[audit] multi-cursor: backward array length mismatch after range normalization

[claude]

Problem

In src/plugins/multiCursor/inputHandling.ts (lines 229–246) and src/plugins/multiCursor/horizontalMovement.ts (lines 99–118), the newBackward array is computed from the pre-normalization nextRanges array. After calling normalizeRangesWithPrimary(), ranges may be merged (deduplicated), reducing the array length. However, the original-length newBackward array is passed directly to the MultiSelection constructor.

The constructor at MultiSelection.ts:38 stores it as-is when provided:

this.backward = backward ?? new Array(normalized.ranges.length).fill(false);

The ?? only triggers when backward is undefined/null — not when it has the wrong length.

Impact

When Shift+Arrow movement causes two cursors to merge to the same position, the backward flags become misaligned with the surviving ranges. This can cause the selection extend direction to flip unexpectedly on subsequent Shift+Arrow presses.

Reproduction

1. Place two cursors close together (e.g., adjacent lines)
2. Hold Shift+ArrowLeft/Right until the two selections overlap and merge
3. Continue Shift+Arrow — the surviving selection may extend in the wrong direction

Suggested fix

After normalization, remap the newBackward array to match the normalized ranges. One approach: track which original range indices survive normalization and filter newBackward accordingly.

Files:

• src/plugins/multiCursor/inputHandling.ts:229-246
• src/plugins/multiCursor/horizontalMovement.ts:99-118
• src/plugins/multiCursor/MultiSelection.ts:38

[xiaolai]

Fixed in 464a96a.

Added remapBackwardFlags() in rangeUtils.ts that maps backward flags from the pre-normalization array to the post-normalization array (handling exact matches, deduplication, and merged ranges). Applied at both call sites in inputHandling.ts and horizontalMovement.ts.

Also added a defensive check in the MultiSelection constructor — if the backward array length doesn't match normalized ranges, it resets to all-false instead of silently using misaligned data.

Tests: 4 new remapBackwardFlags tests + 1 constructor defense test. All 460 multi-cursor tests pass.