fix(edit-history): review round 1 — record-bound deletion, load-time bounds, older reads per source

- The history is deleted when the session's persisted record goes (forgetEditHistory):
  kill via cleanupSession (a pinned record is only demoted and keeps it), the
  persisted-only DELETE, and stale cleanup at startup. After remove() neither a sync in
  flight nor a later request writes the file again; writes are serialized.
- load() re-bounds a damaged file: cursors, pending Bash calls (MAX_PENDING_BASH) and
  subagent labels (MAX_AGENTS, oldest unused dropped first).
- Load older reads one block of every transcript, budget split between them, and only
  the files it asked for; a block short of budget reads its end. A line longer than the
  budget is skipped going back as well (floorMidLine).
- Concurrent first callers share one store; a forward request folded with an older one
  still reads forward.
- Images outside the workspace get no thumbnail (one attachment id per render); a click
  opens the shared preview, which registers once with notify: false.
- Docs: per-edit diff cap, deletion rule, load-time bounds, thumbnails, follow triggers.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test/edit-history-local-source.test.ts

@@ -120,6 +120,24 @@ describe('readClaudeEditSources', () => {
     const res = await readClaudeEditSources(path, [{ relPath: 'main', offset: 2 }], 100);
     expect(res?.files[0].chunk).toEqual(Buffer.from('äöü\n', 'utf8').subarray(2));
   });
+
+  it('with onlyRequested, reads the requested files and nothing else', async () => {
+    const path = put('p/sid.jsonl', 'MAIN');
+    put('p/sid/subagents/agent-a1.jsonl', 'AAAA');
+    put('p/sid/subagents/agent-b2.jsonl', 'BBBB');
+    const res = await readClaudeEditSources(path, [{ relPath: 'subagents/agent-b2.jsonl', offset: 1, len: 2 }], 100, {
+      onlyRequested: true,
+    });
+    expect(res?.files.map((f) => [f.relPath, f.startOffset, f.chunk.toString()])).toEqual([
+      ['subagents/agent-b2.jsonl', 1, 'BB'],
+    ]);
+  });
+
+  it('reads the end of a block that does not fit the budget', async () => {
+    const path = put('p/sid.jsonl', '0123456789');
+    const res = await readClaudeEditSources(path, [{ relPath: 'main', offset: 2, len: 6 }], 3);
+    expect(res?.files[0]).toMatchObject({ startOffset: 5, chunk: Buffer.from('567') });
+  });
 });
 
 describe('probeLocalPaths', () => {

test/edit-history-store.test.ts

@@ -2,7 +2,7 @@
  * Edit history store: byte ranges, cursors, dedupe, cap, persistence.
  * Transcript bytes are built from JSONL lines shaped like real claude records.
  */
-import { mkdtempSync, rmSync, existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
@@ -11,6 +11,7 @@ import {
   entryBytes,
   MAIN_SOURCE,
   MAX_AGENT_META_CHARS,
+  MAX_AGENTS,
   MAX_ENTRIES,
   MAX_STORE_BYTES,
   parseAgentMeta,
@@ -255,6 +256,23 @@ describe('EditHistoryStore: older blocks', () => {
     expect(store.olderRange(MAIN_SOURCE, budget)).toBeNull();
   });
 
+  it('skips a line longer than the budget going back and reaches the lines before it', () => {
+    const store = new EditHistoryStore('s1', { dir });
+    const huge = JSON.stringify({ type: 'user', message: { content: 'x'.repeat(6000) } });
+    const older = Array.from({ length: 10 }, (_, i) => editLine(`old${i}`, i));
+    const newer = Array.from({ length: 5 }, (_, i) => editLine(`new${i}`, 100 + i));
+    const file = jsonl([...older, huge, ...newer]);
+    const budget = 4000;
+    syncForward(store, file, budget);
+    expect(ids(store).sort()).toEqual(newer.map((_, i) => `new${i}`).sort());
+    let rounds = 0;
+    while (syncOlder(store, file, budget) && rounds < 30) rounds++;
+    expect(store.list()).toHaveLength(15);
+    expect(store.getCursor(MAIN_SOURCE)).toMatchObject({ floor: 0 });
+    expect(store.getCursor(MAIN_SOURCE)?.floorMidLine).toBeUndefined();
+    expect(store.backfillTruncated).toBe(false);
+  });
+
   it('refuses an older chunk that does not end at the floor', () => {
     const store = new EditHistoryStore('s1', { dir });
     const file = jsonl(Array.from({ length: 10 }, (_, i) => editLine(`e${i}`, i)));
@@ -353,6 +371,17 @@ describe('EditHistoryStore: cap', () => {
     expect(meta?.description).toHaveLength(MAX_AGENT_META_CHARS);
     expect(meta?.agentType).toBe('coding');
   });
+
+  it(`keeps at most ${MAX_AGENTS} subagent labels, dropping the oldest no entry uses`, () => {
+    const store = new EditHistoryStore('s1', { dir });
+    syncForward(store, jsonl([editLine('e1', 1, '/work/a.ts', { agentId: 'a0' })]));
+    for (let i = 0; i <= MAX_AGENTS + 4; i++) store.setAgentMeta(`a${i}`, `{"description":"d${i}"}`);
+    const agents = store.getAgents();
+    expect(Object.keys(agents)).toHaveLength(MAX_AGENTS);
+    expect(agents.a0).toBeDefined(); // used by an entry
+    expect(agents[`a${MAX_AGENTS + 4}`]).toBeDefined(); // the newest
+    expect(agents.a1).toBeUndefined();
+  });
 });
 
 describe('EditHistoryStore: persistence', () => {
@@ -404,6 +433,33 @@ describe('EditHistoryStore: persistence', () => {
     expect(loaded.get('nohunks')).toBeUndefined();
   });
 
+  it('drops broken cursors, pending Bash calls and agent labels when loading (a damaged file)', async () => {
+    writeFileSync(
+      join(dir, 's1.json'),
+      JSON.stringify({
+        version: 1,
+        sessionId: 's1',
+        transcriptId: 'conv-1',
+        cursors: {
+          main: { offset: 1.5, floor: 0 },
+          'subagents/agent-x.jsonl': { offset: -5, floor: 0 },
+          'subagents/agent-y.jsonl': { offset: 10, floor: 20 },
+          'subagents/agent-z.jsonl': { offset: 10, floor: 5, floorMidLine: true },
+        },
+        pendingBash: [null, 7, { id: 'b1', ts: 1, command: 'render > a.png', cwd: '/work' }],
+        agents: { x: null, y: 'text', z: { description: 'd', agentType: 'coding' } },
+        entries: [{ id: 'e1', ts: 1, path: '/a.ts', hunks: [null] }],
+      })
+    );
+    const loaded = await EditHistoryStore.load('s1', { dir });
+    expect(loaded.knownSources()).toEqual(['subagents/agent-z.jsonl']);
+    expect(loaded.getCursor('subagents/agent-z.jsonl')).toEqual({ offset: 10, floor: 5, floorMidLine: true });
+    expect(loaded.getAgents()).toEqual({ z: { description: 'd', agentType: 'coding' } });
+    expect(loaded.list()).toEqual([]);
+    // The surviving pending call still pairs with its result, and nothing throws.
+    expect(syncForward(loaded, jsonl([bashResult('b1', 3)]))?.candidates[0]?.paths).toEqual(['/work/a.png']);
+  });
+
   it('ignores a file of an unknown version', async () => {
     writeFileSync(join(dir, 'v9.json'), JSON.stringify({ version: 9, entries: [{ id: 'x' }] }));
     expect((await EditHistoryStore.load('v9', { dir })).list()).toEqual([]);
@@ -436,6 +492,15 @@ describe('EditHistoryStore: persistence', () => {
     await new Promise((r) => setTimeout(r, 40));
     await store.flush();
     expect(existsSync(join(dir, 's1.json'))).toBe(false);
+    expect(store.list()).toEqual([]); // the content is forgotten too
+  });
+
+  it('remove() during a write leaves nothing behind (the write cannot rename over the deleted file)', async () => {
+    const store = new EditHistoryStore('s1', { dir, debounceMs: 60_000 });
+    syncForward(store, jsonl([editLine('e1', 1)]));
+    const writing = store.flush();
+    await Promise.all([writing, store.remove()]);
+    expect(readdirSync(dir)).toEqual([]);
   });
 
   it('defaults to the data directory', () => {

test/edit-history-sync.test.ts

@@ -3,15 +3,21 @@
  * "reads only on request" wiring. Reader and probe are fakes; the store is real (temp dir).
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { EditHistoryStore } from '../src/edit-history-store.js';
-import type { EditSourceRequest, EditSources, PathProbe } from '../src/edit-history-local-source.js';
+import type {
+  EditSourceReadOptions,
+  EditSourceRequest,
+  EditSources,
+  PathProbe,
+} from '../src/edit-history-local-source.js';
 import {
   confirmImages,
   EditHistorySync,
   NO_TRANSCRIPT,
+  REMOVED,
   type EditHistorySession,
   type EditHistorySyncDeps,
   unsupportedReason,
@@ -76,7 +82,8 @@ class FakeHost {
   read = async (
     mainPath: string,
     requests: readonly EditSourceRequest[],
-    budget: number
+    budget: number,
+    opts: EditSourceReadOptions = {}
   ): Promise<EditSources | null> => {
     this.calls.push([...requests]);
     this.paths.push(mainPath);
@@ -85,11 +92,16 @@ class FakeHost {
     const out: EditSources = { transcriptId: this.transcriptId, files: [], metas: {} };
     for (const [relPath, buf] of this.files) {
       const req = requests.find((r) => r.relPath === relPath);
+      if (!req && opts.onlyRequested) continue;
       let start: number;
       let len: number;
-      if (req) {
+      if (req?.len !== undefined) {
+        const blockEnd = Math.min(req.offset + req.len, buf.length);
+        len = Math.min(blockEnd - Math.min(req.offset, buf.length), remaining);
+        start = blockEnd - len;
+      } else if (req) {
         start = Math.min(req.offset, buf.length);
-        len = Math.min(req.len ?? remaining, remaining, buf.length - start);
+        len = Math.min(remaining, buf.length - start);
       } else {
         len = Math.min(buf.length, remaining);
         start = buf.length - len;
@@ -115,7 +127,7 @@ function setup(over: Partial<EditHistorySyncDeps> = {}) {
       lookups.push(session.id);
       return host.path;
     },
-    readSources: (path, req, budget) => host.read(path, req, budget),
+    readSources: (path, req, budget, opts) => host.read(path, req, budget, opts),
     probe: async (paths) => paths.map((p) => probes.get(p) ?? null),
     loadStore: (id) => EditHistoryStore.load(id, { dir, debounceMs: 0 }),
     ...over,
@@ -293,6 +305,83 @@ describe('EditHistorySync', () => {
     await sync.remove('s1');
     expect(() => readFileSync(join(dir, 's1.json'))).toThrow();
   });
+
+  it('a deleted session stays deleted: neither a run in flight nor a later request writes it again', async () => {
+    const { host, sync } = setup();
+    host.append('main', editLine('t1', T0, '/w/a.ts'));
+    let release!: () => void;
+    const gate = new Promise<void>((r) => (release = r));
+    const orig = host.read;
+    host.read = async (...a) => {
+      await gate;
+      return orig(...a);
+    };
+    const runs = [sync.sync(local), sync.sync(local)]; // one running, one queued
+    const removing = sync.remove('s1');
+    release();
+    await Promise.all([...runs, removing]);
+    await new Promise((r) => setTimeout(r, 20)); // past the store's debounce
+    expect(readdirSync(dir)).toEqual([]);
+    const reads = host.calls.length;
+    expect(await sync.sync(local)).toEqual({ state: 'unavailable', reason: REMOVED });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(host.calls).toHaveLength(reads);
+    expect(readdirSync(dir)).toEqual([]);
+    expect((await sync.getStore('s1')).list()).toEqual([]);
+  });
+
+  it('concurrent first callers share one store', async () => {
+    const { sync } = setup();
+    const [a, b] = await Promise.all([sync.getStore('s1'), sync.getStore('s1')]);
+    expect(a).toBe(b);
+  });
+
+  it('a forward request queued together with an older one still reads forward', async () => {
+    const { host, sync } = setup();
+    host.append('main', editLine('t1', T0, '/w/a.ts'));
+    let release!: () => void;
+    const gate = new Promise<void>((r) => (release = r));
+    const orig = host.read;
+    host.read = async (...a) => {
+      const res = await orig(...a); // the first run's bytes are taken before the append
+      await gate;
+      return res;
+    };
+    const first = sync.sync(local);
+    await new Promise((r) => setTimeout(r, 0));
+    host.append('main', editLine('t2', T0 + 1, '/w/b.ts'));
+    const queued = [sync.sync(local), sync.sync(local, { older: true })];
+    release();
+    await Promise.all([first, ...queued]);
+    expect((await sync.getStore('s1')).get('t2')).toBeDefined();
+  });
+
+  it('load older moves every source back, reading only the blocks it asked for', async () => {
+    const { host, sync } = setup({ budget: 2000 });
+    for (let i = 0; i < 10; i++) host.append('main', editLine(`m${i}`, T0 + i, `/w/m${i}.ts`));
+    for (let i = 0; i < 10; i++) {
+      host.append('subagents/agent-ab.jsonl', editLine(`s${i}`, T0 + 100 + i, `/w/s${i}.ts`, { agentId: 'ab' }));
+    }
+    await sync.sync(local);
+    await sync.sync(local); // the subagent gets its first block once main is up to date
+    const store = await sync.getStore('s1');
+    const floors = () => [store.getCursor('main')!.floor, store.getCursor('subagents/agent-ab.jsonl')!.floor];
+    const [main0, sub0] = floors();
+    expect(main0).toBeGreaterThan(0);
+    expect(sub0).toBeGreaterThan(0);
+    await sync.sync(local, { older: true });
+    const [main1, sub1] = floors();
+    expect(main1).toBeLessThan(main0);
+    expect(sub1).toBeLessThan(sub0);
+    expect(
+      host.calls
+        .at(-1)!
+        .map((r) => r.relPath)
+        .sort()
+    ).toEqual(['main', 'subagents/agent-ab.jsonl']);
+    for (let i = 0; i < 20 && store.backfillTruncated; i++) await sync.sync(local, { older: true });
+    expect(store.list()).toHaveLength(20);
+  });
 });
 
 describe('confirmImages', () => {

test/edit-history.browser.test.ts

@@ -40,7 +40,7 @@ describe('Edit history panel in a real browser', () => {
   let sessionA: string;
   let sessionB: string;
   const settingsPutStatuses: number[] = [];
-  /** Bodies of POST /api/sessions/:id/attachments (the external thumbnail registration). */
+  /** Bodies of POST /api/sessions/:id/attachments (the file preview registering an external image). */
   const attachmentPosts: unknown[] = [];
   /** Every request to the mocked API: `METHOD url`. */
   const calls: string[] = [];
@@ -253,8 +253,10 @@ describe('Edit history panel in a real browser', () => {
 
   it('a path and an image open the shared file preview with the absolute path', async () => {
     await page.evaluate(() => {
-      (window as any).__previewed = [];
-      (window as any).app.openFilePreview = (p: string, sid: string) => (window as any).__previewed.push([p, sid]);
+      const w = window as any;
+      w.__previewed = [];
+      w.__openFilePreview = w.app.openFilePreview;
+      w.app.openFilePreview = (p: string, sid: string) => w.__previewed.push([p, sid]);
     });
     await rows().nth(2).locator('.edit-history-path').click();
     await page.locator('#editHistoryBody img.edit-history-thumb').click();
@@ -264,6 +266,10 @@ describe('Edit history panel in a real browser', () => {
     ]);
     // Clicking the path never toggles the row's diff.
     expect(await page.locator('#editHistoryBody .edit-history-diff').count()).toBe(0);
+    await page.evaluate(() => {
+      const w = window as any;
+      w.app.openFilePreview = w.__openFilePreview;
+    });
   });
 
   it('"Main agent only" hides the subagent edits; "Group by file" puts edits under their file', async () => {
@@ -338,7 +344,7 @@ describe('Edit history panel in a real browser', () => {
     expect(syncReads(sessionA)).toBe(before + 1);
   });
 
-  it('an image outside the workspace gets its thumbnail through the attachment route, without a notification', async () => {
+  it('an image outside the workspace registers nothing until clicked, then previews through the attachment route quietly', async () => {
     const s = state.get(sessionA)!;
     const outside = join(ext, 'render.png');
     state.set(sessionA, {
@@ -349,18 +355,21 @@ describe('Edit history panel in a real browser', () => {
       ],
     });
     await reload();
-    const thumb = page.locator('#editHistoryBody img.edit-history-thumb').first();
-    await page.waitForFunction(() =>
-      /\/attachments\/[^/]+\/raw$/.test(document.querySelector('img.edit-history-thumb')?.getAttribute('src') ?? '')
-    );
-    expect(attachmentPosts).toEqual([{ path: outside, notify: false }]);
-    expect(await thumb.getAttribute('src')).toMatch(new RegExp(`^/api/sessions/${sessionA}/attachments/[^/]+/raw$`));
-    await page.waitForFunction(
-      () => (document.querySelector('img.edit-history-thumb') as HTMLImageElement)?.naturalWidth === 2
-    );
-    // A re-read reuses the registration instead of minting another id.
+    const row = page.locator('#editHistoryBody .edit-history-entry', { hasText: 'render.png' });
+    await row.waitFor();
+    // No thumbnail for it (that would mint an attachment id per render), and no registration.
+    expect(
+      await page.evaluate(() =>
+        [...document.querySelectorAll('#editHistoryBody img.edit-history-thumb')].map((i) => i.getAttribute('src'))
+      )
+    ).not.toContainEqual(expect.stringContaining('render.png'));
     await reload();
-    expect(attachmentPosts).toHaveLength(1);
+    expect(attachmentPosts).toEqual([]);
+    // A click opens the shared preview, which registers the file once, without a notification.
+    await row.click();
+    await page.waitForSelector('#filePreviewOverlay.visible');
+    expect(attachmentPosts).toEqual([{ path: outside, notify: false }]);
+    await page.evaluate(() => (window as any).app.closeFilePreview());
     state.set(sessionA, s);
   });
 

test/mocks/mock-route-context.ts

@@ -64,6 +64,7 @@ export function createMockRouteContext(options?: {
       forgetCaseDefaultGroup: vi.fn(async () => {}),
     },
     cleanupSession: vi.fn(async () => {}),
+    forgetEditHistory: vi.fn(),
     setupSessionListeners: vi.fn(async () => {}),
     persistSessionState: vi.fn(),
     persistSessionStateNow: vi.fn(),

test/routes/session-routes.test.ts

@@ -983,6 +983,16 @@ describe('session-routes', () => {
       // with no broadcast, so other open tabs kept showing the retired row until
       // their next unrelated fetch.
       expect(harness.ctx.broadcast).toHaveBeenCalledWith('session:deleted', { id: 'ghost-session' });
+      // Its stored edit history (diffs can hold secrets) goes with the record.
+      expect(harness.ctx.forgetEditHistory).toHaveBeenCalledWith('ghost-session');
+    });
+
+    it('keeps the edit history of a pinned persisted-only session whose record is only demoted', async () => {
+      vi.mocked(harness.ctx.store.getSession).mockReturnValueOnce({ id: 'pinned-ghost', owner: undefined } as never);
+      vi.mocked(harness.ctx.store.demoteOrRemoveSession).mockReturnValueOnce('preserved');
+      const res = await harness.app.inject({ method: 'DELETE', url: '/api/sessions/pinned-ghost' });
+      expect(res.statusCode).toBe(200);
+      expect(harness.ctx.forgetEditHistory).not.toHaveBeenCalled();
     });
 
     it('404s a persisted-only session id the state store does not recognize either', async () => {