@opengeni/react 0.15.0 → 0.20.0

package/src/hooks/use-sandbox-git.ts

@@ -4,7 +4,7 @@ import type {
   WorkspaceCaptureManifest,
   WorkspaceCaptureRepo,
 } from "@opengeni/sdk";
-import { useCallback, useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useOpenGeni, type ClientOverride } from "../provider";
 
 export type UseSandboxGitOptions = ClientOverride & {
@@ -13,6 +13,9 @@ export type UseSandboxGitOptions = ClientOverride & {
   events?: SessionEvent[] | undefined;
   /** Repo root within the workspace (multi-repo). Default: workspace root. */
   repoPath?: string | undefined;
+  /** All repository roots in the workspace. When supplied, status and diff are
+   *  aggregated into one workspace-wide result and paths are workspace-relative. */
+  repoPaths?: readonly string[] | undefined;
   /** Diff the staged index vs HEAD (`--cached`) instead of the working tree. */
   staged?: boolean | undefined;
   /** Hold off the initial fetch. Default true. */
@@ -20,20 +23,29 @@ export type UseSandboxGitOptions = ClientOverride & {
   /** Lease liveness ("warm" | "draining" | "cold"). When NOT warm, the diff is
    *  served from the capture (cold/offline) instead of a live `gitDiff` RPC. */
   liveness?: string | undefined;
-  /** The latest turn-end capture (from `useWorkspaceCapture`). Supplies the cold
-   *  diff for this repo. A warm box always wins (live `gitDiff` unchanged). */
+  /** The latest turn-end capture (from `useWorkspaceCapture`). Seeds the diff
+   *  immediately; a warm box reconciles live and leaves this durable review
+   *  surface in place if the live request is temporarily unavailable. */
   capture?: WorkspaceCaptureManifest | null | undefined;
 };
 
+/** A Git diff qualified into workspace scope. `repoRoot` is present for the
+ *  workspace-wide path and lets review UI group real repositories without
+ *  guessing from the first path segment. */
+export type SandboxGitFileDiff = GitFileDiff & { repoRoot?: string | undefined };
+
 export type UseSandboxGitResult = {
   /** Working-tree (or staged) diff vs HEAD — the structured hunks the Pierre
    *  diff view renders. */
-  diff: GitFileDiff[];
+  diff: SandboxGitFileDiff[];
   branch: string | null;
   /** Whether a repo is actually mounted (drives "no repository" vs "no changes"). */
   isRepo: boolean;
   ahead: number;
   behind: number;
+  /** Number and workspace-relative roots of repositories represented here. */
+  repoCount: number;
+  repoRoots: string[];
   refresh: () => Promise<void>;
   /** Which source the diff is served from: the live box or the turn-end capture. */
   source: "live" | "capture" | null;
@@ -45,7 +57,30 @@ export type UseSandboxGitResult = {
 
 /** Normalize a repo root for matching ("" and "." both mean the workspace root). */
 function normalizeRoot(root: string): string {
-  return root === "." ? "" : root;
+  const normalized = root
+    .replaceAll("\\", "/")
+    .replace(/^\.\/+/, "")
+    .replace(/\/+$/, "");
+  return normalized === "." ? "" : normalized;
+}
+
+function qualifyPath(repoRoot: string, path: string): string {
+  const root = normalizeRoot(repoRoot);
+  return root ? `${root}/${path}` : path;
+}
+
+function qualifyDiff(repoRoot: string, file: GitFileDiff): SandboxGitFileDiff {
+  const root = normalizeRoot(repoRoot);
+  return {
+    ...file,
+    path: qualifyPath(root, file.path),
+    oldPath: file.oldPath === null ? null : qualifyPath(root, file.oldPath),
+    repoRoot: root,
+  };
+}
+
+function uniqueRoots(roots: readonly string[]): string[] {
+  return [...new Set(roots.map(normalizeRoot))].sort((a, b) => a.localeCompare(b));
 }
 
 /** Find the capture repo matching `repoPath` (default workspace root). */
@@ -64,10 +99,11 @@ function repoForPath(
 
 /** Full diff equality for identity preservation. Hunk count/count summaries are
  *  not sufficient: an edit can replace text without changing either shape. */
-function sameFileDiff(a: GitFileDiff, b: GitFileDiff): boolean {
+function sameFileDiff(a: SandboxGitFileDiff, b: SandboxGitFileDiff): boolean {
   if (
     a.path !== b.path ||
     a.oldPath !== b.oldPath ||
+    a.repoRoot !== b.repoRoot ||
     a.status !== b.status ||
     a.isBinary !== b.isBinary ||
     a.isImage !== b.isImage ||
@@ -106,7 +142,10 @@ function sameFileDiff(a: GitFileDiff, b: GitFileDiff): boolean {
 /** Merge a freshly-served diff over the current one, preserving the identity of
  *  genuinely unchanged per-file entries so a cold→warm reconcile does NOT
  *  remount unchanged file sections — no-flicker (§12-D1). */
-function mergeDiffs(current: GitFileDiff[], next: GitFileDiff[]): GitFileDiff[] {
+function mergeDiffs(
+  current: SandboxGitFileDiff[],
+  next: SandboxGitFileDiff[],
+): SandboxGitFileDiff[] {
   if (current.length === 0) return next;
   const byPath = new Map(current.map((d) => [d.path, d] as const));
   let changed = current.length !== next.length;
@@ -127,7 +166,7 @@ function mergeDiffs(current: GitFileDiff[], next: GitFileDiff[]): GitFileDiff[]
  * `GitFileDiff[]` (per-file hunks with per-line old/new numbers, rename
  * detection, binary flag, add/del counts) plus branch + ahead/behind. When the
  * box is warm the `git diff` runs in-box (API-direct); when it is cold/offline the
- * diff is served from the turn-end capture instead (dossier §10.4). Refreshes on
+ * diff is served from the turn-end capture instead. Refreshes on
  * `git.changed`; reconciles live in place on the cold→warm transition.
  */
 export function useSandboxGit(
@@ -137,76 +176,141 @@ export function useSandboxGit(
   const { client, workspaceId } = useOpenGeni(options);
   const enabled = (options.enabled ?? true) && Boolean(sessionId);
   const repoPath = options.repoPath ?? "";
+  const workspaceWide = options.repoPaths !== undefined;
+  // Serialize the caller's array so inline values do not retrigger effects. An
+  // explicitly empty advertised list falls back to the legacy repoPath probe.
+  const repoPathsKey = uniqueRoots(
+    options.repoPaths && options.repoPaths.length > 0 ? options.repoPaths : [repoPath],
+  ).join("\u0000");
+  const repoPaths = useMemo(() => repoPathsKey.split("\u0000"), [repoPathsKey]);
   const staged = options.staged ?? false;
   const capture = options.capture ?? null;
   const isLive = options.liveness === "warm" || options.liveness === "draining";
+  const identityKey = `${workspaceId}\u0000${sessionId ?? ""}\u0000${repoPathsKey}\u0000${workspaceWide}\u0000${staged}`;
 
-  const [diff, setDiff] = useState<GitFileDiff[]>([]);
+  const [diff, setDiff] = useState<SandboxGitFileDiff[]>([]);
   const [branch, setBranch] = useState<string | null>(null);
   const [isRepo, setIsRepo] = useState(false);
   const [ahead, setAhead] = useState(0);
   const [behind, setBehind] = useState(0);
+  const [repoRoots, setRepoRoots] = useState<string[]>([]);
   const [source, setSource] = useState<"live" | "capture" | null>(null);
+  const sourceRef = useRef<"live" | "capture" | null>(null);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<Error | null>(null);
+  const [stateIdentity, setStateIdentity] = useState(identityKey);
   // Live requests and event cursors are identity-scoped. The refs deliberately
   // survive renders, so they must be fenced/reset when that identity changes.
   const refreshGenerationRef = useRef(0);
+  const refreshAbortRef = useRef<AbortController | null>(null);
   const lastChangeRef = useRef(0);
 
   const refresh = useCallback(async () => {
     if (!sessionId) return;
+    refreshAbortRef.current?.abort();
+    const refreshAbort = new AbortController();
+    refreshAbortRef.current = refreshAbort;
     const generation = (refreshGenerationRef.current += 1);
     setLoading(true);
     setError(null);
     try {
-      const status = await client.gitStatus(workspaceId, sessionId, { path: repoPath });
+      const statuses = await Promise.all(
+        repoPaths.map(async (root) => ({
+          root,
+          status: await client.gitStatus(
+            workspaceId,
+            sessionId,
+            { path: root },
+            { signal: refreshAbort.signal },
+          ),
+        })),
+      );
       if (refreshGenerationRef.current !== generation) return;
-      setIsRepo(status.isRepo);
-      setBranch(status.head);
-      setAhead(status.ahead);
-      setBehind(status.behind);
-      if (!status.isRepo) {
+      const repositories = statuses.filter(({ status }) => status.isRepo);
+      const roots = repositories.map(({ root }) => root);
+      setRepoRoots(roots);
+      setIsRepo(repositories.length > 0);
+      setBranch(repositories.length === 1 ? (repositories[0]?.status.head ?? null) : null);
+      setAhead(repositories.reduce((sum, { status }) => sum + status.ahead, 0));
+      setBehind(repositories.reduce((sum, { status }) => sum + status.behind, 0));
+      if (repositories.length === 0) {
         setDiff([]);
+        sourceRef.current = "live";
         setSource("live");
         return;
       }
-      const result = await client.gitDiff(workspaceId, sessionId, { path: repoPath, staged });
+      const results = await Promise.all(
+        repositories.map(async ({ root }) => ({
+          root,
+          result: await client.gitDiff(
+            workspaceId,
+            sessionId,
+            {
+              path: root,
+              staged,
+              includeUntracked: !staged,
+            },
+            { signal: refreshAbort.signal },
+          ),
+        })),
+      );
       if (refreshGenerationRef.current !== generation) return;
       // Merge in place so the cold→warm swap keeps unchanged file sections mounted.
-      setDiff((prev) => mergeDiffs(prev, result.files));
+      setDiff((prev) =>
+        mergeDiffs(
+          prev,
+          results.flatMap(({ root, result }) =>
+            workspaceWide ? result.files.map((file) => qualifyDiff(root, file)) : result.files,
+          ),
+        ),
+      );
+      sourceRef.current = "live";
       setSource("live");
     } catch (cause) {
       if (refreshGenerationRef.current !== generation) return;
       setError(cause instanceof Error ? cause : new Error(String(cause)));
     } finally {
       if (refreshGenerationRef.current === generation) setLoading(false);
+      if (refreshAbortRef.current === refreshAbort) refreshAbortRef.current = null;
     }
-  }, [client, workspaceId, sessionId, repoPath, staged]);
+  }, [client, workspaceId, sessionId, repoPaths, staged, workspaceWide]);
 
   // Serve the diff from a capture (the cold/offline source). `staged` has no
   // meaning here: the capture records the combined turn-end change surface vs HEAD.
   const seedFromCapture = useCallback(
     (manifest: WorkspaceCaptureManifest) => {
-      const repo = repoForPath(manifest, repoPath);
-      if (!repo) {
+      const repositories = workspaceWide
+        ? manifest.repos
+        : ([repoForPath(manifest, repoPath)].filter(Boolean) as WorkspaceCaptureRepo[]);
+      if (repositories.length === 0) {
         setIsRepo(false);
         setBranch(null);
         setAhead(0);
         setBehind(0);
+        setRepoRoots([]);
         setDiff((prev) => (prev.length === 0 ? prev : []));
+        sourceRef.current = "capture";
         setSource("capture");
         return;
       }
       setIsRepo(true);
-      setBranch(repo.head);
-      setAhead(repo.ahead);
-      setBehind(repo.behind);
-      setDiff((prev) => mergeDiffs(prev, repo.diff));
+      setBranch(repositories.length === 1 ? (repositories[0]?.head ?? null) : null);
+      setAhead(repositories.reduce((sum, repo) => sum + repo.ahead, 0));
+      setBehind(repositories.reduce((sum, repo) => sum + repo.behind, 0));
+      setRepoRoots(repositories.map((repo) => normalizeRoot(repo.root)));
+      setDiff((prev) =>
+        mergeDiffs(
+          prev,
+          repositories.flatMap((repo) =>
+            workspaceWide ? repo.diff.map((file) => qualifyDiff(repo.root, file)) : repo.diff,
+          ),
+        ),
+      );
+      sourceRef.current = "capture";
       setSource("capture");
       setError(null);
     },
-    [repoPath],
+    [repoPath, workspaceWide],
   );
 
   // Source selection on mount / liveness / capture-revision change. Key on the
@@ -215,21 +319,25 @@ export function useSandboxGit(
   const captureRef = useRef<WorkspaceCaptureManifest | null>(capture);
   captureRef.current = capture;
   const captureRevision = capture?.revision ?? null;
-  const identityKey = `${workspaceId}\u0000${sessionId ?? ""}\u0000${repoPath}\u0000${staged}`;
   const previousIdentityRef = useRef(identityKey);
   useEffect(() => {
     // A liveness/capture source change supersedes any older live request. Only a
     // true data-identity change clears rendered state and the event high-water mark.
+    refreshAbortRef.current?.abort();
+    refreshAbortRef.current = null;
     refreshGenerationRef.current += 1;
     const identityChanged = previousIdentityRef.current !== identityKey;
     previousIdentityRef.current = identityKey;
     if (identityChanged || !enabled) {
       lastChangeRef.current = 0;
       setDiff([]);
+      setStateIdentity(identityKey);
       setIsRepo(false);
       setBranch(null);
       setAhead(0);
       setBehind(0);
+      setRepoRoots([]);
+      sourceRef.current = null;
       setSource(null);
       setLoading(false);
       setError(null);
@@ -237,14 +345,16 @@ export function useSandboxGit(
     if (!enabled) {
       return;
     }
-    if (isLive) {
-      void refresh();
-    } else if (captureRevision !== null && captureRef.current) {
-      seedFromCapture(captureRef.current);
-    } else {
+    const currentCapture = captureRevision !== null ? captureRef.current : null;
+    if (currentCapture && (identityChanged || !isLive || sourceRef.current !== "live")) {
+      seedFromCapture(currentCapture);
+    }
+    if (isLive || !currentCapture) {
       void refresh();
     }
     return () => {
+      refreshAbortRef.current?.abort();
+      refreshAbortRef.current = null;
       refreshGenerationRef.current += 1;
     };
   }, [enabled, isLive, captureRevision, identityKey, refresh, seedFromCapture]);
@@ -267,16 +377,20 @@ export function useSandboxGit(
     }
   }, [enabled, events, refresh]);
 
+  const identityMatches = enabled && stateIdentity === identityKey;
+  const visibleRepoRoots = identityMatches ? repoRoots : [];
   return {
-    diff,
-    branch,
-    isRepo,
-    ahead,
-    behind,
+    diff: identityMatches ? diff : [],
+    branch: identityMatches ? branch : null,
+    isRepo: identityMatches && isRepo,
+    ahead: identityMatches ? ahead : 0,
+    behind: identityMatches ? behind : 0,
+    repoCount: visibleRepoRoots.length,
+    repoRoots: visibleRepoRoots,
     refresh,
-    source,
-    capturedAt: source === "capture" ? (capture?.capturedAt ?? null) : null,
-    loading,
-    error,
+    source: identityMatches ? source : null,
+    capturedAt: identityMatches && source === "capture" ? (capture?.capturedAt ?? null) : null,
+    loading: identityMatches && loading,
+    error: identityMatches ? error : null,
   };
 }

package/src/hooks/use-sandbox-terminal.ts

@@ -82,12 +82,24 @@ export function useSandboxTerminal(
   // is live before the `terminal.pty.started` event round-trips through SSE.
   const ptyFilter = options.ptyId;
   const liveness = options.liveness;
+  const identityKey = `${workspaceId}\u0000${sessionId ?? ""}\u0000${interactive}\u0000${ptyFilter ?? ""}`;
   const [openedPtyId, setOpenedPtyId] = useState<string | null>(null);
   const [openError, setOpenError] = useState<Error | null>(null);
+  const [stateIdentity, setStateIdentity] = useState(identityKey);
   // Bumped to force a fresh PTY open after a write reveals the old PTY was lost
   // (a 409 "pty session lost" — the box rolled over since the open). This makes
   // the interactive terminal self-heal instead of dead-ending on a stale session.
   const [reopenNonce, setReopenNonce] = useState(0);
+  const currentIdentityRef = useRef(identityKey);
+  currentIdentityRef.current = identityKey;
+
+  // Async PTY state belongs to one workspace/session/mode identity. Hide it
+  // synchronously on the switching render, then clear it durably in the effect.
+  useEffect(() => {
+    setStateIdentity(identityKey);
+    setOpenedPtyId(null);
+    setOpenError(null);
+  }, [identityKey]);
 
   // Open ONE interactive PTY against the box, close it on unmount/identity
   // change. The open's banner + subsequent output deltas ride A1, so xterm fills
@@ -99,8 +111,12 @@ export function useSandboxTerminal(
   const openInFlight = useRef(false);
   const boxWarm = liveness === undefined || liveness === "warm" || liveness === "draining";
   useEffect(() => {
-    if (!interactive || !sessionId || ptyFilter || !boxWarm) return;
+    if (!interactive || !sessionId || ptyFilter || !boxWarm) {
+      setOpenError(null);
+      return;
+    }
     let cancelled = false;
+    setOpenError(null);
     openInFlight.current = true;
     let openedId: string | null = null;
     void client
@@ -138,6 +154,9 @@ export function useSandboxTerminal(
     let lastSupportsInput = false;
 
     for (const event of options.events) {
+      // The hook is session-scoped even if a host accidentally retains the old
+      // event array for one render during navigation.
+      if (event.workspaceId !== workspaceId || event.sessionId !== sessionId) continue;
       if (event.type === "terminal.pty.started") {
         const payload = event.payload as { ptyId?: string } | null;
         if (payload?.ptyId) {
@@ -182,19 +201,21 @@ export function useSandboxTerminal(
     const activePty = ptyFilter && open.has(ptyFilter) ? ptyFilter : lastOpened;
     lastSupportsInput = activePty ? (open.get(activePty)?.supportsInput ?? false) : false;
     return { chunks: out, openPty: activePty, supportsInput: lastSupportsInput };
-  }, [options.events, ptyFilter, includeAgentFirehose]);
+  }, [options.events, ptyFilter, includeAgentFirehose, workspaceId, sessionId]);
 
   // The PTY this hook actively drives: the one it opened (interactive) wins so
   // `write` is live the instant the open resolves — even before the
   // `terminal.pty.started` event arrives through SSE. Fall back to whatever the
   // event projection found (a PTY opened elsewhere, or a caller-pinned ptyId).
-  const activePtyId = openedPtyId ?? openPty;
+  const identityMatches = stateIdentity === identityKey;
+  const activePtyId = identityMatches ? (openedPtyId ?? openPty) : null;
   // An interactively-opened PTY accepts stdin by construction (we only open it on
   // a pty-capable backend); a projected PTY uses its advertised supportsInput.
   const canWrite = openedPtyId !== null || supportsInput;
 
   const write = useMemo(() => {
     if (!activePtyId || !canWrite || !sessionId) return null;
+    const writeIdentity = identityKey;
     return (data: string) => {
       void client
         .terminalPtyWrite(workspaceId, sessionId, { ptyId: activePtyId, data })
@@ -205,14 +226,15 @@ export function useSandboxTerminal(
           if (
             cause instanceof OpenGeniApiError &&
             (cause.status === 409 || cause.status === 404) &&
-            activePtyId === openedPtyId
+            activePtyId === openedPtyId &&
+            currentIdentityRef.current === writeIdentity
           ) {
             setOpenedPtyId(null);
             setReopenNonce((n) => n + 1);
           }
         });
     };
-  }, [client, workspaceId, sessionId, activePtyId, canWrite, openedPtyId]);
+  }, [client, workspaceId, sessionId, activePtyId, canWrite, openedPtyId, identityKey]);
 
   const close = useCallback(() => {
     if (!activePtyId || !sessionId) return;
@@ -225,6 +247,6 @@ export function useSandboxTerminal(
     write,
     activePtyId,
     close,
-    error: openError,
+    error: identityMatches ? openError : null,
   };
 }

package/src/hooks/use-session-capabilities.ts

@@ -162,6 +162,7 @@ export function useSessionCapabilities(
   const attachFiles = options.attachFiles ?? false;
   const warmingPollMs = options.warmingPollMs ?? 1500;
   const warmingDeadlineMs = options.warmingDeadlineMs ?? 30_000;
+  const identityKey = `${workspaceId}\u0000${sessionId ?? ""}\u0000${enabled}`;
 
   const [capabilities, setCapabilities] = useState<SessionCapabilities | null>(null);
   const [state, setState] = useState<SessionCapabilitiesState>("idle");
@@ -171,6 +172,7 @@ export function useSessionCapabilities(
   >(null);
   const [viewerCapReached, setViewerCapReached] = useState(false);
   const [viewerId, setViewerId] = useState<string | null>(null);
+  const [stateIdentity, setStateIdentity] = useState(identityKey);
   // Bumped to force a fresh negotiation cycle.
   const [nonce, setNonce] = useState(0);
 
@@ -178,6 +180,7 @@ export function useSessionCapabilities(
   // from the event log, and echoed on heartbeats.
   const epochRef = useRef(0);
   const viewerIdRef = useRef<string | null>(null);
+  const previousIdentityRef = useRef(identityKey);
 
   const renegotiate = useCallback(() => {
     setNonce((n) => n + 1);
@@ -185,6 +188,19 @@ export function useSessionCapabilities(
 
   // ── Negotiation + viewer lifecycle ──────────────────────────────────────────
   useEffect(() => {
+    const identityChanged = previousIdentityRef.current !== identityKey;
+    previousIdentityRef.current = identityKey;
+    if (identityChanged) {
+      setStateIdentity(identityKey);
+      setCapabilities(null);
+      setState("idle");
+      setError(null);
+      setAcknowledgmentRequired(null);
+      setViewerCapReached(false);
+      setViewerId(null);
+      epochRef.current = 0;
+      viewerIdRef.current = null;
+    }
     if (!enabled || !sessionId) {
       setState("idle");
       setCapabilities(null);
@@ -194,6 +210,7 @@ export function useSessionCapabilities(
     let pollTimer: ReturnType<typeof setTimeout> | null = null;
     let heartbeatTimer: ReturnType<typeof setInterval> | null = null;
     let localViewerId: string | null = null;
+    const requestAbort = new AbortController();
     const startedAt = Date.now();
 
     const clearTimers = () => {
@@ -241,7 +258,7 @@ export function useSessionCapabilities(
       pollTimer = setTimeout(() => {
         if (cancelled) return;
         void client
-          .getStreamCapabilities(workspaceId, sessionId)
+          .getStreamCapabilities(workspaceId, sessionId, { signal: requestAbort.signal })
           .then((caps) => {
             if (cancelled) return;
             settle(caps);
@@ -270,7 +287,9 @@ export function useSessionCapabilities(
       setAcknowledgmentRequired(null);
       setViewerCapReached(false);
       try {
-        const caps = await client.getStreamCapabilities(workspaceId, sessionId);
+        const caps = await client.getStreamCapabilities(workspaceId, sessionId, {
+          signal: requestAbort.signal,
+        });
         if (cancelled) return;
         settle(caps);
 
@@ -310,7 +329,14 @@ export function useSessionCapabilities(
             const holder = await client.attachViewer(workspaceId, sessionId, {
               desktop: wantDesktopAttach,
             });
-            if (cancelled) return;
+            if (cancelled) {
+              // The attach crossed an identity/unmount boundary after the server
+              // had already minted a holder. It is too late to publish the result,
+              // but abandoning it would keep the old sandbox warm until the
+              // reaper runs. Release that exact old-session holder immediately.
+              void client.detachViewer(workspaceId, sessionId, holder.viewerId).catch(() => {});
+              return;
+            }
             localViewerId = holder.viewerId;
             viewerIdRef.current = holder.viewerId;
             setViewerId(holder.viewerId);
@@ -415,6 +441,7 @@ export function useSessionCapabilities(
 
     return () => {
       cancelled = true;
+      requestAbort.abort();
       clearTimers();
       // Fire-and-forget detach (idempotent delete-my-row). Capture the id so a
       // re-render/unmount race still releases the right holder.
@@ -435,6 +462,7 @@ export function useSessionCapabilities(
     warmingPollMs,
     warmingDeadlineMs,
     nonce,
+    identityKey,
   ]);
 
   // ── Fold stream.url.rotated from the live event log (no round trip) ──────────
@@ -461,13 +489,14 @@ export function useSessionCapabilities(
     });
   }, [events]);
 
+  const identityMatches = enabled && stateIdentity === identityKey;
   return {
-    capabilities,
-    state,
-    error,
-    acknowledgmentRequired,
-    viewerCapReached,
-    viewerId,
+    capabilities: identityMatches ? capabilities : null,
+    state: identityMatches ? state : "idle",
+    error: identityMatches ? error : null,
+    acknowledgmentRequired: identityMatches ? acknowledgmentRequired : null,
+    viewerCapReached: identityMatches && viewerCapReached,
+    viewerId: identityMatches ? viewerId : null,
     renegotiate,
   };
 }

package/src/hooks/use-session-control.ts

@@ -1,9 +1,9 @@
 import type { SessionControlResponse, SessionEvent } from "@opengeni/sdk";
-import { useCallback } from "react";
-import { useOpenGeni, type ClientOverride } from "../provider";
+import { useCallback, useLayoutEffect, useRef } from "react";
+import { useEmbeddedSession, type EmbeddedSessionClientOverride } from "../session-context";
 import { useMutationRunner } from "./internal";
 
-export type UseSessionControlOptions = ClientOverride;
+export type UseSessionControlOptions = EmbeddedSessionClientOverride;
 
 export type UseSessionControlResult = {
   pause: (reason?: string) => Promise<SessionControlResponse | null>;
@@ -28,19 +28,30 @@ export function useSessionControl(
   sessionId: string | null | undefined,
   options: UseSessionControlOptions = {},
 ): UseSessionControlResult {
-  const { client, workspaceId } = useOpenGeni(options);
+  const { client, workspaceId } = useEmbeddedSession(options);
+  const approvalTargetKey = `${workspaceId}\u0000${sessionId ?? ""}`;
+  const pendingApproval = useRef<{
+    targetKey: string;
+    decisionKey: string;
+    clientEventId: string;
+  } | null>(null);
+  useLayoutEffect(() => {
+    if (pendingApproval.current?.targetKey !== approvalTargetKey) {
+      pendingApproval.current = null;
+    }
+  }, [approvalTargetKey]);
   const {
     run: runControl,
     mutating: controlling,
     mutationError: controlError,
     clearMutationError: clearControlError,
-  } = useMutationRunner();
+  } = useMutationRunner(approvalTargetKey);
   const {
     run: runApproval,
     mutating: responding,
     mutationError: approvalError,
     clearMutationError: clearApprovalError,
-  } = useMutationRunner();
+  } = useMutationRunner(approvalTargetKey);
 
   const pause = useCallback(
     async (reason?: string): Promise<SessionControlResponse | null> => {
@@ -73,15 +84,33 @@ export function useSessionControl(
       if (!sessionId) {
         return null;
       }
-      return await runApproval(() =>
+      const decisionKey = JSON.stringify([approvalId, decision, message ?? null]);
+      if (pendingApproval.current?.decisionKey !== decisionKey) {
+        pendingApproval.current = {
+          targetKey: approvalTargetKey,
+          decisionKey,
+          clientEventId: crypto.randomUUID(),
+        };
+      }
+      const clientEventId = pendingApproval.current.clientEventId;
+      const accepted = await runApproval(() =>
         client.sendApprovalDecision(workspaceId, sessionId, {
           approvalId,
           decision,
           ...(message !== undefined ? { message } : {}),
+          clientEventId,
         }),
       );
+      if (
+        accepted !== null &&
+        pendingApproval.current?.targetKey === approvalTargetKey &&
+        pendingApproval.current.clientEventId === clientEventId
+      ) {
+        pendingApproval.current = null;
+      }
+      return accepted;
     },
-    [client, workspaceId, sessionId, runApproval],
+    [approvalTargetKey, client, workspaceId, sessionId, runApproval],
   );
 
   const approve = useCallback(