From b6583a379d869cc0bf79f9ac9fe52ceee645128f Mon Sep 17 00:00:00 2001
From: zeroaltitude <zeroaltitude@gmail.com>
Date: Mon, 9 Mar 2026 23:50:44 -0700
Subject: [PATCH] fix: use crypto.randomUUID() for slug generator
 sessionId/runId

Replace Date.now() with crypto.randomUUID() for collision-proof
identifiers under concurrent slug-generation calls. Two separate
Date.now() calls could resolve to the same millisecond in burst
scenarios, causing shared sessionId between concurrent runs.
---
 src/hooks/llm-slug-generator.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/hooks/llm-slug-generator.ts b/src/hooks/llm-slug-generator.ts
index cbfeaf032cf..dd562642ebd 100644
--- a/src/hooks/llm-slug-generator.ts
+++ b/src/hooks/llm-slug-generator.ts
@@ -2,6 +2,7 @@
  * LLM-based slug generator for session memory filenames
  */
 
+import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -59,7 +60,7 @@ Reply with ONLY the slug, nothing else. Examples: "vendor-pitch", "api-design",
     // text is extracted.  Slug generation is pure text — it never needs
     // tool access.
     const result = await runEmbeddedPiAgent({
-      sessionId: `slug-generator-${Date.now()}`,
+      sessionId: `slug-generator-${crypto.randomUUID()}`,
       sessionKey: "temp:slug-generator",
       agentId,
       sessionFile: tempSessionFile,
@@ -71,7 +72,7 @@ Reply with ONLY the slug, nothing else. Examples: "vendor-pitch", "api-design",
       model,
       disableTools: true,
       timeoutMs: 15_000, // 15 second timeout
-      runId: `slug-gen-${Date.now()}`,
+      runId: `slug-gen-${crypto.randomUUID()}`,
     });
 
     // Extract text from payloads