Multiple message request to the same session get the same response #1283

Closed
opened 2026-02-16 17:30:17 -05:00 by yindo · 1 comment
Owner

Originally created by @couryrr on GitHub (Aug 13, 2025).

Originally assigned to: @thdxr on GitHub.

I am not sure what the intention is for the API. I could make the argument that the agent would only manage one message at a time but the tui seems to handle multiple messages.

I can send the below at the same time. Which ever one responds first is the response to both calls.

curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"Spell apple backwards?"}]}'

curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"What is the hostname backwards?"}]}'

This response was particularly confusing. The response to both was both request answers merged.

"parts":[{"id":"prt_8a161ad08001vQ72ar6m1oJDtH","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-start"},{"id":"prt_8a161ad0b001ytM6x5wupqkhax","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"text","text":"emantsoh\nelppa\nelppa","time":{"start":1755054190180,"end":1755054190180}},{"id":"prt_8a161ae79001x6nzjIC58nK8fA","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-finish","tokens":{"input":4,"output":17,"reasoning":0,"cache":{"write":61,"read":23391}},"cost":0}]

The interesting bit is: "emantsoh\nelppa\nelppa"

Not sure if this should be flagged as a security concern but if a user was serving opencode and two user were sharing a session leaking a response from one to the other could be an issue. Probably not an ideal setup though.

Originally created by @couryrr on GitHub (Aug 13, 2025). Originally assigned to: @thdxr on GitHub. I am not sure what the intention is for the API. I could make the argument that the agent would only manage one message at a time but the tui seems to handle multiple messages. I can send the below at the same time. Which ever one responds first is the response to both calls. ``` curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"Spell apple backwards?"}]}' curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"What is the hostname backwards?"}]}' ``` This response was particularly confusing. The response to both was both request answers merged. > "parts":[{"id":"prt_8a161ad08001vQ72ar6m1oJDtH","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-start"},{"id":"prt_8a161ad0b001ytM6x5wupqkhax","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"text","text":"emantsoh\nelppa\nelppa","time":{"start":1755054190180,"end":1755054190180}},{"id":"prt_8a161ae79001x6nzjIC58nK8fA","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-finish","tokens":{"input":4,"output":17,"reasoning":0,"cache":{"write":61,"read":23391}},"cost":0}] The interesting bit is: "emantsoh\nelppa\nelppa" Not sure if this should be flagged as a security concern but if a user was serving opencode and two user were sharing a session leaking a response from one to the other could be an issue. Probably not an ideal setup though.
yindo closed this issue 2026-02-16 17:30:17 -05:00
Author
Owner

@rekram1-node commented on GitHub (Dec 27, 2025):

[automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!

@rekram1-node commented on GitHub (Dec 27, 2025): [automated] Closing due to 90+ days of inactivity. Feel free to reopen if you still need this!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1283