fix(editor): clean up orphaned local asset:// files from IndexedDB

[Zhao0335]

What does this PR do?

Fixes #733.

Deleting a local scan or guide node only routed http(s) URLs to onDeleteAsset. Local asset:// Files — including scans up to ~200 MB — stayed in IndexedDB forever after the referencing node was gone.

This PR schedules a delayed delete of the specific File when the last live node that pointed at it is removed:

• Scene-panel delete of a scan/guide schedules the local File for removal after a 120s grace period (undo can still restore the node and load the blob).
• Reference-panel delete and replace paths do the same for guide images.
• deleteAsset in @pascal-app/core removes the IndexedDB entry and revokes any cached object URL.
• A scene epoch is bumped on every applySceneGraphToEditor. Timers scheduled under a previous epoch refuse to delete, so switching projects cannot wipe a File another saved scene still uses.

It does not sweep "all unreferenced assets" on scene load. IndexedDB is origin-global and not scoped by scene.

How to test

1. Self-host the editor (bun dev), open a project, and upload a local guide image.
2. Delete the node from the Scene panel (or the reference panel).
3. Within ~2 minutes, Ctrl+Z the delete — the guide should still resolve.
4. Let the grace period elapse (or wait for the timer) — the IndexedDB entry for that asset should be gone (Application -> IndexedDB in DevTools).
5. Delete a local asset, then immediately open another project before the timer fires — the File must remain loadable when you reopen the first scene.
6. Open another scene that still has local assets — they must remain loadable (no cross-scene wipe).

Screenshots / screen recording

N/A — storage lifecycle only, no visual change.

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

Validation

• packages/core: 1532 tests pass (bun run test)
• packages/editor: local-asset-lifecycle.test.ts 6/6 pass
• @pascal-app/core tsc --build clean
• @pascal-app/editor check-types clean

Review follow-ups

1. Removed the fire-and-forget origin-wide orphan sweep so opening one scene cannot delete assets referenced by other graphs.
2. Added a scene epoch: delayed deletes scheduled under a previous applySceneGraphToEditor epoch are skipped, so a project switch during the grace window cannot delete a File another saved scene still references.

---

Note

Medium Risk
IndexedDB sweeps are gated on a complete scene inventory, but incorrect keep-set logic or API edge cases could still delete blobs shared across scenes or leave large orphans until the next successful GC.

Overview
Adds origin-wide garbage collection for local asset:// blobs in IndexedDB (#733). @pascal-app/core now exposes deleteAsset, listLocalAssetUrls, sweepLocalAssetsExcept, and helpers to collect asset:// references from node url/src fields—physical deletes only happen through an explicit sweep with a full keep-set, not from UI delete/replace paths.

The editor app builds that keep-set from the live scene, localStorage draft, and every server scene graph (via /api/scenes), and aborts if listing fails or hits the 500-scene cap so a partial inventory cannot wipe assets still used elsewhere (e.g. after duplication). SceneLoader runs this GC once after hydration, re-reading live nodes immediately before sweeping so uploads during the fetch stay protected.

Reference and site panels stop doing local IndexedDB cleanup themselves (comments point lifecycle at core/GC instead); http(s) asset deletes via onDeleteAsset are unchanged.

^{Reviewed by Cursor Bugbot for commit 3bea691. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 92c31b27-f9c4-4ce1-a2fb-ce2e00b06d8f

[cursor]

Stale Bugbot comment from a previous run.

[Zhao0335]

Addressed the Bugbot finding in d44b09d: removed the scene-load orphan sweep. IndexedDB is origin-global, so sweeping entries missing from the just-loaded graph could wipe assets still referenced by other scenes. Cleanup is now only the undo-safe delayed delete of a specific �sset:// File after its last live node is removed.

[cursor]

Stale Bugbot comment from a previous run.

[Zhao0335]

Addressed the latest Bugbot finding: delayed deletes now capture a scene epoch at schedule time. �pplySceneGraphToEditor bumps the epoch; timers from a previous epoch refuse to deleteAsset. Switching projects during the grace window no longer deletes origin-global IndexedDB Files that another saved scene still references. Covered by a new unit test.

[Zhao0335]

This finding is already fixed on the current HEAD (cb97731), which is ahead of the reviewed 7ae66a2.

• �pplySceneGraphToEditor bumps a scene epoch (�umpLocalAssetSceneEpoch).
• scheduleLocalAssetDelete captures that epoch at schedule time; the timer returns without deleteAsset if the epoch changed (project/scene switch).
• Covered by unit test: does not delete after a scene switch (another graph may still use the File).

No further code change needed for this comment.

[Aymericr]

Blocker: cleanup is attached to two UI handlers rather than the deletion lifecycle, so the bug still reproduces through supported delete paths.

For example, packages/editor/src/hooks/use-keyboard.ts deletes a selected guide/scan directly with useScene.getState().deleteNode(...), and the generic selection/delete surfaces in selection-routing.ts and group-actions.ts also bypass scheduleLocalAssetDelete. Deleting the same local reference with the Delete key therefore still leaves its asset:// File in IndexedDB.

Please move the scheduling to a single path that observes all committed node removals/replacements, or route every supported guide/scan deletion path through one shared helper. Add a regression test for keyboard deletion (and ideally delete-mode/generic selection deletion) so this cannot remain UI-entry-point dependent. The 120-second grace period, live-reference recheck, cache revocation, and scene-epoch guard are otherwise sensible.

[Zhao0335]

Addressed the deletion-lifecycle blocker in $(git rev-parse --short HEAD):

• Local �sset:// scheduling now lives in @pascal-app/core and runs from deleteNodesAction (and �pplyNodeChanges deletes/url replacements), not the Site/reference panel handlers.
• Covers keyboard Delete (use-keyboard.ts → deleteNode), selection delete, MCP delete_node, and group actions.
• Regression test: packages/core/src/lib/local-asset-lifecycle-delete.test.ts — keyboard-style deleteNode schedules the File; a second live reference keeps it.

Grace period, live-reference recheck, cache revocation, and scene-epoch guard are unchanged.

[cursor]

Stale Bugbot comment from a previous run.

[Aymericr]

The central delete lifecycle now covers the missing keyboard/generic paths, but the current head still has three correctness blockers before cleanup is safe: (1) URL replacement schedules deletion without a fire-time scan of all live nodes, so undo or another node sharing the same asset:// URL can lose its File; (2) the reference-panel replacement schedules before updateNode commits, so a no-op/throw can delete the still-current asset; and (3) the scene epoch only advances in applySceneGraphToEditor, while unload/import/reset paths can replace the graph through setScene/clearScene and leave an old timer valid. Please make the timer predicate query the current graph for the URL at fire time, schedule replacements only after a committed change, and put epoch invalidation at the shared graph-replacement boundary. CI also needs the three Biome organize-import fixes shown by quality. Add regressions for shared-reference replacement, undo restoration, failed/no-op replacement, and a clear/set scene transition.

[Zhao0335]

Addressed the three correctness blockers and Biome organizeImports on $head:

1. Replacement timers re-query the live graph for the URL at fire time (collectSceneAssetUrls(get().nodes)), so undo or a duplicate guide sharing the same �sset:// handle keeps its File.
2. Guide replace no longer schedules before updateNode; only the core updateNodes path schedules after the url change commits.
3. Epoch is bumped in unloadScene and setScene (shared graph-replacement boundary), not only �pplySceneGraphToEditor.

Regressions added for shared-reference replacement, undo restoration, unreferenced replacement, and setScene epoch. packages/core: 1545 tests pass.

[Aymericr]

The new fire-time live-graph checks fix the reported undo/shared-node cases, but there is still a cross-scene data-loss blocker. asset:// storage is origin-global, and scene/project duplication preserves those URLs. If scene A and an unopened saved scene B reference the same File, deleting the last reference in the currently loaded A schedules deleteAsset; staying in A for 120 seconds means the timer sees no current reference and deletes B’s File. The epoch only protects a scene switch during the grace window, not references in persisted scenes that were never loaded. This is the same ownership problem that made the original sweep unsafe.

Please do not physically delete origin-global Files based only on the active graph. The cleanup path needs a durable cross-scene reference index/refcount (updated atomically with scene persistence), per-scene asset ownership/copying, or a conservative explicit garbage-collection pass that can inspect every saved graph. Until one of those exists, this PR trades an orphan leak for silent corruption of another project. Add a regression with two persisted scenes sharing one asset URL; deleting from one must not break the other.

[cursor]

Stale Bugbot comment from a previous run.

[Zhao0335]

Addressed the cross-scene data-loss blocker in 55e04ae.

No longer deletes origin-global Files from the active graph.

1. Removed automatic deleteAsset from deleteNodes / updateNodes timers.
2. Core now exposes explicit GC: sweepLocalAssetsExcept(keepUrls).
3. Standalone editor GC (apps/editor/lib/local-asset-gc.ts) builds the keep-set from current scene + localStorage scene + every /api/scenes graph. If any source cannot be enumerated, it skips the sweep rather than partial-deleting.
4. Regression test: two persisted scenes share one asset:// URL; sweeping with both keep-sets keeps the File.

Orphan leak may remain until a successful full enumeration runs — that is preferred over silent corruption of another project.

[cursor]

Stale Bugbot comment from a previous run.

[Zhao0335]

Fixed the two High findings on 0023ec0:

1. Truncated inventory — /api/scenes has no cursor; a full page (500) is treated as incomplete and GC skips instead of sweeping. Listing failure still skips.
2. In-flight uploads —
   unLocalAssetGc takes a live-node getter and re-reads useScene immediately before sweepLocalAssetsExcept, and keeps initialScene urls in the extra keep-set.

Unit tests cover truncated list, failed list, and mid-GC live-graph growth.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3bea691. Configure here.}

[cursor]

GC deletes in-flight local Files

High Severity

runLocalAssetGc builds its keep-set from the server inventory plus this tab's live nodes, then sweepLocalAssetsExcept immediately deletes everything else. SceneLoader starts that sweep on mount, in parallel with the previous editor's keepalive flush and before a just-written asset:// node is guaranteed to be persisted. A project switch, a second tab, or an upload that has hit IndexedDB but not yet landed on a node can remove a File another saved or in-flight graph still references.

Additional Locations (1)

• apps/editor/components/scene-loader.tsx#L133-L143

 

^{Reviewed by Cursor Bugbot for commit 3bea691. Configure here.}

[cursor]

GC exhausts scene API rate limit

Medium Severity

collectAllPersistedAssetUrls issues one list request plus a sequential GET for every scene, on the same client rate bucket as autosave and SSE (120 requests/minute by default). Opening a /scene/[id] page with tens of scenes can burn the budget so later PUTs return 429, and a full page of fetches also stalls the editor for the whole inventory walk.

 

^{Reviewed by Cursor Bugbot for commit 3bea691. Configure here.}