test(privacy): prove category deletion stays scoped

Author: alichherawalla

docs/FUNCTIONAL_TEST_STRATEGY.md

@@ -28,7 +28,7 @@ really a test of a third-party framework or engine we merely depend on:
   75% branches / 77% functions / 79% lines on the TESTABLE surface (ratchet floor 77/74/76/78,
   climbing toward the 85% goal). ~1200 unit/integration tests.
 - **Swift, `npm run test:swift`:** 37 XCTest cases over the text-extractor pure classifiers.
-- **DB integration, `npm run test:db`:** 104 cases over core and Pro persistence against real
+- **DB integration, `npm run test:db`:** 105 cases over core and Pro persistence against real
   temp SQLite. Kept OUT of the default gate because it needs `better-sqlite3` rebuilt for the
   node ABI (the app builds it for Electron's ABI); the script rebuilds + restores. KNOWN GAP:
   wire `test:db` into CI as an isolated step so database coverage is enforced there.

docs/P0_P2_INTEGRATION_COVERAGE.md

@@ -8,13 +8,13 @@ manual claim does not count as complete integration coverage.
 ## Current status - 2026-07-17
 
 - Scope: 155 journeys - 74 P0, 71 P1, and 10 P2.
-- Covered by direct integration or E2E evidence: 21 - 14 P0, 6 P1, and 1 P2.
-- Left: 134 - including partially covered journeys whose exact release behavior is not yet proven.
+- Covered by direct integration or E2E evidence: 22 - 15 P0, 6 P1, and 1 P2.
+- Left: 133 - including partially covered journeys whose exact release behavior is not yet proven.
 - Green gates today:
   - `npm test`: 203 files passed, 1 skipped; 2,190 tests passed, 1 skipped.
   - `npm run test:coverage`: 96.77% statements, 91.54% branches, 96.25% functions,
     97.55% lines.
-  - `npm run test:db`: 13 files and 104 real SQLite integration tests passed; Electron ABI
+  - `npm run test:db`: 13 files and 105 real SQLite integration tests passed; Electron ABI
     restored afterward.
   - `npm run test:e2e`: 22 Playwright Electron tests passed against fresh synthetic temp profiles.
   - Both TypeScript projects pass.
@@ -51,6 +51,9 @@ manual claim does not count as complete integration coverage.
   attachment persistence across lock and unlock.
 - #128 - Vault recovery and backup. `vault-service.test.ts` and `vault-recovery.test.ts` exercise
   real KDBX export bytes, recovery setup, wrong phrases, and recovery to a new password.
+- #135 - Delete category is scoped. The real SQLite/filesystem integration deletes the Chats
+  category through `clearCategory` and proves memory, projects, connectors, encrypted tokens,
+  models, and unrelated personal files remain.
 - #136 - Delete all is complete. Core and Pro DB integration tests seed projects, chats, memory,
   knowledge, connectors, encrypted tokens, profile data, every registered Pro table, and every
   personal-data directory. They run the real delete-all registry, close and reopen the encrypted
@@ -158,8 +161,8 @@ manual claim does not count as complete integration coverage.
 
 - #129 - Runtime residency toggles persist; #130 - Chat residency stays required; #131 - Resource
   mode applies; #132 - Settings survive relaunch; #133 - Storage usage is truthful; #134 - Clear
-  cache preserves user data; #135 - Delete category is scoped; #137 - Core locked Pro tabs; #138 -
-  Pro license activates; #139 - Invalid or exhausted license fails
+  cache preserves user data; #137 - Core locked Pro tabs; #138 - Pro license activates; #139 -
+  Invalid or exhausted license fails
   clearly; #140 - Offline entitlement behavior; #141 - Core and Pro override behavior; #142 - Manual
   update check; #143 - Update channel persists.
 

src/main/__tests__/data-privacy-delete-all.dbtest.ts

@@ -42,7 +42,7 @@ vi.mock('electron', () => ({
 vi.mock('@lancedb/lancedb', () => ({ connect: async () => ({}) }))
 
 import * as dbmod from '../database'
-import { deleteAllData } from '../data-privacy'
+import { clearCategory, deleteAllData } from '../data-privacy'
 import { addConnector } from '../mcp'
 import { setSecret } from '../secrets'
 import { createProject, desktopVectorStore } from '../rag/store'
@@ -138,3 +138,35 @@ describe('deleteAllData — erases EVERY core personal store (D29/D30)', () => {
     expect(dbmod.getSetting('theme', '')).toBe('dark')
   })
 })
+
+describe('clearCategory — erases only the selected personal-data category', () => {
+  it('clears chats and uploads without touching memory, projects, credentials, or models', async () => {
+    dbmod.createRagConversation('scoped-chat', 'Scoped chat', null)
+    dbmod
+      .getDB()
+      .prepare('INSERT INTO memories (content, source_app) VALUES (?, ?)')
+      .run('keep this memory', 'Notes')
+    createProject({ id: 'keep-project', name: 'Keep project' })
+    addConnector({ name: 'Keep connector', transport: 'http', url: 'https://mcp.example.com' })
+    setSecret('keep:oauth:tokens', JSON.stringify({ access_token: 'keep-token' }))
+
+    const uploadPath = path.join(TMP_DIR, 'uploads', 'private.txt')
+    const entityPhotoPath = path.join(TMP_DIR, 'entity-photos', 'keep.jpg')
+    const modelPath = path.join(TMP_DIR, 'models', 'keep-after-scoped-delete.gguf')
+    for (const file of [uploadPath, entityPhotoPath, modelPath]) {
+      fs.mkdirSync(path.dirname(file), { recursive: true })
+      fs.writeFileSync(file, `content for ${path.basename(file)}`)
+    }
+
+    expect(await clearCategory('chats')).toEqual({ success: true })
+
+    expect(count('rag_conversations')).toBe(0)
+    expect(fs.readdirSync(path.join(TMP_DIR, 'uploads'))).toEqual([])
+    expect(count('memories')).toBeGreaterThan(0)
+    expect(count('projects')).toBeGreaterThan(0)
+    expect(count('connectors')).toBeGreaterThan(0)
+    expect(count('secrets')).toBeGreaterThan(0)
+    expect(fs.existsSync(entityPhotoPath)).toBe(true)
+    expect(fs.existsSync(modelPath)).toBe(true)
+  })
+})