fix(server): use exact-match session lookup in _session_detail

devagent/server/app.py

@@ -118,14 +118,13 @@ def _session_detail(self, session_id: str) -> None:
         try:
             from devagent.session.manager import SessionManager
             mgr = SessionManager()
-            sessions = mgr.list(limit=500)
-            match = next((s for s in sessions if s["id"].startswith(session_id)), None)
-            if match is None:
+            session = mgr.get(session_id)
+            if session is None:
                 self._json({"error": f"session not found: {session_id}"}, status=404)
                 return
-            events = mgr.get_events(match["id"])
-            totals = mgr.get_token_totals(match["id"])
-            self._json({"session": match, "events": events, "token_totals": totals})
+            events = mgr.get_events(session["id"])
+            totals = mgr.get_token_totals(session["id"])
+            self._json({"session": session, "events": events, "token_totals": totals})
         except Exception as exc:
             self._json({"error": str(exc)}, status=500)
 

tests/test_phase6.py

@@ -135,6 +135,43 @@ def test_server_session_not_found():
     assert "error" in body
 
 
+def test_server_session_detail_exact_match_and_prefix_rejection():
+    from devagent.session import store as session_store
+
+    port = _free_port()
+    _start_server(port)
+
+    prefix_id = f"test-prefix-{int(time.time() * 1000)}"
+    full_id = f"{prefix_id}-extended"
+
+    session_store.init_schema()
+    session_store.create_session(
+        full_id,
+        project="/test/project",
+        model="qwen2.5-coder:7b",
+        provider="ollama",
+        title="Exact match test session",
+    )
+
+    try:
+        # Prefix lookup must return 404 rather than matching full_id
+        status, body = _get(port, f"/api/sessions/{prefix_id}")
+        assert status == 404
+        assert "error" in body
+
+        # Exact ID lookup succeeds and returns the session details
+        status, body = _get(port, f"/api/sessions/{full_id}")
+        assert status == 200
+        assert body["session"]["id"] == full_id
+        assert "events" in body
+        assert "token_totals" in body
+    finally:
+        try:
+            session_store.delete_session(full_id)
+        except Exception:
+            pass
+
+
 def test_server_cors_headers():
     port = _free_port()
     _start_server(port)