From 879f712cd0285f20a29e27b37a3b1aafaae9307d Mon Sep 17 00:00:00 2001
From: konsisumer <der@konsi.org>
Date: Sat, 25 Jul 2026 20:32:17 +0200
Subject: [PATCH] fix(desktop): preserve active profile gateway isolation

---
 apps/desktop/src/store/gateway.test.ts | 37 ++++++++++++++++++++++++++
 apps/desktop/src/store/gateway.ts      |  2 +-
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 apps/desktop/src/store/gateway.test.ts

diff --git a/apps/desktop/src/store/gateway.test.ts b/apps/desktop/src/store/gateway.test.ts
new file mode 100644
index 000000000000..fb91d5abf0a8
--- /dev/null
+++ b/apps/desktop/src/store/gateway.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import type { HermesGateway } from '@/hermes'
+
+import {
+  $gateway,
+  activeGateway,
+  closeSecondaryGateways,
+  ensureGatewayForProfile,
+  setPrimaryGateway
+} from './gateway'
+
+describe('activeGateway profile isolation', () => {
+  beforeEach(async () => {
+    closeSecondaryGateways()
+    setPrimaryGateway(null)
+    await ensureGatewayForProfile('default')
+  })
+
+  afterEach(async () => {
+    closeSecondaryGateways()
+    setPrimaryGateway(null)
+    await ensureGatewayForProfile('default')
+  })
+
+  it('does not substitute a newly-primary gateway for the previously active profile', () => {
+    const primary = { connectionState: 'open' } as HermesGateway
+
+    // The primary backend can be re-homed while the store still has the
+    // previous profile as active. Until that profile's own socket is active,
+    // callers must see no gateway rather than send to the new primary.
+    setPrimaryGateway(primary, 'work')
+
+    expect(activeGateway()).toBeNull()
+    expect($gateway.get()).toBeNull()
+  })
+})
diff --git a/apps/desktop/src/store/gateway.ts b/apps/desktop/src/store/gateway.ts
index 61b6f46abcc7..4de0d8ff5853 100644
--- a/apps/desktop/src/store/gateway.ts
+++ b/apps/desktop/src/store/gateway.ts
@@ -128,7 +128,7 @@ export function activeGateway(): HermesGateway | null {
     return g.primaryGateway
   }
 
-  return g.secondaries.get(g.activeKey)?.gateway ?? g.primaryGateway
+  return g.secondaries.get(g.activeKey)?.gateway ?? null
 }
 
 // Mirror a backend's connection state into the global composer state, but only