Skip to content

fix(session): prevent cross-session patch contamination - #20560

Closed
rachavz wants to merge 1 commit into
anomalyco:devfrom
rachavz:fix/cross-session-patch-contamination
Closed

rachavz wants to merge 1 commit into
anomalyco:devfrom
rachavz:fix/cross-session-patch-contamination

Conversation

@rachavz

@rachavz rachavz commented Apr 1, 2026 •

Copy link
Copy Markdown

Issue for this PR

Closes #20552

Type of change

  • Bug fix

What does this PR do?

When multiple sessions run concurrently in the same project directory, the Snapshot service operates on a shared git index (scoped per-directory via InstanceState.make, not per-session). snapshot.patch(hash) returns ALL files changed since rack(), including modifications from other sessions' tools. This causes patch parts from one session to contain file paths from another session.

The fix adds per-processor file tracking: a modifiedFiles set is populated from tool result metadata during each step, then used to filter patch.files before emitting a patch part. Both the normal inish-step path and the cleanup path apply the same filter.

Tool metadata fields used:

  • ilepath (write tool)
  • ilediff.file (edit tool)

esults[].filediff.file (multiedit tool — delegates to edit)

  • iles[].filePath (apply_patch tool)
  • parameters.filePath + parameters.file_path at call-time (batch tool)

Files modified by �ash are not tracked since it doesn't report file paths — this is an accepted limitation matching current behavior.

Also adds an optional ?sessionID= query param to the /event SSE endpoint for server-side event filtering by session.

How did you verify your code works?

Verified by tracing the data flow:

  1. Confirmed sessionID flow is correct throughout — the bug is in snapshot.patch() returning cross-session file changes, not in session ID assignment
  2. Verified tool metadata field names against actual tool source code (�dit.ts, write.ts, multiedit.ts, �pply_patch.ts, �atch.ts)
  3. Confirmed the fallback (modifiedFiles.size > 0 ? filtered : patch.files) preserves existing behavior when no files are tracked

Screenshots / recordings

N/A — core logic change, no UI changes.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

)

When multiple sessions run concurrently in the same project, the shared
Snapshot service's patch() returns ALL files changed since track(),
including modifications from other sessions' tools.

Track which files each processor's tools actually modified via tool
result metadata, then filter patch.files before emitting a patch part.
Also adds optional ?sessionID= query param to /event SSE endpoint for
server-side event filtering.
@github-actions github-actions Bot added needs:compliance This means the issue will auto-close after 2 hours. and removed needs:compliance This means the issue will auto-close after 2 hours. labels Apr 1, 2026
@github-actions

github-actions Bot commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

Thanks for updating your PR! It now meets our contributing guidelines. 👍

@rekram1-node

Copy link
Copy Markdown
Collaborator

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

  • The PR was created more than 1 month ago
  • The PR had fewer than 2 positive reactions
  • Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Data is stored in the wrong session when multiple sessions are running

2 participants