@zzusp/ccsm 1.0.0 → 1.0.1

package/server/lib/delete.test.ts

@@ -0,0 +1,244 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// delete.ts 的关键不变量是"5 处级联 + 2 类安全网"：
+//   级联 = projects/<id>.jsonl + projects/<id>/ + file-history/<id>/ + session-env/<id>/
+//          + history.jsonl 里的行 + sessions/<pid>.json
+//   安全网 = live PID OR 5 分钟内 mtime → 直接跳过
+// 每次都 mock claude-paths.ts 把 PATHS 指到一个独立 tmp dir，
+// 保证测试不会读到真实 ~/.claude。
+
+let fakeRoot: string;
+let fakePaths: {
+  root: string;
+  projects: string;
+  fileHistory: string;
+  sessionEnv: string;
+  sessions: string;
+  history: string;
+};
+
+vi.mock('./claude-paths.ts', () => {
+  // 注意：vi.mock 是 hoist 的，工厂里不能引用模块作用域变量。
+  // 改用 process.env.CCSM_TEST_ROOT 桥接，afterEach 时清掉。
+  return {
+    get PATHS() {
+      const root = process.env.CCSM_TEST_ROOT!;
+      return {
+        root,
+        projects: path.join(root, 'projects'),
+        fileHistory: path.join(root, 'file-history'),
+        sessionEnv: path.join(root, 'session-env'),
+        sessions: path.join(root, 'sessions'),
+        history: path.join(root, 'history.jsonl'),
+      };
+    },
+    isUnderClaudeRoot(target: string): boolean {
+      const root = process.env.CCSM_TEST_ROOT!;
+      const resolved = path.resolve(target);
+      return resolved === root || resolved.startsWith(root + path.sep);
+    },
+    getCacheDir(): string {
+      return path.join(process.env.CCSM_TEST_ROOT!, '_cache');
+    },
+  };
+});
+
+beforeEach(() => {
+  fakeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ccsm-delete-test-'));
+  process.env.CCSM_TEST_ROOT = fakeRoot;
+  fakePaths = {
+    root: fakeRoot,
+    projects: path.join(fakeRoot, 'projects'),
+    fileHistory: path.join(fakeRoot, 'file-history'),
+    sessionEnv: path.join(fakeRoot, 'session-env'),
+    sessions: path.join(fakeRoot, 'sessions'),
+    history: path.join(fakeRoot, 'history.jsonl'),
+  };
+  fs.mkdirSync(fakePaths.projects, { recursive: true });
+  fs.mkdirSync(fakePaths.fileHistory, { recursive: true });
+  fs.mkdirSync(fakePaths.sessionEnv, { recursive: true });
+  fs.mkdirSync(fakePaths.sessions, { recursive: true });
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.CCSM_TEST_ROOT;
+  fs.rmSync(fakeRoot, { recursive: true, force: true });
+});
+
+interface SessionFixture {
+  projectId: string;
+  sessionId: string;
+  jsonlPath: string;
+  subdirPath: string;
+  fhPath: string;
+  sePath: string;
+}
+
+/** 在 fake root 下铺出一份 5 个位置都存在的 session 文件布局。*/
+function makeSession(opts: { sessionId?: string; projectId?: string; mtimeMs?: number } = {}): SessionFixture {
+  const sessionId = opts.sessionId ?? 'sid-' + Math.random().toString(36).slice(2, 10);
+  const projectId = opts.projectId ?? '-Users-alice-proj';
+  const projectDir = path.join(fakePaths.projects, projectId);
+  fs.mkdirSync(projectDir, { recursive: true });
+
+  const jsonlPath = path.join(projectDir, `${sessionId}.jsonl`);
+  fs.writeFileSync(jsonlPath, JSON.stringify({ type: 'user', sessionId }) + '\n');
+
+  const subdirPath = path.join(projectDir, sessionId);
+  fs.mkdirSync(subdirPath, { recursive: true });
+  fs.writeFileSync(path.join(subdirPath, 'notes.md'), 'sub');
+
+  const fhPath = path.join(fakePaths.fileHistory, sessionId);
+  fs.mkdirSync(fhPath, { recursive: true });
+  fs.writeFileSync(path.join(fhPath, 'a.txt'), 'fh');
+
+  const sePath = path.join(fakePaths.sessionEnv, sessionId);
+  fs.mkdirSync(sePath, { recursive: true });
+  fs.writeFileSync(path.join(sePath, 'env.json'), '{}');
+
+  // mtime 拨到一小时前，绕开 5 分钟安全网
+  const mtime = opts.mtimeMs ?? Date.now() - 60 * 60 * 1000;
+  fs.utimesSync(jsonlPath, mtime / 1000, mtime / 1000);
+
+  return { projectId, sessionId, jsonlPath, subdirPath, fhPath, sePath };
+}
+
+function writeHistory(lines: Array<Record<string, unknown>>): void {
+  fs.writeFileSync(
+    fakePaths.history,
+    lines.map((l) => JSON.stringify(l)).join('\n') + '\n',
+  );
+}
+
+function writePidFile(pid: number, sessionId: string, cwd = '/Users/alice/proj'): string {
+  const file = path.join(fakePaths.sessions, `${pid}.json`);
+  fs.writeFileSync(file, JSON.stringify({ pid, sessionId, cwd }));
+  return file;
+}
+
+describe('deleteSessions：5 处级联清理', () => {
+  it('一次 delete 删 jsonl + subdir + file-history + session-env + history 行 + 死 PID 文件', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    const s = makeSession();
+
+    // history.jsonl：留两条同 sid、一条别的
+    writeHistory([
+      { sessionId: s.sessionId, project: '/Users/alice/proj', timestamp: 'T1', display: 'q1' },
+      { sessionId: s.sessionId, project: '/Users/alice/proj', timestamp: 'T2', display: 'q2' },
+      { sessionId: 'sid-other', project: '/Users/alice/proj', timestamp: 'T3', display: 'q3' },
+    ]);
+
+    // 一个已死 PID 文件：进程不存在，但 sessions/<pid>.json 还在
+    const deadPid = 999999;
+    const pidFile = writePidFile(deadPid, s.sessionId);
+
+    const res = await deleteSessions([{ projectId: s.projectId, sessionId: s.sessionId }]);
+
+    expect(res.deleted).toHaveLength(1);
+    expect(res.skipped).toHaveLength(0);
+    expect(res.historyLinesRemoved).toBe(2);
+
+    expect(fs.existsSync(s.jsonlPath)).toBe(false);
+    expect(fs.existsSync(s.subdirPath)).toBe(false);
+    expect(fs.existsSync(s.fhPath)).toBe(false);
+    expect(fs.existsSync(s.sePath)).toBe(false);
+    expect(fs.existsSync(pidFile)).toBe(false);
+
+    // history.jsonl 的非目标行保留
+    const remaining = fs
+      .readFileSync(fakePaths.history, 'utf8')
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as { sessionId: string });
+    expect(remaining).toHaveLength(1);
+    expect(remaining[0]!.sessionId).toBe('sid-other');
+
+    expect(res.deleted[0]!.cleaned).toEqual(
+      expect.arrayContaining([
+        'projects/<id>.jsonl',
+        'projects/<id>/',
+        'file-history/<id>/',
+        'session-env/<id>/',
+      ]),
+    );
+  });
+
+  it('history.jsonl 没有目标 sid 时不重写（atomic 三步不触发）', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    const s = makeSession();
+    writeHistory([{ sessionId: 'sid-other', project: '/x', timestamp: 'T0', display: 'q' }]);
+    const before = fs.readFileSync(fakePaths.history, 'utf8');
+
+    const res = await deleteSessions([{ projectId: s.projectId, sessionId: s.sessionId }]);
+    expect(res.historyLinesRemoved).toBe(0);
+    expect(fs.readFileSync(fakePaths.history, 'utf8')).toBe(before);
+
+    // 没有遗留的 .tmp-clean
+    const stray = fs.readdirSync(fakeRoot).filter((n) => n.startsWith('history.jsonl.tmp-'));
+    expect(stray).toEqual([]);
+  });
+});
+
+describe('deleteSessions：安全网', () => {
+  it('id 不合法（含 .. / 斜杠 / 点开头）直接 skip', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    const res = await deleteSessions([
+      { projectId: 'p', sessionId: '../escape' },
+      { projectId: 'p', sessionId: '.hidden' },
+    ]);
+    expect(res.deleted).toHaveLength(0);
+    expect(res.skipped).toHaveLength(2);
+    expect(res.skipped.every((s) => s.reason === 'invalid id')).toBe(true);
+  });
+
+  it('jsonl 在 5 分钟内被改过则跳过（可能仍在用）', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    // mtime = now，落在 5 分钟窗口内
+    const s = makeSession({ mtimeMs: Date.now() });
+    const res = await deleteSessions([{ projectId: s.projectId, sessionId: s.sessionId }]);
+    expect(res.deleted).toHaveLength(0);
+    expect(res.skipped).toHaveLength(1);
+    expect(res.skipped[0]!.reason).toMatch(/within the last 5 minutes/);
+    // 文件仍在
+    expect(fs.existsSync(s.jsonlPath)).toBe(true);
+    expect(fs.existsSync(s.fhPath)).toBe(true);
+  });
+
+  it('sessionId 出现在仍存活的 PID 文件中则跳过', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    const s = makeSession();
+    // 用当前进程的 pid 当"活进程"，process.kill(pid, 0) 必为 true
+    writePidFile(process.pid, s.sessionId);
+
+    const res = await deleteSessions([{ projectId: s.projectId, sessionId: s.sessionId }]);
+    expect(res.deleted).toHaveLength(0);
+    expect(res.skipped).toHaveLength(1);
+    expect(res.skipped[0]!.reason).toMatch(/live PID/);
+    expect(fs.existsSync(s.jsonlPath)).toBe(true);
+  });
+
+  it('一批里混合 OK / live / recent，逐条独立判定', async () => {
+    const { deleteSessions } = await import('./delete.ts');
+    const ok = makeSession({ sessionId: 'sid-ok' });
+    const liveSid = 'sid-live';
+    const live = makeSession({ sessionId: liveSid });
+    writePidFile(process.pid, liveSid);
+    const recent = makeSession({ sessionId: 'sid-recent', mtimeMs: Date.now() });
+
+    const res = await deleteSessions([
+      { projectId: ok.projectId, sessionId: ok.sessionId },
+      { projectId: live.projectId, sessionId: live.sessionId },
+      { projectId: recent.projectId, sessionId: recent.sessionId },
+    ]);
+
+    expect(res.deleted.map((d) => d.sessionId)).toEqual(['sid-ok']);
+    expect(res.skipped.map((s) => s.sessionId).sort()).toEqual(['sid-live', 'sid-recent']);
+    expect(fs.existsSync(ok.jsonlPath)).toBe(false);
+    expect(fs.existsSync(live.jsonlPath)).toBe(true);
+    expect(fs.existsSync(recent.jsonlPath)).toBe(true);
+  });
+});

package/server/lib/delete.ts

@@ -6,6 +6,7 @@ import { isUnderClaudeRoot, PATHS } from './claude-paths.ts';
 import { RECENT_ACTIVITY_WINDOW_MS } from './constants.ts';
 import { dirSize, fileSize } from './fs-size.ts';
 import { isSafeId } from './safe-id.ts';
+import { safeRemove } from './safe-remove.ts';
 import {
   buildActiveSessionMap,
   readActivePidEntries,
@@ -77,10 +78,10 @@ export async function deleteSessions(items: DeleteRequestItem[]): Promise<Delete
     };
     const cleaned: string[] = [];
 
-    if (rmFile(jsonlPath)) cleaned.push('projects/<id>.jsonl');
-    if (rmDir(subdirPath)) cleaned.push('projects/<id>/');
-    if (rmDir(fhPath)) cleaned.push('file-history/<id>/');
-    if (rmDir(sePath)) cleaned.push('session-env/<id>/');
+    if (safeRemove(jsonlPath)) cleaned.push('projects/<id>.jsonl');
+    if (safeRemove(subdirPath)) cleaned.push('projects/<id>/');
+    if (safeRemove(fhPath)) cleaned.push('file-history/<id>/');
+    if (safeRemove(sePath)) cleaned.push('session-env/<id>/');
 
     deleted.push({
       ...item,
@@ -101,18 +102,6 @@ export async function deleteSessions(items: DeleteRequestItem[]): Promise<Delete
   return { deleted, skipped, historyLinesRemoved };
 }
 
-function rmFile(p: string): boolean {
-  if (!fs.existsSync(p)) return false;
-  fs.rmSync(p, { force: true });
-  return true;
-}
-
-function rmDir(p: string): boolean {
-  if (!fs.existsSync(p)) return false;
-  fs.rmSync(p, { recursive: true, force: true });
-  return true;
-}
-
 function isRecentlyActive(jsonlPath: string): boolean {
   try {
     return Date.now() - fs.statSync(jsonlPath).mtimeMs < RECENT_ACTIVITY_WINDOW_MS;

package/server/lib/disk-usage.ts

@@ -1,16 +1,16 @@
-import { listProjects, listSessionsForProject } from './scan.ts';
+import { scanProjectsForDisk } from './scan.ts';
 import type {
   DiskUsage,
   DiskUsageMonthRow,
   DiskUsageProjectRow,
   DiskUsageTopSession,
-  SessionSummary,
+  RelatedBytes,
 } from '../types.ts';
 
 const TOP_N = 20;
 
 export async function computeDiskUsage(): Promise<DiskUsage> {
-  const projects = await listProjects();
+  const projects = await scanProjectsForDisk();
 
   const byProject: DiskUsageProjectRow[] = [];
   const monthMap = new Map<string, { bytes: number; count: number }>();
@@ -24,7 +24,6 @@ export async function computeDiskUsage(): Promise<DiskUsage> {
   }> = [];
 
   for (const p of projects) {
-    const sessions = await listSessionsForProject(p.id);
     byProject.push({
       projectId: p.id,
       decodedCwd: p.decodedCwd,
@@ -32,8 +31,8 @@ export async function computeDiskUsage(): Promise<DiskUsage> {
       sessionCount: p.sessionCount,
     });
 
-    for (const s of sessions) {
-      const total = sessionTotal(s);
+    for (const s of p.sessions) {
+      const total = sessionTotal(s.relatedBytes);
       const month = s.lastAt ? s.lastAt.slice(0, 7) : 'unknown';
       const acc = monthMap.get(month) ?? { bytes: 0, count: 0 };
       acc.bytes += total;
@@ -77,7 +76,6 @@ export async function computeDiskUsage(): Promise<DiskUsage> {
   };
 }
 
-function sessionTotal(s: SessionSummary): number {
-  const r = s.relatedBytes;
+function sessionTotal(r: RelatedBytes): number {
   return r.jsonl + r.subdir + r.fileHistory + r.sessionEnv;
 }

package/server/lib/export-import-bundle.test.ts

@@ -0,0 +1,337 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// 这份测试目标只有一个：**对称性**。
+//   export：把项目 jsonl 里的 cwd、history.jsonl 里的 project 替换成 ${CLAUDE_PROJECT_ROOT}
+//   import：把同一占位符替换回本机目标路径
+// 不该改的（消息正文 / gitBranch / version）一律按字节保持。
+// roundtrip 后取出的对象图必须与原始相等（cwd 字段视目标路径替换）。
+
+let fakeRoot: string;
+let externalDest: string;
+
+vi.mock('./claude-paths.ts', () => ({
+  get PATHS() {
+    const root = process.env.CCSM_TEST_ROOT!;
+    return {
+      root,
+      projects: path.join(root, 'projects'),
+      fileHistory: path.join(root, 'file-history'),
+      sessionEnv: path.join(root, 'session-env'),
+      sessions: path.join(root, 'sessions'),
+      history: path.join(root, 'history.jsonl'),
+    };
+  },
+  isUnderClaudeRoot(target: string): boolean {
+    const root = process.env.CCSM_TEST_ROOT!;
+    const resolved = path.resolve(target);
+    return resolved === root || resolved.startsWith(root + path.sep);
+  },
+  getCacheDir(): string {
+    return path.join(process.env.CCSM_TEST_ROOT!, '_cache');
+  },
+}));
+
+beforeEach(() => {
+  fakeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ccsm-bundle-rt-'));
+  externalDest = fs.mkdtempSync(path.join(os.tmpdir(), 'ccsm-bundle-out-'));
+  process.env.CCSM_TEST_ROOT = fakeRoot;
+  fs.mkdirSync(path.join(fakeRoot, 'projects'), { recursive: true });
+  fs.mkdirSync(path.join(fakeRoot, 'file-history'), { recursive: true });
+  fs.mkdirSync(path.join(fakeRoot, 'session-env'), { recursive: true });
+  fs.mkdirSync(path.join(fakeRoot, 'sessions'), { recursive: true });
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.CCSM_TEST_ROOT;
+  fs.rmSync(fakeRoot, { recursive: true, force: true });
+  fs.rmSync(externalDest, { recursive: true, force: true });
+});
+
+const SOURCE_CWD = '/Users/alice/proj';
+const PROJECT_ID = '-Users-alice-proj';
+const SESSION_ID = '019410ce-49fb-7d5c-b0a4-2d7d2b6a4b7d';
+
+interface ConvLine {
+  type: string;
+  sessionId?: string;
+  cwd?: string;
+  timestamp?: string;
+  message?: unknown;
+  gitBranch?: string;
+  version?: string;
+}
+
+function seedProject(lines: ConvLine[]): void {
+  const projDir = path.join(fakeRoot, 'projects', PROJECT_ID);
+  fs.mkdirSync(projDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(projDir, `${SESSION_ID}.jsonl`),
+    lines.map((l) => JSON.stringify(l)).join('\n') + '\n',
+  );
+}
+
+function seedHistory(rows: Array<Record<string, unknown>>): void {
+  fs.writeFileSync(
+    path.join(fakeRoot, 'history.jsonl'),
+    rows.map((r) => JSON.stringify(r)).join('\n') + '\n',
+  );
+}
+
+describe('export + import bundle roundtrip', () => {
+  it('cwd / project 双字段被替换成 sentinel；message / gitBranch / version 不动；reimport 还原到目标路径', async () => {
+    const { exportBundle } = await import('./export-bundle.ts');
+    const { commitImport } = await import('./import-bundle.ts');
+
+    const original: ConvLine[] = [
+      {
+        type: 'user',
+        sessionId: SESSION_ID,
+        cwd: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        message: { content: `look at ${SOURCE_CWD}/src/foo.ts` },
+        gitBranch: 'main',
+        version: '1.0.0',
+      },
+      {
+        type: 'assistant',
+        sessionId: SESSION_ID,
+        cwd: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:05Z',
+        message: { content: 'sure' },
+        gitBranch: 'main',
+        version: '1.0.0',
+      },
+    ];
+    seedProject(original);
+    seedHistory([
+      {
+        sessionId: SESSION_ID,
+        project: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        display: 'look at ${SOURCE_CWD}/src/foo.ts',
+        // cwd 字段同源路径，但 history 行的目标字段是 project，cwd 必须保持原样
+        cwd: SOURCE_CWD,
+      },
+      {
+        sessionId: 'sid-other',
+        project: '/some/other/proj',
+        timestamp: '2026-06-09T01:00:00Z',
+        display: 'unrelated',
+      },
+    ]);
+
+    // ── export ──────────────────────────────────────────────
+    const exportDir = path.join(externalDest, 'bundle');
+    const exp = await exportBundle(PROJECT_ID, 'all', exportDir);
+    expect(exp.sessionsExported).toBe(1);
+    expect(exp.historyLinesExported).toBe(1); // 只有匹配 SID 的那条被打包
+
+    // 校验 bundle 里 conversation.jsonl：cwd 被替换、消息正文不动
+    const conv = fs
+      .readFileSync(path.join(exportDir, 'sessions', SESSION_ID, 'conversation.jsonl'), 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as ConvLine);
+    expect(conv).toHaveLength(2);
+    for (const line of conv) {
+      expect(line.cwd).toBe('${CLAUDE_PROJECT_ROOT}');
+      expect(line.gitBranch).toBe('main');
+      expect(line.version).toBe('1.0.0');
+    }
+    // 消息正文里的源路径作为归档原貌保留
+    expect((conv[0]!.message as { content: string }).content).toBe(
+      `look at ${SOURCE_CWD}/src/foo.ts`,
+    );
+
+    // history.ndjson：project 字段被替换；cwd 字段（即便等于 sourceCwd）保留
+    const hist = fs
+      .readFileSync(path.join(exportDir, 'sessions', SESSION_ID, 'history.ndjson'), 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as Record<string, unknown>);
+    expect(hist).toHaveLength(1);
+    expect(hist[0]!.project).toBe('${CLAUDE_PROJECT_ROOT}');
+    expect(hist[0]!.cwd).toBe(SOURCE_CWD); // 不该改
+    expect(hist[0]!.sessionId).toBe(SESSION_ID);
+
+    // bundle 不能写到 ~/.claude 里（再次抽样确认）
+    expect(exportDir.startsWith(fakeRoot)).toBe(false);
+
+    // ── 清理原项目目录 + history，模拟"导入到另一台机器"────
+    fs.rmSync(path.join(fakeRoot, 'projects', PROJECT_ID), { recursive: true, force: true });
+    // 仅保留无关行，等会儿 import 后看是否正确追加
+    seedHistory([
+      {
+        sessionId: 'sid-other',
+        project: '/some/other/proj',
+        timestamp: '2026-06-09T01:00:00Z',
+        display: 'unrelated',
+      },
+    ]);
+
+    // ── import 到新路径 ────────────────────────────────────
+    const targetCwd = '/Users/bob/different-machine-proj';
+    const targetProjectId = '-Users-bob-different-machine-proj';
+    const imp = await commitImport({
+      bundleDir: exportDir,
+      targetCwd,
+      collisionPolicy: 'skip',
+    });
+    expect(imp.targetProjectId).toBe(targetProjectId);
+    expect(imp.imported).toHaveLength(1);
+    expect(imp.imported[0]!.sessionId).toBe(SESSION_ID);
+    expect(imp.historyLinesAdded).toBe(1);
+
+    // 导入后的 jsonl：cwd 替换为目标路径，其它字段按字节回到原状
+    const importedJsonl = path.join(
+      fakeRoot,
+      'projects',
+      targetProjectId,
+      `${SESSION_ID}.jsonl`,
+    );
+    expect(fs.existsSync(importedJsonl)).toBe(true);
+    const reimported = fs
+      .readFileSync(importedJsonl, 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as ConvLine);
+    expect(reimported).toHaveLength(2);
+    for (const line of reimported) {
+      expect(line.cwd).toBe(targetCwd);
+      expect(line.sessionId).toBe(SESSION_ID);
+      expect(line.gitBranch).toBe('main');
+      expect(line.version).toBe('1.0.0');
+    }
+    expect((reimported[0]!.message as { content: string }).content).toBe(
+      `look at ${SOURCE_CWD}/src/foo.ts`,
+    );
+
+    // history.jsonl：原有无关行保留 + 新追加一条 project=targetCwd
+    const historyAfter = fs
+      .readFileSync(path.join(fakeRoot, 'history.jsonl'), 'utf8')
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as Record<string, unknown>);
+    expect(historyAfter).toHaveLength(2);
+    const newHist = historyAfter.find((r) => r.sessionId === SESSION_ID)!;
+    expect(newHist.project).toBe(targetCwd);
+    expect(newHist.cwd).toBe(SOURCE_CWD); // cwd 字段不在替换范围
+  });
+
+  it('同 bundle 重复 import 到同一目标路径是幂等的（history 去重 key 含 project）', async () => {
+    const { exportBundle } = await import('./export-bundle.ts');
+    const { commitImport } = await import('./import-bundle.ts');
+
+    seedProject([
+      {
+        type: 'user',
+        sessionId: SESSION_ID,
+        cwd: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        message: { content: 'hello' },
+      },
+    ]);
+    seedHistory([
+      {
+        sessionId: SESSION_ID,
+        project: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        display: 'hello',
+      },
+    ]);
+
+    const exportDir = path.join(externalDest, 'bundle');
+    await exportBundle(PROJECT_ID, 'all', exportDir);
+
+    // 抹掉本机的项目目录但保留 history 的"原始一行"
+    fs.rmSync(path.join(fakeRoot, 'projects', PROJECT_ID), { recursive: true, force: true });
+
+    const targetCwd = SOURCE_CWD; // 故意 import 回原路径
+    const first = await commitImport({
+      bundleDir: exportDir,
+      targetCwd,
+      collisionPolicy: 'skip',
+    });
+    expect(first.historyLinesAdded).toBe(0); // 原始那行已经在 history 里，去重命中
+
+    // 再 import 一次：sessionId 跟本地一样 → skip
+    const second = await commitImport({
+      bundleDir: exportDir,
+      targetCwd,
+      collisionPolicy: 'skip',
+    });
+    expect(second.imported).toHaveLength(0);
+    expect(second.skipped).toHaveLength(1);
+    expect(second.historyLinesAdded).toBe(0);
+  });
+
+  it('import 到不同目标路径：history 会新增一条（project 字段不同视为不同记录）', async () => {
+    const { exportBundle } = await import('./export-bundle.ts');
+    const { commitImport } = await import('./import-bundle.ts');
+
+    seedProject([
+      {
+        type: 'user',
+        sessionId: SESSION_ID,
+        cwd: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        message: { content: 'hi' },
+      },
+    ]);
+    seedHistory([
+      {
+        sessionId: SESSION_ID,
+        project: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        display: 'hi',
+      },
+    ]);
+
+    const exportDir = path.join(externalDest, 'bundle');
+    await exportBundle(PROJECT_ID, 'all', exportDir);
+
+    fs.rmSync(path.join(fakeRoot, 'projects', PROJECT_ID), { recursive: true, force: true });
+    const targetCwd = '/Users/bob/elsewhere';
+    const res = await commitImport({
+      bundleDir: exportDir,
+      targetCwd,
+      collisionPolicy: 'skip',
+    });
+    expect(res.historyLinesAdded).toBe(1);
+
+    const rows = fs
+      .readFileSync(path.join(fakeRoot, 'history.jsonl'), 'utf8')
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .map((l) => JSON.parse(l) as Record<string, unknown>);
+    // 原有一条 + 新增一条
+    expect(rows).toHaveLength(2);
+    expect(rows.map((r) => r.project).sort()).toEqual([SOURCE_CWD, targetCwd].sort());
+  });
+
+  it('export 拒绝写到 ~/.claude/ 内', async () => {
+    const { exportBundle, ExportError } = await import('./export-bundle.ts');
+    seedProject([
+      {
+        type: 'user',
+        sessionId: SESSION_ID,
+        cwd: SOURCE_CWD,
+        timestamp: '2026-06-09T01:00:00Z',
+        message: { content: 'hi' },
+      },
+    ]);
+    const inside = path.join(fakeRoot, 'sneaky-bundle');
+    await expect(exportBundle(PROJECT_ID, 'all', inside)).rejects.toBeInstanceOf(ExportError);
+  });
+
+  it('export 拒绝非法 projectId（path traversal）', async () => {
+    const { exportBundle, ExportError } = await import('./export-bundle.ts');
+    await expect(
+      exportBundle('../etc', 'all', path.join(externalDest, 'b')),
+    ).rejects.toBeInstanceOf(ExportError);
+  });
+});