address review: require exact cwd match for project-scoped session resume/list

moguangyu5-design · moguangyu5-design · commit a7eced069c9f · 2026-07-01T13:51:06.000+08:00
diff --git a/src/agents/sessions/session-manager.test.ts b/src/agents/sessions/session-manager.test.ts
@@ -2625,4 +2625,48 @@ describe("SessionManager cwd collision guard", () => {
     expect(listA.map((s) => s.path)).toEqual([sessionFileA]);
     expect(listB.map((s) => s.path)).toEqual([sessionFileB]);
   });
+
+  it("ignores cwd-less sessions when resuming or listing for a specific cwd", async () => {
+    const agentDir = await makeTempDir();
+    const cwd = "/home/alice/dev/client/app";
+    const sessionDir = getDefaultSessionDir(cwd, agentDir);
+
+    const matchingFile = path.join(sessionDir, "matching.jsonl");
+    const cwdlessFile = path.join(sessionDir, "cwdless.jsonl");
+
+    await fs.writeFile(
+      matchingFile,
+      `${JSON.stringify(buildSessionHeader(cwd, "matching"))}\n`,
+      "utf8",
+    );
+    await fs.writeFile(
+      cwdlessFile,
+      `${JSON.stringify({
+        type: "session",
+        version: CURRENT_SESSION_VERSION,
+        id: "cwdless",
+        timestamp: "2026-06-18T00:00:00.000Z",
+      })}\n`,
+      "utf8",
+    );
+
+    // Make the cwd-less file strictly newer; without the cwd requirement it
+    // would be picked for the requested cwd.
+    await fs.utimes(
+      matchingFile,
+      new Date("2026-06-18T00:00:00.000Z"),
+      new Date("2026-06-18T00:00:00.000Z"),
+    );
+    await fs.utimes(
+      cwdlessFile,
+      new Date("2026-06-18T00:00:01.000Z"),
+      new Date("2026-06-18T00:00:01.000Z"),
+    );
+
+    expect(findMostRecentSession(sessionDir, { cwd })).toBe(matchingFile);
+    expect(SessionManager.continueRecent(cwd, sessionDir).getSessionFile()).toBe(matchingFile);
+
+    const list = await SessionManager.list(cwd, sessionDir);
+    expect(list.map((s) => s.path)).toEqual([matchingFile]);
+  });
 });
diff --git a/src/agents/sessions/session-manager.ts b/src/agents/sessions/session-manager.ts
@@ -1199,13 +1199,10 @@ function sessionFileMatchesCwd(
   if (!cwd) {
     return true;
   }
-  // Older sessions may not record a cwd; preserve backward compatibility by
-  // treating a missing/empty cwd as a match rather than orphaning them.
-  const headerCwd = header?.cwd;
-  if (!headerCwd) {
-    return true;
-  }
-  return headerCwd === cwd;
+  // Shipped session headers (e.g. v2026.5.28, v2026.6.10) always record cwd,
+  // so project-scoped resume/list requires an exact cwd match. cwd-less files
+  // are not silently adopted as belonging to an arbitrary project.
+  return header?.cwd === cwd;
 }
 
 /** Exported for testing */
@@ -3035,7 +3032,7 @@ export class SessionManager {
     sessions.sort((a, b) => b.modified.getTime() - a.modified.getTime());
     // When the cwd encoder maps multiple cwds to the same directory, only
     // return sessions that actually belong to the requested cwd.
-    return sessions.filter((session) => !session.cwd || session.cwd === cwd);
+    return sessions.filter((session) => session.cwd === cwd);
   }
 
   /**
