fix(ui): remove scope=project from session list requests (NeuralNomadsAI#572)

## Problem

PR NeuralNomadsAI#565 (commit e29c3a0) added `scope=project` to session list requests
so worktree/project sessions remain visible. With OpenCode 1.17.x, the
`/session` endpoint can ignore the `directory` filter when
`scope=project` is present and return sessions from unrelated folders
that share the same project/global bucket.

This can make sessions appear in the wrong project tab. Deleting one of
those sessions still deletes it from the shared OpenCode database, so the
UI must avoid showing unrelated sessions in the wrong tab.

## Reproduction

```bash
PORT=4096

curl -s -u "codenomad:$PASSWORD" \
  "http://127.0.0.1:$PORT/session?directory=/home/user/project-a&scope=project" \
  | jq 'length'
# Can include sessions from other folders too.

curl -s -u "codenomad:$PASSWORD" \
  "http://127.0.0.1:$PORT/session?directory=/home/user/project-a" \
  | jq 'length'
# Filters to the requested folder, but may miss project/worktree sessions.

Related: anomalyco/opencode#33113

Fix
Keep scope: "project" so OpenCode still returns project/worktree
sessions, then filter the returned sessions client-side to the current
root directory plus known CodeNomad worktree directories.

This preserves the worktree-session visibility behavior from NeuralNomadsAI#565 while
avoiding unrelated cross-directory leakage when OpenCode ignores
directory alongside scope=project.

Validation
Focused session-pagination tests pass.
UI typecheck passes.
UI build passes.
Tauri release build passes.
Manual exe tested for validation.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Pascal André <pascalandr@gmail.com>

Author: 3 people

packages/ui/src/stores/session-api.ts

@@ -53,10 +53,17 @@ import { clearCacheForSession } from "../lib/global-cache"
 import { getLogger } from "../lib/logger"
 import { requestData } from "../lib/opencode-api"
 import { getRootClient } from "./opencode-client"
-import { getWorktreeSlugForSession, migrateLegacyWorktreeMapToSessionMetadata, pruneStaleLegacyWorktreeMapEntries, removeLegacyParentSessionMapping, setWorktreeSlugForParentSession } from "./worktrees"
+import {
+  getWorktreeSlugForSession,
+  getWorktrees,
+  migrateLegacyWorktreeMapToSessionMetadata,
+  pruneStaleLegacyWorktreeMapEntries,
+  removeLegacyParentSessionMapping,
+  setWorktreeSlugForParentSession,
+} from "./worktrees"
 import { getOpenCodeWorkspaceIdForSession } from "./opencode-workspaces"
 import { hydrateSessionMetadataWithClient } from "./session-metadata"
-import { PROJECT_SESSION_LIST_LIMIT, buildProjectSessionListOptions } from "./session-list-options"
+import { PROJECT_SESSION_LIST_LIMIT, buildProjectSessionListOptions, filterProjectScopedSessions } from "./session-list-options"
 
 const log = getLogger("api")
 
@@ -142,7 +149,11 @@ async function fetchV2Sessions(instanceId: string, options: V2SessionListOptions
   const client = getRootClient(instanceId)
   const listOptions = buildProjectSessionListOptions(options)
   const data = await requestData<SessionListResponse>(client.session.list(listOptions), "session.list")
-  return { data }
+  const allowedDirectories = [options.directory, ...getWorktrees(instanceId).map((worktree) => worktree.directory)]
+
+  return {
+    data: filterProjectScopedSessions(data, allowedDirectories),
+  }
 }
 
 function getV2SessionItems(response: ProjectSessionListResponse): SDKSession[] {

packages/ui/src/stores/session-list-options.ts

@@ -10,6 +10,21 @@ export type ProjectSessionListOptions = ProjectSessionListInput & {
   scope: "project"
 }
 
+type SessionDirectorySource = {
+  directory?: string | null
+}
+
+function normalizeSessionDirectory(directory: string | null | undefined): string {
+  const trimmed = directory?.trim()
+  if (!trimmed) return ""
+
+  const slashNormalized = trimmed.replace(/\\/g, "/").replace(/\/+$/, "")
+  const comparable = slashNormalized || "/"
+  const isWindowsPath = /^[A-Za-z]:\//.test(comparable) || comparable.startsWith("//") || trimmed.includes("\\")
+
+  return isWindowsPath ? comparable.toLowerCase() : comparable
+}
+
 export function buildProjectSessionListOptions(options: ProjectSessionListInput): ProjectSessionListOptions {
   return {
     ...(options.directory ? { directory: options.directory } : {}),
@@ -18,3 +33,16 @@ export function buildProjectSessionListOptions(options: ProjectSessionListInput)
     scope: "project",
   }
 }
+
+export function filterProjectScopedSessions<T extends SessionDirectorySource>(
+  sessions: T[],
+  allowedDirectories: Array<string | null | undefined>,
+): T[] {
+  const allowed = new Set(allowedDirectories.map(normalizeSessionDirectory).filter(Boolean))
+  if (allowed.size === 0) return sessions
+
+  return sessions.filter((session) => {
+    const directory = normalizeSessionDirectory(session.directory)
+    return !directory || allowed.has(directory)
+  })
+}

packages/ui/src/stores/session-pagination.test.ts

@@ -2,7 +2,7 @@ import assert from "node:assert/strict"
 import { describe, it } from "node:test"
 
 import { applySessionPage, getDefaultSessionPaginationState } from "./session-pagination-model.ts"
-import { PROJECT_SESSION_LIST_LIMIT, buildProjectSessionListOptions } from "./session-list-options.ts"
+import { PROJECT_SESSION_LIST_LIMIT, buildProjectSessionListOptions, filterProjectScopedSessions } from "./session-list-options.ts"
 
 describe("project session list loading", () => {
   it("builds a one-shot project-scoped request without pagination params", () => {
@@ -18,6 +18,35 @@ describe("project session list loading", () => {
     assert.equal("cursor" in options, false)
   })
 
+  it("filters project-scoped results to the root and known worktree directories", () => {
+    const sessions = [
+      { id: "root", directory: "/repo" },
+      { id: "worktree", directory: "/repo/.codenomad/worktrees/feature" },
+      { id: "sibling", directory: "/other" },
+      { id: "unknown" },
+    ]
+
+    assert.deepEqual(
+      filterProjectScopedSessions(sessions, ["/repo", "/repo/.codenomad/worktrees/feature"]).map((session) => session.id),
+      ["root", "worktree", "unknown"],
+    )
+  })
+
+  it("normalizes Windows paths when filtering project-scoped results", () => {
+    const sessions = [
+      { id: "root", directory: String.raw`C:\Repo` },
+      { id: "worktree", directory: "c:/repo/.codenomad/worktrees/feature/" },
+      { id: "other", directory: String.raw`C:\Other` },
+    ]
+
+    assert.deepEqual(
+      filterProjectScopedSessions(sessions, ["c:/repo/", String.raw`C:\Repo\.codenomad\worktrees\feature`]).map(
+        (session) => session.id,
+      ),
+      ["root", "worktree"],
+    )
+  })
+
   it("marks the loaded session list complete because the API does not paginate", () => {
     const state = applySessionPage(getDefaultSessionPaginationState(), ["root-1", "root-2"], false, true)