fix(sessions): reject legacy peer overlap

steipete · steipete · commit ab707179f92e · 2026-06-27T01:19:28.000+01:00
diff --git a/src/routing/session-key.test.ts b/src/routing/session-key.test.ts
@@ -137,7 +137,9 @@ describe("deriveSessionChatTypeFromKey", () => {
     { key: "agent:main:discord:guild-123:channel-456", expected: "channel" },
     { key: "agent:main:channel:legacy-room", expected: "channel" },
     { key: "agent:main:channel:!room:example.org", expected: "channel" },
+    { key: "agent:main:channel:direct:user", expected: "channel" },
     { key: "agent:main:group:room:part", expected: "group" },
+    { key: "agent:main:group:dm:user", expected: "group" },
     { key: "agent:main:whatsapp:123@g.us", expected: "group" },
     { key: "agent:main:telegram:dm:123456", expected: "direct" },
     { key: "telegram:dm:123456", expected: "direct" },
diff --git a/src/sessions/send-policy.test.ts b/src/sessions/send-policy.test.ts
@@ -117,6 +117,12 @@ describe("resolveSendPolicy", () => {
       sessionKey: "agent:main:channel:!room:example.org",
       expected: "deny",
     },
+    {
+      name: "legacy channel keys overlapping canonical direct peers fail closed",
+      cfg: cfgWithRules([{ action: "deny", match: { chatType: "channel" } }]),
+      sessionKey: "agent:main:channel:direct:user",
+      expected: "deny",
+    },
     {
       name: "ambiguous account and peer-kind tokens fail closed",
       cfg: cfgWithRules([{ action: "deny", match: { chatType: "direct" } }]),
diff --git a/src/sessions/session-chat-type-shared.ts b/src/sessions/session-chat-type-shared.ts
@@ -27,8 +27,15 @@ export function hasAmbiguousCanonicalSessionPeerShape(scopedSessionKey: string):
   const hasAccountPeerShape = Boolean(
     parts[0] && parts[1] && isCanonicalPeerKind(parts[2]) && parts[3],
   );
+  const hasBuiltInLegacyPeerShape =
+    deriveBuiltInLegacySessionChatType(scopedSessionKey) !== undefined;
   return (
-    [hasBareDirectPeerShape, hasChannelPeerShape, hasAccountPeerShape].filter(Boolean).length > 1
+    [
+      hasBareDirectPeerShape,
+      hasChannelPeerShape,
+      hasAccountPeerShape,
+      hasBuiltInLegacyPeerShape,
+    ].filter(Boolean).length > 1
   );
 }
 
