[kitlangton]

Creating or importing a session with a relative location now gets a clear 400 instead of an empty 500.
Sessions are stored with an absolute directory. A relative, ~ or empty directory got past the request check and only failed when the session was saved, so the client saw a 500 with no body. Absolute paths, including Windows drive and UNC paths, work as before.

❌ Before

1. A client sends POST /api/session with location: { directory: "relative/path" }.
2. The server accepts the request and tries to save the session.
3. ❌ The save fails and the client gets an empty 500 it can't explain.

✅ After

1. A client sends the same request.
2. The server checks the directory with the same rule the database uses.
3. The client gets a 400 InvalidRequestError on location: "location.directory must be an absolute path".

  session.create / session.import:
+   if location is given (and no parentID) and its directory isn't absolute:
+     fail 400 InvalidRequestError(field: "location")
    create the session at the location

📊 Proof

location.directory	Before	After
""	❌ empty 500	✅ 400
relative/path	❌ empty 500	✅ 400
~/code	❌ empty 500	✅ 400
an absolute path	✅ 200	✅ 200

The new test fails without the change; 1 pass, 8 assertions.

👀 Read: packages/server/src/handlers/session.ts, the new check. It reuses the core rule for stored paths, so the API and the database can't disagree. The rest (the error list and regenerated OpenAPI text) is routine.

_{🔍 Found in a code audit · no user reports}

Checks run

• bun test test/session-create-location.test.ts (packages/server): 1 pass
• bun run check:generated (packages/protocol): in sync
• bun run check:generated (packages/client): in sync
• bun turbo typecheck (pre-push): 32 packages pass

---

Added by the opencode bot (AI-generated).

Related: #59164

Public API: session.create and experimental.session.import can now return a 400 InvalidRequestError for a location directory that isn't absolute (backwards compatible)

[opencodejr]

The fix works and I found nothing that should block a merge. I ran opencode serve from source for the base and for this pull request. POST /api/session with location.directory set to relative/path, ~/code or "" returned an empty 500 on the base and returns a 400 InvalidRequestError (field: "location") with this change. Absolute paths still return 200. I only exercised session.create over HTTP; session.import uses the same check. The new test fails on the base and passes here. The typecheck script fails in both packages because the bun check it calls doesn't exist here; tsc passes in packages/server and packages/protocol.

The check reuses storedAbsolutePath, so the API applies the same rule as the database. It is skipped when a parentID is given, which is correct since the child session takes its parent's location.

Public API: session.create and experimental.session.import can now return a 400 InvalidRequestError, which is added to their error lists and the OpenAPI spec. Requests with absolute paths behave as before, and only requests that used to get a 500 now get a 400, so this is backwards compatible.

#59164 also reports NUL bytes in location[directory] causing empty 500s on other routes. This change doesn't cover that part.

Related: #59164