#20204: fix(sessions): allow negative IDs and colon separators in session IDs
size: XS
experienced-contributor
Cluster:
Session Management Enhancements
## Summary
Fixes #20158
Messages sent to Telegram forum topics in groups with negative chat IDs were being silently dropped because the session ID validation regex rejected them.
## Root Cause
`SAFE_SESSION_ID_RE` (`/^[a-z0-9][a-z0-9._-]{0,127}$/i`) required session IDs to start with alphanumeric characters and didn't allow colons. This rejected:
- Negative Telegram IDs: `-1003110470591` (starts with `-`)
- Topic separators: `-1003110470591:91088` (contains `:`)
## Changes
- Allow session IDs to start with `-` for negative Telegram group/channel IDs
- Allow `:` in session IDs for forum topic ID separators
- Added test coverage
---
🤖 Generated with Claude Code
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
This PR fixes session ID validation to support Telegram forum topics in groups with negative chat IDs. The `SAFE_SESSION_ID_RE` regex is updated from `/^[a-z0-9][a-z0-9._-]{0,127}$/i` to `/^-?[a-z0-9][a-z0-9._:-]{0,127}$/i`, allowing an optional leading `-` and `:` as a separator character.
- **`src/config/sessions/paths.ts`**: Regex updated to accept negative Telegram group IDs (e.g., `-1003110470591`) and colon-separated forum topic IDs (e.g., `-1003110470591:91088`). The change is safe — neither `-` nor `:` enables path traversal, and `resolvePathWithinSessionsDir` provides an additional containment check.
- **`src/config/sessions/sessions.test.ts`**: Adds test coverage for the two new accepted formats.
- No issues found. The fix is minimal, well-scoped, and addresses a real bug where Telegram forum topic messages were silently dropped.
<h3>Confidence Score: 5/5</h3>
- This PR is safe to merge — it's a minimal, well-scoped regex fix with no security or path traversal risk.
- The change is a two-character addition to a regex character class plus an optional leading dash. Neither `-` nor `:` enables path traversal, and the downstream path resolution function provides additional containment. The fix addresses a real bug (Telegram forum topic messages being silently dropped) with appropriate test coverage. No issues found.
- No files require special attention.
<sub>Last reviewed commit: 4179f43</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
Most Similar PRs
#16531: fix(sessions): allow WhatsApp-style identifiers in session IDs (#16...
by robbyczgw-cla · 2026-02-14
81.9%
#16061: fix(sessions): tolerate invalid sessionFile metadata
by haoyifan · 2026-02-14
79.6%
#17132: fix: filter out invalid session entries with empty sessionFile
by Limitless2023 · 2026-02-15
78.8%
#3368: fix: sessions navigation, DM thread display, and DM thread delivery...
by Lukavyi · 2026-01-28
77.4%
#15684: fix(telegram): persist relative session transcript paths
by Jdo300 · 2026-02-13
77.2%
#16548: fix(telegram): enhance chat_id validation and diagnostics
by tanujbhaud · 2026-02-14
76.5%
#15176: fix(sessions): allow channel-routed session IDs and cross-agent paths
by cathrynlavery · 2026-02-13
75.8%
#16812: Fix sessions_send failing on Telegram, Discord, Signal, and Slack
by Clawborn · 2026-02-15
75.3%
#22025: fix(telegram): accept colon provider ids in mdl_list callbacks
by lc708 · 2026-02-20
75.3%
#15888: fix: store relative session file paths instead of absolute
by devAnon89 · 2026-02-14
75.3%