alibaba / alibaba/open-code-review
Sessions from different repositories are mixed when encoded paths collide
- Dominant language
- Go
- Stars
- 24.4k
- Forks
- 1.8k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 105
Description
### OpenCodeReview Version
open-code-review dev linux/amd64
### Operating System
Linux (x86_64)
### Installation Method
Built from source
### LLM Provider
Other OpenAI-compatible endpoint
### Bug Description
OCR derives the session-storage directory by replacing path separators with hyphens. This causes different repository paths such as:
- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`
to map to the same session directory.
After reviewing both repositories with the same HOME directory, `ocr session list --repo` returns sessions from both repositories. This can expose or mix session history in the session list, resume flow, or viewer.
### Steps to Reproduce
1. Create two repositories whose paths collide after replacing `/` with `-`:
- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`
2. Configure OCR to use a local deterministic OpenAI-compatible mock server.
3. Build OCR from source.
4. Run a review for the first repository:
`ocr review --repo --commit HEAD --format json --audience agent`
5. Run a review for the second repository using the same HOME directory.
6. Run:
`ocr session list --repo --json`
7. Observe that sessions for both repositories are returned and stored under the same session directory.
### Expected Behavior
Each repository should have an isolated session-storage directory. Running:
`ocr session list --repo --json`
should return only sessions belonging to that repository. Sessions from another repository should never appear in its list, resume flow, or viewer.
### Logs / Error Output
```shell
Observed output showed two different repositories using the same session directory:
- `/tmp/.../team/service-api`
- `/tmp/.../team-service/api`
Both were stored under:
`.../.opencodereview/sessions/...-team-service-api/`
Running `ocr session list --repo --json` returned sessions for both repositories. No API keys or sensitive credentials were included.
```
### Additional Context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.