JuliusBrussee/caveman · error

invalid native session identity

Error message

invalid native session identity

What it means

Returned by Store.SessionUsage when sessionID fails validEvidenceToken: empty, longer than 256 characters, or containing characters outside [A-Za-z0-9._:-]. Like the evidence query it fails closed — the snapshot comes back with Status 'not_observed' plus the error, and no telemetry is reported for an untrusted identifier.

Source

Thrown at proxy/internal/store/store.go:624

			return nil, err
		}
		out = append(out, item)
	}
	return out, rows.Err()
}

// SessionUsage returns content-blind provider telemetry for one exact correlated
// native session. Dollar values remain catalog list-price subtotals/inferred
// standalone savings; neither is a provider invoice or verified savings.
func (s *Store) SessionUsage(sessionID string) (sessionusage.Snapshot, error) {
	out := sessionusage.Snapshot{
		Status:       "not_observed",
		SessionID:    sessionID,
		CostBasis:    "catalog_list_price_subtotal_provider_complete_priced_rows",
		SavingsBasis: "inferred_standalone_not_verified",
	}
	if !validEvidenceToken(sessionID, 256) {
		return out, fmt.Errorf("invalid native session identity")
	}
	var compressionBases, correlationBases string
	err := s.db.QueryRow(
		`SELECT COUNT(*),
		        COALESCE(SUM(CASE WHEN token_usage_basis = 'provider_complete' THEN 1 ELSE 0 END),0),
		        COALESCE(SUM(input_tokens),0), COALESCE(SUM(output_tokens),0),
		        COALESCE(SUM(cached_input_tokens),0), COALESCE(SUM(cache_creation_input_tokens),0),
		        COALESCE(SUM(reasoning_tokens),0), COALESCE(SUM(total_cost_usd),0),
		        COALESCE(SUM(savings_usd),0), COALESCE(SUM(compression_tokens_before),0),
		        COALESCE(SUM(compression_tokens_after),0),
		        COALESCE(GROUP_CONCAT(DISTINCT NULLIF(compression_token_count_basis,'')),''),
		        COALESCE(GROUP_CONCAT(DISTINCT NULLIF(session_correlation_basis,'')),'')
		   FROM requests WHERE session_id = ?`,
		sessionID,
	).Scan(
		&out.Requests, &out.ProviderCompleteRequests, &out.InputTokens, &out.OutputTokens,
		&out.CachedInputTokens, &out.CacheCreationInputTokens, &out.ReasoningTokens,
		&out.CatalogListPriceSubtotalUSD, &out.InferredSavingsUSD,

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Pass the exact session id the runtime recorded — alphanumeric plus . _ : - only
2. Trim whitespace and strip surrounding quotes from user-supplied ids before calling
3. Reject empty and over-long (>256) ids at the caller boundary
4. Check the error before reading the Snapshot — on failure Status stays 'not_observed' and the numbers are meaningless

Example fix

// before
snap, err := st.SessionUsage(r.URL.Query().Get("session"))

// after
id := strings.TrimSpace(r.URL.Query().Get("session"))
if !validSessionID(id) { http.Error(w, "invalid session id", 400); return }
snap, err := st.SessionUsage(id)
if err != nil { http.Error(w, err.Error(), 400); return }

id = strings.TrimSpace(id)
id = strings.Trim(id, "'\"")
if id == "" || len(id) > 256 { /* reject */ }

func isValidSessionID(s string) bool {
    if s == "" || len(s) > 256 { return false }
    for _, c := range s {
        ok := (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || strings.ContainsRune("._:-", c)
        if !ok { return false }
    }
    return true
}

snap, err := st.SessionUsage(id)
if err != nil {
    if strings.Contains(err.Error(), "invalid native session identity") {
        return fmt.Errorf("session id %q contains disallowed characters; use [A-Za-z0-9._:-] only", id)
    }
    return err
}
if snap.Status == "not_observed" { /* no data, not an error */ }

When it happens

Trigger: Calling SessionUsage with a session id containing spaces, slashes, commas, or quotes; an id taken from an HTTP header without sanitization (it may carry CR/LF or unicode); an empty string; a value longer than 256 chars (e.g. an entire token pasted by mistake).

Common situations: Correlating native sessions where the id originates from user input or logs and includes quoting/whitespace; copy-paste artifacts (curly quotes, trailing newline); passing a provider request id or other free-form string where the caveman session id is expected.

Related errors

• cacheengine: no stable prefix
• cacheengine: invalid scope
• cacheengine: invalid epoch
• history requires memory id
• token budget must be positive, zero (default), or UnlimitedT

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/cf6b2f814786db2c. Report an issue: GitHub.