feat(history): tombstones, deletion, and privacy semantics (slice 5/6)

extensions/history/index.ts

@@ -4,8 +4,8 @@
 // Prompt-history extension entry (slice 3): the selector TUI, overlay glue,
 // and the shortcut/command wiring over the slice-1 writer, slice-2 drains,
 // and slice-4 init sequence (legacy migration + seed bootstrap run once
-// inside getWriter). Deletion (slice 5) and GC/compaction (slice 6) arrive
-// in later slices.
+// inside getWriter). Deletion (slice 5) is wired here; GC/compaction
+// (slice 6) arrives in a later slice.
 //
 // Capture is OPT-IN while the deletion/privacy behavior is unshipped:
 // nothing is recorded unless GENTLE_PI_HISTORY_CAPTURE=1|true|on. With the
@@ -24,6 +24,8 @@ import {
 import {
   appendSessionCapture,
   bootstrapProjectSeed,
+  deleteFromGlobal,
+  deleteFromProject,
   drainGlobal,
   drainProject,
   ensureRegistryEntry,
@@ -32,15 +34,18 @@ import {
   type SessionWriterState,
 } from "./store.ts";
 import { randomUUID } from "node:crypto";
+import { hidePrompt } from "./hide-prompts.ts";
 import {
   buildPromptRecords,
   filterPrompts,
   type PromptEntry,
   clampPreviewOffset,
   clampSelectedIndex,
+  deletionActionsFor,
   dedupePromptEntries,
   getVisiblePromptRecords,
   initialLoadedCount,
+  loadedCountAfterDelete,
   loadedCountForQuery,
   loadedCountForTarget,
   moveSelectedIndex,
@@ -297,6 +302,10 @@ class PromptHistorySelector extends Container implements Focusable {
       match: (d, _kb) => matchesKey(d, "end"),
       handler: () => this.jumpToLast(),
     },
+    {
+      match: (d, _kb) => matchesKey(d, "ctrl+shift+backspace"),
+      handler: () => this.deleteCurrent(),
+    },
     {
       match: (d, _kb) => matchesKey(d, "ctrl+shift+up"),
       handler: () => this.previewPageUp(),
@@ -369,7 +378,7 @@ class PromptHistorySelector extends Container implements Focusable {
       new FixedRowText(
         theme.fg(
           "dim",
-          "↑↓ move • PgUp/PgDn page • tab scope • enter select and quit • ctrl+shift+↑/↓ preview • esc cancel",
+          "↑↓ move • PgUp/PgDn page • tab scope • enter select and quit • ctrl+shift+↑/↓ preview • ctrl+shift+backspace delete • esc cancel",
         ),
         true /* centered */,
       ),
@@ -552,6 +561,54 @@ class PromptHistorySelector extends Container implements Focusable {
     this.applyFilter(this.searchInput.getValue());
   }
 
+  /** Delete the currently selected prompt from disk and refresh the list. */
+  private deleteCurrent(): void {
+    const selected = this.filteredRecords[this.selectedIndex];
+    if (!selected) return;
+
+    // C4 delete flows (design §F): the record's provenance decides the
+    // actions via the pure planner; module constants are used directly.
+    const actions = deletionActionsFor(selected.source ?? "editor");
+
+    if (actions.deleteFromEditorStore) {
+      // Store path: physically remove EVERY copy from the JSONL store
+      // (memory + file in one atomic rewrite).
+      const { removed } =
+        this.scope === "global"
+          ? deleteFromGlobal(PI_HISTORY_ROOT, selected.text)
+          : deleteFromProject(PI_HISTORY_ROOT, CURRENT_CWD, selected.text);
+      if (removed === 0) return;
+    }
+
+    // Tombstone ALWAYS: the session transcripts are immutable and would
+    // re-supply the deleted prompt on the next merge (hide-file suppresses
+    // the twin). Only the session path aborts on a hide error — the store
+    // row is already gone on the editor path, so the splice proceeds.
+    const hide = hidePrompt(PI_HISTORY_NAV_STATE_DIR, selected.text);
+    if (hide.status === "error") {
+      this.onNotify?.(hide.message, "error");
+      if (!actions.deleteFromEditorStore) {
+        return;
+      }
+    }
+    // Remove from the master records array so a subsequent filter doesn't
+    // bring it back.
+    const idx = this.records.indexOf(selected);
+    if (idx !== -1) {
+      this.records.splice(idx, 1);
+      // C4 delete backfill (design §B3): shrink the window with the splice,
+      // then pull the next unloaded row while any remain — genuine shrink
+      // only at exhaustion.
+      this.loadedCount = loadedCountAfterDelete(
+        this.loadedCount,
+        this.records.length,
+      );
+    }
+
+    // Re-apply current filter (rebuilds filteredRecords, list, preview).
+    this.applyFilter(this.searchInput.getValue());
+  }
+
   // -- Navigation ---------------------------------------------------------
 
   private moveUp(): void {

extensions/history/selector-helpers.ts

@@ -215,6 +215,46 @@ export function loadedCountForTarget(
   return next;
 }
 
+/**
+ * Delete backfill (spec C4's two steps verbatim, AC-L4-1..3): decrement the
+ * window against the splice-shrunk snapshot; while unloaded rows remain,
+ * backfill one row (clamped) so the next unloaded record slides into the
+ * deleted slot and the visible list length stays stable; at exhaustion the
+ * decrement is the genuine shrink. Written stepwise — NOT the algebraic
+ * min(L, T') shortcut — so the unit tests pin the contract, not an
+ * equivalence. Callers guarantee the deleted row sits inside the loaded
+ * prefix (idx < loadedCount by construction).
+ */
+export function loadedCountAfterDelete(
+  loadedCount: number,
+  totalCountAfterSplice: number,
+): number {
+  const decrement = loadedCount - 1;
+  if (decrement < totalCountAfterSplice) {
+    return Math.min(decrement + 1, totalCountAfterSplice);
+  }
+  return decrement;
+}
+
+/**
+ * Pure delete-flow planner (spec C4, design §F): maps a record's provenance
+ * to the two delete actions. "editor" deletes from the editor store on disk
+ * AND writes the tombstone (twin suppression — the session copy of the same
+ * text would otherwise resurface next open); "session" writes the tombstone
+ * only (session transcripts are NEVER written). Takes source as a plain
+ * parameter (no member reads — the T23 provenance pin keeps overlay
+ * consumers source-agnostic outside deleteCurrent); the only consumer is
+ * deleteCurrent in history/index.ts.
+ */
+export function deletionActionsFor(
+  source: PromptSource,
+): { deleteFromEditorStore: boolean; writeTombstone: boolean } {
+  if (source === "editor") {
+    return { deleteFromEditorStore: true, writeTombstone: true };
+  }
+  return { deleteFromEditorStore: false, writeTombstone: true };
+}
+
 export function getVisiblePromptRecords(
   records: PromptRecord[],
   selectedIndex: number,

extensions/history/store.ts

@@ -193,8 +193,8 @@ export function parseStoreLine(raw: string): StoreEntry | null {
 }
 
 // ===========================================================================
-// Instance writer (formerly multi-store.ts; scope deletes and GC arrive
-// in later slices)
+// Instance writer (formerly multi-store.ts; GC/compaction arrives in a
+// later slice)
 // ===========================================================================
 
 /** Mutable state of ONE pi instance's exclusive capture file. */
@@ -411,6 +411,87 @@ export function drainGlobal(
   );
 }
 
+// ---------------------------------------------------------------------------
+// Scope delete (design v2)
+// ---------------------------------------------------------------------------
+
+interface SweepResult {
+  filesAffected: number;
+  removed: number;
+}
+
+/**
+ * Remove every line whose prompt identity matches `text` from each file in
+ * `files`, one atomic rewrite (tmp + rename) per affected file. Files whose
+ * every line matched are kept as empty files (never removed — the instance
+ * owning a session file may still append to it).
+ */
+function sweepFiles(files: string[], text: string): SweepResult {
+  const key = promptKey(text);
+  let filesAffected = 0;
+  let removed = 0;
+  for (const file of files) {
+    let raw = "";
+    try {
+      raw = fs.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    const kept: string[] = [];
+    let fileRemoved = 0;
+    for (const lineText of raw.split("\n")) {
+      const parsed = parseStoreLine(lineText);
+      if (!parsed) continue;
+      if (promptKey(parsed.text) === key) {
+        fileRemoved += 1;
+      } else {
+        kept.push(JSON.stringify(parsed));
+      }
+    }
+    if (fileRemoved === 0) continue;
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, kept.length > 0 ? kept.join("\n") + "\n" : "", "utf8");
+    fs.renameSync(tmp, file);
+    filesAffected += 1;
+    removed += fileRemoved;
+  }
+  return { filesAffected, removed };
+}
+
+/** Delete every copy of a prompt from the CURRENT project's scope. */
+export function deleteFromProject(
+  root: string,
+  cwd: string,
+  text: string,
+): SweepResult {
+  return sweepFiles(
+    listProjectFiles(path.join(root, "projects", projectHash(cwd))),
+    text,
+  );
+}
+
+/** Delete every copy of a prompt from the GLOBAL scope (all projects + seed). */
+export function deleteFromGlobal(root: string, text: string): SweepResult {
+  const files: string[] = [];
+  const globalSeed = globalSeedPath(root);
+  if (fs.existsSync(globalSeed)) files.push(globalSeed);
+  let projectDirs: fs.Dirent[];
+  try {
+    projectDirs = fs.readdirSync(path.join(root, "projects"), {
+      withFileTypes: true,
+    });
+  } catch {
+    projectDirs = [];
+  }
+  for (const dirEntry of projectDirs) {
+    if (!dirEntry.isDirectory()) continue;
+    files.push(
+      ...listProjectFiles(path.join(root, "projects", dirEntry.name)),
+    );
+  }
+  return sweepFiles(files, text);
+}
+
 // ---------------------------------------------------------------------------
 // Legacy migration (design v2: one-time, gated)
 // ---------------------------------------------------------------------------