +54,10 @@ export function createChannelRoutes({
   }
 
   async function register(req, res) {
+    if (refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     const body = await readChannelBody(req);
+    if (refuseUnadmitted(res)) return;
     const clientToken = registry.registerClient({
       leadPid: body.leadPid,
       cwd: body.cwd,
@@ -83,9 +96,11 @@ export function createChannelRoutes({
   // channels client registry alive. The broker itself owns a parallel fair
   // scheduler and per-call cancellation.
   async function agentDispatch(req, res) {
+    if (refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     if (!agentBroker?.dispatch) return sendError(res, 'agent broker unavailable', 503);
     const body = await readChannelBody(req);
+    if (refuseUnadmitted(res)) return;
     const callId = String(body.callId || '').trim();
     if (!callId) return sendError(res, 'callId required', 400);
     res.on('close', () => {
@@ -115,8 +130,10 @@ export function createChannelRoutes({
   }
 
   async function call(req, res) {
+    if (refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     const body = await readChannelBody(req);
+    if (refuseUnadmitted(res)) return;
     const clientToken = body.token || null;
     const c = clientToken ? clients.get(clientToken) : null;
     if (!c) return sendError(res, 'unknown client token', 404);

package/src/standalone/channel-transport.mjs

@@ -41,10 +41,21 @@ export function createChannelTransport({
   onClientRegistered = null,
   onRemoteStateChange = null,
   agentBroker = null,
+  // Asked before every register/call/agent dispatch; false answers 503 (the
+  // daemon's owner lease is not held — daemon-owner.mjs).
+  admitWork = () => true,
 } = {}) {
   if (typeof handleCall !== 'function') throw new Error('handleCall is required');
 
-  const remoteIntent = readRemoteIntent(remoteIntentPath);
+  let remoteIntent = null;
+  try {
+    remoteIntent = readRemoteIntent(remoteIntentPath);
+  } catch (error) {
+    // An unreadable pin (permissions, an antivirus lock) only costs the channel
+    // its restored session; it must never keep the whole daemon from booting.
+    // The file stays in place.
+    log(`channel remote intent unreadable, starting unpinned: ${error?.message || error}`);
+  }
   const state = {
     // token -> { token, leadPid, cwd, sse, lastSeen, registeredAt }
     clients: new Map(),
@@ -111,6 +122,7 @@ export function createChannelTransport({
     onClientsEmpty,
     registry,
     dispatch,
+    admitWork,
   });
 
   function beginDrain(reason = 'daemon replacement') {

package/src/standalone/daemon-desktop-runtime.mjs

@@ -16,6 +16,7 @@ export function createDesktopRuntime({ getLocalSessionBridge }) {
       return bridge.attach(options);
     },
     loadProjects: () => import('../runtime/shared/projects.mjs'),
+    loadWorktrees: () => import('../runtime/shared/worktrees/manager.mjs'),
     loadSessionStore: () => import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
     loadSessionSearch: () => import('../runtime/session-search/session-search-db.mjs'),
     loadStatuslineSegments: () => import('../runtime/shared/statusline/statusline-segments.mjs'),

package/src/standalone/daemon-owner.mjs

@@ -0,0 +1,372 @@
+// Whether the daemon-owner.json record still names a daemon, and the lease a
+// daemon holds on it.
+//
+// A live pid proves nothing on its own. A daemon terminated without running
+// its exit hooks (Windows shutdown, an installer or Task Manager ending the
+// process tree) leaves its owner record behind, and the OS soon hands that pid
+// to an unrelated process. A pid-only check then reported a live owner for as
+// long as that process ran: every launcher waited for it to publish, every
+// spawned candidate yielded to it, and the desktop failed every call with
+// "daemon session endpoint is unavailable".
+//
+// Single-owner safety never rests on the wall clock:
+// - Holder: keeps its lease in monotonic time since its last successful
+//   refresh. An expired lease fences it (refuse work, shut down) instead of
+//   being renewed, and every register/call asks `admit()` first. After an
+//   event-loop stall nothing is served until a refresh under the claim lock
+//   proves the record still names it — a contender's claim takes that lock.
+// - Holder's record names `livenessPort` from its very first claim: a tiny
+//   loopback listener started BEFORE the claim (startOwnerLivenessListener)
+//   answers /health with the pid, through boot and for the process lifetime.
+// - Contender: may reclaim a live-pid record only when its heartbeat looks
+//   stale (wall clock: a reused pid never beats) AND that port, probed for the
+//   full OWNER_PROBE_TIMEOUT_MS, does not answer with that pid — never on
+//   wall-clock staleness alone, so a clock jump never reclaims a holder that
+//   answers, booting or not; a holder silent for that long has stalled past
+//   `stallMs` and re-verifies before serving again.
+//
+// Records without a heartbeat come from v1.1.2 and older (and records with a
+// heartbeat but no liveness port only from unreleased intermediate builds,
+// judged the same way). Their pid matching the leftover daemon.json proves
+// nothing — a crashed daemon leaves both files behind — so only the endpoint
+// daemon.json publishes, answering with that pid, proves them alive.
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { isPidAlive } from '../runtime/shared/pid-liveness.mjs';
+import { readSingletonOwner, refreshSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
+
+export const DAEMON_OWNER_STALE_MS = 60_000;
+export const OWNER_PROBE_TIMEOUT_MS = 3_000;
+const PROBE_BODY_MAX_BYTES = 1024 * 1024;
+
+/**
+ * Lease timings. MIXDOG_DAEMON_OWNER_STALE_MS may only shorten the stale
+ * threshold (tests); every process on one data dir must see the same value.
+ * Six beats per threshold; fenced at two thirds of it (40 s of 60 s, leaving
+ * the 15 s shutdown budget inside it); the lease is checked every `tickMs`
+ * and a turn gap over `stallMs` (< OWNER_PROBE_TIMEOUT_MS) counts as a stall.
+ */
+export function daemonOwnerTimings(env = process.env) {
+  const configured = Number(env.MIXDOG_DAEMON_OWNER_STALE_MS);
+  const staleMs =
+    Number.isFinite(configured) && configured > 0
+      ? Math.min(DAEMON_OWNER_STALE_MS, Math.max(600, configured))
+      : DAEMON_OWNER_STALE_MS;
+  const heartbeatMs = Math.round(staleMs / 6);
+  const tickMs = Math.min(250, Math.round(heartbeatMs / 4));
+  return { staleMs, heartbeatMs, fenceMs: Math.round((staleMs * 2) / 3), tickMs, stallMs: tickMs * 4 };
+}
+
+/** daemon.json's pid and session endpoint, or null when missing/unreadable. */
+export function readDiscovery(discoveryPath) {
+  try {
+    const parsed = JSON.parse(readFileSync(discoveryPath, 'utf8'));
+    const session = parsed?.endpoints?.session;
+    return { pid: Number(parsed?.pid) || 0, port: Number(session?.port) || 0, token: session?.token || '' };
+  } catch {
+    return null;
+  }
+}
+
+/** The pid daemon.json names, or 0 when it is missing or unreadable. */
+export function discoveryPid(discoveryPath) {
+  return readDiscovery(discoveryPath)?.pid || 0;
+}
+
+/**
+ * The pid a session endpoint's /health reports (0 when it does not answer
+ * with one), bounded by `timeoutMs` of TOTAL duration — a response trickling
+ * in byte by byte cannot stretch it. `timedOut` tells a probe cut off by the
+ * bound from one refused or answered.
+ */
+export function probeDaemonPid({ port, token = '', timeoutMs = OWNER_PROBE_TIMEOUT_MS }) {
+  return new Promise((resolve) => {
+    if (!(Number.isInteger(port) && port > 0 && port < 65_536)) {
+      resolve({ pid: 0, timedOut: false });
+      return;
+    }
+    let settled = false;
+    let timer = null;
+    let req = null;
+    const finish = (pid, timedOut = false) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ pid, timedOut });
+      req?.destroy();
+    };
+    timer = setTimeout(() => finish(0, true), Math.max(1, timeoutMs));
+    req = http.get(
+      {
+        hostname: '127.0.0.1',
+        port,
+        path: '/health',
+        agent: false,
+        headers: token ? { 'X-Mixdog-Daemon-Token': token } : {},
+      },
+      (res) => {
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => {
+          body += chunk;
+          if (body.length > PROBE_BODY_MAX_BYTES) finish(0);
+        });
+        res.on('end', () => {
+          let health = null;
+          try {
+            health = JSON.parse(body);
+          } catch {}
+          finish(res.statusCode === 200 && health?.status === 'ok' ? Number(health.pid) || 0 : 0);
+        });
+        res.on('error', () => finish(0));
+      }
+    );
+    req.on('error', () => finish(0));
+  });
+}
+
+function olderThan(stamp, now, staleMs) {
+  const at = Date.parse(String(stamp ?? ''));
+  // A clock step in either direction must not keep a dead record fresh.
+  return !Number.isFinite(at) || Math.abs(now - at) > staleMs;
+}
+
+function validPort(value) {
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port < 65_536 ? port : 0;
+}
+
+/** The liveness port of a leased record (heartbeat + port), else 0. */
+function leasedPort(owner) {
+  return owner?.heartbeatAt !== undefined ? validPort(owner.livenessPort) : 0;
+}
+
+/**
+ * The holder's owner-liveness listener: loopback /health answering this pid
+ * (unauthenticated, like the session /health). Started before the claim so
+ * the very first record names its port; it answers whenever this process's
+ * event loop runs. Resolves null when loopback cannot be bound — the record
+ * then carries no port and is judged like a legacy one.
+ */
+export function startOwnerLivenessListener({ pid = process.pid, log = () => {} } = {}) {
+  return new Promise((resolve) => {
+    const server = http.createServer((req, res) => {
+      if (req.method === 'GET' && req.url === '/health') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ status: 'ok', pid }));
+      } else {
+        res.writeHead(404);
+        res.end();
+      }
+    });
+    server.once('error', (error) => {
+      log(`owner liveness listener unavailable: ${error?.message || error}`);
+      resolve(null);
+    });
+    server.listen(0, '127.0.0.1', () => {
+      // Never what keeps the process alive.
+      server.unref();
+      resolve({
+        port: server.address().port,
+        close: () => new Promise((done) => server.close(() => done())),
+      });
+    });
+  });
+}
+
+/**
+ * Liveness proof for a live-pid owner record that may be reclaimable.
+ * Leased record (heartbeat + liveness port): null while the heartbeat looks
+ * fresh, else a probe of that port. Any other record (v1.1.2 and older, or an
+ * intermediate build's record without a port): a probe of the endpoint
+ * daemon.json publishes for that pid. Verdicts: `live` (answered with the
+ * pid), `dead` (refused, answered otherwise, or silent for the full probe
+ * timeout), `unknown` (silent for a probe cut short by `budgetMs`),
+ * `unpublished` (legacy only: no endpoint to probe).
+ */
+export async function proveDaemonOwner(
+  owner,
+  {
+    discoveryPath,
+    now = Date.now(),
+    staleMs = daemonOwnerTimings().staleMs,
+    probe = probeDaemonPid,
+    timeoutMs = OWNER_PROBE_TIMEOUT_MS,
+    budgetMs = Number.POSITIVE_INFINITY,
+  } = {}
+) {
+  const pid = Number(owner?.pid) || 0;
+  if (!pid || !isPidAlive(pid)) return null;
+  const limit = Math.max(1, Math.min(timeoutMs, budgetMs));
+  const verdictOf = (answer) => {
+    if (answer.pid === pid) return 'live';
+    return answer.timedOut && limit < timeoutMs ? 'unknown' : 'dead';
+  };
+  const livenessPort = leasedPort(owner);
+  if (livenessPort) {
+    if (!olderThan(owner.heartbeatAt, now, staleMs)) return null;
+    return { pid, verdict: verdictOf(await probe({ port: livenessPort, timeoutMs: limit })) };
+  }
+  const discovery = readDiscovery(discoveryPath);
+  if (discovery?.pid !== pid || !validPort(discovery.port)) return { pid, verdict: 'unpublished' };
+  return { pid, verdict: verdictOf(await probe({ port: discovery.port, token: discovery.token, timeoutMs: limit })) };
+}
+
+/** proveDaemonOwner for the record currently at `ownerPath`. */
+export function proveDaemonOwnerRecord(ownerPath, options) {
+  return proveDaemonOwner(readSingletonOwner(ownerPath).owner, options);
+}
+
+/**
+ * Whether a live-pid owner record may be reclaimed (the pid check itself is
+ * the caller's: readSingletonOwner / claimSingletonOwner), given `proof` from
+ * proveDaemonOwner for its pid. Without that proof it stands.
+ */
+export function daemonOwnerIsStale(
+  owner,
+  { proof = null, now = Date.now(), staleMs = daemonOwnerTimings().staleMs } = {}
+) {
+  const pid = Number(owner?.pid) || 0;
+  if (!pid || proof?.pid !== pid) return false;
+  if (leasedPort(owner)) {
+    // Only a failed probe of its liveness port, never staleness alone. The
+    // heartbeat is re-checked: under the claim lock the holder may just have
+    // beaten.
+    return olderThan(owner.heartbeatAt, now, staleMs) && proof.verdict === 'dead';
+  }
+  if (proof.verdict === 'dead') return true;
+  return proof.verdict === 'unpublished' && olderThan(owner.claimedAt, now, staleMs);
+}
+
+/**
+ * The holder's side of the lease, in monotonic time (`monoNow`). Every
+ * `tickMs` it checks the lease, notices stalls, and every `heartbeatMs`
+ * rewrites `owner` with a fresh wall-clock `heartbeatAt` under the claim lock
+ * (recreating a deleted record), then calls `onBeat`.
+ * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`).
+ * - The record names another pid: `onSuperseded(record)`.
+ * - A turn gap over `stallMs`: `admit()` refuses work until a refresh succeeds.
+ * Both callbacks must make this process stop serving.
+ */
+export function createOwnerHeartbeat({
+  ownerPath,
+  owner,
+  heartbeatMs,
+  fenceMs,
+  tickMs,
+  stallMs,
+  now = Date.now,
+  monoNow = () => performance.now(),
+  refresh = refreshSingletonOwner,
+  log = () => {},
+  onBeat = () => {},
+  onSuperseded,
+  onFenced,
+}) {
+  const record = { ...owner };
+  let state = 'active';
+  let leaseFrom = monoNow();
+  let lastRefreshAt = record.heartbeatAt ?? null;
+  let lastBeatAt = leaseFrom;
+  let lastTurnAt = leaseFrom;
+  let needsVerify = false;
+  let timer = null;
+
+  function halt(next) {
+    state = next;
+    if (timer) clearInterval(timer);
+    timer = null;
+  }
+
+  function leaseExpired(t) {
+    return t - leaseFrom >= fenceMs;
+  }
+
+  function fence(t) {
+    if (state !== 'active') return;
+    halt('fenced');
+    log(`owner lease not refreshed for ${Math.round(t - leaseFrom)}ms (last ${lastRefreshAt}) — fencing`);
+    onFenced({ lastRefreshAt, sinceMs: Math.round(t - leaseFrom) });
+  }
+
+  function noteTurn(t) {
+    if (t - lastTurnAt > stallMs && !needsVerify) {
+      needsVerify = true;
+      log(`event loop stalled ${Math.round(t - lastTurnAt)}ms — owner lease must be re-verified before serving`);
+    }
+    lastTurnAt = t;
+  }
+
+  function beat() {
+    if (state !== 'active') return null;
+    const t = monoNow();
+    lastBeatAt = t;
+    // Checked before every renewal: an overdue beat after a stall must fence,
+    // not extend a lease a contender may already have reclaimed.
+    if (leaseExpired(t)) {
+      fence(t);
+      return 'fenced';
+    }
+    const heartbeatAt = new Date(now()).toISOString();
+    let result;
+    try {
+      result = refresh(ownerPath, { ...record, heartbeatAt });
+    } catch (error) {
+      log(`owner heartbeat failed: ${error?.message || error}`);
+      result = { status: 'failed' };
+    }
+    if (result.status === 'refreshed') {
+      leaseFrom = t;
+      lastRefreshAt = heartbeatAt;
+      needsVerify = false;
+      onBeat();
+    } else if (result.status === 'superseded') {
+      halt('superseded');
+      onSuperseded(result.owner);
+    } else if (result.status === 'busy') {
+      log('owner heartbeat skipped: claim lock busy');
+    }
+    return result.status;
+  }
+
+  function tick() {
+    if (state !== 'active') return;
+    const t = monoNow();
+    noteTurn(t);
+    if (leaseExpired(t)) fence(t);
+    else if (needsVerify ? t - lastBeatAt >= tickMs : t - lastBeatAt >= heartbeatMs) beat();
+  }
+
+  return {
+    start() {
+      if (timer || state !== 'active') return;
+      timer = setInterval(tick, tickMs);
+      timer.unref?.();
+    },
+    /** Gate for every register/call: true while the lease is held and verified. */
+    admit() {
+      if (state === 'fenced' || state === 'superseded') return false;
+      const t = monoNow();
+      // Shutting down: no ticks run to measure stalls; the lease still bounds it.
+      if (state === 'stopped') return !leaseExpired(t);
+      noteTurn(t);
+      if (leaseExpired(t)) {
+        fence(t);
+        return false;
+      }
+      // Re-verified at most once per tick: a busy claim lock must not block
+      // the loop on every request.
+      if (needsVerify && t - lastBeatAt >= tickMs) beat();
+      return state === 'active' && !needsVerify;
+    },
+    beat,
+    tick,
+    /** Stop beating (shutdown). admit() keeps refusing once the lease runs out. */
+    stop() {
+      if (state === 'active') halt('stopped');
+    },
+    get state() {
+      return state;
+    },
+  };
+}

package/src/standalone/daemon-stored-session-views.mjs

@@ -37,7 +37,10 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       const { createRuntimeReviewApi } = await import('../session-runtime/runtime-review-api.mjs');
       const review = createRuntimeReviewApi({ getCwd: () => metadata.cwd || '', getSessionId: () => sessionId });
       // The runtime review API answers `known`/`summary` itself (turnReviewReply).
-      return action === 'getSessionReviewDiff' ? review.getSessionReviewDiff() : review.getTurnReviewDiff(args[0]);
+      if (action === 'getSessionReviewDiff') return review.getSessionReviewDiff();
+      // A cold session runs no turn: its change record is final.
+      if (action === 'getTurnChanges') return review.getTurnChanges(args[0]);
+      return review.getTurnReviewDiff(args[0]);
     },
     forgetStoredSession: async (sessionId) => {
       const store = await desktopRuntime.loadSessionStore();