@yeaft/webchat-agent 1.0.505 → 1.0.506

package/conversation.js

@@ -423,10 +423,12 @@ export async function resumeConversation(msg) {
   console.log(`[Resume] claudeSessionId: ${claudeSessionId}`);
   console.log(`[Resume] workDir: ${effectiveWorkDir} (lazy start)`);
 
-  // 清理旧条目：同 conversationId 或同 claudeSessionId 的条目（避免重复恢复同一个 session 累积）
+  // 清理旧条目：CLI session ID 只在当前实例的同 owner/provider 内去重。
   let priorProviderOptions = null;
   for (const [id, conv] of ctx.conversations) {
-    if (id === conversationId || (claudeSessionId && conv.claudeSessionId === claudeSessionId)) {
+    if (id === conversationId || (claudeSessionId && conv.claudeSessionId === claudeSessionId &&
+      (conv.providerName || DEFAULT_PROVIDER) === provider &&
+      (conv.userId || null) === (userId || null))) {
       console.log(`[Resume] Cleaning up old conversation: ${id} (claudeSessionId: ${conv.claudeSessionId})`);
       if (conv.providerOptions && !priorProviderOptions) priorProviderOptions = conv.providerOptions;
       let cleanupDriver = null;

package/local-runtime/server/handlers/agent-conversation.js

@@ -87,15 +87,6 @@ export async function handleAgentConversation(agentId, agent, msg) {
 
     case 'conversation_created':
     case 'conversation_resumed': {
-      // 清理同 claudeSessionId 的旧条目（避免重复恢复同一个 session 累积）
-      if (msg.type === 'conversation_resumed' && msg.claudeSessionId) {
-        for (const [id, conv] of agent.conversations) {
-          if (id !== msg.conversationId && conv.claudeSessionId === msg.claudeSessionId) {
-            agent.conversations.delete(id);
-          }
-        }
-      }
-
       // fix-session-dup: if this conv is currently held in another
       // agent's in-memory Map (e.g. user resumed it against a
       // different machine after the original agent went offline),
@@ -141,6 +132,17 @@ export async function handleAgentConversation(agentId, agent, msg) {
       const reportedProvider = (msg.provider && msg.provider !== 'claude-code') ? msg.provider : null;
       const resolvedProvider = reportedProvider || existingConvData?.provider || dbSessionData?.provider || null;
 
+      // CLI IDs are scoped to this Agent, provider and owner, not globally unique.
+      if (msg.type === 'conversation_resumed' && msg.claudeSessionId) {
+        for (const [id, conv] of agent.conversations) {
+          if (id !== msg.conversationId && conv.claudeSessionId === msg.claudeSessionId &&
+            (conv.provider || 'claude-code') === (resolvedProvider || 'claude-code') &&
+            (conv.userId || agent.ownerId || null) === trustedUserId) {
+            agent.conversations.delete(id);
+          }
+        }
+      }
+
       agent.conversations.set(msg.conversationId, {
         id: msg.conversationId,
         workDir: msg.workDir,

package/local-runtime/server/handlers/client-conversation.js

@@ -509,7 +509,6 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
         await sendToWebClient(client, { type: 'error', message: 'Agent is still syncing, please wait...' });
         return;
       }
-      client.currentAgent = resumeAgentId;
       // fix-copilot-provider-persist: the web's auto-restore / recovery
       // resume paths (web/stores/helpers/session.js) send no provider, and
       // the agent's resume handler defaults an absent provider to
@@ -518,7 +517,34 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
       // 'claude-code'} and the persist path would CLOBBER the stored
       // 'copilot' binding — reintroducing the bug, permanently. Inject the
       // persisted provider so a provider-less resume keeps the real one.
-      const resumeProvider = msg.provider || sessionDb.get(msg.conversationId)?.provider || undefined;
+      const persistedResume = msg.conversationId ? sessionDb.get(msg.conversationId) : null;
+      const liveResume = resumeAgent.conversations?.get(msg.conversationId);
+      const resumeProvider = msg.provider || persistedResume?.provider || liveResume?.provider || 'claude-code';
+      // A supplied Web ID may only be reused within its existing identity.
+      // Check both persisted and live rows before forwarding any destructive resume.
+      const bindings = [];
+      if (persistedResume) bindings.push({
+        agentId: persistedResume.agent_id,
+        userId: persistedResume.user_id || agents.get(persistedResume.agent_id)?.ownerId,
+        provider: persistedResume.provider,
+      });
+      if (msg.conversationId) {
+        for (const [agentId, agent] of agents) {
+          const conversation = agent.conversations?.get(msg.conversationId);
+          if (conversation) bindings.push({
+            agentId,
+            userId: conversation.userId || agent.ownerId,
+            provider: conversation.provider || persistedResume?.provider,
+          });
+        }
+      }
+      if (bindings.some(binding => binding.agentId !== resumeAgentId ||
+        (binding.provider || 'claude-code') !== resumeProvider ||
+        (!CONFIG.skipAuth && binding.userId !== client.userId))) {
+        await sendToWebClient(client, { type: 'error', message: 'Permission denied' });
+        return;
+      }
+      client.currentAgent = resumeAgentId;
       await forwardToAgent(resumeAgentId, {
         type: 'resume_conversation',
         conversationId: msg.conversationId || randomUUID(),

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.505"}
+{"version":"1.0.506"}