fix(api): return INVALID_PATH for invalid project sessions path

Author: clean6378-max-it

api/projects.py

@@ -3,6 +3,7 @@
 from flask import Blueprint, current_app
 
 from api._flask_types import FlaskReturn, json_error, json_response
+from api.error_codes import ErrorCode, error_response
 from models.project import ProjectSessionRowDict, SessionListItemDict
 from models.session import SessionDict
 from utils.session_path import get_claude_projects_dir, list_projects, list_sessions, safe_join
@@ -76,7 +77,7 @@ def get_project_sessions(project_name: str) -> FlaskReturn:
     try:
         project_dir = safe_join(base, project_name)
     except ValueError:
-        return json_response([]), 400
+        return error_response(ErrorCode.INVALID_PATH, "Invalid path", 400)
     sessions = list_sessions(project_dir)
     # Add summary preview for each session
     from utils.jsonl_parser import parse_session

docs/api-reference.md

@@ -25,15 +25,7 @@ Most `/api/*` error responses use this shape:
 }
 ```
 
-**Exception (no `{error, code}` body):**
-
-| Endpoint | Status | Body |
-|----------|--------|------|
-| `GET /api/projects/<project_name>/sessions` | 400 | `[]` (empty JSON array) when `project_name` fails path validation |
-
-*Legacy response shape — not the long-term contract. New clients should not treat bare `[]` as the intended error format; migration to structured `{error, code}` with `INVALID_PATH` is planned.*
-
-All other documented error paths below use the structured envelope.
+All documented error paths below use the structured envelope.
 
 Extra fields may appear for specific codes (for example `since` on invalid bulk-export mode).
 
@@ -174,7 +166,7 @@ Lists sessions in one project with summary fields for the workspace sidebar. Ski
 
 | Status | `code` | When |
 |--------|--------|------|
-| 400 | — | Invalid `project_name` (path escape). **Body is `[]`** (legacy — see [Error envelope](#error-envelope) exception); not a structured error |
+| 400 | `INVALID_PATH` | Invalid `project_name` (path escape) |
 
 ```bash
 curl -s "http://127.0.0.1:5000/api/projects/F--boost-capy/sessions" | jq '.[0]'

tests/test_api_routes.py

@@ -61,10 +61,9 @@ def test_search_limit_capped_at_max(client):
     assert len(results) <= 500
 
 
-def test_project_sessions_invalid_path_returns_400_empty_list(client):
+def test_project_sessions_invalid_path_returns_invalid_path(client):
     resp = client.get("/api/projects/../../outside/sessions")
-    assert resp.status_code == 400
-    assert resp.get_json() == []
+    assert_error_response(resp, expected_code="INVALID_PATH")
 
 
 def test_export_state_defaults(client_empty):