Fix notifications opening the wrong workspace (#2331)

* fix(app): open notifications on the right host

Agent notifications previously omitted workspace ownership, so a cold target host was treated as missing and fell back to its empty home route. Carry the authoritative workspace and keep older notifications on a target-host resolver until lookup is conclusive.

* fix(app): separate notification and agent URL routing

Notifications use their authoritative workspace target directly. Stable agent URLs remain server-and-agent targets whose workspace is resolved by the agent route.

* fix(protocol): preserve notification workspace targets

Both attention message variants retain workspaceId through outbound validation so notification clicks receive the authoritative route target.

* test(app): use workspace-scoped notification target

* test(server): give notification agents workspace targets

* test(app): target notification workspace in navigation e2e

packages/protocol/src/agent-attention-notification.test.ts

@@ -6,10 +6,27 @@ import {
 } from "./agent-attention-notification.js";
 
 describe("buildAgentAttentionNotificationPayload", () => {
+  it("carries the workspace needed to open a cold agent destination", () => {
+    const payload = buildAgentAttentionNotificationPayload({
+      reason: "finished",
+      serverId: "srv-1",
+      workspaceId: "workspace-1",
+      agentId: "agent-1",
+    });
+
+    expect(payload.data).toEqual({
+      serverId: "srv-1",
+      workspaceId: "workspace-1",
+      agentId: "agent-1",
+      reason: "finished",
+    });
+  });
+
   it("builds finished notifications from markdown assistant text", () => {
     const payload = buildAgentAttentionNotificationPayload({
       reason: "finished",
       serverId: "srv-1",
+      workspaceId: "workspace-1",
       agentId: "agent-1",
       assistantMessage: "**Done**. Updated `README.md` and [link](https://example.com).",
     });
@@ -19,6 +36,7 @@ describe("buildAgentAttentionNotificationPayload", () => {
       body: "Done. Updated README.md and link.",
       data: {
         serverId: "srv-1",
+        workspaceId: "workspace-1",
         agentId: "agent-1",
         reason: "finished",
       },
@@ -29,6 +47,7 @@ describe("buildAgentAttentionNotificationPayload", () => {
     const payload = buildAgentAttentionNotificationPayload({
       reason: "permission",
       serverId: "srv-2",
+      workspaceId: "workspace-2",
       agentId: "agent-2",
       permissionRequest: {
         id: "perm-1",
@@ -45,6 +64,7 @@ describe("buildAgentAttentionNotificationPayload", () => {
       body: "Approve command - Run git push",
       data: {
         serverId: "srv-2",
+        workspaceId: "workspace-2",
         agentId: "agent-2",
         reason: "permission",
       },
@@ -55,6 +75,7 @@ describe("buildAgentAttentionNotificationPayload", () => {
     const payload = buildAgentAttentionNotificationPayload({
       reason: "error",
       serverId: "srv-3",
+      workspaceId: "workspace-3",
       agentId: "agent-3",
     });
 
@@ -63,6 +84,7 @@ describe("buildAgentAttentionNotificationPayload", () => {
       body: "Encountered an error.",
       data: {
         serverId: "srv-3",
+        workspaceId: "workspace-3",
         agentId: "agent-3",
         reason: "error",
       },

packages/protocol/src/agent-attention-notification.ts

@@ -5,6 +5,7 @@ export type AgentAttentionReason = "finished" | "error" | "permission";
 export interface AgentAttentionNotificationData {
   [key: string]: unknown;
   serverId: string;
+  workspaceId?: string;
   agentId: string;
   reason: AgentAttentionReason;
 }
@@ -18,6 +19,7 @@ export interface AgentAttentionNotificationPayload {
 interface BuildAgentAttentionNotificationPayloadInput {
   reason: AgentAttentionReason;
   serverId: string;
+  workspaceId: string;
   agentId: string;
   assistantMessage?: string | null;
   permissionRequest?: NotificationPermissionRequest | null;
@@ -203,6 +205,7 @@ export function buildAgentAttentionNotificationPayload(
     body,
     data: {
       serverId: input.serverId,
+      workspaceId: input.workspaceId,
       agentId: input.agentId,
       reason: input.reason,
     },

packages/protocol/src/agent-deep-link.ts

@@ -7,18 +7,24 @@ function normalizeSegment(value: string): string {
   return value.trim();
 }
 
-export function buildAgentDeepLink(target: AgentDeepLinkTarget): string {
+function normalizeAgentDeepLinkTarget(target: AgentDeepLinkTarget): AgentDeepLinkTarget {
   const serverId = normalizeSegment(target.serverId);
   const agentId = normalizeSegment(target.agentId);
   if (!serverId || !agentId) {
     throw new Error("Agent deep links require a server ID and agent ID.");
   }
-  return `paseo://h/${encodeURIComponent(serverId)}/agent/${encodeURIComponent(agentId)}`;
+  return { serverId, agentId };
 }
 
-export function buildAgentDeepLinkRoute(target: AgentDeepLinkTarget): string {
-  const link = new URL(buildAgentDeepLink(target));
-  return `/h${link.pathname}`;
+export function buildAgentDeepLinkRoute(
+  target: AgentDeepLinkTarget,
+): `/h/${string}/agent/${string}` {
+  const { serverId, agentId } = normalizeAgentDeepLinkTarget(target);
+  return `/h/${encodeURIComponent(serverId)}/agent/${encodeURIComponent(agentId)}`;
+}
+
+export function buildAgentDeepLink(target: AgentDeepLinkTarget): string {
+  return `paseo:/${buildAgentDeepLinkRoute(target)}`;
 }
 
 export function parseAgentDeepLink(input: string): AgentDeepLinkTarget | null {

packages/protocol/src/messages.ts

@@ -658,6 +658,7 @@ export const AgentStreamEventPayloadSchema = z.discriminatedUnion("type", [
         body: z.string(),
         data: z.object({
           serverId: z.string(),
+          workspaceId: z.string().optional(),
           agentId: z.string(),
           reason: z.enum(["finished", "error", "permission"]),
         }),
@@ -3564,6 +3565,7 @@ export const AgentAttentionRequiredMessageSchema = z.object({
         body: z.string(),
         data: z.object({
           serverId: z.string(),
+          workspaceId: z.string().optional(),
           agentId: z.string(),
           reason: z.enum(["finished", "error", "permission"]),
         }),

packages/protocol/tests/validation/ws-outbound.test.ts

@@ -138,6 +138,65 @@ const SourceSchema = z.object({
     );
   });
 
+  it.each([
+    {
+      name: "dedicated attention message",
+      message: {
+        type: "agent_attention_required",
+        payload: {
+          agentId: "agent-1",
+          reason: "finished",
+          timestamp: "2026-07-22T18:00:00.000Z",
+          shouldNotify: true,
+          notification: {
+            title: "Agent finished",
+            body: "Done",
+            data: {
+              serverId: "server-1",
+              workspaceId: "workspace-1",
+              agentId: "agent-1",
+              reason: "finished",
+            },
+          },
+        },
+      },
+    },
+    {
+      name: "agent stream attention event",
+      message: {
+        type: "agent_stream",
+        payload: {
+          agentId: "agent-1",
+          timestamp: "2026-07-22T18:00:00.000Z",
+          event: {
+            type: "attention_required",
+            provider: "codex",
+            reason: "finished",
+            timestamp: "2026-07-22T18:00:00.000Z",
+            shouldNotify: true,
+            notification: {
+              title: "Agent finished",
+              body: "Done",
+              data: {
+                serverId: "server-1",
+                workspaceId: "workspace-1",
+                agentId: "agent-1",
+                reason: "finished",
+              },
+            },
+          },
+        },
+      },
+    },
+  ])("preserves workspaceId in a $name", ({ message }) => {
+    const envelope = { type: "session", message };
+
+    expect(GeneratedWSOutboundMessageSchema.safeParse(envelope)).toEqual({
+      success: true,
+      data: envelope,
+    });
+  });
+
   it("emits runtime imports with .js extensions", async () => {
     const generated = await readFile(generatedWSOutboundPath, "utf8");
     expect(generated).toContain('from "../../validation/ws-outbound-schema-metadata.js"');