fix(asap): isolate inbound task.request sessions by sender URN - #64
Draft
cursor[bot] wants to merge 1 commit into
Draft
fix(asap): isolate inbound task.request sessions by sender URN#64cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
All POST /asap task.request calls shared the hardcoded session "asap:inbound", leaking conversation history across unrelated clients. Derive per-sender session ids from the envelope sender field. Co-authored-by: esadrianno <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
Every inbound
POST /asaptask.requestused the hardcoded session idasap:inbound, so unrelated ASAP clients shared one SQLite conversation history. A second client could read prior prompts and assistant replies from another sender — cross-client context bleed and privacy violation.Trigger: Client A sends
task.requestwith secret context; Client B (differentsenderURN) sends a follow-up and receives answers informed by A's history.Root cause
handle_asapnever setasap_server_ctx_t.session_id, andhandle_task_requestdefaulted to"asap:inbound"when unset.Fix
asap_resolve_task_session_id()to deriveasap:<sender>from the envelope sender URN when no explicit session is provided.Validation
server.csyntax-checked with-Wall -Wextra -Werrortest_resolve_task_session_idintests/test_asap_server.c