fix(web): drop SSE plan_update/approval_needed events without thread_id

[italic-jinxin]

Summary

• Plan checklists and approval cards from one conversation could leak into another conversation's chat view when the user switched threads, because two SSE handlers (plan_update, approval_needed) used short-circuit guards that treated missing thread_id as "applies to current view".
• Replaced both with strict isCurrentThread(data.thread_id) filtering — matching the convention every other thread-scoped handler in sse.js (response, stream_chunk, tool_started, …) already uses.
• Also guarded approval_needed's else branch on data.thread_id so a null value no longer pollutes the unreadThreads Map.

Root cause

PlanUpdateTool::execute at src/tools/builtin/plan.rs:143 emits:

thread_id: ctx.conversation_id.map(|id| id.to_string()),
When the tool runs in a context without a chat conversation (mission runner, routine engine, heartbeat-driven flows), ctx.conversation_id is None, so the SSE event arrives with thread_id: null.

The old frontend guard:

if (data.thread_id && !isCurrentThread(data.thread_id)) return;
short-circuits on the falsy thread_id and falls through to renderPlanChecklist(data), which renders into the currently-displayed conversation. Same shape on approval_needed via forCurrentThread = !hasThread || isCurrentThread(...).

The fix is at the correct boundary: isCurrentThread(null) === false per chat.js:1-5, so !isCurrentThread(data.thread_id) filters thread_id-less events out instead of routing them to the active view.

Change Type

• Bug fix
• New feature
• Refactor
• Documentation
• CI/Infrastructure
• Security
• Dependencies

Linked Issue

fixes #2833

Validation

• cargo fmt --all -- --check
• cargo clippy --all --benches --tests --examples --all-features -- -D warnings
• cargo build
• Relevant tests pass:
• cargo test --features integration if database-backed or integration behavior changed
• Manual testing:
• If a coding agent was used and supports it, review-pr or pr-shepherd --fix was run before requesting review

Security Impact

Database Impact

Blast Radius

Rollback Plan

Review Follow-Through

---

Review track:

[gemini-code-assist]

Code Review

This pull request refactors the Server-Sent Events (SSE) event listeners in sse.js to simplify conditional logic. The approval_needed listener was updated to remove redundant variables and clarify the handling of background thread updates, while the plan_update listener was streamlined by removing an unnecessary check for data.thread_id. I have no feedback to provide as there were no review comments to evaluate.