fix(tui): drop cross-session events during null-sid switch window (#51058)

[yingliang-zhang]

Problem

Closes #51058 (TUI/Desktop session mix-up after context compression / reconnect resumes the wrong chat).

When two TUI sessions are active simultaneously and one undergoes context compression (or any session switch occurs), the other session's messages can bleed into the active view. A full state.db audit confirms the data layer is correctly isolated — the bug is purely in the TUI frontend event filtering layer.

Root cause

The event filter in createGatewayEventHandler.ts used sid && as a guard:

if (ev.session_id && sid && ev.session_id !== sid && !ev.type.startsWith('gateway.')) {
  return
}

When sid is null (during resetSession() in activateLiveSession / resumeById), sid && evaluates to false, bypassing the entire filter. ALL events from ALL live sessions pass through, causing cross-session content bleed.

Fix

Change sid && to (!sid || so that when sid is null, ALL non-gateway session events are dropped instead of let through:

if (ev.session_id && (!sid || ev.session_id !== sid) && !ev.type.startsWith('gateway.')) {
  return
}

This closes the race window: during session switch, no session-specific events are processed until the new sid is set.

Safety

• gateway.* events always pass (they carry no session-scoped data)
• Events without session_id always pass (session-agnostic)
• At startup (before any session is active), only gateway events are processed — the auto-resume flow gets session info from the RPC response, not from events
• The sid: null window in resetSession() is synchronous (nanostores), so no events are actually processed during it in normal execution — this fix is belt-and-suspenders defense for edge cases (React flushSync, microtask boundaries)

Verification

• tsc --noEmit passes
• node scripts/build.mjs passes
• DB audit confirmed: resolve_resume_session_id, get_compression_tip, get_messages_as_conversation, and list_sessions_rich all return correctly isolated data — the bug was exclusively in the frontend filter

[alt-glitch]

This was generated by AI during triage.

Heads up for reviewers: the title/body describe a 1-line TUI event-filter fix (ui-tui/src/app/createGatewayEventHandler.ts, closes #51058), but the diff also bundles three undisclosed core changes:

• agent/conversation_compression.py — merges the post-compression todo snapshot into the trailing user message (consecutive user/user content-ordering fix).
• cron/scheduler.py — records no_agent runs as sessions for desktop run-history visibility (refs [Bug]: Desktop GUI shows no execution status/output after manually triggering no_agent cron jobs #44080).
• hermes_state.py — delete_session/delete_sessions now cascade-delete the entire compression lineage. This is the same goal as the open fix(sessions): delete entire compression lineages, not just the visible tip #48525 (fix(sessions): delete entire compression lineages, not just the visible tip #48524), which does it via a recursive CTE; this PR uses a Python lineage-walk helper. Competing/overlapping fix — a maintainer should pick one.

Recommend splitting into focused PRs (or at least correcting the title/scope) so each change can be reviewed on its own. Related: #48525, #48524, #51058.

[yingliang-zhang]

Closing — this PR was opened from a main branch that bundled 3 other fixes (compression todo merge, no_agent cron sessions, session delete lineage). Reopening as a focused PR with only the TUI event-filter change: the new PR will be linked shortly. The other fixes have their own dedicated PRs (#53890 for compression todo merge; the cron and session-lineage fixes were duplicates of #44087 and #48525 respectively, now closed).