fix(sessions): bind forge into session key to prevent cross-forge collision #520

New issue

Closed

opened 2026-04-28 09:25:08 +00:00 by claude-desktop · 0 comments

claude-desktop commented

2026-04-28 09:25:08 +00:00

Collaborator

User story

As an operator running the same agent type against repos on Forgejo and GitHub with the same <owner>/<name>, I want session keys to include the forge identifier, so that resume-state from one forge cannot bleed into the other.

Why

Audit (2026-04-28) flagged agent-runner.ts:677 builds session key as <type>:<repo>:<issue>. With multi-forge live, two repos acme/widget on different forges collide; resume picks the wrong session.

Acceptance criteria

Session key shape is <forge>:<type>:<owner>/<name>:<issue> (or equivalent unambiguous form)
Migration: existing rows in the sessions table either backfilled with forgejo: prefix or dropped (decide based on row count — flag in PR description)
All readers updated: database/sessions.ts, agent-runner.ts, foreman, dispatch handle return value
Test: two repos with same <owner>/<name> on different forges keep independent sessions

Out of scope

Schema redesign of sessions table beyond the key change

References

apps/server/src/infrastructure/agents/agent-runner.ts:677
apps/server/src/infrastructure/database/sessions.ts

## User story As an operator running the same agent type against repos on Forgejo and GitHub with the same `<owner>/<name>`, I want session keys to include the forge identifier, so that resume-state from one forge cannot bleed into the other. ## Why Audit (2026-04-28) flagged `agent-runner.ts:677` builds session key as `<type>:<repo>:<issue>`. With multi-forge live, two repos `acme/widget` on different forges collide; resume picks the wrong session. ## Acceptance criteria - [ ] Session key shape is `<forge>:<type>:<owner>/<name>:<issue>` (or equivalent unambiguous form) - [ ] Migration: existing rows in the sessions table either backfilled with `forgejo:` prefix or dropped (decide based on row count — flag in PR description) - [ ] All readers updated: `database/sessions.ts`, `agent-runner.ts`, foreman, dispatch handle return value - [ ] Test: two repos with same `<owner>/<name>` on different forges keep independent sessions ## Out of scope - Schema redesign of sessions table beyond the key change ## References - `apps/server/src/infrastructure/agents/agent-runner.ts:677` - `apps/server/src/infrastructure/database/sessions.ts`

claude-desktop added the

area:sessions

type:bug

labels

2026-04-28 09:25:42 +00:00

claude-desktop referenced this issue

2026-04-28 09:26:58 +00:00

[Meta] Hexagonal: AgentDispatchPort migration #513

claude-desktop added this to the M25 — Agentic dispatch port milestone

2026-04-28 09:27:11 +00:00