@1agh/maude 0.38.1 → 0.39.1

package/apps/studio/http.ts

@@ -658,10 +658,30 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
     // Phase 31 follow-up — persist an image pasted straight into the ACP composer
     // (a clipboard screenshot has no path), returning an absolute path the chip
     // expands to so Claude can Read it. MAIN-ORIGIN ONLY: sameOriginWrite CSRF gate
-    // + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes, so the
-    // untrusted canvas iframe is 403'd. The disk caps live in api.saveChatAttachment
-    // (magic-byte sniff / 10 MB / content-addressed name / session write budget).
+    // on POST + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes,
+    // so the untrusted canvas iframe is 403'd. The disk caps live in
+    // api.saveChatAttachment (magic-byte sniff / 10 MB / content-addressed name /
+    // session write budget).
+    //
+    // GET ?name=<sha8>.<ext> serves the pasted image back to the chat feed
+    // (thumbnail + lightbox). The name is regex-allowlisted in
+    // api.resolveChatAttachment — content-addressed, never a caller path, so
+    // traversal-proof by construction; content-addressed ⇒ immutable cache. No
+    // CSRF gate on GET (sameOriginWrite is the POST/CSRF boundary) — the
+    // main-origin posture above is what keeps the canvas origin out.
     '/_api/acp/attachment': async (req: Request) => {
+      if (req.method === 'GET') {
+        const name = new URL(req.url).searchParams.get('name');
+        const abs = await api.resolveChatAttachment(name);
+        if (!abs) return new Response('Not found', { status: 404 });
+        return serveFile(abs, {
+          'Cache-Control': 'public, max-age=31536000, immutable',
+          // Uploaded bytes on the privileged main origin — never let the browser
+          // MIME-sniff a polyglot into a richer type (mirrors the DDR-088 static
+          // lane; the sniff/allowlist on write is the primary gate).
+          'X-Content-Type-Options': 'nosniff',
+        });
+      }
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });

package/apps/studio/test/acp-attachment-serve.test.ts

@@ -0,0 +1,74 @@
+// GET /_api/acp/attachment — the content-addressed serve route behind the ACP
+// chat image thumbnails + lightbox. The name is the ONLY input and must match
+// our own `<sha8>.<ext>` shape (api.resolveChatAttachment) — traversal-proof by
+// construction, so these tests pin the allowlist: a real uploaded attachment
+// serves 200 with an image content-type + immutable cache; every malformed /
+// hostile name 404s; non-GET/POST methods 405. The canvas-origin 403 lives in
+// canvas-origin-gate.test.ts (dual-allowlist invariant, DDR-054/DDR-088).
+
+import { describe, expect, test } from 'bun:test';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+// Minimal valid PNG magic bytes, padded so length checks pass (asset-api idiom).
+const pad = (header: number[], len = 64): Uint8Array => {
+  const out = new Uint8Array(len);
+  out.set(header, 0);
+  return out;
+};
+const PNG = pad([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+
+describe('acp-attachment-serve / GET /_api/acp/attachment', () => {
+  test('serves an uploaded attachment by name; rejects hostile names; gates methods', async () => {
+    const sandbox = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(sandbox.root, port);
+    const base = `http://localhost:${port}/_api/acp/attachment`;
+    try {
+      // Write side first — the serve route only ever serves what saveChatAttachment
+      // itself named (content-addressed <sha8>.<ext>).
+      const post = await fetch(base, {
+        method: 'POST',
+        headers: { 'Content-Type': 'image/png' },
+        body: PNG,
+      });
+      expect(post.status).toBe(201);
+      const { path: absPath } = (await post.json()) as { path: string };
+      const name = absPath.split('/').pop() as string;
+      expect(name).toMatch(/^[0-9a-f]{8}\.png$/);
+
+      // Happy path — 200, image content-type, immutable cache (content-addressed).
+      const ok = await fetch(`${base}?name=${name}`);
+      expect(ok.status).toBe(200);
+      expect(ok.headers.get('content-type')).toBe('image/png');
+      expect(ok.headers.get('cache-control')).toContain('immutable');
+      expect(new Uint8Array(await ok.arrayBuffer())).toEqual(PNG);
+
+      // Name allowlist — anything that is not our own <sha8>.(png|jpe?g|gif|webp)
+      // shape must 404 (never resolved against the filesystem).
+      for (const bad of [
+        '../../etc/passwd',
+        '..%2f..%2fetc%2fpasswd',
+        `/etc/passwd`,
+        'abc',
+        'deadbeef.svg', // SVG is never written — scriptable, stays unservable
+        'deadbeef.png.svg',
+        'DEADBEEF.png', // uppercase hex — writer emits lowercase only
+        'deadbeef1.png', // 9 hex chars
+        `_chat/attachments/${name}`,
+      ]) {
+        const res = await fetch(`${base}?name=${encodeURIComponent(bad)}`);
+        expect(res.status).toBe(404);
+      }
+      // Missing name / valid-shaped but nonexistent file → 404 too.
+      expect((await fetch(base)).status).toBe(404);
+      expect((await fetch(`${base}?name=00000000.png`)).status).toBe(404);
+
+      // Method gate — only GET (serve) + POST (upload) exist.
+      expect((await fetch(base, { method: 'DELETE' })).status).toBe(405);
+      expect((await fetch(base, { method: 'PUT' })).status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/acp-bridge.test.ts

@@ -4,6 +4,8 @@
 // (DDR-123 guardrail #1, verified end-to-end — the mock echoes its own env).
 
 import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { AcpBridge } from '../acp/bridge.ts';
@@ -112,6 +114,136 @@ describe('AcpBridge — round-trip + subscription guardrail', () => {
   }, 15000);
 });
 
+describe('AcpBridge — cross-restart session resume (DDR-125 gap)', () => {
+  let dir: string;
+
+  afterEach(async () => {
+    if (dir) await rm(dir, { recursive: true, force: true });
+  });
+
+  test('a persisted sessionId resumes via loadSession instead of spawning a new session', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    dir = await mkdtemp(join(tmpdir(), 'acp-bridge-test-'));
+    const storePath = join(dir, 'c1.session.json');
+    await Bun.write(storePath, JSON.stringify({ sessionId: 'persisted-session-abc' }));
+
+    const updates: unknown[] = [];
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: (u) => updates.push(u) });
+    try {
+      bridge.setSessionStorePath(storePath);
+      await bridge.prompt('pokracuj', 'c1');
+      // Resumed the persisted id verbatim — never fell through to session/new
+      // (which would have minted a fresh `mock-session-N`).
+      expect(bridge.sessionId).toBe('persisted-session-abc');
+      // The mock's replay notification must NOT reach the UI sink.
+      expect(JSON.stringify(updates)).not.toContain('REPLAYED-HISTORY-SHOULD-NOT-SURFACE');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('a resume that fails (pruned session) falls back to newSession and re-persists the new id', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    dir = await mkdtemp(join(tmpdir(), 'acp-bridge-test-'));
+    const storePath = join(dir, 'c1.session.json');
+    await Bun.write(storePath, JSON.stringify({ sessionId: 'not-found' }));
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      bridge.setSessionStorePath(storePath);
+      await bridge.prompt('pokracuj', 'c1');
+      expect(bridge.sessionId).toBe('mock-session-1'); // fresh session, not the stale id
+      const stored = JSON.parse(await readFile(storePath, 'utf8'));
+      expect(stored.sessionId).toBe('mock-session-1'); // re-persisted so the NEXT restart resumes it
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('no prior chat for this sidecar behaves exactly as before — a brand new session is created and persisted', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    dir = await mkdtemp(join(tmpdir(), 'acp-bridge-test-'));
+    const storePath = join(dir, 'brand-new.session.json');
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      bridge.setSessionStorePath(storePath);
+      await bridge.prompt('hi', 'c1');
+      expect(bridge.sessionId).toBe('mock-session-1');
+      const stored = JSON.parse(await readFile(storePath, 'utf8'));
+      expect(stored.sessionId).toBe('mock-session-1');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('no sidecar wired at all (e.g. a warm-up before any prompt) never touches disk and behaves exactly as before', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      // setSessionStorePath is never called — sessionStorePath stays null.
+      await bridge.prompt('hi', 'c1');
+      expect(bridge.sessionId).toBe('mock-session-1');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('a malformed persisted sessionId (not a plausible shape) is rejected — falls back to newSession', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    dir = await mkdtemp(join(tmpdir(), 'acp-bridge-test-'));
+    const storePath = join(dir, 'c1.session.json');
+    // Not a plausible sessionId shape (embedded newline + non-UUID charset) —
+    // must never reach the wire as a `loadSession` sessionId.
+    await Bun.write(storePath, JSON.stringify({ sessionId: 'evil\nsessionId; rm -rf /' }));
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      bridge.setSessionStorePath(storePath);
+      await bridge.prompt('hi', 'c1');
+      expect(bridge.sessionId).toBe('mock-session-1'); // rejected — fresh session instead
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('warm and prompt racing for the same chat share one resume attempt (no replaying race)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    dir = await mkdtemp(join(tmpdir(), 'acp-bridge-test-'));
+    const storePath = join(dir, 'c1.session.json');
+    await Bun.write(storePath, JSON.stringify({ sessionId: 'persisted-race-session' }));
+
+    const updates: unknown[] = [];
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: (u) => updates.push(u) });
+    try {
+      bridge.setSessionStorePath(storePath);
+      // Fire warmUp and prompt concurrently for the same chatId — both call
+      // sessionFor('c1') before either has resolved.
+      const [, result] = await Promise.all([bridge.warmUp('c1'), bridge.prompt('pokracuj', 'c1')]);
+      expect(bridge.sessionId).toBe('persisted-race-session');
+      expect(result.stopReason).toBe('end_turn');
+      // Only ONE resume attempt happened — the mock's replay text never leaked,
+      // and the prompt's own turn still streamed normally.
+      expect(JSON.stringify(updates)).not.toContain('REPLAYED-HISTORY-SHOULD-NOT-SURFACE');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
 describe('probeAcpAvailability — not-connected detection', () => {
   test('reports not-available with a Claude-Code reason when the CLI is absent', () => {
     process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;

package/apps/studio/test/acp-commands.test.ts

@@ -6,6 +6,8 @@
 //     the cached list to a freshly-opened socket.
 
 import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import type { ServerWebSocket } from 'bun';
@@ -73,9 +75,11 @@ describe('AcpBridge.warmUp — publishes the command catalogue without a prompt'
 describe('Acp manager — warm frame broadcasts + open replays commands', () => {
   test('a {t:warm} frame yields a {t:commands} frame, replayed to a new socket', async () => {
     useMockAgent();
-    const ctx = {
-      paths: { repoRoot: process.cwd(), designRoot: join(process.cwd(), '.design') },
-    } as unknown as Context;
+    // Isolated tmp designRoot — `warm` now also writes a session-store sidecar
+    // (bridge.ts sessionFor's resume path), so this must not land in a real
+    // repo path.
+    const designRoot = await mkdtemp(join(tmpdir(), 'acp-commands-test-'));
+    const ctx = { paths: { repoRoot: process.cwd(), designRoot } } as unknown as Context;
     const acp = createAcp(ctx);
 
     const a = fakeWs('ws-a');
@@ -103,6 +107,7 @@ describe('Acp manager — warm frame broadcasts + open replays commands', () =>
       acp.onClose(a.ws);
       // give teardown a tick to kill the subprocess
       await new Promise((r) => setTimeout(r, 50));
+      await rm(designRoot, { recursive: true, force: true });
     }
   }, 20000);
 });

package/apps/studio/test/acp-origin-gate.test.ts

@@ -101,9 +101,11 @@ describe('ACP bridge origin gate', () => {
       expect(crossOrigin.status).toBe(403);
 
       // (6) Phase 31 follow-up — /_api/acp/attachment (clipboard-image paste):
-      // POST-only, main-origin only. A valid PNG → 201 with an absolute path under
-      // the runtime _chat/attachments/; GET is 405; the canvas origin + a
-      // cross-origin drive-by POST are 403.
+      // main-origin only. A valid PNG → 201 with an absolute path under the
+      // runtime _chat/attachments/; GET (the thumbnail serve branch) 404s
+      // without a valid content-addressed name — full serve coverage lives in
+      // acp-attachment-serve.test.ts; the canvas origin + a cross-origin
+      // drive-by POST are 403.
       const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
       const up = await fetch(`${main}/_api/acp/attachment`, {
         method: 'POST',
@@ -115,7 +117,7 @@ describe('ACP bridge origin gate', () => {
       const upJson = await up.json();
       expect(typeof upJson.path).toBe('string');
       expect(upJson.path).toContain('_chat/attachments/');
-      expect(await status(main, '/_api/acp/attachment')).toBe(405); // GET not allowed
+      expect(await status(main, '/_api/acp/attachment')).toBe(404); // GET without a name → 404
       expect(await status(canvas, '/_api/acp/attachment')).toBe(403); // off the canvas origin
       const attDriveBy = await fetch(`${main}/_api/acp/attachment`, {
         method: 'POST',

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -114,6 +114,11 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // the untrusted canvas origin must never reach it (it writes the global
         // ~/.config/maude/hubs.json token store).
         '/_api/hub/link',
+        // ACP chat attachments (POST upload + GET thumbnail serve) are MAIN-ORIGIN
+        // ONLY — absent from CANVAS_SAFE_API + startCanvasServer's routes. The
+        // untrusted canvas origin must never read (or write) the user's pasted
+        // chat images; a GET here 403s at the gate, not 404 from the handler.
+        '/_api/acp/attachment',
         '/package.json',
       ]) {
         expect(await code(p)).toBe(403);

package/apps/studio/test/chat-attachments.test.ts

@@ -0,0 +1,117 @@
+// ACP chat image thumbnails — the pure ref helpers behind the two render paths:
+// a LIVE user bubble carries the collapsed chip token ([image-1]), a RELOADED
+// bubble (transcript) carries the expanded absolute `_chat/attachments/` path.
+// Both must resolve to the same content-addressed `<sha8>.<ext>` name the GET
+// serve route accepts — and nothing else may match (a random project path must
+// never render as a thumbnail).
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  attachmentName,
+  designImageRefs,
+  extractAttachmentRefs,
+} from '../client/panels/acp-runtime.js';
+
+const ABS = '/Users/x/proj/.design/_chat/attachments/ab12cd34.png';
+
+describe('chat-attachments / attachmentName', () => {
+  test('extracts the content-addressed basename from attachment paths', () => {
+    expect(attachmentName(ABS)).toBe('ab12cd34.png');
+    expect(attachmentName('_chat/attachments/00ff00ff.webp')).toBe('00ff00ff.webp');
+    expect(attachmentName(`  ${ABS}  `)).toBe('ab12cd34.png'); // trimmed
+    expect(attachmentName('/x/_chat/attachments/deadbeef.jpeg')).toBe('deadbeef.jpeg');
+  });
+
+  test('rejects everything that is not a servable attachment path', () => {
+    expect(attachmentName('/Users/x/proj/assets/ab12cd34.png')).toBeNull(); // wrong dir
+    expect(attachmentName('/x/_chat/attachments/ab12cd34.svg')).toBeNull(); // never served
+    expect(attachmentName('/x/_chat/attachments/AB12CD34.png')).toBeNull(); // uppercase hex
+    expect(attachmentName('/x/_chat/attachments/abc.png')).toBeNull(); // short hash
+    expect(attachmentName(`${ABS}/../secret.png`)).toBeNull(); // trailing junk
+    expect(attachmentName('')).toBeNull();
+    expect(attachmentName(null)).toBeNull();
+  });
+});
+
+describe('chat-attachments / extractAttachmentRefs', () => {
+  test('chip-only string (live bubble)', () => {
+    expect(extractAttachmentRefs('[image-1]')).toEqual([
+      { type: 'chip', token: '[image-1]', kind: 'image' },
+    ]);
+  });
+
+  test('expanded absolute path (reloaded bubble) — path never leaks as text', () => {
+    expect(extractAttachmentRefs(`look at ${ABS}`)).toEqual([
+      { type: 'text', text: 'look at ' },
+      { type: 'attachment', name: 'ab12cd34.png', raw: ABS },
+    ]);
+  });
+
+  test('mixed text, multiple ref kinds, order preserved', () => {
+    const segs = extractAttachmentRefs(`fix [image-2] and [file-1] then ${ABS} done`);
+    expect(segs).toEqual([
+      { type: 'text', text: 'fix ' },
+      { type: 'chip', token: '[image-2]', kind: 'image' },
+      { type: 'text', text: ' and ' },
+      { type: 'chip', token: '[file-1]', kind: 'file' },
+      { type: 'text', text: ' then ' },
+      { type: 'attachment', name: 'ab12cd34.png', raw: ABS },
+      { type: 'text', text: ' done' },
+    ]);
+  });
+
+  test('non-attachment paths and near-miss tokens stay plain text', () => {
+    expect(extractAttachmentRefs('/Users/x/proj/assets/ab12cd34.png')).toEqual([
+      { type: 'text', text: '/Users/x/proj/assets/ab12cd34.png' },
+    ]);
+    expect(extractAttachmentRefs('[image-x] [screenshot-1]')).toEqual([
+      { type: 'text', text: '[image-x] [screenshot-1]' },
+    ]);
+    expect(extractAttachmentRefs('')).toEqual([]);
+  });
+});
+
+describe('chat-attachments / designImageRefs (assistant-mentioned images — DDR-145)', () => {
+  test('the /design:screenshot reply shape — backticked relative path', () => {
+    expect(
+      designImageRefs('Saved to: `.design/_history/.design-ui-smoke/screenshots/001-smoke.png`')
+    ).toEqual(['/.design/_history/.design-ui-smoke/screenshots/001-smoke.png']);
+  });
+
+  test('absolute path is clamped to the designRel-relative URL', () => {
+    expect(designImageRefs('see /Users/x/proj/.design/exports/hero.png done')).toEqual([
+      '/.design/exports/hero.png',
+    ]);
+  });
+
+  test('custom designRel + trailing punctuation + dedup + cap', () => {
+    expect(designImageRefs('wrote mocks/a.png.', 'mocks')).toEqual(['/mocks/a.png']);
+    expect(designImageRefs('x .design/a.png and .design/a.png again')).toEqual(['/.design/a.png']);
+    const many = Array.from({ length: 9 }, (_, i) => `.design/s/${i}0000000.png`).join(' ');
+    expect(designImageRefs(many)).toHaveLength(6);
+  });
+
+  test('never matches outside designRel, non-images, SVG, or lookalike dirs', () => {
+    expect(designImageRefs('site/public/logo.png')).toEqual([]);
+    expect(designImageRefs('.design/ui/Canvas.tsx')).toEqual([]);
+    expect(designImageRefs('.design/assets/mark.svg')).toEqual([]); // scriptable — excluded
+    expect(designImageRefs('not-.design/a.png')).toEqual([]); // prefix must be a path segment
+    expect(designImageRefs('', undefined)).toEqual([]);
+  });
+
+  test('traversal is rejected before it can escape designRel (DDR-145 A9 fix)', () => {
+    // A `..` dot-segment would collapse to /etc/x.png in the browser.
+    expect(designImageRefs('.design/../../etc/secret.png')).toEqual([]);
+    expect(designImageRefs('.design/../.git/config.png')).toEqual([]);
+    // Percent-encoding would decode past <rel>/ server-side — reject any `%`.
+    expect(designImageRefs('.design/..%2f..%2fsecrets/cam.png')).toEqual([]);
+    expect(designImageRefs('.design/%2e%2e/x.png')).toEqual([]);
+    // Backslash: WHATWG rewrites `\`→`/` for http(s), so `..\..\` would climb out
+    // AFTER a naive guard — the canonical-form allowlist catches it (attacker F).
+    expect(designImageRefs('.design/..\\..\\secret.png')).toEqual([]);
+    expect(designImageRefs('.design/a\\..\\..\\x.png')).toEqual([]);
+    // A legit path that merely CONTAINS "dotdot"-ish text (not a segment) is fine.
+    expect(designImageRefs('.design/a..b/hero.png')).toEqual(['/.design/a..b/hero.png']);
+  });
+});

package/apps/studio/test/fixtures/mock-acp-agent.mjs

@@ -5,6 +5,16 @@
 // `agent_message_chunk` whose text echoes whether ANTHROPIC_API_KEY survived
 // into the child env — it MUST read `<unset>`, proving scrubAgentEnv (DDR-123
 // guardrail #1) stripped it before spawn.
+//
+// session/load simulates the REAL adapter's cross-restart resume (this is a
+// fresh subprocess per test, so it has no memory of a prior session/new call —
+// exactly like the real claude-agent-acp adapter after an app restart, whose
+// resume is backed by the underlying `claude` CLI's own on-disk store, not its
+// own process memory). Any sessionId resolves EXCEPT the `not-found` sentinel
+// (simulates a pruned/unresumable session), so a test controls resume
+// success/failure by choosing which id it persists. It also emits one replay
+// `session/update` BEFORE resolving, mirroring claude-agent-acp's
+// `replaySessionHistory` — bridge.ts must not forward or re-transcript it.
 
 import { Readable, Writable } from 'node:stream';
 
@@ -16,7 +26,7 @@ acp
   .agent({ name: 'mock-acp-agent' })
   .onRequest('initialize', () => ({
     protocolVersion: acp.PROTOCOL_VERSION,
-    agentCapabilities: { loadSession: false },
+    agentCapabilities: { loadSession: true },
   }))
   .onRequest(
     'session/new',
@@ -25,6 +35,19 @@ acp
       return () => ({ sessionId: `mock-session-${++n}` });
     })()
   )
+  .onRequest('session/load', async (ctx) => {
+    if (ctx.params.sessionId === 'not-found') {
+      throw new Error('session not found');
+    }
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: 'REPLAYED-HISTORY-SHOULD-NOT-SURFACE' },
+      },
+    });
+    return {};
+  })
   .onRequest('session/prompt', async (ctx) => {
     // The per-request handler context exposes the client connection at `.client`.
     await ctx.client.notify('session/update', {

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "acp-chat-cross-restart-resume",
+      "version": "0.39.1",
+      "date": "2026-07-03",
+      "kind": "fix",
+      "title": "The Assistant remembers your conversation after a restart",
+      "summary": "Killed the app to grab an update, or restarted the dev server mid-chat? The Assistant now picks up the actual conversation where you left off instead of quietly starting fresh while the old messages just sat there.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "acp-chat-image-thumbnails",
+      "version": "0.39.0",
+      "date": "2026-07-03",
+      "kind": "feature",
+      "title": "See images right in the chat",
+      "summary": "Images now show up as thumbnails in the Assistant panel — paste a screenshot into the box and it appears in your message, and when Claude points to an image it made (like a /design:screenshot capture) that shows up too. Click any thumbnail to open it full-size in a lightbox.",
+      "surface": "design-ui"
+    },
     {
       "id": "acp-context-hardening",
       "version": "0.38.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.38.1",
+  "version": "0.39.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -50,13 +50,13 @@
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.38.1",
-    "@1agh/maude-darwin-x64": "0.38.1",
-    "@1agh/maude-linux-arm64": "0.38.1",
-    "@1agh/maude-linux-arm64-musl": "0.38.1",
-    "@1agh/maude-linux-x64": "0.38.1",
-    "@1agh/maude-linux-x64-musl": "0.38.1",
-    "@1agh/maude-win32-x64": "0.38.1"
+    "@1agh/maude-darwin-arm64": "0.39.1",
+    "@1agh/maude-darwin-x64": "0.39.1",
+    "@1agh/maude-linux-arm64": "0.39.1",
+    "@1agh/maude-linux-arm64-musl": "0.39.1",
+    "@1agh/maude-linux-x64": "0.39.1",
+    "@1agh/maude-linux-x64-musl": "0.39.1",
+    "@1agh/maude-win32-x64": "0.39.1"
   },
   "files": [
     "cli",