fix: harden /api/set-workspace handler + traversal test (CodeRabbit on PR #16)

Two CodeRabbit follow-ups:

1. api/config_api.py:set_workspace — when get_json(silent=True) returned
   a non-dict (JSON array, string, number, null), the truthy fallback
   `or {}` was bypassed and `body.get("path", "")` raised AttributeError,
   which the outer Exception handler mis-reported as a 500 server error.
   Added isinstance(body, dict) guard that returns
   400 { error: "request body must be a JSON object" } directly. Diverged
   from CodeRabbit's literal patch in one way: they had it raise
   WorkspacePathError("path is required"), but the actual problem here is
   a malformed body shape — the error message should match the cause so
   the client can fix it.

2. tests/test_workspace_path_validation.py — the traversal test escaped
   to /tmp itself, which is shared and could be flipped by any other
   test / process creating <something>/state.vscdb there. Pinned the
   escape target to an isolated root inside self.tmp.

Also added 4 API-layer regression tests (TestSetWorkspaceApi) using
Flask test_client: JSON array / string / number return 400 (not 500),
plus a sanity end-to-end with a valid {path} body returning 200 and the
canonical realpath.

Full suite: 152/152 OK (was 148; +4 new API tests).

Author: timon0305

api/config_api.py

@@ -76,7 +76,14 @@ def validate_path():
 
 @bp.route("/api/set-workspace", methods=["POST"])
 def set_workspace():
-    body = request.get_json(silent=True) or {}
+    # Reject non-dict JSON bodies (array / string / number / null). Without
+    # this, get_json returns the value directly, the truthy fallback `or {}`
+    # is bypassed, and `body.get("path", "")` raises AttributeError — which
+    # the outer Exception handler then mis-reports as a 500 server error
+    # instead of a 400 client error. (CodeRabbit on PR #16.)
+    body = request.get_json(silent=True)
+    if not isinstance(body, dict):
+        return jsonify({"error": "request body must be a JSON object"}), 400
     raw = body.get("path", "")
     # Validate the supplied path BEFORE storing the override (issue #15).
     # validate_workspace_path collapses `..` traversal AND resolves symlinks

tests/test_workspace_path_validation.py

@@ -99,8 +99,16 @@ def test_rejects_directory_without_cursor_markers(self):
     # ─── Path-traversal class ──────────────────────────────────────
 
     def test_traversal_into_non_workspace_is_rejected(self):
-        # /tmp/<x>/real-storage/../../  → /tmp/  → no Cursor markers → reject
-        storage = _make_cursor_workspace_dir(self.tmp)
+        # Keep traversal target inside this test's own temp tree — escaping
+        # to /tmp itself would be non-deterministic (any other test or
+        # process creating a `state.vscdb` under /tmp/<dir>/state.vscdb
+        # would flip this test's outcome).
+        #
+        #   <self.tmp>/isolated-root/storage/../..  →  <self.tmp>/isolated-root
+        # which contains no state.vscdb under any subdir → reject on markers.
+        isolated_root = os.path.join(self.tmp, "isolated-root")
+        os.makedirs(isolated_root)
+        storage = _make_cursor_workspace_dir(isolated_root)
         escape = os.path.join(storage, "..", "..")
         with self.assertRaises(WorkspacePathError):
             validate_workspace_path(escape)
@@ -129,5 +137,65 @@ def test_symlink_to_real_workspace_is_canonicalised_and_accepted(self):
         self.assertNotEqual(result, link)
 
 
+class TestSetWorkspaceApi(unittest.TestCase):
+    """API-layer regressions for POST /api/set-workspace.
+
+    The validator helper has its own coverage above; these cases exist to
+    pin behaviour the API handler owns (request body shape handling,
+    HTTP status mapping). Notably the non-dict-body case which used to
+    surface as a 500 instead of a 400 — see CodeRabbit on PR #16.
+    """
+
+    def setUp(self):
+        from flask import Flask
+        from api.config_api import bp as config_bp
+
+        self.tmp = tempfile.mkdtemp(prefix="cursor-validate-api-test-")
+        self.addCleanup(shutil.rmtree, self.tmp, ignore_errors=True)
+
+        app = Flask(__name__)
+        app.config["TESTING"] = True
+        app.register_blueprint(config_bp)
+        self.client = app.test_client()
+
+    def test_non_dict_json_array_returns_400_not_500(self):
+        # Regression: a JSON array body (truthy, non-dict) used to trip
+        # AttributeError on body.get(...) and surface as a 500.
+        resp = self.client.post(
+            "/api/set-workspace",
+            data="[]",
+            content_type="application/json",
+        )
+        self.assertEqual(resp.status_code, 400)
+        self.assertIn("error", resp.get_json())
+
+    def test_non_dict_json_string_returns_400(self):
+        resp = self.client.post(
+            "/api/set-workspace",
+            data='"some string"',
+            content_type="application/json",
+        )
+        self.assertEqual(resp.status_code, 400)
+
+    def test_non_dict_json_number_returns_400(self):
+        resp = self.client.post(
+            "/api/set-workspace",
+            data="42",
+            content_type="application/json",
+        )
+        self.assertEqual(resp.status_code, 400)
+
+    def test_dict_with_valid_path_returns_200_with_canonical(self):
+        storage = _make_cursor_workspace_dir(self.tmp)
+        resp = self.client.post(
+            "/api/set-workspace",
+            json={"path": storage},
+        )
+        self.assertEqual(resp.status_code, 200)
+        body = resp.get_json()
+        self.assertTrue(body["success"])
+        self.assertEqual(body["path"], os.path.realpath(storage))
+
+
 if __name__ == "__main__":
     unittest.main()