@1agh/maude 0.45.1 → 0.45.2

package/apps/studio/test/acp-elicitation.test.ts

@@ -0,0 +1,251 @@
+// Pure unit tests for client/panels/acp-elicitation.js — the schema parser +
+// content builder ElicitationPrompt.jsx renders from. Fixture shapes mirror
+// the EXACT wire output of `@agentclientprotocol/claude-agent-acp`'s
+// `askUserQuestionsToCreateRequest` (confirmed on disk — see the file's own
+// header comment), not a guessed/simplified schema.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  buildElicitationContent,
+  looksLikeSecretRequest,
+  parseElicitationSchema,
+} from '../client/panels/acp-elicitation.js';
+
+// A real single-question AskUserQuestion-shaped schema (single() branch of
+// askUserQuestionsToCreateRequest — message carries the question, the field
+// itself has no description).
+const SINGLE_SELECT_SCHEMA = {
+  type: 'object',
+  properties: {
+    question_0: {
+      type: 'string',
+      title: 'Which color?',
+      oneOf: [
+        { const: 'Red', title: 'Red', description: 'Warm' },
+        { const: 'Blue', title: 'Blue' },
+      ],
+    },
+    question_0_custom: {
+      type: 'string',
+      title: 'Other',
+      description: 'Type your own answer instead of choosing an option above (optional).',
+    },
+  },
+};
+
+// A real multi-question schema — index 1 is multi-select (array + items.anyOf).
+const MULTI_QUESTION_SCHEMA = {
+  type: 'object',
+  properties: {
+    question_0: {
+      type: 'string',
+      description: 'Pick one',
+      oneOf: [
+        { const: 'A', title: 'A' },
+        { const: 'B', title: 'B' },
+      ],
+    },
+    question_0_custom: { type: 'string', title: 'Other' },
+    question_1: {
+      type: 'array',
+      description: 'Pick many',
+      items: {
+        anyOf: [
+          { const: 'X', title: 'X' },
+          { const: 'Y', title: 'Y' },
+        ],
+      },
+    },
+    question_1_custom: { type: 'string', title: 'Other' },
+  },
+};
+
+describe('parseElicitationSchema', () => {
+  test('single-select (oneOf): one question, custom field paired not top-level', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    expect(qs.length).toBe(1);
+    expect(qs[0]).toMatchObject({
+      id: 'question_0',
+      kind: 'single',
+      customFieldId: 'question_0_custom',
+      required: false,
+    });
+    expect(qs[0].options).toEqual([
+      { value: 'Red', label: 'Red', description: 'Warm', preview: null },
+      { value: 'Blue', label: 'Blue', description: null, preview: null },
+    ]);
+  });
+
+  test('multi-select (array+items.anyOf) alongside a single-select sibling', () => {
+    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
+    expect(qs.map((q) => q.id)).toEqual(['question_0', 'question_1']);
+    expect(qs[0].kind).toBe('single');
+    expect(qs[1].kind).toBe('multi');
+    expect(qs[1].options).toEqual([
+      { value: 'X', label: 'X', description: null, preview: null },
+      { value: 'Y', label: 'Y', description: null, preview: null },
+    ]);
+    expect(qs[1].customFieldId).toBe('question_1_custom');
+  });
+
+  test('a bare enum (untitled strings) renders with value===label', () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: { color: { type: 'string', enum: ['red', 'blue'] } },
+    });
+    expect(qs[0].options).toEqual([
+      { value: 'red', label: 'red', description: null, preview: null },
+      { value: 'blue', label: 'blue', description: null, preview: null },
+    ]);
+  });
+
+  test('an enum option carrying the AskUserQuestion preview _meta convention surfaces it as `preview`', () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: {
+        question_0: {
+          type: 'string',
+          oneOf: [
+            {
+              const: 'Option A',
+              title: 'Option A',
+              _meta: { '_claude/askUserQuestionOption': { preview: 'const x = 1' } },
+            },
+            { const: 'Option B', title: 'Option B' },
+          ],
+        },
+      },
+    });
+    expect(qs[0].options[0].preview).toBe('const x = 1');
+    expect(qs[0].options[1].preview).toBeNull();
+  });
+
+  test('a plain string/number/boolean property with no enum falls back to a text question', () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: { note: { type: 'string', title: 'Note' }, age: { type: 'number' } },
+    });
+    expect(qs.map((q) => q.kind)).toEqual(['text', 'text']);
+  });
+
+  test('schema.required marks a question required', () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: { note: { type: 'string' } },
+      required: ['note'],
+    });
+    expect(qs[0].required).toBe(true);
+  });
+
+  test('a "_custom"-suffixed field with NO base sibling renders as its own question', () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: { foo_custom: { type: 'string' } },
+    });
+    expect(qs.map((q) => q.id)).toEqual(['foo_custom']);
+  });
+
+  test('malformed/missing schema tolerance — never throws, returns []', () => {
+    expect(parseElicitationSchema(null)).toEqual([]);
+    expect(parseElicitationSchema(undefined)).toEqual([]);
+    expect(parseElicitationSchema({})).toEqual([]);
+    expect(parseElicitationSchema({ properties: null })).toEqual([]);
+    expect(parseElicitationSchema({ properties: 'not-an-object' })).toEqual([]);
+  });
+});
+
+describe('buildElicitationContent', () => {
+  test('a selected single-select option folds into content[id]', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    const content = buildElicitationContent(qs, { question_0: 'Red' });
+    expect(content).toEqual({ question_0: 'Red' });
+  });
+
+  test('a non-empty custom answer overrides the selection (matches applyAskElicitationResponse read order)', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    const content = buildElicitationContent(qs, {
+      question_0: 'Red',
+      question_0_custom: '  Something else  ',
+    });
+    expect(content).toEqual({ question_0_custom: 'Something else' });
+  });
+
+  test('a blank/whitespace-only custom answer does NOT override the selection', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    const content = buildElicitationContent(qs, { question_0: 'Blue', question_0_custom: '   ' });
+    expect(content).toEqual({ question_0: 'Blue' });
+  });
+
+  test('multi-select folds a non-empty array; an empty selection is omitted', () => {
+    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
+    const content = buildElicitationContent(qs, { question_1: ['X', 'Y'] });
+    expect(content).toEqual({ question_1: ['X', 'Y'] });
+  });
+
+  test('multi-select: a custom answer is ADDED to the picks (via the base field), not routed through customFieldId', () => {
+    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
+    const content = buildElicitationContent(qs, {
+      question_1: ['X', 'Y'],
+      question_1_custom: '  Z  ',
+    });
+    // Combined into the BASE field's array — applyAskElicitationResponse only
+    // overrides when content[customFieldId] itself is non-empty, so leaving
+    // that key absent and appending to content[question_1] instead means the
+    // adapter's own join() sees the pick AND the custom text.
+    expect(content).toEqual({ question_1: ['X', 'Y', 'Z'] });
+    expect(content.question_1_custom).toBeUndefined();
+  });
+
+  test('multi-select: a custom answer with NO picks still sends as a single-entry array', () => {
+    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
+    const content = buildElicitationContent(qs, { question_1_custom: 'Just this' });
+    expect(content).toEqual({ question_1: ['Just this'] });
+  });
+
+  test('an unanswered, non-required question is omitted entirely — never fabricates a value', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    expect(buildElicitationContent(qs, {})).toEqual({});
+    expect(buildElicitationContent([], { anything: 'x' })).toEqual({});
+  });
+
+  test('tolerates a missing/malformed answers object', () => {
+    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
+    expect(buildElicitationContent(qs, null)).toEqual({});
+    expect(buildElicitationContent(qs, undefined)).toEqual({});
+  });
+});
+
+describe('looksLikeSecretRequest', () => {
+  test('matches common credential-shaped phrasing, case-insensitively', () => {
+    expect(looksLikeSecretRequest('Enter your API key')).toBe(true);
+    expect(looksLikeSecretRequest('what is your PASSWORD')).toBe(true);
+    expect(looksLikeSecretRequest('Paste your auth token here')).toBe(true);
+    expect(looksLikeSecretRequest('Provide your OAuth token')).toBe(true);
+  });
+
+  test('checks all provided texts, not just the first', () => {
+    expect(looksLikeSecretRequest('Which color do you like?', 'a secret preference')).toBe(true);
+    expect(looksLikeSecretRequest(null, 'Enter your secret key', undefined)).toBe(true);
+  });
+
+  test('an ordinary question does not trip the heuristic', () => {
+    expect(looksLikeSecretRequest('Which color do you like?')).toBe(false);
+    expect(looksLikeSecretRequest('What layout do you prefer?')).toBe(false);
+  });
+
+  test('tolerates no/malformed input', () => {
+    expect(looksLikeSecretRequest()).toBe(false);
+    expect(looksLikeSecretRequest(null, undefined, 42)).toBe(false);
+  });
+
+  test("parseElicitationSchema tags each question's own secretShaped flag from its title/description", () => {
+    const qs = parseElicitationSchema({
+      type: 'object',
+      properties: {
+        question_0: { type: 'string', description: 'Enter your password to continue' },
+      },
+    });
+    expect(qs[0].secretShaped).toBe(true);
+  });
+});

package/apps/studio/test/acp-permission-prompt.test.ts

@@ -0,0 +1,77 @@
+// SECURITY (ethical-hacker finding, retroactive review of Milestone B) —
+// pure unit tests for PermissionPrompt.jsx's default-option selection. The
+// bridge-side backend logic (resolvePermission's optionId validation) was
+// already correct and covered by test/acp-permission.test.ts; the bug this
+// covers lived entirely in the CLIENT affordance — which option Enter/the
+// visually-primary button resolves to — a seam no backend test could see.
+
+import { describe, expect, test } from 'bun:test';
+
+import { pickDefaultAllow, pickDefaultReject } from '../client/panels/PermissionPrompt.jsx';
+
+describe('pickDefaultAllow', () => {
+  test('prefers allow_once over allow_always, regardless of array order', () => {
+    // Matches the REAL adapter's own ordering for a routine tool call —
+    // allow_always listed BEFORE allow_once — the exact shape that made the
+    // original `.find()` grab the wrong one.
+    const options = [
+      { optionId: 'allow-always', kind: 'allow_always', name: 'Allow always' },
+      { optionId: 'allow-once', kind: 'allow_once', name: 'Allow once' },
+      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
+    ];
+    expect(pickDefaultAllow(options)?.optionId).toBe('allow-once');
+  });
+
+  test('ExitPlanMode-shaped option set: prefers the once-only "manually approve edits" over auto/acceptEdits', () => {
+    // Mirrors the REAL adapter's ExitPlanMode option ordering exactly (see
+    // DDR-179 + the ethical-hacker finding): auto/acceptEdits (both
+    // allow_always) listed BEFORE the once-only "default" option.
+    const options = [
+      { optionId: 'auto', kind: 'allow_always', name: 'Yes, and use auto mode' },
+      { optionId: 'acceptEdits', kind: 'allow_always', name: 'Yes, and auto-accept edits' },
+      { optionId: 'default', kind: 'allow_once', name: 'Yes, manually approve edits' },
+      { optionId: 'plan', kind: 'reject_once', name: 'No, keep planning' },
+    ];
+    expect(pickDefaultAllow(options)?.optionId).toBe('default');
+  });
+
+  test('falls back to allow_always only when no once-only option exists', () => {
+    const options = [
+      { optionId: 'allow-always', kind: 'allow_always', name: 'Allow always' },
+      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
+    ];
+    expect(pickDefaultAllow(options)?.optionId).toBe('allow-always');
+  });
+
+  test('no allow-shaped option at all → null, not a reject option', () => {
+    const options = [{ optionId: 'reject-once', kind: 'reject_once', name: 'Reject' }];
+    expect(pickDefaultAllow(options)).toBeNull();
+  });
+
+  test('tolerates missing/malformed input — never throws', () => {
+    expect(pickDefaultAllow(undefined)).toBeNull();
+    expect(pickDefaultAllow(null)).toBeNull();
+    expect(
+      pickDefaultAllow([null, undefined, { kind: 'allow_once', optionId: 'x' }])?.optionId
+    ).toBe('x');
+  });
+});
+
+describe('pickDefaultReject', () => {
+  test('finds a reject_once/reject_always option regardless of position', () => {
+    const options = [
+      { optionId: 'allow-once', kind: 'allow_once', name: 'Allow once' },
+      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
+    ];
+    expect(pickDefaultReject(options)?.optionId).toBe('reject-once');
+  });
+
+  test('no reject-shaped option → null', () => {
+    expect(pickDefaultReject([{ optionId: 'allow-once', kind: 'allow_once' }])).toBeNull();
+  });
+
+  test('tolerates missing/malformed input — never throws', () => {
+    expect(pickDefaultReject(undefined)).toBeNull();
+    expect(pickDefaultReject(null)).toBeNull();
+  });
+});

package/apps/studio/test/acp-permission.test.ts

@@ -0,0 +1,262 @@
+// Proves the permission approve/deny gate end-to-end (Milestone B, retires
+// DDR-125 F2's blanket auto-approve) against a mock ACP agent that calls back
+// into the client via a REAL `session/request_permission` request (fixtures/
+// mock-acp-agent-permission.mjs) — no real `claude` needed. Covers:
+//   • requestPermission is forwarded via onPermissionRequest (+ onPermission
+//     transparency) and stays pending until resolvePermission is called.
+//   • A valid decision (an offered optionId, or 'cancelled') resolves it.
+//   • An UNOFFERED decision fails closed to 'cancelled' (DDR-125 F1 posture).
+//   • Timeout defaults to 'cancelled' (deny), never allow.
+//   • A turn-cancel denies every pending request instead of leaving it hung.
+//   • The Acp manager relays permission-request/-response frames end to end.
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { join } from 'node:path';
+
+import type { ServerWebSocket } from 'bun';
+
+import { AcpBridge, MAX_PENDING_PERMISSIONS } from '../acp/bridge.ts';
+import { createAcp } from '../acp/index.ts';
+import type { Context } from '../context.ts';
+import type { WsData } from '../ws.ts';
+
+const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission.mjs');
+const FIXTURE_FLOOD = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission-flood.mjs');
+const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
+
+function useMockAgent(fixture = FIXTURE) {
+  process.env.MAUDE_ACP_ADAPTER_ENTRY = fixture;
+  process.env.MAUDE_ACP_RUNTIME = process.execPath;
+  process.env.MAUDE_CLAUDE_BIN = process.execPath;
+}
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+});
+
+async function until<T>(fn: () => T | undefined, timeoutMs = 12000): Promise<T> {
+  const start = performance.now();
+  for (;;) {
+    const v = fn();
+    if (v !== undefined) return v;
+    if (performance.now() - start > timeoutMs) throw new Error('timeout waiting for condition');
+    await new Promise((r) => setTimeout(r, 25));
+  }
+}
+
+function fakeWs(id: string) {
+  const frames: Array<Record<string, unknown>> = [];
+  const ws = {
+    data: { id } as WsData,
+    send: (raw: string) => {
+      frames.push(JSON.parse(raw));
+    },
+  } as unknown as ServerWebSocket<WsData>;
+  return { ws, frames };
+}
+
+describe('AcpBridge — permission approve/deny (Task B1)', () => {
+  test('a request is forwarded via onPermissionRequest + onPermission, stays pending, and a valid decision resolves the turn', async () => {
+    useMockAgent();
+    const requests: Array<{ id: string; toolCallTitle?: string; optionIds: string[] }> = [];
+    const transparency: unknown[] = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onPermission: (req) => transparency.push(req),
+      onPermissionRequest: (id, req) =>
+        requests.push({
+          id,
+          toolCallTitle: req.toolCall?.title,
+          optionIds: req.options.map((o) => o.optionId),
+        }),
+    });
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      const req = await until(() => (requests.length ? requests[0] : undefined));
+      expect(req.toolCallTitle).toBe('Write file');
+      expect(req.optionIds).toEqual(['allow-once', 'allow-always', 'reject-once']);
+      expect(transparency.length).toBe(1); // transparency fires unconditionally too
+
+      bridge.resolvePermission(req.id, 'allow-once');
+      await promptPromise;
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('an unoffered decision fails closed to cancelled — never forwards an arbitrary optionId', async () => {
+    useMockAgent();
+    const updates: unknown[] = [];
+    const requests: Array<{ id: string }> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: (u) => updates.push(u),
+      onPermissionRequest: (id) => requests.push({ id }),
+    });
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      const req = await until(() => (requests.length ? requests[0] : undefined));
+      // Not one of ['allow-once','allow-always','reject-once'] — must deny, not select.
+      bridge.resolvePermission(req.id, 'some-optionId-never-offered');
+      await promptPromise;
+      const text = updates.map((u) => u?.content?.text ?? '').join('');
+      expect(text).toContain('"outcome":"cancelled"');
+      expect(text).not.toContain('some-optionId-never-offered');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('resolvePermission("cancelled") denies explicitly', async () => {
+    useMockAgent();
+    const updates: unknown[] = [];
+    const requests: Array<{ id: string }> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: (u) => updates.push(u),
+      onPermissionRequest: (id) => requests.push({ id }),
+    });
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      const req = await until(() => (requests.length ? requests[0] : undefined));
+      bridge.resolvePermission(req.id, 'cancelled');
+      await promptPromise;
+      const text = updates.map((u) => u?.content?.text ?? '').join('');
+      expect(text).toContain('"outcome":"cancelled"');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('a stale/unknown id is a silent no-op — never throws', async () => {
+    useMockAgent();
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      expect(() => bridge.resolvePermission('does-not-exist', 'allow-once')).not.toThrow();
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('timeout defaults to cancelled (deny), never allow', async () => {
+    useMockAgent();
+    const updates: unknown[] = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: (u) => updates.push(u),
+      permissionTimeoutMs: 150, // short override — see AcpBridgeOptions.permissionTimeoutMs (tests only)
+    });
+    try {
+      await bridge.prompt('hi', 'c1'); // never calls resolvePermission — must resolve itself
+      const text = updates.map((u) => u?.content?.text ?? '').join('');
+      expect(text).toContain('"outcome":"cancelled"');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('a turn-cancel denies every pending permission request instead of hanging it forever', async () => {
+    useMockAgent();
+    const requests: Array<{ id: string }> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onPermissionRequest: (id) => requests.push({ id }),
+      permissionTimeoutMs: 60000, // long — proves cancel() settles it, not the timeout racing in
+    });
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      await until(() => (requests.length ? true : undefined));
+      await bridge.cancel(); // must deny the pending request, not leave it hanging
+      await promptPromise; // resolves because the mock's requestPermission() call unblocked
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
+describe('Acp manager — permission-request/-response frames (Task B2)', () => {
+  test('a permission-request frame is relayed to the client and a valid permission-response resolves it', async () => {
+    useMockAgent();
+    const ctx = {
+      paths: { repoRoot: process.cwd(), designRoot: '/tmp/does-not-matter' },
+    } as unknown as Context;
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('perm-ws-a');
+    try {
+      acp.onOpen(a.ws);
+      acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'hi', chat: 'c1' }));
+      const reqFrame = await until(() => a.frames.find((f) => f.t === 'permission-request'));
+      expect(reqFrame.toolCall).toMatchObject({ title: 'Write file' });
+      const options = reqFrame.options as Array<{ optionId: string }>;
+      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'allow-always', 'reject-once']);
+
+      acp.onMessage(
+        a.ws,
+        JSON.stringify({ t: 'permission-response', id: reqFrame.id, decision: 'allow-once' })
+      );
+      await until(() => a.frames.find((f) => f.t === 'turn-end'));
+    } finally {
+      acp.onClose(a.ws);
+      await new Promise((r) => setTimeout(r, 50));
+    }
+  }, 20000);
+
+  test('a permission-response with an unknown id is a harmless no-op — the turn still settles via timeout', async () => {
+    useMockAgent();
+    const ctx = {
+      paths: { repoRoot: process.cwd(), designRoot: '/tmp/does-not-matter-2' },
+    } as unknown as Context;
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('perm-ws-b');
+    try {
+      acp.onOpen(a.ws);
+      acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'hi', chat: 'c1' }));
+      await until(() => a.frames.find((f) => f.t === 'permission-request'));
+
+      // Bogus id — must not throw / crash the manager.
+      expect(() =>
+        acp.onMessage(
+          a.ws,
+          JSON.stringify({ t: 'permission-response', id: 'not-a-real-id', decision: 'allow-once' })
+        )
+      ).not.toThrow();
+    } finally {
+      acp.onClose(a.ws);
+      await new Promise((r) => setTimeout(r, 50));
+    }
+  }, 20000);
+});
+
+// SECURITY (ethical-hacker finding, retroactive review) — a single agent turn
+// can legitimately issue several tool calls back to back, so "one per tool
+// call" was never a real ceiling on `pendingPermissions`. Prove the cap: a
+// flood of concurrent requests only ever keeps MAX_PENDING_PERMISSIONS of
+// them live at once — the rest are denied immediately rather than queued.
+describe('AcpBridge — permission flood cap', () => {
+  test(`a burst of concurrent permission requests only forwards ${MAX_PENDING_PERMISSIONS} to the client — the rest deny immediately`, async () => {
+    useMockAgent(FIXTURE_FLOOD);
+    const requests: Array<{ id: string }> = [];
+    const bridge = new AcpBridge({
+      repoRoot: process.cwd(),
+      onUpdate: () => {},
+      onPermissionRequest: (id) => requests.push({ id }),
+    });
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      // Denying is synchronous inside requestPermission once the cap trips,
+      // so there's nothing further to await once every request has had a
+      // chance to arrive.
+      await new Promise((r) => setTimeout(r, 300));
+      expect(requests.length).toBeLessThanOrEqual(MAX_PENDING_PERMISSIONS);
+      expect(requests.length).toBeGreaterThan(0);
+      for (const req of requests) bridge.resolvePermission(req.id, 'cancelled');
+      await promptPromise;
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});

package/apps/studio/test/acp-toolgroup.test.ts

@@ -0,0 +1,76 @@
+// Pure unit tests for client/panels/ToolGroup.jsx's grouping/summary helpers
+// (Task C1 — collapsed consecutive-tool-call groups).
+
+import { describe, expect, test } from 'bun:test';
+
+import { groupToolCalls, summarizeGroup } from '../client/panels/ToolGroup.jsx';
+
+describe('groupToolCalls', () => {
+  test('a lone tool-call stays a single item, not a group', () => {
+    const parts = [{ type: 'tool-call', toolCallId: '1', toolName: 'Read file' }];
+    expect(groupToolCalls(parts)).toEqual([{ type: 'single', part: parts[0] }]);
+  });
+
+  test('2+ CONSECUTIVE tool-calls fold into one group', () => {
+    const parts = [
+      { type: 'tool-call', toolCallId: '1', toolName: 'Read file' },
+      { type: 'tool-call', toolCallId: '2', toolName: 'Run command' },
+      { type: 'tool-call', toolCallId: '3', toolName: 'Write file' },
+    ];
+    const grouped = groupToolCalls(parts);
+    expect(grouped).toEqual([{ type: 'tool-group', parts }]);
+  });
+
+  test('text/reasoning parts break a run into separate groups', () => {
+    const parts = [
+      { type: 'tool-call', toolCallId: '1', toolName: 'Read file' },
+      { type: 'tool-call', toolCallId: '2', toolName: 'Write file' },
+      { type: 'text', text: 'done reading and writing' },
+      { type: 'tool-call', toolCallId: '3', toolName: 'Run command' },
+    ];
+    const grouped = groupToolCalls(parts);
+    expect(grouped).toEqual([
+      { type: 'tool-group', parts: [parts[0], parts[1]] },
+      { type: 'single', part: parts[2] },
+      { type: 'single', part: parts[3] }, // lone tool-call after the break — not a group
+    ]);
+  });
+
+  test('a mix of text and reasoning parts each stay single, in order', () => {
+    const parts = [
+      { type: 'text', text: 'thinking about it' },
+      { type: 'reasoning', text: '...' },
+      { type: 'text', text: 'here is my answer' },
+    ];
+    expect(groupToolCalls(parts)).toEqual(parts.map((part) => ({ type: 'single', part })));
+  });
+
+  test('tolerates an empty/missing parts array', () => {
+    expect(groupToolCalls([])).toEqual([]);
+    expect(groupToolCalls(undefined)).toEqual([]);
+    expect(groupToolCalls(null)).toEqual([]);
+  });
+});
+
+describe('summarizeGroup', () => {
+  test('all entries sharing one title collapse to "Ran N × <title>"', () => {
+    const parts = [{ toolName: 'Read file' }, { toolName: 'Read file' }, { toolName: 'Read file' }];
+    expect(summarizeGroup(parts)).toBe('Ran 3 × Read file');
+  });
+
+  test('mixed titles list the distinct ones, capped at 3 with an ellipsis', () => {
+    const parts = [
+      { toolName: 'Read file' },
+      { toolName: 'Run command' },
+      { toolName: 'Web search' },
+      { toolName: 'Write file' },
+      { toolName: 'Read file' }, // duplicate — must not inflate the unique count
+    ];
+    const summary = summarizeGroup(parts);
+    expect(summary).toBe('Ran 5 tools — Read file, Run command, Web search…');
+  });
+
+  test('a missing toolName falls back to the generic label, not undefined', () => {
+    expect(summarizeGroup([{}, {}])).toBe('Ran 2 × tool');
+  });
+});