gemini-cli - 💡(How to fix) Fix Session ID Collision Risk in SDK [3 comments, 3 participants]

What happened?

The SDK generates session IDs using createSessionId() but does not verify if a session with that ID already exists in storage before proceeding.

What did you expect to happen?

The SDK should check for collisions or use a high-entropy UUID (which createSessionId likely does, but a check is safer).

Client Information

<details> <summary>Client Information</summary>

OS: linux Date: Sunday, May 10, 2026 Gemini CLI: 0.42.0-nightly

</details>

Login information

Automated audit with Gemini CLI.

Anything else we need to know?

File: packages/sdk/src/agent.ts, Lines 56. While statistically unlikely with UUIDs, it can lead to silent data overwrites if a collision occurs.

Severity: Low Area: area/non-interactive