fix(cli): use random UUID for WS session ID, not sessionKey

The WebSocket URL path segment is a browser connection identifier,
not the chat sessionKey. The sessionKey goes in message payloads.

Author: Daniel-Robbins

packages/cli/src/commands/chat.ts

@@ -64,10 +64,12 @@ export const chatCmd = new Command("chat")
         }
       }
 
-      // Build WS URL
+      // Build WS URL — sessionId in the URL is a random browser session identifier,
+      // NOT the chat sessionKey. The sessionKey goes in the message payload.
+      const wsSessionId = randomUUID();
       const wsProtocol = cfg.url.startsWith("https") ? "wss" : "ws";
       const wsHost = cfg.url.replace(/^https?:\/\//, "");
-      const wsUrl = `${wsProtocol}://${wsHost}/api/ws/${cfg.userId}/${encodeURIComponent(sessionId!)}`;
+      const wsUrl = `${wsProtocol}://${wsHost}/api/ws/${cfg.userId}/${wsSessionId}`;
 
       const timeoutMs = parseFloat(opts.timeout) * 1000;
 

packages/plugin/bin/botschat-cli.mjs

@@ -1149,9 +1149,10 @@ var chatCmd = new Command9("chat").description("Chat with an AI agent").argument
         updateConfig({ defaultSession: sessionId });
       }
     }
+    const wsSessionId = randomUUID3();
     const wsProtocol = cfg.url.startsWith("https") ? "wss" : "ws";
     const wsHost = cfg.url.replace(/^https?:\/\//, "");
-    const wsUrl = `${wsProtocol}://${wsHost}/api/ws/${cfg.userId}/${encodeURIComponent(sessionId)}`;
+    const wsUrl = `${wsProtocol}://${wsHost}/api/ws/${cfg.userId}/${wsSessionId}`;
     const timeoutMs = parseFloat(opts.timeout) * 1e3;
     if (interactive) {
       await runInteractive(wsUrl, sessionId, opts.agent, cfg.userId);