pi-hashline-edit-pro 2.7.2 → 2.8.1

package/src/grep.ts

@@ -3,13 +3,12 @@ import { formatSize, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type TruncationResult
 import { Type } from "typebox";
 import { readdir, stat } from "fs/promises";
 import { dirname, join, relative } from "path";
-import { loadFileKindAndText } from "./file-kind";
-import { readNormFile } from "./file-reader";
+import { tryReadNormFile } from "./file-reader";
 import { MAX_HASH_LINES, fmtRow, HASH_LEN, HASH_SEP } from "./hashline";
 import { MAX_GREP_LINE_BYTES } from "./constants";
 import { toCwd } from "./paths";
 import { loadP, loadGuide } from "./prompts";
-import { normReq } from "./replace-normalize";
+import { normReq } from "./payload-contract";
 import { recordServedSafe } from "./served";
 import { abortIf, errCode, isRec, makePrepareArguments, rejectUnknownFields, truncateToBytes, visLines } from "./utils";
 
@@ -17,6 +16,10 @@ const GREP_KS = new Set(["pattern", "path", "glob", "context", "ignoreCase", "li
 const SKIP_DIRS = new Set(["node_modules", ".git", ".tmp", "coverage"]);
 const MAX_SCAN_FILES = 4000;
 
+function cmp(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
 export interface GrepReq {
   pattern: string;
   path?: string;
@@ -44,6 +47,7 @@ export function assertGrepReq(request: unknown): asserts request is GrepReq {
 }
 
 function buildRegex(pattern: string, literal: boolean, ignoreCase: boolean): RegExp {
+  if (!literal) assertSafeRegex(pattern);
   const source = literal ? pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") : pattern;
   try {
     return new RegExp(source, ignoreCase ? "ui" : "u");
@@ -52,7 +56,97 @@ function buildRegex(pattern: string, literal: boolean, ignoreCase: boolean): Reg
   }
 }
 
+interface RegexGroupRisk {
+  hasQuantifier: boolean;
+  hasAlternation: boolean;
+}
+
+function unsafeRegex(pattern: string): never {
+  throw new Error(
+    `[E_UNSAFE_REGEX] Refusing potentially exponential regex: ${pattern}. Use literal: true or simplify the expression.`,
+  );
+}
+
+function assertSafeRegex(pattern: string): void {
+  if (pattern.length > 4096) unsafeRegex(pattern);
+
+  const groups: RegexGroupRisk[] = [];
+  let inClass = false;
+  let escaped = false;
+  let variableQuantifiers = 0;
+  let lastAtom: { groupRisky: boolean; quantified: boolean } | undefined;
+
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i]!;
+    if (escaped) {
+      if (!inClass && (/[1-9]/.test(ch) || (ch === "k" && pattern[i + 1] === "<"))) {
+        unsafeRegex(pattern);
+      }
+      escaped = false;
+      lastAtom = { groupRisky: false, quantified: false };
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") {
+        inClass = false;
+        lastAtom = { groupRisky: false, quantified: false };
+      }
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "(") {
+      groups.push({ hasQuantifier: false, hasAlternation: false });
+      lastAtom = undefined;
+      continue;
+    }
+    if (ch === ")") {
+      const group = groups.pop();
+      if (group) {
+        lastAtom = {
+          groupRisky: group.hasQuantifier || group.hasAlternation,
+          quantified: false,
+        };
+      }
+      continue;
+    }
+    if (ch === "|") {
+      const group = groups.at(-1);
+      if (group) group.hasAlternation = true;
+      lastAtom = undefined;
+      continue;
+    }
+
+    let quantifierLength = 0;
+    if (ch === "*" || ch === "+" || ch === "?") {
+      quantifierLength = 1;
+    } else if (ch === "{") {
+      quantifierLength = /^\{\d+(?:,\d*)?\}/.exec(pattern.slice(i))?.[0].length ?? 0;
+    }
+    if (quantifierLength > 0 && lastAtom) {
+      if (ch === "?" && lastAtom.quantified) continue;
+      const variable = ch !== "{" || pattern.slice(i, i + quantifierLength).includes(",");
+      if (variable && ++variableQuantifiers > 1) unsafeRegex(pattern);
+      if (lastAtom.groupRisky) unsafeRegex(pattern);
+      const group = groups.at(-1);
+      if (group) group.hasQuantifier = true;
+      lastAtom.quantified = true;
+      i += quantifierLength - 1;
+      continue;
+    }
+
+    lastAtom = { groupRisky: false, quantified: false };
+  }
+}
+
 function globToRegex(glob: string): RegExp {
+  if (glob.startsWith("/")) glob = glob.slice(1);
   let source = "";
   let i = 0;
   while (i < glob.length) {
@@ -79,12 +173,6 @@ function globToRegex(glob: string): RegExp {
   return new RegExp(`^${source}$`);
 }
 
-function isSkipableLoadError(error: unknown): boolean {
-  const code = errCode(error);
-  if (code === "EACCES" || code === "EPERM" || code === "ENOENT" || code === "ELOOP") return true;
-  return error instanceof Error && error.message.startsWith("[E_FILE_TOO_LARGE]");
-}
-
 interface FileHit {
   path: string;
   displayPath: string;
@@ -140,18 +228,24 @@ async function walkFiles(
   root: string,
   state: ScanState,
   onFile: (absPath: string) => Promise<void>,
+  signal?: AbortSignal,
 ): Promise<void> {
   const queue: string[] = [root];
-  while (queue.length > 0 && !state.stopped) {
-    const dir = queue.pop()!;
+  let head = 0;
+  while (head < queue.length && !state.stopped) {
+    abortIf(signal);
+    const dir = queue[head++]!;
     let entries;
     try {
       entries = await readdir(dir, { withFileTypes: true });
     } catch {
       continue;
     }
-    for (const entry of entries) {
+    entries.sort((a, b) => cmp(a.name, b.name));
+    for (let ei = 0; ei < entries.length; ei++) {
+      if ((ei & 127) === 0) abortIf(signal);
       if (state.stopped) break;
+      const entry = entries[ei]!;
       const full = join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
@@ -176,30 +270,20 @@ async function searchFile(
   globRegex: RegExp | undefined,
   context: number,
   maxMatches: number,
+  signal?: AbortSignal,
 ): Promise<FileHit | undefined> {
   const displayPath = relative(cwd, absPath).replace(/\\/g, "/");
   if (globRegex) {
     const globPath = relative(globRoot, absPath).replace(/\\/g, "/");
-    if (!globRegex.test(globPath)) return undefined;
-  }
-  let file;
-  try {
-    file = await loadFileKindAndText(absPath, { maxLines: MAX_HASH_LINES, displayPath });
-  } catch (error) {
-    if (isSkipableLoadError(error)) return undefined;
-    throw error;
-  }
-  if (file.kind !== "text") return undefined;
-  let norm;
-  try {
-    norm = await readNormFile(absPath, cwd, { maxLines: MAX_HASH_LINES, preloadedFile: file, noPersist: true });
-  } catch (error) {
-    if (isSkipableLoadError(error)) return undefined;
-    throw error;
+    if (!globRegex.test(globPath) && !globRegex.test(displayPath)) return undefined;
   }
+  const norm = await tryReadNormFile(absPath, cwd, { maxLines: MAX_HASH_LINES, noPersist: true, signal });
+  if (!norm) return undefined;
   const lines = visLines(norm.normalized);
   const matchLines: number[] = [];
   for (let i = 0; i < lines.length; i++) {
+    if ((i & 1023) === 0) abortIf(signal);
+    if (i !== 0 && (i & 4095) === 0) await new Promise<void>((r) => setImmediate(r));
     if (regex.test(lines[i]!)) matchLines.push(i);
   }
   if (matchLines.length === 0) return undefined;
@@ -252,7 +336,7 @@ const grepToolSchema = Type.Object(
     ),
     glob: Type.Optional(
       Type.String({
-        description: "Filter files by glob pattern; * matches across directories, e.g. '*.ts' or '**/*.spec.ts'",
+        description: "Filter files by glob pattern; * matches across directories, e.g. '*.ts' or '**/*.spec.ts'. A leading / is ignored; the pattern may be relative to the search root or to the current directory.",
       }),
     ),
     ignoreCase: Type.Optional(
@@ -290,6 +374,7 @@ export function regGrep(pi: ExtensionAPI): void {
     promptGuidelines: loadGuide("../prompts/grep-guidelines.md"),
     prepareArguments: makePrepareArguments(),
     parameters: grepToolSchema,
+    executionMode: "sequential",
 
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
       const canonical = normReq(params);
@@ -318,7 +403,8 @@ export function regGrep(pi: ExtensionAPI): void {
       } else {
         await walkFiles(base, state, async (absPath) => {
           files.push(absPath);
-        });
+        }, signal);
+        files.sort(cmp);
       }
       const hits: FileHit[] = [];
       let matches = 0;
@@ -335,7 +421,7 @@ export function regGrep(pi: ExtensionAPI): void {
         abortIf(signal);
         const absPath = files[f]!;
         if (countOnly) {
-          const hit = await searchFile(absPath, globRoot, ctx.cwd, regex, globRegex, context, Number.MAX_SAFE_INTEGER);
+          const hit = await searchFile(absPath, globRoot, ctx.cwd, regex, globRegex, context, Number.MAX_SAFE_INTEGER, signal);
           if (!hit) continue;
           totalRows += hit.rows.length;
           for (const row of hit.rows) totalBytes += Buffer.byteLength(row, "utf-8") + 1;
@@ -353,7 +439,7 @@ export function regGrep(pi: ExtensionAPI): void {
           limitTruncated = true;
           break;
         }
-        const hit = await searchFile(absPath, globRoot, ctx.cwd, regex, globRegex, context, remaining);
+        const hit = await searchFile(absPath, globRoot, ctx.cwd, regex, globRegex, context, remaining, signal);
         if (!hit) continue;
         const keptRows: string[] = [];
         const keptHashes: string[] = [];
@@ -382,6 +468,7 @@ export function regGrep(pi: ExtensionAPI): void {
         hits.push({ ...hit, rows: keptRows, hashes: keptHashes });
         if (rowTruncated) countOnly = true;
       }
+      hits.sort((a, b) => cmp(a.displayPath, b.displayPath));
       for (const hit of hits) {
         await recordServedSafe(hit.path, hit.hashes, "grep", new Set(hit.fileHashes));
       }

package/src/hash-store/cache.ts

@@ -0,0 +1,18 @@
+export interface SnapshotCacheEntry {
+  checksum: string;
+  lineCount: number;
+  hashes: string[];
+}
+
+export const SNAPSHOT_CACHE_LIMIT = 256;
+
+export const snapshotCache = new Map<string, SnapshotCacheEntry>();
+
+export function cacheSnapshot(path: string, checksum: string, lineCount: number, hashes: string[]): void {
+  snapshotCache.delete(path);
+  snapshotCache.set(path, { checksum, lineCount, hashes: hashes.slice() });
+  if (snapshotCache.size > SNAPSHOT_CACHE_LIMIT) {
+    const oldest = snapshotCache.keys().next().value;
+    if (oldest !== undefined) snapshotCache.delete(oldest);
+  }
+}

package/src/hash-store/retry.ts

@@ -0,0 +1,48 @@
+import { isBusyError } from "./validation";
+
+const sleepSab = new Int32Array(new SharedArrayBuffer(4));
+
+function sleepSync(ms: number): void {
+  Atomics.wait(sleepSab, 0, 0, ms);
+}
+
+const BUSY_RETRIES = 3;
+const BUSY_RETRY_DELAY_MS = 50;
+
+export function withBusyRetry<T>(fn: () => T): T {
+  let lastError: unknown;
+  for (let attempt = 0; attempt <= BUSY_RETRIES; attempt++) {
+    try {
+      return fn();
+    } catch (error) {
+      lastError = error;
+      if (!isBusyError(error) || attempt === BUSY_RETRIES) throw error;
+      sleepSync(BUSY_RETRY_DELAY_MS * (1 << attempt));
+    }
+  }
+  throw lastError;
+}
+
+export async function withBusyRetryAsync<T>(fn: () => T): Promise<T> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt <= BUSY_RETRIES; attempt++) {
+    try {
+      return fn();
+    } catch (error) {
+      lastError = error;
+      if (!isBusyError(error) || attempt === BUSY_RETRIES) throw error;
+      await new Promise<void>((r) => setTimeout(r, BUSY_RETRY_DELAY_MS * (1 << attempt)));
+    }
+  }
+  throw lastError;
+}
+
+export function retriedWrite(stmt: { run(...params: (string | number)[]): unknown }): (...params: (string | number)[]) => void {
+  return (...params) => {
+    withBusyRetry(() => { stmt.run(...params); });
+  };
+}
+
+export async function openDbWithBusyRetryAsync<T>(fn: () => T): Promise<T> {
+  return withBusyRetryAsync(fn);
+}

package/src/hash-store/validation.ts

@@ -0,0 +1,62 @@
+import { HASH_RE } from "../hashline/alphabet";
+
+export function isValidHashList(value: unknown): value is string[] {
+  if (!Array.isArray(value)) return false;
+  for (const hash of value) {
+    if (typeof hash !== "string" || !HASH_RE.test(hash)) return false;
+  }
+  if (new Set(value).size !== value.length) return false;
+  return true;
+}
+
+export function parseHashList(raw: string, onInvalid: () => void, context?: string): string[] | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    console.error(`[parseHashList]${context ? ` ${context}:` : ""} failed to parse stored hashes JSON:`, error);
+    onInvalid();
+    return undefined;
+  }
+  if (!isValidHashList(parsed)) {
+    console.error(`[parseHashList]${context ? ` ${context}:` : ""} stored hashes did not pass validation:`, Array.isArray(parsed) ? `length=${parsed.length} sample=${JSON.stringify(parsed.slice(0, 3))}` : (() => { try { return JSON.stringify(parsed)?.slice(0, 500) ?? String(parsed).slice(0, 500); } catch { return String(parsed).slice(0, 500); } })());
+    onInvalid();
+    return undefined;
+  }
+  return parsed;
+}
+
+export function parseStoredHashes(row: Record<string, unknown> | undefined, onInvalid: () => void): string[] | undefined {
+  if (!row) return undefined;
+  return parseHashList(row.hashes as string, onInvalid);
+}
+
+export function isValidSnapshot(value: unknown): value is { content: string; hashes: string[] } {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as Record<string, unknown>;
+  if (typeof v.content !== "string") return false;
+  return isValidHashList(v.hashes);
+}
+
+export function isCorruptionError(error: unknown): boolean {
+  if (error && typeof error === "object") {
+    const errcode = (error as { errcode?: unknown }).errcode;
+    if (typeof errcode === "number") {
+      return errcode === 11 || errcode === 24 || errcode === 26;
+    }
+    const code = (error as { code?: unknown }).code;
+    if (typeof code === "string" && /NOTADB|CORRUPT/.test(code)) return true;
+  }
+  return (
+    error instanceof Error &&
+    /corrupt|not a database|malformed|database disk image/i.test(error.message)
+  );
+}
+
+export function isBusyError(error: unknown): boolean {
+  if (error && typeof error === "object") {
+    const errcode = (error as { errcode?: unknown }).errcode;
+    if (typeof errcode === "number") return errcode === 5 || errcode === 6;
+  }
+  return error instanceof Error && /busy|locked/i.test(error.message);
+}

package/src/hash-store.ts

@@ -1,10 +1,30 @@
 import { existsSync } from "fs";
-import { readFile, rename, mkdir, stat } from "fs/promises";
+import { chmod, readFile, rename, mkdir, stat } from "fs/promises";
 import { hashStorePath, hashStoreDir, legacyHashStorePath } from "./paths";
 import { errCode, isRec, splitLines } from "./utils";
 import { initHasher, contentChecksum } from "./hashline/hasher";
-import { HASH_RE } from "./hashline/alphabet";
 import { HASH_STORE_VERSION, HASH_STORE_BUSY_TIMEOUT } from "./constants";
+import {
+  isValidHashList,
+  parseStoredHashes,
+  isValidSnapshot,
+  isCorruptionError,
+  parseHashList,
+} from "./hash-store/validation";
+import {
+  withBusyRetry,
+  retriedWrite,
+  openDbWithBusyRetryAsync,
+} from "./hash-store/retry";
+import {
+  snapshotCache,
+  cacheSnapshot,
+  SNAPSHOT_CACHE_LIMIT,
+} from "./hash-store/cache";
+
+export { isValidHashList, parseHashList, parseStoredHashes, isCorruptionError };
+export { SNAPSHOT_CACHE_LIMIT };
+export const STORE_NOT_OPEN_MESSAGE = "Hash store is not open; transactional update aborted";
 
 type SqlParams = (string | number)[];
 
@@ -90,117 +110,10 @@ export interface UndoRecord {
   resultContent: string;
 }
 
-interface LegacySnapshot {
-  content: string;
-  hashes: string[];
-}
-
-export function isValidHashList(value: unknown): value is string[] {
-  if (!Array.isArray(value)) return false;
-  for (const hash of value) {
-    if (typeof hash !== "string" || !HASH_RE.test(hash)) return false;
-  }
-  if (new Set(value).size !== value.length) return false;
-  return true;
-}
-
-export function parseHashList(raw: string, onInvalid: () => void): string[] | undefined {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    onInvalid();
-    return undefined;
-  }
-  if (!isValidHashList(parsed)) {
-    onInvalid();
-    return undefined;
-  }
-  return parsed;
-}
-
-export function parseStoredHashes(
-  row: Record<string, unknown> | undefined,
-  onInvalid: () => void,
-): string[] | undefined {
-  if (!row) return undefined;
-  return parseHashList(row.hashes as string, onInvalid);
-}
-
-function isValidSnapshot(value: unknown): value is LegacySnapshot {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value as Record<string, unknown>;
-  if (typeof v.content !== "string") return false;
-  return isValidHashList(v.hashes);
-}
-
-export function isCorruptionError(error: unknown): boolean {
-  if (error && typeof error === "object") {
-    const errcode = (error as { errcode?: unknown }).errcode;
-    if (typeof errcode === "number") {
-      return errcode === 11 || errcode === 24 || errcode === 26;
-    }
-    const code = (error as { code?: unknown }).code;
-    if (typeof code === "string" && /NOTADB|CORRUPT/.test(code)) return true;
-  }
-  return (
-    error instanceof Error &&
-    /corrupt|not a database|malformed|database disk image/i.test(error.message)
-  );
-}
-
-function isBusyError(error: unknown): boolean {
-  if (error && typeof error === "object") {
-    const errcode = (error as { errcode?: unknown }).errcode;
-    if (typeof errcode === "number") return errcode === 5 || errcode === 6;
-  }
-  return error instanceof Error && /busy|locked/i.test(error.message);
-}
-
-function sleepSync(ms: number): void {
-  const sab = new Int32Array(new SharedArrayBuffer(4));
-  Atomics.wait(sab, 0, 0, ms);
-}
-
-const BUSY_RETRIES = 3;
-const BUSY_RETRY_DELAY_MS = 100;
-
-function withBusyRetry<T>(fn: () => T): T {
-  let lastError: unknown;
-  for (let attempt = 0; attempt <= BUSY_RETRIES; attempt++) {
-    try {
-      return fn();
-    } catch (error) {
-      lastError = error;
-      if (!isBusyError(error) || attempt === BUSY_RETRIES) throw error;
-      sleepSync(BUSY_RETRY_DELAY_MS);
-    }
-  }
-  throw lastError;
-}
-
-function openDbWithBusyRetry(storePath: string): { db: RawDb; stmts: Prepared } {
-  return withBusyRetry(() => openDb(storePath));
-}
-
-function retriedWrite(
-  stmt: { run(...params: SqlParams): unknown },
-): (...params: SqlParams) => void {
-  return (...params) => {
-    withBusyRetry(() => { stmt.run(...params); });
-  };
-}
-
 let cachedDb: { path: string; db: RawDb; stmts: Prepared } | null = null;
 let opening: { path: string; promise: Promise<HashStore> } | null = null;
 let exitHandlerRegistered = false;
-interface SnapshotCacheEntry {
-  checksum: string;
-  lineCount: number;
-  hashes: string[];
-}
-const snapshotCache = new Map<string, SnapshotCacheEntry>();
-export const SNAPSHOT_CACHE_LIMIT = 256;
+
 function openDb(storePath: string): { db: RawDb; stmts: Prepared } {
   const db = openDbFn(storePath);
   try {
@@ -213,9 +126,7 @@ function openDb(storePath: string): { db: RawDb; stmts: Prepared } {
   }
 }
 
-function buildStore(
-  db: RawDb,
-): { db: RawDb; stmts: Prepared } {
+function buildStore(db: RawDb): { db: RawDb; stmts: Prepared } {
   db.exec("PRAGMA journal_mode = WAL");
   db.exec("PRAGMA synchronous = NORMAL");
   db.exec(
@@ -333,30 +244,45 @@ function shutdownDb(db: RawDb): void {
 }
 
 async function openStore(storePath: string): Promise<HashStore> {
-  shutdownHashStore();
-
+  if (cachedDb && cachedDb.path === storePath && cachedDb.db.isOpen) {
+    return { stmts: cachedDb.stmts, engine: sqliteEngine };
+  }
+  if (cachedDb) shutdownHashStore();
   await initHasher();
-  await mkdir(hashStoreDir(), { recursive: true });
+  await mkdir(hashStoreDir(), { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") {
+    await chmod(hashStoreDir(), 0o700);
+  }
 
   let existed = existsSync(storePath);
   let opened: { db: RawDb; stmts: Prepared };
   try {
-    opened = openDbWithBusyRetry(storePath);
+    opened = await openDbWithBusyRetryAsync(() => openDb(storePath));
   } catch (error) {
     if (!isCorruptionError(error)) throw error;
     console.error("Hash store failed to open, rebuilding:", error);
     await quarantineStore(storePath);
     existed = false;
-    opened = openDbWithBusyRetry(storePath);
+    opened = await openDbWithBusyRetryAsync(() => openDb(storePath));
   }
   if (!isHealthy(opened.db)) {
     shutdownDb(opened.db);
     await quarantineStore(storePath);
     existed = false;
-    opened = openDbWithBusyRetry(storePath);
+    opened = await openDbWithBusyRetryAsync(() => openDb(storePath));
   }
   const { db, stmts } = opened;
 
+  if (process.platform !== "win32") {
+    for (const candidate of [storePath, `${storePath}-wal`, `${storePath}-shm`]) {
+      try {
+        await chmod(candidate, 0o600);
+      } catch (error) {
+        if (errCode(error) !== "ENOENT") throw error;
+      }
+    }
+  }
+
   if (!existed) {
     try {
       await migrateLegacy(db);
@@ -403,9 +329,9 @@ export function shutdownHashStore(): void {
   snapshotCache.clear();
 }
 
-function withStore(fn: () => void): void {
-  if (!cachedDb) {
-    throw new Error("Hash store is not open; transactional update aborted");
+export function withStore(fn: () => void): void {
+  if (!cachedDb || !cachedDb.db.isOpen) {
+    throw new Error(STORE_NOT_OPEN_MESSAGE);
   }
   withBusyRetry(() => {
     cachedDb!.db.exec("BEGIN IMMEDIATE");
@@ -485,15 +411,6 @@ async function migrateLegacy(db: RawDb): Promise<void> {
   }
 }
 
-function cacheSnapshot(path: string, checksum: string, lineCount: number, hashes: string[]): void {
-  snapshotCache.delete(path);
-  snapshotCache.set(path, { checksum, lineCount, hashes: hashes.slice() });
-  if (snapshotCache.size > SNAPSHOT_CACHE_LIMIT) {
-    const oldest = snapshotCache.keys().next().value;
-    if (oldest !== undefined) snapshotCache.delete(oldest);
-  }
-}
-
 export function getSnapshot(
   store: HashStore,
   path: string,
@@ -528,6 +445,14 @@ export function upsertSnapshot(
   store.stmts.upsert(path, checksum, lineCount, JSON.stringify(hashes), Date.now());
   cacheSnapshot(path, checksum, lineCount, hashes);
 }
+export function persistSnapshot(
+  store: HashStore,
+  path: string,
+  content: string,
+  hashes: string[],
+): void {
+  upsertSnapshot(store, path, contentChecksum(content), splitLines(content).length, hashes);
+}
 
 export function upsertUndo(store: HashStore, path: string, entry: UndoRecord): void {
   store.stmts.undoUpsert(
@@ -593,22 +518,32 @@ export async function pruneMissing(store: HashStore): Promise<void> {
   withStore(() => {
     for (const path of missing) {
       store.stmts.deleteOne(path);
-      snapshotCache.delete(path);
       store.stmts.servedDelete(path);
     }
   });
+  for (const path of missing) snapshotCache.delete(path);
 }
 
 function matchPathsByHashes(
   rows: { path: string; hashes: string }[],
   hashes: string[],
 ): string[] {
+  const needed = new Set(hashes);
+  if (needed.size === 0) return [];
   const matches: string[] = [];
   for (const row of rows) {
     try {
       const parsed = JSON.parse(row.hashes) as unknown;
       if (!isValidHashList(parsed)) continue;
-      if (hashes.every((h) => parsed.includes(h))) matches.push(row.path);
+      const parsedSet = new Set(parsed);
+      let ok = true;
+      for (const h of needed) {
+        if (!parsedSet.has(h)) {
+          ok = false;
+          break;
+        }
+      }
+      if (ok) matches.push(row.path);
     } catch {
       continue;
     }