fix(web): scope sessionResume guard to current flavor only

Hub `resolveAgentResumeId` only honors the metadata.flavor's id; the web
guard was falling back across all flavors so a cursor session with a stale
codexSessionId still tried to resume and 409'd. Mirror the hub switch and
default to claude when flavor is unknown.

Addresses HAPI Bot review on tiann#761.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: heavygee

web/src/lib/sessionResume.test.ts

@@ -15,20 +15,39 @@ function makeSession(overrides: Partial<Session> = {}): Session {
 }
 
 describe('sessionResume', () => {
-    it('resolveAgentSessionIdFromMetadata matches hub flavor precedence (codex before cursor)', () => {
+    it('resolveAgentSessionIdFromMetadata picks the id matching the session flavor', () => {
         expect(resolveAgentSessionIdFromMetadata({
             path: '/p',
             host: 'h',
+            flavor: 'codex',
             codexSessionId: 'codex-1',
             cursorSessionId: 'cursor-1',
         })).toBe('codex-1')
         expect(resolveAgentSessionIdFromMetadata({
             path: '/p',
             host: 'h',
+            flavor: 'cursor',
             cursorSessionId: 'cursor-1',
         })).toBe('cursor-1')
     })
 
+    it('resolveAgentSessionIdFromMetadata ignores stale cross-flavor ids', () => {
+        expect(resolveAgentSessionIdFromMetadata({
+            path: '/p',
+            host: 'h',
+            flavor: 'cursor',
+            codexSessionId: 'codex-1',
+        })).toBeUndefined()
+    })
+
+    it('resolveAgentSessionIdFromMetadata defaults to claude when flavor is missing', () => {
+        expect(resolveAgentSessionIdFromMetadata({
+            path: '/p',
+            host: 'h',
+            claudeSessionId: 'claude-1',
+        })).toBe('claude-1')
+    })
+
     it('inactiveSessionCanResume is true for active sessions', () => {
         expect(inactiveSessionCanResume(makeSession({ active: true }), 0)).toBe(true)
     })
@@ -52,6 +71,25 @@ describe('sessionResume', () => {
         expect(inactiveSessionCanResume(makeSession(), 3)).toBe(false)
     })
 
+    it('inactiveSessionCanResume rejects when stale cross-flavor agent id is present but no messages', () => {
+        expect(inactiveSessionCanResume(makeSession({
+            metadata: {
+                path: '/tmp/project',
+                host: 'localhost',
+                flavor: 'cursor',
+                codexSessionId: 'stale-codex-1',
+            },
+        }), 0)).toBe(true)
+        expect(inactiveSessionCanResume(makeSession({
+            metadata: {
+                path: '/tmp/project',
+                host: 'localhost',
+                flavor: 'cursor',
+                codexSessionId: 'stale-codex-1',
+            },
+        }), 3)).toBe(false)
+    })
+
     it('inactiveSessionCanResume rejects when metadata path is missing', () => {
         expect(inactiveSessionCanResume(makeSession({ metadata: { path: '', host: 'localhost' } }), 0)).toBe(false)
     })

web/src/lib/sessionResume.ts

@@ -1,19 +1,24 @@
+import { isKnownFlavor } from '@hapi/protocol'
 import type { Session } from '@/types/api'
 
-/** Agent thread id used by hub `resolveAgentResumeId` (any flavor). */
+/** Agent thread id used by hub `resolveAgentResumeId`, flavor-specific.
+ *  Mirrors hub: cross-flavor ids are ignored to avoid the web layer claiming a
+ *  session is resumable when the hub will only honor the current flavor's id. */
 export function resolveAgentSessionIdFromMetadata(
     metadata: Session['metadata'] | null | undefined,
 ): string | undefined {
     if (!metadata) {
         return undefined
     }
-    return metadata.codexSessionId
-        ?? metadata.claudeSessionId
-        ?? metadata.geminiSessionId
-        ?? metadata.opencodeSessionId
-        ?? metadata.cursorSessionId
-        ?? metadata.kimiSessionId
-        ?? undefined
+    const flavor = isKnownFlavor(metadata.flavor) ? metadata.flavor : 'claude'
+    switch (flavor) {
+        case 'codex': return metadata.codexSessionId ?? undefined
+        case 'gemini': return metadata.geminiSessionId ?? undefined
+        case 'opencode': return metadata.opencodeSessionId ?? undefined
+        case 'cursor': return metadata.cursorSessionId ?? undefined
+        case 'kimi': return metadata.kimiSessionId ?? undefined
+        default: return metadata.claudeSessionId ?? undefined
+    }
 }
 
 /**