From 59ecb011c0316edbfbdb9eb4bb869157fbf86351 Mon Sep 17 00:00:00 2001
From: oratis <wangharp@gmail.com>
Date: Sun, 9 Aug 2026 22:54:56 +0800
Subject: [PATCH 1/2] feat(desktop): remove threads through the protocol, not
 around it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sidebar archived and deleted session files through Tauri while the
app-server served the same threads. That is not only a second reader — the
app-server is the single owner and writer of thread storage, so a renderer
deleting files behind it can pull the ground out from under an open writer or
leave the index pointing at something gone.

Three call sites, not the two THREE_WAY_REVIEW recorded. `window.deepcode.
sessions.list()` has preferred the protocol since #231, but `Sidebar.tsx`
bypassed the shim and called `listSessions()` directly — so the list was a
second reader too, with its own row shape and its own sort.

`thread/delete` is new. The protocol could list, fork and archive but not
delete, which is why delete had nowhere to go. It sits under the existing
`threadManagement` capability and mirrors `archive`: 404 on a thread that does
not exist rather than silently succeeding, and a store that cannot delete says
so instead of quietly archiving instead — being helpful about a destructive verb
by doing a different one is the worst available answer.

Deleting removes both representations. The protocol snapshot and the canonical
session projection share an id and are two views of one thing, and the composite
`list` reads both; removing one left the row reappearing on the next refresh as
an empty session that could not be opened. `SessionManager.delete` takes the
stream, the legacy stream, the meta sidecar, the writer lock and the per-session
directory — the listing reads the sidecar, so leaving it behind is not a tidy
half-delete.

The Tauri commands stay as the fallback for a sidecar too old to serve the
methods, matching what #231 established for `list`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md                                | 18 +++++++
 apps/desktop/src/components/Sidebar.tsx     | 47 ++++++++++++------
 apps/desktop/src/lib/protocol-agent.test.ts | 38 +++++++++++++++
 apps/desktop/src/lib/protocol-agent.ts      | 11 +++++
 apps/desktop/src/lib/window-shim.ts         | 25 ++++++++++
 apps/desktop/src/preview-app.tsx            |  7 +++
 apps/desktop/src/types/global.d.ts          |  4 ++
 apps/server/src/server.ts                   |  2 +
 apps/server/src/store.test.ts               | 54 +++++++++++++++++++++
 apps/server/src/store.ts                    | 21 +++++++-
 docs/THREE_WAY_REVIEW.md                    |  8 ++-
 packages/core/src/sessions/manager.ts       |  5 ++
 packages/core/src/sessions/storage.ts       | 26 ++++++++++
 packages/protocol/src/runtime.test.ts       | 25 ++++++++++
 packages/protocol/src/runtime.ts            | 31 ++++++++++++
 packages/protocol/src/types.ts              |  8 +--
 16 files changed, 309 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ad8e1c..952ec3d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   so anyone relying on the old behaviour must add rules — or start the server
   with an explicit `--mode`. `--sandbox` also applies now; it did not before.
 
+### ✨ Added
+
+- **`thread/delete`** — the protocol could list, fork and archive threads but not
+  delete one, so the desktop deleted session files through Tauri instead. The
+  app-server is the single owner of thread storage; a client removing files
+  behind it can pull the ground out from under an open writer. Served under the
+  existing `threadManagement` capability, with the local writer kept as the
+  fallback for a sidecar too old to know the method.
+
+
 ### 🔒 Security
 
 - **A sub-agent did not inherit the file contract.** The `Task` delegation
@@ -42,6 +52,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🐛 Fixed
 
+- **The desktop sidebar was a second reader of the session directory.** Archive
+  and delete went through Tauri while the protocol served the same threads, and
+  the list did too — `window.deepcode.sessions.list()` had preferred the
+  protocol since #231, but `Sidebar.tsx` bypassed the shim and called
+  `listSessions()` directly. All three now go through the owner, and deleting a
+  thread removes both its protocol snapshot and its canonical session
+  projection: `list` reads both, so removing one left the row reappearing on the
+  next refresh as an empty session that could not be opened.
 - **`Grep` over a single file no longer prefixes every line with a colon.**
   ripgrep omits the filename when the search path is one _file_ — there is
   nothing to disambiguate — so its `--null` output carries no NUL, and rejoining
diff --git a/apps/desktop/src/components/Sidebar.tsx b/apps/desktop/src/components/Sidebar.tsx
index 0955756..744ffcc 100644
--- a/apps/desktop/src/components/Sidebar.tsx
+++ b/apps/desktop/src/components/Sidebar.tsx
@@ -6,13 +6,7 @@
 
 import { useCallback, useEffect, useState, type JSX } from 'react';
 import { projectName } from '../lib/project.js';
-import {
-  listSessions,
-  sessionArchive,
-  sessionDelete,
-  sessionSetTitle,
-  type SessionMeta,
-} from '../lib/tauri-api.js';
+import { sessionSetTitle } from '../lib/tauri-api.js';
 import { BrandMark } from './BrandMark.js';
 
 interface SidebarProps {
@@ -28,6 +22,20 @@ interface SidebarProps {
   onSessionRemoved?: (id: string) => void;
 }
 
+/**
+ * One row, as the app-server describes it.
+ *
+ * The sidebar used to read the session directory through Tauri while
+ * `window.deepcode.sessions.list()` read the same directory through the
+ * protocol — two readers of one directory, each with its own row shape and its
+ * own sort. This is the one the owner of that storage returns.
+ */
+interface SessionRow {
+  id: string;
+  title?: string;
+  updatedAtSecs: number;
+}
+
 type Bucket = 'Today' | 'Yesterday' | 'Earlier';
 
 function bucketFor(updatedAtSecs: number, nowSecs: number): Bucket {
@@ -53,7 +61,7 @@ export function Sidebar({
   onSwitchProject,
   onSessionRemoved,
 }: SidebarProps): JSX.Element {
-  const [sessions, setSessions] = useState<SessionMeta[]>([]);
+  const [sessions, setSessions] = useState<SessionRow[]>([]);
   const [now, setNow] = useState<number>(Math.floor(Date.now() / 1000));
   // Inline rename: which session is being edited + its draft title.
   const [editingId, setEditingId] = useState<string | null>(null);
@@ -61,8 +69,17 @@ export function Sidebar({
   const [query, setQuery] = useState('');
 
   const reload = useCallback(() => {
-    void listSessions()
-      .then(setSessions)
+    void window.deepcode.sessions
+      .list()
+      .then((rows) =>
+        setSessions(
+          rows.map((row) => ({
+            id: row.id,
+            title: row.title,
+            updatedAtSecs: Math.floor(new Date(row.updatedAt).getTime() / 1000),
+          })),
+        ),
+      )
       .catch(() => setSessions([]));
   }, []);
 
@@ -92,7 +109,7 @@ export function Sidebar({
 
   async function handleArchive(id: string): Promise<void> {
     try {
-      await sessionArchive(id);
+      await window.deepcode.sessions.archive({ id });
       if (id === activeSessionId) onSessionRemoved?.(id);
       reload();
     } catch {
@@ -105,7 +122,7 @@ export function Sidebar({
       return;
     }
     try {
-      await sessionDelete(id);
+      await window.deepcode.sessions.delete({ id });
       if (id === activeSessionId) onSessionRemoved?.(id);
       reload();
     } catch {
@@ -119,13 +136,13 @@ export function Sidebar({
         (s) => (s.title || '').toLowerCase().includes(q) || s.id.toLowerCase().includes(q),
       )
     : sessions;
-  const grouped: Record<Bucket, SessionMeta[]> = {
+  const grouped: Record<Bucket, SessionRow[]> = {
     Today: [],
     Yesterday: [],
     Earlier: [],
   };
   for (const s of visible) {
-    grouped[bucketFor(s.updated_at_secs, now)].push(s);
+    grouped[bucketFor(s.updatedAtSecs, now)].push(s);
   }
 
   return (
@@ -227,7 +244,7 @@ export function Sidebar({
                 ) : (
                   <span className="label">{s.title?.trim() ? s.title : shortTitle(s.id)}</span>
                 )}
-                <span className="meta">{relTime(s.updated_at_secs, now)}</span>
+                <span className="meta">{relTime(s.updatedAtSecs, now)}</span>
                 {editingId !== s.id && (
                   <span className="row-actions">
                     <button
diff --git a/apps/desktop/src/lib/protocol-agent.test.ts b/apps/desktop/src/lib/protocol-agent.test.ts
index 805a9d4..2e0c8d4 100644
--- a/apps/desktop/src/lib/protocol-agent.test.ts
+++ b/apps/desktop/src/lib/protocol-agent.test.ts
@@ -318,3 +318,41 @@ describe('DesktopProtocolAgent', () => {
     });
   });
 });
+
+// The sidebar removed threads through Tauri while the protocol served
+// `thread/archive` — a second writer against storage the app-server owns.
+describe('thread removal', () => {
+  it('archives through the protocol', async () => {
+    const transport = new FakeTransport();
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.archiveThread('thread-1')).toBe(true);
+    expect(transport.requests).toContainEqual({
+      method: 'thread/archive',
+      params: { threadId: 'thread-1' },
+    });
+  });
+
+  it('deletes through the protocol', async () => {
+    const transport = new FakeTransport();
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.deleteThread('thread-1')).toBe(true);
+    expect(transport.requests).toContainEqual({
+      method: 'thread/delete',
+      params: { threadId: 'thread-1' },
+    });
+  });
+
+  it('reports false — not an exception — when the server cannot manage threads', async () => {
+    // The caller falls back to the local writer on false. Throwing would make a
+    // sidecar that predates the method look like a delete that failed.
+    const transport = new FakeTransport();
+    const original = transport.connect.bind(transport);
+    transport.connect = async () => {
+      const init = await original();
+      return { ...init, capabilities: { ...init.capabilities, threadManagement: false } };
+    };
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.deleteThread('thread-1')).toBe(false);
+    expect(transport.requests).toHaveLength(0);
+  });
+});
diff --git a/apps/desktop/src/lib/protocol-agent.ts b/apps/desktop/src/lib/protocol-agent.ts
index 1020015..c39dfbc 100644
--- a/apps/desktop/src/lib/protocol-agent.ts
+++ b/apps/desktop/src/lib/protocol-agent.ts
@@ -92,6 +92,13 @@ export class DesktopProtocolAgent {
     return true;
   }
 
+  async deleteThread(threadId: string): Promise<boolean> {
+    const initialized = await this.transport.connect();
+    if (!initialized.capabilities.threadManagement) return false;
+    await this.transport.request('thread/delete', { threadId });
+    return true;
+  }
+
   async resume(threadId: string): Promise<ThreadSnapshot> {
     await this.transport.connect();
     if (this.threadId && this.threadId !== threadId) {
@@ -387,6 +394,10 @@ export function archiveProtocolThread(threadId: string) {
   return defaultAgent.archiveThread(threadId);
 }
 
+export function deleteProtocolThread(threadId: string) {
+  return defaultAgent.deleteThread(threadId);
+}
+
 export function resumeProtocolThread(threadId: string) {
   return defaultAgent.resume(threadId);
 }
diff --git a/apps/desktop/src/lib/window-shim.ts b/apps/desktop/src/lib/window-shim.ts
index 23c0c35..92d41b8 100644
--- a/apps/desktop/src/lib/window-shim.ts
+++ b/apps/desktop/src/lib/window-shim.ts
@@ -8,6 +8,8 @@ import {
   abortProtocolTurn,
   answerProtocolRequest,
   approveProtocolRequest,
+  archiveProtocolThread,
+  deleteProtocolThread,
   getConfigDiagnostics,
   installProtocolAgentEmitter,
   listProtocolThreads,
@@ -23,6 +25,8 @@ import {
   loadSettingsFile,
   openUrl,
   saveCredentials,
+  sessionArchive,
+  sessionDelete,
   sessionRead,
 } from './tauri-api.js';
 
@@ -91,6 +95,27 @@ export function installTauriShim(): void {
           updatedAt: new Date(r.updated_at_secs * 1000).toISOString(),
         }));
       },
+      // Archive and delete follow list: the app-server owns thread storage and
+      // is its single writer, so a renderer removing files through Tauri is
+      // reaching around the owner — and for delete that can pull the ground out
+      // from under an open writer. The Tauri command stays as the fallback for a
+      // sidecar too old to serve the method, same as list.
+      async archive({ id }) {
+        try {
+          if (await archiveProtocolThread(id)) return;
+        } catch {
+          /* fall through to the local writer */
+        }
+        await sessionArchive(id);
+      },
+      async delete({ id }) {
+        try {
+          if (await deleteProtocolThread(id)) return;
+        } catch {
+          /* fall through to the local writer */
+        }
+        await sessionDelete(id);
+      },
       async resume({ id }) {
         // The snapshot carries every completed item — approvals, ask-user
         // exchanges, errors, review findings. The session projection keeps only
diff --git a/apps/desktop/src/preview-app.tsx b/apps/desktop/src/preview-app.tsx
index 46744b7..7cab05c 100644
--- a/apps/desktop/src/preview-app.tsx
+++ b/apps/desktop/src/preview-app.tsx
@@ -297,6 +297,13 @@ async function handleProtocolRequest(request: ProtocolRequest): Promise<void> {
       archivedThreads.add(String(request.params.threadId));
       await respond({ archived: true });
       break;
+    case 'thread/delete':
+      // The fixture cannot distinguish the two on its own storage, but the
+      // journey only needs the row to leave the list — what it is asserting is
+      // that the button reached the protocol at all.
+      archivedThreads.add(String(request.params.threadId));
+      await respond({ deleted: true });
+      break;
     case 'workspace/diff':
       await respond({
         repository: true,
diff --git a/apps/desktop/src/types/global.d.ts b/apps/desktop/src/types/global.d.ts
index 1a908da..5a69b54 100644
--- a/apps/desktop/src/types/global.d.ts
+++ b/apps/desktop/src/types/global.d.ts
@@ -58,6 +58,10 @@ export interface DeepCodeAPI {
     resume: (args: {
       id: string;
     }) => Promise<{ history: unknown[]; sessionId: string; thread?: unknown }>;
+    /** Move a thread out of the listing. Reversible on disk. */
+    archive: (args: { id: string }) => Promise<void>;
+    /** Irreversibly drop a thread and everything it owns. */
+    delete: (args: { id: string }) => Promise<void>;
   };
   plugins: {
     list: () => Promise<PluginRow[]>;
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 3223fe9..3caa34f 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -239,6 +239,8 @@ export class AppServer {
         return this.lifecycle.forkThread(requiredId(request.params, 'threadId'), traceId);
       case 'thread/archive':
         return this.lifecycle.archiveThread(requiredId(request.params, 'threadId'));
+      case 'thread/delete':
+        return this.lifecycle.deleteThread(requiredId(request.params, 'threadId'));
       case 'turn/start':
         return this.startTurn(request.params, traceId);
       case 'turn/interrupt':
diff --git a/apps/server/src/store.test.ts b/apps/server/src/store.test.ts
index b608806..c24fe91 100644
--- a/apps/server/src/store.test.ts
+++ b/apps/server/src/store.test.ts
@@ -122,3 +122,57 @@ describe('CanonicalThreadStore', () => {
     await expect(store.load(meta.id)).resolves.toEqual(imported);
   });
 });
+
+describe('CanonicalThreadStore.delete', () => {
+  const thread = (id: string): ThreadSnapshot => ({
+    id,
+    cwd: '/workspace',
+    createdAt: '2026-08-01T00:00:00.000Z',
+    updatedAt: '2026-08-01T00:00:02.000Z',
+    turns: [
+      {
+        id: `${id}-turn-1`,
+        threadId: id,
+        status: 'completed',
+        startedAt: '2026-08-01T00:00:01.000Z',
+        completedAt: '2026-08-01T00:00:02.000Z',
+        items: [
+          {
+            id: `${id}-item-1`,
+            type: 'user_message',
+            payload: { text: 'hello', model: 'deepseek-chat' },
+            completedAt: '2026-08-01T00:00:01.000Z',
+          },
+        ],
+      },
+    ],
+  });
+
+  it('removes both representations, so the thread cannot come back', async () => {
+    // The snapshot and the canonical session projection share an id and are two
+    // views of one thing. `list` reads both, so removing one and leaving the
+    // other means the row reappears on the next refresh — as an empty session
+    // that cannot be opened.
+    const { store, sessions } = await fixture();
+    await store.save(thread('thread-del'));
+
+    expect(await store.load('thread-del')).not.toBeNull();
+    expect(await sessions.list()).toHaveLength(1);
+
+    await store.delete('thread-del');
+
+    expect(await store.load('thread-del')).toBeNull();
+    expect(await sessions.list()).toHaveLength(0);
+    expect(await store.list()).toHaveLength(0);
+  });
+
+  it('leaves other threads alone', async () => {
+    const { store } = await fixture();
+    await store.save(thread('thread-keep'));
+    await store.save(thread('thread-drop'));
+
+    await store.delete('thread-drop');
+
+    expect((await store.list()).map((t) => t.id)).toEqual(['thread-keep']);
+  });
+});
diff --git a/apps/server/src/store.ts b/apps/server/src/store.ts
index 6c509f7..571a9e9 100644
--- a/apps/server/src/store.ts
+++ b/apps/server/src/store.ts
@@ -1,4 +1,4 @@
-import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import process from 'node:process';
 
@@ -64,6 +64,13 @@ export class FileThreadStore implements ThreadStore {
     await rename(path, join(target, `${threadId}.json`));
   }
 
+  async delete(threadId: string): Promise<void> {
+    // `force` so deleting an already-archived thread is not an error: the
+    // runtime has already established the thread exists, and failing here would
+    // leave the caller unable to finish a delete it can see the reason for.
+    await rm(this.pathFor(threadId), { force: true });
+  }
+
   private pathFor(threadId: string): string {
     if (!validThreadId(threadId)) throw new Error(`Invalid thread id: ${threadId}`);
     return join(this.directory, `${threadId}.json`);
@@ -124,6 +131,18 @@ export class CanonicalThreadStore implements ThreadStore {
   async archive(threadId: string): Promise<void> {
     await this.snapshots.archive(threadId);
   }
+
+  /**
+   * Drop both representations of a thread.
+   *
+   * The snapshot and the canonical session projection share an id and are two
+   * views of one thing, so removing one and leaving the other is how a deleted
+   * thread comes back in the next listing — the composite `list` reads both.
+   */
+  async delete(threadId: string): Promise<void> {
+    await this.snapshots.delete(threadId);
+    await this.sessions.delete(threadId);
+  }
 }
 
 function metaFromThread(thread: ThreadSnapshot): SessionMeta {
diff --git a/docs/THREE_WAY_REVIEW.md b/docs/THREE_WAY_REVIEW.md
index b908f25..985033c 100644
--- a/docs/THREE_WAY_REVIEW.md
+++ b/docs/THREE_WAY_REVIEW.md
@@ -287,8 +287,12 @@ AskUserQuestion、模式/模型/effort 下拉、Inspector、FilePanel（Source/D
 
 ### 仍未做
 
-- 桌面侧栏的 archive / delete 仍走 Tauri。`thread/archive` 已经服务，但按钮还没改用它——
-  这是"消除第二个读取者"的后半截。
+- ~~桌面侧栏的 archive / delete 仍走 Tauri。`thread/archive` 已经服务，但按钮还没改用它——
+  这是"消除第二个读取者"的后半截。~~
+  已做。顺带发现侧栏连**列表**都还在直连 Tauri：`window.deepcode.sessions.list()` 早就优先走
+  协议了，但 `Sidebar.tsx` 绕过 shim 直接 `listSessions()`——所以"第二个读取者"其实一直是三处
+  而不是两处。delete 协议侧原本没有方法，新增 `thread/delete`：app-server 是 thread 存储的
+  单一 owner，renderer 越过它删文件可能把正在写的 writer 的地板抽掉。
 - **Linux (bwrap) 侧只共享了 sandbox 模式解析，没有在 Linux 主机上做过 #226 那样的实测。**
 - 图片输入仍是空壳（有意保留：DeepSeek 无 vision 模型）。
 
diff --git a/packages/core/src/sessions/manager.ts b/packages/core/src/sessions/manager.ts
index 2ed5e05..9040666 100644
--- a/packages/core/src/sessions/manager.ts
+++ b/packages/core/src/sessions/manager.ts
@@ -5,6 +5,7 @@ import type { StoredMessage } from '../types.js';
 import {
   appendMessage,
   defaultSessionsDir,
+  deleteSession,
   listSessions as listSessionsLow,
   newSessionId,
   readMessages,
@@ -64,6 +65,10 @@ export class SessionManager {
     return listSessionsLow(this.root);
   }
 
+  async delete(sessionId: string): Promise<void> {
+    await deleteSession(this.root, sessionId);
+  }
+
   async snapshot(args: {
     sessionId: string;
     cwd: string;
diff --git a/packages/core/src/sessions/storage.ts b/packages/core/src/sessions/storage.ts
index 5774739..234cdb1 100644
--- a/packages/core/src/sessions/storage.ts
+++ b/packages/core/src/sessions/storage.ts
@@ -68,6 +68,32 @@ export interface SessionFiles {
   snapshotsDir: string;
 }
 
+/**
+ * Irreversibly remove every file belonging to one session.
+ *
+ * Both stream formats, the metadata sidecar, the writer lock and the snapshot
+ * directory. Leaving any of them behind is not a tidy half-delete: the listing
+ * reads the meta sidecar, so a session whose stream is gone but whose sidecar
+ * remains comes back as an empty row that cannot be opened.
+ *
+ * Missing files are not an error. The caller has already established that the
+ * session exists, and a delete that fails partway through because one of five
+ * paths was already gone leaves the user unable to finish it.
+ */
+export async function deleteSession(root: string, sessionId: string): Promise<void> {
+  const files = sessionFiles(root, sessionId);
+  for (const path of [
+    files.jsonlPath,
+    files.legacyJsonlPath,
+    files.metaPath,
+    files.writerLockPath,
+  ]) {
+    await fs.rm(path, { force: true });
+  }
+  // The per-session directory holds snapshots, background-task logs and todos.
+  await fs.rm(join(root, sessionId), { recursive: true, force: true });
+}
+
 export function sessionFiles(root: string, sessionId: string): SessionFiles {
   return {
     metaPath: join(root, `${sessionId}.meta.json`),
diff --git a/packages/protocol/src/runtime.test.ts b/packages/protocol/src/runtime.test.ts
index e8efcbb..41d05a3 100644
--- a/packages/protocol/src/runtime.test.ts
+++ b/packages/protocol/src/runtime.test.ts
@@ -208,6 +208,29 @@ describe('thread management', () => {
     await expect(runtime.archiveThread('nope')).rejects.toThrow(/nope/);
   });
 
+  it('deletes a thread outright', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    const thread = await runtime.startThread('/a');
+    expect(await runtime.deleteThread(thread.id)).toEqual({ deleted: true });
+    expect((await runtime.listThreads()).threads).toHaveLength(0);
+    // Archive hides, delete removes. Both drop out of the listing, so the
+    // listing alone cannot tell them apart — reading can.
+    expect(await runtime.readThread(thread.id)).toBeNull();
+    await expect(runtime.deleteThread(thread.id)).rejects.toThrow(/thread-/);
+  });
+
+  it('archive keeps the thread readable, delete does not', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    const archived = await runtime.startThread('/a');
+    await runtime.archiveThread(archived.id);
+    expect(await runtime.readThread(archived.id)).not.toBeNull();
+  });
+
+  it('refuses to delete a thread that does not exist', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    await expect(runtime.deleteThread('nope')).rejects.toThrow(/nope/);
+  });
+
   it('forks into a new thread and leaves the original alone', async () => {
     const runtime = deterministicRuntime(new MemoryThreadStore());
     const source = await runtime.startThread('/a');
@@ -241,5 +264,7 @@ describe('thread management', () => {
     expect(runtime.initialize().capabilities.threadManagement).toBe(false);
     await expect(runtime.listThreads()).rejects.toThrow(/cannot list/);
     await expect(runtime.archiveThread('x')).rejects.toThrow(/cannot archive/);
+    // A store that cannot delete says so rather than quietly archiving instead.
+    await expect(runtime.deleteThread('x')).rejects.toThrow(/cannot delete/);
   });
 });
diff --git a/packages/protocol/src/runtime.ts b/packages/protocol/src/runtime.ts
index df52081..d94c277 100644
--- a/packages/protocol/src/runtime.ts
+++ b/packages/protocol/src/runtime.ts
@@ -27,6 +27,16 @@ export interface ThreadStore {
    */
   list?(): Promise<ThreadSnapshot[]>;
   archive?(threadId: string): Promise<void>;
+  /**
+   * Optional: irreversibly drop a thread.
+   *
+   * Separate from `archive` because the two are different promises, and a store
+   * that can move a file is not necessarily one that should be asked to destroy
+   * it. A store without this leaves the call rejected rather than silently
+   * archiving instead — quietly downgrading a delete would be the worst way to
+   * be helpful about it.
+   */
+  delete?(threadId: string): Promise<void>;
 }
 
 export class MemoryThreadStore implements ThreadStore {
@@ -51,6 +61,11 @@ export class MemoryThreadStore implements ThreadStore {
   async archive(threadId: string): Promise<void> {
     this.archived.add(threadId);
   }
+
+  async delete(threadId: string): Promise<void> {
+    this.threads.delete(threadId);
+    this.archived.delete(threadId);
+  }
 }
 
 export interface ProtocolRuntimeOptions {
@@ -179,6 +194,22 @@ export class ProtocolRuntime {
     return { archived: true };
   }
 
+  /**
+   * Irreversibly drop a thread.
+   *
+   * Routed through the runtime rather than left to whoever holds a file handle:
+   * the app-server is the single owner of thread storage, and a client deleting
+   * files behind it can pull the ground out from under an open writer or leave
+   * the index pointing at something that is gone.
+   */
+  async deleteThread(threadId: string): Promise<{ deleted: boolean }> {
+    const remove = this.options.store.delete;
+    if (!remove) throw new ProtocolInvariantError('This store cannot delete threads');
+    await this.requireThread(threadId); // 404 rather than silently succeeding
+    await remove.call(this.options.store, threadId);
+    return { deleted: true };
+  }
+
   /**
    * Copy a thread into a new one, leaving the original untouched.
    *
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index 9a6922d..e0a5be7 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -158,9 +158,10 @@ export interface InitializeResult {
     /** Server streams `reasoning.delta` for models that emit reasoning. */
     reasoningDeltas: boolean;
     /**
-     * `thread/list`, `thread/fork` and `thread/archive` are served. Without
-     * these a client has to read the session directory itself, which is how the
-     * desktop ended up with two ways to see the same threads.
+     * `thread/list`, `thread/fork`, `thread/archive` and `thread/delete` are
+     * served. Without these a client has to read the session directory itself,
+     * which is how the desktop ended up with two ways to see the same threads —
+     * and, for delete, two ways to remove a file the app-server owns.
      */
     threadManagement: boolean;
     /**
@@ -304,6 +305,7 @@ export type ProtocolMethod =
   | 'thread/list'
   | 'thread/fork'
   | 'thread/archive'
+  | 'thread/delete'
   | 'turn/start'
   | 'turn/interrupt'
   | 'approval/respond'

From 00a947742e12a2f79bd6be3cc61695ac2ed8e37e Mon Sep 17 00:00:00 2001
From: oratis <wangharp@gmail.com>
Date: Sun, 9 Aug 2026 23:33:11 +0800
Subject: [PATCH 2/2] fix(sessions): refuse a traversal id before the recursive
 delete runs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`deleteSession` ends in `rm -rf <root>/<id>`, and the id is a string the
caller was handed. `..` passes the `^[a-zA-Z0-9._-]+$` check that both
this path and the thread store rely on — it is spelled entirely in
characters an id may legitimately contain — and `join(root, '..')` is the
directory above the sessions root.

Every in-tree caller validates first: `ProtocolRuntime.deleteThread`
404s on a thread that does not exist, and `CanonicalThreadStore.delete`
runs `FileThreadStore.delete` (which validates) before the session
projection. So this is not reachable today. It is also a recursive
delete resolved from an untrusted string, one refactor away from being
the only check, and AGENTS.md asks for adversarial tests exactly here.

`deleteSession` now rejects a malformed id before removing anything, and
`validThreadId` stops admitting `.` and `..` — harmless while every path
built from an id had a suffix appended, not harmless now that one
reaches a directory removal.

The fixture nests its sessions root deep enough that every hostile id
still resolves inside the temp directory: confirming this bug by
deleting the guard walked `rm -rf` up into $TMPDIR, which is not
something a test should be able to do by accident.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md                               |  7 ++-
 apps/server/src/store.ts                   |  5 ++
 packages/core/src/sessions/storage.test.ts | 56 +++++++++++++++++++++-
 packages/core/src/sessions/storage.ts      | 26 ++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 952ec3d..6104501 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   existing `threadManagement` capability, with the local writer kept as the
   fallback for a sidecar too old to know the method.
 
-
 ### 🔒 Security
 
 - **A sub-agent did not inherit the file contract.** The `Task` delegation
@@ -60,6 +59,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   thread removes both its protocol snapshot and its canonical session
   projection: `list` reads both, so removing one left the row reappearing on the
   next refresh as an empty session that could not be opened.
+- `deleteSession` refuses a session id that is not a single path segment, before
+  removing anything. It ends in a recursive delete of `<root>/<id>`, and `..` —
+  the id that resolves to the directory _above_ the sessions root — is spelled
+  entirely in characters an id may legitimately contain, so the character-class
+  check both it and the thread store relied on admitted it. Every in-tree caller
+  validates first; a delete this destructive should not depend on that.
 - **`Grep` over a single file no longer prefixes every line with a colon.**
   ripgrep omits the filename when the search path is one _file_ — there is
   nothing to disambiguate — so its `--null` output carries no NUL, and rejoining
diff --git a/apps/server/src/store.ts b/apps/server/src/store.ts
index 571a9e9..32b47b6 100644
--- a/apps/server/src/store.ts
+++ b/apps/server/src/store.ts
@@ -9,6 +9,11 @@ import type { ThreadSnapshot, ThreadStore } from '@deepcode/protocol';
 import { historyFromThread } from './runtime-executor.js';
 
 function validThreadId(threadId: string): boolean {
+  // `.` and `..` are spelled entirely in characters an id may legitimately
+  // contain, so the class alone admits them. Harmless while every path built
+  // from an id had a suffix appended; not harmless now that `delete` reaches a
+  // recursive removal of `<root>/<id>`.
+  if (threadId === '.' || threadId === '..') return false;
   return /^[a-zA-Z0-9._-]+$/.test(threadId);
 }
 
diff --git a/packages/core/src/sessions/storage.test.ts b/packages/core/src/sessions/storage.test.ts
index 8580365..38d2d4a 100644
--- a/packages/core/src/sessions/storage.test.ts
+++ b/packages/core/src/sessions/storage.test.ts
@@ -1,9 +1,10 @@
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import {
   appendMessage,
+  deleteSession,
   listSessions,
   newSessionId,
   readMessages,
@@ -259,3 +260,56 @@ describe('session storage', () => {
     await expect(readFile(files.jsonlPath, 'utf8')).rejects.toThrow();
   });
 });
+
+// `deleteSession` ends in a recursive `rm` of `<root>/<id>`, so the id is a path
+// segment resolved from a string the caller received. AGENTS.md asks for
+// adversarial tests where a mistake destroys user work; this is that place.
+describe('deleteSession', () => {
+  let root: string;
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'deepcode-delete-'));
+  });
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it('removes every file the session owns', async () => {
+    const id = newSessionId();
+    await writeMeta(root, { id, cwd: '/w', createdAt: 'x', updatedAt: 'x' });
+    await appendMessage(root, id, { role: 'user', content: [{ type: 'text', text: 'hi' }] });
+    const files = sessionFiles(root, id);
+
+    await deleteSession(root, id);
+
+    await expect(readFile(files.metaPath, 'utf8')).rejects.toThrow();
+    await expect(readFile(files.jsonlPath, 'utf8')).rejects.toThrow();
+    expect(await listSessions(root)).toHaveLength(0);
+  });
+
+  it('is not an error when the files are already gone', async () => {
+    await expect(deleteSession(root, newSessionId())).resolves.toBeUndefined();
+  });
+
+  it.each(['..', '.', '', '../..', 'a/b', '../escape'])(
+    'refuses the id %j instead of resolving it into a path',
+    async (id) => {
+      // `..` is the one that matters: it is spelled entirely in characters an
+      // id may legitimately contain, so a character-class check alone admits
+      // it — and `join(sessionsRoot, '..')` is the directory above it.
+      //
+      // The sessions root is nested deep enough that every id here still
+      // resolves inside `root`. Without that, a run with the guard removed
+      // walks `rm -rf` up out of the fixture and into the system temp
+      // directory — which is how this was confirmed, and not something a test
+      // should be able to do by accident.
+      const sessionsRoot = join(root, 'deep', 'deeper', 'sessions');
+      await mkdir(sessionsRoot, { recursive: true });
+      const guarded = join(root, 'keep-me.txt');
+      await writeFile(guarded, 'not mine to delete', 'utf8');
+
+      await expect(deleteSession(sessionsRoot, id)).rejects.toThrow(/invalid id/);
+
+      expect(await readFile(guarded, 'utf8')).toBe('not mine to delete');
+    },
+  );
+});
diff --git a/packages/core/src/sessions/storage.ts b/packages/core/src/sessions/storage.ts
index 234cdb1..830a6b2 100644
--- a/packages/core/src/sessions/storage.ts
+++ b/packages/core/src/sessions/storage.ts
@@ -68,6 +68,24 @@ export interface SessionFiles {
   snapshotsDir: string;
 }
 
+/**
+ * A session id that is safe to interpolate into a path.
+ *
+ * `deleteSession` removes a whole directory recursively, so the id has to be a
+ * single path segment and cannot be a traversal. `..` is the one that matters:
+ * it is composed entirely of characters an id may legitimately contain, so a
+ * character-class check alone lets it through — and `join(root, '..')` is the
+ * parent of the sessions root.
+ */
+function validSessionId(sessionId: string): boolean {
+  return (
+    sessionId !== '' &&
+    sessionId !== '.' &&
+    sessionId !== '..' &&
+    /^[a-zA-Z0-9._-]+$/.test(sessionId)
+  );
+}
+
 /**
  * Irreversibly remove every file belonging to one session.
  *
@@ -79,8 +97,16 @@ export interface SessionFiles {
  * Missing files are not an error. The caller has already established that the
  * session exists, and a delete that fails partway through because one of five
  * paths was already gone leaves the user unable to finish it.
+ *
+ * A malformed id *is* an error, and is refused before anything is removed. The
+ * callers in-tree all validate first, so this can only fire on a programming
+ * mistake — which is exactly when a recursive delete resolved from an untrusted
+ * string must not proceed on the strength of somebody else having checked.
  */
 export async function deleteSession(root: string, sessionId: string): Promise<void> {
+  if (!validSessionId(sessionId)) {
+    throw new Error(`Refusing to delete session with invalid id: ${JSON.stringify(sessionId)}`);
+  }
   const files = sessionFiles(root, sessionId);
   for (const path of [
     files.jsonlPath,