aegis-bridge 2.4.0 → 2.5.0

package/dist/server.js

@@ -117,30 +117,36 @@ app.addHook('onSend', (req, reply, payload, done) => {
     reply.header('Permissions-Policy', 'camera=(), microphone=()');
     done();
 });
-// Auth middleware setup (Issue #39: multi-key auth with rate limiting)
-// #228: Per-IP rate limiting (applies even with master token, with higher limits)
 const ipRateLimits = new Map();
 const IP_WINDOW_MS = 60_000;
 const IP_LIMIT_NORMAL = 120; // per minute for regular keys
 const IP_LIMIT_MASTER = 300; // per minute for master token
 function checkIpRateLimit(ip, isMaster) {
     const now = Date.now();
-    const timestamps = ipRateLimits.get(ip) || [];
-    // Prune old entries
-    while (timestamps.length > 0 && timestamps[0] < now - IP_WINDOW_MS) {
-        timestamps.shift();
-    }
-    timestamps.push(now);
-    ipRateLimits.set(ip, timestamps);
+    const cutoff = now - IP_WINDOW_MS;
+    const bucket = ipRateLimits.get(ip) || { entries: [], start: 0 };
+    // O(1) prune: advance start index past expired entries
+    while (bucket.start < bucket.entries.length && bucket.entries[bucket.start] < cutoff) {
+        bucket.start++;
+    }
+    // Compact when the leading garbage exceeds 50% of the allocated array
+    if (bucket.start > bucket.entries.length >>> 1) {
+        bucket.entries = bucket.entries.slice(bucket.start);
+        bucket.start = 0;
+    }
+    bucket.entries.push(now);
+    ipRateLimits.set(ip, bucket);
+    const activeCount = bucket.entries.length - bucket.start;
     const limit = isMaster ? IP_LIMIT_MASTER : IP_LIMIT_NORMAL;
-    return timestamps.length > limit;
+    return activeCount > limit;
 }
 /** #357: Prune IPs whose timestamp arrays are entirely outside the rate-limit window. */
 function pruneIpRateLimits() {
     const cutoff = Date.now() - IP_WINDOW_MS;
-    for (const [ip, timestamps] of ipRateLimits) {
+    for (const [ip, bucket] of ipRateLimits) {
         // All timestamps are old — remove the entry entirely
-        if (timestamps.length === 0 || timestamps[timestamps.length - 1] < cutoff) {
+        const last = bucket.entries[bucket.entries.length - 1];
+        if (bucket.entries.length - bucket.start === 0 || (last !== undefined && last < cutoff)) {
             ipRateLimits.delete(ip);
         }
     }
@@ -236,27 +242,11 @@ const createSessionSchema = z.object({
     claudeCommand: z.string().max(10_000).optional(),
     env: z.record(z.string(), z.string()).optional(),
     stallThresholdMs: z.number().int().positive().max(3_600_000).optional(),
-    permissionMode: z.enum(['default', 'bypassPermissions', 'plan']).optional(),
+    permissionMode: z.enum(['default', 'bypassPermissions', 'plan', 'acceptEdits', 'dontAsk', 'auto']).optional(),
     autoApprove: z.boolean().optional(),
 }).strict();
 // Health — Issue #397: includes tmux server health check
-app.get('/v1/health', async () => {
-    const pkg = await import('../package.json', { with: { type: 'json' } });
-    const activeCount = sessions.listSessions().length;
-    const totalCount = metrics.getTotalSessionsCreated();
-    const tmuxHealth = await tmux.isServerHealthy();
-    const status = tmuxHealth.healthy ? 'ok' : 'degraded';
-    return {
-        status,
-        version: pkg.default.version,
-        uptime: process.uptime(),
-        sessions: { active: activeCount, total: totalCount },
-        tmux: tmuxHealth,
-        timestamp: new Date().toISOString(),
-    };
-});
-// Backwards compat: unversioned health
-app.get('/health', async () => {
+async function healthHandler() {
     const pkg = await import('../package.json', { with: { type: 'json' } });
     const activeCount = sessions.listSessions().length;
     const totalCount = metrics.getTotalSessionsCreated();
@@ -270,7 +260,9 @@ app.get('/health', async () => {
         tmux: tmuxHealth,
         timestamp: new Date().toISOString(),
     };
-});
+}
+app.get('/v1/health', healthHandler);
+app.get('/health', healthHandler);
 // Issue #81: Swarm awareness — list all detected CC swarms and their teammates
 app.get('/v1/swarm', async () => {
     const result = await swarmMonitor.scan();
@@ -335,7 +327,7 @@ app.get('/v1/sessions/:id/metrics', async (req, reply) => {
 // Issue #89 L14: Webhook dead letter queue
 app.get('/v1/webhooks/dead-letter', async () => {
     for (const ch of channels.getChannels()) {
-        if (ch.name === 'webhook' && 'getDeadLetterQueue' in ch) {
+        if (ch.name === 'webhook' && typeof ch.getDeadLetterQueue === 'function') {
             return ch.getDeadLetterQueue();
         }
     }
@@ -457,7 +449,7 @@ app.get('/sessions', async () => sessions.listSessions());
 /** Validate workDir — delegates to validation.ts (Issue #435). */
 const validateWorkDirWithConfig = (workDir) => validateWorkDir(workDir, config.allowedWorkDirs);
 // Create session (Issue #607: reuse idle session for same workDir)
-app.post('/v1/sessions', async (req, reply) => {
+async function createSessionHandler(req, reply) {
     const parsed = createSessionSchema.safeParse(req.body);
     if (!parsed.success) {
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -508,58 +500,18 @@ app.post('/v1/sessions', async (req, reply) => {
         console.timeEnd("POST_SEND_INITIAL_PROMPT");
     }
     return reply.status(201).send({ ...session, promptDelivery });
-});
-// Backwards compat (Issue #607: same reuse logic as v1 route)
-app.post('/sessions', async (req, reply) => {
-    const parsed = createSessionSchema.safeParse(req.body);
-    if (!parsed.success) {
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    }
-    const { workDir, name, prompt, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove } = parsed.data;
-    if (!workDir)
-        return reply.status(400).send({ error: 'workDir is required' });
-    const safeWorkDir = await validateWorkDirWithConfig(workDir);
-    if (typeof safeWorkDir === 'object')
-        return reply.status(400).send({ error: safeWorkDir.error, code: safeWorkDir.code });
-    // Issue #607: Check for an existing idle session with the same workDir
-    const existing = sessions.findIdleSessionByWorkDir(safeWorkDir);
-    if (existing) {
-        let promptDelivery;
-        if (prompt) {
-            promptDelivery = await sessions.sendInitialPrompt(existing.id, prompt);
-            metrics.promptSent(promptDelivery.delivered);
-        }
-        return reply.status(200).send({ ...existing, reused: true, promptDelivery });
-    }
-    const session = await sessions.createSession({ workDir: safeWorkDir, name, resumeSessionId, claudeCommand, env, stallThresholdMs, permissionMode, autoApprove });
-    // Issue #46: Topic first, then prompt (same fix as v1 route)
-    await channels.sessionCreated({
-        event: 'session.created',
-        timestamp: new Date().toISOString(),
-        session: { id: session.id, name: session.windowName, workDir },
-        detail: `Session created: ${session.windowName}`,
-        meta: prompt ? { prompt: prompt.slice(0, 200), permissionMode: permissionMode ?? (autoApprove ? 'bypassPermissions' : undefined) } : undefined,
-    });
-    let promptDelivery;
-    if (prompt) {
-        promptDelivery = await sessions.sendInitialPrompt(session.id, prompt);
-        metrics.promptSent(promptDelivery.delivered);
-    }
-    return reply.status(201).send({ ...session, promptDelivery });
-});
+}
+app.post('/v1/sessions', createSessionHandler);
+app.post('/sessions', createSessionHandler);
 // Get session (Issue #20: includes actionHints for interactive states)
-app.get('/v1/sessions/:id', async (req, reply) => {
+async function getSessionHandler(req, reply) {
     const session = sessions.getSession(req.params.id);
     if (!session)
         return reply.status(404).send({ error: 'Session not found' });
     return addActionHints(session, sessions);
-});
-app.get('/sessions/:id', async (req, reply) => {
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    return addActionHints(session, sessions);
-});
+}
+app.get('/v1/sessions/:id', getSessionHandler);
+app.get('/sessions/:id', getSessionHandler);
 // #128: Bulk health check — returns health for all sessions in one request
 app.get('/v1/sessions/health', async () => {
     const allSessions = sessions.listSessions();
@@ -580,43 +532,18 @@ app.get('/v1/sessions/health', async () => {
     return results;
 });
 // Session health check (Issue #2)
-app.get('/v1/sessions/:id/health', async (req, reply) => {
-    try {
-        return await sessions.getHealth(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.get('/sessions/:id/health', async (req, reply) => {
+async function sessionHealthHandler(req, reply) {
     try {
         return await sessions.getHealth(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.get('/v1/sessions/:id/health', sessionHealthHandler);
+app.get('/sessions/:id/health', sessionHealthHandler);
 // Send message (with delivery verification — Issue #1)
-app.post('/v1/sessions/:id/send', async (req, reply) => {
-    const parsed = sendMessageSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { text } = parsed.data;
-    try {
-        const result = await sessions.sendMessage(req.params.id, text);
-        await channels.message({
-            event: 'message.user',
-            timestamp: new Date().toISOString(),
-            session: { id: req.params.id, name: '', workDir: '' },
-            detail: text,
-        });
-        return { ok: true, delivered: result.delivered, attempts: result.attempts };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/send', async (req, reply) => {
+async function sendMessageHandler(req, reply) {
     const parsed = sendMessageSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -634,26 +561,22 @@ app.post('/sessions/:id/send', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/send', sendMessageHandler);
+app.post('/sessions/:id/send', sendMessageHandler);
 // Read messages
-app.get('/v1/sessions/:id/read', async (req, reply) => {
+async function readMessagesHandler(req, reply) {
     try {
         return await sessions.readMessages(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.get('/sessions/:id/read', async (req, reply) => {
-    try {
-        return await sessions.readMessages(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.get('/v1/sessions/:id/read', readMessagesHandler);
+app.get('/sessions/:id/read', readMessagesHandler);
 // Approve
-app.post('/v1/sessions/:id/approve', async (req, reply) => {
+async function approveHandler(req, reply) {
     try {
         await sessions.approve(req.params.id);
         // Issue #87: Record permission response latency
@@ -666,22 +589,11 @@ app.post('/v1/sessions/:id/approve', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/approve', async (req, reply) => {
-    try {
-        await sessions.approve(req.params.id);
-        const lat = sessions.getLatencyMetrics(req.params.id);
-        if (lat !== null && lat.permission_response_ms !== null) {
-            metrics.recordPermissionResponse(req.params.id, lat.permission_response_ms);
-        }
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/approve', approveHandler);
+app.post('/sessions/:id/approve', approveHandler);
 // Reject
-app.post('/v1/sessions/:id/reject', async (req, reply) => {
+async function rejectHandler(req, reply) {
     try {
         await sessions.reject(req.params.id);
         const lat = sessions.getLatencyMetrics(req.params.id);
@@ -693,20 +605,9 @@ app.post('/v1/sessions/:id/reject', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/reject', async (req, reply) => {
-    try {
-        await sessions.reject(req.params.id);
-        const lat = sessions.getLatencyMetrics(req.params.id);
-        if (lat !== null && lat.permission_response_ms !== null) {
-            metrics.recordPermissionResponse(req.params.id, lat.permission_response_ms);
-        }
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/reject', rejectHandler);
+app.post('/sessions/:id/reject', rejectHandler);
 // Issue #336: Answer pending AskUserQuestion
 app.post('/v1/sessions/:id/answer', async (req, reply) => {
     const { questionId, answer } = req.body || {};
@@ -723,16 +624,7 @@ app.post('/v1/sessions/:id/answer', async (req, reply) => {
     return { ok: true };
 });
 // Escape
-app.post('/v1/sessions/:id/escape', async (req, reply) => {
-    try {
-        await sessions.escape(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/escape', async (req, reply) => {
+async function escapeHandler(req, reply) {
     try {
         await sessions.escape(req.params.id);
         return { ok: true };
@@ -740,9 +632,11 @@ app.post('/sessions/:id/escape', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/escape', escapeHandler);
+app.post('/sessions/:id/escape', escapeHandler);
 // Interrupt (Ctrl+C)
-app.post('/v1/sessions/:id/interrupt', async (req, reply) => {
+async function interruptHandler(req, reply) {
     try {
         await sessions.interrupt(req.params.id);
         return { ok: true };
@@ -750,34 +644,11 @@ app.post('/v1/sessions/:id/interrupt', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/interrupt', async (req, reply) => {
-    try {
-        await sessions.interrupt(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/interrupt', interruptHandler);
+app.post('/sessions/:id/interrupt', interruptHandler);
 // Kill session
-app.delete('/v1/sessions/:id', async (req, reply) => {
-    if (!sessions.getSession(req.params.id)) {
-        return reply.status(404).send({ error: 'Session not found' });
-    }
-    try {
-        eventBus.emitEnded(req.params.id, 'killed');
-        await channels.sessionEnded(makePayload('session.ended', req.params.id, 'killed'));
-        await sessions.killSession(req.params.id);
-        monitor.removeSession(req.params.id);
-        metrics.cleanupSession(req.params.id);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.delete('/sessions/:id', async (req, reply) => {
+async function killSessionHandler(req, reply) {
     if (!sessions.getSession(req.params.id)) {
         return reply.status(404).send({ error: 'Session not found' });
     }
@@ -792,24 +663,21 @@ app.delete('/sessions/:id', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.delete('/v1/sessions/:id', killSessionHandler);
+app.delete('/sessions/:id', killSessionHandler);
 // Capture raw pane
-app.get('/v1/sessions/:id/pane', async (req, reply) => {
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    const pane = await tmux.capturePane(session.windowId);
-    return { pane };
-});
-app.get('/sessions/:id/pane', async (req, reply) => {
+async function capturePaneHandler(req, reply) {
     const session = sessions.getSession(req.params.id);
     if (!session)
         return reply.status(404).send({ error: 'Session not found' });
     const pane = await tmux.capturePane(session.windowId);
     return { pane };
-});
+}
+app.get('/v1/sessions/:id/pane', capturePaneHandler);
+app.get('/sessions/:id/pane', capturePaneHandler);
 // Slash command
-app.post('/v1/sessions/:id/command', async (req, reply) => {
+async function commandHandler(req, reply) {
     const parsed = commandSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -822,37 +690,11 @@ app.post('/v1/sessions/:id/command', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.post('/sessions/:id/command', async (req, reply) => {
-    const parsed = commandSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { command } = parsed.data;
-    try {
-        const cmd = command.startsWith('/') ? command : `/${command}`;
-        await sessions.sendMessage(req.params.id, cmd);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.post('/v1/sessions/:id/command', commandHandler);
+app.post('/sessions/:id/command', commandHandler);
 // Bash mode
-app.post('/v1/sessions/:id/bash', async (req, reply) => {
-    const parsed = bashSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { command } = parsed.data;
-    try {
-        const cmd = command.startsWith('!') ? command : `!${command}`;
-        await sessions.sendMessage(req.params.id, cmd);
-        return { ok: true };
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
-app.post('/sessions/:id/bash', async (req, reply) => {
+async function bashHandler(req, reply) {
     const parsed = bashSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -865,30 +707,30 @@ app.post('/sessions/:id/bash', async (req, reply) => {
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
+}
+app.post('/v1/sessions/:id/bash', bashHandler);
+app.post('/sessions/:id/bash', bashHandler);
 // Session summary (Issue #35)
-app.get('/v1/sessions/:id/summary', async (req, reply) => {
+async function summaryHandler(req, reply) {
     try {
         return await sessions.getSummary(req.params.id);
     }
     catch (e) {
         return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
     }
-});
-app.get('/sessions/:id/summary', async (req, reply) => {
-    try {
-        return await sessions.getSummary(req.params.id);
-    }
-    catch (e) {
-        return reply.status(404).send({ error: e instanceof Error ? e.message : String(e) });
-    }
-});
+}
+app.get('/v1/sessions/:id/summary', summaryHandler);
+app.get('/sessions/:id/summary', summaryHandler);
 // Paginated transcript read
 app.get('/v1/sessions/:id/transcript', async (req, reply) => {
     try {
         const page = Math.max(1, parseInt(req.query.page || '1', 10) || 1);
         const limit = Math.min(200, Math.max(1, parseInt(req.query.limit || '50', 10) || 50));
+        const allowedRoles = new Set(['user', 'assistant', 'system']);
         const roleFilter = req.query.role;
+        if (roleFilter && !allowedRoles.has(roleFilter)) {
+            return reply.status(400).send({ error: `Invalid role filter: ${roleFilter}. Allowed values: user, assistant, system` });
+        }
         return await sessions.readTranscript(req.params.id, page, limit, roleFilter);
     }
     catch (e) {
@@ -896,7 +738,7 @@ app.get('/v1/sessions/:id/transcript', async (req, reply) => {
     }
 });
 // Screenshot capture (Issue #22)
-app.post('/v1/sessions/:id/screenshot', async (req, reply) => {
+async function screenshotHandler(req, reply) {
     const parsed = screenshotSchema.safeParse(req.body);
     if (!parsed.success)
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
@@ -925,36 +767,9 @@ app.post('/v1/sessions/:id/screenshot', async (req, reply) => {
     catch (e) {
         return reply.status(500).send({ error: `Screenshot failed: ${e instanceof Error ? e.message : String(e)}` });
     }
-});
-app.post('/sessions/:id/screenshot', async (req, reply) => {
-    const parsed = screenshotSchema.safeParse(req.body);
-    if (!parsed.success)
-        return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.issues });
-    const { url, fullPage, width, height } = parsed.data;
-    const urlError = validateScreenshotUrl(url);
-    if (urlError)
-        return reply.status(400).send({ error: urlError });
-    // Post-DNS-resolution check: resolve hostname and reject private IPs
-    const dnsError = await resolveAndCheckIp(new URL(url).hostname);
-    if (dnsError)
-        return reply.status(400).send({ error: dnsError });
-    const session = sessions.getSession(req.params.id);
-    if (!session)
-        return reply.status(404).send({ error: 'Session not found' });
-    if (!isPlaywrightAvailable()) {
-        return reply.status(501).send({
-            error: 'Playwright is not installed',
-            message: 'Install Playwright to enable screenshots: npx playwright install chromium && npm install -D playwright',
-        });
-    }
-    try {
-        const result = await captureScreenshot({ url, fullPage, width, height });
-        return reply.status(200).send(result);
-    }
-    catch (e) {
-        return reply.status(500).send({ error: `Screenshot failed: ${e instanceof Error ? e.message : String(e)}` });
-    }
-});
+}
+app.post('/v1/sessions/:id/screenshot', screenshotHandler);
+app.post('/sessions/:id/screenshot', screenshotHandler);
 // SSE event stream (Issue #32)
 app.get('/v1/sessions/:id/events', async (req, reply) => {
     const session = sessions.getSession(req.params.id);
@@ -1671,4 +1486,3 @@ main().catch(err => {
     console.error('Failed to start Aegis:', err);
     process.exit(1);
 });
-//# sourceMappingURL=server.js.map

package/dist/session.js

@@ -14,6 +14,18 @@ import { computeStallThreshold } from './config.js';
 import { neutralizeBypassPermissions, restoreSettings, cleanOrphanedBackup } from './permission-guard.js';
 import { persistedStateSchema, sessionMapSchema } from './validation.js';
 import { writeHookSettingsFile, cleanupHookSettingsFile } from './hook-settings.js';
+/** Convert parsed JSON arrays to Sets for activeSubagents (#668). */
+function hydrateSessions(raw) {
+    const sessions = {};
+    for (const [id, s] of Object.entries(raw)) {
+        const { activeSubagents, ...rest } = s;
+        sessions[id] = {
+            ...rest,
+            activeSubagents: activeSubagents ? new Set(activeSubagents) : undefined,
+        };
+    }
+    return sessions;
+}
 /**
  * Detect whether CC is showing numbered permission options (e.g. "1. Yes, 2. No")
  * vs a simple y/N prompt. Returns the approval method to use.
@@ -99,7 +111,7 @@ export class SessionManager {
                 const raw = await readFile(this.stateFile, 'utf-8');
                 const parsed = persistedStateSchema.safeParse(JSON.parse(raw));
                 if (parsed.success && this.isValidState({ sessions: parsed.data })) {
-                    this.state = { sessions: parsed.data };
+                    this.state = { sessions: hydrateSessions(parsed.data) };
                 }
                 else {
                     console.warn('State file failed validation, attempting backup restore');
@@ -110,7 +122,7 @@ export class SessionManager {
                             const backupRaw = await readFile(backupFile, 'utf-8');
                             const backupParsed = persistedStateSchema.safeParse(JSON.parse(backupRaw));
                             if (backupParsed.success && this.isValidState({ sessions: backupParsed.data })) {
-                                this.state = { sessions: backupParsed.data };
+                                this.state = { sessions: hydrateSessions(backupParsed.data) };
                                 console.log('Restored state from backup');
                             }
                             else {
@@ -130,12 +142,6 @@ export class SessionManager {
                 this.state = { sessions: {} };
             }
         }
-        // #357: Convert deserialized activeSubagents arrays to Sets
-        for (const session of Object.values(this.state.sessions)) {
-            if (Array.isArray(session.activeSubagents)) {
-                session.activeSubagents = new Set(session.activeSubagents);
-            }
-        }
         // Create backup of successfully loaded state
         try {
             await writeFile(`${this.stateFile}.bak`, JSON.stringify(this.state, null, 2));
@@ -1396,4 +1402,3 @@ export class SessionManager {
         catch { /* ignore parse errors */ }
     }
 }
-//# sourceMappingURL=session.js.map

package/dist/signal-cleanup-helper.js

@@ -115,4 +115,3 @@ export function createSignalHandler(sessions, tmux) {
         });
     };
 }
-//# sourceMappingURL=signal-cleanup-helper.js.map

package/dist/sse-limiter.js

@@ -59,4 +59,3 @@ export class SSEConnectionLimiter {
         }
     }
 }
-//# sourceMappingURL=sse-limiter.js.map

package/dist/sse-writer.js

@@ -92,4 +92,3 @@ export class SSEWriter {
         this.onCleanup();
     }
 }
-//# sourceMappingURL=sse-writer.js.map

package/dist/ssrf.d.ts

@@ -9,6 +9,10 @@
  * - Unspecified: ::
  * - IPv6 unique-local: fc00::/7
  * - CGNAT: 100.64.0.0/10 (RFC 6598)
+ * - Broadcast: 255.255.255.255
+ * - Multicast: 224.0.0.0/4 (RFC 5771)
+ * - Documentation: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 (RFC 5737)
+ * - Benchmarking: 198.18.0.0/15 (RFC 2544)
  */
 export declare function isPrivateIP(ip: string): boolean;
 /**