From 122a5f0375e337c821ba9cc03fcea0994848e8e9 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Fri, 13 Feb 2026 20:23:41 -0800
Subject: [PATCH 01/21] feat: add version history browser (CE3)

Add getArticleHistory, readVersion, and restoreVersion to CmsService
with ancestry validation and provenance trailers. Wire up three new
server endpoints and an Admin UI history panel with lazy-fetch, preview,
and restore. Includes 18 new tests (13 unit, 5 integration).
---
 CHANGELOG.md          |   7 ++
 public/index.html     | 173 ++++++++++++++++++++++++++++++++++++++++++
 src/lib/CmsService.js | 125 ++++++++++++++++++++++++++++++
 src/server/index.js   |  42 ++++++++++
 test/git.test.js      | 149 ++++++++++++++++++++++++++++++++++++
 test/server.test.js   |  93 +++++++++++++++++++++++
 6 files changed, 589 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3118d2..b8cecb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ All notable changes to git-cms are documented in this file.
 
 ### Added
 
+- **Version History Browser (CE3):** Browse prior versions of an article, preview old content, and restore a selected version as a new draft commit
+  - `CmsService.getArticleHistory()` — walk parent chain to list version summaries (SHA, title, status, author, date)
+  - `CmsService.readVersion()` — read full content of a specific commit by SHA
+  - `CmsService.restoreVersion()` — restore historical content as a new draft with ancestry validation and provenance trailers (`restoredFromSha`, `restoredAt`)
+  - `GET /api/cms/history`, `GET /api/cms/show-version`, `POST /api/cms/restore` server endpoints
+  - Admin UI: collapsible history panel with lazy-fetch, version preview, and restore button
+
 - **Content Identity Policy (M1.1):** Canonical slug validation with NFKC normalization, reserved word rejection, and `CmsValidationError` contract (`ContentIdentityPolicy.js`)
 - **State Machine (M1.2):** Explicit draft/published/unpublished/reverted states with enforced transition rules (`ContentStatePolicy.js`)
 - **Admin UI overhaul:** Split/edit/preview markdown editor (via `marked`), autosave, toast notifications, skeleton loading, drag-and-drop file uploads, metadata trailer editor, keyboard shortcuts (`Cmd+S`, `Esc`), dark mode token system
diff --git a/public/index.html b/public/index.html
index 6cd5884..f02ba1a 100644
--- a/public/index.html
+++ b/public/index.html
@@ -359,6 +359,50 @@
       margin-top: var(--size-2);
     }
 
+    /* ── History Section ── */
+    #historySection .history-list {
+      max-height: 240px;
+      overflow-y: auto;
+      margin-top: var(--size-2);
+      display: flex;
+      flex-direction: column;
+      gap: 2px;
+    }
+    .history-item {
+      display: flex;
+      align-items: center;
+      gap: var(--size-3);
+      padding: var(--size-2) var(--size-3);
+      border-radius: var(--radius-2);
+      cursor: pointer;
+      transition: background 0.15s;
+      font-size: var(--font-size-0);
+    }
+    .history-item:hover { background: var(--surface-3); }
+    .history-item.active { background: var(--brand); color: white; }
+    .history-item .hist-sha { font-family: var(--font-mono); font-size: var(--font-size-00); opacity: 0.7; }
+    .history-item .hist-title { flex: 1; font-weight: 500; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .history-item .hist-date { font-size: var(--font-size-00); opacity: 0.7; white-space: nowrap; }
+    .history-item .hist-status { font-size: var(--font-size-00); opacity: 0.7; }
+
+    #historyPreview {
+      margin-top: var(--size-3);
+      border: 1px solid var(--surface-3);
+      border-radius: var(--radius-2);
+      padding: var(--size-3);
+      display: none;
+    }
+    #historyPreview .preview-content {
+      max-height: 300px;
+      overflow-y: auto;
+      line-height: 1.7;
+    }
+    #historyPreview .preview-actions {
+      margin-top: var(--size-3);
+      display: flex;
+      gap: var(--size-2);
+    }
+
     /* ── Status Bar ── */
     .status-bar {
       font-size: var(--font-size-0);
@@ -457,6 +501,17 @@ <h1>Git CMS</h1>
       <button class="btn add-trailer-btn" onclick="UI.addTrailerRow()">+ Add Field</button>
     </details>
 
+    <details id="historySection">
+      <summary>Version History</summary>
+      <div id="historyList" class="history-list"></div>
+      <div id="historyPreview">
+        <div id="historyPreviewContent" class="preview-content"></div>
+        <div class="preview-actions">
+          <button class="btn btn-primary" id="restoreBtn" onclick="UI.restoreVersion()" disabled>Restore This Version</button>
+        </div>
+      </div>
+    </details>
+
     <div class="asset-section" id="dropZone">
       Drop files here or
       <label class="btn" style="margin-left:var(--size-2)">
@@ -490,6 +545,8 @@ <h1>Git CMS</h1>
       autosaveTimer: null,
       editorMode: 'split',
       trailers: {},
+      historyVersions: [],
+      selectedVersion: null,
     };
 
     /* ── API Layer ── */
@@ -537,6 +594,29 @@ <h1>Git CMS</h1>
         if (!res.ok) throw new Error(`Upload failed: ${res.status}`);
         return res.json();
       },
+
+      async history(slug, limit = 50) {
+        const res = await fetch(`${API_BASE}/history?slug=${encodeURIComponent(slug)}&limit=${limit}`);
+        if (!res.ok) throw new Error(`History failed: ${res.status}`);
+        return res.json();
+      },
+
+      async showVersion(slug, sha) {
+        const res = await fetch(`${API_BASE}/show-version?slug=${encodeURIComponent(slug)}&sha=${encodeURIComponent(sha)}`);
+        if (!res.ok) throw new Error(`Show version failed: ${res.status}`);
+        return res.json();
+      },
+
+      async restore({ slug, sha }) {
+        const res = await fetch(`${API_BASE}/restore`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ slug, sha }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw Object.assign(new Error(data.error || `Restore failed: ${res.status}`), { code: data.code });
+        return data;
+      },
     };
 
     /* ── Toast ── */
@@ -903,6 +983,94 @@ <h1>Git CMS</h1>
         this.hideEditor();
       },
 
+      /* Version History */
+      async fetchHistory() {
+        if (!state.currentSlug) return;
+        const listEl = document.getElementById('historyList');
+        listEl.innerHTML = '<div class="skeleton" style="height:1.8em"></div>';
+        document.getElementById('historyPreview').style.display = 'none';
+        state.selectedVersion = null;
+
+        try {
+          const versions = await api.history(state.currentSlug);
+          state.historyVersions = versions;
+          listEl.innerHTML = '';
+
+          versions.forEach((v, idx) => {
+            const div = document.createElement('div');
+            div.className = 'history-item';
+            div.dataset.idx = idx;
+
+            const shaSpan = document.createElement('span');
+            shaSpan.className = 'hist-sha';
+            shaSpan.textContent = v.sha.slice(0, 7);
+
+            const titleSpan = document.createElement('span');
+            titleSpan.className = 'hist-title';
+            titleSpan.textContent = v.title;
+
+            const statusSpan = document.createElement('span');
+            statusSpan.className = 'hist-status';
+            statusSpan.textContent = v.status;
+
+            const dateSpan = document.createElement('span');
+            dateSpan.className = 'hist-date';
+            dateSpan.textContent = relTime(v.date);
+
+            div.append(shaSpan, titleSpan, statusSpan, dateSpan);
+            div.onclick = () => this.selectVersion(v.sha, idx);
+            listEl.appendChild(div);
+          });
+        } catch (err) {
+          toast('Failed to load history', 'error');
+          listEl.innerHTML = '';
+        }
+      },
+
+      async selectVersion(sha, idx) {
+        state.selectedVersion = { sha, idx };
+        document.querySelectorAll('.history-item').forEach((el, i) => {
+          el.classList.toggle('active', i === idx);
+        });
+
+        const previewEl = document.getElementById('historyPreview');
+        const contentEl = document.getElementById('historyPreviewContent');
+        const restoreBtn = document.getElementById('restoreBtn');
+
+        previewEl.style.display = 'block';
+        contentEl.innerHTML = '<div class="skeleton" style="height:4em"></div>';
+
+        try {
+          const data = await api.showVersion(state.currentSlug, sha);
+          contentEl.innerHTML = DOMPurify.sanitize(marked.parse(data.body || ''));
+          // Disable restore for current version (idx 0)
+          restoreBtn.disabled = idx === 0;
+        } catch (err) {
+          contentEl.textContent = 'Failed to load version content';
+          restoreBtn.disabled = true;
+        }
+      },
+
+      async restoreVersion() {
+        if (!state.selectedVersion || !state.currentSlug) return;
+        const { sha } = state.selectedVersion;
+        if (!confirm(`Restore version ${sha.slice(0, 7)}? This creates a new draft with the old content.`)) return;
+
+        try {
+          await api.restore({ slug: state.currentSlug, sha });
+          toast('Version restored', 'success');
+          // Close history section and reload article
+          document.getElementById('historySection').open = false;
+          await this.loadArticle(state.currentSlug);
+        } catch (err) {
+          if (err.code === 'invalid_state_transition') {
+            toast('Cannot restore: unpublish the article first', 'error');
+          } else {
+            toast('Restore failed: ' + err.message, 'error');
+          }
+        }
+      },
+
       escAttr(s) {
         return String(s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/'/g, '&#39;');
       },
@@ -967,6 +1135,11 @@ <h1>Git CMS</h1>
       this.value = '';
     });
 
+    // History section toggle — lazy-fetch on expand
+    document.getElementById('historySection').addEventListener('toggle', (e) => {
+      if (e.target.open) UI.fetchHistory();
+    });
+
     /* ── Init ── */
     UI.fetchList();
   </script>
diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index c275c62..6de4439 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -317,6 +317,131 @@ export default class CmsService {
     return { ref: draftRef, sha: newSha, prev: draftSha };
   }
 
+  /**
+   * Returns version history for an article by walking the parent chain.
+   * @param {{ slug: string, limit?: number }} options
+   * @returns {Promise<Array<{ sha: string, title: string, status: string, author: string, date: string }>>}
+   */
+  async getArticleHistory({ slug, limit = 50 }) {
+    const canonicalSlug = canonicalizeSlug(slug);
+    const draftRef = this._refFor(canonicalSlug, 'articles');
+    const sha = await this.graph.readRef(draftRef);
+
+    if (!sha) {
+      throw new CmsValidationError(
+        `Article not found: "${canonicalSlug}"`,
+        { code: 'article_not_found', field: 'slug' }
+      );
+    }
+
+    const versions = [];
+    let current = sha;
+
+    while (current && versions.length < limit) {
+      const info = await this.graph.getNodeInfo(current);
+      const message = await this.graph.showNode(current);
+      const decoded = this.codec.decode(message);
+
+      versions.push({
+        sha: current,
+        title: decoded.title,
+        status: decoded.trailers?.status || 'draft',
+        author: info.author,
+        date: info.date,
+      });
+
+      current = info.parents?.[0] || null;
+    }
+
+    return versions;
+  }
+
+  /**
+   * Reads full content of a specific commit by SHA.
+   * @param {{ slug: string, sha: string }} options
+   * @returns {Promise<{ sha: string, title: string, body: string, trailers: object }>}
+   */
+  async readVersion({ slug, sha }) {
+    const canonicalSlug = canonicalizeSlug(slug);
+    const draftRef = this._refFor(canonicalSlug, 'articles');
+    const draftSha = await this.graph.readRef(draftRef);
+
+    if (!draftSha) {
+      throw new CmsValidationError(
+        `Article not found: "${canonicalSlug}"`,
+        { code: 'article_not_found', field: 'slug' }
+      );
+    }
+
+    const message = await this.graph.showNode(sha);
+    const decoded = this.codec.decode(message);
+    return { sha, title: decoded.title, body: decoded.body, trailers: decoded.trailers };
+  }
+
+  /**
+   * Restores content from a historical SHA as a new draft commit.
+   * @param {{ slug: string, sha: string }} options
+   * @returns {Promise<{ ref: string, sha: string, prev: string }>}
+   */
+  async restoreVersion({ slug, sha }) {
+    const canonicalSlug = canonicalizeSlug(slug);
+    const draftRef = this._refFor(canonicalSlug, 'articles');
+
+    const { effectiveState, draftSha } = await this._resolveArticleState(canonicalSlug);
+    validateTransition(effectiveState, STATES.DRAFT);
+
+    if (!draftSha) {
+      throw new CmsValidationError(
+        `Cannot restore "${canonicalSlug}": no draft ref exists`,
+        { code: 'no_draft', field: 'slug' }
+      );
+    }
+
+    // Ancestry validation: walk parent chain to verify target SHA belongs to this article
+    let found = false;
+    let walk = draftSha;
+    let steps = 0;
+    const walkLimit = 200;
+    while (walk && steps < walkLimit) {
+      if (walk === sha) { found = true; break; }
+      const info = await this.graph.getNodeInfo(walk);
+      walk = info.parents?.[0] || null;
+      steps++;
+    }
+    if (!found) {
+      throw new CmsValidationError(
+        `SHA "${sha}" is not in the history of article "${canonicalSlug}"`,
+        { code: 'invalid_version_for_article', field: 'sha' }
+      );
+    }
+
+    // Read target SHA content
+    const targetMessage = await this.graph.showNode(sha);
+    const decoded = this.codec.decode(targetMessage);
+    const { updatedat: _, restoredfromsha: _r, restoredat: _ra, ...restTrailers } = decoded.trailers;
+
+    const newMessage = this.codec.encode({
+      title: decoded.title,
+      body: decoded.body,
+      trailers: {
+        ...restTrailers,
+        status: STATES.DRAFT,
+        updatedAt: new Date().toISOString(),
+        restoredFromSha: sha,
+        restoredAt: new Date().toISOString(),
+      },
+    });
+
+    const newSha = await this.graph.commitNode({
+      message: newMessage,
+      parents: [draftSha],
+      sign: process.env.CMS_SIGN === '1',
+    });
+
+    await this._updateRef({ ref: draftRef, newSha, oldSha: draftSha });
+    return { ref: draftRef, sha: newSha, prev: draftSha };
+  }
+
   /**
    * Uploads an asset and returns its manifest and CAS info.
    */
diff --git a/src/server/index.js b/src/server/index.js
index 5c70c44..1c65bb1 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -201,6 +201,48 @@ async function handler(req, res) {
         return;
       }
 
+      // GET /api/cms/history?slug=xxx&limit=50
+      if (req.method === 'GET' && pathname === '/api/cms/history') {
+        const { slug: rawSlug, limit: rawLimit } = query;
+        if (!rawSlug) return send(res, 400, { error: 'slug required' });
+        const slug = canonicalizeSlug(rawSlug);
+        const limit = Math.max(1, Math.min(200, parseInt(rawLimit, 10) || 50));
+        return send(res, 200, await cms.getArticleHistory({ slug, limit }));
+      }
+
+      // GET /api/cms/show-version?slug=xxx&sha=yyy
+      if (req.method === 'GET' && pathname === '/api/cms/show-version') {
+        const { slug: rawSlug, sha } = query;
+        if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
+        const slug = canonicalizeSlug(rawSlug);
+        const result = await cms.readVersion({ slug, sha });
+        // Cap response body at 1MB
+        if (result.body && Buffer.byteLength(result.body, 'utf8') > 1_048_576) {
+          result.body = result.body.slice(0, 1_048_576);
+          result.trailers = { ...result.trailers, truncated: 'true' };
+        }
+        return send(res, 200, result);
+      }
+
+      // POST /api/cms/restore
+      if (req.method === 'POST' && pathname === '/api/cms/restore') {
+        let body = '';
+        req.on('data', (c) => (body += c));
+        req.on('end', async () => {
+          try {
+            const { slug: rawSlug, sha } = JSON.parse(body || '{}');
+            if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
+            const slug = canonicalizeSlug(rawSlug);
+            const result = await cms.restoreVersion({ slug, sha });
+            return send(res, 200, result);
+          } catch (err) {
+            logError(err);
+            return sendError(res, err);
+          }
+        });
+        return;
+      }
+
       // POST /api/cms/upload
       if (req.method === 'POST' && pathname === '/api/cms/upload') {
         let body = '';
diff --git a/test/git.test.js b/test/git.test.js
index 6924e64..caf3823 100644
--- a/test/git.test.js
+++ b/test/git.test.js
@@ -274,3 +274,152 @@ describe('State Machine', () => {
     );
   });
 });
+
+describe('Version History', () => {
+  let cms;
+
+  beforeEach(() => {
+    cms = createTestCms();
+  });
+
+  it('getArticleHistory returns versions newest-first', async () => {
+    await cms.saveSnapshot({ slug: 'hist-order', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'hist-order', title: 'v2', body: 'b2' });
+    await cms.saveSnapshot({ slug: 'hist-order', title: 'v3', body: 'b3' });
+
+    const history = await cms.getArticleHistory({ slug: 'hist-order' });
+    expect(history).toHaveLength(3);
+    expect(history[0].title).toBe('v3');
+    expect(history[1].title).toBe('v2');
+    expect(history[2].title).toBe('v1');
+  });
+
+  it('getArticleHistory includes correct status per version', async () => {
+    await cms.saveSnapshot({ slug: 'hist-status', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'hist-status', title: 'v2', body: 'b2' });
+    await cms.revertArticle({ slug: 'hist-status' });
+
+    const history = await cms.getArticleHistory({ slug: 'hist-status' });
+    expect(history[0].status).toBe('reverted');
+    expect(history[1].status).toBe('draft');
+    expect(history[2].status).toBe('draft');
+  });
+
+  it('getArticleHistory respects limit', async () => {
+    await cms.saveSnapshot({ slug: 'hist-limit', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'hist-limit', title: 'v2', body: 'b2' });
+    await cms.saveSnapshot({ slug: 'hist-limit', title: 'v3', body: 'b3' });
+
+    const history = await cms.getArticleHistory({ slug: 'hist-limit', limit: 2 });
+    expect(history).toHaveLength(2);
+    expect(history[0].title).toBe('v3');
+    expect(history[1].title).toBe('v2');
+  });
+
+  it('getArticleHistory throws for nonexistent article', async () => {
+    await expect(cms.getArticleHistory({ slug: 'no-such-article' })).rejects.toMatchObject({
+      name: 'CmsValidationError',
+      code: 'article_not_found',
+    });
+  });
+
+  it('getArticleHistory returns single entry for 1-version article', async () => {
+    await cms.saveSnapshot({ slug: 'hist-single', title: 'only', body: 'one' });
+
+    const history = await cms.getArticleHistory({ slug: 'hist-single' });
+    expect(history).toHaveLength(1);
+    expect(history[0].title).toBe('only');
+  });
+
+  it('readVersion returns full content for a specific SHA', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'rv-test', title: 'First', body: 'first body' });
+    await cms.saveSnapshot({ slug: 'rv-test', title: 'Second', body: 'second body' });
+
+    const version = await cms.readVersion({ slug: 'rv-test', sha: v1.sha });
+    expect(version.sha).toBe(v1.sha);
+    expect(version.title).toBe('First');
+    expect(version.body).toContain('first body');
+  });
+
+  it('restoreVersion creates new commit with old content', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'restore-test', title: 'Original', body: 'original body' });
+    await cms.saveSnapshot({ slug: 'restore-test', title: 'Edited', body: 'edited body' });
+
+    const result = await cms.restoreVersion({ slug: 'restore-test', sha: v1.sha });
+    expect(result.sha).not.toBe(v1.sha);
+
+    const article = await cms.readArticle({ slug: 'restore-test' });
+    expect(article.title).toBe('Original');
+    expect(article.body).toContain('original body');
+    expect(article.trailers.status).toBe('draft');
+  });
+
+  it('restoreVersion preserves history chain (commit count)', async () => {
+    await cms.saveSnapshot({ slug: 'restore-chain', title: 'v1', body: 'b1' });
+    const v1 = await cms.saveSnapshot({ slug: 'restore-chain', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'restore-chain', title: 'v2', body: 'b2' });
+
+    await cms.restoreVersion({ slug: 'restore-chain', sha: v1.sha });
+
+    // After 3 saves + 1 restore = 4 versions in history
+    const history = await cms.getArticleHistory({ slug: 'restore-chain' });
+    expect(history).toHaveLength(4);
+  });
+
+  it('restoreVersion blocks on published articles', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'restore-pub', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'restore-pub', title: 'v2', body: 'b2' });
+    await cms.publishArticle({ slug: 'restore-pub' });
+
+    await expect(cms.restoreVersion({ slug: 'restore-pub', sha: v1.sha })).rejects.toMatchObject({
+      name: 'CmsValidationError',
+      code: 'invalid_state_transition',
+    });
+  });
+
+  it('restoreVersion works on unpublished articles', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'restore-unpub', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'restore-unpub', title: 'v2', body: 'b2' });
+    await cms.publishArticle({ slug: 'restore-unpub' });
+    await cms.unpublishArticle({ slug: 'restore-unpub' });
+
+    const result = await cms.restoreVersion({ slug: 'restore-unpub', sha: v1.sha });
+    expect(result.sha).toBeDefined();
+
+    const article = await cms.readArticle({ slug: 'restore-unpub' });
+    expect(article.title).toBe('v1');
+  });
+
+  it('restoreVersion works on reverted articles', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'restore-rev', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'restore-rev', title: 'v2', body: 'b2' });
+    await cms.revertArticle({ slug: 'restore-rev' });
+
+    const result = await cms.restoreVersion({ slug: 'restore-rev', sha: v1.sha });
+    expect(result.sha).toBeDefined();
+
+    const article = await cms.readArticle({ slug: 'restore-rev' });
+    expect(article.title).toBe('v1');
+  });
+
+  it('restoreVersion throws for SHA outside article lineage', async () => {
+    await cms.saveSnapshot({ slug: 'restore-lineage-a', title: 'A', body: 'a' });
+    const other = await cms.saveSnapshot({ slug: 'restore-lineage-b', title: 'B', body: 'b' });
+
+    await expect(cms.restoreVersion({ slug: 'restore-lineage-a', sha: other.sha })).rejects.toMatchObject({
+      name: 'CmsValidationError',
+      code: 'invalid_version_for_article',
+    });
+  });
+
+  it('restoreVersion includes provenance trailers (restoredFromSha, restoredAt)', async () => {
+    const v1 = await cms.saveSnapshot({ slug: 'restore-prov', title: 'v1', body: 'b1' });
+    await cms.saveSnapshot({ slug: 'restore-prov', title: 'v2', body: 'b2' });
+
+    await cms.restoreVersion({ slug: 'restore-prov', sha: v1.sha });
+
+    const article = await cms.readArticle({ slug: 'restore-prov' });
+    expect(article.trailers.restoredfromsha).toBe(v1.sha);
+    expect(article.trailers.restoredat).toBeDefined();
+  });
+});
diff --git a/test/server.test.js b/test/server.test.js
index 88bdf75..e08fd62 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -214,6 +214,99 @@ describe('Server API (Integration)', () => {
     expect(data.sha).toBeDefined();
   });
 
+  it('GET /history returns version list', async () => {
+    // Create two versions
+    const snap1 = await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-hist', title: 'v1', body: 'b1' }),
+    });
+    expect(snap1.status).toBe(200);
+    const snap2 = await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-hist', title: 'v2', body: 'b2' }),
+    });
+    expect(snap2.status).toBe(200);
+
+    const res = await fetch(`${baseUrl}/api/cms/history?slug=srv-hist`);
+    const data = await res.json();
+    expect(res.status).toBe(200);
+    expect(Array.isArray(data)).toBe(true);
+    expect(data.length).toBe(2);
+    expect(data[0].title).toBe('v2');
+    expect(data[1].title).toBe('v1');
+  });
+
+  it('GET /history returns 400 without slug', async () => {
+    const res = await fetch(`${baseUrl}/api/cms/history`);
+    const data = await res.json();
+    expect(res.status).toBe(400);
+    expect(data.error).toBeDefined();
+  });
+
+  it('GET /show-version returns content for specific SHA', async () => {
+    const snap1 = await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-showver', title: 'First', body: 'first body' }),
+    });
+    const v1 = await snap1.json();
+    expect(snap1.status).toBe(200);
+    await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-showver', title: 'Second', body: 'second body' }),
+    });
+
+    const res = await fetch(`${baseUrl}/api/cms/show-version?slug=srv-showver&sha=${v1.sha}`);
+    const data = await res.json();
+    expect(res.status).toBe(200);
+    expect(data.title).toBe('First');
+    expect(data.body).toContain('first body');
+  });
+
+  it('POST /restore restores a version', async () => {
+    const snap1 = await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-restore', title: 'Original', body: 'original body' }),
+    });
+    const v1 = await snap1.json();
+    expect(snap1.status).toBe(200);
+    const snap2 = await fetch(`${baseUrl}/api/cms/snapshot`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-restore', title: 'Edited', body: 'edited body' }),
+    });
+    expect(snap2.status).toBe(200);
+
+    const res = await fetch(`${baseUrl}/api/cms/restore`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'srv-restore', sha: v1.sha }),
+    });
+    const data = await res.json();
+    expect(res.status).toBe(200);
+    expect(data.sha).toBeDefined();
+
+    // Verify content was restored
+    const show = await fetch(`${baseUrl}/api/cms/show?slug=srv-restore`);
+    const article = await show.json();
+    expect(article.title).toBe('Original');
+  });
+
+  it('POST /restore returns 400 without required fields', async () => {
+    const res = await fetch(`${baseUrl}/api/cms/restore`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'test' }),
+    });
+    const data = await res.json();
+    expect(res.status).toBe(400);
+    expect(data.error).toBeDefined();
+  });
+
   it('returns 400 with invalid_state_transition for bad transitions', async () => {
     // Create a draft, then try to unpublish it (invalid: draft → unpublished)
     const setupRes = await fetch(`${baseUrl}/api/cms/snapshot`, {

From aba18b1375d107d8df99fa82e774687090655b06 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Fri, 13 Feb 2026 21:17:32 -0800
Subject: [PATCH 02/21] =?UTF-8?q?fix:=20address=20PR=20#4=20review=20feedb?=
 =?UTF-8?q?ack=20=E2=80=94=2016=20comments?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CmsService:
- Add ancestry validation to readVersion (was leaking cross-article content)
- Extract _validateAncestry helper shared by readVersion/restoreVersion
- Fall back to published ref in getArticleHistory for published-only articles
- Parallelize getNodeInfo + showNode calls (Promise.all)
- Distinct error code history_walk_limit_exceeded vs invalid_version_for_article
- Safe destructuring of decoded.trailers (|| {} guard)
- Single Date() call for updatedAt/restoredAt consistency

Server:
- Add readBody helper with 1 MB limit on all POST endpoints (DoS protection)
- Buffer-based truncation for show-version 1 MB cap (byte-accurate)
- SHA format validation (/^[0-9a-f]{40}$/) on show-version and restore
- Wrap GET /history and GET /show-version in try/catch (was leaking stack traces)
- Convert all POST handlers from req.on('end') to await readBody()

UI:
- api.restore: handle non-JSON error responses gracefully
- Refresh history panel on article switch when already open (stale data fix)

Tests:
- Fix misleading v1/v2 naming in restoreVersion chain test
- Assert second snapshot status in show-version server test
---
 public/index.html     |   8 +-
 src/lib/CmsService.js |  67 +++++++-----
 src/server/index.js   | 239 ++++++++++++++++++++++--------------------
 test/git.test.js      |   6 +-
 test/server.test.js   |   3 +-
 5 files changed, 179 insertions(+), 144 deletions(-)

diff --git a/public/index.html b/public/index.html
index f02ba1a..bf67d88 100644
--- a/public/index.html
+++ b/public/index.html
@@ -613,7 +613,8 @@ <h1>Git CMS</h1>
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ slug, sha }),
         });
-        const data = await res.json();
+        let data;
+        try { data = await res.json(); } catch { data = {}; }
         if (!res.ok) throw Object.assign(new Error(data.error || `Restore failed: ${res.status}`), { code: data.code });
         return data;
       },
@@ -718,6 +719,11 @@ <h1>Git CMS</h1>
           updatePreview();
           this.highlightActive(slug);
 
+          // Refresh history if panel is already open
+          if (document.getElementById('historySection').open) {
+            this.fetchHistory();
+          }
+
           statusEl.textContent = `Loaded ${slug} (${data.sha.slice(0, 7)})`;
         } catch (err) {
           toast(`Failed to load ${slug}`, 'error');
diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index 6de4439..32b8f08 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -317,6 +317,32 @@ export default class CmsService {
     return { ref: draftRef, sha: newSha, prev: draftSha };
   }
 
+  /**
+   * Validates that a target SHA exists in an article's ancestry chain.
+   * @private
+   */
+  async _validateAncestry(tipSha, targetSha, slug) {
+    let walk = tipSha;
+    let steps = 0;
+    const walkLimit = 200;
+    while (walk && steps < walkLimit) {
+      if (walk === targetSha) return;
+      const info = await this.graph.getNodeInfo(walk);
+      walk = info.parents?.[0] || null;
+      steps++;
+    }
+    if (steps >= walkLimit) {
+      throw new CmsValidationError(
+        `History walk limit (${walkLimit}) exceeded for article "${slug}"; SHA "${targetSha}" may exist beyond the search window`,
+        { code: 'history_walk_limit_exceeded', field: 'sha' }
+      );
+    }
+    throw new CmsValidationError(
+      `SHA "${targetSha}" is not in the history of article "${slug}"`,
+      { code: 'invalid_version_for_article', field: 'sha' }
+    );
+  }
+
   /**
    * Returns version history for an article by walking the parent chain.
    * @param {{ slug: string, limit?: number }} options
@@ -325,7 +351,8 @@ export default class CmsService {
   async getArticleHistory({ slug, limit = 50 }) {
     const canonicalSlug = canonicalizeSlug(slug);
     const draftRef = this._refFor(canonicalSlug, 'articles');
-    const sha = await this.graph.readRef(draftRef);
+    const pubRef = this._refFor(canonicalSlug, 'published');
+    const sha = await this.graph.readRef(draftRef) || await this.graph.readRef(pubRef);
 
     if (!sha) {
       throw new CmsValidationError(
@@ -338,8 +365,10 @@ export default class CmsService {
     let current = sha;
 
     while (current && versions.length < limit) {
-      const info = await this.graph.getNodeInfo(current);
-      const message = await this.graph.showNode(current);
+      const [info, message] = await Promise.all([
+        this.graph.getNodeInfo(current),
+        this.graph.showNode(current),
+      ]);
       const decoded = this.codec.decode(message);
 
       versions.push({
@@ -364,15 +393,18 @@ export default class CmsService {
   async readVersion({ slug, sha }) {
     const canonicalSlug = canonicalizeSlug(slug);
     const draftRef = this._refFor(canonicalSlug, 'articles');
-    const draftSha = await this.graph.readRef(draftRef);
+    const tipSha = await this.graph.readRef(draftRef);
 
-    if (!draftSha) {
+    if (!tipSha) {
       throw new CmsValidationError(
         `Article not found: "${canonicalSlug}"`,
         { code: 'article_not_found', field: 'slug' }
       );
     }
 
+    // Ancestry validation: verify SHA belongs to this article's lineage
+    await this._validateAncestry(tipSha, sha, canonicalSlug);
+
     const message = await this.graph.showNode(sha);
     const decoded = this.codec.decode(message);
     return { sha, title: decoded.title, body: decoded.body, trailers: decoded.trailers };
@@ -398,37 +430,24 @@ export default class CmsService {
     }
 
     // Ancestry validation: walk parent chain to verify target SHA belongs to this article
-    let found = false;
-    let walk = draftSha;
-    let steps = 0;
-    const walkLimit = 200;
-    while (walk && steps < walkLimit) {
-      if (walk === sha) { found = true; break; }
-      const info = await this.graph.getNodeInfo(walk);
-      walk = info.parents?.[0] || null;
-      steps++;
-    }
-    if (!found) {
-      throw new CmsValidationError(
-        `SHA "${sha}" is not in the history of article "${canonicalSlug}"`,
-        { code: 'invalid_version_for_article', field: 'sha' }
-      );
-    }
+    await this._validateAncestry(draftSha, sha, canonicalSlug);
 
     // Read target SHA content
     const targetMessage = await this.graph.showNode(sha);
     const decoded = this.codec.decode(targetMessage);
-    const { updatedat: _, restoredfromsha: _r, restoredat: _ra, ...restTrailers } = decoded.trailers;
+    const trailers = decoded.trailers || {};
+    const { updatedat: _, restoredfromsha: _r, restoredat: _ra, ...restTrailers } = trailers;
 
+    const now = new Date().toISOString();
     const newMessage = this.codec.encode({
       title: decoded.title,
       body: decoded.body,
       trailers: {
         ...restTrailers,
         status: STATES.DRAFT,
-        updatedAt: new Date().toISOString(),
+        updatedAt: now,
         restoredFromSha: sha,
-        restoredAt: new Date().toISOString(),
+        restoredAt: now,
       },
     });
 
diff --git a/src/server/index.js b/src/server/index.js
index 1c65bb1..f4868fb 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -87,6 +87,27 @@ function sendError(res, err) {
   return send(res, 500, { error: err.message });
 }
 
+const MAX_BODY_BYTES = 1_048_576; // 1 MB
+const SHA_RE = /^[0-9a-f]{40}$/;
+
+function readBody(req, limit = MAX_BODY_BYTES) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    let bytes = 0;
+    req.on('data', (chunk) => {
+      bytes += chunk.length;
+      if (bytes > limit) {
+        req.destroy();
+        reject(new CmsValidationError('Request body too large', { code: 'body_too_large' }));
+        return;
+      }
+      body += chunk;
+    });
+    req.on('end', () => resolve(body));
+    req.on('error', reject);
+  });
+}
+
 function logError(err) {
   if (!(err instanceof CmsValidationError)) {
     console.error(err);
@@ -127,151 +148,139 @@ async function handler(req, res) {
 
       // POST /api/cms/snapshot
       if (req.method === 'POST' && pathname === '/api/cms/snapshot') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug, title, body: content, trailers } = JSON.parse(body || '{}');
-            if (!rawSlug || !title) return send(res, 400, { error: 'slug and title required' });
-            const slug = canonicalizeSlug(rawSlug);
-            const result = await cms.saveSnapshot({ slug, title, body: content, trailers });
-            return send(res, 200, result);
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
-          }
-        });
-        return;
+        try {
+          const body = await readBody(req);
+          const { slug: rawSlug, title, body: content, trailers } = JSON.parse(body || '{}');
+          if (!rawSlug || !title) return send(res, 400, { error: 'slug and title required' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.saveSnapshot({ slug, title, body: content, trailers });
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // POST /api/cms/publish
       if (req.method === 'POST' && pathname === '/api/cms/publish') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug, sha } = JSON.parse(body || '{}');
-            if (!rawSlug) return send(res, 400, { error: 'slug required' });
-            const slug = canonicalizeSlug(rawSlug);
-            const result = await cms.publishArticle({ slug, sha });
-            return send(res, 200, result);
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
-          }
-        });
-        return;
+        try {
+          const body = await readBody(req);
+          const { slug: rawSlug, sha } = JSON.parse(body || '{}');
+          if (!rawSlug) return send(res, 400, { error: 'slug required' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.publishArticle({ slug, sha });
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // POST /api/cms/unpublish
       if (req.method === 'POST' && pathname === '/api/cms/unpublish') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug } = JSON.parse(body || '{}');
-            if (!rawSlug) return send(res, 400, { error: 'slug required' });
-            const slug = canonicalizeSlug(rawSlug);
-            const result = await cms.unpublishArticle({ slug });
-            return send(res, 200, result);
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
-          }
-        });
-        return;
+        try {
+          const body = await readBody(req);
+          const { slug: rawSlug } = JSON.parse(body || '{}');
+          if (!rawSlug) return send(res, 400, { error: 'slug required' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.unpublishArticle({ slug });
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // POST /api/cms/revert
       if (req.method === 'POST' && pathname === '/api/cms/revert') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug } = JSON.parse(body || '{}');
-            if (!rawSlug) return send(res, 400, { error: 'slug required' });
-            const slug = canonicalizeSlug(rawSlug);
-            const result = await cms.revertArticle({ slug });
-            return send(res, 200, result);
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
-          }
-        });
-        return;
+        try {
+          const body = await readBody(req);
+          const { slug: rawSlug } = JSON.parse(body || '{}');
+          if (!rawSlug) return send(res, 400, { error: 'slug required' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.revertArticle({ slug });
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // GET /api/cms/history?slug=xxx&limit=50
       if (req.method === 'GET' && pathname === '/api/cms/history') {
-        const { slug: rawSlug, limit: rawLimit } = query;
-        if (!rawSlug) return send(res, 400, { error: 'slug required' });
-        const slug = canonicalizeSlug(rawSlug);
-        const limit = Math.max(1, Math.min(200, parseInt(rawLimit, 10) || 50));
-        return send(res, 200, await cms.getArticleHistory({ slug, limit }));
+        try {
+          const { slug: rawSlug, limit: rawLimit } = query;
+          if (!rawSlug) return send(res, 400, { error: 'slug required' });
+          const slug = canonicalizeSlug(rawSlug);
+          const limit = Math.max(1, Math.min(200, parseInt(rawLimit, 10) || 50));
+          return send(res, 200, await cms.getArticleHistory({ slug, limit }));
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // GET /api/cms/show-version?slug=xxx&sha=yyy
       if (req.method === 'GET' && pathname === '/api/cms/show-version') {
-        const { slug: rawSlug, sha } = query;
-        if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
-        const slug = canonicalizeSlug(rawSlug);
-        const result = await cms.readVersion({ slug, sha });
-        // Cap response body at 1MB
-        if (result.body && Buffer.byteLength(result.body, 'utf8') > 1_048_576) {
-          result.body = result.body.slice(0, 1_048_576);
-          result.trailers = { ...result.trailers, truncated: 'true' };
+        try {
+          const { slug: rawSlug, sha } = query;
+          if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
+          if (!SHA_RE.test(sha)) return send(res, 400, { error: 'sha must be a 40-character hex string' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.readVersion({ slug, sha });
+          // Cap response body at 1MB (byte-accurate truncation)
+          if (result.body && Buffer.byteLength(result.body, 'utf8') > MAX_BODY_BYTES) {
+            result.body = Buffer.from(result.body, 'utf8').subarray(0, MAX_BODY_BYTES).toString('utf8');
+            result.trailers = { ...result.trailers, truncated: 'true' };
+          }
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
         }
-        return send(res, 200, result);
       }
 
       // POST /api/cms/restore
       if (req.method === 'POST' && pathname === '/api/cms/restore') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug, sha } = JSON.parse(body || '{}');
-            if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
-            const slug = canonicalizeSlug(rawSlug);
-            const result = await cms.restoreVersion({ slug, sha });
-            return send(res, 200, result);
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
-          }
-        });
-        return;
+        try {
+          const body = await readBody(req);
+          const { slug: rawSlug, sha } = JSON.parse(body || '{}');
+          if (!rawSlug || !sha) return send(res, 400, { error: 'slug and sha required' });
+          if (!SHA_RE.test(sha)) return send(res, 400, { error: 'sha must be a 40-character hex string' });
+          const slug = canonicalizeSlug(rawSlug);
+          const result = await cms.restoreVersion({ slug, sha });
+          return send(res, 200, result);
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       // POST /api/cms/upload
       if (req.method === 'POST' && pathname === '/api/cms/upload') {
-        let body = '';
-        req.on('data', (c) => (body += c));
-        req.on('end', async () => {
-          try {
-            const { slug: rawSlug, filename, data } = JSON.parse(body || '{}');
-            if (!rawSlug || !filename || !data) return send(res, 400, { error: 'slug, filename, data required' });
-            const slug = canonicalizeSlug(rawSlug);
-            
-            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-upload-'));
-            const filePath = path.join(tmpDir, filename);
-            fs.writeFileSync(filePath, Buffer.from(data, 'base64'));
-            
-            const result = await cms.uploadAsset({ slug, filePath, filename });
-            const firstChunk = result.manifest?.chunks?.[0];
-            if (!firstChunk?.digest) {
-              throw new Error('Upload manifest contains no chunks');
-            }
-            const assetUrl = `/blog/${ENV}/assets/${slug}/${firstChunk.digest}`;
-            
-            fs.rmSync(tmpDir, { recursive: true, force: true });
-            return send(res, 200, { ...result, assetUrl });
-          } catch (err) {
-            logError(err);
-            return sendError(res, err);
+        try {
+          const body = await readBody(req, 10 * MAX_BODY_BYTES); // 10 MB for uploads
+          const { slug: rawSlug, filename, data } = JSON.parse(body || '{}');
+          if (!rawSlug || !filename || !data) return send(res, 400, { error: 'slug, filename, data required' });
+          const slug = canonicalizeSlug(rawSlug);
+
+          const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-upload-'));
+          const filePath = path.join(tmpDir, filename);
+          fs.writeFileSync(filePath, Buffer.from(data, 'base64'));
+
+          const result = await cms.uploadAsset({ slug, filePath, filename });
+          const firstChunk = result.manifest?.chunks?.[0];
+          if (!firstChunk?.digest) {
+            throw new Error('Upload manifest contains no chunks');
           }
-        });
-        return;
+          const assetUrl = `/blog/${ENV}/assets/${slug}/${firstChunk.digest}`;
+
+          fs.rmSync(tmpDir, { recursive: true, force: true });
+          return send(res, 200, { ...result, assetUrl });
+        } catch (err) {
+          logError(err);
+          return sendError(res, err);
+        }
       }
 
       return send(res, 404, { error: 'API endpoint not found' });
diff --git a/test/git.test.js b/test/git.test.js
index caf3823..39cda52 100644
--- a/test/git.test.js
+++ b/test/git.test.js
@@ -356,10 +356,10 @@ describe('Version History', () => {
 
   it('restoreVersion preserves history chain (commit count)', async () => {
     await cms.saveSnapshot({ slug: 'restore-chain', title: 'v1', body: 'b1' });
-    const v1 = await cms.saveSnapshot({ slug: 'restore-chain', title: 'v1', body: 'b1' });
-    await cms.saveSnapshot({ slug: 'restore-chain', title: 'v2', body: 'b2' });
+    const v2 = await cms.saveSnapshot({ slug: 'restore-chain', title: 'v2', body: 'b2' });
+    await cms.saveSnapshot({ slug: 'restore-chain', title: 'v3', body: 'b3' });
 
-    await cms.restoreVersion({ slug: 'restore-chain', sha: v1.sha });
+    await cms.restoreVersion({ slug: 'restore-chain', sha: v2.sha });
 
     // After 3 saves + 1 restore = 4 versions in history
     const history = await cms.getArticleHistory({ slug: 'restore-chain' });
diff --git a/test/server.test.js b/test/server.test.js
index e08fd62..7776816 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -253,11 +253,12 @@ describe('Server API (Integration)', () => {
     });
     const v1 = await snap1.json();
     expect(snap1.status).toBe(200);
-    await fetch(`${baseUrl}/api/cms/snapshot`, {
+    const snap2 = await fetch(`${baseUrl}/api/cms/snapshot`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ slug: 'srv-showver', title: 'Second', body: 'second body' }),
     });
+    expect(snap2.status).toBe(200);
 
     const res = await fetch(`${baseUrl}/api/cms/show-version?slug=srv-showver&sha=${v1.sha}`);
     const data = await res.json();

From c881431b26605733a812c2a3c41c8b9a033c3fe4 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Fri, 13 Feb 2026 22:10:04 -0800
Subject: [PATCH 03/21] =?UTF-8?q?fix:=20address=20PR=20#4=20round-2=20revi?=
 =?UTF-8?q?ew=20=E2=80=94=205=20issues?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Critical:
- Path traversal via filename in upload handler: sanitize to path.basename()

Major:
- readVersion now checks published ref fallback (consistent with getArticleHistory)
- Add negative-path tests for readVersion (article_not_found, cross-lineage)
- Add SHA format validation integration tests for show-version and restore

Minor:
- UI restoreVersion guards against state.saving (race with autosave)
---
 CHANGELOG.md          |  3 +++
 public/index.html     |  2 +-
 src/lib/CmsService.js |  3 ++-
 src/server/index.js   |  6 +++++-
 test/git.test.js      | 17 +++++++++++++++++
 test/server.test.js   | 18 ++++++++++++++++++
 6 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8cecb3..307d29d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,9 @@ All notable changes to git-cms are documented in this file.
 - **(P2) SRI hashes:** Add `integrity` + `crossorigin` to marked and DOMPurify CDN script tags
 - **(P2) Null guards:** `revertArticle` and `unpublishArticle` throw `no_draft` when draft ref is missing; `_resolveArticleState` throws `article_not_found` when both draft and published refs are missing
 - **(P2) uploadAsset DI guard:** Throw `unsupported_in_di_mode` when `cas`/`vault` are null
+- **(P1) Path traversal in upload handler:** Sanitize user-controlled `filename` to `path.basename()` preventing writes outside tmpDir
+- **(P1) readVersion lineage scoping:** `readVersion` now validates SHA ancestry (prevents cross-article content leakage)
+- **(P1) readVersion published fallback:** `readVersion` checks both draft and published refs (consistent with `getArticleHistory`)
 - **(P2) Trailer key casing:** Use camelCase `updatedAt` in `unpublishArticle` and `revertArticle` (was lowercase `updatedat` which broke `renderBadges` lookups); destructure out decoded lowercase key before spreading to avoid `TrailerInvalidError`
 - **(P2) XSS in `escAttr`:** Escape single quotes (`'` → `&#39;`) to prevent injection into single-quoted attributes
 - **(P2) Supply-chain hardening:** Vendor Open Props CSS files locally (`public/css/`) instead of `@import` from unpkg, eliminating CDN dependency and SRI gap
diff --git a/public/index.html b/public/index.html
index bf67d88..3612e6e 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1058,7 +1058,7 @@ <h1>Git CMS</h1>
       },
 
       async restoreVersion() {
-        if (!state.selectedVersion || !state.currentSlug) return;
+        if (!state.selectedVersion || !state.currentSlug || state.saving) return;
         const { sha } = state.selectedVersion;
         if (!confirm(`Restore version ${sha.slice(0, 7)}? This creates a new draft with the old content.`)) return;
 
diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index 32b8f08..3b7a185 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -393,7 +393,8 @@ export default class CmsService {
   async readVersion({ slug, sha }) {
     const canonicalSlug = canonicalizeSlug(slug);
     const draftRef = this._refFor(canonicalSlug, 'articles');
-    const tipSha = await this.graph.readRef(draftRef);
+    const pubRef = this._refFor(canonicalSlug, 'published');
+    const tipSha = await this.graph.readRef(draftRef) || await this.graph.readRef(pubRef);
 
     if (!tipSha) {
       throw new CmsValidationError(
diff --git a/src/server/index.js b/src/server/index.js
index f4868fb..0f80cfc 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -263,9 +263,13 @@ async function handler(req, res) {
           const { slug: rawSlug, filename, data } = JSON.parse(body || '{}');
           if (!rawSlug || !filename || !data) return send(res, 400, { error: 'slug, filename, data required' });
           const slug = canonicalizeSlug(rawSlug);
+          const safeFilename = path.basename(filename);
+          if (!safeFilename || safeFilename === '.' || safeFilename === '..') {
+            return send(res, 400, { error: 'Invalid filename' });
+          }
 
           const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-upload-'));
-          const filePath = path.join(tmpDir, filename);
+          const filePath = path.join(tmpDir, safeFilename);
           fs.writeFileSync(filePath, Buffer.from(data, 'base64'));
 
           const result = await cms.uploadAsset({ slug, filePath, filename });
diff --git a/test/git.test.js b/test/git.test.js
index 39cda52..bf59b54 100644
--- a/test/git.test.js
+++ b/test/git.test.js
@@ -341,6 +341,23 @@ describe('Version History', () => {
     expect(version.body).toContain('first body');
   });
 
+  it('readVersion throws for nonexistent article', async () => {
+    await expect(cms.readVersion({ slug: 'no-such-slug', sha: 'a'.repeat(40) })).rejects.toMatchObject({
+      name: 'CmsValidationError',
+      code: 'article_not_found',
+    });
+  });
+
+  it('readVersion throws for SHA outside article lineage', async () => {
+    await cms.saveSnapshot({ slug: 'rv-lineage-a', title: 'A', body: 'a' });
+    const other = await cms.saveSnapshot({ slug: 'rv-lineage-b', title: 'B', body: 'b' });
+
+    await expect(cms.readVersion({ slug: 'rv-lineage-a', sha: other.sha })).rejects.toMatchObject({
+      name: 'CmsValidationError',
+      code: 'invalid_version_for_article',
+    });
+  });
+
   it('restoreVersion creates new commit with old content', async () => {
     const v1 = await cms.saveSnapshot({ slug: 'restore-test', title: 'Original', body: 'original body' });
     await cms.saveSnapshot({ slug: 'restore-test', title: 'Edited', body: 'edited body' });
diff --git a/test/server.test.js b/test/server.test.js
index 7776816..6a34535 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -308,6 +308,24 @@ describe('Server API (Integration)', () => {
     expect(data.error).toBeDefined();
   });
 
+  it('GET /show-version returns 400 for invalid SHA format', async () => {
+    const res = await fetch(`${baseUrl}/api/cms/show-version?slug=test&sha=not-a-valid-sha`);
+    const data = await res.json();
+    expect(res.status).toBe(400);
+    expect(data.error).toMatch(/sha/);
+  });
+
+  it('POST /restore returns 400 for invalid SHA format', async () => {
+    const res = await fetch(`${baseUrl}/api/cms/restore`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ slug: 'test', sha: 'ZZZZ' }),
+    });
+    const data = await res.json();
+    expect(res.status).toBe(400);
+    expect(data.error).toMatch(/sha/);
+  });
+
   it('returns 400 with invalid_state_transition for bad transitions', async () => {
     // Create a draft, then try to unpublish it (invalid: draft → unpublished)
     const setupRes = await fetch(`${baseUrl}/api/cms/snapshot`, {

From 3c61794bc9796218e003d75fdef0bc11d51988b8 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:13:52 -0800
Subject: [PATCH 04/21] fix: reset history panel state when switching to new
 article

Prevents stale version history from previous article showing
when creating a new article with the history panel already open.
---
 public/index.html | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/public/index.html b/public/index.html
index 3612e6e..24d6ec8 100644
--- a/public/index.html
+++ b/public/index.html
@@ -742,6 +742,13 @@ <h1>Git CMS</h1>
         state.dirty = false;
         state.trailers = {};
 
+        // Reset history panel to prevent stale data
+        document.getElementById('historySection').open = false;
+        document.getElementById('historyList').innerHTML = '';
+        document.getElementById('historyPreview').style.display = 'none';
+        state.historyVersions = [];
+        state.selectedVersion = null;
+
         document.getElementById('slugInput').value = '';
         document.getElementById('slugInput').disabled = false;
         document.getElementById('titleInput').value = '';

From 4b4b54d83d018b138af8d0987baaebecb16d70ab Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:14:22 -0800
Subject: [PATCH 05/21] fix: guard decoded.trailers destructuring in unpublish
 and revert

Add || {} fallback to prevent TypeError when trailers is undefined,
matching the defensive pattern already used in restoreVersion.
---
 src/lib/CmsService.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index 3b7a185..416d483 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -250,7 +250,7 @@ export default class CmsService {
     // Read current draft content and re-commit with status: unpublished
     const message = await this.graph.showNode(draftSha);
     const decoded = this.codec.decode(message);
-    const { updatedat: _, ...restTrailers } = decoded.trailers;
+    const { updatedat: _, ...restTrailers } = decoded.trailers || {};
     const newMessage = this.codec.encode({
       title: decoded.title,
       body: decoded.body,
@@ -299,7 +299,7 @@ export default class CmsService {
     const parentCommitSha = info.parents[0];
     const parentMessage = await this.graph.showNode(parentCommitSha);
     const parentDecoded = this.codec.decode(parentMessage);
-    const { updatedat: _u, ...restParentTrailers } = parentDecoded.trailers;
+    const { updatedat: _u, ...restParentTrailers } = parentDecoded.trailers || {};
 
     const newMessage = this.codec.encode({
       title: parentDecoded.title,

From b9783670e8ec3d778ef4f38a401bb32ea2c1fe01 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:14:40 -0800
Subject: [PATCH 06/21] fix: guard readVersion return trailers with || {}

Ensures callers always receive an object for trailers, matching
the defensive pattern in restoreVersion and the JSDoc contract.
---
 src/lib/CmsService.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index 416d483..c621c57 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -408,7 +408,7 @@ export default class CmsService {
 
     const message = await this.graph.showNode(sha);
     const decoded = this.codec.decode(message);
-    return { sha, title: decoded.title, body: decoded.body, trailers: decoded.trailers };
+    return { sha, title: decoded.title, body: decoded.body, trailers: decoded.trailers || {} };
   }
 
   /**

From 916eff5bee069c8e1dc3b410171453b30b6077b7 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:15:08 -0800
Subject: [PATCH 07/21] fix: prevent temp directory leak on upload failure

Move tmpDir cleanup to a finally block so it's always removed,
even when cms.uploadAsset or chunk-digest validation throws.
---
 src/server/index.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/server/index.js b/src/server/index.js
index 0f80cfc..5678023 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -258,6 +258,7 @@ async function handler(req, res) {
 
       // POST /api/cms/upload
       if (req.method === 'POST' && pathname === '/api/cms/upload') {
+        let tmpDir;
         try {
           const body = await readBody(req, 10 * MAX_BODY_BYTES); // 10 MB for uploads
           const { slug: rawSlug, filename, data } = JSON.parse(body || '{}');
@@ -268,7 +269,7 @@ async function handler(req, res) {
             return send(res, 400, { error: 'Invalid filename' });
           }
 
-          const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-upload-'));
+          tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-upload-'));
           const filePath = path.join(tmpDir, safeFilename);
           fs.writeFileSync(filePath, Buffer.from(data, 'base64'));
 
@@ -279,11 +280,14 @@ async function handler(req, res) {
           }
           const assetUrl = `/blog/${ENV}/assets/${slug}/${firstChunk.digest}`;
 
-          fs.rmSync(tmpDir, { recursive: true, force: true });
           return send(res, 200, { ...result, assetUrl });
         } catch (err) {
           logError(err);
           return sendError(res, err);
+        } finally {
+          if (tmpDir) {
+            try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+          }
         }
       }
 

From 1f043e1c8f7a836f66e69e67932bbc25531ed656 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:15:35 -0800
Subject: [PATCH 08/21] chore: update CHANGELOG and bump to v1.0.1

Document PR #4 round-3 review fixes (4 issues).
---
 CHANGELOG.md | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 307d29d..d792c0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,5 +63,9 @@ All notable changes to git-cms are documented in this file.
 - DI-mode `_updateRef` now performs manual CAS check against `oldSha`
 - Server tests assert setup call status codes to surface silent failures
 - Vitest exclude glob `test/git-e2e*` → `test/git-e2e**` to cover future subdirectories
+- Admin UI: reset history panel state (versions list, preview, selection) when creating a new article to prevent stale data
+- Defensive `|| {}` guard on `decoded.trailers` destructuring in `unpublishArticle` and `revertArticle` (prevents TypeError if trailers is undefined)
+- `readVersion` now returns `trailers: decoded.trailers || {}` ensuring callers always receive an object
+- Upload handler: moved tmpDir cleanup to `finally` block preventing temp directory leaks on failure
 
 [Unreleased]: https://github.com/flyingrobots/git-cms/compare/main...git-stunts
diff --git a/package.json b/package.json
index e3d02f5..9764f48 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "git-cms",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "A serverless, database-free CMS built on Git plumbing.",
   "type": "module",
   "bin": {

From 1e9458310500b7d0769a66dd6b1dc8247d15eea8 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:33:50 -0800
Subject: [PATCH 09/21] fix: sanitize 500 error responses to prevent internal
 detail leakage

sendError was forwarding raw err.message for non-CmsValidationError
exceptions, potentially exposing file paths, git subprocess details,
or internal state to clients.
---
 src/server/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server/index.js b/src/server/index.js
index 5678023..8a38742 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -84,7 +84,7 @@ function sendError(res, err) {
       field: err.field,
     });
   }
-  return send(res, 500, { error: err.message });
+  return send(res, 500, { error: 'Internal server error' });
 }
 
 const MAX_BODY_BYTES = 1_048_576; // 1 MB

From f59c79dacec147275770c25b66dffe158e727fb7 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:34:06 -0800
Subject: [PATCH 10/21] perf: use Buffer.concat in readBody instead of string
 concatenation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Repeated string concatenation (body += chunk) is O(n²) for large
uploads. Accumulate chunks in an array and concat once on end.
---
 src/server/index.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/server/index.js b/src/server/index.js
index 8a38742..569e966 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -92,7 +92,7 @@ const SHA_RE = /^[0-9a-f]{40}$/;
 
 function readBody(req, limit = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
-    let body = '';
+    const chunks = [];
     let bytes = 0;
     req.on('data', (chunk) => {
       bytes += chunk.length;
@@ -101,9 +101,9 @@ function readBody(req, limit = MAX_BODY_BYTES) {
         reject(new CmsValidationError('Request body too large', { code: 'body_too_large' }));
         return;
       }
-      body += chunk;
+      chunks.push(chunk);
     });
-    req.on('end', () => resolve(body));
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
     req.on('error', reject);
   });
 }

From 87bbc738866dec8dbbbbf3af66da625adcc46a29 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:34:22 -0800
Subject: [PATCH 11/21] fix: reset stale history state unconditionally in
 loadArticle

When the history panel is closed and the user switches articles,
historyVersions and selectedVersion from the previous article
persisted until the panel was next opened. Now reset unconditionally.
---
 public/index.html | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/public/index.html b/public/index.html
index 24d6ec8..e3b414a 100644
--- a/public/index.html
+++ b/public/index.html
@@ -719,6 +719,10 @@ <h1>Git CMS</h1>
           updatePreview();
           this.highlightActive(slug);
 
+          // Reset history state to prevent stale data from previous article
+          state.historyVersions = [];
+          state.selectedVersion = null;
+
           // Refresh history if panel is already open
           if (document.getElementById('historySection').open) {
             this.fetchHistory();

From 1e4b845c2ab40b6954c5ca3e2b122757e1435552 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:34:37 -0800
Subject: [PATCH 12/21] fix: guard selectVersion against stale async responses

Rapid version clicks could cause out-of-order responses to overwrite
the preview. Now checks if the selection is still current after the
await before updating the DOM.
---
 public/index.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/public/index.html b/public/index.html
index e3b414a..e6f8c4a 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1059,10 +1059,12 @@ <h1>Git CMS</h1>
 
         try {
           const data = await api.showVersion(state.currentSlug, sha);
+          if (state.selectedVersion?.sha !== sha) return;
           contentEl.innerHTML = DOMPurify.sanitize(marked.parse(data.body || ''));
           // Disable restore for current version (idx 0)
           restoreBtn.disabled = idx === 0;
         } catch (err) {
+          if (state.selectedVersion?.sha !== sha) return;
           contentEl.textContent = 'Failed to load version content';
           restoreBtn.disabled = true;
         }

From 1d742214726b092ab0fa75dc57d2373a2e247527 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:35:08 -0800
Subject: [PATCH 13/21] refactor: extract HISTORY_WALK_LIMIT as shared constant

The hardcoded walkLimit=200 in _validateAncestry and the server's
history limit clamp were independent values that could silently
diverge. Now both reference a single exported constant.
---
 src/lib/CmsService.js | 5 ++++-
 src/server/index.js   | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index c621c57..5d0a58c 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -23,6 +23,9 @@ import {
  * @property {import('@git-stunts/git-warp').GraphPersistencePort} [graph] - Optional injected graph adapter (skips git subprocess setup).
  */
 
+/** Maximum depth for ancestry walks (history listing, validation). */
+export const HISTORY_WALK_LIMIT = 200;
+
 /**
  * CmsService is the core domain orchestrator for Git CMS.
  */
@@ -324,7 +327,7 @@ export default class CmsService {
   async _validateAncestry(tipSha, targetSha, slug) {
     let walk = tipSha;
     let steps = 0;
-    const walkLimit = 200;
+    const walkLimit = HISTORY_WALK_LIMIT;
     while (walk && steps < walkLimit) {
       if (walk === targetSha) return;
       const info = await this.graph.getNodeInfo(walk);
diff --git a/src/server/index.js b/src/server/index.js
index 569e966..7521e0a 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -3,7 +3,7 @@ import url from 'node:url';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import CmsService from '../lib/CmsService.js';
+import CmsService, { HISTORY_WALK_LIMIT } from '../lib/CmsService.js';
 import {
   CmsValidationError,
   canonicalizeKind,
@@ -212,7 +212,7 @@ async function handler(req, res) {
           const { slug: rawSlug, limit: rawLimit } = query;
           if (!rawSlug) return send(res, 400, { error: 'slug required' });
           const slug = canonicalizeSlug(rawSlug);
-          const limit = Math.max(1, Math.min(200, parseInt(rawLimit, 10) || 50));
+          const limit = Math.max(1, Math.min(HISTORY_WALK_LIMIT, parseInt(rawLimit, 10) || 50));
           return send(res, 200, await cms.getArticleHistory({ slug, limit }));
         } catch (err) {
           logError(err);

From 2b812fd00972e95f079bb2b4f5b24d1cd71d86c5 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:35:25 -0800
Subject: [PATCH 14/21] docs: add inline comment explaining trailer-codec
 lowercase normalization

The destructured lowercase keys followed by camelCase writes look like
a casing bug without context about codec.decode's normalization behavior.
---
 src/lib/CmsService.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index 5d0a58c..bcd8385 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -439,6 +439,8 @@ export default class CmsService {
     // Read target SHA content
     const targetMessage = await this.graph.showNode(sha);
     const decoded = this.codec.decode(targetMessage);
+    // trailer-codec normalizes keys to lowercase on decode; destructure the
+    // lowercase forms so the subsequent camelCase writes create fresh keys.
     const trailers = decoded.trailers || {};
     const { updatedat: _, restoredfromsha: _r, restoredat: _ra, ...restTrailers } = trailers;
 

From 63a9f9a8e58770d4304a276b47d6fbd9fe8a89e9 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:35:59 -0800
Subject: [PATCH 15/21] chore: update CHANGELOG and bump to v1.0.2

---
 CHANGELOG.md | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d792c0d..23998d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -67,5 +67,10 @@ All notable changes to git-cms are documented in this file.
 - Defensive `|| {}` guard on `decoded.trailers` destructuring in `unpublishArticle` and `revertArticle` (prevents TypeError if trailers is undefined)
 - `readVersion` now returns `trailers: decoded.trailers || {}` ensuring callers always receive an object
 - Upload handler: moved tmpDir cleanup to `finally` block preventing temp directory leaks on failure
+- **(P1) sendError info leak:** 500 responses now return generic 'Internal server error' instead of raw `err.message` (prevents leaking file paths, git subprocess details, or internal state)
+- **(P2) readBody O(n²):** `readBody` now accumulates chunks in an array and uses `Buffer.concat` instead of repeated string concatenation
+- Admin UI: `loadArticle` unconditionally resets `historyVersions` and `selectedVersion` to prevent stale history state when switching articles with the panel closed
+- Admin UI: `selectVersion` guards against out-of-order async responses (prevents stale preview flash from rapid clicks)
+- **(P2) walkLimit divergence:** Extracted `HISTORY_WALK_LIMIT` as a shared exported constant used by both `_validateAncestry` and the server's history limit clamp
 
 [Unreleased]: https://github.com/flyingrobots/git-cms/compare/main...git-stunts
diff --git a/package.json b/package.json
index 9764f48..c65371d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "git-cms",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "A serverless, database-free CMS built on Git plumbing.",
   "type": "module",
   "bin": {

From 90ba0a992f0fe48d3e45aa3acae446442a29fcc8 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:49:22 -0800
Subject: [PATCH 16/21] test: add regression test for sendError 500 response
 sanitization

Triggers a 500 via GET /api/cms/show with a non-existent slug and
asserts the response body says 'Internal server error' with no
filesystem paths, .js extensions, or node_modules references.
---
 test/server.test.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/server.test.js b/test/server.test.js
index 6a34535..1dfc7d6 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -326,6 +326,19 @@ describe('Server API (Integration)', () => {
     expect(data.error).toMatch(/sha/);
   });
 
+  it('500 responses return generic message without internal details', async () => {
+    // GET /api/cms/show with a non-existent slug throws a plain Error (not
+    // CmsValidationError), which routes through sendError as a 500.
+    const res = await fetch(`${baseUrl}/api/cms/show?slug=does-not-exist`);
+    const data = await res.json();
+    expect(res.status).toBe(500);
+    expect(data.error).toBe('Internal server error');
+    // Must NOT contain filesystem paths or internal details
+    expect(data.error).not.toMatch(/\//);
+    expect(data.error).not.toMatch(/node_modules/);
+    expect(data.error).not.toMatch(/\.js/);
+  });
+
   it('returns 400 with invalid_state_transition for bad transitions', async () => {
     // Create a draft, then try to unpublish it (invalid: draft → unpublished)
     const setupRes = await fetch(`${baseUrl}/api/cms/snapshot`, {

From 966b7b328ac13c8d60d530f239e076c720ae1dde Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 00:49:29 -0800
Subject: [PATCH 17/21] fix: clear history DOM alongside state reset in
 loadArticle

The previous commit reset state.historyVersions and selectedVersion
but left stale HTML in historyList and a visible historyPreview.
Now matches the full reset pattern used in newArticle.
---
 public/index.html | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index e6f8c4a..d4fa49c 100644
--- a/public/index.html
+++ b/public/index.html
@@ -719,9 +719,11 @@ <h1>Git CMS</h1>
           updatePreview();
           this.highlightActive(slug);
 
-          // Reset history state to prevent stale data from previous article
+          // Reset history state and DOM to prevent stale data from previous article
           state.historyVersions = [];
           state.selectedVersion = null;
+          document.getElementById('historyList').innerHTML = '';
+          document.getElementById('historyPreview').style.display = 'none';
 
           // Refresh history if panel is already open
           if (document.getElementById('historySection').open) {

From c086e0cf37dfbf70105ec59acd0bade623e048f7 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 01:13:14 -0800
Subject: [PATCH 18/21] fix: prevent autosave race and double-prompt in
 restoreVersion

Clear the autosave timer and reset dirty state after the user confirms
but before the async restore call. Prevents the 3-second autosave from
firing mid-restore (CAS conflict) and the redundant "unsaved changes"
prompt when loadArticle is called after the restore completes.
---
 public/index.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/public/index.html b/public/index.html
index d4fa49c..b4371da 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1077,6 +1077,11 @@ <h1>Git CMS</h1>
         const { sha } = state.selectedVersion;
         if (!confirm(`Restore version ${sha.slice(0, 7)}? This creates a new draft with the old content.`)) return;
 
+        // Prevent autosave from racing the restore and suppress
+        // the redundant "unsaved changes" prompt in loadArticle.
+        this.clearAutosave();
+        state.dirty = false;
+
         try {
           await api.restore({ slug: state.currentSlug, sha });
           toast('Version restored', 'success');

From 806784bc354cd90ae738b845eea158e7a565410f Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 01:13:39 -0800
Subject: [PATCH 19/21] fix: clamp limit internally in getArticleHistory

Defense-in-depth: clamp the caller-provided limit to
[1, HISTORY_WALK_LIMIT] inside the service method itself so future
direct callers (CLI, tests) can't trigger unbounded ancestry walks.
---
 src/lib/CmsService.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/CmsService.js b/src/lib/CmsService.js
index bcd8385..26d1c38 100644
--- a/src/lib/CmsService.js
+++ b/src/lib/CmsService.js
@@ -352,6 +352,7 @@ export default class CmsService {
    * @returns {Promise<Array<{ sha: string, title: string, status: string, author: string, date: string }>>}
    */
   async getArticleHistory({ slug, limit = 50 }) {
+    const effectiveLimit = Math.max(1, Math.min(limit, HISTORY_WALK_LIMIT));
     const canonicalSlug = canonicalizeSlug(slug);
     const draftRef = this._refFor(canonicalSlug, 'articles');
     const pubRef = this._refFor(canonicalSlug, 'published');
@@ -367,7 +368,7 @@ export default class CmsService {
     const versions = [];
     let current = sha;
 
-    while (current && versions.length < limit) {
+    while (current && versions.length < effectiveLimit) {
       const [info, message] = await Promise.all([
         this.graph.getNodeInfo(current),
         this.graph.showNode(current),

From f1ab75ec3a0cce15309a690eaa5ea03e2acbe659 Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 01:13:57 -0800
Subject: [PATCH 20/21] fix: use NaN check instead of || for history limit
 parsing

parseInt('0') || 50 evaluates to 50 because 0 is falsy. Use
Number.isNaN to correctly distinguish missing/invalid input from
an explicit zero (which gets clamped to 1 by Math.max).
---
 src/server/index.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/server/index.js b/src/server/index.js
index 7521e0a..b2378f4 100644
--- a/src/server/index.js
+++ b/src/server/index.js
@@ -212,7 +212,8 @@ async function handler(req, res) {
           const { slug: rawSlug, limit: rawLimit } = query;
           if (!rawSlug) return send(res, 400, { error: 'slug required' });
           const slug = canonicalizeSlug(rawSlug);
-          const limit = Math.max(1, Math.min(HISTORY_WALK_LIMIT, parseInt(rawLimit, 10) || 50));
+          const parsed = parseInt(rawLimit, 10);
+          const limit = Math.max(1, Math.min(HISTORY_WALK_LIMIT, Number.isNaN(parsed) ? 50 : parsed));
           return send(res, 200, await cms.getArticleHistory({ slug, limit }));
         } catch (err) {
           logError(err);

From 3154631aa8e7a53a4d87cf60d0e47e800324ff2f Mon Sep 17 00:00:00 2001
From: CI Bot <ci@git-cms.local>
Date: Sat, 14 Feb 2026 01:14:30 -0800
Subject: [PATCH 21/21] test: assert response status before calling .json() in
 server tests

Swap the order so SyntaxError from non-JSON error responses
doesn't mask the real status code failure during CI.
---
 test/server.test.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/server.test.js b/test/server.test.js
index 1dfc7d6..c22932e 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -251,8 +251,8 @@ describe('Server API (Integration)', () => {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ slug: 'srv-showver', title: 'First', body: 'first body' }),
     });
-    const v1 = await snap1.json();
     expect(snap1.status).toBe(200);
+    const v1 = await snap1.json();
     const snap2 = await fetch(`${baseUrl}/api/cms/snapshot`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -261,8 +261,8 @@ describe('Server API (Integration)', () => {
     expect(snap2.status).toBe(200);
 
     const res = await fetch(`${baseUrl}/api/cms/show-version?slug=srv-showver&sha=${v1.sha}`);
-    const data = await res.json();
     expect(res.status).toBe(200);
+    const data = await res.json();
     expect(data.title).toBe('First');
     expect(data.body).toContain('first body');
   });
@@ -273,8 +273,8 @@ describe('Server API (Integration)', () => {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ slug: 'srv-restore', title: 'Original', body: 'original body' }),
     });
-    const v1 = await snap1.json();
     expect(snap1.status).toBe(200);
+    const v1 = await snap1.json();
     const snap2 = await fetch(`${baseUrl}/api/cms/snapshot`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -287,8 +287,8 @@ describe('Server API (Integration)', () => {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ slug: 'srv-restore', sha: v1.sha }),
     });
-    const data = await res.json();
     expect(res.status).toBe(200);
+    const data = await res.json();
     expect(data.sha).toBeDefined();
 
     // Verify content was restored