Schema v1 with required (v, id, ts, room, from, msg) and optional
(to, reply_to, kind) fields. Passthrough preserves unknown fields for
forward-compat. parseMessage returns tagged result so callers can
distinguish malformed JSON from unknown version from invalid shape.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Single chokepoint for all path resolution. Validates room names against
^[a-zA-Z0-9_.-]{1,64}$, asserts resolved paths stay under rooms dir,
creates ~/.cc-bridge tree with mode 0700, room files with mode 0600,
and refuses to open symlinks.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CC_BRIDGE_FROM env var overrides. Otherwise generates host-ppid-rand8
once and caches in ~/.cc-bridge/sessions/<ppid>.id for the life of the
parent shell.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

proper-lockfile guards multi-line writes. 10MB stderr warn, 100MB hard
refuse. Room file mode 0600. Race-safe across N writers (tested).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Watches a room file via chokidar (polling at 50ms for cross-platform
reliability with chokidar 4.x), emits ListenEvent per line. 128KB
per-line cap, truncation detection (offset reset), saves resume offset
to ~/.cc-bridge/state/. Unknown schema versions surface as distinct
event reason for upgrade prompts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

listRooms returns name, size, mtime per .jsonl in rooms dir.
clearRoom truncates. reapStaleSessions deletes session-id cache files
whose PPID is no longer alive (kill -0 probe).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Per-line errors with line number + reason. Skips blank lines. Returns
structured result for CLI to render.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

All public commands wired. Pretty mode strips ANSI. Filter expressions
parse from=X / to=X. SIGINT/SIGTERM exit 0 cleanly. EPIPE swallowed.
Integration suite via execa proves end-to-end round-trip.

Also hardens listen truncation test with a 200ms settle window so the
polling watcher reliably observes the zero-size dip under parallel suite
load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Runs typecheck, lint, vitest with coverage gate, build, version
smoke test, manual two-window test, and high-severity npm audit.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README covers install, two-window quickstart, Monitor recipe, schema,
security model, and v1.1/v2 roadmap. Manual test exercises the
end-to-end primitive with a child listen process and three sends.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Clears 2 critical + 4 moderate dev-only advisories (GHSA-5xrq-8626-4rwp,
GHSA-67mh-4wv8-2f99, GHSA-4w7w-66w2-5vf9 + transitives). npm audit
now reports 0 vulnerabilities. All 66 tests still pass under vitest 4
without API changes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Polling at 50ms beat FSEvents for reliability under chokidar 4.x on
darwin; documented tradeoff and revisit conditions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- rooms: listRooms returns [] when rooms dir is unreadable (chmod 000 -> EACCES)
- rooms: reapStaleSessions returns 0 when sessions dir is unreadable
- rooms: EPERM from process.kill(1, 0) treated as alive (PID 1 not reaped)
- listen: replayLastN > 0 replays prior lines at startup (covers init replay loop)
- listen: accumulated buffer past 128KB without newline emits oversize
- listen: offset persistence failure swallowed (EISDIR via dir-at-path)

rooms.ts now 100% lines / 81.25% branches; listen.ts 98.68% lines / 80% branches.
Left uncovered: rooms L73-77 unlink-during-reap catch (would require fault injection
on fs.unlink mid-call, not reproducible without mocking src/).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>