From 7f83124212572aaf75b58e10a1bba9d3e65b6fe4 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 20 Jul 2026 12:08:11 +0000
Subject: [PATCH] test(companion): correlate sessionId on invalid command
 bodies

Assert lifecycle envelopes keep a present sessionId and omit empty
ones when Zod rejects POST /commands payloads.

Co-authored-by: esadrianno <esadrianno@gmail.com>
---
 services/companion/src/server.test.ts | 45 +++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/services/companion/src/server.test.ts b/services/companion/src/server.test.ts
index bdce8ad..6b5d53a 100644
--- a/services/companion/src/server.test.ts
+++ b/services/companion/src/server.test.ts
@@ -247,6 +247,51 @@ describe("createCompanionApp", () => {
     expect(body.code).toBe("INVALID_COMMAND_BODY");
     expect(body.lifecycle?.kind).toBe("command_error");
     expect(body.lifecycle?.code).toBe("INVALID_COMMAND_BODY");
+    expect(body.lifecycle?.sessionId).toBeUndefined();
+    await app.close();
+  });
+
+  it("correlates sessionId on invalid command body when present", async () => {
+    const { app } = await createCompanionApp({
+      runtime: mockRuntime(),
+      logger: false,
+      localToken: "tok",
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/commands",
+      headers: { "x-webchain-token": "tok" },
+      payload: { action: "navigate", sessionId: "s1", url: "not-a-url" },
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = parseApiError(res);
+    expect(body.code).toBe("INVALID_COMMAND_BODY");
+    expect(body.lifecycle?.kind).toBe("command_error");
+    expect(body.lifecycle?.code).toBe("INVALID_COMMAND_BODY");
+    expect(body.lifecycle?.sessionId).toBe("s1");
+    await app.close();
+  });
+
+  it("omits empty sessionId from invalid command body lifecycle", async () => {
+    const { app } = await createCompanionApp({
+      runtime: mockRuntime(),
+      logger: false,
+      localToken: "tok",
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/commands",
+      headers: { "x-webchain-token": "tok" },
+      payload: { action: "navigate", sessionId: "", url: "https://example.com" },
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = parseApiError(res);
+    expect(body.code).toBe("INVALID_COMMAND_BODY");
+    expect(body.lifecycle?.sessionId).toBeUndefined();
     await app.close();
   });