[samirhvbr]

Resuming an API-spec scan kept the saved /workspace/api-specs/... paths but omitted their sandbox source. This restores the per-run staged specifications for both bind-mount and copy-based backends. Resume reuses those files, including duplicate-name disambiguation, rather than replacing them from changed originals or refetching a collection. A missing staged file now produces an actionable resume error before launch.

Closes #1619.

Validation on upstream 6b7ae2e, Python 3.12.14 with frozen dependencies and an isolated HOME:

• Both new regression tests fail before the fix. Afterward, 180 API-spec, CLI resume, source, workspace-file, input, and session-entry tests pass.
• Coverage follows the real fresh-setup → persisted run → resume path, including changed/deleted originals, duplicate filenames, both sandbox input builders, and a missing staged copy.
• Ruff format/lint, Mypy, Bandit and git diff --check pass.
• make check-all reaches the existing Pyright failures: 936 diagnostics after the patch versus 941 on the unchanged base, with no new diagnostics (compared by file, rule and message, ignoring shifted line numbers).

No live Docker sandbox, LLM, Postman service or target scan was exercised. Staging remains temporary: if the scan's staged copy has been removed, it must be restored or the user must start a fresh scan. This change does not recreate it from a potentially changed source.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Restores staged API specifications when resuming a scan.

• Resumed scans reuse their staged API specifications.

samirhvbr explicitly states that staging remains temporary and that missing staged files must be restored or the user must start a fresh scan. This limit is intentional.

Review was based on code inspection; tests and live sandboxes were not run.

_{Reviews (1) · Last reviewed commit: "fix(cli): restore staged API specificati..." · Reviewed by Greptile}