@1agh/maude 0.45.0 → 0.45.2

package/apps/studio/test/fixtures/mock-acp-agent-elicit-url.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env bun
+// Mock ACP agent that sends a `mode:'url'` elicitation request — proves
+// AcpBridge.unstable_createElicitation rejects it structurally (declines
+// without ever calling onElicitationRequest) even though the adapter/agent
+// side ignored the client's declared `elicitation:{form:{}}`-only capability
+// (ethical-hacker finding — capability negotiation is advisory, not
+// enforced; the client must reject what it never advertised, not just hope
+// the other side honors it).
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-elicit-url' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-elicit-url-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    const response = await ctx.client.request(acp.methods.client.elicitation.create, {
+      mode: 'url',
+      sessionId: ctx.params.sessionId,
+      message: 'Confirm you have completed verification',
+      url: 'https://example.com/verify',
+      elicitationId: 'elicit-url-1',
+    });
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: `response=${JSON.stringify(response)}` },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-elicit.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env bun
+// Mock ACP agent exercising the elicitation-form gate (feature-acp-ask-user-
+// question) — session/prompt calls back INTO the client via a REAL
+// `elicitation/create` request, shaped exactly like
+// `askUserQuestionsToCreateRequest`'s single-question output (confirmed on
+// disk against the installed `@agentclientprotocol/claude-agent-acp` — a
+// titled `oneOf` enum plus its sibling `_custom` free-text field), before
+// streaming its final reply. Mirrors mock-acp-agent-permission.mjs's shape.
+// No real `claude` needed.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-elicit' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-elicit-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    // `ctx.client` (AgentContext) only exposes the generic request()/notify() —
+    // no typed convenience method — so call the raw ACP method via
+    // `acp.methods.client.elicitation.create` (confirmed on disk: acp.js's
+    // `methods.client.elicitation.create === schema.CLIENT_METHODS.elicitation_create`).
+    const response = await ctx.client.request(acp.methods.client.elicitation.create, {
+      mode: 'form',
+      sessionId: ctx.params.sessionId,
+      toolCallId: 'tc-elicit-1',
+      message: 'Which color do you like?',
+      requestedSchema: {
+        type: 'object',
+        properties: {
+          question_0: {
+            type: 'string',
+            oneOf: [
+              { const: 'Red', title: 'Red' },
+              { const: 'Blue', title: 'Blue' },
+            ],
+          },
+          question_0_custom: {
+            type: 'string',
+            title: 'Other',
+            description: 'Type your own answer instead of choosing an option above (optional).',
+          },
+        },
+      },
+    });
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: `response=${JSON.stringify(response)}` },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-permission-flood.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env bun
+// Mock ACP agent proving the MAX_PENDING_PERMISSIONS cap (SECURITY /
+// ethical-hacker finding, retroactive review of Milestone B — a single agent
+// turn can legitimately issue several tool calls back to back, so "one per
+// tool call" is not a natural rate limit). Fires MORE than the cap
+// concurrently, without waiting for each one, and reports which ones actually
+// round-tripped to the client vs. were denied immediately by the bridge's
+// own cap.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+const FLOOD_COUNT = 13; // > MAX_PENDING_PERMISSIONS (10) in acp/bridge.ts
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-permission-flood' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-perm-flood-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    const requests = Array.from({ length: FLOOD_COUNT }, (_, i) =>
+      ctx.client.request(acp.methods.client.session.requestPermission, {
+        sessionId: ctx.params.sessionId,
+        toolCall: { toolCallId: `tc${i}`, title: `Flood tool call ${i}`, kind: 'edit' },
+        options: [
+          { optionId: 'allow-once', name: 'Allow once', kind: 'allow_once' },
+          { optionId: 'reject-once', name: 'Reject', kind: 'reject_once' },
+        ],
+      })
+    );
+    const outcomes = await Promise.all(requests);
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: {
+          type: 'text',
+          text: `outcomes=${JSON.stringify(outcomes.map((o) => o.outcome))}`,
+        },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-permission.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env bun
+// Mock ACP agent exercising the permission approve/deny gate (Milestone B,
+// retires DDR-125 F2) — session/prompt calls back INTO the client via
+// `ctx.client.requestPermission(...)` (a real request, not a notification)
+// before streaming its final reply, mirroring how claude-agent-acp asks for
+// tool authorization mid-turn. No real `claude` needed.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-permission' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-perm-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    // `ctx.client` (AgentContext) only exposes the generic request()/notify() —
+    // no typed `.requestPermission()` convenience method — so call the raw ACP
+    // method via `acp.methods.client.session.requestPermission`.
+    const outcome = await ctx.client.request(acp.methods.client.session.requestPermission, {
+      sessionId: ctx.params.sessionId,
+      toolCall: {
+        toolCallId: 'tc1',
+        title: 'Write file',
+        kind: 'edit',
+        rawInput: { path: '/tmp/x' },
+      },
+      options: [
+        { optionId: 'allow-once', name: 'Allow once', kind: 'allow_once' },
+        { optionId: 'allow-always', name: 'Allow always', kind: 'allow_always' },
+        { optionId: 'reject-once', name: 'Reject', kind: 'reject_once' },
+      ],
+    });
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: `outcome=${JSON.stringify(outcome.outcome)}` },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-usage.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env bun
+// Mock ACP agent emitting `usage_update` notifications (Milestone D) — one
+// after the prompt result (context/cost), and one carrying the thin
+// `_meta["_claude/rateLimit"]` rate-limit signal (mirrors the real adapter's
+// `rate_limit_event` forwarding, acp-agent.js:1768-1776). No real `claude` needed.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-usage' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-usage-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text: 'ok' } },
+    });
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'usage_update',
+        used: 4200,
+        size: 200000,
+        cost: { amount: 0.0123, currency: 'USD' },
+      },
+    });
+    if (ctx.params.prompt?.[0]?.text === 'trigger-rate-limit') {
+      await ctx.client.notify('session/update', {
+        sessionId: ctx.params.sessionId,
+        update: {
+          sessionUpdate: 'usage_update',
+          used: 4200,
+          size: 200000,
+          _meta: {
+            '_claude/rateLimit': {
+              status: 'allowed_warning',
+              rateLimitType: 'five_hour',
+              utilization: 82,
+              resetsAt: 1234567890,
+            },
+          },
+        },
+      });
+    }
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/import-asset.test.ts

@@ -42,16 +42,44 @@ describe('svgPreParseReject', () => {
     expect(() => svgPreParseReject(huge)).toThrow(/cap/);
   });
 
-  test('rejects DOCTYPE (XXE class)', () => {
+  test('rejects a DOCTYPE with an internal subset carrying an ENTITY (XXE class)', () => {
     const xxe =
       '<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY x "y">]><svg xmlns="http://www.w3.org/2000/svg"/>';
-    expect(() => svgPreParseReject(xxe)).toThrow(/DOCTYPE/);
+    expect(() => svgPreParseReject(xxe)).toThrow(/entity-expansion/i);
   });
 
   test('rejects a bare ENTITY declaration even without DOCTYPE wrapping', () => {
     expect(() =>
       svgPreParseReject('<!ENTITY x "y"><svg xmlns="http://www.w3.org/2000/svg"/>')
-    ).toThrow(/DOCTYPE\/ENTITY/);
+    ).toThrow(/ENTITY/);
+  });
+
+  test('rejects an internal DTD subset even with no ENTITY declared', () => {
+    expect(() =>
+      svgPreParseReject('<!DOCTYPE svg [ <!-- x --> ]><svg xmlns="http://www.w3.org/2000/svg"/>')
+    ).toThrow(/internal subset/i);
+  });
+
+  // ethical-hacker review: a `>` inside a quoted external-id literal must NOT let
+  // an internal subset slip past the detector (a naive non-greedy regex truncated
+  // there and missed the `[`).
+  test('rejects an internal subset hidden behind a `>` in a quoted SYSTEM literal', () => {
+    expect(() =>
+      svgPreParseReject(
+        '<!DOCTYPE svg SYSTEM "http://attacker/x>y" [ <!ELEMENT foo ANY> ]><svg xmlns="http://www.w3.org/2000/svg"/>'
+      )
+    ).toThrow(/internal subset/i);
+  });
+
+  // RCA G8 — a plain external-identifier DOCTYPE (no internal subset, no ENTITY)
+  // is what Illustrator/Serif/Inkscape emit; rejecting the whole class turned away
+  // real clean logos. It must be accepted (the sanitizer drops it from the output).
+  test('accepts a plain external-identifier DOCTYPE (Illustrator/Serif export)', () => {
+    const illustrator =
+      '<?xml version="1.0" encoding="UTF-8"?>\n' +
+      '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">\n' +
+      '<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="10" height="10" fill="#3B5BDB"/></svg>';
+    expect(() => svgPreParseReject(illustrator)).not.toThrow();
   });
 
   test('rejects a non-declaration processing instruction (xml-stylesheet)', () => {

package/apps/studio/whats-new.json

@@ -1,6 +1,40 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "acp-ask-user-question",
+      "version": "0.45.2",
+      "date": "2026-07-15",
+      "kind": "feature",
+      "title": "Claude can ask you real questions in chat",
+      "summary": "When Claude needs a decision from you mid-task, it can now ask directly — a multi-choice or free-text form appears right in the chat panel, the same AskUserQuestion picker you'd see in the Claude Code CLI, instead of falling back to plain text.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-testid=\"chat-elicit-prompt\"]",
+          "title": "Claude asking you something",
+          "body": "Pick an option, type your own answer, or Skip — Cancel aborts whatever Claude was about to do with your answer.",
+          "placement": "top"
+        }
+      ]
+    },
+    {
+      "id": "acp-live-capabilities",
+      "version": "0.45.2",
+      "date": "2026-07-15",
+      "kind": "feature",
+      "title": "Model, mode & permission controls in chat",
+      "summary": "Switch models, effort, and permission mode right from the chat panel — pulled live from your own Claude Code install, never a fixed list. Pick Manual to approve each tool action yourself, or Bypass for hands-off editing; plus grouped tool calls, message Copy/Retry, and a context-usage meter.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-testid=\"chat-mode-picker\"]",
+          "title": "Live from your Claude Code",
+          "body": "Model, effort, and permission mode are pulled straight from your own Claude Code install — pick Manual to approve each action, or Bypass for hands-off editing.",
+          "placement": "top"
+        }
+      ]
+    },
     {
       "id": "bring-your-brand",
       "version": "0.44.0",

package/cli/commands/design.mjs

@@ -1,11 +1,21 @@
 import { execSync, spawn, spawnSync } from 'node:child_process';
-import { chmodSync, existsSync, readFileSync } from 'node:fs';
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
+import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
 import { runAdopt, runLink, runStatus, runUnlink } from '../lib/design-link.mjs';
 import { writeGitignoreBlock } from '../lib/gitignore-block.mjs';
+import { isCompiledBinary } from '../lib/pkg-root.mjs';
 
 const SUBCOMMANDS = new Set([
   'serve',
@@ -133,6 +143,89 @@ export async function run({ args, pkgRoot }) {
 // pass straight through — preserves `$(maude design slug …)` capture,
 // `eval "$(maude design prep --shell-export …)"`, and non-zero gating idioms.
 // maude writes nothing of its own on this path (no banner on stdout).
+/** True if a `bun` executable is reachable on the given PATH string (POSIX). */
+function bunOnPath(pathStr) {
+  for (const dir of (pathStr || '').split(':')) {
+    if (dir && existsSync(join(dir, 'bun'))) return true;
+  }
+  return false;
+}
+
+/** A bun-capable compiled binary to borrow as `bun` (RCA G3), or null.
+ *  Prefer the dev-server binary the sidecar hands us, else our own compiled
+ *  self (the `maude` CLI is `bun --compile`d too), else a resolvable server bin. */
+function resolveBunnable(pkgRoot) {
+  const dev = process.env.MAUDE_DEV_SERVER_BIN;
+  if (dev && existsSync(dev)) return dev;
+  if (isCompiledBinary()) return process.execPath;
+  const server = resolveServerBinary({ pkgRoot });
+  if (server && existsSync(server)) return server;
+  return null;
+}
+
+/**
+ * Ensure the design helpers' `command -v bun` / `exec bun run` resolve, even on a
+ * machine with NO standalone `bun` (RCA G3 — the desktop `.app` and the npm
+ * package ship compiled Bun BINARIES, never a `bun` CLI). The compiled binaries
+ * ARE Bun: run with `BUN_BE_BUN=1` a `bun --compile` executable behaves as the
+ * `bun` CLI. So if no real `bun` is on PATH, stage a tiny `bun` shim
+ * (→ `BUN_BE_BUN=1 <compiled-binary> "$@"`) in a per-user cache dir (0700) and
+ * PREPEND it to the child's PATH. No-op when a real `bun` is already present (dev)
+ * or no compiled binary exists to borrow (pure-source dev without bun — where a
+ * real `bun` is expected anyway). Returns the (possibly PATH-augmented) env.
+ */
+/** POSIX single-quote escape: wrap in '…' and encode embedded quotes as '\''.
+ *  Neutralizes $, backticks, ${}, and every other sh metachar — unlike
+ *  JSON.stringify, which leaves them live inside sh double-quotes. */
+function shSingleQuote(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * Provide a `bun` to a design helper that has none (RCA G3), then have the caller
+ * REMOVE it after the spawn. Returns `{ env, shimDir }` — `shimDir` is a fresh
+ * dir the caller must `rmSync` once the helper exits (null when no shim was made).
+ *
+ * Security (ethical-hacker review, DDR-177 addendum): the shim goes in a fresh,
+ * unpredictable, owner-only `mkdtemp` dir created PER SPAWN and torn down right
+ * after — NEVER a stable, guessable `~/.cache/maude/bun-shim/bun`. A stable path
+ * on a child's PATH with an unqualified `bun` lookup is the exact PATH-shadow
+ * primitive `sidecar.rs` deliberately refuses (Attacker-F4/DDR-168): an untrusted
+ * SAME-UID actor (in scope per DDR-054 — a poisoned dependency in an opened
+ * project, a prompt-injected agent's Bash tool) could pre-plant/symlink/race a
+ * stable shim and hijack the interpreter of every future helper. A per-spawn
+ * mkdtemp dir has no pre-existing entry to symlink-follow and no guessable name to
+ * race, and is gone before the next spawn. Fails CLOSED with no HOME (never plants
+ * an executable in world-writable /tmp).
+ */
+function ensureBunOnPath(childEnv, pkgRoot) {
+  if (bunOnPath(childEnv.PATH)) return { env: childEnv, shimDir: null };
+  const bunnable = resolveBunnable(pkgRoot);
+  if (!bunnable) return { env: childEnv, shimDir: null }; // helper's own guard reports the miss
+  const home = homedir();
+  if (!home) return { env: childEnv, shimDir: null }; // fail closed — no /tmp fallback for an executable
+  try {
+    const cacheParent = join(home, '.cache', 'maude');
+    mkdirSync(cacheParent, { recursive: true, mode: 0o700 });
+    // Fresh + unpredictable + 0700, one per spawn. mkdtemp guarantees a brand-new
+    // dir (fails if it exists), so there's nothing to symlink-follow on the write.
+    const shimDir = mkdtempSync(join(cacheParent, 'bun-shim-'));
+    const shim = join(shimDir, 'bun');
+    // Single-quote the binary path (NOT JSON.stringify — that leaves $/backticks
+    // live inside sh double-quotes, so a binary path with shell metacharacters
+    // would run command substitution when the shim executes).
+    writeFileSync(
+      shim,
+      `#!/bin/sh\n# maude bun shim (RCA G3) — the bundled compiled binary IS Bun;\n# BUN_BE_BUN=1 makes it act as the \`bun\` CLI so design helpers run with no\n# user-installed bun. Ephemeral: written per-spawn, removed after (design.mjs).\nBUN_BE_BUN=1 exec ${shSingleQuote(bunnable)} "$@"\n`,
+      { mode: 0o755 }
+    );
+    chmodSync(shim, 0o755);
+    return { env: { ...childEnv, PATH: `${shimDir}:${childEnv.PATH || ''}` }, shimDir };
+  } catch {
+    return { env: childEnv, shimDir: null }; // best-effort; the helper reports the miss
+  }
+}
+
 function runBinDispatch(verb, { args, pkgRoot }) {
   if (!BIN_VERBS.has(verb)) {
     process.stderr.write(`maude design: "${verb}" is not a dev-tooling verb.\n${usage()}`);
@@ -164,10 +257,22 @@ function runBinDispatch(verb, { args, pkgRoot }) {
     const bin = resolveServerBinary({ pkgRoot });
     if (bin) childEnv.MAUDE_DEV_SERVER_BIN = bin;
   }
+  // RCA G3 — make `bun` resolvable to the helper from the bundled compiled binary
+  // when no standalone `bun` is installed (desktop / npm). No-op in dev. The shim
+  // dir is ephemeral (per-spawn mkdtemp) — remove it as soon as the helper exits,
+  // so nothing bun-named lingers on a guessable path (ethical-hacker review).
+  const { env: finalEnv, shimDir } = ensureBunOnPath(childEnv, pkgRoot);
   const child = spawnSync('bash', [script, ...rest], {
     stdio: 'inherit',
-    env: childEnv,
+    env: finalEnv,
   });
+  if (shimDir) {
+    try {
+      rmSync(shimDir, { recursive: true, force: true });
+    } catch {
+      /* best-effort cleanup */
+    }
+  }
   if (child.error) {
     process.stderr.write(`maude design ${verb}: ${child.error.message}\n`);
     process.exit(1);

package/cli/lib/pkg-root.mjs

@@ -59,14 +59,41 @@ export function isPkgRoot(dir) {
 
 /**
  * Resolve maude's own package root — real disk path, safe inside a compiled
- * binary. Priority: (0) explicit override, (1) dev-mode `import.meta.url`
- * (plain `node`/`bun run cli/bin/maude.mjs`), (2) compiled-binary walk-up
- * from `process.execPath` (matches the npm-install layout: binary at
- * `@1agh/maude-<platform>/maude` walks up to `@1agh/maude/`, which ships
- * `apps/studio/` via `package.json` `files`; matches the Tauri desktop layout
- * too, where the bundled `maude` binary and the `Resources/apps/studio`
- * bundle share a common ancestor within the walk-up depth).
+ * binary. Priority: (0) explicit `MAUDE_PKG_ROOT` override (sidecar.rs sets this
+ * on the desktop), (1) dev-mode `import.meta.url` (plain `node`/`bun run
+ * cli/bin/maude.mjs`), (2) compiled-binary walk-up from `process.execPath`
+ * (matches the npm-install layout: binary at `@1agh/maude-<platform>/maude`
+ * walks up to `@1agh/maude/`, which ships `apps/studio/` via `package.json`
+ * `files`), (3) the Tauri **`.app` sibling probe** below.
+ *
+ * Why (3) exists: in a packaged `Maude.app` the bundled `maude` binary lives in
+ * `Contents/MacOS/` but the staged package tree (`apps/studio/`, `cli/`,
+ * `package.json`) lives in the SIBLING `Contents/Resources/` — NOT an ancestor
+ * of the binary, so the walk-up in (2) never reaches it and used to fall through
+ * to `dirname(execPath)` = `Contents/MacOS/`, breaking every `maude design
+ * <verb>` with "helper not found" (RCA issue-acp-panel-hangs-on-nodeless-machine
+ * G2, reproduced on the shipped v0.45.1 `.app`). The earlier claim that the
+ * binary + `Resources/apps/studio` "share a common ancestor within the walk-up
+ * depth" was WRONG — `Contents/` is the common ancestor but `apps/studio` sits
+ * under `Contents/Resources/`, not `Contents/`, and `cli/` isn't in the ancestry
+ * at all. We probe the known Tauri resource-dir siblings explicitly instead.
  */
+/**
+ * Probe the Tauri packaged-app resource dir relative to the binary's own dir.
+ * From `<app>/Contents/MacOS/maude`, the staged package tree is at the SIBLING
+ * `<app>/Contents/Resources`. Covers macOS (`Resources`), the lower-cased
+ * resource dir other Tauri targets use, and a binary co-located with a
+ * `resources/` dir (dev staging). Returns the first valid pkgRoot, or null.
+ * Exported so the RCA-G2 fix is unit-testable without spawning a real `.app`.
+ */
+export function resolveTauriResourcePkgRoot(execDir) {
+  for (const rel of [['..', 'Resources'], ['..', 'resources'], ['resources']]) {
+    const cand = join(execDir, ...rel);
+    if (isPkgRoot(cand)) return cand;
+  }
+  return null;
+}
+
 export function resolvePkgRoot() {
   const override = process.env.MAUDE_PKG_ROOT;
   if (override && !isVirtualBunfsPath(override) && isPkgRoot(override)) return override;
@@ -84,12 +111,13 @@ export function resolvePkgRoot() {
   // from there (e.g. ~/Library/Caches/…/bin-link/) never reaches the repo
   // root. Dereference first. Falls back to the raw path if the file somehow
   // doesn't exist (shouldn't happen — we ARE that running process).
-  let cur;
+  let execDir;
   try {
-    cur = dirname(realpathSync(process.execPath));
+    execDir = dirname(realpathSync(process.execPath));
   } catch {
-    cur = dirname(process.execPath);
+    execDir = dirname(process.execPath);
   }
+  let cur = execDir;
   for (let i = 0; i < 10; i++) {
     if (isPkgRoot(cur)) return cur;
     const parent = dirname(cur);
@@ -97,6 +125,10 @@ export function resolvePkgRoot() {
     cur = parent;
   }
 
+  // (3) Tauri `.app` sibling probe — the packaged layout the walk-up can't reach.
+  const sibling = resolveTauriResourcePkgRoot(execDir);
+  if (sibling) return sibling;
+
   // Final fallback for unanchored test contexts — callers should expect
   // existsSync-based lookups to fail and surface a clear error, same
   // contract as paths.ts's own resolver. Never join a VIRTUAL importDir here

package/cli/lib/pkg-root.test.mjs

@@ -16,7 +16,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
 
-import { isPkgRoot, resolvePkgRoot } from './pkg-root.mjs';
+import { isPkgRoot, resolvePkgRoot, resolveTauriResourcePkgRoot } from './pkg-root.mjs';
 
 function makeRealRoot(base) {
   mkdirSync(join(base, 'apps', 'studio', 'bin'), { recursive: true });
@@ -52,6 +52,38 @@ test('isPkgRoot requires BOTH anchors — the staged-resources false-positive is
   }
 });
 
+test('resolveTauriResourcePkgRoot finds the .app sibling Resources tree (RCA G2)', () => {
+  // Mirror the packaged macOS layout: binary in Contents/MacOS, staged tree in
+  // the SIBLING Contents/Resources — NOT an ancestor of the binary, which is why
+  // the plain walk-up misses it and every `maude design <verb>` broke.
+  const app = mkdtempSync(join(tmpdir(), 'maude-app-'));
+  try {
+    const macosDir = join(app, 'Contents', 'MacOS');
+    const resources = join(app, 'Contents', 'Resources');
+    mkdirSync(macosDir, { recursive: true });
+    makeRealRoot(resources); // stages apps/studio/bin/screenshot.sh + cli/commands/design.mjs
+
+    // From the binary's own dir, the sibling probe must find Resources.
+    assert.equal(resolveTauriResourcePkgRoot(macosDir), resources);
+
+    // Regression guard: Resources WITHOUT cli/ (the shipped-broken v0.45.1 shape)
+    // must NOT resolve — that's exactly the false-positive isPkgRoot rejects.
+    const broken = mkdtempSync(join(tmpdir(), 'maude-app-broken-'));
+    try {
+      const bMacos = join(broken, 'Contents', 'MacOS');
+      const bRes = join(broken, 'Contents', 'Resources', 'apps', 'studio', 'bin');
+      mkdirSync(bMacos, { recursive: true });
+      mkdirSync(bRes, { recursive: true });
+      writeFileSync(join(bRes, 'screenshot.sh'), '#!/bin/sh\n'); // no cli/ staged
+      assert.equal(resolveTauriResourcePkgRoot(bMacos), null);
+    } finally {
+      rmSync(broken, { recursive: true, force: true });
+    }
+  } finally {
+    rmSync(app, { recursive: true, force: true });
+  }
+});
+
 test('resolvePkgRoot honors MAUDE_PKG_ROOT only when it actually satisfies both anchors', () => {
   const real = mkdtempSync(join(tmpdir(), 'maude-pkgroot-real-'));
   const fake = mkdtempSync(join(tmpdir(), 'maude-pkgroot-fake-'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.45.0",
+  "version": "0.45.2",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -51,13 +51,13 @@
     "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.45.0",
-    "@1agh/maude-darwin-x64": "0.45.0",
-    "@1agh/maude-linux-arm64": "0.45.0",
-    "@1agh/maude-linux-arm64-musl": "0.45.0",
-    "@1agh/maude-linux-x64": "0.45.0",
-    "@1agh/maude-linux-x64-musl": "0.45.0",
-    "@1agh/maude-win32-x64": "0.45.0"
+    "@1agh/maude-darwin-arm64": "0.45.2",
+    "@1agh/maude-darwin-x64": "0.45.2",
+    "@1agh/maude-linux-arm64": "0.45.2",
+    "@1agh/maude-linux-arm64-musl": "0.45.2",
+    "@1agh/maude-linux-x64": "0.45.2",
+    "@1agh/maude-linux-x64-musl": "0.45.2",
+    "@1agh/maude-win32-x64": "0.45.2"
   },
   "files": [
     "cli",
@@ -102,6 +102,8 @@
   },
   "dependencies": {
     "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1"
+    "ajv-formats": "^3.0.1",
+    "happy-dom": "20.10.6",
+    "svgo": "^4.0.1"
   }
 }