fix(permissions): scope instance dispose to the repo directory

Drop the session-list cache invalidation from ResetPermissionsDialog:
disposing the OpenCode instance does not change the persisted session
list, so the refetch was unnecessary, and the prior cache key no longer
matched the paginated shape.

Guard the reset-permissions route against an empty repo directory so it
never forwards /instance/dispose without a directory, which would
dispose the entire server instead of only the repo's instance.

Author: chriswritescode-dev

backend/src/routes/repos.ts

@@ -470,7 +470,11 @@ app.get('/', async (c) => {
       if (!repo) {
         return c.json({ error: 'Repo not found' }, 404)
       }
-      
+
+      if (!repo.fullPath) {
+        return c.json({ error: 'Repo has no directory to reset' }, 400)
+      }
+
       const response = await openCodeClient.forward({
         method: 'POST',
         path: '/instance/dispose',

backend/test/routes/repos.test.ts

@@ -248,4 +248,63 @@ describe('Repo Routes', () => {
       expect(res.status).toBe(500)
     })
   })
+
+  describe('POST /:id/reset-permissions', () => {
+    it('should return 404 when repo not found', async () => {
+      vi.mocked(db.getRepoById).mockReturnValue(null)
+
+      const app = createRepoRoutes(mockDb, mockGitAuthService, mockScheduleService, createStubOpenCodeClient())
+      const res = await app.request('/1/reset-permissions', { method: 'POST' })
+
+      expect(res.status).toBe(404)
+    })
+
+    it('should return 400 without disposing when repo has no directory', async () => {
+      const mockRepo = {
+        id: 1,
+        repoUrl: undefined,
+        localPath: 'assistant',
+        fullPath: '',
+        sourcePath: undefined,
+        branch: undefined,
+        defaultBranch: 'main',
+        cloneStatus: 'ready' as const,
+        clonedAt: Date.now(),
+      }
+      vi.mocked(db.getRepoById).mockReturnValue(mockRepo)
+
+      const forward = vi.fn(async () => new Response(JSON.stringify(true), { status: 200 }))
+      const app = createRepoRoutes(mockDb, mockGitAuthService, mockScheduleService, createStubOpenCodeClient({ forward }))
+      const res = await app.request('/1/reset-permissions', { method: 'POST' })
+
+      expect(res.status).toBe(400)
+      expect(forward).not.toHaveBeenCalled()
+    })
+
+    it('should dispose only the repo directory and return success', async () => {
+      const mockRepo = {
+        id: 1,
+        repoUrl: 'https://github.com/test/repo',
+        localPath: 'repos/test-repo',
+        fullPath: '/tmp/test-repo',
+        sourcePath: '/tmp/test-repo/.git',
+        branch: 'main',
+        defaultBranch: 'main',
+        cloneStatus: 'ready' as const,
+        clonedAt: Date.now(),
+      }
+      vi.mocked(db.getRepoById).mockReturnValue(mockRepo)
+
+      const forward = vi.fn(async () => new Response(JSON.stringify(true), { status: 200 }))
+      const app = createRepoRoutes(mockDb, mockGitAuthService, mockScheduleService, createStubOpenCodeClient({ forward }))
+      const res = await app.request('/1/reset-permissions', { method: 'POST' })
+
+      expect(res.status).toBe(200)
+      expect(forward).toHaveBeenCalledWith({
+        method: 'POST',
+        path: '/instance/dispose',
+        directory: '/tmp/test-repo',
+      })
+    })
+  })
 })

frontend/src/components/repo/ResetPermissionsDialog.tsx

@@ -1,6 +1,5 @@
-import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useMutation } from "@tanstack/react-query";
 import { resetRepoPermissions } from "@/api/repos";
-import { invalidateSessionListCaches } from "@/lib/queryInvalidation";
 import {
   Dialog,
   DialogContent,
@@ -24,12 +23,9 @@ export function ResetPermissionsDialog({
   onOpenChange,
   repoId,
 }: ResetPermissionsDialogProps) {
-  const queryClient = useQueryClient();
-
   const resetPermissionsMutation = useMutation({
     mutationFn: () => resetRepoPermissions(repoId),
     onSuccess: () => {
-      invalidateSessionListCaches(queryClient);
       showToast.success("Permissions reset successfully");
       onOpenChange(false);
     },