From 487b342810ee4ee869c40a46b574b6f07de8edd7 Mon Sep 17 00:00:00 2001
From: Saksham Singh <130738043+Saksham1105@users.noreply.github.com>
Date: Sun, 25 Oct 2026 14:39:12 +0530
Subject: [PATCH] fix(server): use exact-match session lookup in
 _session_detail

---
 devagent/server/app.py | 11 +++++------
 tests/test_phase6.py   | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/devagent/server/app.py b/devagent/server/app.py
index 96d5433..dad6c2c 100644
--- a/devagent/server/app.py
+++ b/devagent/server/app.py
@@ -118,14 +118,13 @@ def _session_detail(self, session_id: str) -> None:
         try:
             from devagent.session.manager import SessionManager
             mgr = SessionManager()
-            sessions = mgr.list(limit=500)
-            match = next((s for s in sessions if s["id"].startswith(session_id)), None)
-            if match is None:
+            session = mgr.get(session_id)
+            if session is None:
                 self._json({"error": f"session not found: {session_id}"}, status=404)
                 return
-            events = mgr.get_events(match["id"])
-            totals = mgr.get_token_totals(match["id"])
-            self._json({"session": match, "events": events, "token_totals": totals})
+            events = mgr.get_events(session["id"])
+            totals = mgr.get_token_totals(session["id"])
+            self._json({"session": session, "events": events, "token_totals": totals})
         except Exception as exc:
             self._json({"error": str(exc)}, status=500)
 
diff --git a/tests/test_phase6.py b/tests/test_phase6.py
index 9ee2453..35616db 100644
--- a/tests/test_phase6.py
+++ b/tests/test_phase6.py
@@ -135,6 +135,43 @@ def test_server_session_not_found():
     assert "error" in body
 
 
+def test_server_session_detail_exact_match_and_prefix_rejection():
+    from devagent.session import store as session_store
+
+    port = _free_port()
+    _start_server(port)
+
+    prefix_id = f"test-prefix-{int(time.time() * 1000)}"
+    full_id = f"{prefix_id}-extended"
+
+    session_store.init_schema()
+    session_store.create_session(
+        full_id,
+        project="/test/project",
+        model="qwen2.5-coder:7b",
+        provider="ollama",
+        title="Exact match test session",
+    )
+
+    try:
+        # Prefix lookup must return 404 rather than matching full_id
+        status, body = _get(port, f"/api/sessions/{prefix_id}")
+        assert status == 404
+        assert "error" in body
+
+        # Exact ID lookup succeeds and returns the session details
+        status, body = _get(port, f"/api/sessions/{full_id}")
+        assert status == 200
+        assert body["session"]["id"] == full_id
+        assert "events" in body
+        assert "token_totals" in body
+    finally:
+        try:
+            session_store.delete_session(full_id)
+        except Exception:
+            pass
+
+
 def test_server_cors_headers():
     port = _free_port()
     _start_server(port)