@@ -368,7 +368,10 @@ async def list_sessions(
       self, *, app_name: str, user_id: Optional[str] = None
   ) -> ListSessionsResponse:
     """Lists sessions from Firestore."""
-    if user_id:
+    if user_id == "":
+      # Firestore rejects an empty document ID, so no session can exist here.
+      return ListSessionsResponse()
+    if user_id is not None:
       query = self._get_sessions_ref(app_name, user_id).where(
           filter=FieldFilter("appName", "==", app_name)
       )
@@ -392,7 +395,7 @@ def _iter_sessions_data() -> Iterator[dict[str, Any]]:
     app_state = app_doc.to_dict() if app_doc.exists else {}
 
     user_states_map = {}
-    if user_id:
+    if user_id is not None:
       user_ref = (
           self.client.collection(self.user_state_collection)
           .document(app_name)
 
@@ -961,6 +961,39 @@ async def mock_get_all(refs):
   assert _where_filter(where) == ("appName", "==", app_name)
 
 
+@pytest.mark.asyncio
+async def test_list_sessions_with_empty_user_id_returns_no_sessions(
+    mock_firestore_client,
+):
+  """list_sessions(user_id="") returns no sessions without querying Firestore.
+
+  The collection_group and get_all stubs serve the all-users path only, so the
+  test fails if user_id="" falls through to it.
+  """
+  service = FirestoreSessionService(client=mock_firestore_client)
+  other_user_session = _stored_snapshot({
+      "id": "s-alice",
+      "appName": "test_app",
+      "userId": "alice",
+      "state": {},
+  })
+  mock_firestore_client.collection_group.return_value.where.return_value.get = (
+      mock.AsyncMock(return_value=[other_user_session])
+  )
+
+  async def mock_get_all(refs):
+    for _ in refs:
+      yield mock.MagicMock(exists=False)
+
+  mock_firestore_client.get_all = mock_get_all
+
+  response = await service.list_sessions(app_name="test_app", user_id="")
+
+  assert response.sessions == []
+  mock_firestore_client.collection_group.assert_not_called()
+  mock_firestore_client.collection.assert_not_called()
+
+
 @pytest.mark.asyncio
 async def test_get_user_state_returns_stored_user_state(mock_firestore_client):
   """get_user_state returns the user_states document for the app and user."""