fix(plugins): preserve session mutation guards

jimmypuckett · jimmypuckett · commit 1c7d113387ce · 2026-07-19T09:44:19.000-04:00
diff --git a/src/plugins/registry-runtime-session-policy.ts b/src/plugins/registry-runtime-session-policy.ts
@@ -13,6 +13,9 @@ export const PLUGIN_GATEWAY_SESSION_MUTATION_METHODS = new Set([
   "sessions.compact",
   "sessions.compaction.branch",
   "sessions.compaction.restore",
+  "sessions.branches.switch",
+  "sessions.rewind",
+  "sessions.fork",
   "sessions.create",
   "sessions.delete",
   "sessions.patch",
diff --git a/src/plugins/registry.runtime-config.test.ts b/src/plugins/registry.runtime-config.test.ts
@@ -666,6 +666,13 @@ describe("plugin registry runtime config scope", () => {
         archived: true,
       }),
     ).rejects.toThrow('owned by plugin "codex-owner"');
+    for (const method of ["sessions.branches.switch", "sessions.rewind", "sessions.fork"]) {
+      await expect(
+        otherApi.runtime.gateway.request(method, {
+          sessionKey: reservedKey,
+        }),
+      ).rejects.toThrow('owned by plugin "codex-owner"');
+    }
     await expect(
       otherApi.runtime.gateway.request("agent", {
         sessionId: reservedEntry.sessionId,
