feat: pin sessions to workspace revisions

backend/src/routes/settings.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from "fastify";
 import type { AppConfig } from "../config.js";
-import { loadSettings, saveSettings, type Settings } from "../settings/settings-store.js";
+import type { Settings } from "../settings/settings-store.js";
 import { listWorkspaces, type ListModelsFn } from "./meta.js";
 import { getPrincipal } from "../auth/auth.js";
 import type { PrincipalContext } from "../auth/principal.js";
@@ -9,10 +9,10 @@ import type { PrincipalContext } from "../auth/principal.js";
 export function effectiveSettings(cfg: AppConfig, stored: Settings): Settings {
   const workspaces = listWorkspaces(cfg.harnessDir);
   return {
-    workspace: stored.workspace ?? (workspaces[0]?.name),
-    provider: stored.provider ?? cfg.defaults.provider,
-    model: stored.model ?? cfg.defaults.model,
-    thinking: stored.thinking ?? cfg.defaults.thinking,
+    workspace: workspaces[0]?.name ?? stored.workspace,
+    provider: cfg.defaults.provider ?? stored.provider,
+    model: cfg.defaults.model ?? stored.model,
+    thinking: cfg.defaults.thinking ?? stored.thinking,
   };
 }
 
@@ -21,7 +21,6 @@ export function settingsRoutes(
   deps: {
     cfg: AppConfig; listModels: ListModelsFn;
     getSettings: (principal: PrincipalContext) => Promise<Settings>;
-    saveSettings: (principal: PrincipalContext, settings: Settings) => Promise<void>;
   },
 ): void {
   app.get("/settings", async (req, reply) => {
@@ -50,15 +49,10 @@ export function settingsRoutes(
         });
       }
     }
-    const next: Settings = {
-      workspace: b.workspace,
-      provider: b.provider,
-      model: b.model,
-      thinking: b.thinking,
-    };
     try {
-      await deps.saveSettings(getPrincipal(req), next);
-      return effectiveSettings(deps.cfg, next);
+      // Retain this endpoint as a validating compatibility surface for older clients, but do
+      // not write anonymous users' choices to shared server storage.
+      return await deps.getSettings(getPrincipal(req));
     } catch {
       return reply.code(503).send({ error: "settings storage is unavailable" });
     }