validate-path: reject non-object JSON before body.get

Avoid AttributeError on truthy JSON scalars/arrays (same class as PR #16).
Return valid:false + workspaceCount:0 to match validation error shape.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bradjin8

api/config_api.py

@@ -53,6 +53,10 @@ def validate_path():
     """Same path rules as POST /api/set-workspace: realpath, markers (issue #15)."""
     try:
         body = request.get_json(silent=True) or {}
+        if not isinstance(body, dict):
+            return jsonify(
+                {"valid": False, "error": "invalid JSON body", "workspaceCount": 0}
+            )
         raw = body.get("path", "")
         try:
             canonical = validate_workspace_path(raw)

tests/test_workspace_path_validation.py

@@ -225,6 +225,19 @@ def test_validate_path_invalid_returns_error(self):
         self.assertFalse(data["valid"])
         self.assertIn("error", data)
 
+    def test_validate_path_non_dict_json_returns_structured_error(self):
+        # Mirror set_workspace: truthy non-dict JSON must not reach body.get.
+        resp = self.client.post(
+            "/api/validate-path",
+            data='"not an object"',
+            content_type="application/json",
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.get_json()
+        self.assertFalse(data["valid"])
+        self.assertEqual(data["error"], "invalid JSON body")
+        self.assertEqual(data["workspaceCount"], 0)
+
 
 if __name__ == "__main__":
     unittest.main()