fix: guard session rail against non-array session payloads

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/praisonaiui/templates/frontend/plugins/views/chat.js

@@ -1047,7 +1047,8 @@ async function loadSessions() {
       resp = await fetch('/sessions');
     }
     const data = await resp.json();
-    allSessions = data.sessions || data || [];
+    const fetched = data.sessions || data || [];
+    allSessions = Array.isArray(fetched) ? fetched : [];
     renderSessionList();
   } catch (e) {
     console.warn('[Chat] Failed to load sessions:', e);

tests/unit/test_chat_session_rail_search.py

@@ -21,7 +21,7 @@ class TestChatSessionRailSearch:
 
     def test_load_sessions_caches_and_delegates_render(self):
         src = CHAT.read_text()
-        assert "allSessions = data.sessions || data || [];" in src
+        assert "allSessions = Array.isArray(fetched) ? fetched : [];" in src
         body = src.split("async function loadSessions()", 1)[1].split("\n}\n", 1)[0]
         assert "renderSessionList();" in body