fix(backend): resolve issue with concurrent agent-session creation

components/backend/handlers/oauth.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -440,7 +441,7 @@ func exchangeOAuthCode(ctx context.Context, provider *OAuthProvider, code string
 func storeOAuthCallback(ctx context.Context, state string, data *OAuthCallbackData) error {
 	if state == "" {
 		// Generate a default key if no state provided
-		state = fmt.Sprintf("callback_%d", time.Now().Unix())
+		state = fmt.Sprintf("callback_%s", uuid.New().String())
 	}
 
 	const secretName = "oauth-callbacks"

components/backend/handlers/permissions.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	authnv1 "k8s.io/api/authentication/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -389,8 +390,8 @@ func CreateProjectKey(c *gin.Context) {
 	}
 
 	// Create a dedicated ServiceAccount per key
-	ts := time.Now().Unix()
-	saName := fmt.Sprintf("ambient-key-%s-%d", sanitizeName(req.Name), ts)
+	uid := uuid.New().String()[:8]
+	saName := fmt.Sprintf("ambient-key-%s-%s", sanitizeName(req.Name), uid)
 	sa := &corev1.ServiceAccount{
 		ObjectMeta: v1.ObjectMeta{
 			Name:      saName,
@@ -412,7 +413,7 @@ func CreateProjectKey(c *gin.Context) {
 	}
 
 	// Bind the SA to the selected role via RoleBinding
-	rbName := fmt.Sprintf("ambient-key-%s-%s-%d", role, sanitizeName(req.Name), ts)
+	rbName := fmt.Sprintf("ambient-key-%s-%s-%s", role, sanitizeName(req.Name), uid)
 	rb := &rbacv1.RoleBinding{
 		ObjectMeta: v1.ObjectMeta{
 			Name:      rbName,

components/backend/handlers/scheduled_sessions.go

@@ -13,6 +13,7 @@ import (
 	"ambient-code-backend/types"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	authzv1 "k8s.io/api/authorization/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -141,8 +142,7 @@ func CreateScheduledSession(c *gin.Context) {
 		}
 	}
 
-	timestamp := time.Now().Unix()
-	name := fmt.Sprintf("schedule-%d", timestamp)
+	name := fmt.Sprintf("schedule-%s", uuid.New().String())
 
 	// Inject display name into session template so the trigger can use it for naming
 	if req.DisplayName != "" && req.SessionTemplate.DisplayName == "" {
@@ -431,7 +431,7 @@ func TriggerScheduledSession(c *gin.Context) {
 		return
 	}
 
-	jobName := fmt.Sprintf("%s-manual-%d", name, time.Now().Unix())
+	jobName := fmt.Sprintf("%s-manual-%s", name, uuid.New().String()[:8])
 	job := &batchv1.Job{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      jobName,

components/backend/handlers/sessions.go

@@ -24,6 +24,7 @@ import (
 	"ambient-code-backend/types"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	authnv1 "k8s.io/api/authentication/v1"
 	authzv1 "k8s.io/api/authorization/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -695,10 +696,9 @@ func CreateSession(c *gin.Context) {
 		timeout = *req.Timeout
 	}
 
-	// Generate unique name (timestamp-based)
+	// Generate unique name (UUID-based)
 	// Note: Runner will create branch as "ambient/{session-name}"
-	timestamp := time.Now().Unix()
-	name := fmt.Sprintf("session-%d", timestamp)
+	name := fmt.Sprintf("session-%s", uuid.New().String())
 
 	// Create the custom resource
 	// Metadata

components/backend/handlers/sessions_test.go

@@ -328,13 +328,8 @@ var _ = Describe("Sessions Handler", Label(test_constants.LabelUnit, test_consta
 
 				sessionNames := make([]string, 0)
 
-				// Create multiple sessions with delays to ensure unique timestamps
+				// Create multiple sessions concurrently - UUID-based names ensure uniqueness
 				for i := 0; i < 3; i++ {
-					// Add a delay to ensure unique timestamps (Unix() has 1-second precision)
-					if i > 0 {
-						time.Sleep(1001 * time.Millisecond) // Slightly over 1 second to ensure different Unix timestamps
-					}
-
 					context := httpUtils.CreateTestGinContext("POST", "/api/projects/"+testNamespace+"/agentic-sessions", sessionRequest)
 					httpUtils.SetAuthHeader(testToken)
 					httpUtils.SetProjectContext(testNamespace)