fix(cli): resume older working-directory sessions in /sessions and --continue

.changeset/session-workdir-resume-fix.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Restore older working-directory sessions in `/sessions` and `kimi --continue`.

apps/kimi-code/src/cli/v2/run-v2-print.ts

@@ -14,6 +14,7 @@
  *     `exit` / `drain` / `steer`) before exiting.
  */
 
+import { realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 
 import {
@@ -456,12 +457,32 @@ async function resolveNativeSession(
     return previous;
   };
 
+  function normalizePathForComparison(p: string): string {
+    try {
+      return realpathSync.native(p);
+    } catch {
+      return resolve(p);
+    }
+  }
+
+  function compareNormalizedPaths(a: string, b: string): boolean {
+    return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+  }
+
+  function isSamePath(a: string, b: string): boolean {
+    return compareNormalizedPaths(normalizePathForComparison(a), normalizePathForComparison(b));
+  }
+
   if (opts.session !== undefined) {
     const target = await index.get(opts.session);
     if (target === undefined) {
       throw new Error(`Session "${opts.session}" not found.`);
     }
-    if (target.cwd !== undefined && resolve(target.cwd) !== resolve(workDir)) {
+    if (
+      typeof target.cwd === 'string' &&
+      target.cwd.length > 0 &&
+      !isSamePath(target.cwd, workDir)
+    ) {
       stderr.write(
         `Session "${opts.session}" was created under a different directory.\n` +
           `  cd "${target.cwd}" && kimi -r ${opts.session}\n\n`,
@@ -487,7 +508,13 @@ async function resolveNativeSession(
 
   if (opts.continue) {
     const page = await index.listRecent({});
-    const previous = page.items.find((summary) => summary.cwd === workDir);
+    const normalizedWorkDir = normalizePathForComparison(workDir);
+    const previous = page.items.find(
+      (summary) =>
+        typeof summary.cwd === 'string' &&
+        summary.cwd.length > 0 &&
+        compareNormalizedPaths(normalizePathForComparison(summary.cwd), normalizedWorkDir),
+    );
     if (previous !== undefined) {
       const session = await resumeById(previous.id);
       const agentContext = await ensureMainAgent(session);

packages/agent-core-v2/src/app/sessionIndex/sessionIndex.ts

@@ -70,3 +70,14 @@ export interface ISessionIndexMirror {
 
 export const ISessionIndexMirror: ServiceIdentifier<ISessionIndexMirror> =
   createDecorator<ISessionIndexMirror>('sessionIndexMirror');
+
+export function isSafeSessionId(id: string): boolean {
+  return (
+    Boolean(id) &&
+    id !== '.' &&
+    id !== '..' &&
+    !id.includes('/') &&
+    !id.includes('\\') &&
+    !id.includes('\0')
+  );
+}

packages/agent-core-v2/src/app/sessionIndex/sessionIndexService.ts

@@ -1,3 +1,4 @@
+import { isAbsolute, relative } from 'node:path';
 import { Disposable } from '#/_base/di/lifecycle';
 import { LifecycleScope } from '#/app/scopes';
 import { ScopeActivation, registerScopedService } from '#/_base/di/scope';
@@ -30,6 +31,7 @@ import {
   ISessionIndex,
   ISessionIndexMirror,
   PARENT_SESSION_ID_KEY,
+  isSafeSessionId,
   type SessionCountQuery,
   type SessionIndexStatus,
   type SessionIndexState,
@@ -73,7 +75,9 @@ function isSessionSummaryShape(value: unknown): value is SessionSummary {
     typeof summary['workspaceId'] === 'string' &&
     typeof summary['createdAt'] === 'number' &&
     typeof summary['updatedAt'] === 'number' &&
-    typeof summary['archived'] === 'boolean'
+    typeof summary['archived'] === 'boolean' &&
+    (summary['cwd'] === undefined ||
+      (typeof summary['cwd'] === 'string' && summary['cwd'].length > 0))
   );
 }
 
@@ -339,6 +343,7 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
   }
 
   async get(id: string): Promise<SessionSummary | undefined> {
+    if (!isSafeSessionId(id)) return undefined;
     return this.withReadModel(
       (generation) => this.getFromReadModel(generation, id),
       () => this.getLegacy(id),
@@ -347,7 +352,20 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
 
   async listRecent(query: SessionListQuery): Promise<Page<SessionSummary>> {
     return this.withReadModel(
-      (generation) => this.listRecentFromReadModel(generation, query),
+      async (generation) => {
+        const page = await this.listRecentFromReadModel(generation, query);
+        if (page.items.length === 0 && query.workspaceIds !== undefined) {
+          const cursorId = query.before ?? query.after;
+          if (cursorId !== undefined) {
+            if (!isSafeSessionId(cursorId)) return page;
+            const cursor = await this.get(cursorId);
+            if (cursor === undefined) return page;
+          }
+          const legacy = await this.listLegacy(query);
+          if (legacy.items.length > 0) return legacy;
+        }
+        return page;
+      },
       () => this.listLegacy(query),
     );
   }
@@ -535,6 +553,7 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
       .pending()
       .filter(
         (summary) =>
+          (position === undefined || summary.id !== position.id) &&
           (query.workspaceIds === undefined || query.workspaceIds.includes(summary.workspaceId)) &&
           (query.includeArchived === true || !summary.archived) &&
           summaryMatchesChildOf(summary, query.childOf) &&
@@ -545,10 +564,10 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
               : summary.updatedAt > position.u ||
                 (summary.updatedAt === position.u && summary.id > position.id))),
       );
-    if (pending.length === 0) return page;
     const merged = new Map<string, SessionSummary>();
     for (const summary of pending) merged.set(summary.id, summary);
     for (const summary of page.items) {
+      if (position !== undefined && summary.id === position.id) continue;
       if (!merged.has(summary.id)) merged.set(summary.id, summary);
     }
     const items = [...merged.values()].toSorted(canonicalOrder);
@@ -567,11 +586,36 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
   > {
     const id = query.before ?? query.after;
     if (id === undefined) return { filter: {}, bounds: {} };
+    if (!isSafeSessionId(id)) return undefined;
+    let u: number | undefined;
     const storedValue: unknown = await this.queryStore.get(sessionCollection(generation), id);
-    const stored = isSessionSummaryShape(storedValue) ? storedValue : undefined;
-    const cursor = stored ?? this.mirror.pending().find((summary) => summary.id === id);
-    if (cursor === undefined) return undefined;
-    const u = cursor.updatedAt;
+    const storedUpdatedAt =
+      storedValue !== null &&
+      typeof storedValue === 'object' &&
+      typeof (storedValue as Record<string, unknown>)['updatedAt'] === 'number'
+        ? ((storedValue as Record<string, unknown>)['updatedAt'] as number)
+        : undefined;
+
+    if (storedUpdatedAt !== undefined) {
+      u = storedUpdatedAt;
+      if (!isSessionSummaryShape(storedValue)) {
+        const summary =
+          this.mirror.pending().find((item) => item.id === id) ??
+          (await this.getLegacy(id));
+        if (summary !== undefined) {
+          this.mirror.record(summary);
+        }
+      }
+    } else {
+      const summary =
+        this.mirror.pending().find((item) => item.id === id) ??
+        (await this.getLegacy(id));
+      if (summary !== undefined) {
+        this.mirror.record(summary);
+        u = summary.updatedAt;
+      }
+    }
+    if (u === undefined) return undefined;
     if (query.before !== undefined) {
       return {
         bounds: { lte: u },
@@ -618,6 +662,7 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
 
   private async listLegacy(query: SessionListQuery): Promise<Page<SessionSummary>> {
     if (query.sessionId !== undefined) {
+      if (!isSafeSessionId(query.sessionId)) return { items: [] };
       const summary = await this.getLegacy(query.sessionId);
       const items =
         summary !== undefined && (!summary.archived || query.includeArchived === true)
@@ -652,8 +697,9 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
   }
 
   private async getLegacy(id: string): Promise<SessionSummary | undefined> {
+    if (!isSafeSessionId(id)) return undefined;
     const hinted = await this.workspaceHintFor(id);
-    if (hinted !== undefined) {
+    if (hinted !== undefined && this.isSafeBucketId(hinted)) {
       const summary = await readSessionSummary(this.docs, this.sessionsScope, hinted, id);
       if (summary !== undefined) return summary;
     }
@@ -717,18 +763,27 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
   private async collectAuthoritative(
     workspaceIds: readonly string[] | undefined,
   ): Promise<SessionSummary[]> {
+    const safeWorkspaceIds =
+      workspaceIds === undefined ? undefined : workspaceIds.filter((id) => this.isSafeBucketId(id));
+    if (workspaceIds !== undefined && safeWorkspaceIds!.length === 0) {
+      return [];
+    }
     let collected: SessionSummary[];
     if (
       this.readModelEnabled() &&
       (this.state === 'uninitialized' || this.state === 'preparing')
     ) {
       const { summaries } = await this.projector.sharedScanForRead();
       collected =
-        workspaceIds === undefined
+        safeWorkspaceIds === undefined
           ? summaries
-          : summaries.filter((summary) => workspaceIds.includes(summary.workspaceId));
+          : summaries.filter((summary) => safeWorkspaceIds.includes(summary.workspaceId));
     } else {
-      const ids = workspaceIds ?? (await listWorkspaceIds(this.storage, this.sessionsScope));
+      const knownIds = new Set(await listWorkspaceIds(this.storage, this.sessionsScope));
+      const ids =
+        safeWorkspaceIds === undefined
+          ? [...knownIds]
+          : safeWorkspaceIds.filter((id) => knownIds.has(id));
       collected = [];
       for (const workspaceId of ids) {
         for (const sessionId of await listSessionIds(this.storage, this.sessionsScope, workspaceId)) {
@@ -741,12 +796,26 @@ export class FileSessionIndex extends Disposable implements ISessionIndex {
     if (pending.length === 0) return collected;
     const byId = new Map(collected.map((summary) => [summary.id, summary]));
     for (const summary of pending) {
-      if (workspaceIds !== undefined && !workspaceIds.includes(summary.workspaceId)) continue;
+      if (safeWorkspaceIds !== undefined && !safeWorkspaceIds.includes(summary.workspaceId)) continue;
       byId.set(summary.id, summary);
     }
     return [...byId.values()];
   }
 
+  private isSafeBucketId(id: string): boolean {
+    if (!id || id === '.' || id === '..' || id.includes('/') || id.includes('\\') || id.includes('\0')) {
+      return false;
+    }
+    const root = this.storage.pathFor(this.sessionsScope, '');
+    if (root !== undefined) {
+      const target = this.storage.pathFor(this.sessionsScope, id);
+      if (target === undefined) return false;
+      const rel = relative(root, target);
+      if (rel.startsWith('..') || isAbsolute(rel) || rel !== id) return false;
+    }
+    return true;
+  }
+
   private readModelEnabled(): boolean {
     return databaseBaseEnabled(this.config);
   }

packages/agent-core-v2/src/app/sessionManager/sessionManagerService.ts

@@ -4,7 +4,7 @@ import { Emitter, type Event, type IWaitUntil } from '#/_base/event';
 import { ScopeActivation, registerScopedService, type ISessionScopeHandle } from '#/_base/di/scope';
 import { LifecycleScope } from '#/app/scopes';
 import { Error2, ErrorCodes, isError2, SessionErrors } from '#/errors';
-import { ISessionIndex, type SessionSummary } from '#/app/sessionIndex/sessionIndex';
+import { ISessionIndex, isSafeSessionId, type SessionSummary } from '#/app/sessionIndex/sessionIndex';
 import { IAgentCronService } from '#/features/cron/cronService';
 import type { SessionMeta } from '#/session/sessionMetadata/sessionMetadata';
 import { ISessionLockService, type SessionLockLease } from '#/persistence/interface/sessionLock';
@@ -73,6 +73,9 @@ export class SessionManager implements ISessionManager {
   ) {}
 
   async create(options: CreateManagedSessionOptions): Promise<ISessionScopeHandle> {
+    if (options.sessionId !== undefined && !isSafeSessionId(options.sessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${options.sessionId}"`);
+    }
     const create = async () => {
       const entry = await this.controllerForWorkspace(
         options.workspaceId === undefined
@@ -260,6 +263,12 @@ export class SessionManager implements ISessionManager {
   }
 
   async fork(options: ForkSessionOptions): Promise<SessionMeta> {
+    if (!isSafeSessionId(options.sourceSessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${options.sourceSessionId}"`);
+    }
+    if (options.newSessionId !== undefined && !isSafeSessionId(options.newSessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${options.newSessionId}"`);
+    }
     return this.serializeLifecycleForKeys(
       this.lifecycleKeys(options.sourceSessionId, options.newSessionId),
       async () => {
@@ -276,6 +285,12 @@ export class SessionManager implements ISessionManager {
   }
 
   async createChild(options: CreateChildSessionOptions): Promise<SessionMeta> {
+    if (!isSafeSessionId(options.sourceSessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${options.sourceSessionId}"`);
+    }
+    if (options.newSessionId !== undefined && !isSafeSessionId(options.newSessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${options.newSessionId}"`);
+    }
     return this.serializeLifecycleForKeys(
       this.lifecycleKeys(options.sourceSessionId, options.newSessionId),
       async () => {

packages/agent-core-v2/src/workspace/sessionLifecycle/sessionLifecycleService.ts

@@ -31,6 +31,7 @@ import { CHILD_SESSION_KIND,
   ISessionIndex,
   ISessionIndexMirror,
   PARENT_SESSION_ID_KEY,
+  isSafeSessionId,
 } from '#/app/sessionIndex/sessionIndex';
 import { buildSessionSummary } from '#/app/sessionIndex/sessionIndexSource';
 import type { SessionEndedEvent } from '#/app/telemetry/events';
@@ -209,6 +210,9 @@ export class SessionLifecycleService extends Disposable implements ISessionLifec
   }
 
   async create(opts: CreateSessionOptions): Promise<ISessionScopeHandle> {
+    if (opts.sessionId !== undefined && !isSafeSessionId(opts.sessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${opts.sessionId}"`);
+    }
     const sessionId = opts.sessionId ?? createSessionId();
     await this.workspaceSkillCatalog
       .reloadSources(SESSION_CREATE_RELOAD_SKILL_SOURCES)
@@ -523,6 +527,12 @@ export class SessionLifecycleService extends Disposable implements ISessionLifec
 
   async fork(opts: ForkSessionOptions): Promise<SessionMeta> {
     const sourceId = opts.sourceSessionId;
+    if (!isSafeSessionId(sourceId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${sourceId}"`);
+    }
+    if (opts.newSessionId !== undefined && !isSafeSessionId(opts.newSessionId)) {
+      throw new Error2(ErrorCodes.REQUEST_INVALID, `Invalid session id "${opts.newSessionId}"`);
+    }
 
     const sourceHandle = this.sessions.get(sourceId);
     const indexSummary = await this.index.get(sourceId);