fix: resume BLOCKED tasks in preserved sandbox so Claude finds its session

When a task ran in a sandbox (/tmp/claudomator-sandbox-*) and went BLOCKED,
Claude stored its session under the sandbox path as the project slug. The
resume execution was running in project_dir, causing Claude to look for the
session in the wrong project directory and fail with "No conversation found".

Fix: carry SandboxDir through BlockedError → Execution → resume execution,
and run the resume in that directory so the session lookup succeeds.

- BlockedError gains SandboxDir field; claude.go sets it on BLOCKED exit
- storage.Execution gains SandboxDir (persisted via new sandbox_dir column)
- executor.go stores blockedErr.SandboxDir in the execution record
- server.go copies SandboxDir from latest execution to the resume execution
- claude.go uses e.SandboxDir as working dir for resume when set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 files changed, 114 insertions, 4 deletions

diff --git a/internal/executor/claude.go b/internal/executor/claude.go
index 4839a90..0e29f7f 100644
--- a/internal/executor/claude.go
+++ b/internal/executor/claude.go
@@ -32,6 +32,7 @@ type ClaudeRunner struct {
 type BlockedError struct {
 	QuestionJSON string // raw JSON from the question file
 	SessionID    string // claude session to resume once the user answers
+	SandboxDir   string // preserved sandbox path; resume must run here so Claude finds its session files
 }
 
 func (e *BlockedError) Error() string { return fmt.Sprintf("task blocked: %s", e.QuestionJSON) }
@@ -98,10 +99,16 @@ func (r *ClaudeRunner) Run(ctx context.Context, t *task.Task, e *storage.Executi
 	}
 
 	// For new (non-resume) executions with a project_dir, clone into a sandbox.
-	// Resume executions run directly in project_dir to pick up the previous session.
+	// Resume executions run in the preserved sandbox (e.SandboxDir) so Claude
+	// finds its session files under the same project slug. If no sandbox was
+	// preserved (e.g. task had no project_dir), fall back to project_dir.
 	var sandboxDir string
 	effectiveWorkingDir := projectDir
-	if projectDir != "" && e.ResumeSessionID == "" {
+	if e.ResumeSessionID != "" {
+		if e.SandboxDir != "" {
+			effectiveWorkingDir = e.SandboxDir
+		}
+	} else if projectDir != "" {
 		var err error
 		sandboxDir, err = setupSandbox(projectDir)
 		if err != nil {
@@ -137,8 +144,10 @@ func (r *ClaudeRunner) Run(ctx context.Context, t *task.Task, e *storage.Executi
 	data, readErr := os.ReadFile(questionFile)
 	if readErr == nil {
 		os.Remove(questionFile) // consumed
-		// Preserve sandbox on BLOCKED — agent may have partial work.
-		return &BlockedError{QuestionJSON: strings.TrimSpace(string(data)), SessionID: e.SessionID}
+		// Preserve sandbox on BLOCKED — agent may have partial work and its
+		// Claude session files are stored under the sandbox's project slug.
+		// The resume execution must run in the same directory.
+		return &BlockedError{QuestionJSON: strings.TrimSpace(string(data)), SessionID: e.SessionID, SandboxDir: sandboxDir}
 	}
 
 	// Merge sandbox back to project_dir and clean up.
diff --git a/internal/executor/claude_test.go b/internal/executor/claude_test.go
index 1f6e5be..b5f7962 100644
--- a/internal/executor/claude_test.go
+++ b/internal/executor/claude_test.go
@@ -2,6 +2,7 @@ package executor
 
 import (
 	"context"
+	"errors"
 	"io"
 	"log/slog"
 	"os"
@@ -478,3 +479,102 @@ func TestTeardownSandbox_CleanSandboxWithNoNewCommits_RemovesSandbox(t *testing.
 		os.RemoveAll(sandbox)
 	}
 }
+
+// TestBlockedError_IncludesSandboxDir verifies that when a task is blocked in a
+// sandbox, the BlockedError carries the sandbox path so the resume execution can
+// run in the same directory (where Claude's session files are stored).
+func TestBlockedError_IncludesSandboxDir(t *testing.T) {
+	src := t.TempDir()
+	initGitRepo(t, src)
+
+	logDir := t.TempDir()
+
+	// Use a script that writes question.json to the env-var path and exits 0
+	// (simulating a blocked agent that asks a question before exiting).
+	scriptPath := filepath.Join(t.TempDir(), "fake-claude.sh")
+	if err := os.WriteFile(scriptPath, []byte(`#!/bin/sh
+if [ -n "$CLAUDOMATOR_QUESTION_FILE" ]; then
+  printf '{"question":"continue?"}' > "$CLAUDOMATOR_QUESTION_FILE"
+fi
+`), 0755); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+
+	r := &ClaudeRunner{
+		BinaryPath: scriptPath,
+		Logger:     slog.New(slog.NewTextHandler(io.Discard, nil)),
+		LogDir:     logDir,
+	}
+	tk := &task.Task{
+		Agent: task.AgentConfig{
+			Type:         "claude",
+			Instructions: "do something",
+			ProjectDir:   src,
+			SkipPlanning: true,
+		},
+	}
+	exec := &storage.Execution{ID: "blocked-exec-uuid", TaskID: "task-1"}
+
+	err := r.Run(context.Background(), tk, exec)
+
+	var blocked *BlockedError
+	if !errors.As(err, &blocked) {
+		t.Fatalf("expected BlockedError, got: %v", err)
+	}
+	if blocked.SandboxDir == "" {
+		t.Error("BlockedError.SandboxDir should be set when task runs in a sandbox")
+	}
+	// Sandbox should still exist (preserved for resume).
+	if _, statErr := os.Stat(blocked.SandboxDir); os.IsNotExist(statErr) {
+		t.Error("sandbox directory should be preserved when blocked")
+	} else {
+		os.RemoveAll(blocked.SandboxDir) // cleanup
+	}
+}
+
+// TestClaudeRunner_Run_ResumeUsesStoredSandboxDir verifies that when a resume
+// execution has SandboxDir set, the runner uses that directory (not project_dir)
+// as the working directory, so Claude finds its session files there.
+func TestClaudeRunner_Run_ResumeUsesStoredSandboxDir(t *testing.T) {
+	logDir := t.TempDir()
+	sandboxDir := t.TempDir()
+	cwdFile := filepath.Join(logDir, "cwd.txt")
+
+	// Use a script that writes its working directory to a file in logDir (stable path).
+	scriptPath := filepath.Join(t.TempDir(), "fake-claude.sh")
+	script := "#!/bin/sh\nprintf '%s' \"$PWD\" > " + cwdFile + "\n"
+	if err := os.WriteFile(scriptPath, []byte(script), 0755); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+
+	r := &ClaudeRunner{
+		BinaryPath: scriptPath,
+		Logger:     slog.New(slog.NewTextHandler(io.Discard, nil)),
+		LogDir:     logDir,
+	}
+	tk := &task.Task{
+		Agent: task.AgentConfig{
+			Type:         "claude",
+			ProjectDir:   sandboxDir, // must exist; resume overrides it with SandboxDir anyway
+			SkipPlanning: true,
+		},
+	}
+	exec := &storage.Execution{
+		ID:              "resume-exec-uuid",
+		TaskID:          "task-1",
+		ResumeSessionID: "original-session",
+		ResumeAnswer:    "yes",
+		SandboxDir:      sandboxDir,
+	}
+
+	_ = r.Run(context.Background(), tk, exec)
+
+	got, err := os.ReadFile(cwdFile)
+	if err != nil {
+		t.Fatalf("cwd file not written: %v", err)
+	}
+	// The runner should have executed claude in sandboxDir, not in project_dir.
+	if string(got) != sandboxDir {
+		t.Errorf("resume working dir: want %q, got %q", sandboxDir, string(got))
+	}
+}
diff --git a/internal/executor/executor.go b/internal/executor/executor.go
index f54773a..76c8ac7 100644
--- a/internal/executor/executor.go
+++ b/internal/executor/executor.go
@@ -273,6 +273,7 @@ func (p *Pool) handleRunResult(ctx context.Context, t *task.Task, exec *storage.
 		var blockedErr *BlockedError
 		if errors.As(err, &blockedErr) {
 			exec.Status = "BLOCKED"
+			exec.SandboxDir = blockedErr.SandboxDir // preserve so resume runs in same dir
 			if err := p.store.UpdateTaskState(t.ID, task.StateBlocked); err != nil {
 				p.logger.Error("failed to update task state", "taskID", t.ID, "state", task.StateBlocked, "error", err)
 			}