fix(runtime-host): reject sparse imported session ids

Generated-by: Codex

Author: Sun-GLiang

packages/runtime-host/src/__tests__/external-session-protocol.test.ts

@@ -173,6 +173,30 @@ describe('external Session protocol', () => {
     );
   });
 
+  test('rejects sparse imported Session id arrays', () => {
+    const importedSessionIds = Array<string>(1);
+
+    assert.throws(
+      () =>
+        decodeExternalSessionCatalogQueryResult({
+          sessions: [
+            {
+              id: 'source-1',
+              name: 'Imported source',
+              hostCwd: '/workspace',
+              importState: {
+                importedCount: 1,
+                importedSessionIds,
+                isImporting: false,
+              },
+            },
+          ],
+          nextCursor: null,
+        }),
+      isProtocolError,
+    );
+  });
+
   test('rejects open-ended, malformed, and oversized frames', () => {
     assert.throws(
       () =>

packages/runtime-host/src/protocol/external-session.ts

@@ -260,7 +260,7 @@ function decodeExternalSessionImportState(
   ) {
     throw invalidProtocolFrame('Invalid external Session imported Session ids');
   }
-  const importedSessionIds = state.importedSessionIds.map((id) =>
+  const importedSessionIds = Array.from(state.importedSessionIds, (id) =>
     requireEntityId(id, 'imported Session id'),
   );
   const importedCount = requireCount(state.importedCount, 'external Session imported count');