fix(sessions): reject bindings that resolve to another conversation #262

Merged

severus-snape merged 1 commit from fix/session-binding-conversation into main 2026-11-05 05:10:37 +00:00

Conversation 0 Commits 1 Files changed 2 +28 -2

severus-snape commented 2026-11-05 05:08:18 +00:00

Collaborator

Copy link

FilesystemSessionProvider.active(key) returned the bound session ID without checking that the target record belongs to key; only bind() enforced it. LocalSessions.list()/history() therefore surfaced a foreign conversation's title/history from a corrupted binding (the PI runtime open() already rejected it later).

Fix: active() loads the bound record and rejects a key mismatch with Session belongs to a different conversation. Missing binding still returns undefined. Rejection leaves binding file and record untouched; rebinding repairs it.

Origin: night improvement 2026-11-04, experiment 1 (re-ported onto current main; old ef854bf results not reused).

Evidence:

• Red on main (cbd29b8): new test fails Missing expected rejection; green after fix.
• Test covers Unicode/opaque keys, reopen, unchanged binding/record bytes, repair, same-key switching between two sessions.
• Serial full suite on ab4fa31: 1489/1489 pass; typecheck + build exit 0.
• Independent persistent review: passed, 0 findings (fingerprint 3ddb90f0…).

`FilesystemSessionProvider.active(key)` returned the bound session ID without checking that the target record belongs to `key`; only `bind()` enforced it. `LocalSessions.list()/history()` therefore surfaced a foreign conversation's title/history from a corrupted binding (the PI runtime `open()` already rejected it later). Fix: `active()` loads the bound record and rejects a key mismatch with `Session belongs to a different conversation`. Missing binding still returns `undefined`. Rejection leaves binding file and record untouched; rebinding repairs it. Origin: night improvement 2026-11-04, experiment 1 (re-ported onto current main; old ef854bf results not reused). Evidence: - Red on main (cbd29b8): new test fails `Missing expected rejection`; green after fix. - Test covers Unicode/opaque keys, reopen, unchanged binding/record bytes, repair, same-key switching between two sessions. - Serial full suite on ab4fa31: 1489/1489 pass; typecheck + build exit 0. - Independent persistent review: passed, 0 findings (fingerprint 3ddb90f0…).

severus-snape added 1 commit 2026-11-05 05:08:18 +00:00

fix(sessions): reject bindings that resolve to another conversation ... ab4fa3190f

FilesystemSessionProvider.active(key) returned the bound session ID without checking that the target record belongs to key; bind() already enforced it. LocalSessions.list()/history() therefore surfaced a foreign conversation's title and history from a corrupted binding. Rejection leaves the binding file and record untouched; rebinding repairs it.

severus-snape merged commit c248ca1770 into main 2026-11-05 05:10:37 +00:00

severus-snape referenced this pull request from a commit 2026-11-05 05:10:37 +00:00

Merge pull request 'fix(sessions): reject bindings that resolve to another conversation' (#262) from fix/session-binding-conversation into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

harness/core!262

No description provided.