alibaba / alibaba/open-code-review

Sessions from different repositories are mixed when encoded paths collide

Open
#894 2 comments 0 reactions 1 assignee Claimed by @amh1k View on GitHub
bug
Dominant language
Go
Stars
24.4k
Forks
1.8k
Avg merge
2d 6h
Merged PRs (30d)
105

Description

### OpenCodeReview Version

open-code-review dev linux/amd64

### Operating System

Linux (x86_64)

### Installation Method

Built from source

### LLM Provider

Other OpenAI-compatible endpoint

### Bug Description

OCR derives the session-storage directory by replacing path separators with hyphens. This causes different repository paths such as:

- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`

to map to the same session directory.

After reviewing both repositories with the same HOME directory, `ocr session list --repo` returns sessions from both repositories. This can expose or mix session history in the session list, resume flow, or viewer.

### Steps to Reproduce

1. Create two repositories whose paths collide after replacing `/` with `-`:
- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`
2. Configure OCR to use a local deterministic OpenAI-compatible mock server.
3. Build OCR from source.
4. Run a review for the first repository:
`ocr review --repo --commit HEAD --format json --audience agent`
5. Run a review for the second repository using the same HOME directory.
6. Run:
`ocr session list --repo --json`
7. Observe that sessions for both repositories are returned and stored under the same session directory.

### Expected Behavior

Each repository should have an isolated session-storage directory. Running:

`ocr session list --repo --json`

should return only sessions belonging to that repository. Sessions from another repository should never appear in its list, resume flow, or viewer.

### Logs / Error Output

```shell
Observed output showed two different repositories using the same session directory:

- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`

Both were stored under:

`.../.opencodereview/sessions/...-team-service-api/`

Running `ocr session list --repo --json` returned sessions for both repositories. No API keys or sensitive credentials were included.
```

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.