@1agh/maude 0.55.0 → 0.57.0

package/apps/studio/test/acp-bridge-lifetime.test.ts

@@ -0,0 +1,369 @@
+// feature-acp-write-path-scope Addendum, Task 8 — the bridge outlives its socket.
+//
+// The bug this closes: `bridges` was keyed by `ws.data.id` and `onClose` called
+// `bridge.stop()` immediately, so ANY socket close killed the running agent.
+// `RepoBranchSwitcher.jsx` calls `window.location.reload()` unconditionally on a
+// branch switch / draft-create / local-merge fold, which meant switching drafts
+// mid-turn silently destroyed the work in flight. It merely LOOKED like a lost
+// place, because the transcript and the ACP sessionId are both persisted.
+//
+// What is asserted here, in the plan's own words:
+//   (a) the turn completes after the socket dies,
+//   (b) a re-attaching client receives each update EXACTLY ONCE, and
+//   (c) no orphaned bridge survives the TTL.
+// Plus the hazard the Addendum names explicitly: a permission request raised
+// while NOBODY is attached must fail closed, never read as consent.
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { ServerWebSocket } from 'bun';
+
+import { AcpBridge } from '../acp/bridge.ts';
+import { createAcp, DETACHED_TTL_MS, MAX_DETACHED_BRIDGES } from '../acp/index.ts';
+import type { Context } from '../context.ts';
+import type { WsData } from '../ws.ts';
+
+const FIXTURE_SLOW = join(import.meta.dir, 'fixtures', 'mock-acp-agent-slow.mjs');
+const FIXTURE_PERM = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission.mjs');
+const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
+
+function useMockAgent(fixture: string) {
+  process.env.MAUDE_ACP_ADAPTER_ENTRY = fixture;
+  process.env.MAUDE_ACP_RUNTIME = process.execPath;
+  process.env.MAUDE_CLAUDE_BIN = process.execPath;
+}
+
+const dirs: string[] = [];
+function freshCtx(): Context {
+  const root = mkdtempSync(join(tmpdir(), 'maude-acp-lifetime-'));
+  dirs.push(root);
+  mkdirSync(join(root, '.design', '_chat'), { recursive: true });
+  return {
+    paths: { repoRoot: root, designRoot: join(root, '.design'), designRel: '.design' },
+  } as unknown as Context;
+}
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+function fakeWs(id: string) {
+  const frames: Array<Record<string, unknown>> = [];
+  const ws = {
+    data: { id } as WsData,
+    send: (raw: string) => {
+      frames.push(JSON.parse(raw));
+    },
+  } as unknown as ServerWebSocket<WsData>;
+  return { ws, frames };
+}
+
+async function until<T>(fn: () => T | undefined, timeoutMs = 15000): Promise<T> {
+  const start = performance.now();
+  for (;;) {
+    const v = fn();
+    if (v !== undefined) return v;
+    if (performance.now() - start > timeoutMs) throw new Error('timeout waiting for condition');
+    await new Promise((r) => setTimeout(r, 20));
+  }
+}
+
+describe('bridge lifetime — a closed socket no longer kills the turn', () => {
+  test('the turn COMPLETES after the socket closes, and a re-attach gets every update exactly once', async () => {
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('life-a');
+    acp.onOpen(a.ws);
+    acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'go', chat: 'c1' }));
+
+    // Wait until the turn is genuinely streaming, then yank the socket — the
+    // exact shape of a `window.location.reload()` landing mid-turn.
+    const firstSeq = await until(() => {
+      const f = a.frames.find((x) => x.t === 'update' && typeof x.seq === 'number');
+      return f ? (f.seq as number) : undefined;
+    });
+    // `seq` is the transcript LINE, not an agent-update counter — the bootstrap
+    // brief, the plugin-autoload audit record and the user's own turn all
+    // occupy lines before the first agent chunk. That is deliberate: the client
+    // compares it against the line count the HTTP hydration covered, which
+    // counts those lines too. An "nth agent update" counter would not line up.
+    expect(firstSeq).toBeGreaterThan(0);
+    acp.onClose(a.ws);
+
+    // (a) The bridge SURVIVES the close. Under the old per-socket keying this
+    // was already 0 by now, and the agent was dead.
+    expect(acp.size()).toBe(1);
+
+    // The chat's own transcript keeps growing while nobody is attached — the
+    // durable record the re-attach replays from.
+    await until(async () => {
+      const { chatTranscriptSeq } = await import('../acp/transcript.ts');
+      return chatTranscriptSeq(ctx.paths.designRoot, 'c1') > firstSeq ? true : undefined;
+    });
+
+    // (b) Re-attach from the seq the client had already hydrated. Everything
+    // after it replays; nothing at or before it does.
+    const b = fakeWs('life-b');
+    acp.onOpen(b.ws);
+    acp.onMessage(b.ws, JSON.stringify({ t: 'attach', chat: 'c1', seq: firstSeq }));
+    await until(() => b.frames.find((f) => f.t === 'attached'));
+
+    // Let the turn finish so the replay + live tail are both complete.
+    await until(() => b.frames.find((f) => f.t === 'turn-end'), 20000);
+
+    const seqs = b.frames.filter((f) => f.t === 'update').map((f) => f.seq as number);
+    // EXACTLY ONCE: no duplicates …
+    expect(new Set(seqs).size).toBe(seqs.length);
+    // … and nothing the client already had (that's the whole point of the seam;
+    // without it, the replay and the live stream overlap and the user sees the
+    // last few seconds twice).
+    expect(seqs.every((s) => s > firstSeq)).toBe(true);
+    // … and no HOLE either: the seqs are contiguous from firstSeq+1.
+    expect(seqs).toEqual(seqs.map((_, i) => firstSeq + 1 + i));
+
+    acp.onClose(b.ws);
+    acp.stopAll();
+  }, 40000);
+
+  test('a DETACHED, idle bridge is reaped — no orphaned subprocess', async () => {
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const a = fakeWs('reap-a');
+    acp.onOpen(a.ws);
+    // `warm` establishes a bridge without starting a turn — the "abandoned"
+    // shape, as opposed to the "still working" one above.
+    acp.onMessage(a.ws, JSON.stringify({ t: 'warm', chat: 'c1' }));
+    await until(() => (acp.size() === 1 ? true : undefined));
+    acp.onClose(a.ws);
+    expect(acp.size()).toBe(1); // detached, not yet reaped
+
+    // The real TTL is minutes — assert the CONSTANT is sane rather than sleeping
+    // through it. The reap PATH itself is covered by stopAll() below and by the
+    // ceiling test, which exercises the same `reap()`.
+    expect(DETACHED_TTL_MS).toBeGreaterThan(0);
+    expect(DETACHED_TTL_MS).toBeLessThanOrEqual(15 * 60_000);
+
+    acp.stopAll();
+    expect(acp.size()).toBe(0);
+  }, 30000);
+
+  test('detached bridges are CAPPED — the least-recently-active is reaped', async () => {
+    // Detaching removed the natural reaper that socket-close used to be, so an
+    // unbounded set of detached bridges is a process leak (DDR-125 already books
+    // "N processes" as the cost of parallel chats). Idle ones are sacrificed
+    // first; a detached bridge with a live turn is what we are protecting.
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const sockets = [];
+    for (let i = 0; i <= MAX_DETACHED_BRIDGES; i++) {
+      const s = fakeWs(`cap-${i}`);
+      sockets.push(s);
+      acp.onOpen(s.ws);
+      acp.onMessage(s.ws, JSON.stringify({ t: 'warm', chat: `c${i}` }));
+    }
+    await until(() => (acp.size() === MAX_DETACHED_BRIDGES + 1 ? true : undefined));
+    for (const s of sockets) acp.onClose(s.ws);
+    expect(acp.size()).toBe(MAX_DETACHED_BRIDGES);
+
+    acp.stopAll();
+  }, 30000);
+
+  test('re-attaching CANCELS the reaper (a reload is not an abandonment)', async () => {
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const a = fakeWs('rearm-a');
+    acp.onOpen(a.ws);
+    acp.onMessage(a.ws, JSON.stringify({ t: 'warm', chat: 'c1' }));
+    await until(() => (acp.size() === 1 ? true : undefined));
+    acp.onClose(a.ws);
+    const b = fakeWs('rearm-b');
+    acp.onOpen(b.ws);
+    acp.onMessage(b.ws, JSON.stringify({ t: 'attach', chat: 'c1', seq: 0 }));
+    const attached = await until(() => b.frames.find((f) => f.t === 'attached'));
+    expect(attached.chat).toBe('c1');
+    // Same bridge, not a fresh one — the whole point of keying by chat.
+    expect(acp.size()).toBe(1);
+    acp.stopAll();
+  }, 30000);
+});
+
+describe('bridge lifetime — a detached bridge must never read as consent', () => {
+  test('a permission request raised with NO socket attached fails closed (deny)', async () => {
+    // The Addendum names this hazard explicitly: "A detached bridge is a live
+    // agent with no UI attached. Any requestPermission raised while nobody is
+    // watching must hit the existing timeout → fail-closed deny. 'No client
+    // attached' must never be a path to auto-approval — that would re-open,
+    // from a new direction, exactly what the write gate closes."
+    // Driven at the BRIDGE level with a short timeout override rather than
+    // through the manager: the real PERMISSION_TIMEOUT_MS is 120 s, and a test
+    // that actually sleeps through it would be a 2-minute test proving a
+    // constant. Detachment is modelled the way the manager models it — the
+    // request is raised and `broadcast` reaches nobody, i.e. no sink answers.
+    useMockAgent(FIXTURE_PERM);
+    const updates: Array<{ content?: { text?: string } }> = [];
+    const raised: string[] = [];
+    const bridge = new AcpBridge({
+      repoRoot: freshCtx().paths.repoRoot,
+      permissionTimeoutMs: 250,
+      onUpdate: (u) => updates.push(u as { content?: { text?: string } }),
+      // A DETACHED bridge still RAISES the request (the manager's `broadcast`
+      // is what silently drops it when `sinks` is empty) — it just never gets
+      // an answer. Nothing here calls resolvePermission.
+      onPermissionRequest: (id) => raised.push(id),
+    });
+    try {
+      await bridge.prompt('go', 'c1');
+      expect(raised).toHaveLength(1);
+      const text = updates.map((u) => u?.content?.text ?? '').join('');
+      expect(text).toContain('"outcome":"cancelled"');
+      expect(text).not.toContain('selected');
+    } finally {
+      await bridge.stop();
+    }
+  }, 30000);
+});
+
+describe('bridge lifetime — a socket may only address chats it is attached to', () => {
+  // SECURITY. Before bridges were re-keyed by chat, every control-frame lookup
+  // was `bridges.get(ws.data.id)` — a socket was STRUCTURALLY incapable of
+  // naming another socket's bridge. Re-keying moved the key into the FRAME, and
+  // the first cut resolved `chat` against the whole map, silently widening the
+  // surface so any socket could cancel another chat's turn or flip its config.
+  // The nonce ids make answering another chat's permission impractical to hit
+  // blind, but "you'd have to guess a UUID" is a weaker guarantee than "the
+  // frame cannot name that bridge at all" — and DDR-125 F1's posture is
+  // explicitly the latter. These tests pin the restored property.
+  test('a control frame naming ANOTHER chat is refused', async () => {
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('cross-a');
+    acp.onOpen(a.ws);
+    acp.onMessage(a.ws, JSON.stringify({ t: 'warm', chat: 'victim' }));
+    await until(() => (acp.size() === 1 ? true : undefined));
+
+    const b = fakeWs('cross-b');
+    acp.onOpen(b.ws);
+    acp.onMessage(b.ws, JSON.stringify({ t: 'warm', chat: 'attacker' }));
+    await until(() => (acp.size() === 2 ? true : undefined));
+
+    // Socket B names socket A's chat. Must be a no-op, not a cancel.
+    expect(() =>
+      acp.onMessage(b.ws, JSON.stringify({ t: 'cancel', chat: 'victim' }))
+    ).not.toThrow();
+    expect(() =>
+      acp.onMessage(
+        b.ws,
+        JSON.stringify({ t: 'permission-response', id: 'x', chat: 'victim', decision: 'allow' })
+      )
+    ).not.toThrow();
+    expect(() =>
+      acp.onMessage(
+        b.ws,
+        JSON.stringify({ t: 'set-mode', chat: 'victim', modeId: 'bypassPermissions' })
+      )
+    ).not.toThrow();
+
+    // Both bridges still alive — nothing was cancelled or torn down.
+    expect(acp.size()).toBe(2);
+    acp.stopAll();
+  }, 30000);
+
+  test('a socket CAN address its own chat by name', async () => {
+    // The restriction must not break the normal path — the client echoes `chat`
+    // back on every response frame.
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const a = fakeWs('own-a');
+    acp.onOpen(a.ws);
+    acp.onMessage(a.ws, JSON.stringify({ t: 'warm', chat: 'mine' }));
+    await until(() => (acp.size() === 1 ? true : undefined));
+    expect(() => acp.onMessage(a.ws, JSON.stringify({ t: 'cancel', chat: 'mine' }))).not.toThrow();
+    expect(acp.size()).toBe(1);
+    acp.stopAll();
+  }, 30000);
+});
+
+describe('bridge lifetime — the attach seq is client-supplied and must be bounded', () => {
+  test('hostile seq values (negative, NaN, Infinity, fractional, huge) never throw or over-read', async () => {
+    // `frame.seq` flows into readChatLinesAfter. It is floored, clamped at 0,
+    // and the read is capped — but the values are attacker-chosen, so pin it.
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const a = fakeWs('seq-a');
+    acp.onOpen(a.ws);
+    for (const seq of [-1, -1e9, Number.NaN, Number.POSITIVE_INFINITY, 3.7, 1e15, '5', null]) {
+      expect(() =>
+        acp.onMessage(a.ws, JSON.stringify({ t: 'attach', chat: 'c1', seq }))
+      ).not.toThrow();
+    }
+    // Every attach still answered — degraded to seq 0, never wedged.
+    expect(a.frames.filter((f) => f.t === 'attached').length).toBe(8);
+    // A chat with no transcript replays nothing regardless of the seq claimed.
+    expect(a.frames.filter((f) => f.t === 'update')).toHaveLength(0);
+    acp.stopAll();
+  }, 30000);
+
+  test('a traversal-shaped chat id cannot reach another file', async () => {
+    // chatId is sanitized to [a-z0-9_-] before it reaches the transcript path.
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+    const a = fakeWs('seq-b');
+    acp.onOpen(a.ws);
+    expect(() =>
+      acp.onMessage(a.ws, JSON.stringify({ t: 'attach', chat: '../../../etc/passwd', seq: 0 }))
+    ).not.toThrow();
+    const attached = a.frames.find((f) => f.t === 'attached');
+    expect(attached?.chat).not.toContain('/');
+    expect(attached?.chat).not.toContain('.');
+    acp.stopAll();
+  }, 30000);
+});
+
+describe('set-mode is attachment-scoped too (ethical-hacker A2)', () => {
+  test('a socket CANNOT flip another chat into bypassPermissions', async () => {
+    // A2 was the one control frame that escaped the attachment-scoping sweep,
+    // and the highest-value one to miss: `bypassPermissions` is an advertised
+    // mode and short-circuits ADAPTER-side, so `requestPermission` — and with it
+    // the entire write gate — never runs. A raw `bridges.get(chat)` let any
+    // main-origin socket switch the gate off for a chat it was never attached
+    // to, including a DETACHED one with a live turn and nobody watching.
+    useMockAgent(FIXTURE_SLOW);
+    const ctx = freshCtx();
+    const acp = createAcp(ctx);
+
+    const victim = fakeWs('mode-victim');
+    acp.onOpen(victim.ws);
+    acp.onMessage(victim.ws, JSON.stringify({ t: 'warm', chat: 'victim' }));
+    await until(() => (acp.size() === 1 ? true : undefined));
+
+    const attacker = fakeWs('mode-attacker');
+    acp.onOpen(attacker.ws);
+    acp.onMessage(attacker.ws, JSON.stringify({ t: 'warm', chat: 'attacker' }));
+    await until(() => (acp.size() === 2 ? true : undefined));
+
+    expect(() =>
+      acp.onMessage(
+        attacker.ws,
+        JSON.stringify({ t: 'set-mode', chat: 'victim', modeId: 'bypassPermissions' })
+      )
+    ).not.toThrow();
+    // Both bridges intact and the frame was a no-op — the mode change never
+    // reached a bridge this socket isn't attached to.
+    expect(acp.size()).toBe(2);
+    acp.stopAll();
+  }, 30000);
+});

package/apps/studio/test/acp-caps-bridge.test.ts

@@ -267,6 +267,11 @@ describe('Acp manager — set-mode/set-config frames validate against last-adver
       );
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
       await rm(designRoot, { recursive: true, force: true });
     }

package/apps/studio/test/acp-commands.test.ts

@@ -106,6 +106,11 @@ describe('Acp manager — warm frame broadcasts + open replays commands', () =>
       acp.onClose(b.ws);
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       // give teardown a tick to kill the subprocess
       await new Promise((r) => setTimeout(r, 50));
       await rm(designRoot, { recursive: true, force: true });

package/apps/studio/test/acp-elicitation-bridge.test.ts

@@ -365,6 +365,11 @@ describe('Acp manager — elicitation-request/-response frames', () => {
       expect(settledFrame.id).toBe(reqFrame.id);
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
     }
   }, 20000);

package/apps/studio/test/acp-permission-prompt.test.ts

@@ -6,8 +6,15 @@
 // visually-primary button resolves to — a seam no backend test could see.
 
 import { describe, expect, test } from 'bun:test';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
 
-import { pickDefaultAllow, pickDefaultReject } from '../client/panels/PermissionPrompt.jsx';
+import PermissionPrompt, {
+  describeOutOfProject,
+  pickDefaultAllow,
+  pickDefaultReject,
+  sanitizePathForDisplay,
+} from '../client/panels/PermissionPrompt.jsx';
 
 describe('pickDefaultAllow', () => {
   test('prefers allow_once over allow_always, regardless of array order', () => {
@@ -75,3 +82,170 @@ describe('pickDefaultReject', () => {
     expect(pickDefaultReject(null)).toBeNull();
   });
 });
+
+// feature-acp-write-path-scope Task 4 — the out-of-project WRITE card.
+//
+// Same reasoning as the pickDefaultAllow suite above: the affordance IS the
+// security control. A card that renders the model's own path string, or that
+// still offers an "always allow", is a speed bump rather than a gate — and
+// neither failure is visible to any bridge-side test.
+const OUT_OF_PROJECT = {
+  outOfProjectWrite: true,
+  resolvedPaths: ['/Users/x/.zshenv'],
+  scopeRoot: '/Users/x/git/project',
+  reason: 'outside',
+};
+
+describe('describeOutOfProject', () => {
+  test('absent scope → null (an ordinary permission card is unchanged)', () => {
+    expect(describeOutOfProject(undefined)).toBeNull();
+    expect(describeOutOfProject(null)).toBeNull();
+    // A scope object that isn't explicitly flagged must NOT trigger the copy —
+    // the discriminator is checked, not merely the object's presence.
+    expect(describeOutOfProject({ resolvedPaths: ['/etc/passwd'] })).toBeNull();
+  });
+
+  test('carries the resolved paths + root verbatim', () => {
+    const d = describeOutOfProject(OUT_OF_PROJECT);
+    expect(d?.paths).toEqual(['/Users/x/.zshenv']);
+    expect(d?.scopeRoot).toBe('/Users/x/git/project');
+    expect(d?.lead).toContain('outside this project');
+  });
+
+  test('plural lead for a multi-target write', () => {
+    const d = describeOutOfProject({ ...OUT_OF_PROJECT, resolvedPaths: ['/a', '/b'] });
+    expect(d?.lead).toContain('files outside this project');
+  });
+
+  test('the fail-closed reasons get their own honest copy, not "outside"', () => {
+    // `no-target` and `disagreement` are NOT "the file is outside the project" —
+    // saying so would be a claim the server never made. They are "we could not
+    // tell what will be written", which is a different thing to ask a human about.
+    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'no-target' })?.lead).toContain(
+      'did not say which one'
+    );
+    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'disagreement' })?.lead).toContain(
+      'two different files'
+    );
+  });
+
+  test('tolerates a malformed resolvedPaths — never throws', () => {
+    expect(describeOutOfProject({ outOfProjectWrite: true })?.paths).toEqual([]);
+    expect(
+      describeOutOfProject({ outOfProjectWrite: true, resolvedPaths: [null, '', '/ok'] })?.paths
+    ).toEqual(['/ok']);
+  });
+});
+
+describe('PermissionPrompt — render', () => {
+  const OPTIONS = [
+    { optionId: 'allow_always', kind: 'allow_always', name: 'Always Allow' },
+    { optionId: 'allow', kind: 'allow_once', name: 'Allow' },
+    { optionId: 'reject', kind: 'reject_once', name: 'Reject' },
+  ];
+  const render = (request) =>
+    renderToStaticMarkup(createElement(PermissionPrompt, { request, onRespond: () => {} }));
+
+  test('an ORDINARY request renders the generic copy and every offered option', () => {
+    const out = render({ id: '1', toolCall: { title: 'Run command' }, options: OPTIONS });
+    expect(out).toContain('Claude wants permission to continue');
+    expect(out).not.toContain('chat-perm-outside');
+    expect(out).toContain('Always Allow');
+  });
+
+  test('an OUT-OF-PROJECT write renders the RESOLVED path, never the model string', () => {
+    const out = render({
+      id: '1',
+      // `rawInput.file_path` is the model-authored string. It reads like a docs
+      // edit; only the resolution tells the truth, so the card must show the
+      // latter. Same lesson as the deep-link modal's truncated project name.
+      toolCall: {
+        title: 'Write docs/../../../.zshenv',
+        rawInput: { file_path: 'docs/../../../.zshenv' },
+      },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).toContain('/Users/x/.zshenv');
+    expect(out).not.toContain('docs/../../../.zshenv');
+    expect(out).toContain('outside this project');
+    expect(out).toContain('/Users/x/git/project');
+  });
+
+  test('DECISION D — the out-of-project card offers NO "always" option', () => {
+    const out = render({
+      id: '1',
+      toolCall: { title: 'Write' },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).not.toContain('Always Allow');
+    expect(out).toContain('Allow');
+    expect(out).toContain('Reject');
+    expect(out).toContain('for this request only');
+  });
+
+  test('the out-of-project card is distinguishable, not just differently worded', () => {
+    // A card that LOOKS identical to the routine one gets clicked through at the
+    // same rate, which is the whole prompt-fatigue failure mode.
+    const out = render({
+      id: '1',
+      toolCall: { title: 'Write' },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).toContain('chat-perm--outside');
+    expect(out).toContain('file outside this project'); // aria-label
+  });
+});
+
+// SECURITY (security-auditor F3) — the resolved path's non-existent tail is
+// whatever the model asked to create, so it is attacker-influenced text in the
+// one card whose entire job is to be read accurately. React escapes markup; it
+// does NOT neutralize bidi overrides, so a path can be made to READ as harmless
+// while resolving somewhere else. Written as \u escapes on purpose: a literal
+// override in this source would reorder the test file itself in every editor.
+const RLO = '\u202E';
+const PDF = '\u202C';
+
+describe('sanitizePathForDisplay (F3)', () => {
+  test('neutralizes bidi overrides — the visual-spoofing primitive', () => {
+    const out = sanitizePathForDisplay(`/Users/x/safe/${RLO}gnp.esriv${PDF}`);
+    expect(out).not.toContain(RLO);
+    expect(out).not.toContain(PDF);
+    // Replaced, not deleted — a tampered path should look ODD, not just shorter.
+    expect(out).toContain('\uFFFD');
+  });
+
+  test('neutralizes C0 controls (newline/CR can hide a whole path segment)', () => {
+    const out = sanitizePathForDisplay('/Users/x/a\nb\rc');
+    expect(out).not.toMatch(/[\n\r]/);
+  });
+
+  test('also covers zero-width, directional marks and soft hyphen (F3 nit)', () => {
+    // Zero-width joiners and directional marks are invisible, so they can split
+    // or re-order a path name without leaving any visible trace at all — the
+    // same class of trick as the overrides, just quieter.
+    const sneaky = '/Users/x/\u200Bzsh\u200Cenv\u061C\u00AD';
+    const out = sanitizePathForDisplay(sneaky);
+    for (const ch of ['\u200B', '\u200C', '\u061C', '\u00AD']) {
+      expect(out).not.toContain(ch);
+    }
+  });
+
+  test('leaves an ordinary path completely untouched', () => {
+    const p = '/Users/x/git/project/.design/ui/home.tsx';
+    expect(sanitizePathForDisplay(p)).toBe(p);
+  });
+
+  test('describeOutOfProject sanitizes BOTH the paths and the scope root', () => {
+    const d = describeOutOfProject({
+      outOfProjectWrite: true,
+      reason: 'outside',
+      resolvedPaths: [`/Users/x/${RLO}evil`],
+      scopeRoot: `/Users/x/${RLO}root`,
+    });
+    expect(d.paths[0]).not.toContain(RLO);
+    expect(d.scopeRoot).not.toContain(RLO);
+  });
+});

package/apps/studio/test/acp-permission.test.ts

@@ -75,7 +75,14 @@ describe('AcpBridge — permission approve/deny (Task B1)', () => {
       const promptPromise = bridge.prompt('hi', 'c1');
       const req = await until(() => (requests.length ? requests[0] : undefined));
       expect(req.toolCallTitle).toBe('Write file');
-      expect(req.optionIds).toEqual(['allow-once', 'allow-always', 'reject-once']);
+      // `allow-always` is ABSENT, and that is the point (feature-acp-write-path-
+      // scope Decision D + security-auditor F2). This fixture's tool call is
+      // `kind:'edit'` targeting `/tmp/x` — a write-shaped call landing OUTSIDE
+      // the bridge's project root — so the bridge strips every `allow_always`
+      // option before offering it, and validates any response against that same
+      // filtered set. Consent for an out-of-project write is per-call; one click
+      // must not be able to install a session-wide standing rule.
+      expect(req.optionIds).toEqual(['allow-once', 'reject-once']);
       expect(transparency.length).toBe(1); // transparency fires unconditionally too
 
       bridge.resolvePermission(req.id, 'allow-once');
@@ -191,7 +198,11 @@ describe('Acp manager — permission-request/-response frames (Task B2)', () =>
       const reqFrame = await until(() => a.frames.find((f) => f.t === 'permission-request'));
       expect(reqFrame.toolCall).toMatchObject({ title: 'Write file' });
       const options = reqFrame.options as Array<{ optionId: string }>;
-      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'allow-always', 'reject-once']);
+      // See the Task B1 test above — `allow-always` is stripped for this
+      // out-of-project write-shaped call, and the FRAME carries the filtered
+      // set, so the client is shown the real options rather than a cosmetic
+      // subset the server would then reject.
+      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'reject-once']);
 
       acp.onMessage(
         a.ws,
@@ -200,6 +211,11 @@ describe('Acp manager — permission-request/-response frames (Task B2)', () =>
       await until(() => a.frames.find((f) => f.t === 'turn-end'));
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
     }
   }, 20000);