@openparachute/vault 0.6.4-rc.6 → 0.6.4-rc.8

package/README.md

@@ -586,16 +586,12 @@ Range params require content in the response — with `include_content=false` (o
 
 ### Incremental rebuilds: "what changed since X"
 
-The SSG / sync pattern. Two equivalent forms — bracket-style is canonical going forward; the flat form is the same shape that ships through the REST/MCP date filter today.
+The SSG / sync pattern. Bracket-style is the query-string date filter. (The flat `date_field` / `date_from` / `date_to` params were removed in 0.6.4 — vault#288 — and are now ignored.)
 
 ```bash
-# Bracket-style (canonical)
+# Bracket-style (the query-string date filter)
 curl -H "Authorization: Bearer $VAULT_TOKEN" \
   "http://localhost:1940/vault/default/api/notes?meta[updated_at][gte]=2026-04-01T00:00:00Z"
-
-# Flat form (DEPRECATED in 0.4.3; planned removal in a later 0.x per vault#288)
-curl -H "Authorization: Bearer $VAULT_TOKEN" \
-  "http://localhost:1940/vault/default/api/notes?date_field=updated_at&date_from=2026-04-01T00:00:00Z"
 ```
 
 ```jsonc

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.6.4-rc.6",
+  "version": "0.6.4-rc.8",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/cli.ts

@@ -110,11 +110,17 @@ import { getVaultStore } from "./vault-store.ts";
 import { seedOnboardingNotesBestEffort } from "./onboarding-seed.ts";
 import {
   defaultMirrorConfig,
+  readMirrorConfigForVault,
   resolveMirrorPath,
   writeMirrorConfigForVault,
   type MirrorConfig,
 } from "./mirror-config.ts";
-import { bootstrapInternalMirror } from "./mirror-manager.ts";
+import {
+  bootstrapInternalMirror,
+  readMirrorHistory,
+  showMirrorRevision,
+} from "./mirror-manager.ts";
+import { GitNotInstalledError, ensureGitAvailable } from "./git-preflight.ts";
 import { selfRegister } from "./self-register.ts";
 import {
   hasOwnerPassword,
@@ -234,6 +240,9 @@ switch (command) {
   case "export":
     await cmdExport(cmdArgs);
     break;
+  case "history":
+    await cmdHistory(cmdArgs);
+    break;
   case "schema":
     await cmdSchema(cmdArgs);
     break;
@@ -3330,6 +3339,163 @@ async function cmdExport(args: string[]) {
   await new Promise(() => {});
 }
 
+// ---------------------------------------------------------------------------
+// `parachute-vault history` — surface the vault's git write history (vault#300)
+// ---------------------------------------------------------------------------
+
+/**
+ * `parachute-vault history [--note <path>] [--limit N] [--vault <name>] [--json]`
+ *
+ * Surfaces the mirror's git commit log — the vault is already git-backed
+ * (one file per note), so `git log` IS a tamper-evident, diffable write
+ * history. This CLI front-door wraps the SAME `readMirrorHistory` helper the
+ * REST `/history` endpoint uses (no drift between the two surfaces).
+ *
+ * `--note <path>` scopes to a single note's history (`git log --follow --
+ * <path>.md`). `--show <sha>` (with `--note`) prints that note's content at
+ * a past revision (`git show <sha>:<path>.md`).
+ */
+async function cmdHistory(args: string[]) {
+  let vaultName = "default";
+  let notePath: string | undefined;
+  let limit: number | undefined;
+  let showSha: string | undefined;
+  let asJson = false;
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--vault") {
+      const v = args[++i];
+      if (!v) {
+        console.error("--vault requires a value.");
+        process.exit(1);
+      }
+      vaultName = v;
+    } else if (arg === "--note") {
+      const v = args[++i];
+      if (!v) {
+        console.error("--note requires a note path.");
+        process.exit(1);
+      }
+      notePath = v;
+    } else if (arg === "--limit") {
+      const v = args[++i];
+      if (!v) {
+        console.error("--limit requires a number.");
+        process.exit(1);
+      }
+      const n = Number(v);
+      if (!Number.isInteger(n) || n <= 0) {
+        console.error(`--limit: must be a positive integer (got '${v}')`);
+        process.exit(1);
+      }
+      limit = n;
+    } else if (arg === "--show") {
+      const v = args[++i];
+      if (!v) {
+        console.error("--show requires a commit sha.");
+        process.exit(1);
+      }
+      showSha = v;
+    } else if (arg === "--json") {
+      asJson = true;
+    } else if (arg === "--help" || arg === "-h") {
+      printHistoryUsage();
+      return;
+    } else {
+      console.error(`Unknown argument: ${arg}`);
+      printHistoryUsage();
+      process.exit(1);
+    }
+  }
+
+  if (showSha && !notePath) {
+    console.error("--show <sha> requires --note <path> (which file to read at that revision).");
+    process.exit(1);
+  }
+
+  const config = readVaultConfig(vaultName);
+  if (!config) {
+    console.error(`Vault "${vaultName}" not found. Available: ${listVaults().join(", ") || "(none)"}.`);
+    process.exit(1);
+  }
+
+  // Resolve the mirror dir the same way the server does: per-vault mirror
+  // config (or defaults) → resolveMirrorPath against the vault's data dir.
+  const mirrorConfig = readMirrorConfigForVault(vaultName) ?? defaultMirrorConfig();
+  const mirrorPath = resolveMirrorPath(vaultDir(vaultName), mirrorConfig);
+  if (!mirrorPath || !existsSync(mirrorPath)) {
+    console.error(
+      `No git history for vault "${vaultName}" — the mirror isn't initialized yet.\n` +
+        `Enable history (backup) so writes are recorded, then re-run.`,
+    );
+    process.exit(1);
+  }
+
+  // Preflight git — friendly, actionable message instead of a raw spawn throw.
+  try {
+    ensureGitAvailable();
+  } catch (err) {
+    if (err instanceof GitNotInstalledError) {
+      console.error(err.message);
+      process.exit(1);
+    }
+    throw err;
+  }
+
+  // `--show` path: print one note's content at a past revision.
+  if (showSha && notePath) {
+    const content = await showMirrorRevision(mirrorPath, showSha, notePath);
+    if (content === null) {
+      console.error(
+        `No content for "${notePath}" at ${showSha} — the sha may be unknown, the note may not have existed at that commit, or the path is invalid.`,
+      );
+      process.exit(1);
+    }
+    process.stdout.write(content);
+    return;
+  }
+
+  const history = await readMirrorHistory(mirrorPath, { notePath, limit });
+
+  if (asJson) {
+    console.log(JSON.stringify(history, null, 2));
+    return;
+  }
+
+  if (history.length === 0) {
+    if (notePath) {
+      console.log(`No history for note "${notePath}" in vault "${vaultName}".`);
+    } else {
+      console.log(`No history yet for vault "${vaultName}".`);
+    }
+    return;
+  }
+
+  const scope = notePath ? ` for "${notePath}"` : "";
+  console.log(`Git history for vault "${vaultName}"${scope} (${history.length} commit${history.length === 1 ? "" : "s"}):\n`);
+  for (const entry of history) {
+    // Short sha + date + subject — one line per commit, the `git log --oneline`
+    // shape an operator expects.
+    console.log(`  ${entry.sha.slice(0, 8)}  ${entry.date}  ${entry.message}`);
+  }
+}
+
+function printHistoryUsage(): void {
+  console.error(
+    "Usage: parachute-vault history [--note <path>] [--limit N] [--vault <name>] [--json]\n" +
+      "                              [--note <path> --show <sha>]",
+  );
+  console.error("\nSurface the vault's git write history. The vault is already git-backed via the");
+  console.error("mirror (one file per note), so `git log` IS a tamper-evident, diffable history.");
+  console.error("\nOptions:");
+  console.error("  --vault <name>   Vault to read (default: 'default')");
+  console.error("  --note <path>    Scope to a single note's history (git log --follow)");
+  console.error("  --limit N        Cap the number of commits returned (default 100)");
+  console.error("  --show <sha>     With --note: print that note's content at the given revision");
+  console.error("  --json           Emit the history as JSON instead of the human-readable list");
+}
+
 // ---------------------------------------------------------------------------
 // Schema maintenance — `parachute-vault schema <subcommand>`
 // ---------------------------------------------------------------------------
@@ -4106,6 +4272,15 @@ Import/Export:
                                                        template via --git-message-template;
                                                        --git-push to push after commit)
 
+History:
+  parachute-vault history [--vault <name>]             Show the vault's git write history (the
+                                                       mirror is git-backed — one file per note,
+                                                       so git log IS a tamper-evident history)
+  parachute-vault history --note <path>                Scope to one note's history (git log --follow)
+  parachute-vault history --limit N                    Cap the number of commits (default 100)
+  parachute-vault history --note <path> --show <sha>   Print that note's content at a past revision
+  parachute-vault history --json                       Emit history as JSON
+
 Schema maintenance:
   parachute-vault schema prune [--vault <name>]       Drop orphaned indexed-field columns +
                                                        indexes whose declaring tags no longer

package/src/mirror-history.test.ts

@@ -0,0 +1,426 @@
+/**
+ * Tests for the git-history read surface (vault#300).
+ *
+ * The vault is already git-backed via the mirror — one file per note — so
+ * `git log` IS the write history. These tests exercise:
+ *   - the `readMirrorHistory` / `showMirrorRevision` / `noteHistoryPathspec`
+ *     helpers (mirror-manager.ts) against a real seeded git repo in a tmpdir
+ *   - the `handleMirrorHistory` / `handleMirrorHistoryShow` REST handlers
+ *     (mirror-routes.ts), including the not-initialized + path-scoped cases
+ *
+ * Routing-level admin-gate enforcement lives in routing.test.ts (alongside
+ * the sibling mirror routes); these are the after-auth handler + helper
+ * tests, matching the mirror-manager / mirror-routes test split.
+ *
+ * Like the other mirror tests: real tempdirs + real `git` so we exercise
+ * the actual log/show behavior, not a mock.
+ */
+
+import { describe, test, expect, afterEach, afterAll } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  HISTORY_MAX_LIMIT,
+  noteHistoryPathspec,
+  readMirrorHistory,
+  showMirrorRevision,
+  MirrorManager,
+  type MirrorDeps,
+} from "./mirror-manager.ts";
+import {
+  handleMirrorHistory,
+  handleMirrorHistoryShow,
+} from "./mirror-routes.ts";
+import { defaultMirrorConfig, type MirrorConfig } from "./mirror-config.ts";
+
+// Keep HOME / PARACHUTE_HOME from leaking between test files — same pattern
+// as mirror-manager.test.ts.
+const ORIG_HOME = process.env.HOME;
+const ORIG_PARACHUTE_HOME = process.env.PARACHUTE_HOME;
+afterEach(() => {
+  if (ORIG_HOME === undefined) delete process.env.HOME;
+  else process.env.HOME = ORIG_HOME;
+  if (ORIG_PARACHUTE_HOME === undefined) delete process.env.PARACHUTE_HOME;
+  else process.env.PARACHUTE_HOME = ORIG_PARACHUTE_HOME;
+});
+afterAll(() => {
+  if (ORIG_HOME === undefined) delete process.env.HOME;
+  else process.env.HOME = ORIG_HOME;
+});
+
+function tmp(prefix: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function initRepo(dir: string): void {
+  Bun.spawnSync(["git", "init", "-q", "-b", "main"], { cwd: dir });
+  Bun.spawnSync(["git", "config", "user.email", "t@p.computer"], { cwd: dir });
+  Bun.spawnSync(["git", "config", "user.name", "T P"], { cwd: dir });
+  Bun.spawnSync(["git", "config", "commit.gpgsign", "false"], { cwd: dir });
+}
+
+/** Write a file (creating parent dirs), `git add -A`, commit with `message`. */
+function commitFile(dir: string, relPath: string, content: string, message: string): void {
+  const full = path.join(dir, relPath);
+  fs.mkdirSync(path.dirname(full), { recursive: true });
+  fs.writeFileSync(full, content);
+  Bun.spawnSync(["git", "add", "-A"], { cwd: dir });
+  Bun.spawnSync(["git", "commit", "-q", "-m", message], { cwd: dir });
+}
+
+// ---------------------------------------------------------------------------
+// noteHistoryPathspec — normalize + traversal guard
+// ---------------------------------------------------------------------------
+
+describe("noteHistoryPathspec", () => {
+  test("appends .md to a bare note path", () => {
+    expect(noteHistoryPathspec("Inbox/today")).toBe("Inbox/today.md");
+  });
+
+  test("is idempotent on an already-suffixed path", () => {
+    expect(noteHistoryPathspec("Inbox/today.md")).toBe("Inbox/today.md");
+  });
+
+  test("rejects traversal", () => {
+    expect(noteHistoryPathspec("../etc/passwd")).toBeNull();
+    expect(noteHistoryPathspec("Inbox/../../secret")).toBeNull();
+  });
+
+  test("rejects absolute paths", () => {
+    expect(noteHistoryPathspec("/etc/passwd")).toBeNull();
+  });
+
+  test("rejects empty / whitespace", () => {
+    expect(noteHistoryPathspec("")).toBeNull();
+    expect(noteHistoryPathspec("   ")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readMirrorHistory — the core git-log read
+// ---------------------------------------------------------------------------
+
+describe("readMirrorHistory", () => {
+  test("returns commits newest-first with sha/date/message", async () => {
+    const dir = tmp("vault-history-");
+    initRepo(dir);
+    commitFile(dir, "Inbox/one.md", "one", "export: first (1 note)");
+    commitFile(dir, "Inbox/two.md", "two", "export: second (1 note)");
+
+    const history = await readMirrorHistory(dir);
+    expect(history.length).toBe(2);
+    // Newest first.
+    expect(history[0]!.message).toBe("export: second (1 note)");
+    expect(history[1]!.message).toBe("export: first (1 note)");
+    // Each entry has a full sha + an ISO date.
+    for (const entry of history) {
+      expect(entry.sha).toMatch(/^[0-9a-f]{40}$/);
+      expect(Number.isNaN(Date.parse(entry.date))).toBe(false);
+    }
+  });
+
+  test("?path filters to a single note's commits, --follow across renames", async () => {
+    const dir = tmp("vault-history-path-");
+    initRepo(dir);
+    commitFile(dir, "Notes/alpha.md", "a1", "export: alpha created");
+    commitFile(dir, "Notes/beta.md", "b1", "export: beta created");
+    commitFile(dir, "Notes/alpha.md", "a2", "export: alpha edited");
+
+    const alpha = await readMirrorHistory(dir, { notePath: "Notes/alpha" });
+    // Two commits touched alpha; beta's commit is excluded.
+    expect(alpha.length).toBe(2);
+    expect(alpha.map((e) => e.message)).toEqual([
+      "export: alpha edited",
+      "export: alpha created",
+    ]);
+
+    const beta = await readMirrorHistory(dir, { notePath: "Notes/beta" });
+    expect(beta.length).toBe(1);
+    expect(beta[0]!.message).toBe("export: beta created");
+  });
+
+  test("limit caps the number of commits returned", async () => {
+    const dir = tmp("vault-history-limit-");
+    initRepo(dir);
+    for (let i = 0; i < 5; i++) {
+      commitFile(dir, `Notes/n${i}.md`, `v${i}`, `export: commit ${i}`);
+    }
+    const limited = await readMirrorHistory(dir, { limit: 2 });
+    expect(limited.length).toBe(2);
+    // Newest two.
+    expect(limited[0]!.message).toBe("export: commit 4");
+    expect(limited[1]!.message).toBe("export: commit 3");
+  });
+
+  test("an out-of-range limit is clamped to HISTORY_MAX_LIMIT (never exceeds the ceiling)", async () => {
+    const dir = tmp("vault-history-ceiling-");
+    initRepo(dir);
+    // Seed just a few commits — the assertion is on the ARG cap, not commit
+    // count: an absurd limit must never spawn `git log` with --max-count
+    // above the hard ceiling. With <ceiling commits the result is bounded by
+    // commit count, so we assert it's never MORE than the ceiling.
+    commitFile(dir, "Notes/a.md", "a", "export: a");
+    commitFile(dir, "Notes/b.md", "b", "export: b");
+    const history = await readMirrorHistory(dir, { limit: 99_999_999 });
+    expect(history.length).toBeLessThanOrEqual(HISTORY_MAX_LIMIT);
+    // Sanity: a huge limit still returns the (few) real commits.
+    expect(history.length).toBe(2);
+  });
+
+  test("no commits yet → empty list, not an error", async () => {
+    const dir = tmp("vault-history-empty-");
+    initRepo(dir); // repo but no commits
+    const history = await readMirrorHistory(dir);
+    expect(history).toEqual([]);
+  });
+
+  test("not a git repo → empty list, not an error", async () => {
+    const dir = tmp("vault-history-nonrepo-");
+    // No `git init`.
+    const history = await readMirrorHistory(dir);
+    expect(history).toEqual([]);
+  });
+
+  test("a path with no history → empty list", async () => {
+    const dir = tmp("vault-history-nopath-");
+    initRepo(dir);
+    commitFile(dir, "Notes/exists.md", "x", "export: exists");
+    const history = await readMirrorHistory(dir, { notePath: "Notes/ghost" });
+    expect(history).toEqual([]);
+  });
+
+  test("an unsafe path → empty list (never an unscoped log)", async () => {
+    const dir = tmp("vault-history-unsafe-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "a", "export: a");
+    commitFile(dir, "Notes/b.md", "b", "export: b");
+    // A traversal path must NOT fall back to the full (unscoped) log.
+    const history = await readMirrorHistory(dir, { notePath: "../../../etc/passwd" });
+    expect(history).toEqual([]);
+  });
+
+  test("redacts tokens that appear in a commit subject", async () => {
+    const dir = tmp("vault-history-redact-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "a", "synced from https://x-access-token:ghp_supersecrettoken123@github.com/a/b");
+    const history = await readMirrorHistory(dir);
+    expect(history.length).toBe(1);
+    expect(history[0]!.message).not.toContain("ghp_supersecrettoken123");
+    expect(history[0]!.message).toContain("***");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// showMirrorRevision — read a past revision of a note
+// ---------------------------------------------------------------------------
+
+describe("showMirrorRevision", () => {
+  test("returns the file content at a past revision", async () => {
+    const dir = tmp("vault-show-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "version one", "export: a v1");
+    // Capture the sha at v1.
+    const v1 = (await readMirrorHistory(dir))[0]!.sha;
+    commitFile(dir, "Notes/a.md", "version two", "export: a v2");
+
+    const past = await showMirrorRevision(dir, v1, "Notes/a");
+    expect(past).toBe("version one");
+
+    const current = await showMirrorRevision(dir, (await readMirrorHistory(dir))[0]!.sha, "Notes/a");
+    expect(current).toBe("version two");
+  });
+
+  test("unknown sha → null", async () => {
+    const dir = tmp("vault-show-badsha-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "x", "export: a");
+    const result = await showMirrorRevision(dir, "deadbeef", "Notes/a");
+    expect(result).toBeNull();
+  });
+
+  test("non-hex / option-looking sha → null (no smuggled ref)", async () => {
+    const dir = tmp("vault-show-refsmuggle-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "x", "export: a");
+    expect(await showMirrorRevision(dir, "HEAD", "Notes/a")).toBeNull();
+    expect(await showMirrorRevision(dir, "--output=/tmp/x", "Notes/a")).toBeNull();
+  });
+
+  test("unsafe path → null", async () => {
+    const dir = tmp("vault-show-unsafe-");
+    initRepo(dir);
+    commitFile(dir, "Notes/a.md", "x", "export: a");
+    const sha = (await readMirrorHistory(dir))[0]!.sha;
+    expect(await showMirrorRevision(dir, sha, "../../../etc/passwd")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Route handlers — handleMirrorHistory / handleMirrorHistoryShow
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a MirrorManager whose status reports `mirror_path = mirrorPath`
+ * without standing up the full lifecycle — the history handlers only read
+ * `getStatus().mirror_path`, so we start a minimal enabled internal mirror
+ * pointed at a tmp repo we control.
+ *
+ * Simpler: construct the manager with fake deps and force the status by
+ * starting it against an internal mirror dir we then seed. But the history
+ * read is path-only, so we instead use a tiny manager whose deps resolve the
+ * internal mirror under a tmp PARACHUTE_HOME and start it (which bootstraps a
+ * real git repo), then commit into that repo.
+ */
+function makeStartedManager(home: string): { manager: MirrorManager; deps: MirrorDeps } {
+  process.env.PARACHUTE_HOME = home;
+  process.env.HOME = home;
+  fs.mkdirSync(path.join(home, "vault", "data", "default"), { recursive: true });
+  let stored: MirrorConfig | undefined = { ...defaultMirrorConfig(), enabled: true };
+  const deps: MirrorDeps = {
+    vaultName: "default",
+    runExport: async () => ({ notes: 0 }),
+    firstChangedNoteTitle: async () => "",
+    readMirrorConfig: () => stored,
+    writeMirrorConfig: (c) => {
+      stored = c;
+    },
+  };
+  return { manager: new MirrorManager(deps), deps };
+}
+
+describe("handleMirrorHistory route", () => {
+  test("not-initialized mirror → 200 empty history + note (not 500)", async () => {
+    const home = tmp("vault-route-noinit-");
+    const { manager } = makeStartedManager(home);
+    // Never started → no mirror_path resolved.
+    const res = await handleMirrorHistory(
+      new Request("http://localhost/vault/default/.parachute/mirror/history"),
+      manager,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { history: unknown[]; mirror_path: null; note?: string };
+    expect(body.history).toEqual([]);
+    expect(body.mirror_path).toBeNull();
+    expect(body.note).toBeDefined();
+  });
+
+  test("started mirror with commits → 200 history list", async () => {
+    const home = tmp("vault-route-hist-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const mirrorPath = manager.getStatus().mirror_path!;
+    expect(mirrorPath).toBeTruthy();
+    commitFile(mirrorPath, "Notes/a.md", "a", "export: a created");
+    commitFile(mirrorPath, "Notes/b.md", "b", "export: b created");
+
+    const res = await handleMirrorHistory(
+      new Request("http://localhost/vault/default/.parachute/mirror/history"),
+      manager,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      history: Array<{ sha: string; date: string; message: string }>;
+      mirror_path: string;
+    };
+    // Includes the bootstrap commit + our two; newest first.
+    expect(body.history.length).toBeGreaterThanOrEqual(3);
+    expect(body.history[0]!.message).toBe("export: b created");
+    expect(body.mirror_path).toBe(mirrorPath);
+  });
+
+  test("?path scopes to one note", async () => {
+    const home = tmp("vault-route-histpath-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const mirrorPath = manager.getStatus().mirror_path!;
+    commitFile(mirrorPath, "Notes/alpha.md", "a1", "export: alpha");
+    commitFile(mirrorPath, "Notes/beta.md", "b1", "export: beta");
+
+    const res = await handleMirrorHistory(
+      new Request("http://localhost/vault/default/.parachute/mirror/history?path=Notes/alpha"),
+      manager,
+    );
+    const body = (await res.json()) as {
+      history: Array<{ message: string }>;
+      path?: string;
+    };
+    expect(body.path).toBe("Notes/alpha");
+    expect(body.history.length).toBe(1);
+    expect(body.history[0]!.message).toBe("export: alpha");
+  });
+
+  test("?limit caps the count", async () => {
+    const home = tmp("vault-route-histlimit-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const mirrorPath = manager.getStatus().mirror_path!;
+    for (let i = 0; i < 4; i++) commitFile(mirrorPath, `Notes/n${i}.md`, `v${i}`, `export: c${i}`);
+
+    const res = await handleMirrorHistory(
+      new Request("http://localhost/vault/default/.parachute/mirror/history?limit=2"),
+      manager,
+    );
+    const body = (await res.json()) as { history: unknown[] };
+    expect(body.history.length).toBe(2);
+  });
+
+  test("invalid limit → 400", async () => {
+    const home = tmp("vault-route-histbadlimit-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const res = await handleMirrorHistory(
+      new Request("http://localhost/vault/default/.parachute/mirror/history?limit=-3"),
+      manager,
+    );
+    expect(res.status).toBe(400);
+  });
+});
+
+describe("handleMirrorHistoryShow route", () => {
+  test("returns a past revision's content", async () => {
+    const home = tmp("vault-route-show-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const mirrorPath = manager.getStatus().mirror_path!;
+    commitFile(mirrorPath, "Notes/a.md", "v1 content", "export: a v1");
+    const sha = (await readMirrorHistory(mirrorPath, { notePath: "Notes/a" }))[0]!.sha;
+    commitFile(mirrorPath, "Notes/a.md", "v2 content", "export: a v2");
+
+    const res = await handleMirrorHistoryShow(
+      new Request(
+        `http://localhost/vault/default/.parachute/mirror/history/show?sha=${sha}&path=Notes/a`,
+      ),
+      manager,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { content: string; sha: string; path: string };
+    expect(body.content).toBe("v1 content");
+    expect(body.path).toBe("Notes/a");
+  });
+
+  test("missing sha/path → 400", async () => {
+    const home = tmp("vault-route-show-missing-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const res = await handleMirrorHistoryShow(
+      new Request("http://localhost/vault/default/.parachute/mirror/history/show?sha=abc123"),
+      manager,
+    );
+    expect(res.status).toBe(400);
+  });
+
+  test("unknown sha/path → 404", async () => {
+    const home = tmp("vault-route-show-404-");
+    const { manager } = makeStartedManager(home);
+    await manager.start();
+    const res = await handleMirrorHistoryShow(
+      new Request(
+        "http://localhost/vault/default/.parachute/mirror/history/show?sha=deadbeef&path=Notes/ghost",
+      ),
+      manager,
+    );
+    expect(res.status).toBe(404);
+  });
+});