From 4738cd2952532cfe5bc5a0048e7379a8392efb99 Mon Sep 17 00:00:00 2001
From: lerry <lerry@Macmini-2024.local>
Date: Fri, 26 Jun 2026 14:21:12 +0800
Subject: [PATCH] fix(desktop): respect profile scope for cron jobs and
 messaging sessions

The Desktop App was displaying cron jobs, messaging sessions, and
messaging channels from all profiles regardless of which profile was
selected. This broke the profile isolation boundary.

Root cause: Three data-fetching calls hardcoded 'all' as the profile
parameter instead of respecting the active profile scope:
- getCronJobs() in hermes.ts didn't pass profile query param
- refreshCronSessions() hardcoded profile='all'
- refreshMessagingSessions() hardcoded profile='all'
- loadMoreMessagingForPlatform() hardcoded profile='all'

Fix: Pass the current profileScope (from  store) to all
these calls, matching the pattern already used by refreshSessions().
The backend already supports profile filtering, so this is purely a
frontend fix.

Fixes #52401
---
 apps/desktop/src/app/desktop-controller.tsx | 17 +++++++++++------
 apps/desktop/src/hermes.ts                  |  4 +++-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/apps/desktop/src/app/desktop-controller.tsx b/apps/desktop/src/app/desktop-controller.tsx
index 9df44d628cec..47b55c180080 100644
--- a/apps/desktop/src/app/desktop-controller.tsx
+++ b/apps/desktop/src/app/desktop-controller.tsx
@@ -414,7 +414,9 @@ export function DesktopController() {
   // still resolves into the Pinned section via sessionByAnyId.
   const refreshCronSessions = useCallback(async () => {
     try {
-      const { sessions } = await listAllProfileSessions(CRON_SECTION_LIMIT, 1, 'exclude', 'recent', 'all', {
+      const cronProfile = profileScope === ALL_PROFILES ? 'all' : profileScope
+
+      const { sessions } = await listAllProfileSessions(CRON_SECTION_LIMIT, 1, 'exclude', 'recent', cronProfile, {
         source: 'cron'
       })
 
@@ -422,7 +424,7 @@ export function DesktopController() {
     } catch {
       // Non-fatal: the cron section just stays empty/stale.
     }
-  }, [])
+  }, [profileScope])
 
   // Messaging-platform sessions as their own slice, fetched separately from
   // local recents so each platform renders a self-managed section and never
@@ -430,7 +432,9 @@ export function DesktopController() {
   // seeds every platform; the sidebar splits the rows per source.
   const refreshMessagingSessions = useCallback(async () => {
     try {
-      const result = await listAllProfileSessions(MESSAGING_SECTION_LIMIT, 1, 'exclude', 'recent', 'all', {
+      const msgProfile = profileScope === ALL_PROFILES ? 'all' : profileScope
+
+      const result = await listAllProfileSessions(MESSAGING_SECTION_LIMIT, 1, 'exclude', 'recent', msgProfile, {
         excludeSources: MESSAGING_EXCLUDED_SOURCES
       })
 
@@ -445,7 +449,7 @@ export function DesktopController() {
     } catch {
       // Non-fatal: the messaging sections just stay empty/stale.
     }
-  }, [])
+  }, [profileScope])
 
   // Page a single platform's section independently (mirrors the per-profile
   // pager): fetch that source's next window and merge it back in place, leaving
@@ -453,8 +457,9 @@ export function DesktopController() {
   const loadMoreMessagingForPlatform = useCallback(async (platform: string) => {
     const inPlatform = (s: SessionInfo) => normalizeSessionSource(s.source) === platform
     const loaded = $messagingSessions.get().filter(inPlatform).length
+    const loadProfile = profileScope === ALL_PROFILES ? 'all' : profileScope
 
-    const result = await listAllProfileSessions(loaded + SIDEBAR_SESSIONS_PAGE_SIZE, 1, 'exclude', 'recent', 'all', {
+    const result = await listAllProfileSessions(loaded + SIDEBAR_SESSIONS_PAGE_SIZE, 1, 'exclude', 'recent', loadProfile, {
       source: platform
     })
 
@@ -467,7 +472,7 @@ export function DesktopController() {
 
     const total = result.total ?? incoming.length
     setMessagingPlatformTotals(prev => ({ ...prev, [platform]: Math.max(total, incoming.length) }))
-  }, [])
+  }, [profileScope])
 
   // Cron *jobs* drive the sidebar "Cron jobs" section. Jobs are created
   // synchronously (agent tool call or the cron UI), so refreshing here right
diff --git a/apps/desktop/src/hermes.ts b/apps/desktop/src/hermes.ts
index 8e0656a9e7ab..0c1da4099ab8 100644
--- a/apps/desktop/src/hermes.ts
+++ b/apps/desktop/src/hermes.ts
@@ -585,8 +585,10 @@ export function testMessagingPlatform(platformId: string): Promise<MessagingPlat
 }
 
 export function getCronJobs(): Promise<CronJob[]> {
+  const qs = _apiProfile ? `?profile=${encodeURIComponent(_apiProfile)}` : ''
+
   return window.hermesDesktop.api<CronJob[]>({
-    path: '/api/cron/jobs'
+    path: `/api/cron/jobs${qs}`
   })
 }