Skip to content

fix: isolate channel history by ID - #39

Open
vycdev2 wants to merge 1 commit into
vycdev:mainfrom
vycdev2:fix/isolate-channel-history
Open

fix: isolate channel history by ID#39
vycdev2 wants to merge 1 commit into
vycdev:mainfrom
vycdev2:fix/isolate-channel-history

Conversation

@vycdev2

@vycdev2 vycdev2 commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • key saved history and summaries by globally unique Discord channel IDs while retaining readable channel names in filenames
  • resolve existing ID-keyed files across channel renames and keep legacy name-only files out of automatic prompt loading
  • preserve MCP browsing for legacy files and add channel-ID filtering for the new format
  • cover same-name isolation, summary generation, channel renames, legacy behavior, and filename parsing

Verification

  • npm test — passed: TypeScript build and all 13 Node tests
  • git diff --check — passed

Risk

  • Medium: this intentionally starts a new history filename format; legacy name-only files remain available through MCP browsing but are not loaded automatically because their owning Discord channel cannot be determined safely.

Closes #38

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

vycdev commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Blocking review finding: legacy name-only history files can masquerade as the new v2 ID-keyed format and leak cross-channel context.

The old format could create v2_<victimChannelId>__general_<date>.txt from a channel whose sanitized name was v2_<victimChannelId>__general. After this change, parseChannelHistoryFileName() accepts that same legacy filename as a v2 file for <victimChannelId>, and loadRecentHistory(<victimChannelId>, ..., "general") automatically loads its contents.

I reproduced this locally: creating that legacy filename with a unique secret and then loading history for the embedded channel ID returned the secret. This violates the isolation guarantee and the stated rule that legacy files are not automatically loaded.

Please use a storage namespace that cannot collide with any legacy flat filename (for example, a separate directory/layout or equivalent unambiguous metadata) and add this collision as a regression test before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix: isolate saved history by Discord channel ID

2 participants