Prevent stale session overwrite on new tasks

backend/api/server.py

@@ -2382,6 +2382,19 @@ def create_app(state: AgentState) -> FastAPI:
         ) or uuid4().hex
         account_key = state._account_key(request.account_id)
         prompt = request.prompt.strip()
+        session_directory = state.account_paths(request.account_id)['sessions']
+        if (
+            request.resume_session_id is None
+            and run_record is None
+            and _agent_session_exists(session_directory, requested_session_id)
+        ):
+            raise HTTPException(
+                status_code=409,
+                detail=(
+                    'Session already exists; pass resume_session_id to continue '
+                    'or create a fresh session_id.'
+                ),
+            )
         if run_record is None:
             run_record = state.run_manager.start(
                 account_key,
@@ -2398,7 +2411,6 @@ def create_app(state: AgentState) -> FastAPI:
         run_lock = state.run_lock_for(request.account_id, requested_session_id)
         agent = state.agent_for(request.account_id, requested_session_id)
         config = state.config_for(request.account_id)
-        session_directory = state.account_paths(request.account_id)['sessions']
         jupyter_runtime = _jupyter_runtime_for_session(
             state,
             request.account_id,
@@ -2658,6 +2670,18 @@ def create_app(state: AgentState) -> FastAPI:
         ) or uuid4().hex
         account_key = state._account_key(request.account_id)
         prompt = request.prompt.strip()
+        session_directory = state.account_paths(request.account_id)['sessions']
+        if (
+            request.resume_session_id is None
+            and _agent_session_exists(session_directory, requested_session_id)
+        ):
+            raise HTTPException(
+                status_code=409,
+                detail=(
+                    'Session already exists; pass resume_session_id to continue '
+                    'or create a fresh session_id.'
+                ),
+            )
         run_record = state.run_manager.start(account_key, requested_session_id, prompt)
         state.run_state_store.start(
             run_id=run_record.run_id,
@@ -2672,7 +2696,7 @@ def create_app(state: AgentState) -> FastAPI:
         try:
             agent = state.agent_for(request.account_id, requested_session_id)
             _save_in_progress_session(
-                directory=state.account_paths(request.account_id)['sessions'],
+                directory=session_directory,
                 agent=agent,
                 session_id=requested_session_id,
                 prompt=prompt,
@@ -3347,6 +3371,14 @@ def _save_in_progress_session(
         return None
 
 
+def _agent_session_exists(directory: Path, session_id: str) -> bool:
+    try:
+        load_agent_session(session_id, directory=directory)
+    except (FileNotFoundError, OSError, json.JSONDecodeError):
+        return False
+    return True
+
+
 def _derive_initial_session_title(prompt: str) -> str | None:
     # 第一条消息刚发出时先给侧边栏一个可读标题，后续再由模型摘要精修。
     stripped = _strip_session_context(prompt)