fix(resume): isolate resume store keys by cwd hash to prevent cross-session contamination

src/backend/resume-store.ts

@@ -1,12 +1,14 @@
-// src/backend/resume-store.ts — file-backed sessionKey → backendSessionId, per backend (SPEC-3 §2.4, §4.3).
+// src/backend/resume-store.ts — file-backed sessionKey -> backendSessionId, per backend (SPEC-3 §2.4, §4.3).
+// Hardened against cross-session/cross-cwd result contamination (#102).
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { createHash } from "node:crypto";
 
 function rootDir(): string {
   return process.env.FLEET_RESUME_ROOT ?? join(process.env.HOME ?? "/tmp", ".pi", "agent", "cache", "fleet-resume");
 }
 
-/** Per-backend JSON map: { [sessionKey]: backendSessionId }. */
+/** Per-backend JSON map: { [scopedKey]: backendSessionId }. */
 function fileFor(backendId: string): string {
   return join(rootDir(), `${backendId}.json`);
 }
@@ -28,17 +30,35 @@ function writeMap(backendId: string, m: Record<string, string>): void {
 }
 
 export class ResumeStore {
-  get(backendId: string, sessionKey: string): string | null {
-    return readMap(backendId)[sessionKey] ?? null;
+  private readonly defaultCwd?: string;
+
+  constructor(defaultCwd?: string) {
+    this.defaultCwd = defaultCwd;
+  }
+
+  private scopeKey(sessionKey: string, cwd?: string): string {
+    const activeCwd = cwd ?? this.defaultCwd;
+    if (!activeCwd) return sessionKey;
+    const cwdHash = createHash("sha256").update(activeCwd).digest("hex").slice(0, 12);
+    return `${cwdHash}:${sessionKey}`;
+  }
+
+  get(backendId: string, sessionKey: string, cwd?: string): string | null {
+    const key = this.scopeKey(sessionKey, cwd);
+    return readMap(backendId)[key] ?? null;
   }
-  set(backendId: string, sessionKey: string, backendSessionId: string): void {
+
+  set(backendId: string, sessionKey: string, backendSessionId: string, cwd?: string): void {
+    const key = this.scopeKey(sessionKey, cwd);
     const m = readMap(backendId);
-    m[sessionKey] = backendSessionId;
+    m[key] = backendSessionId;
     writeMap(backendId, m);
   }
-  clear(backendId: string, sessionKey: string): void {
+
+  clear(backendId: string, sessionKey: string, cwd?: string): void {
+    const key = this.scopeKey(sessionKey, cwd);
     const m = readMap(backendId);
-    delete m[sessionKey];
+    delete m[key];
     writeMap(backendId, m);
   }
-}
+}

test/resume-store.test.mts

@@ -37,4 +37,16 @@ test("persists across instances (file-backed)", () => {
   s1.set("claude", "foo", "sess-1");
   const s2 = new ResumeStore();   // re-reads the file
   strictEqual(s2.get("claude", "foo"), "sess-1");
-});
+});
+test("isolates sessionKey resume when different cwds are provided (#102)", () => {
+  delete process.env.FLEET_RESUME_ROOT;
+  const s = new ResumeStore();
+  const cwdA = "/Users/rector/local-dev/armory-fleet";
+  const cwdB = "/Users/rector/local-dev/bug-bounty/hunts/layerzero";
+
+  s.set("claude", "general-purpose", "sess-alpha", cwdA);
+  s.set("claude", "general-purpose", "sess-beta", cwdB);
+
+  strictEqual(s.get("claude", "general-purpose", cwdA), "sess-alpha");
+  strictEqual(s.get("claude", "general-purpose", cwdB), "sess-beta");
+});