Let the chat providers know about the conversation/session ID - #674

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The text, multimodal, and audio chat task scheduling methods now add the session ID as a string conversation_id when the corresponding task type declares that optional input. Otherwise, the methods leave the task input unchanged.

Security Blast Radius

• inferred — An authenticated user able to schedule their own chat or title tasks can cause the identifier to reach any supporting text, multimodal, or audio provider. Exposure beyond that user’s conversation depends on provider identity and state scoping, which is not established.

Security Findings and Attack Paths

• inferred — No provider-side data disclosure is verified. A provider that uses conversation_id alone as a retained state key could combine requests that the application treats as distinct, including title and message tasks; provider-side separation is the unresolved condition.

Trust Boundaries and Controls

• observed — Request-controlled session IDs are checked against the authenticated user before these scheduling paths run. The task retains that user ID and the existing scheduling exception handling; optional-input gating checks shape compatibility, not provider conversation ownership.

Resilience and Maintainability Implications

• inferred — Local session deletion removes session and message records but shows no provider-conversation cleanup. Whether deletion, cancellation, retries, or concurrent tasks can leave or reuse remote state depends on provider and Task Processing behavior not available here.

Hardening Proposals

• proposed — Confirm the consuming providers’ user, deployment, and task-purpose namespacing and conversation-state lifecycle before relying on session ID as their conversation key; if they do not provide those guarantees, use a suitably scoped identifier and define cleanup behavior.

• X
• Mastodon
• Reddit
• LinkedIn