fix(session): bind broker state to peer ownership

[benvinegar]

Summary

• bind snapshots, heartbeats, disconnects, and command results to the originating broker peer
• reject duplicate live session ownership until signed reconnect proof is introduced in the next stack
• prevent queued or late producer work from crossing a socket reconnect
• add adversarial core, daemon, connection, and Hunk integration coverage

Validation

• bun test packages/session-broker-core/src/brokerState.test.ts packages/session-broker/src/broker.test.ts packages/session-broker/src/daemon.test.ts packages/session-broker/src/connection.test.ts src/session/broker/brokerServer.test.ts src/session/broker/browserReviewServer.integration.test.ts src/session/broker/reviewResources.integration.test.ts
• bun run typecheck
• bun run deps:check
• targeted oxfmt --check
• git diff --check

Stack

1. This PR: connection ownership
2. Signed authentication and authorization
3. Runtime validation
4. Bounds and backpressure
5. Hunk automatic credential integration

This PR description was generated by Pi using gpt-5.6-sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hunk-web	Ignored		Aug 29, 2026 2:34pm

[greptile-apps]

Greptile Summary

This PR binds broker mutations and command results to the WebSocket peer that owns each session, rejects competing live registrations, and prevents queued or late command work from crossing reconnects.

• Adds socket ownership checks for snapshots, heartbeats, disconnects, and command results.
• Makes registration outcomes explicit and rejects duplicate live session ownership.
• Associates client-side queued commands and responses with their originating transport.
• Adds adversarial state, daemon, connection, and integration coverage.

Confidence Score: 5/5

The PR appears safe to merge, with ownership enforcement consistently propagated through the broker core, daemon, client connection, and Hunk adapter.

The changed paths reject cross-peer state mutations and forged command results, preserve owner state after duplicate registration attempts, and prevent stale client work from migrating onto replacement sockets without leaving a demonstrated blocking failure.

Important Files Changed

Filename	Overview
packages/session-broker-core/src/brokerState.ts	Adds explicit peer ownership to registration, state mutation, pending-command resolution, and cleanup paths.
packages/session-broker/src/connection.ts	Pins queued commands and asynchronous results to their originating socket so work cannot cross reconnects.
packages/session-broker/src/daemon.ts	Enforces broker ownership outcomes at the protocol boundary and closes peers that assert unauthorized state or results.
src/session/broker/state.ts	Propagates socket identity through Hunk-specific snapshot handling while preserving mirror reconciliation.
src/session/broker/brokerServer.ts	Updates the Hunk controller adapter to pass connection ownership into mutations and command-result handling.

Sequence Diagram

sequenceDiagram
    participant Client as Session client
    participant Socket as Owning socket
    participant Broker as Broker state
    participant Caller as API caller
    Client->>Broker: register(sessionId, snapshot)
    Broker->>Broker: bind sessionId to Socket
    Client->>Broker: snapshot / heartbeat via Socket
    Broker->>Broker: verify Socket owns sessionId
    Caller->>Broker: dispatch command
    Broker->>Socket: command(requestId)
    Socket-->>Broker: command-result(requestId)
    Broker->>Broker: verify result came from originating Socket
    Broker-->>Caller: resolve result
    Socket--xBroker: disconnect
    Broker->>Broker: retire session and reject pending commands

Loading

_{Reviews (1): Last reviewed commit: "fix(session): bind broker state to peer ..." | Re-trigger Greptile}