Yeachan-Heo/oh-my-codex · error · Error

session_id must match ^[A-Za-z0-9_-]{1,64}$

Error message

session_id must match ^[A-Za-z0-9_-]{1,64}$

What it means

Thrown when session_id is a string but does not match ^[A-Za-z0-9_-]{1,64}$ — only alphanumerics, underscore and hyphen, at most 64 chars. The pattern exists because session IDs become filesystem path segments in state directories.

Source

Thrown at src/mcp/state-paths.ts:124

export interface ModeStateFileRef {
  mode: string;
  path: string;
  scope: StateFileScope;
}

export function normalizeSessionId(sessionId: unknown): string | undefined {
  if (typeof sessionId !== 'string') return undefined;
  const normalized = sessionId.trim();
  return SESSION_ID_PATTERN.test(normalized) ? normalized : undefined;
}

export function validateSessionId(sessionId: unknown): string | undefined {
  if (sessionId == null) return undefined;
  if (typeof sessionId !== 'string') {
    throw new Error('session_id must be a string');
  }
  if (!SESSION_ID_PATTERN.test(sessionId)) {
    throw new Error('session_id must match ^[A-Za-z0-9_-]{1,64}$');
  }
  return sessionId;
}


export function validateStateModeSegment(mode: unknown): string {
  if (typeof mode !== 'string') {
    throw new Error('mode must be a string');
  }
  const normalized = mode.trim();
  if (!normalized) {
    throw new Error('mode must be a non-empty string');
  }
  if (normalized.includes('..')) {
    throw new Error('mode must not contain ".."');
  }
  if (normalized.includes('/') || normalized.includes('\\')) {
    throw new Error('mode must not contain path separators');

View on GitHub (pinned to 3ad79a8a6f)

Solutions

1. Sanitize the ID: strip/replace characters outside [A-Za-z0-9_-]
2. Truncate or hash long IDs to <=64 chars
3. Generate IDs as hex/hyphenated tokens (crypto.randomUUID() passes)

Example fix

// before
validateSessionId("sess.#01/abc");
// after
validateSessionId("sess-01-abc");

const SESSION_ID = /^[A-Za-z0-9_-]{1,64}$/;
if (!SESSION_ID.test(sessionId)) sessionId = sessionId.replace(/[^A-Za-z0-9_-]/g, '').slice(0, 64);

function isValidSessionId(v: string): boolean { return /^[A-Za-z0-9_-]{1,64}$/.test(v); }

When it happens

Trigger: session_id containing dots, slashes, spaces, or unicode ("sess.1", "abc/def"); IDs longer than 64 characters (e.g. full UUIDs with braces or nano-style IDs plus prefix exceeding 64).

Common situations: Using UUIDs with dashes is fine, but including curly braces or dots fails; concatenating run metadata into the ID pushing past 64 chars; copy-paste introducing whitespace.

Related errors

• session_id must be a string
• mode must match ^[A-Za-z0-9_-]{1,64}$
• Conflicting setup MCP mode flags: ${source} selects ${next},
• Invalid setup MCP mode: ${next}. Expected one of: none, comp
• Missing setup MCP mode value after --mcp. Expected one of: n

AI-assisted analysis of Yeachan-Heo/oh-my-codex@3ad79a8a6f (2026-08-27). Data as JSON: /api/errors/57ea549943a4fc43. Report an issue: GitHub.