fix(web): default session work_dir to startup directory

[bloodycoder]

Summary

Fixes #1774 by changing the default session work directory selection for web-created sessions.

When POST /api/sessions/ is called without work_dir, the backend now:

1. prefers app startup_dir
2. validates startup_dir (expanduser + resolve + exists + is_dir)
3. falls back to HOME only when startup_dir is unavailable

What changed

• src/kimi_cli/web/api/sessions.py

  • added _resolve_default_work_dir(http_request)
  • updated create_session to use startup_dir-first default resolution
  • added structured log fields in default branch:
    • requested_work_dir
    • effective_work_dir
    • used_fallback_home
  • added fallback warning logs when startup_dir is invalid/unavailable

• tests/web/test_sessions_create_default_workdir.py (new)

  • default without work_dir uses startup_dir
  • invalid startup_dir falls back to HOME and emits fallback signal
  • explicit work_dir behavior remains unchanged
  • API-level closed loop: create session -> /api/sessions/{id}/files/... resolves against created work_dir

Trigger evidence

Current web path can omit work_dir entirely:

• web/src/hooks/useSessions.ts
  • request body is left undefined when workDir is not provided

Tests

pytest -q tests/web/test_sessions_create_default_workdir.py tests/web/test_open_in.py tests/web/test_static_cache_headers.py

Result:

• 8 passed, 2 skipped