fix(web): allow claude session resume via hub message-id recovery

Hub `resolveAgentResumeId` falls back to `recoverClaudeSessionIdFromMessages`
on the claude branch when `metadata.claudeSessionId` is absent, so the web
guard must not block inactive claude sessions that have stored messages but
no metadata id. Other flavors have no such recovery path and stay rejected.

Addresses second HAPI Bot review thread on tiann#761
(`web/src/lib/sessionResume.ts:41`).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: heavygee

web/src/lib/sessionResume.test.ts

@@ -93,4 +93,22 @@ describe('sessionResume', () => {
     it('inactiveSessionCanResume rejects when metadata path is missing', () => {
         expect(inactiveSessionCanResume(makeSession({ metadata: { path: '', host: 'localhost' } }), 0)).toBe(false)
     })
+
+    it('inactiveSessionCanResume allows claude resume by message recovery when no claudeSessionId is stored', () => {
+        expect(inactiveSessionCanResume(makeSession({
+            metadata: { path: '/tmp/project', host: 'localhost', flavor: 'claude' },
+        }), 3)).toBe(true)
+    })
+
+    it('inactiveSessionCanResume allows claude recovery when flavor is missing (defaults to claude)', () => {
+        expect(inactiveSessionCanResume(makeSession({
+            metadata: { path: '/tmp/project', host: 'localhost' },
+        }), 3)).toBe(true)
+    })
+
+    it('inactiveSessionCanResume rejects non-claude flavors with messages but no flavor-specific id (no recovery path)', () => {
+        expect(inactiveSessionCanResume(makeSession({
+            metadata: { path: '/tmp/project', host: 'localhost', flavor: 'codex' },
+        }), 3)).toBe(false)
+    })
 })

web/src/lib/sessionResume.ts

@@ -24,6 +24,9 @@ export function resolveAgentSessionIdFromMetadata(
 /**
  * Whether an inactive session can be activated via resume (or fresh spawn on first send).
  * Matches hub: resume with agent id, or fresh spawn when path exists, no agent id, no user messages.
+ * Claude with messages but no `claudeSessionId` is allowed because hub
+ * `recoverClaudeSessionIdFromMessages` reconstructs the resume id from the
+ * stored message log (only the claude path has this recovery fallback).
  */
 export function inactiveSessionCanResume(
     session: Session,
@@ -38,5 +41,9 @@ export function inactiveSessionCanResume(
     if (resolveAgentSessionIdFromMetadata(session.metadata)) {
         return true
     }
+    const flavor = isKnownFlavor(session.metadata.flavor) ? session.metadata.flavor : 'claude'
+    if (flavor === 'claude' && userMessageCount > 0) {
+        return true
+    }
     return userMessageCount === 0
 }