@1agh/maude 0.45.1 → 0.45.2

package/apps/studio/acp/index.ts

@@ -6,7 +6,11 @@
 
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 
-import type { AvailableCommand, SessionUpdate } from '@agentclientprotocol/sdk';
+import type {
+  AvailableCommand,
+  CreateElicitationRequest,
+  SessionUpdate,
+} from '@agentclientprotocol/sdk';
 import type { ServerWebSocket } from 'bun';
 
 import { isCanvasFile } from '../activity.ts';
@@ -14,22 +18,31 @@ import type { AiActivity } from '../collab/ai-activity.ts';
 import type { Context } from '../context.ts';
 import type { WsData } from '../ws.ts';
 import { buildStudioBrief } from './bootstrap-brief.ts';
-import { AcpBridge, type AcpEffort } from './bridge.ts';
+import { AcpBridge, type BridgeUsage } from './bridge.ts';
 import { isNativePluginContext, resolveSessionPlugins } from './plugin-bootstrap.ts';
 import { probeAcpAvailability } from './probe.ts';
 
-const VALID_EFFORT = new Set(['fast', 'balanced', 'thorough']);
-// Model is set as ANTHROPIC_MODEL on the spawned child — allowlist it server-side
-// (security review F1) so the loopback WS frame can't pin an arbitrary value.
-const VALID_MODELS = new Set(['opus', 'sonnet', 'haiku']);
-
 /**
- * Browser → server frames: `{ t: 'prompt', text, canvas? }`, `{ t: 'cancel' }`,
- * `{ t: 'warm', chat?, model?, effort? }` (spawn + create the session so the agent
- * publishes its slash-command catalogue — no prompt sent).
+ * Browser → server frames: `{ t: 'prompt', text, chat?, model?, effort?, mode? }`,
+ * `{ t: 'cancel' }`, `{ t: 'warm', chat?, model?, effort?, mode? }` (spawn +
+ * create the session so the agent publishes its slash-command catalogue — no
+ * prompt sent), `{ t: 'set-mode', chat?, modeId }`, `{ t: 'set-config', chat?,
+ * configId, value }` (live change on an already-established session —
+ * feature-acp-panel-dynamic-claude-code-capabilities), `{ t: 'permission-response',
+ * id, decision }` (Milestone B), `{ t: 'elicitation-response', id, action,
+ * content? }` (feature-acp-ask-user-question — `action` is `accept`/`decline`/
+ * `cancel`; `content` only meaningful alongside `accept`).
  * Server → browser frames: `ready` (availability on open), `connected` (session
  * live), `update` (each streamed session/update), `commands` (the agent's
- * `available_commands_update` catalogue — cached + replayed on open), `turn-end`,
+ * `available_commands_update` catalogue — cached + replayed on open), `caps`
+ * (the session's mode roster + config-option set — dynamic, never hardcoded),
+ * `session-info` (agent-generated chat title), `permission-request` (Milestone B
+ * approve/deny gate), `elicitation-request` (feature-acp-ask-user-question —
+ * `AskUserQuestion` + any MCP-server-originated form), `elicitation-resolved`
+ * (a pending elicitation settled via ANY path, including one the client never
+ * initiated — timeout/cancel/stop — so the client can drop a now-dead pending
+ * card instead of leaving it stuck), `usage` (context-window + cost +
+ * rate-limit, Milestone D — cached + replayed on open), `turn-end`,
  * `permission`, `error`.
  */
 export interface Acp {
@@ -130,6 +143,10 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
   // on the second panel-open without re-warming. Not persisted (static list in
   // the client covers a cold process); avoids DDR-115 runtime-state churn.
   let latestCommands: AvailableCommand[] = [];
+  // Milestone D — same replay-on-open treatment for the last-seen usage
+  // snapshot, so a freshly-opened socket shows SOMETHING immediately instead
+  // of waiting for the chat's first turn to complete.
+  let latestUsage: BridgeUsage | null = null;
 
   function send(ws: ServerWebSocket<WsData>, payload: unknown): void {
     try {
@@ -169,10 +186,45 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
           send(ws, { t: 'update', update });
         },
         onPermission: (req) => send(ws, { t: 'permission', toolCall: req.toolCall }),
+        onPermissionRequest: (id, req) =>
+          send(ws, { t: 'permission-request', id, toolCall: req.toolCall, options: req.options }),
+        onElicitationRequest: (id, req: CreateElicitationRequest) =>
+          send(ws, {
+            t: 'elicitation-request',
+            id,
+            message: req.message,
+            mode: req.mode,
+            // `req.mode === 'form'` is guaranteed by the bridge (it declines
+            // any other mode before ever calling onElicitationRequest — see
+            // the SECURITY comment in bridge.ts) — this ternary exists for
+            // TYPE narrowing (requestedSchema only exists on the form variant
+            // of the CreateElicitationRequest union), not as a runtime guard.
+            requestedSchema: req.mode === 'form' ? req.requestedSchema : undefined,
+            // Forwarded so the client can attribute the request to the actual
+            // tool call it's scoped to (when present) instead of a blanket
+            // "from Claude" label — ethical-hacker finding: `toolCallId` is
+            // present on `ElicitationSessionScope` and was being silently
+            // dropped, even though ElicitationPrompt.jsx had nothing else to
+            // disambiguate a built-in AskUserQuestion form from an arbitrary
+            // connected MCP server's form.
+            toolCallId: 'toolCallId' in req ? req.toolCallId : undefined,
+          }),
+        // A pending elicitation settled via ANY path, including one the
+        // client never initiated (a bridge-side timeout, cancel(), stop()) —
+        // tells the client to drop it from its own pending list even though
+        // it didn't send the `elicitation-response` itself. See the doc
+        // comment on `onElicitationSettled` in bridge.ts.
+        onElicitationSettled: (id) => send(ws, { t: 'elicitation-resolved', id }),
         onCommands: (commands) => {
           latestCommands = commands;
           send(ws, { t: 'commands', commands });
         },
+        onCaps: (modes, configOptions) => send(ws, { t: 'caps', modes, configOptions }),
+        onSessionInfo: (info) => send(ws, { t: 'session-info', ...info }),
+        onUsage: (usage) => {
+          latestUsage = usage;
+          send(ws, { t: 'usage', usage });
+        },
       });
       bridges.set(ws.data.id, bridge);
     }
@@ -202,12 +254,13 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
     text: string,
     chatId: string,
     model: string | null,
-    effort: AcpEffort
+    effort: string | null,
+    modeId: string | null
   ): Promise<void> {
     const bridge = getOrCreateBridge(ws);
     bridge.setTranscriptPath(transcriptPathFor(chatId));
     bridge.setSessionStorePath(sessionStorePathFor(chatId));
-    bridge.setConfig(model, effort);
+    bridge.setConfig(model, effort, modeId);
     try {
       await bridge.ensureStarted();
       const { stopReason } = await bridge.prompt(text, sanitizeChatId(chatId));
@@ -232,11 +285,12 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
     ws: ServerWebSocket<WsData>,
     chatId: string,
     model: string | null,
-    effort: AcpEffort
+    effort: string | null,
+    modeId: string | null
   ): Promise<void> {
     const bridge = getOrCreateBridge(ws);
     bridge.setSessionStorePath(sessionStorePathFor(chatId));
-    bridge.setConfig(model, effort);
+    bridge.setConfig(model, effort, modeId);
     try {
       await bridge.warmUp(sanitizeChatId(chatId));
     } catch {
@@ -244,6 +298,57 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
     }
   }
 
+  /** True when `value` is currently offered for the select-type option `configId`
+   *  on `bridge`'s last-advertised set — the dynamic replacement for the old
+   *  hardcoded VALID_MODELS/VALID_EFFORT allowlists (DDR-125 F1: a loopback
+   *  frame still can't pin an arbitrary value onto a live session). */
+  function optionOffers(bridge: AcpBridge, configId: string, value: string): boolean {
+    const opt = bridge.configOptions.find((o) => o.id === configId);
+    if (opt?.type !== 'select') return false;
+    const list = Array.isArray(opt.options) ? opt.options : [];
+    for (const o of list) {
+      if (o && typeof o === 'object' && 'options' in o && Array.isArray(o.options)) {
+        if (o.options.some((leaf) => leaf.value === value)) return true;
+      } else if (o && typeof o === 'object' && 'value' in o && o.value === value) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /** Live mode change on an already-established session (Task A2/A4). */
+  async function handleSetMode(
+    ws: ServerWebSocket<WsData>,
+    chatId: string,
+    modeId: string
+  ): Promise<void> {
+    const bridge = bridges.get(ws.data.id);
+    if (!bridge) return;
+    if (!bridge.modes?.availableModes.some((m) => m.id === modeId)) return; // not advertised — reject silently
+    try {
+      await bridge.setMode(sanitizeChatId(chatId), modeId);
+    } catch {
+      /* best-effort — the picker just keeps showing the last-confirmed caps frame */
+    }
+  }
+
+  /** Live config-option change (model/effort/fast/…) on an already-established session. */
+  async function handleSetConfig(
+    ws: ServerWebSocket<WsData>,
+    chatId: string,
+    configId: string,
+    value: string
+  ): Promise<void> {
+    const bridge = bridges.get(ws.data.id);
+    if (!bridge) return;
+    if (!optionOffers(bridge, configId, value)) return; // not advertised — reject silently
+    try {
+      await bridge.setConfigOption(sanitizeChatId(chatId), configId, value);
+    } catch {
+      /* best-effort — see handleSetMode */
+    }
+  }
+
   return {
     onOpen(ws) {
       const probe = probeAcpAvailability();
@@ -251,6 +356,9 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
       // Replay the last-known command catalogue so autocomplete is instant on a
       // re-open (no re-warm needed within a dev-server lifetime).
       if (latestCommands.length) send(ws, { t: 'commands', commands: latestCommands });
+      // Same treatment for usage (Milestone D) — a stale cross-chat snapshot
+      // briefly, corrected by the new chat's own first usage_update.
+      if (latestUsage) send(ws, { t: 'usage', usage: latestUsage });
     },
 
     onMessage(ws, raw) {
@@ -267,24 +375,65 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
         chat?: unknown;
         model?: unknown;
         effort?: unknown;
+        mode?: unknown;
+        modeId?: unknown;
+        configId?: unknown;
+        value?: unknown;
+        id?: unknown;
+        decision?: unknown;
+        action?: unknown;
+        content?: unknown;
       };
 
       const chatId = typeof frame.chat === 'string' && frame.chat ? frame.chat : 'default';
-      const model =
-        typeof frame.model === 'string' && VALID_MODELS.has(frame.model) ? frame.model : null;
-      const effort: AcpEffort =
-        typeof frame.effort === 'string' && VALID_EFFORT.has(frame.effort)
-          ? (frame.effort as AcpEffort)
-          : 'balanced';
+      // Model/effort/mode are opaque, dynamic option ids/values now (no
+      // hardcoded allowlist) — a persisted pick that isn't actually offered by
+      // the resolved session is silently skipped by the bridge's own
+      // `optionOffers` check (`applyDesiredConfigOnce`), never forwarded blind
+      // to the adapter. Live mid-session changes (`set-mode`/`set-config`
+      // below) DO get validated against the bridge's last-advertised set —
+      // that is the DDR-125 F1 boundary that matters (pinning a value onto an
+      // ALREADY-running session).
+      const model = typeof frame.model === 'string' && frame.model ? frame.model : null;
+      const effort = typeof frame.effort === 'string' && frame.effort ? frame.effort : null;
+      const modeId = typeof frame.mode === 'string' && frame.mode ? frame.mode : null;
 
       if (frame.t === 'prompt' && typeof frame.text === 'string') {
-        void handlePrompt(ws, frame.text, chatId, model, effort);
+        void handlePrompt(ws, frame.text, chatId, model, effort, modeId);
       } else if (frame.t === 'warm') {
-        void handleWarm(ws, chatId, model, effort);
+        void handleWarm(ws, chatId, model, effort, modeId);
       } else if (frame.t === 'cancel') {
         // RC5 — a cancelled turn may never resolve prompt(); clear banners now.
         trackers.get(ws.data.id)?.endTurn();
         void bridges.get(ws.data.id)?.cancel();
+      } else if (frame.t === 'set-mode' && typeof frame.modeId === 'string' && frame.modeId) {
+        void handleSetMode(ws, chatId, frame.modeId);
+      } else if (
+        frame.t === 'set-config' &&
+        typeof frame.configId === 'string' &&
+        frame.configId &&
+        typeof frame.value === 'string'
+      ) {
+        void handleSetConfig(ws, chatId, frame.configId, frame.value);
+      } else if (frame.t === 'permission-response' && typeof frame.id === 'string' && frame.id) {
+        // Milestone B — the human's approve/deny decision for a pending
+        // `permission-request`. `decision` is either an offered `optionId` or
+        // the literal 'cancelled'; anything else collapses to 'cancelled'
+        // (deny) rather than forwarding an unvalidated string as an optionId
+        // — resolvePermission itself is a no-op on an unknown/already-settled
+        // id, so a malformed decision here just denies, never allows blind.
+        const decision =
+          typeof frame.decision === 'string' && frame.decision ? frame.decision : 'cancelled';
+        bridges.get(ws.data.id)?.resolvePermission(frame.id, decision);
+      } else if (frame.t === 'elicitation-response' && typeof frame.id === 'string' && frame.id) {
+        // feature-acp-ask-user-question — the human's answer/skip/cancel for a
+        // pending `elicitation-request`. `action`/`content` are forwarded
+        // shallowly; `AcpBridge.resolveElicitation` is the actual fail-closed
+        // gate (anything other than a well-formed accept collapses to decline).
+        const action = typeof frame.action === 'string' ? frame.action : 'decline';
+        const content =
+          frame.content && typeof frame.content === 'object' ? frame.content : undefined;
+        bridges.get(ws.data.id)?.resolveElicitation(frame.id, { action, content });
       }
     },
 

package/apps/studio/acp/probe.ts

@@ -10,7 +10,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
-import { DEV_SERVER_ROOT } from '../paths.ts';
+import { DEV_SERVER_ROOT, IS_COMPILED_BINARY } from '../paths.ts';
 import { scrubAgentEnv } from './env.ts';
 
 /** Adapter npm package — the renamed continuation of `@zed-industries/claude-code-acp`. */
@@ -155,13 +155,37 @@ export function resolveClaudePath(): string | null {
 }
 
 /**
- * The JS runtime used to launch the adapter. The dev-server already runs under
- * Bun, so `process.execPath` is always available; prefer a real `node` when
- * present (the adapter + `@anthropic-ai/claude-agent-sdk` are authored for Node)
- * and fall back to our own Bun. Overridable via `MAUDE_ACP_RUNTIME`.
+ * The JS runtime used to launch the adapter, plus whether it must be spawned
+ * with `BUN_BE_BUN=1`. Ladder: explicit `MAUDE_ACP_RUNTIME` override → a real
+ * `node` (the adapter + `@anthropic-ai/claude-agent-sdk` are authored for Node)
+ * → a real `bun` → our OWN `process.execPath`.
+ *
+ * The last rung is the RCA-G1 fix. On a machine with NO node/bun (the target
+ * user — installs the `.app`, never opens a terminal), `process.execPath` inside
+ * the `bun --compile` dev-server sidecar is the sidecar BINARY, not a JS
+ * interpreter: a compiled Bun executable only runs a passed script when
+ * `BUN_BE_BUN=1` is set — otherwise it re-runs its own embedded server and the
+ * ACP handshake never happens, so the panel hangs at "Working…" forever (the
+ * exact reported bug; the user's own `brew install node` masked it by making the
+ * `node` rung resolve). So when we fall back to our own COMPILED self we flag
+ * `bunBeBun=true`; `bridge.ts` sets it on the child env. In dev, `execPath` is a
+ * real `bun` and `IS_COMPILED_BINARY` is false, so `bunBeBun` stays false (no-op).
+ *
+ * The bundled compiled sidecar IS Bun 1.3.x, so this needs ZERO extra bytes and
+ * makes AI editing work with no user-installed runtime. NOTE the adapter + SDK
+ * are Node-authored — running them under Bun via this rung MUST be verified on a
+ * real compiled, node-less build (the dev path prefers `node`, so Bun is not
+ * exercised there); if a Bun/Node incompatibility surfaces, bundle a real `node`
+ * as an externalBin and point `MAUDE_ACP_RUNTIME` at it (the override rung above).
  */
-export function resolveAgentRuntime(): string {
-  return process.env.MAUDE_ACP_RUNTIME || Bun.which('node') || process.execPath;
+export function resolveAgentRuntime(): { bin: string; bunBeBun: boolean } {
+  const override = process.env.MAUDE_ACP_RUNTIME;
+  if (override) return { bin: override, bunBeBun: false };
+  const node = Bun.which('node');
+  if (node) return { bin: node, bunBeBun: false };
+  const bun = Bun.which('bun');
+  if (bun) return { bin: bun, bunBeBun: false };
+  return { bin: process.execPath, bunBeBun: IS_COMPILED_BINARY };
 }
 
 /**

package/apps/studio/acp/transcript.ts

@@ -2,13 +2,39 @@
 // appends raw per-update lines; these readers turn them into the chat list (for
 // the switcher) and clean per-turn messages (for hydrating the thread on open).
 
-import { existsSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
 import { join } from 'node:path';
 
 export interface ChatSummary {
   id: string;
   title: string;
   updated: number; // mtime ms
+  /** True when `title` came from a user rename (meta.json), not the
+   *  auto-derived first line. The client uses this to stop a later live
+   *  `session_info_update` (agent auto-title) from clobbering an explicit
+   *  rename — see ChatPanel.jsx's `renamedChatIdsRef`. */
+  renamed?: boolean;
+}
+
+/**
+ * User-set overrides (Task C5 — per-chat overflow menu), `<designRoot>/_chat/
+ * <chatId>.meta.json`. `title` wins over BOTH the auto-derived first-line
+ * title and any live `session_info_update` the agent later emits — an
+ * explicit rename must not be silently clobbered by an auto-generated
+ * summary landing afterward. `archived` hides the chat from the switcher's
+ * recents list (`listChats`) without deleting its transcript.
+ */
+export interface ChatMeta {
+  title?: string;
+  archived?: boolean;
 }
 
 export interface ChatMessagePart {
@@ -26,6 +52,52 @@ function chatDir(designRoot: string): string {
   return join(designRoot, '_chat');
 }
 
+function metaPath(designRoot: string, chatId: string): string {
+  return join(chatDir(designRoot), `${chatId}.meta.json`);
+}
+
+/** Read a chat's meta sidecar. Missing/corrupt/malformed → `{}` (no override),
+ *  never throws — a bad sidecar must degrade to "no rename/archive", not break
+ *  the switcher. */
+export function readChatMeta(designRoot: string, chatId: string): ChatMeta {
+  try {
+    const raw = JSON.parse(readFileSync(metaPath(designRoot, chatId), 'utf8')) as unknown;
+    if (!raw || typeof raw !== 'object') return {};
+    const r = raw as Record<string, unknown>;
+    const meta: ChatMeta = {};
+    if (typeof r.title === 'string' && r.title.trim()) meta.title = r.title.trim().slice(0, 200);
+    if (typeof r.archived === 'boolean') meta.archived = r.archived;
+    return meta;
+  } catch {
+    return {};
+  }
+}
+
+/** Merge `patch` into the chat's meta sidecar (creates `_chat/` if needed).
+ *  `title: null` / `archived: false` clear that field rather than deleting
+ *  the file — callers pass only the field(s) they're changing. */
+export function writeChatMeta(
+  designRoot: string,
+  chatId: string,
+  patch: { title?: string | null; archived?: boolean }
+): ChatMeta {
+  const dir = chatDir(designRoot);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  const current = readChatMeta(designRoot, chatId);
+  const next: ChatMeta = { ...current };
+  if ('title' in patch) {
+    const t = patch.title?.trim();
+    if (t) next.title = t.slice(0, 200);
+    else next.title = undefined;
+  }
+  if ('archived' in patch) {
+    if (patch.archived) next.archived = true;
+    else next.archived = undefined;
+  }
+  writeFileSync(metaPath(designRoot, chatId), JSON.stringify(next));
+  return next;
+}
+
 function readLines(file: string): Array<Record<string, unknown>> {
   try {
     return readFileSync(file, 'utf8')
@@ -54,13 +126,18 @@ function deriveTitle(lines: Array<Record<string, unknown>>): string {
   return trimmed ? trimmed.slice(0, 60) : 'New chat';
 }
 
-/** List chats newest-first. */
+/** List chats newest-first. Archived chats (Task C5) are excluded — the
+ *  transcript stays on disk, it just doesn't show up in the switcher. A
+ *  user-set title (readChatMeta) wins over the auto-derived first-line one. */
 export function listChats(designRoot: string): ChatSummary[] {
   const dir = chatDir(designRoot);
   if (!existsSync(dir)) return [];
   const out: ChatSummary[] = [];
   for (const name of readdirSync(dir)) {
     if (!name.endsWith('.jsonl')) continue;
+    const id = name.replace(/\.jsonl$/, '');
+    const meta = readChatMeta(designRoot, id);
+    if (meta.archived) continue;
     const file = join(dir, name);
     let updated = 0;
     try {
@@ -70,14 +147,23 @@ export function listChats(designRoot: string): ChatSummary[] {
     }
     const lines = readLines(file);
     if (lines.length === 0) continue;
-    out.push({ id: name.replace(/\.jsonl$/, ''), title: deriveTitle(lines), updated });
+    out.push({ id, title: meta.title || deriveTitle(lines), updated, renamed: !!meta.title });
   }
   return out.sort((a, b) => b.updated - a.updated);
 }
 
-/** Delete a chat's transcript. Returns true if a file was removed. */
+/** Delete a chat's transcript + its meta/session sidecars. Returns true if
+ *  the transcript file was removed (the sidecars are best-effort cleanup). */
 export function deleteChat(designRoot: string, chatId: string): boolean {
-  const file = join(chatDir(designRoot), `${chatId}.jsonl`);
+  const dir = chatDir(designRoot);
+  for (const suffix of ['.meta.json', '.session.json']) {
+    try {
+      rmSync(join(dir, `${chatId}${suffix}`));
+    } catch {
+      /* absent or unreadable — non-fatal, best-effort cleanup */
+    }
+  }
+  const file = join(dir, `${chatId}.jsonl`);
   if (!existsSync(file)) return false;
   try {
     rmSync(file);

package/apps/studio/bin/_import-asset.mjs

@@ -248,11 +248,41 @@ export function svgPreParseReject(text) {
   if (encMatch && !/^(utf-8|us-ascii|ascii)$/i.test(encMatch[1])) {
     throw new ImportAssetError(3, `unsupported declared encoding: ${encMatch[1]}`);
   }
-  if (/<!DOCTYPE/i.test(text) || /<!ENTITY/i.test(text)) {
-    throw new ImportAssetError(
-      3,
-      'DOCTYPE/ENTITY declarations are rejected (XXE/entity-expansion class)'
-    );
+  // XXE / entity-expansion hardening. The attack surface is an ENTITY
+  // declaration or an internal DTD subset (`<!DOCTYPE svg [ … ]>`, where entities
+  // are declared) — NOT a plain external-identifier DOCTYPE. Adobe Illustrator,
+  // Affinity/Serif, and Inkscape all emit a benign `<!DOCTYPE svg PUBLIC "-//W3C//
+  // DTD SVG 1.1//EN" "…svg11.dtd">` with no internal subset; rejecting that whole
+  // class turned away real, clean brand logos (RCA G8). Reject the actual vector,
+  // allow the benign declaration (the allowlist sanitizer drops the DOCTYPE from
+  // the stored output regardless, and happy-dom treats the DOCTYPE as an inert
+  // node — it never fetches an external DTD). See DDR-167 + DDR-177.
+  if (/<!ENTITY/i.test(text)) {
+    throw new ImportAssetError(3, 'ENTITY declarations are rejected (XXE/entity-expansion class)');
+  }
+  // Internal-subset detection, quote-aware. A naive `/<!DOCTYPE\b(.*?)>/` is
+  // evadable: a `>` inside a quoted external-id literal (`SYSTEM "http://x/>y"
+  // [ … ]`) truncates the capture before the `[` (ethical-hacker review). Scan
+  // from `<!DOCTYPE` respecting quotes, and reject on a `[` (internal subset)
+  // reached before the closing `>`.
+  const dtStart = text.search(/<!DOCTYPE\b/i);
+  if (dtStart >= 0) {
+    let quote = null;
+    for (let i = dtStart + 9; i < text.length; i++) {
+      const c = text[i];
+      if (quote) {
+        if (c === quote) quote = null;
+      } else if (c === '"' || c === "'") {
+        quote = c;
+      } else if (c === '[') {
+        throw new ImportAssetError(
+          3,
+          'DOCTYPE with an internal subset is rejected (XXE/entity-expansion class)'
+        );
+      } else if (c === '>') {
+        break; // end of DOCTYPE, no internal subset seen
+      }
+    }
   }
   // Any processing instruction other than the single leading XML declaration.
   const piRe = /<\?([^?]*)\?>/g;

package/apps/studio/client/panels/CapabilityBar.jsx

@@ -0,0 +1,101 @@
+// The model / effort / mode picker row (feature-acp-panel-dynamic-claude-code-
+// capabilities) — replaces the two hardcoded MODELS/EFFORTS `<select>`s that
+// used to live in ChatPanel.jsx's Composer. Model/effort/mode come from the
+// LIVE ACP session (`modes`/`configOptions`) — never a static list. Any OTHER
+// advertised option (e.g. an "Agent persona" selector) is deliberately NOT
+// rendered here — user call: keep this row to the three controls people
+// actually reach for, not every generic config option the session offers.
+
+import { flattenSelectOptions } from './acp-capabilities.js';
+
+function OptionSelect({ id, label, currentValue, options, onChange, disabled }) {
+  const flat = flattenSelectOptions(options);
+  if (!flat.length) return null;
+  return (
+    <select
+      className="chat-select"
+      value={currentValue ?? ''}
+      aria-label={label}
+      title={flat.find((o) => o.value === currentValue)?.description || label}
+      disabled={disabled}
+      onChange={(e) => onChange(id, e.target.value)}
+    >
+      {flat.map((o) => (
+        <option key={o.value} value={o.value}>
+          {o.name || o.value}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+export default function CapabilityBar({ modes, configOptions, onSetMode, onSetConfig, disabled }) {
+  const modeList = modes?.availableModes ?? [];
+  const model = configOptions?.model ?? null;
+  const effort = configOptions?.effort ?? null;
+  const fast = configOptions?.fast ?? null;
+
+  // Nothing arrived yet — the session is still establishing (a fresh chat
+  // spawns `claude` on first view; see ChatThread's warmedOnVisibleRef). Show
+  // a placeholder instead of rendering nothing at all, so this row doesn't
+  // read as "the picker disappeared" while it's just still connecting.
+  if (!modeList.length && !model && !effort && !fast) {
+    return (
+      <span className="chat-caps chat-caps--connecting" data-testid="chat-caps-connecting">
+        Connecting…
+      </span>
+    );
+  }
+
+  return (
+    <div className="chat-caps" data-testid="chat-caps-bar">
+      {modeList.length ? (
+        <select
+          className="chat-select"
+          value={modes?.currentModeId ?? ''}
+          aria-label="Permission mode"
+          data-testid="chat-mode-picker"
+          title={modeList.find((m) => m.id === modes?.currentModeId)?.description || 'Permission mode'}
+          disabled={disabled}
+          onChange={(e) => onSetMode(e.target.value)}
+        >
+          {modeList.map((m) => (
+            <option key={m.id} value={m.id}>
+              {m.name || m.id}
+            </option>
+          ))}
+        </select>
+      ) : null}
+      {model ? (
+        <OptionSelect
+          id={model.id}
+          label="Model"
+          currentValue={model.currentValue}
+          options={model.options}
+          onChange={onSetConfig}
+          disabled={disabled}
+        />
+      ) : null}
+      {effort ? (
+        <OptionSelect
+          id={effort.id}
+          label="Effort"
+          currentValue={effort.currentValue}
+          options={effort.options}
+          onChange={onSetConfig}
+          disabled={disabled}
+        />
+      ) : null}
+      {fast ? (
+        <OptionSelect
+          id={fast.id}
+          label="Fast mode"
+          currentValue={fast.currentValue}
+          options={fast.options}
+          onChange={onSetConfig}
+          disabled={disabled}
+        />
+      ) : null}
+    </div>
+  );
+}