fix(cli): reject empty session_id and add edge-case tests (#808)

[microsasa]

Closes #808

Changes

Gap 1 — Empty-string prefix validation:
Added an early guard in the session command that rejects an empty session_id argument with exit code 1 and the message "session ID cannot be empty". Previously, str.startswith("") always returns True, so an empty argument would silently display the first session.

Gap 2 — OSError test for _show_session_by_index:
Added test_show_session_by_index_generic_oserror which patches get_cached_events to raise a generic OSError("permission denied") and verifies the red error message is printed without raising.

Gap 3 — Duplicate session_id test for _build_session_index:
Added test_build_session_index_duplicate_ids which verifies that when two SessionSummary objects share the same session_id, the dict comprehension maps to the index of the last occurrence — documenting the tiebreak rule.

Verification

• All three new tests pass
• ruff check and ruff format clean
• pyright passes (0 errors)
• bandit security scan clean
• Full test suite: 1408 passed, coverage 98.94%

Generated by Issue Implementer · ● 9.8M · ◷

[Copilot]

Pull request overview

This PR fixes an edge case in the session CLI command where an empty session_id prefix would previously match the first session, and adds regression tests covering this and two related edge cases.

Changes:

• Add an early guard in session to reject an empty session_id with a clear error and exit code 1.
• Add a test ensuring _show_session_by_index gracefully handles a generic OSError from get_cached_events.
• Add a test documenting _build_session_index’s tie-break behavior for duplicate session_id values (last occurrence wins).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/copilot_usage/cli.py	Adds an early validation guard to prevent empty-prefix session matching.
tests/copilot_usage/test_cli.py	Adds regression tests for empty session id handling, generic OSError, and duplicate session_id indexing behavior.

[github-actions]

Quality Gate: APPROVED ✅

Changes reviewed:

• src/copilot_usage/cli.py: 4-line early guard rejecting empty session_id with click.echo to stderr + sys.exit(1) — clean input validation at the CLI boundary.
• tests/copilot_usage/test_cli.py: 3 new tests covering empty ID rejection, generic OSError handling in _show_session_by_index, and duplicate-ID tiebreak in _build_session_index — all meaningful with clear docstrings and assertions.

Assessment:

• Code follows repository conventions (type annotations, early returns, pytest patterns).
• All 8 CI checks green (lint, typecheck, security, tests, CodeQL).
• Impact: LOW — small edge-case fix with comprehensive test additions.

Auto-approving for merge.