@1agh/maude 0.43.0 → 0.44.0

package/apps/studio/acp/bridge.ts

@@ -95,22 +95,29 @@ function withTimeout<T>(p: Promise<T>, ms: number): Promise<T | typeof TIMED_OUT
 }
 
 /**
- * Build the `session/new` params, carrying TWO adapter-internal `_meta` payloads
- * (both spread by the installed `claude-agent-acp@0.49.x` `newSession`):
+ * Build the `session/new` params, carrying THREE adapter-internal `_meta`
+ * payloads (all spread by the installed `claude-agent-acp` `newSession`):
  *
  *   • `_meta.systemPrompt.append` — the studio brief (feature-acp-context-
  *     hardening); the adapter spreads its object form over the `claude_code`
  *     preset (acp-agent.js:2282).
- *   • `_meta.claudeCode.options.plugins` — session-scoped local plugins (DDR-143);
- *     the adapter reads `_meta.claudeCode.options` (acp-agent.js:2302) and spreads
- *     the whole object into the SDK `query()` options (`...userProvidedOptions`,
+ *   • `_meta.claudeCode.options.plugins` — session-scoped local plugins (DDR-143,
+ *     unconditional injection DDR-168); the adapter reads
+ *     `_meta.claudeCode.options` (acp-agent.js:2302) and spreads the whole
+ *     object into the SDK `query()` options (`...userProvidedOptions`,
  *     :2333 → :2455), so `plugins` reaches the SDK's `plugins?: SdkPluginConfig[]`
  *     (sdk.d.ts:1683) untouched — verified live (Task-1 spike).
+ *   • `_meta.claudeCode.options.settings.enabledPlugins` — DDR-168's structural
+ *     double-registration guard: present ONLY alongside a non-empty `plugins`,
+ *     forcing off any natively-loaded user-level copy of the same plugin id
+ *     via the same `...userProvidedOptions` spread (`settings` rides untouched
+ *     exactly like `plugins` does) into the SDK's documented "flag" settings
+ *     layer (sdk.d.ts:1831, highest priority among user-controlled settings).
  *
- * Both siblings coexist under one `_meta`. The SDK's `zNewSessionRequest` declares
- * `_meta` (zod.gen), so it rides the wire validated. These contracts are
- * adapter/SDK-INTERNAL and undocumented — an adapter/SDK bump that drops either
- * must fail the presence tests LOUDLY (acp-bootstrap-brief.test.ts +
+ * All three siblings coexist under one `_meta`. The SDK's `zNewSessionRequest`
+ * declares `_meta` (zod.gen), so it rides the wire validated. These contracts are
+ * adapter/SDK-INTERNAL and undocumented — an adapter/SDK bump that drops any of
+ * them must fail the presence tests LOUDLY (acp-bootstrap-brief.test.ts +
  * acp-session-plugins.test.ts), not silently un-brief / un-plugin every session.
  * Exported for those tests.
  *
@@ -136,7 +143,34 @@ export function newSessionParams(
   // via a separate path and is unaffected. Always injected — every Maude bridge
   // session is auto-approving. `...plugins` (DDR-143) rides the same options object.
   const options: Record<string, unknown> = { settingSources: ['user'] };
-  if (plugins && plugins.length > 0) options.plugins = plugins;
+  if (plugins && plugins.length > 0) {
+    options.plugins = plugins;
+    // DDR-168 — the bundled `design` plugin is now injected UNCONDITIONALLY
+    // (plugin-bootstrap.ts no longer skips when it's also installed/enabled at
+    // the user level), so a power user with `design@maude` enabled in their OWN
+    // ~/.claude would otherwise get it loaded from TWO sources at once: this
+    // `options.plugins` entry, AND natively via `settingSources: ['user']`
+    // above (double-registration / duplicate MCP spawns / duplicate hooks).
+    // Force the natively-loaded copy off via the SDK's documented "flag"
+    // settings layer (sdk.d.ts:1831 — highest priority among user-controlled
+    // settings, precedence user < project < local < flag < policy; :5193's
+    // `Settings.enabledPlugins` doc comment gives this exact worked example).
+    // Keyed to whichever plugin ids are actually being injected — currently
+    // only `design@maude`. Absent (not merely false) whenever `plugins` is
+    // empty, so the npm/web path (where `plugins` is always empty) is
+    // completely unaffected.
+    //
+    // SECURITY LANDMINE (ethical-hacker finding, DDR-168 review round 2) — this
+    // literal is NOT derived from `plugins`/`plugin-bootstrap.ts`'s injection
+    // set; it's hand-maintained. `plugin-bootstrap.ts`'s own comment calls
+    // re-enabling `flow@maude` injection "a one-line addition" — that one line
+    // does NOT touch this object. If you flip that on, you MUST also add
+    // `'flow@maude': false` here, or a user with `flow@maude` natively enabled
+    // gets it double-loaded with zero suppression (the exact double-
+    // registration risk this override exists to close). No test currently
+    // catches this drift.
+    options.settings = { enabledPlugins: { 'design@maude': false } };
+  }
   meta.claudeCode = { options };
   return {
     cwd: repoRoot,

package/apps/studio/acp/env.ts

@@ -30,6 +30,28 @@ export const SUBSCRIPTION_SCRUBBED_ENV_KEYS = [
  */
 const PROVIDER_REDIRECT_RE = /^(ANTHROPIC_|CLAUDE_CODE_USE_|AWS_BEARER_TOKEN_BEDROCK)/i;
 
+/**
+ * feature-ai-media-generation (DDR-164) — the BYOK generation key-custody env
+ * vars. The ACP `claude` subprocess NEVER needs these: the dev-server (a separate
+ * process, with its own unscrubbed env) resolves provider keys; the agent only
+ * TRIGGERS generation through `maude design generate`. So scrub them from the
+ * child:
+ *   • `MAUDE_GEN_KEY_ENDPOINT` / `MAUDE_GEN_KEY_KEY` — the Phase-5.1 native
+ *     keychain-bridge loopback endpoint + its access key. Inheriting these would
+ *     let a prompt-injected agent query the bridge for every provider key. This
+ *     is DDR-164 **F3**, brought forward from Phase 5.1 so the tripwire is armed
+ *     BEFORE the bridge is wired, never after.
+ *   • `MAUDE_GEN_KEYS_PATH` — a custom key-file location. Scrubbing it removes the
+ *     signpost to a non-default `keys.json` from the child (defense-in-depth).
+ * NOTE this does NOT make the key unreachable to a compromised same-UID agent —
+ * it can still read the DEFAULT `~/.config/maude/keys.json` (0600, owner = the
+ * agent's own user) off disk. That residual is the pre-existing full-tool-agent
+ * trifecta (documented in the `ai-generation` skill + DDR-164), not something an
+ * env-scrub can close. This pattern's job is narrower: never HAND the child an
+ * env pointer/credential it doesn't need.
+ */
+const GENERATION_KEY_CUSTODY_RE = /^MAUDE_GEN_KEY/i;
+
 /**
  * Return a copy of `source` with the billing/provider-redirect keys removed and
  * any `undefined` values dropped (Bun.spawn's `env` wants Record<string,string>).
@@ -42,6 +64,7 @@ export function scrubAgentEnv(
   for (const [key, value] of Object.entries(source)) {
     if (value === undefined) continue;
     if (PROVIDER_REDIRECT_RE.test(key)) continue;
+    if (GENERATION_KEY_CUSTODY_RE.test(key)) continue;
     out[key] = value;
   }
   return out;

package/apps/studio/acp/login-state.ts

@@ -0,0 +1,263 @@
+// Claude auth sign-in from inside Maude (DDR-166, T0d). Drives the user's OWN
+// `claude` CLI through its own documented `auth login`/`auth status` subcommands
+// — Maude never renders a login form, never sees a token, never touches
+// ~/.claude. Deliberately in the SAME Bun process as bridge.ts/env.ts (DDR-166
+// Decision 0), so this reuses the literal `scrubAgentEnv`/`resolveClaudePath`
+// the chat spawn already uses — not a re-derived twin that could drift from it.
+
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { scrubAgentEnv } from './env.ts';
+import { resolveClaudePath, setTrustedClaudeBin } from './probe.ts';
+
+// getClaudeAuthStatus lives in probe.ts now (probeAcpAvailabilityAuthed needs
+// it too, and probe.ts is the lower-level module — login-state.ts building on
+// probe.ts, not the other way around, avoids a circular import). Re-exported
+// here so existing `from './login-state.ts'` imports keep working.
+export { type ClaudeAuthStatus, getClaudeAuthStatus } from './probe.ts';
+
+// Single-flight guard (security review finding: concurrent sign-in attempts
+// must be rejected, not queued or raced — and the child must not outlive the
+// UI's own lifecycle).
+let signinChild: ReturnType<typeof Bun.spawn> | null = null;
+
+export function isSigninInFlight(): boolean {
+  return signinChild !== null;
+}
+
+/**
+ * Spawn `claude auth login` (the user's own CLI's own browser-based OAuth —
+ * never Maude's). Fire-and-forget from the caller's perspective; completion is
+ * detected by polling {@link getClaudeAuthStatus}, not by this function's
+ * return. stdout/stderr are discarded, not drained-and-logged — `claude auth
+ * login`'s own progress text isn't something Maude needs to see or persist.
+ */
+/** DDR-166 Decision 5 — the settings-UI opt-out (prefs.rs `claude_auto_setup`). */
+function autoSetupDisabled(): boolean {
+  return process.env.MAUDE_CLAUDE_AUTOSETUP_ENABLED === '0';
+}
+
+export function startSignin(): { ok: boolean; reason?: string } {
+  if (autoSetupDisabled())
+    return { ok: false, reason: 'Automatic setup is turned off in Settings.' };
+  if (signinChild) return { ok: false, reason: 'A sign-in is already in progress.' };
+  const bin = resolveClaudePath();
+  if (!bin) return { ok: false, reason: 'Claude Code is not installed.' };
+  const child = Bun.spawn([bin, 'auth', 'login', '--claudeai'], {
+    env: scrubAgentEnv(),
+    stdout: 'ignore',
+    stderr: 'ignore',
+  });
+  signinChild = child;
+  child.exited.finally(() => {
+    if (signinChild === child) signinChild = null;
+  });
+  return { ok: true };
+}
+
+/** Kill the in-flight sign-in child, if any — cancel button + app-quit path. */
+export function cancelSignin(): void {
+  if (signinChild) {
+    try {
+      signinChild.kill();
+    } catch {
+      /* already exited */
+    }
+    signinChild = null;
+  }
+}
+
+// DDR-166 T0c, Addendum 2 — install `claude` via the exact official one-liner,
+// once, ephemerally: no persistent Maude-managed cache of a downloaded
+// artifact (that design was rejected on security review — a durable,
+// unverified cache is exactly the "plant a bad file while idle, get a silent
+// standing MITM over every future chat session" exploit chain). Anthropic's
+// own installer decides where the binary lands and how it's trusted, same as
+// when a user runs this command themselves.
+const NATIVE_INSTALL_CMD = 'curl -fsSL https://claude.ai/install.sh | bash';
+// Empirically confirmed 2026-07-13: the native installer places the binary
+// here but does NOT add it to PATH itself — it only prints a suggestion for
+// the user to edit their shell config by hand.
+//
+// `MAUDE_E2E_CLAUDE_INSTALL_PATH` override — desktop-e2e (T0f, `acp-cold-start`
+// scenario) needs to drive this EXACT install flow deterministically, but must
+// never write into a real developer's actual `~/.local/bin/claude` (would
+// clobber a genuine install). The e2e config points this at a disposable temp
+// path instead; unset in every normal launch, so real users always get the
+// real well-known path.
+const WELL_KNOWN_INSTALL_PATH =
+  process.env.MAUDE_E2E_CLAUDE_INSTALL_PATH || join(homedir(), '.local', 'bin', 'claude');
+
+// Desktop-e2e stub (mirrors MAUDE_E2E_FAKE_GITHUB_LOGIN in oauth.rs) — running
+// the REAL `curl | bash` installer in a test harness is both slow/network-
+// dependent and not what's under test (the guided-UI wiring is). When set,
+// `startInstall()` skips the real installer and instead writes this tiny,
+// offline, deterministic stand-in to `WELL_KNOWN_INSTALL_PATH` (itself
+// e2e-overridden — see above) — through the EXACT SAME freshness + content-pin
+// verification path a real install goes through below, so that security-
+// critical code stays exercised, not bypassed. Never set in a normal launch.
+const E2E_FAKE_INSTALL = process.env.MAUDE_E2E_FAKE_CLAUDE_INSTALL === '1';
+const FAKE_CLAUDE_SCRIPT = `#!/bin/sh
+# Maude desktop-e2e fake claude binary (DDR-166) — only ever written when
+# MAUDE_E2E_FAKE_CLAUDE_INSTALL=1. Implements just enough of \`auth status\`/
+# \`auth login\` for the acp-cold-start scenario to drive a real sign-in poll.
+STATE_FILE="$(dirname "$0")/.e2e-signed-in"
+if [ "$1" = "auth" ] && [ "$2" = "status" ]; then
+  if [ -f "$STATE_FILE" ]; then
+    echo '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}'
+  else
+    echo '{"loggedIn":false}'
+  fi
+  exit 0
+elif [ "$1" = "auth" ] && [ "$2" = "login" ]; then
+  sleep 1
+  touch "$STATE_FILE"
+  exit 0
+fi
+exit 1
+`;
+
+type InstallState =
+  | { phase: 'idle' }
+  | { phase: 'running' }
+  | { phase: 'done'; ok: boolean; reason?: string };
+
+let installState: InstallState = { phase: 'idle' };
+
+export function isInstallInFlight(): boolean {
+  return installState.phase === 'running';
+}
+
+/** Poll target — the panel calls this while an install is in flight (mirrors `getClaudeAuthStatus`'s role for sign-in). */
+export function getInstallState(): InstallState {
+  return installState;
+}
+
+/**
+ * Spawn the official installer and return immediately (fire-and-forget) — a
+ * request handler that instead `await`s the full install can exceed Bun's
+ * default 10s idle timeout on a slow network, killing the connection with no
+ * response. Completion is detected by polling {@link getInstallState}, the
+ * same shape {@link startSignin}/{@link getClaudeAuthStatus} already use.
+ *
+ * ONLY on verified-fresh success does this make the result visible to
+ * {@link resolveClaudePath} for the rest of this process's life. "Verified
+ * fresh" = the binary at the well-known path has an mtime AFTER this call
+ * started. This is the fix for a security-review finding against an earlier
+ * draft: an unconditional "does a file exist at `~/.local/bin/claude`" check
+ * is a standing, unverified trust point — a same-user attacker could plant a
+ * substitute there at any idle time, and it would get silently adopted on
+ * some later, unrelated install click, with the exact same blast radius the
+ * original cached-artifact design was rejected for (every future chat spawn
+ * AND every `auth status` check trusts whatever's there). Requiring the
+ * mtime to postdate this call's own start means only a file *this specific
+ * install action* just wrote gets trusted — a pre-existing or planted file
+ * does not, and is reported as an honest "couldn't verify" failure.
+ *
+ * The resulting trust is session-scoped ONLY: `MAUDE_CLAUDE_BIN` is set via
+ * `process.env`, in-memory, never written to disk. A future cold start where
+ * the user didn't just click install gets no special treatment — same as a
+ * manual curl|bash user, who has to add `~/.local/bin` to PATH themselves.
+ */
+// Tracked at module level (not just the async IIFE's own closure) so
+// cancelInstall()/app-shutdown can reach it — a security-review finding
+// against the first cut of this function: the DDR itself names "an explicit
+// answer for how a Tauri app-quit event reaches and kills the login-
+// subprocess's grandchild" as an open question, and the install child had no
+// answer at all (unreachable once spawned).
+let installChild: ReturnType<typeof Bun.spawn> | null = null;
+
+export function startInstall(): { ok: boolean; reason?: string } {
+  if (autoSetupDisabled())
+    return { ok: false, reason: 'Automatic setup is turned off in Settings.' };
+  if (installState.phase === 'running')
+    return { ok: false, reason: 'An install is already in progress.' };
+  installState = { phase: 'running' };
+  const startedAt = Date.now();
+  (async () => {
+    try {
+      let code: number;
+      if (E2E_FAKE_INSTALL) {
+        // Keep the "Installing…" polling UI genuinely exercised instead of
+        // resolving on the same tick.
+        await new Promise((resolve) => setTimeout(resolve, 1200));
+        mkdirSync(dirname(WELL_KNOWN_INSTALL_PATH), { recursive: true });
+        writeFileSync(WELL_KNOWN_INSTALL_PATH, FAKE_CLAUDE_SCRIPT, { mode: 0o755 });
+        chmodSync(WELL_KNOWN_INSTALL_PATH, 0o755);
+        code = 0;
+      } else {
+        const proc = Bun.spawn(['bash', '-c', NATIVE_INSTALL_CMD], {
+          env: scrubAgentEnv(),
+          stdin: 'ignore',
+          // Install progress text carries no PII (unlike auth status), but
+          // there's no product need to surface it either — discard, don't
+          // drain-and-log.
+          stdout: 'ignore',
+          stderr: 'ignore',
+        });
+        installChild = proc;
+        code = await proc.exited;
+        installChild = null;
+      }
+      if (code !== 0) {
+        installState = {
+          phase: 'done',
+          ok: false,
+          reason: `The installer exited with an error (code ${code}).`,
+        };
+        return;
+      }
+      if (!existsSync(WELL_KNOWN_INSTALL_PATH)) {
+        installState = {
+          phase: 'done',
+          ok: false,
+          reason:
+            'The installer reported success, but no binary was found at the expected location.',
+        };
+        return;
+      }
+      const st = statSync(WELL_KNOWN_INSTALL_PATH);
+      if (st.mtimeMs < startedAt) {
+        installState = {
+          phase: 'done',
+          ok: false,
+          reason:
+            'A claude binary already exists but could not be verified as freshly installed. Add ~/.local/bin to your PATH, then try Re-check.',
+        };
+        return;
+      }
+      // DDR-166 — content-pin, not just path-pin (a bare MAUDE_CLAUDE_BIN
+      // existence check trusts the path forever after this one-time
+      // freshness check). setTrustedClaudeBin makes resolveClaudePath()
+      // re-verify this exact content UNCONDITIONALLY on every future
+      // resolution (probe.ts's own doc comment covers why there's
+      // deliberately no mtime-caching shortcut — an earlier draft had one,
+      // and it was itself trivially bypassable by the same attacker).
+      const sha256 = createHash('sha256')
+        .update(readFileSync(WELL_KNOWN_INSTALL_PATH))
+        .digest('hex');
+      setTrustedClaudeBin(WELL_KNOWN_INSTALL_PATH, sha256);
+      process.env.MAUDE_CLAUDE_BIN = WELL_KNOWN_INSTALL_PATH;
+      installState = { phase: 'done', ok: true };
+    } catch {
+      installChild = null;
+      installState = { phase: 'done', ok: false, reason: 'Could not run the installer.' };
+    }
+  })();
+  return { ok: true };
+}
+
+/** Kill the in-flight install child, if any — cancel path + app-quit/shutdown path. */
+export function cancelInstall(): void {
+  if (installChild) {
+    try {
+      installChild.kill();
+    } catch {
+      /* already exited */
+    }
+    installChild = null;
+    installState = { phase: 'idle' };
+  }
+}

package/apps/studio/acp/plugin-bootstrap.ts

@@ -1,4 +1,4 @@
-// ACP session-scoped plugin auto-bootstrap (DDR-143).
+// ACP session-scoped plugin auto-bootstrap (DDR-143; unconditional injection DDR-168).
 //
 // A Maude Desktop user with only Claude Code installed should get `/design:*`
 // working in the chat panel with ZERO manual install — no `npm i`, no `/plugin
@@ -15,7 +15,7 @@
 // no package manager runs, no network is touched (DDR-126/128) — it's reversible
 // and per-session by construction.
 //
-// Three gates, ALL must hold for a plugin to be injected:
+// Two gates must hold for a plugin to be injected:
 //   1. NATIVE / BUNDLE context (guard #4, DDR-119/123). The web `maude design
 //      serve` (npm) path ships no plugin manifest (DDR-044) and its users have a
 //      terminal — never inject there. The signal is the manifest's presence on
@@ -24,15 +24,21 @@
 //      MAUDE_DEV_SERVER_ROOT as an explicit stricter marker.
 //   2. BUNDLED FILES present — the per-plugin dir resolved (Task 2). Null on the
 //      npm/web layout ⇒ skip that plugin.
-//   3. NO-OP for power users (guard #3, hard). If the plugin is already installed
-//      via the marketplace OR enabled in the user's settings.json, it loads
-//      NATIVELY under the adapter's `settingSources:user` — injecting the bundled
-//      copy on top would double-register commands + risk version skew. So a
-//      `scanPlugins()` hit ⇒ skip that plugin. A pristine ~/.claude (the target
-//      non-power-user) reads as not-installed ⇒ inject.
+//
+// DDR-168 — the bundled copy is now injected UNCONDITIONALLY on every native
+// session, regardless of whether the plugin is ALSO installed/enabled on disk
+// (`~/.claude`). Every release ships an internally-consistent, release-matched
+// CLI + plugin set — that's the copy this session should run, not whatever a
+// power user happens to have lying around. This reverses this file's original
+// DDR-143 Decision 3 ("no-op for power users, hard") on purpose. The double-
+// registration risk that gate existed to prevent is now closed structurally,
+// one level up: `bridge.ts`'s `newSessionParams()` sets `options.settings
+// .enabledPlugins['design@maude'] = false` whenever it's carrying a non-empty
+// `plugins` array, forcing off any natively-loaded user-level copy of the same
+// id via the SDK's documented `flag > user` settings precedence — so the
+// bundled copy injected here is the ONLY one that ever loads.
 
 import { DESIGN_PLUGIN_DIR, FLOW_PLUGIN_DIR } from '../paths.ts';
-import { type PluginScan, scanPlugins } from '../readiness.ts';
 
 /**
  * SDK plugin-load config (`@anthropic-ai/claude-agent-sdk` `SdkPluginConfig`).
@@ -55,8 +61,6 @@ export interface SessionPluginDeps {
   designDir: string | null;
   /** Bundled `flow` plugin dir, or null (npm/web layout). */
   flowDir: string | null;
-  /** ~/.claude registry+settings scan — a present plugin loads natively (no-op). */
-  scan: Pick<PluginScan, 'design' | 'flow'>;
 }
 
 /**
@@ -66,15 +70,17 @@ export interface SessionPluginDeps {
 export function computeSessionPlugins(deps: SessionPluginDeps): SdkPluginConfig[] {
   if (!deps.native) return [];
   const out: SdkPluginConfig[] = [];
-  const add = (dir: string | null, alreadyPresent: boolean): void => {
-    // dir === null → not bundled in this layout (web/npm) → skip.
-    // alreadyPresent → loads natively → skip (no double-registration / skew).
-    if (dir && !alreadyPresent) out.push({ type: 'local', path: dir, skipMcpDiscovery: true });
+  const add = (dir: string | null): void => {
+    // dir === null → not bundled in this layout (web/npm) → skip. Otherwise
+    // inject unconditionally (DDR-168) — the double-registration risk of also
+    // having a disk-installed copy is closed structurally in bridge.ts, not
+    // by skipping injection here.
+    if (dir) out.push({ type: 'local', path: dir, skipMcpDiscovery: true });
   };
-  add(deps.designDir, deps.scan.design);
+  add(deps.designDir);
   // `/flow` auto-load is intentionally OFF for now (2026-07-03) — the chat ships
-  // design-only. `deps.flowDir` / `deps.scan.flow` stay resolved (harmless) so
-  // restoring it is a one-liner: re-add `add(deps.flowDir, deps.scan.flow)`.
+  // design-only. `deps.flowDir` stays resolved (harmless) so restoring it is a
+  // one-liner: re-add `add(deps.flowDir)`.
   return out;
 }
 
@@ -98,18 +104,18 @@ export function isNativePluginContext(): boolean {
 }
 
 /**
- * Resolve the session-scoped plugins to inject for a fresh ACP session. Wires the
- * real deps (native context, bundled dirs, live ~/.claude scan) into
- * {@link computeSessionPlugins}. Empty array ⇒ inject nothing (the power-user /
- * web no-op). Recomputed per bridge construction; stable across an adapter
- * re-spawn because it's carried on the bridge's readonly options.
+ * Resolve the session-scoped plugins to inject for a fresh ACP session. Wires
+ * the real deps (native context, bundled dirs) into {@link computeSessionPlugins}.
+ * Empty array ⇒ inject nothing (the web no-op). Recomputed per bridge
+ * construction; stable across an adapter re-spawn because it's carried on the
+ * bridge's readonly options. Does NOT consult `~/.claude`'s registry (DDR-168 —
+ * the bundled copy always wins regardless of disk state); `readiness.ts` still
+ * calls `scanPlugins()` independently for its own UI row.
  */
 export function resolveSessionPlugins(): SdkPluginConfig[] {
-  const scan = scanPlugins();
   return computeSessionPlugins({
     native: isNativePluginContext(),
     designDir: DESIGN_PLUGIN_DIR,
     flowDir: FLOW_PLUGIN_DIR,
-    scan: { design: scan.design, flow: scan.flow },
   });
 }

package/apps/studio/acp/probe.ts

@@ -6,10 +6,12 @@
 // native shell ships the apps/studio source tree (with node_modules), so the
 // adapter resolves on disk there.
 
+import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 import { DEV_SERVER_ROOT } from '../paths.ts';
+import { scrubAgentEnv } from './env.ts';
 
 /** Adapter npm package — the renamed continuation of `@zed-industries/claude-code-acp`. */
 const ADAPTER_PKG = '@agentclientprotocol/claude-agent-acp';
@@ -64,13 +66,91 @@ export function resolveAdapterEntry(): string | null {
   return null;
 }
 
+/**
+ * Content pin for a Maude-auto-provisioned `MAUDE_CLAUDE_BIN` override
+ * (DDR-166 T0c, `installClaudeCli()` in `login-state.ts` is the only writer).
+ *
+ * Second-round security-review finding against the first cut of this file:
+ * checking only `existsSync(override)` on every call meant that once a
+ * freshly-installed binary passed its one-time freshness check, the PATH
+ * override was trusted **forever** for the rest of this long-lived process —
+ * a same-UID attacker who swapped the file's *content* at any later point in
+ * the session (the install-flow one-time check does not repeat) got the
+ * exact "durable, silent MITM over every future chat spawn" blast radius the
+ * original cached-artifact design was rejected for, just reached through a
+ * different door. Path existence is not authenticity.
+ *
+ * The fix: pin the SHA-256 captured at verified-install time, and re-hash
+ * UNCONDITIONALLY on every resolution — no mtime-based caching shortcut.
+ *
+ * A third-round review finding against the first cut of this fix: an
+ * earlier draft cached the hash result keyed on mtime ("skip the re-hash if
+ * mtime is unchanged since the last verified read") as a performance
+ * optimization. That cache is trivially forgeable by the EXACT SAME attacker
+ * the fix exists to stop: swapping the file's content costs them nothing
+ * beyond a `touch -d <original-mtime>` immediately after, at zero additional
+ * privilege — same-UID write access to the file is already required for the
+ * swap itself, and mtime is neither secret nor tamper-evident (`utimensat`
+ * sets it with nanosecond precision, not a race against clock granularity).
+ * The cache silently reopened the exact "durable, silent MITM over every
+ * future chat spawn" blast radius the whole fix exists to close.
+ *
+ * The "don't re-hash on every 1.5s readiness-poll tick" concern that
+ * motivated the cache doesn't actually hold: readiness polling
+ * (`useReadiness` in `ReadinessList.jsx`) only runs while the panel is
+ * DISCONNECTED — i.e., only during the bounded, actively-supervised
+ * install/sign-in flow itself, not for the lifetime of a long session. Once
+ * connected, nothing polls `/_api/preflight` on an interval. A live-measured
+ * SHA-256 pass over the actual ~241 MB installed `claude` binary took
+ * ~116 ms — cheap enough to simply always pay, especially since the other
+ * caller that matters (a fresh chat-session spawn, once per session) has no
+ * latency budget concern at all.
+ */
+let trustedBin: { path: string; sha256: string } | null = null;
+
+/** Called only by `installClaudeCli()` after its own freshness check passes. */
+export function setTrustedClaudeBin(path: string, sha256: string): void {
+  trustedBin = { path, sha256 };
+}
+
+function hashFile(path: string): string | null {
+  try {
+    return createHash('sha256').update(readFileSync(path)).digest('hex');
+  } catch {
+    return null;
+  }
+}
+
+/** True iff `path` is either not a Maude-provisioned override (nothing to pin) or its content still matches the pinned hash — re-hashed every call, deliberately no caching shortcut (see doc comment above). */
+function contentStillTrusted(path: string): boolean {
+  if (!trustedBin || trustedBin.path !== path) return true; // not our concern — e.g. a user-set override
+  return hashFile(path) === trustedBin.sha256;
+}
+
 /**
  * Absolute path to the user's installed `claude` CLI, or null. Honors a
  * `MAUDE_CLAUDE_BIN` override; otherwise looks it up on PATH.
  */
 export function resolveClaudePath(): string | null {
+  // An explicit, content-pinned `MAUDE_CLAUDE_BIN` override is checked FIRST
+  // and always wins — including over the E2E force-missing stub below. This
+  // matters for the desktop-e2e `acp-cold-start` scenario (T0f): it starts
+  // with MAUDE_E2E_FORCE_CLAUDE_STATUS=missing to simulate a machine with no
+  // `claude` on PATH, then drives the real T0c install flow, which sets THIS
+  // override once its own freshness+hash verification passes
+  // (login-state.ts's setTrustedClaudeBin). A coarse "simulate absent" test
+  // stub must not out-rank a just-verified, explicitly-provisioned install —
+  // that would make the guided install flow untestable end-to-end.
   const override = process.env.MAUDE_CLAUDE_BIN;
-  if (override) return existsSync(override) ? override : null;
+  if (override) {
+    if (!existsSync(override)) return null;
+    if (!contentStillTrusted(override)) return null;
+    return override;
+  }
+  // DDR-166 — deterministic E2E stub (mirrors MAUDE_E2E_FAKE_GITHUB_LOGIN in
+  // oauth.rs), simulating a machine where `claude` is absent from PATH.
+  // Never set in a normal launch.
+  if (process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS === 'missing') return null;
   return Bun.which('claude');
 }
 
@@ -110,3 +190,74 @@ export function probeAcpAvailability(): AcpAvailability {
   }
   return { available: true, adapterEntry, claudePath };
 }
+
+export interface ClaudeAuthStatus {
+  loggedIn: boolean;
+  /** 'firstParty' = claude.ai subscription. Anything else may mean API billing. */
+  apiProvider?: string;
+  subscriptionType?: string;
+}
+
+/**
+ * Shells `claude auth status --json` and narrows the result to only the fields
+ * ever trusted/exposed here. `email`/`orgId`/`orgName` are deliberately dropped
+ * on read — never forwarded to a caller, never logged (security review finding:
+ * raw-stdout-to-log is a real habit elsewhere in this codebase; the fix is to
+ * never let the raw payload exist past this function).
+ */
+export async function getClaudeAuthStatus(): Promise<ClaudeAuthStatus | null> {
+  const bin = resolveClaudePath();
+  if (!bin) return null;
+  try {
+    const proc = Bun.spawn([bin, 'auth', 'status', '--json'], {
+      env: scrubAgentEnv(),
+      stdout: 'pipe',
+      stderr: 'ignore',
+    });
+    const timeout = setTimeout(() => proc.kill(), 5000);
+    const out = await new Response(proc.stdout).text();
+    await proc.exited;
+    clearTimeout(timeout);
+    const parsed: unknown = JSON.parse(out);
+    if (typeof parsed !== 'object' || parsed === null) return null;
+    const p = parsed as Record<string, unknown>;
+    return {
+      loggedIn: !!p.loggedIn,
+      apiProvider: typeof p.apiProvider === 'string' ? p.apiProvider : undefined,
+      subscriptionType: typeof p.subscriptionType === 'string' ? p.subscriptionType : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The fuller availability check backing `GET /_api/acp/status` — the ONE
+ * signal the ChatPanel UI's connected/not-connected gate actually watches
+ * (`probeStatus()` in ChatPanel.jsx). Adds a real sign-in check on top of
+ * {@link probeAcpAvailability}'s cheap adapter+path probe.
+ *
+ * Security-review-grade bug found while building the T0f `acp-cold-start`
+ * desktop-e2e scenario: `probeAcpAvailability()` alone reports `available:
+ * true` the moment `claude` is INSTALLED, before the user has signed in —
+ * exactly the "logged-out-but-installed reads as available" failure mode
+ * T0d's own validation criteria calls out by name. Deliberately a SEPARATE
+ * function rather than changing `probeAcpAvailability()` itself: that one
+ * also backs the WS `onOpen` ready frame (cheap, no subprocess spawn on every
+ * socket open) and has an existing test contract (`acp-bridge.test.ts`)
+ * treating "a resolvable binary" as sufficient — this is the one call site
+ * that needs the fuller, auth-checked answer.
+ */
+export async function probeAcpAvailabilityAuthed(): Promise<AcpAvailability> {
+  const base = probeAcpAvailability();
+  if (!base.available) return base;
+  const authStatus = await getClaudeAuthStatus();
+  if (!authStatus?.loggedIn) {
+    return {
+      ...base,
+      available: false,
+      reason: 'Claude Code is installed but not signed in — sign in to connect.',
+    };
+  }
+  return base;
+}