fix(gateway): bind session context at agent turn entry (cross-session identity misbinding)

[Kyzcreig]

Summary

Fixes the live, thrice-reproduced cross-session identity misbinding: an interactive turn could execute with the COMPLETE coherent identity (HERMES_SESSION_CHAT_ID/THREAD_ID/KEY/ID/MESSAGE_ID) of a different live session, causing real misroutes (kanban notify-subscribe subscribed a foreign Discord thread's chat id).

Root cause

_run_agent never enforced its own identity contract. The normal message handler binds session vars, but the in-band queued-follow-up path RECURSES into _run_agent directly — bypassing the handler — so the follow-up turn inherits the outer/sibling turn's coherent binding, which then propagates into the worker thread via copy_context() and out to every tool subprocess.

Fix (spec: Momus-reviewed, 2 passes)

• _run_agent now resets inherited state and binds source/session_key/session_id/event_message_id from its OWN args before local or proxy execution — before any worker copy_context().
• Nested (recursive follow-up) calls restore the OUTER binding via ContextVar tokens (restore_session_vars), never reset-to-UNSET — the A→B→A regression proves outer identity survives inner exit.
• Log-only WARNING when the bound key disagrees with the current turn's source-derived key at dispatch.
• Pool residue ruled out: all gateway agent jobs run under copy_context().run; regression uses a single-worker executor across A→B→A.

Tests

• 3 new tests FAILED pre-fix, pass post-fix; all assert on the WORKER-THREAD/SUBPROCESS surface (_run_in_executor_with_context → subprocess env view), not MainThread ContextVars (which read _UNSET while the live bug was active — the fake-green trap).
• Mutation checks: removing the choke-point bind → 4 fail; removing token restoration → 1 fail (A observes B's full identity).
• Targeted sweep: 574 passed / 0 failed across 21 session/queue/restart/profile/proxy/cron/cache files (py3.11). Ruff + py_compile clean.

Cache safety

No prompt/messages/tool-schema/cache-key behavior changed — context binding only.

[greptile-apps]

Greptile Summary

This PR fixes a live cross-session identity misbinding: recursive queued follow-up turns invoked _run_agent directly, bypassing the top-level message handler that normally binds session ContextVars, causing a queued turn to execute with the full coherent identity (CHAT_ID / THREAD_ID / KEY / ID / MESSAGE_ID) of a sibling session.

• _run_agent is now the identity enforcement choke point: it calls reset_session_vars() (now returns tokens) then _set_session_vars_for_source() from its own call arguments before delegating to _run_agent_inner, regardless of what the caller had already bound.
• Nested calls are safe via LIFO token restoration: outer identity is saved via reset_tokens and session_tokens, restored in the correct reverse order in a two-level finally block so recursive A→B→A turns always exit with A's binding intact.
• restore_session_vars (new) applies per-token try/except so a single bad token cannot abort restoration of remaining vars. Five new tests validated against the worker-thread / subprocess environment surface.

Confidence Score: 5/5

Safe to merge. The fix is narrowly scoped to ContextVar binding order in _run_agent and introduces no behavioral changes to prompt content, cache keys, or tool schemas.

The change closes a well-documented, thrice-reproduced misroute by adding reset→rebind→restore logic at a single choke point. Token LIFO ordering is correct for every affected var, the two-level finally ensures restoration fires even when set_session_vars_for_source raises, and the per-token try/except in restore_session_vars prevents a single bad token from leaving a mixed identity. Five targeted tests validate the worker-thread surface where the live bug was observable.

No files require special attention. All four changed files are internally consistent and well-covered by the new tests.

Important Files Changed

Filename	Overview
gateway/run.py	Core fix: _run_agent now enforces its own session identity contract via reset→rebind→restore; _set_session_env refactored to delegate to the new _set_session_vars_for_source; _run_agent_inner gains a warning-only mismatch detector before dispatch.
gateway/session_context.py	reset_session_vars() now returns tokens (was void); set_session_vars() captures the CWD token; new restore_session_vars() applies per-token best-effort restoration with logging.
agent/runtime_cwd.py	Adds reset_session_cwd() returning a Token so _SESSION_CWD participates in the token-based restore chain; purely additive.
tests/gateway/test_session_context_inheritance.py	Five new tests covering full turn rebind, multiplex profile scope, warning-net, cross-session A→B→A recursive identity, and same-session steer fallback message-id anchor — all asserting on the worker-thread subprocess-env surface.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant H as Message Handler
    participant RA as _run_agent (A)
    participant RAI as _run_agent_inner (A)
    participant RB as _run_agent (B, queued)
    participant RBI as _run_agent_inner (B)
    participant W as Worker Thread
    H->>H: reset_session_vars()
    H->>H: _set_session_env(ctx_A)
    H->>RA: "_run_agent(source=A)"
    RA->>RA: "reset_session_vars() -> reset_tokens_A"
    RA->>RA: "_set_session_vars_for_source(A) -> session_tokens_A"
    RA->>RAI: _run_agent_inner(A)
    RAI->>W: copy_context().run() sees A identity
    RAI->>RB: "_run_agent(source=B) queued follow-up"
    RB->>RB: "reset_session_vars() -> reset_tokens_B"
    RB->>RB: "_set_session_vars_for_source(B) -> session_tokens_B"
    RB->>RBI: _run_agent_inner(B)
    RBI->>W: copy_context().run() sees B identity
    RBI-->>RB: return
    RB->>RB: restore_session_vars(session_tokens_B)
    RB->>RB: restore_session_vars(reset_tokens_B) restores A
    RB-->>RAI: return
    RAI->>W: copy_context().run() sees A identity again
    RAI-->>RA: return
    RA->>RA: restore_session_vars(session_tokens_A)
    RA->>RA: restore_session_vars(reset_tokens_A)
    RA-->>H: return

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant H as Message Handler
    participant RA as _run_agent (A)
    participant RAI as _run_agent_inner (A)
    participant RB as _run_agent (B, queued)
    participant RBI as _run_agent_inner (B)
    participant W as Worker Thread
    H->>H: reset_session_vars()
    H->>H: _set_session_env(ctx_A)
    H->>RA: "_run_agent(source=A)"
    RA->>RA: "reset_session_vars() -> reset_tokens_A"
    RA->>RA: "_set_session_vars_for_source(A) -> session_tokens_A"
    RA->>RAI: _run_agent_inner(A)
    RAI->>W: copy_context().run() sees A identity
    RAI->>RB: "_run_agent(source=B) queued follow-up"
    RB->>RB: "reset_session_vars() -> reset_tokens_B"
    RB->>RB: "_set_session_vars_for_source(B) -> session_tokens_B"
    RB->>RBI: _run_agent_inner(B)
    RBI->>W: copy_context().run() sees B identity
    RBI-->>RB: return
    RB->>RB: restore_session_vars(session_tokens_B)
    RB->>RB: restore_session_vars(reset_tokens_B) restores A
    RB-->>RAI: return
    RAI->>W: copy_context().run() sees A identity again
    RAI-->>RA: return
    RA->>RA: restore_session_vars(session_tokens_A)
    RA->>RA: restore_session_vars(reset_tokens_A)
    RA-->>H: return

Loading

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/session-con..." | Re-trigger Greptile}