dsh-turn-undo 0.0.4 → 0.0.6

package/client.js

@@ -146,6 +146,10 @@ window.__ModuleLoader__.load({
           '.dtu-trigger{display:inline-flex;align-items:center;justify-content:center;width:24px;height:24px;padding:0;border:0;border-radius:6px;background:transparent;color:var(--dsw-alias-label-tertiary);cursor:pointer}',
           '.dtu-trigger:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-secondary)}',
           '.dtu-trigger:disabled{cursor:not-allowed;opacity:.5}',
+          // 点击后浏览器保留 :focus，hover 底色会「粘住」不恢复 —— 鼠标移开时
+          // 显式清掉 focus/active 态的背景与描边。
+          '.dtu-trigger:focus{outline:none}',
+          '.dtu-trigger:focus:not(:hover),.dtu-trigger:focus-visible:not(:hover),.dtu-trigger:active:not(:hover){background:transparent;color:var(--dsw-alias-label-tertiary)}',
           '.dtu-overlay{position:fixed;inset:0;background:rgba(0,0,0,.5);display:flex;align-items:center;justify-content:center;z-index:10000}',
           '.dtu-dialog{box-sizing:border-box;width:min(560px,100%);max-height:calc(100dvh - 48px);overflow:auto;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 8px 32px rgba(0,0,0,.2)}',
           '.dtu-body{display:flex;flex-direction:column;gap:14px;width:100%;min-width:0;max-width:100%;box-sizing:border-box;padding:18px}',
@@ -197,33 +201,7 @@ window.__ModuleLoader__.load({
         document.head.appendChild(styleEl)
       }
 
-      function openRestoredSession(sessionId, draftText) {
-        try {
-          ctx.sessions.open(sessionId)
-        } catch (error) {
-          console.warn('[turn-undo] openRestoredSession open failed:', error.message)
-          return
-        }
-        if (!draftText) return
-        function trySetDraft(remaining) {
-          if (remaining <= 0) return
-          try {
-            var scope = ctx.sessions.scope(sessionId)
-            if (scope !== undefined) {
-              ctx.conversation.input.for(scope).setDraft(draftText)
-              return
-            }
-          } catch (error) {
-            if (remaining <= 1) {
-              console.warn('[turn-undo] openRestoredSession setDraft failed:', error.message)
-            }
-          }
-          setTimeout(function () { trySetDraft(remaining - 1) }, 100)
-        }
-        trySetDraft(20)
-      }
-
-      ctx.inject(['slots', 'sessions', 'conversation'], function (scope) {
+      ctx.inject(['slots', 'conversation', 'uiWorkspace'], function (scope) {
         scope.effect(function () {
           return scope.slots.inject('conversation.session.header.actions', function () {
             return scope.slots.register({
@@ -231,13 +209,21 @@ window.__ModuleLoader__.load({
               id: 'turn-undo-portals',
               order: 100,
               inject: function () {
-                var sessionsSvc = scope.sessions
+                var workspaceSvc = scope.uiWorkspace
                 var conversationSvc = scope.conversation
                 return {
                   openRestoredSession: function (newSessionId, draftText) {
-                    // Open first: the input shell only exists after the session binding is materialized.
-                    if (sessionsSvc && sessionsSvc.open) {
-                      sessionsSvc.open(newSessionId)
+                    // 导航必须走 uiWorkspace：ISessions 没有 open()，
+                    // 旧的 sessionsSvc.open(...) 永远被 if 守卫静默跳过 —— 这正是
+                    // 「改名了但新会话没打开」的根因。
+                    try {
+                      if (workspaceSvc && typeof workspaceSvc.openSession === 'function') {
+                        workspaceSvc.openSession(newSessionId)
+                      } else {
+                        console.warn('[turn-undo] uiWorkspace.openSession unavailable; new session not opened')
+                      }
+                    } catch (e) {
+                      console.warn('[turn-undo] Failed to open restored session:', e.message)
                     }
                     if (!conversationSvc || !conversationSvc.input || !draftText) return
                     function trySetDraft(remaining) {
@@ -395,7 +381,7 @@ window.__ModuleLoader__.load({
         var previewState = useState(null)
         var preview = previewState[0]
         var setPreview = previewState[1]
-        var loadingState = useState(true)
+        var loadingState = useState(false)
         var loading = loadingState[0]
         var setLoading = loadingState[1]
         var errorState = useState(null)
@@ -408,28 +394,17 @@ window.__ModuleLoader__.load({
         var done = doneState[0]
         var setDone = doneState[1]
 
-        useEffect(function () {
-          var cancelled = false
-          setLoading(true)
-          setError(null)
-          fetch(API_PATH + '?sessionId=' + encodeURIComponent(sessionId) + '&messageSeq=' + messageSeq + '&promptText=' + encodeURIComponent(messageText), {
-            method: 'GET', headers: { 'Accept': 'application/json' }, cache: 'no-store',
-          })
-            .then(function (res) { return res.json() })
-            .then(function (data) { if (!cancelled) setPreview(data) })
-            .catch(function (err) { if (!cancelled) setError(err.message || '请求失败') })
-            .finally(function () { if (!cancelled) setLoading(false) })
-          return function () { cancelled = true }
-        }, [])
+        // NOTE: preview 只在用户点开弹框时请求（见 show()）。挂载时预取毫无
+        // 意义——按钮只渲染图标，不消费 preview——却会让每个会话在打开瞬间
+        // 为每条用户消息各发一次全工作区扫描请求（实测单次 1.2–2.7 秒）。
 
         function show() {
           setOpen(true)
           setPreview(null)
           setDone(false)
           setLoading(true)
-          // NOTE: cancelled 只存在于 mount effect 闭包，show() 引用它会抛
-          // ReferenceError → setLoading(false) 永不执行 → 弹框一直"正在检查…"，
-          // 且未捕获错误可能导致 React 卸下 portal（按钮消失）。必须无条件收尾。
+          // NOTE: 必须无条件收尾：任何未捕获错误都会让 setLoading(false) 不执行，
+          // 弹框会永远停在"正在检查…"，且可能让 React 卸下 portal（按钮消失）。
           fetch(API_PATH + '?sessionId=' + encodeURIComponent(sessionId) + '&messageSeq=' + messageSeq + '&promptText=' + encodeURIComponent(messageText), {
             method: 'GET', headers: { 'Accept': 'application/json' }, cache: 'no-store',
           })
@@ -468,6 +443,7 @@ window.__ModuleLoader__.load({
 
         var changes = (preview && Array.isArray(preview.changes)) ? preview.changes : []
         var noSnapshot = (preview && preview.noSnapshot) === true
+        var noBaseline = (preview && preview.noBaseline) === true
         var previewError = (preview && preview.error) ? preview.error : null
 
         return h('div', { className: 'dtu-container' },
@@ -491,7 +467,8 @@ window.__ModuleLoader__.load({
             sessionId: sessionId, messageText: messageText,
             onClose: close, preview: preview, loading: loading, error: error,
             applying: applying, done: done, changes: changes,
-            previewError: previewError, noSnapshot: noSnapshot, canApply: canApply, applyRestore: applyRestore,
+            previewError: previewError, noSnapshot: noSnapshot, noBaseline: noBaseline,
+            canApply: canApply, applyRestore: applyRestore,
           }) : null,
         )
       }
@@ -629,6 +606,7 @@ window.__ModuleLoader__.load({
         var changes = props.changes
         var previewError = props.previewError
         var noSnapshot = props.noSnapshot
+        var noBaseline = props.noBaseline
         var canApply = props.canApply
         var applyRestore = props.applyRestore
         
@@ -662,9 +640,11 @@ window.__ModuleLoader__.load({
                 previewError ? h('p', { className: 'dtu-error' }, previewError) : null,
                 (!loading && noSnapshot)
                   ? h('p', { className: 'dtu-status' }, '该时点没有可用快照，将仅创建新会话。') : null,
-                (!loading && !previewError && !noSnapshot && changes.length === 0)
+                (!loading && !noSnapshot && noBaseline)
+                  ? h('p', { className: 'dtu-status' }, '这条消息之前没有可用快照，无法恢复文件，将仅创建新会话。') : null,
+                (!loading && !previewError && !noSnapshot && !noBaseline && changes.length === 0)
                   ? h('p', { className: 'dtu-status' }, '这条消息之前没有需要恢复的文件。') : null,
-                (!loading && !previewError && changes.length > 0)
+                (!loading && !previewError && !noSnapshot && !noBaseline && changes.length > 0)
                   ? h('div', { className: 'dtu-section' },
                       h('div', { className: 'dtu-section-label' }, '将影响的文件 (' + changes.length + ' 个)'),
                       h('div', { className: 'dtu-files' },
@@ -779,7 +759,7 @@ window.__ModuleLoader__.load({
     }
 
     exports.apply = apply
-    exports.inject = ['slots', 'sessions', 'conversation']
+    exports.inject = ['slots', 'conversation', 'uiWorkspace']
     return module.exports
   },
 })

package/index.js

@@ -41,8 +41,16 @@ export const name = 'turn-undo'
 export { SnapshotStore }
 
 // Injected services (via ctx.inject in apply()): webServer, sessions,
-// sessionQuery, agents, sessionController.
-export const inject = ['webServer', 'sessions', 'sessionQuery', 'agents', 'sessionTitle', 'sessionController']
+// sessionQuery, agents, sessionController, workspaceRegistry.
+export const inject = [
+  'webServer',
+  'sessions',
+  'sessionQuery',
+  'agents',
+  'sessionTitle',
+  'sessionController',
+  'workspaceRegistry',
+]
 
 // ---- Configuration defaults ----
 const DEFAULT_SNAPSHOT_TTL_DAYS = 7
@@ -51,6 +59,12 @@ const DEFAULT_MAX_FILE_BYTES = 10 * 1024 * 1024 // 10 MB
 const DEFAULT_MAX_FILES_PER_SNAPSHOT = 10000
 const DEFAULT_MAX_SNAPSHOT_BYTES = 500 * 1024 * 1024 // 500 MB
 const DEFAULT_SNAPSHOT_DELAY_MS = 250
+// Object-store GC: unreferenced objects are only reclaimed once they are older
+// than the grace window (a capture writes objects before its manifest, so a
+// young unreferenced object may still be in flight). The sweep itself is
+// throttled because it stats every object and parses every surviving manifest.
+const DEFAULT_OBJECT_GC_GRACE_MS = 60 * 60 * 1000
+const DEFAULT_OBJECT_GC_INTERVAL_MS = 6 * 60 * 60 * 1000
 const DEFAULT_EXCLUDES = [
   'node_modules/',
   '.git/',
@@ -187,6 +201,9 @@ class SnapshotStore {
     this.maxBytes = cfg.maxSnapshotBytes ?? DEFAULT_MAX_SNAPSHOT_BYTES
     this.ttlDays = cfg.snapshotTtlDays ?? DEFAULT_SNAPSHOT_TTL_DAYS
     this.maxSnapshots = cfg.maxSnapshotsPerSession ?? DEFAULT_MAX_SNAPSHOTS_PER_SESSION
+    this.objectGcGraceMs = cfg.objectGcGraceMs ?? DEFAULT_OBJECT_GC_GRACE_MS
+    this.objectGcIntervalMs = cfg.objectGcIntervalMs ?? DEFAULT_OBJECT_GC_INTERVAL_MS
+    this.lastObjectSweep = 0
     this.objDir = join(this.base, 'objects')
     this.snapDir = join(this.base, 'snapshots')
   }
@@ -511,20 +528,6 @@ class SnapshotStore {
     return result
   }
 
-  /** Read manifest entries into a map of path -> content */
-  readManifestContents(manifest) {
-    const contents = {}
-    for (const [rel, entry] of Object.entries(manifest)) {
-      if (entry.kind === 'file' && entry.hash) {
-        const content = this.readObjectContent(entry.hash)
-        if (content !== null) {
-          contents[rel] = content
-        }
-      }
-    }
-    return contents
-  }
-
   /** Load snapshot manifests for a session, oldest first. */
   loadChain(sessionId) {
     const dir = join(this.snapDir, sessionId)
@@ -649,6 +652,86 @@ class SnapshotStore {
         try { unlinkSync(join(dir, remaining[i])) } catch {}
       }
     }
+    // Manifests are pruned above; reclaim the objects they no longer reference.
+    // Without this the content-addressed store grows forever (an observed store
+    // reached 983 MB / 40k files whose manifests had long been deleted).
+    try { this.sweepObjects() } catch (e) {
+      console.warn('[turn-undo] object sweep failed:', e.message)
+    }
+  }
+
+  /**
+   * Mark-and-sweep the content-addressed object store.
+   *
+   * Every hash reachable from a surviving manifest is marked; unreferenced
+   * objects older than the grace window are deleted. Objects younger than the
+   * grace window are kept because capture() writes objects before it writes
+   * the manifest that references them — deleting those would corrupt an
+   * in-flight snapshot.
+   *
+   * Throttled to `objectGcIntervalMs` since the mark phase parses every
+   * surviving manifest.
+   * @param opts - `force` bypasses the throttle (tests / explicit invocation);
+   *   `dryRun` counts what would be reclaimed without deleting anything.
+   * @returns Counts, or null when the throttle skipped this call.
+   */
+  sweepObjects(opts = {}) {
+    const now = Date.now()
+    if (!opts.force && now - this.lastObjectSweep < this.objectGcIntervalMs) return null
+    this.lastObjectSweep = now
+
+    // ── Mark ──────────────────────────────────────────────────────────
+    const referenced = new Set()
+    let unreadable = 0
+    if (existsSync(this.snapDir)) {
+      for (const sessionId of readdirSync(this.snapDir)) {
+        const dir = join(this.snapDir, sessionId)
+        let dirStat
+        try { dirStat = statSync(dir) } catch { continue }
+        if (!dirStat.isDirectory()) continue
+        for (const f of readdirSync(dir)) {
+          if (!f.endsWith('.json')) continue
+          const data = readJsonFile(join(dir, f))
+          if (!data || !data.manifest) { unreadable++; continue }
+          for (const entry of Object.values(data.manifest)) {
+            if (entry && typeof entry.hash === 'string') referenced.add(entry.hash)
+          }
+        }
+      }
+    }
+
+    // Fail-safe: an unparseable manifest would contribute no marks, so its
+    // objects would look unreferenced and be deleted — silently destroying a
+    // snapshot that is merely unreadable. Abort rather than sweep on a
+    // possibly-incomplete mark set.
+    if (unreadable > 0) {
+      console.warn(`[turn-undo] object sweep skipped: ${unreadable} manifest(s) unreadable`)
+      return { removed: 0, freedBytes: 0, keptYoung: 0, referenced: referenced.size, aborted: 'unreadable-manifest' }
+    }
+
+    // ── Sweep ─────────────────────────────────────────────────────────
+    let removed = 0
+    let freedBytes = 0
+    let keptYoung = 0
+    if (!existsSync(this.objDir)) return { removed, freedBytes, keptYoung, referenced: referenced.size }
+    for (const name of readdirSync(this.objDir)) {
+      if (referenced.has(name)) continue
+      const abs = join(this.objDir, name)
+      let st
+      try { st = statSync(abs) } catch { continue }
+      if (!st.isFile()) continue
+      if (now - st.mtimeMs < this.objectGcGraceMs) { keptYoung++; continue }
+      if (opts.dryRun) { removed++; freedBytes += st.size; continue }
+      try {
+        unlinkSync(abs)
+        removed++
+        freedBytes += st.size
+      } catch {}
+    }
+    if (removed > 0) {
+      console.info(`[turn-undo] object sweep reclaimed ${removed} objects (${Math.round(freedBytes / 1048576)} MB), kept ${keptYoung} young, ${referenced.size} referenced`)
+    }
+    return { removed, freedBytes, keptYoung, referenced: referenced.size }
   }
 }
 
@@ -693,23 +776,44 @@ function resolveForkBoundary(source, messageSeq, promptText) {
       return { boundary: null, turn: null, cwd, reason: 'no-turn-start' }
     }
     const previousEnd = events.findLast(e => e.type === 'turn/end' && e.seq < start.seq)
+
+    // 第一条消息（无前一个 turn/end）也必须 fork：边界取 turn/start 前
+    // 最近的一个「索引==seq」有效事件（会话初始化完成处），子会话继承
+    // workspace/preset/cwd，而不是 create() 一个空白会话 —— 这正是
+    // 「点击撤销后直接创建新会话、没有 fork 出会话」的根因。
+    let boundary = previousEnd ? previousEnd.seq : null
+    if (boundary !== null && !(events[boundary] && events[boundary].seq === boundary)) {
+      boundary = null
+    }
+    if (boundary === null) {
+      const startIdx = events.indexOf(start)
+      for (let i = startIdx - 1; i >= 0; i--) {
+        if (events[i] && events[i].seq === i) { boundary = i; break }
+      }
+    }
     return {
-      boundary: previousEnd ? previousEnd.seq : null,
+      boundary,
       turn,
       cwd,
-      reason: previousEnd ? 'ok' : 'no-previous-end',
+      reason: boundary !== null ? 'ok' : 'no-previous-end',
     }
   }
 
   // ── Strategy 2: text-based fallback ────────────────────────────────
+  // Only reached for event streams that carry no usable `seq` (persisted
+  // sessions). When the stream DOES carry seqs but none is this user message,
+  // the requested point genuinely does not exist — guessing a different
+  // message here would silently restore the workspace to the wrong turn.
+  const seqsAvailable = events.some(e => typeof e.seq === 'number')
+  if (seqsAvailable && typeof messageSeq === 'number') {
+    return { boundary: null, turn: null, cwd, reason: 'no-matching-message' }
+  }
+
   // Use promptText to match the user message, avoiding the bug of
   // treating messageSeq as an array index when seq is unavailable.
-  //
-  // If promptText is not provided, find the latest user message as a
-  // safe fallback.
   if (promptText) {
     const normalizedPromptText = promptText.trim().substring(0, 200).toLowerCase()
-    message = events.find(e => (
+    const candidates = events.filter(e => (
       e.type === 'user/message'
       && e.data?.source && typeof e.data.source === 'object'
       && e.data.source.kind === 'user'
@@ -721,20 +825,13 @@ function resolveForkBoundary(source, messageSeq, promptText) {
         return text.includes(normalizedPromptText) || normalizedPromptText.includes(text)
       })
     ))
-  }
-
-  // If promptText matching failed or not provided, find the latest user message.
-  if (!message) {
-    for (let i = events.length - 1; i >= 0; i--) {
-      const e = events[i]
-      if (e.type === 'turn/start') break
-      if (e.type === 'user/message'
-          && e.data?.source && typeof e.data.source === 'object'
-          && e.data.source.kind === 'user') {
-        message = e
-        break
-      }
+    // Ambiguous text must not be resolved by position: the first match is
+    // routinely an earlier prompt that merely contains the same words
+    // ("继续" and the like).
+    if (candidates.length > 1) {
+      return { boundary: null, turn: null, cwd, reason: 'ambiguous-message' }
     }
+    if (candidates.length === 1) message = candidates[0]
   }
 
   if (!message) return { boundary: null, turn: null, cwd, reason: 'no-user-message' }
@@ -964,20 +1061,55 @@ async function executeSurfaceRewind(agent, targetSeq) {
  *   no completed turn before it (e.g. the very first user message).
  * @returns the new child session id.
  */
+/**
+ * Find the workspace that owns `sessionId`, so a `cwd`-less `create()` can pass
+ * `workspaceId` and get attached to the workspace catalogue (visible in the
+ * sidebar). Mirrors upstream `SessionController.forkWorkspace`: only sessions
+ * already indexed as live are visible through `WorkspaceRegistry.list()`.
+ * @returns the owning workspace id, or `undefined` when the session is not
+ * indexed (caller then falls back to a `cwd`-only create).
+ */
+function findWorkspaceIdForSession(ctx, sessionId) {
+  try {
+    const registry = ctx.workspaceRegistry
+    if (!registry || typeof registry.list !== 'function') return undefined
+    for (const workspace of registry.list()) {
+      const ids = workspace && workspace.sessionIds
+      if (Array.isArray(ids) && ids.includes(sessionId)) return workspace.id
+    }
+  } catch (e) {
+    console.warn('[turn-undo] Workspace lookup failed (falling back to cwd):', e.message)
+  }
+  return undefined
+}
+
 async function forkAndMarkUndone(ctx, sessionId, messageSeq, promptText) {
   const source = await readSession(ctx, sessionId)
   if (!source) throw new Error('source session not found')
   const b = resolveForkBoundary(source, messageSeq, promptText)
 
+  console.info(
+    '[turn-undo] resolveBoundary session=' + sessionId,
+    'messageSeq=' + messageSeq,
+    'boundary=' + String(b.boundary),
+    'turn=' + String(b.turn),
+    'reason=' + b.reason,
+  )
   let childId
   if (typeof b.boundary === 'number') {
+    // fork() 会自动把子会话 attach 到 source 所在的 workspace（见上游
+    // commands.ts forkWorkspace），所以 fork 分支在侧栏可见。
     const { sessionId: cid } = await ctx.sessionController.fork({ sessionId, atSeq: b.boundary })
     childId = cid
   } else {
+    // create() 只有显式给 workspaceId 才会 attachSession；只给 cwd 的会话
+    // 不会进 workspace 目录，GUI 侧栏看不到 —— 这正是「原会话改名了但没有
+    // 新会话出现」的根因。所以先反查 source 所属 workspace。
     const cwd = source.header?.cwd
     if (!cwd) throw new Error('cannot undo first message without a cwd')
+    const workspaceId = findWorkspaceIdForSession(ctx, sessionId)
     const created = await ctx.sessionController.create({
-      cwd,
+      ...(workspaceId !== undefined ? { workspaceId } : { cwd }),
       ...(source.header?.agentPreset ? { agentPreset: source.header.agentPreset } : {}),
     })
     childId = created.sessionId
@@ -1017,23 +1149,52 @@ function createHandler(ctx, runtime, sessions, agents) {
 
         if (!sessionId) return json(response, 400, { error: 'Missing sessionId' })
 
+        // 单次 readSession 即可：live 会话的 snapshotEvents() 会重放事件，
+        // 每个请求读两遍是纯浪费。
+        const source = await readSession(ctx, sessionId)
+        if (!source) return json(response, 404, { error: 'Session not found' })
+
         let targetTurn = null
+        let unresolved = null
         if (messageSeqParam) {
-          const source = await readSession(ctx, sessionId)
-          if (source) {
-            const b = resolveForkBoundary(source, parseInt(messageSeqParam, 10), promptTextParam)
-            // For preview, pass the turn that the user wants to undo (b.turn).
-            // The preview function will compare this turn's snapshot with the previous one.
-            targetTurn = b.turn !== null && b.turn > 0 ? b.turn : null
-          }
+          const b = resolveForkBoundary(source, parseInt(messageSeqParam, 10), promptTextParam)
+          // For preview, pass the turn that the user wants to undo (b.turn).
+          if (b.turn !== null && b.turn > 0) targetTurn = b.turn
+          else unresolved = b.reason ?? 'no-turn'
         }
 
         // Wait for any in-flight snapshot capture so the preview reflects the
         // latest committed workspace state (avoids showing a stale turn/end).
         try { await runtime.waitForSnapshots() } catch {}
-        const source = await readSession(ctx, sessionId)
-        const cwd = source ? getCwd(source) : undefined
-        const preview = runtime.store.preview(sessionId, targetTurn, cwd)
+
+        // 定位不到消息时返回明确失败，而不是 targetTurn=null 的"0 变更"
+        // —— 后者会让弹框显示"无变化"，掩盖真实的解析失败。
+        if (unresolved !== null) {
+          return json(response, 200, {
+            ok: false,
+            status: 'unresolved',
+            reason: unresolved,
+            error: '定位不到这条消息对应的对话位置，无法撤销',
+            targetTurn: null,
+            totalChanges: 0,
+            changes: [],
+          })
+        }
+
+        let preview
+        try {
+          preview = runtime.store.preview(sessionId, targetTurn, getCwd(source))
+        } catch (e) {
+          logger?.warn?.('[turn-undo] preview failed:', e.message)
+          preview = {
+            ok: false,
+            status: 'preview-failed',
+            error: '预览失败：' + e.message,
+            targetTurn,
+            totalChanges: 0,
+            changes: [],
+          }
+        }
         return json(response, 200, preview)
       }
 
@@ -1053,15 +1214,25 @@ function createHandler(ctx, runtime, sessions, agents) {
         const source = await readSession(ctx, sessionId)
         if (!source) return json(response, 400, { error: 'Session not found' })
         const cwd = getCwd(source)
-        const b = messageSeq !== null ? resolveForkBoundary(source, messageSeq, promptText) : { boundary: null, turn: null, cwd }
+        const b = messageSeq !== null
+          ? resolveForkBoundary(source, messageSeq, promptText)
+          : { boundary: null, turn: null, cwd, reason: 'no-message-seq' }
 
         // Determine restore target: "recover to before this message" means
         // the state at turn/start, i.e. turn T - 0.5. That snapshot captures
         // the workspace before the user sent this message and before any AI work.
-        let restoreTurn = null
-        if (b.turn !== null && b.turn > 0) {
-          restoreTurn = b.turn - 0.5
+        //
+        // 解析不到目标消息时必须中止：继续执行会 fork 出新会话却跳过文件恢复，
+        // 却仍返回 ok:true —— 用户会以为撤销成功。
+        if (b.turn === null || b.turn <= 0) {
+          return json(response, 200, {
+            ok: false,
+            status: 'unresolved',
+            reason: b.reason ?? 'no-turn',
+            error: '定位不到这条消息对应的对话位置，未做任何修改',
+          })
         }
+        const restoreTurn = b.turn - 0.5
 
         // 3. Wait for any pending snapshot to settle so the manifest is on disk.
         //    Without this, a restore issued right after turn/end may read an
@@ -1081,12 +1252,7 @@ function createHandler(ctx, runtime, sessions, agents) {
         }
 
         // 4. Restore files to the best snapshot at/before restoreTurn.
-        let restoreResult
-        if (restoreTurn !== null) {
-          restoreResult = runtime.store.restore(cwd, sessionId, restoreTurn)
-        } else {
-          restoreResult = { ok: false, error: 'NO_SNAPSHOT' }
-        }
+        const restoreResult = runtime.store.restore(cwd, sessionId, restoreTurn)
 
         // 5. Fork 新会话（DSH 原生，web 的在此分叉按钮同款：ctx.agents.create），
         //    并把旧会话标题加上 （已撤销） 前缀后保留。
@@ -1141,6 +1307,8 @@ export function apply(ctx, config = {}) {
     maxSnapshotBytes: config.maxSnapshotBytes,
     snapshotTtlDays: config.snapshotTtlDays,
     maxSnapshotsPerSession: config.maxSnapshotsPerSession,
+    objectGcGraceMs: config.objectGcGraceMs,
+    objectGcIntervalMs: config.objectGcIntervalMs,
   })
   const runtime = new SnapshotRuntime({
     store,
@@ -1163,70 +1331,92 @@ export function apply(ctx, config = {}) {
   })
 
   // HTTP API endpoints.
-  ctx.inject(['webServer', 'sessions', 'sessionQuery', 'agents', 'sessionTitle', 'sessionController'], (scope) => {
-    scope.effect(() => {
-      const handler = createHandler(scope, runtime, scope.sessions, scope.agents)
-      scope.webServer.register({
-        kind: 'exact',
-        path: API_PATH,
-        handler,
-      })
-      return () => {}
-    }, 'turn-undo: http-api')
-  })
+  ctx.inject(
+    ['webServer', 'sessions', 'sessionQuery', 'agents', 'sessionTitle', 'sessionController', 'workspaceRegistry'],
+    (scope) => {
+      scope.effect(() => {
+        const handler = createHandler(scope, runtime, scope.sessions, scope.agents)
+        scope.webServer.register({
+          kind: 'exact',
+          path: API_PATH,
+          handler,
+        })
+        return () => {}
+      }, 'turn-undo: http-api')
+    },
+  )
 }
 
 /**
  * Build a manifest from the current workspace state without persisting it.
- * Used by preview when the target turn is beyond the latest snapshot.
+ *
+ * Entries whose size+mtime+mode already match `referenceManifest` reuse the
+ * recorded hash instead of re-reading the bytes — the same short-circuit
+ * capture() uses. Without it every preview re-hashes the whole workspace.
+ * @param cwd - workspace root being scanned.
+ * @param referenceManifest - a prior manifest (usually the latest snapshot).
  */
-SnapshotStore.prototype.buildLiveManifest = function (cwd) {
+SnapshotStore.prototype.buildLiveManifest = function (cwd, referenceManifest) {
   const ignore = makeIgnore(cwd, this.excludes)
   const files = this.scan(cwd, ignore)
   if (!files) return null
   const manifest = {}
-  for (const p of files) {
-    const abs = p
+  for (const abs of files) {
     let st
     try { st = lstatSync(abs) } catch { continue }
     if (!st.isFile()) continue
     const rel = relative(cwd, abs).split('\\').join('/')
-    manifest[rel] = {
-      kind: 'file',
-      hash: hashFile(abs),
-      size: st.size,
-      mtime: st.mtimeMs,
-      mode: st.mode.toString(8).padStart(4, '0'),
+    const mode = st.mode.toString(8).padStart(4, '0')
+    const prev = referenceManifest && referenceManifest[rel]
+    if (prev && prev.kind === 'file' && prev.hash
+        && prev.size === st.size && prev.mtime === st.mtimeMs && prev.mode === mode) {
+      manifest[rel] = prev
+    } else {
+      manifest[rel] = {
+        kind: 'file',
+        hash: hashFile(abs),
+        size: st.size,
+        mtime: st.mtimeMs,
+        mode,
+      }
     }
   }
   return manifest
 }
 
+/** Read a workspace file's text; '' when unreadable (binary, deleted, permission). */
+SnapshotStore.prototype.readWorkspaceContent = function (cwd, rel) {
+  try { return readFileSync(resolve(cwd, rel), 'utf-8') } catch { return '' }
+}
+
 // Add preview helper to SnapshotStore prototype.
-// Returns the files that changed during the target turn (turn/end vs turn/start).
+// Returns the files that undo (restoring to the target's baseline) will affect.
 SnapshotStore.prototype.preview = function (sessionId, targetTurn, cwd) {
-  const chain = this.loadChain(sessionId)
   if (targetTurn === null) {
     return { ok: true, status: 'ready', targetTurn: null, totalChanges: 0, changes: [] }
   }
+  const chain = this.loadChain(sessionId)
+  if (chain.length === 0) {
+    return { ok: true, status: 'no-snapshot', targetTurn, totalChanges: 0, changes: [], noSnapshot: true }
+  }
 
   // 撤销"发送这条消息之前"会一并回退该消息之后的所有改动，因此影响范围 =
   // baseline（targetTurn 之前最近的快照，即恢复到什么状态）与 latest
   // （会话最新快照，即撤销点之后累积到当前的状态终点）之差。
-  // baseline 取小于 targetTurn 的最新快照：正常是该 turn/start 快照
-  // (T - 0.5)，若中间某 turn 无文件变化没写 manifest，则回退到更早的最近
-  // 快照；对于没有前置快照的首条消息，用空对象 {} 作为基线（即回到空状态）。
   let baseline = null
   for (const m of chain) {
     if (m.turn < targetTurn && (baseline === null || m.turn > baseline.turn)) {
       baseline = m
     }
   }
-  const baselineManifest = baseline ? baseline.manifest : {}
 
-  if (chain.length === 0) {
-    return { ok: true, status: 'ready', targetTurn, totalChanges: 0, changes: [], noSnapshot: true }
+  // 目标消息早于最早可用快照：既无法描述也无法执行恢复。把当前所有文件
+  // 都列成 "created" 会宣称"恢复到空工作区"，而 restore() 随后必以
+  // NO_SNAPSHOT 拒绝 —— 必须明确报告无基线，而不是给出误导性的文件清单。
+  if (baseline === null) {
+    return { ok: true, status: 'no-baseline', targetTurn, totalChanges: 0, changes: [], noBaseline: true }
   }
+  const baselineManifest = baseline.manifest
 
   // 会话最新快照 = 撤销点之后所有改动的累积终点。
   const latest = chain[chain.length - 1]
@@ -1235,55 +1425,54 @@ SnapshotStore.prototype.preview = function (sessionId, targetTurn, cwd) {
   // yet or snapshots were skipped), compare baseline against the CURRENT
   // workspace state instead of the stale latest snapshot. This ensures the
   // preview shows meaningful changes even when the active turn has no snapshot.
-  let latestManifest
+  let latestManifest = latest.manifest
+  let latestIsLive = false
   if (targetTurn > latest.turn && cwd) {
-    const live = this.buildLiveManifest(cwd)
-    latestManifest = live || latest.manifest
-  } else {
-    latestManifest = latest.manifest
+    const live = this.buildLiveManifest(cwd, latest.manifest)
+    if (live) {
+      latestManifest = live
+      latestIsLive = true
+    }
   }
 
-  // Calculate changes between latest and baseline: these are the files that
-  // undo (restoring to baseline) will affect — every change made at or after
-  // the target turn.
-  const changes = []
-  
-  // Read manifest contents for diff computation
-  const baselineContents = this.readManifestContents(baselineManifest)
-  const latestContents = this.readManifestContents(latestManifest)
-  
+  // ── Collect changed paths FIRST ───────────────────────────────────────
+  // Contents are read only for files whose hash differs; reading every object
+  // in both manifests made one preview cost hundreds of file reads.
   const deleted = []
   const created = []
-
-  // Collect deleted files
+  const modified = []
   for (const rel of Object.keys(baselineManifest)) {
-    if (!latestManifest[rel]) {
-      changes.push({ path: rel, kind: 'deleted' })
-      deleted.push({ path: rel, hash: baselineManifest[rel].hash })
-    }
+    if (!latestManifest[rel]) deleted.push({ path: rel, hash: baselineManifest[rel].hash })
   }
-
-  // Collect created and modified files
   for (const rel of Object.keys(latestManifest)) {
     const entry = latestManifest[rel]
-    if (!baselineManifest[rel]) {
-      changes.push({ path: rel, kind: 'created' })
-      created.push({ path: rel, hash: entry.hash })
-    } else {
-      const prevEntry = baselineManifest[rel]
-      if (entry.hash !== prevEntry.hash) {
-        const oldContent = baselineContents[rel] || ''
-        const newContent = latestContents[rel] || ''
-        const oldLines = oldContent.split('\n')
-        const newLines = newContent.split('\n')
-        const diff = this.generateDiff(oldLines, newLines, 10)
-        changes.push({ 
-          path: rel, 
-          kind: 'modified',
-          diff: { oldLines: oldLines.length, newLines: newLines.length, hunks: diff }
-        })
-      }
-    }
+    const prev = baselineManifest[rel]
+    if (!prev) created.push({ path: rel, hash: entry.hash })
+    else if (entry.hash !== prev.hash) modified.push({ path: rel, oldHash: prev.hash, newHash: entry.hash })
+  }
+
+  const changes = []
+  for (const d of deleted) changes.push({ path: d.path, kind: 'deleted' })
+  for (const c of created) changes.push({ path: c.path, kind: 'created' })
+  for (const m of modified) {
+    const oldContent = this.readObjectContent(m.oldHash) || ''
+    // A live entry's bytes were never written to the object store; read the
+    // working tree instead, or the diff would show every old line as removed.
+    const newContent = latestIsLive
+      ? this.readWorkspaceContent(cwd, m.path)
+      : (this.readObjectContent(m.newHash) || '')
+    const oldLines = oldContent.split('\n')
+    const newLines = newContent.split('\n')
+    // generateDiff is O(n*m) DP; skip hunks for pathologically large files
+    // rather than allocating a multi-hundred-MB table on a preview click.
+    const tooLarge = oldLines.length * newLines.length > 4_000_000
+    changes.push({
+      path: m.path,
+      kind: 'modified',
+      diff: tooLarge
+        ? { oldLines: oldLines.length, newLines: newLines.length, hunks: [], truncated: true }
+        : { oldLines: oldLines.length, newLines: newLines.length, hunks: this.generateDiff(oldLines, newLines, 10) },
+    })
   }
 
   // Detect rename/move: same content hash, different path

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-turn-undo",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Undo to any point in a DSH conversation — revert files and fork a new session",
   "type": "module",
   "main": "index.js",