@1agh/maude 0.45.1 → 0.46.0

package/apps/studio/client/panels/SettingsPanel.jsx

@@ -385,6 +385,203 @@ function WhisperModelCard() {
   );
 }
 
+// feature-scene-aware-keyframes — the video-analysis frame-selection engine, the
+// sibling of the Subtitles section. Persists `keyframeEngine` to /_api/generate/prefs.
+const KEYFRAME_ENGINES = [
+  { id: 'auto', label: 'Auto', note: 'Use the best available: Gemma scout → ffmpeg → blind.' },
+  { id: 'gemma', label: 'Gemma scout', note: 'Semantic action beats. Needs Apple Silicon + mlx-vlm + a model.' },
+  { id: 'ffmpeg', label: 'ffmpeg scene-detect', note: 'Scene cuts + endpoints. Needs ffmpeg. No model download.' },
+  { id: 'blind', label: 'Blind (even-spaced)', note: 'Chromium fallback — works with neither ffmpeg nor Gemma.' },
+];
+
+function KeyframeEngineCard() {
+  const [engine, setEngine] = useState(null);
+  const [busy, setBusy] = useState(false);
+  const [status, setStatus] = useState(null);
+
+  useEffect(() => {
+    fetch('/_api/generate/prefs')
+      .then((r) => (r.ok ? r.json() : Promise.reject(new Error(`HTTP ${r.status}`))))
+      .then((d) => setEngine(d?.keyframeEngine || 'auto'))
+      .catch(() => setEngine('auto'));
+  }, []);
+
+  async function choose(id) {
+    if (id === engine) return;
+    const prev = engine;
+    setEngine(id);
+    setBusy(true);
+    setStatus(null);
+    try {
+      const res = await fetch('/_api/generate/prefs', {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ keyframeEngine: id }),
+      });
+      if (!res.ok) throw new Error(await res.text());
+      setStatus({ ok: true, msg: 'Saved.' });
+    } catch (err) {
+      setEngine(prev);
+      setStatus({ ok: false, msg: err && err.message ? err.message : 'save failed' });
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="st-provider-card">
+      <div className="st-provider-hd">
+        <span className="st-provider-name">Scene-aware keyframes — analysis engine</span>
+      </div>
+      <div className="st-provider-notes">
+        How Maude picks frames when it analyzes a video (`/design:video-analyze`, `/design:reel`).
+        Scene-aware beats a blind frame rate. This is an explicit choice — a chosen-but-unavailable
+        engine tells you how to fix it; <strong>Auto</strong> just uses the best you have installed.
+      </div>
+      <div className="st-engine-radios" role="radiogroup" aria-label="Keyframe engine">
+        {KEYFRAME_ENGINES.map((e) => (
+          <label key={e.id} className={'st-engine-radio' + (engine === e.id ? ' is-selected' : '')}>
+            <input
+              type="radio"
+              name="keyframe-engine"
+              value={e.id}
+              checked={engine === e.id}
+              disabled={busy || engine === null}
+              onChange={() => choose(e.id)}
+            />
+            <span className="st-engine-radio-body">
+              <span className="st-engine-radio-label">{e.label}</span>
+              <span className="st-engine-radio-note">{e.note}</span>
+            </span>
+          </label>
+        ))}
+      </div>
+      {status && (
+        <div
+          className="st-provider-status"
+          style={{ color: status.ok ? 'var(--accent)' : 'var(--danger, #e5484d)' }}
+        >
+          {status.msg}
+        </div>
+      )}
+    </div>
+  );
+}
+
+// The MODEL half of the Gemma scout — one click, mirroring WhisperModelCard. The
+// RUNTIME (mlx-vlm) is a manual `pip install` the app can't do, so the download is
+// gated on mlxVlmAvailable and the card says which tier will actually run.
+function GemmaModelCard() {
+  const [state, setState] = useState(null); // { models, downloading, mlxVlmAvailable, ffmpegAvailable }
+  const [err, setErr] = useState(null);
+
+  const load = useCallback(() => {
+    fetch('/_api/generate/keyframe-model')
+      .then((r) => (r.ok ? r.json() : Promise.reject(new Error(`HTTP ${r.status}`))))
+      .then(setState)
+      .catch((e) => setErr(e && e.message ? e.message : 'failed to load models'));
+  }, []);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  useEffect(() => {
+    if (!state?.downloading) return undefined;
+    const t = setInterval(load, 1500);
+    return () => clearInterval(t);
+  }, [state?.downloading, load]);
+
+  async function download(id) {
+    setErr(null);
+    try {
+      const res = await fetch('/_api/generate/keyframe-model', {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ id }),
+      });
+      if (!res.ok) throw new Error(await res.text());
+      load();
+    } catch (e) {
+      setErr(e && e.message ? e.message : 'download failed');
+    }
+  }
+
+  const dl = state?.downloading;
+  const mlx = state?.mlxVlmAvailable;
+  const ff = state?.ffmpegAvailable;
+  const pctOf = (r, t) => (t > 0 ? Math.min(100, Math.round((r / t) * 100)) : 0);
+  const activeTier = mlx ? 'Gemma scout' : ff ? 'ffmpeg scene-detect' : 'blind (even-spaced)';
+
+  return (
+    <div className="st-provider-card">
+      <div className="st-provider-hd">
+        <span className="st-provider-name">Gemma scout model (optional)</span>
+      </div>
+      <div className="st-provider-notes">
+        The <strong>Gemma</strong> tier adds semantic action-beat detection on top of scene cuts. It
+        needs an <strong>Apple-Silicon Mac</strong> and the <code>mlx-vlm</code> runtime
+        (<code>pip install mlx-vlm</code> — a manual step Maude can’t do for you). Downloading a model
+        below is the one-click half. Models live in your HuggingFace cache, never committed.
+      </div>
+      {state && (
+        <div className="st-provider-notes">
+          On this machine the active tier is <strong>{activeTier}</strong>
+          {!mlx && ff && ' — install mlx-vlm + download a model to unlock the Gemma scout.'}
+          {!mlx && !ff && ' — install ffmpeg for scene-aware frames, or mlx-vlm for the Gemma scout.'}
+        </div>
+      )}
+      {err && (
+        <div className="st-provider-status" style={{ color: 'var(--danger, #e5484d)' }}>
+          {err}
+        </div>
+      )}
+      {dl?.error && (
+        <div className="st-provider-status" style={{ color: 'var(--danger, #e5484d)' }}>
+          Download of {dl.id} failed: {dl.error}
+        </div>
+      )}
+      {state === null && !err && <div className="st-settings-intro">Loading…</div>}
+      <div className="st-model-list">
+        {(state?.models || []).map((m) => {
+          const busy = dl && !dl.error && dl.id === m.id;
+          return (
+            <div key={m.id} className="st-model-row">
+              <div className="st-model-info">
+                <span className="st-model-label">
+                  {m.label}
+                  <span className="st-model-size">~{Math.round(m.sizeMB / 100) / 10} GB</span>
+                </span>
+                <span className="st-engine-radio-note">{m.note}</span>
+                {busy && (
+                  <span className="st-model-progress">Downloading… {pctOf(dl.received, dl.total)}%</span>
+                )}
+              </div>
+              <div className="st-model-actions">
+                {m.downloaded ? (
+                  <span className="st-provider-configured">
+                    <Icon name="check" size={12} /> ready
+                  </span>
+                ) : (
+                  <button
+                    type="button"
+                    className="st-btn"
+                    disabled={!mlx || !!(dl && !dl.error)}
+                    title={mlx ? '' : 'Install mlx-vlm first (pip install mlx-vlm)'}
+                    onClick={() => download(m.id)}
+                  >
+                    {busy ? 'Downloading…' : mlx ? 'Download' : 'Needs mlx-vlm'}
+                  </button>
+                )}
+              </div>
+            </div>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
+
 // feature-unified-settings-modal — one modal for every Maude preference, laid
 // out as a left vertical tab rail + an internally-scrolling pane. Categories:
 const TABS = [
@@ -393,6 +590,7 @@ const TABS = [
   { id: 'layout', label: 'Layout' },
   { id: 'ai-generation', label: 'AI generation' },
   { id: 'subtitles', label: 'Subtitles' },
+  { id: 'video', label: 'Video' },
 ];
 const SETTINGS_TAB_STORE = 'mdcc-settings-tab';
 
@@ -820,6 +1018,19 @@ export default function SettingsPanel({
               <TranscriptionEngineCard />
               <WhisperModelCard />
             </section>
+
+            {/* Video — scene-aware keyframe engine. Kept mounted so GemmaModelCard's
+                download poll survives a tab switch (like Subtitles above). */}
+            <section
+              role="tabpanel"
+              id="st-spanel-video"
+              aria-labelledby="st-stab-video"
+              hidden={tab !== 'video'}
+            >
+              <div className="st-rp-hd">Video</div>
+              <KeyframeEngineCard />
+              <GemmaModelCard />
+            </section>
           </div>
         </div>
       </div>

package/apps/studio/client/panels/ToolGroup.jsx

@@ -0,0 +1,79 @@
+// Collapsed consecutive-tool-call summary row (Task C1) — folds a RUN of 2+
+// back-to-back tool-call parts into one "Ran N tools" line, expandable to the
+// individual ChatToolCards. A single isolated tool call renders as-is (no
+// wrapper) so the common case stays exactly as it was.
+
+import { useState } from 'react';
+
+/**
+ * Pure grouping fn (exported for tests): `parts` (a message's raw content
+ * array, or the continuation tail's parts) → an ordered list of
+ * `{ type:'single', part }` | `{ type:'tool-group', parts:[...] }`. Only
+ * CONSECUTIVE tool-call parts fold into a group; anything else (text,
+ * reasoning) — or a lone tool-call with no neighbor — passes through single.
+ */
+export function groupToolCalls(parts) {
+  const list = Array.isArray(parts) ? parts : [];
+  const out = [];
+  let i = 0;
+  while (i < list.length) {
+    const p = list[i];
+    if (p?.type === 'tool-call') {
+      const run = [];
+      let j = i;
+      while (j < list.length && list[j]?.type === 'tool-call') {
+        run.push(list[j]);
+        j++;
+      }
+      out.push(run.length > 1 ? { type: 'tool-group', parts: run } : { type: 'single', part: run[0] });
+      i = j;
+    } else {
+      out.push({ type: 'single', part: p });
+      i++;
+    }
+  }
+  return out;
+}
+
+/** "Ran N × Write file" when every entry in the run shares one title, else a
+ *  short "Ran N tools — A, B, C…" listing the distinct titles seen. */
+export function summarizeGroup(parts) {
+  const names = parts.map((p) => p.toolName || 'tool');
+  const uniq = [...new Set(names)];
+  if (uniq.length === 1) return `Ran ${parts.length} × ${uniq[0]}`;
+  const shown = uniq.slice(0, 3).join(', ');
+  return `Ran ${parts.length} tools — ${shown}${uniq.length > 3 ? '…' : ''}`;
+}
+
+export default function ToolGroup({ parts, ToolCard, forceOpen = false, verbose = false }) {
+  const [open, setOpen] = useState(forceOpen);
+  const allDone = parts.every((p) => p.result !== undefined);
+  const anyError = parts.some((p) => p.isError);
+  return (
+    <details
+      className="chat-toolgroup"
+      open={forceOpen || open}
+      onToggle={(e) => setOpen(e.currentTarget.open)}
+      data-testid="chat-tool-group"
+    >
+      <summary className="chat-toolgroup-sum">
+        <span className={`chat-tool-dot ${allDone ? 'chat-tool-dot--done' : 'chat-tool-dot--run'}`} />
+        <span>{summarizeGroup(parts)}</span>
+        {anyError ? <span className="del"> · error</span> : null}
+      </summary>
+      <div className="chat-toolgroup-body">
+        {parts.map((p, i) => (
+          <ToolCard
+            key={p.toolCallId || i}
+            toolName={p.toolName}
+            args={p.args}
+            result={p.result}
+            isError={p.isError}
+            verbose={verbose}
+            flat
+          />
+        ))}
+      </div>
+    </details>
+  );
+}

package/apps/studio/client/panels/acp-capabilities.js

@@ -0,0 +1,82 @@
+// Pure helpers for the ACP session-capabilities channel (feature-acp-panel-
+// dynamic-claude-code-capabilities). Every model/mode/effort list rendered by
+// the panel is parsed from these — NEVER a hardcoded array. The session's
+// `configOptions[]` is a generic, agent-defined menu (models/effort/fast-mode/
+// agent persona/…, keyed by opaque ids); `modes` is the separate, protocol-
+// typed permission-mode roster. See CapabilityBar.jsx for the render side.
+
+const KNOWN_CONFIG_IDS = { model: 'model', effort: 'effort', fast: 'fast', mode: 'mode' };
+
+/**
+ * `configOptions[]` → the three well-known controls (identified by `id` —
+ * `category` is only a UX hint and may be absent, e.g. the "Agent persona"
+ * option) plus every OTHER advertised select option, generic. The "mode"
+ * entry mirrors `modes`/`SessionModeState` (the adapter keeps both in sync)
+ * so it's excluded here — the dedicated mode picker renders from `parseModes`
+ * instead, never from this list, or it would show twice.
+ */
+export function parseConfigOptions(configOptions) {
+  const list = Array.isArray(configOptions) ? configOptions : [];
+  let model = null;
+  let effort = null;
+  let fast = null;
+  const others = [];
+  for (const opt of list) {
+    if (!opt || typeof opt !== 'object' || opt.id === KNOWN_CONFIG_IDS.mode) continue;
+    if (opt.id === KNOWN_CONFIG_IDS.model) model = opt;
+    else if (opt.id === KNOWN_CONFIG_IDS.effort) effort = opt;
+    else if (opt.id === KNOWN_CONFIG_IDS.fast) fast = opt;
+    else others.push(opt);
+  }
+  return { model, effort, fast, others };
+}
+
+/**
+ * `SessionModeState` → `{ current, available }` (empty when the agent doesn't
+ * advertise modes at all). `available` legitimately varies turn to turn — the
+ * adapter clamps the roster to what the CURRENT model supports (e.g. "Auto"
+ * only when `supportsAutoMode`) — never assume a fixed set.
+ */
+export function parseModes(modes) {
+  if (!modes || !Array.isArray(modes.availableModes)) return { current: null, available: [] };
+  return { current: modes.currentModeId ?? null, available: modes.availableModes };
+}
+
+/**
+ * Flatten a `SessionConfigSelect.options` — a flat option array OR grouped
+ * (`SessionConfigSelectGroup[]`, each `{group,name,options}`) — into one list
+ * of selectable leaves (`{value,name,description}`).
+ */
+export function flattenSelectOptions(options) {
+  const list = Array.isArray(options) ? options : [];
+  const out = [];
+  for (const o of list) {
+    if (o && Array.isArray(o.options)) out.push(...o.options);
+    else if (o) out.push(o);
+  }
+  return out;
+}
+
+/**
+ * Resolve which value a picker should show: the user's last explicit pick
+ * (localStorage, `savedValue`) if it's still offered among `availableValues`
+ * (a plain array of value/id strings — the caller flattens+maps first), else
+ * `defaultValue` (the session's own current value — a fresh session/model can
+ * default to something the last chat didn't use).
+ */
+export function resolvePersistedPick(availableValues, savedValue, defaultValue) {
+  const set = new Set(Array.isArray(availableValues) ? availableValues : []);
+  if (savedValue != null && set.has(savedValue)) return savedValue;
+  return defaultValue ?? null;
+}
+
+// Modes where the agent CANNOT apply an edit and there's no interactive approve
+// path to unblock it (DDR-184 #3). `plan` = "no actual tool execution"; `dontAsk`
+// denies anything without a standing pre-approval (and Maude's default allow-list
+// only covers edits + `maude`, so an off-list step is silently denied). The
+// ChatPanel ModeBanner reads this to decide whether to show the loud alert. Keyed
+// off the mode id, never a label, so it stays truthful as the roster evolves.
+export const NO_EDIT_MODE_IDS = new Set(['plan', 'dontAsk']);
+export function modeBlocksEdits(modes) {
+  return !!modes?.currentModeId && NO_EDIT_MODE_IDS.has(modes.currentModeId);
+}

package/apps/studio/client/panels/acp-elicitation.js

@@ -0,0 +1,194 @@
+// Pure helpers for ACP form elicitation (feature-acp-ask-user-question) —
+// parses a `requestedSchema` (ElicitationSchema, confirmed on disk against
+// `@agentclientprotocol/sdk`'s schema/types.gen.d.ts) into renderable question
+// descriptors, and folds the UI's answer state back into the `content` map a
+// `CreateElicitationResponse` expects. No DOM — `ElicitationPrompt.jsx` is the
+// only consumer that touches rendering.
+//
+// The exact field-naming convention this is written against — `question_<n>`
+// paired with a sibling `question_<n>_custom` free-text field, enum options
+// carrying `{const, title, description?}` — is confirmed by reading
+// `@agentclientprotocol/claude-agent-acp/dist/elicitation.js`'s
+// `askUserQuestionsToCreateRequest`/`applyAskElicitationResponse` directly (the
+// installed source, not the docs — this whole feature rides an UNSTABLE
+// protocol surface). The parser is written generically against the pairing
+// PATTERN (`<key>` + `<key>_custom` both present in `properties`), not
+// hardcoded to the `question_` prefix, so a well-formed non-AskUserQuestion MCP
+// form that happens to follow the same convention renders correctly too.
+
+// SECURITY (ethical-hacker finding) — Maude's bridge only ever declares the
+// `form` elicitation capability, never `url` (see DDR-180's Open decisions +
+// `acp/bridge.ts`'s structural rejection of any other mode). The MCP spec's
+// OWN guidance is that url-mode exists specifically so a real credential
+// request never has to pass through the LLM/client at all. By not supporting
+// it, Maude makes the free-text box on THIS card the only channel any
+// connected MCP server — benign or hostile — can ever use to ask for a
+// secret. This heuristic doesn't change accept/decline routing or try to
+// block the request; it only asks the free-text input to behave like a
+// password field (masked, with a visible warning) when the question's own
+// text reads as a credential ask, so a user who WOULD stop and think twice
+// before typing a real secret into a password-styled field gets that same
+// pause here. A false positive just means an unrelated question shows a
+// masked box — harmless; a false negative leaves today's behavior unchanged.
+const SECRET_SHAPED_PATTERN =
+  /\b(password|passphrase|secret|api[\s_-]?key|access[\s_-]?key|private[\s_-]?key|auth(?:entication)?[\s_-]?token|credential|oauth[\s_-]?token)\b/i;
+
+/** Does this question's own text read as a request for a credential/secret?
+ *  Checked against title + description (or a top-level card `message`) — text
+ *  the requester chose, never the user's own typed answer. */
+export function looksLikeSecretRequest(...texts) {
+  const joined = texts.filter((t) => typeof t === 'string').join(' ');
+  return SECRET_SHAPED_PATTERN.test(joined);
+}
+
+/** `_meta` key under which `askUserQuestionsToCreateRequest` bridges an
+ *  AskUserQuestion option's `preview` (mockup/code-snippet/comparison) — ACP's
+ *  `EnumOption` has no first-class slot for it (confirmed on disk against the
+ *  installed `claude-agent-acp/dist/elicitation.js`). */
+const OPTION_PREVIEW_META_KEY = '_claude/askUserQuestionOption';
+
+/** Titled or bare enum options → a uniform `{value, label, description, preview}`
+ *  list. `oneOf`/array-items `anyOf` carry `{const, title, description?, _meta?}`;
+ *  a bare `enum` is just an array of strings with no separate label/preview. */
+function normalizeOptions(schema) {
+  if (Array.isArray(schema?.oneOf)) {
+    return schema.oneOf.map((o) => ({
+      value: o?.const,
+      label: o?.title ?? String(o?.const ?? ''),
+      description: o?.description ?? null,
+      preview: o?._meta?.[OPTION_PREVIEW_META_KEY]?.preview ?? null,
+    }));
+  }
+  if (Array.isArray(schema?.enum)) {
+    return schema.enum.map((v) => ({
+      value: v,
+      label: String(v),
+      description: null,
+      preview: null,
+    }));
+  }
+  return [];
+}
+
+/** Classify one ElicitationPropertySchema into a renderable `kind` + its options. */
+function classifyProperty(prop) {
+  if (!prop || typeof prop !== 'object') return null;
+  if (prop.type === 'string' && (Array.isArray(prop.oneOf) || Array.isArray(prop.enum))) {
+    return { kind: 'single', options: normalizeOptions(prop) };
+  }
+  if (prop.type === 'array') {
+    const items = prop.items;
+    const options = Array.isArray(items?.anyOf)
+      ? normalizeOptions({ oneOf: items.anyOf })
+      : normalizeOptions(items);
+    if (options.length) return { kind: 'multi', options };
+    return { kind: 'text', options: [] }; // array without an item enum — no renderer for it; fall back to text
+  }
+  // string/number/integer/boolean with no enum, or anything unrecognized —
+  // render as a plain free-text field rather than dropping the question.
+  return { kind: 'text', options: [] };
+}
+
+/**
+ * Walk `requestedSchema.properties` in object-key order into an ordered list
+ * of renderable question descriptors:
+ *   { id, title, description, kind: 'single'|'multi'|'text', options, required, customFieldId }
+ * Tolerates a missing/malformed schema (returns `[]`) — never throws, since a
+ * malformed elicitation must still let the user Skip/Cancel rather than crash
+ * the panel.
+ */
+export function parseElicitationSchema(requestedSchema) {
+  const properties = requestedSchema?.properties;
+  if (!properties || typeof properties !== 'object') return [];
+  const keys = Object.keys(properties);
+  const required = new Set(Array.isArray(requestedSchema.required) ? requestedSchema.required : []);
+  // A key is a "custom" sibling (and must NOT render as its own top-level
+  // question) when `<base>_custom` names it AND `<base>` is also a property.
+  const customKeys = new Set();
+  for (const k of keys) {
+    if (!k.endsWith('_custom')) continue;
+    const base = k.slice(0, -'_custom'.length);
+    if (base && Object.hasOwn(properties, base)) customKeys.add(k);
+  }
+
+  const questions = [];
+  for (const id of keys) {
+    if (customKeys.has(id)) continue;
+    const prop = properties[id];
+    const classified = classifyProperty(prop);
+    if (!classified) continue;
+    const customFieldId = customKeys.has(`${id}_custom`) ? `${id}_custom` : null;
+    questions.push({
+      id,
+      title: prop.title ?? null,
+      description: prop.description ?? null,
+      kind: classified.kind,
+      options: classified.options,
+      required: required.has(id),
+      customFieldId,
+      secretShaped: looksLikeSecretRequest(prop.title, prop.description),
+    });
+  }
+  return questions;
+}
+
+/**
+ * Fold the UI's answer state into the `content` map a `CreateElicitationResponse`
+ * `accept` action carries. `answers` is keyed by question id (string for
+ * single/text, string[] for multi) AND by `customFieldId` (string) where the
+ * user typed a free-text override.
+ *
+ * Single/text: a non-empty, trimmed custom answer WINS over a selection —
+ * mirrors `applyAskElicitationResponse`'s documented read order exactly (it
+ * checks the `_custom` field first and only falls back to the base field when
+ * empty), so a single-select AskUserQuestion field folds identically however
+ * the adapter reads it back. This is a real protocol constraint, not a UI
+ * choice — a single-select question only has room for one answer.
+ *
+ * Multi: a non-empty custom answer is APPENDED to the checked options instead
+ * (routed through the BASE field, `content[q.id]`, never `content[customFieldId]`)
+ * — dogfooding expected "type something extra" to ADD to a multi-select pick,
+ * not silently discard it the way single-select's override does. This is safe
+ * specifically because `applyAskElicitationResponse` only reads the custom key
+ * to decide whether to override; when it's absent, it falls through to
+ * `Array.isArray(value) ? value.join(", ") : ...` on the base field, which
+ * doesn't validate array entries against the declared enum — appending an
+ * arbitrary string is exactly what a real multi-select "and also…" answer
+ * should read as once joined. `content[customFieldId]` is deliberately never
+ * populated for a multi-select question, so the override path never fires.
+ *
+ * An unanswered, non-required question is simply omitted from `content`
+ * (Skip/leave-blank must never fabricate a value).
+ */
+export function buildElicitationContent(questions, answers) {
+  // `Object.create(null)` — a question/custom-field id of `__proto__` (an
+  // agent-supplied schema key, technically attacker-influenceable) would
+  // otherwise hit the Object.prototype accessor on a plain `{}` literal
+  // instead of creating an own key, silently dropping that answer
+  // (security-auditor finding; not exploitable across the wire since
+  // JSON.stringify never serializes it either way, but a null-prototype
+  // object closes it outright rather than relying on that side effect).
+  const content = Object.create(null);
+  const src = answers && typeof answers === 'object' ? answers : {};
+  for (const q of questions ?? []) {
+    const custom = q.customFieldId ? src[q.customFieldId] : undefined;
+    const trimmedCustom = typeof custom === 'string' ? custom.trim() : '';
+
+    if (q.kind === 'multi') {
+      const selected = Array.isArray(src[q.id]) ? src[q.id] : [];
+      const combined = trimmedCustom ? [...selected, trimmedCustom] : selected;
+      if (combined.length) content[q.id] = combined;
+      continue;
+    }
+
+    if (trimmedCustom) {
+      content[q.customFieldId] = trimmedCustom;
+      continue;
+    }
+    const value = src[q.id];
+    if (typeof value === 'string' && value !== '') {
+      content[q.id] = value;
+    }
+  }
+  return content;
+}