@orion-agents/orion-code 0.3.25 → 0.3.27

package/dist/services/code-review/contract.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINDING_TEXT_LIMITS = exports.DEFAULT_REVIEW_BUDGETS = void 0;
+exports.validateReviewFinding = validateReviewFinding;
+exports.resolveReviewConclusion = resolveReviewConclusion;
+exports.resolveReviewBudgets = resolveReviewBudgets;
+exports.reviewApplicability = reviewApplicability;
+exports.computeReceiptDigest = computeReceiptDigest;
+exports.verifyReceiptDigest = verifyReceiptDigest;
+/**
+ * v0.3.27 PR0 — the shared code-review contract, frozen before any runtime
+ * wiring. This module is the single source of truth for review selectors,
+ * states, conclusions, findings, budgets and receipt digests; CLI and Web both
+ * consume it and neither may redefine the semantics locally (goal G3: one
+ * engine, one contract).
+ *
+ * Design sources: docs/plan/v0.3.27-plan.md §4 (identity, state, conclusions),
+ * §4.3 (bounded resources), §5 (read-only execution). The conclusion mapping
+ * encodes the plan's rule that tool success is not review success: a partial,
+ * failed, cancelled or untrustworthy output can never surface as a green
+ * "no findings".
+ */
+const canonical_1 = require("../../runtime/protocol/canonical");
+exports.DEFAULT_REVIEW_BUDGETS = Object.freeze({
+    maxFiles: 50,
+    maxBodyBytes: 2 * 1024 * 1024,
+    maxDiffBytes: 1024 * 1024,
+    maxReadToolCalls: 50,
+    maxDurationMs: 5 * 60 * 1000,
+    maxFindings: 100,
+    maxResultBytes: 256 * 1024,
+});
+/** Text size caps for finding fields, in characters. Chosen so 100 maximal
+ *  findings stay well inside the 256 KiB result bound. */
+exports.FINDING_TEXT_LIMITS = Object.freeze({
+    title: 200,
+    trigger: 2000,
+    impact: 2000,
+    evidence: 4000,
+    fileKey: 1024,
+});
+const FINDING_ID_PATTERN = /^[0-9a-f]{8,64}$/iu;
+const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+/** Validates one model-produced finding against the frozen shape. Returns the
+ *  finding unchanged when valid; a typed reason when not. Membership against
+ *  the snapshot manifest is a separate Host check (PR1+). */
+function validateReviewFinding(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return { valid: false, reason: 'not_an_object' };
+    }
+    const candidate = value;
+    const text = (field) => typeof candidate[field] === 'string' ? candidate[field] : '';
+    if (typeof candidate.findingId !== 'string' || !FINDING_ID_PATTERN.test(candidate.findingId)) {
+        return { valid: false, reason: 'finding_id_invalid' };
+    }
+    if (candidate.priority !== 'P0' &&
+        candidate.priority !== 'P1' &&
+        candidate.priority !== 'P2' &&
+        candidate.priority !== 'P3') {
+        return { valid: false, reason: 'priority_invalid' };
+    }
+    const title = text('title').trim();
+    if (!title || title.length > exports.FINDING_TEXT_LIMITS.title) {
+        return { valid: false, reason: 'title_invalid' };
+    }
+    const trigger = text('trigger').trim();
+    if (!trigger || trigger.length > exports.FINDING_TEXT_LIMITS.trigger) {
+        return { valid: false, reason: 'trigger_invalid' };
+    }
+    const impact = text('impact').trim();
+    if (!impact || impact.length > exports.FINDING_TEXT_LIMITS.impact) {
+        return { valid: false, reason: 'impact_invalid' };
+    }
+    const fileKey = text('fileKey');
+    if (!fileKey ||
+        fileKey.length > exports.FINDING_TEXT_LIMITS.fileKey ||
+        fileKey.startsWith('/') ||
+        fileKey.includes('\0') ||
+        fileKey.split('/').includes('..')) {
+        return { valid: false, reason: 'file_key_invalid' };
+    }
+    if (candidate.side !== 'old' && candidate.side !== 'new') {
+        return { valid: false, reason: 'side_invalid' };
+    }
+    const startLine = candidate.startLine;
+    const endLine = candidate.endLine;
+    if (!Number.isSafeInteger(startLine) ||
+        startLine < 1 ||
+        !Number.isSafeInteger(endLine) ||
+        endLine < startLine) {
+        return { valid: false, reason: 'line_range_invalid' };
+    }
+    const evidence = text('evidence').trim();
+    if (!evidence || evidence.length > exports.FINDING_TEXT_LIMITS.evidence) {
+        return { valid: false, reason: 'evidence_invalid' };
+    }
+    return {
+        valid: true,
+        finding: Object.freeze({
+            findingId: candidate.findingId,
+            priority: candidate.priority,
+            title,
+            trigger,
+            impact,
+            fileKey,
+            side: candidate.side,
+            startLine: startLine,
+            endLine: endLine,
+            evidence,
+        }),
+    };
+}
+/**
+ * v0.3.27 §4.1 — the conclusion mapping, frozen as code so CLI and Web cannot
+ * diverge. The invariants:
+ * - `queued`/`running` results carry no conclusion (callers must not call this).
+ * - A state that is not `completed` can never conclude `no_findings`.
+ * - Invalid findings make the output untrustworthy: zero valid findings with
+ *   invalid ones present is `inconclusive`, never a green pass.
+ * - Zero findings without complete coverage is `inconclusive`, never a green
+ *   pass ("不静默截断后宣布全部完成").
+ */
+function resolveReviewConclusion(input) {
+    if (input.state === 'queued' || input.state === 'running') {
+        throw new Error('A queued or running review cannot have a terminal conclusion.');
+    }
+    if (input.state === 'failed' || input.state === 'cancelled') {
+        return 'inconclusive';
+    }
+    if (input.validFindingCount > 0) {
+        return 'findings';
+    }
+    if (input.state === 'partial') {
+        return 'inconclusive';
+    }
+    // state === 'completed'
+    if (input.invalidFindingCount > 0) {
+        return 'inconclusive';
+    }
+    return input.coverageComplete ? 'no_findings' : 'inconclusive';
+}
+/** Applies the budgets with the tighten-only rule: every override must be a
+ *  safe integer at or below the frozen default, otherwise the run is refused
+ *  rather than silently widened. */
+function resolveReviewBudgets(overrides = {}) {
+    const resolved = {};
+    for (const [field, ceiling] of Object.entries(exports.DEFAULT_REVIEW_BUDGETS)) {
+        const requested = overrides[field];
+        if (requested === undefined) {
+            resolved[field] = ceiling;
+            continue;
+        }
+        if (!Number.isSafeInteger(requested) || requested < 1 || requested > ceiling) {
+            return { ok: false, field };
+        }
+        resolved[field] = requested;
+    }
+    return {
+        ok: true,
+        budgets: Object.freeze(resolved),
+    };
+}
+/** Marks a stored result's applicability against the current input snapshot and
+ *  rules digests. The receipt itself is never rewritten. */
+function reviewApplicability(result, current) {
+    return result.inputSnapshotDigest === current.inputSnapshotDigest &&
+        result.rulesDigest === current.rulesDigest
+        ? 'current'
+        : 'stale';
+}
+/** The receipt digest covers the canonical form of the result with the digest
+ *  field itself excluded, so verification is a recomputation, not a lookup. */
+function computeReceiptDigest(result) {
+    const content = { ...result };
+    delete content.receiptDigest;
+    const digest = (0, canonical_1.digestRuntimeValue)(content);
+    return DIGEST_PATTERN.test(digest) ? digest : digest.toLowerCase();
+}
+/** Verifies a stored receipt by recomputing its digest. */
+function verifyReceiptDigest(result) {
+    const { receiptDigest, ...content } = result;
+    return computeReceiptDigest(content) === receiptDigest;
+}
+//# sourceMappingURL=contract.js.map

package/dist/services/code-review/snapshot.d.ts

@@ -0,0 +1,64 @@
+import { type ReviewBudgetsV1, type ReviewSelectorV1 } from './contract';
+export interface ReviewSnapshotFileSideV1 {
+    readonly source: 'staged' | 'unstaged' | 'base' | 'head';
+    readonly oid: string | null;
+    readonly contentDigest: string;
+    readonly byteSize: number;
+    readonly truncated: boolean;
+}
+export interface ReviewSnapshotHunkV1 {
+    readonly oldStart: number;
+    readonly oldLines: number;
+    readonly newStart: number;
+    readonly newLines: number;
+    readonly header: string;
+}
+export interface ReviewSnapshotFileV1 {
+    readonly fileKey: string;
+    readonly path: string;
+    readonly oldPath: string | null;
+    readonly sensitive: boolean;
+    readonly sides: readonly ReviewSnapshotFileSideV1[];
+    readonly hunks: readonly ReviewSnapshotHunkV1[];
+}
+export interface ReviewSnapshotSkipV1 {
+    readonly path: string;
+    readonly reason: 'over_budget_files' | 'over_budget_bytes' | 'binary' | 'sensitive' | 'unreadable' | 'changed_during_review' | 'other';
+    readonly detail?: string;
+}
+export interface CodeReviewSnapshotV1 {
+    readonly schemaVersion: 1;
+    readonly snapshotId: string;
+    readonly kind: 'worktree' | 'base';
+    readonly baseOid: string | null;
+    readonly headOid: string | null;
+    readonly requestedPaths: readonly string[];
+    readonly files: readonly ReviewSnapshotFileV1[];
+    readonly inputSnapshotDigest: string;
+    readonly skipped: readonly ReviewSnapshotSkipV1[];
+}
+export declare class ReviewSnapshotError extends Error {
+    readonly code: 'not_a_repository' | 'ref_unresolved' | 'no_merge_base' | 'path_invalid' | 'worktree_changed';
+    constructor(message: string, code: 'not_a_repository' | 'ref_unresolved' | 'no_merge_base' | 'path_invalid' | 'worktree_changed');
+}
+/** Runs a read-only git command with argument arrays. The caller injects this,
+ *  so tests drive real temporary repositories without spawning beyond git. */
+export type ReviewGitRunner = (args: readonly string[]) => Promise<string>;
+export interface ReviewSnapshotOptionsV1 {
+    readonly root: string;
+    readonly selector: ReviewSelectorV1;
+    readonly budgets?: Partial<ReviewBudgetsV1>;
+    readonly runGit: ReviewGitRunner;
+    /** Reads one working-tree file relative to the root, or null when missing. */
+    readonly readWorktreeFile?: (relativePath: string) => Promise<string | null>;
+    readonly snapshotIdPrefix?: string;
+}
+/** Resolves the selector to a frozen snapshot. Every OID and digest in the
+ *  returned object was taken at admission time; callers persist the returned
+ *  digest as the review's input identity. */
+export declare function captureReviewSnapshot(options: ReviewSnapshotOptionsV1): Promise<CodeReviewSnapshotV1>;
+/** Reads one working-tree file for review purposes, refusing to leave the
+ *  repository root (same containment discipline as the v0.3.25 conflict
+ *  reader). Returns null when the file is missing or unreadable. */
+export declare function createContainedWorktreeReader(rootInput: string): (relativePath: string) => Promise<string | null>;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/services/code-review/snapshot.js

@@ -0,0 +1,321 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReviewSnapshotError = void 0;
+exports.captureReviewSnapshot = captureReviewSnapshot;
+exports.createContainedWorktreeReader = createContainedWorktreeReader;
+/**
+ * v0.3.27 PR1 — the minimal shared Git snapshot reader for code review
+ * (plan §4.2). One reader, two scopes:
+ *
+ *  - `worktree`: staged, unstaged and untracked changes are recorded as
+ *    separate sources for the same path and are never merged into one
+ *    composite diff.
+ *  - `base`: the ref, HEAD and merge-base are resolved to immutable OIDs at
+ *    admission; later ref movement cannot change the frozen input.
+ *
+ * Security posture (§4.2.7): git runs with argument arrays through the read
+ * profile, never a shell; external diff drivers and textconv are disabled;
+ * blobs are read by OID; untracked working files are read directly under the
+ * same sensitive/binary/boundary policies as everything else. No optional
+ * locks, no arbitrary subcommands exposed to the model.
+ */
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const redaction_1 = require("../redaction");
+const contract_1 = require("./contract");
+class ReviewSnapshotError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'ReviewSnapshotError';
+    }
+}
+exports.ReviewSnapshotError = ReviewSnapshotError;
+function sha256(value) {
+    return (0, crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+function assertSafePath(value) {
+    if (!value ||
+        value.length > 1024 ||
+        value.startsWith('/') ||
+        value.includes('\0') ||
+        value.split('/').includes('..')) {
+        throw new ReviewSnapshotError(`Unsafe review path: ${value}`, 'path_invalid');
+    }
+    return value;
+}
+/** Parses `git diff --name-status -z` records into status/path groups. */
+function parseNameStatusZ(records) {
+    const parsed = [];
+    let index = 0;
+    while (index < records.length) {
+        const record = records[index];
+        if (!record) {
+            index += 1;
+            continue;
+        }
+        const status = record.slice(0, 1);
+        const paths = [];
+        if (status === 'R' || status === 'C') {
+            paths.push(records[index + 1] ?? '', records[index + 2] ?? '');
+            index += 3;
+        }
+        else {
+            paths.push(records[index + 1] ?? '');
+            index += 2;
+        }
+        parsed.push({ status, paths });
+    }
+    return parsed;
+}
+function parseDiffHunks(diffText) {
+    const files = [];
+    let current;
+    const HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/;
+    for (const line of diffText.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            const rest = line.slice('diff --git '.length);
+            const split = rest.indexOf(' b/');
+            current = {
+                path: split >= 0 ? rest.slice(split + 3) : rest,
+                hunks: [],
+                diffBytes: 0,
+            };
+            files.push(current);
+            continue;
+        }
+        if (!current)
+            continue;
+        current.diffBytes += line.length + 1;
+        const header = HUNK.exec(line);
+        if (header) {
+            current.hunks.push({
+                oldStart: Number(header[1]),
+                oldLines: header[2] === undefined ? 1 : Number(header[2]),
+                newStart: Number(header[3]),
+                newLines: header[4] === undefined ? 1 : Number(header[4]),
+                header: line,
+            });
+        }
+    }
+    return files;
+}
+function pathMatches(path, requestedPaths) {
+    if (requestedPaths.length === 0)
+        return true;
+    return requestedPaths.some(filter => path === filter || path.startsWith(`${filter}/`));
+}
+/** Resolves the selector to a frozen snapshot. Every OID and digest in the
+ *  returned object was taken at admission time; callers persist the returned
+ *  digest as the review's input identity. */
+async function captureReviewSnapshot(options) {
+    const budgets = { ...contract_1.DEFAULT_REVIEW_BUDGETS, ...options.budgets };
+    const { runGit } = options;
+    const requestedPaths = (options.selector.paths ?? []).map(assertSafePath);
+    let baseOid = null;
+    let headOid = null;
+    let nameStatusArgs;
+    let unifiedArgs;
+    if (options.selector.kind === 'base') {
+        headOid = (await runGit(['rev-parse', '--verify', 'HEAD'])).trim();
+        const refOid = (await runGit(['rev-parse', '--verify', `${options.selector.ref}^{commit}`]).catch(() => '')).trim();
+        if (!refOid) {
+            throw new ReviewSnapshotError(`Review base ref could not be resolved: ${options.selector.ref}`, 'ref_unresolved');
+        }
+        baseOid = (await runGit(['merge-base', refOid, headOid]).catch(() => '')).trim();
+        if (!baseOid) {
+            throw new ReviewSnapshotError(`No merge base between ${options.selector.ref} and HEAD`, 'no_merge_base');
+        }
+        nameStatusArgs = [
+            'diff',
+            '--no-ext-diff',
+            '--no-textconv',
+            '--find-renames',
+            '--name-status',
+            '-z',
+            baseOid,
+            headOid,
+        ];
+        unifiedArgs = ['diff', '--no-ext-diff', '--no-textconv', baseOid, headOid];
+    }
+    else {
+        nameStatusArgs = [
+            'diff',
+            '--no-ext-diff',
+            '--no-textconv',
+            '--find-renames',
+            '--name-status',
+            '-z',
+            'HEAD',
+        ];
+        unifiedArgs = ['diff', '--no-ext-diff', '--no-textconv', 'HEAD'];
+    }
+    const nameStatusRaw = await runGit(nameStatusArgs);
+    const changed = parseNameStatusZ(nameStatusRaw.split('\0')).filter(entry => {
+        const path = entry.paths.at(-1);
+        return Boolean(path) && pathMatches(path, requestedPaths);
+    });
+    const files = [];
+    const skipped = [];
+    const seenPaths = new Set();
+    for (const entry of changed) {
+        const path = assertSafePath(entry.paths.at(-1));
+        if (seenPaths.has(path))
+            continue;
+        if (files.length >= budgets.maxFiles) {
+            skipped.push({ path, reason: 'over_budget_files' });
+            continue;
+        }
+        seenPaths.add(path);
+        const oldPath = entry.status === 'R' || entry.status === 'C' ? (entry.paths[0] ?? null) : null;
+        const sensitive = (0, redaction_1.isSensitiveFilePath)(path) || (oldPath ? (0, redaction_1.isSensitiveFilePath)(oldPath) : false);
+        if (sensitive) {
+            skipped.push({ path, reason: 'sensitive' });
+            continue;
+        }
+        if (entry.status === 'B') {
+            skipped.push({ path, reason: 'binary' });
+            continue;
+        }
+        files.push({
+            fileKey: sha256(`${entry.status}:${oldPath ?? ''}:${path}`).slice(0, 16),
+            path,
+            oldPath,
+            sensitive: false,
+            sides: [],
+            hunks: [],
+        });
+    }
+    const parsedFiles = parseDiffHunks(await runGit(unifiedArgs));
+    for (const file of files) {
+        const match = parsedFiles.find(candidate => candidate.path === file.path);
+        if (match)
+            file.hunks.push(...match.hunks);
+    }
+    for (const file of files) {
+        const totalDiff = file.hunks.reduce((sum, hunk) => sum + hunk.oldLines + hunk.newLines, 0);
+        if (totalDiff * 128 > budgets.maxDiffBytes) {
+            skipped.push({ path: file.path, reason: 'over_budget_bytes' });
+            continue;
+        }
+        if (options.selector.kind === 'base') {
+            const headOidForPath = (await runGit(['rev-parse', '--verify', `${headOid}:${file.path}`]).catch(() => '')).trim();
+            const baseOidForPath = (await runGit([
+                'rev-parse',
+                '--verify',
+                `${baseOid}:${file.oldPath ?? file.path}`,
+            ]).catch(() => '')).trim();
+            if (headOidForPath) {
+                file.sides.push({
+                    source: 'head',
+                    oid: headOidForPath,
+                    contentDigest: headOidForPath,
+                    byteSize: Number((await runGit(['cat-file', '-s', headOidForPath])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+            if (baseOidForPath) {
+                file.sides.push({
+                    source: 'base',
+                    oid: baseOidForPath,
+                    contentDigest: baseOidForPath,
+                    byteSize: Number((await runGit(['cat-file', '-s', baseOidForPath])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+        }
+        else {
+            const indexOid = (await runGit(['ls-files', '-s', '-z', '--', file.path]).then(raw => {
+                const record = raw.split('\0').find(item => item.length > 0);
+                return record ? (record.split(' ')[1] ?? '') : '';
+            })).trim();
+            if (indexOid) {
+                file.sides.push({
+                    source: 'staged',
+                    oid: indexOid,
+                    contentDigest: indexOid,
+                    byteSize: Number((await runGit(['cat-file', '-s', indexOid])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+            if (options.readWorktreeFile) {
+                const before = await options.readWorktreeFile(file.path);
+                if (before === null) {
+                    file.sides.push({
+                        source: 'unstaged',
+                        oid: null,
+                        contentDigest: sha256(''),
+                        byteSize: 0,
+                        truncated: false,
+                    });
+                }
+                else {
+                    const beforeDigest = sha256(before);
+                    const after = await options.readWorktreeFile(file.path);
+                    if (after === null || sha256(after) !== beforeDigest) {
+                        throw new ReviewSnapshotError(`Working file changed while snapshotting: ${file.path}`, 'worktree_changed');
+                    }
+                    file.sides.push({
+                        source: 'unstaged',
+                        oid: null,
+                        contentDigest: beforeDigest,
+                        byteSize: Buffer.byteLength(before, 'utf8'),
+                        truncated: before.length > budgets.maxBodyBytes,
+                    });
+                }
+            }
+        }
+    }
+    const manifest = {
+        kind: options.selector.kind,
+        baseOid,
+        headOid,
+        requestedPaths,
+        files: files.map(file => ({
+            fileKey: file.fileKey,
+            path: file.path,
+            oldPath: file.oldPath,
+            sides: file.sides.map(side => ({ source: side.source, contentDigest: side.contentDigest })),
+        })),
+    };
+    const inputSnapshotDigest = sha256(JSON.stringify(manifest));
+    const snapshotId = `${options.snapshotIdPrefix ?? 'rev'}-${inputSnapshotDigest.slice(0, 16)}`;
+    return Object.freeze({
+        schemaVersion: 1,
+        snapshotId,
+        kind: options.selector.kind,
+        baseOid,
+        headOid,
+        requestedPaths,
+        files: Object.freeze(files.map(file => Object.freeze({
+            ...file,
+            sides: Object.freeze(file.sides),
+            hunks: Object.freeze(file.hunks),
+        }))),
+        inputSnapshotDigest,
+        skipped: Object.freeze(skipped),
+    });
+}
+/** Reads one working-tree file for review purposes, refusing to leave the
+ *  repository root (same containment discipline as the v0.3.25 conflict
+ *  reader). Returns null when the file is missing or unreadable. */
+function createContainedWorktreeReader(rootInput) {
+    const root = (0, fs_1.realpathSync)(rootInput);
+    return async (relativePath) => {
+        try {
+            const absolute = (0, path_1.resolve)(root, relativePath);
+            const fileReal = (0, fs_1.realpathSync)(absolute);
+            if (fileReal !== root && !fileReal.startsWith(root + path_1.sep))
+                return null;
+            if (!(0, fs_1.statSync)(fileReal).isFile())
+                return null;
+            return await (0, promises_1.readFile)(fileReal, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    };
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/services/session-storage.js

@@ -1858,6 +1858,21 @@ function updateSessionSummary(sessionId, _messages) {
     // Callers may hold a stale transcript snapshot. Re-read under the same lock
     // used by append/delete so reconciliation can never roll metadata backwards.
     withLockedSession(sessionId, session => {
+        // v0.3.26 #277 — a cutover Session's summary comes from the authoritative
+        // v2 Thread. Its legacy JSONL is frozen at cutover, so summarizing from it
+        // (as /exit and the shutdown path do) would move messageCount and
+        // historySizeBytes backwards while the Thread history is intact. Reopening
+        // the Session repairs the read model from v2; this makes the exit path
+        // agree instead of regressing it.
+        const threadView = (0, thread_session_view_1.loadThreadSessionViewV1)(session.projectPath, session.id);
+        if (threadView) {
+            session.messageCount = threadView.messageCount;
+            session.historySizeBytes = threadView.historySizeBytes;
+            session.updatedAt = threadView.updatedAt;
+            session.updatedAtIso = new Date(session.updatedAt).toISOString();
+            writeSessionMetaUnlocked(session);
+            return;
+        }
         const summary = summarizeSessionMessages(readSessionMessagesForSession(session));
         session.toolsUsed = summary.toolsUsed;
         session.filesModified = summary.filesModified;
@@ -2553,6 +2568,12 @@ function deleteSession(sessionId) {
         updateSessionCatalog(catalog => {
             delete catalog.sessions[sessionId];
         });
+        // v0.3.26 #276 — a cutover Session's v2 records are the authoritative
+        // history; permanent deletion must remove them with the legacy files.
+        // The Web deletion dialog promises exactly that.
+        if ((0, legacy_thread_materializer_1.deleteSessionThreadRecordsV1)(session.projectPath, sessionId)) {
+            deleted = true;
+        }
         return deleted;
     }) ?? false);
 }

package/dist/web/git-diff-document.d.ts

@@ -41,6 +41,18 @@ export interface GitHunkV2 {
     readonly complete: boolean;
 }
 export type GitDiffDocumentKindV2 = 'text' | 'binary' | 'symlink' | 'submodule' | 'metadata';
+/**
+ * v0.3.26 #275 — parser state for a hunk that a page boundary split. Carried in
+ * the continuation cursor so the next page re-opens the hunk with its stable
+ * identity (`index:oldStart:newStart`) and correct running line cursors instead
+ * of demoting the continuation rows to document meta.
+ */
+export interface GitDiffHunkResumeV1 {
+    readonly header: string;
+    readonly index: number;
+    readonly oldCursor: number;
+    readonly newCursor: number;
+}
 export interface GitDiffCapabilitiesV2 {
     readonly stageFile: boolean;
     readonly unstageFile: boolean;
@@ -63,6 +75,11 @@ export interface GitDiffDocumentV2 {
     readonly hunks: readonly GitHunkV2[];
     /** Metadata lines that are not part of any hunk (file headers, mode changes, …). */
     readonly meta: readonly string[];
+    /**
+     * v0.3.26 #275 — the hunk still open when this page ended, for the
+     * continuation cursor. Null when the page ends on a hunk boundary.
+     */
+    readonly pendingHunk: GitDiffHunkResumeV1 | null;
     readonly completeness: 'complete' | 'paged' | 'limited';
     readonly additions: number;
     readonly deletions: number;
@@ -79,5 +96,7 @@ export declare function parseGitDiffDocument(input: {
     readonly hasMore: boolean;
     /** Host-signed continuation cursor, or null. Never synthesised here. */
     readonly nextCursor: string | null;
+    /** v0.3.26 #275 — hunk state from the previous page's `pendingHunk`. */
+    readonly resume?: GitDiffHunkResumeV1 | null;
 }): GitDiffDocumentV2;
 //# sourceMappingURL=git-diff-document.d.ts.map