fix(sessions): make session path encoding injective and verify cwd on resume (#96542)

maweibin · claude · maweibin · commit 1e886d4b2ee7 · 2026-06-25T13:03:39.000+08:00
getDefaultSessionDir replaces path separators with '-' which means
"client/app" and "client-app" produce identical encoded paths, causing
session cross-contamination. Fix: use percent-encoding (%2F/%5C/%3A)
to distinguish separators from literal hyphens.

Also add cwd verification in continueRecent so that if a session file
from a colliding directory is found, the code scans remaining files for
one matching the requested cwd before falling back to a fresh session.

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/src/agents/sessions/session-manager.ts b/src/agents/sessions/session-manager.ts
@@ -437,7 +437,10 @@ export function buildSessionContext(
  * Encodes cwd into a safe directory name under ~/.openclaw/agent/sessions/.
  */
 export function getDefaultSessionDir(cwd: string, agentDir: string = getDefaultAgentDir()): string {
-  const safePath = `--${cwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")}--`;
+  const safePath = `--${cwd
+    .replace(/^[/\\]/, "")
+    .replace(/%/g, "%25")
+    .replace(/[/\\:]/g, (c) => (c === "/" ? "%2F" : c === "\\" ? "%5C" : "%3A"))}--`;
   const sessionDir = join(agentDir, "sessions", safePath);
   if (!existsSync(sessionDir)) {
     mkdirSync(sessionDir, { recursive: true });
@@ -1200,6 +1203,35 @@ export function findMostRecentSession(sessionDir: string): string | null {
   }
 }
 
+function readSessionCwd(filePath: string): string | undefined {
+  try {
+    const firstLine = readFirstSessionFileLine(filePath);
+    if (!firstLine) {
+      return undefined;
+    }
+    const parsed = JSON.parse(firstLine);
+    return parsed.type === "session" ? parsed.cwd : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function findMostRecentSessionByCwd(sessionDir: string, cwd: string): string | null {
+  try {
+    const normalizedCwd = resolve(cwd);
+    const files = readdirSync(sessionDir)
+      .filter((f) => f.endsWith(".jsonl"))
+      .map((f) => join(sessionDir, f))
+      .filter(isValidSessionFile)
+      .map((path) => ({ path, mtime: statSync(path).mtime, sessionCwd: readSessionCwd(path) }))
+      .filter((f) => f.sessionCwd !== undefined && resolve(f.sessionCwd) === normalizedCwd)
+      .toSorted((a, b) => b.mtime.getTime() - a.mtime.getTime());
+    return files[0]?.path || null;
+  } catch {
+    return null;
+  }
+}
+
 function isMessageWithContent(message: AgentMessage): message is Message {
   return typeof (message as Message).role === "string" && "content" in message;
 }
@@ -2923,7 +2955,14 @@ export class SessionManager {
     const dir = sessionDir ?? getDefaultSessionDir(cwd);
     const mostRecent = findMostRecentSession(dir);
     if (mostRecent) {
-      return new SessionManager(cwd, dir, mostRecent, true);
+      const sessionCwd = readSessionCwd(mostRecent);
+      if (sessionCwd !== undefined && resolve(sessionCwd) === resolve(cwd)) {
+        return new SessionManager(cwd, dir, mostRecent, true);
+      }
+      const cwdMatch = findMostRecentSessionByCwd(dir, cwd);
+      if (cwdMatch) {
+        return new SessionManager(cwd, dir, cwdMatch, true);
+      }
     }
     return new SessionManager(cwd, dir, undefined, true);
   }
