Skip to content

fix: preserve profile scope when deleting sessions - #652

Merged
pedronauck merged 2 commits into
compozy:mainfrom
richardfogaca:fix/session-delete-profile
Sep 16, 2026
Merged

pedronauck merged 2 commits into
compozy:mainfrom
richardfogaca:fix/session-delete-profile

Conversation

@richardfogaca

@richardfogaca richardfogaca commented Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

What & why

Fixes #651. Deleting a session owned by a non-default profile returned “Session not found” because Web omitted the profile and the API resolved the request to default.

Single and bulk deletion now carry the target session’s profile and workspace through confirmation, mutation, and cache reconciliation. The API contract declares the already-supported optional profile query; generated OpenAPI and Web types are included. Backend authorization remains unchanged. Successful deletion also refreshes global catalogs and attention counts without relying on the catalog stream. QA screenshots have distinct profile names, and the lifecycle E2E matcher checks the DELETE pathname and profile separately.

Implemented and validated by Richard’s agent; no human verification is claimed.

How you verified it

  • make gate under Node 22: code generation consistency, scoped Go lint/race tests, Web lint/typecheck/tests.
  • Production Web build through the root Turbo pipeline.
  • The host Node 25 run exposed unrelated Web test environment failures; the same failing suites passed unchanged under Node 22 (the release toolchain).
  • 150 focused adapter, mutation, and session-page control tests passed, including mixed-owner bulk targets.
  • Existing daemon-served browser suite: default and non-default profile deletion passed; selected active/stopped sessions disappear, the unselected neighbor survives, and a wrong-profile DELETE returns 404. Completion screenshots were inspected.

Follow-up validation: make gate passed under Node 22 (7,316 Web tests, lint/typecheck, codegen and scoped Go checks). Regression coverage verifies cache invalidation and leaves unrelated workspace catalogs untouched. The Web CI timeout came from matching a DELETE URL without its new profile query. The Desktop bootstrap-quit failure is separate: the identical base passed that job, but a targeted rerun was rejected with HTTP 403 (repository admin rights required). Its outcome remains unverified pending the next PR run. Vercel deployment requires team authorization.

Impact

Web deletion and its declared API query parameter. Existing HTTP/UDS behavior and profile authorization remain intact; no migration, configuration, hook, CLI, SDK implementation, or official skill syntax change. The affected QA scenario and cross-surface audit are updated. Other session lifecycle actions are outside this fix.

Risk is limited to deletion target propagation and reconciliation. Existing failure/retry and observer-suppression coverage is retained. Reverting this change restores the previous Web request behavior without changing stored data.


  • make gate passes locally; this PR is delivered only after its required CI checks are green — local gate passes; current-head CI remains pending and is not claimed green.
  • New or changed behavior is covered by tests, or I explained above why not
  • If an agent wrote or co-wrote this, I named it above and verified the result myself — agent validation is recorded above; human verification is not claimed.

Summary by CodeRabbit

  • Bug Fixes
    • Session deletion now uses the session’s own workspace and profile, ensuring requests target the correct context.
    • Bulk and individual deletion actions now consistently preserve session context.
    • Delete requests include the applicable profile information for accurate scoping.
    • Related workspace lists and attention summaries now refresh after successful deletion.

Copilot AI lite review requested due to automatic review settings September 16, 2026 11:55
@vercel

vercel Bot commented Sep 16, 2026

Copy link
Copy Markdown

@richardfogaca is attempting to deploy a commit to the Compozy Team on Vercel.

A member of the Team first needs to authorize it.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@coderabbitai

coderabbitai Bot commented Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 5c965f72-d004-404b-8317-07575cdcedab

📥 Commits

Reviewing files that changed from the base of the PR and between d72a3df and c82c390.

⛔ Files ignored due to path filters (4)
  • docs/_memory/change-impact.md is excluded by !**/*.md
  • docs/qa/scenarios/ET-web-session-list-bulk-actions.md is excluded by !**/*.md
  • web/e2e/__tests__/session-bulk-actions.spec.ts is excluded by !web/e2e/**
  • web/e2e/__tests__/session-hardening.spec.ts is excluded by !web/e2e/**
📒 Files selected for processing (4)
  • web/src/hooks/routes/use-session-page-controls.ts
  • web/src/systems/session/adapters/session-api.ts
  • web/src/systems/session/hooks/__tests__/use-session-actions.test.tsx
  • web/src/systems/session/hooks/use-session-actions.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • web/src/systems/session/adapters/session-api.ts
  • web/src/hooks/routes/use-session-page-controls.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.


Walkthrough

Session deletion now carries the session workspace and profile through the web mutation and DELETE request. The API specification adds profile selection. Lifecycle, route, adapter, and hook tests verify profile-scoped deletion and payload propagation.

Changes

Session deletion

Layer / File(s) Summary
Profile-scoped delete API
internal/api/spec/registry_sessions.go, web/src/systems/session/adapters/session-api.ts, web/src/systems/session/adapters/__tests__/session-api.test.ts
The delete operation uses profile-selected parameters. deleteSession requires profile and sends it as a query parameter. Adapter tests cover the profile-specific URL and error paths.
Session payload mutation
web/src/systems/session/hooks/use-session-actions.ts, web/src/systems/session/hooks/use-session-lifecycle-actions.ts, web/src/systems/session/hooks/__tests__/use-session-actions.test.tsx
Deletion receives session identity fields instead of only an ID. Workspace resolution uses the session workspace, and the mutation passes profile_name to deleteSession. Single and batch deletion paths pass full session objects. Related cache invalidation is tested.
Route deletion integration
web/src/hooks/routes/use-session-page-controls.ts, web/src/hooks/routes/__tests__/use-session-page-controls.test.tsx
Session page controls stop passing a separate workspace option and pass the full session object to the delete mutation. The success test verifies the new payload.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to c82c3

Profile-scoped session deletion is consistently propagated and reconciled across the reviewed paths, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 8 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The pull request meets the coding requirements in issue #651. deleteSession sends the target profile as a query parameter. useDeleteSession and lifecycle actions pass the target session, including…
Out of Scope Changes check ✅ Passed The changes stay within issue #651. The adapter, hook, lifecycle, test, and API specification changes support profile-aware session deletion and reconciliation. Generated contract updates support the …
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: preserving profile scope during session deletion.
  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Sep 16, 2026
@greptile-apps

greptile-apps Bot commented Sep 16, 2026 •

Copy link
Copy Markdown
Greptile Summary

Session deletion now keeps each session’s workspace and profile from confirmation through the final request. This fixes non-default profile deletions and refreshes the right catalogs after success.

  • Single and bulk deletes carry each target’s owner scope.
  • Successful deletes refresh workspace, global, and attention views.
  • API, generated types, and browser coverage now include profile scope.

Confidence Score: 5/5

The PR appears safe to merge. Deletion keeps the target profile and refreshes each affected session view.

No new issue remains. Both earlier threads were manually resolved without explanation, and the current changes address their reported cases.

Important Files Changed
Filename Overview
web/src/systems/session/hooks/use-session-actions.ts useDeleteSession now deletes with the target session's workspace and profile. Success refreshes owner, global, and attention queries.
web/src/systems/session/hooks/use-session-lifecycle-actions.ts Single and bulk delete flows now pass full session targets, so profile and workspace stay fixed through confirmation.
web/src/systems/session/adapters/session-api.ts deleteSession now sends the profile query declared by the generated API type.
internal/api/spec/registry_sessions.go The delete operation now declares the optional profile selector already supported by the API.
web/e2e/tests/session-bulk-actions.spec.ts The browser test covers default and non-default profiles. It also keeps each profile's screenshots separate.
Sequence Diagram
sequenceDiagram
    actor User
    participant Web
    participant API
    participant Store
    participant Cache
    User->>Web: Confirm session deletion
    Web->>Web: Read target workspace and profile
    Web->>Store: Pause live updates for session
    Web->>API: "DELETE /workspaces/{workspace}/sessions/{id}?profile={profile}"
    API-->>Web: 204 No Content
    Web->>Store: Remove session and resume live updates
    Web->>Cache: Remove detail and ID queries
    Web->>Cache: Refresh owner workspace lists
    Web->>Cache: Refresh global lists and attention count
    Web-->>User: Remove row and show success
Loading

Reviews (2): Last reviewed commit: "fix: reconcile session deletion views an..." | Re-trigger Greptile

Comment thread web/src/systems/session/hooks/use-session-actions.ts
Comment thread web/e2e/__tests__/session-bulk-actions.spec.ts Outdated
@pedronauck
pedronauck merged commit 7b64ab1 into compozy:main Sep 16, 2026
47 of 48 checks passed
@pedronauck pedronauck mentioned this pull request Sep 16, 2026
This was referenced Sep 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Web session deletion omits non-default profile and returns Session not found

3 participants