fix(desktop): keep recovered actions bound to the selected session

[33hodl]

1|## What does this PR do?
2|
3|Keeps Hermes Desktop's recovered prompt, redirect, and interrupt actions bound to the conversation the user actually selected.
4|
5|After a gateway restart, a stale runtime session can return session not found. Desktop resumes the durable session and receives a replacement runtime ID. Current main can update only the hot ref while leaving $activeSessionId stale, and asynchronous recovery can continue after the user switches conversations — including switch-away-and-back cases where the final IDs look unchanged.
6|
7|This narrowed PR fixes only that session-correctness boundary:
8|
9|- synchronize recovered runtime IDs into both activeSessionIdRef.current and $activeSessionId;
10|- make profile-switch fresh-session teardown synchronous before gateway activation can move to another profile;
11|- advance a monotonic selection generation synchronously at the stored-selection write boundary, so batched A → B → A is still observable;
12|- abort prompt-submit, redirect, and interrupt recovery when route, stored selection, runtime selection, or generation changes;
13|- prevent late recovered-submit failures from adding errors to a newly selected session;
14|- preserve a newly selected session's busy/notification state when a recovered interrupt resolves or rejects late;
15|- keep background queued sends pinned to their queued session;
16|- migrate or remove optimistic state only inside the operation's target runtime;
17|- add focused regression coverage for submit, redirect, interrupt, busy retry, optimistic cleanup, profile switch, and switch-away-and-back races.
18|
19|## Why this PR is narrower now
20|
21|The earlier version also changed OAuth-ticket classification and remote liveness. That work overlaps merged PR #68250 and is removed from this branch.
22|
23|Backend-restart connection retry is also intentionally excluded and is tracked separately in #69059 so maintainers can evaluate retry policy independently from this correctness fix.
24|
25|## Related work and attribution
26|
27|- Preserves the atom/ref synchronization contribution from #62471 and its original author via cherry-pick.
28|- Incorporates the profile-switch timing fix from #66889 and preserves its original author via cherry-pick.
29|- Complements #68250; it does not duplicate that merged OAuth/liveness implementation.
30|
31|## Correctness invariants
32|
33|1. The runtime-session ref and reactive atom agree after recovery.
34|2. Recovery never overwrites, reports errors into, or clears state in a conversation selected after the operation began.
35|3. Switching away and back is still observable as user intent.
36|4. A profile switch clears foreground session identity before the active gateway can change.
37|5. Background queued sends remain pinned to their queued destination.
38|6. An intentional recovery runtime-ID rotation is distinguished from a later user selection.
39|
40|## Validation
41|
42|Run from the repository root on current main (683059feb54f511717c831e0989e0f3c54450785):
43|
44|- npm test --workspace apps/desktop -- --project ui src/app/session/hooks/use-prompt-actions/index.test.tsx src/app/hooks/use-fresh-session-requests.test.tsx src/app/session/hooks/use-background-queue-drain.test.tsx src/store/session.test.ts
45| - 121 passed
46|- npm run typecheck --workspace apps/desktop
47| - passed (UI, Electron, and E2E TypeScript projects)
48|- npm run lint --workspace apps/desktop
49| - 0 errors; 21 unrelated existing warnings
50|- git diff --check origin/main...HEAD
51| - passed
52|- changed-line secret-pattern scan
53| - no private keys, GitHub tokens, AWS keys, or generic secret assignments
54|- package/dependency review
55| - no manifest or lockfile changes
56|
57|Independent review was performed after repair against the live-main-rebased head. Publication was held until every blocking finding had a RED regression test and a verified fix.
58|
59|## Scope
60|
61|Desktop renderer/session state and regression tests only. No authentication, liveness, backend-retry, generated artifact, dependency, configuration, or credential changes are included.
62|

[teknium1]

Thanks — the reported behavior is present on current main.

Problems

• The new 401/403-only classification conflicts with the current Desktop engineering contract: apps/desktop/AGENTS.md:127-130 says any OAuth ticket-mint failure means reauthentication. Update that guidance so future changes preserve the intended transient-failure behavior.

Suggested changes

• Amend apps/desktop/AGENTS.md:127-130 to state that a fresh ticket is required on every dial, but only confirmed 401/403 failures require sign-in; transient/network/server failures remain retryable.

Salvageability is high. The PR base predates current main, and current-main changes touch several modified production files, so a maintainer cherry-pick will need focused conflict resolution rather than a blind apply. This is an automated hermes-sweeper review.

[33hodl]

Addressed the hermes-sweeper review request in commit 60b75077f. Updated apps/desktop/AGENTS.md to clarify that every OAuth dial mints a fresh WebSocket ticket, while only confirmed 401/403 (or explicitly tagged auth) failures require sign-in; transient network, timeout, and server failures remain retryable.

The branch is rebased onto current main, conflicts are resolved, and focused Electron validation passed: 439 passed, 1 skipped.

[33hodl]

Rebased the remote Desktop gateway/session resilience series onto current origin/main (fb0ed8396) and added a fifth fix from independent review:

• abort recovered prompt.submit when the user switches sessions during a bounded session busy retry delay;
• re-check the pinned session/route before every retry attempt;
• add a regression test covering the switch-during-retry window.

Validation on the refreshed head:

• focused UI: 73 passed;
• focused Electron: 64 passed;
• full Electron: 484 passed, 1 skipped;
• TypeScript: passed;
• ESLint: 0 errors;
• production build: passed;
• macOS ARM64 Electron Builder package: passed;
• production dependency audit: 0 vulnerabilities;
• added-line credential scan and git diff --check: passed.

The branch remains a small upstream-plus-five-commit delta. The macOS build stamp is clean and points to the PR head.

[33hodl]

@austinpickett This PR has been narrowed to the Desktop session-correctness boundary and rebased onto current main. The OAuth/liveness overlap from #68250 and restart-retry policy were removed. Focused UI tests pass 58/58, Desktop typecheck passes, and an independent review approved the final recovery/session-switch behavior. Could you review when bandwidth permits? The stale area/auth label is no longer applicable.

[33hodl]

Repaired branch is now published at bcb972b5581604230f6421aa1e82844a7e48f359.

Final gates:

• independent review: APPROVE on the exact published head
• focused + neighboring regression tests: 121/121 passed
• Desktop typecheck: passed (UI, Electron, E2E)
• lint: 0 errors (21 existing warnings)
• git diff --check: passed
• changed-line secret scan: no matches
• dependency review: no manifest or lockfile changes
• original contributor commits/authorship preserved

The branch was rebased once onto NousResearch main at 683059feb54f511717c831e0989e0f3c54450785. Main advanced by 19 commits during final review; none touch this PR’s files and git merge-tree --write-tree origin/main HEAD is clean, so I did not churn the reviewed commits with another unnecessary force-rebase.

I could not create a formal reviewer request because GitHub returned 404 for this fork PR. @austinpickett, please review when available.

[33hodl]

Rebased onto current main and adapted to the newer shared resolver — new head 941403d80f.

• The recovery/drift guards are now implemented in withSessionNotFoundResume (shared by every caller), not just the submit path; the manual per-commit recovery code was removed in favor of current main's helper.
• sessionId rebinds on recovery so cleanup can't strand busy state or attach errors to a stale runtime.
• Validation: 169 focused tests pass (use-prompt-actions, use-fresh-session-requests, session), typecheck clean, ESLint has no new issues.
• The luxles co-author commit is preserved.

Ready for another pass.