Added a closely-related fix on the same branch (commit 0a8a311):

GET /api/agents/{id}/session now honors ?session_id= query param.

While testing /new I noticed the dashboard sessions dropdown appeared to do nothing — clicking any row showed an empty chat pane. Root cause: the frontend fetches history via /api/agents/{id}/session (singular) but never forwarded the URL-pinned sessionId, so the backend always returned whichever session the kernel thinks is canonical-active for that agent. After /new (and in general any time the canonical pointer drifts), that can be a different session than any row in the dropdown — so none of them appear to work.

• Backend (routes/agents.rs): get_agent_session accepts an optional session_id query param, validates session.agent_id == agent_id before returning (so one agent's id can't read another agent's history), and 400s on malformed UUIDs. Absent param preserves the original canonical-active behaviour.
• Frontend (api.ts, ChatPage.tsx): loadAgentSession(agentId, sessionId?) forwards the URL id; useChatMessages passes its sessionId argument through.

Verified end-to-end: GET /session?session_id=<X> returns exactly <X>'s messages; no param returns canonical-active as before. This was already implicit in the per-tab multi-session model from #2959 — the WS send path honors session_id, but the initial history load didn't. Now both do.

Added a third related fix on the same branch (commit 209a513):

Don't drop URL-pinned hand agents when showHandAgents is off.

Refreshing the dashboard on a hand-agent chat (?agentId=<hand>) would dump the user back to the default assistant. Root cause: agents is built from useAgents({ includeHands: showHandAgents }), and showHandAgents is a localStorage toggle that defaults off. When off, hand-spawned agents aren't in the list, the "clear missing selection" effect fires, and the auto-select effect picks the first running standalone agent.

Fix: before clearing selectedAgentId, flip showHandAgents on and let the refetch include hand agents. If the id is still unresolved after that, then clear. Side effect: landing on any hand-agent URL persists showHandAgents = "1" in localStorage, so hand agents stay visible in the picker — intended UX since the user clearly wanted one.

Review

Overview

Feature design is good: splitting /new (fresh session, new UUID, navigate) from /reset (wipe in place, same UUID), and letting GET /api/agents/{id}/session?session_id= pin a specific session per tab. The dashboard correctly syncs URL + sessions dropdown in one round-trip.

Blocking — scope creep

The diff silently bundles two unrelated changes not mentioned anywhere in the description:

1. Entire PR #3068 kernel-manifest fix is in this branch — manifest_helpers.rs + kernel/mod.rs (parse-order swap, four-name-form matching, name preservation, 7 unit tests). If #3068 merges first this becomes a redundant diff; if it merges after, whichever lands second will fight the other. Please rebase onto #3068's merged state.

2. MAX_HISTORY_MESSAGES: 40 → 400 (agent_loop.rs:79) — same 10× context-budget change I flagged on #3045 and #3068, and the comment above still lies about "40 gives roughly 7–10 turns". Needs its own PR with justification.

Backend

3. Silent empty session_id on /new (ws.rs:~L1130)

let sid = info
    .get("session_id")
    .and_then(|v| v.as_str())
    .unwrap_or_default()
    .to_string();

If create_agent_session ever returns a JSON shape without a session_id string, sid becomes "" and the frontend's truthy check silently drops the navigate — user sees "New session created." but the URL doesn't change. This is exactly the silent-failure class this PR is otherwise fighting. Either emit an explicit error, or tighten create_agent_session's return type to a concrete struct.

4. No test for the new cross-agent leak guard (agents.rs:~L1385)

if session.agent_id != agent_id {
    return (StatusCode::NOT_FOUND, ...);
}

Check is correct — without it, GET /api/agents/A/session?session_id=<B's session> would leak B's history. Please pin it with an integration test; security-sensitive logic shouldn't live without a regression.

5. Untyped query struct (agents.rs:~L1338)

Query(params): Query<HashMap<String, String>> works but a typed struct SessionQuery { session_id: Option<Uuid> } would give automatic UUID validation and cleaner 400s, and matches the rest of the API. Minor.

Dashboard

6. Silent override of showHandAgents preference (ChatPage.tsx:~L2018)

Auto-enabling the hand-agents toggle whenever the URL points at an agent not in the current list is a real UX win (avoids kicking users to the default agent on refresh of a hand-agent URL), but it overrides a user-set localStorage toggle without any signal. Please mention it in the description — it's behaviour change the Summary skips.

7. loadAgentSession 404 path — with session_id now validated server-side (404 for cross-agent, 400 for bad UUID), the .then(session => ...) in useChatMessages doesn't visibly handle those in the diff. Confirm the existing catch surfaces a readable toast rather than leaving setAgentLoading(loadId, true) set.

i18n

8. zh.json still says "重置会话" for cmd_new. Test plan flags this as "follow-up" but an unticketed follow-up tends to stay that way. Either fix here or link an issue.

SDKs

All four get a breaking signature change on get_agent_session. Two concrete worries:

9. Python None-handling

def get_agent_session(self, id: str, session_id: Any = None):
    return self._c._request("GET", f"/api/agents/{id}/session", None, query={"session_id": session_id})

Depending on _request's serialization, None may serialize as "None" or empty — backend's parse::<uuid::Uuid>() will then 400 every default call. Verify _request drops None values, or guard explicitly:

query = {"session_id": session_id} if session_id else None

Same concern for Rust SDK's Option<&str> threaded through &[("session_id", session_id)] — depends on do_req's handling.

10. Go SDK is a hard break — GetAgentSession(id) → GetAgentSession(id, query) with no default. If the SDKs are auto-generated from openapi.json, unavoidable, but callers need release-notes warning.

Test plan vs CLAUDE.md

Only manual dashboard clicks are listed. Project instructions require cargo test --workspace + cargo clippy --workspace --all-targets -- -D warnings. Please paste output. The new cross-agent leak guard + session-id parsing is net-new security-sensitive logic.

Requested changes

• Rebase to drop the fix(kernel): boot-time TOML drift detection now reaches hand agents #3068 manifest diff
• Drop MAX_HISTORY_MESSAGES: 40 → 400; open separately
• Explicit error from /new when session_id is missing from kernel response
• Integration test for cross-agent session-read rejection (404)
• Verify/fix Python + Rust SDK None-handling for session_id
• Update Chinese cmd_new string or link a tracking issue
• Document the showHandAgents auto-flip in the description
• Paste cargo test + cargo clippy results

Core feature design is good and the backend scoping check is the right move — once the scope is trimmed and the silent-failure cases are tightened, this is mergeable.

Thanks for the thorough review @houko — addressed everything in a force-push (2c4ada5c → 68b75a22):

Blocking

1. fix(kernel): boot-time TOML drift detection now reaches hand agents #3068 manifest diff dropped. Rebased onto upstream/main directly via cherry-pick of the three feature commits — the manifest_helpers.rs + kernel/mod.rs parse-order changes are no longer in this branch, so fix(kernel): boot-time TOML drift detection now reaches hand agents #3068 can land independently without conflict.
2. MAX_HISTORY_MESSAGES reverted to 40. Dropped the bump commit; the misleading "7–10 turns" comment is back to its original form. Will open separately with justification + updated tests.

Backend

3. Silent empty session_id on /new (commit ca9dffad): cmd_new now matches the session_id field explicitly and emits a typed error event if it's missing or empty, instead of returning a fake-success command_result with session_id: "".
4. Cross-agent guard test (commit 2b78d339): added test_get_agent_session_rejects_cross_agent_session_id. While writing it I discovered the guard had a fallthrough: get_session returns Ok(None) for unmaterialized sessions (fresh-spawned agent, no messages), and the handler used to fall back to the agent's canonical-active session — meaning GET /api/agents/A/session?session_id=<B's-session-uuid> would 200 with A's empty session under the requested id. Same commit tightens that branch: explicit session_id not matching this agent's canonical id → 404. Test covers cross-agent 404, malformed-UUID 400, and same-agent round-trip 200.
5. Typed query struct (commit 2b78d339): replaced Query<HashMap<String,String>> with GetAgentSessionQuery { session_id: Option<Uuid> }. Serde validates the UUID and returns 400 before the handler runs.

Dashboard

6. showHandAgents auto-flip documented in the updated PR body under "Behaviour changes".
7. loadAgentSession 404 path (commit 68b75a22): the .catch was a comment-only swallow; now forwards the error message to the existing onClearError toast channel. The .finally was already clearing setAgentLoading, so the spinner part of the concern wasn't actually present, but the silent empty-chat-on-stale-URL definitely was.

i18n

8. zh.json cmd_new (commit 68b75a22): now "新建会话（生成新会话 ID）". Fixed in this PR rather than punting.

SDKs

9. Python + Rust None-handling: verified — both helpers already filter None cleanly. Client._request (Python) line ~69: {k: v for k, v in query.items() if v is not None}. do_req (Rust) lines 46–49: filter_map(|(k, v)| v.map(|vv| (*k, vv))). Same for JS (_withQuery skips undefined/null) and Go (withQuery skips ""). Default None callers don't transmit the param.
10. Go SDK breaking signature: noted. Since SDKs are auto-generated from openapi.json, callers will see the change on the next regen anyway.

Tests

• cargo test -p librefang-api: 42 passed, 0 failed. Includes the new cross-agent integration test.
• cargo clippy --workspace --all-targets -- -D warnings: clean.
• cargo test --workspace: 1 failure — librefang-kernel::config::tests::test_load_config_defaults — host-env dependent (asserts config.log_level == "info" but load_config(None) falls back to ~/.librefang/config.toml); identical assertion on upstream/main so unrelated to this PR.

PR body updated to call out the two undocumented behaviour changes.