fix: close browser session lifecycle gaps

apps/server/src/errors/error-handler.ts

@@ -40,6 +40,9 @@ function mapError(error: FastifyError | Error): {
   if ("statusCode" in error && error.statusCode === 413) {
     return { statusCode: 413, code: "PAYLOAD_TOO_LARGE", message: "Request payload is too large", details: {} };
   }
+  if ("statusCode" in error && error.statusCode === 400) {
+    return { statusCode: 400, code: "INVALID_REQUEST_BODY", message: "Request body could not be processed", details: {} };
+  }
   return { statusCode: 500, code: "INTERNAL_ERROR", message: "Internal server error", details: {} };
 }
 

apps/server/tests/api.test.ts

@@ -53,4 +53,21 @@ describe("HTTP API", () => {
     expect(busy.statusCode).toBe(409);
     expect(busy.body).not.toContain("stack");
   });
+
+  it("keeps Fastify body parse errors as safe client errors", async () => {
+    const { app } = createTestApp();
+    apps.push(app);
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/sessions",
+      headers: { "content-type": "application/json" },
+      payload: "",
+    });
+
+    expect(response.statusCode).toBe(400);
+    expect(response.json()).toMatchObject({
+      error: { code: "INVALID_REQUEST_BODY", message: "Request body could not be processed" },
+    });
+    expect(response.body).not.toContain("stack");
+  });
 });