fix: harden workflow console rpc boundary

web/apps/console/src/app/App.tsx

@@ -58,7 +58,7 @@ export const App = () => {
             id: `sources-${Date.now()}`,
             operation: "workflow.sources.list",
             label: "Source inventory",
-            equivalentCli: "uv run wf sources list --limit 50",
+            equivalentCli: result.equivalentCli,
             request: result.exchange.request,
             response: result.exchange.response,
             durationMs: result.durationMs,
@@ -72,7 +72,7 @@ export const App = () => {
             id: `sources-${Date.now()}`,
             operation: "workflow.sources.list",
             label: "Source inventory",
-            equivalentCli: "uv run wf sources list --limit 50",
+            equivalentCli: "uv run wf source list --limit 50",
             request: result.exchange.request,
             response: result.exchange.response,
             durationMs: 0,

web/apps/console/src/app/state.test.ts

@@ -45,25 +45,35 @@ describe("initialState", () => {
     expect(state.draftTarget).toBe("http://127.0.0.1:8765/rpc");
   });
 
-  it("restores target from localStorage when available", () => {
+  it("restores target from sessionStorage when available", () => {
     try {
-      localStorage.setItem(STORAGE_KEY, "http://custom:9999/rpc");
+      sessionStorage.setItem(STORAGE_KEY, "http://custom:9999/rpc");
     } catch {
-      return; // skip if localStorage unavailable
+      return; // skip if sessionStorage unavailable
     }
     const state = initialState();
     expect(state.draftTarget).toBe("http://custom:9999/rpc");
   });
 
   it("restored target does not trigger automatic connection", () => {
+    try {
+      sessionStorage.setItem(STORAGE_KEY, "http://custom:9999/rpc");
+    } catch {
+      return; // skip if sessionStorage unavailable
+    }
+    const state = initialState();
+    expect(state.phase).toBe("not_configured");
+    expect(state.connectedTarget).toBeNull();
+  });
+
+  it("ignores localStorage so persistence is session-scoped", () => {
     try {
       localStorage.setItem(STORAGE_KEY, "http://custom:9999/rpc");
     } catch {
       return; // skip if localStorage unavailable
     }
     const state = initialState();
-    expect(state.phase).toBe("not_configured");
-    expect(state.connectedTarget).toBeNull();
+    expect(state.draftTarget).toBe("http://127.0.0.1:8765/rpc");
   });
 });
 

web/apps/console/src/app/state.ts

@@ -47,14 +47,6 @@ export type ConnectionState = {
 
 export const STORAGE_KEY = "lda.workflowConsole.target";
 
-const safeLocalStorage = (): Storage | null => {
-  try {
-    return typeof localStorage !== "undefined" ? localStorage : null;
-  } catch {
-    return null;
-  }
-};
-
 const safeSessionStorage = (): Storage | null => {
   try {
     return typeof sessionStorage !== "undefined" ? sessionStorage : null;
@@ -64,8 +56,8 @@ const safeSessionStorage = (): Storage | null => {
 };
 
 const getDefaultTarget = (): string => {
-  const ls = safeLocalStorage();
-  return ls?.getItem(STORAGE_KEY) ?? "http://127.0.0.1:8765/rpc";
+  const ss = safeSessionStorage();
+  return ss?.getItem(STORAGE_KEY) ?? "http://127.0.0.1:8765/rpc";
 };
 
 export const initialState = (): ConnectionState => ({