fix(desktop): route session fetches by auth mode

[sealca]

What does this PR do?

Fixes Desktop's merged remote-profile session list so the primary/global backend uses the correct REST auth path when it is OAuth-authenticated.

When at least one named remote profile is configured, Desktop intercepts GET /api/profiles/sessions and merges rows from the primary backend plus each remote profile. Current main already has fetchJsonForProfile(), which routes requests by conn.authMode and uses the OAuth session path when needed. The primary/backend fetch inside mergeRemoteProfileSessions() still bypassed that routing and always called the token-based fetchJson() helper.

For OAuth remotes, primary.token can be null, the OAuth session cookie is not attached, the request fails, and the merge fallback silently treats the primary backend as empty. The result is a sidebar that omits the global/default backend sessions even though they still exist on the remote backend.

This PR keeps the change minimal: the merge-path primary fetch now goes through fetchJsonForProfile(null, ...) instead of manually calling the token-only helper.

Related Issue

Fixes #41529

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Updated mergeRemoteProfileSessions() so the primary/global backend fetch respects the resolved backend auth mode via fetchJsonForProfile(null, ...).
• Dropped the stale helper/test/package changes from the earlier version of this PR because current main already has the right request-routing helper.

How to Test

Verified locally from a clean worktree based on current upstream main (c3055d618):

cd apps/desktop
node --check electron/main.cjs
npm run test:desktop:platforms

Results:

• node --check electron/main.cjs: passed.
• npm run test:desktop:platforms: 102 passed, 0 failed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Linux 6.8.0 / Ubuntu VPS for Node/Electron platform tests

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

N/A. The fix is in Electron main-process request routing. Test output is summarized above.

[Morad37]

The extraction makes the routing decision testable independently from Electron's main process. The fetchTokenJson/fetchOauthJson injection is clean.

One thing I noticed: mergeRemoteProfileSessions has a .catch() that falls back to an empty result set. If the session is expired or the remote is unreachable, the user gets an empty session list with no indication anything went wrong. A warning log in the catch handler would give some visibility. But thats scope for a follow up. The routing refactor itself is solid.

[sealca]

Thanks — agreed. I kept this PR scoped to the auth-mode routing fix, but surfacing remote session fetch failures instead of silently returning an empty list would make sense as a follow-up.

[austinpickett]

Reviewed by Hermes Agent — Approve ✅

Good DRY fix. mergeRemoteProfileSessions() was hand-rolling the primary backend fetch with ensureBackend(null) + fetchJson(...), which bypasses the auth-mode routing that the remote-profile path already gets. Replacing it with the existing fetchJsonForProfile(null, ...) helper means the primary/global backend now uses the correct OAuth session path when it's OAuth-authenticated — same routing the remotes already use. The .catch(() => ({ sessions: [], total: 0, profile_totals: {} })) fallback is preserved. Consistent and minimal. LGTM.

[teknium1]

Thanks for the focused routing fix. The underlying defect is still present on current main, but the desktop entrypoint moved during the TypeScript migration.

Problems

• The PR modifies apps/desktop/electron/main.cjs, which was replaced by apps/desktop/electron/main.ts in 39d09453f95e8aefc0c97e5d9b30ff341cae9ed8. Current main still has the token-only primary fetch at apps/desktop/electron/main.ts:7861-7866.
• apps/desktop/electron/main.ts:6172-6177 already centralizes the required OAuth/token selection, but the current merge path bypasses it. The patch should be ported to that TypeScript call site and covered by a regression test for an OAuth primary plus named remote-profile merge.

Suggested changes

• Replace the direct fetchJson(... primary.token ...) call at apps/desktop/electron/main.ts:7863 with fetchJsonForProfile(null, ...), preserving the existing fallback.
• Add a focused auth-routing regression test for this merge path.

This is an automated hermes-sweeper review.

[alt-glitch]

This was generated by AI during triage.

Related to #41529. The fix is still needed, but this branch edits retired main.cjs; please rebase it onto the current apps/desktop/electron/main.ts call site and retain a focused OAuth-primary merge regression test.

[TheAngryPit]

I opened #67578 as a current-main replacement for this fix. It ports the OAuth-aware primary fetch to apps/desktop/electron/main.ts, also covers the batched sidebar call site added by #67245, and adds focused regression tests. I preserved the original issue linkage and credited this PR as the superseded implementation.

[OutThisLife]

Superseded by #67578.

You had this right first — fetchJsonForProfile(null, …) is exactly the fix, and #67578 is that same change ported to main.ts after 39d09453f deleted main.cjs, extended to the second call site (fetchProfilesSessionSlice, added later in #67245) and extracted behind a tested helper.

Your authorship is credited in the squash body, and #41529 closes with it. Thanks for the original diagnosis and fix.