dsh-rewind-plugin 0.11.0 → 0.12.1

package/docs/format.md

@@ -16,63 +16,105 @@ Deleting the root only removes file backups; the store rebuilds from scratch.
 ```
 <root>/
 └── <sessionId>/                        # safeSessionId(sessionId)
+    ├── store                           # store-format marker ("2")
+    ├── format                          # DSH session-format marker (session.header.version)
     ├── <anchorSeq>/                    # decimal seq of the anchoring user/message
-    │   └── <callId>.json               # one committed before-backup
-    └── restore-journal-<opId>.json     # one restore-op journal
+    │   ├── <base>.json                 # one committed before-backup (metadata)
+    │   └── <base>.before               # its raw byte sidecar (the before content)
+    ├── .pending/                       # captures staged but not yet committed
+    │   └── <base>.before
+    ├── rescue/<opId>/<n>.before        # one pre-restore ("rescue") copy per op
+    └── journal-<opId>.json             # one restore-op journal
 ```
 
 - `sessionId` is sanitized to `[a-zA-Z0-9._-]`; the bare values `.` and `..`
   are replaced (`safeSessionId`) so a hostile id cannot traverse out of the
   root.
-- `callId` is sanitized to `[a-zA-Z0-9._-]` (`safeFileId`).
+- `callId` is sanitized to `[a-zA-Z0-9._-]` (`safeFileId`) and extended with an
+  8-hex digest of the unsanitized id — `<base>` is
+  `<safeFileId(callId)>-<sha256(callId)[0..8]>`, so two call ids that sanitize
+  to the same name (e.g. `a:b` / `a_b`) cannot collide. Readers never infer a
+  name: every reference names its file, so pre-digest (released v1) names keep
+  resolving.
 - `<anchorSeq>` is a decimal integer; directories with non-integer names are
   ignored by readers.
-- Journal files are recognized by the `restore-journal-` prefix; everything
-  else ending in `.json` under the session dir is treated as a checkpoint
-  entry.
+- Checkpoint entries are read from those numeric directories only
+  (`<anchorSeq>/<base>.json`). Neither marker is `.json`, and a stray `.json` in
+  the session root is ignored.
+- Journal files are recognized by the `journal-` prefix (current format) or the
+  released `restore-journal-` prefix (read-only compatibility).
+- `store` is the session's store-format marker (a decimal version, written
+  atomically); a missing marker means the released v1 string format. `format` is
+  the DSH **session**-format marker the snapshots were anchored under (see
+  `docs/snapshot-auto-cleanup.md`) — the two are independent.
 
 ## Checkpoint entry
 
-One JSON file per before-backup, named `<callId>.json`:
+One JSON file per before-backup, named `<base>.json` next to its `<base>.before`
+sidecar:
 
 ```ts
-interface CheckpointEntry {
-  callId: string      // the tool call that mutated the file
-  anchorSeq: number   // seq of the user message anchoring the turn of the change
-  path: string        // resolved display path (absolute)
-  before: string | null // full content before the change; null = file was created
-  time: number        // epoch ms, strictly increasing within a store instance
+interface CheckpointEntryJson {   // one `<base>.json`
+  store: 2              // on-disk store format (absent/1 = the released v1 string format)
+  callId: string        // the tool call that mutated the file
+  file: string          // resolved display path (absolute)
+  parent?: string       // realpath of the file's directory at commit time (the location pin)
+  blob: string | null   // sibling sidecar file name; null = the file was created
+  size: number          // byte length of the sidecar (0 when `blob` is null)
+  mode?: number         // permission bits, applied when content is restored
+  lossy?: true          // recorded from v1 content that had already lost bytes
+  time: number          // epoch ms, strictly increasing within a store instance
 }
 ```
 
+A dedup link (see below) carries `callId`, `file`, `ref`, `time` and an
+optional `parent` instead of `blob` and `size`.
+
 Semantics:
 
-- **`before` is the pre-edit state**: `null` means the call created the file.
-- **`anchorSeq` ties the backup to a user message**: rewinding to message N
-  applies every entry anchored at or after N (the boundary is inclusive).
+- **`blob` is the pre-edit state**: a string names the sidecar holding the exact
+  before bytes (copied raw, never through a JS string, so binary and non-UTF-8
+  files round-trip byte-exactly); `null` means the call created the file — valid
+  only with `size: 0` and never with `lossy`. The name is an invariant: it must
+  equal the entry's own file name minus `.json` plus `.before`.
+- **`anchorSeq` is the parent directory**, deliberately not a field of the
+  entry: rewinding to message N applies every entry anchored at or after N (the
+  boundary is inclusive).
+- **`parent` is the location pin**: the `realpath` of `dirname(file)` at commit
+  time. A restore refuses the path when its directory no longer resolves there.
+  Only the path's FINAL component is checked for links (`lstat().nlink > 1` or a
+  symlink; see `SECURITY.md`), so a repointed ancestor directory would otherwise
+  redirect the write — or the unlink of a recorded creation — outside the
+  recorded location. Absent means "no pin" and falls back to the final-component
+  check alone.
 - **`time` is the ordering key within an anchor group**: it is monotonic per
   store instance (bumped past the previous commit), so same-millisecond
   commits stay capture-ordered and a re-read always picks the same "earliest"
   entry per path.
+- **`mode` never decides an action** (a mode-only difference is a no-op); it is
+  applied, best-effort, only when content is written back.
+- **`lossy` marks a record that had already lost bytes** (v1 content that was
+  decoded lossily, or a materialized link to one): it is comparable but never
+  written back, so a lossy record can never overwrite a live file.
 - Synthetic re-check entries (external edits/deletions seen at a user-message
   boundary) use `callId = recheck-<anchorSeq>-<sha256(path) first 8 hex>`.
 
 ### Dedup link entry
 
 A tracked file that records the same `before` content as its immediately-prior
-entry for that path is stored as a **link** instead of a full copy: the entry
-carries a `ref` (the `<anchorSeq>/<callId>.json` of that prior entry) and omits
-`before`, so identical content is never duplicated across entries. A reader
-resolves the `ref` back to the terminal real snapshot; `before: null` still
-means "the file was created". A `ref` is validated as a single-level,
-`<digits>/<callId>.json` relative reference (no traversal) so a corrupt or
-hostile ref cannot escape the store root when followed. Because links reference
-prior entries, `prune` materializes a surviving link whose `ref` lands on a
-group it is about to drop before deleting that group, so no kept link is left
-dangling.
-
-Real entries (with `before`) are unchanged and read identically before and
-after this addition; a link entry is a distinct kind that lacks `before`.
+entry for that path is stored as a **link** instead of a second byte copy: the
+entry carries a `ref` (the `<anchorSeq>/<base>.json` of that prior entry) and
+omits `blob`/`size`, so identical content is never duplicated across entries. A
+reader resolves the `ref` back to the terminal real snapshot; `blob: null` (i.e.
+a recorded creation) still means "the file was created". A `ref` is validated as
+a single-level, `<digits>/<file>.json` relative reference (no traversal) so a
+corrupt or hostile ref cannot escape the store root when followed; because refs
+name the actual file, a link may point at a released-v1 entry. Because links
+reference prior entries, `prune` materializes a surviving link whose `ref` lands
+on a group it is about to drop before deleting that group, so no kept link is
+left dangling; the materialized entry keeps the bytes and the link's own
+location pin, but not the referent's `mode` (a link records no permissions of
+its own).
 
 ## Restore journal
 
@@ -80,8 +122,10 @@ One JSON file per restore operation, written **before any mutation** and
 updated as the pass applies:
 
 ```ts
+type ByteRef = { blob: string } | { text: string }   // session-relative byte file, or inline text
+
 interface RestoreJournal {
-  version: 1
+  version: 2
   id: string                    // `op-<base36 ms>-<random>`; file name suffix
   sessionId: string
   targetSeq: number             // rewind target the restore belongs to
@@ -94,20 +138,32 @@ interface RestoreJournal {
 
 interface RestoreJournalAction {
   path: string
-  action: 'restore' | 'delete'  // restore = write `before` back; delete = unlink
-  before: string | null         // target content for restore; null for delete
-  rescue: string | null         // pre-restore disk state; null = file was absent
+  action: 'restore' | 'delete'  // restore = write the content back; delete = unlink
+  before: ByteRef | null        // target content for restore; null for delete
+  rescue: ByteRef | null        // pre-restore disk state; null = file was absent
+  mode?: number                 // recorded target permissions
+  rescueMode?: number           // recorded pre-restore permissions
+  parent?: string               // checkpoint-time location pin (see the entry)
   rescueError?: string          // set when the rescue capture failed (rollback skips it)
   done: boolean                 // true once the action's fs op completed and was marked
   failed?: string               // per-action failure message (the pass never aborts)
 }
 ```
 
+A `{blob}` reference is safe and session-relative: `<anchorSeq>/<base>.before`
+(an entry sidecar) or `rescue/<opId>/<n>.before` (a rescue copy), validated on
+both write and read so a corrupt or hostile journal can never point a restore or
+a rollback outside the store. `{text}` refs carry content that has no sidecar:
+released-v1 entry content, or a legacy journal's inline strings.
+
 States: `running` and `rollback-running` are non-terminal; `completed` /
-`rolled-back` are terminal. A restart never rewrites the journal — a
-reconciliation *reports* a still non-terminal op as `interrupted` (or
-`recovery-required` when the journal is corrupt or a rollback could not
-complete), while the journal itself stays `running` / `rollback-running`.
+`rolled-back` are terminal. Reconciliation *reports* a still non-terminal op as
+`interrupted` (or `recovery-required` when the journal is corrupt or a rollback
+could not complete), while the journal itself stays `running` /
+`rollback-running`. A journal read back from a legacy file (`restore-journal-`
+prefix, `version: 1`, inline strings) is rewritten IN PLACE as `version: 2` once
+a redo or rollback pass completes, so the same op never leaves two divergent
+versions on disk.
 
 ## Write guarantees
 
@@ -116,9 +172,29 @@ complete), while the journal itself stays `running` / `rollback-running`.
   file — never a readable half-written target — and readers ignore temp files
   (they do not end in `.json`). The next write of the same target overwrites
   a leftover temp.
+- **Bytes before metadata**: a checkpoint commit places the sidecar first
+  (a staged capture is `rename`d out of `.pending/`; other sources are written
+  temp-then-rename) and only then publishes the entry JSON, so a crash can
+  leave an unreferenced sidecar but never an entry whose bytes are missing.
+  A sidecar that is missing or shorter than `size` is a per-file failure, never
+  a silent "the file was created".
+- **Pinned location**: every record this build writes — entry, link and journal
+  action — carries where the tracked file's directory resolved at commit time
+  (the `parent` pin, best-effort), and a restore re-checks it before touching the
+  path — the initial pass, a post-restart `continueRestore` and a
+  `rollbackRestore` alike (the journal carries the pin). A directory that
+  resolves elsewhere is refused and reported, so a restore can never write or
+  unlink outside the recorded location; a record with no pin (released-v1 data,
+  or a commit whose parent could not be resolved) falls back to the
+  final-component link check alone. A parent chain that is GONE is still
+  recreated — the plugin restores files whose directory was deleted — but only
+  while its nearest surviving ancestor resolves inside the pin. A stable
+  symlinked ancestor is never refused: both sides of the comparison are
+  `realpath`s.
 - **Journal before mutation**: the rescue state of every planned path is
-  captured and the intent journal persisted atomically BEFORE the first fs
-  mutation; each action is marked `done` as it is applied.
+  captured as a raw byte copy and the intent journal — references only —
+  persisted atomically BEFORE the first fs mutation; each action is marked
+  `done` as it is applied.
 - **Disk is truth**: after a restart, reconciliation compares the real disk
   against each action's goal (the restore target for `running` journals, the
   rescue state for `rollback-running` / `recovery-required` ones). A path
@@ -126,32 +202,62 @@ complete), while the journal itself stays `running` / `rollback-running`.
 - **Bounded storage**: `prune` keeps the newest 100 anchor groups per session
   (`MAX_ANCHOR_GROUPS`), materializing any surviving dedup link that references
   a group being dropped before deleting whole anchor directories; it also
-  recycles terminal journals (`completed` / `rolled-back`). Non-terminal and
-  corrupt journals are always kept. Across sessions, `pruneStale` removes whole
-  long-inactive session directories whose newest member stamp is older than a
-  configurable idle cutoff (default off), so the store root does not grow
-  without bound either.
+  recycles terminal journals (`completed` / `rolled-back`) together with their
+  `rescue/<opId>/` bytes, and collects `.pending/` captures older than 24 h that
+  no commit consumed. A group a non-terminal journal still references is pinned
+  — evicting it would make "continue finishes the interrupted op" impossible —
+  so the effective window may exceed `keep` until that op is resolved.
+  Non-terminal and corrupt journals are always kept. Across sessions,
+  `pruneStale` removes whole long-inactive session directories whose newest
+  member stamp is older than a configurable idle cutoff (default off), so the
+  store root does not grow without bound either.
 
 ## Validation and failure policy
 
-- **Entries**: a missing or malformed entry is read as `undefined` (silently
-  skipped) — losing one backup, never the recovery path.
+- **Entries**: a missing, malformed, or self-contradictory entry is read as
+  `undefined` (silently skipped) — losing one backup, never the recovery path.
+  Contradictions are never guessed at: a `blob: null` with `size !== 0` or with
+  `lossy`, a `blob` that is not this entry's sidecar name, and a non-string
+  `before` in a v1 record are all corruption, and guessing an entry's kind is
+  how a restore turns into a delete. An absent or malformed `parent` is not
+  corruption: it means "no pin", so the entry falls back to the released
+  final-component rule. Two cases are *not* silent skips: an entry
+  whose `store` is newer than this build fails the whole operation closed (see
+  Versioning), and a record whose sidecar is missing or too short is a per-file
+  failure that the restore reports — never a delete of the live file.
 - **Journals**: a corrupt or schema-invalid journal **fails loud** —
   `reconcileRestores` reports it as `recovery-required` and never drops it,
   because dropping it would silently erase the interrupted restore's recovery
-  record.
+  record. A `ref` with a traversal, absolute, or unknown-root segment counts as
+  corrupt.
 - **Journal IO**: best-effort by design — if a journal cannot be written, the
   restore proceeds with pre-journal semantics (crash safety degrades,
   behavior does not).
 
 ## Versioning policy
 
-The journal schema is `version: 1` (currently descriptive — `isRestoreJournal`
-validates shape, not version). Checkpoint entries carry no version field. A
-future incompatible format should either make readers reject an unknown
-`version` (there is no best-effort fallback or legacy coercion) or move the
-state root (e.g. `rewind-snapshots/v2`) and ship an explicit migration tool.
-Old-format data is never silently re-interpreted.
+The format is versioned twice: a session-level `store` marker (the value is the
+current `CURRENT_STORE_VERSION`, 2) and a self-describing field on every record
+(`store` on entries, `version` on journals). A missing `store` marker (or `1`)
+means the released v1 string format, which is still read but never migrated. A
+`store` **above** the current version fails the whole operation closed — no file
+restore and no new entry written into a store a newer build owns (an explicit
+clear or the age-based sweep is not version-gated) — while the conversation
+rewind itself keeps working (it does not depend on snapshots). A journal whose
+`version` is present but neither 1 nor 2 is corrupt and is reported
+`recovery-required` (see Validation).
+
+Because compatibility is not safe in both directions, the byte format reuses
+none of v1's path/state keys (`path`, `anchorSeq`, `before`) and does not carry
+`anchorSeq` (it equals the parent directory). A released v1 build therefore
+rejects each such entry instead of reading it as "the file was created", so a
+downgrade cannot delete workspace files; that field-name contract is pinned by
+`tests/downgrade-safety.test.ts`. Compatibility means reading old data, not
+repairing it: bytes the v1 build had already lost cannot be recovered.
+
+A future incompatible format should raise the marker/version (readers already
+fail closed above their own version) or move the state root and ship an explicit
+migration tool. Old-format data is never silently re-interpreted.
 
 ## Cleanup policy persistence
 

package/docs/snapshot-auto-cleanup.md

@@ -50,19 +50,17 @@ The auto-cleanup switch and the idle-day cutoff live in the **dsh-settings confi
 
 ## When automatic cleanup runs
 
-Automatic cleanup checks at most **once per run** (a restart lets it check again),
-on the first session activity (a message you send or a tool call that finishes),
-and only when it's enabled and at least 24 hours have passed since the last
-check. The 24-hour clock is saved to `<dsh home>/snapshot-cleanup-last-sweep.json`,
-so restarting doesn't reset it. It runs in the background and never blocks
-what you're doing.
-
-If you want a change to take effect right away, use `run`; automatic cleanup
-picks up a fresh setting on the next run.
+When it's enabled, automatic cleanup runs in the background at most **once a
+day** — and only after 24 hours have passed since the last cleanup. The clock is
+saved to `<dsh home>/snapshot-cleanup-last-sweep.json`, so restarting the host
+can't make it run early. To clean up right now instead of waiting, use
+`/snapshot-auto-cleanup run`.
 
 ## Safety
 
-- Only rewind **snapshots** (the file backups) are ever removed. Your
+- Only rewind **snapshots** are ever removed: a session's snapshot directory
+  holds the before-write file backups plus their bookkeeping (staged captures,
+  rescue copies, restore journals), and that is all the cleanup touches. Your
   conversation is never touched, and the plugin never rewrites or deletes your
   session history.
 - Automatic cleanup never removes your **active** session's snapshots — only

package/docs/snapshot-auto-cleanup.zh.md

@@ -38,13 +38,11 @@
 
 ## 自动清理何时运行
 
-自动清理每次运行（宿主启动）**最多检查一次**，发生在首次活动时（你发出一条消息或某次工具调用完成），且仅在**已开启**且距上次检查**已满 24 小时**时才执行。这个 24 小时时钟会写入 `<dsh home>/snapshot-cleanup-last-sweep.json`，重启不会重置。它后台运行，从不阻塞你在做的事。
-
-想让改动立即生效，请用 `run`；自动清理要到下次运行才会采用新设置。
+开启后，自动清理在后台运行，**一天最多一次**——且距上次清理已满 24 小时才会执行。这个时钟保存在 `<dsh home>/snapshot-cleanup-last-sweep.json`，所以重启宿主也不会让它提前运行。想立刻清理而不等待，用 `/snapshot-auto-cleanup run`。
 
 ## 安全
 
-- 只会移除回退用的**快照**（那份文件备份）。你的对话绝不会被动到，插件也绝不改写或删除你的会话历史。
+- 只会移除回退用的**快照**：一个会话的快照目录里只有写前文件备份及其附属记录（暂存副本、救援副本、还原日志），清理也只动这些。你的对话绝不会被动到，插件也绝不改写或删除你的会话历史。
 - 自动清理**永不**移除你**当前活跃**会话的快照——只清理已失活超过阈值的会话。
 - `run --current` 会清空当前会话的快照。这对该会话的文件回退历史是**不可逆**的：你无法回退到清空之前的代码状态，但你的对话保持完整，会话会从"现在"开始重新记录快照。
 

package/lib/client.js

@@ -167,6 +167,48 @@ function rewindOptionsFromCandidates(candidates, t) {
   }));
 }
 
+// src/client/log.ts
+var NS = "dsh-rewind";
+var DEBUG_KEY = "dsh-rewind.debug";
+var ALWAYS_ON = /* @__PURE__ */ new Set(["error", "warn"]);
+function switchValue() {
+  try {
+    return window.localStorage.getItem(DEBUG_KEY) ?? "";
+  } catch {
+    return "";
+  }
+}
+function matches(value, ns) {
+  for (const entry of value.split(",")) {
+    const part = entry.trim();
+    if (part === "") continue;
+    if (part === "*" || part === `${NS}*`) return true;
+    if (part.endsWith("*")) {
+      if (ns.startsWith(part.slice(0, -1))) return true;
+    } else if (ns === part) {
+      return true;
+    }
+  }
+  return false;
+}
+function tag(scope) {
+  return `[${NS}:${scope}]`;
+}
+function log(level, scope, message, data) {
+  if (ALWAYS_ON.has(level)) {
+    console[level](tag(scope), message, data);
+    return;
+  }
+  if (!matches(switchValue(), `${NS}:${scope}`)) return;
+  console.info(tag(scope), message, data);
+}
+var rewindLog = {
+  error: (scope, message, data) => log("error", scope, message, data),
+  warn: (scope, message, data) => log("warn", scope, message, data),
+  info: (scope, message, data) => log("info", scope, message, data),
+  debug: (scope, message, data) => log("debug", scope, message, data)
+};
+
 // src/client/styles.ts
 var CLASS = {
   button: "dsh-rewind-btn",
@@ -663,8 +705,21 @@ function isPreviewFor(node, seq) {
 }
 async function previewImpact(session, chatOf, seq, watch) {
   const known = knownCommandSeqs(session, chatOf, (node) => isPreviewFor(node, seq));
-  const result = await session.command(`/rewind preview @${seq} both`);
-  if (!result.ok || result.value?.matched !== true) return null;
+  let result;
+  try {
+    result = await session.command(`/rewind preview @${seq} both`);
+  } catch (error) {
+    rewindLog.warn("preview", `preview command threw for @${seq}`, error);
+    return { kind: "error", text: error instanceof Error ? error.message : String(error) };
+  }
+  if (!result.ok) {
+    rewindLog.warn("preview", `preview command rejected for @${seq}`, result.error);
+    return { kind: "error", text: `${result.error.code}: ${result.error.message}` };
+  }
+  if (result.value?.matched !== true) {
+    rewindLog.warn("preview", `preview command was not matched for @${seq}`);
+    return { kind: "error", text: "the rewind command is not registered on this host" };
+  }
   return waitForCommand(session, chatOf, (node) => isPreviewFor(node, seq) && !known.has(node.seq), 8e3, watch);
 }
 function el(tag2, className, text) {
@@ -912,13 +967,13 @@ function openPopover(opts) {
     impactOutcome = outcome;
     if (outcome !== null && outcome.kind === "success") {
       bothState = { state: hasFileImpact(outcome.text) ? "hasChanges" : "noChanges" };
-    } else if (outcome !== null && outcome.kind === "error") {
-      bothState = { state: "error", message: outcome.text ?? "unknown error" };
+    } else {
+      bothState = { state: "error", message: outcome?.text ?? "preview command timed out" };
     }
     renderModes();
     shell.position();
   })().catch(() => {
-    bothState = { state: "hasChanges" };
+    bothState = { state: "error", message: "unexpected error" };
     renderModes();
     shell.position();
   });
@@ -948,48 +1003,6 @@ function retractSpan(steering, targetId) {
   return steering.slice(index).map((item) => item.id);
 }
 
-// src/client/log.ts
-var NS = "dsh-rewind";
-var DEBUG_KEY = "dsh-rewind.debug";
-var ALWAYS_ON = /* @__PURE__ */ new Set(["error", "warn"]);
-function switchValue() {
-  try {
-    return window.localStorage.getItem(DEBUG_KEY) ?? "";
-  } catch {
-    return "";
-  }
-}
-function matches(value, ns) {
-  for (const entry of value.split(",")) {
-    const part = entry.trim();
-    if (part === "") continue;
-    if (part === "*" || part === `${NS}*`) return true;
-    if (part.endsWith("*")) {
-      if (ns.startsWith(part.slice(0, -1))) return true;
-    } else if (ns === part) {
-      return true;
-    }
-  }
-  return false;
-}
-function tag(scope) {
-  return `[${NS}:${scope}]`;
-}
-function log(level, scope, message, data) {
-  if (ALWAYS_ON.has(level)) {
-    console[level](tag(scope), message, data);
-    return;
-  }
-  if (!matches(switchValue(), `${NS}:${scope}`)) return;
-  console.info(tag(scope), message, data);
-}
-var rewindLog = {
-  error: (scope, message, data) => log("error", scope, message, data),
-  warn: (scope, message, data) => log("warn", scope, message, data),
-  info: (scope, message, data) => log("info", scope, message, data),
-  debug: (scope, message, data) => log("debug", scope, message, data)
-};
-
 // src/client/portals.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
 function fillComposerEditable(text) {
@@ -1041,7 +1054,12 @@ async function runRewindAndFill(session, seq, mode, currentSessionId, chatOf, wa
     rewindLog.warn("refill", `rewind command threw, skipping refill @${seq}`, error);
     return;
   }
-  if (!result.ok || result.value?.matched !== true) {
+  if (!result.ok) {
+    rewindLog.warn("refill", `rewind command rejected for @${seq}`, result.error);
+    return;
+  }
+  if (result.value?.matched !== true) {
+    rewindLog.warn("refill", `rewind command was not matched for @${seq}`);
     return;
   }
   let outcome;
@@ -1130,6 +1148,13 @@ function collectTargets(chat, hiddenSeqs) {
   }
   return targets;
 }
+function isRewindInertSession(snapshot) {
+  return snapshot.subagent !== null && snapshot.subagent !== void 0;
+}
+function collectDurableTargets(snapshot, chat, hiddenSeqs) {
+  if (chat === void 0 || isRewindInertSession(snapshot)) return [];
+  return collectTargets(chat, hiddenSeqs);
+}
 function bubbleTextOf(row) {
   const clone = row.cloneNode(true);
   clone.lastElementChild?.remove();
@@ -1205,7 +1230,7 @@ function RewindPortals({ sessionId, sessionOf, chatOf, currentSessionId, watchCh
           hidden.current.delete(seat);
         }
       }
-      const durable = chat === void 0 ? [] : collectTargets(chat, hiddenSeqs);
+      const durable = collectDurableTargets(snapshot, chat, hiddenSeqs);
       const next = [...durable, ...collectPendingTargets(snapshot)];
       setTargets((current) => sameTargets(current, next) ? current : next);
     };
@@ -1345,8 +1370,8 @@ function createRewindBridge(deps) {
 }
 
 // src/client/build-info.ts
-var PLUGIN_VERSION = true ? "0.11.0" : "dev";
-var BUILD_HASH = true ? "d770983e" : "dev";
+var PLUGIN_VERSION = true ? "0.12.1" : "dev";
+var BUILD_HASH = true ? "248f750a" : "dev";
 
 // src/client/locales.ts
 var zh = {
@@ -1705,6 +1730,7 @@ function apply(ctx) {
     const commandUi = ctx.get("commandUi");
     const hasCandidates = (sessionId) => {
       const face = sessionId === void 0 ? void 0 : sessionOf(sessionId);
+      if (face === void 0 || isRewindInertSession(face.getSnapshot())) return false;
       const chat = chatOf(face);
       return chat !== void 0 && rewindCandidatesOfChat(chat).length > 0;
     };