aegis-bridge 2.3.6 → 2.3.7

package/dist/hooks.js

@@ -14,6 +14,7 @@
  * Issue #169: Phase 1 — HTTP hooks infrastructure.
  * Issue #169: Phase 3 — Hook-driven status detection.
  */
+import { isValidUUID } from './validation.js';
 /** CC hook events that require a decision response. */
 const DECISION_EVENTS = new Set(['PreToolUse', 'PermissionRequest']);
 /** Permission modes that should be auto-approved via hook response. */
@@ -105,6 +106,10 @@ export function registerHookRoutes(app, deps) {
         if (!sessionId) {
             return reply.status(400).send({ error: 'Missing session ID — provide X-Session-Id header or sessionId query param' });
         }
+        // Issue #580: Reject non-UUID session IDs before getSession lookup.
+        if (!isValidUUID(sessionId)) {
+            return reply.status(400).send({ error: 'Invalid session ID — must be a UUID' });
+        }
         const session = deps.sessions.getSession(sessionId);
         if (!session) {
             return reply.status(404).send({ error: `Session ${sessionId} not found` });

package/dist/server.js

@@ -155,11 +155,15 @@ function setupAuth(authManager) {
             return;
         // Hook routes — exact match: /v1/hooks/{eventName} (alpha only, no path traversal)
         // Issue #394: Require valid X-Session-Id for known sessions instead of blanket bypass.
+        // Issue #580: Validate UUID format before getSession lookup.
         // CC hooks run from localhost and always include the session ID they were started with.
         const hookMatch = /^\/v1\/hooks\/[A-Za-z]+$/.exec(urlPath);
         if (hookMatch) {
             const hookSessionId = req.headers['x-session-id']
                 || req.query?.sessionId;
+            if (hookSessionId && !isValidUUID(hookSessionId)) {
+                return reply.status(400).send({ error: 'Invalid session ID — must be a UUID' });
+            }
             if (hookSessionId && sessions.getSession(hookSessionId)) {
                 return; // valid session — allow
             }
@@ -437,11 +441,10 @@ app.get('/v1/sessions', async (req) => {
     const total = all.length;
     const start = (page - 1) * limit;
     const items = all.slice(start, start + limit);
+    const totalPages = Math.ceil(total / limit);
     return {
         sessions: items,
-        total,
-        page,
-        limit,
+        pagination: { page, limit, total, totalPages },
     };
 });
 // Backwards compat: /sessions (no prefix) returns raw array

package/dist/ws-terminal.js

@@ -182,8 +182,8 @@ export function registerWsTerminalRoute(app, sessions, tmux, auth) {
                     await sessions.sendMessage(sessionId, msg.text);
                 }
                 else if (msg.type === 'resize') {
-                    const cols = clamp(msg.cols ?? 80, 1, 1000, 80);
-                    const rows = clamp(msg.rows ?? 24, 1, 1000, 24);
+                    const cols = clamp(msg.cols ?? 80, 10, 500, 80);
+                    const rows = clamp(msg.rows ?? 24, 5, 200, 24);
                     await tmux.resizePane(session.windowId, cols, rows);
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-bridge",
-  "version": "2.3.6",
+  "version": "2.3.7",
   "type": "module",
   "description": "Orchestrate Claude Code sessions via API. Create, brief, monitor, refine, ship.",
   "main": "dist/server.js",