@yeaft/webchat-agent 0.1.901 → 0.1.902

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "0.1.901",
+  "version": "0.1.902",
   "description": "Remote agent for Yeaft WebChat — connects worker machines to the central server",
   "main": "index.js",
   "type": "module",

package/yeaft/memory/ams-registry.js

@@ -78,9 +78,10 @@ export class AmsRegistry {
   /**
    * Resolve the on-disk path for a group's ams.json.
    *
-   * `sessionId` is trusted: `nextSessionId()` (groups/ids.js) emits ids matching
-   * `grp_[a-z0-9_-]+`, and the single-VP path uses the literal
-   * `DEFAULT_GROUP_KEY`. No defensive escaping is needed.
+   * `sessionId` is trusted: `nextSessionId()` (sessions/ids.js) emits ids matching
+   * `grp_[a-z0-9_-]+_[0-9A-HJKMNP-TV-Z]{8}` (slug + 8-char crockford suffix),
+   * and the single-VP path uses the literal `DEFAULT_GROUP_KEY`. No defensive
+   * escaping is needed.
    *
    * @param {string} sessionId
    * @returns {string}

package/yeaft/sessions/ids.js

@@ -38,9 +38,15 @@ export function nextMsgId() {
 }
 
 export function nextSessionId(slug = 'default') {
-  // Slug-tolerant: lowercase a-z0-9_- only.
-  const safe = String(slug).toLowerCase().replace(/[^a-z0-9_-]+/g, '-').slice(0, 32) || 'group';
-  return `grp_${safe}`;
+  // Slug-tolerant: lowercase a-z0-9_- only, capped at 24 chars so the
+  // total id stays compact after the suffix is appended.
+  const safe = String(slug).toLowerCase().replace(/[^a-z0-9_-]+/g, '-').slice(0, 24) || 'group';
+  // Append 8 crockford-base32 chars (~40 bits) so re-creating a session
+  // with the same display name yields a fresh id instead of throwing
+  // `duplicate` on the existsSync check in session-crud.js. The
+  // `duplicate` branch is now a true defensive guard rather than the
+  // first-collision footgun it used to be.
+  return `grp_${safe}_${randEncoded(8)}`;
 }
 
 /**