fix(extension): use deterministic fallback attachment ID to keep refs stable across saves

Replace crypto.randomUUID() fallback with a deterministic ID derived from
session ID, message ID, and part index. This ensures that file attachment
references remain stable when re-saving a session where only a later message
changed, preventing duplicate attachment writes.

Add test 'keeps earlier attachment refs stable when only the latest message
rewrites' to cover this behaviour.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lcomplete

app/extension/src/__tests__/sessionStoragePersistence.test.ts

@@ -281,6 +281,47 @@ function createTwoTurnSession(secondQuestion = "Follow-up") {
   };
 }
 
+function createTwoTurnSessionWithAttachment(secondAnswer = "Second answer") {
+  return {
+    ...createSession("Question", "First answer"),
+    messages: [
+      {
+        id: "user-1",
+        role: "user" as const,
+        parts: [
+          { type: "text" as const, text: "Question" },
+          {
+            type: "file" as const,
+            filename: "note.txt",
+            mediaType: "text/plain",
+            dataUrl: "data:text/plain;base64,SGVsbG8=",
+            size: 5,
+          },
+        ],
+        status: "complete" as const,
+      },
+      {
+        id: "assistant-1",
+        role: "assistant" as const,
+        parts: [{ type: "text" as const, text: "First answer" }],
+        status: "complete" as const,
+      },
+      {
+        id: "user-2",
+        role: "user" as const,
+        parts: [{ type: "text" as const, text: "Follow-up" }],
+        status: "complete" as const,
+      },
+      {
+        id: "assistant-2",
+        role: "assistant" as const,
+        parts: [{ type: "text" as const, text: secondAnswer }],
+        status: "complete" as const,
+      },
+    ],
+  };
+}
+
 describe("sessionStorage persistence layout", () => {
   let fakeIndexedDB: FakeIndexedDB;
 
@@ -378,6 +419,57 @@ describe("sessionStorage persistence layout", () => {
     ]);
   });
 
+  it("keeps earlier attachment refs stable when only the latest message rewrites", async () => {
+    const { saveSession } = await import("../sidepanel/sessionStorage");
+    const originalFetch = globalThis.fetch;
+
+    globalThis.fetch = jest.fn(async () => ({
+      ok: true,
+      blob: async () =>
+        ({ size: 5, type: "text/plain" }) as unknown as Blob,
+    })) as unknown as typeof fetch;
+
+    try {
+      await saveSession(createTwoTurnSessionWithAttachment());
+
+      const db = fakeIndexedDB.databases.get("huntly-agent")!;
+      const messageStore = db.stores.get("session-messages")!;
+      const attachmentStore = db.stores.get("session-attachments")!;
+      const storedUserMessage = messageStore.records.get(
+        "session-1\u001fuser-1"
+      ) as {
+        message: { parts: Array<{ type: string; attachmentId?: string }> };
+      };
+      const firstAttachmentId = storedUserMessage.message.parts[1].attachmentId;
+
+      expect(firstAttachmentId).toBeDefined();
+      expect(attachmentStore.records.has(firstAttachmentId!)).toBe(true);
+
+      messageStore.putCount = 0;
+
+      await saveSession(
+        createTwoTurnSessionWithAttachment("Updated second answer")
+      );
+
+      expect(messageStore.putCount).toBe(1);
+
+      const updatedUserMessage = messageStore.records.get(
+        "session-1\u001fuser-1"
+      ) as {
+        message: { parts: Array<{ type: string; attachmentId?: string }> };
+      };
+      const updatedAttachmentId =
+        updatedUserMessage.message.parts[1].attachmentId;
+
+      expect(updatedAttachmentId).toBe(firstAttachmentId);
+      expect(Array.from(attachmentStore.records.keys())).toEqual([
+        firstAttachmentId,
+      ]);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   it("keeps history metadata and stored messages after a run completes", async () => {
     const { getSession, listSessionMetadata, saveSession } = await import(
       "../sidepanel/sessionStorage"

app/extension/src/sidepanel/sessionStorage.ts

@@ -195,6 +195,14 @@ function getMessageStorageKey(sessionId: string, messageId: string): string {
   return `${sessionId}\u001f${messageId}`;
 }
 
+function getFallbackAttachmentId(
+  sessionId: string,
+  messageId: string,
+  partIndex: number
+): string {
+  return `${sessionId}\u001f${messageId}\u001fattachment-${partIndex}`;
+}
+
 function createMessageRef(
   sessionId: string,
   message: ChatMessage,
@@ -437,13 +445,19 @@ async function serializeSessionAttachments(
   const referencedAttachmentIds = new Set<string>();
 
   const messages = await Promise.all(
-    session.messages.map(async (message) => ({
+    session.messages.map(async (message, messageOrder) => ({
       ...message,
       parts: await Promise.all(
-        message.parts.map(async (part) => {
+        message.parts.map(async (part, partIndex) => {
           if (part.type !== "file") return part;
 
-          const attachmentId = part.attachmentId || crypto.randomUUID();
+          const attachmentId =
+            part.attachmentId ||
+            getFallbackAttachmentId(
+              session.id,
+              getMessageId(message, messageOrder),
+              partIndex
+            );
           referencedAttachmentIds.add(attachmentId);
 
           if (part.dataUrl && !attachmentRecords.has(attachmentId)) {