ompchamber 3.4.0 → 3.5.0

package/src/client/components/mobile/mobile-session-sidebar/SessionRow.tsx

@@ -1,6 +1,7 @@
-import { Archive, ArchiveRestore, Check, ChevronDown, ChevronRight, CircleQuestionMark, Loader2, Pencil } from 'lucide-preact';
+import { Check, ChevronDown, ChevronRight, CircleQuestionMark, Loader2, MoreHorizontal } from 'lucide-preact';
 import type { SessionItemData } from '@/shared/types';
 import { useInlineRename } from '@/client/hooks/ui/inline-rename';
+import { SessionActionsMenu, useRowMenu } from '@/client/components/common/session-actions-menu';
 
 export interface MobileSessionRowProps {
   session: SessionItemData;
@@ -16,6 +17,9 @@ export interface MobileSessionRowProps {
   onToggleExpand?: () => void;
   onSelect: () => void;
   onArchive: () => void;
+  /** Omitted for a session that cannot be deleted yet (a pending `new-…` chat,
+   *  which has no transcript anywhere). */
+  onDelete?: () => void;
   onRename?: (name: string) => void;
 }
 
@@ -30,6 +34,7 @@ export function MobileSessionRow({
   onToggleExpand,
   onSelect,
   onArchive,
+  onDelete,
   onRename,
 }: MobileSessionRowProps) {
   const {
@@ -41,6 +46,9 @@ export function MobileSessionRow({
     handleKeyDown,
     handleBlur,
   } = useInlineRename(session.title, onRename);
+  // One trigger for every row action; also reachable by long-press contextmenu.
+  const menu = useRowMenu();
+  const hasActions = Boolean(onRename || onArchive || onDelete);
 
   // The roster toggle is the row's LAST element, so its glyph lands in the same
   // column as the folder header's expand chevron — one vertical line of
@@ -71,76 +79,86 @@ export function MobileSessionRow({
   }
 
   return (
-    <div
-      className={`w-full rounded-lg flex items-center transition-colors ${
-        isActive ? 'bg-ink/10 font-medium text-ink' : 'hover:bg-ink/5 text-ink/85'
-      }`}
-    >
-      <button
-        type="button"
-        onClick={onSelect}
-        className="flex-1 text-left pl-2 pr-3 py-2 flex items-center justify-between min-w-0"
+    <>
+      <div
+        onContextMenu={hasActions ? menu.openAtCursor : undefined}
+        className={`w-full rounded-lg flex items-center transition-colors ${
+          isActive ? 'bg-ink/10 font-medium text-ink' : 'hover:bg-ink/5 text-ink/85'
+        }`}
       >
-        <div className="flex items-center min-w-0 pr-2">
-          {/* Status slot, 16px at the same x as the folder header's icon slot,
-              so the left column reads as one line. Waiting on an answer
-              outranks the run spinner — the spinner says work is happening,
-              the question mark says it is YOUR turn (desktop parity). */}
-          <span className="w-4 flex-shrink-0 flex items-center justify-center">
-            {awaitingInput ? (
-              <CircleQuestionMark size={13} className="text-ink/70 animate-pulse" />
-            ) : status === 'stream' ? (
-              <Loader2 size={13} className="text-ink/50 animate-spin" />
-            ) : status ? (
-              <Check size={13} className="text-ink/50" />
-            ) : null}
-          </span>
-          <span className="text-xs truncate leading-snug ml-2">{title}</span>
-        </div>
-
-        <span className="text-[11px] text-ink/45 font-mono flex-shrink-0 ml-2">{timeAgo ?? ''}</span>
-      </button>
-
-      {onRename && (
         <button
           type="button"
-          onClick={startRename}
-          title="Rename session"
-          className="flex-shrink-0 p-2 text-ink/35 hover:text-ink rounded-lg cursor-pointer"
+          onClick={onSelect}
+          className="flex-1 text-left pl-2 pr-3 py-2 flex items-center justify-between min-w-0"
         >
-          <Pencil size={14} />
+          <div className="flex items-center min-w-0 pr-2">
+            {/* Status slot, 16px at the same x as the folder header's icon slot,
+                so the left column reads as one line. Waiting on an answer
+                outranks the run spinner — the spinner says work is happening,
+                the question mark says it is YOUR turn (desktop parity). */}
+            <span className="w-4 flex-shrink-0 flex items-center justify-center">
+              {awaitingInput ? (
+                <CircleQuestionMark size={13} className="text-ink/70 animate-pulse" />
+              ) : status === 'stream' ? (
+                <Loader2 size={13} className="text-ink/50 animate-spin" />
+              ) : status ? (
+                <Check size={13} className="text-ink/50" />
+              ) : null}
+            </span>
+            <span className="text-xs truncate leading-snug ml-2">{title}</span>
+          </div>
+
+          <span className="text-[11px] text-ink/45 font-mono flex-shrink-0 ml-2">{timeAgo ?? ''}</span>
         </button>
-      )}
 
-      {/* A row WITHOUT a roster toggle still has to keep the toggle's column
-          empty, or its archive glyph would sit where the toggle is and the
-          trailing icons would step in and out row to row. This `mr-1` is what
-          reserves that column: it moves the 14px glyph's centre from x=363 to
-          x=359, the exact x the toggle uses on a row that has one. */}
-      <button
-        type="button"
-        onClick={onArchive}
-        title={session.is_archived === 1 ? 'Unarchive session' : 'Archive session'}
-        className={`flex-shrink-0 p-2 text-ink/35 hover:text-ink rounded-lg cursor-pointer ${showChevron ? '' : 'mr-1'}`}
-      >
-        {session.is_archived === 1 ? <ArchiveRestore size={14} /> : <Archive size={14} />}
-      </button>
+        {/* One trigger for rename / archive / delete, always visible: a touch
+            surface has no hover, and the always-on action buttons this replaced
+            consumed a third of a phone's row width.
+            `mr-1` only when the row has NO roster toggle — it reserves that
+            column so the trailing glyph's centre stays 19px from the row's right
+            edge whether the last element is this trigger or the chevron. Without
+            it the glyphs step in and out from row to row. */}
+        {hasActions && (
+          <button
+            type="button"
+            onClick={menu.openBelow}
+            title="Session actions"
+            aria-label="Session actions"
+            aria-haspopup="menu"
+            aria-expanded={menu.anchor !== null}
+            className={`flex-shrink-0 p-2 text-ink/35 hover:text-ink rounded-lg cursor-pointer ${showChevron ? '' : 'mr-1'}`}
+          >
+            <MoreHorizontal size={16} />
+          </button>
+        )}
 
-      {/* Last element, so its glyph sits in the folder header's chevron column.
-          `p-1.5 mr-1.5` centres a 14px glyph on that column while keeping a
-          touch-sized tap target. */}
-      {showChevron && (
-        <button
-          type="button"
-          onClick={onToggleExpand}
-          title={isExpanded ? 'Collapse subagents' : 'Expand subagents'}
-          aria-expanded={isExpanded}
-          aria-label={isExpanded ? 'Collapse subagents' : 'Expand subagents'}
-          className="flex-shrink-0 p-1.5 mr-1.5 flex items-center justify-center text-ink/50 hover:text-ink rounded-lg cursor-pointer"
-        >
-          {isExpanded ? <ChevronDown size={14} /> : <ChevronRight size={14} />}
-        </button>
+        {/* Last element, so its glyph sits in the folder header's chevron column.
+            `p-1.5 mr-1.5` centres a 14px glyph on that column while keeping a
+            touch-sized tap target. */}
+        {showChevron && (
+          <button
+            type="button"
+            onClick={onToggleExpand}
+            title={isExpanded ? 'Collapse subagents' : 'Expand subagents'}
+            aria-expanded={isExpanded}
+            aria-label={isExpanded ? 'Collapse subagents' : 'Expand subagents'}
+            className="flex-shrink-0 p-1.5 mr-1.5 flex items-center justify-center text-ink/50 hover:text-ink rounded-lg cursor-pointer"
+          >
+            {isExpanded ? <ChevronDown size={14} /> : <ChevronRight size={14} />}
+          </button>
+        )}
+      </div>
+
+      {menu.anchor && (
+        <SessionActionsMenu
+          anchor={menu.anchor}
+          isArchived={session.is_archived === 1}
+          onRename={onRename ? startRename : undefined}
+          onArchive={onArchive}
+          onDelete={onDelete}
+          onClose={menu.close}
+        />
       )}
-    </div>
+    </>
   );
 }

package/src/client/hooks/workspace/session-delete.ts

@@ -0,0 +1,94 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Session deletion, shared by the desktop session row and the mobile one.
+ *
+ * Both sidebars render the same confirmation dialog and issue the same request,
+ * so the state machine (which row is pending, in-flight, why it was refused)
+ * lives here rather than in two components that would drift on the URL, the
+ * verb, or the event they dispatch afterwards.
+ *
+ * Two follow-ups are load-bearing and both happen only on success:
+ *
+ *   - `omp:workspace-updated` refreshes the sidebar list. The deleted row is
+ *     gone from disk, but the client still holds the previous snapshot.
+ *   - when the deleted session is the one on screen, `?sessionId=` is dropped.
+ *     Leaving the URL pointing at a removed session renders the chat's "not
+ *     found" state over a row the user just deleted, and every panel keyed to
+ *     that id keeps fetching for it.
+ */
+
+import { useCallback, useState } from 'preact/hooks';
+import { useSearchParams } from '@/client/lib/router/search-params';
+import { forgetSession } from '@/shared/lib/workspace/session-state/store';
+import type { SessionItemData } from '@/shared/types';
+
+export interface SessionDeleteActions {
+  /** The session awaiting confirmation, or null when the dialog is closed. */
+  pending: SessionItemData | null;
+  /** True while the DELETE request is in flight. */
+  isDeleting: boolean;
+  /** The server's refusal reason, shown inside the dialog. */
+  error: string | null;
+  /** Open the confirmation for this session. */
+  requestDelete: (session: SessionItemData) => void;
+  /** Close it without deleting. */
+  cancelDelete: () => void;
+  /** Issue the delete. Resolves once the request settled. */
+  confirmDelete: () => Promise<void>;
+}
+
+export function useSessionDelete(): SessionDeleteActions {
+  const [pending, setPending] = useState<SessionItemData | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  const requestDelete = useCallback((session: SessionItemData) => {
+    setError(null);
+    setPending(session);
+  }, []);
+
+  const cancelDelete = useCallback(() => {
+    setError(null);
+    setPending(null);
+  }, []);
+
+  const confirmDelete = useCallback(async () => {
+    if (!pending || isDeleting) return;
+    const sessionId = String(pending.id);
+    setIsDeleting(true);
+    setError(null);
+    try {
+      const res = await fetch(`/api/sessions/${encodeURIComponent(sessionId)}`, { method: 'DELETE' });
+      const body = (await res.json().catch(() => null)) as { error?: string } | null;
+      if (!res.ok) {
+        // The refusal reasons the server gives (mid-run, pending chat) are
+        // actionable, so they stay on screen instead of closing the dialog.
+        setError(body?.error || `Could not delete the session (HTTP ${res.status}).`);
+        return;
+      }
+      forgetSession(sessionId);
+      if (searchParams.get('sessionId') === sessionId) {
+        setSearchParams((prev) => {
+          const next = new URLSearchParams(prev);
+          next.delete('sessionId');
+          // A subagent transcript belongs to the session being removed.
+          next.delete('subagent');
+          return next;
+        }, { replace: true });
+      }
+      setPending(null);
+      window.dispatchEvent(new CustomEvent('omp:workspace-updated'));
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Could not reach the server.');
+    } finally {
+      setIsDeleting(false);
+    }
+  }, [pending, isDeleting, searchParams, setSearchParams]);
+
+  return { pending, isDeleting, error, requestDelete, cancelDelete, confirmDelete };
+}

package/src/server/lib/btw/purge.server.ts

@@ -0,0 +1,56 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Deleting a session's side questions.
+ *
+ * A side question is keyed to the parent session but stored outside it — rows
+ * in `btw_topics`/`btw_turns`, a live omp child per topic, and a private
+ * transcript directory under `<db dir>/btw/<sessionId>/<topicId>/`. Deleting
+ * the chat session therefore leaves all three behind unless they are purged
+ * with it: orphan turns still readable in the database, and on disk a full
+ * copy of the very transcript the user just deleted.
+ *
+ * Kept out of `service.server.ts` (which owns the interactive topic
+ * operations) so that file's growth stays attributable.
+ */
+
+import path from 'path';
+import { listBtwTopics, deleteBtwTopic } from '@/server/lib/btw/store.server';
+import { forgetBtwRuntime, getBtwRuntime } from '@/server/lib/btw/registry.server';
+import { getBtwRoot, removeBtwWorkspace, resolveBtwWorkspacePaths } from '@/server/lib/btw/session-copy.server';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+
+/**
+ * Drop every topic of `sessionId`, its child, its rows, and its workspace.
+ *
+ * `sessionId` MUST name one child of the btw root. The last step below removes
+ * `join(getBtwRoot(), sessionId)` unconditionally, and `join(root, '.')` is
+ * `root` itself — so an id of `.` (or any id with a separator) turns this
+ * per-session purge into "delete every session's side questions on disk". The
+ * route validates its id; this check is the independent second gate, because
+ * this function is reachable on its own and its failure mode is other
+ * sessions' data.
+ */
+export async function purgeBtwForSession(sessionId: string): Promise<number> {
+  if (!isSinglePathSegment(sessionId)) return 0;
+
+  const topics = await listBtwTopics(sessionId);
+  for (const topic of topics) {
+    const runtime = getBtwRuntime(topic.id);
+    if (runtime) {
+      // Disposes the child; a running turn is settled as cancelled rather than
+      // left to write into a transcript this purge is about to remove.
+      await runtime.dispose();
+      forgetBtwRuntime(topic.id);
+    }
+    await deleteBtwTopic(topic.id);
+    await removeBtwWorkspace((await resolveBtwWorkspacePaths(sessionId, topic.id)).dir);
+  }
+  // The per-session directory as a whole: a topic whose row is already gone can
+  // still have a workspace (a crash between the two, a manual row delete).
+  await removeBtwWorkspace(path.join(await getBtwRoot(), sessionId));
+  return topics.length;
+}

package/src/server/lib/fs/path-segment.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The session-delete blast radius.
+ *
+ * `DELETE /api/sessions/:sessionId` removes a directory under the sessions root
+ * and another under the btw root, both by joining the id onto the root. The
+ * case that shipped broken was `.`: `join(root, '.')` is `root` itself, so the
+ * btw purge's unconditional workspace removal deleted EVERY session's side
+ * questions and the route still answered 404 — an invisible, root-wide wipe
+ * from a request that looked like a miss.
+ *
+ * These tests pin the two properties that made it possible: the guard rejects
+ * every value that is not one segment, and the btw purge refuses a non-segment
+ * even when called directly (the route is not the only entry point).
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+import { purgeBtwForSession } from '@/server/lib/btw/purge.server';
+
+describe('isSinglePathSegment', () => {
+  test('accepts the id shapes the app actually produces', () => {
+    // omp session ids are UUIDs; mock ids are integers; pending chats are `new-…`.
+    expect(isSinglePathSegment('11111111-2222-3333-4444-555555555555')).toBe(true);
+    expect(isSinglePathSegment('3')).toBe(true);
+    expect(isSinglePathSegment('new-1758800000000')).toBe(true);
+    // A dot INSIDE a name is fine — only a name that resolves to a directory is not.
+    expect(isSinglePathSegment('session.v2')).toBe(true);
+  });
+
+  test('refuses the values that resolve somewhere other than one child', () => {
+    // The shipped bug: join(root, '.') === root.
+    expect(isSinglePathSegment('.')).toBe(false);
+    expect(isSinglePathSegment('..')).toBe(false);
+    expect(isSinglePathSegment('a/b')).toBe(false);
+    expect(isSinglePathSegment('..\\a')).toBe(false);
+    expect(isSinglePathSegment('')).toBe(false);
+    // A NUL byte truncates at the syscall boundary.
+    expect(isSinglePathSegment('a\0b')).toBe(false);
+  });
+
+  test('the guard agrees with the join it is guarding', () => {
+    // The property that matters: whenever the guard says yes, joining onto a
+    // root stays directly inside it. Asserted against `path.join` itself rather
+    // than a restatement of the rule.
+    const root = '/tmp/root';
+    for (const id of ['11111111-2222-3333-4444-555555555555', '3', 'new-1', 'session.v2']) {
+      expect(isSinglePathSegment(id)).toBe(true);
+      expect(path.join(root, id).startsWith(`${root}${path.sep}`)).toBe(true);
+      expect(path.dirname(path.join(root, id))).toBe(root);
+    }
+    for (const id of ['.', '..', 'a/b', '../x']) {
+      expect(isSinglePathSegment(id)).toBe(false);
+    }
+  });
+});
+
+describe('purgeBtwForSession refuses a non-segment id', () => {
+  const root = '/tmp/omc-path-segment-test';
+  const btwRoot = path.join(root, 'btw');
+  const seeded = [
+    path.join(btwRoot, 'sessA', 'topicA', 'session.jsonl'),
+    path.join(btwRoot, 'sessB', 'topicB', 'session.jsonl'),
+  ];
+
+  beforeAll(async () => {
+    await fs.promises.rm(root, { recursive: true, force: true });
+    // Two unrelated sessions' side questions, exactly as the bug destroyed them.
+    // The btw root is derived from the database path, so pointing that at this
+    // tree is what puts them where the purge would look.
+    for (const file of seeded) {
+      await fs.promises.mkdir(path.dirname(file), { recursive: true });
+      await Bun.write(file, '{"type":"session"}\n');
+    }
+    Bun.env.OMPCHAMBER_DB_PATH = path.join(root, 'db.sqlite');
+  });
+
+  afterAll(async () => {
+    delete Bun.env.OMPCHAMBER_DB_PATH;
+    await fs.promises.rm(root, { recursive: true, force: true });
+  });
+
+  test('`.` does not remove the btw root', async () => {
+    // The guard returns before `listBtwTopics`, so no database is touched.
+    expect(await purgeBtwForSession('.')).toBe(0);
+    // Both sessions' transcripts must survive — this is the regression.
+    for (const file of seeded) expect(fs.existsSync(file)).toBe(true);
+  });
+
+  test('a separator does not reach outside the root', async () => {
+    expect(await purgeBtwForSession('../btw')).toBe(0);
+    for (const file of seeded) expect(fs.existsSync(file)).toBe(true);
+  });
+});

package/src/server/lib/fs/path-segment.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * One rule, two callers: does this id name exactly one child of a root?
+ *
+ * The purge paths join a session id onto a root to find the directory it owns —
+ * `join(sessionsRoot, …)`, `join(btwRoot, sessionId)` — and then remove it
+ * recursively. `path.join` NORMALIZES, so a value that is not a plain segment
+ * silently retargets the removal:
+ *
+ *   join(root, '.')  === root          → deletes every child of the root
+ *   join(root, '..') === dirname(root) → deletes outside the root
+ *   join(root, 'a/b')                  → reaches into a sibling subtree
+ *
+ * Measured: `DELETE /api/sessions/.` (curl needs `--path-as-is`; it strips the
+ * trailing dot itself) passed a `/^[A-Za-z0-9._-]+$/` guard, normalized to the
+ * btw root, and removed two unrelated sessions' side-question transcripts.
+ *
+ * The check is deliberately structural rather than an enumeration of dangerous
+ * spellings: an id is safe exactly when it is one non-dot segment. Real ids
+ * satisfy that by construction — omp session ids are UUIDs and mock ids are
+ * integers — so nothing legitimate is refused.
+ *
+ * `normalize` is compared, not just scanned for separators, because it is the
+ * same operation the callers' `join` performs: asserting the two agree is what
+ * makes this a proof about the path that will actually be built, rather than a
+ * guess about which inputs look suspicious.
+ */
+
+import { normalize } from 'node:path';
+
+/** True when `id` names one child of a root, and nothing else. */
+export function isSinglePathSegment(id: string): boolean {
+  if (id.length === 0) return false;
+  if (id === '.' || id === '..') return false;
+  if (id.includes('/') || id.includes('\\')) return false;
+  // A NUL byte would truncate the path at the syscall boundary.
+  if (id.includes('\0')) return false;
+  // The load-bearing assertion: normalization must be a no-op, so `join(root, id)`
+  // cannot resolve anywhere but directly under `root`.
+  return normalize(id) === id;
+}

package/src/server/lib/omp/session/delete.server.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Deleting a session: the transcript on disk, its subagent artifacts, and every
+ * chamber-side row keyed to the session id.
+ *
+ * The transcript is authoritative — omp's own session listing is derived from
+ * the JSONL alone — so a delete that removed only the chamber's rows would see
+ * the session come straight back on the next sidebar scan. What "delete" means
+ * here, in one place:
+ *
+ *   - the session JSONL, plus any `<name>.jsonl.bak-*` copy an earlier rewind
+ *     left beside it (a full copy of the same transcript: leaving it behind
+ *     would mean the conversation was not actually deleted);
+ *   - its sibling artifacts directory, which holds the subagent transcripts;
+ *   - the `archived_sessions`, `session_ui_state`, `session_stream_state`,
+ *     `queued_messages` and `chat_sessions` rows for that id;
+ *   - in mock mode the demo `sessions` row and its `files` tree.
+ *
+ * The caller owns the process: a live omp child MUST be destroyed before this
+ * runs, because omp flushes its session state on shutdown and would otherwise
+ * recreate the file this just removed. Side-question rows and workspaces are
+ * the btw module's business (`purgeBtwForSession`).
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { getDb } from '@/server/db.server';
+import type { DbClient } from '@/server/lib/db/client';
+import { findSessionFileById } from '@/server/lib/omp/session/locator';
+import { clearSessionFileCaches } from '@/server/lib/omp/session/files';
+import { invalidateOmpSidebarData } from '@/server/lib/omp/session/reader';
+import { siblingDirForSession } from '@/server/lib/omp/subagent/history/paths';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+
+export interface SessionPurgeResult {
+  /** Something keyed to this id existed — a transcript, a mock session row, or
+   *  a chamber row. False means the id resolved nowhere at all. */
+  found: boolean;
+  fileRemoved: boolean;
+  artifactsRemoved: boolean;
+}
+
+/**
+ * Chamber rows keyed by a session id. Every statement is a no-op when the id
+ * matches nothing, which is what makes one purge serve both modes: real
+ * sessions (omp UUIDs, present on disk only) and mock ones (numeric ids in
+ * `sessions`).
+ *
+ * `files` carries a FOREIGN KEY to `sessions` and `foreign_keys` is ON, so its
+ * children go before the session row or the delete is refused.
+ */
+const SESSION_ROW_DELETES: readonly (readonly [string, string])[] = [
+  ['archived_sessions', 'session_id'],
+  ['session_ui_state', 'session_id'],
+  ['session_stream_state', 'session_id'],
+  ['queued_messages', 'session_id'],
+  ['chat_sessions', 'session_id'],
+  ['files', 'session_id'],
+];
+
+async function purgeChamberRows(db: DbClient, sessionId: string): Promise<number> {
+  let changes = 0;
+  for (const [table, column] of SESSION_ROW_DELETES) {
+    const result = await db.run(`DELETE FROM ${table} WHERE ${column} = ?`, [sessionId]);
+    changes += result.changes ?? 0;
+  }
+  const mockRow = await db.run('DELETE FROM sessions WHERE id = ?', [sessionId]);
+  return changes + (mockRow.changes ?? 0);
+}
+
+/** Remove the transcript and the `.bak-*` copies beside it. */
+async function removeTranscript(filePath: string): Promise<boolean> {
+  const existed = await Bun.file(filePath).exists();
+  await fs.promises.rm(filePath, { force: true });
+  const dir = path.dirname(filePath);
+  const prefix = `${path.basename(filePath)}.bak-`;
+  try {
+    for (const entry of await fs.promises.readdir(dir)) {
+      if (entry.startsWith(prefix)) await fs.promises.rm(path.join(dir, entry), { force: true });
+    }
+  } catch {
+    // A backup that cannot be listed is not worth failing a delete the
+    // transcript half of which already succeeded.
+  }
+  return existed;
+}
+
+/**
+ * Purge everything the chamber and the agent directory hold for `sessionId`.
+ * `sessionId` must be a single safe path segment — it names the artifacts
+ * directory — which the route validates before calling.
+ */
+export async function purgeSessionData(sessionId: string): Promise<SessionPurgeResult> {
+  // Second gate, independent of the route's: an id that is not one segment
+  // would make `siblingDirForSession` and the btw purge resolve outside the
+  // session it names. Refusing here means a future caller that forgets the
+  // route's guard still cannot widen the blast radius.
+  if (!isSinglePathSegment(sessionId)) {
+    return { found: false, fileRemoved: false, artifactsRemoved: false };
+  }
+
+  const filePath = await findSessionFileById(sessionId);
+  let fileRemoved = false;
+  let artifactsRemoved = false;
+  if (filePath) {
+    fileRemoved = await removeTranscript(filePath);
+    const artifactsDir = siblingDirForSession(filePath);
+    // `stat`, not `Bun.file().exists()`: the latter answers for regular files
+    // only and reports a directory as absent, which would claim every session
+    // had no subagent transcripts.
+    artifactsRemoved = await fs.promises
+      .stat(artifactsDir)
+      .then((stats) => stats.isDirectory(), () => false);
+    await fs.promises.rm(artifactsDir, { recursive: true, force: true });
+  }
+
+  const db = await getDb();
+  const rowChanges = await purgeChamberRows(db, sessionId);
+
+  // Both caches outlive the mutation by their own keys: the file list/scan pair
+  // is mtime-keyed (a delete bumps the parent directory, but the memo can still
+  // answer first) and the sidebar dataset is TTL'd, so without this the deleted
+  // row is served back to the refresh that follows the delete.
+  clearSessionFileCaches();
+  invalidateOmpSidebarData();
+
+  return {
+    found: Boolean(filePath) || rowChanges > 0,
+    fileRemoved,
+    artifactsRemoved,
+  };
+}

package/src/server/lib/omp/session/reader.ts

@@ -60,6 +60,19 @@ export async function loadOmpSidebarData(): Promise<OmpSidebarData> {
   return slot.inFlight;
 }
 
+/**
+ * Drop the cached dataset so the next load re-scans disk. For a mutation the
+ * TTL cannot see: deleting a session removes a row rather than changing one, so
+ * nothing in the cached snapshot is stale — it is simply wrong, and the refresh
+ * that follows the delete would otherwise serve it back for up to the TTL.
+ */
+export function invalidateOmpSidebarData(): void {
+  const slot = globalThis.__ompChamberSidebarDataCache;
+  if (!slot) return;
+  slot.data = undefined as unknown as OmpSidebarData;
+  slot.expiresAt = 0;
+}
+
 /** Resolve each unique cwd to its project root; bounded concurrency so 100+
  *  unique cwds don't spawn 100 parallel git processes. */
 async function resolveRootsByCwd(cwds: string[]): Promise<Map<string, string>> {