fix(session): scope session list to current directory to prevent cross-worktree leakage#16827
Conversation
…s-worktree leakage When multiple git worktrees share the same root commit, they get the same project_id. This causes sessions from different worktrees to appear mixed in the session list. Similarly, the 'global' project (worktree '/') acts as a catch-all bucket, mixing sessions from unrelated directories. Changes: - Default the session list API route to filter by Instance.directory, ensuring sessions are scoped to the active working directory - Fix workspace_id filtering to include sessions with NULL workspace_id (pre-migration sessions) using OR condition instead of strict equality - Use explicit workspaceID input parameter in Session.list() instead of only reading from WorkspaceContext (the param was dead code before) - Add workspaceID query parameter to GET /session/ API route - Pass directory filter in CLI 'session list' command - Allow explicit workspaceID in Session.createNext() input - Add tests for directory scoping, NULL workspace_id handling, and explicit workspaceID in createNext Fixes anomalyco#15678, relates to anomalyco#16744, anomalyco#16137
|
The following comment was made by an LLM, it may be inaccurate: Potential Duplicate PRs Found:
These should be reviewed to ensure the current PR isn't duplicating prior work or to understand why previous attempts may need refinement. |
|
I need this bad, otherwise I'm forced to run an OpenCode server per project right now in order to get session segregation. That means I'm running 10-20+ OpenCode servers at all times. |
2 participants
Issue for this PR
Closes #15678
Type of change
What does this PR do?
Scopes the session list to the current working directory to prevent cross-worktree session leakage. When multiple worktrees share the same git root commit (same
project_id), sessions from all worktrees appear mixed in the list.Changes:
GET /session/to filter byInstance.directorywhen no directory param is providedNULLvalues (pre-migration sessions) viaOR(eq, isNull)workspaceIDinput param inSession.list()(was dead code) andcreateNext()workspaceIDquery param to session list API routedirectory: Instance.directoryin CLIsession listcommandHow did you verify your code works?
Full test suite: 128 tests across 13 files, 124 pass, 4 skip, 0 fail.
Added 3 new tests in
test/server/session-list.test.ts:workspace_idincluded when filtering by workspaceIDcreateNextaccepts explicit workspaceIDManually verified with worktrees sharing the same root commit — sessions now scoped correctly.
Screenshots / recordings
N/A — no UI changes, backend/API fix only.
Checklist