We require contributors to sign our Contributor License Agreement, and we don't have @maskedband1t on file. You can sign our CLA at https://zed.dev/cla. Once you've signed, post a comment here that says '@cla-bot check'.

@cla-bot check

The cla-bot has been summoned, and re-checked this pull request!

Good fix — confirmed this resolves the loadSession() path. One additional code path has the same vulnerability: unstable_resumeSession().

The gap

unstable_resumeSession() calls createSession({ resume: sessionId }) with no error handling, identical to the pre-fix loadSession():

// src/acp-agent.ts — unstable_resumeSession() (current)
async unstable_resumeSession(params: ResumeSessionRequest): Promise<SessionResponse> {
  const response = await this.createSession(   // ← unguarded, same as the pre-fix loadSession
    { cwd: params.cwd, mcpServers: params.mcpServers ?? [], _meta: params._meta },
    { resume: params.sessionId },
  );
  // ...
}

If the .jsonl file is absent, the subprocess dies and createSession rejects with -32603 — the same untyped error that bypasses shouldFallbackToNewSession().

Suggested addition

  async unstable_resumeSession(params: ResumeSessionRequest): Promise<SessionResponse> {
-   const response = await this.createSession(
-     { cwd: params.cwd, mcpServers: params.mcpServers ?? [], _meta: params._meta },
-     { resume: params.sessionId },
-   );
+   let response;
+   try {
+     response = await this.createSession(
+       { cwd: params.cwd, mcpServers: params.mcpServers ?? [], _meta: params._meta },
+       { resume: params.sessionId },
+     );
+   } catch {
+     throw RequestError.resourceNotFound(params.sessionId);
+   }

    setTimeout(() => {
      this.sendAvailableCommandsUpdate(response.sessionId);
    }, 0);
    return response;
  }

Verification

We independently reproduced the issue and confirmed both code paths are reachable. SDK debug logs show:

Spawning Claude Code: ... --resume <session-id> ...
[DEBUG] LSP server manager shut down successfully    ← immediate shutdown
[DEBUG] SessionEnd hook query: other
Claude Code process exited with code 1               ← 1.7s after spawn

The Claude Code subprocess exits before any MCP servers connect, and the error propagates as -32603 regardless of which method initiated the resume.

Patching both methods resolves the issue completely — would it make sense to extend this PR to cover unstable_resumeSession() as well?

Thanks I pushed this into createSession as it happens at the initialize phase if we have a resume param