Fix session list freshness and unread indicators

[Liu-KM]

Summary

Fix stale session-list state and add lightweight unread indicators for sessions that update while the user is looking elsewhere.

• update sessions.updated_at whenever messages are stored or moved between sessions
• keep a global SSE subscription active so the sidebar receives updates even when a specific session is selected
• patch session-list timestamps immediately from message-received events
• persist per-session last-seen timestamps in localStorage and show unread dots on sessions, project groups, and machines

Why

The sidebar could show stale thinking/status and stale relative times until a session was opened. This made completed sessions still look active and made it hard to tell which background sessions had new output.

Validation

• cd hub && bun test src/sync/sessionModel.test.ts
• cd web && bun test src/components/SessionList.test.ts
• bun run typecheck:hub
• bun run typecheck:web

Notes

AI-assisted with GPT-5.4.

[github-actions]

Findings

• [Major] Selected-session SSE connection never reports visibility changes — The new second useSSE call opens another /events?sessionId=... stream, but only the global subscriptionId is passed to useVisibilityReporter. That leaves the session-scoped subscription stuck with whatever visibility it had at connect time. Because push fallback checks hasVisibleConnection(namespace) before sending notifications, backgrounding the app after opening a session can suppress push delivery and keep routing toasts to a hidden tab instead. Evidence web/src/App.tsx:259, related context web/src/hooks/useVisibilityReporter.ts:13, hub/src/push/pushNotificationChannel.ts:39.
  Suggested fix:

  const { subscriptionId } = useSSE({ ...globalOptions })
  const { subscriptionId: sessionSubscriptionId } = useSSE({
      enabled: Boolean(api && token && selectedSessionId),
      token: token ?? '',
      baseUrl,
      subscription: sessionEventSubscription,
      onEvent: handleSseEvent
  })
  
  useVisibilityReporter({
      api,
      subscriptionId,
      enabled: Boolean(api && token)
  })
  useVisibilityReporter({
      api,
      subscriptionId: sessionSubscriptionId,
      enabled: Boolean(api && token && selectedSessionId)
  })

Summary

• Review mode: initial
• 1 finding. Main regression: the new per-session SSE stream can keep a hidden client marked visible, which suppresses push notifications for that namespace.

Testing

• Not run (automation)

HAPI Bot

[github-actions]

[MAJOR] This second SSE stream never gets a visibility report. useVisibilityReporter only receives the global subscriptionId below, so this session-scoped subscription stays visible after a visible connect. PushNotificationChannel then sees hasVisibleConnection(namespace) and can skip push delivery even when the tab is hidden.

Suggested fix:

const { subscriptionId: sessionSubscriptionId } = useSSE({
    enabled: Boolean(api && token && selectedSessionId),
    token: token ?? '',
    baseUrl,
    subscription: sessionEventSubscription,
    onEvent: handleSseEvent
})

useVisibilityReporter({
    api,
    subscriptionId: sessionSubscriptionId,
    enabled: Boolean(api && token && selectedSessionId)
})