@1agh/maude 0.45.0 → 0.45.2

package/apps/studio/generation/whisper-models.test.ts

@@ -125,7 +125,9 @@ describe('downloadWhisperModel', () => {
       headers: new Headers(),
       body: new Response(new Uint8Array(1)).body,
     })) as unknown as typeof fetch;
-    await expect(downloadWhisperModel('tiny', () => {})).rejects.toThrow(/off huggingface\.co/);
+    await expect(downloadWhisperModel('tiny', () => {})).rejects.toThrow(
+      /off the allowed HF hosts/
+    );
     expect(existsSync(join(whisperModelsDir(), 'ggml-tiny.bin'))).toBe(false);
   });
 
@@ -140,6 +142,31 @@ describe('downloadWhisperModel', () => {
     const path = await downloadWhisperModel('tiny', () => {});
     expect(existsSync(path)).toBe(true);
   });
+
+  test("accepts a redirect that lands on HF's Xet CDN (xethub.hf.co)", async () => {
+    const bytes = new Uint8Array(512);
+    globalThis.fetch = (async () => ({
+      url: 'https://cas-bridge.xethub.hf.co/repos/x/ggml-tiny.bin',
+      ok: true,
+      headers: new Headers({ 'content-length': String(bytes.byteLength) }),
+      body: new Response(bytes).body,
+    })) as unknown as typeof fetch;
+    const path = await downloadWhisperModel('tiny', () => {});
+    expect(existsSync(path)).toBe(true);
+  });
+
+  test('rejects a lookalike host that merely contains an allowed apex', async () => {
+    globalThis.fetch = (async () => ({
+      url: 'https://xethub.hf.co.evil.example/ggml-tiny.bin',
+      ok: true,
+      headers: new Headers(),
+      body: new Response(new Uint8Array(1)).body,
+    })) as unknown as typeof fetch;
+    await expect(downloadWhisperModel('tiny', () => {})).rejects.toThrow(
+      /off the allowed HF hosts/
+    );
+    expect(existsSync(join(whisperModelsDir(), 'ggml-tiny.bin'))).toBe(false);
+  });
 });
 
 describe('registry integrity', () => {

package/apps/studio/generation/whisper-models.ts

@@ -81,6 +81,18 @@ export const WHISPER_MODELS: readonly WhisperModelDescriptor[] = [
 const MODEL_HOST = 'https://huggingface.co';
 const MODEL_REPO_PATH = '/ggerganov/whisper.cpp/resolve/main';
 
+// Apex domains a model-download redirect is allowed to land on. `huggingface.co`
+// is the classic Git-LFS CDN; `xethub.hf.co` is HF's newer Xet storage backend,
+// which several repos (incl. ggerganov/whisper.cpp) have been migrated to — its
+// edge nodes (e.g. `cas-bridge.xethub.hf.co`) are a different apex entirely, not
+// a subdomain of huggingface.co. Anchored subdomain match only (never
+// `includes()`), so `xethub.hf.co.evil.com` / `evilxethub.hf.co` still reject.
+const ALLOWED_REDIRECT_APEXES = ['huggingface.co', 'xethub.hf.co'] as const;
+
+function isAllowedRedirectHost(hostname: string): boolean {
+  return ALLOWED_REDIRECT_APEXES.some((apex) => hostname === apex || hostname.endsWith(`.${apex}`));
+}
+
 /** The fixed, non-interpolated download URL for a model (SSRF-safe — the file
  *  comes from the frozen registry above, never from a request). */
 export function whisperModelUrl(m: WhisperModelDescriptor): string {
@@ -163,7 +175,9 @@ export function resolveWhisperModel(preferId?: string): string | null {
  * (Task 2.7). Egress discipline: the URL is derived from the FROZEN registry
  * (initial host is always huggingface.co, asserted https + fixed host); the
  * redirect the HF blob store issues is followed but the FINAL hop is re-asserted
- * https + a `*.huggingface.co` host (ethical-hacker Finding 2); the body is
+ * https + a host on `ALLOWED_REDIRECT_APEXES` (`*.huggingface.co` for the
+ * classic LFS CDN, `*.xethub.hf.co` for HF's newer Xet storage backend —
+ * ethical-hacker Finding 2 plus the Xet-migration follow-up); the body is
  * size-capped per-chunk to the model's expected size (+20% margin) before it can
  * fill the disk; written to a `.part` temp and atomically renamed so a
  * partial/aborted download never looks complete. Pass an AbortSignal (a timeout)
@@ -190,15 +204,16 @@ export async function downloadWhisperModel(
   const tmpPath = `${finalPath}.part`;
 
   const cap = Math.ceil(m.sizeMB * 1.2) * 1024 * 1024; // expected size + 20% margin
-  // huggingface.co 302-redirects model blobs to its own LFS CDN, so we must
-  // follow — but re-assert the FINAL hop is still https + a huggingface.co host
-  // (ethical-hacker Finding 2): an open-redirect/on-path must not land the fetch
-  // on an arbitrary host. A wall-clock timeout is layered by the caller's signal.
+  // huggingface.co 302-redirects model blobs to its own LFS/Xet CDN, so we must
+  // follow — but re-assert the FINAL hop is still https + a host on
+  // ALLOWED_REDIRECT_APEXES (ethical-hacker Finding 2): an open-redirect/on-path
+  // must not land the fetch on an arbitrary host. A wall-clock timeout is
+  // layered by the caller's signal.
   const res = await fetch(url, { signal, redirect: 'follow' });
   try {
     const finalUrl = new URL(res.url || url);
-    if (finalUrl.protocol !== 'https:' || !/(^|\.)huggingface\.co$/.test(finalUrl.hostname))
-      throw new Error(`model download redirected off huggingface.co (${finalUrl.hostname})`);
+    if (finalUrl.protocol !== 'https:' || !isAllowedRedirectHost(finalUrl.hostname))
+      throw new Error(`model download redirected off the allowed HF hosts (${finalUrl.hostname})`);
   } catch (err) {
     if (err instanceof Error && err.message.startsWith('model download redirected')) throw err;
     throw new Error('model download resolved to an invalid URL');

package/apps/studio/http.ts

@@ -17,7 +17,7 @@ import {
   startSignin,
 } from './acp/login-state.ts';
 import { probeAcpAvailabilityAuthed } from './acp/probe.ts';
-import { deleteChat, listChats, readChatMessages } from './acp/transcript.ts';
+import { deleteChat, listChats, readChatMessages, writeChatMeta } from './acp/transcript.ts';
 import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { ImportAssetError, importSvg, SVG_MAX_BYTES } from './bin/_import-asset.mjs';
 import { ImportBrandError, importBrand } from './bin/_import-brand.mjs';
@@ -1017,7 +1017,7 @@ export function createHttp(
       Response.json(listChats(ctx.paths.designRoot), {
         headers: { 'Cache-Control': 'no-store' },
       }),
-    '/_api/acp/chat': (req: Request) => {
+    '/_api/acp/chat': async (req: Request) => {
       const id = (new URL(req.url).searchParams.get('id') ?? '')
         .replace(/[^a-z0-9_-]/gi, '')
         .slice(0, 64);
@@ -1025,6 +1025,37 @@ export function createHttp(
         const removed = id ? deleteChat(ctx.paths.designRoot, id) : false;
         return Response.json({ ok: removed }, { headers: { 'Cache-Control': 'no-store' } });
       }
+      // Task C5 — Rename / Archive from the chat switcher's overflow menu.
+      // Same CSRF + loopback gate as every other privileged write route
+      // (DDR-088); id is already sanitized/contained above.
+      if (req.method === 'PATCH') {
+        if (!sameOriginWrite(req))
+          return new Response('cross-origin write rejected', { status: 403 });
+        if (!isLoopbackHost(req.headers.get('host')))
+          return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+        if (!id) return new Response('missing id', { status: 400 });
+        let body: unknown;
+        try {
+          body = await req.json();
+        } catch {
+          return new Response('invalid JSON body', { status: 400 });
+        }
+        if (!body || typeof body !== 'object') return new Response('invalid body', { status: 400 });
+        const b = body as { title?: unknown; archived?: unknown };
+        const patch: { title?: string | null; archived?: boolean } = {};
+        if ('title' in b) {
+          if (b.title === null) patch.title = null;
+          else if (typeof b.title === 'string') patch.title = b.title;
+          else return new Response('title must be a string or null', { status: 400 });
+        }
+        if ('archived' in b) {
+          if (typeof b.archived !== 'boolean')
+            return new Response('archived must be a boolean', { status: 400 });
+          patch.archived = b.archived;
+        }
+        const meta = writeChatMeta(ctx.paths.designRoot, id, patch);
+        return Response.json(meta, { headers: { 'Cache-Control': 'no-store' } });
+      }
       if (!id) return Response.json([], { headers: { 'Cache-Control': 'no-store' } });
       return Response.json(readChatMessages(ctx.paths.designRoot, id), {
         headers: { 'Cache-Control': 'no-store' },

package/apps/studio/test/acp-bridge.test.ts

@@ -52,7 +52,7 @@ describe('AcpBridge — round-trip + subscription guardrail', () => {
     }
   }, 15000);
 
-  test('setConfig passes model + effort to the child env (ANTHROPIC_MODEL / MAX_THINKING_TOKENS)', async () => {
+  test('model/effort are no longer env-at-spawn — a config change never respawns the running adapter', async () => {
     process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
     process.env.MAUDE_ACP_RUNTIME = process.execPath;
     process.env.MAUDE_CLAUDE_BIN = process.execPath;
@@ -60,19 +60,24 @@ describe('AcpBridge — round-trip + subscription guardrail', () => {
     const updates: unknown[] = [];
     const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: (u) => updates.push(u) });
     try {
+      // A persisted pick this mock doesn't advertise (it has no configOptions at
+      // all) is skipped best-effort, never forwarded to ANTHROPIC_MODEL/env.
       bridge.setConfig('opus', 'thorough');
       await bridge.prompt('hi', 'c1');
+      const sid = bridge.sessionId;
       const first = JSON.stringify(updates);
-      expect(first).toContain('model=opus');
-      expect(first).toContain('thinking=31999');
+      expect(first).toContain('model=<unset>');
+      expect(first).toContain('thinking=<unset>');
 
-      // Changing the config re-spawns with the new env on the next prompt.
+      // Changing the config again must NOT tear down / respawn the live process
+      // (Task A3 — the old configChanged()-triggered stop() is gone).
       updates.length = 0;
       bridge.setConfig(null, 'fast');
       await bridge.prompt('again', 'c1');
+      expect(bridge.sessionId).toBe(sid); // same session — no respawn happened
       const second = JSON.stringify(updates);
-      expect(second).toContain('model=<unset>'); // null model → ANTHROPIC_MODEL not set
-      expect(second).toContain('thinking=0'); // fast → thinking disabled
+      expect(second).toContain('model=<unset>');
+      expect(second).toContain('thinking=<unset>');
     } finally {
       await bridge.stop();
     }

package/apps/studio/test/acp-capabilities.test.ts

@@ -0,0 +1,123 @@
+// Pure unit tests for client/panels/acp-capabilities.js — the parsing +
+// persisted-pick-resolution helpers the dynamic CapabilityBar renders from.
+// No hardcoded model/effort/mode list is under test here BY DESIGN: these
+// functions must work for whatever the session actually advertises.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  flattenSelectOptions,
+  parseConfigOptions,
+  parseModes,
+  resolvePersistedPick,
+} from '../client/panels/acp-capabilities.js';
+
+describe('parseConfigOptions', () => {
+  test('identifies model/effort/fast by id, excludes the mode-mirror entry, and buckets everything else into others', () => {
+    const configOptions = [
+      { id: 'model', category: 'model', currentValue: 'sonnet', options: [] },
+      { id: 'effort', category: 'thought_level', currentValue: 'default', options: [] },
+      { id: 'mode', category: 'mode', currentValue: 'default', options: [] },
+      { id: 'fast', category: 'model_config', currentValue: 'off', options: [] },
+      { id: 'agent', currentValue: 'default', options: [] }, // no category — the documented gap
+      { id: 'some-future-option', category: '_custom', currentValue: 'x', options: [] },
+    ];
+    const { model, effort, fast, others } = parseConfigOptions(configOptions);
+    expect(model?.id).toBe('model');
+    expect(effort?.id).toBe('effort');
+    expect(fast?.id).toBe('fast');
+    expect(others.map((o) => o.id)).toEqual(['agent', 'some-future-option']);
+  });
+
+  test('tolerates missing/empty/malformed input', () => {
+    expect(parseConfigOptions(undefined)).toEqual({
+      model: null,
+      effort: null,
+      fast: null,
+      others: [],
+    });
+    expect(parseConfigOptions(null)).toEqual({ model: null, effort: null, fast: null, others: [] });
+    expect(parseConfigOptions([])).toEqual({ model: null, effort: null, fast: null, others: [] });
+    // A non-object entry must not throw.
+    expect(parseConfigOptions([null, 'x', 42]).others).toEqual([]);
+  });
+
+  test('a session with only a subset of options omits the rest as null, not a stale default', () => {
+    const { model, effort, fast } = parseConfigOptions([{ id: 'model', options: [] }]);
+    expect(model).not.toBeNull();
+    expect(effort).toBeNull();
+    expect(fast).toBeNull();
+  });
+});
+
+describe('parseModes', () => {
+  test('returns current + available from a real SessionModeState', () => {
+    const modes = {
+      currentModeId: 'plan',
+      availableModes: [
+        { id: 'default', name: 'Manual' },
+        { id: 'plan', name: 'Plan Mode' },
+      ],
+    };
+    expect(parseModes(modes)).toEqual({
+      current: 'plan',
+      available: modes.availableModes,
+    });
+  });
+
+  test('an agent that never advertises modes yields an empty, non-throwing shape', () => {
+    expect(parseModes(null)).toEqual({ current: null, available: [] });
+    expect(parseModes(undefined)).toEqual({ current: null, available: [] });
+    expect(parseModes({})).toEqual({ current: null, available: [] });
+  });
+});
+
+describe('flattenSelectOptions', () => {
+  test('passes through a flat option list unchanged', () => {
+    const options = [
+      { value: 'a', name: 'A' },
+      { value: 'b', name: 'B' },
+    ];
+    expect(flattenSelectOptions(options)).toEqual(options);
+  });
+
+  test('flattens grouped SessionConfigSelectGroup[] into one leaf list', () => {
+    const options = [
+      { group: 'g1', name: 'Group 1', options: [{ value: 'a', name: 'A' }] },
+      {
+        group: 'g2',
+        name: 'Group 2',
+        options: [
+          { value: 'b', name: 'B' },
+          { value: 'c', name: 'C' },
+        ],
+      },
+    ];
+    expect(flattenSelectOptions(options).map((o) => o.value)).toEqual(['a', 'b', 'c']);
+  });
+
+  test('tolerates missing input', () => {
+    expect(flattenSelectOptions(undefined)).toEqual([]);
+    expect(flattenSelectOptions(null)).toEqual([]);
+  });
+});
+
+describe('resolvePersistedPick', () => {
+  test('prefers the saved pick when the session still offers it', () => {
+    expect(resolvePersistedPick(['opus', 'sonnet'], 'opus', 'sonnet')).toBe('opus');
+  });
+
+  test('falls back to the session default when the saved pick is no longer offered', () => {
+    expect(resolvePersistedPick(['sonnet', 'haiku'], 'opus', 'sonnet')).toBe('sonnet');
+  });
+
+  test('falls back to null when there is neither a valid saved pick nor a default', () => {
+    expect(resolvePersistedPick([], 'opus', undefined)).toBeNull();
+    expect(resolvePersistedPick([], null, null)).toBeNull();
+  });
+
+  test('a null/undefined saved value always defers to the default', () => {
+    expect(resolvePersistedPick(['a', 'b'], null, 'b')).toBe('b');
+    expect(resolvePersistedPick(['a', 'b'], undefined, 'a')).toBe('a');
+  });
+});

package/apps/studio/test/acp-caps-bridge.test.ts

@@ -0,0 +1,274 @@
+// Proves the session-capabilities channel end-to-end against a mock ACP agent
+// (fixtures/mock-acp-agent-caps.mjs) — no real `claude` needed. Covers Tasks
+// A1/A2/A3/A4 of feature-acp-panel-dynamic-claude-code-capabilities:
+//   • AcpBridge captures modes/configOptions from session/new and fires onCaps
+//     once the resume-replay window is closed.
+//   • AcpBridge.setMode/setConfigOption drive LIVE changes on an established
+//     session (no respawn) and the full refreshed configOptions echoes back.
+//   • setConfig's persisted model/effort/mode picks are applied ONCE, best-
+//     effort, right after a session establishes (never onto an already-live one).
+//   • The Acp manager (index.ts) validates `set-mode`/`set-config` frames
+//     against the bridge's last-advertised caps before ever calling the bridge
+//     (DDR-125 F1 — the dynamic replacement for VALID_MODELS/VALID_EFFORT).
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { ServerWebSocket } from 'bun';
+
+import { AcpBridge } from '../acp/bridge.ts';
+import { createAcp } from '../acp/index.ts';
+import type { Context } from '../context.ts';
+import type { WsData } from '../ws.ts';
+
+const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent-caps.mjs');
+const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
+
+function useMockAgent() {
+  process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+  process.env.MAUDE_ACP_RUNTIME = process.execPath;
+  process.env.MAUDE_CLAUDE_BIN = process.execPath;
+}
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+});
+
+async function until<T>(fn: () => T | undefined, timeoutMs = 12000): Promise<T> {
+  const start = performance.now();
+  for (;;) {
+    const v = fn();
+    if (v !== undefined) return v;
+    if (performance.now() - start > timeoutMs) throw new Error('timeout waiting for condition');
+    await new Promise((r) => setTimeout(r, 25));
+  }
+}
+
+function fakeWs(id: string) {
+  const frames: Array<Record<string, unknown>> = [];
+  const ws = {
+    data: { id } as WsData,
+    send: (raw: string) => {
+      frames.push(JSON.parse(raw));
+    },
+  } as unknown as ServerWebSocket<WsData>;
+  return { ws, frames };
+}
+
+describe('AcpBridge — capability channel (Tasks A1/A2/A3)', () => {
+  test('onCaps fires with the initial modes + configOptions once a session establishes', async () => {
+    useMockAgent();
+    const caps: Array<[unknown, unknown]> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onCaps: (modes, configOptions) => caps.push([modes, configOptions]),
+    });
+    try {
+      await bridge.warmUp('c1');
+      const [modes, configOptions] = await until(() =>
+        caps.length ? caps[caps.length - 1] : undefined
+      );
+      expect((modes as { currentModeId: string }).currentModeId).toBe('default');
+      expect(
+        (modes as { availableModes: Array<{ id: string }> }).availableModes.map((m) => m.id)
+      ).toEqual(['default', 'plan']);
+      const ids = (configOptions as Array<{ id: string }>).map((o) => o.id);
+      expect(ids).toEqual(['model', 'effort', 'mode']);
+      expect(bridge.modes?.currentModeId).toBe('default');
+      expect(bridge.configOptions.length).toBe(3);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('onSessionInfo fires with the agent-generated title', async () => {
+    useMockAgent();
+    const infos: Array<{ title?: string | null }> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onSessionInfo: (info) => infos.push(info),
+    });
+    try {
+      await bridge.warmUp('c1');
+      const info = await until(() => (infos.length ? infos[infos.length - 1] : undefined));
+      expect(info.title).toBe('New chat');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('setMode live-changes the mode on an established session (no respawn) and lastModes cross-derives from config_option_update', async () => {
+    useMockAgent();
+    const caps: Array<[unknown, unknown]> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onCaps: (modes, configOptions) => caps.push([modes, configOptions]),
+    });
+    try {
+      await bridge.warmUp('c1');
+      await until(() => (caps.length ? true : undefined));
+      const procBefore = bridge.connected;
+
+      await bridge.setMode('c1', 'plan');
+      await until(() => {
+        const last = caps[caps.length - 1];
+        const modes = last?.[0] as { currentModeId: string } | null;
+        return modes?.currentModeId === 'plan' ? true : undefined;
+      });
+
+      expect(bridge.connected).toBe(procBefore); // never tore down / respawned
+      expect(bridge.modes?.currentModeId).toBe('plan');
+      const modeOpt = bridge.configOptions.find((o) => o.id === 'mode') as
+        | { currentValue?: unknown }
+        | undefined;
+      expect(modeOpt?.currentValue).toBe('plan');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('setConfigOption live-changes the model and the FULL refreshed option set echoes back through onCaps', async () => {
+    useMockAgent();
+    const caps: Array<[unknown, unknown]> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onCaps: (modes, configOptions) => caps.push([modes, configOptions]),
+    });
+    try {
+      await bridge.warmUp('c1');
+      await until(() => (caps.length ? true : undefined));
+      expect(bridge.configOptions.some((o) => o.id === 'fast')).toBe(false);
+
+      await bridge.setConfigOption('c1', 'model', 'opus');
+      await until(() => (bridge.configOptions.some((o) => o.id === 'fast') ? true : undefined));
+
+      const modelOpt = bridge.configOptions.find((o) => o.id === 'model') as
+        | { currentValue?: unknown }
+        | undefined;
+      expect(modelOpt?.currentValue).toBe('opus');
+      // Switching to opus offers a NEW "fast" option in this fixture — proves
+      // the bridge feeds back the full refreshed set, not just the changed field.
+      expect(bridge.configOptions.some((o) => o.id === 'fast')).toBe(true);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('setConfig persists a pick applied ONCE on a fresh session — never forced onto an already-live one', async () => {
+    useMockAgent();
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      bridge.setConfig('opus', 'high', 'plan');
+      await bridge.warmUp('c1');
+      await until(() => (bridge.configOptions.length ? true : undefined));
+
+      const modelOpt = bridge.configOptions.find((o) => o.id === 'model') as
+        | { currentValue?: unknown }
+        | undefined;
+      const effortOpt = bridge.configOptions.find((o) => o.id === 'effort') as
+        | { currentValue?: unknown }
+        | undefined;
+      expect(modelOpt?.currentValue).toBe('opus');
+      expect(effortOpt?.currentValue).toBe('high');
+      expect(bridge.modes?.currentModeId).toBe('plan');
+
+      // A DIFFERENT persisted pick set later must NOT retroactively change this
+      // already-established chat — it only affects the NEXT fresh session.
+      bridge.setConfig('sonnet', 'default', 'default');
+      await bridge.prompt('hi', 'c1');
+      const modelAfter = bridge.configOptions.find((o) => o.id === 'model') as
+        | { currentValue?: unknown }
+        | undefined;
+      expect(modelAfter?.currentValue).toBe('opus'); // unchanged — no forced respawn
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('an unsupported persisted pick is skipped, not thrown — the session keeps its own default', async () => {
+    useMockAgent();
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      bridge.setConfig('does-not-exist-model', null, 'does-not-exist-mode');
+      await bridge.warmUp('c1'); // must not throw
+      await until(() => (bridge.configOptions.length ? true : undefined));
+      const modelOpt = bridge.configOptions.find((o) => o.id === 'model') as
+        | { currentValue?: unknown }
+        | undefined;
+      expect(modelOpt?.currentValue).toBe('sonnet'); // session's own default, untouched
+      expect(bridge.modes?.currentModeId).toBe('default');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
+describe('Acp manager — set-mode/set-config frames validate against last-advertised caps (DDR-125 F1)', () => {
+  test('a caps frame is broadcast on establish; set-mode/set-config apply live; unadvertised values are rejected silently', async () => {
+    useMockAgent();
+    const designRoot = await mkdtemp(join(tmpdir(), 'acp-caps-test-'));
+    const ctx = { paths: { repoRoot: process.cwd(), designRoot } } as unknown as Context;
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('caps-ws-a');
+    try {
+      acp.onOpen(a.ws);
+      acp.onMessage(a.ws, JSON.stringify({ t: 'warm', chat: 'c1' }));
+      const capsFrame = await until(() => a.frames.find((f) => f.t === 'caps'));
+      expect((capsFrame.modes as { currentModeId: string }).currentModeId).toBe('default');
+
+      // Valid live mode change — advertised by the caps frame above.
+      acp.onMessage(a.ws, JSON.stringify({ t: 'set-mode', chat: 'c1', modeId: 'plan' }));
+      await until(() =>
+        a.frames.find(
+          (f) =>
+            f.t === 'caps' &&
+            (f.modes as { currentModeId?: string } | null)?.currentModeId === 'plan'
+        )
+      );
+
+      // An unadvertised modeId must be rejected BEFORE ever reaching the bridge
+      // — no new caps frame, no error frame, no crash.
+      const framesBefore = a.frames.length;
+      acp.onMessage(
+        a.ws,
+        JSON.stringify({ t: 'set-mode', chat: 'c1', modeId: 'bypassPermissions' })
+      );
+      await new Promise((r) => setTimeout(r, 150));
+      expect(a.frames.length).toBe(framesBefore); // nothing new sent
+
+      // An unadvertised config value is likewise rejected pre-call.
+      acp.onMessage(
+        a.ws,
+        JSON.stringify({ t: 'set-config', chat: 'c1', configId: 'model', value: 'gpt-5' })
+      );
+      await new Promise((r) => setTimeout(r, 150));
+      expect(a.frames.length).toBe(framesBefore);
+
+      // A valid config change still works after the rejected attempts.
+      acp.onMessage(
+        a.ws,
+        JSON.stringify({ t: 'set-config', chat: 'c1', configId: 'model', value: 'opus' })
+      );
+      await until(() =>
+        a.frames.find(
+          (f) =>
+            f.t === 'caps' &&
+            (f.configOptions as Array<{ id: string; currentValue?: unknown }>).find(
+              (o) => o.id === 'model'
+            )?.currentValue === 'opus'
+        )
+      );
+    } finally {
+      acp.onClose(a.ws);
+      await new Promise((r) => setTimeout(r, 50));
+      await rm(designRoot, { recursive: true, force: true });
+    }
+  }, 20000);
+});