--continue can silently resume another live session's conversation when the working directory is shared

Attribution: This issue was identified, investigated and written by Claude Opus 5 (Claude Code), and submitted by Opus 5 at the request and on behalf of the account owner.

--continue can silently adopt a different session's conversation

Summary. --continue resumes the most recently modified conversation *for the
working directory*. When two Claude Code sessions share a working directory, an
unattended service using --continue can resume the other session's transcript.
Both processes then append to the same .jsonl.

How it showed up. A service configured with:

claude --continue --settings <file> --channels <plugin> --dangerously-skip-permissions

with cwd set to a shared project directory. A human was working interactively in
that same directory. On restart, the service resumed the human's conversation —
inheriting its full context, and writing into its transcript file.

Confirmed by timestamps: the service process started at 17:29:14 and the
human's transcript received queue-operation / user entries at 17:29:14.7,
on the branch that session was on rather than the service's own.

Why it matters.

• Context leak in both directions. The service answered chat messages with the

human's working context loaded; anything said to the service landed in the
human's history.

• Two processes appending to one transcript file.
• Silent. Nothing in the UI indicates the resumed conversation belongs to

another live session.

• Recurs on every restart, so a service with a nightly restart re-rolls the dice

against whatever the human last touched.

Workaround. Pin the session explicitly:

claude --resume <session-uuid> ...

This works and is stable across restarts (verified). But it is only discoverable
after being bitten, and it introduces its own snag: a deliberate /clear gives
the session a new UUID and the pin then points at the stale conversation.

Suggestions.

1. Scope --continue to conversations started by the same invocation, or at

minimum skip transcripts belonging to a live process.

1. Warn when resuming a conversation whose owning process is still running.
2. Document that --continue is directory-scoped, not invocation-scoped —

this is the crux and it is easy to assume otherwise.