@1agh/maude 0.42.0 → 0.44.0

package/apps/studio/stickers/project-status/manifest.json

@@ -0,0 +1,328 @@
+{
+  "name": "Project status stickers",
+  "author": "Iconfinder",
+  "attributionUrl": "https://www.figma.com/community/file/1128224635870836270",
+  "license": "Figma Community (see attributionUrl for terms)",
+  "stickers": [
+    {
+      "file": "group-100.png",
+      "keywords": ["thumbs-up", "awesome", "approve"]
+    },
+    {
+      "file": "group-101.png",
+      "keywords": ["super-star", "star", "cool"]
+    },
+    {
+      "file": "group-102.png",
+      "keywords": ["off", "launch", "rocket"]
+    },
+    {
+      "file": "group-103.png",
+      "keywords": ["star", "sparkle", "favorite"]
+    },
+    {
+      "file": "group-104.png",
+      "keywords": ["hot", "fire", "skull"]
+    },
+    {
+      "file": "group-105.png",
+      "keywords": ["yeah", "rock-on", "excited"]
+    },
+    {
+      "file": "group-106.png",
+      "keywords": ["plus-one", "+1", "agree"]
+    },
+    {
+      "file": "group-107.png",
+      "keywords": ["no", "reject"]
+    },
+    {
+      "file": "group-108.png",
+      "keywords": ["hate-it", "dislike", "broken-heart"]
+    },
+    {
+      "file": "group-109.png",
+      "keywords": ["fresh", "new"]
+    },
+    {
+      "file": "group-110.png",
+      "keywords": ["sleepy", "zzz", "tired"]
+    },
+    {
+      "file": "group-111.png",
+      "keywords": ["meh", "unimpressed", "neutral"]
+    },
+    {
+      "file": "group-112.png",
+      "keywords": ["ok", "thumbs-up"]
+    },
+    {
+      "file": "group-113.png",
+      "keywords": ["nope", "no", "reject"]
+    },
+    {
+      "file": "group-114.png",
+      "keywords": ["star", "sparkle", "favorite"]
+    },
+    {
+      "file": "group-115.png",
+      "keywords": ["party-time", "celebrate", "party"]
+    },
+    {
+      "file": "group-117.png",
+      "keywords": ["peace", "peace-sign"]
+    },
+    {
+      "file": "group-118.png",
+      "keywords": ["omg", "surprised", "shocked"]
+    },
+    {
+      "file": "group-119.png",
+      "keywords": ["love-it", "heart", "like"]
+    },
+    {
+      "file": "group-120.png",
+      "keywords": ["ok", "okay-hand"]
+    },
+    {
+      "file": "group-121.png",
+      "keywords": ["great-idea", "idea", "lightbulb"]
+    },
+    {
+      "file": "group-122.png",
+      "keywords": ["hmm", "thinking", "question"]
+    },
+    {
+      "file": "group-41.png",
+      "keywords": ["lol", "funny", "laugh"]
+    },
+    {
+      "file": "group-42.png",
+      "keywords": ["sparkle", "shiny", "star"]
+    },
+    {
+      "file": "group-43.png",
+      "keywords": ["good-idea", "idea", "lightbulb"]
+    },
+    {
+      "file": "group-44.png",
+      "keywords": ["thanks", "thank-you"]
+    },
+    {
+      "file": "group-45.png",
+      "keywords": ["ok", "okay"]
+    },
+    {
+      "file": "group-46.png",
+      "keywords": ["done", "finished", "complete"]
+    },
+    {
+      "file": "group-47.png",
+      "keywords": ["flagged", "flag", "important"]
+    },
+    {
+      "file": "group-48.png",
+      "keywords": ["awesome", "great"]
+    },
+    {
+      "file": "group-49.png",
+      "keywords": ["dead", "skull", "killed-it"]
+    },
+    {
+      "file": "group-50.png",
+      "keywords": ["hot", "fire", "trending"]
+    },
+    {
+      "file": "group-51.png",
+      "keywords": ["done", "thumbs-up", "approved"]
+    },
+    {
+      "file": "group-52.png",
+      "keywords": ["meh", "unimpressed", "neutral"]
+    },
+    {
+      "file": "group-53.png",
+      "keywords": ["feedback", "question"]
+    },
+    {
+      "file": "group-54.png",
+      "keywords": ["work-busy", "busy", "clock"]
+    },
+    {
+      "file": "group-55.png",
+      "keywords": ["chill", "relax", "cool"]
+    },
+    {
+      "file": "group-56.png",
+      "keywords": ["almost-done", "nearly-finished", "hourglass"]
+    },
+    {
+      "file": "group-57.png",
+      "keywords": ["no", "reject"]
+    },
+    {
+      "file": "group-58.png",
+      "keywords": ["nope", "no", "reject"]
+    },
+    {
+      "file": "group-59.png",
+      "keywords": ["star", "favorite"]
+    },
+    {
+      "file": "group-60.png",
+      "keywords": ["peace", "peace-sign"]
+    },
+    {
+      "file": "group-61.png",
+      "keywords": ["hmm", "thinking", "question"]
+    },
+    {
+      "file": "group-62.png",
+      "keywords": ["thumbs-up", "awesome", "approve"]
+    },
+    {
+      "file": "group-63.png",
+      "keywords": ["ok", "okay-hand"]
+    },
+    {
+      "file": "group-64.png",
+      "keywords": ["love-it", "heart", "like"]
+    },
+    {
+      "file": "group-65.png",
+      "keywords": ["fresh", "new"]
+    },
+    {
+      "file": "group-66.png",
+      "keywords": ["off", "launch", "rocket"]
+    },
+    {
+      "file": "group-67.png",
+      "keywords": ["hate-it", "dislike", "broken-heart"]
+    },
+    {
+      "file": "group-68.png",
+      "keywords": ["wow", "heart", "surprised"]
+    },
+    {
+      "file": "group-69.png",
+      "keywords": ["yes", "agree"]
+    },
+    {
+      "file": "group-70.png",
+      "keywords": ["plus-one", "+1", "agree"]
+    },
+    {
+      "file": "group-71.png",
+      "keywords": ["party-time", "celebrate", "party"]
+    },
+    {
+      "file": "group-72.png",
+      "keywords": ["omg", "surprised", "shocked"]
+    },
+    {
+      "file": "group-73.png",
+      "keywords": ["hot", "fire", "skull"]
+    },
+    {
+      "file": "group-74.png",
+      "keywords": ["sleepy", "zzz", "tired"]
+    },
+    {
+      "file": "group-75.png",
+      "keywords": ["wow", "surprised"]
+    },
+    {
+      "file": "group-76.png",
+      "keywords": ["yeah", "rock-on", "excited"]
+    },
+    {
+      "file": "group-77.png",
+      "keywords": ["high-alert", "warning", "urgent"]
+    },
+    {
+      "file": "group-78.png",
+      "keywords": ["thumbs-down", "dislike"]
+    },
+    {
+      "file": "group-79.png",
+      "keywords": ["great-idea", "idea", "lightbulb"]
+    },
+    {
+      "file": "group-80.png",
+      "keywords": ["super-star", "star", "cool"]
+    },
+    {
+      "file": "group-81.png",
+      "keywords": ["wow", "heart", "surprised"]
+    },
+    {
+      "file": "group-82.png",
+      "keywords": ["done", "thumbs-up", "approved"]
+    },
+    {
+      "file": "group-83.png",
+      "keywords": ["wow", "surprised"]
+    },
+    {
+      "file": "group-84.png",
+      "keywords": ["work-busy", "busy", "clock"]
+    },
+    {
+      "file": "group-85.png",
+      "keywords": ["thumbs-down", "dislike"]
+    },
+    {
+      "file": "group-86.png",
+      "keywords": ["thanks", "thank-you"]
+    },
+    {
+      "file": "group-87.png",
+      "keywords": ["flagged", "flag", "important"]
+    },
+    {
+      "file": "group-88.png",
+      "keywords": ["dead", "skull"]
+    },
+    {
+      "file": "group-89.png",
+      "keywords": ["high-alert", "warning", "urgent"]
+    },
+    {
+      "file": "group-90.png",
+      "keywords": ["good-idea", "idea", "lightbulb"]
+    },
+    {
+      "file": "group-91.png",
+      "keywords": ["lol", "funny", "laugh"]
+    },
+    {
+      "file": "group-92.png",
+      "keywords": ["awesome", "great"]
+    },
+    {
+      "file": "group-93.png",
+      "keywords": ["hot", "fire"]
+    },
+    {
+      "file": "group-94.png",
+      "keywords": ["chill", "relax", "cool"]
+    },
+    {
+      "file": "group-96.png",
+      "keywords": ["done", "finished", "complete"]
+    },
+    {
+      "file": "group-97.png",
+      "keywords": ["feedback", "question"]
+    },
+    {
+      "file": "group-98.png",
+      "keywords": ["yes", "agree"]
+    },
+    {
+      "file": "group-99.png",
+      "keywords": ["almost-done", "nearly-finished", "hourglass"]
+    }
+  ]
+}

package/apps/studio/test/_helpers.ts

@@ -37,7 +37,12 @@ export function makeSandbox(): Sandbox {
   return { root, designRoot };
 }
 
-let portCounter = 4500;
+// Base is spread by pid, not a fixed literal — bun test runs different test
+// files as separate processes, each importing a fresh copy of this module, so
+// a fixed base (e.g. 4500 for everyone) reliably collides across files. The
+// pid spread doesn't guarantee uniqueness on its own — bootServer's pid check
+// below is the actual safety net — but it makes collisions rare in practice.
+let portCounter = 4500 + (process.pid % 4000);
 export function nextPort(): number {
   // Bump on every call so parallel tests don't collide. Bun.serve will throw
   // EADDRINUSE if the host happened to bind one — caller retries with nextPort().
@@ -65,7 +70,15 @@ export async function bootServer(
       const r = await fetch(`http://localhost:${port}/_health`, {
         signal: AbortSignal.timeout(200),
       });
-      if (r.ok) return proc;
+      if (r.ok) {
+        const json = (await r.json()) as { pid?: number };
+        // A same-port collision with a concurrently-running test file's server
+        // (see the portCounter comment above) would otherwise look "ready" —
+        // /_health answers fine, just from someone else's sandbox — and every
+        // later request 404s against a designRoot that doesn't have our
+        // fixtures. Only trust the health check if it's actually our process.
+        if (json.pid === proc.pid) return proc;
+      }
     } catch {
       /* not up yet */
     }

package/apps/studio/test/acp-bootstrap-brief.test.ts

@@ -164,4 +164,15 @@ describe('buildStudioBrief — native session commands available (DDR-143)', ()
       buildStudioBrief({ designRel: '.design', projectLabel: 'maude', commandsAvailable: true })
     ).toBe(brief);
   });
+
+  test('names board + the whiteboard capability so it is reached for unprompted (Phase 5, whiteboard-improvements)', () => {
+    expect(brief).toContain('board');
+    expect(brief.toLowerCase()).toContain('whiteboard');
+  });
+
+  test('web path (commandsAvailable falsy) names board in the command family but skips the whiteboard capability fact (no in-session claim)', () => {
+    const web = buildStudioBrief({ designRel: '.design', projectLabel: 'maude' });
+    expect(web).toContain('board');
+    expect(web.toLowerCase()).not.toContain('whiteboard');
+  });
 });

package/apps/studio/test/acp-bridge.test.ts

@@ -9,7 +9,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { AcpBridge } from '../acp/bridge.ts';
-import { probeAcpAvailability } from '../acp/probe.ts';
+import { probeAcpAvailability, probeAcpAvailabilityAuthed } from '../acp/probe.ts';
 
 const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent.mjs');
 const TEST_ENV_KEYS = [
@@ -261,3 +261,36 @@ describe('probeAcpAvailability — not-connected detection', () => {
     expect(probe.adapterEntry).toBe(FIXTURE);
   });
 });
+
+describe('probeAcpAvailabilityAuthed — DDR-166 T0d, logged-out must not read as available', () => {
+  const AUTH_FIXTURE = join(import.meta.dir, 'fixtures', 'fake-claude-auth.mjs');
+
+  afterEach(() => {
+    delete process.env.FAKE_CLAUDE_LOGGED_IN;
+  });
+
+  test('installed but NOT signed in reports available:false (the bug this closes)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '0';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/signed in/i);
+  });
+
+  test('installed AND signed in reports available:true', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '1';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(true);
+  });
+
+  test('not installed still reports the plain not-installed reason (no auth spawn attempted)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = join(import.meta.dir, 'no-such-claude-bin');
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/Claude Code/i);
+  });
+});

package/apps/studio/test/acp-commands.test.ts

@@ -101,7 +101,8 @@ describe('Acp manager — warm frame broadcasts + open replays commands', () =>
       acp.onOpen(b.ws);
       const replay = b.frames.find((f) => f.t === 'commands');
       expect(replay).toBeDefined();
-      expect((replay?.commands as Array<{ name: string }>).length).toBe(2);
+      const replayCommands = replay?.commands as Array<{ name: string }>;
+      expect(replayCommands.length).toBe(2);
       acp.onClose(b.ws);
     } finally {
       acp.onClose(a.ws);

package/apps/studio/test/acp-env.test.ts

@@ -62,4 +62,34 @@ describe('scrubAgentEnv — subscription guardrail', () => {
     const out = scrubAgentEnv();
     expect('ANTHROPIC_API_KEY' in out).toBe(false);
   });
+
+  // feature-ai-media-generation Phase 1 (Task 1.4) + DDR-164 F3 — the ACP chat
+  // panel can TRIGGER generation because the BYOK provider key is resolved
+  // SERVER-SIDE (the dev-server, a separate process, reads the 0600 file /
+  // keychain via keys.ts). The ACP `claude` subprocess never needs a generation
+  // key-custody env var, so we SCRUB them: the Phase-5.1 keychain-bridge endpoint
+  // + key (`MAUDE_GEN_KEY_*` — F3, brought forward so the tripwire is armed before
+  // the bridge is wired) AND a custom key-file path (`MAUDE_GEN_KEYS_PATH`). This
+  // does NOT make the key unreachable to a compromised same-UID agent (it can
+  // still read the default keys.json off disk — the pre-existing full-tool-agent
+  // trifecta, documented, not closable by an env-scrub); it only ensures the child
+  // is never HANDED a pointer/credential it doesn't need. Meanwhile the `maude`
+  // CLI on PATH still resolves, so generation keeps working through the scrub.
+  test('scrubs the generation key-custody env vars, keeps CLI PATH (Task 1.4 / DDR-164 F3)', () => {
+    const out = scrubAgentEnv({
+      PATH: '/usr/local/bin:/usr/bin',
+      MAUDE_GEN_KEYS_PATH: '/Users/x/.config/maude/keys.json',
+      MAUDE_GEN_KEY_ENDPOINT: 'http://127.0.0.1:9/keychain', // Phase-5.1 bridge — MUST be scrubbed (F3)
+      MAUDE_GEN_KEY_KEY: 'per-launch-bridge-secret',
+      ANTHROPIC_API_KEY: 'sk-should-be-scrubbed',
+    });
+    // The generate CLI stays reachable (the sidecar, not this child, holds the key).
+    expect(out.PATH).toBe('/usr/local/bin:/usr/bin');
+    // Every generation key-custody var is stripped from the agent env.
+    expect('MAUDE_GEN_KEYS_PATH' in out).toBe(false);
+    expect('MAUDE_GEN_KEY_ENDPOINT' in out).toBe(false);
+    expect('MAUDE_GEN_KEY_KEY' in out).toBe(false);
+    // The subscription guardrail still fires.
+    expect('ANTHROPIC_API_KEY' in out).toBe(false);
+  });
 });

package/apps/studio/test/acp-plugin-bootstrap.test.ts

@@ -1,10 +1,14 @@
-// ACP session-scoped plugin auto-bootstrap resolver (DDR-143).
+// ACP session-scoped plugin auto-bootstrap resolver (DDR-143; unconditional
+// injection DDR-168).
 //
-// The pure gate logic — native/bundle context, per-plugin bundled-dir presence,
-// and the no-op-for-power-users registry gate — all exercised without touching
-// disk or ~/.claude. The wire-level presence test (that the resolved configs
-// actually land on `_meta.claudeCode.options.plugins`) lives in
-// acp-session-plugins.test.ts.
+// The pure gate logic — native/bundle context and per-plugin bundled-dir
+// presence — all exercised without touching disk or ~/.claude. Since DDR-168,
+// there is no longer a `scan`-gated no-op: a bundled plugin injects regardless
+// of whether it's ALSO installed on disk (the double-registration risk that
+// used to gate this is now closed structurally in bridge.ts instead — see
+// acp-session-plugins.test.ts). The wire-level presence test (that the
+// resolved configs actually land on `_meta.claudeCode.options.plugins`) lives
+// in acp-session-plugins.test.ts.
 
 import { describe, expect, test } from 'bun:test';
 
@@ -12,78 +16,40 @@ import { computeSessionPlugins } from '../acp/plugin-bootstrap.ts';
 
 const DESIGN = '/bundle/plugins/design';
 const FLOW = '/bundle/plugins/flow';
-const NEITHER_INSTALLED = { design: false, flow: false };
 
 describe('computeSessionPlugins — gates', () => {
   // `/flow` auto-load is intentionally OFF for now (2026-07-03) — only `design`
-  // is ever injected, even when the flow dir resolves + flow is not installed.
-  test('neither installed, native, both bundled ⇒ inject design only (flow disabled)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+  // is ever injected, even when the flow dir resolves.
+  test('native, both bundled ⇒ inject design only (flow disabled)', () => {
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
     expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
   });
 
-  test('no-op gate: design already installed ⇒ inject nothing (flow never injected)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: { design: true, flow: false },
-    });
-    expect(out).toEqual([]);
-  });
-
-  test('no-op gate: BOTH already installed (power user) ⇒ inject nothing', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: { design: true, flow: true },
-    });
-    expect(out).toEqual([]);
+  // DDR-168 — no more no-op gate: injection no longer depends on disk state.
+  // The double-registration risk this used to guard against is now closed
+  // structurally via bridge.ts's `options.settings.enabledPlugins` override.
+  test('design already installed on disk ⇒ STILL injects (no more scan-gated no-op)', () => {
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
+    expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
   });
 
   test('native-only gate: not native (web serve) ⇒ inject nothing even if dirs resolve', () => {
-    const out = computeSessionPlugins({
-      native: false,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: false, designDir: DESIGN, flowDir: FLOW });
     expect(out).toEqual([]);
   });
 
   test('path-missing gate: design dir null ⇒ inject nothing (flow disabled, so no fallback)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: null,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: true, designDir: null, flowDir: FLOW });
     expect(out).toEqual([]);
   });
 
   test('web/npm layout: native false AND both dirs null ⇒ empty', () => {
-    const out = computeSessionPlugins({
-      native: false,
-      designDir: null,
-      flowDir: null,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: false, designDir: null, flowDir: null });
     expect(out).toEqual([]);
   });
 
   test('every injected config sets skipMcpDiscovery (SDK host owns MCP)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
     expect(out.every((c) => c.skipMcpDiscovery === true && c.type === 'local')).toBe(true);
   });
 });