feat: project-based session view + responsive sidebar

[aterrylu]

Summary

• Project session browser: New /api/projects endpoint using Claude Agent SDK's listSessions() — returns all Claude Code sessions grouped by project directory, sorted by recency
• Two-section sidebar: Live PTY sessions (top) + historical project sessions (bottom, expandable tree with summary, git branch, age)
• Collapsible sidebar: Hidden by default, toggled via ☰ hamburger in the header
• Responsive layout: Sidebar overlays on mobile (< md), sits inline on desktop (≥ md). Tap-outside-to-close on mobile
• Mobile scroll fix: 100dvh + overflow: hidden on body to prevent header scrolling with page on Android Chrome
• ROADMAP update: Reflects shipped work

Test plan

• Click ☰ — sidebar opens/closes
• Desktop: sidebar pushes terminal content inline
• Mobile: sidebar overlays as drawer, tapping outside closes it
• Projects section lists all Claude Code projects with session counts
• Expanding a project shows individual sessions with summary + branch + age
• Live sessions section still works (create/switch/kill)
• Header stays fixed on mobile scroll

🤖 Generated with Claude Code

[nox-0x]

🟡 Warning

Problem: env is built and sanitized but never passed to listSessions(). The SDK call on line 25 ignores it entirely.

Why it matters: This looks like a half-finished security measure — the intent was probably to strip CLAUDECODE (or other sensitive keys) from the environment before the SDK uses it. As written, it is dead code that gives a false sense of sanitization while listSessions() still has full access to process.env.

Suggested fix:

// Either pass it (if the SDK accepts it):
const sessions = await listSessions({ env });

// Or remove the dead code entirely if the SDK does not accept env overrides:
const sessions = await listSessions();

[nox-0x]

🟡 Warning

Problem: listSessions() is called with no error handling. A filesystem error, SDK misconfiguration, or missing ~/.claude directory will cause an unhandled rejection and return a 500 with a stack trace.

Why it matters: This endpoint is polled every 30 seconds from the dashboard. Any transient failure surfaces as an error in the browser and could expose internal paths via the stack trace.

Suggested fix:

let sessions: Awaited<ReturnType<typeof listSessions>>;
try {
  sessions = await listSessions();
} catch (err) {
  console.error("[projects] listSessions failed:", err);
  return c.json([], 200); // return empty rather than 500
}

[nox-0x]

Clean feature — the two-section sidebar with project history is a nice UX improvement and the responsive overlay pattern is solid. Two warnings in projects.ts worth a follow-up: (1) the env variable is dead code — it sanitizes process.env but is never passed to listSessions(), creating a false sense of security; (2) listSessions() has no try/catch, so any SDK or filesystem error will 500 and leak a stack trace to the browser on a polled endpoint. Neither blocks merge but both should be addressed soon.