fix(web): rotate PTY attach token on session switch

[mario841859784]

Problem

In the Dashboard Chat page, switching between sessions via the sidebar updates the resume query parameter but the terminal shows an empty view instead of the selected session's conversation history.

Root Cause

ptyAttachToken() in ChatPage.tsx persists the attach token in localStorage so page refreshes can reattach to the same live PTY. However, when the user switches to a different session, resume changes but the token stays the same. The server sees the identical attach token and reattaches to the old PTY instead of spawning a new one for the new session — so no history is loaded.

Fix

Add a useEffect that watches resumeParam changes. When it changes (and it's not the initial mount), call ptyAttachToken(true) to force-rotate the token, then bump reconnectNonce to trigger a fresh WebSocket connect. The server sees the new token, starts a new PTY bound to the new session, and replays its history.

Changes

• web/src/pages/ChatPage.tsx: add prevResumeRef and a useEffect that rotates the attach token on resumeParam change.

Verification

• tsc --noEmit passes
• npm run build succeeds
• Manual test: switch between sessions in the sidebar, confirm the terminal shows the correct conversation history each time.

[alt-glitch]

This was generated by AI during triage.

Related to the dashboard wrong-session-on-switch cluster (#61284 issue; #61045 earliest-open frontend anchor, #60745 backend anchor, #61107 frontend sibling), all stemming from the merged keep-alive PTY regression #60515. This is not a duplicate — it uses a different mechanism: it rotates/mints a new attach token on every resume change (orphaning the old PTY), whereas #61045/#61107 namespace the token per resume target so a per-session keep-alive PTY survives switch-back. Same goal, different trade-off — flagging for a maintainer to pick between rotate-on-switch and per-session namespacing.

[teknium1]

Thanks for the focused session-switch fix. The current-main premise is confirmed: ChatPage sends a persistent bare attach token (web/src/pages/ChatPage.tsx:61-81, :799-809) and the server reattaches live PTYs solely by that token (hermes_cli/web_server.py:15430-15454; hermes_cli/pty_session.py:148-166).

Problems

• The new resume-only rotation does not cover a profile switch. scopedProfile already rebuilds the websocket and is sent to /api/pty (web/src/pages/ChatPage.tsx:294, :805-809), but the new effect does not rotate on that change and the backend registry does not scope its key by profile. A live PTY from the previous profile can still be reattached.
• The PR has no regression coverage. Existing keep-alive coverage only asserts same-token reuse (tests/test_pty_keepalive_ws.py:7-52), not target isolation.

Suggested changes

• Scope the attach identity by both resume and profile, preferably enforcing that invariant before PTY_REGISTRY.attach_or_spawn in hermes_cli/web_server.py:15452-15454.
• Add tests for different resume targets and different profiles, alongside same-target reattachment.

Automated hermes-sweeper review.