fix(tui): isolate /new sessions to prevent cross-client broadcast (#39217)

widingmarcus-cyber · widingmarcus-cyber · commit c7ddd8df0e8c · 2026-03-07T23:33:25.000+01:00
When multiple TUI clients connect to the same agent and one calls /new,
replies were being broadcast to all connected clients because they
shared the same session key.

This fix differentiates /new from /reset:
- /new: Creates a unique session key (tui-{uuid}) to isolate the client
- /reset: Resets the shared session (existing behavior preserved)

This ensures each TUI client using /new gets its own isolated session
context, preventing unintended message sharing between terminals.
diff --git a/src/tui/tui-command-handlers.test.ts b/src/tui/tui-command-handlers.test.ts
@@ -7,12 +7,14 @@ type SetActivityStatusMock = ReturnType<typeof vi.fn> & ((text: string) => void)
 function createHarness(params?: {
   sendChat?: ReturnType<typeof vi.fn>;
   resetSession?: ReturnType<typeof vi.fn>;
+  setSession?: ReturnType<typeof vi.fn>;
   loadHistory?: LoadHistoryMock;
   setActivityStatus?: SetActivityStatusMock;
   isConnected?: boolean;
 }) {
   const sendChat = params?.sendChat ?? vi.fn().mockResolvedValue({ runId: "r1" });
   const resetSession = params?.resetSession ?? vi.fn().mockResolvedValue({ ok: true });
+  const setSession = params?.setSession ?? vi.fn().mockResolvedValue(undefined);
   const addUser = vi.fn();
   const addSystem = vi.fn();
   const requestRender = vi.fn();
@@ -36,7 +38,7 @@ function createHarness(params?: {
     closeOverlay: vi.fn(),
     refreshSessionInfo: vi.fn(),
     loadHistory,
-    setSession: vi.fn(),
+    setSession,
     refreshAgents: vi.fn(),
     abortActive: vi.fn(),
     setActivityStatus,
@@ -51,6 +53,7 @@ function createHarness(params?: {
     handleCommand,
     sendChat,
     resetSession,
+    setSession,
     addUser,
     addSystem,
     requestRender,
@@ -104,16 +107,24 @@ describe("tui command handlers", () => {
     expect(requestRender).toHaveBeenCalled();
   });
 
-  it("passes reset reason when handling /new and /reset", async () => {
+  it("creates unique session for /new and resets shared session for /reset", async () => {
     const loadHistory = vi.fn().mockResolvedValue(undefined);
-    const { handleCommand, resetSession } = createHarness({ loadHistory });
+    const setSessionMock = vi.fn().mockResolvedValue(undefined);
+    const { handleCommand, resetSession } = createHarness({
+      loadHistory,
+      setSession: setSessionMock,
+    });
 
     await handleCommand("/new");
     await handleCommand("/reset");
 
-    expect(resetSession).toHaveBeenNthCalledWith(1, "agent:main:main", "new");
-    expect(resetSession).toHaveBeenNthCalledWith(2, "agent:main:main", "reset");
-    expect(loadHistory).toHaveBeenCalledTimes(2);
+    // /new creates a unique session key (isolates TUI client) (#39217)
+    expect(setSessionMock).toHaveBeenCalledTimes(1);
+    expect(setSessionMock).toHaveBeenCalledWith(expect.stringMatching(/^tui-[a-f0-9]{8}$/));
+    // /reset still resets the shared session
+    expect(resetSession).toHaveBeenCalledTimes(1);
+    expect(resetSession).toHaveBeenCalledWith("agent:main:main", "reset");
+    expect(loadHistory).toHaveBeenCalledTimes(1); // Only /reset loads history
   });
 
   it("reports send failures and marks activity status as error", async () => {
diff --git a/src/tui/tui-command-handlers.ts b/src/tui/tui-command-handlers.ts
@@ -423,6 +423,17 @@ export function createCommandHandlers(context: CommandHandlerContext) {
         }
         break;
       case "new":
+        try {
+          // Generate unique session key to isolate this TUI client (#39217)
+          // This ensures /new creates a fresh session that doesn't broadcast
+          // to other connected TUI clients sharing the original session key.
+          const uniqueKey = `tui-${randomUUID().slice(0, 8)}`;
+          await setSession(uniqueKey);
+          chatLog.addSystem(`new session: ${state.currentSessionKey}`);
+        } catch (err) {
+          chatLog.addSystem(`new session failed: ${String(err)}`);
+        }
+        break;
       case "reset":
         try {
           // Clear token counts immediately to avoid stale display (#1523)
