refactor(routes): extract the 585-line GET /api/session handler to _handle_session_get (#7340)

* refactor(routes): extract the 585-line GET /api/session handler to _handle_session_get

Pure move out of handle_get's if/elif chain into a named module-level handler, matching the pattern the other ~200 routes already use. Body is verbatim (one-level dedent only); AST identity of the moved statements verified; no behavior change — the GET /api/session test slice passes identically before and after.

* test: repoint four source-window tests to _handle_session_get

The moved block's source-window extractors (chat_start synthesiser/read-only
pins, regressions runtime-streaming-state window, issue1436 load-path
markers, security-redaction inspect) now anchor on the extracted handler;
assertions unchanged.

* test: repoint messaging-session loader pin to _handle_session_get

---------

Co-authored-by: nesquena-hermes <nesquena+hermes@gmail.com>

tests/test_chat_start_claim_cli_session.py

@@ -151,9 +151,9 @@ def test_chat_start_no_longer_bare_404_on_keyerror():
 def test_get_session_route_uses_shared_synthesiser():
     """The GET KeyError path must also delegate to the same helper."""
     src = ROUTES_PY.read_text(encoding="utf-8")
-    # Find the /api/session GET block (not /api/sessions).
+    # Find the /api/session GET handler (extracted to _handle_session_get).
     block = re.search(
-        r'if parsed\.path == "/api/session":.*?return j\(handler, \{"session": public_session_projection\(sess\)\}\)',
+        r'def _handle_session_get\(.*?return j\(handler, \{"session": public_session_projection\(sess\)\}\)',
         src,
         re.DOTALL,
     )
@@ -185,7 +185,7 @@ def test_get_session_preserves_cli_read_only_flag():
     sets to True for BOTH the explicit AND the source-refused
     refusal paths."""
     block = re.search(
-        r'if parsed\.path == "/api/session":.*?return j\(handler, \{"session": public_session_projection\(sess\)\}\)\)?',
+        r'def _handle_session_get\(.*?return j\(handler, \{"session": public_session_projection\(sess\)\}\)\)?',
         ROUTES_PY.read_text(encoding="utf-8"),
         re.DOTALL,
     )

tests/test_issue1436_context_indicator_load_path.py

@@ -374,8 +374,8 @@ class TestIssue1436SourceMarkers:
         # The session load path can call a helper, but the lazy import must
         # remain in routes.py so WebUI still works with older/missing agent
         # bundles by swallowing metadata-resolution failures.
-        start = src.find('if parsed.path == "/api/session":')
-        end = src.find('if parsed.path == "/api/projects":', start)
+        start = src.find('def _handle_session_get')
+        end = src.find('def handle_get(', start)
         block = src[start:end]
         assert "_resolve_context_length_for_session_model" in block, (
             "GET /api/session load-path block must resolve model context "
@@ -391,8 +391,8 @@ class TestIssue1436SourceMarkers:
         src = ROUTES.read_text(encoding="utf-8")
         # Find the load-path block (between "if parsed.path == \"/api/session\":"
         # and the next `if parsed.path` after it).
-        start = src.find('if parsed.path == "/api/session":')
-        end = src.find('if parsed.path == "/api/projects":', start)
+        start = src.find('def _handle_session_get')
+        end = src.find('def handle_get(', start)
         block = src[start:end]
         assert "#1436" in block, (
             "GET /api/session load-path block must reference #1436 in a comment"

tests/test_regressions.py

@@ -642,8 +642,8 @@ def test_chat_start_persists_pending_turn_metadata_for_reload_recovery(cleanup_t
 def test_session_detail_uses_runtime_streaming_state(cleanup_test_sessions):
     """GET /api/session must agree with /api/sessions on live stream ownership."""
     routes_src = (REPO_ROOT / "api/routes.py").read_text()
-    session_route = routes_src.split('if parsed.path == "/api/session":', 1)[1].split(
-        'if parsed.path == "/api/session/lineage/report":', 1
+    session_route = routes_src.split('def _handle_session_get(', 1)[1].split(
+        'def handle_get(', 1
     )[0]
     assert "active_stream_ids = _active_stream_ids()" in session_route
     assert "s.compact(" in session_route

tests/test_security_redaction.py

@@ -507,10 +507,10 @@ def test_api_session_redacts_messages():
     """GET /api/session route must call redact_session_data() before returning."""
     import inspect
     import api.routes as routes
-    src = inspect.getsource(routes.handle_get)
+    src = inspect.getsource(routes._handle_session_get)
     # Verify redact_session_data is applied to the session payload
     assert "redact_session_data" in src, (
-        "api/routes.py handle_get must call redact_session_data() on /api/session response"
+        "api/routes.py GET /api/session handler must call redact_session_data() on the response"
     )
 
 

tests/test_session_import_cli_fallback_model.py

@@ -388,7 +388,7 @@ def test_sessions_endpoint_suppresses_duplicate_webui_state_projection(monkeypat
 
 def test_messaging_session_loader_prefers_longer_sidecar_transcript():
     """Pin the /api/session invariant that repaired sidecars can be longer than state.db segments."""
-    handler = _extract_handler("handle_get")
+    handler = _extract_handler("_handle_session_get")
     old = "if is_messaging_session and cli_messages:\n                    _all_msgs = cli_messages"
     assert old not in handler
     assert "_all_msgs = _merged_session_messages_for_display(s, cli_messages)" in handler