Session switched projects on its own — duplicate session IDs across project directories

[TheophilusChinomona]

Session switched projects on its own — duplicate session IDs across project directories

Summary

With two projects registered in Command Code Desktop, a session spontaneously started referencing the wrong project. No manual project switch was made. Investigation shows the same session IDs exist in both project directories with completely different transcripts, indicating a cross-project session collision.

Environment

• OS: Windows
• App: Command Code Desktop v0.1.22 → v0.1.25 (auto-updated during session window)
• Projects: 2 projects registered ~1 hour apart (Project A and Project B)
• Session where bug was reported: KYLwd2_uwfTpKTw6JyVnr — "Session Switch Bug" (2026-09-03)

Evidence — duplicate session IDs in both project slugs

Sessions are stored per docs as ~/.commandcode/projects/<project-slug>/<session-id>.jsonl (header records cwd). Two IDs exist in both slugs with divergent content:

ID 0OdgweRGWNjtJoVOitaAw

	Project A slug	Project B slug
.meta.json title	Install Agent Browser	Explore Repository
.jsonl header cwd	Project A root	Project B root
header timestamp	2026-09-02T13:27:41Z	2026-09-02T12:41:22Z
first user message	install agent browser	explore AGENTS.md

ID ClB46Yifwhg5QzUo8NIP-

	Project A slug	Project B slug
.meta.json title	Deployment Exploration	Run Project
.jsonl header cwd	Project A root	Project B root
header timestamp	2026-09-03T05:52:54Z	2026-09-02T13:40:13Z
first user message	how is this deployed and working without my env?	run this project

Each duplicate has completely different traceIds sets in the .meta.json, confirming they are different transcripts, not copies.

Also observed placeholder metas with minimal content in both project dirs (27-byte files).

What happened from the user's perspective

"it changed one projects session to another and started referencing the wrong thing. it switched on its own its not something i did"

Reported during session KYLwd2_uwfTpKTw6JyVnr. The transcript shows normal flow until 503 Service temporarily unavailable / 400 name must match ^[a-zA-Z0-9_.-]+$ errors at the same time.

Logs checked

• AppData\Roaming\Command Code\logs\main.log — only startup/updater lines ([thread-index] ready, [updater] checking/up-to-date). No explicit project/session switch entry at bug time.
• AppData\Roaming\Command Code\app-state.json — confirms 2 projects registered, active thread pointed to one project while session files exist in both.

Expected vs actual

• Expected: Session IDs are globally unique; ~/.commandcode/projects/<slug>/ is strictly scoped, picker/resume only shows sessions for the launched cwd.
• Actual: Same ID resolves to two different transcripts on disk; app state collapses both to one projectPath, so resume/references can pick the wrong file and the session appears to "switch projects."

Repro / clues

1. Register two projects (Project B, then Project A ~65 min later).
2. Create sessions in each around 2026-09-02. Observe IDs collide.
3. The newer Project A copy shadows the older Project B copy — unclear if ID generator reused IDs or a copy/migration duplicated files to wrong slug.

Impact

Data integrity — wrong cwd, wrong transcript, potential file edits/checkpoints applied to wrong project.

Suggested fix / next steps

• Ensure session ID generation is globally unique (or namespace by slug) and guard against writing a session with a cwd that doesn't match its slug.
• thread-index.db should enforce (id, projectSlug) uniqueness and surface a conflict instead of silently shadowing.
• Add diagnostic to main.log when a session file is resolved/loaded that logs sessionId + resolved slug + header cwd to make future switches traceable.

---

Teams can reproduce by checking for duplicate <session-id>.jsonl filenames across ~/.commandcode/projects/*/ and comparing their headers/metas. No user-identifying paths needed.

[TheophilusChinomona]

Update: sanitized the body to remove absolute file paths, email, and account-specific IDs. Previous version contained PII — please let me know if GitHub history needs further redaction. Thanks for flagging.