fix(web): scope Composer drafts to Sessions

[627150795]

Problem

Web Composer drafts can cross Session/workspace boundaries, manual New Session creation can discard an unsent workspace draft, and rapid Enter presses can replace the identity of a pending prompt admission. These failures can show or resend text in the wrong context. Fixes #457.

Value

Drafts stay scoped to the selected workspace and Session, unsent text survives manual New Session creation, and a pending admission cannot be replaced by a duplicate UI send. Failed sends remain editable.

Approach

• Use the selected Session path only when the canonical selected Session belongs to the selected workspace; otherwise use the new:${selectedWorkspace} scope.
• Transfer an unsent draft across the same-workspace manual New Session transition and the confirmed created Session, while still clearing drafts when switching to another workspace.
• Ignore a second Composer send while the first submission is pending.
• Add focused regressions plus a real-browser delayed-network admission path.

Validation

• bunx vitest run tests/web/app-render.spec.ts — 22 passed.
• bun run check — passed.
• bun run test:web:e2e — 11 passed, including real Chromium with a delayed /api/prompt response and rapid double-Enter input.
• git diff --check — passed.
• bun run test — this Windows runner reported unrelated background-terminal process-control failures and did not exit cleanly; the preceding suite reported 1,359 passed and 9 skipped before that suite.

Impact

• User-visible behavior: drafts remain in the intended workspace/Session and duplicate pending sends are ignored.
• Model-visible context/tools: None.
• Runtime/lifecycle: None.
• Persisted config/data: None; drafts remain in memory.
• Compatibility/risk: limited to the Web Composer draft and send lifecycle.

[tt-a1i]

Reviewed at exact head 180892f.

Standards

[P1] Draft ownership prefers selectedPath whenever it is non-null, but setWorkspace() enables a workspace draft without clearing the previous Session path. Switching from Session A to a new draft in workspace B therefore keeps A’s scope and unsent text visible in B, where it can be submitted to the wrong repository. Draft mode must prefer new:${selectedWorkspace} or the store must atomically clear selectedPath; add an active-A → workspace-B regression.

Spec

[P1] Manual new-Session creation loses an unsent workspace draft. Transfer is allowed only when pendingSubmission exists; if the user types a workspace draft and clicks New Session before submitting, the path changes and the normal scope-change effect clears the draft. Add explicit transfer semantics and a manual-creation test.

[P2] A second Enter while admission is pending replaces pendingSubmission.current before the store rejects the duplicate. When the original send succeeds, its identity no longer matches and the already-sent text remains available for accidental resend. Guard the UI send path while pending or preserve the original pending identity, with a rapid double-Enter test.

Focused tests and bundle parity pass, but the requested real-browser delayed-network path is not covered.

[627150795]

Addressed the review findings in e6f6a55:

• Composer now ignores a stale selectedPath when the canonical selected Session belongs to another workspace, so an active Session A draft is cleared when entering workspace B draft mode.
• Unsubmitted text transfers across same-workspace manual New Session creation and remains available after the created Session is confirmed.
• Composer ignores rapid duplicate sends while the first admission is pending.
• Added regressions for all three cases and covered the delayed-network path in the existing Playwright suite (150 ms delayed /api/prompt, real Chromium, rapid double Enter).

Validation after rebasing onto 5bf2fe2:

• bunx vitest run tests/web/app-render.spec.ts — 22 passed
• bun run check — passed
• bun run test:web:e2e — 11 passed
• git diff --check — passed

The full test command remains non-clean on this Windows runner because unrelated background-terminal process-control tests fail and do not exit cleanly; the preceding suite reported 1,359 passed and 9 skipped.

[tt-a1i]

Reviewed 815f6ba after current-main integration. Standards: no remaining actionable blocker identified. Spec: Draft ownership now checks Session/workspace identity, manual creation preserves its draft, and pending submission identity prevents stale clearing. The old findings are fixed. No P0/P1 found. This supersedes findings against older implementations where stated; merge remains conditional on current required CI and branch protection.

[tt-a1i]

最新 main 集成修复已完成，重新生成 Web 产物。双线复审保留既有侧栏焦点行为和本 PR 功能。 bun run check 已通过；完整测试已执行或正在串行验证，本机部分测试存在资源竞争超时，最终状态以最新 CI 为准。未发现 P0/P1。此账户推送了修复，仍需另一位维护者满足最后一次推送后的独立批准。