Struct ProviderSessionId 

pub struct ProviderSessionId(/* private fields */);

A provider’s own name for its conversation — an external correlation id, never the episode’s identity.

It is how a provider’s hook finds the episode it opened: the hook passes --provider-session <x>, the open record lives at state/sessions-open/<key of x>.yaml, and an end event for x closes that episode and no other. That is the whole of its job.

It is not the session identity, for three reasons that are each a measured incident rather than a worry. An episode opened by hand has no provider session at all and is keyed hand, so the identity would be missing for the one episode a person opens. Two providers may name their sessions in the same shape, so the value is unique only within a provider. And the value changes under the worker: on 2026-09-09 a session in this repository was re-established, came back under a different peer identity, and was invisible to eight others for three hours because a durable thing had been keyed by a value that is not.

The stored key is reduced to one path segment so that nothing a provider sends can name a file outside the store.

use majordomus_cli::session::ProviderSessionId;

let p = ProviderSessionId::new("01Bv2gJsfAoYrXnpfC9uJ4uv");
assert_eq!(p.store_key(), "01Bv2gJsfAoYrXnpfC9uJ4uv");

// anything that could leave the store becomes an inert segment
assert_eq!(ProviderSessionId::new("../../etc/passwd").store_key(), ".._.._etc_passwd");
assert_eq!(ProviderSessionId::new("a/b").store_key(), "a_b");

// and a segment made only of dots is not a directory: `.` and `..` survive an
// allow-list that permits a dot, so the segment is what is checked, not the bytes
assert_eq!(ProviderSessionId::new("..").store_key(), "_..");
assert_eq!(ProviderSessionId::new(".").store_key(), "_.");

// an episode nobody named is the hand-opened one, and there is at most one
assert_eq!(ProviderSessionId::hand().store_key(), "hand");
assert!(ProviderSessionId::hand().is_hand());
assert!(ProviderSessionId::new("   ").is_hand(), "a blank name names nobody");

Implementations

impl ProviderSessionId

pub fn new(value: impl Into<String>) -> Self

The provider’s own string, as sent. Nothing about its shape is assumed: it is a provider’s private identifier, and this type’s job is to stop it being used as an episode identity rather than to validate it.

use majordomus_cli::session::ProviderSessionId;
assert_eq!(ProviderSessionId::new("01Bv2gJsf").as_str(), "01Bv2gJsf");

pub fn hand() -> Self

The episode nobody named: a provider that sends no session identity is indistinguishable from a person at a terminal, and inventing a distinction there would multiply episodes nobody can close.

use majordomus_cli::session::ProviderSessionId;
assert!(ProviderSessionId::hand().is_hand());
assert_eq!(ProviderSessionId::hand().store_key(), "hand");

pub fn is_hand(&self) -> bool

Is this the hand-opened episode’s key? True for an empty or blank value. A provider that sends whitespace has named nobody just as surely as one that sends nothing, so both are the hand-opened episode.

use majordomus_cli::session::ProviderSessionId;
assert!(ProviderSessionId::new(" \t ").is_hand());
assert!(!ProviderSessionId::new("01Bv2gJsf").is_hand());

pub fn as_str(&self) -> &str

The value as sent, which is what a record carries and what a hook passes back. Not the file name: ProviderSessionId::store_key is that, and the two differ exactly when the provider sent something a path segment may not contain.

use majordomus_cli::session::ProviderSessionId;
let p = ProviderSessionId::new("a/b");
assert_eq!(p.as_str(), "a/b");
assert_ne!(p.as_str(), p.store_key());

pub fn store_key(&self) -> String

The value reduced to exactly one path segment, for the file the open record lives in. Every byte outside A-Za-z0-9._- becomes _; the blank value becomes hand.

A value made only of dots gets a _ in front of it. . and .. survive an allow-list that permits a dot — they are made of nothing else — and both name a directory rather than a file in it. The test that found this is in this module: an allow-list is a claim about bytes, and the claim that has to hold is about the segment.

use majordomus_cli::session::ProviderSessionId;
assert_eq!(ProviderSessionId::new("01Bv2gJsf").store_key(), "01Bv2gJsf");
assert!(!ProviderSessionId::new("../etc/passwd").store_key().contains('/'));

Trait Implementations

impl Clone for ProviderSessionId

fn clone(&self) -> ProviderSessionId

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProviderSessionId

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProviderSessionId

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ProviderSessionId

impl Hash for ProviderSessionId

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl JsonSchema for ProviderSessionId

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Ord for ProviderSessionId

fn cmp(&self, other: &ProviderSessionId) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for ProviderSessionId

fn eq(&self, other: &ProviderSessionId) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for ProviderSessionId

fn partial_cmp(&self, other: &ProviderSessionId) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for ProviderSessionId

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProviderSessionId