Skip to content

fix(session): make InMemorySessionStore.messageID increment atomic #3592

Closed
Bug
#3607
Closed
fix(session): make InMemorySessionStore.messageID increment atomic#3592
Bug
#3607
Assignees
aheritier
Labels
area/runtimeRuntime engine, agent loop execution, tool dispatch, loop detectionarea/securityAuthentication, authorization, secrets, vulnerabilitiesarea/sessionsFor features/issues/fixes related to session lifecycle (resume, persistence, export)kind/fixPR fixes a bug (maps to fix:). Use on PRs only.

Description

@aheritier
aheritier
opened on Jul 11, 2026

Summary

pkg/session/store.go:137 is a plain int64 incremented at :284 with no atomic/mutex, while the store is hit concurrently (HTTP handlers + runtime PersistenceObserver). Lost increments → duplicate message IDs → UpdateMessage (searches by ID, store.go:290-314) can edit the wrong message.

Fix

Use atomic.Int64 (or a mutex) for the counter.

Acceptance

  • Concurrent AddMessage test asserts unique IDs; -race clean.

Activity

  1. aheritier
    self-assigned this
    on Jul 11, 2026
  2. aheritier
    added
    area/sessionsFor features/issues/fixes related to session lifecycle (resume, persistence, export)
    kind/fixPR fixes a bug (maps to fix:). Use on PRs only.
    on Jul 11, 2026
  3. aheritier
    added the
    Bug
    issue type on Jul 11, 2026
  4. aheritier
    added
    area/securityAuthentication, authorization, secrets, vulnerabilities
    area/runtimeRuntime engine, agent loop execution, tool dispatch, loop detection
    on Jul 11, 2026
  5. dgageot
    closed this as completedin #3607on Jul 13, 2026
  6. dgageot
    added a commit that references this issue on Jul 13, 2026

    Merge pull request #3607 from docker/fix/3592-atomic-messageid

    baa8763
  7. pull
    added a commit that references this issue on Jul 13, 2026

    fix(session): make InMemorySessionStore.messageID atomic (docker#3592)

    0913076
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/runtimeRuntime engine, agent loop execution, tool dispatch, loop detectionarea/securityAuthentication, authorization, secrets, vulnerabilitiesarea/sessionsFor features/issues/fixes related to session lifecycle (resume, persistence, export)kind/fixPR fixes a bug (maps to fix:). Use on PRs only.

Type

Bug

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions