aegis-bridge 2.4.0 → 2.4.1

package/dist/config.js

@@ -146,12 +146,19 @@ function applyEnvOverrides(config) {
             case 'tgAllowedUsers':
                 config[key] = value.split(',').map(s => Number(s.trim())).filter(n => !isNaN(n) && n > 0);
                 break;
+            // All remaining env-mapped keys are string-typed — assign directly.
+            case 'host':
+            case 'authToken':
+            case 'tmuxSession':
+            case 'stateDir':
+            case 'claudeProjectsDir':
+            case 'tgBotToken':
+            case 'tgGroupId':
+                config[key] = value;
+                break;
             default:
                 // Skip complex types (Record<string,string>) that can't be set from a single env var
-                if (typeof config[key] === 'object' && config[key] !== null && !Array.isArray(config[key]))
-                    break;
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                config[key] = value;
+                break;
         }
     }
     return config;

package/dist/events.d.ts

@@ -74,6 +74,8 @@ export declare class SessionEventBus {
     subscriberCount(sessionId: string): number;
     /** Global emitter for aggregating events across all sessions. */
     private globalEmitter;
+    /** #689: Pending setImmediate timers for cleanup on destroy. */
+    private pendingTimers;
     /** Subscribe to events from ALL sessions (new and existing). Returns unsubscribe function. */
     subscribeGlobal(handler: (event: GlobalSSEEvent) => void): () => void;
     /** Emit a session created event to global subscribers. */

package/dist/events.js

@@ -98,7 +98,11 @@ export class SessionEventBus {
         }
         const emitter = this.emitters.get(sessionId);
         if (emitter) {
-            setImmediate(() => emitter.emit('event', event));
+            const imm = setImmediate(() => {
+                this.pendingTimers.delete(imm);
+                emitter.emit('event', event);
+            });
+            this.pendingTimers.add(imm);
         }
         // Forward to global subscribers
         if (this.globalEmitter) {
@@ -108,7 +112,11 @@ export class SessionEventBus {
             if (this.globalEventBuffer.length > SessionEventBus.BUFFER_SIZE) {
                 this.globalEventBuffer.splice(0, this.globalEventBuffer.length - SessionEventBus.BUFFER_SIZE);
             }
-            setImmediate(() => this.globalEmitter.emit('event', globalEvent));
+            const imm = setImmediate(() => {
+                this.pendingTimers.delete(imm);
+                this.globalEmitter?.emit('event', globalEvent);
+            });
+            this.pendingTimers.add(imm);
         }
     }
     /** Get events emitted after the given event ID for a session. */
@@ -217,6 +225,8 @@ export class SessionEventBus {
     // ── Global (all-session) SSE ──────────────────────────────────────
     /** Global emitter for aggregating events across all sessions. */
     globalEmitter = null;
+    /** #689: Pending setImmediate timers for cleanup on destroy. */
+    pendingTimers = new Set();
     /** Subscribe to events from ALL sessions (new and existing). Returns unsubscribe function. */
     subscribeGlobal(handler) {
         if (!this.globalEmitter) {
@@ -226,6 +236,10 @@ export class SessionEventBus {
         this.globalEmitter.on('event', handler);
         return () => {
             this.globalEmitter?.off('event', handler);
+            // #689: Nullify globalEmitter when all subscribers leave
+            if (this.globalEmitter && this.globalEmitter.listenerCount('event') === 0) {
+                this.globalEmitter = null;
+            }
         };
     }
     /** Emit a session created event to global subscribers. */
@@ -262,6 +276,11 @@ export class SessionEventBus {
     }
     /** Clean up all emitters. */
     destroy() {
+        // #689: Clear pending setImmediate timers before removing listeners
+        for (const imm of this.pendingTimers) {
+            clearImmediate(imm);
+        }
+        this.pendingTimers.clear();
         for (const emitter of this.emitters.values()) {
             emitter.removeAllListeners();
         }

package/dist/hooks.js

@@ -14,7 +14,7 @@
  * Issue #169: Phase 1 — HTTP hooks infrastructure.
  * Issue #169: Phase 3 — Hook-driven status detection.
  */
-import { isValidUUID } from './validation.js';
+import { isValidUUID, hookBodySchema } from './validation.js';
 /** CC hook events that require a decision response. */
 const DECISION_EVENTS = new Set(['PreToolUse', 'PermissionRequest']);
 /** Permission modes that should be auto-approved via hook response. */
@@ -114,10 +114,15 @@ export function registerHookRoutes(app, deps) {
         if (!session) {
             return reply.status(404).send({ error: `Session ${sessionId} not found` });
         }
+        // Issue #665: Validate hook body with Zod instead of unsafe casts
+        const parseResult = hookBodySchema.safeParse(req.body);
+        if (!parseResult.success) {
+            return reply.status(400).send({ error: `Invalid hook body: ${parseResult.error.message}` });
+        }
+        const hookBody = parseResult.data;
         // Issue #88: Track active subagents
-        const hookBody = req.body;
         if (eventName === 'SubagentStart') {
-            const agentName = hookBody?.agent_name || hookBody?.tool_input?.command || 'unknown';
+            const agentName = hookBody.agent_name || hookBody.tool_input?.command || 'unknown';
             deps.sessions.addSubagent(sessionId, agentName);
             deps.eventBus.emit(sessionId, {
                 event: 'subagent_start',
@@ -127,7 +132,7 @@ export function registerHookRoutes(app, deps) {
             });
         }
         else if (eventName === 'SubagentStop') {
-            const agentName = hookBody?.agent_name || 'unknown';
+            const agentName = hookBody.agent_name || 'unknown';
             deps.sessions.removeSubagent(sessionId, agentName);
             deps.eventBus.emit(sessionId, {
                 event: 'subagent_stop',
@@ -149,16 +154,15 @@ export function registerHookRoutes(app, deps) {
         if (eventName === 'PreCompact' || eventName === 'PostCompact') {
             session.lastActivity = Date.now();
         }
-        // Forward the raw hook event to SSE subscribers
-        deps.eventBus.emitHook(sessionId, eventName, req.body);
+        // Forward the validated hook event to SSE subscribers
+        deps.eventBus.emitHook(sessionId, eventName, hookBody);
         // Issue #89 L25: Capture model field from hook payload for dashboard display
-        const hookPayload = req.body;
-        if (hookPayload?.model && typeof hookPayload.model === 'string') {
-            deps.sessions.updateSessionModel(sessionId, hookPayload.model);
+        if (hookBody.model) {
+            deps.sessions.updateSessionModel(sessionId, hookBody.model);
         }
         // Issue #89 L24: Validate permission_mode from PermissionRequest hook
         if (eventName === 'PermissionRequest') {
-            const rawMode = hookBody?.permission_mode;
+            const rawMode = hookBody.permission_mode;
             if (rawMode !== undefined && !VALID_PERMISSION_MODES.has(rawMode)) {
                 console.warn(`Hooks: invalid permission_mode "${rawMode}" from PermissionRequest, using "default"`);
                 hookBody.permission_mode = 'default';
@@ -167,8 +171,8 @@ export function registerHookRoutes(app, deps) {
         // Issue #169 Phase 3: Update session status from hook event
         // Issue #87: Extract timestamp from hook payload for latency calculation
         const hookReceivedAt = Date.now();
-        const hookEventTimestamp = hookPayload?.timestamp
-            ? new Date(hookPayload.timestamp).getTime()
+        const hookEventTimestamp = hookBody.timestamp
+            ? new Date(hookBody.timestamp).getTime()
             : undefined;
         // Issue #87: Record hook latency if we have a timestamp from the payload
         if (hookEventTimestamp && deps.metrics) {
@@ -202,22 +206,20 @@ export function registerHookRoutes(app, deps) {
                     deps.eventBus.emitStatus(sessionId, 'working', 'Elicitation result received (hook: ElicitationResult)');
                     break;
                 case 'PermissionRequest':
-                    deps.eventBus.emitApproval(sessionId, req.body?.permission_prompt
-                        || 'Permission requested (hook)');
+                    deps.eventBus.emitApproval(sessionId, hookBody.permission_prompt || 'Permission requested (hook)');
                     break;
             }
         }
         // Decision events need a response body that CC uses
         // Format: { hookSpecificOutput: { hookEventName, permissionDecision, reason? } }
         if (DECISION_EVENTS.has(eventName)) {
-            const hookBody = req.body;
-            const toolName = hookBody?.tool_name || '';
-            const permissionPrompt = hookBody?.permission_prompt || '';
+            const toolName = hookBody.tool_name || '';
+            const permissionPrompt = hookBody.permission_prompt || '';
             if (eventName === 'PreToolUse') {
                 // Issue #336: Intercept AskUserQuestion for headless question answering
                 if (toolName === 'AskUserQuestion') {
-                    const toolInput = hookBody?.tool_input;
-                    const toolUseId = hookBody?.tool_use_id || '';
+                    const toolInput = hookBody.tool_input;
+                    const toolUseId = hookBody.tool_use_id || '';
                     const questionText = extractQuestionText(toolInput);
                     // Emit ask_question SSE event for external clients
                     deps.eventBus.emit(sessionId, {

package/dist/monitor.js

@@ -234,7 +234,7 @@ export class SessionMonitor {
                             await this.channels.statusChange(this.makePayload('status.permission_timeout', session, detail));
                         }
                         catch (e) {
-                            console.error(`Monitor: auto-reject failed for session ${session.id}: ${e.message}`);
+                            console.error(`Monitor: auto-reject failed for session ${session.id}: ${e instanceof Error ? e.message : String(e)}`);
                         }
                     }
                 }

package/dist/server.js

@@ -236,11 +236,11 @@ const createSessionSchema = z.object({
     claudeCommand: z.string().max(10_000).optional(),
     env: z.record(z.string(), z.string()).optional(),
     stallThresholdMs: z.number().int().positive().max(3_600_000).optional(),
-    permissionMode: z.enum(['default', 'bypassPermissions', 'plan']).optional(),
+    permissionMode: z.enum(['default', 'bypassPermissions', 'plan', 'acceptEdits', 'dontAsk', 'auto']).optional(),
     autoApprove: z.boolean().optional(),
 }).strict();
 // Health — Issue #397: includes tmux server health check
-app.get('/v1/health', async () => {
+async function healthHandler() {
     const pkg = await import('../package.json', { with: { type: 'json' } });
     const activeCount = sessions.listSessions().length;
     const totalCount = metrics.getTotalSessionsCreated();
@@ -254,23 +254,9 @@ app.get('/v1/health', async () => {
         tmux: tmuxHealth,
         timestamp: new Date().toISOString(),
     };
-});
-// Backwards compat: unversioned health
-app.get('/health', async () => {
-    const pkg = await import('../package.json', { with: { type: 'json' } });
-    const activeCount = sessions.listSessions().length;
-    const totalCount = metrics.getTotalSessionsCreated();
-    const tmuxHealth = await tmux.isServerHealthy();
-    const status = tmuxHealth.healthy ? 'ok' : 'degraded';
-    return {
-        status,
-        version: pkg.default.version,
-        uptime: process.uptime(),
-        sessions: { active: activeCount, total: totalCount },
-        tmux: tmuxHealth,
-        timestamp: new Date().toISOString(),
-    };
-});
+}
+app.get('/v1/health', healthHandler);
+app.get('/health', healthHandler);
 // Issue #81: Swarm awareness — list all detected CC swarms and their teammates
 app.get('/v1/swarm', async () => {
     const result = await swarmMonitor.scan();
@@ -335,7 +321,7 @@ app.get('/v1/sessions/:id/metrics', async (req, reply) => {
 // Issue #89 L14: Webhook dead letter queue
 app.get('/v1/webhooks/dead-letter', async () => {
     for (const ch of channels.getChannels()) {
-        if (ch.name === 'webhook' && 'getDeadLetterQueue' in ch) {
+        if (ch.name === 'webhook' && typeof ch.getDeadLetterQueue === 'function') {
             return ch.getDeadLetterQueue();
         }
     }
@@ -457,7 +443,7 @@ app.get('/sessions', async () => sessions.listSessions());
 /** Validate workDir — delegates to validation.ts (Issue #435). */
 const validateWorkDirWithConfig = (workDir) => validateWorkDir(workDir, config.allowedWorkDirs);
 // Create session (Issue #607: reuse idle session for same workDir)
-app.post('/v1/sessions', async (req, reply) => {
+async function createSessionHandler(req, reply) {
     const parsed = createSessionSchema.safeParse(req.body);
     if (!parsed.success) {
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -508,58 +494,18 @@ app.post('/v1/sessions', async (req, reply) => {
         console.timeEnd("POST_SEND_INITIAL_PROMPT");
     }
     return reply.status(201).send({ ...session, promptDelivery });
-});
-// Backwards compat (Issue #607: same reuse logic as v1 route)
-app.post('/sessions', async (req, reply) => {
-    const parsed = createSessionSchema.safeParse(req.body);
-    if (!parsed.success) {
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    }
-    const { workDir, name, prompt, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove } = parsed.data;
-    if (!workDir)
-        return reply.status(400).send({ error: 'workDir is required' });
-    const safeWorkDir = await validateWorkDirWithConfig(workDir);
-    if (typeof safeWorkDir === 'object')
-        return reply.status(400).send({ error: safeWorkDir.error, code: safeWorkDir.code });
-    // Issue #607: Check for an existing idle session with the same workDir
-    const existing = sessions.findIdleSessionByWorkDir(safeWorkDir);
-    if (existing) {
-        let promptDelivery;
-        if (prompt) {
-            promptDelivery = await sessions.sendInitialPrompt(existing.id, prompt);
-            metrics.promptSent(promptDelivery.delivered);
-        }
-        return reply.status(200).send({ ...existing, reused: true, promptDelivery });
-    }
-    const session = await sessions.createSession({ workDir: safeWorkDir, name, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove });
-    // Issue #46: Topic first, then prompt (same fix as v1 route)
-    await channels.sessionCreated({
-        event: 'session.created',
-        timestamp: new Date().toISOString(),
-        session: { id: session.id, name: session.windowName, workDir },
-        detail: `Session created: ${session.windowName}`,
-        meta: prompt ? { prompt: prompt.slice(0, 200), permissionMode: permissionMode ?? (autoApprove ? 'bypassPermissions' : undefined) } : undefined,
-    });
-    let promptDelivery;
-    if (prompt) {
-        promptDelivery = await sessions.sendInitialPrompt(session.id, prompt);
-        metrics.promptSent(promptDelivery.delivered);
-    }
-    return reply.status(201).send({ ...session, promptDelivery });
-});
+}
+app.post('/v1/sessions', createSessionHandler);
+app.post('/sessions', createSessionHandler);
 // Get session (Issue #20: includes actionHints for interactive states)
-app.get('/v1/sessions/:id', async (req, reply) => {
+async function getSessionHandler(req, reply) {
     const session = sessions.getSession(req.params.id);
     if (!session)
         return reply.status(404).send({ error: 'Session not found' });
     return addActionHints(session, sessions);
-});
-app.get('/sessions/:id', async (req, reply) => {
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    return addActionHints(session, sessions);
-});
+}
+app.get('/v1/sessions/:id', getSessionHandler);
+app.get('/sessions/:id', getSessionHandler);
 // #128: Bulk health check — returns health for all sessions in one request
 app.get('/v1/sessions/health', async () => {
     const allSessions = sessions.listSessions();
@@ -580,43 +526,18 @@ app.get('/v1/sessions/health', async () => {
     return results;
 });
 // Session health check (Issue #2)
-app.get('/v1/sessions/:id/health', async (req, reply) => {
+async function sessionHealthHandler(req, reply) {
     try {
         return await sessions.getHealth(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.get('/sessions/:id/health', async (req, reply) => {
-    try {
-        return await sessions.getHealth(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.get('/v1/sessions/:id/health', sessionHealthHandler);
+app.get('/sessions/:id/health', sessionHealthHandler);
 // Send message (with delivery verification — Issue #1)
-app.post('/v1/sessions/:id/send', async (req, reply) => {
-    const parsed = sendMessageSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { text } = parsed.data;
-    try {
-        const result = await sessions.sendMessage(req.params.id, text);
-        await channels.message({
-            event: 'message.user',
-            timestamp: new Date().toISOString(),
-            session: { id: req.params.id, name: '', workDir: '' },
-            detail: text,
-        });
-        return { ok: true, delivered: result.delivered, attempts: result.attempts };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/send', async (req, reply) => {
+async function sendMessageHandler(req, reply) {
     const parsed = sendMessageSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -634,26 +555,22 @@ app.post('/sessions/:id/send', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/send', sendMessageHandler);
+app.post('/sessions/:id/send', sendMessageHandler);
 // Read messages
-app.get('/v1/sessions/:id/read', async (req, reply) => {
+async function readMessagesHandler(req, reply) {
     try {
         return await sessions.readMessages(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.get('/sessions/:id/read', async (req, reply) => {
-    try {
-        return await sessions.readMessages(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.get('/v1/sessions/:id/read', readMessagesHandler);
+app.get('/sessions/:id/read', readMessagesHandler);
 // Approve
-app.post('/v1/sessions/:id/approve', async (req, reply) => {
+async function approveHandler(req, reply) {
     try {
         await sessions.approve(req.params.id);
         // Issue #87: Record permission response latency
@@ -666,22 +583,11 @@ app.post('/v1/sessions/:id/approve', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/approve', async (req, reply) => {
-    try {
-        await sessions.approve(req.params.id);
-        const lat = sessions.getLatencyMetrics(req.params.id);
-        if (lat !== null && lat.permission_response_ms !== null) {
-            metrics.recordPermissionResponse(req.params.id, lat.permission_response_ms);
-        }
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/approve', approveHandler);
+app.post('/sessions/:id/approve', approveHandler);
 // Reject
-app.post('/v1/sessions/:id/reject', async (req, reply) => {
+async function rejectHandler(req, reply) {
     try {
         await sessions.reject(req.params.id);
         const lat = sessions.getLatencyMetrics(req.params.id);
@@ -693,20 +599,9 @@ app.post('/v1/sessions/:id/reject', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/reject', async (req, reply) => {
-    try {
-        await sessions.reject(req.params.id);
-        const lat = sessions.getLatencyMetrics(req.params.id);
-        if (lat !== null && lat.permission_response_ms !== null) {
-            metrics.recordPermissionResponse(req.params.id, lat.permission_response_ms);
-        }
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/reject', rejectHandler);
+app.post('/sessions/:id/reject', rejectHandler);
 // Issue #336: Answer pending AskUserQuestion
 app.post('/v1/sessions/:id/answer', async (req, reply) => {
     const { questionId, answer } = req.body || {};
@@ -723,16 +618,7 @@ app.post('/v1/sessions/:id/answer', async (req, reply) => {
     return { ok: true };
 });
 // Escape
-app.post('/v1/sessions/:id/escape', async (req, reply) => {
-    try {
-        await sessions.escape(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/escape', async (req, reply) => {
+async function escapeHandler(req, reply) {
     try {
         await sessions.escape(req.params.id);
         return { ok: true };
@@ -740,9 +626,11 @@ app.post('/sessions/:id/escape', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/escape', escapeHandler);
+app.post('/sessions/:id/escape', escapeHandler);
 // Interrupt (Ctrl+C)
-app.post('/v1/sessions/:id/interrupt', async (req, reply) => {
+async function interruptHandler(req, reply) {
     try {
         await sessions.interrupt(req.params.id);
         return { ok: true };
@@ -750,18 +638,11 @@ app.post('/v1/sessions/:id/interrupt', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/interrupt', async (req, reply) => {
-    try {
-        await sessions.interrupt(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/interrupt', interruptHandler);
+app.post('/sessions/:id/interrupt', interruptHandler);
 // Kill session
-app.delete('/v1/sessions/:id', async (req, reply) => {
+async function killSessionHandler(req, reply) {
     if (!sessions.getSession(req.params.id)) {
         return reply.status(404).send({ error: 'Session not found' });
     }
@@ -776,54 +657,21 @@ app.delete('/v1/sessions/:id', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.delete('/sessions/:id', async (req, reply) => {
-    if (!sessions.getSession(req.params.id)) {
-        return reply.status(404).send({ error: 'Session not found' });
-    }
-    try {
-        eventBus.emitEnded(req.params.id, 'killed');
-        await channels.sessionEnded(makePayload('session.ended', req.params.id, 'killed'));
-        await sessions.killSession(req.params.id);
-        monitor.removeSession(req.params.id);
-        metrics.cleanupSession(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.delete('/v1/sessions/:id', killSessionHandler);
+app.delete('/sessions/:id', killSessionHandler);
 // Capture raw pane
-app.get('/v1/sessions/:id/pane', async (req, reply) => {
+async function capturePaneHandler(req, reply) {
     const session = sessions.getSession(req.params.id);
     if (!session)
         return reply.status(404).send({ error: 'Session not found' });
     const pane = await tmux.capturePane(session.windowId);
     return { pane };
-});
-app.get('/sessions/:id/pane', async (req, reply) => {
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    const pane = await tmux.capturePane(session.windowId);
-    return { pane };
-});
+}
+app.get('/v1/sessions/:id/pane', capturePaneHandler);
+app.get('/sessions/:id/pane', capturePaneHandler);
 // Slash command
-app.post('/v1/sessions/:id/command', async (req, reply) => {
-    const parsed = commandSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { command } = parsed.data;
-    try {
-        const cmd = command.startsWith('/') ? command : `/${command}`;
-        await sessions.sendMessage(req.params.id, cmd);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/command', async (req, reply) => {
+async function commandHandler(req, reply) {
     const parsed = commandSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -836,23 +684,11 @@ app.post('/sessions/:id/command', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/command', commandHandler);
+app.post('/sessions/:id/command', commandHandler);
 // Bash mode
-app.post('/v1/sessions/:id/bash', async (req, reply) => {
-    const parsed = bashSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { command } = parsed.data;
-    try {
-        const cmd = command.startsWith('!') ? command : `!${command}`;
-        await sessions.sendMessage(req.params.id, cmd);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/bash', async (req, reply) => {
+async function bashHandler(req, reply) {
     const parsed = bashSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -865,24 +701,20 @@ app.post('/sessions/:id/bash', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/bash', bashHandler);
+app.post('/sessions/:id/bash', bashHandler);
 // Session summary (Issue #35)
-app.get('/v1/sessions/:id/summary', async (req, reply) => {
-    try {
-        return await sessions.getSummary(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.get('/sessions/:id/summary', async (req, reply) => {
+async function summaryHandler(req, reply) {
     try {
         return await sessions.getSummary(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.get('/v1/sessions/:id/summary', summaryHandler);
+app.get('/sessions/:id/summary', summaryHandler);
 // Paginated transcript read
 app.get('/v1/sessions/:id/transcript', async (req, reply) => {
     try {
@@ -896,7 +728,7 @@ app.get('/v1/sessions/:id/transcript', async (req, reply) => {
     }
 });
 // Screenshot capture (Issue #22)
-app.post('/v1/sessions/:id/screenshot', async (req, reply) => {
+async function screenshotHandler(req, reply) {
     const parsed = screenshotSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -925,36 +757,9 @@ app.post('/v1/sessions/:id/screenshot', async (req, reply) => {
     catch (e) {
         return reply.status(500).send({ error: `Screenshot failed: ${e instanceof Error ? e.message : String(e)}` });
     }
-});
-app.post('/sessions/:id/screenshot', async (req, reply) => {
-    const parsed = screenshotSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { url, fullPage, width, height } = parsed.data;
-    const urlError = validateScreenshotUrl(url);
-    if (urlError)
-        return reply.status(400).send({ error: urlError });
-    // Post-DNS-resolution check: resolve hostname and reject private IPs
-    const dnsError = await resolveAndCheckIp(new URL(url).hostname);
-    if (dnsError)
-        return reply.status(400).send({ error: dnsError });
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    if (!isPlaywrightAvailable()) {
-        return reply.status(501).send({
-            error: 'Playwright is not installed',
-            message: 'Install Playwright to enable screenshots: npx playwright install chromium && npm install -D playwright',
-        });
-    }
-    try {
-        const result = await captureScreenshot({ url, fullPage, width, height });
-        return reply.status(200).send(result);
-    }
-    catch (e) {
-        return reply.status(500).send({ error: `Screenshot failed: ${e instanceof Error ? e.message : String(e)}` });
-    }
-});
+}
+app.post('/v1/sessions/:id/screenshot', screenshotHandler);
+app.post('/sessions/:id/screenshot', screenshotHandler);
 // SSE event stream (Issue #32)
 app.get('/v1/sessions/:id/events', async (req, reply) => {
     const session = sessions.getSession(req.params.id);

package/dist/session.js

@@ -14,6 +14,18 @@ import { computeStallThreshold } from './config.js';
 import { neutralizeBypassPermissions, restoreSettings, cleanOrphanedBackup } from './permission-guard.js';
 import { persistedStateSchema, sessionMapSchema } from './validation.js';
 import { writeHookSettingsFile, cleanupHookSettingsFile } from './hook-settings.js';
+/** Convert parsed JSON arrays to Sets for activeSubagents (#668). */
+function hydrateSessions(raw) {
+    const sessions = {};
+    for (const [id, s] of Object.entries(raw)) {
+        const { activeSubagents, ...rest } = s;
+        sessions[id] = {
+            ...rest,
+            activeSubagents: activeSubagents ? new Set(activeSubagents) : undefined,
+        };
+    }
+    return sessions;
+}
 /**
  * Detect whether CC is showing numbered permission options (e.g. "1. Yes, 2. No")
  * vs a simple y/N prompt. Returns the approval method to use.
@@ -99,7 +111,7 @@ export class SessionManager {
                 const raw = await readFile(this.stateFile, 'utf-8');
                 const parsed = persistedStateSchema.safeParse(JSON.parse(raw));
                 if (parsed.success && this.isValidState({ sessions: parsed.data })) {
-                    this.state = { sessions: parsed.data };
+                    this.state = { sessions: hydrateSessions(parsed.data) };
                 }
                 else {
                     console.warn('State file failed validation, attempting backup restore');
@@ -110,7 +122,7 @@ export class SessionManager {
                             const backupRaw = await readFile(backupFile, 'utf-8');
                             const backupParsed = persistedStateSchema.safeParse(JSON.parse(backupRaw));
                             if (backupParsed.success && this.isValidState({ sessions: backupParsed.data })) {
-                                this.state = { sessions: backupParsed.data };
+                                this.state = { sessions: hydrateSessions(backupParsed.data) };
                                 console.log('Restored state from backup');
                             }
                             else {
@@ -130,12 +142,6 @@ export class SessionManager {
                 this.state = { sessions: {} };
             }
         }
-        // #357: Convert deserialized activeSubagents arrays to Sets
-        for (const session of Object.values(this.state.sessions)) {
-            if (Array.isArray(session.activeSubagents)) {
-                session.activeSubagents = new Set(session.activeSubagents);
-            }
-        }
         // Create backup of successfully loaded state
         try {
             await writeFile(`${this.stateFile}.bak`, JSON.stringify(this.state, null, 2));

package/dist/terminal-parser.js

@@ -142,11 +142,13 @@ export function detectUIState(paneText) {
         return 'waiting_for_input';
     return 'unknown';
 }
+/** Number of lines from the bottom of the pane to scan for active spinners. */
+const SPINNER_SEARCH_LINES = 30;
 /** Check if any line in the pane has an active spinner character followed by working text. */
 function hasSpinnerAnywhere(lines) {
     // Only check lines in the content area (not the very bottom few which are prompt/footer)
     const searchEnd = Math.max(0, lines.length - 3);
-    for (let i = Math.max(0, lines.length - 20); i < searchEnd; i++) {
+    for (let i = Math.max(0, lines.length - SPINNER_SEARCH_LINES); i < searchEnd; i++) {
         const stripped = lines[i].trim();
         if (!stripped)
             continue;

package/dist/tmux.js

@@ -39,7 +39,7 @@ export class TmuxManager {
         this.socketName = socketName ?? `aegis-${process.pid}`;
     }
     /** Promise-chain queue that serializes all tmux CLI calls to prevent race conditions. */
-    queue = Promise.resolve(undefined);
+    queue = Promise.resolve();
     /** #403: Counter of in-flight createWindow calls — direct methods must queue when > 0. */
     _creatingCount = 0;
     /** #357: Short-lived cache for window existence checks to reduce CLI calls. */

package/dist/validation.d.ts

@@ -40,6 +40,25 @@ export declare const webhookEndpointSchema: z.ZodObject<{
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
+/** POST /v1/hooks/:eventName — CC hook event payload (Issue #665). */
+export declare const hookBodySchema: z.ZodObject<{
+    session_id: z.ZodOptional<z.ZodString>;
+    agent_name: z.ZodOptional<z.ZodString>;
+    agent_type: z.ZodOptional<z.ZodString>;
+    tool_name: z.ZodOptional<z.ZodString>;
+    tool_input: z.ZodOptional<z.ZodObject<{
+        command: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    tool_use_id: z.ZodOptional<z.ZodString>;
+    permission_prompt: z.ZodOptional<z.ZodString>;
+    permission_mode: z.ZodOptional<z.ZodString>;
+    hook_event_name: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    timestamp: z.ZodOptional<z.ZodString>;
+    stop_reason: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+    command: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
 /** POST /v1/sessions/:id/hooks/permission */
 export declare const permissionHookSchema: z.ZodObject<{
     session_id: z.ZodOptional<z.ZodString>;
@@ -64,6 +83,9 @@ export declare const batchSessionSchema: z.ZodObject<{
             default: "default";
             bypassPermissions: "bypassPermissions";
             plan: "plan";
+            acceptEdits: "acceptEdits";
+            dontAsk: "dontAsk";
+            auto: "auto";
         }>>;
         autoApprove: z.ZodOptional<z.ZodBoolean>;
         stallThresholdMs: z.ZodOptional<z.ZodNumber>;
@@ -82,6 +104,9 @@ export declare const pipelineSchema: z.ZodObject<{
             default: "default";
             bypassPermissions: "bypassPermissions";
             plan: "plan";
+            acceptEdits: "acceptEdits";
+            dontAsk: "dontAsk";
+            auto: "auto";
         }>>;
         autoApprove: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
@@ -104,9 +129,9 @@ export declare const persistedStateSchema: z.ZodRecord<z.ZodString, z.ZodObject<
     monitorOffset: z.ZodNumber;
     status: z.ZodEnum<{
         unknown: "unknown";
+        permission_prompt: "permission_prompt";
         idle: "idle";
         working: "working";
-        permission_prompt: "permission_prompt";
         bash_approval: "bash_approval";
         plan_mode: "plan_mode";
         ask_question: "ask_question";
@@ -116,7 +141,14 @@ export declare const persistedStateSchema: z.ZodRecord<z.ZodString, z.ZodObject<
     lastActivity: z.ZodNumber;
     stallThresholdMs: z.ZodNumber;
     permissionStallMs: z.ZodDefault<z.ZodNumber>;
-    permissionMode: z.ZodString;
+    permissionMode: z.ZodEnum<{
+        default: "default";
+        bypassPermissions: "bypassPermissions";
+        plan: "plan";
+        acceptEdits: "acceptEdits";
+        dontAsk: "dontAsk";
+        auto: "auto";
+    }>;
     settingsPatched: z.ZodOptional<z.ZodBoolean>;
     hookSettingsFile: z.ZodOptional<z.ZodString>;
     lastHookAt: z.ZodOptional<z.ZodNumber>;

package/dist/validation.js

@@ -43,6 +43,23 @@ export const webhookEndpointSchema = z.object({
     headers: z.record(z.string(), z.string()).optional(),
     timeoutMs: z.number().int().positive().optional(),
 }).strict();
+/** POST /v1/hooks/:eventName — CC hook event payload (Issue #665). */
+export const hookBodySchema = z.object({
+    session_id: z.string().optional(),
+    agent_name: z.string().optional(),
+    agent_type: z.string().optional(),
+    tool_name: z.string().optional(),
+    tool_input: z.object({ command: z.string().optional() }).passthrough().optional(),
+    tool_use_id: z.string().optional(),
+    permission_prompt: z.string().optional(),
+    permission_mode: z.string().optional(),
+    hook_event_name: z.string().optional(),
+    model: z.string().optional(),
+    timestamp: z.string().optional(),
+    stop_reason: z.string().optional(),
+    cwd: z.string().optional(),
+    command: z.string().optional(),
+}).passthrough();
 /** POST /v1/sessions/:id/hooks/permission */
 export const permissionHookSchema = z.object({
     session_id: z.string().optional(),
@@ -61,7 +78,7 @@ const batchSessionSpecSchema = z.object({
     name: z.string().max(200).optional(),
     workDir: z.string().min(1),
     prompt: z.string().max(100_000).optional(),
-    permissionMode: z.enum(['default', 'bypassPermissions', 'plan']).optional(),
+    permissionMode: z.enum(['default', 'bypassPermissions', 'plan', 'acceptEdits', 'dontAsk', 'auto']).optional(),
     autoApprove: z.boolean().optional(),
     stallThresholdMs: z.number().int().positive().max(3_600_000).optional(),
 });
@@ -74,7 +91,7 @@ const pipelineStageSchema = z.object({
     workDir: z.string().min(1).optional(),
     prompt: z.string().min(1).max(MAX_INPUT_LENGTH),
     dependsOn: z.array(z.string()).optional(),
-    permissionMode: z.enum(['default', 'bypassPermissions', 'plan']).optional(),
+    permissionMode: z.enum(['default', 'bypassPermissions', 'plan', 'acceptEdits', 'dontAsk', 'auto']).optional(),
     autoApprove: z.boolean().optional(),
 });
 /** POST /v1/pipelines */
@@ -122,7 +139,7 @@ export const persistedStateSchema = z.record(z.string(), z.object({
     lastActivity: z.number(),
     stallThresholdMs: z.number(),
     permissionStallMs: z.number().default(300_000),
-    permissionMode: z.string(),
+    permissionMode: z.enum(['default', 'bypassPermissions', 'plan', 'acceptEdits', 'dontAsk', 'auto']),
     settingsPatched: z.boolean().optional(),
     hookSettingsFile: z.string().optional(),
     lastHookAt: z.number().optional(),

package/dist/ws-terminal.js

@@ -31,7 +31,8 @@ const sessionPolls = new Map();
 /** Reset all internal state (for testing). */
 export function _resetForTesting() {
     for (const poll of sessionPolls.values()) {
-        clearInterval(poll.timer);
+        if (poll.timer)
+            clearInterval(poll.timer);
     }
     sessionPolls.clear();
 }
@@ -282,7 +283,8 @@ function evictSubscriber(sessionId, socket, sub) {
         poll.subscribers.delete(socket);
         // If no more subscribers, clean up the poll timer
         if (poll.subscribers.size === 0) {
-            clearInterval(poll.timer);
+            if (poll.timer)
+                clearInterval(poll.timer);
             sessionPolls.delete(sessionId);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-bridge",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "type": "module",
   "description": "Orchestrate Claude Code sessions via API. Create, brief, monitor, refine, ship.",
   "main": "dist/server.js",