fix: resume BLOCKED tasks in preserved sandbox so Claude finds its session

When a task ran in a sandbox (/tmp/claudomator-sandbox-*) and went BLOCKED,
Claude stored its session under the sandbox path as the project slug. The
resume execution was running in project_dir, causing Claude to look for the
session in the wrong project directory and fail with "No conversation found".

Fix: carry SandboxDir through BlockedError → Execution → resume execution,
and run the resume in that directory so the session lookup succeeds.

- BlockedError gains SandboxDir field; claude.go sets it on BLOCKED exit
- storage.Execution gains SandboxDir (persisted via new sandbox_dir column)
- executor.go stores blockedErr.SandboxDir in the execution record
- server.go copies SandboxDir from latest execution to the resume execution
- claude.go uses e.SandboxDir as working dir for resume when set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

5 files changed, 131 insertions, 15 deletions

diff --git a/internal/api/server.go b/internal/api/server.go
index 944e450..c545253 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -260,12 +260,14 @@ func (s *Server) handleAnswerQuestion(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Submit a resume execution.
+	// Submit a resume execution. Carry the sandbox path so the runner uses
+	// the same working directory where Claude stored its session files.
 	resumeExec := &storage.Execution{
 		ID:              uuid.New().String(),
 		TaskID:          taskID,
 		ResumeSessionID: latest.SessionID,
 		ResumeAnswer:    input.Answer,
+		SandboxDir:      latest.SandboxDir,
 	}
 	if err := s.pool.SubmitResume(context.Background(), tk, resumeExec); err != nil {
 		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": err.Error()})
diff --git a/internal/executor/claude.go b/internal/executor/claude.go
index 4839a90..0e29f7f 100644
--- a/internal/executor/claude.go
+++ b/internal/executor/claude.go
@@ -32,6 +32,7 @@ type ClaudeRunner struct {
 type BlockedError struct {
 	QuestionJSON string // raw JSON from the question file
 	SessionID    string // claude session to resume once the user answers
+	SandboxDir   string // preserved sandbox path; resume must run here so Claude finds its session files
 }
 
 func (e *BlockedError) Error() string { return fmt.Sprintf("task blocked: %s", e.QuestionJSON) }
@@ -98,10 +99,16 @@ func (r *ClaudeRunner) Run(ctx context.Context, t *task.Task, e *storage.Executi
 	}
 
 	// For new (non-resume) executions with a project_dir, clone into a sandbox.
-	// Resume executions run directly in project_dir to pick up the previous session.
+	// Resume executions run in the preserved sandbox (e.SandboxDir) so Claude
+	// finds its session files under the same project slug. If no sandbox was
+	// preserved (e.g. task had no project_dir), fall back to project_dir.
 	var sandboxDir string
 	effectiveWorkingDir := projectDir
-	if projectDir != "" && e.ResumeSessionID == "" {
+	if e.ResumeSessionID != "" {
+		if e.SandboxDir != "" {
+			effectiveWorkingDir = e.SandboxDir
+		}
+	} else if projectDir != "" {
 		var err error
 		sandboxDir, err = setupSandbox(projectDir)
 		if err != nil {
@@ -137,8 +144,10 @@ func (r *ClaudeRunner) Run(ctx context.Context, t *task.Task, e *storage.Executi
 	data, readErr := os.ReadFile(questionFile)
 	if readErr == nil {
 		os.Remove(questionFile) // consumed
-		// Preserve sandbox on BLOCKED — agent may have partial work.
-		return &BlockedError{QuestionJSON: strings.TrimSpace(string(data)), SessionID: e.SessionID}
+		// Preserve sandbox on BLOCKED — agent may have partial work and its
+		// Claude session files are stored under the sandbox's project slug.
+		// The resume execution must run in the same directory.
+		return &BlockedError{QuestionJSON: strings.TrimSpace(string(data)), SessionID: e.SessionID, SandboxDir: sandboxDir}
 	}
 
 	// Merge sandbox back to project_dir and clean up.
diff --git a/internal/executor/claude_test.go b/internal/executor/claude_test.go
index 1f6e5be..b5f7962 100644
--- a/internal/executor/claude_test.go
+++ b/internal/executor/claude_test.go
@@ -2,6 +2,7 @@ package executor
 
 import (
 	"context"
+	"errors"
 	"io"
 	"log/slog"
 	"os"
@@ -478,3 +479,102 @@ func TestTeardownSandbox_CleanSandboxWithNoNewCommits_RemovesSandbox(t *testing.
 		os.RemoveAll(sandbox)
 	}
 }
+
+// TestBlockedError_IncludesSandboxDir verifies that when a task is blocked in a
+// sandbox, the BlockedError carries the sandbox path so the resume execution can
+// run in the same directory (where Claude's session files are stored).
+func TestBlockedError_IncludesSandboxDir(t *testing.T) {
+	src := t.TempDir()
+	initGitRepo(t, src)
+
+	logDir := t.TempDir()
+
+	// Use a script that writes question.json to the env-var path and exits 0
+	// (simulating a blocked agent that asks a question before exiting).
+	scriptPath := filepath.Join(t.TempDir(), "fake-claude.sh")
+	if err := os.WriteFile(scriptPath, []byte(`#!/bin/sh
+if [ -n "$CLAUDOMATOR_QUESTION_FILE" ]; then
+  printf '{"question":"continue?"}' > "$CLAUDOMATOR_QUESTION_FILE"
+fi
+`), 0755); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+
+	r := &ClaudeRunner{
+		BinaryPath: scriptPath,
+		Logger:     slog.New(slog.NewTextHandler(io.Discard, nil)),
+		LogDir:     logDir,
+	}
+	tk := &task.Task{
+		Agent: task.AgentConfig{
+			Type:         "claude",
+			Instructions: "do something",
+			ProjectDir:   src,
+			SkipPlanning: true,
+		},
+	}
+	exec := &storage.Execution{ID: "blocked-exec-uuid", TaskID: "task-1"}
+
+	err := r.Run(context.Background(), tk, exec)
+
+	var blocked *BlockedError
+	if !errors.As(err, &blocked) {
+		t.Fatalf("expected BlockedError, got: %v", err)
+	}
+	if blocked.SandboxDir == "" {
+		t.Error("BlockedError.SandboxDir should be set when task runs in a sandbox")
+	}
+	// Sandbox should still exist (preserved for resume).
+	if _, statErr := os.Stat(blocked.SandboxDir); os.IsNotExist(statErr) {
+		t.Error("sandbox directory should be preserved when blocked")
+	} else {
+		os.RemoveAll(blocked.SandboxDir) // cleanup
+	}
+}
+
+// TestClaudeRunner_Run_ResumeUsesStoredSandboxDir verifies that when a resume
+// execution has SandboxDir set, the runner uses that directory (not project_dir)
+// as the working directory, so Claude finds its session files there.
+func TestClaudeRunner_Run_ResumeUsesStoredSandboxDir(t *testing.T) {
+	logDir := t.TempDir()
+	sandboxDir := t.TempDir()
+	cwdFile := filepath.Join(logDir, "cwd.txt")
+
+	// Use a script that writes its working directory to a file in logDir (stable path).
+	scriptPath := filepath.Join(t.TempDir(), "fake-claude.sh")
+	script := "#!/bin/sh\nprintf '%s' \"$PWD\" > " + cwdFile + "\n"
+	if err := os.WriteFile(scriptPath, []byte(script), 0755); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+
+	r := &ClaudeRunner{
+		BinaryPath: scriptPath,
+		Logger:     slog.New(slog.NewTextHandler(io.Discard, nil)),
+		LogDir:     logDir,
+	}
+	tk := &task.Task{
+		Agent: task.AgentConfig{
+			Type:         "claude",
+			ProjectDir:   sandboxDir, // must exist; resume overrides it with SandboxDir anyway
+			SkipPlanning: true,
+		},
+	}
+	exec := &storage.Execution{
+		ID:              "resume-exec-uuid",
+		TaskID:          "task-1",
+		ResumeSessionID: "original-session",
+		ResumeAnswer:    "yes",
+		SandboxDir:      sandboxDir,
+	}
+
+	_ = r.Run(context.Background(), tk, exec)
+
+	got, err := os.ReadFile(cwdFile)
+	if err != nil {
+		t.Fatalf("cwd file not written: %v", err)
+	}
+	// The runner should have executed claude in sandboxDir, not in project_dir.
+	if string(got) != sandboxDir {
+		t.Errorf("resume working dir: want %q, got %q", sandboxDir, string(got))
+	}
+}
diff --git a/internal/executor/executor.go b/internal/executor/executor.go
index f54773a..76c8ac7 100644
--- a/internal/executor/executor.go
+++ b/internal/executor/executor.go
@@ -273,6 +273,7 @@ func (p *Pool) handleRunResult(ctx context.Context, t *task.Task, exec *storage.
 		var blockedErr *BlockedError
 		if errors.As(err, &blockedErr) {
 			exec.Status = "BLOCKED"
+			exec.SandboxDir = blockedErr.SandboxDir // preserve so resume runs in same dir
 			if err := p.store.UpdateTaskState(t.ID, task.StateBlocked); err != nil {
 				p.logger.Error("failed to update task state", "taskID", t.ID, "state", task.StateBlocked, "error", err)
 			}
diff --git a/internal/storage/db.go b/internal/storage/db.go
index 01ce902..5ba0786 100644
--- a/internal/storage/db.go
+++ b/internal/storage/db.go
@@ -80,6 +80,7 @@ func (s *DB) migrate() error {
 		`ALTER TABLE tasks ADD COLUMN rejection_comment TEXT`,
 		`ALTER TABLE tasks ADD COLUMN question_json TEXT`,
 		`ALTER TABLE executions ADD COLUMN session_id TEXT`,
+		`ALTER TABLE executions ADD COLUMN sandbox_dir TEXT`,
 	}
 	for _, m := range migrations {
 		if _, err := s.db.Exec(m); err != nil {
@@ -348,7 +349,8 @@ type Execution struct {
 	ArtifactDir string
 	CostUSD     float64
 	ErrorMsg    string
-	SessionID   string // claude --session-id; persisted for resume
+	SessionID  string // claude --session-id; persisted for resume
+	SandboxDir string // preserved sandbox path when task is BLOCKED; resume must run here
 
 	// In-memory only: set when creating a resume execution, not stored in DB.
 	ResumeSessionID string
@@ -358,23 +360,23 @@ type Execution struct {
 // CreateExecution inserts an execution record.
 func (s *DB) CreateExecution(e *Execution) error {
 	_, err := s.db.Exec(`
-		INSERT INTO executions (id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		INSERT INTO executions (id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id, sandbox_dir)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		e.ID, e.TaskID, e.StartTime.UTC(), e.EndTime.UTC(), e.ExitCode, e.Status,
-		e.StdoutPath, e.StderrPath, e.ArtifactDir, e.CostUSD, e.ErrorMsg, e.SessionID,
+		e.StdoutPath, e.StderrPath, e.ArtifactDir, e.CostUSD, e.ErrorMsg, e.SessionID, e.SandboxDir,
 	)
 	return err
 }
 
 // GetExecution retrieves an execution by ID.
 func (s *DB) GetExecution(id string) (*Execution, error) {
-	row := s.db.QueryRow(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id FROM executions WHERE id = ?`, id)
+	row := s.db.QueryRow(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id, sandbox_dir FROM executions WHERE id = ?`, id)
 	return scanExecution(row)
 }
 
 // ListExecutions returns executions for a task.
 func (s *DB) ListExecutions(taskID string) ([]*Execution, error) {
-	rows, err := s.db.Query(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id FROM executions WHERE task_id = ? ORDER BY start_time DESC`, taskID)
+	rows, err := s.db.Query(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id, sandbox_dir FROM executions WHERE task_id = ? ORDER BY start_time DESC`, taskID)
 	if err != nil {
 		return nil, err
 	}
@@ -393,7 +395,7 @@ func (s *DB) ListExecutions(taskID string) ([]*Execution, error) {
 
 // GetLatestExecution returns the most recent execution for a task.
 func (s *DB) GetLatestExecution(taskID string) (*Execution, error) {
-	row := s.db.QueryRow(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id FROM executions WHERE task_id = ? ORDER BY start_time DESC LIMIT 1`, taskID)
+	row := s.db.QueryRow(`SELECT id, task_id, start_time, end_time, exit_code, status, stdout_path, stderr_path, artifact_dir, cost_usd, error_msg, session_id, sandbox_dir FROM executions WHERE task_id = ? ORDER BY start_time DESC LIMIT 1`, taskID)
 	return scanExecution(row)
 }
 
@@ -518,10 +520,10 @@ func (s *DB) UpdateTaskQuestion(taskID, questionJSON string) error {
 func (s *DB) UpdateExecution(e *Execution) error {
 	_, err := s.db.Exec(`
 		UPDATE executions SET end_time = ?, exit_code = ?, status = ?, cost_usd = ?, error_msg = ?,
-		stdout_path = ?, stderr_path = ?, artifact_dir = ?, session_id = ?
+		stdout_path = ?, stderr_path = ?, artifact_dir = ?, session_id = ?, sandbox_dir = ?
 		WHERE id = ?`,
 		e.EndTime.UTC(), e.ExitCode, e.Status, e.CostUSD, e.ErrorMsg,
-		e.StdoutPath, e.StderrPath, e.ArtifactDir, e.SessionID, e.ID,
+		e.StdoutPath, e.StderrPath, e.ArtifactDir, e.SessionID, e.SandboxDir, e.ID,
 	)
 	return err
 }
@@ -576,12 +578,14 @@ func scanTaskRows(rows *sql.Rows) (*task.Task, error) {
 func scanExecution(row scanner) (*Execution, error) {
 	var e Execution
 	var sessionID sql.NullString
+	var sandboxDir sql.NullString
 	err := row.Scan(&e.ID, &e.TaskID, &e.StartTime, &e.EndTime, &e.ExitCode, &e.Status,
-		&e.StdoutPath, &e.StderrPath, &e.ArtifactDir, &e.CostUSD, &e.ErrorMsg, &sessionID)
+		&e.StdoutPath, &e.StderrPath, &e.ArtifactDir, &e.CostUSD, &e.ErrorMsg, &sessionID, &sandboxDir)
 	if err != nil {
 		return nil, err
 	}
 	e.SessionID = sessionID.String
+	e.SandboxDir = sandboxDir.String
 	return &e, nil
 }