fix(console): freeze session identity for chat sends

[zhijianma]

Description

Fix Console session-identity races that could route a queued message or a stop/cancel action to a different conversation when users switch sessions, pages, agents, or browser tabs while another turn is running.

The root cause was that request identity was reconstructed at send time from mutable shared state (window.currentSessionId, lastActiveChatId, and the current session list). A late session load, agent switch, queue drain, or another tab could overwrite that state between enqueue and submission.

This PR:

• captures an immutable { agent_id, chat_id, sdk_session_id, session_id, user_id, channel } snapshot in biz_params for every submission and queued item;
• removes the mutable window.currentSessionId/currentUserId/currentChannel identity globals;
• resolves send, reconnect, project-directory, stop, and approval-cancel behavior from the explicit request or route identity;
• rejects stale session work through the existing agent ownership epoch instead of allowing a late callback to mutate the active view;
• keeps queues durable across local-session-to-backend-UUID resolution instead of dropping them;
• scopes blank-chat queues as new:${agentId}, so one agent cannot migrate another agent's pending messages;
• coordinates same-conversation tabs with Web Locks while keeping different agents and sessions independent;
• versions the persisted queue schema and safely removes unsupported legacy queue entries;
• preserves a PawApp dialogue only when the fallback session belongs to that PawApp namespace.

Issues

Closes #7231

Closes #7011

Closes #3254

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactoring

Component(s) Affected

• Core / Backend (app, agents, config, providers, utils, local_models)
• Console (frontend web UI)
• Channels (DingTalk, Lark, QQ, Discord, iMessage, etc.)
• Skills
• CLI
• Documentation (website)
• Tests
• CI/CD
• Scripts / Deploy

Security Considerations

No authentication or authorization contract changes. The change strengthens identity isolation by preventing queued requests from combining one agent's identity with another session and by refusing to expose a host/PawApp session outside the active PawApp namespace.

Testing

Focused regression coverage includes:

• immutable submission identity and rebinding after local session creation;
• queue persistence and local-ID-to-backend-UUID migration;
• new:${agentId} isolation across agents;
• unsupported persisted queue cleanup;
• cross-tab ownership/send locking;
• stale agent/session ownership callbacks;
• PawApp current-dialogue fallback and namespace rejection.

Checklist

• I ran pre-commit run --all-files locally and it passes
• If pre-commit auto-fixed files, I committed those changes and reran checks
• I ran tests locally (pytest or as relevant) and they pass
• Documentation updated (not needed; behavior-only fix)
• Ready for review

Evidence

$ npm run test:run -- src/stores/messageQueueStore.test.ts src/plugins/hostSdk/hooks.test.ts src/plugins/pawapp-sdk/scoping.test.tsx src/pages/Chat/submissionBizParams.test.ts

Test Files  4 passed (4)
Tests       76 passed (76)

$ npx tsc -b --noEmit
# exited successfully

$ npm run build
✓ built in 57.19s
[verify-monaco-css] OK - Monaco stylesheet present in 81 CSS file(s).
Precompressed 363 Console assets.
Initial bundle: 9.32 MiB raw, 2.36 MiB Brotli across 8 assets.

The build reports the repository's existing dynamic-import and large-chunk warnings; all build verification steps pass.

Additional Notes

Legacy persisted queue entries are intentionally discarded rather than migrated because the old records do not contain the immutable bizParams identity required for a safe retry.

[github-actions]

Welcome to QwenPaw! 🐾

Hi @zhijianma, this is your 198th Pull Request.

🙌 Join Developer Community

Thanks so much for your contribution! We'd love to invite you to join the official QwenPaw developer group! You can find the Discord and DingTalk group links under the "Developer Community" section on our docs page:
https://qwenpaw.agentscope.io/docs/community

We truly appreciate your enthusiasm—and look forward to your future contributions! 😊

We'll review your PR soon.

[zhijianma]

Follow-up 3eae6997 removes the last bundled consumer of window.currentSessionId: CloudPaw now uses window.QwenPaw.host.getCurrentSessionId() and its committed UI bundle has been rebuilt. A repository-wide scan now finds no references to window.currentSessionId, window.currentUserId, or window.currentChannel.