fix(#99): gate tool and clarify events by session id to prevent leaks (#168)

app/src/main/java/com/m57/hermescontrol/data/ws/EventParser.kt

@@ -71,12 +71,12 @@ object EventParser {
 
             "tool.start" -> {
                 val name = payload?.get("name") as? String
-                WsEvent.ToolStart(name, payload)
+                WsEvent.ToolStart(name, payload, sessionId)
             }
 
             "tool.complete" -> {
                 val name = payload?.get("name") as? String
-                WsEvent.ToolComplete(name, payload)
+                WsEvent.ToolComplete(name, payload, sessionId)
             }
 
             "clarify.request" -> {
@@ -86,7 +86,7 @@ object EventParser {
 
                 @Suppress("UNCHECKED_CAST")
                 val options = (rawOptions as? List<*>)?.filterIsInstance<String>()
-                WsEvent.ClarifyRequest(text, options, clarifyId)
+                WsEvent.ClarifyRequest(text, options, clarifyId, sessionId)
             }
 
             "status.update" -> {

app/src/main/java/com/m57/hermescontrol/data/ws/WsEvent.kt

@@ -44,11 +44,13 @@ sealed class WsEvent {
     data class ToolStart(
         val name: String?,
         val data: Map<String, Any?>?,
+        val sessionId: String? = null,
     ) : WsEvent()
 
     data class ToolComplete(
         val name: String?,
         val data: Map<String, Any?>?,
+        val sessionId: String? = null,
     ) : WsEvent()
 
     // ── Interactive ──────────────────────────────────────────────────────
@@ -57,6 +59,7 @@ sealed class WsEvent {
         val text: String?,
         val options: List<String>?,
         val clarifyId: String? = null,
+        val sessionId: String? = null,
     ) : WsEvent()
 
     // ── Status ───────────────────────────────────────────────────────────

app/src/main/java/com/m57/hermescontrol/ui/chat/ChatViewModel.kt

@@ -160,6 +160,7 @@ class ChatViewModel(
             is WsEvent.ToolComplete -> handleToolComplete(event)
 
             is WsEvent.ClarifyRequest -> {
+                if (!isCurrentSession(event.sessionId)) return
                 _uiState.update {
                     it.copy(
                         clarifyRequest =
@@ -369,6 +370,7 @@ class ChatViewModel(
     // ── Tool events ──────────────────────────────────────────────────────
 
     private fun handleToolStart(event: WsEvent.ToolStart) {
+        if (!isCurrentSession(event.sessionId)) return
         var orphanToPersist: ChatMessage? = null
         val sessionId = _uiState.value.currentSessionId
 
@@ -409,6 +411,7 @@ class ChatViewModel(
     }
 
     private fun handleToolComplete(event: WsEvent.ToolComplete) {
+        if (!isCurrentSession(event.sessionId)) return
         var completedTool: ChatMessage? = null
 
         _uiState.update { state ->