fix(auth): tolerate query-less route inputs

api/routes.py

@@ -548,7 +548,7 @@ def _guard_request_session_visibility(handler, parsed, body=None, method="GET")
     method = str(method).upper()
     if _request_session_visibility_exempt(method, getattr(parsed, "path", "")):
         return True
-    sid = parse_qs(parsed.query).get("session_id", [None])[0]
+    sid = parse_qs(getattr(parsed, "query", "") or "").get("session_id", [None])[0]
     if not _session_id_visible_to_request_profile(handler, sid):
         return False
     if isinstance(body, dict) and not _session_id_visible_to_request_profile(handler, body.get("session_id")):

tests/test_session_ops.py

@@ -14,9 +14,10 @@ import pytest
 from tests.conftest import TEST_BASE, TEST_STATE_DIR, _post, make_session_tracked
 
 
-def _get(path):
+def _get(path, headers=None):
     """GET helper -- returns parsed JSON, or raises HTTPError on non-2xx."""
-    with urllib.request.urlopen(TEST_BASE + path, timeout=10) as r:
+    req = urllib.request.Request(TEST_BASE + path, headers=headers or {})
+    with urllib.request.urlopen(req, timeout=10) as r:
         return json.loads(r.read())
 
 
@@ -240,7 +241,10 @@ def test_status_returns_profile_specific_hermes_home(cleanup_test_sessions):
     sid = data['session']['session_id']
     cleanup_test_sessions.append(sid)
 
-    r = _get(f'/api/session/status?session_id={sid}')
+    r = _get(
+        f'/api/session/status?session_id={sid}',
+        headers={'Cookie': 'hermes_profile=research'},
+    )
 
     assert r['profile'] == 'research'
     assert r['hermes_home'] == str(TEST_STATE_DIR / 'profiles' / 'research')