Multiple message request to the same session get the same response #1895

I am not sure what the intention is for the API. I could make the argument that the agent would only manage one message at a time but the tui seems to handle multiple messages.

I can send the below at the same time. Which ever one responds first is the response to both calls.

curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"Spell apple backwards?"}]}'

curl --request POST http://127.0.0.1:4096/session/<some_session>/message -H "Content-Type: application/json" --data '{"providerID": "anthropic","modelID": "claude-sonnet-4-20250514","parts": [{"type":"text", "text":"What is the hostname backwards?"}]}'

This response was particularly confusing. The response to both was both request answers merged.

"parts":[{"id":"prt_8a161ad08001vQ72ar6m1oJDtH","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-start"},{"id":"prt_8a161ad0b001ytM6x5wupqkhax","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"text","text":"emantsoh\nelppa\nelppa","time":{"start":1755054190180,"end":1755054190180}},{"id":"prt_8a161ae79001x6nzjIC58nK8fA","messageID":"msg_8a161a5e4001ahW3A3tc8BOs21","sessionID":"ses_7730632a0ffesG04EJ1MIehKTE","type":"step-finish","tokens":{"input":4,"output":17,"reasoning":0,"cache":{"write":61,"read":23391}},"cost":0}]

The interesting bit is: "emantsoh\nelppa\nelppa"

Not sure if this should be flagged as a security concern but if a user was serving opencode and two user were sharing a session leaking a response from one to the other could be an issue. Probably not an ideal setup though.