fix: reset focusOrder on blur and reject stale connectionId in consumer

- PreviewAutomationBroker: Reset focusOrder to 0 when an owner reports
  blur (focused: false). Previously the focusOrder was preserved, letting
  a blurred owner keep winning the routing tiebreak over other unfocused
  peers until they explicitly reported focus.

- previewAutomationRequestConsumer: Always drop events whose connectionId
  does not match the active connection. Previously, when no 'connected'
  event had been observed, the consumer would accept and switch to any new
  connectionId, allowing stale events from an older generation to be
  processed and responded to with a mismatched id.

Author: cursoragent

apps/server/src/mcp/PreviewAutomationBroker.ts

@@ -296,7 +296,7 @@ export const make = Effect.gen(function* PreviewAutomationBrokerMake() {
       clients.set(owner.clientId, {
         ...currentOwner,
         focused: owner.focused,
-        focusOrder: owner.focused ? focusSequence : currentOwner.focusOrder,
+        focusOrder: owner.focused ? focusSequence : 0,
       });
       return { ...current, clients, focusSequence };
     });

apps/web/src/components/preview/previewAutomationRequestConsumer.ts

@@ -39,7 +39,6 @@ export function createPreviewAutomationRequestConsumerAtom<E>(options: {
     get.mount(options.requestHandlerAtom);
     let disposed = false;
     let activeConnectionId: PreviewAutomationStreamEvent["connectionId"] | null = null;
-    let connectionExplicitlyAnnounced = false;
     let reportedConnectionId: PreviewAutomationStreamEvent["connectionId"] | null = null;
     let requestsVersion = 0;
 
@@ -48,12 +47,10 @@ export function createPreviewAutomationRequestConsumerAtom<E>(options: {
       const event = result.value;
       if (event.type === "connected") {
         activeConnectionId = event.connectionId;
-        connectionExplicitlyAnnounced = true;
       } else if (activeConnectionId === null) {
         activeConnectionId = event.connectionId;
       } else if (activeConnectionId !== event.connectionId) {
-        if (connectionExplicitlyAnnounced) return;
-        activeConnectionId = event.connectionId;
+        return;
       }
       if (reportedConnectionId !== event.connectionId) {
         reportedConnectionId = event.connectionId;
@@ -98,7 +95,6 @@ export function createPreviewAutomationRequestConsumerAtom<E>(options: {
     const initialRequest = get.once(options.requestsAtom);
     if (AsyncResult.isSuccess(initialRequest)) {
       activeConnectionId = initialRequest.value.connectionId;
-      connectionExplicitlyAnnounced = initialRequest.value.type === "connected";
       if (initialRequest.value.type === "connected") {
         reportedConnectionId = initialRequest.value.connectionId;
         get.set(options.connectionAtom, initialRequest.value.connectionId);