aegis-bridge 2.3.3 → 2.3.5

package/dist/channels/webhook.js

@@ -6,6 +6,7 @@
  */
 import { webhookEndpointSchema, getErrorMessage } from '../validation.js';
 import { validateWebhookUrl } from '../ssrf.js';
+import { redactSecretsFromText } from '../utils/redact-headers.js';
 export class WebhookChannel {
     name = 'webhook';
     endpoints;
@@ -124,7 +125,7 @@ export class WebhookChannel {
                 }
             }
             catch (e) {
-                lastError = getErrorMessage(e);
+                lastError = redactSecretsFromText(getErrorMessage(e), ep.headers);
                 if (attempt < maxRetries) {
                     const delay = WebhookChannel.backoff(attempt);
                     console.warn(`Webhook ${ep.url} error for ${event} (attempt ${attempt}/${maxRetries}): ${lastError}, retrying in ${Math.round(delay)}ms`);

package/dist/server.js

@@ -448,19 +448,30 @@ app.get('/v1/sessions', async (req) => {
 app.get('/sessions', async () => sessions.listSessions());
 /** Validate workDir — delegates to validation.ts (Issue #435). */
 const validateWorkDirWithConfig = (workDir) => validateWorkDir(workDir, config.allowedWorkDirs);
-// Create session
+// Create session (Issue #607: reuse idle session for same workDir)
 app.post('/v1/sessions', async (req, reply) => {
     const parsed = createSessionSchema.safeParse(req.body);
     if (!parsed.success) {
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
     }
     const { workDir, name, prompt, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove } = parsed.data;
-    console.time("POST_CREATE_SESSION");
     if (!workDir)
         return reply.status(400).send({ error: 'workDir is required' });
     const safeWorkDir = await validateWorkDirWithConfig(workDir);
     if (typeof safeWorkDir === 'object')
         return reply.status(400).send({ error: safeWorkDir.error, code: safeWorkDir.code });
+    // Issue #607: Check for an existing idle session with the same workDir
+    const existing = sessions.findIdleSessionByWorkDir(safeWorkDir);
+    if (existing) {
+        // Send prompt to the existing session if provided
+        let promptDelivery;
+        if (prompt) {
+            promptDelivery = await sessions.sendInitialPrompt(existing.id, prompt);
+            metrics.promptSent(promptDelivery.delivered);
+        }
+        return reply.status(200).send({ ...existing, reused: true, promptDelivery });
+    }
+    console.time("POST_CREATE_SESSION");
     const session = await sessions.createSession({ workDir: safeWorkDir, name, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove });
     console.timeEnd("POST_CREATE_SESSION");
     console.time("POST_CHANNEL_CREATED");
@@ -490,7 +501,7 @@ app.post('/v1/sessions', async (req, reply) => {
     }
     return reply.status(201).send({ ...session, promptDelivery });
 });
-// Backwards compat
+// Backwards compat (Issue #607: same reuse logic as v1 route)
 app.post('/sessions', async (req, reply) => {
     const parsed = createSessionSchema.safeParse(req.body);
     if (!parsed.success) {
@@ -502,6 +513,16 @@ app.post('/sessions', async (req, reply) => {
     const safeWorkDir = await validateWorkDirWithConfig(workDir);
     if (typeof safeWorkDir === 'object')
         return reply.status(400).send({ error: safeWorkDir.error, code: safeWorkDir.code });
+    // Issue #607: Check for an existing idle session with the same workDir
+    const existing = sessions.findIdleSessionByWorkDir(safeWorkDir);
+    if (existing) {
+        let promptDelivery;
+        if (prompt) {
+            promptDelivery = await sessions.sendInitialPrompt(existing.id, prompt);
+            metrics.promptSent(promptDelivery.delivered);
+        }
+        return reply.status(200).send({ ...existing, reused: true, promptDelivery });
+    }
     const session = await sessions.createSession({ workDir: safeWorkDir, name, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove });
     // Issue #46: Topic first, then prompt (same fix as v1 route)
     await channels.sessionCreated({

package/dist/session.d.ts

@@ -154,6 +154,10 @@ export declare class SessionManager {
     isWindowAlive(id: string): Promise<boolean>;
     /** List all sessions. */
     listSessions(): SessionInfo[];
+    /** Issue #607: Find an idle session for the given workDir.
+     *  Returns the most recently active idle session, or null if none found.
+     *  Used to resume existing sessions instead of creating duplicates. */
+    findIdleSessionByWorkDir(workDir: string): SessionInfo | null;
     /** Get health info for a session.
      *  Issue #2: Returns comprehensive health status for orchestrators.
      */

package/dist/session.js

@@ -652,6 +652,17 @@ export class SessionManager {
     listSessions() {
         return Object.values(this.state.sessions);
     }
+    /** Issue #607: Find an idle session for the given workDir.
+     *  Returns the most recently active idle session, or null if none found.
+     *  Used to resume existing sessions instead of creating duplicates. */
+    findIdleSessionByWorkDir(workDir) {
+        const candidates = Object.values(this.state.sessions).filter((s) => s.workDir === workDir && s.status === 'idle');
+        if (candidates.length === 0)
+            return null;
+        // Return the most recently active session
+        candidates.sort((a, b) => b.lastActivity - a.lastActivity);
+        return candidates[0];
+    }
     /** Get health info for a session.
      *  Issue #2: Returns comprehensive health status for orchestrators.
      */

package/dist/utils/redact-headers.d.ts

@@ -0,0 +1,13 @@
+/**
+ * redact-headers.ts — Redact sensitive header values for safe logging.
+ *
+ * Issue #582: Prevent webhook custom headers (Authorization, Cookie, etc.)
+ * from leaking into error logs on delivery failures.
+ */
+/** Return a copy of `headers` with sensitive values replaced. */
+export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
+/**
+ * Scrub any sensitive header *values* from arbitrary text.
+ * If a fetch error message happens to include a header value, this removes it.
+ */
+export declare function redactSecretsFromText(text: string, headers: Record<string, string> | undefined): string;

package/dist/utils/redact-headers.js

@@ -0,0 +1,55 @@
+/**
+ * redact-headers.ts — Redact sensitive header values for safe logging.
+ *
+ * Issue #582: Prevent webhook custom headers (Authorization, Cookie, etc.)
+ * from leaking into error logs on delivery failures.
+ */
+/** Header names whose values should be treated as secrets. Case-insensitive. */
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token',
+    'api-key',
+    'apikey',
+    'proxy-authorization',
+    'x-csrf-token',
+    'www-authenticate',
+    'proxy-authenticate',
+]);
+function isSensitive(headerName) {
+    return SENSITIVE_HEADER_NAMES.has(headerName.toLowerCase());
+}
+function redactValue(value) {
+    if (value.length <= 8)
+        return '[REDACTED]';
+    return `${value.slice(0, 4)}...[REDACTED]`;
+}
+/** Return a copy of `headers` with sensitive values replaced. */
+export function redactHeaders(headers) {
+    const result = {};
+    for (const [name, value] of Object.entries(headers)) {
+        result[name] = isSensitive(name) ? redactValue(value) : value;
+    }
+    return result;
+}
+/**
+ * Scrub any sensitive header *values* from arbitrary text.
+ * If a fetch error message happens to include a header value, this removes it.
+ */
+export function redactSecretsFromText(text, headers) {
+    if (!headers)
+        return text;
+    let result = text;
+    for (const [name, value] of Object.entries(headers)) {
+        if (!isSensitive(name) || !value)
+            continue;
+        // Skip very short values — too many false positives
+        if (value.length < 4)
+            continue;
+        result = result.replaceAll(value, '[REDACTED]');
+    }
+    return result;
+}
+//# sourceMappingURL=redact-headers.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-bridge",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "type": "module",
   "description": "Orchestrate Claude Code sessions via API. Create, brief, monitor, refine, ship.",
   "main": "dist/server.js",