feat(session-manager): add session_rename tool

[moha-abdi]

Summary

Add session_rename tool to the session-manager.

The session-manager already provides session_list, session_read, session_search, and session_info tools for reading session data. However, renaming a session currently requires manual intervention through the TUI (Ctrl+R in session list). This adds session_rename to complete the toolset, allowing the LLM to rename sessions programmatically without user interaction.

What This Does

• Adds session_rename tool that updates the title field in session metadata JSON files
• Defaults to current session when session_id is not provided
• Instructs the LLM to auto-generate descriptive titles from conversation context when user doesn't specify one
• Displays session titles in session_list and session_info outputs

Files Changed

File	Change
types.ts	Add SessionRenameArgs interface
constants.ts	Add SESSION_RENAME_DESCRIPTION with LLM instructions
storage.ts	Add findSessionMetadataPath, renameSession, getSessionTitle
tools.ts	Implement session_rename tool
utils.ts	Display title in formatSessionList and formatSessionInfo
index.ts	Export session_rename in builtinTools

Testing

Full TDD approach with BDD comments.

bun run typecheck  # passes
bun run build      # succeeds
bun test           # 92 tests pass

Usage

// With explicit title
session_rename(new_title="Auth Implementation")

// With explicit session
session_rename(session_id="ses_abc123", new_title="New Title")

// User says "rename this session" without title
// LLM analyzes conversation context and generates appropriate title

---

Summary by cubic

Add a session_rename tool to rename sessions programmatically and surface titles in session_list and session_info. It defaults to the current session, validates titles to prevent TUI crashes, and guides the model to auto-generate a descriptive title when the user doesn’t provide one.

• New Features

  • Added session_rename with new_title and optional session_id (falls back to current session).
  • Titles now shown in session_list and session_info.
  • Storage helpers: findSessionMetadataPath and renameSession; internal getSessionTitle for info display.
  • Tests cover rename tool and storage behavior.

• Bug Fixes

  • Prevent TUI crash by rejecting empty titles at the tool layer.
  • Storage preserves the existing title if an empty string slips through.
  • Graceful handling for missing sessions, invalid JSON, and FS errors.

^{Written for commit a326de8. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 8 files

Confidence score: 2/5

• Unvalidated sessionID used to build metadata paths in src/tools/session-manager/storage.ts allows path traversal outside SESSION_STORAGE, a concrete security and data-integrity risk.
• The test in src/tools/session-manager/tools.test.ts performs real filesystem writes via session_rename, which can mutate local session metadata and cause flaky or corrupting test runs.
• Given the security-impacting path traversal risk (severity 7/10), this change is high risk without additional validation/guards.
• Pay close attention to src/tools/session-manager/storage.ts and src/tools/session-manager/tools.test.ts - path traversal protection and test isolation.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/tools/session-manager/tools.test.ts">

<violation number="1" location="src/tools/session-manager/tools.test.ts:130">
P2: Test invokes session_rename which performs real filesystem writes without isolation; if a matching session exists locally, the test mutates real session metadata and can be flaky or corrupt developer data.</violation>
</file>

<file name="src/tools/session-manager/storage.ts">

<violation number="1" location="src/tools/session-manager/storage.ts:265">
P1: Unvalidated sessionID is used to build metadata paths, enabling path traversal outside SESSION_STORAGE when user-provided session_id contains "../" or path separators.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Unvalidated sessionID is used to build metadata paths, enabling path traversal outside SESSION_STORAGE when user-provided session_id contains "../" or path separators.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/tools/session-manager/storage.ts, line 265:

<comment>Unvalidated sessionID is used to build metadata paths, enabling path traversal outside SESSION_STORAGE when user-provided session_id contains "../" or path separators.</comment>

<file context>
@@ -232,7 +247,49 @@ export async function getSessionInfo(sessionID: string): Promise<SessionInfo | n
+      if (!projectDir.isDirectory()) continue
+
+      const projectPath = join(SESSION_STORAGE, projectDir.name)
+      const sessionFile = `${sessionID}.json`
+      const sessionPath = join(projectPath, sessionFile)
+
</file context>

[cubic-dev-ai]

P2: Test invokes session_rename which performs real filesystem writes without isolation; if a matching session exists locally, the test mutates real session metadata and can be flaky or corrupt developer data.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/tools/session-manager/tools.test.ts, line 130:

<comment>Test invokes session_rename which performs real filesystem writes without isolation; if a matching session exists locally, the test mutates real session metadata and can be flaky or corrupt developer data.</comment>

<file context>
@@ -121,4 +121,62 @@ describe("session-manager tools", () => {
+    const args = { session_id: "ses_nonexistent", new_title: "New Title" }
+    
+    //#when executing rename
+    const result = await session_rename.execute(args, mockContext)
+    
+    //#then returns error message
</file context>