mixdog 1.2.2 → 1.2.3

package/src/standalone/daemon-owner.mjs

@@ -246,6 +246,7 @@ export function daemonOwnerIsStale(
  * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`).
  * - The record names another pid: `onSuperseded(record)`.
  * - A turn gap over `stallMs`: `admit()` refuses work until a refresh succeeds.
+ *   The gap is logged once, with `describeStall(fromMono, toMono)` appended.
  * Both callbacks must make this process stop serving.
  */
 export function createOwnerHeartbeat({
@@ -259,6 +260,7 @@ export function createOwnerHeartbeat({
   monoNow = () => performance.now(),
   refresh = refreshSingletonOwner,
   log = () => {},
+  describeStall = null,
   onBeat = () => {},
   onSuperseded,
   onFenced,
@@ -290,11 +292,22 @@ export function createOwnerHeartbeat({
   }
 
   function noteTurn(t) {
-    if (t - lastTurnAt > stallMs && !needsVerify) {
-      needsVerify = true;
-      log(`event loop stalled ${Math.round(t - lastTurnAt)}ms — owner lease must be re-verified before serving`);
-    }
+    const from = lastTurnAt;
+    // Rebased before reporting: one long block is one gap, however many
+    // callers (tick, admit) observe it afterwards.
     lastTurnAt = t;
+    if (t - from <= stallMs) return;
+    needsVerify = true;
+    let detail = '';
+    try {
+      detail = describeStall?.(from, t) || '';
+    } catch {
+      /* attribution must not disturb the lease */
+    }
+    log(
+      `event loop stalled ${Math.round(t - from)}ms — owner lease must be re-verified before serving` +
+        (detail ? ` | ${detail}` : '')
+    );
   }
 
   function beat() {

package/src/standalone/daemon-pg-stop.mjs

@@ -0,0 +1,51 @@
+// The daemon's PostgreSQL stop inside its shutdown. The normal teardown stops
+// PostgreSQL after every user of it has closed, letting durable writes still in
+// flight commit first; a fallback timer stops it regardless just before the
+// launcher's kill (PG_FORCED_STOP_AT_MS), because a daemon killed before
+// `pg_ctl stop` leaves the daemonized postmaster running.
+import { PG_FORCED_STOP_AT_MS } from './daemon-stop-budget.mjs';
+
+const ADAPTER = '../runtime/memory/lib/pg/adapter.mjs';
+
+/**
+ * Arm at shutdown start. `finish()` is the ordered teardown step: it drains
+ * durable writes until the fallback point, then stops. Idempotent: whichever
+ * of finish/fallback comes first runs the one stop; the other joins it.
+ */
+export function createDaemonPgStop({
+  log,
+  stopTimeoutMs,
+  forcedStopAtMs = PG_FORCED_STOP_AT_MS,
+  loadAdapter = () => import(ADAPTER),
+}) {
+  const startedAt = Date.now();
+  let stopping = null;
+  // The drain budget is what remains until the fallback point once the adapter
+  // has loaded, so a slow load never stretches the drain past that point.
+  const drainBudget = () => Math.max(0, startedAt + forcedStopAtMs - Date.now());
+  const run = (drain) => {
+    stopping ??= loadAdapter()
+      .then(({ shutdownOwnedPg }) =>
+        shutdownOwnedPg({ timeoutMs: stopTimeoutMs, drainMs: drain ? drainBudget() : 0 })
+      )
+      .then(
+        (stopped) => {
+          if (stopped) log('postgres stopped');
+        },
+        (e) => log(`postgres stop failed: ${e?.message || e}`)
+      );
+    return stopping;
+  };
+  const fallback = setTimeout(() => {
+    if (stopping) return; // the ordered stop is draining; its bound is this same point
+    log(`teardown still running ${forcedStopAtMs}ms into shutdown; stopping postgres before the launcher's kill`);
+    void run(false);
+  }, forcedStopAtMs);
+  fallback.unref?.();
+  return {
+    finish() {
+      clearTimeout(fallback);
+      return run(true);
+    },
+  };
+}

package/src/standalone/daemon-stop-budget.d.mts

@@ -0,0 +1,2 @@
+export const IN_TREE_DAEMON_STOP_GRACE_MS: number;
+export const PG_FORCED_STOP_AT_MS: number;

package/src/standalone/daemon-stop-budget.mjs

@@ -0,0 +1,18 @@
+// Time budget of an in-tree daemon's stop, shared by the launcher that waits
+// for it (desktop quit) and the daemon that has to finish inside it.
+
+/** How long a launcher waits for an in-tree daemon to exit after asking it to
+ *  stop. Past this the launcher exits and the daemon dies with its process
+ *  tree — on Windows without any exit hook. A healthy daemon stop (PostgreSQL
+ *  included) measures ~0.6 s; the rest is room for a slow teardown to finish
+ *  its writes. The desktop window is hidden before this wait begins. */
+export const IN_TREE_DAEMON_STOP_GRACE_MS = 5_000;
+
+/** `pg_ctl stop` spawn + signal delivery. Once signalled, the postmaster
+ *  finishes its shutdown on its own even if the daemon is then killed. */
+const PG_STOP_SIGNAL_MARGIN_MS = 800;
+
+/** Fallback point (from shutdown start) at which the daemon stops PostgreSQL
+ *  even while earlier teardown steps still run: just before the launcher's
+ *  kill, so a slow-but-healthy teardown keeps its writes until then. */
+export const PG_FORCED_STOP_AT_MS = IN_TREE_DAEMON_STOP_GRACE_MS - PG_STOP_SIGNAL_MARGIN_MS;

package/src/standalone/daemon-stored-session-views.mjs

@@ -38,6 +38,8 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       const review = createRuntimeReviewApi({ getCwd: () => metadata.cwd || '', getSessionId: () => sessionId });
       // The runtime review API answers `known`/`summary` itself (turnReviewReply).
       if (action === 'getSessionReviewDiff') return review.getSessionReviewDiff();
+      if (action === 'getSessionReviewFilePatch') return review.getSessionReviewFilePatch(args[0], args[1]);
+      if (action === 'getTurnReviewFilePatch') return review.getTurnReviewFilePatch(args[0]);
       // A cold session runs no turn: its change record is final.
       if (action === 'getTurnChanges') return review.getTurnChanges(args[0]);
       return review.getTurnReviewDiff(args[0]);

package/src/standalone/daemon-telemetry.mjs

@@ -139,6 +139,25 @@ export function createPostGcHeapTracker({
   };
 }
 
+/**
+ * Builds the `describeStall(fromMono, toMono)` the owner heartbeat appends to
+ * its stall line: the spans that overlapped the stall window plus the in-flight
+ * work snapshot at report time. Counters and labels only.
+ */
+export function createStallDescriber({ spans, getWork = () => ({}), limit = 3 } = {}) {
+  return (fromMono, toMono) => {
+    const parts = [];
+    const overlapping = spans?.describe(fromMono, toMono, limit);
+    if (overlapping) parts.push(overlapping);
+    const work = workCounts(getWork());
+    parts.push(
+      `in-flight: activeCalls=${work.activeCalls} queuedCalls=${work.queuedCalls}` +
+        ` busySessions=${work.busySessions} busyMemoryAgents=${work.busyMemoryAgents}`
+    );
+    return parts.join(' | ');
+  };
+}
+
 export function formatDaemonTelemetry(record, reason = 'periodic') {
   const row = record && typeof record === 'object' ? record : collectDaemonTelemetry();
   return [

package/src/standalone/daemon.mjs

@@ -66,6 +66,7 @@ import {
 import { createAgentDispatchBroker } from './agent-dispatch-broker.mjs';
 import { createChannelTransport } from './channel-transport.mjs';
 import { drainDeferral, idleGcEligible } from './daemon-drain-policy.mjs';
+import { createDaemonPgStop } from './daemon-pg-stop.mjs';
 import { createChannelSessionRouter } from '../session-runtime/services/channel-session-router.mjs';
 import { createSessionTransport } from './session-transport.mjs';
 import { createSessionService } from './session-service.mjs';
@@ -75,6 +76,7 @@ import * as quotaResumeStore from '../runtime/shared/quota-resume-store.mjs';
 import { registerWorktreeCacheCleanups } from '../runtime/shared/worktrees/cache-cleanups.mjs';
 import { createInlineSessionRuntimeHost } from './session-runtime-inline-host.mjs';
 import { getStandaloneMemoryRuntime } from '../session-runtime/services/memory-runtime-proxy.mjs';
+import { registerTranscriptPurgeHook } from '../session-runtime/session-transcript-purge.mjs';
 import { createBootPhaseProfiler } from './boot-phase-profiler.mjs';
 import { createDaemonBootCoordinator } from './daemon-boot-coordinator.mjs';
 import { createDaemonLog } from './daemon-log.mjs';
@@ -83,11 +85,13 @@ import {
   installDaemonExitRecorder,
   reconcileLostDaemonCaptures,
 } from '../session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs';
-import { createDaemonTelemetry } from './daemon-telemetry.mjs';
+import { createDaemonTelemetry, createStallDescriber } from './daemon-telemetry.mjs';
+import { slowSpans } from '../runtime/shared/slow-span.mjs';
 import { createLagProfiler } from './daemon-lag-profiler.mjs';
 import { createChannelsRuntimeLoader } from './daemon-channels-loader.mjs';
 import { createDesktopRuntime } from './daemon-desktop-runtime.mjs';
 import { createCanonicalAgentControl } from './daemon-agent-control.mjs';
+import { flushAllIndexWrites } from '../session-runtime/services/agent-tool/index-write-queue.mjs';
 import { registerAutomationAgentTool } from '../session-runtime/automation-agents.mjs';
 import {
   compareRuntimeVersions,
@@ -132,7 +136,9 @@ let sessionTransport = null;
 let sessionService = null;
 let sessionRuntimeHost = null;
 let localSessionBridge = null;
+let canonicalAgentControl = null;
 let memoryRuntime = null;
+let transcriptPurgeUnregister = null;
 let agentDispatchBroker = null;
 let remoteSessionState = { enabled: false, sessionId: null };
 let shuttingDown = false;
@@ -161,6 +167,13 @@ function registerMemoryRuntimeLazy() {
   // real memory call (memory/recall tools, the Memory install) starts the
   // singleton; nothing warms it at boot. The PG cluster itself usually starts
   // earlier: the channels schedules/webhooks stores open it at boot.
+  // Deleting a session removes its transcript file here, and its memory ingest
+  // offsets once the memory runtime exists (none when memory is skipped).
+  if (!transcriptPurgeUnregister) {
+    transcriptPurgeUnregister = registerTranscriptPurgeHook({
+      forgetOffsets: (transcriptPaths) => memoryRuntime?.forgetTranscripts(transcriptPaths),
+    });
+  }
   if (process.env.MIXDOG_DAEMON_SKIP_MEMORY === '1') {
     log('memory runtime skipped (MIXDOG_DAEMON_SKIP_MEMORY=1)');
     return;
@@ -201,6 +214,8 @@ function eventLoopStatus() {
 /** Ceiling for the whole teardown sequence, above the slowest individual stop
  *  (channels/memory) so a healthy shutdown always finishes on its own. */
 const SHUTDOWN_BUDGET_MS = 15_000;
+/** Graceful PostgreSQL stop bound inside that budget (pg_ctl stop -m fast). */
+const PG_STOP_TIMEOUT_MS = 6_000;
 
 async function shutdown(reason, code = 0) {
   if (shuttingDown) return;
@@ -221,6 +236,9 @@ async function shutdown(reason, code = 0) {
     process.exit(code);
   }, SHUTDOWN_BUDGET_MS);
   forcedExit.unref?.();
+  // PostgreSQL stops after its users below (durable writes drained first), or
+  // at the fallback point just before the launcher's kill, whichever is first.
+  const pgStop = createDaemonPgStop({ log, stopTimeoutMs: PG_STOP_TIMEOUT_MS });
   try {
     setChannelNotifySink(null);
   } catch {}
@@ -241,6 +259,15 @@ async function shutdown(reason, code = 0) {
   } catch (e) {
     log(`session runtime host stop failed: ${e?.message || e}`);
   }
+  // Every runtime is closed: drain the canonical agent's index writers (and any
+  // other queued index write) before process.exit, whose 'exit' hook cannot
+  // finish async work.
+  try {
+    await canonicalAgentControl?.dispose?.();
+    await flushAllIndexWrites();
+  } catch (e) {
+    log(`agent index drain failed: ${e?.message || e}`);
+  }
   // Host-side Computer Use workers and target claims are reaped only on an
   // explicit release; the runtime's deferred timer is unref'd and never fires
   // once this process exits.
@@ -271,6 +298,11 @@ async function shutdown(reason, code = 0) {
   } catch (e) {
     log(`memory.stop failed: ${e?.message || e}`);
   }
+  // PostgreSQL this daemon started through its stores (schedules, webhooks,
+  // session search) after every user of it above is closed. `pg_ctl start`
+  // daemonizes the postmaster outside this process tree, so without this stop
+  // it outlives the daemon. A cluster another live process owns is left to it.
+  await pgStop.finish();
   try {
     agentDispatchBroker?.close?.(reason);
   } catch (e) {
@@ -315,6 +347,9 @@ function inFlightWork() {
 
 // Opt-in CPU profiling of lag windows while DATA_DIR/lag-profile.on exists.
 const lagProfiler = createLagProfiler({ dataDir: DATA_DIR, log });
+// Request spans share the heartbeat's performance.now() clock; `[slow-op]` lines
+// and stall attribution come from the same recorder.
+slowSpans.setLog(log);
 
 daemonTelemetry = createDaemonTelemetry({
   log,
@@ -506,6 +541,7 @@ async function claimDaemonOwnership(bootPhases) {
     tickMs: timings.tickMs,
     stallMs: timings.stallMs,
     log,
+    describeStall: createStallDescriber({ spans: slowSpans, getWork: inFlightWork }),
     onBeat: republishMissingDiscovery,
     onSuperseded: (record) => fenceDaemon(`owner claim superseded by pid=${record?.pid}`),
     onFenced: ({ lastRefreshAt, sinceMs }) =>
@@ -696,6 +732,22 @@ function announceDaemonReady({ port, token, startedAt, bootPhases }) {
   });
 }
 
+/** After ready, off every request path: arm the last-chance PostgreSQL stop on
+ *  exit, then open the schedules/webhooks stores. On an existing cluster that
+ *  starts PostgreSQL here, so the first catalog read (the desktop sidebar's
+ *  channel setup) joins this start instead of being the one that runs it; a
+ *  data dir with no cluster yet starts nothing (channel-admin). Loaded after
+ *  the stderr redirect, so the PG layer's logs reach daemon.log. */
+function startPostgresInBackground() {
+  void import('../runtime/memory/lib/pg/adapter.mjs')
+    .then((pg) => {
+      pg.installOwnedPgExitStop();
+      if (shuttingDown) return null;
+      return import('../session-runtime/services/channel-admin.mjs').then((admin) => admin.hasActiveAutomation());
+    })
+    .catch((error) => log(`postgres background start failed: ${error?.message || error}`));
+}
+
 /** The channels front door: pointer-routed calls over HTTP+SSE. Creating the
  *  transport also wires the channels notification sink (session-bound
  *  notifications reach the session service, the rest fan out to channel
@@ -844,6 +896,7 @@ async function main() {
     getSessionRuntimeHost: () => sessionRuntimeHost,
     cwd: CWD,
   });
+  canonicalAgentControl = agentControl;
   // Schedules and webhooks run headless here; their sessions reach the same
   // canonical agent control through the automation tool scope.
   registerAutomationAgentTool(agentControl.execute);
@@ -938,6 +991,13 @@ async function main() {
   log(`session front door on 127.0.0.1:${sessionEndpoint.port}`);
 
   announceDaemonReady({ port, token, startedAt, bootPhases });
+  // After ready, off the boot path: load the session-runtime module tree so
+  // the first session.create does not block the loop on synchronous module
+  // compilation. Failures fall back to the lazy import inside create.
+  setImmediate(() => {
+    void sessionRuntimeHost?.warmLocalRuntime?.();
+  });
+  startPostgresInBackground();
 
   // Automation may spawn the shared daemon; keep schedules/webhooks live.
   // A TUI-spawned daemon keeps the historical eager start (its channels client

package/src/standalone/desktop-service-registry.mjs

@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { sanitizeForWire } from './session-wire-values.mjs';
+import { annotateSpan } from '../runtime/shared/slow-span.mjs';
 import { modelProxyClientMode } from '../runtime/shared/model-proxy-mode.mjs';
 import { getModelProxyChannel } from '../runtime/agent/orchestrator/providers/model-proxy-channel.mjs';
 
@@ -217,6 +218,10 @@ export class DesktopServiceRegistry {
     const { service } = this.#requireSubscribed(desktopId, ctx);
     const name = String(method || '');
     if (!name) throw new TypeError('desktop service method is required');
+    // `[slow-op] desktop.invoke` names the call it timed: a desktop operation
+    // (Git reads) or a session capability, not only the generic route.
+    const target = name === 'invokeDesktopOperation' || name === 'invokeCapability' ? String(args?.[0] || '') : '';
+    annotateSpan(target ? `${name}:${target}` : name);
     return sanitizeForWire(await service.instance.invoke(name, Array.isArray(args) ? args : [])) ?? null;
   }
 

package/src/standalone/local-session-runtime.mjs

@@ -19,6 +19,7 @@ import { createContextState } from '../tui/session/context-state.mjs';
 import { createSessionFlow } from '../tui/session/session-flow.mjs';
 import { createRunTurn } from '../tui/session/turn.mjs';
 import { createQuotaResumeLane } from '../tui/session/quota-resume.mjs';
+import { createGitHeadWatcher } from '../runtime/shared/worktrees/git-head.mjs';
 import { publicQuotaResume, quotaResumeEntry } from '../runtime/shared/quota-resume-store.mjs';
 import { createSessionApi } from '../tui/session/session-api.mjs';
 import { createSessionDraftStore } from '../tui/session/draft-store.mjs';
@@ -33,18 +34,54 @@ import { formatDoctorReport, runDoctorChecks } from '../tui/app/doctor.mjs';
 // tuiDebug is an opt-in diagnostic trace for the hang chain (runTurn start/end,
 // busy-queue enqueue/drain). Quiet by default so it can never tear through
 // the alternate-screen render; enable with MIXDOG_TUI_DEBUG=1.
-import { tuiDebug, nextId, createTranscriptSpillBuffer } from '../tui/session/transcript-spill.mjs';
+import {
+  tuiDebug,
+  nextId,
+  createTranscriptSpillBuffer,
+  sweepStaleTranscriptSpillDirsOnce,
+} from '../tui/session/transcript-spill.mjs';
 
 const SESSION_RUNTIME_MODULE = '../mixdog-session-runtime.mjs';
 
 // Shared across create calls so concurrent session startups import the
 // runtime graph once.
 let sessionRuntimeModulePromise = null;
+let sessionRuntimeImporter = () => import(SESSION_RUNTIME_MODULE);
 function importSessionRuntimeModule() {
-  sessionRuntimeModulePromise ??= import(SESSION_RUNTIME_MODULE);
+  // A failed import is forgotten so the next caller retries lazily.
+  sessionRuntimeModulePromise ??= Promise.resolve()
+    .then(() => sessionRuntimeImporter())
+    .catch((error) => {
+      sessionRuntimeModulePromise = null;
+      throw error;
+    });
   return sessionRuntimeModulePromise;
 }
 
+/**
+ * Background warm-up for the daemon (scheduled after the ready signal): loads
+ * the session-runtime module tree and runs the one-per-process transcript
+ * spill sweep, so the first session.create pays for neither. Failures are
+ * swallowed — create falls back to the same lazy import.
+ */
+export async function warmLocalSessionRuntime() {
+  try {
+    await importSessionRuntimeModule();
+    // Separate turn: let queued I/O run between the import and the sync sweep.
+    await new Promise((resolve) => setImmediate(resolve));
+    sweepStaleTranscriptSpillDirsOnce();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Test seam: replace the dynamic import of the session-runtime module. */
+export function setSessionRuntimeImporterForTest(importer) {
+  sessionRuntimeImporter = importer || (() => import(SESSION_RUNTIME_MODULE));
+  sessionRuntimeModulePromise = null;
+}
+
 const TOOL_APPROVAL_TIMEOUT_MS = (() => {
   const value = Number(process.env.MIXDOG_TOOL_APPROVAL_TIMEOUT_MS);
   return Number.isFinite(value) && value > 0 ? Math.max(1000, Math.round(value)) : 120_000;
@@ -98,7 +135,7 @@ export function createRuntimePulse({
     if (!set(changed)) emit();
     return true;
   };
-  return () => {
+  const pulse = () => {
     if (flags.disposed) return;
     if (flags.pendingSessionReset) return;
     // Attached viewer with a live pipe: the owner's frames are authoritative
@@ -115,6 +152,12 @@ export function createRuntimePulse({
       ...agentStatusState(),
     });
   };
+  /** Publishes just the workspace (a HEAD change): no stats or agent recompute. */
+  pulse.publishWorkspace = () => {
+    if (flags.disposed || flags.pendingSessionReset) return;
+    publishChanged({ workspace: routeState().workspace });
+  };
+  return pulse;
 }
 
 export async function createLocalSessionRuntime({
@@ -277,20 +320,29 @@ export async function createLocalSessionRuntime({
       timeoutMs: TOOL_APPROVAL_TIMEOUT_MS,
     }
   );
-  lifecycle.runtimePulseTimer = setInterval(
-    createRuntimePulse({
-      flags,
-      liveShareMirroring: () => bag.liveShareMirroring?.() === true,
-      getState,
-      getPublishedState,
-      set,
-      emit: store.emit,
-      routeState,
-      agentStatusState,
-      syncContextStats,
-    }),
-    2000
-  );
+  const runtimePulse = createRuntimePulse({
+    flags,
+    liveShareMirroring: () => bag.liveShareMirroring?.() === true,
+    getState,
+    getPublishedState,
+    set,
+    emit: store.emit,
+    routeState,
+    agentStatusState,
+    syncContextStats,
+  });
+  // A `git switch` from any terminal reaches the island within ~a frame; the
+  // pulse retargets the watch when the session's folder moves.
+  const headWatch = createGitHeadWatcher({
+    getCwd: () => runtime.getLiveWorkspace?.()?.cwd || runtime.cwd,
+    onChange: runtimePulse.publishWorkspace,
+  });
+  headWatch.retarget();
+  lifecycle.unsubscribeGitHeadWatch = headWatch.dispose;
+  lifecycle.runtimePulseTimer = setInterval(() => {
+    headWatch.retarget();
+    runtimePulse();
+  }, 2000);
   lifecycle.runtimePulseTimer.unref?.();
 
   const {
@@ -405,8 +457,7 @@ export async function createLocalSessionRuntime({
   Object.assign(bag, createSessionFlow(bag));
   // Runtime-driven completion wakes (no attached surface acked the completion)
   // get the same idle auto-clear as a user submit.
-  lifecycle.unsubscribeCompletionWakeGate =
-    runtime.setCompletionWakeGate?.(() => bag.autoClearBeforeWake()) || null;
+  lifecycle.unsubscribeCompletionWakeGate = runtime.setCompletionWakeGate?.(() => bag.autoClearBeforeWake()) || null;
   Object.assign(
     bag,
     createGoalContinuation({

package/src/standalone/session-client.mjs

@@ -21,6 +21,7 @@ import { withHeapCap } from '../runtime/shared/heap-cap.mjs';
 import { daemonCrashCaptureDir, daemonDataDir } from '../session-runtime/services/daemon-crash-capture.mjs';
 import { forkDaemonCandidate } from '../session-runtime/services/daemon-candidate.mjs';
 import { daemonOwnerIsStale, proveDaemonOwnerRecord } from './daemon-owner.mjs';
+import { IN_TREE_DAEMON_STOP_GRACE_MS } from './daemon-stop-budget.mjs';
 import { createAttachmentCalls } from './session-client/attachment-calls.mjs';
 import { daemonUnavailableError } from './session-client/daemon-unavailable.mjs';
 import { createLeaseHeartbeat } from './session-client/lease-heartbeat.mjs';
@@ -324,6 +325,12 @@ async function replaceLowerDaemon(discovery, initialHealth, { log, onUpgradeWait
  *  caller then re-reads discovery and attaches to whoever won. The shared fork
  *  and crash capture live in ./daemon-candidate.mjs.
  *  `entry` is a test seam; production always forks the real daemon. */
+// Daemons this process forked into its own process tree (daemonShouldDetach
+// false: the packaged Windows Desktop). Such a child is killed with its
+// launcher (libuv's kill-on-close job), which skips its whole teardown —
+// PostgreSQL stop included — so the launcher's quit stops it first.
+const inTreeDaemons = new Map();
+
 export function spawnDaemonCandidate({ cwd, log, timeoutMs = 30_000, entry = daemonEntry() }) {
   const t0 = performance.now();
   const at = () => Math.round(performance.now() - t0);
@@ -353,6 +360,10 @@ export function spawnDaemonCandidate({ cwd, log, timeoutMs = 30_000, entry = dae
       const forkMs = at();
       child.once('spawn', () => {
         log(`daemon fork: forkMs=${forkMs} spawnEventMs=${at()}`);
+        if (!detached && child.pid) {
+          inTreeDaemons.set(child.pid, child);
+          child.once('exit', () => inTreeDaemons.delete(child.pid));
+        }
       });
     },
     onReady: () => log(`daemon ready at=${at()}ms`),
@@ -634,6 +645,37 @@ export async function shutdownDaemon(
   return true;
 }
 
+/** Launcher quit: a daemon this process forked into its own tree would die
+ *  with it, so ask the serving one to stop (forced — its work cannot outlive
+ *  this tree anyway) and wait, bounded, for every such child's graceful exit.
+ *  One that already unpublished its endpoint is mid-teardown: only waited on.
+ *  False when no such child is alive (detached, or another launcher's). */
+export async function stopInTreeDaemon({
+  timeoutMs = IN_TREE_DAEMON_STOP_GRACE_MS,
+  discovery = readSessionDiscovery(),
+} = {}) {
+  const pids = [...inTreeDaemons.keys()].filter((pid) => isPidAlive(pid));
+  if (!pids.length) return false;
+  if (discovery?.port && pids.includes(Number(discovery.pid))) {
+    try {
+      await request({
+        port: discovery.port,
+        token: discovery.token,
+        method: 'POST',
+        path: '/stop',
+        body: { force: true },
+        timeoutMs: 3000,
+        control: true,
+      });
+    } catch {
+      // Past its front door already: only the wait remains.
+    }
+  }
+  const deadline = Date.now() + Math.max(1, Number(timeoutMs) || IN_TREE_DAEMON_STOP_GRACE_MS);
+  while (pids.some((pid) => isPidAlive(pid)) && Date.now() < deadline) await delay(50);
+  return !pids.some((pid) => isPidAlive(pid));
+}
+
 export async function shutdownDaemonForRuntimeRoot(root, options = {}) {
   const runtimeRoot = String(root || '').trim();
   if (!runtimeRoot) return false;

package/src/standalone/session-protocol.mjs

@@ -30,6 +30,7 @@ export const SESSION_READ_ACTIONS = Object.freeze([
   'getQuotaAutoResume',
   'getQuotaHistory',
   'getRecapSettings',
+  'getSessionTitleSettings',
   'getWebSearchRoute',
   'getSettingsSnapshot',
   'getSystemShell',
@@ -41,9 +42,11 @@ export const SESSION_READ_ACTIONS = Object.freeze([
   'inspectHuggingFaceModel',
   'getLocalProviderModelDetails',
   'getSessionReviewDiff',
+  'getSessionReviewFilePatch',
   'getSessionUsage',
   'getTurnChanges',
   'getTurnReviewDiff',
+  'getTurnReviewFilePatch',
   'getTurnLiveness',
   'getUpdateSettings',
   'getUpdateStatus',
@@ -84,6 +87,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'addPlugin',
   'addSkill',
   'agentControl',
+  'askSide',
   'authenticateProvider',
   'beginOAuthProviderLogin',
   'beginMcpOAuthLogin',
@@ -93,6 +97,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'cancelOAuthProviderLogin',
   'cancelMcpOAuthLogin',
   'cancelConversationImport',
+  'cancelSide',
   'checkForUpdate',
   'clear',
   'compact',
@@ -110,6 +115,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'removeCustomProvider',
   'updateCustomProviderModel',
   'testCustomProvider',
+  'checkCustomProviderKeyEnv',
   'discoverCustomProviderModels',
   'deleteSession',
   'deleteWebhook',
@@ -194,6 +200,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'setProfile',
   'setProgressHint',
   'setRecapEnabled',
+  'setAiSessionTitles',
   'setRoute',
   'setScheduleEnabled',
   'setWebSearchRoute',